dosinfo

Tool tools/dos/dosinfo.py (program, 16-bit DOS). First look at a DOS or Windows 3.x executable (MZ, NE): what it is, how it was built, what it uses.

Run it with ./gameframe run dosinfo ARGS or python3 tools/dos/dosinfo.py. Source on GitHub.

Its own help

This is the help text in the tool itself, as ./gameframe tool dosinfo prints it.

First look at a DOS or Windows 3.x executable (MZ, NE): what it is, how it was built, what it uses.

Usage: dosinfo.py BINARY [--imports] [--exports] [--strings MIN] [--pstrings MIN]

The 16-bit counterpart of tools/pe/peinfo.py. It prints:
  - the format: plain real-mode MZ, NE (16-bit protected mode: Windows 3.x, OS/2 1.x, Borland
    Pascal/C++ DPMI16), LE/LX (32-bit DOS extenders such as DOS/4GW) or PE (use peinfo.py);
  - MZ: load size, entry CS:IP and SS:SP, relocations, and data appended after the image
    (overlays, Borland .OVR, packed payloads);
  - NE: module name, description, entry point and stack, every segment with the selector
    Ghidra gives it (0x1000 + 8 * (N - 1)), its size, CODE/DATA and relocation count, the
    imported modules with how many places use each function, and the exports;
  - fingerprints: compiler and runtime (Turbo/Borland Pascal, Borland C++, Microsoft C, Watcom,
    DJGPP...), DOS extenders, packers (LZEXE, PKLITE, EXEPACK...) and middleware (sound and
    video libraries) found in the bytes;
  - `--strings MIN`: C-style strings; `--pstrings MIN`: Pascal strings (a length byte, then the
    text). Ghidra does not find Pascal strings by itself, so this is how to see a Pascal
    program's messages and file names with their addresses.

  - debug symbols: Borland Turbo Debugger symbols (read them with tdinfo.py) or a CodeView trailer.

It does not unpack packed programs, read resources or parse LE/LX images.

Named by

Skills: re-start, re-inventory, re-ghidra.

Agents: re-identifier.