Questions tagged [reverse-engineering]
The process of determining how a device was made. Usually for the purposes of replication.
26
questions
19
votes
2
answers
4k
views
Do people fix software bugs in old arcade games?
Do people fix software bugs in old coin-op arcade games? Here is one list of arcade game bugs.
Presumably the ROM images that run on emulators like MAME allow reverse compilation. This would allow ...
- 291
21
votes
5
answers
4k
views
How can I reverse-engineer the game Wizardry (1981) for PC, based on UCSD Pascal?
I am looking at the files included with the 1981 game Wizardry. The particular version I have is from a 1998 re-release, but I do not know if the binary is still the original 1981 release.
My ...
- 313
5
votes
1
answer
515
views
Reverse engineering an old 40-pin connector
I found a 40 pin connector on the side of one of my old electric typewriters. There is zero documentation of this plug online or in the owner's manual, and I want to figure out what exactly it can do. ...
- 51
5
votes
1
answer
340
views
Can anyone help me identify what 6803/6303 development tools might have been used to build this program?
I've been doing some hobby work reverse-engineering vintage synthesizer ROMs from the early 80s, and I'm curious about what kind of development tools the original engineers may have used. Normally ...
- 836
3
votes
0
answers
216
views
How do you jump to an absolute address in a SNES ROM, in IDA Pro?
I used to know more about the SNES memory mapping than I do now, apparently.
I'm using a combination of bsnes-plus (a debug oriented fork of bsnes) and IDA pro in an attempt to figure out something ...
- 1,543
2
votes
0
answers
349
views
Trying To Understand DOS Game Assembly Instructions [closed]
I am trying to understand assembly language instructions, for a DOS Game. I have looked at the following Link :- https://atrevida.comprenica.com/atrtut07.html
reading about how VGA Graphics work in ...
- 21
10
votes
3
answers
905
views
How can I make the Microsoft C compiler for DOS emit a loop with an intermediate jump to continue?
I am trying to recreate the exact C source code from some 16bit DOS 8086 assembly generated by the MS C 5.0 compiler. After making some progress, I've hit a wall with the following code (annotated in ...
- 963
10
votes
2
answers
3k
views
Is there a common name for this 'switch' like 6800 assembly routine?
I've been reverse-engineering a 6303/6800 binary from the early 1980s, which includes a subroutine for jumping to one entry in a table of relative offsets in memory, based upon whether the value of a ...
- 836
8
votes
1
answer
647
views
How to make Microsoft C for MS-DOS emit an immediate-target far call into the data segment?
I am trying to recreate the C source code from some 16bit DOS 8086 assembly generated by the MS C 5.0 compiler. I've hit a wall with this far call instruction.
0000008D 9A2F0CB506 call 0x6b5:...
- 963
16
votes
1
answer
3k
views
Did Digital Research clean-room MS-DOS?
From https://en.wikipedia.org/wiki/DR-DOS
DR-DOS (written as DR DOS, without a hyphen, in versions up to and including 6.0) is a disk operating system for IBM PC compatibles. Upon its introduction in ...
- 61k
15
votes
2
answers
2k
views
What information was "off limits" to IBM PC clone BIOS authors?
Back in the PC clone days the accepted legally defensible method of selling a non-IBM PC BIOS was using a "clean room" whereby an engineer who had never been exposed to proprietary IBM ...
- 1,297
8
votes
2
answers
734
views
Reverse engineering an RS-422 protocol with access to only one device?
I have a console, but not the main computer it's designed to connect to.
My goal is to interface this with a (Linux) PC, and hopefully more than just the keyboard. I have never tried something like ...
- 183
6
votes
1
answer
419
views
Dump process memory of Windows 3.1 control panel applet
I'm trying to work out how a Control Panel applet on Windows 3.1, which interacts with some host-specific hardware, works and as part of this I'd like to dump the contents of memory which the process ...
- 163
3
votes
1
answer
531
views
Loading a Tandy CoCo or a Dragon 32 machine code program from cassette with multiple "name blocks"
For the Dragon 32 and the TRS-80 Color Computer I've found two documents describing how loading from cassette tape works:Dragon 32 doc, CoCo doc.
They both say that a standard program consists of a ...
- 6,666
14
votes
3
answers
2k
views
How are Amiga Kickstart Relocation Files (.RTB) created?
Examples of Amiga Kickstart files (ROMs) can be 256k (1.2/1.3) or 512k (3.0/3.1) binary files, located at $FC0000-$1000000 or $F80000-$1000000
Several programs are able to "soft-kick" Amigas, i.e. ...
- 11.1k
5
votes
2
answers
833
views
How can I extract game data from Nitemare 3D files?
I am trying to reverse engineer an old Wolf3D style Dos game named "Nitemare 3D". I can get a raycasting engine with directional sprites running pretty easily using SDL2, but I have no experience with ...
- 53
29
votes
1
answer
3k
views
In the original Z80 layout, where are the "traps" located? And what are their effects?
According to Zilog Oral History, Zilog only had a tight schedule to design the Z80. Facing the potential competition, Federico Faggin and Masatoshi Shima were worrying about Japanese semiconductor ...
- 3,114
15
votes
2
answers
895
views
What is known about the internal workings of the Z80?
There is a wonderful project called Visual6502, and I've used it from time to time to figure things out, like exactly the difference between rti and rts. It is good to see which control lines were ...
- 38.9k
7
votes
3
answers
1k
views
How can I debug a Mac OS Classic application?
I have a Mac OS Classic application (a game) that I want to "debug". It has data files in a unique format than I am attempting to reverse-engineer. I've made some progress with a hex editor, but ...
- 223
8
votes
2
answers
621
views
Do TG16 games and software suffer from lag frame similar to NES Super Mario Bros?
As a speedrunning fan, I've watched hours of Super Mario Bros speedruns, and have heard the term "lag frame". I don't think it's similar to typical computer lag, but instead an extremely technical ...
- 4,031
5
votes
1
answer
543
views
What is the format of a TurboGrafX instruction (modified 6502 instruction set)?
What is the general format of TurboGrafX processor instructions?
For example, and this is made up: one word for opcode + two words for flags + one word for every parameter listed under that ...
- 4,031
4
votes
1
answer
234
views
How big is one word in TG16 hardware?
My goal is to recreate the TurboGrafx at gate-level, however there isn't much documentation of the system, probably due to its relative obscurity.
What I want to know is how long one word (processor ...
- 4,031
18
votes
5
answers
4k
views
What tools were used in late MS-DOS era for reverse engineering and patching binary executables?
In the late MS-DOS era, what were the state of the art software tools for reverse engineering and patching binaries, i.e. .exe and .com files?
A simple list of the tools that were "state of the art", ...
- 1,543
9
votes
1
answer
424
views
Powerbook (140, 170) battery dimensions/components/specs for reverse engineering
I have a PowerBook 140 that — apart from a dead screen requiring the inevitable capacitor replacement — seems to work well. It has no battery, though, and any available battery will likely have 25+ ...
- 21.6k
7
votes
1
answer
218
views
Is otx (Object Tool Extended) still actively being maintained for reverse engineering legacy OS X binaries?
otx is a tool used to disassemble Mach-O binaries on OS X 10.0-10.4. It is an enhancement on top of otool to add additional symbol information to its disassembled output.
The main site and SVN ...
- 9,502
57
votes
8
answers
10k
views
How were Western computer chips reverse-engineered in USSR?
The British ZX Spectrum computer had many clones in the Eastern Bloc. It seems many of them were built using Russian-made chips from the Angstrem factory in Zelenograd in/near Moscow. The Russian ...
- 38.9k