2

Yes, mov DWORD PTR 40[rsp], 6 is the same as mov DWORD PTR [rsp + 40], 6. The first syntax makes a lot more sense in cases where the constant is the base address of an array, and the register contains a byte offset into that array. That's the use case the syntax was designed for.


2

You are not looking at functions that you can't reach, but at unassigned variables. As you said, you are looking at the .bss section. From Wikipedia, the .bss section is the portion of an object file, executable, or assembly language code that contains statically-allocated variables that are declared but have not been assigned a value yet. IDA is showing ...


1

You can either press Ctrl+G and type LoadLibraryA to land at this function address, or if you want to list all the functions from kernel32.dll you can go to the Symbols tab like this: From there you can view the function address or just double-click "LoadLibraryA" to follow it in disassembler.


1

This is because of your old radare2 installation. If you installed radare2 via apt its very old. Build it from latest source instead and you can look at different symbols. I tried to replicate your problem in an Ubuntu 20.04 docker container root@4a6deaf68cd8:/tmp# r2 -v radare2 4.2.1 0 @ linux-x86-64 git.4.2.1 commit: unknown build: root@4a6deaf68cd8:/tmp# ...


1

This is not true for all functions in kernel32.dll, but for specific functions that are imported from other dlls. You have to find out where the function is imported from and then look at the disassembly of the required dll. Your disassembler might show you where the functions are imported from, kernel32.dll imports a lot of functions from the api-ms-*.dlls ...


1

It seems it’s simply performing initialization of the VGA registers and clearing the screen buffer. The array at 318EF contains the values of the CRT controller indexed registers (ports 3D4/3D5).


Only top voted, non community-wiki answers of a minimum length are eligible