Top > Product Version << Back

(Cover art supplied by ISFDB)


Specification in Disassembler AGNSS


<New Features of Disassembler AGNSS 2.60>

* All CPU instructions in Pentium IV (Multi-Data instructions, SIMD 2, etc.) are supported.
* All CPU instructions in Pentium III (Multi-Data instructions, SIMD, etc.) are supported.
* All CPU instructions in Pentium Pro (conditional move instructions, cmov, etc.) are supported.
* All CPU instructions in MMX Pentium (MMX instructions, etc.) are supported.
* Making source files is extended to all executable files in Windows 95, 98, and Windows 2000/NT/XP.
* Supported the new mechanism that enables to automatically judge offset operators or immediate values correctly for EXEs with no relocations.
* All of three moveable versions (MSDOS/Con32/Win32) are included in the product version.

Also,
* In output source for Windows 95/98/2000/NT/XP, offset operators and data labels are completely resolved. That is, in output assembly source generated by the fully automatical mode, there is no lack of offset operators/data labels and there is no redundant ones, and so, by reassembling/relinking, you can make the executable file that can move almostly as it is.

* TD32's TDS (Borland's debug information) in Windows 95/98/2000/NT/XP is completely supported. By this, using CGN2 of DCC 2.60, you can make TDS directly from MAP file generated by AGNSS, and so, you can execute source-debugging immediately by the output assembly sources.

* Command files to restore the complete C source files for Decompressing tools, Disassembling module and PE Dumping Tool are included. (DCC 2.60 is needed to restore C source files.)

* For Windows EXEs and DLLS, the complete resource files and the complete module-definition files are ouput, and hence you can reassemble and relink the assembly sources by using file-divisional mechanism of AGNSS. Furthermore AGNSS completely supports import/export symbols in Windows, label/segment/group symbols in OBJ, symbol files such as SYM and TDS, and rename files by users, so that you can enhance the readability of the output sources by renamed labels.


<Characteristics of Disassembler AGNSS>

[1] Delinking
As the output source being able to be DIVIDED INTO ANY MODULE FILES, and the makefile being output in order to reassemble and relink the module files, you can reassemble and relink them only by executing a make-utility for the makefile, even for a more than 100KB executable input file, which can be neither reassembled nor relinked by the existing disassemblers. That is, it is very easy to extract, i.e., delink OBJ files from a huge EXE file.

[2] Debug Information
As the MAP FILE being output, you can execute source-debugging the original executable input file directly in terms of the source files output by AGNSS, by using MAPSYM/SYMDEB or TDMAP/TD386. (Note i)

[3] INT/IO Access Information
As all INTERRUPT and IN/OUT-PORT ACCESSES being output, followed by each addresses and each adequate comments, into the dump file, you can know briefly the summary of features of the original executable input file in advance of analyzing it.

[4] Call Flow Diagram
As the correrative calling relation in all funcions and procedures within EXE is output in simple tree structure, you can know completely the whole structure of the original executable input file in advance.


Target CPU: 8086-586/8087-387/Real-Protect mode/Pentium IV
Target System: MS-DOS/Windows3.0-3.1/Windows 95/98/2000/NT/XP/ Dos-Extender/ROM
Size of Input Files: up to 16MB
Type of Input Files: EXE/DLL/EXP/COM/SYS/OBJ/MEM/LIB/RES/SYM/TDS
Output Ascii Files: ASM/LST/CTR/CFR/MAK/LOG/MSG/DMP/MAP/DEF/RC
Output Binary Files: BIO/386/RES/CUR/ICO/BMP/FNT/USR
Executable Environment (MSDOS version):
General-use in MS-DOS machine on Intel 80X86-CPU
(after MS-DOS 2.11)
Executable Environment (32-bits Windows version/32-bits Console version): (Note iii)
General-use in 32-bits Windows on Intel 80X86-CPU
Virtual memory: EMS/XMS (Only in MSDOS version)

(Note i) MAPSYM/SYMDEB/MASM/MS-DOS/Windows are the products of Microsoft.
TDMAP/TD386/TD32/TASM are the products of Borland International.
(Note ii) DCC is an abbreviation of DeCompiler for C.
AGNSS is an abbreviation of Automatically GeNErating Source System.
AGNES is a nickname of AGNSS, or the name of a main process in Disassembler.
(Note iii)
As product versions for AGNSS, we supply three kinds that are different
only in the executable environment.
32-bits Windows version (Win32 version) is moveable as a GUI application
in 32-bits Windows (Windows 95/98/2000/NT/XP).
32-bits Console version (Con32 version) is moveable as a 32-bits
console application in 32-bits Windows (Windows 95/98/2000/NT/XP).
MSDOS version is moveable as a 16-bits application in MSDOS.
The three moveable versions have the same input/output files and
the same mechanism. They are the almost same in speed in execution.
(When MSDOS version is moved in MSDOS window of Windows, its speed
becomes slower ten times because Windows simulates MSDOS.)
The mechanism that MSDOS version has, but Windows 95 and 32-bits Console
version do not have, is only 'bio' command to automatically create
source files from the memory space.
The product version of AGNSS includes all of those moveable versions, Win32, Con32, and MSDOS.

Target CPU:
Intel 8086 to 80586, real and protect mode. MMX instructions in MMX Pentium (586), conditional move (cmov) in Pentium Pro, and SIMD in Pentium III and IV are perfectly supported.

