• Backstory: I'm poking through SimTower for Windows to discover the actual logic for how it decides how much alternative background is used for the SimTower lobby floors (the ones with the green telephones and fountains).

  • SimTower for Windows is a Win16 executable compiled with Borland's compiler, which means:

    1. Lots of fun with segmented addresses.
    2. Pascal calling-conventions.

    This makes this a brick-wall difficulty level because Ghidra still has issues with segmented addresses (e.g. try telling Ghidra that a char* is 16-bits long in one function but 32-bits long in another function), as well as needing to manually add support for Pascal calling-conventions (callee-cleans-up, parameter arguments pushed on the stack in left-to-right order, and some return types passed in registers, but others on the stack).

  • I'm using SoftICE 3.2 in Windows 98 on a VirtualBox VM. I'm amazed it runs at all, tbh.

  • For static analysis, I have Ghidra open.

I was able to follow execution from the entrypoint through to the Win32 message pump functions, but then I got lost - this is because the Win16 modules were relocated at different addresses than the base addresses displayed in Ghidra - which is especially confusing given Win16's the segmented memory model (which I still haven't groked, unfortunately).

I ran stack in SoftICE in the hope it would tell me where I was, but obviously the runtime memory addresses of the IP don't correspond to any location in the static image in Ghidra (due to relocation), but maddeningly while stack tells me that I'm in TOWER.EXE and not USER.EXE, none of the x86 opcodes currently executing appear in Ghidra's listing, so I'm assuming that I'm still stepping through Windows' code.

enter image description here

To summarize:

  • When single-stepping in SoftICE, how can I find out what the image address of the currently executing function is?
    • I note that I don't have any symbols. Only a module exports list.
    • I have been consulting the SoftICE Users' Guide and Command Reference and I think they all depend on symbols and translation files, which as far as I know is not something that I have.
  • In SoftICE, how can I set a breakpoint on a function given only its image address or export ordinal?
    • (This question is basically the inverse of above: I want to be able to map image function addresses to runtime function memory addresses and back again).
  • In Ghidra, how do I make it apply a relocation so the memory addresses displayed in Ghidra match those in SoftICE?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.