In Ollydbg when you look at the segment registers you might see something like this:
ES 0023 32bit 0(FFFFFFFF)
CS 001B 32bit 0(FFFFFFFF)
SS 0023 32bit 0(FFFFFFFF)
DS 0023 32bit 0(FFFFFFFF)
FS 003B 32bit 7FFDE000(FFF)

Does anybody know how OllyDbg is able to calculate 7FFDE000 from 3B, and 0 from 23, 1B etc?? I see no correlation

Thanks for any help

Greetings,

what you are looking at is 32 bit protected mode (and virtual 86 mode to some extend, DOS/BIOS legacy code emulation).

Memory handling in protected mode is not easy to understand, partly because a number of similar items exist in both the segment mechanism and the paging mechanism, often with just enough difference that unless you work with it constantly, you usually need to look things up again to be sure of exactly how each part works.

Win32 makes virtually no use of segmentation at all.
The segments are always set up to allow addressing of the entire 4Gig address space.
Within that address space, there will frequently be parts that 1) aren't present at all, and 2) are only accessible in specific ways.
Certain parts will be executable only, others read only, others read/write, some generally won't be accessible at all unless you happen to have 4Gig of RAM installed.

Now to the values itself:

0x23 consists of the selector 0x20 and the privilege level 3 (this is for user mode).
The selector 0x20 is an index into a table called the global descriptor table (GDT) containing segment descriptions.
The most common one is Base 0, Length 0xffffffff and some flags for right
management etc.

Now armed with that knowlegde we can decode the "rows"

[segment reg] [selector value] [segment size bit = 16/32 bit] [segment base address] [sizeof segment]

If you really want to know more: get some protected mode primers

http://www.internals.com/articles/protmode/protmode.htm ("http://www.internals.com/articles/protmode/protmode.htm") might be useful...

More? -> google is your friend

Regards,

A. Focht