0

So I'm seeing this a lot in an IDA database:

; wchar_t off_BADF00D
off_BADF00D     dd offset loc_6F0062
                dd offset loc_740074
                dd offset loc_6D006E+1
                align 10h

So given the comment at the top IDA knows from the code reference that this ought to be a zero-terminated wide character string.

I was thinking of writing a simple IDAPython script to find instances of this and force these items to be converted to the appropriate data type automatically.

However, neither ; nor : showed anything, so this is neither a repeatable nor a normal comment. So what is it and how can I use IDAPython to extract it? I also tried (prompted by a comment here) if it's an anterior or posterior comment line. It wasn't.

Alternatively I'll also be happy if someone can point out how to "guide" IDA to do the right thing without scripting, but this sparked my curiosity, so only bonus points for that. I'd still like to find out how to get the comment shown.

Improve this question
4
  • It could be a "line above" comment. The other types – once : and repeated ; – appear at the end of the first line of code or data.
    – Jongware
    Dec 19, 2017 at 20:48
  • Thanks, good idea. However, they're not anterior or posterior lines either. Will edit my question accordingly.
    – 0xC0000022L ♦
    Dec 19, 2017 at 20:56
  • Could it be some form of declaration? A function declaration appears like this above its first line. But this is not a function, so ... some other type?
    – Jongware
    Dec 19, 2017 at 21:26
  • Here is a thought: you can find out what IDA internally calls this if you select this part of the code and dump it as an IDC file (or at least, I think that's the one with all the commands listed).
    – Jongware
    Dec 20, 2017 at 18:51

1 Answer 1

Reset to default
1

Can't tell about python, but in IDC you can partially get that 'comment' via GetType(ea). I say partially because it gives wchar_t[67] as result for comment like ; wchar_t aHttpSchemas_27[67].

Improve this answer
1
  • Awesome, exactly what I'm looking for in that case. And yes, the type is more interesting to me than the variable name IDA gave it.
    – 0xC0000022L ♦
    Dec 22, 2017 at 19:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.