Click to See Complete Forum and Search --> : String References


Bengi
July 9th, 2002, 05:45 AM
hi all,
i am trying to doa little app which will read an EXE file and look at the ".text" section for all strings references the progeam uses.
i mean,i want to display all strings that it uses, but the thing is that when u read from an exe file u acn't determine the lenght of the string becuz u read it like a vector of bytes, i.e:
sd Hello World @#$df which in hex its: 73 64 20 48 65 6C 6C 6F 20 57 6F 72 6C 64 20 20 40 23 24 64 66

my app need to display "Hello World" and not the garbage before, also note some string can come after the "hello world" which i need to display as well.
i hope u can help me figure it out, thnx
ben

Elrond
July 9th, 2002, 06:28 AM
I don't think there is a way. The best is probably to "guess" what a string is: It is a succession of at least N letters, numbers and spaces. It will very rarely happen than plain binary code will contain, say, more than 5 letters in a row.

Once you get that, may be you can accept a few more isolated characters included in a string (there is letters, numbers and spaces before and after). Some characters like #,=,.... And then you also need to include punctuation (.,,,?,!, ...).

I guess you have to write your own rules and try them to see if you get a good result.

Whatever happen, it will never be perfect, and you will probably miss a few strings (if they are just a short word), cut some other in two strings (if they contain some special characters) and include one or two pieces of binary code.

I'd be interested if you have a better solution.

If you want to improve the result, you can also use a dictionnary, the only problem with this being that some strings may contains special word (like the program name) that will not be in any dictionnary.

Bengi
July 9th, 2002, 06:31 AM
check Win32Dasm app, it gives Perfec String References, thats how i try to do it.
yeah i know about the missing words, than how win32dasm do it?...weird indeed
anybody with some sulotions??

cup
July 9th, 2002, 07:16 AM
There is a Unix utility call strings that prints out all printable strings. There might be a windows version that will do the same thing.

Graham
July 9th, 2002, 07:46 AM
I remember that - I used it once to find the wizard password in Rogue. It was the only to complete the blasted game!

Bengi
July 9th, 2002, 07:54 AM
hhe, but i still need to code such string finder er..

jfaust
July 9th, 2002, 10:24 AM
Graham,

Rogue? Boy you must be old. All us modern people played nethack. Superior graphics, better sound. It's almost like your there!

Jeff

cup
July 9th, 2002, 02:23 PM
nethack didn't have sound when I played it. It had the kitchen sink though.

I still play rogue and advnture (PC version).

jfaust
July 9th, 2002, 05:46 PM
Actually, I was thinking of Angband or ZAngband, a Nethack derivative, which has very primitive, repetetive, annoying sounds. Regardless, I was poking fun at those ridiculously addicting games.

Jeff