I am new user of IDA Pro. The version I am using is 6.8 demo. I know conceptions of program segmentation and segment register. But, I am confused about why there are two views, "Program Segmentation" and "Segment register" Belew is snapshot of program segmentation view. Belew is snapshot of program register view As we can see the information of two views is almost duplicated.
1 Answer
This was interesting when DOS was the operating system of choice, processors had 16 bits, and programs were larger than 64 KB. Those times, the content of segment registers changed a lot; programs had to use far jumps (that changed CS and IP) to jump to addresses more than 64 KB away, and they had to load a value into DS or ES first to access large data segments (or load 0x0040
into ES to access BIOS data structures and have access to the 'high resolution timer' which changed 18.2 times a second).
Here's part of the disassembly of an old 16 bit program:
Please note that there are three segment changes that change the assumption of IDA about the contents of the segments, and another one at 25EB
where ES
is 'changed' to seg130
, which isn't really a change, so there's no assume
directive.
Here's the corresponding segment registers view:
in which 15412
corresponds to seg001:25B2
; if you click on that row in IDA, the program view will jump to that address. The following 3 'change points' correspond to the next addresses where the code actually changes a segment register value.
Those days, programs contained several code segments, and several data segments, so the program segmentation view had a lot to show as well:
you see there are many CODE
segments and many UNK
nown segments, only a small part of the whole program is shown. Each of these CODE
segments used a different value for CS
, which is why IDA creates a new segment register change entry for each new segment.
These days, unless you're disassembling kernel code, you won't see segment register changes at all, and even if you're disassembling the kernel, you'll have one code segment and one data segment, not many of them. So IDA just creates one segment from each section of the input file, and creates the corresponding change points, but there's no change point except the ones that are created for the segments. Which is why the views correspond to each other, and which is also why you're not interested in either of them in most cases.
-
Really helpful. I roughly understand the usage. And thanks a lot for the description for the history and background. Commented Jul 3, 2015 at 8:22