Questions tagged [strings]
A chain of characters, usually used to store text messages lying statically in the program or to receive dynamically messages from the user.
78
questions
2
votes
0
answers
31
views
Ghidra Strings and Global Renaming Issue
I am currently reverse engineering a piece of 16-bit software (originally written in C/C++ from what I can gather).
I have identified a function that seems to print text to the console. The text to be ...
- 153
3
votes
0
answers
35
views
Cant find the string "AutoOpen" in a macro enabled Word document
So, I was testing a Yara rule which goes like this:
rule macro_auto_run
{
meta:
description = "Document with macro that auto runs"
strings:
$s1 = "...
- 319
3
votes
0
answers
37
views
Contents of EAX in IDA Free?
I am doing Level 2 of TryHackMe's REloaded reverse engineering challenges.
In the screen shot below, you can see I have found the string I want by hovering my mouse over EAX, however a good chunk is ...
- 185
4
votes
1
answer
116
views
Ghidra 16-Bit DOS Strings
I am attempting to reverse-engineer a 16-Bit DOS MZ executable.
The file contains many different strings, most of which are printed out to the console at various points.
IDA seems to be able to pick ...
- 153
2
votes
0
answers
50
views
Why the global string varable exploitation using angr doesn't work?
To learn the angr module, I have made a simple C code like follows.
test.c
#include <stdio.h>
#include <string.h>
char input[6];
int main(void)
{
scanf("%s", input);
...
- 55
3
votes
1
answer
51
views
GNU strings with --encoding=S
I have two binaries. Both contain the string "precondition failed" (without the quotes).
The corresponding byte sequence 70 72 65 63 6C 65 64 00 is the same for both binaries. However, the ...
- 1,518
2
votes
0
answers
61
views
How to search for a graphical string?
I am trying to search for a string but in my case, that string is not like a normal string but it's a graphical string.
As you have seen, that is not a normal string that can search for but it's a ...
- 269
1
vote
2
answers
319
views
How to use IDA pro to find ALL strings in an exe file?
I've been using IDA for some time and most of the time I can find the strings I am looking for in the String panel.
In one of the recent exe files I was working on, many string are missing, or not ...
- 19
1
vote
0
answers
226
views
Reinterpreting local function strings in Ghidra (ARM)
The program I'm working with has stuff like this all over:
strbuf = 0x20746567;
local_824 = (undefined *)0x6863616d;
local_820 = (undefined *)0x20656e69;
local_81c = (undefined ...
- 31
3
votes
1
answer
167
views
View user32.dll LoadStringA string ID's in IDA on MacOS like you can with Ghidra
I'm going through through Challenge 3 (Task 4) of Basic Malware RE: https://tryhackme.com/room/basicmalwarere
And in Ghidra after I do analysis, I can view the .rsrc area and it shows me all the ...
- 133
1
vote
1
answer
397
views
Strange DWORD/QWORD C++ Strings in decompilation
I have never seen something like this before but I assume this is some kind of way C++ allocates dynamic strings. In my decompilation listing in Ghidra I see something like:
local_14 = DAT_00404004 ^...
- 23
0
votes
1
answer
112
views
Need help with this .tbl file
I don't know if it's encrypted, but I tried changing encoding to latin1, but no avail, some text are still not clear, file looks to be like a csv table. Plus, it has a FTABLE as a header, I don't know ...
1
vote
1
answer
305
views
IDA: String referenced in Assembly, but not shown in string view
I was looking for a spcific string in IDA, but there were no hits in the "string view". Now after browsing the disassembly for a while I realize that not only does the string exist, IDA did ...
- 423
2
votes
1
answer
3k
views
Why does Ghidra show no references to any strings?
I'm attempting to compare this binary bootloader to a slightly different C version of some boot code. My initial approach is to look at the msg() calls and the strings they use. I can dump the strings,...
- 171
1
vote
1
answer
656
views
x64dbg is unable to find string references vs. Ollydbg
I want to know how to find string references in x64dbg as Olly does : it finds every string references I need when I open Memory map window, then rightclick on "Search" and then I enter the ...
- 79
1
vote
1
answer
435
views
How to change string-detection rule in IDA Pro?
I'd like to debug a Firmware (ARM-based) which contains a lot of C-Strings. IDA Pro 7.2 seems to have problems detecting strings having special chars (above 7-Bit ASCII) in it. Here is one example of ...
