In IDA what does db and dd offset means in data section?

Question

So, in .data section there is some variable, and after it there is db or dd (offset). What exactly does this mean? And what does “align” means? Is there any Wiki or something like that that tells all this in detail?

    .data:0048A374                 db    0
    .data:0048A375                 db    0
    .data:0048A376                 db    0
    .data:0048A377                 db    0
    .data:0048A378 off_48A378      dd offset unk_48A000    ; DATA XREF: start+41↑o
    .data:0048A37C                 dd offset unk_48A1CE
    .data:0048A380                 dd offset unk_48A1CE
    .data:0048A384                 dd offset unk_48A33C
    .data:0048A388 byte_48A388     db 1                    ; DATA XREF: __InitVCL+3↑r
    .data:0048A389                 align 10h
    .data:0048A390                 dd offset WinMain
    .data:0048A394                 dd offset __matherr
    .data:0048A398                 dd offset __matherrl
    .data:0048A39C                 align 10h
    .data:0048A3A0                 dd offset unk_48F66C
    .data:0048A3A4                 dd offset off_490784
    .data:0048A3A8                 dd offset off_490788
    .data:0048A3AC                 dd offset __handle_setargv
    .data:0048A3B0                 dd offset __handle_exitargv
    .data:0048A3B4                 dd offset __handle_wsetargv
    .data:0048A3B8                 dd offset __handle_wexitargv
    .data:0048A3BC                 dd offset dword_48F0EC
    .data:0048A3C0 byte_48A3C0     db 0                    ; DATA XREF: ___CRTL_VCL_Init_2+2↑r
    .data:0048A3C0                                         ; __InitVCL+17↑r
    .data:0048A3C1 byte_48A3C1     db 0                    ; DATA XREF: .text:00401060↑r
    .data:0048A3C1                                         ; ___CRTL_VCL_Init_2+B↑r ...
    .data:0048A3C2                 dd offset unk_4906E4
    .data:0048A3C6                 dd offset unk_4907AC
    .data:0048A3CA                 dd offset unk_4904F0
    .data:0048A3CE                 db    0
    .data:0048A3CF ; DWORD dwTlsIndex
    .data:0048A3CF dwTlsIndex      dd 0                    ; DATA XREF: start:loc_401012↑r
    .data:0048A3CF                                         ; .text:00401082↑r ...
    .data:0048A3D3 dword_48A3D3    dd 0                    ; DATA XREF: start+1A↑w
    .data:0048A3D7 dword_48A3D7    dd 0                    ; DATA XREF: start+4D↑w
    .data:0048A3D7                                         ; .text:__getHInstance↑r ...
    .data:0048A3DB                 db  90h ; ђ
    .data:0048A3DC ; Exported entry 156. ___CPPdebugHook
    .data:0048A3DC                 public ___CPPdebugHook
    .data:0048A3DC ___CPPdebugHook db    0                 ; DATA XREF: start+E↑o
    .data:0048A3DC                                         ; sub_46AF30+20↑o ...
    .data:0048A3DD                 db    0
    .data:0048A3DE                 db    0
    .data:0048A3DF                 db    0

Answer 1

• db means “define byte”, i.e. a reservation of 1 byte of memory,
• dw means “define word” (2 bytes of memory),
• dd means “define double-word” (4 bytes of memory).

The offset prefix means to fill the reserved byte(s) not with the mentioned data itself (i.e., not with the content), but only with the offset to it (i.e., with the position of data in memory, expressed as the number of bytes from the beginning of the segment).

The align directive means “If this address is not a multiple of the given number, skip the necessary number of bytes to fulfill this address requirement for the next data”.

---

You may see it in your listing:

• db 1 is at address 0048a388, it occupies only 1 byte (db – define byte, i.e., 1 byte) and fills it with the given value (1). So the next address is 0048a389.

• At this next address (0048a389) is the align 10h directive, so the byte at this address and the subsequent 6 bytes at addresses

  • 0048a38a, 0048a388b, 0048a38c, 0048a38d, 0048a38e, and 0048a38f

  are skipped, because they don't fulfill the request “a multiple of 10h” (i.e., their last digit in hexadecimal notation is not 0).

• At the next address 0048a390 (which finally fulfills the align 10h requirement) is the directive

  • dd offset WinMain,

  which reserves 4 bytes of memory (dd – define double word), and fills them with the offset of the (start of) WinMain function (offset WinMain).