Software Archaeology: Two Tales of hacking 90s MS-DOS Software
No ratings
Presented at BlueHat IL 2026 by
MS-DOS is dead. Except when it’s not - when it’s still running a real business workflow, or when the only copy of critical data lives inside a weird, password‑locked format from 1992. Ever wondered what an MS-DOS program actually does under the hood? How memory and OS services worked before user/kernel-mode separation, and what “crypto” and “security” looked like when your whole world was INT 21h, TSRs, and raw bytes? In this talk we will demonstrate - through two real-life cases we encountered - how to unpack, reverse-engineer, debug and patch two MS-DOS based programs -“The QText Diaries.” We recovered access to a trove of password‑locked documents from a 1992 Hebrew/English word processor by identifying classic DOS packers, reconstructing the key‑derivation flow from disassembly, and extracting the original plaintext password to decrypt files. Along the way we’ll ask an uncomfortable archival-security question: how do you protect a backup that must still be readable 40 years later - and can “strong encryption” stay strong when the tooling, platforms, and assumptions rot? “The Impossible Saga.” A 1998 Clipper/xBase legal case‑management system rendered dates incorrectly - making the software unusable past January 1st 2026. We’ll show how we mapped the date code paths, located the formatting logic, and fixed it with a single‑byte patch - then validated it in a real-life deployment that still depends on it today. You’ll learn why DOS extenders turn “simple reversing” into a rabbit hole of protected-mode memory maps, overlays, and debugger-hostile weirdness - and how platforms like Clipper/xBase actually behaved in the wild. You will also see how modern emulators, virtualization, and automation make this only marginally easier: faster iteration, better snapshots, same ancient tricks - and how digging through obscure corners of the internet can make (or break) your research.