View Single Post
  #2  
Old 05-13-2004, 08:10
JMI JMI is offline
Leader
 
Join Date: Jan 2002
Posts: 1,627
Rept. Given: 5
Rept. Rcvd 199 Times in 99 Posts
Thanks Given: 0
Thanks Rcvd at 98 Times in 96 Posts
JMI Reputation: 100-199 JMI Reputation: 100-199
In Softice 3.0 and 3.1 breakpoints are context sensitive. That means that they work only within the "context" of the process within which they are set. While D.S. 3.0 had no option, D.S. 3.1 has an option to have breakpoints operate like they did in former versions of Softice. Those threads you say you reviewed should have made this clear.

Softice also comes with a manual. You should have reviewed the ADDR and ATTACH instructions in that manual. Again those threads explained how these worked. ADDR in on page 8 and ATTACH on page 22.

Reading these threads:
http://66.98.132.48/forum/showthread.php?t=5470

http://www.exetools.com/forum/showthread.php?s=&threadid=2548&highlight=sice

should have explained it to you.

You set ADDR you type ADDR (process name/id), then you should be able to bpx <whatever...>

You can use ATTACH instead of ADDR if you want. "ATTACH <process name/id>" causes an automatic "ADDR <process name/id>" every time you Ctrl+D.

Another good idea reported in those threads is to let the SYMBOL LOADER load the application, stop at the ENTRYPOINT (it does all this automatically) and then put in your breakpoints.

another reported solution was to:

Put a breakpoint at entrypoint (be sure to type first bpint3 in sice), start the program and when it breaks start puting breakpoints for the apis u'r interested to spy. After that replace the CC byte with the original one and press F5. Each time a function u'r bp sice will popup.

Regards,
__________________
JMI

Last edited by JMI; 05-13-2004 at 08:13.
Reply With Quote