0

So far I batch disassembled all files using following PowerShell and IDA:

$files = Get-Content S:\files.txt
ForEach ($file in $files)
{
    Write-Host "Processing $file"
    &"C:\Program Files\IDA Pro 7.4\ida.exe" -B $file 
}

I then did a simple processing to try and identify DOS APIs used:

$files = Get-ChildItem -Path S:\ -Filter *.asm -Recurse

$ApiNames = @()

ForEach ($file in $files)
{
    Write-Host "Processing $file"
    $content = Get-Content $file.Fullname 
    $APIs = $content | Where-Object { $_.Contains("                int     ") }
    ForEach($API in $APIs)
    {
        if ($API.Contains(";"))
        {
            $split = $API.Split(";").Trim().Replace("     ", " ")
            $ApiName = "$($split[0]) - $($split[1])"
            $ApiName = $ApiName.Replace("- -","-").Trim()
            if ($apiName -eq "int 3 - software interrupt to invoke the debugger") { $apiName = "int 3 - Trap to Debugger" }
            if (!$ApiName.EndsWith(" -"))
            {
                if (!$ApiNames.Contains($ApiName))
                {
                    $ApiNames += $ApiName
                }
            }
        }
    }

}

$SortedApiNames = $ApiNames | Sort-Object

$table = New-Object System.Data.DataTable

$table.Columns.Add("Process")
ForEach ($ApiName in $SortedApiNames)
{
    $table.Columns.Add($ApiName)
}

ForEach ($file in $files)
{
    Write-Host "Processing $file"
    $content = Get-Content $file.Fullname 
    $APIs = $content | Where-Object { $_.Contains("                int     ") }
    $row = @()
    $row+= $file.FullName
    $ApiList = @()
    ForEach($API in $APIs)
    {
        if ($API.Contains(";"))
        {
            $split = $API.Split(";").Trim().Replace("     ", " ")
            $ApiName = "$($split[0]) - $($split[1])"
            $ApiName = $ApiName.Replace("- -","-").Trim()
            if ($apiName -eq "int 3 - software interrupt to invoke the debugger") { $apiName = "int 3 - Trap to Debugger" }
            $ApiList+=$ApiName
        }
    }

    For($i=1;$i -lt $table.Columns.Count;$i++)
    {
        if ($ApiList.Contains($table.Columns[$i].ColumnName))
        {
            $row+= "Yes"
        }
        else
        {
            $row+="No"
        }
    }

    $table.Rows.Add($row)

}

$table | Export-Csv -NoTypeInformation APIUse.csv

This identified the following interrupt calls used:

