2

I've been disassembling an MS-DOS EXE and I've been using this link http://www.delorie.com/djgpp/doc/exe/ to make heads and tails of the binary.

The header seems to be an older version compared to the headers that precede the PE segment found in today's modern Windows executables.

I've been using nasm's (Disassembler), but the program is not as complex as IDA Pro. Finding it hard to find main function entry point, especially with the disassembler engine working on an offset based logic to determine the decoding per instruction and due to the nature I'm also not familiar with the standard.

I'm assuming the IP field in the MS-DOS could be the main function entry point of the executable and was hoping someone or somebody could confirm my speculations.

3

The entry point is calculated like this:

((header_paragraphs + cs) << 4) + ip

I wrote a MZ exe disassembler time ago, take a look.

0

The header IP of MSEXE file compiled by C/C++ point to the language runtime initial code that will call main function later. So if you wanna find out the main, you need trace it or read the crt code in clib or src file.

  • If you noticed the tag for my post was DOS EXE and I didn't mention or bring up PE. DOS has 2 binary formats COM and MZ EXE, first being a completely flat file with no header and the later having a header for benefits of the executable surpassing the 64KiB executable size limit. Thus allowing for greater freedom in regards what the software can do, but with reliance on relocation feature that is handled by the loader. During the Load/Execute operation! – Nocturnal Mar 7 '17 at 18:11
  • Of couse I know you said is MSDOSEXE not a PE, the highlevel language have the same compiling pattern both EXE and PE. – xxldao Mar 10 '17 at 4:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.