3

I'm trying to decompile a binary in IDA Pro. Currently I am looking at a list of pointers to strings, which represent game data ("Left turn", "Right turn" etc). Frustratingly, it appears like nothing references the addresses storing this data, though I know they are used in the game.

So I am guessing the program is using some code to reference "Left turn" with pointer arithmetic, like print(BASE_STRING_PTR + offset).

This is difficult to detect though; I'm new to IDA and have been playing around with the buttons but haven't found anything short of trying "Find references" for each address above the address I want. I was hoping more experienced reverse engineers would have some advice?

If there is another tool that's good for this, awesome, though I'm on a Mac which limits me somewhat.

Improve this question
5
  • Do the strings show up in .rsrc?
    – Avery3R
    Apr 22, 2014 at 6:16
  • I'm not sure what that is.
    – Kevin Burke
    Apr 22, 2014 at 10:19
  • .rsrc is the segment where resources are stored. If the address of the string looks like .rsrc:ADDR then it is in .rsrc. Resources aren't accessed normally, they're accessed through WINAPI functions such as LockResource. However, this is all entirely irrelevant if you're not using windows, or the program you're analyzing is not a windows program.
    – Avery3R
    Apr 23, 2014 at 8:11
  • Ah, I think the parts of the program I'm looking at are in the .data section.
    – Kevin Burke
    Apr 23, 2014 at 10:46
  • Good question. Other than searching for sequences of bytes I haven't found a good way to find pointer+offset. You could of course write a script to do so, it would be fairly easy to search for bytes within a certain range.
    – rollsch
    Jul 12, 2016 at 4:45

1 Answer 1

Reset to default
4

In this case, the best approach is to use a debugger (either IDA Pro's debugger or another debugger of your choosing).

Run the program in a debugger and set a hardware-read breakpoint on the first byte of one of the strings. Then interact with the program in a way that causes that given string to be accessed by the program (for example, something that causes the string to be displayed on the screen). The hardware breakpoint should trigger, allowing you to look at the call-stack in the debugger to see what code in the program caused the given string to be accessed.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.