0

I have disassembled an old DOS application with IDA. It run in 16-bit real mode. Some instructions are referencing variables defined in the data segment (DS).

push    word ptr ds:8401h

Since I have imported debug symbols, I can display variable name by simply putting mouse over the ds:xxxxh part.

The problem is this only works when IDA is running in debug mode (eg: a DOSBox process is attached to it). Otherwise nothing is shown.

One possible explanation is that the data segment register (DS) is only set when application is running so IDA as no clue what value it is. In fact, the very first instructions of the program are dedicated to initializing the data segment :

; entry point
mov   dx, seg dseg 
...                     
...                      ; a few instruction later
mov   ds, dx

I think this is how IDA is able to guess where the data segment is (which is reported as dseg in the Segments view).

In that application, DS is set once for good and never changed over the time. Is there a way to tell IDA it should assume DS is equal to a given value in the whole disassembly ? (so hovering those variables will give proper name even when no process is attached).

1

You need to set ds to the actual segment value used by the program. Usually it's one of the segments near the end. I suggest you to check which of the segments has something fitting at 8401h, or try to see how ds is set up in the calling function (you may need to go several levels up). You can also try to map the value you see in DOSBox debugger back to one of the segments in IDA (e.g. check what is at ds:0 and find it in database).

In the Alt-G dialog, you can enter the selector (paragraph) value of the segment (database, not runtime) or simply the segment name.

If all accesses in the current code segment use the same data segment, you can set it as the default in Edit-Segments-Set Default Segment Register Value...

| improve this answer | |
  • The last part is exactly what I wanted. Thanks – tigrou Jun 11 at 20:35
1

You can press Ctrl+G and check the different settings of the segment registers.

You can press Alt+G to edit the segment registers.

| improve this answer | |
  • Ctrl+G is indeed very useful. Thanks for the tip. If I press Alt+G, select ds and enter some value (eg: 294C) nothing happen. All I have is "assume ds:nothing" added where the cursor is. – tigrou Jun 11 at 19:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.