0

I'm working on decompiling a DOS .exe that was written in Pascal or Delphi. When looking at the decompiled code, there appears to be many strings that are are padded with 00. Example:

06 53 54 52 49 4E 47 00 00 00 STRING
07 41 4E 4F 54 48 45 52 00 00 ANOTHER
08 4C 41 53 54 7F 4F 4E 45 00 LAST ONE

The leading number is the length of string, using Pascal conventions. If I were to run the .exe, these strings appear in a list. Because of this, I assume that the organization of the strings is supposed to be a list of some sort.

My questions are these:

  1. Is there a way in Ghidra to puts these string into an Array, with one string per element? When I hit [ it tries to build the array only off the length of the string and the characters of the first string and ignores the 00.

  2. Why was the code compiled this way. It would appear to increase the size of the file with addition padding byte(s), and I see these type of lists all over the decompiled file.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.