0

I've been doing some reverse engineering lately trying to improve my skills and came across the following bytes on the start of .rdata segment.

Filename: C:/cygwin64/bin/xkbcomp.exe

Bytes:

70 D3 FD FF 50 D3 FD FF  28 D3 FD FF 00 D3 FD FF
E0 D2 FD FF B8 D2 FD FF  90 D2 FD FF 68 D2 FD FF
48 D2 FD FF 30 D2 FD FF  18 D2 FD FF F8 D1 FD FF
D0 D1 FD FF B0 D1 FD FF  90 D1 FD FF 78 D1 FD FF
58 D1 FD FF 30 D1 FD FF  08 D1 FD FF F0 D0 FD FF
D0 D0 FD FF B0 D0 FD FF  A0 D3 FD FF 00 00 00 00
56 61 6C 75 65 20 6F 66  20 25 73 20 66 69 65 6C
64 20 6D 75 73 74 20 62  65 20 6F 66 20 74 79 70

Note: There had been other DLL files that contained similar data.

As you may have noticed, the ASCII characters start on line 7 after 4 null bytes. As per my knowledge, .rdata segment is meant to contain read-only data, but the initial number of bytes makes no sense to me.

Can anyone tell me what this is, and why is it there?

Improve this question

2 Answers 2

Reset to default
1

it appeared to be some sort of switch data since you haven't provided much details I googled for the binary and found one.

:\>file xkbcomp64.exe
xkbcomp64.exe: PE32+ executable (console) x86-64, for MS Windows

:\>certutil -hashfile xkbcomp64.exe MD5 | grep -iv hash
aba2c2755017f4d11bf99964e87f4427

whose .rdata start contains differnt bytes

:\>dumpbin /section:.rdata xkbcomp64.exe
Microsoft (R) COFF/PE Dumper Version 14.16.27045.0
Copyright (C) Microsoft Corporation.  All rights reserved.


Dump of file xkbcomp64.exe

File Type: EXECUTABLE IMAGE

SECTION HEADER #3
  .rdata name
    A7C0 virtual size
   22000 virtual address (0000000100422000 to 000000010042C7BF)
    A800 size of raw data
   20800 file pointer to raw data (00020800 to 0002AFFF)
       0 file pointer to relocation table
       0 file pointer to line numbers
       0 number of relocations
       0 number of line numbers
40600040 flags
         Initialized Data
         RESERVED - UNKNOWN
         RESERVED - UNKNOWN
         Read Only

  Summary

        B000 .rdata

actual data at .rdata start location

:\>xxd -s 0x20800 -g 4 -l 0x100 xkbcomp64.exe
00020800: 63796767 636a2d31 362e646c 6c005f4a  cyggcj-16.dll._J
00020810: 765f5265 67697374 6572436c 61737365  v_RegisterClasse
00020820: 73000000 00000000 00000000 00000000  s...............
00020830: 00000000 00000000 00000000 00000000  ................
00020840: 62f3fdff 42f3fdff 22f3fdff 00f3fdff  b...B...".......
00020850: e0f2fdff b4f2fdff 92f2fdff 70f2fdff  ............p...
00020860: 52f2fdff 41f2fdff 30f2fdff 14f2fdff  R...A...0.......
00020870: f0f1fdff d0f1fdff b0f1fdff 91f1fdff  ................
00020880: 74f1fdff 50f1fdff 23f1fdff 10f1fdff  t...P...#.......
00020890: f0f0fdff d0f0fdff 90f3fdff 00000000  ................
000208a0: 56616c75 65206f66 20257320 6669656c  Value of %s fiel
000208b0: 64206d75 73742062 65206f66 20747970  d must be of typ
000208c0: 65202573 0a004163 74696f6e 20257320  e %s..Action %s
000208d0: 64656669 6e697469 6f6e2069 676e6f72  definition ignor
000208e0: 65640a00 696e7465 67657220 2872616e  ed..integer (ran
000208f0: 67652031 2e2e3829 00000000 00000000  ge 1..8)........

