KJE2282@TAMVENUS.BITNET (06/11/87)
Hello Fellow Vaxphiles, Is there a PD program out there that will dissassemble a .EXE file ? I would appreciate any leads to such a utility. Kevin Kevin J. English "Proffesional Student" Texas A&M University Dept. of Electrical Engineering KJE22282 @ TAMVENUS (BITNET) UTASPAN::UTA3081::VENUS::KJE2282 (SPANNET)
johnf@runx.ips.oz (John F. Baird) (06/22/87)
Disassembling .EXE files? Easy! Run the program /DEBUG, SET LANGUAGE MACRO, work out where the code is (trail and error), and do an EXAMINE/INSTRUCTION for the relavent pages. Hope this helps!
BARMSTRO@carleton.EDU ("Borden Armstrong, x4627") (06/26/87)
> >Disassembling .EXE files? Easy! Run the program /DEBUG, SET LANGUAGE MACRO, >work out where the code is (trail and error), and do an EXAMINE/INSTRUCTION >for the relavent pages. > >Hope this helps! > Let me mention a technicality. If the program has been linked /NOTRACEBACK (which seems to happen a fair amount -- reasons of image size and execution time, perhaps?) then RUN/DEBUG never gets you to the debugger prompt. I, too, would be interested in any p-d software that could disassemble an executable lacking traceback information. Borden Armstrong PhoneNet: barmstro@carleton.edu Software Specialist UUCP: ...{ihnp4|rosevax}!stolaf!ccnfld!barmstro Carleton College AT&T: (507) 663-4627 One North College Street Northfield, Minnesota 55057 USA -------
Sm@numm.nu (Scott Merrilees) (07/02/87)
In article <8706270813.AA00477@ucbvax.Berkeley.EDU> BARMSTRO@carleton.EDU ("Borden Armstrong, x4627") writes: > >Let me mention a technicality. If the program has been linked /NOTRACEBACK >(which seems to happen a fair amount -- reasons of image size and execution >time, perhaps?) then RUN/DEBUG never gets you to the debugger prompt. I, >too, would be interested in any p-d software that could disassemble an >executable lacking traceback information. > To run /notraceback images with debug, there are two patches that can be made. 1. Make SYS$IMGSTA the first transfer address of the image. This enables you to use run/debug to invoke the debugger, but just run only invokes the traceback handler. There are three transfer addresses in the image starting at %x30. Copy the addresses at %x30 and %x34 to %x34 and %x38. Insert the address of SYS$IMGSTA, %x7ffedf68, into %x30. $ patch/absolute program.exe PATCH> examine 30,34,48 00000030: 00000400 00000034: 00000000 00000038: 00000000 PATCH> replace 30 = 400,0,0 NEW> 7ffedf68 NEW> 400 NEW> 0 NEW> exit OLD: 00000030: 00000400 OLD: 00000034: 00000000 OLD: 00000038: 00000000 NEW: 00000030: 7FFEDF68 NEW: 00000034: 00000400 NEW: 00000038: 00000000 PATCH> update PATCH> exit 2. To cause the program to start up the debugger normally when the image is executed (as though the program had been linked /debug), then also set the low bit in byte %x20 of the image header. $ patch/absolute program.exe PATCH> examine/byte 20 00000020: 28 PATCH> replace/byte 20 = 28 NEW> 29 NEW> exit PATCH> update PATCH> exit -- Scott Merrilees [Samarium] ARPA: Sm%numm.nu.oz@seismo.css.gov ACSnet: Sm@numm.nu.oz UUCP: ...!{seismo,mcvax}!munnari!numm.nu.oz!Sm
FSJTM@ALASKA.BITNET (07/12/87)
Subj: Disassembler...? Does anyone know the whereabouts of a VAX/VMS disassembler? Please EMAIL directly to me, as I don't read this group much. Thanks, FSJTM@ALASKA