1

I have extracted the .rdata section from a windows executable. I would like to parse the variables contained in the section into a easily understandable format, such as:

char s[] = "hello world"
int i = 0

There does not appear, however, to be data types associated with the variables, so simply encoding the variable data in hexadecimal might be more realistic.

Is the data stored in the .rdata section in an easily parsable format? If so, what would that be?

2 Answers2

3

No, the data is not easily parsable.

The best option is to use a disassembler (such as IDA Pro) that can create cross-references from code to data in your .rdata section. This can help you better identify strings, bytes, words, and dwords in the .rdata section:

https://samsclass.info/123/proj10/honeynet/honeynet-rev.html

Jason Geffner
  • 20,681
  • 1
  • 36
  • 75
  • What if the source code is not available? That is my situation. –  Dec 10 '14 at 16:48
  • 1
    My answer above already assumes that the source code is not available. The screenshot is that of an .rdata section with cross-references to disassembled code. – Jason Geffner Dec 10 '14 at 17:15
0

After compiling to a release build with many compilers no debug or symbolic information about the function name or variable names is left in the native binaries, so the data section u have dumped only contains the variable values at different positions, manually its not easy to find variables, so use a debugger or disassembler which will ease the work for you, it will let you see different variables categorized and identified according to their alignment and size.

Alok Saini
  • 101