I'm new to reverse engineering with IDA.
If dd
is short for data, double-word, is a 32-bit value. It shows ?
How do I identify the value stored in dword_140007674
?
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this communityI'm new to reverse engineering with IDA.
If dd
is short for data, double-word, is a 32-bit value. It shows ?
How do I identify the value stored in dword_140007674
?
It's simply the common way to state that this is a double word (32 bit integer, signedness isn't as much a concern at this level) with unknown value.
See here for an overview. The summary for the most common ones is:
db
- byte (8 bit integer)dw
- word (16 bit integer)dd
- double word (32 bit integer)dq
- quad word (64 bit integer)The ?
denotes that this value is unknown and will only be known at runtime. And example of this are variables inside an uninitialized data section.
If you start a debug session with IDA, the address will eventually contain some value. But since you use static analysis without running the code, there is no information what value it will contain.
And you can't know the value during static analysis. This is one of the big limitations of static (not running the code) versus dynamic (running the code) analysis.