4

I have recently joined a company that is specialized in air ducts & ventilation systems and I was quite surprised when I noticed that they are still using a DOS program to calculate the pressure loss of a specific duct system. You see, when air travels through the ductwork it encounters a lot of resistance (bends, ...) and this program calculates the amount of resistance once you enter all the different components of the system.

The program still works today but has to be run on a virtual server running Windows XP, plus the layout is quite ... outdated. I am wondering whether it is possible to reverse engineer this program and put in into a "modern" jacket, + enable easy data instruction.

For instance, today you have to manually enter each component from the system, but it would be a lot easier/faster to run the program on a list of components (extracted from our drawing software). (this is an extra)

I am not a programmer but I saw this thread, which is a quite similar problem and which eventually found a solution.

The program dates back from 1990 and if I open the files in Notepad I can see that it is written in TURBO BASIC. I have .DAT and .EXE files, and also .KAN files (I think those last files are specifically created by the program, which is called LUWKAN). Development of this program has stopped years ago, and even the company does not have the software anymore.

Any help or direction would be much appreciated? I would assume that the source code can be easily examined and copied but I might be too naive.

  • What tools are you already acquainted with? There are modifications of DOSBox (not to mention you could modify it yourself) to debug a DOS program. Additionally there used to be a rather good IDA plugin interfacing with a (debug-enabled) DOSBox. Generally any circumstantial information can be valuable in RCEing a target. Also, in DOS times people used a lot more tricks to deal with limitations of resources. So probably worthwhile grabbing a book like "Programming Pearls" and read up on those tricks. – 0xC0000022L Jun 23 '19 at 11:42
4

I am wondering whether it is possible to reverse engineer this program and put in into a "modern" jacket, + enable easy data instruction.

Yes, it is possible, but not for a non programmer. To do so, one should examine how the calculations are performed and exact formulas used. Then, after obtaining such a knowledge, one could write an application working for modern processors incorporating the techniques used in the original program.

I would assume that the source code can be easily examined and copied but I might be too naive.

It should be easy to examine, especially if the application isn't very complex (which I assume is true since it's an old DOS application). However there are several nuances here:

  1. What you get from the executable file is not the source code of the application. It is a translation from a source code written in human readable high level programming language to a so called machine code, which is a language that is understandable by a computer and instructions contained there are executed directly by CPU.
  2. It will have to be rewritten, i.e. you cannot just copy the code. One of the reasons behind that is that the way of interaction between OS and programs has changed since the time that software was released.
  3. Even if you had the source code of this application, it wouldn't help much and should be rewritten either way (look at the point above) to be compatible with modern OSes.

But it wouldn't be a big problem to analyse and rewrite it (+ add some other features), I think, especially if the computations performed there aren't too complex. I cannot say much more, because you didn't upload the executable.

What I can say however, is that a non programmer just will not do that; you would need some assistance, since it requires both programming and RE knowledge, but it seems being doable.

The tools I could recommend and that I used for reversing DOS programs are:

  • DOSBox Debugger for dynamic analysis (observing program behaviour while being run)
  • IDA for static analysis (analysing program while not running it).

But as I stated above, to take advantage of them, you will need some assistance.

0

It sounds like it's still possible to communicate with the company. Excellent: ask them what their opinions are with

  • reverse engineering the program, expressly to facilitate continuation of business operations

  • publicly disseminating binary copies of the program on the internet, modified or unmodified, also for the express purpose of reverse engineering to facilitate continuation of operations

  • if public dissemination is not agreeable, privately sharing the binary with others without requiring a signed NDA from the would-be recipient

  • allowing the same team performing reverse engineering to also reimplement the required functionality directly, without a clean-room needing to be in the middle (ref: https://en.wikipedia.org/wiki/Clean_room_design)

  • (you may be able to answer this yourself) sharing many screenshots and/or videos (from a camera, or from the obs-studio screen recording software) of what interaction with the program looks like

  • (if you have any .bas files) sharing anything that might appear to constitute program source code, privately or publicly

Essentially you're kind of asking to slightly rearrange your original license agreement :). I look at this a bit like a warranty: your software has completely exceeded all original definitions of maintenance, along with what might be contemporarily regarded as reasonable aftermarket maintenance. The vendor's perspective may differ here.

In the interests of cooperation you might offer to send the vendor any algorithms you recover from any reverse engineering efforts you make. (What is sent may or may not include any modernization/interfaces you add on top, since that is unique effort you are making independently.) Of course such an offer would only be of value to the vendor if they do not offer a modern supercessor to LUKWAN themselves.

In any case, once you have some clear answers, you'll have a concrete legal foundation to built on instead of the current sea of gray you're in right now.

If you can publicly dump the binary on the internet, that will simplify matters greatly; go find a few reverse engineering forums, share the program, and you'll likely receive extremely accurate quotes (and ETAs) in a matter of days. You may end up hiring a team of two or so.

