Within A Folder of 100s of 16-bit MS-DOS Disassembled EXEs Identify Ones That Need/Use DOS/4GW

Question

So far I batch disassembled all files using following PowerShell and IDA:

$files = Get-Content S:\files.txt
ForEach ($file in $files)
{
    Write-Host "Processing $file"
    &"C:\Program Files\IDA Pro 7.4\ida.exe" -B $file 
}

I then did a simple processing to try and identify DOS APIs used:

$files = Get-ChildItem -Path S:\ -Filter *.asm -Recurse

$ApiNames = @()

ForEach ($file in $files)
{
    Write-Host "Processing $file"
    $content = Get-Content $file.Fullname 
    $APIs = $content | Where-Object { $_.Contains("                int     ") }
    ForEach($API in $APIs)
    {
        if ($API.Contains(";"))
        {
            $split = $API.Split(";").Trim().Replace("     ", " ")
            $ApiName = "$($split[0]) - $($split[1])"
            $ApiName = $ApiName.Replace("- -","-").Trim()
            if ($apiName -eq "int 3 - software interrupt to invoke the debugger") { $apiName = "int 3 - Trap to Debugger" }
            if (!$ApiName.EndsWith(" -"))
            {
                if (!$ApiNames.Contains($ApiName))
                {
                    $ApiNames += $ApiName
                }
            }
        }
    }

}

$SortedApiNames = $ApiNames | Sort-Object

$table = New-Object System.Data.DataTable

$table.Columns.Add("Process")
ForEach ($ApiName in $SortedApiNames)
{
    $table.Columns.Add($ApiName)
}

ForEach ($file in $files)
{
    Write-Host "Processing $file"
    $content = Get-Content $file.Fullname 
    $APIs = $content | Where-Object { $_.Contains("                int     ") }
    $row = @()
    $row+= $file.FullName
    $ApiList = @()
    ForEach($API in $APIs)
    {
        if ($API.Contains(";"))
        {
            $split = $API.Split(";").Trim().Replace("     ", " ")
            $ApiName = "$($split[0]) - $($split[1])"
            $ApiName = $ApiName.Replace("- -","-").Trim()
            if ($apiName -eq "int 3 - software interrupt to invoke the debugger") { $apiName = "int 3 - Trap to Debugger" }
            $ApiList+=$ApiName
        }
    }

    For($i=1;$i -lt $table.Columns.Count;$i++)
    {
        if ($ApiList.Contains($table.Columns[$i].ColumnName))
        {
            $row+= "Yes"
        }
        else
        {
            $row+="No"
        }
    }

    $table.Rows.Add($row)

}

$table | Export-Csv -NoTypeInformation APIUse.csv

This identified the following interrupt calls used:

