13

I have a game that I can play in a Windows 3.1 emulator.

Now I want to have a look "behind the scenes" of the game EXE file. I hope to find game graphics (sprites) there.

But how can I extract it?

Every unpacker that I tried says "Not a valid PE file".

Improve this question
11
  • 7
    I would suggest trying to open the EXE file in a resource editor. This thread seems to give a few good tool recommendations: vogons.org/viewtopic.php?t=31517. As for the unpackers, I doubt that executable file compression tools were heavily used for Win16 executables
    – DmytroL
    Mar 14, 2021 at 14:12
  • i have a resourcehacker, but it gives the same error. Some of the links in your shown forum-thread are bloken...
    – Drachenbauer
    Mar 14, 2021 at 14:15
  • 11
    since you're using an emulator, it would be a better bet to rip the graphics from the memory while the game is running. That way you don't depend on the data format (which is often custom, and not necessarily located in the exe: if there are data files, the best bet is that the data is in the data files)
    – Jean-François Fabre
    Mar 14, 2021 at 14:24
  • 2
    Many emulators have some way of debugging the program that is running. If your emulator has this, too, try to pinpoint the routine that does the drawing, then go back and find where the data comes from. That's called "reverse engineering", and needs some skills in assembly. This will work in particular if your game doesn't use a standard format (which is likely, giving that all programs you've tried fail). Unfortunately, your question is short on details, like what emulator and what game it is.
    – dirkt
    Mar 15, 2021 at 6:28
  • 1
    try PV beware its MS-DOS tool ... also there are aps like Resource hacker ...
    – Spektre
    Mar 15, 2021 at 6:49

3 Answers 3

Reset to default
35

Executable files for 16-bit Windows are usually laid out in the now-rather-inaccurately-named New Executable format. Most current Windows executable analysis tools do not support this format; they can only read files in the 32-bit and 64-bit Portable Executable format. This is what the error message you cited is trying to tell you.

As for how to extract assets from the game, that will depend on how they are stored.

  • The crudest way to find embedded data would be to use a tool such as binwalk, which can scan for signatures of common data formats and extract data that follows. In my own test on NE executables bundled with Windows itself, the results of using this tool were rather underwhelming; I guess that it is likewise tuned for looking for modern formats rather than historically-used ones, which have rather few distinguishing features anyway. But it may be an option worth at least trying.
  • Since the asker mentioned it’s a Windows 3.x game, the assets may be embedded in the executable as Windows resources. Those can be extracted and manipulated with tools analogous to modern resource editors, but with support for NE files. Such were often distributed with contemporaneous compiler toolchains:
    • Borland Resource Workshop, itself a 16-bit Windows program, distributed with later versions of Borland’s early Pascal (Turbo/Borland Pascal 7) and C++ (Borland C++ 3.1) toolchains;
    • The Watcom Resource Editor, distributed with the Watcom/OpenWatcom toolchain (I am much less familiar with it, and so I am less sure whether it actually supports reading complete executables).
  • The assets may be simply static data embedded in the executable image next to the code. In that case, finding and extracting it will require using a disassembler such as Ghidra. Disassembly is a laborious process that requires knowledge of assembly language and some skills in its own right, but in the long term it’s the only one guaranteed to produce definitive answers as to where the executable actually looks for data.

Though most of the above is assuming that the data are actually embedded directly (and uncompressed, too) in the executable file itself, which it need not actually be. You may need to scan other game files if there are any, or failing that, again, disassemble the executable and learn where it looks for the assets.

Improve this answer
7
  • There's also WRE.EXE from Open Watcom C/C++, which probably even supports 16-bit NE EXEs in its 32-bit builds (I don't have it installed to test right now) but I think I remember it only supporting a subset of the kinds of bitmap resources the Borland tools did.
    – ssokolow
    Mar 14, 2021 at 23:18
  • APSTUDIO.EXE from Microsoft Visual C++ 1.5 can also open and edit the resources of 16-bit executables.
    – john_e
    Mar 15, 2021 at 9:37
  • rather than historically-used ones I think in that era of computers the concept of a "format" was still pretty new. Software frequently went-it-alone, so to speak. With no internet, sharing libraries was nowhere near as common as it is today so things from this era tended to be very homebrew and bespoke.
    – J...
    Mar 15, 2021 at 13:02
  • 1
    @ChrisH Sure, but the keyword here is some. You're just as likely to find other variations, hacks, and DIY strategies either foisted upon loose standards or entirely independent of those format standards. There's no way to know for sure without looking, and you have to be on the lookout for anything.
    – J...
    Mar 15, 2021 at 16:23
  • 1
    @J...: I found that most Win16 programs had plenty to be seen in resources. If OP can't find ancient tools he can look for BM headers scattered throughout the file. Though if the game authors had to compress stuff, he's on his own.
    – Joshua
    Mar 16, 2021 at 1:45
1

There was a tool from Borland that came with Borland Delphi 1.0. You pointed it at an EXE and it would show you all the resources that were embedded in the file.

It was extremely useful. I don't remember the name of the application, maybe something like "Resource Viewer" or "Resource Manager"? Maybe something like that.

If I recall, Borland was forced to stop shipping this tool with future versions of Delphi as it violated some kind of license agreements or something.

Maybe if you can find an old copy of the Delphi 1.0 CDs, you might find the tool there. I hope this helps!

UPDATE: Here it is, "Resource Workshop" ... https://vetusware.com/download/Borland%20Resource%20Workshop%205.02/?id=13304

Improve this answer
-2

You can try to use one of the forensic tools used to extract images and documents from damaged files or disk images. If the executable has e.g. a JPG embedded, they might be able to extract it.

Improve this answer
2
  • 7
    JPEG in a Windows 3.x era executable seems rather unlikely. You haven’t even named any actual tool in your answer. And for what it’s worth, I actually tried running binwalk on some bundled Windows programs (like SOL.EXE), and the results were pretty disappointing: it did not even manage to find the card bitmaps that Resource Workshop extracts with ease.
    – user3840170
    Mar 15, 2021 at 8:19
  • 1
    Images from that era are likely to be Windows Bitmap (which doesn't have much of a header), PCX (which has even less of one), or a proprietary format. Forensic tools won't be much good for extracting them. Occasionally you'll get lucky and have GIF images, which have a distinctive header.
    – Mark
    Mar 15, 2021 at 21:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .