
           WHITE & BLACK PHANTOMS EXECUTING INSPECTOR. Version 1.1
          
 Manual Reference.                                       8.02.1994-16.11.1994
                                     


       	This manual is a private property of Voikhansky Artemy and Drubet-
	sky Vadim, the authors and owners of White & Black Phantoms Executing
	Inspector. No part of this document may be changed or distributed
	without independent approval in writing of both its owners.

   	This manual desribes White & Black Phantoms Executing Inspector. It 
consists of several parts and contains a full description of a new product. 
Here is a summary:

	- Introduction to Inspector and some technical details.
	- Chapter I. Why Everybody Must Know Assembler.
	- Chapter II. Loading & Debugging a Program.
	- Chapter III. View/Edit Services.
	- Chapter IV. String Operations. I/O Services.
	- Chapter V. Special Services And Features.
	- Chapter VI. On-Line Help. Interrupt Info Service.
	- Chapter VII. Installation & Options. Setup Program.
	- Appendix 1. A Short Description of Assembler.
	- Appendix 2. A Summary of Inspector's Menues, Hot Keys and Mouse
Support.
        - Appendix 3. List of Reserved Names and Abbreviatures Used In
this Manual.
	- Appendix 4. List of Files of White & Black Phantoms Executing
Inspector's Full Version.
	- Appendix 5. Contact with White & Black Phantoms.


        Note Appendixes 3 (several examples of typical work seccions
	with Inspector) and 5 (contact with White & Black Phantoms) are absent
	in this manual, because it's a description of the product. This appen-
	dix is present in the commercial decumentation.


	INTRODUCTION.
       

	White & Black Phantoms Executing Inspector is a new polyfunctional
low-level debugger. It can serve a great number of purposes, providing
to its user powerful tools for inspecting executing process, debugging
programs and performing control on the PC. The following chapters des-
cribe the working process on White & Black Phantoms Executing Inspec-
tor. Here is a number of technical details.
	White & Black Phantoms Executing Inspector is written in the as-
sembly language of 8086 microprocessor and will work on any machine
that supports its instruction set (any IBM PC-compatible). All popular
video systems are supported for output as well as input from both key-
board and mouse. The minimum requirement for software is DOS version 2
or higher. Hard disks with partition greater than 32 Mbytes require
DOS version 4.0 minimum. To use mouse device with Executing Inspector,
MS-Mouse or compatible driver should be installed first.
	Inspector uses 335 Kbytes of disk space (full version) and mini-
mum 66 Kbytes of conventional memory when working or being resident.
When Inspector is started, it performs check-up of present hardware
and software. The technical detailes mentioned in the previous para-
graph are determined automatically by Inspector as well as XMS driver
presence. If XMS driver is available, Inspector uses extended memory
for its internal buffers, leaving more base memory for debugging and
inspecting work.
	Inspector has an easy-to-use window system and friendly environ-
ment; small size lets almost all the programs to be successfully lo-
aded into memory for inspecting and running. As it was signed already
above, the Executing Inspector is suitable to a wide range of low-le-
vel tasks. Thus, it may be used for debugging programs on assembly
language and unassembling code generated by high-level languages com-
pilers - as a source-level debugger. View/Edit File & Disk services
remind the analogous options of PCTools (PCShell) and Norton Utiliti-
es; but, using the original concept, allow assembly writes to disk and
file. This option (unassembling disk contents) may be useful for vie-
wing disk contents and quickly orienting in cases of unexpectable
changes of disk contents and will assist in an anti-virus fight.
	Inspector has a built-in 80286 assembler. In a connection with the
window system, Save File service and low-level means it allows use of
Inspector as an assemble-language interpreter.
	An on-line help makes work with Inspector possible even for new-
commers; it answers shortly all the possible questions that may appe-
ar during a work seccion. If You want more information, look through
the relative topic of this manual; if You are still not satisfied,
contact us (see Appendix 5).
 	All the work with White & Black Phantoms Executing Inspector is
accomplished via assembly-language instructions and hexadecimal num-
bers. This may seem horrible for the people that know only high-level
languages like Basic or Pascal or work with DataBases as DBASE or FOX
BASE and don't interest how does the computer operate at all. We ho-
pe that they have good enough compilers and interpreters to serve the-
ir purposes. But before closing to yourself low-level programming, try
to look through the Chapter I and Appendix 1 of this manual. If we
couldn't tempt You to attempt using assembler, keep your way; if we
did, purchase assembler manual and we hope that Inspector will be a
good assistant for You during all your way.
 	For the newcomers that learn assembler there is an APPENDIX 1 that
describes 8086 assembly language. APPENDIX 3 contains several examples
relative to Executing Inspector. Look them if You have any questions
about assembler and its interpretation by Inspector.
 	For the programmers on assembly-language and for high-level pro-
grammers who use low-level routines and a wide set of operation sys-
tem's means we see no need to tell about the advantages of assmebler.
For You, as we guess, the main problems are efficiency of Your prog-
ram and those "little" mistakes that cost great blood. For You White
& Black Phantoms Executing Inspector has a lot of powerful tools; You
should better start to pass through this manual from Chapter II. Hope
You will find Executing Inspector fitable, easy and convenient to use.


	I. WHY EVERYBODY MUST KNOW ASSEMBLER.
       

 	Every programmer, from his first steps is taught some stereoty-
pes. In the majority of cases, he starts with one of high-level pro-
gramming languages (BASIC, for example). He learns a lot about logic
structure of the program, about structure programming (and in the
recent time object-orient programming).
	It's paradoxal, but a fact that assembler has a reputation of a
"hard nut" - hard to learn and hard to use language. There is a rea-
son that in assembly language one can't write easy understandable
programs; that it takes a great number of hours to write a program
and a half of life - to test it and make it work.
	But - doesn't it look strange? - a programmer from the very be-
ginning starts to write in machine-language. Yes, writing on Pascal
or Basic, C or Fortran, in fact You are writing on assembler. Speci-
al programs (compilers) translate your high-level module into machi-
ne codes - assembly language - and then linkers link them into DOS
format. If You work with interpreter, every high-level instruction
is consistently translated into machine language and executed. In any
case, the computer that can't understand high-level language, rece-
ives his native code.
	Here is a great advantage of assembly language: the programmer
works directly with the microprocessor. He may be sure that no stra-
nge transformations are performed with his program; he understands
all the steps that the CPU will do according to his program. Natu-
rally, for such a work programmer must understand how does his com-
puter really work; but how can he be a programmer without this?
	In the other hand, a question about "clearness" of the program
is disputable. The clearest high-level programs, written with the
observance of all the rules of structure programming, have especially
involved and unclear machine code. A reason for thus is that a compi-
ler can't know what a programmer wants to do with his program. It has
a fixed number of built-in features, possibilities and means to con-
vert any situation that may appear in the program to its standards,
generalizing generated code. On the contrary, literally written assem-
bly-language program, supplied with needed remarks is clear both for
men and computers.
 	The great problem for programmer is in many cases an efficiency
of the program. Sure, for the program that must output to display a
message "Hello, world" and exit to DOS it's no need to make it the
most effective. The simpiest way is to run BASIC interpreter, to
enter the following:

	10	PRINT "Hello, world": END

and run it. (Or, may be, the most effective way is to write a batch
file, for example, HELLO.BAT with the contents "ECHO Hello, world" ?).
But if You are developping a serious application that must remain
resident in memory, it must be compact. In this case, minimum the re-
sident part of the program has to be written in assembler. In the
other side, a programming "monster" - environment, a packet of pro-
grams have time-critical parts, and this parts must be written in
assembler.
	Additionally, although almost all high-level languages have in-
structions (or routines) for low-level I/O, only assembly language
provides a way to effective programming in this level. And every cri-
tical part of the program has to be tested. Here Inspector is an ir-
replacable assistant. Additionally, Appendix 1 contains short des-
cription of Assembler and Inspector tools for writing assemble-lan-
guage instructions and receiving data in assemble language instruc-
tions.
 	One of the authors of Inspector faced a strange case working with
one of well-known compilers (Turbo C v2.0). At first it was decided to
write Executing Inspector on C language. And a short program of 10 Kb,
which was then Inspector, constructed according to the rules of struc-
ture programming, simply hung the system. After viewing its machine
code, that was unclear, we succeeded to find out that the compiler
have done an "optimization for size" and in one place did a mistake in
calculation a length for CALL instruction by 1 byte! And instead of
near CALL to a main () function computer tried to execute one of pro-
tected-mode instructions that caused a fail in real mode.
 	After the next incident, that a program of 15 Kb caused compiler's
"out of memory" error it was decided to write Inspector all in assem-
bly language.
	White & Black Phantoms Executing Inspector was written on assembly
language from the first letter to the last. Although it took a bit of
time to write and test all the different parts, now You have a compact
and efficient debugger. If You have ever seen an analogous to Inspec-
tor program, comparable with it by parameters written on any high-
level language, let us know. For a special cash You can receive a
full set of source codes of White & Black Phantoms Executing Inspec-
tor, including a library of macros and subroutines.
 	White & Black Phantoms wish You all the best in programming, to
be optimist and believe in future just like we do.


	II. LOADING & DEBUGGING A PROGRAM.
       

 	This chapter constists of several parts and contains description
how to load a program in Inspector environment and use powerful In-
spector's tools for inspecting and debugging it.

 
	II.1. Loading And Unloading a Program.
       

	A) White & Black Phantoms Executing Inspector supports modules
written in two main DOS formats: .EXE and .COM (further, for shorten-
ing, EXE and COM modules). Inspector recognizes programs both by their
extensions and internal structures. Any program that doesn't have an
.EXE extension or EXE format is supposed to be a COM program. A modu-
le larger that 64Kb may be loaded only if they exist in an EXE format.
	In Inspector's environment there are three ways to load a program.
The description of all is following. Only note that program's name is
a full name including extension (in any other case Inspector will re-
port an error "File doesn't exist").

	- A program may be loaded from the menu using "Load" option of the
file menu. "F1" key press accesses the file menu; then, navigating the
arrows, select the "Load" option and press "Enter". A little window
will appear in the middle of the screen and ask You to input the file
name. Enter program's name and press "Enter".

	- You may use the "L" command key from the main window (not from
menu!). This will cause the little window appear in the middle of the
screen. Input the program's name and press "Enter".

 	- If Inspector is used especially for inspecting and debugging a
programs, it can be loaded just from the DOS prompt. For example, to
load a program "COMMAND.COM" from root directory, type the following:

			INSPECT \COMMAND.COM

This way is preferable in entering command-line arguments: You enter
them just like if You were typing them in DOS prompt.

	If no error occurs, Inspector loads the program into memory, cre-
ates PSP and environment for it and loads parameters (if there are
any). In this case, unassemble window shows the source code starting
form CS:IP pair (start of the program); dump window shows dump of the
PSP from the start; registers window shows current register set, with
which a program will start and stack window shows stack so that SS:SP
is the lowest line represented in the window. In the bottom line of
the display currently loaded module's name is written; the system is
ready for any work with the module.
 	If there is an error while loading a program, the error message
is displayed at the bottom of the main window. On-line help (F10) gi-
ves short description of the common situation in which this error may
occur and gives an advise how to abolish the error situation.

