Igor’s tip of the week #39: Export Data

Malware Analysis
1

The  Edit > Export Data command (Shift+E) offers you several formats for extracting the selected data from the database:

  • hex string (unspaced): 4142434400
  • hex string (spaced): 41 42 43 44 00
  • string literal: ABCD
  • C unsigned char array (hex): unsigned char aAbcd[] = { 0x41, 0x42, 0x43, 0x44, 0x00 };
  • C unsigned char array (decimal): unsigned char aAbcd[] = { 65, 66, 67, 68, 0 };
  • initialized C variable: struc_40D09B test = { 16961, 17475 };
    NB: this option is valid only in some cases, such as for structure instances or items with type information.
  • raw bytes [can be only saved to file]
501×593

Data in the selected format is shown in the preview text box which can be copied to the clipboard or saved to a file for further processing.

 

 

Article Link: Igor’s tip of the week #39: Export Data – Hex Rays