Sign in to follow this  
antareus

Disassembly question

Recommended Posts

I'm teaching myself disassembly by throwing stuff like the Reverse Engineering Compiler at stuff I have the source code for to try to recognize how common constructs are represented at the assembly level. One thing I notice is that I'll have code that references memory just beyond the last PE section when it is loaded in memory, e.g. if I have a code section that ends at 0x00476000, I'll see references to 0x0047a000 being made. This strikes me as odd as it doesn't appear to be the stack, nor does it appear to be the heap. What would be stored there? Global variables?

Share this post


Link to post
Share on other sites
Generate a map file (usually a linker option) which will tell you the address and length of the various sections of the executable.
I'd guess its the BSS (uninitialised globals) section which is set to all zero upon program load.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

Sign in to follow this