Log in

View Full Version : Need help with Soft-Ice


Mambo
April 30th, 2003, 19:09
Hello.
In some cases when you first for example call
BPX GetWindowTextA
and press F11 it takes me straight to user32.dll. So how can I get Soft-Ice to the address from where this function has been called? (module&address).

naides
April 30th, 2003, 19:48
Well F11 does exactly that. What its happening is GetWindowTextA was not directly called by your app but indirectly through user32.dll and perhaps other intermediary burocracy.

One solution is to keep pressing F12 (pRET) until you land in the code of your application, which should not be far from the call that produced the GetWindowsTextA call.

Other situation may arise when your application uses an interpreter or virtual machine like java and VB. In this situtation the normal Windows API calls are not called diectly and you have to use another way to break into the code.

Mambo
May 1st, 2003, 05:07
I see...thanks.

F12 works well, but with this it just quits softi-ice when I press F12. What´s another way to break into this code, please?

naides
May 1st, 2003, 05:26
Quote:
Originally posted by Mambo
I see...thanks.

F12 works well, but with this it just quits sofi-ice when I press F12. What´s another way to break into this code, please?


Well this is sorta of wide open, and thorny question, which lies at the heart of software cracking, none the less: Breaking in the right area of the code is close to 50% of the RE endeavor. . .

Without knowing anything about your target I would suggest:

Disassemble the app and look at the import table. There you willl see a list of the APIs that are indeed directly called by your app, and you may have better luck in setting breakpoints.

Some people may disagree with me but Cracking in NT based systems like W2000 and XP adds unnecessary complexity to the task. Given the choice, do your carcking in a win98 system. There I have found that using F12 sooner or later takes me back to the app code. With WinXP you might have landed into a truly independent thread and once you go through the call-stack, Sice just quits and the sytem continues the flow of the programs.

Explore methods using BMSG Break on wm_destroy or wm_lbuttonup outlined in tutors else where (try the Cracker's Notes, still a newbie classic) and open your reperoire of braking inside the code methods.

By the way, I just read another post you placed in a different thread. If you are using Sice 4.05 NT in a windows XP system, you are bound to problems:

Only Sice 4.27 or Driversrudio 2.7 performs half decent with winXP, and that is after applying Kayaker's patch, available somewhere in this board.

Mambo
May 1st, 2003, 05:39
Thank you.
I will try that.