


                 NEWVIEW 1.1 - PROGRAMMER'S DOCUMENTATION

                 Copyright , 1994-1995 by Frank E. Haggar

                          ALL RIGHTS RESERVED


     --------------------------------------------------------------------

     This program is SHAREWARE:  $49.95 + $4.00 S/H

     You can register on CompuServe:  GO SWREG and select #4146

     Or, you may send a check or money order in
     US funds, made payable to Frank E. Haggar at:

       Frank E. Haggar
       21118 Madria Circle
       Boca Raton, Fla 33433


     FOR TECH SUPPORT, please contact:

     CompuServe: Frank Haggar (75672,1206)
     INTERNET:   75672.1206@compuserve.com

   --------------------------------------------------------------------

   =============
   INTRODUCTION:
   =============

        NewView is an file viewer which displays the contents of 16-bit
     New Executable (EXE/DLL) files for the MS-Windows 3.x operating
     environment. These 'NE' segmented executables contain a variety of
     headers and tables, code segments, data segments, and resource data.
     In addition, they can contain relocation "fixup" information, which
     is used by the Windows' loader to dynamically link external API
     references at runtime.  NewView provides an arsenal of tools that
     can present the NE file information in a variety of report formats.

        Although NewView is primarily designed to display the wealth of
     information available in 16-bit segmented executable files, it can
     also combine the NE file's contents with a variety of "live" data
     that is only available at runtime.  This capability produces reports
     with increasingly meaningful results, often containing symbolic names
     instead of cryptic hexadecimal addresses.

        Since finding and uniquely identifying the correct file to view can
     be a mundane or potentially time consuming process, NewView provides a
     number of tools to reduce the effort.  These features help you locate
     application programs and/or dynamic link libraries by describing files
     in a directory, parsing standard INI configuration file contents, and
     scanning the system's registration database.

   --------------------------------------------------------------------

   ====================
   FUNCTIONAL OVERVIEW:
   ====================

       NewView is designed to improve your productivity by reducing the
    time needed to review the contents of a Windows 3.x executable file.
    There are a number of problem areas that easily become hidden in the
    volume of detail inside an executable. NewView simplifies the task of
    identifying the important dependencies and relationships needed for
    programs to run successfully under Windows, and offers features to
    let you view this information from a variety of perspectives.

    Here are some examples of the capabilities that NewView provides:


   --------------------------
   HEADER/TABLE REPORT TOOLS:
   --------------------------

    Features that present the NE file's header tables:
    --------------------------------------------------
    Presents the MZ table's contents, representing the MS-DOS stub program
    Formats the NE Header, describing the segmented executable's configuration
    Displays the Entry Table information, sorted by name, address, or ordinal
    Lists the Segment Table entries, with details for each segment's settings
    Shows the Resource Table information, allowing individual resource access
    Reports the symbolic names found in Resident and Non-Resident Name Tables
    Identifies the module and function references from the Imported Name Table

    Features that analyze the available information:
    ------------------------------------------------
    Parses the name tables and present "unmangled" symbolic name information
    Traverses the Version Information resource text for custom string entries
    Analyzes file contents to identify wasteful compiler/linker settings
    Process the relocation tables to analyze internal fixups and imported APIs

    Features that improve the information presented:
    ------------------------------------------------
    Utilizes program filename data in APPS.INF and SETUP.INF to identify files
    Automatically scans MAP or SYM files to find the symbol name for an address


   --------------------------
   RUNTIME INFORMATION TOOLS:
   --------------------------

    Features that identify currently running program files:
    -------------------------------------------------------
    List Active Tasks and the drive:\path\filename program location
    List Active Modules shows the usage counts and modules' filenames
    List Active Installable Drivers identifies all User-Installable drivers
    List Task/Module Usage Tree shows each task's implicit DLL dependencies

    Features that apply NE file information to runtime data values:
    ---------------------------------------------------------------
    List Active Windows and their callback procedures
    List Active Window Classes and default callback procedures
    List Active Installed Hooks and their hook procedures
    List Active MakeProcInstance Thunks and the procedures they reference
    List Stack Walk of each running task, showing the system API call nesting
    List Task Databases and the function pointers' referenced procedures
    Address Lookup identifies names for entry points or called API locations


