0

when trying to decompile some interrupt service routines done with Watcom, the __GETDS call at the beginning of the functions will break the decompiler output completely. Here's the disassembly: Disassembly

And here the decompiler output: Decompiler

What could be the reason for this? Is there a way to fix this? The only thing that worked for me was creating a separate function for the code below __GETDS, but that's not really satisfying. Thanks in advance!

1

This happens because __GETDS is placed just after the entrypoint code and is initially detected by IDA as part of the start function:

cseg01:0001AAD1                 push    eax
cseg01:0001AAD2                 mov     eax, 0
cseg01:0001AAD7                 mov     edx, 0Fh
cseg01:0001AADC                 call    __FiniRtns
cseg01:0001AAE1                 pop     eax
cseg01:0001AAE2                 mov     ah, 4Ch ; 'L'
cseg01:0001AAE4                 int     21h             ; DOS - 2+ - QUIT WITH EXIT CODE (EXIT)
cseg01:0001AAE4                                         ; AL = exit code
cseg01:0001AAE6                 mov     eax, eax
cseg01:0001AAE8
cseg01:0001AAE8 __GETDS:                                ; CODE XREF: __int23_handler+A↓p
cseg01:0001AAE8                                         ; __int_ctrl_break_handler+A↓p ...
cseg01:0001AAE8 __GETDSStart_:
cseg01:0001AAE8                 mov     ds, cs:word_1AAF1
cseg01:0001AAF0                 retn
cseg01:0001AAF0 start           endp

Since the call is to a middle of an existing function, IDA considers it to be non-returning and stops the code flow. The solution is to break start after the int 21h call (Set function end, or 'E' key) and create a proper function for __GETDS itself. Then you will need to reanalyze all call sites (and maybe recreate the functions) so that code flow is properly updated.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.