TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Spice86 – A PC emulator for real mode reverse engineering

175 点作者 alberto-m3 个月前

7 条评论

ggambetta3 个月前
Oooh, I LOVE this! Especially the ability to &quot;Overriding emulated code with C# code&quot; I had a similar idea years ago (<a href="https:&#x2F;&#x2F;gabrielgambetta.com&#x2F;remakes.html" rel="nofollow">https:&#x2F;&#x2F;gabrielgambetta.com&#x2F;remakes.html</a>), not in the context of a debugger or reverse engineering per se, but in the context of remakes and &quot;special edition&quot; games. Not entirely surprised that this is a byproduct of OpenRakis. Amazing work!
评论 #43120112 未加载
gexos3 个月前
[flagged]
johnklos3 个月前
Forty years ago I had a Sinclair QL with an 8086 emulator. Because the Sinclair QL had preemptive multitasking, I could easily search memory for patterns, monitor locations, stop and start the emulation, or change memory programmatically and easily from the QDOS side. It was worlds easier than using a debugger, particularly since I didn&#x27;t own an 8086 system.<p>I always thought it was a clever way to get insights in to software while it was running that wasn&#x27;t available to people with 8086 systems, and it&#x27;s interesting to see this idea so many years later.
评论 #43116995 未加载
DrNosferatu3 个月前
A tutorial on how to reverse engineer a simple DOS game would be absolutely awesome!
评论 #43117608 未加载
评论 #43117980 未加载
评论 #43117762 未加载
评论 #43117950 未加载
eminence323 个月前
Question from a reverse-engineering noob:<p>Why can&#x27;t ghidra (or any other reverse engineering tool) be used directly on the .exe? Why do you have to go through this emulator? Is it because the thing you want to debug only runs in x86 realmode?
评论 #43122713 未加载
评论 #43118421 未加载
评论 #43119905 未加载
评论 #43125525 未加载
评论 #43118433 未加载
bernadus_edwin3 个月前
Why are so many emulators written in C#?
评论 #43117970 未加载
评论 #43132103 未加载
评论 #43118029 未加载
kevin2863 个月前
Hello! I&#x27;m the creator of the Java version of Spice86, and I just saw this thread. Let me address a few topics:<p>Why Java &#x2F; C#?<p>I initially chose Java because it&#x27;s a decently fast language I am comfortable working with, and it has a lot of tooling available to investigate performance issues, debug easily, and provide basic, easy access to multiplatform sound and graphics.<p>However, we eventually migrated to C# for several reasons: - Control Structures: Re-implementing Cryo Dune DOS assembly code in Java proved challenging, especially when mapping jumps to high-level control structures. Just adding a goto and taking care of it later was easier. - Unsigned Integers: Java&#x27;s lack of support for unsigned integers was a source of bugs. - Similarities: C# and Java have similar syntaxes so migration was not too crazy, toolings are equally good, and performances are comparable.<p>Why Not Just Use Ghidra &#x2F; IDA?<p>I wish we could, but there are many reasons why this isn&#x27;t straightforward: - Ghidra Support for 16-bit x86 real mode isn&#x27;t great, with some bugs requiring significant investment to fix. For example, this issue: <a href="https:&#x2F;&#x2F;github.com&#x2F;NationalSecurityAgency&#x2F;ghidra&#x2F;issues&#x2F;981">https:&#x2F;&#x2F;github.com&#x2F;NationalSecurityAgency&#x2F;ghidra&#x2F;issues&#x2F;981</a>. I guess no one is willing to invest in that because there is no market. - IDA is not free and hex-rays doesn&#x27;t support decompiling DOS code.<p>Additionally, code from that era often involved hand-crafted assembly mixed with C, compiled by forgotten tools. As a result, tools like Ghidra and IDA struggle with static analysis due to practices like self-modifying code, jumping in the middle of instructions, and editing the function call stack to redirect return statements.<p>One simple yet concrete example is the switch statement. When a switch statement is written, one implementation method a compiler might use is creating a table in memory with the addresses of all the case statements. The assembly code will then compute the address in that table based on the condition and jump to the appropriate case. When decompiling such code, if the compiler version is known and supported, you can infer the location of the jump table and reconstruct the addresses of all the code in the switch statement. However, if the code is handwritten assembly, you would need to debug it at execution time to find where the rest of the code is, as it is not statically reachable. Very concretely, if you see something like JMP AX, you need to debug to see where is the rest of the code.<p>How Do We Get Work Done despite all that?<p>Spice86 provides two main strategies: - Override assembly with high-level code, that way you can rewrite your game bit by bit, testing as you go. - Execution flow recording and code generation. It records execution flow and tells you what was executed. We have a Ghidra plugin to import that data and generate code from it. For example, see <a href="https:&#x2F;&#x2F;github.com&#x2F;OpenRakis&#x2F;LOGO&#x2F;blob&#x2F;main&#x2F;GeneratedCode_OriginalAsm.cs">https:&#x2F;&#x2F;github.com&#x2F;OpenRakis&#x2F;LOGO&#x2F;blob&#x2F;main&#x2F;GeneratedCode_Or...</a>. Interestingly, since it&#x27;s now C#, you can decompile it again to extract control structures, as shown here <a href="https:&#x2F;&#x2F;github.com&#x2F;OpenRakis&#x2F;LOGO&#x2F;blob&#x2F;main&#x2F;GeneratedCode_DecompiledAsm.cs">https:&#x2F;&#x2F;github.com&#x2F;OpenRakis&#x2F;LOGO&#x2F;blob&#x2F;main&#x2F;GeneratedCode_De...</a>.<p>Issue with code generation is that ghidra does not like real mode code so the plugin is full of workarounds (and broken at the moment), and there are some fundamental things that can&#x27;t be done. For instance, self modifying code support is murky with the ghidra plugin.<p>Future Improvements<p>We&#x27;re working on eliminating Ghidra by generating code directly from Spice86 from the recorded execution trace. Our goal is to fully support self-modifying code and generate functional code from an execution trace with minimal human intervention.<p>I thought I would make a quick reply, but it turns out there&#x27;s a lot to say on the topic :)
评论 #43139149 未加载
评论 #43143757 未加载