   -------------------
   FILE FINDING TOOLS:
   -------------------

    Features that remember where you found the information:
    -------------------------------------------------------
    The Recent Files List allows quick access to current projects
    Maintains a complete History of Files so you can find previous files again

    Features that identify the configured usage for programs and libraries:
    -----------------------------------------------------------------------
    List the REG.DAT associations for data and program files
    Parse key sections from WIN.INI, CONTROL.INI, PROGMAN.INI, WINFILE.INI,
       DOSAPP.INI, WLDR.INI, BCHKW.INI, DLGEDIT.INI, APSTUDIO.INI, WORKSHOP.INI

    Features that locate files in a directory:
    ------------------------------------------
    Provides descriptive lists for a variety of file extensions, including:
        EXE, DLL, VBX, DRV, SCR, CPL, 3GR, TSK, MOD, etc...
    Presents information on the contents of existing GRP or PIF files

   --------------------------------------------------------------------

    ==================
    INFORMATION VIEWS:
    ==================

       NewView allows you to quickly select commands that generate reports on
    specific information within the file you're viewing. These commands allow
    you to rapidly review the overall contents of the file. They also provide
    direct access to specific reports so you can easily find the information.

   -------------------
   PUSHBUTTON REPORTS:
   -------------------

    Old Header
    ----------
       Reports the contents of the MS-DOS stub's executable header.

     * Double-Clicking the LEFT mouse button will present the HEX dump window

     * Double-Clicking the RIGHT mouse button can run an external HEX dump
       application.  The default HEX dump program is HDUMP.EXE, but this
       can be customized within NEWVIEW.INI (for more information, see below)
       (NOTE:  HDUMP.EXE is not included with NewView. HDUMP is available as
               one of the sample programs provided with Borland C++)

    New Header
    ----------
       Report the contents of the 'NE' (New Executable) header information.
       This report can appear in 2 different formats that alternate when
       this pushbutton is repeatedly pressed.  Below is the initial format.
       Pressing the "New Header" button a second time displays the same
       data in a format similar to EXEHDR.EXE's output (with HEX values).

     * Double-Clicking the RIGHT mouse button will launch the NE application
       when the above report format is displayed. (be careful if you're viewing
       a DLL, since you may create an orphaned library module or encounter
       undesirable results from the DLL's LibMain() routine)

     * Holding down the SHIFT+CTRL keys while requesting the above report
       causes NewView to scan the entire file, looking for a variety of
       known text strings in an attempt to identify the program's copyright
       owner and MS or Borland compilers' runtime library.  Although this
       approach is not guaranteed to be reliable, it does work for a number
       of program files.


    Entry Table, Entry Sort, Entry Names
    ------------------------------------
       Reports the contents of the ENTRY TABLE information, sorted by
       ordinal, address, or exported name.  The report sorted by ordinal
       (shown below) also shows "Placeholder" entries that represent
       unused, or skipped, ordinal number(s).  If the RESIDENT or NON-
       RESIDENT NAME TABLES contain symbolic names that correspond to
       the ordinal entry points, those names will appear in the list.

       If no matching NAME TABLE entry is found, NewView will construct
       a name based on the individual entry's address information.

       To change the sort order of the information press the pushbutton
       repeatedly.  The report's title will indicate which sort format
       is currently shown, and the Entry Table button's text will change
       to indicate which sort order will be displayed next.

     * Double-Clicking with either mouse button will present a HEX DUMP
       of the data found in the file, at the selected entry point's location.

     * Since certain entry tables contain a significantly large number of
       records that do not correspond to items in the NAME TABLE, you can
       suppress the display of those items by holding down the SHIFT+CTRL
       keys as you request the reports.

    Segments
    --------
       Reports the contents of the SEGMENTS TABLE information, allowing
       individual segments to be selected for additional inquiry on details.

