0

enter image description here

There is a large continuous, memory region as shown above in IDA disassembly which has got the same address for every possible address. Is the disassembly incorrect? How do I interpret one single row?

DCB "0000000000000000 l df *ABS*",9,"0000000000000000 gic.c",0xA

The row above doesn't seem to be continuous data even. How are the columns (space/tab and comma separated) significant? I can locate the following column values:

  • DCB
  • 0000000000000000
  • 1
  • df
  • *ABS*
  • 9
  • 0000000000000000
  • gic.c
  • 0xA

2 Answers 2

2

It's just a single (very long) text string. Look at the dcb and double quotes; unprintable characters are included outside the double quotes, in hex.

Presumably there is a zero-terminator at the very end, which is how IDA Pro identified it as a string: all it contains are printable characters, plus the characters Tab and LF.

It's broken up at the linefeeds so it is slightly better readable, but that's for display only. If you press the * "Define array" key somewhere inside this, you will see it's indeed a single long array of bytes.

The starting address is only repeated for your convenience. "The" address of a larger structure is in general the address of its first byte.

1

This is a structure recognized automatically by IDA. Structures are displayed like that, IDA bundles the different values of the structure sequentially and displays the starting address of the entire structure for all values of it. If you'll hit the plus (+) key IDA will spread the structure across multiple lines, displaying extra details about each member of the structure.

2
  • Pressing the + key doesn't do anything. But how come all the structures start from the same address?
    – sherlock
    Commented Jan 13, 2017 at 17:27
  • I might be wrong about the key shortcut. This is a single structure and every member is listed with the address of the structure's start address.
    – NirIzr
    Commented Jan 13, 2017 at 17:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.