12

I have a game that I can play in a Windows 3.1 emulator.

Now I want to have a look "behind the scenes" of the game EXE file. I hope to find game graphics (sprites) there.

But how can I extract it?

Every unpacker that I tried says "Not a valid PE file".

11
  • 7
    I would suggest trying to open the EXE file in a resource editor. This thread seems to give a few good tool recommendations: vogons.org/viewtopic.php?t=31517. As for the unpackers, I doubt that executable file compression tools were heavily used for Win16 executables – DmytroL Mar 14 at 14:12
  • i have a resourcehacker, but it gives the same error. Some of the links in your shown forum-thread are bloken... – Drachenbauer Mar 14 at 14:15
  • 11
    since you're using an emulator, it would be a better bet to rip the graphics from the memory while the game is running. That way you don't depend on the data format (which is often custom, and not necessarily located in the exe: if there are data files, the best bet is that the data is in the data files) – Jean-François Fabre Mar 14 at 14:24
  • 2
    Many emulators have some way of debugging the program that is running. If your emulator has this, too, try to pinpoint the routine that does the drawing, then go back and find where the data comes from. That's called "reverse engineering", and needs some skills in assembly. This will work in particular if your game doesn't use a standard format (which is likely, giving that all programs you've tried fail). Unfortunately, your question is short on details, like what emulator and what game it is. – dirkt Mar 15 at 6:28
  • 1
    try PV beware its MS-DOS tool ... also there are aps like Resource hacker ... – Spektre Mar 15 at 6:49
33

Executable files for 16-bit Windows are usually laid out in the now-rather-inaccurately-named New Executable format. Most current Windows executable analysis tools do not support this format; they can only read files in the 32-bit and 64-bit Portable Executable format. This is what the error message you cited is trying to tell you.

As for how to extract assets from the game, that will depend on how they are stored.

  • The crudest way to find embedded data would be to use a tool such as binwalk, which can scan for signatures of common data formats and extract data that follows. In my own test on NE executables bundled with Windows itself, the results of using this tool were rather underwhelming; I guess that it is likewise tuned for looking for modern formats rather than historically-used ones, which have rather few distinguishing features anyway. But it may be an option worth at least trying.
  • Since the asker mentioned it’s a Windows 3.x game, the assets may be embedded in the executable as Windows resources. Those can be extracted and manipulated with tools analogous to modern resource editors, but with support for NE files. Such were often distributed with contemporaneous compiler toolchains:
    • Borland Resource Workshop, itself a 16-bit Windows program, distributed with later versions of Borland’s early Pascal (Turbo/Borland Pascal 7) and C++ (Borland C++ 3.1) toolchains;
    • The Watcom Resource Editor, distributed with the Watcom/OpenWatcom toolchain (I am much less familiar with it, and so I am less sure whether it actually supports reading complete executables).
  • The assets may be simply static data embedded in the executable image next to the code. In that case, finding and extracting it will require using a disassembler such as Ghidra. Disassembly is a laborious process that requires knowledge of assembly language and some skills in its own right, but in the long term it’s the only one guaranteed to produce definitive answers as to where the executable actually looks for data.

Though most of the above is assuming that the data are actually embedded directly (and uncompressed, too) in the executable file itself, which it need not actually be. You may need to scan other game files if there are any, or failing that, again, disassemble the executable and learn where it looks for the assets.

7
  • There's also WRE.EXE from Open Watcom C/C++, which probably even supports 16-bit NE EXEs in its 32-bit builds (I don't have it installed to test right now) but I think I remember it only supporting a subset of the kinds of bitmap resources the Borland tools did. – ssokolow Mar 14 at 23:18
  • APSTUDIO.EXE from Microsoft Visual C++ 1.5 can also open and edit the resources of 16-bit executables. – john_e Mar 15 at 9:37
  • rather than historically-used ones I think in that era of computers the concept of a "format" was still pretty new. Software frequently went-it-alone, so to speak. With no internet, sharing libraries was nowhere near as common as it is today so things from this era tended to be very homebrew and bespoke. – J... Mar 15 at 13:02
  • @J... I recall some games using resource files based on standard image file formats but with many sprites in one file, and a header that looked like it belonged to a smaller file containing only one sprite. Changing the extension could sometimes see some or all of the contents; sometimes hex-editing the header was needed to access all of it. But it was a long time ago; I've probably forgotten key steps – Chris H Mar 15 at 16:20
  • 1
    @ChrisH Sure, but the keyword here is some. You're just as likely to find other variations, hacks, and DIY strategies either foisted upon loose standards or entirely independent of those format standards. There's no way to know for sure without looking, and you have to be on the lookout for anything. – J... Mar 15 at 16:23
0

There was a tool from Borland that came with Borland Delphi 1.0. You pointed it at an EXE and it would show you all the resources that were embedded in the file.

It was extremely useful. I don't remember the name of the application, maybe something like "Resource Viewer" or "Resource Manager"? Maybe something like that.

If I recall, Borland was forced to stop shipping this tool with future versions of Delphi as it violated some kind of license agreements or something.

Maybe if you can find an old copy of the Delphi 1.0 CDs, you might find the tool there. I hope this helps!

UPDATE: Here it is, "Resource Workshop" ... https://vetusware.com/download/Borland%20Resource%20Workshop%205.02/?id=13304

-2

You can try to use one of the forensic tools used to extract images and documents from damaged files or disk images. If the executable has e.g. a JPG embedded, they might be able to extract it.

2
  • 7
    JPEG in a Windows 3.x era executable seems rather unlikely. You haven’t even named any actual tool in your answer. And for what it’s worth, I actually tried running binwalk on some bundled Windows programs (like SOL.EXE), and the results were pretty disappointing: it did not even manage to find the card bitmaps that Resource Workshop extracts with ease. – user3840170 Mar 15 at 8:19
  • 1
    Images from that era are likely to be Windows Bitmap (which doesn't have much of a header), PCX (which has even less of one), or a proprietary format. Forensic tools won't be much good for extracting them. Occasionally you'll get lucky and have GIF images, which have a distinctive header. – Mark Mar 15 at 21:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.