We have a DOS executable program like to NC. How do we find and change a text or a ASCII art in it?
I'm a newbie in reverse.
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.Sign up to join this community
Any hex editor will do. Under DOS both NC and VC have their own which are enough. Very good DOS tool is HIEW (hex editor + x86 dissasembler).
what to do
determine the executable form
open it as text/hex and if no program string are present then they are in different file or the file is packed/encrypted. Some executables are packet by PKLITE tools so unpack them. If file is encrypted you have to try to decrypt it first.
find the text you want to change
edit the text
The string size must stay the same !!! If program uses any kind of CRC then you have to override the call by
nop/jump or change the comparison values to the new CRC
that should be all but
If the program uses those texts in specific ways then some thing can be broken like search for specific character/pattern in string to do some crazy effect etc. So if the edit is bugged return to original executable and try to edit string one by one ... to detect which strings will broke the exe. After that just leave those as are and edit the rest to what you need
if all fails
Then write TSR launcher for your program (terminate and stay program) that will change the text screens for you. In DOS there are no access violations so you can do anything...
detect the actual screen the program is presenting
Text mode VideoRAM is at
B800:0000h if my memory serves well Each character is represented by
2 BYTEs (one is ASCII and one is color attributes). Standard text-mode used in DOS is
80x25 characters so read the specific positions of screen and detect strings that match each page of program.
if page detected
Then rewrite it by your new page (can flicker a bit)
continue this scanning in some timer ... (PIT interrupt or keyboard interrupt)
you can combine this with keyboard keystrokes detection
This way you know if you hit F1 then page F1 will occur etc. This can be used for hard to detect pages (have no title).
You could write window App that will present the DOS program. Just you need to pass mouse movement and keyboard events to the DOS program (which can be run as hidden process) and present the (invisible) DOS screen in your Window. In Windows use DLPORTIO driver or any other way to get Kernel mode access rights so you can actually read / access the DOS VRAM or access the commandline or DOSbox backbuffer by WinAPI in gfx. Decode it back to text (the font is usually fixed so that should be easy enough) and recode it to your new texts and present back in your window App.
Graphical DOS program means it uses graphic video mode instead of Text mode. NC is example of Text mode program not graphical !!! Some Text mode based Apps use different text modes so you should detect actual text mode resolution. I think some call to EGA/VGA BIOS
int 13h should do the trick or you can hook up the entire interrupt for this. If you got aligned lines and table borders then that can be also used for resolution detection. You should do this once in a while because resolution can change during operation for example try ALT+F9 in VC.