2

There are hundreds unicode strings in rdata's binary, but IDA doesn't define them properly, so I have to specify each Unicode string offset manually (Alt+A -> Unicode). After doing so, string is rendered properly.

I'm wondering, whether there are some scripts here, since I've googled too much, and changed any possible settings and defaults to Unicode, but still no results.

2
  • What version of IDA are you using?
    – tambre
    Jul 14 '17 at 18:00
  • I use IDA 6.8 + HexRays plugin
    – yudjin
    Jul 16 '17 at 8:23
0

I've found solution http://www.openrce.org/forums/posts/771

There is only 1 "but" - it works with undefined strings only. That's why changing settings didn't help me in existing project - unicode strings were defined somehow as a data.

So I've opened binary from scratch, with "Create offset if data xref to seg32 exists" disabled, and IDA recognized all unicode strings.

I dumped all UNICODE strings addresses (begin-end) from newly recognized project, using IDAPython magics. And then used them in existing project: take an address range, undefine it, define as data (with UNICODE), define a string.

Worked like a charm.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.