2

I have a 2 MB executable that I'm attempting to reverse engineer. It's executed on a 16-bit 8086 CPU.

The segments go from 4000 (0x140000) to F000 (0x1F0000).

I'm attempting to map the segments in the Program Segmentation window, but when doing so, addresses for call / jump operations fail to resolve when converting the entrypoint to code.

Taking the final segment as an example, I set the Start Address to 0x1F0000, and the End Address to 0x200000. I set the base to 0xF000, as this is how it's referred to in the machine code.

I do the same with the other segments, including the problem segment (0xD000 -> 0x1D0000).

When converting to code, the resulting line is resolved as follows:

jmp far ptr 0D000h:1Ah

This is as expected, jumping to segment 0xD000, with an offset of 0x1A, however IDA is not happy with this, complaining about it with the NONAME and BOUNDS errors.

I have no idea how to properly map this in IDA. Can someone point me in the right direction?

[edit]

For reference, I already have the full list of segments I want to map along with their binary addresses:

2000:0x1F0000

3000:0x1F0000

4000:0x140000

5000:0x150000

6000:0x160000

7000:0x170000

8000:0x180000

9000:0x190000

A000:0x1A0000

B000:0x1B0000

C000:0x1C0000

D000:0x1D0000

E000:0x1E0000

F000:0x1F0000

  • How did you get 0x140000 from 4000? – Igor Skochinsky Jan 19 at 0:35
  • @IgorSkochinsky 140000 is the file offset, 4000 is the base segment offset. – lyptt Jan 19 at 8:08
  • For this architecture, segments are mapped from the end of the file - 64kb (F000, 0x1F0000) backwards, in 64kb chunks. – lyptt Jan 19 at 8:16
  • 1
    On a normal 8086, segment 4000 would be mapped to 40000. You also have dupes in your list. I think you’re not explaining everything. – Igor Skochinsky Jan 19 at 13:18
  • @IgorSkochinsky It's not a normal 8086, it's an 8086 compatible clone. On this architecture the first two segments are mapped to the same offset as the last one. – lyptt Jan 19 at 13:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.