PDA

View Full Version : Displaying Unicode Strings with IDA


Aelorean
May 15th, 2006, 02:17
So, I was disappointed to find out that in IDA 4.9 the 'strings' window of IDA still did not output 'unicode' strings. So, I thought I'd try to help myself and write my own plugin.

However, even the example given in the guide that I read still didn't produce the unicode strings that I was seeing. For example, I see this type of thing in my IDA View-A:
Code:

.rdata:10B5C110 aIssuedByS:
.rdata:10B5C110 unicode 0, <Issued by: %s >,0

(Note: There are a LOT of these type unicode strings.)

..but, when I ran the plugin that I created, I got this as a result:
Code:

Total Strings: 2706
Finished.



Any help?

Here is the plugin I was using:
Code:

msg("Total Strings: %d\n", get_strlist_qty());

for (int i = 0; i < get_strlist_qty(); i++)
{
char string[MAXSTR];
string_info_t si;

//Get the string item
get_strlist_item(i, &si);
if (si.length < sizeof(string))
{
get_many_bytes(si.ea, string, si.length);
if (si.type == 3) // unicode
msg("String: %d: %S\n", i, string);
}
}

msg("Finished.";
return;


Thanks!!!

LOUZEW
May 16th, 2006, 14:31
Why do not simply use the option menu/ ASCII strings Style/Unicode ? ?

Aimless
May 17th, 2006, 02:30
1. You can display strings window, select settings, and ask it to include the unicode strings. You need to understand IDA better in that case.

2. You CANNOT do that in the warezed copy of IDA 4.9 floating around. It is broken. I cannot help you in that case. Maybe you need to move to the IDA 4.8 version (warezed or not)



Have Phun