int 0C7h - used by BASIC while in interpreter
int 0Dh - IRQ5 - FIXED DISK (PC), LPT2 (AT/PS)
int 0E4h - used by BASIC while in interpreter
int 0Fh - IRQ7 - PRINTER INTERRUPT
int 10h - VIDEO - ALTERNATE FUNCTION SELECT (PS, EGA, VGA, MCGA) - GET EGA INFO
int 10h - VIDEO - DISPLAY COMBINATION (PS,VGA/MCGA): read display combination code
int 10h - VIDEO - GET CURRENT VIDEO MODE
int 10h - VIDEO - GET INDIVIDUAL PALETTE REGISTER (VGA)
int 10h - VIDEO - INSTALLATION CHECK (Video7 VGA,VEGA VGA)
int 10h - VIDEO - Microsoft Mouse driver EGA support - WRITE ONE REGISTER
int 10h - VIDEO - READ ATTRIBUTES/CHARACTER AT CURSOR POSITION
int 10h - VIDEO - READ CURSOR POSITION
int 10h - VIDEO - READ INDIVIDUAL DAC REGISTER (EGA, VGA/MCGA)
int 10h - VIDEO - SCROLL PAGE UP
int 10h - VIDEO - SELECT DISPLAY PAGE
int 10h - VIDEO - SET CURSOR CHARACTERISTICS
int 10h - VIDEO - SET CURSOR POSITION
int 10h - VIDEO - SET INDIVIDUAL DAC REGISTER (EGA, VGA/MCGA)
int 10h - VIDEO - SET VIDEO MODE
int 10h - VIDEO - WRITE ATTRIBUTES/CHARACTERS AT CURSOR POSITION
int 10h - VIDEO - WRITE CHARACTERS ONLY AT CURSOR POSITION
int 11h - EQUIPMENT DETERMINATION
int 15h - Get Extended Memory Size
int 15h - SYSTEM - GET CONFIGURATION (XT after 1/10/86,AT mdl 3x9,CONV,XT286,PS)
int 16h - KEYBOARD - CHECK BUFFER, DO NOT CLEAR
int 16h - KEYBOARD - GET SHIFT STATUS
int 16h - KEYBOARD - READ CHAR FROM BUFFER, WAIT IF EMPTY
int 1Ah - CLOCK - GET TIME OF DAY
int 20h - DOS - PROGRAM TERMINATION
int 21h - DOS - 2+ - ADJUST MEMORY BLOCK SIZE (SETBLOCK)
int 21h - DOS - 2+ - ALLOCATE MEMORY
int 21h - DOS - 2+ - CHANGE THE CURRENT DIRECTORY (CHDIR)
int 21h - DOS - 2+ - CLOSE A FILE WITH HANDLE
int 21h - DOS - 2+ - CREATE A FILE WITH HANDLE (CREAT)
int 21h - DOS - 2+ - CREATE A SUBDIRECTORY (MKDIR)
int 21h - DOS - 2+ - CREATE DUPLICATE HANDLE (DUP)
int 21h - DOS - 2+ - DELETE A FILE (UNLINK)
int 21h - DOS - 2+ - FIND FIRST ASCIZ (FINDFIRST)
int 21h - DOS - 2+ - FIND NEXT ASCIZ (FINDNEXT)
int 21h - DOS - 2+ - FORCE DUPLICATE HANDLE (FORCDUP,DUP2)
int 21h - DOS - 2+ - FREE MEMORY
int 21h - DOS - 2+ - GET COUNTRY-DEPENDENT INFORMATION
int 21h - DOS - 2+ - GET CURRENT DIRECTORY
int 21h - DOS - 2+ - GET DISK SPACE
int 21h - DOS - 2+ - GET EXIT CODE OF SUBPROGRAM (WAIT)
int 21h - DOS - 2+ - GET FILE ATTRIBUTES
int 21h - DOS - 2+ - GET FILE'S DATE/TIME
int 21h - DOS - 2+ - GET INTERRUPT VECTOR
int 21h - DOS - 2+ - GET VERIFY FLAG
int 21h - DOS - 2+ - IOCTL - GET DEVICE INFORMATION
int 21h - DOS - 2+ - IOCTL - READ CHARACTER DEVICE CONTROL STRING
int 21h - DOS - 2+ - IOCTL - SET DEVICE INFORMATION
int 21h - DOS - 2+ - LOAD OR EXECUTE (EXEC)
int 21h - DOS - 2+ - MOVE FILE READ/WRITE POINTER (LSEEK)
int 21h - DOS - 2+ - OPEN DISK FILE WITH HANDLE
int 21h - DOS - 2+ - QUIT WITH EXIT CODE (EXIT)
int 21h - DOS - 2+ - READ FROM FILE WITH HANDLE
int 21h - DOS - 2+ - REMOVE A DIRECTORY ENTRY (RMDIR)
int 21h - DOS - 2+ - RENAME A FILE
int 21h - DOS - 2+ - SET FILE ATTRIBUTES
int 21h - DOS - 2+ - SET FILE'S DATE/TIME
int 21h - DOS - 2+ - WRITE TO FILE WITH HANDLE
int 21h - DOS - 2+ internal - GET LIST OF LISTS
int 21h - DOS - 2+ internal - GET SWITCHAR/AVAILDEV
int 21h - DOS - 2+ internal - RETURN CritSectFlag (InDOS) POINTER
int 21h - DOS - 2+ internal - SET PSP SEGMENT
int 21h - DOS - 3.1+ internal - GET ADDRESS OF DOS SWAPPABLE DATA AREA
int 21h - DOS - 3+ - CREATE NEW FILE
int 21h - DOS - 3+ - GET EXTENDED ERROR CODE
int 21h - DOS - 3+ - GET PSP ADDRESS
int 21h - DOS - 4.0 - EXTENDED OPEN/CREATE
int 21h - DOS - BUFFERED KEYBOARD INPUT
int 21h - DOS - CLEAR KEYBOARD BUFFER
int 21h - DOS - DIRECT CONSOLE I/O CHARACTER OUTPUT
int 21h - DOS - DIRECT STDIN INPUT, NO ECHO
int 21h - DOS - DISK RESET
int 21h - DOS - DISPLAY OUTPUT
int 21h - DOS - DOS 2+ - TERMINATE BUT STAY RESIDENT
int 21h - DOS - DOS v??? - OEM FUNCTION
int 21h - DOS - EXTENDED CONTROL-BREAK CHECKING
int 21h - DOS - GET ALLOCATION TABLE INFORMATION FOR SPECIFIC DRIVE
int 21h - DOS - GET CURRENT DATE
int 21h - DOS - GET CURRENT TIME
int 21h - DOS - GET DEFAULT DISK NUMBER
int 21h - DOS - GET DISK TRANSFER AREA ADDRESS
int 21h - DOS - GET DOS VERSION
int 21h - DOS - KEYBOARD INPUT
int 21h - DOS - KEYBOARD INPUT, NO ECHO
int 21h - DOS - Novell Advanced NetWare 2.0+ - FILE SERVER FILE COPY
int 21h - DOS - PARSE FILENAME
int 21h - DOS - PRINT STRING
int 21h - DOS - SELECT DISK
int 21h - DOS - SET CURRENT DATE
int 21h - DOS - SET CURRENT TIME
int 21h - DOS - SET DISK TRANSFER AREA ADDRESS
int 21h - DOS - SET INTERRUPT VECTOR
int 21h - DOS - SET VERIFY FLAG
int 2Fh - Multiplex - MS WINDOWS -  3+ - BEGIN CRITICAL SECTION
int 2Fh - Multiplex - MS WINDOWS - ENHANCED WINDOWS INSTALLATION CHECK
int 2Fh - Multiplex - MS WINDOWS - Mode Interface - INSTALLATION CHECK
int 2Fh - Multiplex - XMS - GET DRIVER ADDRESS
int 2Fh - Multiplex - XMS - INSTALLATION CHECK
int 3 - Trap to Debugger
int 31h - DPMI Services   ax=func xxxxh
int 33h - MS MOUSE - DEFINE DOUBLE-SPEED THRESHOLD
int 33h - MS MOUSE - DEFINE INTERRUPT SUBROUTINE PARAMETERS
int 33h - MS MOUSE - DEFINE SCREEN REGION FOR UPDATING
int 33h - MS MOUSE - DEFINE TEXT CURSOR
int 33h - MS MOUSE - HIDE MOUSE CURSOR
int 33h - MS MOUSE - POSITION MOUSE CURSOR
int 33h - MS MOUSE - READ MOTION COUNTERS
int 33h - MS MOUSE - RESET DRIVER AND READ STATUS
int 33h - MS MOUSE - RESTORE DRIVER STATE
int 33h - MS MOUSE - RETURN DRIVER STORAGE REQUIREMENTS
int 33h - MS MOUSE - RETURN POSITION AND BUTTON STATUS
int 33h - MS MOUSE - SAVE DRIVER STATE
int 33h - MS MOUSE - SHOW MOUSE CURSOR
int 3Fh - Overlay manager interrupt
int 48h - PCjr - Cordless Keyboard Translation
int 67h - LIM EMS - GET HANDLE AND ALLOCATE MEMORY
int 67h - LIM EMS - GET NUMBER OF PAGES
int 67h - LIM EMS - GET PAGE FRAME SEGMENT
int 67h - LIM EMS - MAP MEMORY
int 67h - LIM EMS - RELEASE HANDLE AND MEMORY
int 67h - LIM EMS 4.0 - REALLOCATE PAGES
int 67h - LIM EMS Program Interface - FREE 4K PAGE
int 67h - LIM EMS Program Interface - GET 8259 INTERRUPT VECTOR MAPPINGS
int 67h - LIM EMS Program Interface - GET PROTECTED MODE INTERFACE
int 67h - LIM EMS Program Interface - INSTALLATION CHECK
int 67h - LIM EMS Program Interface - SWITCH TO PROTECTED MODE
int 75h - IRQ13 - AT/XT286/PS50+ - 80287 ERROR
int 7Ah - Novell NetWare to v2.0a - LOW-LEVEL API
int 89h - used by BASIC while in interpreter
int 8Ch - used by BASIC while in interpreter
int 91h - used by BASIC while in interpreter
int 98h - used by BASIC while in interpreter

