I had success with IDA Free 4.1 in the end. I thought it wouldn't be useful since it runs in a console, but it disassembled the Win 3.1 executables I wanted to manipulate fine. It helpfully linked together string constants and jumps with neat labels, so I could find all the button handlers easily, step through the registration sequence, and figure out the algorithms for the various challenge/response routines.

Were you using that on Win98SE?
It seems both Ghidra and Cutter (a GUI for radare2) have some support for 16-bit too...idk what that means in practical terms.
I've heard good things about IDA so maybe these don't bring much anything new to the table. They are also quite resource hungry, so a modern(ish) platform is a must.
But they're both Open Source and they both have the great Ghidra decompiler built in, so may be worth a try if you're in the habit of doing much of disassembly.

MrD wrote on 2021-02-05, 22:29:

I had success with IDA Free 4.1 in the end. I thought it wouldn't be useful since it runs in a console, but it disassembled the Win 3.1 executables I wanted to manipulate fine.

I only use IDA Free 4.1 to disassemble an executable and then I use a newer version with a graphical user interface that can open the output of 4.1.

Were you using that on Win98SE?

Yes, disassembling the Win 3.1 game on 98SE with IDA Free 4.1, using the IDA interface in a console window.

Calvero wrote on 2021-02-07, 16:10:

MrD wrote on 2021-02-05, 22:29:

I had success with IDA Free 4.1 in the end. I thought it wouldn't be useful since it runs in a console, but it disassembled the Win 3.1 executables I wanted to manipulate fine.

I only use IDA Free 4.1 to disassemble an executable and then I use a newer version with a graphical user interface that can open the output of 4.1.

Could you explain that process a little bit please? 😀 What output should I be looking to produce, and which other version do you use to open it?

The game in question was 'Win Elvis-N-Space', btw - and I've learned enough about it to figure out how to bypass the protection with a patch, or generate my own registration codes.

Open the executable in IDA Free 4.1, click on File->Save database as...
Now you have a .idb file that you can open with IDA Free 5.0.