How to retrieve name of a variable defined in the data segment in IDA when no process is attached?

Question

I have disassembled an old DOS application with IDA. It run in 16-bit real mode. Some instructions are referencing variables defined in the data segment (DS).

push    word ptr ds:8401h

Since I have imported debug symbols, I can display variable name by simply putting mouse over the ds:xxxxh part.

The problem is this only works when IDA is running in debug mode (eg: a DOSBox process is attached to it). Otherwise nothing is shown.

One possible explanation is that the data segment register (DS) is only set when application is running so IDA as no clue what value it is. In fact, the very first instructions of the program are dedicated to initializing the data segment :

; entry point
mov   dx, seg dseg 
...                     
...                      ; a few instruction later
mov   ds, dx

I think this is how IDA is able to guess where the data segment is (which is reported as dseg in the Segments view).

In that application, DS is set once for good and never changed over the time. Is there a way to tell IDA it should assume DS is equal to a given value in the whole disassembly ? (so hovering those variables will give proper name even when no process is attached).

Answer 1

You need to set ds to the actual segment value used by the program. Usually it's one of the segments near the end. I suggest you to check which of the segments has something fitting at 8401h, or try to see how ds is set up in the calling function (you may need to go several levels up). You can also try to map the value you see in DOSBox debugger back to one of the segments in IDA (e.g. check what is at ds:0 and find it in database).

In the Alt-G dialog, you can enter the selector (paragraph) value of the segment (database, not runtime) or simply the segment name.

If all accesses in the current code segment use the same data segment, you can set it as the default in Edit-Segments-Set Default Segment Register Value...

Answer 2

You can press Ctrl+G and check the different settings of the segment registers.

You can press Alt+G to edit the segment registers.