If you can share the program privately without NDA, you can reach a 90%+-as-good situation, especially if you can share images/videos of the program in action. The quote process will just require interested parties to ping you first, and will go somewhat slower as the initial analysis won't be asynchronous.

I'm not sure what sort of rates you'd be looking at, as I have no experience in this field myself. Video and descriptions will likely get a good rough initial estimate.


I took a look at https://en.wikipedia.org/wiki/PowerBASIC, which is what Turbo BASIC got turned into.

Unfortunately for you, one of this particular environment's headline features (back when it was still Turbo BASIC) was that it built native binaries that did not require a bundled runtime.

This generally means you will have to go down the "hard mode" road of full assembly-language reverse engineering... but on the flip side of the coin, while there are eg a huge number of tools out there to eg reverse "compiled" Java or obfuscated JavaScript, by now (2019), any tools to reverse eg the QuickBASIC "compiled program" format (which used bytecode and a runtime interpreter) would probably have either fallen off the edge of the earth or be hiding behind a massive price tag. So that's kind of a nice thing, FWIW.

Clearly noting the program is written in Turbo BASIC when you look for RE assistance will be particularly useful. There are probably people out there very experienced with the peculiarities of the TB compiler.


I am wondering whether it is possible to reverse engineer this program and put in into a "modern" jacket, + enable easy data instruction.

Yes. I can think of two different approaches. Both are complex, and it's hard to say which will work out easier without a good stare at the exact circumstances.

  1. What might be described as the "traditional" RE approach would be to take the program to bits through techniques such as static (IDA Pro, Ghidra, radare2) and dynamic (CodeView, Turbo Debugger, SoftICE) analysis, and attempt to tease the math out from the rest of the program, where it can be straightforwardly reimplemented elsewhere.

    The main risk here is whether the process doesn't catch important algorithmic details or edge case handling. This is the only bit I'm going to make bold: you can aid this process by providing tens to many hundreds of tests. (Start thinking about this process now - say, 10 or so tests of each kind of specific case the program handles should be a good start.)

    If the program is straightforward and the areas where calculation are done are easy to identify (impossible to say without poking the binary) this should mitigate the risk somewhat.

     

  2. A technique that fairly closely follows the literal translation of your notion of making a "jacket" would have you wrap the program in an emulator (such as DOSBox) that has been modified to "export" the state of the screen and accept synthesized keyboard input - and then add a translation layer on top that rapidly keys data in and scrapes the screen for the results.

    The main risk with this approach is the number of screens the program can show, and the complexity involved (is scrolling needed to grab all data? is the next action to perform unambiguously obvious based on what indications are presented on the screen?) in scraping the information.


[...] it would be a lot easier/faster to run the program on a list of components (extracted from our drawing software). (this is an extra)

What format is this list of components generated in?

This may be anything from trivial to mildly complex. The cost to add this capability will be significantly less than the initial RE effort.


I am very interested to hear how this project goes! If you take this question to other forums it would be very cool if you could put links out to the relevant threads. :)

0
  1. File extensions normaly do not help - there is no real standard, there are 1000 of .DAT and .KAN files around with absolutly not relation only the content of the files can give us any hint

  2. an executable does normaly not contain source (or source like stuff), only enough information that the cpu can work with it, nearly not human readable - except by the cracks :)

  3. Is is a small Command line tool or a full blown graphical application?

  4. Can you upload the software somewhere (http://www.tinyupload.com/) - so we are able to analyze or understand how the software is working - or a listing of the directory (screenshot or textfile) to get file sizes, extensions etc.

  5. Does the software run under Dosbox (download here: https://www.dosbox.com/) to get rid of the VM/Win95 dependency and get a feeling how complex the software ist (dongle, hardware dependecies, etc.) -> you could also try: https://github.com/dmsc/emu2 if the program is realy simple, cmd only and if linux is an option, but try DosBox before

  6. its very doable if the size of the program isn't very big

  7. any form of video or something that shows how the software is filled with data, calculating etc. would help (https://www.screentogif.com/)

  8. why do you think that the exe is based on Turbo Basic? Info-String in den Exe? try opening the exe in IDA freeware 5 (https://www.scummvm.org/news/20180331/?lang=en) - only the version 5 freeware is capable to open DOS executables - the current version 7 freeware brings you nowhere ->to get us more detail information about the executable

  9. ALWAYS back up your complete installation, a single save-file in notepad cand kill your exe or data files - better use this tiny freeware hex editor: https://mh-nexus.de/en/hxd/

i've done several small to large reverse engineering projects before - so i known what im talking about :)

!!! 9 questions/statments given => 9 answers/feedbacks required !!!

  • Hi and welcome to RE.SE. While these questions are legit, it's not really appropriate to post them as answer. However, seeing that you have no reputation as of yet, I can see the conundrum you find yourself in. It would be good for the original inquirer to incorporate these questions in the OP and answer them inline. – 0xC0000022L Jul 3 '19 at 10:57
  • thanks for the info will do better next time, ... no response from him since question, maybe he don't get the updates as a non-registered-user :( – llm Jul 3 '19 at 12:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.