18
votes
Accepted
How can I find the source of a string in an old DOS game?
This program uses the PharLap DOS extender, as can be seen in its MZ header. The 32-bit executable program starts at offset 18A0, per "offset within header of relocation table" (see http://www.program-...
- 2,334
10
votes
Accepted
How did this 80286 detection code work?
I'll dive into the past and try to give an explanation of the different checks you are observing in your software. I found three references explaining the behaviour (as I hope), which I will reference ...
- 1,934
9
votes
Accepted
What's this assembly doing?
This looks like a 32-bit shift right compiler helper. In 16-bit era, 32-bit numbers were represented by a pair of registers, in this case ax:dx. The check for 16 is an optimization: if the shift is ...
- 35.6k
6
votes
How can I find the source of a string in an old DOS game?
There's an ida plugin that connects to (a patched version of) DosBox and allows you to debug DosBox games from ida. However, i doubt you'd get that to work with the free version of ida.
The fact that ...
- 12.8k
5
votes
Reverse Engineering (very) old DOS calculation program
I am wondering whether it is possible to reverse engineer this program and put in into a "modern" jacket, + enable easy data instruction.
Yes, it is possible, but not for a non programmer. To do so, ...
- 3,309
5
votes
Accepted
Assembly that just seems to be a jumble
This appears to be a 32 bit multiplication implemented on a 16 bit architecture.
Input numbers are dx:ax and cx:bx, result in dx:ax.
The xchgs make the code confusing but if you play it through you ...
- 1,381
5
votes
What's this assembly doing?
It appears to be a 32 bit right shift with the 32 bit number provided in dx:ax, and cl being the number of bits to shift.
If you assume cl is over 16, a right shift by more than 16 bit only needs to ...
- 1,381
5
votes
Accepted
Unrecognized procedures in IDA Pro
Unused functions in executables
There are various explanations for that.
Obfuscation, as Itsbriany said, but i don't think that was much of a thing in old DOS executables.
Unneeded library functions. ...
- 12.8k
4
votes
Is there a way to import debug/symbol information of a C++ DOS executable to IDA?
In case anyone has same question, here is how I solved it :
1) I exported all debug symbol information to a text file, using TDUMP.
TDUMP somefile.exe > 1.txt
2) I cleaned the txt file to keep ...
- 351
4
votes
IDA Pro and recognized library functions
Oh, the happyness of near functions vs. far functions, near pointers vs. far pointers, and mixed models (far functions, near pointers)
Back in the 16 bit world, programs could either
use a maximum ...
- 12.8k
4
votes
debugging a graphical msdos game
Please check this guide https://www.vogons.org/viewtopic.php?t=3944
DosBox has additional internal debugger, but it has to be build with support for that.
- 319
3
votes
Accepted
Why would VGA port 03CC respond with bit 3 set and bit 2 not?
First: the code is only checking bit 2 (bit 0,1,2) if 25 or 28Mhz clock is set
Second: maybe its redundant but can't say without original code - could be still a problem with your disassembler
retf ...
- 281
3
votes
Accepted
DOS Executable Segments
In a DOS EXE file, if I have sub1, sub2, and sub3, split between two
code segments, how do I know which sub is in which segment?
Theoretically, you can't, since most addresses can belong to at least ...
- 35.6k
3
votes
Accepted
Working with 16bit offsets and segments in Radare2
You can use -m 0x100 to load the binary at a specific address, as can be seen in r2 -h output:
-m [addr] map file at given address (loadaddr)
So you can do something like this:
$ r2 -m 0x100 -...
- 8,809
2
votes
How did this 80286 detection code work?
Check 2: While check 1 tests if the high-order bits of the flag word can be cleared, check 2 tests whether they can be set. On an 80286, these bits cannot be set in real mode, while on an 80386 they ...
- 121
2
votes
Assembly that just seems to be a jumble
It looks like the code is specifically generating these outputs:
ax: (ax * bx)
dx: (bx * dx + ax * cx)
This is under the assumption that the mul instructions never have operands large enough to set ...
- 881
2
votes
Reverse Engineering (very) old DOS calculation program
File extensions normaly do not help - there is no real standard, there are 1000 of .DAT and .KAN files around with absolutly not relation
only the content of the files can give us any hint
an ...
- 281
2
votes
Accepted
Within A Folder of 100s of 16-bit MS-DOS Disassembled EXEs Identify Ones That Need/Use DOS/4GW
DOS/4GW executables normally use LE (linear executable) format for the actual main program (the DOS stub is just a launcher for the DOS4GW.EXE extender) and should be detected as such by IDA so you ...
- 35.6k
2
votes
LE executable Fixup Record Table format
The additional 16 bits is the target offset (TRGOFF in the textfiles doc).
I recommend you to check your parser against Hex-Rays' Extensive File Dumper.
- 35.6k
2
votes
Finding Code Reference String in MS-DOS 16-bit Executable with IDA Pro
I found the code accessing the string using SoftICE for MS-DOS.
To use I did the following:
Add SoftICE driver as first entry in CONFIG.SYS
DEVICE=C:\SICE\S-ICE.EXE /SYM 50
Launch program and Alt+...
- 1,165
2
votes
Finding API in ROM dump (DOS debug)
In DOS programs, a common sequence to look for is a sequence of push instructions, interleaved with sub sp,<size-of-local-vars>. This is a typical entry to a function. Whether this is an API ...
- 1,040
1
vote
Accepted
How to determine commands sent over DC-37 port by software from 1992
You’re in for a wild ride but it can be achieved if you persist and in any case you will learn a lot.
I would probably start like this:
Check what programs are run by autoexec.bat
Run them in ...
- 35.6k
1
vote
IDA/Hexrays: local variable allocation has failed; how to fix this?
First, local variable allocation failures do not necessarily mean that the decompilation is incorrect. They can happen naturally when using forced variables, for example. I'd proceed trying to analyze ...
- 8,489
1
vote
x86 disassembly confusion regarding VESA functions
This code takes the most significant bit of EAX (msb(EAX)) and then, it subtracts it from AH and compares the result to 1. According to this specification ("VBE Return Status" section):
AX = 014F => ...
- 3,309
1
vote
Trying to view sprites from an old game
Ok first you mention Borland C++ IIRC there where decompiler for this IDE/compiler that would create source code from the executable. Diging through decompiled source might help you learn about the ...
- 1,384
1
vote
Trying to view sprites from an old game
There’s an application called QuickBMS that you could use to import/export data.
Here’s a tutorial on how to do so, by creating BMS scripts: Making BMS Scripts
Also there are communities such as ...
- 21
1
vote
Accepted
Converting 2 bytes into date
Well let's just pick these two:
32 47 = 0x4732 => 05/02/2005
31 47 = 0x4731 => 05/01/2005
So that 16-bit value is counting the days!
Well when that counting started?
0x4732 => 18226 days /...
- 158
1
vote
Reverse Engineering (very) old DOS calculation program
It sounds like it's still possible to communicate with the company. Excellent: ask them what their opinions are with
reverse engineering the program, expressly to facilitate continuation of business ...
- 121
1
vote
Accepted
Issues rewriting portions of DOS app's assembly
In the end, the issue was due to the fixup tables. I wrote custom code to read the LE structure and thanks to some documents, figured out what offsets were being fixed up.
Please note, you need to ...
- 178
1
vote
Issues rewriting portions of DOS app's assembly
In case of Watcom fastcall uses eax, edx, ebx, ecx for the first 4 arguments, however your code is pushing eax and is not restoring the stack afterwards. You should probably either add another pop (e....
- 35.6k
Only top scored, non community-wiki answers of a minimum length are eligible