2

I'm reverse engineering a binary that has very generic, standard xor+math encryption on every string. I've written IDAPython to find each one(they're used in a generic way) and decrypt them, then add the decrypted string as a comment / try to rename the variable.

This doesn't tell IDA that offsets to these blocks is actually a string, though. For example, it won't show up in idautils.Strings(necessary for plugins/the rest of my script library...), the strings view, etc.

I guess it wasn't clear: Strings are stored in encrypted blocks statically. They are only decrypted during runtime but are otherwise used just like normal string references.

I could replace the encrypted blocks with their decrypted result in the IDB, but that is less than ideal as it creates an IDB that isn't 1:1 to the file statically.

Is there a way to tell IDA to identify an address as a string with a specific value?

Improve this question
2
  • You could rename the address but the name will have restraints. Your best bet is to add the decrypted string as a repeatable comment by calling idc.MakeRtpCmt(address, "plain text").
    – alexanderh
    Mar 24, 2015 at 16:53
  • @Alex -- that's what I did before this Q. It's less than ideal as other functionality RELIES on strings being identified by ida as strings.
    – Ditmar Wendt
    Mar 26, 2015 at 4:54

3 Answers 3

Reset to default
4

I think the API you're looking for is idaapi.make_ascii_string(start, len, strtype)

It's not really documented on https://www.hex-rays.com/products/ida/support/idapython_docs/idaapi-module.html but an example blog post showing how to use the API for a similar circumstance is here: http://security.my/post/38222980198/decrypting-strings-in-a-binary-with-an-idapython

Improve this answer
2
  • Note that this will only work if the strings exist statically in the IDB. It's unclear in the original question if that's the case, or if they're instead constructed dynamically on the stack.
    – Jason Geffner
    Mar 23, 2015 at 19:42
  • Yeah, this works if you have a normal string. This question is talking about strings stored in an encrypted format. Patching the IDB loses your original data -- which is less than ideal.
    – Ditmar Wendt
    Mar 23, 2015 at 19:52
2

I think you should review this blog post about Custom data types and formats. This would allow you to define a new type of string and provide the algorithm to use for "printing" it.

Custom data type: A custom type is basically just a way to tag some bytes for later display with custom format, when the built-in IDA types (dt_byte, dt_word, etc) are not enough. For example: an XMM vector, a Pascal string, a half-precision (16 bits) floating-point number, a 16:32 far pointer (fword), uleb128 number and so on.

It's not clear that creating a new type would cause entries to show up in the strings menu, if not I'm sure you could use the names window with its filtering to have an alternative.

For more details search the idaapi for data_format_t, and check out bytes.hpp. However, I think the first link will put you on the right track.

Improve this answer
1

I don't believe you can tell IDA to add a string to its string list if that string doesn't statically exist in your IDB.

You could have your script do the following, however:

  1. Create a new section
  2. Write the decrypted strings into that section (via byte-patching in the IDB), potentially with cross-references between the decrypted strings and the encrypted strings
  3. Run idaapi.refresh_strlist() (arguments documented here) on the decrypted strings written to the new section
Improve this answer
1
  • Writing the decrypted strings to the new section will make them show up in the string view without modifying the original binary, sure. Say I have situations where the encrypted block is used in a mov eax, offset myblock -- this solution wouldn't allow IDA to identify the strings in these situations, though? Maybe iterate every xref to the original block and tell it it's some custom offset to the new section string?
    – Ditmar Wendt
    Mar 23, 2015 at 20:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.