9 votes
Accepted

Call to an imported function in a PE file: Why is destination prepended with ds (call ds:func_name)?

The FF 15 is an absolute indirect call. It is fetching the value at a memory location, and then transferring control to the fetched address. In order to specify that memory location precisely, the ...
  • 4,511
6 votes

Segmentation fault while pushing onto the stack

The segmentation fault error doesn't have anything to do with pushing the strings on the stack. I used gdb to debug it, and the problem lies at: ;exit(int ret) mov al,1 xor ebx, ebx int 0x80 ...
  • 219
6 votes
Accepted

Any correlation between DOS Program Segment Prefix and the base address of loaded executable?

DOS didn't have a concept of more than one application being able to run at the same time, with each of those applications able to allocate memory. Programs that stayed resident after termination ...
6 votes
Accepted

What is the meaning of the ".debugxxx" segments in IDA Debugger?

Generally, these are allocated regions within a debugged process. Some are heap related, some are internal to the OS's implementation, some can be pages allocated by another process that interacts ...
  • 11.4k
5 votes

How are addresses calculated from the values in x86 segment registers?

In protected mode the segment selectors are indexes into the descriptor table (local or global one, depending on the TI bit of the selector). The descriptor entry describes the base address, limit (...
  • 35.1k
5 votes

Segmentation on x86 for stack canaries

Check the stack protection in the linux kernel source. The gs register gets initialized by the kernel to a percpu structure, which contains a random value that's intended to be used as stack canary. ...
5 votes
Accepted

Segments in IDA. How to overcome NONAME problem

Your program is using a segment with base 1AD9h (the segment part of the far call). You need to create a new segment which matches it. Start = 0x1AD90 (0x1AD9<<4) End = 0x2AD90 [for example]...
  • 35.1k
4 votes

Any correlation between DOS Program Segment Prefix and the base address of loaded executable?

MZ-format executables also have the PSP at CS-0x10 just before the data loaded from the file. Quoting Tech Help!, probaly the best DOS programming reference: EXE-format programs define multiple ...
  • 35.1k
4 votes

How are addresses calculated from the values in x86 segment registers?

You're looking at 32 bit registers (probably in a 32bit process). Since 32bit processors segment registers are rarely used as offset addresses for the simple reason 32 bit is enough to represent a ...
  • 11.4k
4 votes

Segments in IDA. How to overcome NONAME problem

I dealt with a ROM image once and faced this problem. I was confused too about what to do until Igor offered his advice. What seemed to be happening was that the linker was placing every object file ...
  • 8,004
3 votes
Accepted

Dealing With x86 Segmentation Overlaps

So, a complete answer would be worth a series of blog posts but I'll try to touch the high points: While you can use different seg:base pairs to refer to the same location, in real code it rarely ...
  • 35.1k
3 votes
Accepted

DOS Executable Segments

In a DOS EXE file, if I have sub1, sub2, and sub3, split between two code segments, how do I know which sub is in which segment? Theoretically, you can't, since most addresses can belong to at least ...
  • 35.1k
3 votes
Accepted

Manual Segmentation of Objects in non-Intel Firmware

Not an answer, really, but too long for a comment; also, i know the x86 architecture well, but have no idea about the TMS320C5, so please take this with a grain of salt. I'm afraid that what you're ...
3 votes

How can I change the Read/Write/Execute flags on a segment in IDA?

You can do it using Sark (code, docs): import sark # Get the segment segment = sark.Segment(ea=0x00400000) # Set the permissions segment.permissions.write = True Disclaimer: I am the author of ...
  • 1,499
3 votes
Accepted

Why IDA aggressively assumes 'nothing' on segment registers?

DOS programs used segments and IDA was made to mimic that behavior. That's why you cannot change CS (since in properly set up database CS is just the segment's base) and why your changes to segment ...
  • 35.1k
2 votes
Accepted

IDA segmentation problem

Short answer: your newly created segments probably have an invalid selector value of 0, and things should start working again as soon as you set the selector to a valid value (e.g. SetSegmentAttr(here,...
  • 1,960
2 votes

Segments in IDA. How to overcome NONAME problem

The problem behind this is that each segment addresses a maximum of 64KB, and, to generate meaningful assembly, IDA needs to know what the segment registers are supposed to be when code is executed. ...
2 votes

Any correlation between DOS Program Segment Prefix and the base address of loaded executable?

It is typically true that DOS loads a .EXE program immediately after the PSP, meaning in your terms that base - PSP == 0x0010. But it's not necessarily true, and if you were writing this (or any) DOS ...
2 votes

Segmentation fault while pushing onto the stack

In addition to the answer by @user2389688 it's important to note that the syscall numbers are wrong if you're doing amd64, as are the passed in registers. Here's a 64 bit abi version which corrects ...
  • 1,561
2 votes

Why base address of GDT(global descriptor table) differ in intel x64 processor?

IIRC on Linux GDT is separate for each processor so you’re probably seeing the addresses for different processors.
  • 35.1k
2 votes

How is DS register interpreted in x86-64 assembly instructions?

Segments are still used on 64 bit long mode and are still set up, except the CPU treats their bases to be 0 (except for gs and fs), and does not perform a limit check. The default segment for rax is ...
2 votes

Question about the limit and base address in x86-64 segmentation model?

Q1: In its manual "Intel® 64 and IA-32 Architectures Software Developer’s Manual Volume 3A: System Programming Guide, Part 1" Intel writes in the chapter "3.5.1 Segment Descriptor Tables": "As with ...
  • 1,814
1 vote

How to retrieve name of a variable defined in the data segment in IDA when no process is attached?

You can press Ctrl+G and check the different settings of the segment registers. You can press Alt+G to edit the segment registers.
1 vote

problem rewriting ELF binary to add an additional loadable segment

I think that if you want to inject code in an elf, the best way would be to resize your second PT LOAD where the will be your loadable data, add execution permissions and inject your code at the end ...
  • 63
1 vote
Accepted

Split IDA segment into sub segments

Open the segments window in IDA. Go to edit that one big segment you have. Change the name to .text and edit the permissions as applicable. Uncheck "Move adjacent segments" and "Disable addresses", ...
  • 1,160
1 vote

Split IDA segment into sub segments

i've always found it easier to split and join the file outside of ida to what is needed and just create segments using edit ->segment->createSegment with proper start and end address rather that ...
  • 15.2k
1 vote

Dealing With x86 Segmentation Overlaps

igorsk gave a nice reply there this post is just to illustrate how you can use some standalone disassembler framework to look for proper ljmps instead of your xxd | tr hacks I am using capstone ...
  • 15.2k
1 vote

Putting instructions in placeholder code IDA?

Edit > Segments > Create Segment
  • 2,287
1 vote

Intel PIN: How to log the value of the fs and gs registers at every instruction?

const CONTEXT *ctx; (from the arguments of LogRegWrite...) PIN_REGISTER regval; PIN_GetContextRegval(ctx, REG_SEG_GS, reinterpret_cast<UINT8*>(&regval)); PIN_GetContextRegval(ctx, REG_SEG_FS,...
  • 121

Only top scored, non community-wiki answers of a minimum length are eligible