Hexrays CFSTR can't detect if raw string point inside string

IDA General
1

look at stru_ABF0A0 can’t detect because point inside string aAudioformatdes_33+35h

cfstring:0000000000ABF080 stru_ABF080 __CFString <offset __CFConstantStringClassReference, 7C8h,
cfstring:0000000000ABF080 offset aCCCC08x, 0Dh> ; “%c%c%c%c:%08X”

cfstring:0000000000ABF0A0 stru_ABF0A0 __CFString <offset __CFConstantStringClassReference, 7C8h,
cfstring:0000000000ABF0A0 offset aAudioformatdes_33+35h, 8> ; “%c%c%c%c”

if ( a3 )
return CFStringCreateWithFormat(a1, 0LL, CFSTR(“%c%c%c%c:%08X”), v3, BYTE2(a2));
else
return CFStringCreateWithFormat(a1, 0LL, &stru_ABF0A0, v3, BYTE2(a2));

can you fix this ?

2

Best way to get such issues fixed is to open a ticket on support.hex-rays.com and attach a sample binary.

3

does this support work only for users who bought ida or for others too?

4

Your reference is SUPPORT-4876

5

Thank you! It seems your sample is an ELF file for Linux. Currently our Objective-C support mostly covers iOS and macOS. We’ll check this one but it won’t be high priority.

6

P.S. as a temporary workaround, it seems using a split string literal works:

.rodata:0000000000043668 aBlock          db 'Block'              ; DATA XREF: cfstring:stru_24D960↓o
.rodata:000000000004366D aWidth          db 'Width',0            ; DATA XREF: cfstring:stru_24C940↓o

This seems to produce both CFSTR("BlockWidth") and CFSTR("Width").

7

how split literal to use ?

yes binary ELF linux
because i cant have macOS access

raw pointer into string
seems should be avail for any cases
isn’t ?

8

undefine the big string, then create two shorter ones (use selection for the first part).

1 Like