	B) To unload the program, press <Shift-Delete> key combination. 
This will cause Inspector to clear all its internal flags and return 
to a standard state with no module loaded and all CPU registers set 
to their Inspector's standard values.

	C) To reset the program there is an F6 key. Inspector will clear
the program and load it once more, returning to the state exactly
after You have loaded the program. May be useful if the program con-
tains serious mistakes that You can't follow already.


	II.2. Loading Command-Line Arguments.
       

 	Some programs for their work need command-line arguments, using
the DOS feature to transmit to a program a line of parameters. Theese
parameters usually may be file names  to load or work with or options
to a program. Inspector provides two ways to load arguments.

 	- "Arguments" option of the "Debug" menu. Use F5 key to enter the
debug menu. Then navigate by "Up" and "Down" keys to "Arguments" opti-
on. Press "Enter" when this option is selected by a highlight bar. A
little window will appear in the middle of the screen and ask You to
input the arguments. Enter the arguments or press "Esc." to cancel.

 	- Type theese arguments in DOS prompt while loading Inspector with
the directive to load another module. For example, the line

 			INSPECT A:ARJ.EXE A B:DOS C:\DOS\*.*

gives Inspector a directive to load a program ARJ.EXE from the current
directory of disk A: with the parameters " A B:DOS C:\DOS\*.*" (proba-
bly to find out how does ARJ really work).
	In Inspector arguments may be entered anywhere, even when no prog-
ram is loaded; so You may write your own programs that would feel like
in DOS environment.


	II.3. Inspecting & Debugging the Program.
       

 	For inspecting and debugging the program White & Black Phantoms
Executing Inspector has a set of tools. This part contains descripti-
on of the services with the purposes that they serve.

 	A) Inspector supports software breakpoints. When user specifies
breakpoint at any address, Inspector saves this address in its inter-
nal buffer. While program is runned, Inspector uses this address to
locate a breakpoint and when the program passes this address, Ins-
pector receives control. Inspector supports 128 breakpoints simulta-
neously. The ways that You may specify breakpoint are different.

 	- "Break Here" option of the Debug menu or "Insert" key while the
unassemble window is opened inserts breakpoint at the address position
specified by a select bar. If in this place a breakpoint is already
exist, this command deletes it. In Inspector this is the only, but
enough sufficient way to delete a single breakpoint.

	- Option "BreakPoint At" of the "Debug" menu. Use F5 key to open
the Debug menu. Select by the highlight bar the desired option and
press "Enter". At the special window You will be asked to specify the
address for the breakpoint (Segment & Offset); press "Enter" on the
"Segment:" prompt to leave the current segment of unassemble window.
If a breakpoint already exists in the specified address, Inspector
ignores the request and the number of available breakpoints remains
unchanged.

	- Option "Go Until" from the "Debug" menu or from the keyboard
while main window is active. From keyboard use "Ctrl-G" keys combina-
tion. In the special window You will be asked to input the address
for the breakpoint. All is the same to "Breakpoint At", except that
after "Go Until" option is used, the loaded (or written) program re-
ceives control.

	- You may enter breakpoints codes immediately in your source mo-
dule (INT NN). This provides an "unremovable" breakpoint, that can't
be deleted by the Inspector's means. Inspector will stop the program
execution every time it will face INT NN. To remove this breakpoint
You may replace INT NN by a NOP instruction (or its opcode 90H).

 	- To delete breakpoint You may use "Insert" key (delete single
break) or "Delete" key (Delete all breaks) or "Delete All Breaks" op-
tion of the Debug menu.

 	B) In Inspector a program may be runned with different levels of
control.

	- A program may be runned in a full speed. Use "Go" option of the
Debug menu or "G" key from the keyboard while main window is active.
In this case only Ctrl-Break press may return too Inspector if futher
program's running is not wanted (see II.3.C).

 	- Trace (single instruction). May be called from the debug menu
("Trace" option) or by F9 key from the main window. This option when
is called executes one instruction at a time. Provides a full control
on the process, letting inspect every step of it. Trace uses a hard-
ware interrupt 1, so this option lets inspecting ROM procedures.

 	- Single Step. This is equivalent to a "Trace" option except that
it considers CALL, LOOPx, REPx and INT to be a single instruction and
doesn't enter them. Useful to replace trace while any routine is known
to work properly. May be called from "Single Step" option from the
Debug menu or by F8 key from the main window. In all cases that differ
between "Trace" and "Single Step", the last cannot be used to inspect
ROM.

 	C) Inspector uses a different ways to receive control. Some of
 them (breakpoints & single step interrupt) were already mentioned;
 some may be useful in unusual situations.

 	- Inspector captures exit-to-DOS interrupts. This causes programs
that suppose that they return to DOS indeed return control to Inspec-
tor (normal termination). A special report window appears on the scre-
en that has information about the program's termination (normal or
 TSR) and exit code (for early DOS functions - such as INT 20h, INT 21h
function 0, INT 27 exit code in always 0).

	- Inspector uses "Ctrl-Break" key combination to abort program's
execution. From any place in the program if keyboard interrupt is ena-
bled Inspector receives control (abnormal termination). No report is
made in this case. Inspector remains in the state with module loaded,
unassemble window shows code starting from CS:IP, dump window - data
from DS:0, stack window - SS:SP in the low line.

	- Inspector may be left resident in memory ("Resident" option of
the File menu). When necessary, it may be called from any environment
if only keyboard interrupt is enabled. Use "Alt-Ctrl-Del" key combi-
nation to transfer control to resident Inspector. This case is iden-
tical to previous, except that no module is loaded.
	Note. When Inspector is active, "Alt-Ctrl-Del" synchro press ca-
uses warm reboot.

	- Inspector can use any software interrupt as software breakpoint.
The default value is got from configuration file and may be reconfi-
gured by SETUP utility. To put the desired interrupt number when loa-
ding Inspector, You may use the following command line:

		INSPECT *bNN

	*b : option, specifies set new breakpoint interrupt number
	NN : interrupt number (hexadecimal).

In futher we suppose that INT 3 is installed as a Software Breakpoint.

	D) For different testing purposes Inspector also has a number of
means. This paragraph shortly describes them.

 	- View/Edit services. Inspector has possibilities to perform View/
Edit on memory, file and disk drive contents. For view Inspector al-
ways has special Dump and Unaseemble windows that represent relative
data in the two main Inspector's formats. For edit Inspector also
receives data in two main formats: assembly-language instructions
and hexadecimal data input.
 	While debugging programs only View/Edit memory services are actual
to the task. In Inspector You can view any memory location which has
a valid address in both dump and unassemble windows; any writable me-
mory can be editted. Generally, the main window contains full state
of the current process at any time: except the already mentioned, the-
re are registers window that contains all the CPU internal registers
values and stack window. See Chapter III (View/Edit services) for
detailed description.

	- Print output of the memory contents. This option supplied espe-
cially by White & Black Phantoms Executing Inspector seems to be ve-
ry useful. Detailed description is in the special section of Chapter
III (View/Edit).

 	- Inspector has built-in string operations (here and futher string
is defined as a consequention of bytes with specified start location
(Segment:Offset) and range). According to this definition, strings
may pass through the segment border. The next byte after XXXX:FFFF is
supposed to be XXXX:0000 (XXXX=hexadecimal number). Inspector supports
copy, compare strings; search operations for data byte, text string,
instruction (repeatable); fill operations with byte, and I/O with
hardware ports. See Chapter IV (string operations) for the full des-
cription.

 	- INSPECTOR has an ability to execute a single instruction with
"no location". This means that You can write and execute instruction
without changing memory contents. This option is useful while You must
make slight changes for the testing purposes without destroying the
program that is currently loaded (for example, change video mode).
Immediate execution may be called by "Immediate" option from the Tools
menu or by "Shift+Ins" key combination while the main window is acti-
ve. This service is new for low-level debuggers. See also Chapter V
(new services).
 	Caution! The instruction that You write in this way has no spe-
cific address; it is kept in Inspector's internal buffer. All relative
control transfers - short (conditional) and near jumps, near calls are
illegal and will probably hang the system. Avoid using this instructi-
ons in immediate instruction prompt.

	RECOMMENDATIONS ABOUT USAGE. If You are an expirenced low-level
programmer, You may skip this part of the manual and pass to chapter
III immediately. For others here is a number of notes and recommenda-
tions taken from the author's practice in debugging.
	First of all, You may forget about a program that runs from the
first time normally without any mistakes. All we are humans and it's
a human nature to make errors - serious and slight. For programmer
the most terrible are "slight" mistakes that cause a great fault and
almost invisible from the first look.
	If You have made one of those mistakes, it's optimally to use
an "unremovable" breakpoint. Suppose that program works normally un-
til any specific moment or situation and then... for example, perfor-
mes cold reboot to a system (this act was not forsaw by You). So You
pass through the program's source, look through all the suspicious
instructions - control transfers (JMP, Jx, CALL, INT, LOOPx) and put
INT 3 instruction before all of them (starting from the place, until
which a program works absolutely correct). Probably, this way is re-
commended only for near and far jumps, calls and interrupts, because
You can easely inspect near jumps, so it's no need to overload your
program with breakpoints. Then start Inspector with your program from
the command line and run it in full speed ("G" command). Then every
time Inspector receives control, check the state in which it was rece-
ived, remember (or write down) its address and delete a breakpoint
(write a NOP instruction using a space key while an unassemble window
is active or using an "A" command with the address of the breakpoint).
Then use the "G" command again. Repead all theese steps until You face
a reboot after the next breakpoint. Now You know where is the "fault".
Reload a program and repead all steps until You will meet a control
transfer to a cold reboot routine.
	If You know in generally where is a mistake, another tactics may
be recommended. Load a program to debug and put breakpoint in the lo-
cation, until which a program works properly. When the program reaches
this place, use single step and trace debugging tools. Use single step
to pass through the procedures that work normally and trace the suspi-
cious places. Watch all the program state (registers, stack, dump, un-
assemble), use view screen, immediate execution I/O and string opera-
tions.
	If You are developping a logic system that has a logic mistake
and (for instance) has entered the permanent cycle, You may use the
"Ctrl-Break" key to capture control and scan the state. In the majori-
ty of cases You will see immediately what feature of the state doesn't
answer your expects. Than You can reload the program, put breakpoint
before the enter in this circle and run the program. After this using
trace, single step, view dump and registers and other debug features
of the Inspector You can correct the error situation.
	If You are trying to enter the strange program for any purpose
(for example, to crack a game and remove a password check), You may
try to use control capturing by Inspector. For instance, load the
program into memory, run it and press "Ctrl-Break" at the place You
want to inspect it. Otherwise You may perform a resident exit ("Resi-
dent" option of the File menu) and press "Alt-Ctrl-Del" at this place.
After receiving control, You may trace until return from the prompt
routine (probably, it would be an interrupt) and watch the desired
data using View Dump service at the segment specified by DS selector.


