Finding API in ROM dump (DOS debug)

Question

Have dumped the ROM from a HP 200LX using these instructions:

debug #Enters the debug mode
r bx #Reads the bx register and prompts you to enter a new value
30 #The new value for bx
r cx #Reads the cx register and prompts you to enter a new value
0000 #The new value for cx
n 3M.bin #The name of the dump file
w 0:0 #Write out the data, starting at offset 0:0

and see some interesting strings in the data, but would like to investigate in a more technically sophisticated manner.

What would be the easiest way to find APIs, ie procedure entry points? Am particularly interested in the cc:Mail Vendor Independent Messaging API which I suspect hides there somewhere.

There is also at least one binary file on the disk which seems related, so ideally I would like a tool that reads both the ROM dump and this file together.

Answer 1

In DOS programs, a common sequence to look for is a sequence of push instructions, interleaved with sub sp,<size-of-local-vars>. This is a typical entry to a function. Whether this is an API entry point is harder to determine without more information. You could use a disassembler tool that is capable of handling MS-DOS images (like Reko, https://github.com/uxmal/reko) to perform a heuristic scan of the binary and then look at procedures with 0 callers. This gives you a starting point.