1

I'd like to debug a Firmware (ARM-based) which contains a lot of C-Strings. IDA Pro 7.2 seems to have problems detecting strings having special chars (above 7-Bit ASCII) in it. Here is one example of the Spanish word "navegación", which has an diacritics "o" in it:

MAIN:0007AE4D                 DCB 0x4E ; N
MAIN:0007AE4E                 DCB 0x61 ; a
MAIN:0007AE4F                 DCB 0x76 ; v
MAIN:0007AE50                 DCB 0x65 ; e
MAIN:0007AE51                 DCB 0x67 ; g
MAIN:0007AE52                 DCB 0x61 ; a
MAIN:0007AE53                 DCB 0x63 ; c
MAIN:0007AE54                 DCB 0x69 ; i
MAIN:0007AE55                 DCB 0xF3
MAIN:0007AE56                 DCB 0x6E ; n
MAIN:0007AE57                 DCB    0

You see that 0xF3 is a valid ASCII char (ISO Latin-1), but IDA does not detect it as a valid char. If i now press "a" on the first letter (or let IDA doing a string detection), i would end up with this:

MAIN:0007AE4D aNavegaci       DCB "Navegaci"
MAIN:0007AE55                 DCB 0xF3
MAIN:0007AE56                 DCB 0x6E ; n
MAIN:0007AE57                 DCB    0

It see's the char as if it where a string-termination char. How can i get IDA to as least ignore such special chars and just rely on my setting to show strings in C-Style (0x00 terminated)?

1 Answer 1

2

You should open your IDA's cfg\ida.cfg file and look for the StrlitChars definition inside it. That configuration variable controls which characters are considered legitimate string characters when converting an address/array to a string.

Add your selected character in the format used and restart IDA.

The comment above the configuration variable is pretty straightforward, so following it shouldn't be an issue:

// the following characters are allowed in strings, i.e.
// in order to find end of a string IDA looks for a character
// which doesn't belong to this array:
// Note about CURRENT_CULTURE:
//  - if the IDB's default encoding for 1-byte/symbol strings, is not
//    UTF-8, a "culture" will be derived from it. E.g., "windows-1252"
//    will yield culture "Latin_1".
//  - this cannot be done automatically for UTF-8, since UTF-8 covers
//    the whole Unicode codepoints space.
//  - regardless of whether a "culture" can be derived from the default
//    encoding or not, this can be overridden by the CULTURE configuration
//    property (see below)
//  - the CURRENT_CULTURE directive tells IDA to consider all
//    codepoints that are defined as part of that culture, as valid
//    in the string literals.
//  - this applies to codepoints >= 0x80
//  - a "culture" refers to the name of a .clt file in the cfg/ directory.
//    E.g., "Latin_1" will correspond to the "Latin_1.clt" file.
//    In this case, the culture will contain all codepoints specified by
//    the file.
//    (It is worth pointing out that a culture file can, itself, include
//    other culture file(s))

As well as the Official IDA documentation

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.