Date post: | 01-Apr-2015 |
Category: |
Documents |
Upload: | christiana-oakley |
View: | 217 times |
Download: | 0 times |
DAT2343
File Analysis with MicroSoft DEBUG
© Alan T. Pinck / Algonquin College; 2003
Starting a DOS Window in XP
• Start – Run – (command)or• Start – Programs – Accessories – Command Prompt
(slight variations may exist between this and different installations of XP or other Windows Operating Systems)
DOS Windows Controls in XP
It is often useful to be able to mark and copy text from a DOS window (to be pasted into some other application file).
By left-clicking on the title bar icon and selecting Edit from the drop-down menu, it is possible to mark and then copy text from a DOS window.
(Other Windows OS’s provide icon tools to do this on the title bar).
Running DEBUG from the DOS prompt
At the DOS prompt, type:DEBUG
and hit <Enter>
DEBUG will respond with its prompt symbol, the dash
-
Examining a File in DEBUG
At the DEBUG prompt, enter:N followed by the filepath for the file to be examined This identifies the file Name to DEBUG
L This tells DEBUG to Load the file
D This tells DEBUG to Display or Dump
Sample DEBUG File Display
Copying the Hex Contents for Analysis
4A 70 20 33 45 20 64 52-35 32 C8 FE 44 61 64 20FF FF CD 21 80 3C 00 74-06 BA DA 89 34 00 CA 0A08 98 80 FC 3A 74 02 B0-40 8A 0E 24 99 0C 20 2C60 A2 C2 96 A0 07 98 8A-26 6A 98 25 02 02 0A C0
Use the DOS Windows controls to copy a few lines of the hexadecimal file contents into a NotePad or similar file to work with; set the font to Courier New or some other non-proportional font:
Quitting DEBUG
In order to exit or “quit” the DEBUG program, enter
Q
at the DEBUG prompt
(Return to the file where you pasted the hexadecimal file contents)
Sample Analysis of the “Dump”
Suppose that the file contained records composed of a 4 (ASCII) character field followed by a (2-byte) integer field (2’s complement, little Endian).
The first two records could be extracted from the dump as:
4A 70 20 33 45 20 64 52 35 32 C8 FE
Analysis of First “Dump” Record
4A 70 20 33 45 20 4 ASCII characters:
4A 70 20 33 Using an ASCII table this translates into “Jp 3”
2-byte integer field 45 20 (little Endian form)
Using standard 2’s complement conversion:2045(hex) = 8261(dec)
Summary of DEBUG Commands
Nfilepath Name file to be used
L Load previously named file
D or Dxxxx Dump/Display memory contents (starting at offset
xxxx)
Q Quit DEBUG
End of Lecture