0

I am trying to find the correct Data Segment, corresponding to a certain File in a 16bit DOS Game. The Assembly Instructions for the Decompiled .exe File in IDA Pro Version 5, I am looking at.

I was wondering, is there a difference to DOS Assembly Hexadecimal, for a File, than a File opened up in a modern Hex Editor ? I use HxD the File in question, opened up in that Hex Editor is Offset(h):220A

An example of Assembly Instruction in the decompiled code is :- mov ds:264Ah, ax

there is no Code with ds i.e. Data Segment ds:220Ah so what Value should I be looking for, if there is differences ? And are there any online converters, to help me achieve this ? or does anyone know how do work it out manually ?

Any help would be much appreciated.

1
  • No hex representation cannot change 0x2b cannot become 0x2c or 0x2? Based on tools. Your interpretation the address you are looking may be different and your question as is does not make sense devoid of context.
    – blabb
    Oct 30, 2023 at 4:06

1 Answer 1

0

Tip:

DOS exe get "relocated" when loaded by DOS/Dosbox - and only the non header part of the EXE gets loaded at the load-segment behind the PSP

and IDA offsets are relocated differently: normally to base adress 0x1000 and start segment is 0

so there is a mapping between the real loaded EXE, the EXE as a file and the EXE loaded in IDA

to your hex-question:

hex is hex but there are many difference when talking about "offsets"

  1. linear offset in DOS 1MB ram?
  2. segment/offset pointer in DOS ram?
  3. segment/offset loaded in Dosbox(with/without debugger)
  4. linear IDA (EA) offsets, segment/offset in IDA, file offset in IDA
  5. file offset in EXE-image
  6. file offset in EXE-file
  7. near/far pointer
  8. code/data-segments,overlays offsets

you want to read a book, written in encrypted chinese - without knowing anything about decryption AND chinese

and the answer is completely different if the game is using some sort of non-standard overlay-technique or many other only-this-game-exe related stuff like self modifiying code, memory reduction techniques, partially packed data, strange stuff that were only done in the old times of coding

and you still asking questions like the 4 before - questions out of context, no information what you already know, that just does not work

reverse engineering is much more suffering as you think

maybe come up with a small assembler example and help people to explain that to you - maybe one i've already sent :)

2
  • @blabb many thanks for your reply aswell Oct 30, 2023 at 9:05
  • Hi @llm Many thanks for your reply, I see now, that this alot harder, than I first thought. And trial and error, is really hard, with so much assembly code in the .exe File. Oct 30, 2023 at 9:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.