📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  IDA Pro  >>  Distinguishing Static Locals from Globals

Topic created on: July 26, 2007 08:30 CDT by stahl .

hello,

i wonder if someone can help me.

how can i distinguish a static local variable from a global variable? are there any sdk functions or data-structures which tell me?

i noticed that in both cases, ida pro reprents these variables by e.g

ds:dword_403010

which is an operand of type direct memory access, data. so how to tell its a global or a static local variable?

thank you for your help!!!

  Macpunk     July 27, 2007 05:18.29 CDT
Well, I've never run into a need to know this before(never used IDA either), but my guess would be the different stack locations for the variables. A local variable would be closer to the bottom of the stack, and a global variable would be closer to the top, given that the stack grows downwards(towards lower memory addresses).

For example, say we have a globalA, and a localB. The stack pointer points to 0x0000. The top of the stack is at 0x0016. globalA would be located closer to 0x0016, while localB would be located closer to 0x0000.

I'm also assuming the top of the stack is at a higher memory addresses, and the bottom is at the lower memory addresses. This may seem backwards to some people.

And I'm assuming that the variable is kept on the stack. :|

--Dalton

  stahl   July 28, 2007 11:37.55 CDT
yes you are:-)

in my posting i am talking about variables not on the stack, like

ds:dword_403010
that is: a variable in the data segment at address 403010

thank you anyway!

  igorsk     August 1, 2007 06:40.15 CDT
The difference between a static local and a global is purely semantic, the produced code looks exactly the same. The only difference I can think of is that a local is accessed from one function only while a global can be accessed anywhere.

  stahl   August 1, 2007 09:26.08 CDT
okay, thank you!

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit