I'm new to reverse engineering with IDA.
If dd is short for data, double-word, is a 32-bit value. It shows ?
How do I identify the value stored in dword_140007674?
-
See this answer.– MarianDMar 15 at 18:13
Add a comment
|
1 Answer
It's simply the common way to state that this is a double word (32 bit integer, signedness isn't as much a concern at this level) with unknown value.
See here for an overview. The summary for the most common ones is:
db- byte (8 bit integer)dw- word (16 bit integer)dd- double word (32 bit integer)dq- quad word (64 bit integer)
The ? denotes that this value is unknown and will only be known at runtime. And example of this are variables inside an uninitialized data section.
If you start a debug session with IDA, the address will eventually contain some value. But since you use static analysis without running the code, there is no information what value it will contain.
And you can't know the value during static analysis. This is one of the big limitations of static (not running the code) versus dynamic (running the code) analysis.
