IDA Pro disassembly shows ? instead of hex or plain ascii in .data?

Question

I am using IDA Pro to disassemble a Windows DLL file. At one point I have a line of code saying

mov esi, dword_xxxxxxxx

I need to know what the dword is, but double-clicking it brings me to the .data page and everything is in question marks.

How do I get the plain text that is supposed to be there?

Enciso

Answer 1

If you see question marks in IDA, this means that there's no physical data at this location on the file (on your disk drive).

Sections in PE files have a physical size (given by the SizeOfRawData field of the section header). This physical size (on disk) might be different from the size of the section once it is mapped onto the process memory by the Windows' loader (this size is given by the VirtualSize field of the section header).

So, if the VirtualSize field is bigger than the SizeOfRawData field, a part of the section has no physical existence and it exists only in memory (once the file is mapped onto the process address space).

On most case, at program entry point, you can assume this memory is filled with 0 (but some parts of the memory might be written by the windows loader).

To get the locations where the data is being written, read or loaded you can use cross-references (xref). Here's an example :

Click on the name of the data from which you want the xref :

Then press 'x', you'll be shown all known (to ida) location where the data is used :

The second column indicates how the data is used:

• r means it is read
• w means it is written
• o means it is loaded as a pointer

Philippine

So how do I trace where the dword memory is located, or where that portion of the memory is being written to? – Enciso

@bernlim "So how do I trace where the dword memory is located" : do you mean statically or in the process address space? For the second part of your question, I updated my answer. – Philippine

This is exactly what I needed – Enciso

And what if the question marks are not on a page granularity, and have zeroes interspersed, like the IAT. – Heartrending