Update
As pointed out by 0stracon there is an option in Hexrays that actually enables it to print all strings. Go to Hex-Rays Decompiler Analysis Options and untick ‘Print only constant string literals’.
To make it permanent, enable it in hexrays.cfg:
#define HO_CONST_STRINGS 0x0040 // Only print string literals if they reside // in read-only memory (e.g. .rodata segment). // When off, all strings are printed as literals. // You can override decompiler's decision by // adding 'const' or 'volatile' to the // string variable's type declarationHEXOPTIONS = 0x.... // Combination of HO_... bits
I was not aware of this option and reinvented the wheel
Old post
One of the features of IDA is its ability to recognize strings. This is a great feature, especially useful when you combine it with a power of HexRays decompiler – together they can produce a very nice pseudocode.
There is only one annoying bit there: if strings are recognized and defined inside a writable segment, they will not be presented by the decompiler as strings, but as variable names referring to strings.
Let’s have a look at the example.
In the below example (Dexter sample) IDA recognizes the string “UpdateMutex:”
(the ‘s__’ prefix comes from the string prefix I typically use i.e. ‘s->’ which decompiler ‘flattens’ to ‘s__’). The s__Updatemutex refers to a string as shown below i.e. “UpdateMutex:” :
This is exactly what the strings_to_const.py script is intended to do.
It enumerates all segments, finds all strings recognized by IDA (note the comment about the prefix I use, you may need to adapt it to your needs), and then converts them to read-only.
The result?
See below – before and after:
联系客服