DOS Executable Segments

Question

In a DOS EXE file, if I have sub1, sub2, and sub3, split between two code segments, how do I know which sub is in which segment? There seem to be no physical markers in the exe code.

I know the EXE header gives a couple of these items, but looking at the relocation table for a random large EXE, all the segment addresses there were 0, yet there are actually 20 different segments in the program when I look at it in IDA.

Do programs like IDA just guess at segment sizes and offsets based on code analysis? Or have I missed something important in the DOS EXE file structure?

Answer 1

In a DOS EXE file, if I have sub1, sub2, and sub3, split between two code segments, how do I know which sub is in which segment?

Theoretically, you can't, since most addresses can belong to at least 16 different segments, but in practice there are some heuristics. For example, for targets of far calls and jumps you know their selector (segment value) and offset in that segment, so if you gather that info over the whole executable, you can figure out (at least roughly) what part belongs to which segment. See here for a specific example

As for loading EXE files, you can check how IDA does it in the source of the DOS EXE loader in the SDK (ldr/dos). Here's the relevant part (function doRelocs):

uint16 curval = get_word(xEA);
uint16 base = curval + delta;
put_word(xEA, base);
fd.sel = base;
set_fixup(xEA, &fd);
if ( dosegs )
  add_segm_by_selector(base, NULL);

So basically, a segment is added for each unique relocated selector value. Of course, this may be not enough for some complicated executables, so manual tuning of segment boundaries may be necessary.