Disassembly question

Started by
1 comment, last by antareus 19 years, 8 months ago
I'm teaching myself disassembly by throwing stuff like the Reverse Engineering Compiler at stuff I have the source code for to try to recognize how common constructs are represented at the assembly level. One thing I notice is that I'll have code that references memory just beyond the last PE section when it is loaded in memory, e.g. if I have a code section that ends at 0x00476000, I'll see references to 0x0047a000 being made. This strikes me as odd as it doesn't appear to be the stack, nor does it appear to be the heap. What would be stored there? Global variables?
--God has paid us the intolerable compliment of loving us, in the deepest, most tragic, most inexorable sense.- C.S. Lewis
Advertisement
Generate a map file (usually a linker option) which will tell you the address and length of the various sections of the executable.
I'd guess its the BSS (uninitialised globals) section which is set to all zero upon program load.
"Most people think, great God will come from the sky, take away everything, and make everybody feel high" - Bob Marley
Will give that a try, thank you.
--God has paid us the intolerable compliment of loving us, in the deepest, most tragic, most inexorable sense.- C.S. Lewis

This topic is closed to new replies.

Advertisement