Consider the following disassembly:
mov dword ptr [rbp+430h+var_458], 690068h ; L'i' + L'h' mov dword ptr [rbp+430h+var_458+4], 2E0064h ; L'.' + L'd' mov dword ptr [rbp+430h+var_458+8], 6C0064h ; L'l' + L'd' mov dword ptr [rbp+430h+var_458+0Ch], 6Ch ; 'l' ; -> L"hid.dll"
This is structurally similar to the disassembly from this question, except that the characters are
wchar_t instead of
char and moved dword-wise instead of byte-wise. The comment on the last
mov was automatically added by IDA, I had to add the others myself.
6Ch in the last
mov line could also be treated with R to change the representation to what's currently shown in the comment.
Not so with the other lines. R has no effect there, although IDA has no trouble deciphering a dword-wise copy of char-based strings as evidenced in this blog article (example from there: 70747468h -> 'ptth' -> "http").
I know of the stackstrings plugin, but cannot use it due to its dependency on Python 2.x!
Is there a configuration setting (similar to string types and data carousel) to teach IDA the ability to use R in these cases to make better sense of those
wchar_t-based stack strings?
IDA Pro version: latest (7.7.220218)