Disassembling the OS with IDA

[ralphdspam]

Is there an easy way to emulate ROM paging in IDA, or do I have to disassemble each page separately? 

[thepenguin77]

There probably is an easy way, however, we do not know how to do it. So you are free to look (I've talked to brandonW about this)

But, on another note, brandonW's Pterodactyl will break an OS file into pages and assign all of the common memory locations with their proper names. (As well as take a solid whack at the page 00 calls)

So, I recommend pterodactylling your OS, and then going in page by page. After that, you'll have to convert the two bytes after every rst 28h (bcall) to data to avoid weirdness. (If you happen to be disassembling 2.53 or 2.55 and you are on a x64 machine, I can give you my current progress (I'm pretty sure this is actually legal too ))

[ralphdspam]

Thanks.  I saw something about using paging on 8086 code, but it seems that the method depends on the Segment Register.  (AAAHH!  )

(If you happen to be disassembling 2.53 or 2.55 and you are on a x64 machine, I can give you my current progress (I'm pretty sure this is actually legal too ))

Thanks for the offer, but I think I'll learn the most if I disassemble it myself. 

Unfortunately, brandonw.net seems to be down right now.  I'll download that tool as soon as it goes back online.

[thepenguin77]

Good thing I downloaded it a while ago

Edit:
   I should also point out that if you ever intend to consult others or ask questions, brandonW destroyed OS 2.41 and my workhorse is 2.53. Talking about different OS's can be a little challenging sometimes.

[ralphdspam]

I should also point out that if you ever intend to consult others or ask questions, brandonW destroyed OS 2.41 and my workhorse is 2.53. Talking about different OS's can be a little challenging sometimes.

I'm going to disassemble OS 2.55.  I want to take a look at the USB routines and the BASIC parser.  Maybe I can fix that annoying mathprint screen glitch.  

EDIT: Hey, look at that!  His site is back up.  
EDIT2: It asks for the end of BCALL jump table.  What should I put down for 2.55?  I don't know because I haven't disassembled the OS yet.  
EDIT3: I entered the example numbers, hopefully that's right.


EDIT4: Ok, I somewhat figured out the paging. 

Edit > Segments > Create Segment
Segment Name = (Just note that if your name starts with a number, an underscore will be automatically added.)
Start Address = IDA linear address
End Address = IDA linear address + 1 (If you want your page to end at 0x4FFFF, use 0x50000)
Base = (StartAddress - VirtualAddress) / 0x10


Example:
Segment Name: Page02
Start Address: 8000
End Address: C000
Base: 400

[thepenguin77]

Missed your post somehow.

I'm going to disassemble OS 2.55.  I want to take a look at the USB routines and the BASIC parser. 

The usb routines are mostly on boot page 6F, though, there are some in the OS (they're just more complicated).

Maybe I can fix that annoying mathprint screen glitch. 

Already figured it out. It has to do with the universal flash exploit. It's not fixable, but there is a workaround. I posted it in the OS glitch compilation thread.


Also, I believe we've known about segments, the real beauty would be making all the bcalls and such jump around to each other.