What are DSF files DSF files contain the symbols of the exports from different BPL libraries. DeDe disassemble engine use this symbol files to comment the class members method calls in ASM source it generates. The ideology is very close to the IDA symbol files for VCL, MFC etc. If you haven't loaded a symbol file for any BPL you wont get references to calls to this BPL classes! How to load DSF files You can load a DSF file using File|Load Symbol File menu selecting the dsf file. If you want some dsf files to be loaded automaticly each time DeDe is loaded use the View|Configuration menu and from Symbols tab manage the dsf that should be loaded at startup of DeDe. If you want to see the names of exports that are contained in a certain DSF file use the View|Symbols menu. Why should i create DSF files Because if you deal with a program that uses custom components and you have the components BPLs if you create a DSF for these components DeDe will comment for you all the calls to those components. Nice uh? :) Also the creation of DSFs is very fast. What are DOI files DOI = Delphi Class Offset Information. This technology uses offset information to recognize class members - methods and fields. The DOI files contains the needed data for recognition and DeDe emulates instructions and find references using those offsets. For example at offset CC from the beginning of any class that derives from TForm stays the pointer to ShowModal method. So when call [reg + $00CC] is called and the emulator knows that reg contains object from such class it puts reference to TForm.ShowModal. The DOI files should reside in the DSF folder. This is a simple generated code with the help of DOI: * Reference to control LogMemo : TMemo | 004E4E7C 8B80F4020000 mov eax, [eax+$02F4] * Reference to field TMemo.Lines : TStrings | 004E4E82 8B8004020000 mov eax, [eax+$0204] * Possible String Reference to: 'Loading Export Names ...' | 004E4E88 BA0C584E00 mov edx, $004E580C 004E4E8D 8B08 mov ecx, [eax] * Reference to method TStrings.Add(string) | 004E4E8F FF5134 call dword ptr [ecx+$34] How do i use DOI files Copy the joined *.DOI files in the DSF folder. The DOI file data should be included automatically in the generated code. What is this: show all found references. Recognizing of a procedure calls is made by comparing bytes. Sometimes (depending how many DSFs you have loaded) there are more than one procedure with the same byte pattern. In this case DeDe is unable to determine exactly whitch one is called. If you check this option DeDe will show you all references if it finds more than one. If this is unchecked you will see only the first found reference. Note: The search orded is by the order of loaded DSFs and then alphabeticaly by unit name, class name, procedure name. What is this : String references. Normaly programs like W32DASM for example search only for english string references. If you deal with a program that has other language strings then from here you can choose the set of chars DeDe disassemble engine will search string references. Note: You may have invalid referencec if you use the full set #32-#255. Note: delphi programs normaly do not use UNICODE strings and thats why this option is not included in string references configuration. Can i save the processed target? Yes there is such an option. In general DeDe is very fast so you may not need this. After saving a project do not try to open it, if the same target is processed in DeDe. You will have problems. If you open a project file you will be able to disassemble and use all DeDe options except one - saving delph project space. If you want to do this you have to reprocess the target again! Why Dede says : This is not a Delphi Program. 1-st make sure the target is not packed or crypted 2-nd if you have unpacked/dumped the target make sure it has a valid entry point and also valid section names. A normal delphi program has these sections: 'CODE', 'DATA', 'BSS', '.idata', '.tls', '.rdata', '.reloc', '.rsrc'. If it is a dll it will also have '.edata' section. If you are sure the target is OK and it is a delphi program, then you are dealing with one of those delphi programs that are processes somehow to fool DeDe and other similar programs. I'm working over the engine to recognize such stupid tricks that make DeDe to fail (in a different way, exceptions). So I will appreciate if you send me a mail with your target name and problem description. Various Tips.
|
|