1

We have a DOS executable program like to NC. How do we find and change a text or a ASCII art in it?

I'm a newbie in reverse.

Improve this question
  • 1
    Hexdump it, disassemble it, find the text, change it. Your question is way too unspecific to be answered well. – Guntram Blohm Dec 7 '14 at 6:10
  • Which tool can help me? IDA Pro DOSBox Plugin? This Answer? – ali Dec 7 '14 at 6:54
  • @ali. some compilers have decompilers I saw borland TP7/TCPP versions that make the source code in Pascall/C++ but only for programs compiled by them of coarse. also forget about variable/function names they where auto-generated. for asm I thing NASM has also some disassembler in the full package but I could be wrong haven't use it in a looooong time – Spektre Dec 7 '14 at 10:02
  • Thank you @Spektre :) – ali Dec 7 '14 at 10:51
  • 3
    Note that it's ok to ask about a specific system, as long as it's a 'i came this far, i'm stuck now' kind of question. The problem i have with this post is the unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem part. The question could mean anything from "are there any tools that will let me modify dos executables" to "how do i find a text string in an executable if my hex editor doesn't find it" to "how do i handle packed DOS executable". This makes it hard to know what the OP expects and what kind of answer would actually help him. – Guntram Blohm Dec 8 '14 at 10:14
6

Tools

Any hex editor will do. Under DOS both NC and VC have their own which are enough. Very good DOS tool is HIEW (hex editor + x86 dissasembler).

what to do

  1. determine the executable form

    open it as text/hex and if no program string are present then they are in different file or the file is packed/encrypted. Some executables are packet by PKLITE tools so unpack them. If file is encrypted you have to try to decrypt it first.

  2. find the text you want to change

  3. edit the text

    The string size must stay the same !!! If program uses any kind of CRC then you have to override the call by nop/jump or change the comparison values to the new CRC

  4. that should be all but

    If the program uses those texts in specific ways then some thing can be broken like search for specific character/pattern in string to do some crazy effect etc. So if the edit is bugged return to original executable and try to edit string one by one ... to detect which strings will broke the exe. After that just leave those as are and edit the rest to what you need

  5. if all fails

    Then write TSR launcher for your program (terminate and stay program) that will change the text screens for you. In DOS there are no access violations so you can do anything...

    For example:

    1. detect the actual screen the program is presenting

      Text mode VideoRAM is at B800:0000h if my memory serves well Each character is represented by 2 BYTEs (one is ASCII and one is color attributes). Standard text-mode used in DOS is 80x25 characters so read the specific positions of screen and detect strings that match each page of program.

    2. if page detected

      Then rewrite it by your new page (can flicker a bit)

    3. continue this scanning in some timer ... (PIT interrupt or keyboard interrupt)

    4. you can combine this with keyboard keystrokes detection

      This way you know if you hit F1 then page F1 will occur etc. This can be used for hard to detect pages (have no title).

Windows

You could write window App that will present the DOS program. Just you need to pass mouse movement and keyboard events to the DOS program (which can be run as hidden process) and present the (invisible) DOS screen in your Window. In Windows use DLPORTIO driver or any other way to get Kernel mode access rights so you can actually read / access the DOS VRAM or access the commandline or DOSbox backbuffer by WinAPI in gfx. Decode it back to text (the font is usually fixed so that should be easy enough) and recode it to your new texts and present back in your window App.

[Notes]

Graphical DOS program means it uses graphic video mode instead of Text mode. NC is example of Text mode program not graphical !!! Some Text mode based Apps use different text modes so you should detect actual text mode resolution. I think some call to EGA/VGA BIOS int 13h should do the trick or you can hook up the entire interrupt for this. If you got aligned lines and table borders then that can be also used for resolution detection. You should do this once in a while because resolution can change during operation for example try ALT+F9 in VC.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.