Exetools

Exetools (https://forum.exetools.com/index.php)
-   General Discussion (https://forum.exetools.com/forumdisplay.php?f=2)
-   -   IDA can't properly deal with RUST strings (https://forum.exetools.com/showthread.php?t=19889)

WhoCares 07-06-2021 11:18

IDA can't properly deal with RUST strings
 
RUST strings are not zero-terminated, so there is no delimiter for two strings which are in a consecutive memory region.

RUST compiler/linker puts many constant strings in the ".rodata" segment.

Currently IDA can't properly handle this. It needs to be updated, e.g. adding RUST compiler type(no stable ABI) and RUST string literal type. Or writing some plugins to do this.

TQN 07-07-2021 11:04

You can try with this Rust reversing helper
https://github.com/cha5126568/rust-reversing-helper

WhoCares 07-08-2021 00:28

thank u for the info.

This python script uses "idaapi.create_strlit(addr, len, get_inf_attr(INF_STRTYPE))" to create string literals.

get_inf_attr(INF_STRTYPE) returns the current string literal type.
But RUST string literal doesn't match any of the known string literal types of IDA.

The string length is hard-coded in a MOV instruction, usually moved to a register like ESI.

Quote:

Originally Posted by TQN (Post 123359)
You can try with this Rust reversing helper
https://github.com/cha5126568/rust-reversing-helper


TQN 07-08-2021 10:46

Thanks WhoCares
IDA and create_strlit function can create a NON NULL Terminated string.
The len parameter in create_strlit function specifies the length of the string, not necessary to include NULL char
Best regards,


All times are GMT +8. The time now is 12:12.

Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2021, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX