Question

I have a short set of machine instructions (160 bytes), and I dont know what it does.

Im on a mac and I ran it under a GDB dissasembler and it came out with this:

....f3c0:   jmp    0x7fff5fbff3c6
....f3c2:   scas   %es:(%rdi),%eax
....f3c3:   retq   $0xa3bf
....f3c6:   sub    $0x100,%esp
....f3cc:   xor    %ecx,%ecx
....f3ce:   mov    %cl,(%rsp,%rcx,1)
 + 50 more lines....

I know very little assembler, but some of the commands looked funny ( like rex.RXB, rex.WB, rex.B). So after a bit of googling I found this command which told me it was a DOS executable:

   $ file program
   program: DOS executable (COM)

• Is there a program that can disassemble a DOS executable?

If not, I will try to disassemble it manually since there is only 160 bytes. However I will need a reference of what each bytes means. E.g.

90 = NOP
8a = MOV
....

• Is there a reference like this for DOS machine code instructions?

• How else might I find out what the program does?

---

Update:

After a great suggestion from IGOR I disassembled the code using a different program. However, there are still some bad instructions:

 e:  88 0c                  mov    BYTE PTR [si],cl
10:  0c fe                  or     al,0xfe
12:  c1                     (bad)  
13:  75 f9                  jne    0xe
......
......
96:  90                     nop
97:  e8 9d ff               call   0x37
9a:  ff                     (bad)  
9b:  ff 41 41               inc    WORD PTR [bx+di+0x41]

• Any ideas why its says (bad)?

Answer 1

If it’s a COM file, then it’s just raw real-mode x86 code. You can tell objdump to use 8086 mode, e.g.:

objdump -b binary -D -m i8086 file.com

To see Intel-style mnemonics (used by most of Intel and DOS documentation), add “-M intel“.

For the instruction reference, try this or this.