1

I have a simple DOS COM program which I want to analyse using Radare2:

  USE16
  ORG 100h

  mov ax, cs
  dec ax
  mov ds, ax

  mov dx, message+10h
  mov ah, 9
  int 21h
  ret

message:   db "Hello there!$"

(Use yasm or echo "jMhIjti6HQG0Cc0hw0hlbGxvIHRoZXJlISQ=" | base64 -d > test.com to compile it to a binary.)

When I load the binary using r2 -b16 test.com radare shows that I'm at 0000:0000.

How can I tell radare that the actual program address should be 0000:0100?

Also how can I tell radare that the offset loaded into the dx register points to message? In other words, can I tell radare that dx is an offset using a segment that starts at 0000:0100 - 0x10?

2

You can use -m 0x100 to load the binary at a specific address, as can be seen in r2 -h output:

-m [addr] map file at given address (loadaddr)

So you can do something like this:

$ r2 -m 0x100 -b 16 test.com

[0000:0100]> aa
[x] Analyze all flags starting with sym. and entry0 (aa)
[0000:0100]> pdf
╭ (fcn) fcn.00000100 13
│   fcn.00000100 ();
│           0000:0100      8cc8           mov ax, cs
│           0000:0102      48             dec ax
│           0000:0103      8ed8           mov ds, ax
│           0000:0105      ba1d01         mov dx, 0x11d                ; 285
│           0000:0108      b409           mov ah, 9
│           0000:010a      cd21           int 0x21                     ; '!'
╰           0000:010c      c3             ret

Regarding your second question, the bytes that interpreted as mov dx, 0x11d are ba1d01. As you can see, 0x01d1 is hard coded so r2 won't add message + to it.

You can create a flag using f str.message 13 @ 0x10d but it would probably not be helpful in your case.

  • Thanks. I tried -m before but it felt a bit hacky. I thought there is a way of manually defining sections/segments where I could specify what is the base address of the section and then instruct r2 to use that section after 0000:0103. – zxxc Sep 27 '18 at 16:49
  • Interestingly, when I do r2 -m 0x110 -b 16 test.com, then f str.message 13 @ 0x11d and then aa, the message will be displayed in the comment and the disassembly becomes mov dx, str.message. Not a solution since code offsets are wrong but it feels so close. :) – zxxc Sep 27 '18 at 16:49
  • Thanks, I accepted the answer since I think you covered everything and nobody seems to know better. Looks like radare2 in its current version is not the right tool to disassemble old 16-bit DOS executables. – zxxc Oct 28 '18 at 21:23

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.