	II.4. Creating Programs.
       

 	White & Black Phantoms Executing Inspector contains tools that
make available creating and saving to disk short programs (no longer
than 64Kb). The program may be written with the Inspector's built-in
Assembler Interpreter that contains full instruction set for 80286
and compatible microprocessors. Assembler is available by "Assemble"
option of the Tools menu, "A" command key from the main window or
by inline assembler from Unassemble window active in main service.

	- When "Assemble" menu option or "A" key are used, Inspector dis-
playes special little prompt window, in which asks to input memory
location for assembling (Segment:Offset) and after this - assembly
language instruction. In address prompt You may use the default valu-
es - for assembler they are current segment and offset pointed by a
highlight bar in the unassemble window - by pressing an "Enter" key.
Then input the instruction. If You have input a wrong instruction, or
a wrong operand or operands combination, Inspector reports an error.
Look an Appendix 1 (short description of assembler) to find out what
was the mistake.

	- If You are using the Inspector's inline assembler, the currently
pointed by a selecting item instructions is deleted and You are promp-
ted to input an instruction directly in Unassemble window. Enter the
instruction. If everything is OK, the typed instruction is converted
to a machine-language code and displayed at the Unassemble window.
The incorrect input in the inline assemble doesn't cause Inspector to
report an error; unchanged contents of memory is displayed at the Un-
assemble window.
	Inspector's built-in assembler supports a DB instruction for ente-
ring string data. This instruction may receive as an operand only a
string of characters bounded by "" or ''. This string may be no longer
than 99 characters. To input single data bytes use the tecniques des-
cribed in Chapter III (View/Edit services) in the Dump section.

	After program is written, all debugging, testing and inspecting
services of Inspector are available for it. The program now may be
saved by using "Save" option of the File menu or "S" command key from
the main window. Inspector opens a special prompt window and asks You
to input the starting memory location (Segment:Offset; You may use
the default values of current segment for unassemble and offset of
100H), file length (must be no greater than 64Kb) and the file name.
Inspector writes the specified memory contents to a file and if any
error occured, reports an error. On-line help gives an advise to eli-
minate the error situation.
	RECOMMENDATIONS ABOUT USAGE. Inspector's means for creating short
modules are very useful for writing short programs. As a matter of
fact, this features let White & Black Phantoms Executing Inspector
be considered as an assembler interpreter. Really, with this Inspec-
tors services any kind of programs may be written. To avoid Inspec-
tor's limitation of 64Kb for file length You may use the following
tactics.

	- Suppose that all the memory above the currently pointed in Un-
assemble window location belongs to You. This is not really truth, be-
cause Inspector allocates 64Kb for user's purposes, remaining the rest
of memory free. If You need more than 64K for code, use DOS functions
49H to free the allocated memory and 48H to allocate a memory block
(see MS-DOS Programmer's Reference). This purpose for You may serve
an Immediate execution option of Inspector (see also section 3, pa-
ragraph D) of the current chapter, chapter V and Appendix 2).

	- Write your program and locate data trying to use different seg-
ments.

	- Save your program code and data segment by segment in different
files.

	- Use simple MS-DOS technique to copy multiply files to a single
file (for example, use

		COPY PROG1.COM+PROG2.COM+PROG3.COM

from DOS command prompt to write three saved files to a single file).
   Note. Inspector has no means to create an EXE module; this task
is very complicative if You don't use special programs - linkers. You
must refer to MS-DOS reference to get information about EXE modules
internal structure. In any case, we don't recommend such a work, it's
obviously more simply to use any regular assembler. If You program
can't be contained in a single segment, use the overlays and data fi-
les.


	III. VIEW/EDIT SERVICES.
       

 	White & Black Phantoms Executing Inspector is designed as a win-
dow system. It is not overloaded by different options and window ma-
nagement, like some other analogs. From the other side, Inspector
uses a number of methods to preserve user's screen and to provide to
user maximum easy and comfortable service in inspecting data, in which
wee see the main destination of the Inspector.
 	Inspector has tools to perform View/Edit of memory, file or disk
contents. The following sections contain a detailed description of
each service.


	III.1. Inspect Memory & CPU.
       

 	When White & Black Phantoms Executing Inspector starts work secci-
on or receives control from a process, always the main service window
is active. The whole window is divided to four parts: Unassemble win-
dow, Dump window, Registers window and Stack window. Generally, the
main service window contains all the necessary information about the
current state of the process.

	A) Unassemble window. This window lets view all data available in
your system memory as assmebly-language instructions. The disassembler
supports full 80286 instruction set. In this window "" points to IP
location while it's seen in the window. When the window is active,
spacebar key activates the Inspector's built-in inline assembler. In
inline assembler You are typing an instruction immediately at the
prompt in the unassemble window. The current line for the inline assem-
bler is pointed by a select bar of the unassemble window.
	Inspector also contains a CPU internal queue emulator. This works
when You are using the "Trace" service, so Inspector in this case be-
haves exactly as CPU executing single instruction. Inspectors emulator
even differs between CPU's and during the initial determination when
it is loaded, calculates between the other the length of CPU's inter-
nal queue. Look Chapter V.6.
 	Inspector's built-in assembler is a powerful tool for editting
data. It recognizes all 80286 extended instruction set, including a
popular DB directive.
 	There is a number of differences of Inspector's built-in assembler
from any of regulars. That's because Executing Inspector has an assem-
bler interpreter with no features of translator. The following list
describes all the differences that You always have to remember.

 	1) Relative jumps. Jx, JMP SHORT, JMP, CALL, LOOPx address_label
instruction use address_label as an operand. Normally it is a symbo-
lic name that is translated to an address by assembler. Here You must
write an address offset instead of the label. For example:

Regular assembler			Inspector's assembler

CMP	AX, DX	   			1000:0100	CMP	AX, DX
JE	equal 				1000:0102	JE	140
. . .	 | 	 			. . .        	 	|
. . .    |	 			. . .        		|
equal: <-	 			1000:0140             <-

     2) Long control transfers must have an absolute Segment:Offset as
operand instead of far label.

 	Regular assembler                    Inspector's assembler
					
   	CMP AX, DX			1000:0100	CMP AX, DX
 ------ JNE $+7			 ------	1000:0102	JNE 109
|       JMP equal----		|	1000:0104	JMP FAR 1010:0036
 ->	. . .			 ->	. . .            	|
		       |                       			|
 In the other segment: |                       		     	|
equal label far	     <-        		1010:0036             <-

     3) Variables names are translated into addresses in memory. So, if
variable VAR has an offset 8000h, VAR operand must be raplaced by
[8000].

     Regular assembler                   Inspector's assembler

     MOV AX, VAR[SI]			 MOV AX, [SI+8000]

     4) Inspector's assembler can't control data types. Address is not
assigned any type. So You must control the type when the type is not
clear according to instruction.

 	Regular assembler                   Inspector's assembler

     	VAR DB	?								-------
         . . .                                    . . .
	MOV	VAR, 10h							MOV BYTE PTR [8000h], 10

     If You haven't specified a data type, Inspector considers the ope-
rand to have a BYTE type.

 	5) All the numbers in Inspector's assembler are hexadecimal. You
cannot use

 		MOV	WORD PTR [8000h], 96D

to specify [8000h]=96 (decimal). Inspector will suppose it to mean
[8000h]=96Dh and You will face an error. Check all the numbers that
You use to have correct hexadecimal values!

 	For calling assembler Inspector uses "Assemble" option of the To-
ols menu or "A" command key while a main service window is active.
 	Unassemble window represents data in a following format:

 SEGM:OFFS  NN NN NN	Instruction  [operand1][, operand2][, operand3]

 	SEGM:OFFS are absolute Segment:Offset of directly addressed memo-
ry, where an Instruction is located. NN NN NN are hexadecimal numbers
(N here means a single hexadecimal digit - 0-9 or A-F), that represent
the machine code of instruction. A number of byte depends on the code
recognized by the first byte. Instruction is a mnemo-code representa-
tion of the instruction (assembly-language). For example, the follo-
wing line is possible:

191A:0100  B80100		MOV          AX, 0001

	If an instruction selected by a lighlight bar contains indirect ope-
rand, for instanse, [BP+DI+3456], at the top of the window appears a
prompt with a value stored at this location, such as:

Top border  DS:[0000] = CD 
		191A:0100	. . .
Selected	191A:0102	C60512 	MOV 	BYTE PTR [SI], 12
		191A:0105	. . .

	In unassemble window You may easily change the current memory lo-
cation (pointed by a select bar) by using Up, Down arrows and PgUp,
PgDown keys. Up & Down keys increase and decrease the current location
by one instruction; PgUp & PgDn keys change location by one full un-
assemble window of instructions. Shift-Up and Shift-Down combinations
increment and decrement the start (top) offset of the unassemble win-
dow respectively. Inspector's special key combinations Ctrl-Right
Arrow and Ctrl-Left Arrow increase and decrease IP register by one in-
struction.
 	Breakpoint here (insert & delete options) are available with the
Insert key only when Unassemble window is active - see Chapter II.3.
 	To change the starting location for unassemble, use "Unassemble"
option of the Tools menu or "U" command key. Inspector will prompt
You in a special window for Segment (current in default) and offset
(there is no default). Press Esc. key at any prompt to cancel.

 	B) Dump window. This wimdow represents data in hexadecimal-number
format and as ASCII characters. As in Unassemble window, in this win-
dow all valid locations of Your PC may be shown. To change the Dump
start loaction You may use "Dump" option of the Tools menu or "D" com-
mand key. In the special window Inspector will ask You about new lo-
cation (segment & offset). For segment the default is the current
dump segment; for offset there is no default.
 	A format of the data representation in the Dump window is the same
as the following

 SEGM:OFFS  NN NN NN NN NN NN NN NN NN NN   CCCCCCCCCC

SEGM:OFFS are Segment and Offset ot the start of the line. Each line
contains 16 (10H) data bytes. NN NN NN . . .  are hexadecimal values
stored at the respective locations (N=hexadecimal digit). CCCC . . .
are ASCII codes of theese values.
 	The highlight box is pointing to a current dump location when
dump window is active. You can easily control the current location
by the cursor movement keys - the same meaning as in unassemble win-
dow active).
	To edit data Inspector supports a set of operations. To edit a
single byte, You may press "Enter" when Dump window is active and In-
spector will prompt You to input a new value for selected byte.
 	In both Unassemble and Dump windows Home and End keys locate the
start of window to start and end of the current segment respectively.

 	C) Registers window. This window contains the current values of the
CPU internal registers for the process. Flags register has a special
representation in a lower section of this window.
	To navigate a selecting bar, use Up & Down keys. To change the se-
lected register's value, press "Enter" key and You will be asked to
input a new value. Home key locates a selecting bar to AX register;
End key - to IP register.
	Registers window is divided to two sub-windows: general registers
and flags. You may switch them by using <TAB> and <Shift-TAB>, as for
normal windows. Navigate a select bar by Left, Right, Up & Down keys 
and use a space key to change the currently selected flag. To return 
to a registers main section, press Shift-Up Arrow key combination.
	General registers are shown as hexadecimals and flags - as mnemo-
codes.

