3

I've been disassembling an MS-DOS EXE and I've been using this link http://www.delorie.com/djgpp/doc/exe/ to make heads and tails of the binary.

The header seems to be an older version compared to the headers that precede the PE segment found in today's modern Windows executables.

I've been using nasm's (Disassembler), but the program is not as complex as IDA Pro. Finding it hard to find main function entry point, especially with the disassembler engine working on an offset based logic to determine the decoding per instruction and due to the nature I'm also not familiar with the standard.

I'm assuming the IP field in the MS-DOS could be the main function entry point of the executable and was hoping someone or somebody could confirm my speculations.

Improve this question

2 Answers 2

Reset to default
4

The entry point is calculated like this:

((header_paragraphs + cs) << 4) + ip

I wrote a MZ exe disassembler time ago, take a look.

Improve this answer
3
  • Why is it different in your code? github.com/Nico01/ded/blob/master/core.c#L267
    – utahwithak
    Sep 21, 2017 at 17:58
  • 1
    Because i didn't update the github repo with the new changes i made.
    – Nico01
    Sep 22, 2017 at 15:12
  • I figured as much. Doin a deep dive into this have used your tool; would love the latest. Cheers!
    – utahwithak
    Sep 22, 2017 at 16:40
0

The header IP of MSEXE file compiled by C/C++ point to the language runtime initial code that will call main function later. So if you wanna find out the main, you need trace it or read the crt code in clib or src file.

Improve this answer
2
  • If you noticed the tag for my post was DOS EXE and I didn't mention or bring up PE. DOS has 2 binary formats COM and MZ EXE, first being a completely flat file with no header and the later having a header for benefits of the executable surpassing the 64KiB executable size limit. Thus allowing for greater freedom in regards what the software can do, but with reliance on relocation feature that is handled by the loader. During the Load/Execute operation!
    – Nocturnal
    Mar 7, 2017 at 18:11
  • Of couse I know you said is MSDOSEXE not a PE, the highlevel language have the same compiling pattern both EXE and PE.
    – xxldao
    Mar 10, 2017 at 4:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.