Reverse Engineering for Beginners

(avery) #1

CHAPTER 53. WINDOWS 16-BIT CHAPTER 53. WINDOWS 16-BIT


WinMain proc near
push bp
mov bp, sp
mov ax, 123
push ax
mov ax, 456
push ax
mov ax, 789
push ax
call func1
mov ax, 9 ; high part of 600000
push ax
mov ax, 27C0h ; low part of 600000
push ax
mov ax, 0Ah ; high part of 700000
push ax
mov ax, 0AE60h ; low part of 700000
push ax
mov ax, 0Ch ; high part of 800000
push ax
mov ax, 3500h ; low part of 800000
push ax
call func2
mov ax, 9 ; high part of 600000
push ax
mov ax, 27C0h ; low part of 600000
push ax
mov ax, 0Ah ; high part of 700000
push ax
mov ax, 0AE60h ; low part of 700000
push ax
mov ax, 0Ch ; high part of 800000
push ax
mov ax, 3500h ; low part of 800000
push ax
mov ax, 7Bh ; 123
push ax
call func3
xor ax, ax ; return 0
pop bp
retn 0Ah
WinMain endp


32-bit values (thelongdata type implies 32 bits, whileintis 16-bit) in 16-bit code (both MS-DOS and Win16) are passed in
pairs. It is just like when 64-bit values are used in a 32-bit environment (24 on page 379).


sub_B2 hereis a library function written by the compiler’s developers that does “long multiplication”, i.e., multiplies two
32-bit values. Other compiler functions that do the same are listed here:E on page 903,D on page 902.


TheADD/ADC instruction pair is used for addition of compound values: ADDmay set/clear theCFflag, andADCuses it
after.


TheSUB/SBBinstruction pair is used for subtraction: SUBmay set/clear theCFflag,SBBuses it after.


32-bit values are returned from functions in theDX:AXregister pair.


Constants are also passed in pairs inWinMain()here.


Theint-typed 123 constant is first converted according to its sign into a 32-bit value using theCWDinstruction.


53.5 Example #5


#include <windows.h>


int PASCAL string_compare (char s1, char s2)
{
while (1)
{
if (s1!=s2)
return 0;

Free download pdf