Igor’s tip of the week #72: More string literals

We’ve covered basics of working with string constants (aka string literals) before but IDA support additional features which may be useful in some situations.

Exotic string types

Pascal and derived languages (such as Delphi) sometimes employ string literals which start with the length followed by the characters. Similarly to the wide (Unicode) strings, they can be created using the corresponding buttons in the Options > String literals… dialog or the Edit > Strings submenu.

Some OS or embedded firmware can employ a byte other than 0 as string terminator. When analyzing such binary, you can set this up in the Options > General…, Strings tab (also accessible via Options > String literals…, “Manage defaults” link.

As a common variation of this type, DOS type strings (terminated with the $ character) have their own entry in the Edit > Strings menu.

Changing string length

For already-created string literals, you can use the * shortcut to edit them as if they were an array and adjust “Array size” to change the length of the string.

See also:

Unicode strings and custom encodings

How to format multiple strings placed together.

 

Article Link: Igor’s tip of the week #72: More string literals – Hex Rays