These 0x90 bytes ( or 0x24 dwords ) occur often in windows ce arm binaries
00000000 00004033 00444101 09401050 00004005 00534c01 09401050 00002078
00534c01 802910ec 0000c0f0 00534b01 812910ec 00000000 00545204 813910ec
0000900b 00545204 813910ec 0000d0c9 00545204 813910ec 0000e04c 00545204
13001186 000050ba 004c4404 0020100b 0000a0cc 00474e05 905010b7 00006008
00433306 920010b7 00000476 00433306
Does anyone know what it is for?
My guess is that it is some kind of padding between static data sections of different modules.
another one is
85E0B100 11D104FA A000DAB7 D64803C9
That also seems to occur in many binaries without obvious reason.
igorsk found out that the first block is defined in halether.h - EdbgVendorIds
Found in a debug WinCE lib:
.rdata:00000000 EdbgVendorIds DCD 0, 0x4033, 0x444101, 0x9401050, 0x4005, 0x534C01, 0x9401050
.rdata:00000000 DCD 0x2078, 0x534C01, 0x802910EC, 0xC0F0, 0x534B01, 0x812910EC
.rdata:00000000 DCD 0, 0x545204, 0x813910EC, 0x900B, 0x545204, 0x813910EC
.rdata:00000000 DCD 0xD0C9, 0x545204, 0x813910EC, 0xE04C, 0x545204, 0x13001186
.rdata:00000000 DCD 0x50BA, 0x4C4404, 0x20100B, 0xA0CC, 0x474E05, 0x905010B7
.rdata:00000000 DCD 0x6008, 0x433306, 0x920010B7, 0x476, 0x433306
After searching for EdbgVendorIds in WinCE sources, found this in halether.h:
// The following defs can be used for platforms which support multiple adapter types.
// Identifiers are provided here for drivers which are built in common\oak\drivers\ethdbg.
// Any platform specific adapter types can be identified based off of EDBG_ADAPTER_OEM.
#define EDBG_ADAPTER_SMC9000 0
#define EDBG_ADAPTER_NE2000 1
#define EDBG_ADAPTER_DEFAULT 2
#define EDBG_ADAPTER_DEC21140 3
#define EDBG_ADAPTER_RTL8139 4
#define EDBG_ADAPTER_DP83815 5
#define EDBG_ADAPTER_3C90X 6
#define EDBG_ADAPTER_OEM 16
#define EDBG_USB_RNDIS 'R'
//
// Ethernet debug controller vendor and PCI information.
//
typedef struct __Edbg_VendorId // NIC vendor ID
{
USHORT wVenId; // PCI Vendor ID
USHORT wDevId; // PCI Device ID
ULONG dwUpperMAC; // First 3 bytes of Ethernet address
UCHAR Type; // NIC type (EDBG_ADAPTER_xxx)
UCHAR szAbbrev[3]; // Vendor name abbreviation
} EDBG_VENDORID, *PEDBG_VENDORID;
// VenId DevId MAC Type Name
// -------------------------------------------------------
#define SUPPORTED_COMMON_NIC \
{0x0000, 0x0000, 0x004033, EDBG_ADAPTER_NE2000, "AD" }, /* Addtron */\
{0x1050, 0x0940, 0x004005, EDBG_ADAPTER_NE2000, "LS" }, /* LinkSys */\
{0x1050, 0x0940, 0x002078, EDBG_ADAPTER_NE2000, "LS" }, /* LinkSys */\
{0x10EC, 0x8029, 0x00C0F0, EDBG_ADAPTER_NE2000, "KS" }, /* Kingston */\
{0x10EC, 0x8129, 0x000000, EDBG_ADAPTER_RTL8139, "RT" }, /* RealTek */\
{0x10EC, 0x8139, 0x00900B, EDBG_ADAPTER_RTL8139, "RT" }, /* RealTek */\
{0x10EC, 0x8139, 0x00D0C9, EDBG_ADAPTER_RTL8139, "RT" }, /* RealTek */\
{0x10EC, 0x8139, 0x00E04C, EDBG_ADAPTER_RTL8139, "RT" }, /* RealTek */\
{0x1186, 0x1300, 0x0050BA, EDBG_ADAPTER_RTL8139, "DL" }, /* D-Link */\
{0x100B, 0x0020, 0x00A0CC, EDBG_ADAPTER_DP83815, "NG" }, /* Netgear */\
{0x10B7, 0x9050, 0x006008, EDBG_ADAPTER_3C90X, "3C" }, /* 3Com */\
{0x10B7, 0x9200, 0x000476, EDBG_ADAPTER_3C90X, "3C" } /* 3Com */
static const EDBG_VENDORID EdbgVendorIds[] =
{
SUPPORTED_COMMON_NIC
};
#define NUM_EDBG_VENDORIDS (sizeof(EdbgVendorIds)/sizeof(EDBG_VENDORID))
