Questions tagged [strings]
A chain of characters, usually used to store text messages lying statically in the program or to receive dynamically messages from the user.
65
questions
1
vote
1answer
57 views
Identify strings shared between multiple files from the Linux command line
Given a set of arbitrary files, what's the best way to identify the text strings shared between them (either in all files or a subset of them) from the Linux command line?
This would be useful for ...
1
vote
1answer
127 views
How to find encrypted strings in an executable?
I am trying to reverse engineer an executable.
I am using Process explorer to dump all strings present in the exe image, and from the process's RAM when it is running.
The two dumps return a ...
0
votes
0answers
20 views
“strings” command from *nix, but as a Java API?
Looking for the "strings" command from *nix, but as a Java API. Does such a library or JAR exist? I've automated calling the strings *nix command, but would like to explore reverse ...
0
votes
2answers
75 views
C++ hide string parameter for string viewer
bool isLaunched = CreateProcessW(
L"C:\\Windows\\System32\\Notepad.exe", // Should be shown in any string viewer or decompiler.
0x0,
0x0,
0x0,
TRUE,
0,
0x0,
...
1
vote
2answers
176 views
How to convert hexadecimal values to 16-bit Unicode in IDA Pro 7.5?
The context:
For a student project which goal is to make us learn reverse engineering and how to use IDA Pro, we have to reverse engineer the APT28 hospitality malware (as described in this blog post: ...
0
votes
0answers
45 views
Looking for encoding of SVG data
I have some SVG images stored in a database; but I am not able to find out which encoding is used.
Unfortunately, I don't have the exact SVG plain text available. The given examples "probably&...
0
votes
0answers
78 views
Relative/absolute addressing; RVA, ASLR, the relocation table and patching instructions
I've been trying to learn reverse-engineering for fun, cracking my own dummy games and whatnot and I just learned ASLR is a thing.
I'm now trying to re-conceptualize everything I've read so far ...
0
votes
0answers
73 views
How to find and edit the source of a string in a DX11 game's exe/files (debug build of the game available)
I want to find and edit the values for the motion blur effect in Naruto: Ultimate Ninja Storm 3 on PC (Windows, DX11) to be more in line with the PS3 version (and the other Storm games on PC as well). ...
0
votes
0answers
30 views
Is it posible to break at string when it being use by program?
Like the title, i need to break at an url string when it being used by program.
I try memory break point but it will break at begin of the section.
I use x64dbg.
8
votes
0answers
332 views
Extracting strings from Go binaries
Is there an easy way to extract all of the strings from Go binaries that will work cross architecture?
The problem with Go is that strings are stored without a null terminator so you can't use the "...
0
votes
0answers
32 views
Print Stacktrace when process read String
There is a process that prints HELLO , in Ida that simple to find it in Strings and watch with X-ref all the functions that read that strings.
There is an option to put a hardware breakpoint on this ...
0
votes
1answer
122 views
Replace string in hexa with a longer one in .bin without destroying the structure (in .data)
I would like to replace some hard-coded strings in a compiled exe (in .data) which is in chinese (with no possibility to put it in other languages).
I managed to replace strings in hexadecimal with ...
0
votes
1answer
55 views
Get string from function and pass it to another program
I want to make a small tool that analyzes text from console in online game and I'm stuck at reading a string from a function and sending it to another program. I managed to find function that takes ...
0
votes
1answer
101 views
In IDA's strings window, how to run MakeStrLit on all the selection
Ida allows to turn bytes into a string using the A shortcut
There is also this window to find strings :
You can press enter to jump to a specific string, but is it possible to run MakeStrLit on all ...
1
vote
1answer
41 views
How to determine what code created a string, in a live debugger session?
I'm using IDA 7 to debug a running application that must be a child of another application, which means I can't start it from IDA (using Debugger->Run). Instead, I have to run the application normally,...
0
votes
1answer
148 views
Abusing the strlen output
My question is related to the strlen function from the C and C++.
I am reversing a program, that reads a byte data from allocated memory and sends to the strlen directly. To be completely honest ...
0
votes
0answers
194 views
IDA free : How to find a string reference in .text
To begin with, I'd like to point out that I'm very new to this.
