
                    
                    
DexDebug v1.01b 32-bit (March 14 1997)
Copyright (c)1994-1997 Dejan Kaljevic
All Rights Reserved
(Web: http://www.net.yu/~dejan)
(eMail: dejan@net.yu)






===============
DEXDEBUG MANUAL
===============


Contents:

1. DESCRIPTION
2. WORKING LAYOUT
3. BREAKPOINTS REFERENCE
4. MISCELANEOUS COMMANDS










1. DESCRIPTION



After succesful loading, DexDebug installs DPMI and stays resident,
taking full control over the machine. This is 32-bit debugger designed
for analysing 32-bit programs. Monitoring standard DPMI entry point, 
debugger will activate itself automatically when program tries to 
enter DPMI mode. Still, there is another way to start debugging - using 
command line sytax:
    
    dexdebug <program> [<program parameters>]

DexDebug recognizes and decodes *all* documented Intel x86 processor 
family instructions - and even undocumented ones!





2. WORKING LAYOUT




DexDebug workspace is divided into several windows:

CPU Window
Registers Window
Flags Window
Stack Window
Memory Window
Command Line Window

You can switch between windows using TAB key, except when entering 
command in Command Line Window.


2.1 CPU Window
--------------

Main window. This window displays program disassembly code. Black
triangle pointer shows current CS:EIP position; blue line cursor 
is used as a movement pointer for various tasks (ie. when setting
breakpoints). Available actions in this window are:

[Movement]

Cursor Up/down       Navigate through program code one line at a 
                     time (just blue line pointer movement, no 
                     program execution)
Cursor Left/Right    Scroll CPU window content left/right            
PgUp/PgDn            Previous/next page of instructions
Home                 Return to current instruction (CS:EIP)

[Commands]

Esc                  Exit from debugger
Tab                  Next debugger window

F1                   Enter command line mode
F2                   Toggle breakpoint. This is a software INT3 
                     breakpoint so you cannot set it at ROM address.
                     For ROM address breakpoints use BPX. Breakpoint
                     is displayed in red.
F4                   Run to blue cursor
F5                   Switch between debugger and program window
F6                   Trace In. This command traces even interrupt
                     routines.
F7                   Trace (no entering INT routines)
F8                   Step Over. 
                      

2.2 Registers Window
--------------------

This window displys current register content. Highlighted values 
indicate that the last executed instruction (or routine) caused 
register change. 

Placing pointer over the register and pressing Enter key allows
you to change register value. 


2.3 Flags Window
----------------

This window displays some of the flags from EFLAG register. Placing 
pointer over the flag and pressing Enter key allows you to change 
its state. 


2.4 Stack Window
----------------

This window displays current SS:ESP position. You can browse through
stack within this window.

2.5 Memory Window
-----------------

This window shows memory content at specified location. In this window
you can directly view/change memory content. Press F2 to enable/disable
edit.

To specify an address to display, enter command line mode by pressing F1,
and then execute one of the following commands:

E <segment:offset>        ; for editing memory content
D <segment:offset>        ; for viewing memory content

Seg:offset values are entered in hexadecimal.


Arrow keys, PgUp and PgDn are used for navigating through memory content.


2.6 Command Line Window
-----------------------

Command line mode is entered by pressing F1 key while in any other window. 
To exit this mode, press Esc. DexDebug remembers up to nineteen executed 
commands, so you can recall them at the command line using arrow keys. 

DexDebug recognizes command abbreviations - just type part of the command
displayed uppercase in HELP line. Commands are case insensitive.

All numbers are entered in hexadecimal, except IRQs and breakpoint numbers.






3. BREAKPOINTS REFERENCE


3.1 Breakpoint types
--------------------

DexDebug supports several breakpoint types. They can be set on the command
line.


------
BPDPMI  Break upon entering DPMI
------

Usage: BPDPMI ON/OFf (ENable/DIsable)      ;default: ON


-----
BPIRQ Break on IRQ generated
-----

Usage: BPIRQ <IRQ num> ON/OFf (ENable/DIsable)  ; IRQ num = 0-15

Upon entering this breakpoint, DexDebug shows IRQ proc address.


-----
BPINT Breakpoint on interrupt
-----

Usage: BPINT <INT num> [<condition>]      ; INT num = 0 - FF

  where <condition> must be in form <register> <qualifier> <value>.
      <register>   can be any of the following: 
                   EAX, EBX, ECX, EDX, ESI, EDI, EBP, ESP, 
                   CS, DS, ES, FS, GS, SS, EIP, EFL,     
                   AX, BX, CX, DX, SI,DI, BP, SP, IP, FL,
                   AL, AH, BL, BH, CL, CH, DL or DH
      <quailifier> can be any of the following:
                   =   ; equal
                   !=  ; not equal
                   >   ; greater than
                   <   ; less than
                   >=  ; greater than or equal
                   <=  ; less than or equal
      <value>      hexadecimal value 



----
BPMB Breakpoint on memory range access (range size = 1 byte)
---- 

Usage: BPMB <segment:offset> <X|R|W|RW> [<condition>] 
  where X stays for 'executon'
        R stays for 'read'
        W stays for 'write'
        RW stays for 'read or write'

  <condition> has the same form as in BPINT syntax.

Seg:offset values are entered in hexadecimal.


----
BPMW Breakpoint on memory range access (range size = 2 bytes)
---- 

Usage: BPMW <segment:offset> <X|R|W|RW> [<condition>] 

Parameters are the same as in BPMB syntax. Address <seg:offset>
must be WORD aligned.


----
BPMD Breakpoint on memory range access (range size = 4 bytes)
---- 

Usage: BPMD <segment:offset> <X|R|W|RW> [<condition>] 

Parameters are the same as in BPMB syntax. Address <seg:offset> 
must be DWORD aligned.


----
BPMX Breakpoint on execution       
----

Usage: BPMX <segment:offset> [<condition>]
  
  where <condition> has the same form as in BPINT syntax.

Seg:offset values are entered in hexadecimal.


3.2 Breakpoint manipulation
---------------------------

Breakpoint manipulation includes setting, enabling, disabling, listing 
and clearing breakpoints.

--
BC Clear breakpoint
--

Clears breakpoint(s). This command cannot be used with BPDPMI and BPIRQ
breakpoint types - they must be disabled first.

Usage: BC <breakpoint num>

where <breakpoint num> is any valid breakpoint number specified in
decimal. You can clear all breakpoints at once specifying BC* or BCC
command.

--
BD Disable breakpoint
--

Disables breakpoint. 

Usage: BD <breakpoint num>

where <breakpoint num> is any valid breakpoint number specified in
decimal.

--
BE Enable breakpoint
--

Enables breakpoint. 

Usage: BE <breakpoint num>

where <breakpoint num> is any valid breakpoint number specified in
decimal.

--
BL List breakpoints
--

Usage: BL





4. MISCELANEOUS COMMANDS



----
CODE Display instruction opcodes (on/off)
----

Usage: CODE <ON|OFf>
       
Display column width can be set using CODE <columns> syntax, where
<columns> is a decimal number that specifies how many CODE columns to 
display. CODE ON restores default 8-bytes column width.

---------
SMARTSWAP <ON|OFf>
---------

By default, DexDebug uses SmartSwap (tm) technology to decide whether to
display program output. Normally, this behaviour should be enabled. But in 
some circumstances (ie. when some specific display drivers are loaded) 
you may experience difficulties in DexDebug operation. In these cases, 
SMARTSWAP OFF will force DexDebug to restore program screen after every 
executed instruction (causing flickering).