0

enter image description here

There is a large continuous, memory region as shown above in IDA disassembly which has got the same address for every possible address. Is the disassembly incorrect? How do I interpret one single row?

DCB "0000000000000000 l df *ABS*",9,"0000000000000000 gic.c",0xA

The row above doesn't seem to be continuous data even. How are the columns (space/tab and comma separated) significant? I can locate the following column values:

  • DCB
  • 0000000000000000
  • 1
  • df
  • *ABS*
  • 9
  • 0000000000000000
  • gic.c
  • 0xA
2

It's just a single (very long) text string. Look at the dcb and double quotes; unprintable characters are included outside the double quotes, in hex.

Presumably there is a zero-terminator at the very end, which is how IDA Pro identified it as a string: all it contains are printable characters, plus the characters Tab and LF.

It's broken up at the linefeeds so it is slightly better readable, but that's for display only. If you press the * "Define array" key somewhere inside this, you will see it's indeed a single long array of bytes.

The starting address is only repeated for your convenience. "The" address of a larger structure is in general the address of its first byte.

| improve this answer | |
1

This is a structure recognized automatically by IDA. Structures are displayed like that, IDA bundles the different values of the structure sequentially and displays the starting address of the entire structure for all values of it. If you'll hit the plus (+) key IDA will spread the structure across multiple lines, displaying extra details about each member of the structure.

| improve this answer | |
  • Pressing the + key doesn't do anything. But how come all the structures start from the same address? – Holmes.Sherlock Jan 13 '17 at 17:27
  • I might be wrong about the key shortcut. This is a single structure and every member is listed with the address of the structure's start address. – NirIzr Jan 13 '17 at 17:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.