       NOTE: This report provides access to a significant number of useful
             and powerful features that involve the segment table records,
             the contents of a segment, and the relocation table for a
             segment.

     * Double-Clicking the left mouse button pops up a dialog that contains
       a report on all of the relocation table "fixup" records associated
       with the selected segment. (The dialog will not appear if the "#Rels"
       column contains a zero, because there are no relocation records to
       display).

       NOTE: This relocation table report's dialog box supports additional
             viewing features.  See the description on the Relocation Table
             Report in the POPUP DIALOG COMMANDS section for more information

     * Double-Clicking the left mouse button while holding down SHIFT+CTRL
       pops up a dialog box that allows you to alter the settings for the
       bit flag field of the selected segment table record.

       NOTE: BE CAREFUL! This command changes the actual executable file!
       (See the accompanying document: CAUTION.TXT for more information!)


     * Double-Clicking the right mouse button produces a HEX DUMP pop-up
       dialog that displays the selected segment's contents.

     * Double-Clicking the right mouse button while holding down SHIFT+CTRL
       produces a HEX DUMP of the relocation table for the selected segment.

    Resources
    ---------
       Reports all types of resources, number of each type, and information
       on each individual resource of each type.  Individual resources can
       be selected and shown in their graphical display format or in hex.

    Resident Names
    --------------
       Reports the items in the Resident Name table, including their ordinal
       value and the length of the text.

     * Hold down SHIFT+CTRL to include the MODULE NAME (ordinal 0) in the list

    Imported Names
    --------------
       Reports the implicitly linked DLL module references, as well as
       a list of any functions that are imported by name.

     * Double-Click on a MODULE name to get a list of all relocation records
       from all segments which reference the individual imported module

     * Hold down SHIFT+CTRL and Double-Click on a MODULE name to open that
       DLL into NewView for viewing.

    NonResident Names
    -----------------
       Reports the items in the NonResident Name table, including their
       ordinal value and the length of the text.

     * Hold down SHIFT+CTRL to include the DESCRIPTION (ordinal 0) in the list

    Size Analysis
    -------------
       Performs a size analysis that will identify wasteful compiler/linker
       options used when building the executable.  If your alignment is
       reported as wasting space, change the linker option. If you have
       duplicate relocation entries, use EXECHAIN (or the new TLINK options)
       to recover that space.

   --------------------------------------------------------------------

   ==============
   MENU COMMANDS:
   ==============

        NewView offers additional commands that allow you to expedite
      a variety of other tasks associated with viewing the contents of
      an executable, such as locating files to view or peering into
      currently running executables' information.

   ----
   File
   ----

      Open...
      -------
           Presents the standard Open File dialog box for use in
           selecting a file to view.

      Run...
      -------
           Presents the standard Open File dialog box for use in
           selecting a file to launch.  If you are currently viewing
           an executable, it's filename will appear as the default
           program to run.   Simply press OK to run that file, or
           you can select another executable file to be run.

      Close
      -------
           Closes the currently opened executable, returning to the
           previously displayed file selection list (if there was one).
           If no executable is displayed and there is no previous file
           list to regenerate, this command will prompt to exit NewView.

      History List
      ------------
           Generate a list of all files previously viewed by NewView in
           the historical order in which they were last opened.

      Recent Files
      ------------
           Presents a list of the last 12 files viewed.  The number of
           files listed is configurable using the Preferences command.
           After you've viewed at least one NE file, this list will be
           presented automatically when the program starts.

      Exit
      ----
           Closes NewView

   ----
   List
   ----

      Task Names
      -----------
           Lists all the currently active tasks, allowing you to select
           one to open and view.  This list will be presented at program
           startup whenever the Recent Files List is empty.

      Task Header Procs
      -----------------
           Lists the TDB (Task DataBase) information for each running task
           and presents information about the function pointers in use for
           each one.

      Task Execution Stacks
      ---------------------
           Performs a stack walk on each active task, showing the current
           call stack as reported by TOOLHELP.

