Under the question How did Windows ME "cripple" DOS?, Ross Ridge's answer showed a section of his disassembly.

I would like to know, a) what disassembler was used and b) what adjustment or setting had to be used for the file to be disassembled.

I have tried IDA Freeware version 5 with various input sources, such as DOS EXE, DOS SYS, Binary, etc but have nor been able to obtain the desired result of a disassembly of the whole file.

If anyone can help with advice I would be most appreciative.

  • 1
    The author of that post appears to be quite active on the Retrocomputing SE. Have you asked him directly? (If you get an answer and no one else has replied, make sure to come back and answer your own question!)
    – RETRAC
    Commented Jul 5, 2020 at 16:15
  • 3
    Disassembly is still an art form. Especially with modern tools on old software. And DOS/IO is based on handwritten assembly. Si it might be more than just some settings.
    – Raffzahn
    Commented Jul 5, 2020 at 17:26
  • 3
    I haven’t managed to work out how to contact contributors individually yet so I thought that I would post a question in the meantime.
    – Steven
    Commented Jul 6, 2020 at 19:13

3 Answers 3


Windows 95 and 98 IO.SYS/WINBOOT.SYS consists of three parts: the initial loader, the payload and the device configuration manager executable.

  • The initial loader (MSLOAD) comprises the first three or four0 512-byte sectors of the file; the first sector begins with the signature MZ, the second starts with the signature BJ and the last ends with the signature MS. The FAT boot sector puts the initial loader at real mode address 0070:0000, checks the first two of these signatures, then starts execution at address 0070:0200. The job of MSLOAD is to copy boot sector variables into its data area (the first sector), relocate itself to a higher memory address, load the rest of the file starting at segment 0x70 again and then transfer control to 0070:0000.
  • MSLOAD is immediately followed by the payload, which is the DOS kernel proper, loaded as described above. Although it is loaded into a single contiguous region of memory, it is too large to fit into a single 64 KiB real-mode segment, and so the DOS kernel is further split into regions addressed using different segment bases; discovering those will be up to you. The length of this part can be determined by reading the word at offset 8 of the file, multiplying it by 16 and subtracting the length of MSLOAD.
  • The device configuration manager (MSDCM1) is a small executable whose purpose is to read the Registry and prompt the user to pick a hardware configuration if there are multiple configurations defined. As it turns out, it is no accident that IO.SYS begins with the signature MZ, just like DOS executables; the file is simultaneously a regular EXEPACK-compressed2 DOS executable, and the values in the MZ header at the beginning of the file allow it to be executed using interrupt 0x21 service 0x4b, which will load the third part of the file. If the real-mode kernel detects that it is booting a Windows installation, the kernel will do just that early in the boot process, before even CONFIG.SYS is processed.3 The word at offset 8 is simply the ‘header length’ field of the MZ header, used both by MSLOAD to determine the length of the payload, and by the MZ loader to skip over the payload when loading MSDCM.

In Windows Me, the IO.SYS file has a similar structure, with the following differences:

  • MSDCM has been integrated into the payload as a subroutine; it is no longer independently executable. The MZ signature and the ‘header length’ field remain where they were (as MSLOAD still uses them), but the other fields of the executable header are filled with zeroes.

  • The payload may be compressed; this is indicated by the signature CM. If MSLOAD sees the payload starting with that signature, it looks for the end for the compressed stream and will then use the decompression routine located at a 16-byte-aligned offset right after the payload (also preceded by a signature CM, and some headers). If the compression signature is not found, the payload is loaded directly, like in previous versions.

    The compression format itself is a rather unremarkable LZSS-ish bitstream split into chunks. Rudolph Loew’s IO8DCOMP can decompress the file in-place, or you may see how GRUB4DOS accomplishes it.4

To recap:

  • MSLOAD can be disassembled by loading the first four sectors of IO.SYS as a raw binary at address 0070:0000 and placing the entry point at 0070:0200;
  • The payload can be disassembled by cutting it out of the file, decompressing it (if compressed), loading it starting at segment 0x70, placing the entry point at the beginning of that segment (i.e. at 0070:0000), and discovering other segments by trial and error;
  • MSDCM (before Millennium) can be disassembled by using an EXEPACK decompressor2 and disassembling the output as an MZ executable.

As it happens, the Windows Me ‘crippling’ code is located entirely within MSLOAD; there is no need to decompress the file. In fact, taking a copy of IO.SYS from the Emergency Boot Disk and overwriting the code in its first four sectors with the loader from the hard disk’s copy of IO.SYS would accomplish the same thing as applying the patch. (In fact, a somewhat well-known patch by ‘Manifest Destiny’ goes exactly that route.)

0 Three in versions prior to Windows 95 OSR2, four in OSR2 and later versions. Although in pre-OSR2 versions MSLOAD fits in three sectors, the boot sector still loads four.

1 I call it so because the string ‘MSDCMMSG’ appears repeated in the uncompressed executable image.

2 Although IO.SYS uses a variant of the EXEPACK format with a 16-byte header that some decompressors may fail to recognise. David Fifield’s reimplementation of EXEPACK in Rust manages to read it.

3 In interactive boot, this step can be skipped by answering N to the prompt ‘Process the system Registry [Enter=Y,Esc=N]?’; it is also controlled by the SystemReg= setting in MSDOS.SYS/WINBOOT.INI.

4 As it turns out, this compression format was only slightly altered from the one used to store the embedded boot-up splash screen (LOGO.SYS) in earlier versions of Windows. A very similar bitstream (only framed differently) is also used to compress W4-format VMM32.VXD in Windows Millennium. As far as I can tell, it is identical to the “DS” format used in DriveSpace. Or DoubleSpace. At least one of the two.

  • WOW! what fantastic and knowledgeable response to my question. There's a lot of information to take in and absorb. Thank you so much. I f I may I might have more questions as I'm on a steep learning curve with 80x86 code particularly relating to MS-DOS. Cheers for now.
    – Steven
    Commented Jul 13, 2020 at 16:21
  • 1
    Huh, already plagiarised: <vogons.org/viewtopic.php?p=938449#p938449> (unauthorised mirrors of Stack Exchange aside) Commented Jul 21, 2022 at 16:26

I have tried IDA Freeware version 5 with various input sources, such as DOS EXE, DOS SYS, Binary, etc but have nor been able to obtain the desired result of a disassembly of the whole file.

Windows ME io.sys is compressed, so a disassembly will look like random junk. To decompress it use IO8DECOMP by Rudolph R. Loew.

  • I know about io8dcomp, which is very good and, like you, I was given to understand that Me’s io.sys is compressed. This is not strictly true, first 2948 bytes are code. This is shown by the post referred to in my question that showed a part disassembly by Ross Ridge.
    – Steven
    Commented Jul 6, 2020 at 19:03
  • 1
    There is a small bit of code (~1580 bytes) at the start which (I presume) includes the decompression routine, just like in other self-extracting executables. IDA should be able disassemble that part, but (as you found out) it can't disassemble the whole file. You could could get a full disassembly by first running the decompression code in a debugger and then disassembling the memory it decompressed to. IDA freeware V5 might have debugging functions that can do it, but io8dcomp decompresses the file automatically so... Commented Jul 6, 2020 at 23:55

You can decompress IO.SYS by downloading the decompressor io8decomp at https://rloewelectronics.com/

It gives you something not decompressed,

Windows ME also has himem.sys buried in the file. It's pretty early, but you can search for the device name in it. But the version from the boot cd has a different header.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .