如何更改 IDA Pro 中的字符串检测规则?

逆向工程 艾达 拆卸 字符串
2021-07-05 13:44:57

我想调试包含大量 C 字符串的固件(基于 ARM)。IDA Pro 7.2 似乎在检测包含特殊字符(7 位 ASCII 以上)的字符串时出现问题。这是西班牙语单词“navegación”的一个例子,其中包含一个变音符号“o”:

MAIN:0007AE4D                 DCB 0x4E ; N
MAIN:0007AE4E                 DCB 0x61 ; a
MAIN:0007AE4F                 DCB 0x76 ; v
MAIN:0007AE50                 DCB 0x65 ; e
MAIN:0007AE51                 DCB 0x67 ; g
MAIN:0007AE52                 DCB 0x61 ; a
MAIN:0007AE53                 DCB 0x63 ; c
MAIN:0007AE54                 DCB 0x69 ; i
MAIN:0007AE55                 DCB 0xF3
MAIN:0007AE56                 DCB 0x6E ; n
MAIN:0007AE57                 DCB    0

您会看到 0xF3 是有效的 ASCII 字符(ISO Latin-1),但 IDA 未将其检测为有效字符。如果我现在在第一个字母上按“a”(或者让 IDA 进行字符串检测),我会得到这样的结果:

MAIN:0007AE4D aNavegaci       DCB "Navegaci"
MAIN:0007AE55                 DCB 0xF3
MAIN:0007AE56                 DCB 0x6E ; n
MAIN:0007AE57                 DCB    0

它看到的字符就好像它是一个字符串终止字符。我怎样才能让 IDA 至少忽略这些特殊字符,而只依靠我的设置以 C 样式(0x00 终止)显示字符串?

1个回答

您应该打开您的 IDAcfg\ida.cfg文件并查找其中的StrlitChars定义。该配置变量控制在将地址/数组转换为字符串时哪些字符被视为合法字符串字符。

以使用的格式添加您选择的字符并重新启动 IDA。

配置变量上方的注释非常简单,因此遵循它应该不是问题:

// the following characters are allowed in strings, i.e.
// in order to find end of a string IDA looks for a character
// which doesn't belong to this array:
// Note about CURRENT_CULTURE:
//  - if the IDB's default encoding for 1-byte/symbol strings, is not
//    UTF-8, a "culture" will be derived from it. E.g., "windows-1252"
//    will yield culture "Latin_1".
//  - this cannot be done automatically for UTF-8, since UTF-8 covers
//    the whole Unicode codepoints space.
//  - regardless of whether a "culture" can be derived from the default
//    encoding or not, this can be overridden by the CULTURE configuration
//    property (see below)
//  - the CURRENT_CULTURE directive tells IDA to consider all
//    codepoints that are defined as part of that culture, as valid
//    in the string literals.
//  - this applies to codepoints >= 0x80
//  - a "culture" refers to the name of a .clt file in the cfg/ directory.
//    E.g., "Latin_1" will correspond to the "Latin_1.clt" file.
//    In this case, the culture will contain all codepoints specified by
//    the file.
//    (It is worth pointing out that a culture file can, itself, include
//    other culture file(s))

以及官方 IDA 文档