Newest 'strings' Questions

1

vote

1answer

47 views

How to change string-detection rule in IDA Pro?

I'd like to debug a Firmware (ARM-based) which contains a lot of C-Strings. IDA Pro 7.2 seems to have problems detecting strings having special chars (above 7-Bit ASCII) in it. Here is one example of ...

asked Nov 8 '21 at 8:57

T-Regex

111 bronze badge

0

votes

1answer

23 views

How to convert string to a variable in IDA

I have the following string "CreatePipe" and I want to convert it to a variable so I can use x to find all its references: How can I do it? I am not sure what to choose here:

ida disassembly strings

asked Aug 25 '21 at 10:31

E235

4313 silver badges14 bronze badges

0

votes

0answers

86 views

radare2: Print strings in function for 32-bit binaries

I want to see the strings that are printed by the puts() function in the output of radare2's pdf, but it doesn't work. I have a similar problem as mentioned here, but I think it's somehow related to ...

disassembly radare2 strings

asked Jul 28 '21 at 10:08

fransie

12 bronze badges

1

vote

1answer

76 views

Inserting two digits into binary per Hex - without making EXE corrupt

I dont have much knowledge with assemblers. I beg ur pardon in advance. I need to change an IP address in a win-binary (Net) where the IP its hard-coded. Just changing the IP with an Hex Editor would ...

patching .net hex strings

asked Jul 16 '21 at 10:57

TefoD

132 bronze badges

0

votes

0answers

12 views

Changing the strings relating to text layers inside an AEP file, only the name of the layer changes

So here's my situation. I have an After Effects Project file. Inside this project, there's a text layer. Let's say the text layer says "Faster Pussycat! Kill! Kill!" and the name of the text ...

strings binary-format

asked May 15 '21 at 0:48

Chubi Wubi

1

vote

1answer

81 views

Identify strings shared between multiple files from the Linux command line

Given a set of arbitrary files, what's the best way to identify the text strings shared between them (either in all files or a subset of them) from the Linux command line? This would be useful for ...

linux strings command-line

asked Mar 17 '21 at 21:08

recvfrom

859 bronze badges

1

vote

1answer

570 views

How to find encrypted strings in an executable?

I am trying to reverse engineer an executable. I am using Process explorer to dump all strings present in the exe image, and from the process's RAM when it is running. The two dumps return a ...

windows encryption windbg encodings strings

asked Feb 3 '21 at 23:12

Sahil Singh

1114 bronze badges

0

votes

0answers

22 views

"strings" command from *nix, but as a Java API?

Looking for the "strings" command from *nix, but as a Java API. Does such a library or JAR exist? I've automated calling the strings *nix command, but would like to explore reverse ...

java strings

asked Jan 27 '21 at 18:18

kotlinstackoverflow

1

0

votes

2answers

193 views

C++ hide string parameter for string viewer

bool isLaunched = CreateProcessW( L"C:\\Windows\\System32\\Notepad.exe", // Should be shown in any string viewer or decompiler. 0x0, 0x0, 0x0, TRUE, 0, 0x0, ...

c++ strings software-security

asked Jan 9 '21 at 21:03

William

1

vote

2answers

609 views

How to convert hexadecimal values to 16-bit Unicode in IDA Pro 7.5?

The context: For a student project which goal is to make us learn reverse engineering and how to use IDA Pro, we have to reverse engineer the APT28 hospitality malware (as described in this blog post: ...

ida encodings strings pe32

asked Dec 8 '20 at 15:12

DisplayNeth

1112 bronze badges

0

votes

0answers

54 views

Looking for encoding of SVG data

I have some SVG images stored in a database; but I am not able to find out which encoding is used. Unfortunately, I don't have the exact SVG plain text available. The given examples "probably&...

encryption encodings strings

asked Sep 24 '20 at 11:43

Dominik Lübbers

1

0

votes

0answers

94 views

How to find and edit the source of a string in a DX11 game's exe/files (debug build of the game available)

I want to find and edit the values for the motion blur effect in Naruto: Ultimate Ninja Storm 3 on PC (Windows, DX11) to be more in line with the PS3 version (and the other Storm games on PC as well). ...

windows debugging strings game-hacking graphics

asked Jul 22 '20 at 20:33

Nikk Mann

11 bronze badge

0

votes

0answers

33 views

Is it posible to break at string when it being use by program?

