Questions tagged [segmentation]

Can be either the division of a computer's primary memory into segments or sections, or the process in the operating system that maps virtual memory onto physical memory.

Filter by
Sorted by
Tagged with
10
votes
4answers
6k views

How can I change the Read/Write/Execute flags on a segment in IDA?

Sometimes when you load a binary manually in IDA you wind up with segments that have unknown read write and execute flags. You can see them under the Segments subview (Shift + F7). Is there a way to ...
7
votes
1answer
607 views

What is the meaning of the “.debugxxx” segments in IDA Debugger?

When I debug an application inside the IDA Debugger, sometimes I get referenced to a .debugxxx segment. What are those segment ? Heap allocations ? If so, why are they called .debug ? Also, even if ...
6
votes
3answers
4k views

Segments in IDA. How to overcome NONAME problem

I'm disassembling a packed 16 bit DOS MZ EXE. To deobfuscate it, I've set a breakpoint in DOSbox at the end of the unpacking routine, let it run, and made a memory dump. This way I essentially got ...
6
votes
1answer
415 views

How can I check I've moved outside the stack without triggering a protection fault?

I'm adding a feature to my Linux debugger (I'm using Ptrace to manipulate the traced process as well as libbfd/libopcodes) to unwind the stack and determine if discrepancies exist between each CALL's ...
6
votes
1answer
2k views

Segmentation on x86 for stack canaries

I just compiled some C code that reads in input using gets and disassembled the code. The platform is Ubuntu 32-bit. There are these 3 lines that check if the canary value has been tampered with. ...
5
votes
1answer
1k views

Call to an imported function in a PE file: Why is destination prepended with ds (call ds:func_name)?

In windows PE files (32 and 64 bit) calls to imported functions look like this in IDA PRO: call ds:SetEvent // default setting call [ds:SetEvent] // Target Assembler set ...
5
votes
4answers
1k views

Any correlation between DOS Program Segment Prefix and the base address of loaded executable?

I'm using IDA to disassemble Test Drive III. It's a 1990 DOS game. The *.EXE has MZ format. The game uses a number of anti-reversing features such as copying its code to segment (PSPseg+2be7) where ...
5
votes
3answers
7k views

Segmentation fault while pushing onto the stack

So I have been following some tutorials on assembly and the instructor compiles the following code: ;hello3.asm attempts to make the code position independent section .text global _start _start: ;...
4
votes
1answer
363 views

Manual Segmentation of Objects in non-Intel Firmware

I am currently working on reversing a firmware file for the older TMS320C5 16-bit microprocessor. I'm using IDA pro to do so and I need to manually create segments for each object contained in the ...
4
votes
1answer
803 views

Question about the limit and base address in x86-64 segmentation model?

I'm trying to understand how segmentation works under x86-64. From what I see, it's mostly disabled, but not entirely. It looks like GS and FS registers are still using it. So I was reviewing the ...
4
votes
2answers
2k views

IDA segmentation problem

In the program I'm trying to reverse engineer, originally IDA only created three segments: CODE, DATA and .idata. Using the information from the compiler source code (http://pastebin.com/ParJ3683 ...
3
votes
2answers
2k views

How are addresses calculated from the values in x86 segment registers?

How are the 16-bit values in segment registers used to represent large memory addresses? ES 0023 32bit 0(FFFFFFFF) CS 001B 32bit 0(FFFFFFFF) SS 0023 32bit 0(FFFFFFFF) DS 0023 32bit 0(FFFFFFFF) FS ...
2
votes
1answer
2k views

Why IDA aggressively assumes 'nothing' on segment registers?

I'm disassembling a packed 16 bit DOS MZ EXE. To deobfuscate it, I've set a breakpoint in DOSbox at the end of the unpacking routine, let it run, and made a memory dump. This way I essentially got ...
2
votes
1answer
118 views

Why base address of GDT(global descriptor table) differ in intel x64 processor?

I have created a simple linux kernel module to get the base address of GDT table: #include <linux/init.h> #include <linux/module.h> #include <linux/const.h> #include <linux/errno....
1
vote
2answers
247 views

Dealing With x86 Segmentation Overlaps

I load my project into IDA 7 and select 8086 as this rom is a 512kb in the high address space. I apply an offset of 0x80000 and it loads properly. I then go to 0xFFFF0 and find a far jump to 0xFDAF:...
1
vote
1answer
1k views

Memory segment in IDA - ARM kernel

I just loaded up an ARM kernel image into IDA. When I boot up the ARM kernel and inspect the kernel symbols, I can see the following :- / $ cat /proc/kallsyms | head -n 10 00000000 t __vectors_start ...
1
vote
2answers
346 views

Split IDA segment into sub segments

I'm reversing a firmware, that comes in one big binary chunk(.bin file). After some reversing, I could identify that the big bin has two segments - text and data. Now I want to split the original ...
1
vote
1answer
455 views

How is DS register interpreted in x86-64 assembly instructions?

IDA disassembled an x86-64 instruction as below: 0000000000000761 lea rdx, ds:0[rax*4] What I know is, segment registers are only relevant in in segmented memory model, while in ...
1
vote
1answer
366 views

DOS Executable Segments

In a DOS EXE file, if I have sub1, sub2, and sub3, split between two code segments, how do I know which sub is in which segment? There seem to be no physical markers in the exe code. I know the EXE ...
1
vote
1answer
2k views

Intel PIN: How to log the value of the fs and gs registers at every instruction?

I modified the pinatrace pintool example and managed to log all values of the "regular" registers: VOID Instruction(INS ins, VOID *v) { ... // Instrument REGISTER writes using a predicated ...
1
vote
2answers
376 views

Putting instructions in placeholder code IDA?

In IDA, is it possible to convert placeholder data into a code segment? In the end of the library I am working with, there is an uninitialized segment starting at 016AAB31. The hex and actual data (...
1
vote
1answer
52 views

How to make a reference to a different segment?

I am reverse engineering a very old LE MS-DOS binary and have convinced Ghidra that there are two segments in the file, one is the code segment and another one is the data segment. Now when I look ad ...
0
votes
2answers
82 views

How to retrieve name of a variable defined in the data segment in IDA when no process is attached?

I have disassembled an old DOS application with IDA. It run in 16-bit real mode. Some instructions are referencing variables defined in the data segment (DS). push word ptr ds:8401h Since I have ...
0
votes
1answer
45 views

Expanding .data section at particular area

I have a program which creates a hard-coded number of objects. I patched the binary so that now it can attempt to create more objects than the limit allows, however when it does it allocates them to ...
0
votes
1answer
104 views

problem rewriting ELF binary to add an additional loadable segment

I have a problem rewriting ELF binary to add an additional loadable segment for add.c code. I have problem working with https://pdfhost.io/v/U@uP1+nCY_Compact_Control_Flow_Integerity_in_Linuxpdf.pdf ...
0
votes
0answers
20 views

getting the content of the Thread Envoirment Block in IDA Pro

i have started out reverse engineering with IDA Pro a few weeks ago. Currently i am reversing a heavily obfuscated file which uses many anti-reversing techniques and in particular relys heavily on ...