1

I am reverse engineering a very old LE MS-DOS binary and have convinced Ghidra that there are two segments in the file, one is the code segment and another one is the data segment.

Now when I look ad the disassembled code in a function of the code segment, I see this:

   cseg:00074b82 66 c7 05        MOV        word ptr [DAT_00002670],0x1a00
                 70 26 00 
                 00 00 1a

The problem is that I can not work with DAT_00002670, because Ghidra thinks that it is a reference to the code segment, but in reality it is a reference to the data segment through the ds register, so ds:0x2670 instead of cs:0x2670.

I tried to edit the reference with the references editor, but there is no option to set the destination segment.

How can I change the reference, so Ghidra recognize that it goes to the data segment?

0

You can override the address of a reference, for example the data segment starts at 0x90000 when the executable is loaded. I specified that in the memory map.

When I set the address of the reference to 0x92670 instead of 0x2670 Ghidra figures out that the MOV is going to the data segment.

However the decompiler does not seem to pick that up.

Edit:

I have now remapped my data segment to address 0x00000. That way the decompiler picks the references up :).

I had to move the code segment somewhere else, but that doesn't seem to be a problem.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.