Like the title, i need to break at an url string when it being used by program. I try memory break point but it will break at begin of the section. I use x64dbg.

debugging breakpoint strings

asked Jun 8 '20 at 11:16

Brian MJ

472 bronze badges

11

votes

0answers

758 views

Extracting strings from Go binaries

Is there an easy way to extract all of the strings from Go binaries that will work cross architecture? The problem with Go is that strings are stored without a null terminator, so you can't use the &...

disassembly binary-analysis elf binary strings

asked May 13 '20 at 9:37

Drxxd

2111 silver badge4 bronze badges

0

votes

1answer

292 views

Replace string in hexa with a longer one in .bin without destroying the structure (in .data)

I would like to replace some hard-coded strings in a compiled exe (in .data) which is in chinese (with no possibility to put it in other languages). I managed to replace strings in hexadecimal with ...

binary-analysis radare2 executable strings

asked Apr 18 '20 at 17:00

Martin

153 bronze badges

0

votes

1answer

58 views

Get string from function and pass it to another program

I want to make a small tool that analyzes text from console in online game and I'm stuck at reading a string from a function and sending it to another program. I managed to find function that takes ...

strings dll-injection game-hacking

asked Apr 11 '20 at 0:55

Dasmitian

11 bronze badge

0

votes

1answer

192 views

In IDA's strings window, how to run MakeStrLit on all the selection

Ida allows to turn bytes into a string using the A shortcut There is also this window to find strings : You can press enter to jump to a specific string, but is it possible to run MakeStrLit on all ...

ida strings

asked Mar 12 '20 at 16:09

Lapin

11 bronze badge

1

vote

1answer

55 views

How to determine what code created a string, in a live debugger session?

I'm using IDA 7 to debug a running application that must be a child of another application, which means I can't start it from IDA (using Debugger->Run). Instead, I have to run the application normally,...

ida disassembly debugging strings x86-64

asked Dec 27 '19 at 17:48

NERL

512 bronze badges

0

votes

1answer

305 views

Abusing the strlen output

My question is related to the strlen function from the C and C++. I am reversing a program, that reads a byte data from allocated memory and sends to the strlen directly. To be completely honest ...

disassembly c++ c exploit strings

asked Nov 17 '19 at 5:41

Matthew Darens

133 bronze badges

0

votes

0answers

281 views

IDA free : How to find a string reference in .text

To begin with, I'd like to point out that I'm very new to this. Here's the simple thing I'd like to do : The program I want to mess around with displays a msgbox with the string "Please run the ...

ida disassembly strings

asked Aug 4 '19 at 11:02

user29223

433 bronze badges

2

votes

2answers

240 views

How to identify the encoding performed on this string

I have an old application that stores the username and password in plaintext but encoded by an unknown encoding algorithm to me, it seams like base64, but I think it's not, It seams that any word ...

encryption encodings strings

asked Jul 17 '19 at 20:12

ksr

233 bronze badges

-1

votes

1answer

125 views

How to find who use these strings?

When i see function like this, im getting confused, because all the strings i need in this function, but how can i find which functions which this strings? how can i know the address of the function ...

static-analysis strings

asked Jul 14 '19 at 7:15

Yoni

1

0

votes

1answer

283 views

Is there a way to export all the strings for a certain module in x64dbg?

I have an encrypted file that I was able to step through the code until that specific DLL file was decrypted in memory and I was able to list all of its strings. It has a ton of them that I would like ...

x64dbg strings

asked Jun 4 '19 at 19:41

Hey101

31 bronze badge

0

votes

1answer

275 views

How to view registers values in string

Is it possible that radare2 will show registers values also in strings ? For example, when I run ar I am getting the liste of registers and I have: rax = 0x000000042 Is there a way to also show ...

radare2 strings register

asked May 2 '19 at 11:42

E235

4313 silver badges14 bronze badges

1

vote

1answer

361 views

Not able to find Hard coded strings in the mac executable file

I know that there is a string called "Activate your subscription" used in this particular app. But Im not able to find this string from its executable. I tried strings myapp and also searched for same ...

patch-reversing strings hopper macos

asked Mar 28 '19 at 6:23

Jaffer Sheriff

1458 bronze badges

2

votes

1answer

223 views

obtaining string value from Unknown elf-x86-64 binary with gdb

I'm trying to find a string value stored in memory by a binary (possibly written in C) that won't show up when I perform "strings a.out". I have tried examining particular memory addresses of interest ...

binary-analysis gdb binary strings

asked Nov 20 '18 at 18:11

To Ban

212 bronze badges

2

votes

1answer

207 views

Find out string encoding/shift of proprietary binary file format

I'm trying to reverse-engineer a proprietary file format to be able to extract certain strings from files in this format. I have the application, that writes the files, at hand. By trial-and-error I ...

file-format deobfuscation encodings strings

asked Oct 23 '18 at 20:41

user1683766

232 bronze badges

2

votes

2answers

788 views

How can I view in-memory strings of a process on Linux (Ubuntu)?

