Igor’s Tip of the Week #167: Adding and splitting segments

When analyzing firmware binaries, a proper memory layout is quite important. When loading a raw binary, IDA usually creates a code segment for the whole binary. This is good enough when that code is all you need to analyze, but it is not always the case. For example, the code can refer to external hardware uses as MMIO (memory-mapped I/O), or use extra memory which is not part of the binary image. How to handle such situations?

Creating segments …

binary case code firmware good ida important layout malware analysis memory segment week