How to define SYSCALL?

I’m currently reversing an OS based on 8086/80186 that use it’s own syscall convention. I have all the information about them as it is documented, and it would be nice if there where a way to explain to ghidra how they are working.

Basically, it work a bit like DOS do, there are some INT which are dedicated to some functions, and it use registers as parameter.

I’m quite sure that Ghidra have such facility, to automatically document syscall, and take them correctly in the decompiler (instead of using the pseudo function “swi”)

Let’s take an example, this function is calling one of the syscall:

                             void __cdecl16near _display_control(uint flags)
             void              <VOID>         <RETURN>
             uint              Stack[0x2]:2   flags 
                             _display_control 
megStart:e000:005f(c),             
       e000:a672 55              PUSH       BP
       e000:a673 8b ec           MOV        BP,SP
       e000:a675 8b 5e 04        MOV        BX,word ptr [BP + flags]
       e000:a678 b4 00           MOV        AH,0x0
       e000:a67a cd 12           INT        0x12
       e000:a67c 5d              POP        BP
       e000:a67d c3              RET

The function is decompiled into:

void __cdecl16near _display_control(uint flags)
{
  code *pcVar1;
  pcVar1 = (code *)swi(0x12);
  (*pcVar1)();
  return;
}

Which is almost useless as, the flags parameter is lost, and the swi construction is somewhat incorrect and some crucial values in registers (here AH which store which function to actually call) is also lost

Is there is a way to tell Ghidra more about that? Is that is only possible for disassembly by using some script? Is there is a way for the decompiled code to explain Ghidra that this is really a syscall and so display properly something about?

In that case I can ignore the function as I know what it is doing, but in some cases the syscall was inlined in another function call, and Ghidra get somewhat confused by it.

[Godzil]

I don’t think it is working for 16bit like 8086 INTs. (like DOS INT)

With Guidra 9.1, I’ve followed the tutorial, I can’t apply the “syscall” calling convention as there is no such thing, and I don’t really know where to do the reference. All I get from this code for example:

       e000:a66d b4 00           MOV        AH,KEY_PRESS_CHECK
       e000:a66f cd 11           INT        INT_KEY                                          
       e000:a671 c3              RET

(in this OS, there are multiples INTs used for various functions, and AH is the function number from that INT called)

Is this warning:

WARNING: Output of swi destroyed by override!

And this error in the decompiler window:

Exception while decompiling e000:a66d: Decompiler process died

What is the way to do here?

[russdill]

Is there at least a way to tie a register to the swi/svc instruction manually so that it isn’t completely ignored?