NationalSecurityAgency / ghidra

Ghidra is a software reverse engineering (SRE) framework
https://www.nsa.gov/ghidra
Apache License 2.0
50.91k stars 5.8k forks source link

Windows 3.11/95 VMMCalls #6021

Open korneliuszo opened 9 months ago

korneliuszo commented 9 months ago

Is your feature request related to a problem? Please describe. Ghidra doesn't decompile properly int 0x20 calls in which function number is inserted after int 0x20 instruction (see VXD_AsmCall in https://github.com/joncampbell123/doslib/blob/d999738efedfa9ecf34adc949d500d4110fd8b54/windows/w9xvmm/dev_vxd_util.h)

Describe the solution you'd like Function call insertion based on file in format in https://github.com/joncampbell123/doslib/blob/d999738efedfa9ecf34adc949d500d4110fd8b54/windows/w9xvmm/dev_vxd_dev_vmm.vxddef

Describe alternatives you've considered I'm beginner so I don't know which solutions exists for my problem.

Additional context I'm writing VxDs for windows 3.11 https://github.com/korneliuszo/winvxdlib and I need to decompile some of VxDs to understand internal workings of IFS API. Simmilar solution: https://github.com/Gravelbones/GhidraDosToolbox and I'm using: https://github.com/yetmorecode/ghidra-lx-loader to load VxD to Ghidra - (no exports shown but as it's only DDB interesting it's workable)

korneliuszo commented 9 months ago

I'm able to commision this work.

greenozon commented 9 months ago

have you tried Hiew util? it has got lots of old tech support

korneliuszo commented 9 months ago

Hiew dos version is disassembling correctly. I'm still looking for ghidra plugin, for now I work on modified ia.sinc and manually setting CALL_OTHER overrides