String Searcher Extension

[Washi1337]

Problem

General-purpose disassemblers like Ghidra and IDA include cross-referencing for strings found in a binary. dnSpy, however, lacks this feature, which can make it awkward to use for tasks such as malware analysis where string literals frequently serve as indicators of compromise (IoC). Furthermore, strings are also useful for identifying obfuscators and in general for quickly locating and navigating related parts of a program.

Solution

This PR proposes a new string searcher extension that can enumerate string literals found in all method bodies of a selected module:

The strings are displayed in a new searchable and sortable pane which can be used to navigate around in the module easily:

output.mp4

Considered Alternatives

The existing search pane (activated by Ctrl+Shift+K) can also search for string literals, but this A) only displays the member it was referenced in and doesn't include the full string, and B) assumes you know the string you want to look for beforehand, making it not very useful for the scenarios described in the above.

[ElektroKill]

Aside from the comments regarding the code, I think it would be nice to have an option to display the strings view from the Edit/View toolbar menus, since that's how dnSpy tool windows are summoned.

I also think it would be a good addition to include strings that can be found in custom attributes, field constants, etc., in the string view.

Additional options when it comes to filtering, like case-insensitive compare or matching by whole words.

Let me know if you would be willing to add this as part of your PR, or if it's something I should add myself.

[Washi1337]

Aside from the comments regarding the code, I think it would be nice to have an option to display the strings view from the Edit/View toolbar menus, since that's how dnSpy tool windows are summoned.

Added:

I also think it would be a good addition to include strings that can be found in custom attributes, field constants, etc., in the string view.

Added both CA and Constant metadata provider to the search. I also added a Kind column to differentiate between the types of xrefs, plus some icons and richer "Referrer" column rendering:

Note on the implementation of this: I added FormatterOptions.ShowFieldTypes so that I can remove field types from the "Referrer" column cells for better clarity.

Additional options when it comes to filtering, like case-insensitive compare or matching by whole words.

Let me know if you would be willing to add this as part of your PR, or if it's something I should add myself.

I could add it, though the PR is already getting pretty big. Up to you.

[Washi1337]

Additional options when it comes to filtering, like case-insensitive compare or matching by whole words.

Added some basic options in an expandable menu similar to the original search pane:

Search should now also respect the "Show compiler generated / hidden members" option.

[ElektroKill]

Other than a few minor touchups and the license header in each file, LGTM!

[ElektroKill]

LGTM!

Thanks for the contribution.