Flag: Tornado! Hurricane!

 Forums >>  Brainstorms - General  >>  What is the best way for reverse-engineering DOS/4GW extended EXE file?

Topic created on: May 7, 2010 08:36 CDT by dodamn .

Hello.

I have an EXE file for MS-DOS. It is built by Watcom C/C++ compiler and has DOS/4GW extended format.
I want to reverse-engineer it.

So First, I use IDA pro Hex-ray. But it is my first time for reversing. So I just open the file in IDA pro and just click 'Next', 'Next' and 'Next'. :) But IDA pro is GOD!. It shows assembly code! And I can create .c code using menu 'File'->'Produce file'->'Create C file'. I tried to compile those disassembled/decompiled codes. But it failed.

Second, I use DOSBox. Because DOSBox(debug mode) shows registers' values, assembly code. Also DOSBox provide breakpoint feature. But assembly code what DOSBox shows is not same as IDA pro does. So I can't put breakpoint properly. Why code, what DOSBox shows, is different from what IDA pro shows?

Anyway, what is the best way for reversing DOS/4GW extended EXE file?
Is there any way to put breakpoint on somewhre in the code when the program runs?

  GreenPiece     May 17, 2010 08:08.59 CDT
To debug DOS programs you can try Soft-Ice (as I tried it on Windows 98 and it worked nice, in case of experiencing troubles with WinXP), AFDPro, TurboDebugger, TRW2000.

Results in IDA and debugger may alter because of many reasons, one of them is self-modifying code.

And BTW, never try to produce .exe from what you get from Hex-Rays, there are a lot of errors in this code and if you want to compile it, you'd better refer to IDA disasm-listing.

  jduck     May 17, 2010 12:19.47 CDT
I believe that Gynvael and j00ru have some experience in this area.. http://gynvael.coldwind.pl/ and http://j00ru.vexillium.org/ are their blog links...

I think they even released or plan to release some tools or something to aid in doing this type of reversing.

Note: Registration is required to post to the forums.

Active in Last 5 Minutes
waleedassar

There are 28,224 total registered users.


Recently Created Topics
Reverse Engineering ...
Jan/23
Career: DoD Agency I...
Jan/22
"Disappearing&q...
Jan/17
Career: Software Sec...
Jan/11
Where is the call st...
Jan/07
IDA Pro 6.1 Breakpoi...
Jan/01
How to create data s...
Dec/30
can i search all mod...
Dec/23
IDA symbol table exp...
Dec/20
An anti-attach trick
Dec/17


Recent Forum Posts
Reverse Engineering ...
NirIzr
"Disappearing&q...
NirIzr
Reverse Engineering ...
charlie
"Disappearing&q...
charlie
An anti-attach trick
Bass
An anti-attach trick
waleeda...
An anti-attach trick
Bass
An anti-attach trick
waleeda...
An anti-attach trick
Bass
Looking for value in...
NirIzr


Recent Blog Entries
cmathieu
Feb/07
Hacker Carnival

waleedassar
Feb/06
OllyDbg v1.10 And Hardware ...

waleedassar
Jan/31
Yet Another Anti-Debug Trick

RolfRolles
Jan/22
Finding Bugs in VMs with a ...

waleedassar
Jan/13
An OllyDbg Bug Disables Sof...

More ...


Recent Blog Comments
waleedassar on:
Feb/07
OllyDbg v1.10 And Hardware ...

NirIzr on:
Feb/07
OllyDbg v1.10 And Hardware ...

NirIzr on:
Feb/05
Yet Another Anti-Debug Trick

trolotou on:
Feb/05
Doudoune Moncler -Pennies F...

waleedassar on:
Feb/01
Yet Another Anti-Debug Trick

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit