-2

Just wondering what it means when in the visual display it shows invalid? Is that just a way of saying there is nothing at that address?

0x0003ce0c      ff             invalid
0x0003ce0d      ff             invalid
0x0003ce0e      ff             invalid
0x0003ce0f      ff             invalid
0x0003ce10      ff             invalid
0x0003ce11      ff             invalid
0x0003ce12      ff             invalid
0x0003ce13      ff             invalid
0x0003ce14      ff             invalid
0x0003ce15      ff             invalid
0x0003ce16      ff             invalid
0x0003ce17      ff             invalid
0x0003ce18      ff             invalid
  • 1
    There are 0xFF bytes at those addresses. It's rather clearly not "nothing". – usr2564301 Jan 24 '18 at 23:10
3

It simply means that the bytes, 0xff in your case, are not valid instructions.
So, to put it simply, it means that you are not looking at code. Try another offsets and sections.

Is that just a way of saying there is nothing at that address?

This does not mean that there's nothing there, it means that there are no valid instructions there. As you can see, these addresses at your paste contains "0xff" bytes.

  • 1
    I know IDA Pro can show db ?, which is also not "nothing" but not a defined byte either. Does radare2 do the same thing? If so, maybe you could add that, just for completeness. – usr2564301 Jan 24 '18 at 23:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.