Help Index
Contents

General Information About W32Dasm Version 2.0

W32Dasm Information

How to Order Full Version of W32Dasm

Order Info

Commands

File Menu

Text Search Menu

Goto Menu

Functions Menu

Execute Menu

Data Menu

Code Menu

Print Menu

Help Menu

Toolbar

Toolbar Commands

Procedures

Exiting

Printing


For information on how to use Help, press F1 or select Using Help from the Help menu.


To get the full version of W32Dasm, which includes the File Print and File Save Functions,

print this page and fill out information below. Send a $20.00 check or money order payable

to P. J. Urbanik,

          To:

 	      URSoftware

      44 Sachem Dr.

      Glastonbury Conn. 06033.

Software will be provided on a 3.5 inch floppy disk in ZIP format. Software can also be Emailed directly

if desired. Please provide Email address if you want this option.

 Questions/Inquiries regarding this software can be sent via Email to: urbie@msn.com.

Purchasers Name: _________________________________

                 Address: _________________________________

    _________________________________ Zip: _________________

[ ]  Send Floppy

[ ]  Email Copy  -> Email Address: _______________________________


W32Dasm Version 2.0 will disassemble 32 Bit Windows programs that are in the Portable Executable (PE) Format.

W32Dasm  does not disassemble Windows 16 Bit programs.

Version 2.0 includes added functionality and fixes known anomalies in Version 1.0.

A assembly code listing will be produced that has header information describing all Imported and Exported functions in the file. Processes , Calls to functions and Data references are color coded on the screen listing. Search functions are available to aide in finding functions, code, data, etc. Imported Functions,  Exported functions and Data References are listed alphabetically in special List Boxes with a search feature. A  goto Program Entry Point command is available to quickly find the program starting point. (Starting points for windows programs are not necessarily at the start of the code listing). Commands for execution of jump, call, and return from call instructions are also available. The Print and Save Text to File commands are disabled in the DEMO version. To obtain full version, see How to Order Full Version in Help Contents Menu.


File Menu

The File menu provides commands for opening 32 Bit Windows programs for disassembly, saving disassembler text to an ASCII file, printing diassembler text, and exiting the application.

Open	Opens an existing file for disassembly. File can be any valid Windows 32 bit program file that has a Portable Executable (PE) format.

Save	Saves the disassembler text to a ASCII file. The default filename is the original filename with an .alf (Assembly List File) extension.

Exit	Exits the W32Dasm application.


Search Menu
Text Search Menu

The Text Search menu provides commands to find and mark selected text.

Find 	Finds a pattern of text and marks in red on the screen display. This is useful for finding specific functions in the disassembly text. All code location begin with a semicolon (ie :004123CB) to uniquely identify them in searches. Searches can be performed up or down from the current screen location by selecting the appropriate button in the Find Dialog Box. The text Case Match is defaulted OFF but may also be activated in the Find Dialog Box.

Next 	Repeats search of last find operation. The F3 key or toolbar button can also be used for Find Next operations.


Goto Menu

Goto Code Start	Sets Disassembled text to the start of the Code Listing. The F7 or Toolbar Button can also be used for this function.

Goto Program Entry Point 	Sets Disassembled text to Program Entry Point Code. The F8 or Toolbar Button can also be used for this function.

Goto Page 	Sets Disassembled text to the Page Selected from the Goto Page Dialog Box. The F9 or Toolbar Button can also be used for this function.


Function Menu
Functions Menu

The Functions Menu provides access to the Import and Export Function List Boxes.

Imports	 Displays the Imported Functions List Box.

Exports	Displays the Exported Functions List Box.


Execute Menu

The Execute Menu provides access to the generic jump, call, and return from call commands.

Execute Jump	 Sets listing to the location specified by the jump instruction that is at the top line of the screen display.

Execute Call	Sets listing to the location specified by the call instruction that is at the top line of the screen display.

Return From Call	Returns listing to the location of the most recently executed call (See Execute Call).


Data Menu

The Data menu provides access to the Data List Box.

Data Reference 	Displays the Data Reference List Box.

Hex Display of Data Object 	Displays the Data Object in hexadecimal form.


Code Menu

The Code menu provides access to a Hex display of the code currently displayed on the screen.

Hex Display of Code Data 	Displays the current screen code as Hex data.


