Skip to content

Instantly share code, notes, and snippets.

@cursey
Last active July 19, 2019 01:52
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save cursey/346c65182f6543b25b602f56b59204ab to your computer and use it in GitHub Desktop.
Save cursey/346c65182f6543b25b602f56b59204ab to your computer and use it in GitHub Desktop.
Fix strings in IDA for Mabinogi dumps (original author @Tachiorz)
from idautils import *
from idaapi import *
START_EA = 0x0297FAF3 # Set this to the start of data containing strings
END_EA = 0x032FA562- 4 # Set this to the end - 4
def is_string(start_ea):
strlen = 0
ea = start_ea
# Determine the length of the potential string.
while True:
buffer = bytearray(get_bytes(ea, 2))
if buffer[0] != 0 and buffer[1] == 0:
strlen += 1
elif buffer[0] != 0 and buffer[1] != 0:
# Doesn't appear to be a string we care about.
return None, ea
ea += 2
if buffer[0] == 0 and buffer[1] == 0:
break
# If the strings long enough and can be decoded, return the result.
try:
if strlen >= 3:
buffer = bytearray(get_bytes(start_ea, ea - start_ea))
return buffer.decode("utf-16"), ea
except:
pass
# Couldn't be decoded as utf-16 so we don't care about it.
return None, ea
def main():
print "Looking at {:08x} .. {:08x}".format(START_EA, END_EA)
ea = START_EA
count = 0
while ea < END_EA:
# Only look for named addresses.
name = get_name(ea)
if name is None or name == "":
ea += 1
continue
# Only look for addresses that appear to be strings.
content, content_end_ea = is_string(ea)
if content is None or content == "":
ea = content_end_ea + 1
continue
# Print the string.
try:
print "{:08x} {:08x} {}".format(ea, content_end_ea, content.encode("ascii"))
except:
pass
# Delete any named addresses contained within our string and create the string
# literal.
del_items(ea, 0, content_end_ea - ea)
create_strlit(ea, content_end_ea - ea, STRTYPE_C_16)
ea = content_end_ea
main()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment