aimless
July 4th, 2001, 23:44
Hullo All,
Win2K,
Softice 4.05 for NT
(no SPs in NT, so ICE works excellent...)
Now,
* Go to loader and starting notepad.exe (yup!)
* giving command
T =cs:eip 300
Now, this traces the next 300 instructions as they occur.. (sorta like a executable run time listing...I always wanted that).
But...
This command also traces over system code (ntdll, ntoskrnl, kernel32..yiddayidda).
Is there any way (none that I could find in the manual or net) that can instruct softice to trace only instructions in the current process (that is context of notepad ONLY) and auto do a P RET if it encounters system code...?
CSIP not ... does not work as it requires BPs to be set.
*Sigh*, wish there was a P =cs:eip 300 command acceptable in ICE!!
Any leads anyone?
Regards,
Win2K,
Softice 4.05 for NT
(no SPs in NT, so ICE works excellent...)
Now,
* Go to loader and starting notepad.exe (yup!)
* giving command
T =cs:eip 300
Now, this traces the next 300 instructions as they occur.. (sorta like a executable run time listing...I always wanted that).
But...
This command also traces over system code (ntdll, ntoskrnl, kernel32..yiddayidda).
Is there any way (none that I could find in the manual or net) that can instruct softice to trace only instructions in the current process (that is context of notepad ONLY) and auto do a P RET if it encounters system code...?
CSIP not ... does not work as it requires BPs to be set.
*Sigh*, wish there was a P =cs:eip 300 command acceptable in ICE!!
Any leads anyone?
Regards,