IDA Unicode String Anylist and comment maker

早在很久之前就写过一个导入Unicode字符串注释的脚本,但是脚本操作还是有自己的局限性。每次都要通过其他的分析工具搜索定位到字符串,然后导出,在然后倒入。这是多么蛋疼的时间事情啊。 😎

Augusta Ada King, Countess of Lovelace (10 December 1815 – 27 November 1852), born Augusta Ada Byron, was an English writer chiefly known for her work on Charles Babbage’s early mechanical general-purpose computer, the analytical engine. Her notes on the engine include what is recognised as the first algorithm intended to be processed by a machine; thanks to this, she is sometimes considered the “World’s First Computer Programmer”
She was the only legitimate child of the poet Lord Byron (with Anne Isabella Milbanke). She had no relationship with her father, who died when she was nine. As a young adult, she took an interest in mathematics, and in particular Babbage’s work on the analytical engine. Between 1842 and 1843, she translated an article by Italian mathematician Luigi Menabrea on the engine, which she supplemented with a set of notes of her own. These notes contain what is considered the first computer programme — that is, an algorithm encoded for processing by a machine. Though Babbage’s engine has never been built, Lovelace’s notes are important in the early history of computers. She also foresaw the capability of computers to go beyond mere calculating or number-crunching while others, including Babbage himself, focused only on these capabilities.


// Refresh our window contents
static void refresh_window(ea_t ea)
  qfree(text);                            // destroy the old string contents
  text = NULL;
  if ( isASCII(get_flags_novalue(ea)) )   // is an ascii string constant?
    long stype = get_str_type(ea);        // string type
    if ( stype == ASCSTR_UNICODE          // is unicode string?...
      || stype == ASCSTR_ULEN2
      || stype == ASCSTR_ULEN4 )
      int delta = 0;
      if ( stype == ASCSTR_ULEN2 )
        delta = 2;
      if ( stype == ASCSTR_ULEN4 )
        delta = 4;
      size_t size = get_item_size(ea);
      if ( size > delta )
        size -= delta;
        text = (wchar_t *)qalloc(size*sizeof(wchar_t));
        if ( text != NULL )
        { // get string contents from the database
          get_many_bytes(ea+delta, text, size);
          text[size/2] = '\0';
          // if the window was not created, do it now
          if ( hwnd == NULL )
  if ( hwnd != NULL )              // our window exists only if a unicode string
  {                                // has been encountered
    SetWindowTextW(th, text);
//    RECT r;
//    GetClientRect(hwnd, &r);
//    InvalidateRect(hwnd, &r, true);
  must_refresh = false;                   // we did refresh the window

如果到ida解析完的数据库中查看对应的字符串就会发现,数据的前缀为unk,也就是未识别的数据格式,而插件处理的数据格式的时候会首先调用 isASCII判断是否是字符串,通常这种情况会直接导致调用时候返回了,因为ida并没有解析出正确的数据格式。所以这个插件也就识别不了什么中文了。

即使得到的是字符串,那么对于字符串类型也仅限于 ASCSTR_UNICODE, ASCSTR_ULEN2 , ASCSTR_ULEN4三种,同样这个过滤会导致无法识别unicode。所以最有效的办法就是直接从ea处读取unicode字符串,然后自己转换。相关的代码这里就不贴鸟,还有关键性的字符串搜索的代码没有完成。真是蛋疼啊,蛋疼。 :p



所有在我的机器上能显示的字符已经都可以显示了,并且和源程序显示的是一样滴。 🙂





  1. 为啥我的6.3显示:

    IDA is analysing the input file…
    You may start to explore the input file right now.
    UniCodeString @h4ck.wS: could not load plugin

    1. 我现在用的还是6.2 ,6.3下可能有不兼容的情况,具体的我也不太清楚。不好意思。呵呵


您的电子邮箱地址不会被公开。 必填项已用*标注