-1

There is some DCD data in a disassembled binary using IDA as shown the image description. The binary is an ELF of ARM processor type. I want to know what are these data? Is it possible they be code which IDA could not disassembled? enter image description here

1 Answer 1

2

That is the ELF header from your executable, and IDA is aware that there is no practical use to disassemble it as if it's code.

See The 101 of ELF Binaries on Linux: Understanding and Analysis in case you don't know what an "ELF header" is or if you want to know the meaning of every single byte in the header you show.

More generally speaking, IDA automatically tries to determine what parts are code and data, but it may fail on both. Data that gets treated as code will usually contain undefined bytes – these will appear as literal dcd bytes among seemingly valid disassembled instructions. (And on close inspection, those "instructions" are usually nonsensical.)

Code that gets treated as data is more difficult to spot, especially if there are no obvious references into it. With sufficient experience, one may be able to recognize certain hex sequences as "most likely code"; in that case, instruct IDA to disassemble such a sequence and see what it produces.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.