MENU OPTIONS

File (Alt+F)

Open (Ctrl+O) | select a PE file to open
Dump (Ctrl+D) | dump the current PE file to an IL source file
Dump TreeView (Ctrl+T) | dump the fully expanded tree view of current PE file to a text file
Exit (Ctrl+X) | close the current PE file and exit

View (Alt+V)

Set Fonts | set the fonts for tree view and disassembly windows. Default fonts are MS Sans Serif 8 for tree view and Courier 10 for Disassembly windows
Sort by name | (on/off) sort the items in tree view by name
Show Public | (on/off) show or dump the items having public accessibility
Show Private | (on/off) show or dump the items having private accessibility
Show Family | (on/off) show or dump the items having family accessibility
Show Assembly | (on/off) show or dump the items having assembly accessibility
Show FamANDAssem | (on/off) show or dump the items having family-and-assembly accessibility
Show FamORAssem | (on/off) show or dump the items having family-or-assembly accessibility
Show PrivateScope | (on/off) show or dump the items having private scope accessibility
Show Member Types | (on/off) show types of members ('method','field',etc.) in tree view nodes
Show bytes | (on/off) show the actual IL code in hexadecimal (as comments) when disassembling the methods
Show token values | (on/off) show token values in hexadecimal (as comments)
Show source lines | (on/off) show the original source code (as comments, if the original source is available)
Quote all names | (on/off) include all names in single quotes (when off, only illegal names are quoted)
Expand try/catch | (on/off) present SEH clauses in expanded form when possible (try { ... } catch ExceptionClass { ... })
COR Header | show contents of COR header in a disassembly window"
Statistics
(advanced mode only) 		show PE file statistics in a disassembly window
MetaInfo
(advanced mode only) 		Header (on/off) show metadata info as header summary
More HEX | (on/off) show token and attribute values (in hexadecimal) in metadata info
CSV | (on/off) show metadata info as comma-separated values
Unresolved ext | (on/off) add list of unresolved external references to metadata info
Validate | (on/off) show metadata validation results
Show! (Ctrl+M) | show the metadata info in a disassembly window


TREE VIEW ICONS

Namespace | (Blue shield)
Class | (Blue rectangle with three outputs)
Interface | (Blue rectangle with three outputs marked 'I')
Value Class | (Brown rectangle with three outputs)
Enum | (Brown rectangle with three outputs marked 'E')
Method | (Magenta rectangle)
Static method | (Magenta rectangle marked 'S')
Field | (Cyan diamond)
Static field | (Cyan diamond marked 'S')
Event | (Green point-down triangle)
Property | (Red point-up triangle)
Manifest or a class info item | (Red point-right triangle)


CLICKING ON TREE VIEW ITEMS

Double-clicking on various tree view items results in the following actions:

  • On namespace or any type of class - expanding/collapsing respective subtree

  • On manifest, field, method, event, property - showing disassembly of the item in a separate window

  • On .class info item - showing partial disassembly of the class in a separate window

  • On extends info item - selecting the parent class (if present) in tree view

  • On implements info item - selecting the implemented interface (if present) in tree view


KEYBOARD COMMANDS

Hot keys:

Ctrl+O | open a file
Ctrl+D | disassemble the loaded file into IL source file
Ctrl+T | dump fully expanded tree view into a text file
Ctrl+M | show metadata info in a disassembly window (advanced mode only)
Ctrl+X | exit
F1 or Alt+H | Show this help window

In tree view:

Enter | similar to double clicking (see above)
Cursor right | expand subtree
Cursor left | collapse subtree
Cursor up/down | select previous/next item