18
votes
Accepted
How can I find the source of a string in an old DOS game?
This program uses the PharLap DOS extender, as can be seen in its MZ header. The 32-bit executable program starts at offset 18A0, per "offset within header of relocation table" (see http://www.program-...
- 2,274
10
votes
Accepted
How did this 80286 detection code work?
I'll dive into the past and try to give an explanation of the different checks you are observing in your software. I found three references explaining the behaviour (as I hope), which I will reference ...
- 1,814
9
votes
Accepted
What's this assembly doing?
This looks like a 32-bit shift right compiler helper. In 16-bit era, 32-bit numbers were represented by a pair of registers, in this case ax:dx. The check for 16 is an optimization: if the shift is ...
- 34.7k
7
votes
Accepted
How to start a DOS application in DOSbox in debug mode?
If you build with --enable-debug[=heavy] and run the program via debug.com, it automatically breaks on the first instruction. See the DOS_Execute function in src/dos/dos_execute.cpp and ...
- 1,561
6
votes
Accepted
Any correlation between DOS Program Segment Prefix and the base address of loaded executable?
DOS didn't have a concept of more than one application being able to run at the same time, with each of those applications able to allocate memory. Programs that stayed resident after termination ...
- 12.7k
6
votes
How can I find the source of a string in an old DOS game?
There's an ida plugin that connects to (a patched version of) DosBox and allows you to debug DosBox games from ida. However, i doubt you'd get that to work with the free version of ida.
The fact that ...
- 12.7k
6
votes
Accepted
Change a text in DOS executables
Tools
Any hex editor will do. Under DOS both NC and VC have their own which are enough. Very good DOS tool is HIEW (hex editor + x86 dissasembler).
what to do
determine the executable form
open it ...
- 1,374
5
votes
Reverse Engineering (very) old DOS calculation program
I am wondering whether it is possible to reverse engineer this program and put in into a "modern" jacket, + enable easy data instruction.
Yes, it is possible, but not for a non programmer. To do so, ...
- 3,189
5
votes
Accepted
Assembly that just seems to be a jumble
This appears to be a 32 bit multiplication implemented on a 16 bit architecture.
Input numbers are dx:ax and cx:bx, result in dx:ax.
The xchgs make the code confusing but if you play it through you ...
- 1,341
5
votes
What's this assembly doing?
It appears to be a 32 bit right shift with the 32 bit number provided in dx:ax, and cl being the number of bits to shift.
If you assume cl is over 16, a right shift by more than 16 bit only needs to ...
- 1,341
5
votes
Accepted
Unrecognized procedures in IDA Pro
Unused functions in executables
There are various explanations for that.
Obfuscation, as Itsbriany said, but i don't think that was much of a thing in old DOS executables.
Unneeded library functions. ...
- 12.7k
4
votes
Is there a way to import debug/symbol information of a C++ DOS executable to IDA?
In case anyone has same question, here is how I solved it :
1) I exported all debug symbol information to a text file, using TDUMP.
TDUMP somefile.exe > 1.txt
2) I cleaned the txt file to keep ...
- 331
4
votes
IDA Pro and recognized library functions
Oh, the happyness of near functions vs. far functions, near pointers vs. far pointers, and mixed models (far functions, near pointers)
Back in the 16 bit world, programs could either
use a maximum ...
- 12.7k
4
votes
Any correlation between DOS Program Segment Prefix and the base address of loaded executable?
MZ-format executables also have the PSP at CS-0x10 just before the data loaded from the file.
Quoting Tech Help!, probaly the best DOS programming reference:
EXE-format programs define multiple ...
- 34.7k
4
votes
debugging a graphical msdos game
Please check this guide https://www.vogons.org/viewtopic.php?t=3944
DosBox has additional internal debugger, but it has to be build with support for that.
