Of course anyone who's intimately familiar with SoftIce will probably already know this, but I finally figured it out (it seems).

Even with DriverStudio 2.7, I could not get SI to BPX on anything in XP with SP1. In fact, you would know why, if you go into SI and do a "U messageboxa". It shows you nothing. No code. So it basically doesn't even know where the code is.

If you read thru the SI release notes, it states that you can make SI load the symbols for ntoskrnl.exe. Since binaries of the exe will be different in SP1, I think this "breaks" it. (Even though compuware says 2.7 supports XP with SP1, I can't get it to work, on two different computers with SP1). To make SI load the symbols and work correctly do this:

1. Get the symbols for ntoskrnl.exe from microsoft. I just used the nice handly utility that comes with DriverStudio 2.7, It's called Symbol Retriever. You can open this up, and select the file you want symbols for (ntoskrnl.exe) and click "Get symbols". It will automatically go to m$'s site and download the current symbols for that file and convert them to *.nms format. Nice huh?

2. NOw, go to Symbol loader and "Edit -> Softice INitialization Settings".

3. Go to "Symbols", and add the ntoskrnl.nms file that you just downloaded/created with the symbol retriever.

4. Go to "Advanced" and enter "NTSYMBOLS=ON" in the text box and press "Add".

5. Reboot.

After this SoftICE should work correctly and see the correct addresses. I just tried it on XP SP1 which SI wasn't working correct, and it fixed it just fine.

Oh, and Read the SI Manual If you are newb !

-nt20

Hey.
Thanks for the tip. That was the missing link for me to get softice to break at program start when loading a program via the loader.
I did apply Kayakers patch, but it didn't work. I have traced through a lot of Softice code the last few days without finding the solution. The patch did what is was supposed to do and put the value FFFF in the memory at the right place. And I couldn't find any flaws while tracing all the way until I ws back in nmtrans.dll.
But now it works...

Nice,

hobgoblin

Funny, in DS 2.7 I did not need to load symbols to have the imports loaded properly. The bug in DS 2.6 was that imports for the main DLLs or any EXP= in the softice initialization file would not be resolved into memory properly. Noone really ever investigated why and I am surprised Numega did not catch it. Having symbols in addition since they include the imports did seem to solve the problem in many but not all cases. But 2.7 fixed it all for me symbols or no symbols though I must admit that symbol downloader utility is very handy . Softice not breaking on winmain is a completely seperate error. That is what Kayakers patch is for. I fear that people are mixing those 2 glitches up. Though I fear people are breaking at winmain too much. Yes it is a useful technique but often completely unnecessary. I rarely if ever require a break upon entry. Of course I am more of a dead code reverser but still even if you are investigating a serial check on load I am sure you can find an API that will lead you right into the code you want to look at not the entry point ie RegQueryValueEx or CreateFile, etc... Yes I realize entry point can be useful but it seems far overrated to me. If you dont have it you can probably find a way to do what you need anyway .

Snatch

Well, yes, this wasnt to solve the WinMain problem. I myself could also care less about WinMain. This was to fix my problem of not being able to set ANY breakpoints at all.

I am a dead code reverser as well by the way. I mean I prefer it that way.

-nt20

Well looks like we have some things in common. I would hope most reversers are of this approach though. I feel with live code I am going on a journey where I am looking for specific values and to not understand the code but to see how it changes the registers and memory. With dead code I understand and look at the big picture. Anything I am completely baffled on I can always use live code if necessary to help understand. The freedom one has with a dead listing is at least for me a more relaxed perspective. I guess its the difference between a keygen and a serial but for me I always start with a dead listing and go from there.

Snatch

I was one of the people in which Kayaker Patch worked right away. The Symbol Exports for NTOSKRNL.EXE were loaded into Sice BY DEFAULT, so I did not have to do what Nikola is describing. And Neither would I ever figure it out.

Now, what I am thinking about may be old news, so please don't flame me for saying it:

In the win98 memory model, Each app had a memory space, but the system libraries and API were shared by all applications, so they had a known, defined and easily findable memory address.

In the new memory model, XP each app has a full memory space that it owns, and has it's own copy of the system libraries it uses within its memory space.
While in Win98 a bpx CreateFile referred to a single instance and publicly known address of the CreateFile API, In the new model each program has an instance of CreateFile in its memory space, So a general BPX CreateFile does not make sense unless you further qualify which instance you are referring to. There are several of them, each belonging to the memory space of an app. Am I wrong in my interpretation of the problem of BPX on APIs?

Yep,

Just have a new comp. here installed with xp.......... .
At setting up SI i expected problems like setting bpx's etc.
Tried all sugestions but all faild untill i tried to softice's driversuits configuration settings > here you can specify when loading softice.First i tried "boot" (load softice before windows loads)
this didn,t work so i switched to "system" (start softice with windows) and YES this did the trick.
(i do not know if this will correct all problems (cause it seems some people have prob's and others none...) but it's woth checking this.)

Okee,

Happy reversing on xp !

SpeKK.

naides:

2K and XP exhibit "copy on write" memory for system files. ALL programs share the same system data (user32.dll, etc) unless one of these files gets modified by an external program, then the O.S. copies the data and swaps out the page from the other programs, to protect them.

This is to allow "protection" from a bad program trying to hook into all other programs with some sort of global API overwrite.

However, SoftICE lies underneath the system and hence it wouldn't fit into this catergory in my opinion. Once the system is loaded, API addresses don't change, even under different processes. (the code could change tho, and if it did, the O.S. would copy it into that specific process and page out the shared code to protect itself.)

-nt20