Hot answers tagged

18 votes
Accepted

How can I find the source of a string in an old DOS game?

This program uses the PharLap DOS extender, as can be seen in its MZ header. The 32-bit executable program starts at offset 18A0, per "offset within header of relocation table" (see http://www.program-...
user avatar
  • 2,274
10 votes
Accepted

How did this 80286 detection code work?

I'll dive into the past and try to give an explanation of the different checks you are observing in your software. I found three references explaining the behaviour (as I hope), which I will reference ...
user avatar
  • 1,814
9 votes
Accepted

What's this assembly doing?

This looks like a 32-bit shift right compiler helper. In 16-bit era, 32-bit numbers were represented by a pair of registers, in this case ax:dx. The check for 16 is an optimization: if the shift is ...
user avatar
  • 34.7k
7 votes
Accepted

How to start a DOS application in DOSbox in debug mode?

If you build with --enable-debug[=heavy] and run the program via debug.com, it automatically breaks on the first instruction. See the DOS_Execute function in src/dos/dos_execute.cpp and ...
user avatar
  • 1,561
6 votes
Accepted

Any correlation between DOS Program Segment Prefix and the base address of loaded executable?

DOS didn't have a concept of more than one application being able to run at the same time, with each of those applications able to allocate memory. Programs that stayed resident after termination ...
user avatar
6 votes

How can I find the source of a string in an old DOS game?

There's an ida plugin that connects to (a patched version of) DosBox and allows you to debug DosBox games from ida. However, i doubt you'd get that to work with the free version of ida. The fact that ...
user avatar
6 votes
Accepted

Change a text in DOS executables

Tools Any hex editor will do. Under DOS both NC and VC have their own which are enough. Very good DOS tool is HIEW (hex editor + x86 dissasembler). what to do determine the executable form open it ...
user avatar
  • 1,374
5 votes

Reverse Engineering (very) old DOS calculation program

I am wondering whether it is possible to reverse engineer this program and put in into a "modern" jacket, + enable easy data instruction. Yes, it is possible, but not for a non programmer. To do so, ...
user avatar
  • 3,189
5 votes
Accepted

Assembly that just seems to be a jumble

This appears to be a 32 bit multiplication implemented on a 16 bit architecture. Input numbers are dx:ax and cx:bx, result in dx:ax. The xchgs make the code confusing but if you play it through you ...
user avatar
5 votes

What's this assembly doing?

It appears to be a 32 bit right shift with the 32 bit number provided in dx:ax, and cl being the number of bits to shift. If you assume cl is over 16, a right shift by more than 16 bit only needs to ...
user avatar
5 votes
Accepted

Unrecognized procedures in IDA Pro

Unused functions in executables There are various explanations for that. Obfuscation, as Itsbriany said, but i don't think that was much of a thing in old DOS executables. Unneeded library functions. ...
user avatar
4 votes

Is there a way to import debug/symbol information of a C++ DOS executable to IDA?

In case anyone has same question, here is how I solved it : 1) I exported all debug symbol information to a text file, using TDUMP. TDUMP somefile.exe > 1.txt 2) I cleaned the txt file to keep ...
user avatar
  • 331
4 votes

IDA Pro and recognized library functions

Oh, the happyness of near functions vs. far functions, near pointers vs. far pointers, and mixed models (far functions, near pointers) Back in the 16 bit world, programs could either use a maximum ...
user avatar
4 votes

Any correlation between DOS Program Segment Prefix and the base address of loaded executable?