Here's the simple thing I'd like to do :
The program I want to mess around with displays a msgbox with the string "Please run the ...
2
votes
2answers
219 views
How to identify the encoding performed on this string
I have an old application that stores the username and password in plaintext but encoded by an unknown encoding algorithm to me, it seams like base64, but I think it's not,
It seams that any word ...
-1
votes
1answer
108 views
How to find who use these strings?
When i see function like this, im getting confused, because all the strings i need in this function, but how can i find which functions which this strings?
how can i know the address of the function ...
0
votes
1answer
160 views
Is there a way to export all the strings for a certain module in x64dbg?
I have an encrypted file that I was able to step through the code until that specific DLL file was decrypted in memory and I was able to list all of its strings. It has a ton of them that I would like ...
0
votes
1answer
180 views
How to view registers values in string
Is it possible that radare2 will show registers values also in strings ?
For example, when I run ar I am getting the liste of registers and I have:
rax = 0x000000042
Is there a way to also show ...
1
vote
1answer
262 views
Not able to find Hard coded strings in the mac executable file
I know that there is a string called "Activate your subscription" used in this particular app. But Im not able to find this string from its executable. I tried strings myapp and also searched for same ...
2
votes
1answer
190 views
obtaining string value from Unknown elf-x86-64 binary with gdb
I'm trying to find a string value stored in memory by a binary (possibly written in C) that won't show up when I perform "strings a.out". I have tried examining particular memory addresses of interest ...
2
votes
1answer
183 views
Find out string encoding/shift of proprietary binary file format
I'm trying to reverse-engineer a proprietary file format to be able to extract certain strings from files in this format. I have the application, that writes the files, at hand.
By trial-and-error I ...
2
votes
2answers
482 views
How can I view in-memory strings of a process on Linux (Ubuntu)?
On Windows, I can use tools like Process Explorer and Process Hacker to view in-memory strings generated at runtime of a given process. How can I accomplish this same task on Ubuntu?
2
votes
1answer
183 views
Why can I see certain strings when PE is opened with a hex editor or a simple static analysis tool but not with IDA?
I found the executable in question using VirusTotal "hunting" feature, where one can run Yara rules for the files existing in VT database and match the strings. I downloaded the file, opened ...
2
votes
1answer
377 views
How do you print fixed width strings with radare's print format `pf`?
Let's say I have a byte sequence where U is an unsigned int (4 bytes), and ccccccccccccccc is a 15 byte character array
UcccccccccccccccU
Is it possible to print this structure using pf? I can print ...
2
votes
1answer
559 views
IDA 7 does not recognize/reference Delphi 16bits Strings correctly
I am dabbling with a XE3 Delphi application in IDA 7.0, and can't get Strings representation to work correctly:
While selecting Delphi (16 bits) in the Strings Window yield correct results:
...
1
vote
1answer
112 views
Build Graph Printable String Information in ELF
I'm new in the field of reverse engineering to detect malicious code in ELF file. I used IDA Pro to retrieve a list of strings in an elf file. But I wonder if IDA can build a graph showing the link ...
2
votes
1answer
131 views
How can I generate the recovery password on a legacy system (Original company is out of business) running on my local machine?
I'm attempting to use a legacy systems recovery feature that typically required calling/faxing a company that is no longer around.
Basically, the system was designed to go into a recovery mode and ...
-1
votes
1answer
369 views
how to find the strings values in a comparision using ollydbg
In OllyDbg 1.10 (assembler level deubugger) I can find all referenced text strings
The program compare if a user input string is equal a internal string.
When I debug the program, I can't find the ...
2
votes
1answer
347 views
Hex-Rays function signature does not match demangled name
From the demangled name, I know that a function takes an std::string const& as a parameter but when generating psuedo-c code with Hex-Rays' decompiler it autodetects the parameters as (int a1, int ...
2
votes
1answer
137 views
What other methods can be used to find file paths in an executable?
I'm hacking a game in my library (Mirror's Edge) to re-route where the save data is located. I've done this with many other games successfully, but this one has me stumped. Normally, I start with HxD ...
1
vote
1answer
729 views
I'm would like to view this malicious payload, but am having trouble decoding it
This is a gzip compressed base64 string. I tried decoding it with an online converter but it said the data was corrupt. Can anyone decode this?
