> For the complete documentation index, see [llms.txt](https://docs.hex-rays.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.hex-rays.com/add-ons/malware/how-tos/recover-a-stack-string.md).
# Recover a Stack String
This how-to shows how to recover a string that is decrypted on the stack at runtime, using Isolated System Emulation.
{% hint style="info" %}
This how-to uses `d77e3ce835fdc84c8f286736309a1130008d39a03a7043ca078ca9ad4ac1f3e5` (`xorstr-nopdb.exe`), a non-malicious test executable, to demonstrate the feature.
{% endhint %}
## Prerequisites
* IDA Pro 9.5 or later with the Malware Analysis add-on installed. See [Getting Started](/add-ons/malware/getting-started.md).
* Download the sample to follow along:
{% file src="/files/OqMJYpZNJ1fsFyAIeUAS" %}
## Recover the string
1. Decompile the `main` function. You can see a string being constructed on the stack and decrypted:
```c
int __fastcall main(int argc, const char **argv, const char **envp)
{
__m128 v3; // xmm0
__m128 v5; // [rsp+30h] [rbp-50h]
__m128 v6; // [rsp+40h] [rbp-40h]
char Buffer[16]; // [rsp+50h] [rbp-30h] BYREF
__m128 v8; // [rsp+60h] [rbp-20h] BYREF
*(_QWORD *)Buffer = 0x8CD836CFBE21A90CuLL;
*(_QWORD *)&Buffer[8] = 0xC0D7C25B984E168AuLL;
v8.m128_u64[0] = 0xF81FD713D4EBC1C9uLL;
v8.m128_u64[1] = 0x7C0AC6C1772DBDE6LL;
v5.m128_u64[0] = 0xE9F842AACC42CC5FuLL;
v5.m128_u64[1] = 0xA4B2B62BE13C75E4uLL;
v6.m128_u64[0] = 0x9D78B660A78EACE9uLL;
v3 = _mm_xor_ps((__m128)_mm_load_si128((const __m128i *)Buffer), v5);
v6.m128_u64[1] = 0x7C0AC6C1772DBDE6LL;
v8 = _mm_xor_ps((__m128)_mm_load_si128((const __m128i *)&v8), v6);
*(__m128 *)Buffer = v3;
puts(Buffer);
return 0;
}
```
2. To recover this string, use [Isolated System Emulation](/add-ons/malware/concepts/isolated-system-emulation.md#configuration). Click the **Start isolated system emulator** button in the toolbar to start it.
This lands you at the executable entry point:
3. The string gets decrypted while `main` runs, so you can set RIP directly to that point.
Press G to navigate to `main`. At the start of the function, right-click and choose **Set IP** (Ctrl+N):
Set RIP to the start of main so that the function initializes its stack frame properly.
4. From there, step (F7) or run (F4) to the call at `0x1400010E0` to `puts`. The decrypted string appears on the stack:
## What's next?
To run the same steps headlessly from a script, see [Emulate Code from an idalib Script](/add-ons/malware/how-tos/emulate-code-from-idalib.md).
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.hex-rays.com/add-ons/malware/how-tos/recover-a-stack-string.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.