MZ-format executables also have the PSP at CS-0x10 just before the data loaded from the file. Quoting Tech Help!, probaly the best DOS programming reference: EXE-format programs define multiple ...
user avatar
  • 34.7k
4 votes

debugging a graphical msdos game

Please check this guide https://www.vogons.org/viewtopic.php?t=3944 DosBox has additional internal debugger, but it has to be build with support for that.
user avatar
  • 184
3 votes
Accepted

Working with 16bit offsets and segments in Radare2

You can use -m 0x100 to load the binary at a specific address, as can be seen in r2 -h output: -m [addr] map file at given address (loadaddr) So you can do something like this: $ r2 -m 0x100 -...
user avatar
  • 8,639
3 votes
Accepted

DOS Executable Segments

In a DOS EXE file, if I have sub1, sub2, and sub3, split between two code segments, how do I know which sub is in which segment? Theoretically, you can't, since most addresses can belong to at least ...
user avatar
  • 34.7k
3 votes
Accepted

Why would VGA port 03CC respond with bit 3 set and bit 2 not?

First: the code is only checking bit 2 (bit 0,1,2) if 25 or 28Mhz clock is set Second: maybe its redundant but can't say without original code - could be still a problem with your disassembler retf ...
user avatar
  • 251
2 votes

Any correlation between DOS Program Segment Prefix and the base address of loaded executable?

It is typically true that DOS loads a .EXE program immediately after the PSP, meaning in your terms that base - PSP == 0x0010. But it's not necessarily true, and if you were writing this (or any) DOS ...
user avatar
2 votes

Assembly that just seems to be a jumble

It looks like the code is specifically generating these outputs: ax: (ax * bx) dx: (bx * dx + ax * cx) This is under the assumption that the mul instructions never have operands large enough to set ...
user avatar
  • 871
2 votes

LE executable Fixup Record Table format

The additional 16 bits is the target offset (TRGOFF in the textfiles doc). I recommend you to check your parser against Hex-Rays' Extensive File Dumper.
user avatar
  • 34.7k
2 votes

How did this 80286 detection code work?

Check 2: While check 1 tests if the high-order bits of the flag word can be cleared, check 2 tests whether they can be set. On an 80286, these bits cannot be set in real mode, while on an 80386 they ...
user avatar
2 votes

Reverse Engineering (very) old DOS calculation program

File extensions normaly do not help - there is no real standard, there are 1000 of .DAT and .KAN files around with absolutly not relation only the content of the files can give us any hint an ...
user avatar
  • 251
2 votes
Accepted

Within A Folder of 100s of 16-bit MS-DOS Disassembled EXEs Identify Ones That Need/Use DOS/4GW

DOS/4GW executables normally use LE (linear executable) format for the actual main program (the DOS stub is just a launcher for the DOS4GW.EXE extender) and should be detected as such by IDA so you ...
user avatar
  • 34.7k
2 votes

Finding Code Reference String in MS-DOS 16-bit Executable with IDA Pro

I found the code accessing the string using SoftICE for MS-DOS. To use I did the following: Add SoftICE driver as first entry in CONFIG.SYS DEVICE=C:\SICE\S-ICE.EXE /SYM 50 Launch program and Alt+...
user avatar
2 votes

Finding API in ROM dump (DOS debug)

In DOS programs, a common sequence to look for is a sequence of push instructions, interleaved with sub sp,<size-of-local-vars>. This is a typical entry to a function. Whether this is an API ...
user avatar
1 vote

Trying to view sprites from an old game

Ok first you mention Borland C++ IIRC there where decompiler for this IDE/compiler that would create source code from the executable. Diging through decompiled source might help you learn about the ...
user avatar
  • 1,374
1 vote

Trying to view sprites from an old game

There’s an application called QuickBMS that you could use to import/export data. Here’s a tutorial on how to do so, by creating BMS scripts: Making BMS Scripts Also there are communities such as ...
user avatar
  • 21
1 vote
Accepted

Converting 2 bytes into date

Well let's just pick these two: 32 47 = 0x4732 => 05/02/2005 31 47 = 0x4731 => 05/01/2005 So that 16-bit value is counting the days! Well when that counting started? 0x4732 => 18226 days /...
user avatar
  • 148
1 vote

Reverse Engineering (very) old DOS calculation program

It sounds like it's still possible to communicate with the company. Excellent: ask them what their opinions are with reverse engineering the program, expressly to facilitate continuation of business ...
user avatar
  • 121

Only top scored, non community-wiki answers of a minimum length are eligible