 	D) Stack window. This window shows word values contained in stack
segment (specified by SS selector). "<--" arrow points to a stack base
(SS:BP) and highlight bar points to a stack top (SS:SP). Stack window
is mainly a view window; highlight bar specifies a location in stack
segment that is to be editted. Press "Enter" when Stack window is ac-
tive to input a new value to this location.

	For editting and inspecting data Inspector also has string and I/O
operations; although they relate to a View/Edit service, they are de-
scribed in a particular chapter (IV).
 	Inspector has a very useful option: it can output dump and unas-
semble to printer rather than to display. For this You can use a Print
option of the top menu or F4 key while main window is active. In spe-
cial dialog box Inspector will ask You to input the data representati-
on format (dump or unassemble), starting location (Segment:Offset)and
ending location (Segment:Offset). There is no default location, so re-
ply all Inspector's inquires.


	III.2. View/Edit Disk Service.
       

 	This special service lets inspecting logical disk data. This ser-
vice is accessable from the "View Disk" option of the Specials menu.
Inspector will open a special View/Edit Disk window and ask You to
input a drive letter. After your answer, if the drive is valid, Inspe-
ctor fills the two windows with data.
 	All data in this service is represented in two windows: Unassem-
ble and Dump. Every window has a script with currently viewed absolu-
te sector and offsets relative to it.
 	In the case of an error Inspector displays a relative message and
asks to press Esc. key. Then it returns to main service window.
 	In View/Edit Disk only the most necessary services are included.
Here is a full summary of them.

 	A) Unassemble. Called by "U" key. Changes current unassemble abso-
lute sector and relative offset. Inspector will prompt You about the
new sector number (press Enter to leave the current) and new offset.
If an error occurs while loading sector, Inspector displays an error
message and waits for Esc. key press. After this it returns to the
unchanged state.

	B) Dump. Called by "D" key. Changes current dump absolute sector
and relative offset. All the "Unassemble" option features suitable
here relative to a Dump window.

	C) Assemble. Called by "A" key. Writes assembly-language instructi-
on to disk. Inspector asks You to input the relative offset (to the
start of the current sector for unassemble) and the instruction. If an
error occurs, Inspector displays the error message and don't change
disk contents.

 	D) Move. Called by "M" key. Enters data in hexadecimal format to
disk. You will be asked in special window to input the offset relati-
ve to the start of the current sector for dump and the data byte.

 	E) Cursor movement keys are used to scroll up & down the contents
of the current window. When end of sector is reached, a new one is lo-
aded and the scroll continues from the start of it. Up, Down, PgUp and
PgDown keys are used to scroll the window. Home key locates the start
of the active window to absolute sector 0, offset 0. End key locates
to the last sector (according to DOS data), offset 0.

 	F) TAB key swithes between the windows, changing the current one.

	G) When You are working with the View/Edit disk service, Inspector
loads sectors for unassemble & dump to its internal buffers. All the
changes that You make with assemble and move options are written to
theese buffers rather than directly to disk. To perform a real change
of disk contents, press "W" (write) key. This command makes Inspector
write on disk the contents of its buffers (for both unassemble and
dump sectors).
	Note If You have made any changes with the contents of the sec-
tor relative to the current window, and then changed a sector number
for the current window without using the "W" command, all the changes
are discarded. So, before loading a new sector for the current window,
make sure that You have saved the new contents of disk, or that this
is unnecessary.
 	To return to a main service window, press Escape key.


	III.3. View File Service.
       

     Inspector provides View/Edit service for files in the same manner
as it does for disks. To use this Inspector's feature, use the "View
File" option of the Specials menu. Principally, this service is analo-
goc to a View/Edit Disk service. The whole service window is divided in-
to two parts - unassemble and dump windows.
 	Unassemble window consists of two fields: hexadecimal number shows
relative offset from the start of file; instruction field represents
assembly-language instruction located at this offset in the file.
 	In dump window there are three fields: relative offset from the
start of file; hexadecimal representation and ASCII representation.
	* Cursor movement keys are used to scroll the contents of the cur-
rent window. Up & Down Arrow keys scroll one line of the current win-
dow. Page Up & Page Down keys scroll one full page of the current win-
dow. Home key locates the start of the currently active window to the
start of file (offset 0); End key locates to the end of file (accor-
ding to DOS data).
	* To change the current unassemble window start, use "U" (unassem-
ble). For the same action with dump window, there is a "D" key (dump).
 	* To change the file's contents assemble ("A") and move ("M") ope-
rations are supported by Inspector.
 	* To change current active window use the TAB key.
 	* To exit the View/Edit File option use the Esc. key.


	III.4. View User Screen.
       

	White & Black Phantoms Executing Inspector uses text mode 3 (80x25x
16 colors) or 7 (80x25x2 mono colors) for work environment. So when user
works with screen, especially in graphics, Inspector doesn't transmit
itself to new user mode, destroying both itself and user's picture (like
DEBUG does), but keeps current (last changed) screen in its internal buf-
fer. Here Inspector provides a good control on both screen and buffer
size. Screen buffer sizes are specified in configuration file and may be
set by user (see Chapter VII). Inspector supports all standard Monochro-
me, CGA, EGAA, MCGA, VGA modes and extended VGA modes. In all cases it
saves all video information that doesn't exceed its' buffer. Thus user
may save only part of the screen if it is known that the rest of the
screen will not be changed.
	Note Inspector saves all Video controller's registers, including
EGA's palette registers and VGA DAC registers; so You may don't care
about it.


	IV. STRING OPERATION. I/O SERVICES.
       

     Inspector has a number of options that are described here, in a
special chapter although they may be connected with some other to-
pics. The reason for such an approach is a considerable difference
of this services from the others.
	String operation are defined here as operations with memory areas
with known start location (Segment:Offset) and range. In all prompts
there is a default segment. In operations with assembly-language in-
structions it is the current segment for unassemble, in all other ca-
ses it's a current dump segment. To select a default segment, press
"Enter" key at the "Input Segment" prompt instead of input a number.
	Inspector supports the following set of operations for performing
without a need to write special subroutines.
 	* Compare strings. May be called by a "Compare" option of the Spe-
cials menu or from keyboard by Alt-C key. Needs two locations and a
range. Creates a report about the two specified strings (do they dif-
fer or no).

 	A) Copy strings. Called by a "Copy" option of the Specials menu or
by Alt-P key from keyboard. Needs two locations and range.

	B) Search operations. Inspector can perform search in a given seg-
ment for data byte, string or instruction. All this options may be
called from Specials menu or from keyboard. The keys are:
 			- Alt-B	-> Search for byte
     		- Alt-S -> Search for string
     		- Alt-N -> Search for instruction
 	In all the cases starting location, range and the search argument
are needed. After the search is completed, the selecting items of the
window relative to search are located to point to the found argument,
or Inspector reports that argument is not found (that's not an error,
so no specific help on this topic may be seen). For search for instru-
ction the respective window is Unassemble window; for byte and string
search it's a Dump window.
 	Inspector also supports repeated search for all arguments; it's
available from keyboard with Ctrl-[relative letter key] (Ctrl key re-
places Alt). If You are trying to repead a search without performing
the first one, Inspector turns You to a standard search prompt.

 	C) Fill operations. Inspector may fill a string with any value.
There are three options relative to fill:

		1) Fill area with byte (location, range and data byte are re-
quired; current segment for dump is default). Calling: "Enter" option
in Specials menu or "E" key.

 		2) Fill area from a port. This and the next are operations re-
lative to both strings and I/O service. Fills a string by a values,
consequently read from a single port. Location, range and port number
are required. May be called by "In Port" option of Specials menu or
by "Alt-I" key.

 		3) Fill port from area. Fills a single port by consequent wri-
tes from a string. Uses requirements of the previous described opera-
tion. For both I/O operations the default segment is the current one
for dump. Called by "Out Port" option of Specials menu or by "Alt-O"
key.
	Notes As it was already signed, White & Black Phantoms Executing
Inspector is written in 8086 codes. Although the Fill Port and Fill
Area from port seem to use the 80186+ INSB and OUTSB instructions,
they don't; so You may feel no feer in using this Inspector's options
on the original PC.
	Be careful when You are using Inspector's Copy Strings option.
This operation uses 8086 string MOVS instruction directly, without
intermediate copy to any buffer.
 	The usage of Inspector's powerful options is clear; search for in-
struction, for example, is very useful for find different CALLS to a
single subroutine, if You suspect that one of them is not formed cor-
rectly. Search for data may help You in inspecting data segments.
However, several examples may be found in Appendix 3.

 	Inspector supports regular I/O operations for ports and disk dri-
ves. For ports there are Input From Port (In option of Tools menu or
"I" key from a keyboard) and Out To Port (Out option of Tools menu or
"O" key). For disks Inspector has Read and Write operations of abso-
lute sector (DOS concept). Any valid disk absolute sector may be read
into or written from memory. This options may be called from the "Re-
ad" and "Write" options of the Tools menu or by "R" and "W" keys re-
latively.
 	Notes Port I/O options may read or write only byte data values.
To make the same effect as writing to a 16-bit port, You can perform
two writes to two consequent ports. For example

 			IN AX, 100 =is the same as= IN AL, 100 + IN AH, 101

	Disk I/O operations may read only one sector at a time. To read
a chain of sectors, call the needed option several times.


	V. SPECIAL SERVICES AND FEATURES.
       

 	The following services are principally new for debuggers. Although
all of them are relative to the other topics, this chapter contains a
list of them with a description of required parameters and usage.
 	All this options are not new for a number of programs; they were
included to White & Black Phantoms Executing Inspector because the
authors wanted to have a really polyfunctional debugger with a wide
set of possibilities and use their concept.

 	1. Immediate Instruction Execution. This option is relative to an
assembly-language interpreter. It executes a single assembly-language
instruction without writing it to a work memory area. May be very use-
ful in testing work.
		Immediate Instruction is called from "Tools" menu, "Immediate"
topic or from keyboard by "Shift+Ins" key command. Then a special
window appears on the screen:

			ͻ
			     IMMEDIATE	     
			 Input Instruction: 
					     
			 	 _	     
			ͼ
						
	The instruction that You will input here will be executed.
	Note Remember, that this instruction is "addressless", so, al-
though control transfers are allowed, they will probably hang Your
system. Don't use control transfer instructions in "Immediate" mode!

	2. View/Edit Disk service. This option has been already realized by
PCTools (PCShell) utilities packet, Norton Utilities, but is still new
for debuggers. Moreover, the representation of disk data in two for-
mats is pretending to be principally new. See Chapter III.2 for deta-
iled description.

 	3. View/Edit File service. View file service is not already new
even for debuggers; therefore the realization of this option by Tur-
bo Debugger doesn't allow editting files; also showing data in two
windows, editting via assembling are new. See Chapter III.3 for deta-
iled description.

