📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  Brainstorms - General  >>  Converting Segment Registers + Address to VA Mentally and Quickly

Topic created on: March 16, 2007 02:05 CDT by apridgen .

Is there a quick mental trick or an easy way to convert segmented addressing into virtual addressing quickly?

DS = 0023
For Example: DS:[0116005C] => ?

I read the Intel manuals and it kinda just goes over my head, and I figured there was some neat and clean way to do this my head quickly since it's all binary anyway.

Thanks in advance for any help.

  anonymouse     March 16, 2007 02:14.13 CDT
This may be not a good answer but in the latest and greatst of computers (I mean the 32 bit processors, oh yeah I'm still lost in 32 bits haven't had a chance yet to meet the darth vaders and lukas skywalkers of 64 bit) these segments don't matter much the memory is flat 4 gb.

Once upon a time in olden golden days when memory and disk space and operating systems were primitive the neanderthals used to play with segments and stuff.

ds:[401000] = cs:[401000] = es:[401000] = ss:[401000]

If I'm not dreaming. Only fs: segment is different it is supposed to be some hack in processor architecture to deal with intricacies of changing from lower privilege to higher privilege codes and back.

You will find you have peb, teb etc all filled up in fs: segment and if you code in masm and want to use fs: segment you have to declare .assume fs:nothing before invoking it from SEH handlers.

  Nevar     March 17, 2007 05:18.26 CDT
In 16bit mode, the calculation is:

linear = segment<<4 + offset

In 32bit/ProtectedMode, the segment registers play a totally different role.  The segment register is an index into either the GDT or LDT where a descriptor resides.  This desctiptor defines the base and limit of a block of memory to which the offset part is then added.

I would strongly suggest reading the intel architecture manuals on protected mode to get a firm understanding.

-nevar

  apridgen   March 18, 2007 16:12.25 CDT
Thanks for the feedback anonymous and Nevar.  

I have primarily been working a Win32 application, does windows use protected mode in some applications or inside the kernel?  

I have seen protected mode before in the Linux 2.6 Kernel when I played around it for a few weeks.  Thanks.

  nezumi     March 23, 2007 06:40.10 CDT
there are no more _segments_ in win32, I mean _true_ ones. you have to deal with _selectors_ (they are not the same!), you can't assign selector in user mode. cs:, ds: and ds: selectors are mapped onto the same memory region, so, cs:[xxx] _always_ equal_ ds:[xxx] or ss:[xxx]. the only exception is the fs:, it also mapped onto 4 Gb address space, but it's base address and limit are quite different, however, you may get access to fs:[foo] via ds:[bar], to determine base address on fs you must read GDT table.

"linear = segment<<4 + offset" doesn't work in 32-protect mode.
selectors are not segments, they are like handlers.
0023:[0116005C] is 0023:[0116005C], try to use 0027:[0116001C] and see what happens :)
(23+4):[ 0116005C - 4*0x10]. however, in kernel mode you can create new selector with the same base address and limit as 23, but having #69 number, after that, 0023:[0116005C] and 0069: [0116005C] will point to the same address.

so, to know virtual address, you have to read GDT, take base address of selector and add the offset value. for example, selector #23 have zero base address, so virtual address simple equal offset value (0116005C in your case).

  apridgen   March 23, 2007 12:45.00 CDT
thanks for illustrating nezumi.

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit