memoryjs icon indicating copy to clipboard operation
memoryjs copied to clipboard

How do I read a UTF16 string from a program?

Open TreeOfSelf opened this issue 4 years ago • 2 comments

Can't seem to figure it out .

TreeOfSelf avatar Apr 23 '20 00:04 TreeOfSelf

Currently this library only really supports UTF-8 (well, ASCII). You could take a look at the code if you want to give it a go yourself. Basically right now the library reads one byte at a time at the given memory address until it encounters a null terminator, and treats every byte it encounters as a char. If you know how UTF16 strings are stored in memory (specifically, what type of UTF16 you are targeting) you should be able to easily edit the method for how strings are read.

In JS the current method is basically just:

const chars = [];
let offset = 0x0;
while (true) {
  const char = readMemory(handle, address + offset);
  
  if (char === '\0') break; // null terminator, end of string

  chars.push(char);
  offset += 1; // size of 1 char
}

const string = chars.join('');

To read UTF16, it would most likely involve reading 2 bytes at a time instead of just one (but then processing those 2 bytes into 1 char, and it could be either little endian or big endian). I would happily implement support for more string types into the library, I am just not sure where to find a good resource as a basis (that defines all string types, how to determine the endianness, etc).

Rob-- avatar Apr 28 '20 10:04 Rob--

You can also use memoryjs.readBuffer to read a buffer if you know the size

ex


    var buff = memoryjs.readBuffer(handle, address, 8*2)
    var text = buff.toString("utf16le")
    console.log(text)

8 here is the length of the string, and its 2 bytes per character (8*2) you can switch utf16le with other supported formats

  • utf8

  • utf16le

  • latin1

  • base64

  • hex

  • ascii

  • binary

  • ucs2

In my case there is a byte in memory I am also reading that contains the length of the string so this works great for me. If you don't know the length you can read in 2 bytes at a time until you hit the term code for the implementation the program you are reading from uses. In my case it has a 0x00 0x00 at the end of the string.

rs28083 avatar May 03 '20 14:05 rs28083