 	4. String I/O operations. This is an extension of the regular I/O.
See the description in Chapter IV.

 	5. Interrupt info service. Displays location and short information
about system call. User has to input only an interrupt number. See de-
scription in Chapter VI.

	6. Inspector has built-in CPU internal queue emulator. When star-
ting the work session, Inspector performs several checks, including
CPU check and determines the appropriate queue length. During the work
when user issues "Trace" service, Inspector takes code not from the 
"Unassemble" window contents, but automatically with internal queue 
emulator's buffer, thus making the full effect of work with the CPU.
The next instruction that is supposed to be executed is displayed al-
ways at the top of the unassemble window as CS:IP .
	The internal queue is reloaded in this way: after any instruction
is executed, the queue shifts right and the rest of bytes is loaded.
After control transfer the queue is reloaded fully.
	User may change the internal queue by common Inspector's means:
input hexadecimal data, assembly instructions, etc. After each data in-
put CPU queue is fully reloaded.
	

	VI. ON-LINE HELP. INTERRUPT INFO SERVICE.
       

 	1) Inspector's on-line help.
 	Inspector has an on-line help to assist You to orient in its en-
vironment. Inspector's help is available from a keyboard via F10 key.
At any given moment Inspector is in some particular state, which has
its own original code. Inspector uses this code to find relative da-
ta in the file "INSP.HLP". All error situations also have a special
code; data for them includes an advise how to remove the error state.
 	While help is displayed on the screen, You may use Up and Down
Arrow keys to scroll the help window and read all the help informati-
on. To exit help, You must press one of white space characters or Esc.
key.
 	To receive help about Inspector and its authors, select Help menu
option from the main top menu and press "Enter" or F10.
 	To get help on menu options, select the desired option via menu
and press F10 instead of "Enter". Inspector will display You help on
the topic.
 	Inspector's on-line help is not available when a dialog box is
opened. In such a state F10 key has no effect.

 	2) Inspector's Interrupt Info service.
     Inspector provides a short "Interrupt help" service. This option
is available from the Tools menu ("Interrupts" service), prompts You
for interrupt number and displays short information about the speci-
fied system call (loaded from the file "INTS.dat"). This information
contains of:
 	* Interrupt's location. Absolute address (Segment:Offset) read
from the interrupts vector table.
 	* Short information about standard destination of the interrupt
handling routine and its type (hardware or software interrupt). Hard-
ware interrupts are supported by a machine; they are called automati-
cally upon some specific events on devices by a PIC. For instance,
keyboard calls hardware interrupt #9 (IRQ 1) upon key press. Bios has
an interrupt handler written especially to serve this event.
 	Software interrupts are probably routines that are resident in
memory. The system call of software interrupt is analogous to a proce-
dure call.
 	All interrupt handlers may be overwritten to make them serve more
purposes (or another, specific purpose). For example, Inspector over-
writes interrupts ## 1, 3, 8, 9 (optionally), 10h, 16h, 1Bh, 20h, 21h,
24h, 27h.

 	Note Both Inspector info services use data files. Full Inspector
packet cotains theese two data files; but if You don't have any of
them, the respective service becomes unavailable. Inspector doesn't
report any error in such a case; it just ignores your call.


	VII. INSTALLATION AND OPTIONS. SETUP PROGRAM.
       

 	The full packet of White & Black Phantoms Executing Inspector con-
tains the following files:
 	* INSPECT.COM - main executable module for Inspector. Runs Inpsec-
tor and performs all its options.
 	* SETUP.COM - a program to change setup for Inspector.
   * INSP.CFG - Inspector's configuration file. SETUP program writes
its changes to this file.
 	* INSP.HLP - data file for Inspector's on-line help.
   * INTS.DAT - data file for Inspector's Interrupts Info service.
   * INSPECT.DOC - this file - description of White & Black Phantoms
Executing Inspector.

     A number of options Inspector considers after the automatic check
of present hardware and software when being runned. Besides this, some
of Inspector's internal parameters may be set by user to optimize the
work seccion with Inspector. All changes of this kind may be done with
a SETUP program.
	If You want to change the current setup for Inspector, run SETUP
from the DOS command prompt. The current changable setup will be dis-
played. Use Up and Down Arrow keys to move the pointer among the opti-
ons. A list of options is following above with a description of option
and purpose to change it.
 	Press "F1" key to save the current setup for futher use by Inspec-
tor and "Esc." key to end setup.


	List of SetUp Options.
       

 	1) Inspector's active page. Although Inspector watches its main en-
vironment screen, saves it in internal buffer when user's program is
being executed and this option seems unnecessary, it has a usefull-
ness. The reason is that Inspector doesn't follow the direct writes to
a display memory. So user's program that access directly the video me-
mory may conflict with Inspector. To avoid it, set for Inspector video
page not accessable by a program.
 	Monochrome display has only one video page, so this option even
set has no effect on the work seccion with Inspector if You work with
monochrome card or monochrome video mode.

 	2) Text mode buffer. Inspector saves user active screen to buffer
and loads it when user's program is executed. This parameter sets the
size of text-mode buffer that Inspector will keep in memory. This pa-
rameter must be set if You have to use more then one text page (the
default setting). The size of one text-mode page is 2 Kb for 40x25
mode and 4 Kb for 80x25 mode. See next paragraph.

 	3) Graphics mode buffer. this parameter specify a size of graphics
mode buffer, in which Inspector will save user's screen if a program
will switch to a graphics mode (or is started in such a mode). It is
unwise to keep video buffer larger then You need. The table that is
following below contains recommended by the authors values for this
parameter suitable to a specific video mode.

 Ŀ
  Mode  Type Resolution  Adapter    Colors    Recommended size 
 Ĵ
   0    Text   40x25     CGA/EGA     16         2 KB           
 Ĵ
   1    Text   40x25     CGA/EGA     16         2 KB           
 Ĵ
   2    Text   80x25     CGA/EGA     16         4 KB           
 Ĵ
   3    Text   80x25     CGA/EGA     16         4 KB           
 Ĵ
   4    Gfx.  320x200    CGA/EGA      4         16 KB          
 Ĵ
   5    Gfx.  320x200    CGA/EGA      4         16 KB          
 Ĵ
   6    Gfx.  640x200    CGA/EGA      2         16 KB          
 Ĵ
   7    Text   80x25     Monochr      2          4 KB          
 Ĵ
   D    Gfx.  320x200    EGA/VGA      16         32 KB         
 Ĵ
   E    Gfx.  640x200    EGA/VGA      16         64 KB         
 Ĵ
   F    Gfx.  640x350    EGA/VGA      2          28 KB         
 Ĵ
   10   Gfx.  640x350    EGA/VGA      4/16       112 KB        
 Ĵ
   11   Gfx.  640x480     VGA         2          32 KB         
 Ĵ
   12   Gfx.  640x480     VGA         16         128 KB        
 Ĵ
   13   Gfx.  320x200     VGA        256         64 KB         
 

 	For changing the first three items, press "Enter" and input the
new requested value at the prompt.

 	4) Display swapping. Inspector allows two modes of display swap-
ping when tracing: smart (recommended) and always. Always means that
user screen is reloaded each time Trace or Single Step options are
used. In smart swapping mode Inspector decides if the next instructi-
on is able to change the screen contents or read from it or no. If it
is, Inspector loads the user's screen and then transfers control to a
program. If it isn't, Inspector doesn't load the screen, economing ti-
me.
 	Use Space key to change this parameter value to opposite.

	5) Default brealpoint interrupts. Specifies what interrupt number
will be used as Software Breakpoint if it is omitted from command line.
The recommended default value is 3.

	6) Display colors. Almost all the color attributes used by Inspec-
tor may be changed. Setup program allows to change colors. Navigate
pointer to an attribute You want to change; then "+" on the extended
keyboard increments the foreground attribute, "-" on the extended key-
board decrements. Shift- "+"/"-" increments/decrements background co-
lor value.


	APPENDIX 1. A SUMMARY OF 80286 ASSEMBLY-LANGUAGE INSTRUCTIONS.
       

    	This appendix includes the full set of 80286 instructions and its
address combinations in real mode addressing. For the protected-mode
addressing see special references.
	Note Executing Inspector doesn't support the work in 80x86 pro-
tected modes; if You are smart enough, use special technics to make
Inspector think that it works in real mode (such as, for instanse,
HIMEM.SYS does).
 	The description of every instruction contains its mnemo-code used
to refer to it in assembly language (specified by great letters), se-
quence of acts that CPU performs according to the instruction (boun-
ded by "<. . .>" and word description of the effects of this instruc-
tion.


 	1. 80286 Instruction Set.
       

	MATH COMMANDS
       ---------------

	In two-operand arithmetic instructions available operand combi-
nations are:
 		- Register, [Mem_Loc] & VS
   	- Register, Value
   	- Memory, Value
 	In one-operand instructions the only operand must be a register
or [memory_location] with the required type.

