Hacker News Reader

Comment by butz | Hacker News Reader

Could someone refer to any good entry level DOS games reverse engineering materials? I dabbled a bit with NES hacking, but I'm finding it hard to get into DOS reverse engineering. What debugger to use? Any gotchas I should know in advance?

View on HN

Borland's debugger (came with Borland C++) was very good, if you can get hold of it. I removed copy protection from several games I owned using it, and actually fixed mouse support for another game.

Spice86 has a pretty good built-in debugger. I found it much easier to work with than DosBox's debugger. Spice86's DOS emulation isn't as good as DosBox's yet, but it's getting better all the time. https://github.com/OpenRakis/Spice86

I second LowLevelMahn's recommendation for IDA 5 Free. It's a good disassembler for DOS applications and helps me navigate what I'm looking at in the Spice86 debugger. It also runs very well in Wine.

Tools: IDA Pro 5 (Freeware) is the last Freeware version able to handle DOS executeables (official available by the ScummVM devs https://www.scummvm.org/news/20180331/) - IDA Pro still supports DOS-stuff with latest release - but not the freeware

or Ghidra - but the DOS/16bit support is sometimes lacky - but the decompiler is builtin

here is a list of articles to read: https://forum.stunts.hu/index.php?topic=4287.0

Gotcha: once you get into it, hacking the game gets to be way more fun than actually playing it. Way back in the day I used the DOS debug utility to edit my Bard’s Tale savegames. But once everybody has 127 hit points and -10 AC, the game gets way less interesting.

LLMs are actually great for reverse engineering small chunks of code now.

I'll add another recommendation for the freeware version of IDA 5, a copy of which the ScummVM project has permission to host. Although it's Windows-only and its UI feels a bit clunky today, the keyboard shortcuts allow an experienced user to be pretty efficient in navigating code, assigning data types, changing symbol names, etc.

I was especially pleased with IDA 5's ability to find and organize all the segments in just about any MZ EXE I've used it to reverse. It was even able to deal with the overlay segments in a Borland VROOMM / FBOV executable, and that was a pretty short-lived endeavor that faded to obscurity as soon as DOS/4G was on the scene.

Reply on news.ycombinator.com