Hot answers tagged

2 votes

How to change string-detection rule in IDA Pro?

You should open your IDA's cfg\ida.cfg file and look for the StrlitChars definition inside it. That configuration variable controls which characters are considered legitimate string characters when ...
  • 11.4k
2 votes

Why does Ghidra show no references to any strings?

My problem was that the boot loader code gets loaded into SRAM, which has a base address of 0x20000. So that means the code can access data based at 0x0 and also the same data starting at offset ...
  • 151
2 votes
Accepted

Strange DWORD/QWORD C++ Strings in decompilation

This is a standard method for the C and C++ compilers to build static strings directly on the stack. This method will be used by the compiler when compiling this code: #include <cstdio> int ...
  • 136
1 vote

Need help with this .tbl file

Based on the limited knowledge and references on strings I was able to extract some of the fields - most of which don't make sense like Member(anim_id=1, anim_name=22821, name_len=4, loop=65536, ...
  • 2,399
1 vote
Accepted

IDA: String referenced in Assembly, but not shown in string view

Right-click in the strings window, choose "Setup", and ensure that, under "Allowed string types", "Unicode C-style (16 bits)" is enabled:
  • 8,004
1 vote

x64dbg is unable to find string references vs. Ollydbg

Okay I finally accidentally found it ;) I just had to click on "Find pattern" on the memory dump window and I found the same function as Olly !
1 vote

Extracting strings from Go binaries

I just read a good article on the challenges with Go binaries: https://cujo.com/reverse-engineering-go-binaries-with-ghidra/ I think this could be classed as a "cross-architecture solution" ...

Only top scored, non community-wiki answers of a minimum length are eligible