- 184
3
votes
Accepted
Working with 16bit offsets and segments in Radare2
You can use -m 0x100 to load the binary at a specific address, as can be seen in r2 -h output:
-m [addr] map file at given address (loadaddr)
So you can do something like this:
$ r2 -m 0x100 -...
- 8,639
3
votes
Accepted
DOS Executable Segments
In a DOS EXE file, if I have sub1, sub2, and sub3, split between two
code segments, how do I know which sub is in which segment?
Theoretically, you can't, since most addresses can belong to at least ...
- 34.7k
3
votes
Accepted
Why would VGA port 03CC respond with bit 3 set and bit 2 not?
First: the code is only checking bit 2 (bit 0,1,2) if 25 or 28Mhz clock is set
Second: maybe its redundant but can't say without original code - could be still a problem with your disassembler
retf ...
- 251
2
votes
Any correlation between DOS Program Segment Prefix and the base address of loaded executable?
It is typically true that DOS loads a .EXE program immediately after the PSP, meaning in your terms that base - PSP == 0x0010. But it's not necessarily true, and if you were writing this (or any) DOS ...
2
votes
Assembly that just seems to be a jumble
It looks like the code is specifically generating these outputs:
ax: (ax * bx)
dx: (bx * dx + ax * cx)
This is under the assumption that the mul instructions never have operands large enough to set ...
- 871
2
votes
LE executable Fixup Record Table format
The additional 16 bits is the target offset (TRGOFF in the textfiles doc).
I recommend you to check your parser against Hex-Rays' Extensive File Dumper.
- 34.7k
2
votes
How did this 80286 detection code work?
Check 2: While check 1 tests if the high-order bits of the flag word can be cleared, check 2 tests whether they can be set. On an 80286, these bits cannot be set in real mode, while on an 80386 they ...
- 121
2
votes
Reverse Engineering (very) old DOS calculation program
File extensions normaly do not help - there is no real standard, there are 1000 of .DAT and .KAN files around with absolutly not relation
only the content of the files can give us any hint
an ...
- 251
2
votes
Accepted
Within A Folder of 100s of 16-bit MS-DOS Disassembled EXEs Identify Ones That Need/Use DOS/4GW
DOS/4GW executables normally use LE (linear executable) format for the actual main program (the DOS stub is just a launcher for the DOS4GW.EXE extender) and should be detected as such by IDA so you ...
- 34.7k
2
votes
Finding Code Reference String in MS-DOS 16-bit Executable with IDA Pro
I found the code accessing the string using SoftICE for MS-DOS.
To use I did the following:
Add SoftICE driver as first entry in CONFIG.SYS
DEVICE=C:\SICE\S-ICE.EXE /SYM 50
Launch program and Alt+...
- 1,111
2
votes
Finding API in ROM dump (DOS debug)
In DOS programs, a common sequence to look for is a sequence of push instructions, interleaved with sub sp,<size-of-local-vars>. This is a typical entry to a function. Whether this is an API ...
- 1,020
1
vote
Trying to view sprites from an old game
Ok first you mention Borland C++ IIRC there where decompiler for this IDE/compiler that would create source code from the executable. Diging through decompiled source might help you learn about the ...
- 1,374
1
vote
Trying to view sprites from an old game
There’s an application called QuickBMS that you could use to import/export data.
Here’s a tutorial on how to do so, by creating BMS scripts: Making BMS Scripts
Also there are communities such as ...
- 21
1
vote
Accepted
Converting 2 bytes into date
Well let's just pick these two:
32 47 = 0x4732 => 05/02/2005
31 47 = 0x4731 => 05/01/2005
So that 16-bit value is counting the days!
Well when that counting started?
0x4732 => 18226 days /...
- 148
1
vote
Reverse Engineering (very) old DOS calculation program
It sounds like it's still possible to communicate with the company. Excellent: ask them what their opinions are with
reverse engineering the program, expressly to facilitate continuation of business ...
- 121
Only top scored, non community-wiki answers of a minimum length are eligible