2

I'm disassembling a packed 16 bit DOS MZ EXE.

To deobfuscate it, I've set a breakpoint in DOSbox at the end of the unpacking routine, let it run, and made a memory dump. This way I essentially got the deobfuscated EXE image. Then I loaded this image in IDA.

Obviously, there's no MZ header anymore, so IDA can't know the application's entry point and initial values of CS, SS and other segment registers. I, however, do know these values, and I'm willing to supply them to IDA. To do this, I hit Alt+G and type the register's value.

However, instead of showing assume ds:<value>, IDA shows

seg000:1AEBC                     assume es:nothing, ss:nothing, ds:nothing

Why?

Another question. Why there is no option to set the value of CS register? Consider code which contains near jumps. Without knowledge about the CS register value, IDA won't be able to proceed with disassembling. But I do know what value CS has at this specific point! How do I supply this information to IDA if the Segment Register Value dialog window doesn't have CS option?

3

DOS programs used segments and IDA was made to mimic that behavior. That's why you cannot change CS (since in properly set up database CS is just the segment's base) and why your changes to segment registers do now show up (because there is no segment corresponding to the values you enter).

I would suggest opening a normal (not packed) MZ file to see how it's supposed to look. If you keep fighting IDA instead of working with it you'll keep having problems.

  • I'm not 'fighting' IDA, I'm just a newbie seeking help. Thank you for your answer, it helped, so I'll mark it. – ScumCoder Aug 13 '14 at 20:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.