23

I have some crucial data written decades ago by an ancient 16bit DOS application. There are no docs, no source, and no information about the author. Just the 16 bit exe. I guess it's time for me to learn how to decompile stuff, since it seems the only way to restore file format. I've tried OllyDbg, it looks really great, but it can't 16 bit. Is there a disassembler/debugger capable of working with such executables?

I know DOSbox, the app runs in it all right. The problem is, I don't need to run it, I need to understand the file format in which it writes data. Do you think starting some old 16bit DOS debugger/decompiler in DOSbox sounds like an idea? If yes, could you please name a decent DOS debugger?

Thanks.

P.S.: I copypasted this question from StackOverflow, because I didn't know about ReverseEngineering section when I was asking it. Please delete it if it's against the rules.

  • 4
    Can you share one, or preferably more, data files? Decompiling an entire executable is a lot of work. If you have a general idea what to look for -- magic values, constants, data structures, etc. -- you can concentrate on relevant parts only, rather than disassembling some huge routine that turns out to only calculate the width of a dialog box. – usr2564301 Nov 23 '13 at 10:20
  • 2
    It sounds a bit as if you are underestimating this task, hence my comment; Depending on the complexity of the written data (mostly text vs. plenty of mixed binary data) and the expected precision of your file-format reversing, the expectable investment for achieving your goal might easily exceed a month of hard work. – Till Nov 29 '13 at 23:22
  • I recommend to using Turbo Debugger as @Ange's answer. Because the UI of TD is similar to the OllyDbg as you like. Link to download: phatcode.net/downloads.php?id=280 – tuantm Aug 29 '14 at 6:26
11

2 great disassemblers... lost in time. SPECIFICALLY for DOS and 16 bit programs. They were the IDA PRO of THEIR days...

  1. WCB (EXTREMELY rare to find. NEVER misses beginnings of a routine. NEVER)

  2. SOURCERER (IF you can find it. THE disassembler to go to when professionals wanted to disassemble any file. INDUSTRIAL strength, MORE OPTIONS that you can throw a bone at, EXTREMELY USEFUL. Don't forget to download INTERRUPT LIST interpretations and COLLECT INTERRUPT lists at the end).

IDA is good. Not nearly good enough when it comes to these two.

My personal choice --- SOURCERER.

SYMDEB.EXE, the symbolic debugger from microsoft FOR DOS. Turbodebugger --- not that much.

Hope that helps.

Anonymous.

  • 2
    are you sure it's not Sourcer, from V Communications ? I didn't mention it because it wouldn't enable to take note and manipulate them like IDA would. – Ange Nov 23 '13 at 10:34
  • Looks like WCB stands for 'Windows CodeBack'. Its Readme says this: "The current version does not include support for conventional DOS .EXE files". – ScumCoder Nov 23 '13 at 14:07
  • 1
    well, most DOS tools aren't for sale anymore ;) – Ange Nov 29 '13 at 8:23
  • 1
    It looks like you want to google "wcb105a.zip" for WCB. It's actually surprisingly findable. If 1.05 is not the newest version, I'd appreciate finding out. – i336_ Sep 17 '17 at 10:50
  • 1
    It is indeed possible to find wcb. For my particular old dos .exe it however says I need dll files, which I don't have. – dorien Apr 24 '18 at 4:33
5
  • there are no decent decompiler for 16b DOS afaik

  • Dosbox has an integrated debugger, otherwise try TurboDebugger - and opening the file in IDA simultaneously to document on the go. Also check this recent blogpost about such a situation.

3

If you don't care about dynamic analysis, you should give a try to radare2 (a free software), that can (among other things) disassemble 16bit DOS binaries very well.

  • 2
    Disassembling is the bare minimum for reversing, though. – Ange Nov 29 '13 at 10:49
3

Two useful DOS debuggers come into my mind:

  1. SoftIce

  2. DeGlucker.

SoftIce is commercial, DeGlucker is freeware.

Edit: Gametools (G3X) is also a very useful TSR debugger for DOS. The best feature in Gametools is its memory scanner that can scan memory for exact values, for greater values than previous time and for lesser values than previous time. Then you can set hardware memory breakpoints on the matching memory addresses (when you have sufficiently few memory addresses left, usually after some rounds) and that way you can find the essential routines that access those memory addresses. If I had to reverse-engineer a DOS application, I would definitely start with Gametools.

3

I know this question is old, but for future reference. You can download DOSBOX Debug version. It will give you a nice debug window where you can stem trough the assembler code. just run debug.exe program.exe og press alt+pause when the application is running. You need to know assembler to understand the output, but it is a very strong utility to look trough a programs code.

  • 2
    I already did that, but thanks for the answer either way. (Also, IMHO there is no such thing as an "old question" - even if the OP has already solved his problem and doesn't need your answer, it may still help other people who stumble upon this thread from web search). – ScumCoder Feb 18 '17 at 19:46
2

My answer is a little late; newcomer to this site. The Decompiler project was initiated in order to decompile MS-DOS EXE and COM binaries. The project has both a command-line and a GUI tool:

https://sourceforge.net/projects/decompiler/

Use the following command with the command-line tool to decompile COM programs:

decompile --default-to ms-dos-com myprog.com

In the GUI, use the menu command File > Open as... to open the COM file and specify a start address like 0800:0100.

1

The Reko Decompiler is updated regularly and works for 16-bit DOS executables.

It can generate C code from the disassembly.

It's written in C#/.NET so requires mono if you want to run it on linux or macos.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.