MENU OPTIONS

   File (Alt+F)

     Open (Ctrl+O)  - select a PE file to open

     Dump (Ctrl+D)  - dump the current PE file to an IL source file

     Dump TreeView (Ctrl+T)  - dump the fully expanded tree view of current PE file to a text file

     Exit (Ctrl+X)  - close the current PE file and exit

   View (Alt+V)

     Set Fonts   	- set the fonts for tree view and disassembly windows.

Default fonts are MS Sans Serif.8 for tree view and Courier.10 for

Disassembly windows

     Sort by name   - (on/off) sort the items in tree view by name

     Show Public    - (on/off) show or dump the items having public accessibility

     Show Private   - (on/off) show or dump the items having private accessibility

     Show Family    - (on/off) show or dump the items having family accessibility

     Show Assembly  - (on/off) show or dump the items having assembly accessibility

     Show FamANDAssem - (on/off) show or dump the items having family-and-assembly

accessibility

     Show FamORAssem - (on/off) show or dump the items having family-or-assembly

 accessibility

     Show PrivateScope - (on/off) show or dump the items having private scope accessibility

     Show Member Types - (on/off) show types of members ('method','field',etc.) in tree view

 nodes

     Show bytes     - (on/off) show the actual IL code in hexadecimal (as comments)

                                    when disassembling the methods

     Show token values - (on/off) show token values in hexadecimal (as comments)

     Show source lines - (on/off) show the original source code

                                       (as comments, if the original source is available)

     Quote all names - (on/off) include all names in single quotes

                                     (when off, only illegal names are quoted)

     Expand try/catch - (on/off) present SEH clauses in expanded form when possible

                                      (.try { ... } catch ExceptionClass { ... })

    COR Header    - show contents of COR header in a disassembly window";

    Statistics (advanced mode only)    - show PE file statistics in a disassembly window

    MetaInfo (advanced mode only)

           Header    - (on/off) show metadata info as header summary

           More HEX  - (on/off) show token and attribute values (in hexadecimal) in metadata info

           CSV       - (on/off) show metadata info as comma-separated values

           Unresolved ext - (on/off) add list of unresolved external references to metadata info

           Validate  - (on/off) show metadata validation results

           Show! (Ctrl+M) - show the metadata info in a disassembly window


TREE VIEW ICONS

   Namespace:	(Blue shield)

   Class:	(Blue rectangle with three outputs)

   Interface:	(Blue rectangle with three outputs marked 'I')

   Value Class:	(Brown rectangle with three outputs)

   Enum:	(Brown rectangle with three outputs marked 'E')

   Method:	(Magenta rectangle )

   Static method:	(Magenta rectangle marked 'S')

   Field:	(Cyan diamond)

   Static field:	(Cyan diamond  marked 'S')

   Event:	(Green point-down triangle)

   Property:	(Red point-up triangle)

   Manifest or a

      class info item	(Red point-right triangle)


CLICKING ON TREE VIEW ITEMS

   Double-clicking on various tree view items results in the following actions:

•	On namespace or any type of class - expanding/collapsing respective subtree

•	On manifest, field, method, event, property - showing disassembly of the item in a separate window

•	On .class info item - showing partial disassembly of the class in a separate window

•	On extends info item - selecting the parent class (if present) in tree view

•	On implements info item - selecting the implemented interface (if present) in tree view


KEYBOARD COMMANDS

   Hot keys:

Ctrl+O  - open a file

Ctrl+D  - disassemble the loaded file into IL source file

Ctrl+T  - dump fully expanded tree view into a text file

Ctrl+M  - show metadata info in a disassembly window (advanced mode only)

Ctrl+X  - exit

F1 or Alt+H  - Show this help window

   In tree view:

Enter - similar to double clicking (see above)

Cursor right - expand subtree

Cursor left - collapse subtree

Cursor up/down - select previous/next item