3

I've open wsl.exe in IDA v7. With Tab key I open pseudocode of sub_1400129F4 like this:

__int64 sub_1400129F4(__int64 a1, __int64 a2, __int64 a3, __int64 a4, ...) { ...... v8 = (__int64 *)sub_140011A40(); }
  • The assembly of sub_140011A40():
sub_140011A40 proc near lea rax, unk_14001C2B0 retn sub_140011A40 endp
  • The pseudo code of sub_140011A40():
void *sub_140011A40() { return &unk_14001C2B0; }
  • The .data sections shows this:
.data:000000014001C2AE db 0 .data:000000014001C2AF db 0 .data:000000014001C2B0 unk_14001C2B0 db 0 ; DATA XREF: sub_140011A40↑o .data:000000014001C2B1 db 0 .data:000000014001C2B2 db 0 .data:000000014001C2B3 db 0 .data:000000014001C2B4 db 0 .data:000000014001C2B5 db 0 .data:000000014001C2B6 db 0 .data:000000014001C2B7 db 0 .data:000000014001C2B8 unk_14001C2B8 db 0 ; DATA XREF: sub_140011A48↑o .data:000000014001C2B9 db 0 .data:000000014001C2BA db 0
  • Question: What is the unk in that pseudo code or in that assembly? Does it hold the values of eight zeros from .data section?
Improve this question
3
  • post the assembly too interpreting a pseudo interpretation without context is tedious unk means unknown (may be someone writes there during runtime ?? and it is unknown at the moment does assembly say mov eax, qword [unk] Commented Mar 9, 2018 at 19:53
  • so it is clear lea returns 14001C2B0 not the 0 lea is a speacial kind of move instruction that moves the address not the contents so v8 = 14001C2B0 Commented Mar 9, 2018 at 20:06
  • 2
    forget the unk it is a label and it has no meaning in c or d or go it is a name given by ida to that specific address try pressing d on the address the unk will change to byte , press d again it will beome word press d again it will become dword etc etc the code would be appromiximately v8 = &foo() Commented Mar 9, 2018 at 20:28

1 Answer 1

Reset to default
4 
lea rax , unk___xxx ret

means the function returns the address not the contents

lea (load effective address ) is a special kind of mov instruction that load the address not the contents

the unk is a label ida could not decipher the type so it labelled the address as unk (possibly short form for unknown)

if you select that address and press d ida will replace the unk with byte if you press d again ida will rename the byte to word etc etc

basically from your pseudo code

the result would be v8 = &foo()

a screen shot where ida wasn't sure what the type was for a CRITICAL_SECTION pointer manually applying the structure to the address

enter image description here

Improve this answer
0

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.