1

I've tried to analyze this small exe online.

I've tried with https://onlinedisassembler.com/odaweb/ (link) but it's hard for me to get the first question: enter image description here

Why the tool doesn't try to detect the set of instruction by itself? Dos program could run on architectures different from x86? The base address wasn't the same for every dos program?

I tried also with IDA Free, but it says there are tons of problems enter image description here

I also tried with radare2 but it's really hard for me..

I've found this info through virustotal:
File type   DOS EXE
Magic   MS-DOS executable, MZ for MS-DOS
TrID    EXEPACK compressed DOS Executable (68.2%)
TrID    Clipper DOS Executable (10.5%)
TrID    Generic Win/DOS Executable (10.5%)
TrID    DOS Executable Generic (10.4%)
TrID    VXD Driver (0.1%)
File size   63.16 KB (64680 bytes)

EDIT: thanks to the advice I used radare + a graphical interface called Cutter. It seems to work properly but I can't understand how to export the whole pseudocode

the pseudocode

Improve this question
9
  • “start” should be the entry point
    – Igor Skochinsky ♦
    Mar 21, 2021 at 10:06
  • 1
    EXE files are relocatable. They get adjusted during loading so that changes of the base address do not affect execution. A typical suggestion is to load DOS exe files at an address like 1000:0000, to prevent access to well-known memory areas of a DOS system being misidentified as access to memory areas belonging to the program. As the interrupt vectors and the bios state is near address 0, it is generally unwise to load EXE files with base address 0 into a reverse enigineering tool.
    – Michael Karcher
    Mar 23, 2021 at 17:20
  • 1
    Just ignore the IDA "problems" window for now. IDA just points out where the automatic analysis is unsure how to interpret some areas of code. As long as you have no problems reading the parts you are interested in, and you don't rely on Xrefs being complete, there is no harm in having lots of problem in highly optimized library code.
    – Michael Karcher
    Mar 23, 2021 at 17:22
  • 1
    @Revious you need a "decompiler" to get pseudocode. There are multiple decompilers available, most include their own disassembler. GHIDRA includes a decompiler for free. IDA has an optional decompiler for a lot of $$$ (called HexRays), and AFAIK radare2 also includes some decompiler. In my experience, the GHIDRA decompiler output on segmented 16-bit executables is mediodcre. I don't think I tried other decompilers on 16-bit executables seriously, yet.
    – Michael Karcher
    Mar 24, 2021 at 7:03
  • 1
    Did you give the old "debug" command a try? It's an old Windows debugger that's mainly dedicated for older 16-bit COM/EXE executables.
    – Abdullah Mohamed
    Mar 28, 2021 at 8:57

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.