Log in

View Full Version : Remove assembled code from image


Silver
July 13th, 2004, 08:39
Hi guys,

This is either such a stupid question that no-one has asked it, or it's not possible. In sice, how do you remove an in-mem patch you add using the assembler?

The sice manual under the command reference for A says the 3 ways to remove it are to reboot, modify the image or flush the cache. I don't want to reboot every time, and modifying the image is awkward and annoying. I also can't figure how to flush the cache - everything I find talks about flushing the disk cache, not the instruction/patch cache.

Yep, I've googled and searched. Maybe I'm searching the wrong terms. It seems such an easy thing - load an app, trace, make a patch, then remove it to start fresh & try something else.

Feel free to slap me if I'm being stupid

evlncrn8
July 13th, 2004, 11:46
sysinternals, download sync from there, should do the job, alternatively createfilea c:\ or whatever the drive is, then call flushfilebuffers (using the handle you obtain from the createfilea), then a closehandle.. same thing

Silver
July 13th, 2004, 12:16
I already tried that, and assumed I misunderstood the post. Sync flushes the delayed write buffer to disk, but sice is holding the patch internally.

I found a newsgroup post that suggested the same thing, so I downloaded sync, made a change in sice, ran sync, reloaded the module, and my assembled patch was still in the image. So at least I tried

I'm still open to being told I'm an idiot

evlncrn8
July 13th, 2004, 19:43
before starting, copy the exe to a .bak or whatever, then do ur stuff, then copy the .bak back to the .exe and run sync, with any luck that should work, but softice can be wierd sometimes