In this chapter, I cover my two favorite tools for analyzing programs.
The W32Dasm is a symbiosis of a powerful disassembler and a debugger. For the moment, version 8.93 of this program is the most widespread. It can work not only with PE modules but also with DOS, NE, and LE modules. In this chapter, I cover
The program window is shown in Fig. 24.1. The menu is supplemented by the toolbar whose elements are activated depending on the situation.
Figure 24.1: W32Dasm window
As already mentioned, this program is a combined disassembler and debugger This is reflected by the presence of two menu items:
. Accordingly, there are individual settings for debugger and disassembler. For disassembler, there are only three options
Debugger options are greater in number; however, they all are self-evident. The debugger options window is shown in Fig. 24.2. All these options relate to specific features of loading processes, threads, and dynamic link libraries (DLLs).
Figure 24.2: Debugger options
To begin working with the executable module, choose the required file from the
Figure 24.3: Fragment of the disassembled text
To accomplish your work with the module, it is possible to create a project using the Disassembler Save Disassembler menu options. By default, projects are saved in the subdirectory named .WPJ FILES under the W32Dasm working directory. This subdirectory will contain two files: The file with the ALF filename extension will contain the disassembled text, and the file with the WPJ filename extension will contain the project. When you need to restart your work, you can open the project instead of the file. This is accomplished by choosing the Project Open menu commands.
When navigating the disassembled text, the current line is highlighted. Jumps and procedure calls are specially highlighted. Navigation is further simplified by the Goto menu command:
Goto Code Start Go to the start of the listing.
Goto Program Entry Point Go to the program entry point (the most important menu item).
Goto Page Go to the page with the specified number; by default, the number of lines per page is assumed to be 50.
Goto Code Location Jump to the specified address; if the address is missing, the range and proximity to other addresses are taken into account.
menu command is another method of navigating the disassembled text. This command doesn't
If the current line contains a jump or procedure call, you can jump to the appropriate address by clicking the respective toolbar button. You can continue navigating this way until you detect the required program fragment. The most advantageous point here is that it is also possible to move in the inverse direction. All required toolbar
Furthermore, those addresses, to which the jump is carried out, contain lists of source addresses, from which the jumps were carried out. If you highlight the line, in which the address is located, and double-click it with the right mouse button, you'll go to the required line of code.
There are several methods of working with the data.
First, there is the
HexData Hex Display of Data
menu item, which you can use to view the contents of data segments in hex or string representations. In addition, the program code can be
Second, there is the Refs String Data References menu item. This is a powerful and useful tool. When you choose this menu item, the list of the code lines, to which there are references from the program text, will appear. This list includes everything that the disassembler could detect when analyzing the program. By selecting the required line, you can double-click it and jump to the required program location. If this line is referred to from several locations, you can continue double-clicking to visit all required locations. Fig. 24.4 displays the window containing references to string data types.
Figure 24.4: Window displaying references to strings
As you can see from Fig. 24.4, it is possible to copy either the selected string or all strings into the clipboard.
The list of imported functions and modules is located in the beginning of the disassembled text (Fig. 24.5). In addition, the list of imported functions can be obtained by choosing the Functions Imports menu options. If you select a specific function from the list and double-click it, you'll get all program locations, from which that function is called.
Figure 24.5: Fragment of the list of imported modules and functions
To get the list of exported functions, choose the Functions Exports menu commands.
Resources (or, to be more precise, two main resourcesmenu and dialog) are also described in the beginning of the disassembled text. It is possible to work with the list of resources in special
Strings of the disassembled text can be copied to the clipboard or printed. To select the string, move the cursor to its leftmost position and click the left mouse button. To select a
There are two methods of loading a module for debugging. To load the module that has already been disassembled, choose the Debug Load Process menu commands. The Debug Attach to an Active Process menu options allow you to attach and debug the process loaded into the memory. When the debugger loads, two windows appear on the screen. The first one is the information window (Fig. 24.6).
Figure 24.6: First information window of the debugger
The second window is the control window (Fig. 24.7).
Figure 24.7: Control window of the debugger
The information window contains several list boxes: contents of the CPU registers, processor flag values, breakpoints, contents of segment registers, base addresses, and two data displays. Later in this chapter, I will explain the functions of the buttons located in this window.
Now, consider the control window. The
button starts the program loaded into the debugger, and the
button pauses its execution. The
button stops the program execution and
Note that if you are attaching to the process loaded into the memory, then this process will be unloaded from the memory when exiting the debugger, which might result in incorrect operation of the operating system.
To debug a DLL, you can proceed as
You can set breakpoints in the disassembled listing. To achieve this, go to the required line of code and press <F2> or press <Ctrl> and click the left mouse button. The breakpoint will immediately appear in the information window and in the control window; the
To quickly jump to the required breakpoint, choose it from the list in the information window and double-click it with the mouse. Finally, it is possible to set breakpoints to specific events, such as loading and unloading a DLL or creating and deleting a thread. These goals are achieved by setting an appropriate flag in the information window.
The debugger allows you to modify the code that you loaded previously. To do so, click the Patch Code button in the control window (Fig. 24.8). It is important to note that only the code loaded into the debugger is modified, not the disassembled text. Having found the required location in the code being debugged, you can modify this code and immediately test the result of modification by running the program. If your modification was correct, you can proceed with modifying the module.
Figure 24.8: Window for modifying the code being debugged
To modify the registers and memory
Figure 24.9: Window for modifying the contents of registers and memory cells
The debugger allows you to output additional information about executed API functions. To use this functionality, proceed as follows: Go to the control window and set the following flags:
Enable Documented API Detail
Stop Auto On API.
Then, press <F5> to start the program execution. Every time the program
Quite often, it is necessary to find a location within the disassembled code that corresponds to a specific location within the executable program. The most efficient way of achieving this goal is as follows: Load the required module into the debugger. Then, start it for execution, step to the required position, and click the
button. As a result, the highlighted string in the disassembled code will be at the required position. You should only bear in mind that some programs introduce modifications that
The use of the W32Dasm will be covered in more detail later in this book.
Although W32Dasm works with modules of different types, only PE modules are