Exports
If you have worked with Win32 executables before and especially DLLs, the presence of the Exports node should come as no big surprise. Keep in mind though that plain old programs can sometimes contain exports as well. Also, if you have some familiarity with ActiveX modules like MSSCRIPT.OCX, the presence of DllCanUnloadNow, DllRegisterServer, etc. should also be expected. See Figure 4:
Figure 4
Expand the Exports node and double-click (or select View/Disassemble from the main or popup menu) at random one of the items to open a disassembly window, the second entry-point.
Debug/Debug Symbols
If you have access to debug symbols for the system DLLs and have set up PEBrowse correctly, expanding the "Debug" and "Debug Symbols" nodes should produce a large number of entries, as in Figure 5:
Figure 5
If there is only a "CodeView" node showing, try the following:
1) Close the file (File/Close File);
2) If you have the _NT_SYMBOL_PATH environment variable set, change in the configuration dialog box on the Debug Symbols tab sheet the radio button selection under "Debug Symbols Location" to "_NT_SYMBOL_PATH" (or select one of the other options as appropriate);
3) Reopen the file.
Further help is available by selecting File/View DbgHelp Log. You may find the display in Figure 5 does not match what you are currently viewing, but is showing instead an alphabetical listing of debug symbols for MSSCRIPT.OCX. I have checked the option, "Display debug symbols in a class hierarchy?" for this image. If you wish to view symbols using a class hierarchy now, change your selection in the configuration dialog box Environment tab sheet and then select View/Refresh. Again, disassemble one of the items for a third entry-point.
 prev page | 1st page | next page  |