[HN Gopher] Reverse Engineering DOS Software as If It Were 1990
       ___________________________________________________________________
        
       Reverse Engineering DOS Software as If It Were 1990
        
       Author : thunderbong
       Score  : 69 points
       Date   : 2024-02-01 11:49 UTC (1 days ago)
        
 (HTM) web link (and0uille.net)
 (TXT) w3m dump (and0uille.net)
        
       | boricj wrote:
       | Here's another series of articles on reverse-engineering a DOS
       | game, using the original toolchain as part of the process of
       | decompiling it: https://neuviemeporte.github.io/category/f15-se2
        
         | s-macke wrote:
         | Here is my approach to reverse-engineer a DOS game: Starflight
         | [1]. Actually, all the tools failed to disassemble the code and
         | I had to write all tools myself.
         | 
         | What I find most fascinating is that reverse engineering these
         | kind of games is very satisfying and even more fun than playing
         | them.
         | 
         | [1] https://github.com/s-macke/starflight-reverse
        
       | mobilio wrote:
       | I still miss NuMega tools...
        
         | zwieback wrote:
         | Me too. I seem to remember we even had a NMI pushbutton with
         | tiny contact pads the width of a ISA bus contact. You could
         | force the kernel debugger to pop up when otherwise all hope was
         | lost.
        
           | satiated_grue wrote:
           | I did a horribly ugly thing and soldered wires to the NMI and
           | ground pins at the CPU, and ran them out to a switch, and
           | used that with Turbo Debugger running on the second (MDA)
           | monitor. Worked a treat.
        
       | ipython wrote:
       | SoftICE brings back memories... although now that you're using
       | Bochs, you can just use Bochs' internal debugger to do the same
       | thing. Heck you can connect the Bochs debugger to IDA Pro:
       | https://hex-rays.com/products/ida/support/idadoc/1329.shtml.
       | 
       | I've used the Bochs debugger many times to debug DOS apps and to
       | even do things like create an unencrypted forensic image of a
       | full-disk encrypted drive (obviously assuming you have the
       | encryption key, no magic there).
        
         | anthk wrote:
         | Bochs is an unknown beast. The IPC clock might be not so
         | precise to adjust, but it can emulate highend i7's. Slowly,
         | yes, but you will fake every instruction to the guest. And, you
         | know, you can RE hard stuff like malware in no time.
        
       | jgrahamc wrote:
       | Oh SoftICE. That was a truly excellent tool that was incredibly
       | useful when doing low level stuff. I used it a lot for device
       | driver development on DOS.
        
         | twh270 wrote:
         | Yes it was, I had it hooked up to my target machine with a
         | serial cable -- developing display drivers for Windows and
         | OS/2. The only thing SoftICE couldn't do was debug the video
         | card itself!
        
       | rzzzt wrote:
       | I found a DOS version of IDA Freeware from 1997 recently; it uses
       | a Turbo Vision(-based? -like?) UI. A little bit cramped for my
       | taste :)
        
         | mobilio wrote:
         | True - that version was compiled on TurboPascal.
        
       | torbengee wrote:
       | Oh SoftICE, you got me past many shareware nag screens ... :)
        
         | gregschlom wrote:
         | Same here! `:bpx MessageBoxA`, step out, nop nop nop, done.
         | 
         | Great memories. Being able to step through each instruction on
         | my CPU and seeing the memory update was like a super power and
         | really helped understand things at a deeper level.
        
       | thebeardisred wrote:
       | I'm also a fan of this person's videos:
       | https://www.youtube.com/watch?v=KdIpuCznir4
       | 
       | He's using Rizin/Cutter and goes into some of the details of the
       | COM file format.
        
       | voldacar wrote:
       | Is there anything comparable to softICE for modern x64 systems?
        
         | bri3d wrote:
         | https://hyperdbg.org and m1n1 (Apple Silicon) spring to mind as
         | modern supervisor/hypervisor debuggers.
         | 
         | There's nothing modern I'm aware of that lets you press a key
         | combination to get into a hypervisor debug UI like softICE was
         | known for, though. It's all shifted to host-and-target
         | debugging. You'd use a "normal" debugger on one machine
         | (lldb/gdb, WinDbg, IDA, etc.) and either supervised host-to-
         | target connection (network-to-kernel/hypervisor on x86, OCD
         | like JTAG/SWD/CoreSight on embedded) or emulation (for pretty
         | much everything but device driver development).
        
         | Dwedit wrote:
         | There are modern debuggers around, it depends on what you're
         | trying to do.
         | 
         | For example, x64dbg is a Windows program that can debug x86 and
         | x64 Windows programs without any source code or debug symbols.
         | 
         | WinDbg lets you debug the Windows kernel even on a remote
         | machine. If you use an emulator like VirtualBox, the remote
         | machine can even be on the same physical computer. Useful if
         | you're developing drivers.
        
       ___________________________________________________________________
       (page generated 2024-02-02 23:00 UTC)