03.IDENTIFYING GLOBAL VARIABLES

UNINITIALIZED GLOBAL VARIABLE

global variables in Ghidra are marked with DAT_...

#step 1: find main

#step 2a - option 1: look for its usage in ghidra decompiler!

 iVar1 = _printf(s_Hello,%s._0040e094, &DAT_0040fb40);

 ... follow by double clicking the address then verifying whether it's set to zero
      - all uninitialized globals are automatically initialized to zero!

#step 2b - option 2: 

INITIALIZED GLOBAL VARIABLE

#step 1: find main

#step 2: - option 1: identify and follow ALL functions that may be using it

 mov eax, [DAT_0040f0e0]

Last updated