Flag: Tornado! Hurricane!

 Forums >>  IDA Pro  >>  Debugging DOS Executables

Topic created on: February 28, 2008 08:47 CST by jeffporter .

Hello all,

Sorry for my first post being a newbie quesion, but....

I'm trying to look into a little DOS program.
Note: The program requies "VBDRT10E.EXE" to be present.

When I load it in IDA I get the message...

"possibly a packed file, continue?"

So I click yes, I then get a message in the 'IDA View-a' of...

"start endp ; sp-analysis failed"

The log file produced seem to show it loaded correctly.

My question is...

Should I worry about the sp-analysis?
Do I need to unpack the exe file somehow first?

Thanks for taking the time to read this.
:-)

Jeff

P.s. before I get flamed, I've done asm back at uni, but I've been mostly living in the world of Java for the last 11years.

<snip>
The initial autoanalysis has been finished.
Unloading IDP module C:\Program Files\IDA\procs\pc.w32...
<snip>
Loading IDP module C:\Program Files\IDA\procs\pc.w32 for processor metapc...OK
Autoanalysis subsystem has been initialized.
Possible file format: MS-DOS executable (EXE) (C:\Program Files\IDA\loaders\dos.ldw)
Loading file 'C:\DOSPROG\test\SKIP.EXE' into database...
Detected file format: MS-DOS executable (EXE)
Reading relocation table...
  0. Creating a new segment  (0000D840-00010BA0) ... ... OK
  1. Creating a new segment  (00010B20-00010BA0) ... ... OK
Dummy segment at 0x0 (next segment at 0xD840)
  2. Creating a new segment  (00000000-0000D840) ... ... OK
Searching for the data segment...
Looking for ' - Copyright'...
Assuming __cdecl calling convention by default
Marking typical code sequences...
Flushing buffers, please wait...ok
File 'C:\DOSPROG\SKIP.EXE' is successfully loaded into the database.
Compiling file 'C:\Program Files\IDA\idc\ida.idc'...
Executing function 'main'...
Compiling file 'C:\Program Files\IDA\idc\onload.idc'...
Executing function 'OnLoad'...
IDA is analysing the input file...
You may start to explore the input file right now.
The initial autoanalysis has been finished.

  sp     February 28, 2008 10:53.19 CST
You can quickly find out whether your file needs unpacking by looking at the IDA disassembly. If the assembly code looks good, then you probably don't need unpacking.

If the assembly code looks bad, then you can try an unpacker. My DOS memory is very fuzzy but I believe to remember that there was a pretty good generic unpacker for DOS files. It might be http://www.geocities.com/Paris/9733/tron130r.zip but I am not sure. If that doesn't work, maybe Google for other DOS unpackers.

  daniellewis     February 28, 2008 17:04.33 CST
Sorry to hear to experience with assembler had to be on DOS.  It's a bit more fun in x86-64 long mode.

  jeffporter     February 29, 2008 03:10.00 CST
sp, you're a star!

Tron did the job, it now looks like a proper program, not a 20 line mess.

Cheers.

  jeffporter     February 29, 2008 03:41.34 CST
hmm, guess I spoke to soon.

The program looks complete, except...

I can't debug in IDA, debugging other exe files (ie. putty) is fine, just not this old school dos program. :-(

I suspect its due to one of the block reporting..

"start endp ; sp-analysis failed"

I'll keep plugging away at it, but any advice would be great.

Thanks
Jeff

  jeffporter     February 29, 2008 09:21.21 CST
ah, crap.

Ok. so my problem is that I'm trying to debug an old 16-bit dos app, which is impossible under a 32bit OS.

Hence ODBLG110 doesnt work, and only see's NTVDM.

Ida pro, does better, but not perfect.

Guess I have to setup a VM of Win98.
Do you think that would work?

  sp     February 29, 2008 10:08.52 CST
I don't think you can debug DOS programs with OllyDbg or IDA Pro. I used to debug DOS programs with Borland's Turbo Debugger. You can probably find it on the internet somewhere.

Another option is to find an old version of SoftICE for DOS somewhere.

  Wannabe   March 3, 2008 12:11.30 CST
http://www.exetools.com/debuggers.htm  and
http://www.bttr-software.de/products/insight/
are two places you might look for DOS debuggers.
And a VM of DOS might come handy.

  jeffporter     March 4, 2008 04:35.53 CST
thanks for the all the responces.

I've installed WinME on some VM-ware, but that was too modern.
So I've now installed MSDos7 and am using Turbo Debugger(TD.exe).

I must say I feel a little dirty getting this low down, but I'm sure a cold shower will get rid of the feeling.   :-)

I think I've found the line I'm lookng for.

(Im trying to bypass a five digit reg code that the user has to enter)

The line I'm looking at is either...

cmp word ptr [0086],0000
The memory at 0086 contains BB
0080 00 0D 00 03 89 66 BB 66

Or

test cs:byte ptr [0009],20
jne 044A
F0 is in 0009
0008 1D F0 E6 01 41 19 B0 01

Anyone got any tips on how to get around this?

  abuse007     March 4, 2008 17:27.22 CST
jeffporter, test your theory using TD to force the program to take the other code path. If this bypasses the code the user has to enter then you have found the correct location of the check. It is also possibly there is multiple checks.

Once all the checks have been found, patch the conditional jumps with either jmp (jmp always), or nop, depending on which code path you want it to take.

There may also be integrity checks of the code, which would need to be taken care of.

  fileoffset     March 4, 2008 19:29.26 CST
Install Windows 98SE and Softice 4.10 or equivelant.

Debug the program with softice's dos loader (dldr?.exe) its in the Softice\Utils folder i think (its been a while).

Those bytes don't look quite right unless they are post-transformation of the key, are you sure you are looking in the right segment? 'd cs:86' in softice

  jeffporter     March 5, 2008 11:50.37 CST
I've tried WinME via VM ware and SI 4.0.
But all I get is ...

DLDR JEFF.EXE
>softice not loaded.

So Im back on TD.exe

I have to enter a 5 digit code. e.g. 12345, no letters.
& I can see the 10-ish lines of code that it runs around waiting for the final digit to be entered.

ok, an update.

Think I've found the line I'm looking for...

cs:C8D2 380656A08   cmp [085A], al
cs:C8D6 74FA        je  C8D2

If I look in the dump, there is nothing in 085A,
In the main window it contains 2000 (so 8192 decimal).


From what I understand AL is the low byte section of the registry AX? is that correct?

If so, then AX contains 0607, so how does it compare 2000 with 07?

screen grab...
http://www.qenet.co.uk/personal/td.jpg

Thanks
Jeff

  fileoffset     March 6, 2008 21:10.43 CST
al = 07 in the above example, and since the 85a is a byte pointer, it looks to be comparing it with either 00 or 20 (space). I'm not really familiar with TD, but try showing ds:85a in the data window.

  antus     June 10, 2008 19:59.00 CDT
Im currently trying to find some soft to debug an old pmode watcom exectable, and stumbled upon this thread. Heres and old old overview I once wrote for cracking with TD, though its probably nothing new to you guys.

http://ant.is-a-geek.org/fineales/cracking/

Note: Registration is required to post to the forums.

There are 31,322 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
hi!
Jul/01
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit