Ghidra 16-Bit DOS Strings

Question

I am attempting to reverse-engineer a 16-Bit DOS MZ executable.

The file contains many different strings, most of which are printed out to the console at various points.

IDA seems to be able to pick up the locations from which the strings are utilised, for example:

Clicking on this reference shows the code that utilises the string, which I assume passes it into the function (sub 1462) which prints it out to the screen.

When I attempt to analyse the same code in Ghidra, it is unable to pickup the same strings. I have manually gone to the location shown in IDA, and setup the "print" (sub 1462) function in this way:

So I would expect the decompiler to show the string, however it doesn't seem to pick it up:

I'm assuming that this has something to do with the stack pointer being set (or assumed to be) an incorrect value? However, Ghidra seems to locate this string at a different location to IDA:

Thanks, James.

Answer 1

I managed to solve this one myself thanks to @Blabb's comment (thanks again!).

The first identifiable string was MS Run-Time Library - Copyright (c) 1992, Microsoft Corp.

For some reason, this managed to throw Ghidra off, and it added just this string to a memory segment of its own. This, therefore, offset all of the other strings as they were pushed down into their own memory segment, causing the incorrect offsets.

To solve this, I used Ghidra's Memory Manager to remove the two memory segments, and then create a new one with all the strings combined.

Before: After:

As a result of these changes, and with the DS register set to the correct offset, the string now shows in the decompiler window.