      Task/Module Tree
      ----------------
           Lists each active task and their implicitly referenced modules.
           Any modules loaded dynamically or by Windows' startup procedure
           will be presented at the bottom.  A module usage reference value
           is displayed each time a module is listed.  Any DLLs remaining at
           the bottom of the list were either loaded by LoadLibrary, or have
           been "orphaned" by another application that is no longer running.

      Module Usage Counts
      -------------------
           Lists all currently active modules, with the total usage count for
           each one.

      Auxiliary Drivers
      -----------------
           Lists the currently active "User Installable" drivers.  (Hold the
           SHIFT+CTRL keys down while selecting this command to see the
           "alias" and "description" information for each driver listed)

      Hooks and Owners
      ----------------
           Lists the system-wide hooks, then lists the task-specific hooks
           active for each active task. (Hold down the SHIFT+CTRL keys when
           selecting this command to see the entire hook table for each
           task, including the unused hook entries)

      Callback Thunks
      ---------------
           Lists the MakeProcInstance "thunks" that currently exist for each
           active task, and translates the address to an exported function
           name whenever possible.  (Hold down the SHIFT+CTRL keys to see
           the entire MakeProcInstance table, including the empty slots that
           have been left by calls to FreeProcInstance)

      Class Names and Owner
      ---------------------
           Lists the currently existing window classes, with the name of the
           module associated with the class.  The window class's default
           callback function is also presented, showing the exported ordinal
           number and symbolic function name whenever possible.

      Window List and Owner
      ---------------------
           Lists the currently existing windows and their title text.  The
           window class names are also presented for each window, along with
           the name of the module associated with the window and with the
           window class.  The callback procedure information is presented
           for both the window and the window class.

   ----
   View
   ----

      Configuration             WIN.INI
      ---------------------------------
           Parses the contents of WIN.INI and presents information on a
           variety of different "standard" sections that commonly contain
           references to programs or dynamic link libraries.  These sections
           include the embedding information, installed print drivers, and
           a variety of text and graphic file conversion filters.

      C-Panel Driver List       CONTROL.INI
      -------------------------------------
           Parses the contents of CONTROL.INI and presents information on
           the print drivers, print driver descriptions, and user-installable
           drivers.

      File Manager Extensions   WINFILE.INI
      -------------------------------------
           Parses the contents of WINFILE.INI and presents information on
           the currently installed "UNDELETE" configuration, as well as any
           File Manager extensions.

      Font Settings             WIN.INI
      ---------------------------------
           Parses the contents of WIN.INI and presents information on the
           currently installed font file configuration.

      Program Manager Icons     PROGMAN.INI
      -------------------------------------
           Parses the contents of PROGMAN.INI and presents information on the
           currently available Program Manager Group (.GRP) files.  You can
           double-click on any entry to see the contents of that .GRP file,
           and can then select any of those items for viewing in NewView.

      File Associations         WIN.INI
      ---------------------------------
           Parses the contents of WIN.INI and presents information on the
           current "File Association" information settings.  This list allows
           you to see the application that will be launched for a particular
           file extension.

      Popular Programs          APPEXEC.INI
      -------------------------------------
           Parses the contents of APPEXEC.INI and presents information on the
           list of programs that this program has frequently launched.

      MS-DOS Executables        DOSAPP.INI
      ------------------------------------
           Parses the contents of DOSAPP.INI and presents information on the
           MS-DOS executables, .PIF files, and .BAT files you've run while
           Windows is active.  This information can be quite interesting as
           a way of reviewing historical program usage from within Windows. It
           can also reveal a number of entries that are no longer necessary,
           since the associated MS-DOS program is no longer installed on your
           system.

      Debugging History         WLDR.INI,BCHKW.INI
      --------------------------------------------
           Parses the contents of WLDR.INI and BCHKW.INI and presents
           a list of the programs that have previously been run using tools
           from Nu-Mega Corp. (WLDR for WINICE and BoundsChecker for Windows)


      Custom Control Libraries  ANY OF THE FOLLOWING
      ------------------------   SDK Dialog Editor    DLGEDIT.INI
                                 Resource Workshop    WORKSHOP.INI
                                 AppStudio            APSTUDIO.INI
                                 ----------------------------------
           Parses the contents of the INI files used by these popular resource
           editing programs and presents information on the installed custom
           control libraries and/or VBX files that have previously been
           configured for use by those tools.

