has anyone ever got this message while trying to open a file in wdasm

"cannot find .alf File
Be sure that .alf File exists and is in the same Directory as the .wpj file"

i am suspecting that this file has some kind of anti-debugging trick

anyone seen somethin like it in wdasm??

sharon

Hi,

The alf and wpj files are created once you've saved a WDasm disassembly. Ignore them and just re-disassemble the original file and you should be OK.

yes Kayaker.. i know what u are talking about..
but this error message is faulty cuz i dont try to open a previous project.. i try to dissassemble from new.. thats why i say its some kind of anti debugging trick

thanx again

Hi,

I've never seen anything like this before...

What file are you trying to disassemble?

Regards,

Kayaker

tha name of the program is InTouch from wonderware..

the file is
intspt.dll
i am providing it at this location if anyone is interested in taking a look
http://www.cyberflat.net/intspt.zip

any inout is highly appreciated
thanx

Hi,

Very bizarre. There's a couple of strange things with this dll that must be confusing the hell out of W32Dasm

First, it's got over 60 non-standard sections after the .text section which have the code characteristics 60000020 (contains code, executable, readable). Even if W32Dasm was able to disassemble it, it might choke on the 7B000 bytes of executable code.

Second, it contains debug information, which essentially seems to encompass the whole of the file. You can actually use PEBrowsePro to disassemble each of the sections (right click on the entries under Debug Symbols and select Disassemble). Is there such a thing as a "debug dll"? Of what benefit, or purpose, would this be in a program?

IDA disassembles the file, but it asks for several dlls on "Reading Imports Directory". You can either provide them to IDA or just hit Cancel several times and make what sense you can out of things.

I thought that with changing the code characteristics of each of the (60+) sections to non-executable, W32Dasm would ignore them. So I replaced all occurrences of "60000020" in the Sections Header with "C000040" with Hexedit (then changed the single .text section back), but I still got the "Cannot find .alf file" error message. So maybe it's the debug info or something else screwing W32Dasm up.

Hope this helps,

Kayaker

Hi to you all,

Just downloaded the dll and disassembled...!??
Nothing crashed and it gives all the stings etc.
I tried with the patched wdasm(vb) and unpatched but all two did fine using W98 (first edition) and w32dasm8.9
greetz............ SpeKKel.........

thank you all for ur input.. i appreciate it..
i hope u didnt loose ur patience yet cuz i have one more question for both of u..

Kayaker: looking at the pe section .. do u think this dll is encrypted??

SpeKKeL: can u tell me where i can get my hands on v8.9 of wdasm??

cheers everyone

LOt's of places...>>www.lockless.com/dasm.html

...................................

Good 'ol reliable W32Dasm ;-)

Version 8.93 doesn't know what to do with intspt.dll, just gives that bizarre error message on both Win95 and Win98.

Version 8.90 and even the old 8.7 have no problems with it.

From the looks of the String refs to "License", I guess that's the file you want

Cheers,
Kayaker

You wrote:


Ok... I've got this error sometime ago. W32dasm doesn't load somekind of files, due to a bug (it's not only a antidebug trick). This bug is due to a lack of memory on the reading process.

I fixed sometime ago, and now, you can load any file without errors.

Otherthing, i changed w32dasm enabling breakpoints on forbiddens dlls, like kernell32, for example.

Now you can breakpoint directly on the dll loaded (any of them), and w32dasm will break, similar like softice do.

But, if you break on kernel32.dll, user.dll etc...w32dasm may crash due to this files are being used on windows. It does not crash every time.

It can be solved, but i still need much more memory to process the infos, and i am disassembling w32dasm in order to compile it under masm615.

If i could be able to completelly decode all data on w32dasm, the possibilities are endless, specially because i intend to put a resource editor under w32dasm and other features.

If you want the bug fix for w32dasm, let me know, and i'll send to you the patch or the tutorial on how to fix it.

Best regards,

Beyond2000!