Target executable file:
executable files (EXE,DLL,COM,SYS,etc.) in MS-DOS or Windows 3.0-3.1/Windows 95/98/2000/NT/XP, OBJ files (16/32-bits OMF format), and memory files. For PharLap DOS-EXTENDER, OBJ and simple EXP are supported. Up to 16MB file size as executable ones. Also supported to automatically convert the memory spaces up to 1MB into source files (Only in MSDOS version).

Executable environment of AGNSS (MSDOS version):
General use in all MS-DOS machines mounted by Intel 80X86-type CPU's. The high capacity browser of AGNSS also moves in all MS-DOS machines. (ANSI.SYS needs to be installed in IBM and its compatible machines). 640KB and more of mounted conventional memory. 450KB and more of available conventional memory. Version 2.11 and above in MS-DOS.

Executable environment of AGNSS (32-bits Windows version/32-bits Console version):
General-use in 32-bits Windows running on Intel 80X86-type CPU's. There is no restriction in mounted memory chips.

Virtual memory:
EMS and XMS perfectly supported (Only in MSDOS version). Moveable in file mode on disk in case of without any virtual memory.

Supported assemblers to reassemble and relink:
MASM and TASM.

Main output files:
Makefile (.MAK) is automatically output to reassemble and relink. Assembly sources (.ASM/.INC) and list file (.LST). In Windows, as the complete resource file (.RC) and module definition file (.DEF) being output, you can reassemble and relink the source files only by executing a make-utility (MAKE.EXE) for the makefile. Map file (.MAP), dump file (.DMP), logging file (.LOG), message file (.MSG), and so on.

Automatical comments:
Automatical comment files for INT/IO accesses and VMM functions in Windows are supplied in the form of editable ASCII files.

FP instructions:
All floating-point (FP) instructions up to 80387, conditional move (fcmov) in Pentium Pro, and SIMD (fcom, etc.) in Pentium III are perfectly supported. In emulation (INT 34H to 3DH), the corresponding FP instruction is displayed as comment.

Virtual segments:
In C++'s OBJ, the virtual segments such as Borland's VIRDEF and Microsoft's COMDAT are automatically detected and reproduced as sources.

Overlaid files:
As overlaid files, Borland's overlay (VROOMM) and Microsoft's old overlay and new overlay (MOVE) are perfectly supported.

Symbols: Renaming labels by users are supported.
As SYM and TDS being supported as symbol files, in those cases, labels are automatically renamed. As for TDS, the symbol information for Borland's TD32 (32-bits Windows debugger) is completely supported. For OBJ and Windows files, labels are automatically renamed according to their external declarations.

Command file:
All indications in any assembly structures such as code/data description, etc., can be achieved perfectly by AGN commands. By making a simple command file, you can recover the 'complete' source files. You can divide the source into any module files in manners of each addresses, each sizes, or each segments. In command file, you can use the conditional directives (@ifdef) and the macro mechanism (@macro).

Perfect automatical mode:
There is mounted XSIM, the strong EXE simulator, that automatically and strongly analyzes the assembly structure of the target executable file such as code/data description, etc.

Call flow diagram:
All functions' or procedures' call_to and call_from flow diagrams are output. In order to know the mechanism of a function, you must know the mechanism of the other functions referred by it. And, conversely, if you knew the mechanism of a function, you need not to trace out the others referred by it. By seeing such a correrative relation among functions in simple call flow diagrams, you can know completely the whole structure of the original executable input file in advance.

Delinking:
Assembly source files output by AGNSS do not occur any assembling errors in most cases when reassembled. That is, by using file- divisonal mechanism of output files, you can easily and correctly extract, i.e., delink only OBJ files to be analyzed. By using such delinked OBJ files from a huge EXE as input files, e.g., of DeCompiler for C, DCC, you can analyze the same codes in a huge EXE without the heavy overhead which always follows to a huge input EXE.

Document files:
All manuals are supplied as document files (about 500KB). The simulation algorithm of EXE simulator, is included in document files with flow charts (HCP-like).

All Source Files for Decompressing Tools/Disassembling module/PE Dumping Tool:
Command files to restore the complete C source files for Decompressing Tools, Disassembling module, and PE Dumping Tool are included. The idea in order to decompress some protect routines against disassemblers is opened to the public. (DCC 2.60 is needed to restore C source files.)

Integrated Enviromental Shell Module (32-bits Windows version):
In 32-bits Windows version, the integrated enviromental shell module AGNDCCW is included. In there, you can start each executable module in AGNSS, assign its start options and its command line parameters, and create/ revise the necessary command files. The format of more important AGN commands becomes more complicated. You can input its parameters from simple dialogs, and so you can easily know the structure of important commands visualizedly. Also you can always see its explanation (.HLP/.DOC) for any command.

Product List

Disassembler AGNSS 2.60 $500 USD

DeCompiler for C DCC 2.60 $500 USD

Disassembler & DeCompiler for C AGNSS & DCC 2.60 $900 USD
(Please select English in the next login screen for paypal!)

Bilyzkid Co.,Ltd.
Higashi-Izumi 1-34-19-102
Komae-Shi, Tokyo 201-0014, JAPAN
Phone:81-3-5497-1962