10
votes
Accepted
How did this 80286 detection code work?
I'll dive into the past and try to give an explanation of the different checks you are observing in your software. I found three references explaining the behaviour (as I hope), which I will reference ...
- 1,814
6
votes
Accepted
16 bit Dos string concat function
It's a minor speed optimization. The main loop for moving characters use movsw (move words) which was probably slightly faster than moving bytes. However, in case the number of bytes is odd, one byte ...
- 34.9k
6
votes
Accepted
Any correlation between DOS Program Segment Prefix and the base address of loaded executable?
DOS didn't have a concept of more than one application being able to run at the same time, with each of those applications able to allocate memory. Programs that stayed resident after termination ...
- 12.7k
5
votes
Accepted
Is it possible to extract or otherwise edit the source code of an .exe file?
Principally: Yes.
But: it's not practically.
You could change the machine-code within the .exe, but that's not really practically if you want to change the interface/presentation. Also you would need ...
- 66
5
votes
Accepted
PE DOS stub content not commands
This is the so-called "Rich header", added by Microsoft's link.exe (you can see the text "Rich" at the end of the mysterious block). It contains information about the versions of compilers and other ...
- 34.9k
4
votes
debugging a graphical msdos game
Please check this guide https://www.vogons.org/viewtopic.php?t=3944
DosBox has additional internal debugger, but it has to be build with support for that.
- 184
4
votes
Accepted
Disassembling an MS-DOS EXE
The entry point is calculated like this:
((header_paragraphs + cs) << 4) + ip
I wrote a MZ exe disassembler time ago, take a look.
- 91
4
votes
How to quickly distinguish PE/DLL/DOS-MZ files based on magic numbers?
An old DOS EXE header is only 28 (0x1C) bytes long and is usually followed by the DOS relocation table if present. The IMAGE_DOS_HEADER struct of the NT PE header is much larger at 64 (0x40) bytes as ...
- 141
4
votes
Decompiling a 1990 DOS application
The Reko Decompiler is updated regularly and works for 16-bit DOS executables.
It can generate C code from the disassembly.
It's written in C#/.NET so requires mono if you want to run it on linux ...
- 141
4
votes
Any correlation between DOS Program Segment Prefix and the base address of loaded executable?
MZ-format executables also have the PSP at CS-0x10 just before the data loaded from the file.
Quoting Tech Help!, probaly the best DOS programming reference:
EXE-format programs define multiple ...
- 34.9k
3
votes
Is it possible to extract or otherwise edit the source code of an .exe file?
The short answer is no - the source is not available if only the .exe is available. The source code is an entirely separate file which is generally not shared with the public. However, given the ....
- 4,511
3
votes
Decompiling a 1990 DOS application
Ghidra (which is free) is able to disassemble x86 16-bit applications and even to decompile them to C (something you can't do with IDA).
- 331
3
votes
Decompiling a 1990 DOS application
I know this question is old, but for future reference. You can download DOSBOX Debug version. It will give you a nice debug window where you can stem trough the assembler code. just run debug.exe ...
- 131
3
votes
Decompiling a 1990 DOS application
My answer is a little late; newcomer to this site. The Decompiler project was initiated in order to decompile MS-DOS EXE and COM binaries. The project has both a command-line and a GUI tool:
https://...
- 1,030
2
votes
How to edit an .exe file without overwriting previous information
Without seeing the program, we can't say definitely one way or the other if it would be possible.
However, whenever the French text is at least the same size as the English equivalent, you can simply ...
- 4,511
2
votes
How to edit an .exe file without overwriting previous information
Ok, you clearly have no idea what you are on about.
However this is not a problem, first learn why a C++ Decompiler is a weird thing to ask for. Second, if you are in luck the strings can be accessed ...
- 2,265
2
votes
Any correlation between DOS Program Segment Prefix and the base address of loaded executable?
It is typically true that DOS loads a .EXE program immediately after the PSP, meaning in your terms that base - PSP == 0x0010. But it's not necessarily true, and if you were writing this (or any) DOS ...
2
votes
Accepted
How to quickly distinguish PE/DLL/DOS-MZ files based on magic numbers?
That would be e_lfanew in the MZ header itself. For simple (16 bit) MSDOS software, this ought to be 0, and for any extended format it should point right to one of the specific LE, PE, or NE headers' ...
- 2,274
2
votes
Accepted
Within A Folder of 100s of 16-bit MS-DOS Disassembled EXEs Identify Ones That Need/Use DOS/4GW
DOS/4GW executables normally use LE (linear executable) format for the actual main program (the DOS stub is just a launcher for the DOS4GW.EXE extender) and should be detected as such by IDA so you ...
- 34.9k
2
votes
How did this 80286 detection code work?
Check 2: While check 1 tests if the high-order bits of the flag word can be cleared, check 2 tests whether they can be set. On an 80286, these bits cannot be set in real mode, while on an 80386 they ...
- 121
2
votes
Accepted
How to extract debug information from a DOS executable compiled with Watcom C/C++?
OpenWatcom includes the wdump utility which can dump the debug info (if it's present).
- 34.9k
1
vote
How to extract debug information from a DOS executable compiled with Watcom C/C++?
This web site: http://www.exphys.jku.at/Skripten/PK_PROG/Watcom.pdf
is a PDF that (step by step) explains how to debug such files.
- 136
1
vote
Accepted
Issues rewriting portions of DOS app's assembly
In the end, the issue was due to the fixup tables. I wrote custom code to read the LE structure and thanks to some documents, figured out what offsets were being fixed up.
Please note, you need to ...
- 178
1
vote
Issues rewriting portions of DOS app's assembly
In case of Watcom fastcall uses eax, edx, ebx, ecx for the first 4 arguments, however your code is pushing eax and is not restoring the stack afterwards. You should probably either add another pop (e....
- 34.9k
1
vote
How to edit an .exe file without overwriting previous information
IDA Pro https://www.hex-rays.com/products/ida/ and my blog https://firebitsbr.wordpress.com/2015/09/28/list-of-pluginsscripts-for-ida-pro-both-re-malware-vulnerabilities-and-exploits/ many plugins for ...
- 226
Only top scored, non community-wiki answers of a minimum length are eligible