Finding Correct Segment From An Address For Windows 3.1 EXE in IDA Pro

Question

We have an EXE that IDA pro lists the following segments:

Name    Start   End R   W   X   D   L   Align   Base    Type    Class   AD  es  ss  ds  fs  gs
cseg01  00000000    0000EA50    ?   ?   ?   .   L   para    0000    public  CODE    16  FFFFFFFF    FFFFFFFF    5BD5    FFFFFFFF    FFFFFFFF
cseg02  00000000    0000E020    ?   ?   ?   .   L   para    0EA5    public  CODE    16  FFFFFFFF    FFFFFFFF    5BD5    FFFFFFFF    FFFFFFFF
cseg03  00000000    0000AE20    ?   ?   ?   .   L   para    1CA7    public  CODE    16  FFFFFFFF    FFFFFFFF    5BD5    FFFFFFFF    FFFFFFFF
cseg04  00000000    0000EFD0    ?   ?   ?   .   L   para    2789    public  CODE    16  FFFFFFFF    FFFFFFFF    5BD5    FFFFFFFF    FFFFFFFF
cseg05  00000000    0000EFB0    ?   ?   ?   .   L   para    3686    public  CODE    16  FFFFFFFF    FFFFFFFF    5BD5    FFFFFFFF    FFFFFFFF
cseg06  00000000    0000EFF0    ?   ?   ?   .   L   para    4581    public  CODE    16  FFFFFFFF    FFFFFFFF    5BD5    FFFFFFFF    FFFFFFFF
cseg07  00000000    00007550    ?   ?   ?   .   L   para    5480    public  CODE    16  FFFFFFFF    FFFFFFFF    5BD5    FFFFFFFF    FFFFFFFF
dseg08  00000000    0000A4D0    ?   ?   ?   .   L   para    5BD5    public  DATA    16  FFFFFFFF    FFFFFFFF    5BD5    FFFFFFFF    FFFFFFFF
COMMDLG 00000000    00000004    ?   ?   ?   .   L   para    6622    public      16  FFFFFFFF    FFFFFFFF    FFFFFFFF    FFFFFFFF    FFFFFFFF
PZOHDLL 00000000    00000011    ?   ?   ?   .   L   para    6623    public      16  FFFFFFFF    FFFFFFFF    FFFFFFFF    FFFFFFFF    FFFFFFFF
KERNEL  00000000    00000023    ?   ?   ?   .   L   para    6625    public      16  FFFFFFFF    FFFFFFFF    FFFFFFFF    FFFFFFFF    FFFFFFFF
GDI 00000000    0000003D    ?   ?   ?   .   L   para    6628    public      16  FFFFFFFF    FFFFFFFF    FFFFFFFF    FFFFFFFF    FFFFFFFF
USER    00000000    0000006D    ?   ?   ?   .   L   para    662C    public      16  FFFFFFFF    FFFFFFFF    FFFFFFFF    FFFFFFFF    FFFFFFFF
WIN87EM 00000000    00000001    ?   ?   ?   .   L   para    6633    public      16  FFFFFFFF    FFFFFFFF    FFFFFFFF    FFFFFFFF    FFFFFFFF
CSD_LOGO    00000000    00000001    ?   ?   ?   .   L   para    6634    public      16  FFFFFFFF    FFFFFFFF    FFFFFFFF    FFFFFFFF    FFFFFFFF
X1WIN   00000000    00000003    ?   ?   ?   .   L   para    6635    public      16  FFFFFFFF    FFFFFFFF    FFFFFFFF    FFFFFFFF    FFFFFFFF

If I have stack traces/etc, return addresses, or data addresses in format : how can I match up the segment address to the segment name in IDA Pro.

For example when this module loaded LoadModule returned HINSTANCE of 0x28A7. . I have two addresses I wanted to find in IDA:

1. 28df:69ca
2. 28e7:246c

Now in this case I search IDA for the address i.e. 69ca and manually find the matching segment based on knowledge of what I expect to be executing at that point.

However wonder what approach can be used to easily translate the segment address without needing to search i.e. 0x28df = cseg01 and 0x28e7 = cseg02.

There is an option to rebase based on address of first segment, but that doesn't seem to change anything (or I'm not using it correctly)

Answer 1

Rebase does not help you in this case, because rebasing is meant to shift virtual addresses in flat mode or physical addresses of real-mode programs, but it does not apply to selectors of segmented protected mode programs. It is very likely that all segments of your programs get selectors spaced 8 apart, so if you got worked out that 28df is cseg01, the relation that 28e7 is cseg02 is expected. Likely the 2917 is the selector for the data segment. If you get a register dump along with the back trace, possibly you find DS=2917 to help you find the selector values of the code segments.