How to determine target of far call in Windows 3 16-bit protected mode binary

Question

I'm attempting to patch an old 16-bit windows 3 new executable binary which is in protected mode. It's a simple setup executable. Additionally, I'm doing this disassembly on linux and I've used Semblance to disassemble the binary, and am confronted with the following code:

1:0f91 <no name>:
  1:0f91:       33 ed                   xor     bp, bp
  1:0f93:       55                      push    bp
  1:0f94:       9a ff ff 00 00          call    KERNEL.91
  1:0f99:       0b c0                   or      ax, ax
  1:0f9b:       74 5b                   jz      0ff8
  1:0f9d:       8c 06 fe 02             mov     [02FEh], es
  1:0fa1:       81 c1 00 01             add     cx, 0100h
  1:0fa5:       72 51                   jb      0ff8
  1:0fa7:       89 0e d0 02             mov     [02D0h], cx
  1:0fab:       89 36 d2 02             mov     [02D2h], si
  1:0faf:       89 3e d4 02             mov     [02D4h], di
  1:0fb3:       89 1e d6 02             mov     [02D6h], bx
  1:0fb7:       8c 06 d8 02             mov     [02D8h], es
  1:0fbb:       89 16 da 02             mov     [02DAh], dx
  1:0fbf:       e8 3c 00                call    0ffe
  1:0fc2:       e8 f9 01                call    11be
  1:0fc5:       e8 84 03                call    134c
  1:0fc8:       33 c0                   xor     ax, ax
  1:0fca:       50                      push    ax
  1:0fcb:       9a ff ff 00 00          call    KERNEL.30
  1:0fd0:       ff 36 d4 02             push    word [02D4h]
  1:0fd4:       9a ff ff 00 00          call    USER.5
  1:0fd9:       0b c0                   or      ax, ax
  1:0fdb:       74 1b                   jz      0ff8

There are several call instructions and I've verified that the non-far call addresses are all there in the file. If you notice however, there are 3 far-calls here, but all have the same ptr16:16 argument! I'll reproduce them here:

  1:0f94:       9a ff ff 00 00          call    KERNEL.91
  1:0fcb:       9a ff ff 00 00          call    KERNEL.30
  1:0fd4:       9a ff ff 00 00          call    USER.5

9a is the opcode for a far call, but they all have the same argument! Yet, Semblance has determined not only which system modules its calling into, but possibly which function, but I haven't figured out the significance of the number yet. I should point out, that KERNEL and USER are both modules present in the exe's module reference table. All far calls in the binary have been linked to one of those modules in the reference table.

So, How is semblance doing this? All the calls seem identical. I'd just like to figure out what functions are being called, and I can begin to figure out how to patch around the error I'm facing.

If this is something that's impossible to do from linux, fine, but I'd like to try it this way first. I'm a beginner with assembly and reverse engineering so I'm viewing this as a learning opportunity so learning the sorts of details necessary to resolve these far calls might be useful.

Answer 1

Since the external modules may be loaded at an address not known until runtime, a specific address can't be used, so the information about external calls is not encoded in the instruction themselves (the bytes used are just placeholders) but in the separate section of the New Executable (NE) called Module-reference table combined with the relocation fixup data which is part of the Per-segment data. For more info see the reference and/or look up how Semblance resolves this information.

BTW, the number after the module name is the ordinal of the function used from that module; the ordinals for Win16 were fixed and you can look up which ordinal maps to which function for example in WINE: USER, KERNEL.