16-bit Assembly

This page is under construction. USE AT YOUR OWN RISK!

Assembly Language Tutorial

Please choose a tutorial page: Fundamentals -- Information about C Tools Registers Simple Instructions Example 1 -- SC CDKey Initial Verification Example 2 -- SC CDKey Shuffle Example 2b -- SC CDKey Final Decode The Stack Stack Example Functions Example 3 -- Storm.dll SStrChr Assembly Summary Machine Code Example 4 -- Smashing the Stack Cracking a Game Example 5 -- Cracking a game Example 6 -- Writing a keygen .dll Injection and Patching Memory Searching Example 7 -- Writing a cheat for Starcraft (1.05) Example 7 Step 1 -- Displaying Messages Example 7 Step 1b -- Above, w/ func ptrs Example 7 Final Example 8 -- Getting IX86.dll files 16-bit Assembly Example 9 -- Keygen for a 16-bit game Example 10 -- Writing a loader

Older software, before 32-bit was common, was written in 16-bit x86 assembly. Although it is rare to come across, it does happen. This section will talk about some of the challenges to cracking a 16-bit program.

Thankfully, IDA supports 16-bit programs as well as 32-bit programs. That means that, if nothing else, a friendly disassembler is available to assist with reverse engineering.

W32Dasm also works well on 16-bit programs.

Challenges

There are many challenges with cracking a 16-bit game that aren't present in modern 32-bit programs. Some examples of issues are:

• Debuggers don't work unless they're specially designed, since 16-bit programs run in a virtual machine.
• Small segments means code is more spread out.
• Different uses for registers/instructions.

This section will address the final point, since that's the only really necessary tool.

Registers

The general purpose registers are similar, with one exception: the 32-bit registers no longer exist. That means that the registers available are:

• ax
• bx
• cx
• dx
• si
• di
• bp
• sp

Another change is in the instruction pointer, eip -- there are now two instruction pointers, XXXXX and ip. XXXXX points to the current segment and ip points to the current instruction within that segments.

The reason for this change is because a 16-bit register only has a 65536-value range, and most programs are more than 64k big.

Instructions

The main differences in instructions is that the instructions that operate on 64-bit registers (such as div and mul) now operate on 32-bit registers. That means that any instruction that uses edx:eax now uses dx:ax.