PDA

View Full Version : How are C strings accessed???


rebible
May 5th, 2012, 21:48
I am trying to find the offset of some code. I can see the output string tables that the compiler left. How do C compilers normally access the strings.

thanks
robert

disavowed
May 5th, 2012, 23:14
C compilers/linkers parse strings in source code and put them into data sections as multi-byte or wide-char arrays, depending on the source code and compiler options.

rebible
May 6th, 2012, 21:26
I don't understand something. People seem to use strings to find the code offsets. If the compiler just uses the string locations in-line, I am not sure I see anyway to use them to your advantage.

I was hoping that there would be an index table or ...


thanks
robert

owl
May 10th, 2012, 09:02
I think what you want is to look at the strings in order to find a msg or hardcoded pwd, URLs, or license key. In IDA, go to the strings tab. In Ollydbg, right-mouse-click on the main window (code), pick "search for" ->"All reference text strings".

TBone
May 10th, 2012, 14:50
To be a little more nuts-and-bolts, C references strings by their starting address. As Disavowed said, strings whose content is known at compile time are usually found in a/the data section. The program's code will be found in the code section (sometimes called the text section, confusingly enough). When the code needs to access a string, it will reference its address one way or another.

A picture is worth 1000 words. Here's a bit of disassembly from IDA free of "dia-app.dll" from the windows binary of the open source diagramming tool, Dia (http://projects.gnome.org/dia/). Suppose I want to find where in the program it displays the "About" dialogue. One of the things it displays there is "A program for drawing structured diagrams." If you take a look in the .rdata section, you'll find this string:

Code:
.rdata:10042334 aComments db 'comments',0 ; DATA XREF: sub_100049AA+CDo
.rdata:1004233D align 10h
.rdata:10042340 aAProgramForDra db 'A program for drawing structured diagrams.',0
.rdata:10042340 ; DATA XREF: sub_100049AA+BFo
.rdata:1004236B align 4

And the corresponding hex dump:
Code:
.rdata:10042330 44 69 61 00 63 6F 6D 6D 65 6E 74 73 00 00 00 00 Dia.comments....
.rdata:10042340 41 20 70 72 6F 67 72 61 6D 20 66 6F 72 20 64 72 A program for dr
.rdata:10042350 61 77 69 6E 67 20 73 74 72 75 63 74 75 72 65 64 awing structured
.rdata:10042360 20 64 69 61 67 72 61 6D 73 2E 00 00 63 6F 70 79 diagrams...copy


The string starts at virtual address 0x10032340. IDA is kind enough to inform us that there is a reference to this string somewhere in a subroutine located at 0x100049AA. Sure enough, if we follow that reference we find this in the .text (code) section:

Code:

.text:10004A3C push offset aTranslatorCred ; "translator-credits"
.text:10004A41 push offset off_1005F3D0
.text:10004A46 push offset aDocumenters ; "documenters"
.text:10004A4B push offset off_1005F330
.text:10004A50 push offset aAuthors ; "authors"
.text:10004A55 push offset aHttpLive_gnome ; "http://live.gnome.org/Dia"
.text:10004A5A push offset aWebsite ; "website"
.text:10004A5F push offset aC19982009TheFr ; "(C) 1998-2009 The Free Software Foundat"...
.text:10004A64 push offset aCopyright ; "copyright"
.text:10004A69 push offset aAProgramForDra ; "A program for drawing structured diagra"...
.text:10004A6E call libintl_gettext
.text:10004A73 add esp, 4
.text:10004A76 push eax
.text:10004A77 push offset aComments ; "comments"
.text:10004A7C push offset a0_97_2 ; "0.97.2"
.text:10004A81 push offset aVersion ; "version"
.text:10004A86 push offset aDia_0 ; "Dia"
.text:10004A8B push offset aName ; "name"
.text:10004A90 mov ecx, [ebp+var_C]
.text:10004A93 push ecx
.text:10004A94 push offset aLogo ; "logo"
.text:10004A99 push 0
.text:10004A9B call gtk_show_about_dialog

Yep, that looks like code for showing the About dialog, all right.

In this case, the address of the "A program for drawing..." string is pushed onto the stack as an argument to function call to the libintl_gettext function, which obviously does something with text. My guess from the name is that Dia is an "internationalized" program, and this function fetches translated strings for whatever language you happen to using, if not English.

Anyway, if we "zoom in" on that push, you can see exactly how this reference works:

Code:
.text:10004A60 78 23 04 10 68 6C 23 04 10 68 40 23 04 10 E8 65 x#hl#h@#Fe
.text:10004A70 AA 03 00 83 C4 04 50 68 34 23 04 10 68 CC 19 04 .-Ph4#h


Starting at address 0x1004A69 we have this instruction:
Code:
68 40 23 04 10

The first byte (0x68) is an x86 opcode that means to push a 4-byte value on the stack. The following 4 bytes are the data pushed onto the stack. The contain the address:
0x10042340 (Intel is big-endian). Scroll back and you'll see this is the starting address of the "A program for drawing...".

Olly's disassembly looks a little different from IDA's, but the information is the same. Finding key-checking code by following the strings uses the same logic. If the program displays a message like "Program registered!" or "Bad key. Try again.", these strings will probably be reference immediately after the code checks whether the entered key is valid. It isn't always quite that straight-forward, but in a lot of cases, it will at least get you in the right neighborhood.

proc-self-maps
May 13th, 2012, 10:50
Quote:
[Originally Posted by TBone;92544]Starting at address 0x1004A69 we have this instruction:
Code:
68 40 23 04 10

The first byte (0x68) is an x86 opcode that means to push a 4-byte value on the stack. The following 4 bytes are the data pushed onto the stack. The contain the address:
0x10042340 (Intel is big-endian).


Minor nitpick: x86 is little-endian, and that is a little-endian representation of 0x10042340.

Civa
June 24th, 2012, 07:01
Quote:
The string starts at virtual address 0x10032340.


There is typo, address should be 0x10042340.