Topic created on: April 20, 2008 06:20 CDT by tagetora .
Okay, let's say we have an exe with a large .text section (0x00400000 to 0x00750000), and it has a lot of unicode strings.
I noticed that using the default options in IDA Pro, the IDA kernel tends to interpret the unicode strings as offsets to code. I mean, if we have the "hello" unicode little endian string (68 00 65 00 6c 00 6c 00 6f 00), the kernel will see it as an offset to 0x00650068, then another offset to 0x006c006c, and so... of course all offsets pointed to code at .text so I understand why the IDA kernel is doing this way. The question is, is there any way to tell the kernel that unicode strings have priority over offsets?
The exe I was analyzing had about 80% of the unicode strings as offsets (wow). I was in a hurry so I solved it using a semi-intelligent buggy-script, but now I'm curious about what would be the right way ;D