- 21
0
votes
1
answer
82
views
How to convert string to a variable in IDA
I have the following string "CreatePipe" and I want to convert it to a variable so I can use x to find all its references:
How can I do it? I am not sure what to choose here:
- 573
1
vote
1
answer
116
views
Inserting two digits into binary per Hex - without making EXE corrupt
I dont have much knowledge with assemblers. I beg ur pardon in advance.
I need to change an IP address in a win-binary (Net) where the IP its hard-coded.
Just changing the IP with an Hex Editor would ...
- 13
1
vote
1
answer
135
views
Identify strings shared between multiple files from the Linux command line
Given a set of arbitrary files, what's the best way to identify the text strings shared between them (either in all files or a subset of them) from the Linux command line?
This would be useful for ...
- 195
1
vote
1
answer
1k
views
How to find encrypted strings in an executable?
I am trying to reverse engineer an executable.
I am using Process explorer to dump all strings present in the exe image, and from the process's RAM when it is running.
The two dumps return a ...
- 111
2
votes
2
answers
587
views
C++ hide string parameter for string viewer
bool isLaunched = CreateProcessW(
L"C:\\Windows\\System32\\Notepad.exe", // Should be shown in any string viewer or decompiler.
0x0,
0x0,
0x0,
TRUE,
0,
0x0,
...
- 21
1
vote
2
answers
1k
views
How to convert hexadecimal values to 16-bit Unicode in IDA Pro 7.5?
The context:
For a student project which goal is to make us learn reverse engineering and how to use IDA Pro, we have to reverse engineer the APT28 hospitality malware (as described in this blog post: ...
- 111
0
votes
0
answers
70
views
Looking for encoding of SVG data
I have some SVG images stored in a database; but I am not able to find out which encoding is used.
Unfortunately, I don't have the exact SVG plain text available. The given examples "probably&...
0
votes
0
answers
121
views
How to find and edit the source of a string in a DX11 game's exe/files (debug build of the game available)
I want to find and edit the values for the motion blur effect in Naruto: Ultimate Ninja Storm 3 on PC (Windows, DX11) to be more in line with the PS3 version (and the other Storm games on PC as well). ...
12
votes
1
answer
2k
views
Extracting strings from Go binaries
Is there an easy way to extract all of the strings from Go binaries that will work cross architecture?
The problem with Go is that strings are stored without a null terminator, so you can't use the &...
- 221
0
votes
1
answer
625
views
Replace string in hexa with a longer one in .bin without destroying the structure (in .data)
I would like to replace some hard-coded strings in a compiled exe (in .data) which is in chinese (with no possibility to put it in other languages).
I managed to replace strings in hexadecimal with ...
- 15
0
votes
1
answer
98
views
Get string from function and pass it to another program
I want to make a small tool that analyzes text from console in online game and I'm stuck at reading a string from a function and sending it to another program. I managed to find function that takes ...
0
votes
1
answer
475
views
In IDA's strings window, how to run MakeStrLit on all the selection
Ida allows to turn bytes into a string using the A shortcut
There is also this window to find strings :
You can press enter to jump to a specific string, but is it possible to run MakeStrLit on all ...
- 1
1
vote
1
answer
91
views
How to determine what code created a string, in a live debugger session?
I'm using IDA 7 to debug a running application that must be a child of another application, which means I can't start it from IDA (using Debugger->Run). Instead, I have to run the application normally,...
- 161
0
votes
1
answer
572
views
Abusing the strlen output
My question is related to the strlen function from the C and C++.
I am reversing a program, that reads a byte data from allocated memory and sends to the strlen directly. To be completely honest ...
2
votes
2
answers
317
views
How to identify the encoding performed on this string
I have an old application that stores the username and password in plaintext but encoded by an unknown encoding algorithm to me, it seams like base64, but I think it's not,
It seams that any word ...
- 23
2
votes
1
answer
214
views
How to find who use these strings?
When i see function like this, im getting confused, because all the strings i need in this function, but how can i find which functions which this strings?
how can i know the address of the function ...
- 31
0
votes
1
answer
661
views
Is there a way to export all the strings for a certain module in x64dbg?
I have an encrypted file that I was able to step through the code until that specific DLL file was decrypted in memory and I was able to list all of its strings. It has a ton of them that I would like ...
- 3
0
votes
1
answer
467
views
How to view registers values in string
Is it possible that radare2 will show registers values also in strings ?
