Hello everyone!

Has anyone succeeded in installing visual softice and using it for remote debugging? I tried to install target components on a win2k sp4 machine and add a virtual nic to enable the machine to be debugged remotely but the driver didnt seem to work... Any exeriences?

Softice: YES

Softice for remote debugging: NO

Visual Softice: wuzzat??

Have Phun

Visual softice is inluded in Driver Studio 3 and is used for remote debugging.

I can't even get the normal softice to work on XP SP1... Installs fine and I can enter softice and set breakpoints but they NEVER trigger. That is breakpoints set on the windows api (showwindow, destroywindow, getwindowtext). When loading a program in the symbol loader and starting it it breaks nicely at the start of the program and when I set a bp on a memorylocation in there it DOES trigger.

Downloaded symbol files, used the osinfo.dat from the numega site as they mentioned but nothing seems to help. What am I missing?

I'll install Service pack 1a now... hope that that will help but if anyone has an idea please say so.

Btw, it's Driverstudio 3.0 with Softice 4.3.0 (build 1268)... tia

Hi!

for bpx.es you have to be in context of debugee...
this is done with addr command or attach...

if this is no good for you, one can make it work as of old by:
- Using symbolretriever (part of the softice package) to down symbols for ntoskrnl.exe and convert them to nms then load them with symbol loader... This will make bpx work with all contexts...

personaly I think that sucks, since we don't want it to break on the wrong app/context... but it's a matter of taste or if one can relearn... I was very surprised when I went to DS2.7 and discovered this...

then again... Your problem may be something worse...?

/Manko

Thanx for the reply Manko.

I never knew of this addr/attach nessecity... is it new since 3.0 or specific for xp sp1? Since I used 2.7 (and previous versions) for a long time and never needed to do this.

So the 'global' breakpoints on things like getwindowtext don't work anymore (after exporting the nessecary dll's)? I did try the symbol retriever but without any luck. I am going to read into those commands some more and see if I can get it to work like that...

Though I'd prefer the old way of simply starting softice and setting the nessecary breakpoints

Is everyone on crack? Just Kidding

DS 2.7 still sets global breakpoints! For BPM's tho you DO need to be in debugee's context, but not for BPX

-nt20

Hi!



Sorry Nico, such is not the case with my DS2.7.
...for bpx on api i must be in context... hmm...

...also... I never needed to be in context for BPM on API... is this also case in DS30?

/Manko

Allrighty, got it to work... so the method is now to load the app into symbol loader, then set the address (ADDR processname) en set breakpoints from there on...

Does it also break in dll's used by the process/program then? And is this really THE way to do it? It seems to work fine now and I must say it's quite an advantage that it now only breaks on the relevant process and not EVERY occurance of the api even though that means a few more steps before being able to set the breakpoints....

Hi!

You can also use
BPM <address/api> x
instead of bpx.

That will also give you info on from where the proc was called.

Also, instead of the symbolloader you can use other tools like LordPE Break'N'Enter.

Also, if you have time, just start the app you're gonna debug, CTRL-d into ntice, addr, addr <name>, now put BPX where you want them, for example on getdlgitemtexta before you press the ok-button to let proggy get reginfo... now it will break...

or, first bpm on some API that is always run first in any app, then do bpx.es with addr and stuff...

To be honest, I usually only do bpx on addresses in the app... Maybe I should use them more... ? Hmm...

There are tricks against both methods, so it's try and see...

btw, if you use symbolloader, the app breaks automatically, so you don't need addr to get into correct context, you're there already. (Attach on the other hand might be good. ATTACH: Will make it so that sice issues a addr <appname> everytime you do CTRL-D)

/Manko

aaaaah, like that... things are quite clear now finally hehe. Been a while since I meddled with softice on my puter, the problems with xp have been to big for a while for me to keep calm while using it

Tnx for the help Manko

Hmmm, here I am again...

I wonder how you can best do this in the case of an installer (like .msi) instead of a normal app. For this one creates new temporary files from which the code is executed and loading the main setup.exe through the symbolloader doesn't seem to work, that is... breakpoints don't trigger.

Also when doing an "ADDR" when in the setup I see multiple instances of MSIEXEC, how to get into the address context of a specific one? Or would the only solution in this case be setting global breakpoints (by downloading the symbol files). Are there other ways to do global breakpoints?

I tried the "bpm 'api' x" but that one also only seems to work after an ADDR/ATTACH... Sorry for all the questions but I can't seem to find the right information to answer them myself :/ Tia.