Hanse - Die Expedition (1994)

[hackgrid]

Hi!

I wanted to disassemble Hanse and followed this video:

https://www.youtube.com/watch?v=bG9tEZOSrQg

I disassembled "spiel.exe", but i do not think it worked correctly, because all these other executeables are missing?

Did I do something wrong?
Is it too old?

Inside the binary it claims:

WATCOM C Run-Time system code is provided on an "as is" basis and is (c) Copyright by WATCOM Systems Inc. 1988-1992. All rights reserved.

Thank you! :)

[fonic]

I disassembled "spiel.exe", but i do not think it worked correctly, because all these other executeables are missing?

I don't quite understand what you mean by that. Which executables are missing? Does the game have multiple .exe files?

Judging from the screenshot you provided, everything worked as it should, wcdatool generated the output that is expected.

For the generated disassembly, see subfolder spiel.exe_modules (should be populated with multiple .asm files if the executable contains debug symbols, empty otherwise) or spiel.exe_disasm_object_X_disassembly_formatted_deduplicated.asm (those will have contents regardless of debug symbols being available or not).

[hackgrid]

Thanks for your fast reply! :) Sorry I do not know that DOS stuff at all...
I also forgot to attach the binaries, I even prepared them for this issue:

Output.zip

In the video, at 4:55, wcdatool generates multiple .exe files - from one input file - where dos4gw is stripped out, I thought I would need that version for the next steps.

The modules folder is empty sadly, so no debug symbols I guess? :(

[fonic]

In the video, at 4:55, wcdatool generates multiple .exe files - from one input file - where dos4gw is stripped out, I thought I would need that version for the next steps.

Ok, I get now what you were referring to. DOS4G(W) is only stripped out if it was a part of the .exe to begin with. In case of your spiel.exe, it would seem that it does NOT contain DOS4G(W). The game will likely have a separate DOS4GW.EXE file in its main folder. So that's all perfectly normal in your case.

The modules folder is empty sadly, so no debug symbols I guess? :(

That's right, that executable does not seem to contain any debug symbols. Even worse, it seems to contain all its code and data within the data object (i.e. object 2). That's quite unusual. The issue with wcdatool in this case is that it cannot take an educated guess to distinguish code from data.

I'd suggest finding as many different versions as you can of that game and check each of those for debug symbols. Executables with debug symbols can often be found in later releases, re-releases, game compilation, etc. (likely due to the fact that those were often hastily produced with less care taken).

Disassembling without debug symbols is of course still possible, but quite tedious. If you manage to find a version containing debug symbols, it would be relatively easy to generate a hint file to help wcdatool with identifying code and data sections.

[hackgrid]

Okay, thank you very much! Sadly I think there are no other different versions for this game, but I can keep looking... (meaning all releases use the same .exe file).

Can you somehow tell the tool which encoding to use for the strings in the assembly?
e.g.:

2b0a2: 4b db 0x4b ; dec: 75, chr: 'K'
2b0a3: 94 db 0x94 ; dec: 148, chr: ''
2b0a4: 6e 69 67 20 57 61 6c 64 65 6d 61 72 20 49 56 2e 00 db "nig Waldemar IV.",0x00

0x94 is supposed to be "ö" (german umlaut) here, so the whole string should be "König Waldemar IV".

Not sure which codepage 0x94 = ö is supposed to be,
there is even a stackoverflow for this haha:

https://stackoverflow.com/questions/75399440/which-codepage-is-0x81-%C3%BC-0x94-%C3%B6-0x9a-%C3%9C

Thank you very much!

[fonic]

Okay, thank you very much! Sadly I think there are no other different versions for this game, but I can keep looking... (meaning all releases use the same .exe file).

There is at least a CD version and a floppy version:
https://archive.org/search?query=hanse+die+expedition&tab=all

Can you somehow tell the tool which encoding to use for the strings in the assembly? e.g.:

2b0a2: 4b db 0x4b ; dec: 75, chr: 'K'
2b0a3: 94 db 0x94 ; dec: 148, chr: ''
2b0a4: 6e 69 67 20 57 61 6c 64 65 6d 61 72 20 49 56 2e 00 db "nig Waldemar IV.",0x00

0x94 is supposed to be "ö" (german umlaut) here, so the whole string should be "König Waldemar IV".

No, that would have been close to impossible to implement correctly. The string detection relies on the fact that strings contain subsequent characters within the ASCII range (i.e. 0-127). If you were to extend that range to code pages (which span across 256 characters), strings could no longer be detected since each and every byte would then fall into that extended range of 0-255, naturally.

[hackgrid]

I see, thank you!
I own these versions and I check them again, but some years ago I was under the impression that their binaries were all the same...

It may be possible that the game was created with GFA Basic and then compiled to C with a converter, maybe thats why the code is strangely inside the data object. I guess this makes it even harder to decompile...

So I guess I can not debug this game with OpenWatcom like the Fatal Racing video, because wcdatool does not generate an actual .exe for the game? Only the 11kb stub and a 274kb "payload"?

Thanks again!

[fonic]

I see, thank you! I own these versions and I check them again, but some years ago I was under the impression that their binaries were all the same...

Also check for preview versions, beta versions, shareware versions, versions included with gaming magazines, etc. You never know, even a beta version with debug symbols would help out a lot since it'll likely share lots of code with the final release.

It may be possible that the game was created with GFA Basic and then compiled to C with a converter, maybe thats why the code is strangely inside the data object. I guess this makes it even harder to decompile...

Could be. I don't know anything about that technique, thus I'm unable to make an educated guess. It's certainly unusual - I've come across executables that contain some code within the data object (like MK2), but I've never seen one like this where the code object is mostly empty (with just two instructions at the top) and everything else is in the data object.

So I guess I can not debug this game with OpenWatcom like the Fatal Racing video, because wcdatool does not generate an actual .exe for the game? Only the 11kb stub and a 274kb "payload"?

Oh no, you can debug this just fine. Simply use spiel.exe as is. For debugging, an executable without DOS4GW is required, and spiel.exe already matches that criteria out of the box, which is why wcdatool does not generate a different one.

I attached a hints file that can be used to properly decode the comprehensive string section (including the German umlauts, which will simply be included as raw bytes in between). Simply put the file in the Hints folder, re-run wcdatool and check out the now altered contents at the end of object 2 (i.e. in file spiel.exe_disasm_object_2_disassembly_formatted_deduplicated.asm).

spiel.exe.txt