2

I have a Ghidra question for you. I am disecting an executable binary and I am noticing a TON of data types that are clearly Unicode in the "Listing" Pane but are showing up as unknown Bytes.

I am aware that I can click on the first address and then select "Data" > "TerminatedUnicode" but there are hundreds of these bytes that need to be converted to Unicode.

Is there an automated way to perform this tedious task?

Data in Byte Format instead of Unicode

Manually casting individual Byte Data Types to Unicode

Stryker2k2
  • 108
  • 9

1 Answers1

4

That should just be a fairly simple script, basically just createUnicodeString(Address) and getUndefinedDataAfter(Address) in a loop. The tricky part is deciding when to actually stop, but if you know when this memory range ends, that's just a simple additional check. Handling padding/alignment will be another slight pitfall, but it should be enough to repeat getUndefinedDataAfter until the current address isn't a null byte

Florian Magin
  • 576
  • 3
  • 6
  • Interesting. I've give it a shot! I'll "accept" the answer once I get a good a half-decent script written up. – Stryker2k2 Jul 11 '22 at 14:28