Search in a process address space (memory) or in the process' executable?