RAD Studio
ContentsIndex
PreviousUpNext
TDUMP.EXE, the File Dumping Utility

TDUMP.EXE produces a file dump that shows the structure of a file.  

TDUMP breaks apart a file structurally and uses the file's extension to determine the output display format. TDUMP recognizes many file formats, including .EXE, .OBJ, and .LIB files. If TDUMP doesn't recognize an extension, it produces a hexadecimal dump of the file. You can control the output format by using the TDUMP command-line options when you start the program.  

TDUMP's ability to peek at a file's inner structure displays not only a file's contents, but also how a file is constructed. Moreover, because TDUMP verifies that a file's structure matches its extension, you can also use TDUMP to test file integrity.

TDUMP [<options>] <inputfile> [<listfile>] [<options>]

  • <inputfile> is the file whose structure you want to display (or “dump”).
  • <listfile> is an optional output filename (you can also use the standard DOS redirection command (>).
  • <options> are any of the TDUMP command line options.
To display command line help, enter:  

tdump 

You can use either the / or the - switch character. For example, these two commands are equivalent: 

TDUMP -e1 -v demo.exe 

TDUMP /el /v demo.exe 

 

Option 
Description 
-a, -a7  
TDUMP automatically adjusts its output display according to the file type. You can force a file to be displayed as ASCII by including the ‑a or ‑a7 option.
-a produces an ASCII file display, which shows the offset and the contents in displayable ASCII characters. A character that is not displayable (like a control character) appears as a period.
-a7 converts high-ASCII characters to their low-ASCII equivalents. This is useful if the file you are dumping sets high-ASCII characters as flags (WordStar files do this).  
-b#  
Allows you to display information beginning at a specified offset. For example, if you want a dump of MYFILE starting from offset 100, you would use: TDUMP -b100 MYFILE  
-C  
Causes TDUMP to dump information found in COFF format files (.OBJ and .LIB). This option is useful when linking with Microsoft .OBJ and .LIB files.  
-d  
Causes TDUMP to dump any CodeGear 32-bit debug information found in the .OBJ file. If you do not specify this option, TDUMP displays raw data only.  
-e, -el, -er, -ex  
All four options force TDUMP to display the file as an executable (.EXE) file.
An .EXE file display consists of information contained within a file that is used by the operating system when loading a file. If symbolic debugging information is present (Turbo Debugger or Microsoft CodeView), TDUMP displays it.
TDUMP displays information for DOS executable files, NEW style executable files ( Microsoft Windows and OS/2 .EXEs and DLLs ), Linear Executable files, and Portable Executable (PE) files used by Windows NT and Windows 95/98 and Windows 2000.
  • -e Displays file as Executable (EXE/DLL, DOS, Win16, OS/2, PE)
  • -ea[:v] Displays All Exports unsorted, or (:v) sort by RVA (default dumps only named exports, sorting on the name) a[:v] Displays All Exports unsorted, or (:v) sort by RVA (default dumps only named exports, sorting on the name)
  • -ed Disables EXE debug information
  • -ee[=x] Lists Exports only from EXE/DLL (optional x lists matches only)
  • -el Suppresses line numbers in the display
  • -eiID Includes only .EXE table ID (HDR, OBJ, FIX, NAM, ENT)
  • -em[=x] Lists Imports only from EXE/DLL (optional x lists matches only)
  • -em.[x] Lists Imported modules only from EXE/DLL (optional x search string)
  • -ep Disables EXE PE header display
  • -er Prevents the relocation table from displaying
  • -ex Prevents the display of New style executable information. This means TDUMP only displays information for the DOS "stub" program
 
