7

Sometimes strings are dynamically constructed in programs due to compiler optimization or simply to hide the strings (e.g. in malware). For example :

enter image description here

When displaying the bytes as chars we can see the string 'INVALID FILE SIZE'.

enter image description here

Does anyone know a script to extract those strings in IDA? I will write one if it does not exist but I figured I would ask first.

perror
  • 19,083
  • 29
  • 87
  • 150
ekse
  • 2,208
  • 13
  • 19
  • Sorry for the duplicate question, my google skills failed me this time. Thanks for the answers, the script ASERT does exactly what I was looking for. – ekse Jan 27 '14 at 20:51

2 Answers2

4

Select the block of code you would like to convert and then run the following IDAPython function. Comment out the call to MakeComm if you don't want a comment added.

def convert_to_char():
    current = SelStart()
    end = SelEnd()
    tmp = ''
    while current < end:
        OpChr(current,1)
        try:
            tmp += chr(GetOperandValue(current, 1))
        except:
            tmp += '_'
        current = NextHead(current)
    MakeComm(PrevHead(current), tmp)

Adding some logic to verify the operand might be useful if other instruction are also in the selected region.

alexanderh
  • 1,062
  • 8
  • 14
3

Finding Byte Strings Using IDAPython

This is exactly what you were looking for from Assert MindshaRE Effectively this script will go through instruction by instruction to find moves of ASCII characters into a memory location. It gets fancy and used QT to create an interactive table however you can gut out that part and just have it place a comment at the instruction that gets used.

jbh
  • 516
  • 3
  • 7