2

I have a 2 MB executable that I'm attempting to reverse engineer. It's executed on a 16-bit 8086 CPU.

The segments go from 4000 (0x140000) to F000 (0x1F0000).

I'm attempting to map the segments in the Program Segmentation window, but when doing so, addresses for call / jump operations fail to resolve when converting the entrypoint to code.

Taking the final segment as an example, I set the Start Address to 0x1F0000, and the End Address to 0x200000. I set the base to 0xF000, as this is how it's referred to in the machine code.

I do the same with the other segments, including the problem segment (0xD000 -> 0x1D0000).

When converting to code, the resulting line is resolved as follows:

jmp far ptr 0D000h:1Ah

This is as expected, jumping to segment 0xD000, with an offset of 0x1A, however IDA is not happy with this, complaining about it with the NONAME and BOUNDS errors.

I have no idea how to properly map this in IDA. Can someone point me in the right direction?

[edit]

For reference, I already have the full list of segments I want to map along with their binary addresses:

2000:0x1F0000

3000:0x1F0000

4000:0x140000

5000:0x150000

6000:0x160000

7000:0x170000

8000:0x180000

9000:0x190000

A000:0x1A0000

B000:0x1B0000

C000:0x1C0000

D000:0x1D0000

E000:0x1E0000

F000:0x1F0000

  • How did you get 0x140000 from 4000? – Igor Skochinsky Jan 19 at 0:35
  • @IgorSkochinsky 140000 is the file offset, 4000 is the base segment offset. – lyptt Jan 19 at 8:08
  • For this architecture, segments are mapped from the end of the file - 64kb (F000, 0x1F0000) backwards, in 64kb chunks. – lyptt Jan 19 at 8:16
  • 1
    On a normal 8086, segment 4000 would be mapped to 40000. You also have dupes in your list. I think you’re not explaining everything. – Igor Skochinsky Jan 19 at 13:18
  • @IgorSkochinsky It's not a normal 8086, it's an 8086 compatible clone. On this architecture the first two segments are mapped to the same offset as the last one. – lyptt Jan 19 at 13:43

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.