PROVIEW (tm) Integrated System Analyzer and Viewer Copyright (C) 1992 - 1993 by McAfee Associates All rights reserved Version 1.2 McAfee Associates (408) 988-3832 office 3350 Scott Blvd, Bldg. 14 (408) 970-9727 fax Santa Clara, CA 95054 (408) 988-4004 BBS (25 lines) U.S.A. USR HST/v.32/v.42bis/MNP1-5 CompuServe GO MCAFEE InterNet support@mcafee.COM Overview PROVIEW is a menu driven program used to analyze, view and edit the basic components of a system, including the system memory, system interrupts, device drivers, and installed disk drive sectors and file contents. PROVIEW will allow you to view system elements in HEX, ASCII or disassembled code format. Full searching and editing functions are included. PROVIEW displays data in real time. For example, if you are viewing a memory location that is being updated by the system (the clock interrupt, for example), PROVIEW will display the changes as they occur. PROVIEW provides an extensive on-line context sensitive help function. At any point in the program you may press the key to display help text for the process you are currently engaged in. NOTE: The PV.HLP file must be in the same directory as the PV.EXE file. PROVIEW is Novell Network aware. You may view any network file and edit any network file that is not locked. Using The Menus After you have entered the PROVIEW menu system (type PV at the DOS prompt), you will be able to move about the PROVIEW menus to access all of the system functions. To pull down one of the available menus, press the ALT key and the highlighted letter of the menu you want or use the mouse to select the pulldown list. For example, to access the Memory menu, press ALT-M. To access the functions within the pulldown list, you can either use the arrow keys to move the highlight to the option you want and press ENTER, select the option with the mouse, or press the letter that is highlighted in that option. For example, in the Memory menu to access the list of interrupt vectors, press I. The PROVIEW menu system allows you to open more than one window at a time to view the system parameters. Using the PROVIEW Windows The Window menu contains commands to close, move and perform other window-management commands. Most of the windows in this program have all the standard window elements, including scroll bars, a close box, and zoom icons. Size/Move (Ctrl-F5) When you choose Size/Move, the active window moves in response to the arrow keys. Once you've moved the window to where you want it, press Enter. If you press Shift while you use the arrow keys, you can change the size of the active window. Once you've adjusted its size or position, press Enter. You can also move a window by dragging its title bar with the mouse. If a window has a Resize corner, you can drag that corner with the mouse to resize the window. Zoom (F5) Choose Zoom to resize the active window to the maximum size. If the window is already zoomed, you can choose this command to restore it to its previous size. You can also double-click anywhere on the window's title bar (except where an icon appears) to zoom or unzoom the window. Next (Ctrl-F6) Choose Next to cycle forwards through the windows on the desktop. Close (Ctrl-F4) Choose Close to close the active window. You can also click the Close box in the upper right corner to close a window. Cascade Choose Cascade to stack all file viewers on the desktop. 旼컴컴컴컴컴컴컴컴컴컴컴컴�1커 넬컴컴컴컴컴컴컴컴컴컴컴컴�2커 납旼컴컴컴컴컴컴컴컴컴컴컴�3커 납냥袴袴袴袴袴袴袴袴袴袴袴�4敲 납낳 � 납낳 � 납낳 � 납낳 � 납낳 � 응읜袴袴袴袴袴袴袴袴袴袴袴袴暠 Cascaded Windows Tile Choose Tile to tile all file viewers on the desktop. 旼컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴커 � �袴袴袴袴袴袴1袴쁘컴컴컴컴컴컴2컴� � � � 볐 � � � � 볐 � � � � 볐 � � � � 볐 � � � 훤袴袴袴袴袴袴袴셈컴컴컴컴컴컴컴켸 � � 旼컴컴컴컴컴�3컴왯컴컴컴컴컴컴4컴� � � � 납 � � � � 납 � � � � 납 � � � � 납 � � � 읕컴컴컴컴컴컴컴牡컴컴컴컴컴컴컴켸 � 읕컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴켸 Tiled Windows Using the Edit Functions The Edit menu contains all the commands you need to edit or change the system elements that are accessed with the Memory and Disk menus. Undo (Backspace) To undo any change that you have made. Note that any values that have been changed are highlighted. Set Mask/Value (F3) The mask/value may be set to any hex byte value for XOR/Negate or Add/Subtract operations. XOR/Negate (F7/Shift-F7) XOR/Negate the selected byte using the mask value. Add/Subtract (F8/Shift-F8) Add/subtract the Mask/Value to the highlighted field. Rotate Left/Right (F9/Shift-F9) Rotate selected byte left or right. The FILE Menu The file menu has three options: Save Edited Object Permits saving any changes you have made without having to exit the current edit in process. Read only (Default = No) This options allows you to enable or disable the Read Only function. When enabled (ON), you will not be able to change or edit any system data with the PROVIEW program. To make changes, and be able to save them, toggle this option to read NO. Exit