int 0C7h - used by BASIC while in interpreter
int 0Dh - IRQ5 - FIXED DISK (PC), LPT2 (AT/PS)
int 0E4h - used by BASIC while in interpreter
int 0Fh - IRQ7 - PRINTER INTERRUPT
int 10h - VIDEO - ALTERNATE FUNCTION SELECT (PS, EGA, VGA, MCGA) - GET EGA INFO
int 10h - VIDEO - DISPLAY COMBINATION (PS,VGA/MCGA): read display combination code
int 10h - VIDEO - GET CURRENT VIDEO MODE
int 10h - VIDEO - GET INDIVIDUAL PALETTE REGISTER (VGA)
int 10h - VIDEO - INSTALLATION CHECK (Video7 VGA,VEGA VGA)
int 10h - VIDEO - Microsoft Mouse driver EGA support - WRITE ONE REGISTER
int 10h - VIDEO - READ ATTRIBUTES/CHARACTER AT CURSOR POSITION
int 10h - VIDEO - READ CURSOR POSITION
int 10h - VIDEO - READ INDIVIDUAL DAC REGISTER (EGA, VGA/MCGA)
int 10h - VIDEO - SCROLL PAGE UP
int 10h - VIDEO - SELECT DISPLAY PAGE
int 10h - VIDEO - SET CURSOR CHARACTERISTICS
int 10h - VIDEO - SET CURSOR POSITION
int 10h - VIDEO - SET INDIVIDUAL DAC REGISTER (EGA, VGA/MCGA)
int 10h - VIDEO - SET VIDEO MODE
int 10h - VIDEO - WRITE ATTRIBUTES/CHARACTERS AT CURSOR POSITION
int 10h - VIDEO - WRITE CHARACTERS ONLY AT CURSOR POSITION
int 11h - EQUIPMENT DETERMINATION
int 15h - Get Extended Memory Size
int 15h - SYSTEM - GET CONFIGURATION (XT after 1/10/86,AT mdl 3x9,CONV,XT286,PS)
int 16h - KEYBOARD - CHECK BUFFER, DO NOT CLEAR
int 16h - KEYBOARD - GET SHIFT STATUS
int 16h - KEYBOARD - READ CHAR FROM BUFFER, WAIT IF EMPTY
int 1Ah - CLOCK - GET TIME OF DAY
int 20h - DOS - PROGRAM TERMINATION
int 21h - DOS - 2+ - ADJUST MEMORY BLOCK SIZE (SETBLOCK)
int 21h - DOS - 2+ - ALLOCATE MEMORY
int 21h - DOS - 2+ - CHANGE THE CURRENT DIRECTORY (CHDIR)
int 21h - DOS - 2+ - CLOSE A FILE WITH HANDLE
int 21h - DOS - 2+ - CREATE A FILE WITH HANDLE (CREAT)
int 21h - DOS - 2+ - CREATE A SUBDIRECTORY (MKDIR)
int 21h - DOS - 2+ - CREATE DUPLICATE HANDLE (DUP)
int 21h - DOS - 2+ - DELETE A FILE (UNLINK)
int 21h - DOS - 2+ - FIND FIRST ASCIZ (FINDFIRST)
int 21h - DOS - 2+ - FIND NEXT ASCIZ (FINDNEXT)
int 21h - DOS - 2+ - FORCE DUPLICATE HANDLE (FORCDUP,DUP2)
int 21h - DOS - 2+ - FREE MEMORY
int 21h - DOS - 2+ - GET COUNTRY-DEPENDENT INFORMATION
int 21h - DOS - 2+ - GET CURRENT DIRECTORY
int 21h - DOS - 2+ - GET DISK SPACE
int 21h - DOS - 2+ - GET EXIT CODE OF SUBPROGRAM (WAIT)
int 21h - DOS - 2+ - GET FILE ATTRIBUTES
int 21h - DOS - 2+ - GET FILE'S DATE/TIME
int 21h - DOS - 2+ - GET INTERRUPT VECTOR
int 21h - DOS - 2+ - GET VERIFY FLAG
int 21h - DOS - 2+ - IOCTL - GET DEVICE INFORMATION
int 21h - DOS - 2+ - IOCTL - READ CHARACTER DEVICE CONTROL STRING
int 21h - DOS - 2+ - IOCTL - SET DEVICE INFORMATION
int 21h - DOS - 2+ - LOAD OR EXECUTE (EXEC)
int 21h - DOS - 2+ - MOVE FILE READ/WRITE POINTER (LSEEK)
int 21h - DOS - 2+ - OPEN DISK FILE WITH HANDLE
int 21h - DOS - 2+ - QUIT WITH EXIT CODE (EXIT)
int 21h - DOS - 2+ - READ FROM FILE WITH HANDLE
int 21h - DOS - 2+ - REMOVE A DIRECTORY ENTRY (RMDIR)
int 21h - DOS - 2+ - RENAME A FILE
int 21h - DOS - 2+ - SET FILE ATTRIBUTES
int 21h - DOS - 2+ - SET FILE'S DATE/TIME
int 21h - DOS - 2+ - WRITE TO FILE WITH HANDLE
int 21h - DOS - 2+ internal - GET LIST OF LISTS
int 21h - DOS - 2+ internal - GET SWITCHAR/AVAILDEV
int 21h - DOS - 2+ internal - RETURN CritSectFlag (InDOS) POINTER
int 21h - DOS - 2+ internal - SET PSP SEGMENT
int 21h - DOS - 3.1+ internal - GET ADDRESS OF DOS SWAPPABLE DATA AREA
int 21h - DOS - 3+ - CREATE NEW FILE
int 21h - DOS - 3+ - GET EXTENDED ERROR CODE
int 21h - DOS - 3+ - GET PSP ADDRESS
