4

Im new to reverse engineering, and ive trying Ghidra, IDA (Freeware) and Radare2 with a simple CrackMe, the problem is, both Ghidra and IDA couldnt detect a string while Radare2 (Using Cutter GUI) could figure out the name. I used default analysis for all 3. Is there something im missing ? because even the 'strings' command can actually find the string im looking for.

Ghidra:

enter image description here

IDA:

enter image description here

Radare2 (Cutter):

enter image description here

6

I don't know the exact length of string. But, few things to note here are as follows:

  1. Ghidra and IDA has a minimum bound on size of string to recover correct type (ghidra has a limit - or lower bound of 5).
  2. This is necessary to avoid any false positives or conflicting types. And recover correct types without marking a pointer as a string. Check out this figure for your reference. Generated using Ghidra automated analysis.

enter image description here

In Ghidra you can change this limit (minimum is 4) in analysis section.

enter image description here

  1. Strings command outputs printable characters with minimum size 4 (plus it doesn't use sophisticated type recovery algorithms like ghidra or Ida). I believe that you have a string with length less than 5 and my guess is that it must be 4 to be precise.
  2. strings are usually defined in .rodata section. If you doubleclick on DAT_xxxx, it will take you to the location where that string is defined. There, you will see consecutive bytes bunched together by Ghidra or IDA (as shown in image-1). But, the type is not resolved as a "string".
  3. In Ghidra a quick way to fix this by changing data type of DAT_xxxx label: Right click -> Data -> Choose Data Type -> choose string

enter image description here

Rereferences:

1
  • 1
    Thank you for taking the time to write such a detailed answer, i changed the data type to string and it worked perfectly and i now also understand how the minimum string's length can effect the analysis, Thank you again! – RedZ Jan 15 at 17:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.