2

I've got an hexdump of COM MSDOS 8086 file, and I'm trying to transform it to COM executable.

After looking around, I found a site1 that gives reasonable disassembly of the hexdump. Although, when I try to use that assembly generated code in a TASM, it doesn't build, and throw errors.

In contrast, I tried also to use IDA, and it does not seem to get the same assembly result as 1.

My questions are:

  1. Is there any other way that I'm missing in transforming hexdump into an executable COM file?
  2. The site gives me expressions like: mov $0x400,%di , but TASM only recognize mov di,400. Is that a better way to translate the hexdumps into instructions that TASM will recognize?

BTW - The context is that I'm trying to solve an RE riddle, which I cannot post online (and I'm a pretty newbie in RE and assembly).

1
  • From the looks of it the Online Disassembler generates the disassembly in the AT&T syntax (mov $0x400,%di), which is odd, given that when I visit the site it gives back Intel syntax. Anyway, the difference is that AT&T syntax is somewhat more verbose and the source operand comes left of the comma as opposed to right of the comma with Intel's syntax.
    – 0xC0000022L
    Jun 30 '18 at 20:25
3

DOS COM files do not have any structure or headers; they are loaded into memory by DOS as-is and are executed from the first byte, so you just need to convert hex bytes to binary to get a COM file.

The difference you see is likely caused by the processor mode setting; mov di, 400h in 16-bit mode and and mov edi, 0x400 in 32-bit mode have exactly the same opcode.

IDA knows that COM files are 16-bit code and disassembles them accordingly, but ODA seems to default to 32-bit mode. To force 16-bit disassembly, select i8086 in the Mode combo box.

6
  • Thanks! in ODA I already chose i8086. my "complains" were about the $, % signs and the fact that the operands were exchanged. Jun 30 '18 at 0:29
  • @user1387682 switch syntax to intel
    – Igor Skochinsky
    Jun 30 '18 at 0:30
  • Thanks, again! Can you guide me how? It does not give me an option (see the screenshot here: ibb.co/dJ08Wd), and the tutorial is not working in this site. Jun 30 '18 at 0:42
  • @user1387682 I see it when I click on the Platform button. maybe try another browser.
    – Igor Skochinsky
    Jun 30 '18 at 0:52
  • I see it only when I choose I386:intel platform. Is it good to the case that I asked (instead of i8086)? Jun 30 '18 at 1:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.