Finding Code Reference String in MS-DOS 16-bit Executable with IDA Pro

Question

Have an application that has code to detect serial port model. I'm trying to work out how it works through static analysis. I have unpacked the EXE and can find the references to the strings:

dseg:2DA8 38 32 35 30 00           a8250     db '8250',0      ; DATA XREF: seg124:4EC1↑o
dseg:2DAD 31 36 34 35 30 00        a16450    db '16450',0     ; DATA XREF: seg124:4EC6↑o
dseg:2DB3 31 36 35 35 30 00        a16550    db '16550',0     ; DATA XREF: seg124:4ECB↑o
dseg:2DB9 31 36 35 35 30 41 46 00  a16550af  db '16550AF',0   ; DATA XREF: seg124:4ED0↑o
dseg:2DC1 31 36 35 35 31 00        a16551    db '16551',0     ; DATA XREF: seg124:4ED5↑o
dseg:2DC7 31 36 35 35 32 00        a16552    db '16552',0     ; DATA XREF: seg124:4EDA↑o
dseg:2DCD 38 32 30 35 30 00        a82050    db '82050',0     ; DATA XREF: seg124:4EDF↑o
dseg:2DD3 38 32 35 31 30 00        a82510    db '82510',0     ; DATA XREF: seg124:4EE4↑o

Now when when I hit x to find the XRef for these I am taking to strings and the string length values:

seg124:4EC0 04                               db    4   
seg124:4EC1 A8 2D 26 6A                      dd a8250         ; "8250"
seg124:4EC5 05                               db    5   
seg124:4EC6 AD 2D 26 6A                      dd a16450        ; "16450"
seg124:4ECA 05                               db    5   
seg124:4ECB B3 2D 26 6A                      dd a16550        ; "16550"
seg124:4ECF 07                               db    7   
seg124:4ED0 B9 2D 26 6A                      dd a16550af      ; "16550AF"
seg124:4ED4 05                               db    5   
seg124:4ED5 C1 2D 26 6A                      dd a16551        ; "16551"
seg124:4ED9 05                               db    5   
seg124:4EDA C7 2D 26 6A                      dd a16552        ; "16552"
seg124:4EDE 05                               db    5   
seg124:4EDF CD 2D 26 6A                      dd a82050        ; "82050"
seg124:4EE3 05                               db    5   
seg124:4EE4 D3 2D 26 6A                      dd a82510        ; "82510"

There is no reference to these automatically found by IDA. Is there a value or instruction I could search for to narrow the search. i.e. a reference to seg124:4ECB

I have also tried to use a live debugger but I get Out of Memory error which is why I'm trying to work it out statically

Answer 1

I found the code accessing the string using SoftICE for MS-DOS. To use I did the following:

1. Add SoftICE driver as first entry in CONFIG.SYS

DEVICE=C:\SICE\S-ICE.EXE /SYM 50

2. Launch program and Alt+PrintScreen triggered break into SoftICE Window. (SoftIce Documentation also mentioned Ctrl+D but this didn't work for me)

3. Searched memory for my target string:

s 0 L FFFFFFFF "16550AF

Which output memory address 6AF0:2DB9

3. Set breakpoint on read/write memory access for that location:

bpm 6AF0:2DB9 RW

4. X to continue program execution

5. On breakpoint the instruction mov al,ES:[BX] access the string location

6. IDA pro was searched for the bytes i.e. 26 8A 07 25 FF 00 75 03 to find the instruction:

Answer 2

It seems you have an array of records of the following format:

struct msg_rec
{
 char len;
 char __far *string;
};

(possibly the fields are swapped)

In such case a good strategy is to scroll up until the first read or offset xref - that should be the code which walks or indexes the array and retrieves the string address.