📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  Target Specific - General  >>  16-bit to 32-bit exe

Topic created on: December 14, 2010 00:39 CST by midget .

I have an application that a friend of mine bought a long time ago (95) that deals with recording comics into a database. It works fine in Windows 7 when ran in compatibility mode with 95. It will list items in the database but when you try to open an entry it returns an error. I don't have the error message right now as it's on another computer. All the APIs that are called load correctly from the DLLs. I think it has to do with it being 16-bit.

I want to make it 32-bit but I don't have any source that I could recompile. I was wondering if anyone knows a way of doing this or if it's not worth the trouble.

As a personal reference to how much I know. I am at 39 in the lena151 series. These however seem to be cracking oriented which is not what I'm looking for. I want interoperability. Any help would be appreciated. Let me know if I am not providing enough information.

-midget

  GynvaelColdwind     December 14, 2010 01:51.36 CST
Hey,

Porting from 16-bit to 32-bit is possible, but it take a lot of work, time, energy, etc.
Basically you have to write a disassembler that's output will be recompilable by a 32-bit assembler of your choice. This sounds easy, but since there are quite a few architectural changes between 16-bit and 32-bit (e.g. segments vs flat mode (well, you can use segments to emulate this I guess), 16-bit pointers including stack pointers vs 32-bit pointers in pmode).
In addition to that, you'll have to replace all legacy API/ABI calls with calls to same functions in new libraries. This normally requires you to create a layer of wrappers to convert the calling convention / stored registers / etc. Additionally some APIs/ABIs might not exist or would not have a proper replacement in new libraries, and in such case you would have to implement your own replacements.

Summarizing: it's a project for a year (if it's a small-medium sized app) of constant work, and it required you to have (gain) knowledge of the DOS architecture / ABI, compiling process, pmode and Windows 7 API, and also a good programming skill to write lots and lots of tools.

Another method would be to reverse engineer the old app and reimplement it in C/C++/other language (i.e. reimplement the database parser, GUI, and whatever else would need reimplementing, basically the whole app).
This is easier than the recompilation option, but takes probably the same amount of time (since you have to analyze every function and figure out how to properly reimplement it).

I think personally I would go for the second option :)

  midget     December 14, 2010 02:46.46 CST
Thanks for the reply. I appreciate it.

"Basically you have to write a disassembler that\'s output will be recompilable by a 32-bit assembler of your choice."

I'm not good at programming. I can follow the logical flow of source code fairly well but I coming up with it in the first place is the hard part.

"segments vs flat mode (well, you can use segments to emulate this I guess), 16-bit pointers including stack pointers vs 32-bit pointers in pmode)."

Thanks. You gave me something to read up on.

It's not a very complex program. Windows 7 seems to be able to implement old APIs well (e.g user.dll instead of user32.dll)

"Another method would be to reverse engineer the old app and reimplement it in C/C++/other language (i.e. reimplement the database parser, GUI, and whatever else would need reimplementing, basically the whole app). This is easier than the recompilation option, but takes probably the same amount of time (since you have to analyze every function and figure out how to properly reimplement it)."

I might do this. It would be an interesting project to undertake and I'm sure I could learn a lot.

I really do appreciate the reply. I'm surprised there isn't an application that would be able to convert a 16-bit exe to a 32-bit exe.

-midget

  GynvaelColdwind     December 14, 2010 07:00.15 CST
@midget
I forgot to ask the most important question:
Is this a Windows Application? Does it have an NE header (Windows 3.1 etc)? Or is it a DOS application?
If it's Windows, I guess the API part will be much simpler :)

However the second project is still easier imo.

As for:
"I'm surprised there isn't an application that would be able to convert a 16-bit exe to a 32-bit exe."
The topic is not simple. Such a converter might be created, but I'm not sure if the amount of work needed to do it is worth the effect.

  midget     December 14, 2010 13:40.51 CST
When Loaded into IDA it is identified as NE.

"The topic is not simple. Such a converter might be created, but I'm not sure if the amount of work needed to do it is worth the effect."

I figured it could be done but not worth the effort.

I decided that I'm going to install Virtual Machine and put 95 on it. Hopefully that will work.

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit