0

As part of exercise in RE I noticed that some string is not appear correctly in the code.

I have the following code:
enter image description here

In the orange colour the string doesn't appear correctly.
In the red it appear correctly.

I want that the code in the orange will be like the one in the red.

We can see that in address 0x10751 we have:

push offset word_107DE ; SourceString

At the address of word_107DE (0x107DE) the string appears as:

word_107DE dw '\'
aDosedevicesPr_0:
    unicode 0, <DosDevices\ProceHelper>, 0

In 0x107DE we have an extra row:

word_107DE dw '\'  

How can I fix it and merge this row to be like this:

aDosedevicesPr_0:
    unicode 0, <\DosDevices\ProceHelper>, 0

And after this I hope to see the name of the string in the code.

1 Answer 1

2

Move the cursor to word_107DE, press ALTA (or Options/Ascii String style from the menu), and click the Unicode button.

1
  • Btw, how can I make IDA to print it as a comment? I thought it will be automatically once I did your solution.
    – E235
    Commented Dec 23, 2016 at 17:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.