0

I'm having issue reversing a small old COM file from the early 90s. My understanding was that code begins at 0x100, however the one I have seems to begin at 0x90 (0s before). However some of the commands point to locations well outside the program space and I'm wondering if the offset isn't wrong - particularly after c2.

Using onlinedisassembler.com, I have a few example segments below...

.data:0x00000090    e612    out    0x12,al  
.data:0x00000092    131c16  adc    ebx,DWORD PTR [esi+edx*1]    
.data:0x00000095    d89ade3b6153    fcomp  DWORD PTR [edx+0x53613bde]   
.data:0x0000009b    3831    cmp    BYTE PTR [ecx],dh    
.data:0x0000009f    d309    ror    DWORD PTR [ecx],cl   
.data:0x000000a1    41  inc    ecx  
.data:0x000000a2    56  push   esi  
.data:0x000000a3    5b  pop    ebx  
.data:0x000000a4    ce  into

...

Any guidance would be appreciated.

Improve this question
4
  • This doesn't seem to look like valid code at all. I'm 99% sure it's something else, not processor instructions. Is that a COM object or a .com file? As you're saying "code begins at 0x100", i assume the 2nd. The space from 0x80 to 0xff was reserved for the command line, and wasn't initialized after the trailing '\0', so what you're seeing is probably just random garbage.
    – Guntram Blohm
    Sep 15, 2014 at 13:13
  • This is a .com file. I agree that it's supposed to begin at 0x100, so I'm very confused. If I look at what starts at 0x100, I get this: > .data:0x00000000 2453 and al,0x53 > .data:0x00000002 52 push edx .data:0x00000003 4e dec esi .data:0x00000004 59 pop ecx .data:0x00000005 a0b2e0212f mov al,ds:0x2f21e0b2 .data:0x0000000a 18f5 sbb ch,dh .data:0x0000000c f3f3f9 repz repz stc .data:0x0000000f 7d9b jge 0xffffffac .data:0x00000011 5d pop ebp .data:0x00000012 224adb and cl,BYTE PTR [edx-0x25] .data:0x00000015 b013 mov al,0x13
    – youcantexplainthat
    Sep 15, 2014 at 16:15
  • Are you sure these are executable files? Can you actually run them (in DOS)?
    – Igor Skochinsky ♦
    Sep 16, 2014 at 20:13
  • it seems oda silently ate 0f 25 between 9b and 9f 0f 25 iirc is an invalid opcode #ud exception should be generated can be some ntvdm detection not sure i had seen 0f 3f in vpc not generating exception but silently executing while most disassemblers couldnt decipher it
    – blabb
    Sep 16, 2014 at 20:50

1 Answer 1

Reset to default
4

The DOS .COM files get loaded into the memory at offset 100h (the first 100h bytes are the PSP, allocated and filled by the DOS loader). The file on disk of course starts at byte 0 (which corresponds to address 100h in memory).

Since .COM is just a binary blob with no headers, your disassembler has no idea about the address or even the processor mode it's using. That why you get garbage output.

To get correct results you need to ensure you're disassembling in 16-bit mode. On onlinedisassembler.com, this is the "i8086" option (which actually comes from binutils on which it's obviously based).

However, the bytes you quote don't make sense even in 16-bit mode so it's possible the file has been compressed or encrypted. Since you did not quote the beginning of the file, we can only guess.

Improve this answer
8
  • The bytes you see in my post at 0x90 are the first non zero bytes. Everything before that is 00.
    – youcantexplainthat
    Sep 16, 2014 at 0:17
  • Using i8086 from 0x100, I still don't understand (then again my assembly is rusty) ` 0x00 2453 and $0x53,%al ` 0x02 52 push %dx ` 0x03 4e dec %si ` 0x04 59 pop %cx ` 0x05 a0b2e0 mov 0xe0b2,%al ` 0x08 212f and %bp,(%bx) ` 0x0a 18f5 sbb %dh,%ch ` 0x0c f3f3f9 repz repz stc ` 0x0f 7d9b jge 0xffffffac ` 0x11 5d pop %bp ` 0x12 224adb and -0x25(%bp,%si),%cl ` 0x15 b013 mov $0x13,%al ` 0x17 fb sti ` 0x18 e510 in $0x10,%ax ` 0x1b 33e2 xor %dx,%sp ` 0x1d 55 push %bp ` 0x1e 0411 add $0x11,%al
    – youcantexplainthat
    Sep 16, 2014 at 0:24
  • Why doesn't code markup work in comments??! So frustrating!
    – youcantexplainthat
    Sep 16, 2014 at 0:27
  • Just add a plain hexdump to your post, don't try to disassemble it. So far it seems your file may be not a com file at all.
    – Igor Skochinsky ♦
    Sep 16, 2014 at 4:11
  • tx igor for i8086 i played with addr16 and data16 with i386 didnt make any sense thought oda didnt disassemble 16bit plucked the bytes and dropped it into debug.com didnt make sense either with :\>awk "{print $2}" copypaste.txt | tr -d \n\r | xxd -r -p > some.com :\>debug some.com -u 100 14F3:0100 E612 OUT 12,AL 14F3:0102 131C ADC BX,[SI] 14F3:0104 16 PUSH SS 14F3:0105 D89ADE3B FCOMP DWORD PTR [BP+SI+3BDE] 14F3:0109 61 DB 61 14F3:010A 53 PUSH BX 14F3:010B 3831 CMP [BX+DI],DH
    – blabb
    Sep 16, 2014 at 7:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.