-1

I've open wsl.exe in IDA v7. With Tab key I open pseudocode of sub_1400129F4 like this:

__int64 sub_1400129F4(__int64 a1, __int64 a2, __int64 a3, __int64 a4, ...) {
......

v8 = (__int64 *)sub_140011A40();
}
  • The assembly of sub_140011A40():
sub_140011A40 proc near
lea     rax, unk_14001C2B0
retn
sub_140011A40 endp
  • The pseudo code of sub_140011A40():
void *sub_140011A40() {
  return &unk_14001C2B0;
}
  • The .data sections shows this:
.data:000000014001C2AE                 db    0
.data:000000014001C2AF                 db    0
.data:000000014001C2B0 unk_14001C2B0   db    0                 ; DATA XREF: sub_140011A40↑o
.data:000000014001C2B1                 db    0
.data:000000014001C2B2                 db    0
.data:000000014001C2B3                 db    0
.data:000000014001C2B4                 db    0
.data:000000014001C2B5                 db    0
.data:000000014001C2B6                 db    0
.data:000000014001C2B7                 db    0
.data:000000014001C2B8 unk_14001C2B8   db    0                 ; DATA XREF: sub_140011A48↑o
.data:000000014001C2B9                 db    0
.data:000000014001C2BA                 db    0
  • Question: What is the unk in that pseudo code or in that assembly? Does it hold the values of eight zeros from .data section?
  • post the assembly too interpreting a pseudo interpretation without context is tedious unk means unknown (may be someone writes there during runtime ?? and it is unknown at the moment does assembly say mov eax, qword [unk] – blabb Mar 9 '18 at 19:53
  • so it is clear lea returns 14001C2B0 not the 0 lea is a speacial kind of move instruction that moves the address not the contents so v8 = 14001C2B0 – blabb Mar 9 '18 at 20:06
  • 2
    forget the unk it is a label and it has no meaning in c or d or go it is a name given by ida to that specific address try pressing d on the address the unk will change to byte , press d again it will beome word press d again it will become dword etc etc the code would be appromiximately v8 = &foo() – blabb Mar 9 '18 at 20:28
1
lea rax , unk___xxx 
ret 

means the function returns the address not the contents

lea (load effective address ) is a special kind of mov instruction that load the address not the contents

the unk is a label ida could not decipher the type so it labelled the address as unk (possibly short form for unknown)

if you select that address and press d ida will replace the unk with byte if you press d again ida will rename the byte to word etc etc

basically from your pseudo code

the result would be v8 = &foo()

a screen shot where ida wasn't sure what the type was for a CRITICAL_SECTION pointer manually applying the structure to the address

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.