Hello,

I have a program that uses its own dll. The dll has some interesting export functions. I've added the path to the dll into winice.dat (I've copied the dll into %SYSTEMROOT% directory) :

EXP=c:\windows\system\bla.dll

But once I want to set a breakpoint (after restarting) on some of the functions >> Symbol not def.... Is it possible to use these (export) functions (as breakpoints) or it is nonsence (and I am lame)?

Thanks,
sF

Try ensuring that CASE-SESITIVITY in not ON in softice (though by default, it is off).

Other than that, try this final step:

1. Do NOT copy it to %systemroot.
2. Instead, let it be present in your app folder (say, c:\MyApp)
3. Set path in ICE to point to that directory (as in EXP=c:\MyApp\bla.dll)
4. That SHOULD work.

...Have Phun

Or just use the symbol loader to load the exports from the dll.

File -> Load Exports and voila...

Hi sF,

All those ways should work to load your dll into Softice. To make sure they are loaded you can type
EXP <partial-name>
in Softice. For example if your dll exports the function _blafoo then you if you typed
EXP _blaf
you should get the calling address of that function. Then you should be able to set a breakpoint on the name or the address.

You can use this too when you're reversing if you forget, or want to peruse, the exports. For example 'EXP reg' will give you all the standard advapi32.dll registry breakpoints.

Cheers,
Kayaker