Print Menu

Print Preview	View a sample printout of the current disassembler text.

Print	Sends the disassembler text to a printer. User can select specific pages or print the whole listing.

Print Setup	Set printer characteristics, ie Landscape, Portrait, etc.


Help Menu

The Help menu provides access to the help system and the about dialog.

Contents	Help topic contents.

Context Help Context sensitive help.

About About W32Dasm.


Exiting

To exit W32Dasm, choose File|Exit from the menu. You will be prompted to save any unsaved disassembly text before exiting.


Printing

There are three commands on the File menu which support printing of disassembled text from  W32Dasm.  File|Print Setup is used to select and configure a printer device.  File|Print Preview displays a special preview window which shows how the text will appear when printed.  File|Print allows for printing all or selected pages of the current displayed  disassembler text.


File Exit Command

The File|Exit command exits W32Dasm.  If you've modified documents without saving, you'll be prompted to save before exiting.


File Open Command

The File|Open command displays the Open a File dialog box so you can select a file to disassemble.


Print Print Command

The Print|Print command prints all or selected pages of the disassembler text.  Use File|Print Preview to see how the text will be laid out on printer pages.  Use File|Print Setup to select a printer, and to set printer options. This function is disabled in the DEMO version. See How to Order Full Version topic in Help Contents menu.


Print Print Preview Command

Print|Print Preview opens a special window that shows how the disassembled text will appear when printed.  The preview window shows one or two pages of the active document as they would be laid out on printer pages.  If the Printer is set up for Landscape printing, only one page is available in the print preview window. Controls on the window allow you to page through the pages of the text.


Print Print Setup Command

The Print|Printer Setup command displays the Printer Setup dialog box which allows you to select and configure the printer to be used to print documents in the application.


File Save Command

The File|Save command saves the disassembler text to an ASCII text file. The default name of the saved file will be the original name/path of the disassembled file with an .alf (Assembler List File) extension. This file can be used in a word processor such as MS Word for further editing, searching and formatting. The default filename/path can be overridden by the user. This function is disabled in the DEMO version. See How to Order Full Version topic in Help Contents menu.


Search Find Command
Text Search Find Command

The Search|Find command searches the disassembled text for a  pattern.  The command displays the Find dialog which controls the search process.  Options in the dialog determine whether  the case of characters is significant, and whether the search should be conducted forwards or backwards through the document.  As each match is found, it is highlighted in red in on the screen.


Search Next Command
Text Search Next Command

The Search|Find Next command repeats the last Find  operation.


Goto Goto Code Start Command

The Goto|Goto Code Start Command sets the disassembled text to the start of the code listing. This is not necessarily the start point for the execution of the subject program.  (See Goto Program Entry Point)


Goto Goto Program Entry Point Command

The Goto|Goto Program Entry Point Command sets the disassembled text to the program entry point code (See Figure 1). This is the start point for the execution of the subject program.  When using a debugger program, a breakpoint may be set here to trap beginning of the program execution.

 If the code location (ie. :XXXXXXXX of the program entry point is set to the top line of the display by using the Scroll Bar or pressing the Line Down key, the status bar at the bottom of the screen will give information as to the hex offset in the program file where this code exists(See Figure 2). Patching the code byte of this location with a hex editor to a CC value will place an INT 3 instruction which will cause the program to break automatically when used with a debugger. Of course the original value of the patched byte would then have to be reinstated to continue the debug.

In the example Figure 2, the byte A1h at code location :00410000 would be replaced by byte CCh which is at file W32DASM.EXE file offset 600h. After trapping with a debugger program, the byte CCh would need to be replaced by the original byte A1h.

       Figure 1.

       Figure 2.


Goto Goto Page
Goto Goto Page Command

The Search|Goto Page Command sets the disassembled text to the page selected from the Goto Page Dialog. The Current Page is displayed when the Dialog is initialized. Page numbers entered that are greater than the total pages available will goto to the last page.


Functions Imports

The Functions|Imports displays a List Box with all the disassembled programs identified Imported Functions listed alphabetically.

Imported Functions are functions that are required to run a program but  reside in files other than the subject program file. Imported Functions in the Disassembled Listing, are references to Calls to the function. There can be more than, and usually is, one reference. Imported Functions are usually the result of calls made to Dynamic Link Library files (DLLs).

