search

kaitai-io / kaitai_struct_formats

Kaitai Struct: library of binary file formats (.ksy)
http://formats.kaitai.io
711 stars 204 forks source link

DOS MZ updates #593

Closed armijnhemel closed 2 years ago

armijnhemel commented 2 years ago

This updates fixes the magic and reworks the header which also corrects the offsets of the body.

The previous version did not work for various executables used in FreeDOS 1.2 like PING.EXE. These are now correctly (or: "more correctly") parsed.

The biggest change is reworking the header and to look at the actual length of the header (for which a separate len_header instance was created). According to http://www.delorie.com/djgpp/doc/exe/:

 The header includes the relocation entries.
armijnhemel commented 2 years ago

I wanted to include data like num_pages to calculate the actual size of the body, but this doesn't work in case the binary has been packed or compressed, or if some extender has been used. For example:

$ file PING.EXE 
PING.EXE: MS-DOS executable, COFF for MS-DOS, DJGPP go32 DOS extender

The data inside the file says that the file should be 2048 bytes, but the actual file is much larger (1818189 bytes). The first 2048 bytes is the stub that is executed to find the rest of the data.