0

What are these things I marked in red circles on the screenshot?

enter image description here

In this program which i tried to disassemble there are 1427 of them.

Is there any other application to view it in a better way ?

  • Please give this question with a bit more descriptive title – Paweł Łukasik May 19 '18 at 13:44
  • what is your question? We're not mind readers. Please be more specific and fix the title. – Igor Skochinsky May 19 '18 at 17:55
  • Edited the question , i hope there is more clarity now – wikilol May 19 '18 at 20:13
  • 1
    Please don't edit the entire question. If you have another question, please open a new post. If you want to clarify your question, please add your editions to the original post without deleting its content. – Megabeets May 20 '18 at 7:09
4

These are functions in the binary that were detected by IDA.

These names are automatically generated by IDA and are not part of the binary's symbol table. The automatically generated names usually have one of the following prefixes followed by their corresponding virtual address: sub_, loc_, byte_, word_, dword_ and unk_.

In your case, sub_* are subroutines, functions.

To quote from the IDA docs:

Dummy names are automatically generated by IDA. They are used to denote subroutines, program locations and data.

Dummy names have various prefixes depending on the item type and value:

sub_ : instruction, subroutine start
locret_ : 'return' instruction
loc_ : instruction
...
...

| improve this answer | |
  • Thanks Megabeets , I think i read your website few hours ago , i think it was about radare2 :) – wikilol May 19 '18 at 14:11
  • 1
    "sub" is actualy from "subroutine". not "submodule" – Igor Skochinsky May 19 '18 at 17:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.