   ----
   Scan
   ----

      Registry Database     REG.DAT
      -----------------------------
           Scans the registration database, presenting entries that correspond
           with program files or data file associations.  (Hold the SHIFT+CTRL
           keys down when selecting this command to get a complete list of the
           entire registration database's contents)

      GRP Files             *.GRP
      ---------------------------
           Scans the current DOS directory for any .GRP files, and presents
           information on their contents.  This command is great for hunting
           through old .GRP files to determine the location of infrequently
           used applications.  It is also helpful when trying to reconfigure
           Windows after re-installing from scratch.

      PIF Files             *.PIF
      ---------------------------
           Scans the current DOS directory for any .PIF files, and presents
           information on their contents.  This command is great for verifying
           that a .PIF file will run the program you expect it to, and is also
           handy when trying to clean out old/unused disk files.

      Drive and Subdirectory List
      ---------------------------
           Presents a list of all subdirectories under the current directory,
           followed by all disk drives available.  Clicking on a disk or
           directory will change the current directory to that location.
           Clicking the RIGHT mouse button will automatically invoke the
           "Directory List of Programs" command, so you can easily scan the
           directory for programs, DLLs, device drivers, etc.

      Directory List of Programs
      --------------------------
           Scans the current directory for all .EXE, .DLL, .CPL, .VBX, .SCR,
           .FON, .FOT, .3GR, and .MOD files.  The files will be presented in
           groups, by extension and the file description information will be
           presented.  Click the RIGHT mouse button to toggle back to the
           "Drive and Subdirectory List".  These two commands can be used
           together to easily locate a variety of Windows NE files on your
           disk and to identify what those files may contain.

   ------
   Report
   ------

      Relocation Duplicate Summary...
      -------------------------------
           Generates a report on the chained or duplicated relocation table
           information for each segment of the currently viewed NE file.

      All Relocation Tables...
      ------------------------
           Generates a detailed listing of the relocation table references
           for each segment of the currently viewed NE file.  Each entry
           will show the number of duplicate records and/or the number of
           chained relocation fixups used within the given segment of the file.

      CrossReferences to File...
      --------------------------
           Generates a LARGE report that combines the entry table information,
           the segment table information, and the relocation table information.
           This report will show an approximate address location for each
           internal or external function call that requires a relocation table
           fixup record.  (It is not as complete as a true disassembler would
           generate, but it can be helpful in figuring out the contents of
           a post-mortem dump utility report, such as Dr. Watson or WinSpector)

      Unmangled Export Names
      ----------------------
           Generates a report of the unmangled names found in the RESIDENT and
           NON-RESIDENT NAME TABLES of the currently viewed NE file.

      Version Resource Contents
      -------------------------
           Dumps the complete contents of the VERSION INFORMATION resource,
           including any non-standard entries it contains.  (Hold the
           SHIFT+CTRL keys down when selecting this command to see a more
           detailed list of the values contained inside the version resource
           data)

   -----
   Tools
   -----

      Address Lookup
      --------------
           This command allows you to type in the address of a function or
           the address of a call to a function, in a variety of different
           formats.  It will attempt to translate that address into a more
           meaningful symbolic function name or entry point, whenever possible.

          Here are some of the things you can do:

             0x053f:09bc  -> up pops a box reporting this is the entry point
                             for "SIGNALPROC" inside of USER.
             0x0F3f:0a2e  -> reports that this is USER segment 1, offset 0a2e

             (load user.exe)
             *0x01:0a2e   -> reports that USER.01:0a2e (seg 1, off 0a2e) calls
                             KERNEL.SETREOURCEHANDLER

        (NOTE that User 01:0a2a ACTUALLY contains the far call, and 0a2b is the
         fixed up address. 0x0a2e is where the call will RETURN TO, and since
         that's the address shown in Dr. Watson and other fault trapping utils,
         NewView works with that address.  When in doubt, try adding or
         subtracting a few times, and you may get the information you need)

      Location Hex Dump
      -----------------
           This command allows you to type in the location of information
           to be presented in a HEX dump.  The information you enter can be
           supplied in a variety of different formats, and the program will
           calculate the actual offset into the NE file for you.

