1

I disassembled a jni .so file(the native part of an android application) and I decompiled one of its function in ghidra.

I saw a DAT_* in a part of decompiled code and when I double clicked on that ghidra show me only question marks.

What should I do for finding the data in the DAT_*

( '*' Means any chars )

mahdi bigdely
  • 23
  • 1
  • 3
  • Please clarify your specific problem or provide additional details to highlight exactly what you need. As it's currently written, it's hard to tell exactly what you're asking. – Community Nov 09 '21 at 21:22

1 Answers1

2

I think what you are referring to are the questions mark like in this screenshot:

enter image description here

This just means that the datatype of the data at this address is not yet defined in any way. For example, if you specify the data at this address to be of the type QWORD it will state dq and look like this:

enter image description here

if it is a string it will contain ds and look like this

enter image description here

Florian Magin
  • 576
  • 3
  • 6
  • Thanks, If I define that DAT datatype to QWORD the plain text will shown? – mahdi bigdely Nov 10 '21 at 16:38
  • I am not sure what you mean by "the plain text will show" depending on the datatype Ghidra will render the actual data, IF it is static and already known, in the appropriate way. – Florian Magin Nov 11 '21 at 08:16