DOS ain't dead

HX-DOS Extender and Java (DOSX)

posted by 4D5A9000, 19.07.2021, 17:44
(edited by 4D5A9000 on 19.07.2021, 17:59)

OK, after doing some reverse-engineering, I found that "java.lang.ClassLoader$NativeLibrary.load" is an exported function in java.dll. It's named "_Java_java_lang_ClassLoader_00024NativeLibrary_load@12". That function calls "_JVM_LoadLibrary@4", which yet another is an exported function in jvm.dll. It does a lot of operations, but eventually, It calls "LoadLibraryA".
Here are some decompiled codes from Ghidra:

HMODULE __cdecl FUN_6d81dee4(LPCSTR param_1,char *param_2,uint param_3)

{
  bool bVar1;
  HMODULE pHVar2;
  DWORD DVar3;
  int _FileHandle;
  int iVar4;
  undefined **ppuVar5;
  int extraout_EDX;
  int extraout_EDX_00;
  undefined *puVar6;
  undefined *puVar7;
  char *_Format;
  int local_c;
  uint local_8;
 
  pHVar2 = LoadLibraryA(param_1);
  if (pHVar2 == (HMODULE)0x0) {
    DVar3 = GetLastError();
    if (DVar3 == 0x7e) {
      strncpy(param_2,s_Can't_find_dependent_libraries_6d89e3ac,param_3 - 1);
      param_2[param_3 - 1] = '\0';
    }
    else {
      FUN_6d81ff15(param_2,param_3);
      param_2[param_3 - 1] = '\0';
      _FileHandle = _open(param_1,0x8000);
      if (-1 < _FileHandle) {
        local_8 = 0;
        FUN_6d7e66bc(_FileHandle,0x3c,0,0);
        if ((((extraout_EDX < 0) || (iVar4 = _read(_FileHandle,&local_c,4), iVar4 != 4)) ||
            (FUN_6d7e66bc(_FileHandle,local_c + 4,0,0), extraout_EDX_00 < 0)) ||
           (iVar4 = _read(_FileHandle,&local_8,2), iVar4 != 2)) {
          bVar1 = true;
        }
        else {
          bVar1 = false;
        }
        _close(_FileHandle);
        if (!bVar1) {
          puVar6 = (undefined *)0x0;
          puVar7 = (undefined *)0x0;
          ppuVar5 = &PTR_s_IA_32_6d878994;
          do {
            if ((short)local_8 == *(short *)(ppuVar5 + -1)) {
              puVar7 = *ppuVar5;
            }
            if (*(short *)(ppuVar5 + -1) == 0x14c) {
              puVar6 = *ppuVar5;
            }
            ppuVar5 = ppuVar5 + 2;
          } while (ppuVar5 < &DAT_6d8789ac);
          if ((short)local_8 != 0x14c) {
            if (puVar7 == (undefined *)0x0) {
              puVar7 = (undefined *)(local_8 & 0xffff);
              _Format = s_Can't_load_this_.dll_(machine_co_6d89e340;
            }
            else {
              _Format = s_Can't_load_%s-bit_.dll_on_a_%s-b_6d89e380;
            }
            _snprintf(param_2,param_3 - 1,_Format,puVar7,puVar6);
          }
        }
      }
    }
    pHVar2 = (HMODULE)0x0;
  }
  return pHVar2;
}

Apparently, this piece of code checks whether the module is loaded successfully. If it is, the function returns the loaded module's base address. If it's not, it modifies the character array "param_2" in the formal parameter, then returns 0. Notice that the function "FUN_6d81ff15" is where the "FormatMessageA" is called:

size_t __cdecl FUN_6d81ff15(char *param_1,uint param_2)

{
  char cVar1;
  DWORD dwMessageId;
  size_t _Count;
  int *piVar2;
  char *_Source;
  uint uVar3;
  char *pcVar4;
 
  dwMessageId = GetLastError();//It should be 0xB, I guess.
  if (dwMessageId == 0) {
    piVar2 = _errno();
    if (*piVar2 == 0) {
      _Count = 0;
    }
    else {
      piVar2 = _errno();
      _Source = strerror(*piVar2);
      uVar3 = 0xffffffff;
      pcVar4 = _Source;
      do {
        if (uVar3 == 0) break;
        uVar3 = uVar3 - 1;
        cVar1 = *pcVar4;
        pcVar4 = pcVar4 + 1;
      } while (cVar1 != '\0');
      _Count = ~uVar3 - 1;
      if (param_2 <= _Count) {
        _Count = param_2 - 1;
      }
      strncpy(param_1,_Source,_Count);
      param_1[_Count] = '\0';
    }
  }
  else {
    _Count = FormatMessageA(0x1200,(LPCVOID)0x0,dwMessageId,0,param_1,param_2,(va_list *)0x0);
    if (3 < _Count) {
      if (param_1[_Count - 1] == '\n') {
        _Count = _Count - 1;
      }
      if (param_1[_Count - 1] == '\r') {
        _Count = _Count - 1;
      }
      if (param_1[_Count - 1] == '.') {
        _Count = _Count - 1;
      }
      param_1[_Count] = '\0';
    }
  }
  return _Count;
}

Now I have a theory, I wanna debug HX to see if it's true, also, try to figure out why "LoadLibraryA" fails. But I got stuck on debugging. I didn't realized that HX is written in assembly language, which I don't understand. I really don't know what should I do next...

Complete thread:

• HX-DOS Extender and Java - 4D5A9000, 13.07.2021, 11:13
  • HX-DOS Extender and Java - Japheth, 14.07.2021, 08:03
  • HX-DOS Extender and Java - DosWorld, 19.07.2021, 03:57
  • HX-DOS Extender and Java - 4D5A9000, 19.07.2021, 17:44
    • HX-DOS Extender and Java - tkchia, 20.07.2021, 06:12
      • HX-DOS Extender and Java - Japheth, 20.07.2021, 06:32
        • HX-DOS Extender and Java - 4D5A9000, 20.07.2021, 07:08
          • HX-DOS Extender and Java - Japheth, 20.07.2021, 10:12
            • HX-DOS Extender and Java - tkchia, 20.07.2021, 10:18
            • HX-DOS Extender and Java - 4D5A9000, 20.07.2021, 14:23
              • HX-DOS Extender and Java - Japheth, 21.07.2021, 03:17
                • HX-DOS Extender and Java - 4D5A9000, 01.10.2021, 03:56