Displaying Unicode Strings with IDA [Archive] - RCE Messageboard's Regroupment

Aelorean

May 15th, 2006, 02:17

So, I was disappointed to find out that in IDA 4.9 the 'strings' window of IDA still did not output 'unicode' strings. So, I thought I'd try to help myself and write my own plugin.

However, even the example given in the guide that I read still didn't produce the unicode strings that I was seeing. For example, I see this type of thing in my IDA View-A:

Code:



.rdata:10B5C110 aIssuedByS:                    

.rdata:10B5C110                 unicode 0, <Issued by: %s >,0

(Note: There are a LOT of these type unicode strings.)

..but, when I ran the plugin that I created, I got this as a result:

Code:



Total Strings: 2706

Finished.

Any help?

Here is the plugin I was using:

Code:



	msg("Total Strings: %d\n", get_strlist_qty());



	for (int i = 0; i < get_strlist_qty(); i++)

	{

		char string[MAXSTR];

		string_info_t si;



		//Get the string item

		get_strlist_item(i, &si);

		if (si.length < sizeof(string))

		{

			get_many_bytes(si.ea, string, si.length);

			if (si.type == 3)	  // unicode

				msg("String: %d: %S\n", i, string);

		}

	}



	msg("Finished.";

	return;

Thanks!!!

Aimless

May 17th, 2006, 02:30

1. You can display strings window, select settings, and ask it to include the unicode strings. You need to understand IDA better in that case.

2. You CANNOT do that in the warezed copy of IDA 4.9 floating around. It is broken. I cannot help you in that case. Maybe you need to move to the IDA 4.8 version (warezed or not)

Have Phun