2

I'm trying to write some scripts that do some string searching through the disassembly in IDA. Currently, I loop through all the disassembly, MinEA() to MaxEA() and use idc.FindText() to see if a potential string is in the disassembly. Although this works, its very time consuming. I was wondering if there was a way I could just use an API method to get all the strings in IDAs string window. For example, I was able to get all the imports used in the import window by using idaapi.get_import_module_qty() and idaapi.enum_import_names(i, import_call_back). That's very fast and I can easily just check if something has been imported. Is there something similar that will allow me to get all the strings from the strings window? If not, is there a less time-consuming method of string searching that is possible? Thanks for any input.

4

It looks like that the following is what you are looking for or at least similar:

import idautils
sc = idautils.Strings()

for s in sc:
    print "%x: len=%d type=%d -> '%s'" % (s.ea, s.length, s.type, str(s))

Tested and works in IDA 6.8, 64 bit. The details about the class Strings in idautils module are here: https://www.hex-rays.com/products/ida/support/idapython_docs/idautils.Strings-class.html

1

another variation to get all the strings

import idaapi as ia
sc = ia.string_info_t()
for i in range(0,ia.get_strlist_qty()):
    ia.get_strlist_item(i,sc)
    print ia.get_ascii_contents(sc.ea,sc.length,sc.type)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.