I was in charge of analyze and reverse engineering the old unknown EXE for past few month. The binary works on MS-DOS for NEC-PC98 (retro PC), old (20years more ago), nobody knows how it's made.
I done the job and knew the binary had been generated by unknown vendor's basic compiler. The binary has interesting technique; well-designed VM, partial relocated overlaying like a DLL, data-section-compression and self melting. It highly impressed me. So I'd like to know the compiler generates the binary.
For now I guess that the vendor may be Microsoft. I'd try to use QuickBasic's compiler (BC.EXEQB.EXE
) and would generate small binary but unfortunately I'm not owner the old toolchain.
So I'd love to ask someone a favor, if you have any Microsoft's Basic Compiler then goto dig your garage and put an old binary generated by such a compiler on me. I'll see it and want to identify the compiler and vendor.
The binary has following characteristics:
- indicates magicWORD, 0x1e, on its exe header's reloc table offset address field
- start-up-code/address is in higher address (backward of exe)
- includes common libraries (such a libc) are relocatable on a single binary
- generates fully native code not an P-code. a
call
matches a (unknown) VM-OP-code - Character code is ASCII/Shift-JIS big endian(cp932, multibyte code for Japanese)
- floating points IEEE754 not MS-FP
- rodata sections are easily compressed (optional?)
the EXE address map:
00000: MZ HEADER
00200: module1-header
00230: module1-code
00xxx: module1-data (compressed)
: (repeats by module-N)
yyyyy: native libraries
zzzzz: startup code
ZZZZZ: relocation table (for calling a library)
BC.EXE
, Microsoft PDS, is one of interested products for me.
Please compile a simple code like this:
X = 0.5 * 100.0
PRINT X
FOR I=0 TO 16
PRINT "Hello, World"
NEXT I
and I would appreciate it if you send me an output executable.
qb.exe
? I remember using bothbc.exe
(Borland C) and QB, without having to add paths. Also, QuickBasic was a product in itself – I've never seen referred to it as "Microsoft's Basic Compiler". OTOH: that wikipedia startup screen shot looks eerily familiar ... – Jongware Jan 08 '18 at 20:21