      Save Chained Fixup...
      ---------------------
           This command allows you to rewrite an EXE or DLL file, chaining
           any duplicate relocation information to reduce the file size.

      Preferences...
      --------------
           Presents a dialog box that allows you to permanently configure a
           variety of different options. You can control the style, display,
           thickness, and position of the divider lines, the background color
           for the report window, etc.  You can specify the number of items
           to be presented in the "Recent Files" list.  You can enable or
           disable loading CTL3D.DLL, and other options that control how
           NewView looks for information to report.

      Fonts and Tabstops
      ------------------
           This command allows you to select a different font and/or to alter
           the tab stop settings for the currently displayed report.

      OpenFile Usage Logging
      ----------------------
           This command allows NewView to display a window that logs the
           file access activity it performs.  It can be very helpful when
           trying to verify that a .SYM or .MAP file is actually being used
           by NewView.  It's also a great way to make sure that NewView is
           referencing the .EXE or DLL file from the directory you expect,
           or that it's actually finding the EXE/DLL in another location (just
           as the Windows' loader would if it tried to access that file!)

   ----
   Help
   ----

      About
      -----
           A list of "Credits" and copyright information.


   --------------------------------------------------------------------

   ======================
   POPUP DIALOG COMMANDS:
   ======================

       NewView provides additional commands inside the following dialogs:

   ------------------------
   Relocation Table Report:
   ------------------------

        Whenever a relocation table report is listed, you can get a HEX
        DUMP of additional information related to the selected record:

        * Double-click with the left mouse button to view the data in the
          segment at the offset where the fixup will be applied

        * Double-click with the right mouse button to view relocation record
          segment at the offset where the fixup will be applied

   ----------------
   HEX DUMP Dialog:
   ----------------

         Whenever the HEX DUMP window appears, you can use the additional
        items that have been added to the dialog box window's System Menu
        (Control Menu) to change the format of the dumped information to
        ASCII, use the OEM font, remove the line numbering, etc.  This is
        handy when attempting to view more data than the EDIT control can
        accommodate, and turning off HEX and OFFSETS will increase the
        limit on what can be displayed to around 50K or so.

   --------------------------------------------------------------------

   ================
   HOTKEY COMMANDS:
   ================

     *  NewView's main window and/or report dialog windows can be maximized
        and restored using the ALT+ENTER keystroke.

     *  The SPACEBAR and ENTER keys can be used to select items from lists
        instead of the left mouse button

     *  Whenever a resource is displayed (except for dialog box resources),
        pressing the TAB and SHIFT+TAB keys will cycle to the next or previous
        resource of the same type.  This is a fast way to scan through menus,
        bitmaps, etc.

   --------------------------------------------------------------------

   ========================
   CUSTOMIZING NEWVIEW.INI:
   ========================

  (1)  To replace HDUMP.EXE with an alternate HEX dump application's filename,
       add the following keyword to the [Display] section of NEWVIEW.INI:

       [Display]
       FileDump=YOURDUMP.EXE %1

       You can also provide a full drive:\pathname\filename.ext, as follows:

       [Display]
       FileDump=C:\YOURPATH\YOURDUMP.EXE %1

       You can even run DOS programs, although you may need to create a PIF.

       [Display]
       FileDump=DOS_DUMP.PIF %1

   (Note that %1 will be replaced with the full drive:\path\filename.ext for
    the currently viewed executable, when the dump program is launched. Also
    note that you can include other command-line options or arguments that
    will be passed through to the launched program)

   --------------------------------------------------------------------

   THANK YOU FOR USING NewView!

   Frank E.  Haggar
  _________________________________________________________________________
        Copyright 1994,1995 by Frank E. Haggar    (ALL RIGHTS RESERVED)
