2

Is there a trick in IDA Pro to deal with unrolled loops like in the screenshot below? enter image description here

Another, possibly related compiler optimisation is this - instead of loading an offset into a memory area, it does mov for each character (MSVC8). Any quick way to deal with these?

enter image description here

  • 1
    I'm not sure what you mean by "deal with", but I believe there is a way to combine blocks into a single relabeled one. – RoraΖ Feb 16 '15 at 14:25
  • The 'optimisation' is an obfuscation trick, to ensure that the strings in question do not show up in the binary. To find stuff like this requires emulation, either with a homebrewed script or something like the x86emu plugin. – DarthGizka Feb 16 '15 at 14:31
  • @DarthGizka not convinced this was done on purpose although it is plausible. There are optimisations like if you had previously resolved InternetOpenA and now want to resolve InternetCrackUrlA, they'd copy only the CrackURLA part. Seems like compiler optimisation got its way. – Konrads Feb 16 '15 at 16:44
  • 1
    @Konrads it's also sometimes used to build PIC. Normally the strings would end up in .rdata but this way (const char szName[] = {'a', 'b', 'c', 0};) it doesn't – user45891 Feb 18 '15 at 14:14
1

There is a topic regarding the 2nd question, see How can I clean up strings built at runtime?. Personally I use the script by ASERT script, it works pretty well.

| improve this answer | |
  • The ASERT script doesn't really work if you have statements like this: mov [rsp+138h+var_118], 'k' where this is the first in the sequence :( – Konrads Feb 17 '15 at 17:09
  • I also now realise there are 2 questions in 1. – Konrads Feb 17 '15 at 17:17
  • The scripts that work with x64 are from FireEye/FLARE: fireeye.com/blog/threat-research/2014/08/… – Konrads Feb 18 '15 at 10:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.