find /h 0x564d2f0d0000, 0x564d2f0d4000, 0xffff find 0x7eff36311000,0x7eff3652d000 ,{char[3]}"sh"
b = bytes h = halfwords (2 bytes) w = words (4 bytes) g = giant words (8 bytes)