AAA - ASCII Adjust for Addition
	AAA
	Converts the result of addition of two unpacked BCD numbers
	in AL to unpacked BCD format.
AAD - ASCII Adjust for Division
	AAM
	Converts the unpacked BCD in AX to binary code in AL for
	futher division.
AAM - ASCII Adjust for Multiplication
	AAM
	Converts the result of multiplication of two unpacked BCD numbers
	in AL to unpacked BCD format.
AAS - ASCII Adjust for Subtraction
	AAS
	Converts the result of subtraction of two unpacked BCD numbers
	in AL to unpacked BCD format.
ADC - Add with CARRY
	ADC destination, source		<destination=destination+source+CF>
	This command adds source with destination with CARRY and
	puts the result to destination. So, if you have 0 in AX
	and 0 in BX, but CARRY flag is set, after ADC AX, BX
	you will get 1 in AX.
ADD - Add
	ADD destination, source		<destination=destination+source>
	Add source with destination and stores result in destination.
	Only one of the operands may be a memory location. Source may
	be also an immediate value.
CBW - Convert Byte to Word
	CBW
	Converts signed value in AL to signed value in AX register.
CWD - Convert Word to Double word
	CWD
	Converts signed value in AX to signed value in DX:AX pair.
DAA - Decimal Adjust for Addition
	DAA
	Converts the result of addition of two packed BCD numbers
	to packed BCD in AL. If result is greater than 99, it adds
	1 to AH.
DAS - Decimal Adjust for Subtraction
	DAS
	Converts the result of addition of two packed BCD numbers
	to packed BCD in AL. If result is greater than 99, it sub-
	tracts 1 from AH.
DEC - Decrement
	DEC destination		<destination=destination-1>
	Subtracts 1 from destination.
DIV - Divide (unsigned)	
	DIV operand         <AX/operand=AL+AH(remainder)> or
						<DS:AX/operand=AX+DX(remainder)
	If operand is a 8 bit value, AX register will be divided by
	this value and result will be placed in AL, remainder will
	be placed in AH. If operand is a 16-bit value, DX:AX pair
	will be divided with result in AX and remainder in DX.
    	If a result exceeds destination (AL or AX register), in-
   terrupt 0 is called (Divide Overflow).
IDIV - Divide (signed)
	IDIV operand		<analogous to DIV instruction>
	If operand is a 8 bit value, AX register will be divided by
	this value and result wil be placed in AL, remainder will
	be placed in AH. If operand is a 16-bit value, DX:AX pair
	will be divided with result in AX and remainder in DX.
   Copies most significant bit of result to a SF (sign) and calls
   INT 0 upon overflow.
IMUL - Multiplication (signed)
	IMUL operand		<AX=AL*operand> or
						<DX:AX=AX*operand>
	If operand is 8-bit value (register or memory location), it
	multiplies AL with operand and result will be placed in AX.
	If operand is 16-bit, it will be multiplied with AX and result
	will be placed in DX:AX pair.
IMUL - Immediate multiplication (signed)			80186
	IMUL destination, source, value        		        -----
    					<destination=source*value>
   Multiplies source by value and puts result in source. All three
   operands must have a WORD type. If a result of the operation
   exceeds destination, CF (carry) is set and the high word of the
   result is lost. Sets SF (sign) if the result is negative.
INC - Increment
	INC destination		<destination=destination+1>
	Adds 1 to destination.
MUL - Multiplication (unsigned)
	MUL operand			<analogous to IMUL instruction>
	If operand is 8-bit value (register or memory location), it
	multiplies AL with operand and result will be placed in AX.
	If operand is 16-bit, it will be multiplied with AX and result
	will be placed in DX:AX pair.
NEG - Complement sign
	NEG destination		<destination=-destination>
	Multiplies destination by -1.
SBB - Subtraction with Borrow
	SBB destination, source		<destination=destination-source-CF>
	Subtracts (source + CARRY) from destination, storing the
	result in destination.
SUB - Subtraction
	SUB destination, source		<destination=destination-source>
	Subtracts source from destination. Only one operand may be
	specified by memory location. Second operand may be specified
	by immediate value.


	DATA STORAGE COMMANDS
	---------------------

LEA - Load Effective Address
	LEA register, memory location	<register=address of [mem_loc]>
	Loads memory locations' address to register. Effective in
	constructions like:
		LEA SI, [BX+DI+244]
        Register must be a WORD register.
LDS - Load pointer using DS
	LDS register, memory_location	 <register=mem_loc>, DS=mem_loc+2>
	Loads pointer placed in memory_location:
		offset will be loaded into specified register
		segment will be loaded into DS register
LES - Load pointer using ES
	LES register, memory_location    <register=mem_loc>, ES=mem_loc+2>
	Loads pointer like LDS command, but segment will be placed
	in ES register.
MOV - Move value to memory/register
	MOV destination, source			<destination=source>
    	The following operands combinations are available for
   MOV instruction:
    	Reg, Reg
        Reg, Mem_Loc & VS
        Reg, Value
        Mem_Loc, Value
        Mem_Loc or Reg16, Segment_Reg & VS
	Moves value of the source to the destination. Value may be
	register, memory location or immediate value. Destination
	may be register or memory location. Source and destination
	must be the same type. Can't move from memory location
	to memory location - you must use a register for tempro-
	rary use.
POP - Pop value from stack
	POP destination			<destination=SS:SP>, <SP=SP+2>
	Pops value from the stack and puts it to destination. May
	be used with 16-bit registers/memory locations only.
PUSH - Push value to stack
	PUSH source				<SP=SP-2>, <SS:SP=source>
	Pushes value to the stack. Source must be 16-bit only.
   Source may be register or memory_location.
   80186 allows also PUSH immediate_value format.
   -----
XCHG - Exchange two values
	XCHG value1, value2
	Swaps two values. Values may be kept in registers or memory
	locations. Can't swap two memory locations.


	PROCESSOR/EXECUTION CONTROL COMMANDS
	------------------------------------

CALL - Call procedure
	CALL address		<IP=IP+3+value>, or
   CALL register		<IP=register>, or
   CALL [mem_loc]      <IP=[mem_loc]>, or
	CALL FAR address    <CS:IP=address>, or
	CALL FAR [mem_loc]	<CS:IP=mem_loc>		(far CALL)

	Puts next command address to stack and transfers control
	to part of the program destinated at specified address.
	Address may be an immediate value, value of register or
	value of a specified memory location. For NEAR CALL IP is put
	to stack (word), for FAR CALL - CS:IP pair (2 words).
CLC - Clear CARRY
	CLC						<CF=0>
	Clears CARRY flag (usable for math operations).
CLD - Clear DIRECTION
	CLD						<DF=0>
	Clears DIRECTION flag (usable for string operations).
CLI - Clear INTERRUPT
	CLI						<IF=0>
	Clears INTERRUPT flag - disables interrupts.
CMC - Complement CARRY		
	CMC                     <AF=0>
	Complements CF flag (inverses current value)
ESC - Sent instruction to other processor
	ESC immediate, source
HLT - Halt processor
	HLT
	Stops processor until INT pin in CPU would be not
	activated by external device.
INT - Call interrupt
	INT number
	Calls interrupt with specified number. FLAG register,
	CS register and offset of next command would be stored in stack.
INTO - Call interrupt 4 on overflow
	INTO
	Calls interrupt 4 if OVERFLOW flag is set
IRET - Interrupt Return
	IRET
	Returns from interrupt: pops from stack offset and segment
	of the command to transfer control to, and pops FLAG
	register.
JMP(s) - Transfer control to another part of program
	JMP address
	Transfers control to command located at specified address.
	JMP - Unconditional jump.	<analogous to CALL>
    	Address may be a value, register, or memory location address.
	Conditional jumps:
    	Address must be an immediate value so that
					-128 <= Address-IP <= 127
	Often used after CMP command.
	Conditional jumps are:
	JO		-	Jump on overflow/OVERFLOW set
	JNO		-	Jump if no overflow
	JB/JNAE/JC	-	Jump if below/CARRY set
	JNB/JAE		-	Jump if above or equal
	JZ/JE		-	Jump if equal/ZERO set
	JNE/JNZ		- 	Jump if not equal
	JBE/JNA		-	Jump if below or equal
	JNBE/JNA	-	Jump if not above
	JS		-	Jump if SIGN set ( <=0 )
	JNS		-	Jump if SIGN not set ( >0 )
	JP/JPE		-	Jump on parity
	JNP/JPO		-	Jump if no parity
	JL/JNGE		-	Jump if less
	JNL/JGE		-	Jump if greater or equal
	JLE/JNG		-	Jump if less or equal
	JCXZ		-	Jump if CX = 0

LAHF - Load AH with FLAGS
	LAHF
	Fills AH register by FLAGs. Used for compatibility with
	8080 processor family.
LOCK - Lock bus
	LOCK
	Locks the bus until command after LOCK would be finished.
LOOP(s) - Loop
	LOOP address		<analogous to relative JMP>
	Transfers contorl to command specified at address,
	decreases CX by 1. When CX would be 0, transfers control
	to command placed after LOOP.
	May be also conditional loops:
	LOOPZ/LOOPE  	-	Loop until CX <> 0 and ZERO flag set.
	LOOPNZ/LOOPNE	- 	Loop until CX <> 0 and ZERO flag not set.
NOP - No operation
	NOP
	Am empty opcode: no operation taken.
POPF - Pop FLAGS from stack
	POPF
	Pops FLAG register from stack. (See POP)
PUSHF - Push FLAGS to stack
	Pushes FLAG register value to stack. (See PUSH).
REP(s) - Repeat prefix.
	REP
	Repeats next command decreasing CX value. Gets out when
	CX = 0. May be conditional REP:
	REPE/REPZ  	-	Repeat until CX <> 0 and ZERO set.
	REPNE/REPNZ	- 	Repeat until CX <> 0 and ZERO not set.
	May be used only before string operations (ignored in other
	cases).
RET - Return from procedure
	RET [immediate]
	May be in two formats:

   RETN (return near)	<IP=SS:SP>, <SP=SP+2> or
   RETF (return far)	<IP=SS:SP>, <SP=SP+2>, <CS=SS:SP>, <SP=SP+2>

	This command pops an address from stack and transfers control
	to it. If immediate is specified, it also increases SP register
	by this value.
SAHF - Save FLAGS from AH
	Fills FLAGS register by bits set in AH. Used for compatibility
	with i8080.
STC - Set CARRY
	STC							<CF=1>
	Sets CARRY flag.
STD - Set DIRECTION
	STD							<DF=1>
	Sets DIRECTION flag (used for string operation)
STI - Set INTERRUPT				
	STI                         				<IF=1>
	Enables interrupts.
WAIT - Wait
	WAIT
	Makes processor wait until the next operation executed.


	STRING/ARRAY OPERATIONS
	-----------------------

	By using segment prefix before string instructions, You may
   overwrite the DS segment selector. The ES selector cannot be
   overwritten (a prefix is ignored if placed). For example:
    	CS: MOVSW moves word from CS:SI to ES:DI location.
   On the contrary,
    	CS: SCASB compares AL with ES:DI, prefix doesn't matter.
	INSB, INSW, OUTSB, OUTSW instructions described later in I/O 
   instructions description are also string instructions.

CMPSB/CMPSW - Compare strings
	
	CMPSB command compares byte destinated at address DS:SI
	with byte destinated at ES:DI, then increases DI and SI
	by 1if DIRECTION flag is not set and decreases if DIREC-
	TION is set. CMPSW compares word and changes SI and DI by
	2. You may use REP prefix before this command.
    	
MOVSB/MOVSW - Move string
	MOVSB
	Copies string. Source string offset must be placed in SI,
	destination string offset must be loaded in DI.  MOVSB
	copies byte form memory located by DS:SI to ES:DI then
	increases SI and DI by 1 if DIRECTION flag is not set.
	if DIRECTION flag is set, it decreases SI and DI.
	MOVSW copies word and changes SI and DI by 2.
	You may use REP prefix before this command.
LODSB/LODSW - Load string
	LODSB
	This command loads string element placed at DS:SI into
	AL register and increases SI if DIRECTION is not set. If
	Direction is set, it decreases SI register. LODSW loads
	word into AX and changes SI by 2.
SCASB/SCASW - Scan string
	SCASB
	This command compares byte placed at ES:DI with AL register
	and increases/decreases DI register. SCASW compares AX
	with the address specified in ES:DI. You may use REP
	prefix before this command.
STOSB/STOSW - Store string
	STOSB
	This command stores byte placed in AL to memory location
	specified in ES:DI, then increases/decreases DI. STOSW
	stores word placed in AX and increases/decreases DI by 2.
	You may use REP prefix before this command.
XLAT - Tables access
	XLAT		<AL=DS:BX[AL]>
	This command loads into AL register byte from the table
	placed in address specified by BX register. Number of
	element of the table must be specified in AL register
	before call.