-h  
Displays the dump file in hexadecimal (hex) format. Hex format consists of a column of offset numbers, 16 columns of hex numbers, and their ASCII equivalents (a period appears where no displayable ASCII character occurs).
If TDUMP doesn't recognize the input file's extension, it displays the file in hex format (unless an option is used to indicate another format).  
-i  
Specifies the debug table(s) to use.  
-l, -li, -le  
Displays the output file in library (.LIB) file format. A library file is a collection of object files (see the -o option for more on object files). The library file dump displays library-specific information, object files, and records in the object file.
The -li option tells TDUMP to display a short form of "impdef" records when dumping import libraries. You can also specify a search string using the following syntax:
-li=<string>
For example, this command:
tdump —li=codeptr import32.lib
results in the following output:
Impdef:(ord) KERNEL32.0336=ISBADCODEPTR
This output shows that the function is exported by ordinal, whose ordinal value is 336 (decimal). In addition, the output displays the module and function name.
If you enter the following command:
tdump —li=walk import32.lib
TDUMP displays:
Impdef:(name) KERNEL32.????=HEAPWALK
This shows the output of a function exported by name.  
-le  
Tells TDUMP to display a short form of the "expdef" records when dumping OBJ files. You can also specify a search string using the following syntax: -le=<string>  
-m  
Leaves C++ names occurring in object files, executable files, and Turbo Debugger symbolic information files in "mangled" format. This option is helpful in determining how the C++ compiler "mangles" a given function name and its arguments.  
o, -oc, -oi, -ox  
  • -o displays the file as an object (.OBJ) file. An object file display contains descriptions of the command records that pass commands and data to the linker, telling it how to create an .EXE file. The display format shows each record and its associated data on a record-by-record basis.
  • -oc causes TDUMP to perform a cyclic redundancy test (CRC) on each encountered record. The display differs from the -o display only if an erroneous CRC check is encountered (the TDUMP CRC value differs from the record's CRC byte).
  • -oi<id> includes only specified record types in the object module dump. Replace <id> with the name of the record to be displayed. For instance: TDUMP -oiPUBDEF MYMODULE.OBJ produces an object module display for MYMODULE.OBJ that displays only the PUBDEF records.
The -ox and -oi options are helpful in finding errors that occur during linking. By examining the spelling and case of the EXTDEF symbol and the PUBDEF symbol, you can resolve many linking problems. For instance, if you receive an "unresolved external" message from the linker, use TDUMP -oiEXTDEF to display the external definitions occurring in the module causing the error. Then, use TDUMP -oiPUBDEF on the module containing the public symbol the linker could not match.
Another use for the -oi switch is to check the names and sizes of the segments generated in a particular module. For instance: TDUMP -oiSEGDEF MYMODULE.OBJ displays the names, attributes, and sizes of all of the segments in MYMODULE.
Note: To get a list of record types for -oi and -ox, use the command line options -oi? and -ox?.  
-r  
Causes TDUMP to display raw data.  
-R  
Causes TDUMP to dump relocation tables from 32-bit PE (Win32) format images. The default is to suppress these dumps.  
-s, -su, -s[xx]  
Tells TDUMP to display strings. By default -s displays all strings in a given file. You can specify a string, or part of a string, using the following syntax:
-s=<string>
For example, the command:
TDUMP -s=black GoGame.exe
results in the following output of all strings containing 'black':
56840: IDI_BLACK
81965: Capture Black
85038: black.bmp
The optional string argument is case insensitive. To specify several words of a string, use quotes. For example:
TDUMP -s="game of go" GoGame.exe
The -su option is used in the same manner, with an optional string argument, and tells TDUMP to display Unix-style strings, meaning with no offset.
For example, the command:
TDUMP -su=black GoGame.exe
results in the following output:
IDI_BLACK
Capture Black
black.bmp
For the -s[xx] switch, xx can be:
  • # - minimum string length to look for (default: 4)
  • b# - Beginning file offset (-b# is the same as -sb#)
  • e# - Ending file offset
  • f - Format (wrap) long strings
  • s - Search string with case sensitivity (default: no)
  • u - unix format: no offset (or decimal offsets, -h for hex)
  • =x - search string = x
 
-um  
Displays mangled names as unmangled. You do not need to reformat the text to edit out only the mangled names before using this option. You can pass output that has mangled names anywhere in the text, and only the mangled names will be affected.  
-v  
Verbose display. If used with an .OBJ or .LIB file, TDUMP produces a hexadecimal dump of the record's contents without any comments about the records.
If you use TDUMP on a Turbo Debugger symbol table, it displays the information tables in the order in which it encounters them. TDUMP doesn't combine information from several tables to give a more meaningful display on a per-module basis.  
-x  
Specifies the debug table(s) to exclude.  
Copyright(C) 2009 Embarcadero Technologies, Inc. All Rights Reserved.
What do you think about this topic? Send feedback!