Reversing rodata

Question

I'm playing with an ELF binary to learn IDA, and I'm not sure how to interpret what I'm seeing..

A function calls this:

v1 = MList[2 * result];

When I look at MList, it looks like this:

public MList
MList          dd 12Fh
dd offset M1
db  30h ; 0
db    1
db    0
db    0
offset M2
db  31h ; 1
db    1
db    0
db    0
dd offset M3
db  32h ; 2
db    1
db    0
db    0
...

Each of the M*s looks like this:

public M2
M2 db  0Ch
db    0
db    0
db    0
db    1

So what exactly is MList? I'm guessing some kind of global table or something, but I can't make heads or tails of what it is. What would this be in regular C code?

Answer 1

MList seems to be an array of 8-byte structures. Observe how it contains:

1. a dword (4 bytes)
2. an offset (4 bytes)
3. 4 bytes
4. an offset
5. (repeat)

So it's probably something like:

struct mlist_item
{
 int  number;
 int  *arr; 
};

mlist_item MList[];

Answer 2

The notation is an access of array member.
Without more context deciphering the type of MList would be a guess game.
MList could be int, byte, char, pointer, or some other complex type.

So for example it could be int MList[0x10] and accessing this with a variable expression 2* result where value of result is "1" would yield every second member of the array.

v1 = MList[0x10} = {0,1,2,3,,,,16};

with result = 1 so MList[2*result] == MList[2] == 2; and so v1 in this case would be 2.

From the looks of data MList appears to be a structure so first you need to decipher the type and modify the data MList before guessing the result of v1.