	LOGICAL AND BITWISE COMMANDS
	----------------------------

    	Note Logical shifts described in this chapter use n_bits
   according to the following:
    	n_bits=1 or n_bits=CL for 8086 instruction set
      n_bits=value or n_bits=CL for 80186 instruction set
AND - Logical AND
	AND first, second
	This command performs logical AND for first and second parameter
	and stores the result in register/memory location specified
	by first operand. Only one of two operands may be a memory
	location, second operand may be an immediate value.
CMP - Compare two values
	CMP first, second
	This command compares first and second operand and sets
	FLAGS so you can perform conditional jump after this command.
	Only one of two operands may be a memory location, second
	operand may be also an immediate value.
NOT - Logical NOT
	NOT operand
	This command performs logical NOT with its operand.
OR - Logical OR
	OR first, second
	This command performs logical OR for first and second parameter
	and stores the result in register/memory location specified
	by first operand. Only one of two operands may be a memory
	location, second operand may be an immediate value.
RCL - Rotate Left Through CARRY
	Rotates left bits in destination and CARRY by value specified
	by n_bits. N_bits may be an immediate value or CL register.
RCR - Rotate Right Through CARRY
	Rotates right bits in destination and CARRY by value specified
	by n_bits. N_bits may be an immediate value or CL register.
ROL - Rotate Left
	ROL destination, n_bits
	Rotates left bits in destination by value specified by n_bits.
	N_bits may be an immediate value or CL register.
ROR - Rotate Right
	ROR destination, n_bits
	Rotates right bits in destination by value specified by n_bits.
	N_bits may be an immediate value or CL register.
SAL/SHL - Shift Left
	SHL destination, n_bits
	Shifts left bits in destination by value specified by n_bits.
	N_bits may be an immediate value or CL register.
SAR - Shift Right (signed)
	SAR destination, n_bits
	Shifts right bits in destination by value specified by n_bits.
	N_bits may be an immediate value or CL register. Value is signed,
	bit 7 doesn't shift.
SHR - Shift Right (unsigned)
	SHR destination, n_bits
	Shifts right bits in destination by value specified by n_bits.
	N_bits may be an immediate value or CL register.
TEST - Test bits
	TEST value1, value2
	Sets ZERO flag if one or more bits in value1 and value2 are
	same. Only one of the values may be specified by memory
	location, value2 may be also an immediate value.
XOR - Exclusive OR
	XOR first, second
	This command performs exclusive OR for first and second parameter
	and stores the result in register/memory location specified
	by first operand. Only one of two operands may be a memory
	location, second operand may be an immediate value.


	HIGH LANGUAGE SUPPORT
        ---------------------

    	Theese instruction available only for 80186+ microprocessors.
                                              ------
ENTER - enter procedure
	ENTER n_words, n_bytes	<PUSH BP>, <BP=SP>,
							<SP=SP-(n_words*2+n_bytes)>
	Formats stack for procedure use after CALL - prepares a room for
	procedure's local variables.
		This instruction's format is not natural, and the simply in-
	struction sequence PUSH BP\ MOV BP, SP\ SUB SP, value is more ef-
	fective. This is a reason that most compilers don't use this in-
	struction.
LEAVE - leave procedure
	LEAVE		<SP=BP>, <POP BP>
   Restores the caller's stack before procedure returns.
BOUND - bound if array is out of range.
	BOUND register, [memory_location]
	Checks if [memory_location] <= register <= [memory_location+2].
	If the result is negative, calls interrupt 5.


	80286 PROTECTION CONTROL
        ------------------------

    	This set of instructions serves different purposes of protecti-
   on control in 80286+ microprocessors. Inspector doesn't serve de-
   bugging in protected mode, so this instructions are only mentioned
   here. Look in special literature for the description of all details
   noted (and omitted) here.
LGDT - load Global Descriptor Table.
	LGDT [source]
	Loads Global Descriptor Table base Register (GDTR) with 6-byte
	value starting from source.
	Used to set base of GDT before switching to PM.
SGDT - store Global Descriptor Table.
   SGDT [dest]
	Stores 6-byte Global Descriptor Table base Register (GDTR) to
   memory starting from dest.
LIDT - load Interrupt Descriptor Table.
	LIDT [source]
	Loads Interrupt Descriptor Table base Register (IDTR) with
	6-byte value starting from source.
SIDT - store Interrupt Descriptor Table.
	SIDT [dest]
   Stores 6-byte Interrupt Descriptor Table base Register (IDTR) to
	memory starting from dest.
LLDT - load Local Descriptor Table base Register.
	LLDT [source]
   Loads a WORD LDTR (selector in GDT) from word ptr [source]
SLDT - store Local Descriptor Table base Register.
	SLDT [dest]
   Stores LDTR to word ptr [dest]
    	Both LLDT and SLDT instructions are illegal in real mode.
LMSW - load machine status word (MSW).
	LMSW source
   Source may be a WORD register or memory location.
   Used to switch to protected mode.
SMSW - store machine status word (MSW).
	SMSW dest
   Dest may be a WORD register or memory location.
LTR - load task register (TR).
	LTR source
   Loads TR from WORD register or memory_location. Use for task switch
   in protected mode.
STR - store task register (TR).
	STR dest
   Stores TR is WORD register or memory_location
LAR - load access rights
	LAR dest, source
   Loads high-byte of dest with access rights of the source descriptor.
   Dest is a WORD register.
LSL - load segment limit
	LSL dest, source
   Loads segment limit of source descriptor to dest.
   Dest is a WORD register.
VERR - verify for read
	VERR segment
	Sets ZF=1 if segment can be read by a task.
   Segment is an [address]
VERW - verify for write
	VERW segment
   Sets ZF=1 if segment can be written by a task.
   Segment is an [address]
ARPL - adjust requested privilege level
	ARPL segment, register
   Sets WORD register with the higher of [segment] DPL and CPL.
   Accessable only in PM.


	INPUT/OUTPUT OPERATIONS.
        ------------------------

    	All 80x86 microprocessors support 64 Kb of I/O addressing space.
   For I/O the following instructions are used:

IN - input from a port
	IN accumulator, port
   Reads a value from a hardware port. Accumulator may be AL if BYTE
   I/O or AX if WORD I/O operation is performed.
   Port operand may be a BYTE immediate value or DX (this allows access
   to ports with number greater than 255).
OUT - output to a port
	OUT port, accumulator
   Writes a value to a hardware port. Operands have the same meaning as
   in IN instruction.
INSB, INSW - input from a port to string
	Reads a BYTE or WORD value from DX port number to ES:[DI] and incre-
   ases (decreases) DI register by 1 or 2 relatively according to DF.
OUTSB, OUTSW - output to a port from string
	Writes BYTE or WORD value from DS:[SI] to DX port number and incre-
   ases (decreases) SI register by 1 or 2 relatively.
    	String I/O are available only for 80186+ microprocessors.
                                          ------


	2. CPU structure & addressing mode.
       

	8086 has 13 internal WORD registers, that are used for different
purposes. The special features of each described below.
	- Four segment selectors: CS, DS, ES, SS specify segments for
data references:
 	CS specifies current code segment
	DS specified the default segment for data references
	ES used as destination in string instructions; may be loaded
with any value ass addition data segment selector
	SS specifies stack segment and default for [BP+...] references.

     - Eight general purpose registers; four of them allow access
to both high low bytes:
 	AX (accessable also by AH and AL bytes) - accumulator. Use in
arithmetic instruction, I/O operations, string operations.
 	BX (BH & BL) - base register. Use as base pointer in [BX+...]
addressing and in XLAT instruction as base table address.
 	CX (CH & CL) - counter. Use in REP string_instruction construc-
tions and in LOOPx instruction as counter. Special use in JCXZ in-
struction and logical shift instructions (bit counter). CL is used
in shift instructions.
	DX (DH & DL) - data register. Used in I/O operations as port in-
dex and as high word and remainder in math. instructions.
	SI - source index. Pointer to source data in string moving ope-
rations.
	DI - destination index. Pointer to destination data in string
operations. SI and DI registers are useful as indexes in [BX+SI+...]
and [BP+DI+...] constructions.
	BP - stack base register. Default pointer for stack segment in
[BP+...] constructions.
 	SP - stack pointer. Specifies word that is the top of stack seg-
ment (stack grows down). Use in PUSH/POP instructions, procedure and
interrupt calls, with RET and IRET instruction.

 	Additional, flags register used to define the current state of
the CPU. Some bits of this register have special mnemonics:
 	CF - carry flag. Set when the result of operation exceeds desti-
nation, when borrow is made with SUB and CMP instructions. May be
set by STC instruction or cleared by CLC.
 	AF - auxiliary carry flag. Analogous to carry ralative to bit 3
of the destination.
 	PF - parity check flag. Set when  a result of operation has even
number of set bits.
 	ZF - zero flag. Set when a result of operation is 0, by VERR and
VERW instructions if succesfull.
 	SF - sign flag. Copies a most significant bit of the result of
some math instructions.
     DF - direction flag. Determines whether string operations incre-
ment (=0) or decrement (=1) index registers. May be set and cleared by
STD and CLD instructions.
 	IF - interrupt enable flag. Allows CPU receive signals from an
INT pin. When set, disables interrupts (no hardware interrupts take
place). May be set & cleared by STC and CLC instructions.
 	OF - overflow flag. Set upon overflow in division instructions.

 	8086 uses 24 different ways to access indirectly data in memory.
That are all available structures that may replace [memory_location]
field in section 1 of this appendix.

[BX+SI]			[BX+SI+byte_value]		[BX+SI+word_value]
[BX+DI]			[BX+DI+byte_value]		[BX+DI+word_value]
[BP+SI]			[BP+SI+byte_value]		[BP+SI+word_value]
[BP+DI]			[BP+DI+byte_value]		[BP+DI+word_value]
[SI]			[SI+byte_value]			[SI+word_value]
[DI]			[DI+byte_value]			[DI+word_value]
[immediate]		[BP+byte_value]			[BP+word_value]
[BX]			[BX+byte_value]			[BX+word_value]

The physical address is calculated as ADDR=SEG*16+OFFSET. Offset is
calculated in one of 24 ways, according to operand field of instruc-
tion. SEG is the default for every addressing mode, unless not over-
written. The default segment is SS: for [BP+...] and DS: for all the
others. Segment one-byte preffixes CS:, DS:, ES:, SS: allow to change
the default segment selector used to calculate the physical address.

	8086 uses the following data types:
   	- BYTE (1 byte, 8 bits)
     	- WORD (2 bytes, 16 bits)
     	- DOUBLE WORD (4 bytes, 32 bits).


	APPENDIX 2. A SUMMARY OF INSPECTOR'S MENUES, HOT KEYS AND MOUSE
       
SUPPORT.


