Goto Code Start - This means go to the start of the listing. Navigation over the disassembled code is also simplified by the Goto menu item. In addition, jumps and procedure calls are highlighted specially. When navigating the disassembled code, the current line is highlighted in a different color. If you want to start another working session, you can open the saved project using the Project | Open. wpj file name extension, which represents the project as such. alf file name extension, containing the disassembled text, and another file with the. Every project includes two files: the file with the. By default, the project will be saved in the wpjfiles subdirectory of the W32Dasm working directory. Having completed the work with the module, it is possible to create a working project using the Disassembler | Save Disassembler. 2.9).įigure 2.9: A fragment of the disassembled text W32Dasm correctly recognizes API functions and supplies them with informative comments (Fig. After that, the program will carry out analysis of that module and produce the disassembled text, along with detailed information about the sections existing in the module. To start working with the chosen executable module, it is necessary to choose the required file by selecting the Disassembler | Open File. As you can see, all debugger options relate to the specific features of loading processes, threads, and DLLs.įigure 2.8: The W32Dasm Debugger Options window The W32Dasm Debugger Options window is shown in Fig. Principally, disabling these options might be necessary if you are going to disassemble a large program, because this would slightly speed up the process of program code analysis.ĭebugger options are more numerous however, all of them are self-evident. It is undesirable to disable these options because this reduces the information content of the disassembled code. For the disassembler, there are only three options related to the analysis of the cross-references in conditional jumps, unconditional jumps, and procedure calls. Accordingly, there are individual settings both for the disassembler and for the debugger. This is reflected by the presence of the two menu items: Disassembler and Debug. The main menu is supplemented by the toolbar, elements of which are activated depending on the situation.įigure 2.7: The main window of the W32Dasm programĪs already mentioned, this program is a combination of a debugger and a disassembler. The main window of the W32Dasm program is shown in Fig. In this section, this program will be covered in detail. Versions 8.93 and 10 of this program, which are the most widely used nowadays, can work not only with PE modules but also with DOS, NE, and LE modules. The Windows Disassembler (W32Dasm) program is a symbiosis of a powerful debugger and a disassembler.

W32dasm 10