12
2 great disassemblers... lost in time. SPECIFICALLY for DOS and 16 bit programs. They were the IDA PRO of THEIR days...
WCB (EXTREMELY rare to find. NEVER misses beginnings of a routine. NEVER)
SOURCERER (IF you can find it. THE disassembler to go to when professionals wanted to disassemble any file. INDUSTRIAL strength, MORE OPTIONS that you can throw a ...
10
I'll dive into the past and try to give an explanation of the different checks you are observing in your software. I found three references explaining the behaviour (as I hope), which I will reference to in this answer as /1/, /2/, /3/.
/1/ http://www.drdobbs.com/embedded-systems/processor-detection-schemes/184409011
It is an archive article from the ...
6
DOS didn't have a concept of more than one application being able to run at the same time, with each of those applications able to allocate memory. Programs that stayed resident after termination weren't able to allocate more memory while another program was running. So, there was no fragmentation in memory, and no "memory location that was big enough".
The ...
6
It's a minor speed optimization. The main loop for moving characters use movsw (move words) which was probably slightly faster than moving bytes. However, in case the number of bytes is odd, one byte would be left uncopied, and that's why there is an extra mosvb before and after it (so the extra byte is moved before or after, depending on alignment of the ...
5
This is the so-called "Rich header", added by Microsoft's link.exe (you can see the text "Rich" at the end of the mysterious block). It contains information about the versions of compilers and other tools which participated in producing the code of the executable. Some references:
Finding the Needle: A Study of the PE32 Rich Header and Respective Malware ...
5
Principally: Yes.
But: it's not practically.
You could change the machine-code within the .exe, but that's not really practically if you want to change the interface/presentation. Also you would need to do it at least in assembly language.
If you want to improve the software, I think, the best would be to contact the developer and ask if you can help him to ...
5
there are no decent decompiler for 16b DOS afaik
Dosbox has an integrated debugger, otherwise try TurboDebugger - and opening the file in IDA simultaneously to document on the go. Also check this recent blogpost about such a situation.
4
MZ-format executables also have the PSP at CS-0x10 just before the data loaded from the file.
Quoting Tech Help!, probaly the best DOS programming reference:
EXE-format programs define multiple program segments, including a
code, data, and stack segment. The EXE file is loaded starting at
PSP:0100.
4
Please check this guide https://www.vogons.org/viewtopic.php?t=3944
DosBox has additional internal debugger, but it has to be build with support for that.
4
The entry point is calculated like this:
((header_paragraphs + cs) << 4) + ip
I wrote a MZ exe disassembler time ago, take a look.
4
An old DOS EXE header is only 28 (0x1C) bytes long and is usually followed by the DOS relocation table if present. The IMAGE_DOS_HEADER struct of the NT PE header is much larger at 64 (0x40) bytes as it has been extended for the various other Windows executable formats.
Trying to interpret e_lfanew at offset 60 (0x3C) for a plain DOS executable as ...
3
The short answer is no - the source is not available if only the .exe is available. The source code is an entirely separate file which is generally not shared with the public. However, given the .exe file, it might be possible to "decompile" it into a form of source code which would allow a new .exe file to be produced, and which should match the existing ...
3
I know this question is old, but for future reference. You can download DOSBOX Debug version. It will give you a nice debug window where you can stem trough the assembler code. just run debug.exe program.exe og press alt+pause when the application is running. You need to know assembler to understand the output, but it is a very strong utility to look trough ...
3
If you don't care about dynamic analysis, you should give a try to radare2 (a free software), that can (among other things) disassemble 16bit DOS binaries very well.
3
Two useful DOS debuggers come into my mind:
SoftIce
DeGlucker.
SoftIce is commercial, DeGlucker is freeware.
Edit: Gametools (G3X) is also a very useful TSR debugger for DOS. The best feature in Gametools is its memory scanner that can scan memory for exact values, for greater values than previous time and for lesser values than previous time. Then you ...
3
Ghidra (which is free) is able to disassemble x86 16-bit applications and even to decompile them to C (something you can't do with IDA).
2
The Reko Decompiler is updated regularly and works for 16-bit DOS executables.
It can generate C code from the disassembly.
It's written in C#/.NET so requires mono if you want to run it on linux or macos.
2
It is typically true that DOS loads a .EXE program immediately after the PSP, meaning in your terms that base - PSP == 0x0010. But it's not necessarily true, and if you were writing this (or any) DOS executable, you might do better to know this. However, this is not you. Instead, here, you are a reverse engineer - or at least trying your hand at being one. ...
2
My answer is a little late; newcomer to this site. The Decompiler project was initiated in order to decompile MS-DOS EXE and COM binaries. The project has both a command-line and a GUI tool:
https://sourceforge.net/projects/decompiler/
Use the following command with the command-line tool to decompile COM programs:
decompile --default-to ms-dos-com myprog....
2
Without seeing the program, we can't say definitely one way or the other if it would be possible.
However, whenever the French text is at least the same size as the English equivalent, you can simply use a hex editor to overwrite the French text with the corresponding English text without any issue (leaving any left-over French characters in place, in order ...
2
Ok, you clearly have no idea what you are on about.
However this is not a problem, first learn why a C++ Decompiler is a weird thing to ask for. Second, if you are in luck the strings can be accessed directly from the program. Open the application in a decen hexeditor (HxD, 010, Hiew, Hexworkshop) and scroll down hoping you find the strings. Edit them (dont ...
2
DOS/4GW executables normally use LE (linear executable) format for the actual main program (the DOS stub is just a launcher for the DOS4GW.EXE extender) and should be detected as such by IDA so you can probably just check the loaded file format.
2
Check 2: While check 1 tests if the high-order bits of the flag word can be cleared, check 2 tests whether they can be set. On an 80286, these bits cannot be set in real mode, while on an 80386 they can.
Check 3: This is testing what kind of shifter the processor has. Some (the newer ones) have a barrel shifter that effectively masks the shift count to the ...
2
That would be e_lfanew in the MZ header itself. For simple (16 bit) MSDOS software, this ought to be 0, and for any extended format it should point right to one of the specific LE, PE, or NE headers' identifiers (which all are exactly those two characters). As in all of these cases the header itself is a mere stub, e_cp (the total size of this executable in ...
2
OpenWatcom includes the wdump utility which can dump the debug info (if it's present).
1
In the end, the issue was due to the fixup tables. I wrote custom code to read the LE structure and thanks to some documents, figured out what offsets were being fixed up.
Please note, you need to parse the Fixup Page table and then loop through checking positions. Then read the record data.
1
In case of Watcom fastcall uses eax, edx, ebx, ecx for the first 4 arguments, however your code is pushing eax and is not restoring the stack afterwards. You should probably either add another pop (e.g. pop eax) after the call or an add esp, 4, OR use the esp value you saved in ebp, i.e. mov esp, ebp.
1
This web site: http://www.exphys.jku.at/Skripten/PK_PROG/Watcom.pdf
is a PDF that (step by step) explains how to debug such files.
1
IDA Pro https://www.hex-rays.com/products/ida/ and my blog https://firebitsbr.wordpress.com/2015/09/28/list-of-pluginsscripts-for-ida-pro-both-re-malware-vulnerabilities-and-exploits/ many plugins for ida pro.
Only top voted, non community-wiki answers of a minimum length are eligible