3

I am dabbling with a XE3 Delphi application in IDA 7.0, and can't get Strings representation to work correctly:

While selecting Delphi (16 bits) in the Strings Window yield correct results:

IDA 7 Strings Window, Delphi 16 bits

References to Strings in the Disassembly view are failing.

  • Below is the string definition at .text:008717DC:

enter image description here

  • Below is a (failing) reference to it:

enter image description here

Trying to change the String type to Delphi (16 bits) fails with Command "SetStrlitStyle" failed

enter image description here

Oddly, not all strings are misreferenced:

enter image description here

enter image description here

For the record, IDR (Interactive Delphi Reconstructor) yields correct representations:

enter image description here

I have set the Default String type to Delphi (16 bits) in Options:

enter image description here

Here are the Compiler Options:

enter image description here

All help welcome, thanks !

Improve this question

1 Answer 1

Reset to default
2

It's not only Delphi problem, it's a generic unicode detection problem of IDA. I can't be sure how exactly it works, but I feel like IDA has an issue, when detecting the data type. And it's related to the priority of address representation over string literal. I.e. when it finds some instruction, which references the address, it tries to determine what data is situated at this address. In your case it found mov eax, offset 8717E0, it read 4 bytes at address 8717E0. It got 0x6F0053, it made a check does 0x6F0053 look like an address? Yes, in current database it's a valid address. Then screw all further detection let's make data at 8717E0 offset to loc_6F0053. If there was no such address 0x6F0053, it would go into further analysis and in the end came to the conclusion, that it's a unicode string.

So to fix this, you need to hook the analysis in the process module, and do your own type detection. It can't be solved by any of IDA settings.

Improve this answer
2
  • Is that a situation you have experienced yourself ? Your analysis appears sound to me, but with the widespread use of Unicode I can't help but wonder how this isn't a largely discussed issue, and how it could exist in such an iconic software in the first place.
    – Alexis
    Jun 5, 2018 at 15:44
  • Yes I've seen this multiple times. As for iconic ... there are so many bugs, which are not fixed for decades :)
    – Anton Kukoba
    Jun 6, 2018 at 7:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.