since i could see the pattern you posted at offset 0x40 from start of .rdata i tossed it into ghidra to look if this is referenced somewhere and obviously it is referenced as switch data

 switchD_100401109::switchdataD_100422040     XREF[2]:     FUN_1004010f0:1004010f9(*), 
                                                           FUN_1004010f0:100401102(R)  
   100422040 62 f3 fd ff            uint     FFFDF362h
   100422044 42 f3 fd ff            uint     FFFDF342h
   100422048 22 f3 fd ff            uint     FFFDF322h
   10042204c 00 f3 fd ff            uint     FFFDF300h
   100422050 e0 f2 fd ff            uint     FFFDF2E0h
   100422054 b4 f2 fd ff            uint     FFFDF2B4h

function that is referencing this Switchdata

**************************************************************
                         *                          FUNCTION                          *
                         **************************************************************
                         undefined * __fastcall FUN_1004010f0(uint param_1)
         undefined *       RAX:8          <RETURN>
         uint              ECX:4          param_1
 FUN_1004010f0                                XREF[5]:     FUN_100401410:10040141e(c), 
                                                           FUN_100401570:100401587(c), 
                                                           FUN_100401810:100401827(c), 
                                                           10040373a(c), 10042e03c(*)  
   1004010f0 83 f9 16               CMP      param_1,0x16
   1004010f3 0f 87 f9 02            JA       LAB_1004013f2
             00 00
   1004010f9 48 8d 05 40            LEA      RAX,[switchD_100401109::switchdataD_100422040]        = FFFDF362h
             0f 02 00
   100401100 89 c9                  MOV      param_1,param_1
   100401102 48 63 14 88            MOVSXD   RDX,dword ptr [RAX + param_1*0x4]=>switchD_100401109  = FFFDF362h
   100401106 48 01 d0               ADD      RAX,RDX
 switchD_100401109::switchD
   100401109 ff e0                  JMP      RAX

EDIT

these are the offsets in my binary as posted above

00020840: 62f3fdff 42f3fdff 22f3fdff 00f3fdff  b...B...".......
00020850: e0f2fdff b4f2fdff 92f2fdff 70f2fdff  ............p...
00020860: 52f2fdff 41f2fdff 30f2fdff 14f2fdff  R...A...0.......
00020870: f0f1fdff d0f1fdff b0f1fdff 91f1fdff  ................
00020880: 74f1fdff 50f1fdff 23f1fdff 10f1fdff  t...P...#.......
00020890: f0f0fdff d0f0fdff 90f3fdff 00000000  ................

the code based on param_1 value (0 to 16) will jump to the resultant location of script below

LEA      RAX,100422040 
MOVSXD   RDX,dword ptr [RAX + param_1*0x4] 
ADD      RAX,RDX
JMP      RAX

jump addresses

>>> import ghidra
>>> staddr = getMemoryBlock(".rdata").start.add(0x40)
>>> for i in range(0,16,1):
...         hex((currentProgram.getMemory().getInt(staddr.add(i*4)))+ staddr.offset)
... 
'0x1004013a2L'
'0x100401382L'
'0x100401362L'
'0x100401340L'
'0x100401320L'
'0x1004012f4L'
'0x1004012d2L'
'0x1004012b0L'
'0x100401292L'
'0x100401281L'
'0x100401270L'
'0x100401254L'
'0x100401230L'
'0x100401210L'
'0x1004011f0L'
'0x1004011d1L'

switch case 0 to 4 as screen shot

enter image description here

Improve this answer
3
  • by switch do you mean the switch statement, as in switch(blah): case; case; default?
    – Neehack
    Commented Nov 22, 2021 at 0:03
  • yes these are the indexes or entries in the jump table used like address + (index * ptr(.rdata[i])) so if index is 0 it will result in address + (-0xff,,,,362). being the resolved location i have posted the relevent function in my answer for the googled binary
    – blabb
    Commented Nov 22, 2021 at 3:45
  • i edited the answer and added further details take a look
    – blabb
    Commented Nov 22, 2021 at 14:17
0

