Log in

View Full Version : 'T' - ing in SoftICE: But lets stick to the debugged process...


aimless
July 4th, 2001, 23:44
Hullo All,

Win2K,
Softice 4.05 for NT
(no SPs in NT, so ICE works excellent...)

Now,

* Go to loader and starting notepad.exe (yup!)
* giving command

T =cs:eip 300

Now, this traces the next 300 instructions as they occur.. (sorta like a executable run time listing...I always wanted that).

But...

This command also traces over system code (ntdll, ntoskrnl, kernel32..yiddayidda).

Is there any way (none that I could find in the manual or net) that can instruct softice to trace only instructions in the current process (that is context of notepad ONLY) and auto do a P RET if it encounters system code...?

CSIP not ... does not work as it requires BPs to be set.

*Sigh*, wish there was a P =cs:eip 300 command acceptable in ICE!!

Any leads anyone?

Regards,