50 lines
2.6 KiB
Markdown
50 lines
2.6 KiB
Markdown
# TDKPIN.EXE decompilation
|
|
|
|
## Target
|
|
|
|
- File: `TDKPIN.EXE`
|
|
- SHA-256: `a9022f1894e3e6e21fc42e8f6c932f7c549ca77f63aaa0c488bb9d55d9d0174c`
|
|
- Format: Windows 3.x New Executable (NE), 16-bit protected-mode x86
|
|
- NE entry point: segment 1, offset `fd85` (Ghidra address `1000:fd85`)
|
|
- Image: five executable segments, one data segment, and 63 resource blocks
|
|
- Companion import: `MMTIMER.DLL`
|
|
|
|
The executable contains a Borland runtime copyright string, but it does not retain
|
|
useful original function or variable names. The `FUN_...` and `DAT_...` names in
|
|
the output are therefore analysis-generated identifiers.
|
|
|
|
## Outputs
|
|
|
|
- `TDKPIN_GHIDRA_RAW.c`: C-like Ghidra output for every recovered in-image function.
|
|
- `FUNCTIONS.tsv`: address ledger separating in-image functions from imported APIs.
|
|
- `COVERAGE.tsv`: executable-block, instruction, function-body, and undefined-range audit.
|
|
- `tools/ExportDecompilation.java`: deterministic decompiler exporter.
|
|
- `tools/SeedMissingEntrypoints.java`: seeds one missed NE export and the NE startup entry.
|
|
- `tools/AuditCoverage.java`: regenerates the byte-coverage audit.
|
|
- `tools/decompile.sh`: runs the import, repair, export, and audit from scratch.
|
|
|
|
## Accounting
|
|
|
|
- 301/301 NE exported entry points have corresponding in-image functions.
|
|
- 62 additional internal/startup functions were recovered.
|
|
- 363 in-image functions were submitted to the decompiler.
|
|
- 363 produced C-like output; none returned a decompiler failure.
|
|
- 292 imported Win16 APIs are recorded separately and are not represented as fake bodies.
|
|
- 91,332/93,064 executable-segment bytes (98.14%) are instructions in recovered function bodies.
|
|
- 1,730 executable-segment bytes remain undefined. Most are islands in the runtime-heavy fifth
|
|
segment and may include embedded tables or alignment, but they have not been fully classified.
|
|
|
|
Ghidra's initial NE analysis missed export ordinal 10 at `1000:eab1` and the program entry at
|
|
`1000:fd85`. Both were verified as code from the image bytes, explicitly disassembled, and
|
|
included in the final output.
|
|
|
|
## Fidelity boundary
|
|
|
|
`TDKPIN_GHIDRA_RAW.c` is a decompilation artifact, not recovered original source and not yet a
|
|
buildable replacement. In particular, Ghidra still emits guessed parameter lists, generic data
|
|
types, unnamed globals, and several warnings around segmented pointers, stack tracking, and one
|
|
indirect jump table. The source has not been executed against Windows 3.x or compared
|
|
differentially with the original program. Consequently, the current result establishes broad
|
|
static code coverage, not source-level semantic parity or a reproducible binary build.
|
|
|