5 ms·

Are there any decompilers for old x86 DOS com files?

by 1wd 4y ago

MattKimber 4y ago
The commercial versions of IDA still do COM and MZ executables as far as I'm aware, although it's been dropped from the free versions since 5. (Which is still available from ScummVM's reverse engineering page, but is only a disassembler and doesn't come with the decompiler) Ghidra does a vaguely OK job with MZ executables, providing they've been unpacked first. It really struggles to represent DOS function calls properly, you'll find arguments go missing from the decompiled code. There are some third-party plugins which improve things a bit. And it doesn't have signatures for any of the libraries so the output will just be a lot of `if ((var26 & 0xFEEE) && var42 > 0xE0) { ... }` and it's up to you to work out when one of the variables is actually a pointer to video memory or whatever. Reko can also decompile this era of code, it does have a tendency to crash on any more complex program but will be fine for simple files. Similar problem that the decompiled pseudo-C code doesn't really illuminate what's going on any more than just reading the disassembled x86 assembly language and walking through any tricky sections in the DOSBox debugger does. Without all of the Win32 API calls modern programs make there's a lot more work needed to figure out what's going on. Personally I find I also end up needing to use a vintage tool like Sourcer alongside the modern ones, because the newer stuff doesn't annotate things which were common in the era like directly referencing the BIOS data area or reading the interrupt table from memory rather than using the DOS calls for it. It's that or spending a lot of your reverse-engineering time discovering how things were done in the DOS days.
- 1wd 4y ago
  Thanks. I had tried Reko and your description matches my impression. I hoped to try hunt down the DOS Tetris easter egg described on the original authors website. https://vadim.oversigma.com/Tetris.htm https://vadim.oversigma.com/Tetris.htm The executable is linked in the image. I managed to decipher some functions (video memory pointers were actually kind of helpful) but didn't get far.
mobilio 4y ago
You can use old versions of IDA, IDA for DOS or i think Sourcerer.
- rasz 4y ago
  Sourcer is pretty amazing if you need to patch old BIOS, nothing can touch it in that niche https://corexor.wordpress.com/2015/12/09/sourcer-and-windows-source/ https://corexor.wordpress.com/2015/12/09/sourcer-and-windows...

Are there any decompilers for old x86 DOS com files?

by 1wd 4y ago

Are there any decompilers for old x86 DOS com files?

The commercial versions of IDA still do COM and MZ executables as far as I'm aware, although it's been dropped from the free versions since 5. (Which is still available from ScummVM's reverse engineering page, but is only a disassembler and doesn't come with the decompiler) Ghidra does a vaguely OK job with MZ executables, providing they've been unpacked first. It really struggles to represent DOS function calls properly, you'll find arguments go missing from the decompiled code. There are some third-party plugins which improve things a bit. And it doesn't have signatures for any of the libraries so the output will just be a lot of `if ((var26 & 0xFEEE) && var42 > 0xE0) { ... }` and it's up to you to work out when one of the variables is actually a pointer to video memory or whatever. Reko can also decompile this era of code, it does have a tendency to crash on any more complex program but will be fine for simple files. Similar problem that the decompiled pseudo-C code doesn't really illuminate what's going on any more than just reading the disassembled x86 assembly language and walking through any tricky sections in the DOSBox debugger does. Without all of the Win32 API calls modern programs make there's a lot more work needed to figure out what's going on. Personally I find I also end up needing to use a vintage tool like Sourcer alongside the modern ones, because the newer stuff doesn't annotate things which were common in the era like directly referencing the BIOS data area or reading the interrupt table from memory rather than using the DOS calls for it. It's that or spending a lot of your reverse-engineering time discovering how things were done in the DOS days.

1wd 4y ago
Thanks. I had tried Reko and your description matches my impression. I hoped to try hunt down the DOS Tetris easter egg described on the original authors website. https://vadim.oversigma.com/Tetris.htm https://vadim.oversigma.com/Tetris.htm The executable is linked in the image. I managed to decipher some functions (video memory pointers were actually kind of helpful) but didn't get far.

mobilio 4y ago

You can use old versions of IDA, IDA for DOS or i think Sourcerer.

rasz 4y ago
Sourcer is pretty amazing if you need to patch old BIOS, nothing can touch it in that niche https://corexor.wordpress.com/2015/12/09/sourcer-and-windows-source/ https://corexor.wordpress.com/2015/12/09/sourcer-and-windows...