0

So I'm seeing this a lot in an IDA database:

; wchar_t off_BADF00D
off_BADF00D     dd offset loc_6F0062
                dd offset loc_740074
                dd offset loc_6D006E+1
                align 10h

So given the comment at the top IDA knows from the code reference that this ought to be a zero-terminated wide character string.

I was thinking of writing a simple IDAPython script to find instances of this and force these items to be converted to the appropriate data type automatically.

However, neither ; nor : showed anything, so this is neither a repeatable nor a normal comment. So what is it and how can I use IDAPython to extract it? I also tried (prompted by a comment here) if it's an anterior or posterior comment line. It wasn't.

Alternatively I'll also be happy if someone can point out how to "guide" IDA to do the right thing without scripting, but this sparked my curiosity, so only bonus points for that. I'd still like to find out how to get the comment shown.

  • It could be a "line above" comment. The other types – once : and repeated ; – appear at the end of the first line of code or data. – usr2564301 Dec 19 '17 at 20:48
  • Thanks, good idea. However, they're not anterior or posterior lines either. Will edit my question accordingly. – 0xC0000022L Dec 19 '17 at 20:56
  • Could it be some form of declaration? A function declaration appears like this above its first line. But this is not a function, so ... some other type? – usr2564301 Dec 19 '17 at 21:26
  • Here is a thought: you can find out what IDA internally calls this if you select this part of the code and dump it as an IDC file (or at least, I think that's the one with all the commands listed). – usr2564301 Dec 20 '17 at 18:51
1

Can't tell about python, but in IDC you can partially get that 'comment' via GetType(ea). I say partially because it gives wchar_t[67] as result for comment like ; wchar_t aHttpSchemas_27[67].

  • Awesome, exactly what I'm looking for in that case. And yes, the type is more interesting to me than the variable name IDA gave it. – 0xC0000022L Dec 22 '17 at 19:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.