On Windows, I can use tools like Process Explorer and Process Hacker to view in-memory strings generated at runtime of a given process. How can I accomplish this same task on Ubuntu?

dynamic-analysis strings

asked Aug 7 '18 at 18:35

xoreaxeaxeax_fan

232 bronze badges

2

votes

1answer

269 views

Why can I see certain strings when PE is opened with a hex editor or a simple static analysis tool but not with IDA?

I found the executable in question using VirusTotal "hunting" feature, where one can run Yara rules for the files existing in VT database and match the strings. I downloaded the file, opened ...

ida strings

asked Jul 17 '18 at 12:05

skooog

1974 bronze badges

2

votes

1answer

439 views

How do you print fixed width strings with radare's print format `pf`?

Let's say I have a byte sequence where U is an unsigned int (4 bytes), and ccccccccccccccc is a 15 byte character array UcccccccccccccccU Is it possible to print this structure using pf? I can print ...

radare2 strings

asked Jun 27 '18 at 18:39

Evan Carroll

1,60412 silver badges39 bronze badges

3

votes

1answer

680 views

IDA 7 does not recognize/reference Delphi 16bits Strings correctly

I am dabbling with a XE3 Delphi application in IDA 7.0, and can't get Strings representation to work correctly: While selecting Delphi (16 bits) in the Strings Window yield correct results: ...

ida strings delphi

asked Jun 3 '18 at 19:14

Alexis

1333 bronze badges

1

vote

1answer

125 views

Build Graph Printable String Information in ELF

I'm new in the field of reverse engineering to detect malicious code in ELF file. I used IDA Pro to retrieve a list of strings in an elf file. But I wonder if IDA can build a graph showing the link ...

ida elf strings

asked May 25 '18 at 2:50

MrBob

691 silver badge2 bronze badges

2

votes

1answer

138 views

How can I generate the recovery password on a legacy system (Original company is out of business) running on my local machine?

I'm attempting to use a legacy systems recovery feature that typically required calling/faxing a company that is no longer around. Basically, the system was designed to go into a recovery mode and ...

encryption java encodings strings

asked May 16 '18 at 14:59

Landmine

515 bronze badges

-1

votes

1answer

453 views

how to find the strings values in a comparision using ollydbg

In OllyDbg 1.10 (assembler level deubugger) I can find all referenced text strings The program compare if a user input string is equal a internal string. When I debug the program, I can't find the ...

windows ollydbg debugging strings

asked Mar 21 '18 at 19:22

incode

234 bronze badges

2

votes

1answer

357 views

Hex-Rays function signature does not match demangled name

From the demangled name, I know that a function takes an std::string const& as a parameter but when generating psuedo-c code with Hex-Rays' decompiler it autodetects the parameters as (int a1, int ...

ida arm hexrays strings

asked Jan 24 '18 at 3:37

armnotstrong

558 bronze badges

2

votes

1answer

197 views

What other methods can be used to find file paths in an executable?

I'm hacking a game in my library (Mirror's Edge) to re-route where the save data is located. I've done this with many other games successfully, but this one has me stumped. Normally, I start with HxD ...

windows ollydbg strings

asked Dec 30 '17 at 5:37

Mr. Mendelli

18310 bronze badges

1

vote

1answer

1k views

I'm would like to view this malicious payload, but am having trouble decoding it

This is a gzip compressed base64 string. I tried decoding it with an online converter but it said the data was corrupt. Can anyone decode this? H4sIAAAAAAAAAL1X6W6jyBb+...

malware file-format decompress strings byte-code

asked Nov 1 '17 at 3:15

user52738

112 bronze badges

2

votes

1answer

442 views

Dolphin Emulator Android port modifications

I am modifying the Dolphin Emulator Alpha for android, but I'm having some trouble with a string in it's smali code. The value I am having trouble with is dolphin-emu, it is the name of the folder ...

android strings local-variables binary-editing

asked Aug 16 '17 at 2:17

Mr. Mendelli

18310 bronze badges

2

votes

2answers

476 views

How can I identify how this string is being encoded so I can replicate it?

