2

Is there a trick in IDA Pro to deal with unrolled loops like in the screenshot below? enter image description here

Another, possibly related compiler optimisation is this - instead of loading an offset into a memory area, it does mov for each character (MSVC8). Any quick way to deal with these?

enter image description here

Improve this question
4
  • 1
    I'm not sure what you mean by "deal with", but I believe there is a way to combine blocks into a single relabeled one.
    – RoraΖ
    Commented Feb 16, 2015 at 14:25
  • The 'optimisation' is an obfuscation trick, to ensure that the strings in question do not show up in the binary. To find stuff like this requires emulation, either with a homebrewed script or something like the x86emu plugin.
    – DarthGizka
    Commented Feb 16, 2015 at 14:31
  • @DarthGizka not convinced this was done on purpose although it is plausible. There are optimisations like if you had previously resolved InternetOpenA and now want to resolve InternetCrackUrlA, they'd copy only the CrackURLA part. Seems like compiler optimisation got its way.
    – Konrads
    Commented Feb 16, 2015 at 16:44
  • 1
    @Konrads it's also sometimes used to build PIC. Normally the strings would end up in .rdata but this way (const char szName[] = {'a', 'b', 'c', 0};) it doesn't
    – user45891
    Commented Feb 18, 2015 at 14:14

1 Answer 1

Reset to default
1

There is a topic regarding the 2nd question, see How can I clean up strings built at runtime?. Personally I use the script by ASERT script, it works pretty well.

Improve this answer
3
  • The ASERT script doesn't really work if you have statements like this: mov [rsp+138h+var_118], 'k' where this is the first in the sequence :(
    – Konrads
    Commented Feb 17, 2015 at 17:09
  • I also now realise there are 2 questions in 1.
    – Konrads
    Commented Feb 17, 2015 at 17:17
  • The scripts that work with x64 are from FireEye/FLARE: fireeye.com/blog/threat-research/2014/08/…
    – Konrads
    Commented Feb 18, 2015 at 10:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.