If there are no Imported Functions identified, the command is disabled. To search for an Imported Function in the disassembled text, Double Click  the Left Mouse Button on the desired function in the List Box.


Functions Exports

The Functions|Exports displays a List Box with all the disassembled programs identified Exported Functions listed alphabetically.

Exported Functions are functions that are available to other programs. Exported Functions in the Disassembled Code Listing  show the actual function code. There should be only one reference in the Code portion of the Disassembler Listing per Exported Function. DLL files usually have many exported functions. Program {exe} files usually have few if any.

If there are no Exported Functions identified, the Command is disabled. To search for an Exported Function in the disassembled text, Double Click  the Left Mouse Button on the desired function in the List Box.


Execute Execute Jump

The Execute|Execute Jump command sets the screen listing to the location specified by the jump instruction that is on the top line of the screen listing. All direct jumps to the code object are executed. The command is automatically enabled if a valid jump instruction is in the top line position. In the case that the jump location is invalid, a message will be posted after a unsuccessful attemptis made.


Execute Execute Call

The Execute|Execute Call command sets the screen listing to the location specified by the call instruction that is on the top line of the screen listing. All direct calls to the code object are executed. The command is automatically enabled if a valid call instruction is in the top line position. In the case that the call location is invalid, a message will be posted after a unsuccessful attempt is made. After a call command is executed, the Execute|Return command can be used to return to the original call location. Call commands can be stacked, and Return commands will set locations in the order of the calls.


Execute Return From Call

The Execute|Return From Call command sets the screen listing to the location of the last executed Execute|Execute Call command. Call commands are stacked, and Return commands will set locations in the reverse order  of the calls. The command is automatically enabled when valid call commands are executed.


Data Data
Data Data References

The Data|Data References displays a List Box with all the disassembled programs identified data references listed alphabetically by String Data and Integer Data.

If there is no Data identified, the Command is disabled. To search for a data item reference in the disassembled text, Double Click  the Left Mouse Button on the desired data text in the List Box.


Data Hex Display of Data Object
Data Hex Display of Data Object Command

The Data|Hex Display of Data Object displays a List Box with all the Data Object data in hexadecimal format. The data is grouped into 1024 byte pages which are selectable from the list box. The number of pages is dependent on the size of the data object. This command in enabled after a valid disassembly is executed.


Code Hex Display of Code Data
Code Hex Display of Code Data Command

The Data|Hex Display of Code Data displays a List Box with the current page code data in hexadecimal format. The sarting location is the same as the code location specified at the top line of the screen. This command is disabled if a valid code location is not available on the top line of the screen. (Note: If a page reference is at the top of the screen, the next line will acitivate this command if it is a valid code location.)


Help table of contents
Window Help table of contents

The Help|Contents displays the help contents page.


Window Context Sensitive Help

The Help|Context Help creates a cursor that calls up help when  clicked over any toolbar or menu item. The context help cursor is automatically deleted upon return from help or it can be canceled by using the right mouse button or pressing the keyboard escape key {Esc}.


Window About W32Dasm

Displays dialog box with information about the W32Dasm Application.


Toolbar
The Toolbar

The Toolbar is a row of buttons at the top of the main window which represent application commands. Clicking one of the buttons is a quick alternative to choosing a command from the menu.  Buttons on the toolbar activate and deactivate according to the state of the application.

Button	Action	Menu Equivalent

Open File to Disassemble.	File|Open

Save Disassembly to a Text File.	File|Save

Find Text.	Search|Find

Fint Next.	Search|Next

Goto Code Starting Location of Code Listing.	Goto|Goto Code Start Point

Goto Program Entry Point in the Code Listing.	Goto|Goto Program Entry Point

Select and Goto Specified Page .	Goto|Goto Page

List Import Functions.	Function|Imports

List Export Functions.	Function|Exports

Execute Jump Instruction.	Execute|Execute Jump

Execute Call Instruction.	Execute|Execute Call

Return From Call.	Execute|Return From Call

List and Search Data References.	Data|Data References

Display of Data Object in Hex Format.	Data|Hex Display of Data Object

Display of Code Data in Hex Format.	Data|Hex Display of Code Data

Print the Disassembler Text.	Print|Print

Print Preview the Disassembler Text.	Print|Print Preview

Context Sensitive Help	Help|Context Help