H4sIAAAAAAAAAL1X6W6jyBb+...
2
votes
1answer
426 views
Dolphin Emulator Android port modifications
I am modifying the Dolphin Emulator Alpha for android, but I'm having some trouble with a string in it's smali code. The value I am having trouble with is dolphin-emu, it is the name of the folder ...
2
votes
2answers
422 views
How can I identify how this string is being encoded so I can replicate it?
A friends company uses an old VB6 application to generate encoded strings to then use in their also old and out of date database system.
They have the application running in standalone mode so I can ...
1
vote
1answer
132 views
Is it possible to make a string bigger on an executable without breaking it?
I am a new reverse enigneerer. I know I can patch strings using a hex editor, but I obviously can't add or remove a single byte. Is there any workaround that will let me make a... let's say, 10 byte ...
3
votes
2answers
286 views
Problem with converting hex values to decimal
I'm reverse-engineering custom binary file format. I'm using 010 Editor to check this file. I found data structure to represent UTF-8 strings, which has header section of one or two bytes in length ...
4
votes
1answer
1k views
GDB find string strange results
I'm playing with gdb and strange things are happening. I wanted to find some address in memory where string "/bin/sh" is located, and gdb says it found it. But when I examine the memory there, the ...
4
votes
2answers
381 views
Cannot locate a variable on the stack
I am unable to locate a variable on the stack. I'm using Fedora 25 x64 but with a 32 bit program, btw.
C program:
#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>
#...
1
vote
2answers
8k views
OllyDbg: How to set conditional breakpoint on a register value?
I want to set a breakpoint when the register EAX references a specific Unicode string, e.g. "Enter". In Ollydbg there is usually right beside the EAX value a string that says "ASCII: Enter ".
I read ...
0
votes
2answers
179 views
Identifying a very weak hash algorithm
I'm reverse-engineering a string translation file format for a particular game. It's ultimately just an ID-to-string map, where the IDs are four-byte integers. There are 1935 IDs in total; you can see ...
0
votes
1answer
351 views
Using HEX editor and making 4 chars from 3 chars [closed]
I need to replace a single string in a bin. The actual string has 3 chars and the new one must have 4.If I use a hex editor this will make the exe useless.So is there any way to add bytes there to ...
3
votes
1answer
479 views
How to find address of more complicated, unknown data structures
I am trying to read messages from a (32bit windows application) chat window. Unfortunately, the window has a custom class, therefore GetWindowText() doesn't help. I need to read the data from memory ...
1
vote
4answers
1k views
XMPP clubs in league of legends
Hopefully I'm asking this at the right place. League of legends recently added the option to join a club. Clubs still use the XMPP protocol just like before for their public chat rooms: XMPP for ...
1
vote
0answers
184 views
Modyfying PE file data section [duplicate]
I am a bit new to RE, so forgive me any weird or stupid questions.
The app that I am currently working on has strings I need to modify in .data section. That's why Ollydbg doesn't allow me to copy ...
2
votes
1answer
1k views
Need help with searching for reference for a string in IDA Pro [closed]
I have a little problem, i have loaded some firmware to IDA and it didn't analyze it correctly so i did located and tagged all the strings manyaly but it didn't helped me to find the references to ...
3
votes
1answer
266 views
Is this a known encoding or cipher? (multiplayer game network traffic)
I'm trying to decode chat strings in a multiplayer game's network traffic; the way it encodes them is seemingly some arbitrary encoding. I've been analyzing the UDP traffic to the server with ...
2
votes
2answers
180 views
What compression algorithm could have generated these strings?
To what kind of compression algorithm could the following sentences belong to?
AxFWR:YRCtIPns<_o%p_=Q>LELBM
AxFWRPA:cXe#<InM=L:Mthwekblc
AxFWREFEp`f?PU`;K;M:;P?MDMCL
AxFWRW%VK>Hk]...
4
votes
2answers
4k views
Can't find “referenced string” in OllyDBG
So I am trying to reverse a program but I am not able to find any of the Strings through searching for "referenced Strings" or "binary Strings", I am new to OllyDBG and I don't know a lot about it, ...
