Aelorean
May 15th, 2006, 02:17
So, I was disappointed to find out that in IDA 4.9 the 'strings' window of IDA still did not output 'unicode' strings. So, I thought I'd try to help myself and write my own plugin.
However, even the example given in the guide that I read still didn't produce the unicode strings that I was seeing. For example, I see this type of thing in my IDA View-A:
(Note: There are a LOT of these type unicode strings.)
..but, when I ran the plugin that I created, I got this as a result:
Any help?
Here is the plugin I was using:
Thanks!!!
However, even the example given in the guide that I read still didn't produce the unicode strings that I was seeing. For example, I see this type of thing in my IDA View-A:
Code:
.rdata:10B5C110 aIssuedByS:
.rdata:10B5C110 unicode 0, <Issued by: %s >,0
(Note: There are a LOT of these type unicode strings.)
..but, when I ran the plugin that I created, I got this as a result:
Code:
Total Strings: 2706
Finished.
Any help?
Here is the plugin I was using:
Code:
msg("Total Strings: %d\n", get_strlist_qty());
for (int i = 0; i < get_strlist_qty(); i++)
{
char string[MAXSTR];
string_info_t si;
//Get the string item
get_strlist_item(i, &si);
if (si.length < sizeof(string))
{
get_many_bytes(si.ea, string, si.length);
if (si.type == 3) // unicode
msg("String: %d: %S\n", i, string);
}
}
msg("Finished.";
return;
Thanks!!!