1

I have recently been trying to improve my skills on reverse engineering. So, I opened C:/Windows/System32/DriverStore/FileRepository/xboxgip.inf_amd64_90ed6b3fdc759a5b/devauthe.sys in IDA. While playing around the file, I came across the following bytes under .data segment:

00 00 00 00 00 00 00 00  00 00 00 00 32 A2 DF 2D
99 2B 00 00 CD 5D 20 D2  66 D4 FF FF 01 00 D2 8B
0A 35 60 BD F1 C9 D6 5D  6C 59 51 D5 24 FD 02 F5
43 26 29 79 53 3E B0 FB  2B 97 BF 5E FC 20 02 00
54 B4 F2 54 77 D2 99 71  BD 9C 0B 85 C9 D0 29 BE
85 AD 6B CB D7 CA 71 D4  AB 28 DB FA 1A 0E E0 9F
03 00 B0 EB 26 B7 F4 68  74 C7 34 F0 18 10 26 20
01 BB 63 6E F6 20 E2 3B  D7 7B D1 1A B4 6D 33 BA
6B 4B 5C D0 0D 95 6B 2F  CF 0D 53 C5 AE AC 03 87
23 9B A4 BE 5D 70 E1 26  19 06 56 49 79 E6 7C 1A
71 20 D0 11 C1 D8 7C 61  44 3A 47 B2 9E 8E 44 AB
2E 42 EB 59 B0 3B F1 9C  B1 66 4F A3 DA 37 1F 30
5B 7E FF E5 FC 87 00 00  00 00 00 00 C9 57 84 41
69 9B 06 7E C1 14 C5 CA  C1 56 B7 8F 71 48 4A FC
08 1D A5 E6 C9 DB F6 53  A6 15 78 5F F4 46 C1 48
76 3B DF 9B 84 5B A3 49  5C 46 B5 D1 66 81 8A 53
E5 EC 02 85 02 2C 4B 24  61 9E 3C 2A A5 28 4D 85
F7 A6 25 45 B4 4D EC FD  A0 CD AB 01 8D B3 71 07
DA 93 06 6E D6 37 A1 16  EF 74 E1 A6 BC E0 CE E7
D4 02 C9 C1 40 5B CD 3B  9A 62 84 39 E8 40 3D 13
20 E2 1A B6 3C D3 E6 7A  C6 F3 27 B4 6D 66 5B 8D
52 81 06 0F 3C BC F3 1C  05 90 77 67 8B 99 FD 00
04 AD 27 E9 1D B5 68 B2  21 A6 0D A5 81 C0 53 C9
99 B4 ED F1 11 D0 01 91  59 A8 ED 80 BA 82 86 62
CF 3D 94 70 C3 1C 50 9E  C6 95 6D 57 17 0F 95 DA
14 38 76 38 09 E7 D5 0C  3E 89 2F 5D DF F4 D6 31
C1 26 02 9C 30 0B EE 28  A7 86 74 A3 46 8F B7 85
FA 8C 0F BB 79 65 A5 AD  C9 12 BA CF 43 64 CC 62
A0 30 3F AE 88 06 40 86  EF 27 CA 93 52 53 41 32

Looking at the bytes, it doesn't seem to be ASCII strings, neither does it look to be code, since disassemblers fails on certain bytes. I understand my question might be a bit vague, but can anyone tell me what this is?

Improve this question

1 Answer 1

Reset to default
0

In the .data segment are generally — as it name suggest — simply data.

Data are not only ASCII strings, but other data, too. For example, integers and floating-point numbers. They are encoded as sequences of bits, and are preferably displayed — as in your question — in the form of hexadecimal symbols.

Knowing nothing about their meaning, we may conclude nothing about values which they represent. Even nothing about the start and end position of individual piece of data.

For example, let's take the left half of your 3rd row: 0A 35 60 BD F1 C9 D6 5D. What is its meaning:

  • 8 bytes?
  • 4 words?
  • 2 double-words?
  • 4 bytes and 1 double-word?
  • etc., etc., ...

Even if we know that they are 2 double-words, what they represent? Integers or floating-point numbers? If integers, signed or unsigned ones? And so on.

It means that in the .data segment may be everything. Nothing is suspicious, if you have no other information.

Improve this answer
3
  • would you know how to tell if they are either Integers or floating-points? I was assuming that they need to be null-terminated, but with your example on left 3rd row, there is no null byte before or afterward. of does integers and floating-points don't need to be null-terminated?
    – Neehack
    Commented Nov 27, 2021 at 22:57
  • No null-termination is required for integers or floating-point numbers. (BTW, it doesn't matter in the context of your question.)
    – MarianD
    Commented Nov 28, 2021 at 9:15
  • What should I do when someone answers my question?
    – MarianD
    Commented Nov 28, 2021 at 10:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.