IDA Pro disassembly shows ? instead of hex or plain ascii in .data?

Question

I am using IDA Pro to disassemble a Windows DLL file. At one point I have a line of code saying

mov esi, dword_xxxxxxxx

I need to know what the dword is, but double-clicking it brings me to the .data page and everything is in question marks.

How do I get the plain text that is supposed to be there?

Answer 1

If you see question marks in IDA, this means that there's no physical data at this location on the file (on your disk drive).

Sections in PE files have a physical size (given by the SizeOfRawData field of the section header). This physical size (on disk) might be different from the size of the section once it is mapped onto the process memory by the Windows' loader (this size is given by the VirtualSize field of the section header).

So, if the VirtualSize field is bigger than the SizeOfRawData field, a part of the section has no physical existence and it exists only in memory (once the file is mapped onto the process address space).

On most case, at program entry point, you can assume this memory is filled with 0 (but some parts of the memory might be written by the windows loader).

To get the locations where the data is being written, read or loaded you can use cross-references (xref). Here's an example :

Click on the name of the data from which you want the xref :

Then press 'x', you'll be shown all known (to ida) location where the data is used :

The second column indicates how the data is used:

• r means it is read
• w means it is written
• o means it is loaded as a pointer