A friends company uses an old VB6 application to generate encoded strings to then use in their also old and out of date database system. They have the application running in standalone mode so I can ...

encryption encodings strings visual-basic vb6

asked Aug 15 '17 at 16:57

Landmine

515 bronze badges

1

vote

1answer

146 views

Is it possible to make a string bigger on an executable without breaking it?

I am a new reverse enigneerer. I know I can patch strings using a hex editor, but I obviously can't add or remove a single byte. Is there any workaround that will let me make a... let's say, 10 byte ...

executable binary patching strings

asked May 23 '17 at 15:05

Jakeashacks

111 bronze badge

3

votes

2answers

290 views

Problem with converting hex values to decimal

I'm reverse-engineering custom binary file format. I'm using 010 Editor to check this file. I found data structure to represent UTF-8 strings, which has header section of one or two bytes in length ...

binary-analysis hex strings struct binary-format

asked Apr 6 '17 at 9:19

Anthony J.

334 bronze badges

4

votes

1answer

2k views

GDB find string strange results

I'm playing with gdb and strange things are happening. I wanted to find some address in memory where string "/bin/sh" is located, and gdb says it found it. But when I examine the memory there, the ...

debugging gdb memory strings

asked Feb 24 '17 at 19:27

Michal Sládeček

412 bronze badges

4

votes

2answers

418 views

Cannot locate a variable on the stack

I am unable to locate a variable on the stack. I'm using Fedora 25 x64 but with a 32 bit program, btw. C program: #include <stdlib.h> #include <unistd.h> #include <stdio.h> #...

strings vulnerability-analysis

asked Jan 27 '17 at 5:25

the_endian

1,5859 silver badges31 bronze badges

2

votes

2answers

9k views

OllyDbg: How to set conditional breakpoint on a register value?

I want to set a breakpoint when the register EAX references a specific Unicode string, e.g. "Enter". In Ollydbg there is usually right beside the EAX value a string that says "ASCII: Enter ". I read ...

disassembly ollydbg strings breakpoint

asked Nov 17 '16 at 23:16

Chris

231 silver badge3 bronze badges

0

votes

2answers

189 views

Identifying a very weak hash algorithm

I'm reverse-engineering a string translation file format for a particular game. It's ultimately just an ID-to-string map, where the IDs are four-byte integers. There are 1935 IDs in total; you can see ...

static-analysis strings hash-functions

asked Nov 1 '16 at 8:07

RoadrunnerWMC

1113 bronze badges

0

votes

1answer

387 views

Using HEX editor and making 4 chars from 3 chars [closed]

I need to replace a single string in a bin. The actual string has 3 chars and the new one must have 4.If I use a hex editor this will make the exe useless.So is there any way to add bytes there to ...

c++ hex patch-reversing strings

asked Aug 26 '16 at 10:25

Ciolte Alin

1

3

votes

1answer

500 views

How to find address of more complicated, unknown data structures

I am trying to read messages from a (32bit windows application) chat window. Unfortunately, the window has a custom class, therefore GetWindowText() doesn't help. I need to read the data from memory ...

ida windows memory strings

asked Jun 21 '16 at 15:06

Johannes Stricker

1495 bronze badges

1

vote

4answers

1k views

XMPP clubs in league of legends

Hopefully I'm asking this at the right place. League of legends recently added the option to join a club. Clubs still use the XMPP protocol just like before for their public chat rooms: XMPP for ...

protocol strings networking sniffing

asked Apr 20 '16 at 2:26

Apos

134 bronze badges

1

vote

0answers

193 views

Modyfying PE file data section [duplicate]

I am a bit new to RE, so forgive me any weird or stupid questions. The app that I am currently working on has strings I need to modify in .data section. That's why Ollydbg doesn't allow me to copy ...

ollydbg pe strings

asked Apr 17 '16 at 18:25

blondkarol

111 bronze badge

2

votes

1answer

2k views

Need help with searching for reference for a string in IDA Pro [closed]

I have a little problem, i have loaded some firmware to IDA and it didn't analyze it correctly so i did located and tagged all the strings manyaly but it didn't helped me to find the references to ...

ida strings

asked Apr 16 '16 at 11:43

Igor.N

212 bronze badges

Questions tagged [strings]

Related Tags