I'm attempting to patch an old 16-bit windows 3 new executable binary which is in protected mode. It's a simple setup executable. Additionally, I'm doing this disassembly on linux and I've used Semblance to disassemble the binary, and am confronted with the following code:
1:0f91 <no name>: 1:0f91: 33 ed xor bp, bp 1:0f93: 55 push bp 1:0f94: 9a ff ff 00 00 call KERNEL.91 1:0f99: 0b c0 or ax, ax 1:0f9b: 74 5b jz 0ff8 1:0f9d: 8c 06 fe 02 mov [02FEh], es 1:0fa1: 81 c1 00 01 add cx, 0100h 1:0fa5: 72 51 jb 0ff8 1:0fa7: 89 0e d0 02 mov [02D0h], cx 1:0fab: 89 36 d2 02 mov [02D2h], si 1:0faf: 89 3e d4 02 mov [02D4h], di 1:0fb3: 89 1e d6 02 mov [02D6h], bx 1:0fb7: 8c 06 d8 02 mov [02D8h], es 1:0fbb: 89 16 da 02 mov [02DAh], dx 1:0fbf: e8 3c 00 call 0ffe 1:0fc2: e8 f9 01 call 11be 1:0fc5: e8 84 03 call 134c 1:0fc8: 33 c0 xor ax, ax 1:0fca: 50 push ax 1:0fcb: 9a ff ff 00 00 call KERNEL.30 1:0fd0: ff 36 d4 02 push word [02D4h] 1:0fd4: 9a ff ff 00 00 call USER.5 1:0fd9: 0b c0 or ax, ax 1:0fdb: 74 1b jz 0ff8
There are several call instructions and I've verified that the non-far call addresses are all there in the file. If you notice however, there are 3 far-calls here, but all have the same ptr16:16 argument! I'll reproduce them here:
1:0f94: 9a ff ff 00 00 call KERNEL.91 1:0fcb: 9a ff ff 00 00 call KERNEL.30 1:0fd4: 9a ff ff 00 00 call USER.5
9a is the opcode for a far call, but they all have the same argument! Yet, Semblance has determined not only which system modules its calling into, but possibly which function, but I haven't figured out the significance of the number yet. I should point out, that KERNEL and USER are both modules present in the exe's module reference table. All far calls in the binary have been linked to one of those modules in the reference table.
So, How is semblance doing this? All the calls seem identical. I'd just like to figure out what functions are being called, and I can begin to figure out how to patch around the error I'm facing.
If this is something that's impossible to do from linux, fine, but I'd like to try it this way first. I'm a beginner with assembly and reverse engineering so I'm viewing this as a learning opportunity so learning the sorts of details necessary to resolve these far calls might be useful.