31

I have some crucial data written decades ago by an ancient 16bit DOS application. There are no docs, no source, and no information about the author. Just the 16 bit exe. I guess it's time for me to learn how to decompile stuff, since it seems the only way to restore file format. I've tried OllyDbg, it looks really great, but it can't 16 bit. Is there a disassembler/debugger capable of working with such executables?

I know DOSbox, the app runs in it all right. The problem is, I don't need to run it, I need to understand the file format in which it writes data. Do you think starting some old 16bit DOS debugger/decompiler in DOSbox sounds like an idea? If yes, could you please name a decent DOS debugger?

Thanks.

P.S.: I copypasted this question from StackOverflow, because I didn't know about ReverseEngineering section when I was asking it. Please delete it if it's against the rules.

Improve this question
3
  • 4
    Can you share one, or preferably more, data files? Decompiling an entire executable is a lot of work. If you have a general idea what to look for -- magic values, constants, data structures, etc. -- you can concentrate on relevant parts only, rather than disassembling some huge routine that turns out to only calculate the width of a dialog box.
    – Jongware
    Nov 23, 2013 at 10:20
  • 2
    It sounds a bit as if you are underestimating this task, hence my comment; Depending on the complexity of the written data (mostly text vs. plenty of mixed binary data) and the expected precision of your file-format reversing, the expectable investment for achieving your goal might easily exceed a month of hard work.
    – Till
    Nov 29, 2013 at 23:22
  • I recommend to using Turbo Debugger as @Ange's answer. Because the UI of TD is similar to the OllyDbg as you like. Link to download: phatcode.net/downloads.php?id=280
    – tuantm
    Aug 29, 2014 at 6:26

9 Answers 9

Reset to default
15

Two great disassemblers—lost in time—specifically for DOS and 16 bit programs. They were the IDA PRO of their days…

  1. Windows Codeback Disassmbler (WCB): Extremely rare to find. Never misses beginnings of a routine. Never

  2. Sourcerer (If you can find it. The disassembler to go to when professionals wanted to disassemble any file. Industrial strength, more options than you can throw a bone at, extremely useful. Don't forget to download INTERRUPT LIST interpretations and COLLECT INTERRUPT lists at the end).

IDA is good. Not nearly good enough when it comes to these two.

My personal choice: Sourcerer.

SYMDEB.EXE, the symbolic debugger from Microsoft for DOS.

Turbodebugger --- not that much.

Hope that helps.

Anonymous.

Improve this answer
7
  • 2
    are you sure it's not Sourcer, from V Communications ? I didn't mention it because it wouldn't enable to take note and manipulate them like IDA would.
    – Ange
    Nov 23, 2013 at 10:34
  • 2
    Looks like WCB stands for 'Windows CodeBack'. Its Readme says this: "The current version does not include support for conventional DOS .EXE files".
    – ScumCoder
    Nov 23, 2013 at 14:07
  • 1
    well, most DOS tools aren't for sale anymore ;)
    – Ange
    Nov 29, 2013 at 8:23
  • 2
    It looks like you want to google "wcb105a.zip" for WCB. It's actually surprisingly findable. If 1.05 is not the newest version, I'd appreciate finding out.
    – i336_
    Sep 17, 2017 at 10:50
  • 1
    It is indeed possible to find wcb. For my particular old dos .exe it however says I need dll files, which I don't have.
    – dorien
    Apr 24, 2018 at 4:33
5

  • there are no decent decompiler for 16b DOS afaik

  • Dosbox has an integrated debugger, otherwise try TurboDebugger - and opening the file in IDA simultaneously to document on the go. Also check this recent blogpost about such a situation.

Improve this answer
1
5

The Reko Decompiler is updated regularly and works for 16-bit DOS executables.

It can generate C code from the disassembly.

It's written in C#/.NET so requires mono if you want to run it on linux or macos.

Improve this answer
4

Ghidra (which is free) is able to disassemble x86 16-bit applications and even to decompile them to C (something you can't do with IDA).

Improve this answer
1
  • Any tips for getting Ghidra to properly decompile DOS API calls? I like Ghidra, but by default it decompiles MOV AH, 0x30; INT 0x21 into pcVar8 = (code *)swi(0x21); I'd rather it decompiled it into something easier to read, like dosAPICall(0x30), and also not drop the 0x21.
    – RedDragonWebDesign
    Sep 8, 2020 at 9:37
3

If you don't care about dynamic analysis, you should give a try to radare2 (a free software), that can (among other things) disassemble 16bit DOS binaries very well.

Improve this answer
1
  • 3
    Disassembling is the bare minimum for reversing, though.
    – Ange
    Nov 29, 2013 at 10:49
3

Two useful DOS debuggers come into my mind:

  1. SoftIce

  2. DeGlucker.

SoftIce is commercial, DeGlucker is freeware.

Edit: Gametools (G3X) is also a very useful TSR debugger for DOS. The best feature in Gametools is its memory scanner that can scan memory for exact values, for greater values than previous time and for lesser values than previous time. Then you can set hardware memory breakpoints on the matching memory addresses (when you have sufficiently few memory addresses left, usually after some rounds) and that way you can find the essential routines that access those memory addresses. If I had to reverse-engineer a DOS application, I would definitely start with Gametools.

Improve this answer
3

My answer is a little late; newcomer to this site. The Decompiler project was initiated in order to decompile MS-DOS EXE and COM binaries. The project has both a command-line and a GUI tool:

https://sourceforge.net/projects/decompiler/

Use the following command with the command-line tool to decompile COM programs:

decompile --default-to ms-dos-com myprog.com

In the GUI, use the menu command File > Open as... to open the COM file and specify a start address like 0800:0100.

Improve this answer
3

I know this question is old, but for future reference. You can download DOSBOX Debug version. It will give you a nice debug window where you can stem trough the assembler code. just run debug.exe program.exe og press alt+pause when the application is running. You need to know assembler to understand the output, but it is a very strong utility to look trough a programs code.

Improve this answer
1
  • 2
    I already did that, but thanks for the answer either way. (Also, IMHO there is no such thing as an "old question" - even if the OP has already solved his problem and doesn't need your answer, it may still help other people who stumble upon this thread from web search).
    – ScumCoder
    Feb 18, 2017 at 19:46
0

Dark Debugger v0.04: small V86 mode debugger based on DeGlucker for DOS with build in assembler (FASM). Dark Debugger is a perfect debugger in order to u unpack protected executable files.

http://www.ndn.muxe.com/download/file/DD.7Z

https://board.flatassembler.net/topic.php?t=18708

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.