reverse-engineeringghidra

Question marks in ghidra DAT_*

I disassembled a jni .so file(the native part of an android application) and I decompiled one of its function in ghidra.

I saw a DAT_* in a part of decompiled code and when I double clicked on that ghidra show me only question marks.

What should I do for finding the data in the DAT_*

( '*' Means any chars )

Solution

  • I think what you are referring to are the questions mark like in this screenshot:

    enter image description here

    This just means that the datatype of the data at this address is not yet defined in any way. For example, if you specify the data at this address to be of the type QWORD it will state dq and look like this:

    enter image description here

    if it is a string it will contain ds and look like this

    enter image description here