Nina KalininaNov 1
Arrgh, Ghidra keeps creating thunk functions when there are none :/ This code is particularly Ghidra-unfriendly. I feel like I should switch to some old-school x86 disassembler instead of Ghidra T_T
Show threadevNov 1
@nina_kali_nina i've used objdump with "-D -b binary -mi386 -Maddr16,data16" to poke at x86 assembly stuff, also that old version of IDA that was freely shared at some point for a bios (it's meh)

if you're trying to figure out syscalls, debugging from an x86 emulator might be something with better yields, though i don't have a setup for that (yet)
Show threadNina Kalinina

@evv42 the code is a mighty beast, with over 1MB in overlays. So I keep interesting bits in Ghidra, find them in overlays, find overlays in RAM in Bochs, set breakpoints, and investigate. I've tried Qemu+GDB, it just doesn't cut if. Bochs' debugger is not awesome, but it might be the best thing available for my kind of project.

MAME is an option, but its debugger doesn't show stack frames. Marty PC is interesting, but it doesn't fit on my display.

Nov 2 at 12:57amWeb