Log in

View Full Version : Softice startup problem in XP SP1


roocoon
February 1st, 2004, 08:08
Hi all.
Maybe somebody has come across this case and has some suggestions.
On an XP SP1 system, I used to run Softice (from DriverStudio 3.0) with its normal problems. in manual startup mode.
I backed up to 2.7 later on and still could run it the same way.
I haven't used the debugger for a couple of months and just tried it out now to locate a problem with msvcrt.dll crashing.
Well, I can't start it up anymore.
The DOS window comes up with the "net start ntice" completing successfully message but the DOS window doesn't close.
A CTRL+D opens the Softice window but the screen doesn't have its normal panels but only the trace log.
In there, after the Softice version, XP version, loaded mice etc, allocated memory and such, it comes to the first Load32 of module NetMsg.
Int0E Fault in Softice at some address, fault code 0.
Right after wbemcons loads successfully and that's about it.
The screen refresh slows down and an hboot is the easy way out.
So, why the error on NetMsg (it's v5.1.2600.0)?
My workgroup works fine and have no problems with it.
I've reinstalled 3.0 and even tried Softice 4.3 Lite but the problem remains.
The firewall (Outpost) is disabled and in any case I used to have it before when Softice was running fine.
No hardware changes either. Only a bunch of software and what is probably the culprit: WinXP security hotfixes.
If so, which one? I'd hate to remove them piecemeal, reboot and try.
Did anybody have a similar problem with some specific hotfix? Or can think of another reason?
Regards

nikolatesla20
February 1st, 2004, 08:50
I really don't know what happened either, but My DS 2.7 went down for the count as well with similar symptoms. I could start it manually but it would lock up the machine. If I started it at boot time, it would BSOD !

I actually was able to fix it by reloading SoftICE again, repatching it (to hide it) and getting the latest ntoskrnl.exe and ntdll.dll symbols using the symbol retriever tool. I always set up SoftICE to use a symbols file for NT OS's because it's the only way to get it to work 100% reliably in my opinion, on NT.

Since both my XP system consists only of Service Pack 1, and the blaster worm patch (I have a firewall at home so I don't update everything all the time), I suspect the blaster patch. But its only a theory.

My SoftICE works fine again now in my desktop system. It's still hosed on my laptop, with the exact same symptoms that my desktop system had.

Try reloading SoftICE again, and then use the Symbol Retriever (found in the programs menu with SoftICe under "Tools", to get new symbols for ntoskrnl.exe and ntdll.dll, it will download the newest symbols automatically, using the file data, etc, from Microsoft, and convert them to nms files. Then go into SoftICE settings, under "Symbols", and tell it to load those files. Also, then go into "Advanced" where you see just a bunch of INI like type entries, and add the string "NTSYMBOLS=ON", and reboot. My theory right now is I got a BSOD cause the kernel changed, and softICe wasn't hooking into the right areas anymore.

And actual thought that just occurs to me, heh, I always use the symbol files, I guess if I patched the OS with an update than my files would already be bad prolly, and SI would still try to use them, hence mayhem? So maybe it won't act that way if you already DON'T use symbol files? I don't know. But I do know that using symbol files has always solved the big problems with SI for me. That of being able to BPX properly on API's, and now it seems to have possibly fixed this BSOD and lock-ups as well.

Don't know if all of that stuff still is there in DS 3.0. I still use 2.7 for everything.

-nt20

dELTA
February 1st, 2004, 13:53
Here is a thread with very complex discussions about exactly this problem, including how he solved it on his computer:

http://www.woodmann.net/forum/showthread.php?t=5335

Please try the search function.

roocoon
February 2nd, 2004, 16:39
Thanks for the suggestions.
Good pointer about the symbols nicolatesla20. I had forgotten to update them and even though they were not the reason for the problem, I'm sure they saved me from some misfortune later on.
dELTA, I had searched before and saw that article. The description there, matched my problem in parts but the solutions didn't seem to apply to me.
Well, thanks for making me read it again.
I picked up two things I had missed the first time.
The link to OSINFO.DAT (handy to have) and the reference to Kaspersky AV to switch it to manual mode.
My Kaspersky service was disabled already that's why I had ignored that.
Big mistake. It was Kaspersky that was causing the problem after all. Disabling it, is not enough. I doubt it was the scan engine that was to blame (after all it was disabled) but probably it messed up the driver chain (I had a similar problem 2-3 years ago with a TCP/IP tracer utility).
So I removed Kaspersky and got back my Softice. A better deal I'd think.
Now if only I could get it to run on my laptop too and recognize the external mouse...
While I'm at it, what antivirus scanner and firewall for XP you know that works with Softice?
Take care all.