How can I clean up/simplify strings that are built at runtime?I've seen this a couple of times and figured that there has to be something easier. I've been manually converting the characters to try and interpret what strings are being formed..text:0040166E C6 45 F0 5C   mov     [ebp+pszSubKey+2Ch], '\'.text:00401672 C6 45 F1 57   mov     [ebp+pszSubKey+2Dh], 'W'.text:00401676 C6 45 F2 69   mov     [ebp+pszSubKey+2Eh], 'i'.text:0040167A C6 45 F3 6E   mov     [ebp+pszSubKey+2Fh], 'n'.text:0040167E C6 45 F4 6C   mov     [ebp+pszSubKey+30h], 'l'.text:00401682 C6 45 F5 6F   mov     [ebp+pszSubKey+31h], 6Fh.text:00401686 C6 45 F6 67   mov     [ebp+pszSubKey+32h], 67h.text:0040168A C6 45 F7 6F   mov     [ebp+pszSubKey+33h], 6Fh.text:0040168E C6 45 F8 6E   mov     [ebp+pszSubKey+34h], 6Eh.text:00401692 C6 45 F9 5C   mov     [ebp+pszSubKey+35h], 5Ch
How can I clean up strings built at runtime?
ida;idapython
Finding Byte Strings using IDAPythonASERT MindshaRE solves this right. No need to actually run the code which isn't always possible.Effectively this script will go through instruction by instruction to find moves of ASCII characters into a memory location. It gets fancy and used QT to create an interactive table however you can gut out that part and just have it place a comment at the instruction that gets used.