Posted: Fri Dec 20, 2019 9:20 am Post subject: Can someone explain how Referenced Strings works?
So I let the code dissector run and it spits out a huge list of strings, each associated with some function call.
But where do these strings actually reside? What is the relationship between that string and the code that it's pointing to?
I'm trying to use Reference Strings as a starting point to figure out which function calls are handling the behavior I want to look at. But its not really clear to me how the string is related to the code it's pointing to.
Some of the strings even seem to contain variables, for example: "file_version=%d" or "user_profile=%s". If I could figure out how those variables are being filled in it would be hugely useful.
Joined: 25 Jan 2006 Posts: 8585 Location: 127.0.0.1
Posted: Sat Dec 21, 2019 12:50 am Post subject:
Referenced strings are just pointers that CE has found to be used by the actual code of the given application/module. A quick example of this, say you have a basic C++ program like this:
Here the main function references a string "Hello world!\r\n". If you run the dissector on this app it should find that string as a reference and show the main function as what uses/references it.
For variable based strings such as "file_version=%d", you can use the referenced function information to trace back to the call that uses the string and see how it is being used. In my example above, you would see a call to printf in this case which uses the referenced string directly. _________________
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum