-1

enter image description here

i am beginner in reverse engineering. i want to understand where the variables and it's size are stored inside an windows executable file.

somehow i can able to find the values of variables i declared inside a c program.

as you can see in 00402000 the bar variable's value is stored.
but i can't find where the variable name "bar" and it's size is stored.

In data section values only get stored. In which section i can find variable names and it's sizes?
then i have another doubt as you can see in the picture there is some address like 00402000. is it the address of a byte which exist in harddrive?
like RAM , HardDisk also an has address for each byte?

2

In data section values only get stored.

Yes, that is how it works. Information about variables such as name, size and type are high-level language concepts. Such information is lost when code written in a high-level language is compiled into machine code. This is part of the reason why reverse engineering binary executables can be challenging.

Read the answers to this question: how data types and variables are converted to machine code?

The bit width of a value (half-word, word, double word, etc) can sometimes be inferred from the read/write operations performed on it; if it is written from memory into a register, you can look at the size of the register. eax is 32 bit, al is 16 bits, etc.

To locate statically allocated variables, disassemble the function(s) in which they are accessed. Pointers (memory addresses) to these variables will be operands in instructions that access these values.

In your case this means disassembling main(). Since nothing is done with the variables in main() other than reassignment, it is possible that the compiler did not generate any code referencing these variables (dead code elimination).

then i have another doubt as you can see in the picture there is some address like 00402000. is it the address of a byte which exist in harddrive?

This is an address in virtual memory. Read more about this here:

Linux example: http://duartes.org/gustavo/blog/post/anatomy-of-a-program-in-memory/

https://stackoverflow.com/questions/2170843/va-virtual-address-rva-relative-virtual-address

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.