3

As per IDA Online Help:

The segment class name identifies the segment with a class name (such as CODE, FAR_DATA, or STACK). The linker places segments with the same class name into a contiguous area of memory in the runtime memory map.

IDA has the following predefined segment class names:

    CODE    -       Pure code
    DATA    -       Pure data
    CONST   -       Pure data
    BSS     -       Uninitialized data
    STACK   -       Uninitialized data
    XTRN    -       Extern definitions segment

As far as I could tell permission on a segment already offer all relevant information. What is the exact purpose(or applicable usage) of Segment Class Name? How does IDA utilize it internally?

4

I have looked through IDA SDK and specifically segment.hpp file, and this is what I figured out. IDA has 12 segments types defined based on how those are treated by kernel. In addition, there are several "fake" segments, which IDA presumes would not contain code or data. As a result those are completely excluded from disassembly. This is how segment type is defined:

/* 94 */  uchar type;   // Type of the segment. The kernel treats different
                        // segment types differently.
                        // Segments marked with '*' contain no instructions
                        // or data and are not declared as 'segments' in
                        // the disassembly.

#define SEG_NORM        0       // Unknown type, no assumptions
#define SEG_XTRN        1       // * segment with 'extern' definitions
                                //   no instructions are allowed
#define SEG_CODE        2       // code segment
#define SEG_DATA        3       // data segment
#define SEG_IMP         4       // java: implementation segment
#define SEG_GRP         6       // * group of segments
#define SEG_NULL        7       // zero-length segment
#define SEG_UNDF        8       // undefined segment type (not used)
#define SEG_BSS         9       // uninitialized segment
#define SEG_ABSSYM     10       // * segment with definitions of absolute symbols
#define SEG_COMM       11       // * segment with communal definitions
#define SEG_IMEM       12       // internal processor memory & sfr (8051)

The Class of the segment is "mapped" to its type in the following manner:

 //                      "CODE"  -> SEG_CODE
 //                      "DATA"  -> SEG_DATA
 //                      "CONST" -> SEG_DATA
 //                      "STACK" -> SEG_BSS
 //                      "BSS"   -> SEG_BSS
 //                      "XTRN"  -> SEG_XTRN
 //                      "COMM"  -> SEG_COMM
 //                      "ABS"   -> SEG_ABS

In addition, I have found out that permissions are actually "figured out" and set by particular loader modules, which would also set segment types (ergo Classes) based on specifics of the loaded file.

| improve this answer | |
4

Also, while permissions are more or less standardized and can inform you about the types of data/code found in a segment, remember that if you're talking about malware analysis there is no guarantee that the permissions on a segment are what you would expect.

Not to mention that there is often a fair amount of header tampering in addition to non-standard memory utilization. In fact, this is often how you can tell whether something was written in assembly, mangled with a tool or compiled from some other language.

| improve this answer | |
2

There are differences between the segments types other than the permissions. For example XTRN is used to show the pink areas for imports in the disassembly view. I guess that info also helps IDA in the autoanalysis phase for code, data and const segments. Elements in code sections have higher chance of being code then data, and vice versa. Stack is obviously very different at how it's displayed and handled.

| improve this answer | |
  • @Nirlzr "I guess that info also helps IDA in the autoanalysis phase for code, data and const segments" How does it help IDA? – PSS Jul 6 '13 at 19:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.