tdkpin/original/DECOMPILATION.md

TDKPIN.EXE decompilation

Target

• File: TDKPIN.EXE
• SHA-256: a9022f1894e3e6e21fc42e8f6c932f7c549ca77f63aaa0c488bb9d55d9d0174c
• Format: Windows 3.x New Executable (NE), 16-bit protected-mode x86
• NE entry point: segment 1, offset fd85 (Ghidra address 1000:fd85)
• Image: five executable segments, one data segment, and 63 resource blocks
• Companion import: MMTIMER.DLL

The executable contains a Borland runtime copyright string, but it does not retain useful original function or variable names. The FUN_... and DAT_... names in the output are therefore analysis-generated identifiers.

Outputs

• TDKPIN_GHIDRA_RAW.c: C-like Ghidra output for every recovered in-image function.
• FUNCTIONS.tsv: address ledger separating in-image functions from imported APIs.
• COVERAGE.tsv: executable-block, instruction, function-body, and undefined-range audit.
• tools/ExportDecompilation.java: deterministic decompiler exporter.
• tools/SeedMissingEntrypoints.java: seeds one missed NE export and the NE startup entry.
• tools/AuditCoverage.java: regenerates the byte-coverage audit.
• tools/decompile.sh: runs the import, repair, export, and audit from scratch.

Accounting

• 301/301 NE exported entry points have corresponding in-image functions.
• 62 additional internal/startup functions were recovered.
• 363 in-image functions were submitted to the decompiler.
• 363 produced C-like output; none returned a decompiler failure.
• 292 imported Win16 APIs are recorded separately and are not represented as fake bodies.
• 91,332/93,064 executable-segment bytes (98.14%) are instructions in recovered function bodies.
• 1,730 executable-segment bytes remain undefined. Most are islands in the runtime-heavy fifth segment and may include embedded tables or alignment, but they have not been fully classified.

Ghidra's initial NE analysis missed export ordinal 10 at 1000:eab1 and the program entry at 1000:fd85. Both were verified as code from the image bytes, explicitly disassembled, and included in the final output.

Fidelity boundary

TDKPIN_GHIDRA_RAW.c is a decompilation artifact, not recovered original source and not yet a buildable replacement. In particular, Ghidra still emits guessed parameter lists, generic data types, unnamed globals, and several warnings around segmented pointers, stack tracking, and one indirect jump table. The source has not been executed against Windows 3.x or compared differentially with the original program. Consequently, the current result establishes broad static code coverage, not source-level semantic parity or a reproducible binary build.