TDUMP.EXE produces a file dump that shows the structure of a file.
TDUMP breaks apart a file structurally and uses the file's extension to determine the output display format. TDUMP recognizes many file formats, including .EXE, .OBJ, and .LIB files. If TDUMP doesn't recognize an extension, it produces a hexadecimal dump of the file. You can control the output format by using the TDUMP command-line options when you start the program.
TDUMP's ability to peek at a file's inner structure displays not only a file's contents, but also how a file is constructed. Moreover, because TDUMP verifies that a file's structure matches its extension, you can also use TDUMP to test file integrity.
TDUMP [<options>] <inputfile> [<listfile>] [<options>]
tdump
You can use either the / or the - switch character. For example, these two commands are equivalent:
TDUMP -e1 -v demo.exe
TDUMP /el /v demo.exe
Option |
Description |
-a, -a7 |
TDUMP automatically adjusts its output display according to the file type. You can force a file to be displayed as ASCII by including the ‑a or ‑a7 option. -a produces an ASCII file display, which shows the offset and the contents in displayable ASCII characters. A character that is not displayable (like a control character) appears as a period. -a7 converts high-ASCII characters to their low-ASCII equivalents. This is useful if the file you are dumping sets high-ASCII characters as flags (WordStar files do this). |
-b# |
Allows you to display information beginning at a specified offset. For example, if you want a dump of MYFILE starting from offset 100, you would use: TDUMP -b100 MYFILE |
-C |
Causes TDUMP to dump information found in COFF format files (.OBJ and .LIB). This option is useful when linking with Microsoft .OBJ and .LIB files. |
-d |
Causes TDUMP to dump any CodeGear 32-bit debug information found in the .OBJ file. If you do not specify this option, TDUMP displays raw data only. |
-e, -el, -er, -ex |
All four options force TDUMP to display the file as an executable (.EXE) file. An .EXE file display consists of information contained within a file that is used by the operating system when loading a file. If symbolic debugging information is present (Turbo Debugger or Microsoft CodeView), TDUMP displays it. TDUMP displays information for DOS executable files, NEW style executable files ( Microsoft Windows and OS/2 .EXEs and DLLs ), Linear Executable files, and Portable Executable (PE) files used by Windows NT and Windows 95/98 and Windows 2000.
|
-h |
Displays the dump file in hexadecimal (hex) format. Hex format consists of a column of offset numbers, 16 columns of hex numbers, and their ASCII equivalents (a period appears where no displayable ASCII character occurs). If TDUMP doesn't recognize the input file's extension, it displays the file in hex format (unless an option is used to indicate another format). |
-i |
Specifies the debug table(s) to use. |
-l, -li, -le |
Displays the output file in library (.LIB) file format. A library file is a collection of object files (see the -o option for more on object files). The library file dump displays library-specific information, object files, and records in the object file. The -li option tells TDUMP to display a short form of "impdef" records when dumping import libraries. You can also specify a search string using the following syntax: -li=<string> For example, this command: tdump —li=codeptr import32.lib results in the following output: Impdef:(ord) KERNEL32.0336=ISBADCODEPTR This output shows that the function is exported by ordinal, whose ordinal value is 336 (decimal). In addition, the output displays the module and function name. If you enter the following command: tdump —li=walk import32.lib TDUMP displays: Impdef:(name) KERNEL32.????=HEAPWALK This shows the output of a function exported by name. |
-le |
Tells TDUMP to display a short form of the "expdef" records when dumping OBJ files. You can also specify a search string using the following syntax: -le=<string> |
-m |
Leaves C++ names occurring in object files, executable files, and Turbo Debugger symbolic information files in "mangled" format. This option is helpful in determining how the C++ compiler "mangles" a given function name and its arguments. |
o, -oc, -oi, -ox |
Another use for the -oi switch is to check the names and sizes of the segments generated in a particular module. For instance: TDUMP -oiSEGDEF MYMODULE.OBJ displays the names, attributes, and sizes of all of the segments in MYMODULE. Note: To get a list of record types for -oi and -ox, use the command line options -oi? and -ox?. |
-r |
Causes TDUMP to display raw data. |
-R |
Causes TDUMP to dump relocation tables from 32-bit PE (Win32) format images. The default is to suppress these dumps. |
-s, -su, -s[xx] |
Tells TDUMP to display strings. By default -s displays all strings in a given file. You can specify a string, or part of a string, using the following syntax: -s=<string> For example, the command: TDUMP -s=black GoGame.exe results in the following output of all strings containing 'black': 56840: IDI_BLACK 81965: Capture Black 85038: black.bmp The optional string argument is case insensitive. To specify several words of a string, use quotes. For example: TDUMP -s="game of go" GoGame.exe The -su option is used in the same manner, with an optional string argument, and tells TDUMP to display Unix-style strings, meaning with no offset. For example, the command: TDUMP -su=black GoGame.exe results in the following output: IDI_BLACK Capture Black black.bmp For the -s[xx] switch, xx can be:
|
-um |
Displays mangled names as unmangled. You do not need to reformat the text to edit out only the mangled names before using this option. You can pass output that has mangled names anywhere in the text, and only the mangled names will be affected. |
-v |
Verbose display. If used with an .OBJ or .LIB file, TDUMP produces a hexadecimal dump of the record's contents without any comments about the records. If you use TDUMP on a Turbo Debugger symbol table, it displays the information tables in the order in which it encounters them. TDUMP doesn't combine information from several tables to give a more meaningful display on a per-module basis. |
-x |
Specifies the debug table(s) to exclude. |
Copyright(C) 2008 CodeGear(TM). All Rights Reserved.
|
What do you think about this topic? Send feedback!
|