0

I don't know why but I noticed, on some program I am reversing, that in a section named .bss, there functions and I can't find them through the regular search, why is that.

For example, I wanted to search for _mainScene but it found me only one functioned named newMainScene:
enter image description here

EDIT:
A friend show me that I can search with Shift+4 in IDA for the names in .bss.

3
  • dd? Is normally a pointer and not a function
    – blabb
    Commented Oct 24, 2020 at 12:34
  • What is dd ? I know it only from WinDBG as a command. Or you meant ds, data segment? Is there a way to search in this?
    – E235
    Commented Oct 24, 2020 at 13:49
  • dd? = uninitialized dword it is there in your screen shot see the address 0x44ddac and around they are all a placeholder or a pointer i dont under stand what you want to search
    – blabb
    Commented Oct 24, 2020 at 14:26

1 Answer 1

2

You are not looking at functions that you can't reach, but at unassigned variables.

As you said, you are looking at the .bss section. From Wikipedia, the .bss section is

the portion of an object file, executable, or assembly language code that contains statically-allocated variables that are declared but have not been assigned a value yet.

IDA is showing you this with the dd opcode. As @blabb point out, this is an uninitialized dword, which mean a dword that was not assigned yet. Exactly what is supposed to be in the .bss section !

Theses variables don't have any hardcoded default values, so they are placed in this section of the binary, waiting to be populated at runtime with dynamic values.

What you can do is to write down the address of the variable that you want to find more about, open up a debugger, let it run a bit (or you can break on a specific function if you know where this variable is being populated), and check the content of this variable by looking at the previously written memory address.

You'll know what type of data is supposed to be inside this variable !

Don't forget to deactivate the ASLR while running the binary (otherwise the address that you saw in IDA would not match naything), or if needed, to rebase your program in IDA.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.