How MS-DOS Executes 32-Bit DOS Extenders

MS-DOS 6.22 is a 16-bit, real-mode operating system that cannot natively run 32-bit protected-mode applications. To execute 32-bit software, the system relies on specialized runtime layers known as 32-bit DOS extenders (such as DOS/4GW, PMODE/W, or Phar Lap). This article explains how MS-DOS initiates these programs through a 16-bit real-mode stub, switches the CPU into 32-bit protected mode using interfaces like DPMI or VCPI, and transparently translates 16-bit operating system interrupts so that advanced software can run seamlessly within the constraints of DOS.

The Real-Mode Limitation

MS-DOS 6.22 operates entirely within the 16-bit Real Mode of x86 processors. In this mode, memory addressing is limited to 1 MB using a segmented architecture (segment:offset), with only the lower 640 KB typically available for executable code and data. MS-DOS has no native awareness of 32-bit registers, paging, or the 4 GB flat-memory address space introduced with the Intel 80386 processor.

The 16-Bit Stub Entry Point

Executables built for 32-bit DOS extenders (typically ending in .EXE) use a dual-layer binary structure:

  1. The MZ Header and Real-Mode Stub: The outer file wrapper is a standard 16-bit MS-DOS executable (MZ format). When a user launches the program, MS-DOS parses the file using its standard execution service (INT 21h, AH=4Bh). MS-DOS is unaware that the file contains 32-bit code; it only executes this small 16-bit launcher stub.
  2. The 32-Bit Payload: Embedded behind the stub is the actual 32-bit executable binary, typically packaged in formats such as Linear Executable (LE) or Linear Formatted (LX).

Memory Interface Negotiation

Once the 16-bit stub receives execution control, it inspects the hardware and memory management environment before attempting to run 32-bit code:

  • CPU Verification: It checks that an Intel 80386 or newer processor is present.
  • Environment Detection: The stub checks for active system supervisors. If Windows or an OS/2 DOS box is running, it interfaces with the DOS Protected Mode Interface (DPMI). If MS-DOS 6.22 is running standalone with EMM386.EXE, the extender detects the Virtual Control Program Interface (VCPI). If only HIMEM.SYS is present, it uses Extended Memory Specification (XMS) calls.

Switching to 32-Bit Protected Mode

After verifying the supervisor interfaces, the extender initiates the transition into protected mode:

  • Descriptor Tables: It configures the Global Descriptor Table (GDT) and Interrupt Descriptor Table (IDT) to define a 32-bit flat memory model where code and data segments span up to 4 GB.
  • CPU Mode Switch: If running on bare metal or with XMS, the extender sets the Protection Enable (PE) bit in the CPU's CR0 control register. If running under EMM386.EXE (which places the CPU in Virtual 8086 mode), the extender issues VCPI interrupts to request that the expanded memory manager switch the processor into protected mode.
  • Loading the 32-Bit Payload: The extender allocates physical RAM in extended memory (above the 1 MB boundary), reads the 32-bit executable sections from the disk file, performs base relocations, sets up a 32-bit stack, and jumps to the 32-bit entry point.

Interrupt Thunking and DOS Translation

MS-DOS 6.22 remains completely 16-bit while the application runs in 32-bit mode. Because the application periodically requires operating system services—such as disk I/O, keyboard input, or file handling—the extender acts as an intermediary through a process called "thunking":

  1. Interrupt Interception: When the 32-bit code executes an interrupt such as INT 21h, the CPU does not jump directly into DOS. Instead, the extender's protected-mode IDT intercepts the call.
  2. Data Marshaling: The extender inspects the request. If the call involves passing data (such as writing a file buffer), the extender copies the data from 32-bit extended memory into a small transfer buffer located in conventional memory (below 1 MB) that real-mode DOS can access.
  3. Mode Switch to Real Mode: The extender transitions the processor down to Real Mode (or Virtual 8086 Mode) and executes the original INT 21h handler inside MS-DOS 6.22.
  4. Return to Protected Mode: Once MS-DOS finishes handling the call, the extender catches the return, retrieves any return data or error codes, switches the CPU back into 32-bit protected mode, updates the 32-bit registers, and resumes the application.