2

Have an application that has code to detect serial port model. I'm trying to work out how it works through static analysis. I have unpacked the EXE and can find the references to the strings:

dseg:2DA8 38 32 35 30 00           a8250     db '8250',0      ; DATA XREF: seg124:4EC1↑o
dseg:2DAD 31 36 34 35 30 00        a16450    db '16450',0     ; DATA XREF: seg124:4EC6↑o
dseg:2DB3 31 36 35 35 30 00        a16550    db '16550',0     ; DATA XREF: seg124:4ECB↑o
dseg:2DB9 31 36 35 35 30 41 46 00  a16550af  db '16550AF',0   ; DATA XREF: seg124:4ED0↑o
dseg:2DC1 31 36 35 35 31 00        a16551    db '16551',0     ; DATA XREF: seg124:4ED5↑o
dseg:2DC7 31 36 35 35 32 00        a16552    db '16552',0     ; DATA XREF: seg124:4EDA↑o
dseg:2DCD 38 32 30 35 30 00        a82050    db '82050',0     ; DATA XREF: seg124:4EDF↑o
dseg:2DD3 38 32 35 31 30 00        a82510    db '82510',0     ; DATA XREF: seg124:4EE4↑o

Now when when I hit x to find the XRef for these I am taking to strings and the string length values:

seg124:4EC0 04                               db    4   
seg124:4EC1 A8 2D 26 6A                      dd a8250         ; "8250"
seg124:4EC5 05                               db    5   
seg124:4EC6 AD 2D 26 6A                      dd a16450        ; "16450"
seg124:4ECA 05                               db    5   
seg124:4ECB B3 2D 26 6A                      dd a16550        ; "16550"
seg124:4ECF 07                               db    7   
seg124:4ED0 B9 2D 26 6A                      dd a16550af      ; "16550AF"
seg124:4ED4 05                               db    5   
seg124:4ED5 C1 2D 26 6A                      dd a16551        ; "16551"
seg124:4ED9 05                               db    5   
seg124:4EDA C7 2D 26 6A                      dd a16552        ; "16552"
seg124:4EDE 05                               db    5   
seg124:4EDF CD 2D 26 6A                      dd a82050        ; "82050"
seg124:4EE3 05                               db    5   
seg124:4EE4 D3 2D 26 6A                      dd a82510        ; "82510"

There is no reference to these automatically found by IDA. Is there a value or instruction I could search for to narrow the search. i.e. a reference to seg124:4ECB

I have also tried to use a live debugger but I get Out of Memory error which is why I'm trying to work it out statically

2
  • 1
    Have you tried it in DOSBox? There's a project out there somewhere which helps connecting the "checked" build of DOSBox with IDA. I think IDADos or so?
    – 0xC0000022L
    Nov 11, 2020 at 7:55
  • In the past I was able to use W32Dasm (version 10.0) in order to find string references for 16-bit programs when IDA and Ghidra failed
    – Dvd848
    Nov 12, 2020 at 20:56

2 Answers 2

2

I found the code accessing the string using SoftICE for MS-DOS. To use I did the following:

  1. Add SoftICE driver as first entry in CONFIG.SYS

DEVICE=C:\SICE\S-ICE.EXE /SYM 50

enter image description here

  1. Launch program and Alt+PrintScreen triggered break into SoftICE Window. (SoftIce Documentation also mentioned Ctrl+D but this didn't work for me)

  2. Searched memory for my target string:

s 0 L FFFFFFFF "16550AF

Which output memory address 6AF0:2DB9

  1. Set breakpoint on read/write memory access for that location:

bpm 6AF0:2DB9 RW

enter image description here

  1. X to continue program execution

  2. On breakpoint the instruction mov al,ES:[BX] access the string location

  3. IDA pro was searched for the bytes i.e. 26 8A 07 25 FF 00 75 03 to find the instruction:

1

It seems you have an array of records of the following format:

struct msg_rec
{
 char len;
 char __far *string;
};

(possibly the fields are swapped)

In such case a good strategy is to scroll up until the first read or offset xref - that should be the code which walks or indexes the array and retrieves the string address.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.