Re: disassembly of Debug.exe?
- From: Terence <spamtrap@xxxxxxxxxx>
- Date: Tue, 29 Jul 2008 16:47:58 -0700 (PDT)
Jim Carlock wrote:
1) It's not a PE file, it's a 16-bit DOS executable.
2) When you start it up debug.exe on any NT machine, a version of ntvdm.exe
starts up, which in turn runs the application (debug.exe).
3) You might want to copy it to another folder, rename it as debug.com and
try to run it. It runs and it starts up the ntvdm.exe program in which
it runs inside of. And the ntvdm.exe that started up then does not shut
itself down until you exit the cmd.exe prompt.
I scanned it with PEID, which told me that it's a DOS executable, not a PE.
OllyDbg warns that the application is not a 32-bit Portable Executable and
asks if you'd like to load it.
Debug.exe may NOT support any 32-bit mnemonics at all. It certainly does
not allow one to encode in 32-bit. And that's why grdb.exe came around, or
so I've heard.
Tapping on the ? question mark once inside of debug.exe identifies that it
is capable of working with expanded memory.
allocate expanded memory XA [#pages]
deallocate expanded memory XD [handle]
map expanded memory pages XM [Lpage] [Ppage] [handle]
display expanded memory status XS
-XS
EMS not installed
And I've not messed with expanded memory at all in the last 8 years
(or so I believe).
You may need to open a command.com prompt, then run debug.exe inside
of that prompt. I'm pretty sure command.com reads from an autoexec.nt
and a config.nt file, so if you wanted to load an expanded memory
manager, you'd might need to go about it in that manner. I don't ever
recall messing with expanded memory on Windows 2000/XP.
Inside the cmd.exe prompt you can type the following to get around the
page by page viewing.
debug.exe debug.exe >> debug.txt
U 10 1000
Q
Note: You will not see what you type, but the commands get executed
and you will end up with a big file named debug.txt.
I EXPECT it to be a 16-bit executable; I'm not interested in any other
kind!
I program in 16 bits for DOS systems and emulations.
And I'm using both CMD.exe and command.exe on a Windows 2000 system
to do the work, just in case a difference shoed up.
Oh, I know about using debug.exe itself, but that's self-flagelation.
I wanted to use something better becuase the end-point is SUPPOSED to
be something better!.
I was wrong on one point. It was GRDB that did something. and BUBBLE
that was a bomber.
I just want to list the code of debug.exe then fix it and reassemble
and have a better tool, unless someone has alredy done this, but my
searches found no clues.
.
- References:
- disassembly of Debug.exe?
- From: Terence
- Re: disassembly of Debug.exe?
- From: Jim Carlock
- disassembly of Debug.exe?
- Prev by Date: Re: Atomic operations in 32 and 64 bit platforms
- Next by Date: Re: disassembly of Debug.exe?
- Previous by thread: Re: disassembly of Debug.exe?
- Next by thread: Re: disassembly of Debug.exe?
- Index(es):
Relevant Pages
|
