I'm working on decompiling a DOS .exe that was written in Pascal or Delphi. When looking at the decompiled code, there appears to be many strings that are are padded with 00. Example:

06 53 54 52 49 4E 47 00 00 00 STRING
07 41 4E 4F 54 48 45 52 00 00 ANOTHER
08 4C 41 53 54 7F 4F 4E 45 00 LAST ONE

The leading number is the length of string, using Pascal conventions. If I were to run the .exe, these strings appear in a list. Because of this, I assume that the organization of the strings is supposed to be a list of some sort.

My questions are these:

  1. Is there a way in Ghidra to puts these string into an Array, with one string per element? When I hit [ it tries to build the array only off the length of the string and the characters of the first string and ignores the 00.

  2. Why was the code compiled this way. It would appear to increase the size of the file with addition padding byte(s), and I see these type of lists all over the decompiled file.

  • I am running into this same problem with an Arm cortex-M binary. The only solution I have found is manually editing the raw hex to place the terminated strings sequentially, then placing the removed padding bytes after the last string to keep everything aligned. Very hacky, I know.... but it works so far.
    – AltxF4
    Jun 6 at 19:55

While it'd be nice to define a struct using Ghidra's flexible arrays, they are limited in functionality to the point where I haven't found them particularly useful.

In your case though, the padding bytes may actually make your life easier. If the strings are all 9 bytes like your example, you could do this:

struct pstring {
  byte len;
  char[9] str;

And then make an array of pstring instances.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.