SymbolView 2.1.2

[SymbolView.wlx]
dumps .lib export maps (exported functions),IDL of COM objects and PE file structures, contained inside .ocx, .tlb, .dll  or .exe in a human readable way (it uses the Microsoft's Interface Description Language).
Supported extensions: .lib, .ocx, .tlb, .exe, .dll and all PE file (starting with "MZ" signature)
All executable PE format files, are recognised by this application, them are recognised using the "MZ" signature (the first two bytes in ascii are "MZ").

Installation
-------------
To install add these two lines to your wincmd.ini

1) copy the .wlx file in a proper folder, where you place lister's extensions and modify the wincmd.ini as following
[ListerPlugins]
0=D:\wincmd\LS-plugin\SymbolView.wlx

where you'll have to adjust the path in the above example to your real one and the number (it's a simple numerical order value, no bit-wise flags inside it as the packer or file-system extensions do).

2) Copy the PEDUmp.DLL, UndSymbol.dll in the *same* directory where the .wlx file has been placed (if you wish them can also be in the TotalCommander main instllation directory).

3) If you have WIndows98/ME copy DbgHelp.dll in the *same* directory where the .wlx file has been placed

Usage Instructions
-----------------------
The first time the wlx is used it creates a standard systeminfo.ini file with values taken from the wincmd.ini file [Lister] section. After this you have to modify this default ini file with your settings.

A particular attention must be paid to the voice PEFlags in the symbolview.ini. It contains the parameters that will be passed to PEDUmp.dll. In particular to see the help file set this voice to HELP -> PEFlags=HELP. In this case the shown text will be a brief help of available settings.

Here it is also too:

	Available switches (all are optional)
	  A    include everything in dump
	  B    show base relocations
	  H    include hex dump of sections
	  I    include Import Address Table thunk addresses
	  L    include line number information
	  P    include PDATA (runtime functions)
	  R    include detailed resources (stringtables and dialogs)
	  S    show symbol table
	  U    Undecorate all functions names (name demangling), only support Microsoft's Syntax 
	  
	Warning: now you should change the voice PEFlags in symbolview.ini properly

You can have a default behaviour leaving this voice empty or simply to not write it. It reports most useful informations such as export table, used API and so on.

Examples.
PEFlags=  or not placing this voice -> default behaviour
PEFlags=LHPS -> applies options L, H, P, S, see above help (no spaces required)
PEFlags=A -> applies all available options (equivalent to PEFlags=BHILPRS)
PEFlags=XXX -> unknown options are ignored, equivalent to PEFlags= with nothing on right side of equal sign)
PEFlags=HELP -> instead of the translated file content shows the above help.

Note that you can modify these setting as many times as you want without restarting TC, because them are read each time the Lister's starts.

Symbols demangling
--------------------------
Through an API contained in DbgHelp.DLL (UnDecorateSymbolName()) now the program support library name undecoration/demangling in Microsoft format. This DLL is already in the system only for Win2000/XP, in anycase in this archive there's a version that can be used on all Windows Systems (I tested it on Win98/ME and Win2000).
Demangled names are placed between " ". 
* Note that not always demangler is able to get meaningful names, there's nothing to do with it. Demangling algorithm is not public and the only implementation is through the API I used.

 For a literature review of the method used see: http://www.kegel.com/mangle.html
 The official distribution of the "Debugging Tools for Windows" including DbgHelp.dll is here http://www.microsoft.com/ddk/debugging/ The version included in this distribution is 6.1.17.0, suitable for all Windows systems

Files in this archive
-----------------------
 CorrectKeys.reg - an example of correct regitry entries if you have problems. Before inserting in the registry adjust to your real installation path the InstallDir key.
 DbgHelp.dll - Microsoft Debug Help DLL. It's already included in WindowsNT/2000/XP, for Windows98/ME it must be placed somewhere in the path (for example in the TotalCommander's installation folder)
 readme.txt - this file ^__^
 SymbolView.wlx - the artwork matter of this whole archive
 SymbolView.ini - an example of ini file (use it as is or modify or do not copy it to let wlx automagically create a new one)
 PEDUmp.DLL - the DLL used to dig inside PE files, made specifically for this wlx
 UndSymbol.dll - a DLL that worries of Undecorating names, it's separated because it requires MFC Debugger library that not all people have. 

Suggestions:
---------------
1) set FontFace to a not proportional font, such as Courier, to keep formatting well done.
2) for big files it can take a long time before getting results, at the moment everything is in one thread, so this operations blocks the lister.
3) CTRL + Mouse wheel zooms out and in the font used by this plugin (it's a property of used RichEdit control).

Problems:
-----------
1) If you get messages such as MFCxxd.DLL is missing, please place in systeminfo.ini UndecorateNames=0. This is because undecoration need debugger libraries loaded by the UndSymbol.dll that is loaded only when the UndecorateNames ini key is set to 1. The best solution in this case is to remove UndSymbol.dll at all.
Debugger versions of MFC libraries can be downloaded from MSDN Microsoft's site or are installed with VisualC++

Acknowledgements
------------------------
To write this plugin I used some code from other people:
- Christian Ghisler with his demo plugin
- George Poulose, for his LibDump. http://gpoulose.home.att.net/
- Matt Pietrek, for his PEDump program and his excellent articles on PE format. http://www.wheaty.net/

History
---------
1.0 Nov 2002 -first public release
1.1 Dec 2002 
	- fixed sharing violation with COM object containers (after view were possible to delete files, only after 
	  closing TC)
2.0 Dec 2002
	+ added PEDUmp.dll which dumps PE files informations with huge customizable detail levels (see section above)
	+ added moved setting to systeminfo.ini 
	+ added all the outputs are tab sensitive
2.1 Dec 2002
	+ added undecoration of lib and DLL symbols (use setting UndecorateNames=1) with Microsoft syntax, see above note about the used DbgHelp.dll
	+ PEDUmp.dll v1.1 now supports demangling
	+ added now searching function correctly tells if nothing has found
	- fixed now search starts from begining of file if nothing has found from where cursor was
	- fixed, now tries to find in the registry the wincmd.ini location, but anyway asks to the user to confirm found value or navigate to the correct one (uses a shell extension as dialog) and stores it in the TCinipath ini key
	+ added, if the TCinipath value is incorrect proposes a dialog box to browse to the correct location
	+ demangle "import table" and "export table" for any PE files (may take long time, so it's by default disabled)
2.1.1 Dec 2002
	- fixed, usage of debugger DLL: the demangling function require them, so I isolated the points where them are used into a separate DLL that is compiled with debugger extensions. This problem is the reason why version 2.1 on some system wasn't launched at all.
2.1.2 Dec 2002
	- more descriptive errors when UndSYmbol.dll is missing
	+ added a beep when search restart from beginning of file
	- fixed, now the only debug DLL used is MSVCRTD.DLL also reported in this archive
	- fixed wlx distribution has been aspacked

Known Issues
----------------
1. with large .lib files the plugin becomes slow
2. with even larger files the RichEdit controls comes to its limits and displays strange things
3. add a dialogbox to dinamically change setting pressing the right mouse button

Bug Report
--------------
Report any bug to zapped@libero.it with a mail containing the name of the extension such as following
"[SymbolView] subject goes here" to allow mine automatic filters to go in action ^__^

Author
---------
Frumento Enrico, zapped@libero.it  (http://web.cefriel.it/~frumento)