What can I look for to confirm if an app uses DOS/4GW?

Igor Skochinsky · Accepted Answer · 2020-01-29 12:43:01Z

2

DOS/4GW executables normally use LE (linear executable) format for the actual main program (the DOS stub is just a launcher for the DOS4GW.EXE extender) and should be detected as such by IDA so you can probably just check the loaded file format.

answered Jan 29, 2020 at 12:43

Igor Skochinsky♦

36.4k7 gold badges64 silver badges115 bronze badges

I found the executables with text "Format : Linear Executable (LE)"
– chentiangemalc
Jan 29, 2020 at 21:02

Add a comment |

Stack Exchange Network

Within A Folder of 100s of 16-bit MS-DOS Disassembled EXEs Identify Ones That Need/Use DOS/4GW

1 Answer 1

Your Answer

Not the answer you're looking for? Browse other questions tagged
disassembly
dos
dos-exe
or ask your own question.

Hot Network Questions

Within A Folder of 100s of 16-bit MS-DOS Disassembled EXEs Identify Ones That Need/Use DOS/4GW

1 Answer 1

Your Answer

Sign up or log in

Post as a guest

Not the answer you're looking for? Browse other questions tagged disassemblydosdos-exe or ask your own question.

Hot Network Questions

Not the answer you're looking for? Browse other questions tagged
disassembly
dos
dos-exe
or ask your own question.