Reverse Engineering for Beginners

CHAPTER 53. WINDOWS 16-BIT CHAPTER 53. WINDOWS 16-BIT

push bp

mov bp, sp

mov bx, [bp+arg_0]

loc_72: ; CODE XREF: remove_digits+18j

mov al, [bx]

test al, al

jz short loc_86

cmp al, 30h ; '0'

jb short loc_83

cmp al, 39h ; '9'

ja short loc_83

mov byte ptr [bx], 2Dh ; '-'

loc_83: ; CODE XREF: remove_digits+Ej

; remove_digits+12j

inc bx

jmp short loc_72

loc_86: ; CODE XREF: remove_digits+Aj

pop bp

retn 2

remove_digits endp

WinMain proc near ; CODE XREF: start+EDp

push bp

mov bp, sp

mov ax, offset aAsd ; "asd"

push ax

mov ax, offset aDef ; "def"

push ax

call string_compare

push ds

mov ax, offset aAsd ; "asd"

push ax

push ds

mov ax, offset aDef ; "def"

push ax

call string_compare_far

mov ax, offset aHello1234World ; "hello 1234 world"

push ax

call remove_digits

xor ax, ax

push ax

push ds

mov ax, offset aHello1234World ; "hello 1234 world"

push ax

push ds

mov ax, offset aCaption ; "caption"

push ax

mov ax, 3 ; MB_YESNOCANCEL

push ax

call MESSAGEBOX

xor ax, ax

pop bp

retn 0Ah

WinMain endp

Here we see a difference between the so-called “near” pointers and the “far” pointers: another weird artefact of segmented

memory in 16-bit 8086.

You can read more about it here:94 on page 868.

“near” pointers are those which point within the current data segment. Hence, thestring_compare()function takes
only two 16-bit pointers, and accesses the data from the segment thatDSpoints to (Themov al, [bx]instruction actually
works likemov al, ds:[bx]—DSis implicit here).

“far” pointers are those which may point to data in another memory segment. Hencestring_compare_far() takes
the 16-bit pair as a pointer, loads the high part of it in theESsegment register and accesses the data through it (mov al,