Disassembler

MHS comes with a powerful Disassembler and built-in debugger. To open the Disassembler, press Ctrl-D or select the Tools/Disassembler menu item.

 

The Disassembler features:

  • Helpful Color Highlighting
  • Quick Go-To Links
  • Many Decoding/Display Options
  • All Instructions Decoded
  • Symbol Names Resolved
  • Loads OllyDbg UDD Files
  • Multiple Tabs
  • ASM Hints

The Helper Window also provides information on:

 

Controls

  • Ctrl-I - Inject Code: Displays the Inject Code dialog. See Injection Manager for more details.
  • Ctrl-G - Go To…: Allows you to go directly to an address.
  • Ctrl-P - Open Current Process: Opens the current process in a new tab. If there is no process opened, no action is performed.
  • Ctrl-D - Debug: Starts the debugger.
  • Ctrl-Shift-D - Detach Debugger: Stops debugging.
  • Ctrl-Z - Undo: All operations performed in the Disassembler can be undone.
  • Ctrl-Y - Redo: All operations undone can be redone.
  • Ctrl-F4 - Close: Closes the current Disassembler tab.
  • Ctrl-Shift-F4 - Close All: Closes all Disassembler tabs.
  • Ctrl-C - Copy: Copies the selected lines of disassembly as text, including the address, code, disassembly, and extra.

 

Links

Mousing over some operand arguments cause them to turn blue. These are links that can be quickly followed. Hold Ctrl and left-click the link to go to its target. Hold Shift to go to the target in a new tab.

Some links can not be followed, and no action will be performed when clicked.

Some links point to data rather than to code, so clicking them will open a new tab in the Hex Editor.

 

JMP/CALL Targets

Mousing over a JMP or CALL instruction causes it, its target, and the code between to be highlighted. This makes it easy to see where a JMP or CALL will go.

You can lock the highlighted area by holding Ctrl and left-clicking while the highlight is shown. After this you can move your mouse away from the instruction and the highlight will remain. You can unlock the highlight by holding Ctrl and left-clicking again anywhere on the Disassembler control.

Copyright © 2006 Shawn (L. Spiro) Wilcoxen