8

How can I clean up/simplify strings that are built at runtime?

I've seen this a couple of times and figured that there has to be something easier. I've been manually converting the characters to try and interpret what strings are being formed.

.text:0040166E C6 45 F0 5C   mov     [ebp+pszSubKey+2Ch], '\'
.text:00401672 C6 45 F1 57   mov     [ebp+pszSubKey+2Dh], 'W'
.text:00401676 C6 45 F2 69   mov     [ebp+pszSubKey+2Eh], 'i'
.text:0040167A C6 45 F3 6E   mov     [ebp+pszSubKey+2Fh], 'n'
.text:0040167E C6 45 F4 6C   mov     [ebp+pszSubKey+30h], 'l'
.text:00401682 C6 45 F5 6F   mov     [ebp+pszSubKey+31h], 6Fh
.text:00401686 C6 45 F6 67   mov     [ebp+pszSubKey+32h], 67h
.text:0040168A C6 45 F7 6F   mov     [ebp+pszSubKey+33h], 6Fh
.text:0040168E C6 45 F8 6E   mov     [ebp+pszSubKey+34h], 6Eh
.text:00401692 C6 45 F9 5C   mov     [ebp+pszSubKey+35h], 5Ch
Improve this question
3
  • Can't you just put a breakpoint after the string builder function ?
    – jvoisin
    Commented Oct 29, 2013 at 17:09
  • I could set a breakpoints but I am trying to simplify it for all occurrences not just the one time.
    – phoenix89
    Commented Oct 30, 2013 at 7:02
  • 1
    The "hackish" way could be to break after all strings are built, and to run the "strings" command on the memomy dump.
    – jvoisin
    Commented Oct 30, 2013 at 13:10

3 Answers 3

Reset to default
7

Finding Byte Strings using IDAPython

ASERT MindshaRE solves this right. No need to actually run the code which isn't always possible.

Effectively this script will go through instruction by instruction to find moves of ASCII characters into a memory location. It gets fancy and used QT to create an interactive table however you can gut out that part and just have it place a comment at the instruction that gets used.

Improve this answer
3
  • Script looks neat, but it fails on x64 apparently. Will try to patch :)
    – Konrads
    Commented Feb 16, 2015 at 16:46
  • 1
    Yeah, the one thing I noticed about the script is it relied heavily on strings being equivalent. (it is looking for "mov" and "[e") So it will definitely only work on x86. I reimplemented it for different architectures but have misplaced it.
    – jbh
    Commented Feb 17, 2015 at 3:59
  • I started patching it - making it work with x64 was a matter of changing [e to [(e|r) however it then makes an assumption that the 1st mov will be mov [rsp],'x' whereas in my case it is mov [rsp+138h+var_118], 'x'. Back to patching...
    – Konrads
    Commented Feb 17, 2015 at 17:11
4

The one that worked for me eventually was "stackstrings" plugin from FireEye/Mandiant FLARE (based on this module)

Improve this answer
3

You could use ida-x86emu to emulate the dynamic construction of the string.

But if you want something more automated then you'd need to write an IDA script or plugin.

Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.