to DOS Returns you to the DOS prompt. Be sure to save any changes that you have made before exiting. The MEMORY Menu System memory may be viewed and edited by PROVIEW. Memory may be viewed in HEX, ASCII or disassembled code format. If viewing in assembler format, you may follow the control of the program by selecting the numbers in parenthesis to the right of each branch instruction that is displayed on the screen. to reverse the flow of control, press (0) to return to the previous branch instruction. The following options are available in the Memory Menu: DOS System Area View/Edit the DOS System Area, starting at 0K and continuing as much as space as necessary for all the information loaded. Information stored here includes the BIOS DATA Area, DOS Communication Area, IO and DOS code, System File Tables, FCB Tables, Disk Buffers, System STACKS (CODE and DATA), as well as devices loaded with the CONFIG.SYS file (e.g., HIMEM.SYS, SETVER driver, MOUSE driver). Program Area View/Edit the Program Area of memory, starting at the end of the DOS System Area and including all used and unused space up to 640K. Information stored here includes the COMMAND.COM code, as well as any TSR programs loaded by the system (e.g., MOUSE, DOSKEY). Upper Memory Area View/Edit the Upper Memory Area, starting at 640K and including all the used and unused space up to 1MB. Information stored here includes the Graphic and Text Video RAM, Video ROM BIOS, and System ROM BIOS. Interrupts View/Edit the System Interrupt Vectors. Proview indicates which ones are currently in use, their memory addresses, owners and interrupt chains. You may display/edit the actual interrupt code in hex or ASM format. NOTE: Do not use the "Display Interrupt Chain" sub-function of this feature if you are running any background multi-programming operating environment such as DESQview. Your system may hang under some circumstances if it is attempted. Drivers View/Edit installed system device Drivers. PROVIEW displays the list of installed drivers and their attributes. Individual drivers may be selected for viewing or editing. Absolute Memory View View/Edit a user selectable memory address range within the system absolute memory. WARNING!! Changes made to system memory can cause system crashes or data loss. Make sure that you understand any change that you wish to make to any memory location. DISK Menu File View View/Edit files on the default hard disk drive. You can view the file in either HEX, ASM or ASCII format. Files may be selected from hard disk, floppy diskette or network drives. Sector View View/Edit logical sectors on any installed disk drive, hard or floppy. This option may not be used on network drives. Physical Sector View View/Edit physical sectors on any disk drive. This option may not be used on network drives. Boot Record View/Edit the boot record on any installed drive. This option may not be used on network drives. Master Boot Record View Edit the Master Boot record on any drive. WARNING!! Changes made to the Boot sector, Master Boot Record or File allocation table area of the hard disk or floppy disk can cause system crashes and/or loss of data. Make sure that you understand any changes made to these areas. HELP Function Comprehensive context sensitive help is provided with PROVIEW. At any point in the program press to display help instructions for the function you are engaged in. In the Help Menu is also a section on Help On Help. If you are having trouble finding anything in Help, or using Help, Press Alt-H to access the Help Menu list, the press H to access the Help On Help. When you are finished with Help, press Enter or select OK with the Mouse to return to the PROVIEW menu. AUTHENTICITY Before using PROVIEW for the first time, verify that it has not been tampered with or infected by a virus by using the the enclosed VALIDATE program. For instructions on using VALIDATE, please read the VALIDATE.DOC file. The validation results for Version 1.2 should be: FILE NAME: PV.EXE SIZE: 87,885 DATE: 03-05-1993 FILE AUTHENTICATION Check Method 1: 4C16 Check Method 2: 0048 If your copy of PROVIEW differs, it may have been damaged. Always obtain your copy of PROVIEW from a known source. The latest version of PROVIEW and validation data for PV.EXE can be obtained from McAfee Associates' bulletin board system at (408) 988-4004 or from the McAfee Virus Help Forum on CompuServe (GO MCAFEE), or the mcafee.COM anonymous ftp site on the Internet. PROVIEW series are archived with PKWare's PKZIP Authentic File Verification. If you do not see an "-AV" after every file is unzipped and receive the "Authentic Files Verified! # NWN405 Zip Source: McAFEE ASSOCIATES" message when you unzip the files then do not use them. If your version of PKUNZIP does not have verification ability, then this message may not be displayed. Please contact us if you believe tampering has occurred to the .ZIP file.