home *** CD-ROM | disk | FTP | other *** search
- Sniffer Utility (SNIFF16) Release 4 September 23, 1993
-
- Invocation
-
- The syntax for SNIFF16 is:
-
- SNIFF16 [-switches]... filename...
-
- where the valid switches are:
- e brings problem calls up in EPM (debug information necessary)
- f displays fully-qualified path information for modules
- h displays copyright header
- v displays verbose file output
-
- Use the environmental variable SNIFF16PATH to set the path SNIFF16
- will search for .exe's, .dll's, and source files (.c's).
-
- Wildcards (* and ?) are supported for the filenames.
-
- In order to use EPM to inspect flagged references, the user must at
- least have version 6.00 and include the macro file MYCNF.E. If EPM is
- unmodified, the user can just copy EPM.EX and EXTRA.EX to the EPM
- directory. Otherwise the user must merge EPM's MYCNF.E and SNIFF16's
- MYCNF.E and recompile EPM.E and EXTRA.E.
-
- SNIFF16 will output a table giving relevant information regarding the
- module or modules run against. The "All 32" column will have a yes or
- no depending on whether any 16-bit object is contained in the exe or
- dll. The "16-bit Ref" column contains the number of 16-bit references
- made from the exe or dll to another dll. The "DosCall" column contains
- the number of calls to DosLoadModule followed by a "/" and then the
- number of calls to DosQueryProcAddr. Either of these calls may address
- 16-bit code. (SNIFF16 cannot determine if code brought in by one of
- these DosCalls is 32- or 16-bit.) The "IOPL" column contains two
- numbers separated by a "/." The first is the number of calls performed
- that reference IOPL code. The second is the number of IOPL entries
- found within the exe or dll. Currently, if more than 999 calls are
- found, the number will be truncated.
-
- SNIFF16's verbose output will give much more detailed information
- including: the size and type of any 16-bit object code; the entry
- number of 16-bit referenced code and DosCalls; the source file and line
- number of 16-bit referenced code and DosCalls.
-
- SNIFF16's EPM option will invoke EPM if flagged references were found
- and debug information exists for the modules in question. EPM will be
- brought up after all modules have been searched and all questionable
- calls have been found. EPM will come up on the first call with the line
- of the call marked. Pressing ALT+N will bring up the next questionable
- call. Pressing ALT+P will bring up the previous questionable call.
- Pressing ALT+F1 while on the line of a questionable call will bring up a
- message box which tells why the call may be a problem. The user may
- exit EPM at any time by pressing ALT+F4.