int 21h - DOS - 4.0 - EXTENDED OPEN/CREATE
int 21h - DOS - BUFFERED KEYBOARD INPUT
int 21h - DOS - CLEAR KEYBOARD BUFFER
int 21h - DOS - DIRECT CONSOLE I/O CHARACTER OUTPUT
int 21h - DOS - DIRECT STDIN INPUT, NO ECHO
int 21h - DOS - DISK RESET
int 21h - DOS - DISPLAY OUTPUT
int 21h - DOS - DOS 2+ - TERMINATE BUT STAY RESIDENT
int 21h - DOS - DOS v??? - OEM FUNCTION
int 21h - DOS - EXTENDED CONTROL-BREAK CHECKING
int 21h - DOS - GET ALLOCATION TABLE INFORMATION FOR SPECIFIC DRIVE
int 21h - DOS - GET CURRENT DATE
int 21h - DOS - GET CURRENT TIME
int 21h - DOS - GET DEFAULT DISK NUMBER
int 21h - DOS - GET DISK TRANSFER AREA ADDRESS
int 21h - DOS - GET DOS VERSION
int 21h - DOS - KEYBOARD INPUT
int 21h - DOS - KEYBOARD INPUT, NO ECHO
int 21h - DOS - Novell Advanced NetWare 2.0+ - FILE SERVER FILE COPY
int 21h - DOS - PARSE FILENAME
int 21h - DOS - PRINT STRING
int 21h - DOS - SELECT DISK
int 21h - DOS - SET CURRENT DATE
int 21h - DOS - SET CURRENT TIME
int 21h - DOS - SET DISK TRANSFER AREA ADDRESS
int 21h - DOS - SET INTERRUPT VECTOR
int 21h - DOS - SET VERIFY FLAG
int 2Fh - Multiplex - MS WINDOWS -  3+ - BEGIN CRITICAL SECTION
int 2Fh - Multiplex - MS WINDOWS - ENHANCED WINDOWS INSTALLATION CHECK
int 2Fh - Multiplex - MS WINDOWS - Mode Interface - INSTALLATION CHECK
int 2Fh - Multiplex - XMS - GET DRIVER ADDRESS
int 2Fh - Multiplex - XMS - INSTALLATION CHECK
int 3 - Trap to Debugger
int 31h - DPMI Services   ax=func xxxxh
int 33h - MS MOUSE - DEFINE DOUBLE-SPEED THRESHOLD
int 33h - MS MOUSE - DEFINE INTERRUPT SUBROUTINE PARAMETERS
int 33h - MS MOUSE - DEFINE SCREEN REGION FOR UPDATING
int 33h - MS MOUSE - DEFINE TEXT CURSOR
int 33h - MS MOUSE - HIDE MOUSE CURSOR
int 33h - MS MOUSE - POSITION MOUSE CURSOR
int 33h - MS MOUSE - READ MOTION COUNTERS
int 33h - MS MOUSE - RESET DRIVER AND READ STATUS
int 33h - MS MOUSE - RESTORE DRIVER STATE
int 33h - MS MOUSE - RETURN DRIVER STORAGE REQUIREMENTS
int 33h - MS MOUSE - RETURN POSITION AND BUTTON STATUS
int 33h - MS MOUSE - SAVE DRIVER STATE
int 33h - MS MOUSE - SHOW MOUSE CURSOR
int 3Fh - Overlay manager interrupt
int 48h - PCjr - Cordless Keyboard Translation
int 67h - LIM EMS - GET HANDLE AND ALLOCATE MEMORY
int 67h - LIM EMS - GET NUMBER OF PAGES
int 67h - LIM EMS - GET PAGE FRAME SEGMENT
int 67h - LIM EMS - MAP MEMORY
int 67h - LIM EMS - RELEASE HANDLE AND MEMORY
int 67h - LIM EMS 4.0 - REALLOCATE PAGES
int 67h - LIM EMS Program Interface - FREE 4K PAGE
int 67h - LIM EMS Program Interface - GET 8259 INTERRUPT VECTOR MAPPINGS
int 67h - LIM EMS Program Interface - GET PROTECTED MODE INTERFACE
int 67h - LIM EMS Program Interface - INSTALLATION CHECK
int 67h - LIM EMS Program Interface - SWITCH TO PROTECTED MODE
int 75h - IRQ13 - AT/XT286/PS50+ - 80287 ERROR
int 7Ah - Novell NetWare to v2.0a - LOW-LEVEL API
int 89h - used by BASIC while in interpreter
int 8Ch - used by BASIC while in interpreter
int 91h - used by BASIC while in interpreter
int 98h - used by BASIC while in interpreter

What can I look for to confirm if an app uses DOS/4GW?

1 Answer 1

2

DOS/4GW executables normally use LE (linear executable) format for the actual main program (the DOS stub is just a launcher for the DOS4GW.EXE extender) and should be detected as such by IDA so you can probably just check the loaded file format.

1
  • I found the executables with text "Format : Linear Executable (LE)" Jan 29, 2020 at 21:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.