0

I have the following instruction in IDAs Decompiler:

result = data[3 * a1] + ptr;

and would like to know what is at the position if a1=60.

So I have to look at data[180]. Unfortunately all I see there is

.rodata:EDDCCB10          data   dd 0, 10001h, 2 dup(1), 10001h, 1, 2, 10001h, 1, 3, 10001h
.rodata:EDDCCB10                 dd 1, 4, 10001h, 1, 5, 10001h, 1, 6, 10001h, 1, 7, 10001h
.rodata:EDDCCB10                 dd 1, 8, 10001h, 1, 0Ch, 10004h, 1, 10h, 10004h, 1, 14h
.rodata:EDDCCB10                 dd 10004h, 1, 18h, 10004h, 1, 1Ch, 10004h, 1, 20h, 10004h
.rodata:EDDCCB10                 dd 1, 24h, 10004h, 1, 28h, 10004h, 1, 2Ch, 10010h, 1, 3Ch
.rodata:EDDCCB10                 dd 10040h, 1, 7Ch, 10006h, 1, 82h, 10001h, 1, 84h, 10078h

Of course I could just count 180 elements, but is there really no better way to know whats behind data[180] so I can look what the offset bases on ptr is?

0

There is. Move the cursor to data and press *. Uncheck Use "dup" construct and select Display indexes option. You'll get something like this: enter image description here

  • Thanks, very helpful! – Roman Jul 11 at 18:51
  • You are welcome. – bart1e Jul 11 at 18:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.