Hot answers tagged

10 votes
Accepted

How did this 80286 detection code work?

I'll dive into the past and try to give an explanation of the different checks you are observing in your software. I found three references explaining the behaviour (as I hope), which I will reference ...
user avatar
  • 1,814
6 votes
Accepted

16 bit Dos string concat function

It's a minor speed optimization. The main loop for moving characters use movsw (move words) which was probably slightly faster than moving bytes. However, in case the number of bytes is odd, one byte ...
user avatar
  • 34.9k
6 votes
Accepted

Any correlation between DOS Program Segment Prefix and the base address of loaded executable?

DOS didn't have a concept of more than one application being able to run at the same time, with each of those applications able to allocate memory. Programs that stayed resident after termination ...
user avatar
5 votes
Accepted

Is it possible to extract or otherwise edit the source code of an .exe file?

Principally: Yes. But: it's not practically. You could change the machine-code within the .exe, but that's not really practically if you want to change the interface/presentation. Also you would need ...
user avatar
  • 66
5 votes
Accepted

PE DOS stub content not commands

This is the so-called "Rich header", added by Microsoft's link.exe (you can see the text "Rich" at the end of the mysterious block). It contains information about the versions of compilers and other ...
user avatar
  • 34.9k
4 votes

debugging a graphical msdos game

Please check this guide https://www.vogons.org/viewtopic.php?t=3944 DosBox has additional internal debugger, but it has to be build with support for that.
user avatar
  • 184
4 votes
Accepted

Disassembling an MS-DOS EXE

The entry point is calculated like this: ((header_paragraphs + cs) << 4) + ip I wrote a MZ exe disassembler time ago, take a look.
user avatar
  • 91
4 votes

How to quickly distinguish PE/DLL/DOS-MZ files based on magic numbers?

An old DOS EXE header is only 28 (0x1C) bytes long and is usually followed by the DOS relocation table if present. The IMAGE_DOS_HEADER struct of the NT PE header is much larger at 64 (0x40) bytes as ...
user avatar
  • 141
4 votes

Decompiling a 1990 DOS application

The Reko Decompiler is updated regularly and works for 16-bit DOS executables. It can generate C code from the disassembly. It's written in C#/.NET so requires mono if you want to run it on linux ...
user avatar
  • 141
4 votes

Any correlation between DOS Program Segment Prefix and the base address of loaded executable?

MZ-format executables also have the PSP at CS-0x10 just before the data loaded from the file. Quoting Tech Help!, probaly the best DOS programming reference: EXE-format programs define multiple ...
user avatar
  • 34.9k
3 votes

Is it possible to extract or otherwise edit the source code of an .exe file?

The short answer is no - the source is not available if only the .exe is available. The source code is an entirely separate file which is generally not shared with the public. However, given the ....
user avatar
  • 4,511
3 votes

Decompiling a 1990 DOS application

Ghidra (which is free) is able to disassemble x86 16-bit applications and even to decompile them to C (something you can't do with IDA).
user avatar
  • 331
3 votes

Decompiling a 1990 DOS application

I know this question is old, but for future reference. You can download DOSBOX Debug version. It will give you a nice debug window where you can stem trough the assembler code. just run debug.exe ...
user avatar
  • 131
3 votes

Decompiling a 1990 DOS application

My answer is a little late; newcomer to this site. The Decompiler project was initiated in order to decompile MS-DOS EXE and COM binaries. The project has both a command-line and a GUI tool: https://...
user avatar
2 votes

How to edit an .exe file without overwriting previous information

Without seeing the program, we can't say definitely one way or the other if it would be possible. However, whenever the French text is at least the same size as the English equivalent, you can simply ...
user avatar
  • 4,511
2 votes

How to edit an .exe file without overwriting previous information

Ok, you clearly have no idea what you are on about. However this is not a problem, first learn why a C++ Decompiler is a weird thing to ask for. Second, if you are in luck the strings can be accessed ...
user avatar
  • 2,265
2 votes

Any correlation between DOS Program Segment Prefix and the base address of loaded executable?

It is typically true that DOS loads a .EXE program immediately after the PSP, meaning in your terms that base - PSP == 0x0010. But it's not necessarily true, and if you were writing this (or any) DOS ...
user avatar
2 votes
Accepted

How to quickly distinguish PE/DLL/DOS-MZ files based on magic numbers?

That would be e_lfanew in the MZ header itself. For simple (16 bit) MSDOS software, this ought to be 0, and for any extended format it should point right to one of the specific LE, PE, or NE headers' ...
user avatar
  • 2,274
2 votes
Accepted

Within A Folder of 100s of 16-bit MS-DOS Disassembled EXEs Identify Ones That Need/Use DOS/4GW

DOS/4GW executables normally use LE (linear executable) format for the actual main program (the DOS stub is just a launcher for the DOS4GW.EXE extender) and should be detected as such by IDA so you ...
user avatar
  • 34.9k
2 votes

How did this 80286 detection code work?

Check 2: While check 1 tests if the high-order bits of the flag word can be cleared, check 2 tests whether they can be set. On an 80286, these bits cannot be set in real mode, while on an 80386 they ...
user avatar
2 votes
Accepted

How to extract debug information from a DOS executable compiled with Watcom C/C++?

OpenWatcom includes the wdump utility which can dump the debug info (if it's present).
user avatar
  • 34.9k
1 vote

How to extract debug information from a DOS executable compiled with Watcom C/C++?

This web site: http://www.exphys.jku.at/Skripten/PK_PROG/Watcom.pdf is a PDF that (step by step) explains how to debug such files.
user avatar
1 vote
Accepted

Issues rewriting portions of DOS app's assembly

In the end, the issue was due to the fixup tables. I wrote custom code to read the LE structure and thanks to some documents, figured out what offsets were being fixed up. Please note, you need to ...
user avatar
  • 178
1 vote

Issues rewriting portions of DOS app's assembly

In case of Watcom fastcall uses eax, edx, ebx, ecx for the first 4 arguments, however your code is pushing eax and is not restoring the stack afterwards. You should probably either add another pop (e....
user avatar
  • 34.9k
1 vote

How to edit an .exe file without overwriting previous information

IDA Pro https://www.hex-rays.com/products/ida/ and my blog https://firebitsbr.wordpress.com/2015/09/28/list-of-pluginsscripts-for-ida-pro-both-re-malware-vulnerabilities-and-exploits/ many plugins for ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible