At times you need to browse through some code (sometimes it's even your own code) following subroutine calls, conditional jumps, etc. wherever they might go. To make this task easier, use the s-F1 and s-F2 keys. To disassemble at the target of some instruction which transfers control, place the instruction at the top of the disassembly window and press s-F1. For example, say at offset 1234 in the code segment there is a CALL 5678. Place the CALL at the top of the disassembly window and press s-F1. The disassembly window now displays the code at 5678 with an invisible bookmark left at the calling address 1234. Each time s-F1 is used, it leaves a bookmark at the instruction at the top of the disassembly window and disassembles at that instruction's target. To return to the previous bookmark, press s-F2. 386SWAT supports up to 128 nested levels of such disassembly.
As another example, you should be able to disassemble almost any interrupt (say, U .VMI21 which disassembles at VM interrupt 21h), and using the bookmark feature exclusively, go down to the bottom of the chain.
This feature is clever, but not that clever. It can figure out where (say)
JMP Dword Ptr CS:[1234]
is going and disassemble at that target, but it can't figure out the same instruction with a DS override. Nor can it handle effective addresses other than ones with an immediate displacement only (i.e., no registers such as [BX+SI]).
 NARS2000 © 2006-2020 |
|
| Comments or suggestions? Send them to . | |