IDA Delphi strings recognition [Archive] - RCE Messageboard's Regroupment

_Servil_

January 25th, 2003, 15:13

Hello,

I'd like to setup IDA to handle better Delphi strings. The analysis mostly produces similar just chunk of numbers like this

Code:

CODE:005E617C     dd 0FFFFFFFFh, 1Eh

CODE:005E6184 dword_5E6184 dd 61647055h, 676E6974h, 65687420h, 64656D20h, 68206169h, 66207361h, 656C6961h

CODE:005E6184                                ; DATA XREF: sub_5E5DB4+1EBo

CODE:005E6184     dd 2E64h, 0FFFFFFFFh, 0Bh

CODE:005E61AC dword_5E61AC dd 436E7442h, 69746E6Fh, 65756Eh, 0FFFFFFFFh, 10h

CODE:005E61AC                                ; DATA XREF: sub_5E5DB4+226o

CODE:005E61C0 dword_5E61C0 dd 706F4354h, 73694D79h, 676E6973h, 6D726F46h, 0, 0FFFFFFFFh, 8

CODE:005E61C0                                ; DATA XREF: sub_5E5DB4+22Bo

CODE:005E61C0                                ; sub_5E5DB4+24Bo

CODE:005E61DC byte_5E61DC db 42h, 74h, 6Eh   ; DATA XREF: sub_5E5DB4+246o

CODE:005E61DF unknown_libname_1391 dd 726F6241h, 74h, 0FFFFFF00h

CODE:005E61EB     dd 2FFh

CODE:005E61EF     align 4

CODE:005E61F0 dword_5E61F0 dd 220Dh, 0FFFFFFFFh, 1

CODE:005E61F0                                ; DATA XREF: sub_5E5DB4+28Eo

CODE:005E61FC dword_5E61FC dd 22h            ; DATA XREF: sub_5E5DB4+299o

After I undefinde the block and parse strings manually, the disassembly looks better so I can see all strings like text:

Code:

CODE:005E617A     align 4

CODE:005E617C     dd 0FFFFFFFFh

CODE:005E6180 aUpdatingTheMedi dd 30         ; DATA XREF: sub_5E5DB4+1EBo

CODE:005E6180     db 'Updating the media has failed.',0

CODE:005E61A3     align 4

CODE:005E61A4     dd 0FFFFFFFFh

CODE:005E61A8 aBtncontinue dd 11             ; DATA XREF: sub_5E5DB4+226o

CODE:005E61A8     db 'BtnContinue',0

CODE:005E61B8     dd 0FFFFFFFFh

CODE:005E61BC aTcopymissingfor dd 16         ; DATA XREF: sub_5E5DB4+22Bo

CODE:005E61BC                                ; sub_5E5DB4+24Bo

CODE:005E61BC     db 'TCopyMissingForm',0

CODE:005E61D1     db    0 ;

CODE:005E61D2     align 4

CODE:005E61D4     dd 0FFFFFFFFh

CODE:005E61D8 aBtnabort dd 8                 ; DATA XREF: sub_5E5DB4+246o

CODE:005E61D8     db 'BtnAbort',0

CODE:005E61E5     align 4

CODE:005E61E8     dd 0FFFFFFFFh

CODE:005E61EC     dd 2                       ; DATA XREF: sub_5E5DB4+28Eo

CODE:005E61EC     db 0Dh,'"',0

CODE:005E61F3     align 4

CODE:005E61F4     dd 0FFFFFFFFh

CODE:005E61F8     dd 1                       ; DATA XREF: sub_5E5DB4+299o

CODE:005E61F8     db '"',0

CODE:005E61FE     align 4

I select Delphi as the compiler and string types to Delphi. Most strings are even referred in code, thogh IDA doesn't recognize. It looks quite silly -- perhaps ida's bad setting?, Does it always handle D-strings so badly? (MSVC or assembler's strings are handled much better).

tia.