5

I'm working on a disassembly of an old DOS game. (Real old: 16-bit, real mode.) The bulk of the game is in a large resource file of mixed binary and data; the executable basically just loads a chunk of "resource manager" code from the binary, and that resource manager dynamically chunks in other code and data as needed. I can track how this code and data is loaded, how it's decompressed, where it's placed in memory, etc. But obviously, this makes doing a static disassembly pretty tricky.

For the time being, I just went into the first level of the game, dumped the full contents of memory from DosBox, and have been working on that in IDA Pro 5--renaming functions/variables, commenting as I figure things out. But as far as I can tell, there's no way in IDA Pro 5 to add an overlay or alternative code block in any given place, so I'm eventually going to hit a wall with this approach (as soon as I need to look at, say, behavior for the enemies in the second level). I could dump that replacement code somewhere else in memory, but presumably all of the jumps/offsets would be broken. I could also start over with a new full memory dump in whatever game area I want to work on next, but then I'll lose all of my renames/comments on the stuff that stays the same.

Is there some kind of standard operating procedure for dealing with this sort of thing? (The page on reverse engineering in the ScummVM wiki is super-helpful, but on the subject of overlays it's basically like, "They can make things tricky! 😬") My goal would be to end up with a readable (at least to me) commented disassembly of the full game code that I can eventually use to work up a source port. Any suggestions would be much appreciated!

1
  • Woof, that looks pretty complicated. But maybe it's just a gnarly solution to a gnarly problem. Thank you for the suggestion, I'll give it a shot! Dec 11, 2022 at 15:38

1 Answer 1

1

The key problem with reversing and debugging dos overlay programs is the lack of memory for the debugger to work.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.