For example, when I run ar I am getting the liste of registers and I have:
rax = 0x000000042
Is there a way to also show ...
- 573
1
vote
1
answer
484
views
Not able to find Hard coded strings in the mac executable file
I know that there is a string called "Activate your subscription" used in this particular app. But Im not able to find this string from its executable. I tried strings myapp and also searched for same ...
- 145
2
votes
1
answer
389
views
obtaining string value from Unknown elf-x86-64 binary with gdb
I'm trying to find a string value stored in memory by a binary (possibly written in C) that won't show up when I perform "strings a.out". I have tried examining particular memory addresses of interest ...
- 21
2
votes
1
answer
264
views
Find out string encoding/shift of proprietary binary file format
I'm trying to reverse-engineer a proprietary file format to be able to extract certain strings from files in this format. I have the application, that writes the files, at hand.
By trial-and-error I ...
- 23
2
votes
2
answers
2k
views
How can I view in-memory strings of a process on Linux (Ubuntu)?
On Windows, I can use tools like Process Explorer and Process Hacker to view in-memory strings generated at runtime of a given process. How can I accomplish this same task on Ubuntu?
- 23
2
votes
1
answer
431
views
Why can I see certain strings when PE is opened with a hex editor or a simple static analysis tool but not with IDA?
I found the executable in question using VirusTotal "hunting" feature, where one can run Yara rules for the files existing in VT database and match the strings. I downloaded the file, opened ...
- 197
2
votes
1
answer
621
views
How do you print fixed width strings with radare's print format `pf`?
Let's say I have a byte sequence where U is an unsigned int (4 bytes), and ccccccccccccccc is a 15 byte character array
UcccccccccccccccU
Is it possible to print this structure using pf? I can print ...
- 1,724
3
votes
1
answer
897
views
IDA 7 does not recognize/reference Delphi 16bits Strings correctly
I am dabbling with a XE3 Delphi application in IDA 7.0, and can't get Strings representation to work correctly:
While selecting Delphi (16 bits) in the Strings Window yield correct results:
...
- 133
1
vote
1
answer
152
views
Build Graph Printable String Information in ELF
I'm new in the field of reverse engineering to detect malicious code in ELF file. I used IDA Pro to retrieve a list of strings in an elf file. But I wonder if IDA can build a graph showing the link ...
- 69
2
votes
1
answer
142
views
How can I generate the recovery password on a legacy system (Original company is out of business) running on my local machine?
I'm attempting to use a legacy systems recovery feature that typically required calling/faxing a company that is no longer around.
Basically, the system was designed to go into a recovery mode and ...
- 51
-1
votes
1
answer
604
views
how to find the strings values in a comparision using ollydbg
In OllyDbg 1.10 (assembler level deubugger) I can find all referenced text strings
The program compare if a user input string is equal a internal string.
When I debug the program, I can't find the ...
- 23
2
votes
1
answer
373
views
Hex-Rays function signature does not match demangled name
From the demangled name, I know that a function takes an std::string const& as a parameter but when generating psuedo-c code with Hex-Rays' decompiler it autodetects the parameters as (int a1, int ...
- 55
2
votes
1
answer
247
views
What other methods can be used to find file paths in an executable?
I'm hacking a game in my library (Mirror's Edge) to re-route where the save data is located. I've done this with many other games successfully, but this one has me stumped. Normally, I start with HxD ...
- 193
1
vote
1
answer
1k
views
I'm would like to view this malicious payload, but am having trouble decoding it
This is a gzip compressed base64 string. I tried decoding it with an online converter but it said the data was corrupt. Can anyone decode this?
H4sIAAAAAAAAAL1X6W6jyBb+...
- 11
2
votes
1
answer
468
views
Dolphin Emulator Android port modifications
I am modifying the Dolphin Emulator Alpha for android, but I'm having some trouble with a string in it's smali code. The value I am having trouble with is dolphin-emu, it is the name of the folder ...
- 193
2
votes
2
answers
545
views
How can I identify how this string is being encoded so I can replicate it?
A friends company uses an old VB6 application to generate encoded strings to then use in their also old and out of date database system.
They have the application running in standalone mode so I can ...
- 51
1
vote
1
answer
194
views
Is it possible to make a string bigger on an executable without breaking it?
I am a new reverse enigneerer. I know I can patch strings using a hex editor, but I obviously can't add or remove a single byte. Is there any workaround that will let me make a... let's say, 10 byte ...
- 11