	1. Menues.
       

    	All Inspector's run-time service functions may be called via menu.
Inspector has a system of openable menu windows. On the top line of
the screen there are displayed six topics of the main menu and hot
keys that open the relative menu from the keyboard in any state.
 	To access the top menu - menu topics without opening them, there
is an Escape key; it selects File menu topic without open it. Then cu-
rsor movement keys (Left & Right) navigate the selecting bar in menu
topics; Up & Down Arrows open the selected menu topic for option sele-
ction. Besides Print and Help menu topics all the others have options.
"Enter" key issues the selected topic in any case. If the topic has
options, it opens the options menu bar; if it doesn't, "Enter" key
executes the relative service function.
 	If You have opened the menu options window, all the options are
displayed in it with the hot keys that call this function from the
keyboard. For example, the first line of the File topic menu is

	Load    <L>.

 	The "L" key will call the "Load" option from the working window,
but here it is unavailable. To select a menu option from a box, You
must navigate the selecting bar to it by Up & Down cursor movement
keys and press "Enter" when done.
 	"Escape" key exits menu from any level; it also exits all the ser-
vice functions (View/Edit) if You decide to discard them.
 	Menu is not available while any service function is being proces-
sed.
 	Here is a summary of Inspector's menues and options, including
purposes and hot keys. A key bounded by <. . .> calls the same option
from the keyboard when menu is not opened. If there is no key, that
means that the option is accessable only from menu.

	A) File menu <F1>.
       
   * Load <L> - loads a program to debug & inspect.
   * Save <S> - Saves a program to disk.
   * Change Dir <C> - Changes DOS current disk and directory.
   * DOS Shell - Pauses Inspector and runs DOS command interpreter.
   * Exit <Alt-X> - Ends Inspector work seccion.
   * Resident - Ends Inspector, leaving it resident in memory.

	B) Tools menu <F2>.
       
   * Dump <D> - Change current location for Dump.
   * Unassemble <U> - Change current location for Unassemble.
   * Assemble <A> - Assemble to specified location.
   * Immediate <Shift-INS> - Immediate instruction execution.
   * In Port <I> - Read byte from a hardware port.
   * Out Port <O> - Write byte to a hardware port.
   * View Screen <V> - View user work screen.
   * Interrupts - Interrupt Short Info service.
   * Move <M> - Write byte to specified location.
   * Read <R> - Read disk absolute sector to memory.
   * Write <W> - Write memory contents to absolute sector on disk.

 	C) Specials menu <F3>.
       
   * View Disk - View/Edit Disk service.
   * View File - View/Edit File service.
   * Enter <E> - Fill memory area with data byte.
   * In Port <Alt-I> - Fills area with values from a hardware port.
   * Out Port <Alt-O> - Fills a hardware port with values from area.
   * Compare <Alt-C> - Compares two strings (memory areas).
   * Find Byte <Alt-B> - Search for a byte.
   * Find String <Alt-S> - Search for a string.
   * Find Instruction <Alt-N> - Search for instruction.
   * Copy <Alt-P> - Copy one memory area contents to another.

	D) Print menu <F4>.
       
     There is no submenu available in Print menu topic. Selection of
this topic causes Inspector to start a print service funcion.

       	E) Debug menu <F5>.
       
   * Breakpoint At - Puts breakpoint at specified location.
   * Go Until <Ctrl-G> - Executes until specified address.
   * Run <G> - Runs program on full speed.
   * Break Here <Insert> - Puts/Deletes  breakpoint at current loca-
tion.
   * Single Step <F8> - Executes one step of a program.
   * Delete All Breaks <Delete> - Deletes all breakpoints.
   * Trace <F9> - Executes one instruction of a program.
   * Arguments - Prompts for command-line arguments for a program.

	F) Help <F10>.
       
	This topic also doesn't have a submenu in White & Black Phantoms
Executing Inspector version 1.0. When selected, gives "help on help" -
about Inspector and how to get help in Inspector's environment.

       	2) Hot Keys.
       
 	When Inspector starts working, a set of keyboard keys become
active. In every state only a number of keys from this set is avail-
able. The table below contains the short description of destination
of every key.

͸
 Keyboard key       Function Assigned to a Key by Inspector        
͵
     "A"       Calls Inspector's built-in assembler. Requires spe- 
Ĵ
     "C"          Change of current DOS disk & directory           
Ĵ
     "D"       Changes starting location for current Dump window.  
Ĵ
     "E"          Fill a memory area with data byte   	     
Ĵ
     "G"          Go (Run). Runs user program with full speed      
Ĵ
     "I"          Performs a single read from a hardware port      
Ĵ
     "L"          Loads module from disk			     
Ĵ
     "M"          Moves a data byte to a specified memory location 
Ĵ
     "O"      	Performs a single write to a hardware port   
Ĵ
     "R"      	Read a sector from disk to memory	     
Ĵ
     "S"      	Save specified memory contents in a file     
Ĵ
     "U"       Changle stsrting location for current Unassemble    
	       					window       
Ĵ
     "V"      	View user screen			     
Ĵ
     "W"        Write specified memory contents to absolute disk   
	         sector. Saves to disk changes in View/Edit Disk    
Ĵ
 Cursor move-  Navigate selecting item through the currently ac-   
 ment keys     tive window. Scroll up & down the current window.   
Ĵ
    Insert      Insert/Delete breakpoint while unassemble window   
	        is active.					     
Ĵ
 Delete       	Deletes all breakpoints			     
Ĵ
 Enter	        Perform a choise: select menu item, open an in-     
	        put box, input strings and values in dialogs.	     
Ĵ
 Escape        Exits the current choise that is in progress. Exits 
	        from all services to main services set. Calls menu. 
Ĵ
   TAB         Swaps current active window on the Arrow direction  
Ĵ
 Shift - Up    Decrements starting location for active Dump or Un- 
	        assemble windows. Swaps Registers window areas to   
	        to main registers when active			     
Ĵ
 Shift - Down  Increments starting location for active Dump or Un- 
	        assemble windows. Swaps Registers window areas to   
	        flags register when active			     
Ĵ
 Shift - Ins.  		Immediate instruction execution	     
Ĵ
 Shift - Del.  Unload currently loaded program and restore stan-   
	        dard Inspector's state with no module loaded	     
Ĵ
 Alt - "B"    			Search for a data byte	     
Ĵ
 Alt - "C"       	Compare strings (memory areas)		     
Ĵ
 Alt - "I"    	Fill memory area from a hardware port	     
Ĵ
 Alt - "N"    		Search for an instruction   	     
Ĵ
 Alt - "O"    	Fill a hardware port from memory area	     
Ĵ
 Alt - "P"    		Copies strings (memory areas)	     
Ĵ
 Alt - "S"    			Search for a data string     
Ĵ
 Ctrl - "B"     Repeat search for data byte from the current lo-   
	        cation						     
Ĵ
 Ctrl - "G"    Go Until. Execute user program until specified	     
	        address					     
Ĵ
 Ctrl - "N"    Repeat search for instruction from the current	     
	        location                                            
Ĵ
 Ctrl - "S"    Repeat search for string from the current loca-     
	        tion						     
Ĵ
 Ctrl - Right  Increases IP register by one instruction  when      
	        Unassemble window is active                         
Ĵ
 Ctrl - Left      Decreases IP register by one instruction  when   
	        Unassemble window is active			     
Ĵ
	   F1  	Open File menu                               
Ĵ
	   F2  	Open Tools menu				     
Ĵ
	   F3  	Open Specials menu			     
Ĵ
	   F4  	Select Print menu topic			     
Ĵ
	   F5  	Open Debug menu                              
Ĵ
	   F6  	Reset the currently loaded module	     
Ĵ
     	   F8  	Execute  Single Step over a program   	     
Ĵ
	   F9  	Execute  single instruction (trace)	     
Ĵ
	   F10 	Get an on-line help			     
;

	3. Mouse Support.
       
 	Inspector supports input from mouse device if MS-MOUSE or compa-
tible driver present. At the start of work Inspector changes the pre-
sent hardware & software and sets its interal flags; so mouse driver
presence will be detected automatically.
	Inspector supports standard one-button mouse; the only button of
standard one is the left of poly-buttoned mouse. The left button is
select button in Inspector. According to displacing of mouse pointer,
left button press selects relative function. The right button is a can-
cel button; it cancel previously selected operation. And the third,
central, button provides help (in fact, the same function as F10 key-
board key).


	APPENDIX 3. LIST OF RESERVED NAMES AND ABBREVIATURES USED IN
       
THIS MANUAL.


 	* IBM PC is a registered trademark of International Business Ma-
chines Corporation.
 	* 8086, 80186, 80286 are registered trademarks of Intel
Corporation.
 	* MS-DOS, MS-MOUSE, DEBUG, HIMEM are registered trademarks
of Microsoft Corporation.
 	* Turbo Debugger, Turbo C are registered trademarks of Borland
International.
   * PCTools, PCShell are registered trademarks of Central Point
Software Corporation.
	* Norton Utilities is a registered trademark of Peter Notron
Computing.
	* DBASE is a regestered trademark of Ashton-Tate Corporation.
	* All other products mentioned in this Manual are properties of
their respective owners.

     The symbols 'Inspector', 'Executing Inspector' refer to
White & Black Phantoms Executing Inspector. White & Black Phantoms
 Executing Inspector is a personal property of its authors, Drubetsky
Vadim (Black Phantom) and Voikhansky Artemy (White Phantom).

 	Short glossary of used abbreviatures:
     - CPU is central processing unit (microprocessor)
     - I/O is Input/Output
     - PC is personal computer
     - DOS is disk operating system
     - Kbyte is 1024 bytes, Mbyte is 1024 Kbytes
     - XMS is extended memory system
     - PSP is program segment prefix
     - BASIC is beginner's all-puprose symbolic instruction code
     - ROM is read-only memory
     - ASCII is american standard code for information interchange
     - PIC is programmable interrupt controller


	APPENDIX 4. LIST OF FILES OF WHITE & BLACK PHANTOMS
       
EXECUTING INSPECTOR.


		The full version of White & Black Phantoms Executing Inspec-
	tor includes the following set of files. Check their presence to
	make sure that Your version will have all the documented features.

		- INSPECT.COM --- the main program
		- SETUP.COM ----- Inspector configurator
		- INSP.CFG ------ the configuration file
		- INSP.HLP ------ help file
		- INTS.DAT ------ data file
		- INSPECT.TXT --- this documentation file
		- README -------- basic information file
		- LICENSE ------- license agreement file
		- SRC\INSPECT --- source code for Executing Inspector
		- SRC\SETUP ----- source code for setup program.


	APPENDIX 5. CONTACT WITH WHITE & BLACK PHANTOMS.
       

Ŀ
 Drubetsky Vadim is a real name  Voikhansky Artemy is a real name 
 of Black Phantom.		  of White Phantom.                
Ĵ
    The address is:		     The address is:               
 Hashmonaim  26 apt. 8, 59384,   Bilu  6 entr. 2, apt. 3, 59308,  
 Bat-Yam, Israel.                Bat-Yam, Israel                  
Ĵ
    EMail address: INTERNET	     EMail address: FIDONET        
 bphanotm@inter.net.il          				    
Ĵ
    The contact phone numer is:     The contact phone number is:  
       (972)(50) - 481860	        (972)(54) - 346691         


