0

In a DOS EXE file, if I have sub1, sub2, and sub3, split between two code segments, how do I know which sub is in which segment? There seem to be no physical markers in the exe code.

I know the EXE header gives a couple of these items, but looking at the relocation table for a random large EXE, all the segment addresses there were 0, yet there are actually 20 different segments in the program when I look at it in IDA.

Do programs like IDA just guess at segment sizes and offsets based on code analysis? Or have I missed something important in the DOS EXE file structure?

1

In a DOS EXE file, if I have sub1, sub2, and sub3, split between two code segments, how do I know which sub is in which segment?

Theoretically, you can't, since any address can belong to 16 different segments, but in practice there are some heuristics. For example, for targets of far calls and jumps you know their selector (segment value) and offset in that segment, so if you gather that info over the whole executable, you can figure out (at least roughly) what part belongs to which segment. See here for a specific example

As for loading EXE files, you can check how IDA does it in the source of the DOS EXE loader in the SDK (ldr/dos). Here's the relevant part (function doRelocs):

uint16 curval = get_word(xEA);
uint16 base = curval + delta;
put_word(xEA, base);
fd.sel = base;
set_fixup(xEA, &fd);
if ( dosegs )
  add_segm_by_selector(base, NULL);

So basically, a segment is added for each unique relocated selector value. Of course, this may be not enough for some complicated executables, so manual tuning of segment boundaries may be necessary.

  • I was already starting to come to this conclusion on further study, but your answer is much more detailed and informative than what I'd figured out so far. Thanks! – RobinHood70 May 14 '17 at 17:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.