The first bytes are indeed a jump table for a switch, and the string constants start after an alignment padding:

.rdata:0000000100424000             _rdata          segment align_32 public 'DATA' use64
.rdata:0000000100424000                             assume cs:_rdata
.rdata:0000000100424000                             ;org 100424000h
.rdata:0000000100424000 42 D3 FD FF+jpt_1004010A9   dd offset loc_100401342 - 100424000h
.rdata:0000000100424000 22 D3 FD FF+                                        ; DATA XREF: fieldText+9↑o
.rdata:0000000100424000 02 D3 FD FF+                                        ; fieldText+12↑r
.rdata:0000000100424000 E0 D2 FD FF+                dd offset loc_100401322 - 100424000h ; jump table for switch statement
.rdata:0000000100424000 C0 D2 FD FF+                dd offset loc_100401302 - 100424000h
.rdata:0000000100424000 94 D2 FD FF+                dd offset loc_1004012E0 - 100424000h
.rdata:0000000100424000 72 D2 FD FF+                dd offset loc_1004012C0 - 100424000h
.rdata:0000000100424000 50 D2 FD FF+                dd offset loc_100401294 - 100424000h
.rdata:0000000100424000 32 D2 FD FF+                dd offset loc_100401272 - 100424000h
.rdata:0000000100424000 21 D2 FD FF+                dd offset loc_100401250 - 100424000h
.rdata:0000000100424000 10 D2 FD FF+                dd offset loc_100401232 - 100424000h
.rdata:0000000100424000 F4 D1 FD FF+                dd offset loc_100401221 - 100424000h
.rdata:0000000100424000 D0 D1 FD FF+                dd offset loc_100401210 - 100424000h
.rdata:0000000100424000 B0 D1 FD FF+                dd offset loc_1004011F4 - 100424000h
.rdata:0000000100424000 90 D1 FD FF+                dd offset loc_1004011D0 - 100424000h
.rdata:0000000100424000 71 D1 FD FF+                dd offset loc_1004011B0 - 100424000h
.rdata:0000000100424000 54 D1 FD FF+                dd offset loc_100401190 - 100424000h
.rdata:0000000100424000 30 D1 FD FF+                dd offset loc_100401171 - 100424000h
.rdata:0000000100424000 03 D1 FD FF+                dd offset loc_100401154 - 100424000h
.rdata:0000000100424000 F0 D0 FD FF+                dd offset loc_100401130 - 100424000h
.rdata:0000000100424000 D0 D0 FD FF+                dd offset loc_100401103 - 100424000h
.rdata:0000000100424000 B0 D0 FD FF+                dd offset loc_1004010F0 - 100424000h
.rdata:0000000100424000 70 D3 FD FF                 dd offset loc_1004010D0 - 100424000h
.rdata:0000000100424000                             dd offset loc_1004010B0 - 100424000h
.rdata:0000000100424000                             dd offset loc_100401370 - 100424000h
.rdata:000000010042405C 00 00 00 00                 align 20h
.rdata:0000000100424060             ; const char s[]
.rdata:0000000100424060 56 61 6C 75+s               db 'Value of %s field must be of type %s',0Ah,0
.rdata:0000000100424060 65 20 6F 66+                                        ; DATA XREF: ReportMismatch+18↑o

Because the jump table itself does not change depending on input data, it is effectively read-only and can be placed into .rdata

Improve this answer
3
  • can you please tell me what this jump table and switch is? is it something to do with some function in .code/.text segment?
    – Neehack
    Commented Nov 21, 2021 at 23:42
  • or do you mean the switch statement as in switch(n): case; case case;
    – Neehack
    Commented Nov 22, 2021 at 0:01
  • @Neehack yes, see the function fieldText() in the source code (action.c)
    – Igor Skochinsky ♦
    Commented Nov 24, 2021 at 21:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.