Change a text in DOS executables [closed]

Question

We have a DOS executable program like to NC. How do we find and change a text or a ASCII art in it?

I'm a newbie in reverse.

Answer 1

Tools

Any hex editor will do. Under DOS both NC and VC have their own which are enough. Very good DOS tool is HIEW (hex editor + x86 dissasembler).

what to do

1. determine the executable form

   open it as text/hex and if no program string are present then they are in different file or the file is packed/encrypted. Some executables are packet by PKLITE tools so unpack them. If file is encrypted you have to try to decrypt it first.

2. find the text you want to change

3. edit the text

   The string size must stay the same !!! If program uses any kind of CRC then you have to override the call by nop/jump or change the comparison values to the new CRC

4. that should be all but

   If the program uses those texts in specific ways then some thing can be broken like search for specific character/pattern in string to do some crazy effect etc. So if the edit is bugged return to original executable and try to edit string one by one ... to detect which strings will broke the exe. After that just leave those as are and edit the rest to what you need

5. if all fails

   Then write TSR launcher for your program (terminate and stay program) that will change the text screens for you. In DOS there are no access violations so you can do anything...

   For example:

   1. detect the actual screen the program is presenting

      Text mode VideoRAM is at B800:0000h if my memory serves well Each character is represented by 2 BYTEs (one is ASCII and one is color attributes). Standard text-mode used in DOS is 80x25 characters so read the specific positions of screen and detect strings that match each page of program.

   2. if page detected

      Then rewrite it by your new page (can flicker a bit)

   3. continue this scanning in some timer ... (PIT interrupt or keyboard interrupt)

   4. you can combine this with keyboard keystrokes detection

      This way you know if you hit F1 then page F1 will occur etc. This can be used for hard to detect pages (have no title).

Windows

You could write window App that will present the DOS program. Just you need to pass mouse movement and keyboard events to the DOS program (which can be run as hidden process) and present the (invisible) DOS screen in your Window. In Windows use DLPORTIO driver or any other way to get Kernel mode access rights so you can actually read / access the DOS VRAM or access the commandline or DOSbox backbuffer by WinAPI in gfx. Decode it back to text (the font is usually fixed so that should be easy enough) and recode it to your new texts and present back in your window App.

[Notes]

Graphical DOS program means it uses graphic video mode instead of Text mode. NC is example of Text mode program not graphical !!! Some Text mode based Apps use different text modes so you should detect actual text mode resolution. I think some call to EGA/VGA BIOS int 13h should do the trick or you can hook up the entire interrupt for this. If you got aligned lines and table borders then that can be also used for resolution detection. You should do this once in a while because resolution can change during operation for example try ALT+F9 in VC.