Hot answers tagged

18 votes
Accepted

How can I find the source of a string in an old DOS game?

This program uses the PharLap DOS extender, as can be seen in its MZ header. The 32-bit executable program starts at offset 18A0, per "offset within header of relocation table" (see http://www.program-...
  • 2,334
10 votes
Accepted

How did this 80286 detection code work?

I'll dive into the past and try to give an explanation of the different checks you are observing in your software. I found three references explaining the behaviour (as I hope), which I will reference ...
  • 1,934
9 votes
Accepted

What's this assembly doing?

This looks like a 32-bit shift right compiler helper. In 16-bit era, 32-bit numbers were represented by a pair of registers, in this case ax:dx. The check for 16 is an optimization: if the shift is ...
  • 35.6k
6 votes

How can I find the source of a string in an old DOS game?

There's an ida plugin that connects to (a patched version of) DosBox and allows you to debug DosBox games from ida. However, i doubt you'd get that to work with the free version of ida. The fact that ...
5 votes

Reverse Engineering (very) old DOS calculation program

I am wondering whether it is possible to reverse engineer this program and put in into a "modern" jacket, + enable easy data instruction. Yes, it is possible, but not for a non programmer. To do so, ...
  • 3,309
5 votes
Accepted

Assembly that just seems to be a jumble

This appears to be a 32 bit multiplication implemented on a 16 bit architecture. Input numbers are dx:ax and cx:bx, result in dx:ax. The xchgs make the code confusing but if you play it through you ...
5 votes

What's this assembly doing?

It appears to be a 32 bit right shift with the 32 bit number provided in dx:ax, and cl being the number of bits to shift. If you assume cl is over 16, a right shift by more than 16 bit only needs to ...
5 votes
Accepted

Unrecognized procedures in IDA Pro

Unused functions in executables There are various explanations for that. Obfuscation, as Itsbriany said, but i don't think that was much of a thing in old DOS executables. Unneeded library functions. ...
4 votes

Is there a way to import debug/symbol information of a C++ DOS executable to IDA?

In case anyone has same question, here is how I solved it : 1) I exported all debug symbol information to a text file, using TDUMP. TDUMP somefile.exe > 1.txt 2) I cleaned the txt file to keep ...
  • 351
4 votes

IDA Pro and recognized library functions

Oh, the happyness of near functions vs. far functions, near pointers vs. far pointers, and mixed models (far functions, near pointers) Back in the 16 bit world, programs could either use a maximum ...
4 votes

debugging a graphical msdos game

Please check this guide https://www.vogons.org/viewtopic.php?t=3944 DosBox has additional internal debugger, but it has to be build with support for that.
  • 319
3 votes
Accepted

Why would VGA port 03CC respond with bit 3 set and bit 2 not?

First: the code is only checking bit 2 (bit 0,1,2) if 25 or 28Mhz clock is set Second: maybe its redundant but can't say without original code - could be still a problem with your disassembler retf ...
  • 281
3 votes
Accepted

DOS Executable Segments

In a DOS EXE file, if I have sub1, sub2, and sub3, split between two code segments, how do I know which sub is in which segment? Theoretically, you can't, since most addresses can belong to at least ...
  • 35.6k
3 votes
Accepted

Working with 16bit offsets and segments in Radare2

You can use -m 0x100 to load the binary at a specific address, as can be seen in r2 -h output: -m [addr] map file at given address (loadaddr) So you can do something like this: $ r2 -m 0x100 -...
  • 8,809
2 votes

How did this 80286 detection code work?

Check 2: While check 1 tests if the high-order bits of the flag word can be cleared, check 2 tests whether they can be set. On an 80286, these bits cannot be set in real mode, while on an 80386 they ...
2 votes

Assembly that just seems to be a jumble

It looks like the code is specifically generating these outputs: ax: (ax * bx) dx: (bx * dx + ax * cx) This is under the assumption that the mul instructions never have operands large enough to set ...
  • 881
2 votes

Reverse Engineering (very) old DOS calculation program

File extensions normaly do not help - there is no real standard, there are 1000 of .DAT and .KAN files around with absolutly not relation only the content of the files can give us any hint an ...
  • 281
2 votes
Accepted

Within A Folder of 100s of 16-bit MS-DOS Disassembled EXEs Identify Ones That Need/Use DOS/4GW

DOS/4GW executables normally use LE (linear executable) format for the actual main program (the DOS stub is just a launcher for the DOS4GW.EXE extender) and should be detected as such by IDA so you ...
  • 35.6k
2 votes

LE executable Fixup Record Table format

The additional 16 bits is the target offset (TRGOFF in the textfiles doc). I recommend you to check your parser against Hex-Rays' Extensive File Dumper.
  • 35.6k
2 votes

Finding Code Reference String in MS-DOS 16-bit Executable with IDA Pro

I found the code accessing the string using SoftICE for MS-DOS. To use I did the following: Add SoftICE driver as first entry in CONFIG.SYS DEVICE=C:\SICE\S-ICE.EXE /SYM 50 Launch program and Alt+...
2 votes

Finding API in ROM dump (DOS debug)

In DOS programs, a common sequence to look for is a sequence of push instructions, interleaved with sub sp,<size-of-local-vars>. This is a typical entry to a function. Whether this is an API ...
1 vote
Accepted

How to determine commands sent over DC-37 port by software from 1992

You’re in for a wild ride but it can be achieved if you persist and in any case you will learn a lot. I would probably start like this: Check what programs are run by autoexec.bat Run them in ...
  • 35.6k
1 vote

IDA/Hexrays: local variable allocation has failed; how to fix this?

First, local variable allocation failures do not necessarily mean that the decompilation is incorrect. They can happen naturally when using forced variables, for example. I'd proceed trying to analyze ...
  • 8,489
1 vote

x86 disassembly confusion regarding VESA functions

This code takes the most significant bit of EAX (msb(EAX)) and then, it subtracts it from AH and compares the result to 1. According to this specification ("VBE Return Status" section): AX = 014F => ...
  • 3,309
1 vote

Trying to view sprites from an old game

Ok first you mention Borland C++ IIRC there where decompiler for this IDE/compiler that would create source code from the executable. Diging through decompiled source might help you learn about the ...
  • 1,384
1 vote

Trying to view sprites from an old game

There’s an application called QuickBMS that you could use to import/export data. Here’s a tutorial on how to do so, by creating BMS scripts: Making BMS Scripts Also there are communities such as ...
  • 21
1 vote
Accepted

Converting 2 bytes into date

Well let's just pick these two: 32 47 = 0x4732 => 05/02/2005 31 47 = 0x4731 => 05/01/2005 So that 16-bit value is counting the days! Well when that counting started? 0x4732 => 18226 days /...
  • 158
1 vote

Reverse Engineering (very) old DOS calculation program

It sounds like it's still possible to communicate with the company. Excellent: ask them what their opinions are with reverse engineering the program, expressly to facilitate continuation of business ...
  • 121
1 vote
Accepted

Issues rewriting portions of DOS app's assembly

In the end, the issue was due to the fixup tables. I wrote custom code to read the LE structure and thanks to some documents, figured out what offsets were being fixed up. Please note, you need to ...
  • 178
1 vote

Issues rewriting portions of DOS app's assembly

In case of Watcom fastcall uses eax, edx, ebx, ecx for the first 4 arguments, however your code is pushing eax and is not restoring the stack afterwards. You should probably either add another pop (e....
  • 35.6k

Only top scored, non community-wiki answers of a minimum length are eligible