适用于 Linux 的反汇编程序能够反汇编旧的 DOS .COM/.EXE 文件
我的第一个问题，希望我没有做错。
我的问题是我有一个旧的 DOS 程序，它对文件格式进行了极大的修改以节省空间。 （是的，对于那些知道的人来说，这是一个演示场景。）
Objdump 不想帮助我；它只是想帮助我。快速谷歌搜索没有得出该问题的实际结果，并且联机帮助页在这方面似乎也不太慷慨。
是的，还有其他人，比如利达。然而，由于某种原因，我无法让 Lida 工作；我相信还有其他选择。
有人有在 Linux 上反汇编 DOS 可执行文件的经验吗？或者我应该尝试一些基于 DOS 的反汇编程序并在 Dosemu 上运行它？
My first question here, hopefully I'm not doing it wrong.
My problem is that I have a certain old DOS program which has quite much hacked the file format to the extreme to save space. (Yes, it's a demoscene prod for those who know.)
Objdump doesn't want to help me with it; quick Googling yielded no real results for the problem and the manpage doesn't seem too generous in this regard either.
There are others yes, like lida. However, for some reason I couldn't get lida to work; I believe there are alternatives.
Anyone have any experience of disassembling DOS executables on Linux? Or should I just try some DOS based disassembler and run it on Dosemu?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
IDA是最好的反汇编器，而且还有linux版本。它比简单的反汇编器更好，因为它是交互式的。
另外，如果你想看到漂亮的“手工”组装，最好的地方就是旧病毒。不是二进制文件，而是源代码，因为它们被注释了。您可以尝试 Netlux 。
IDA is the best disassembler, and there is also linux version. It's better than a simple dissasembler because it's interactive.
Also, if you want to see nice "hand made" assembly, the best place to look are old viruses. And not the binaries, but sources, because they are commented. You can try Netlux for that.
ndisasm附带 NASM，网络汇编程序。它非常通用，包括反汇编原始字节流（因为您提到了 COM 文件）以及一些目标文件格式的能力。严格来说，我认为也可以使用一些 objdump 选项来反汇编原始字节流，但我不记得这是如何进行的。然而，自修改代码可能会使这变得相当棘手。观察字节流，如果程序进行自我修改，则很难预测最终执行的指令可能是什么，这是 DOS 时代常见的节省空间的技巧。您提到启动到 DOS，这给了我一些有趣的想法：也许您可以使用 DOS 调试器单步执行它，或者在
qemu下运行 DOS 并使用其调试选项（其中一些包括转储程序集输出和执行期间的寄存器状态）。ndisasmcomes with NASM, the netwide assembler. It is pretty versatile, including the ability to disassemble raw streams of bytes (since you mentioned COM files) and also a few object file formats. Strictly speaking I think it's also possible to disassemble raw streams of bytes with someobjdumpoption, but I don't remember how that goes.However self-modifying code can make this rather tricky. Looking at a stream of bytes, it's hard to predict what the final instructions executed might be if the program will modify itself, a common space-saving trick in the DOS era. You mentioned booting into DOS, which gives me some interesting ideas: Perhaps you could step through it using a DOS debugger, or run DOS under
qemuand use its debugging options (some of which include dumping assembly output and register state during execution).