2

I am new user of IDA Pro. The version I am using is 6.8 demo. I know conceptions of program segmentation and segment register. But, I am confused about why there are two views, "Program Segmentation" and "Segment register" Belew is snapshot of program segmentation view. enter image description here Belew is snapshot of program register view enter image description here As we can see the information of two views is almost duplicated.

8

This was interesting when DOS was the operating system of choice, processors had 16 bits, and programs were larger than 64 KB. Those times, the content of segment registers changed a lot; programs had to use far jumps (that changed CS and IP) to jump to addresses more than 64 KB away, and they had to load a value into DS or ES first to access large data segments (or load 0x0040 into ES to access BIOS data structures and have access to the 'high resolution timer' which changed 18.2 times a second).

Here's part of the disassembly of an old 16 bit program:

enter image description here

Please note that there are three segment changes that change the assumption of IDA about the contents of the segments, and another one at 25EB where ES is 'changed' to seg130, which isn't really a change, so there's no assume directive.

Here's the corresponding segment registers view:

enter image description here

in which 15412 corresponds to seg001:25B2; if you click on that row in IDA, the program view will jump to that address. The following 3 'change points' correspond to the next addresses where the code actually changes a segment register value.

Those days, programs contained several code segments, and several data segments, so the program segmentation view had a lot to show as well:

enter image description here

you see there are many CODE segments and many UNKnown segments, only a small part of the whole program is shown. Each of these CODE segments used a different value for CS, which is why IDA creates a new segment register change entry for each new segment.

These days, unless you're disassembling kernel code, you won't see segment register changes at all, and even if you're disassembling the kernel, you'll have one code segment and one data segment, not many of them. So IDA just creates one segment from each section of the input file, and creates the corresponding change points, but there's no change point except the ones that are created for the segments. Which is why the views correspond to each other, and which is also why you're not interested in either of them in most cases.

1
  • Really helpful. I roughly understand the usage. And thanks a lot for the description for the history and background.
    – appleleaf
    Jul 3 '15 at 8:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.