Log in

View Full Version : SoftIce strange behaviour


robson
December 17th, 2004, 11:18
I have a question regarding SoftIce. I'm running it on Windows 2000 Professional. When I was a debugging a program that contains calls like messageboxa and createdialogparama I encountered strange behaviour and it wasn't for the first time. It was breaking fine on both routines, but then after couple program restarts (10 or more) it stopped breaking on a program and started to break a program on a message that displays SoftIce "An error occurred during symbol translation/load. Load executable anyway?" after you re-load a program. I rebooted PC, but now it doesn’t break on any of these calls, even they are there and SoftIce is loaded. And this is not for the first time. It has happened to me before on different PCs with different programs. Please can you tell me what am I doing wrong?
Thanx for any help.

naides
December 17th, 2004, 15:34
I just want to tell you that I have seen similar problems.

In winXP ( I do not have a clue to what extent in win2k) the Sice "status" is saved when you hybernate or close(The previously placed BPX "survive" the boot off ) the puter, but I doubt compuware and microsoft are exchanging quality costumer info. So unpredictable problems will and may come through. . .
No suggest appart from do your debug on a clean, reboot environment.

robson
December 20th, 2004, 04:08
Thank you for a confirmation.
I'm surprised, that 80 people have seen this thread, but just one response. I thought, that there is some logical explanation, or work around. If you can't depend on softice that it breaks a program execution at the set up point, than the toll is totally useless. I believe there has to be some explanation for such behaviour. If some experienced cracker could bring some light in ..... highly appreciated.

naides
December 20th, 2004, 08:52
I read your Post more carefully, see coments in red



Quote:
[Originally Posted by robson]I have a question regarding SoftIce. I'm running it on Windows 2000 Professional. When I was a debugging a program that contains calls like messageboxa and createdialogparama I encountered strange behaviour and it wasn't for the first time. It was breaking fine on both routines, but then after couple program restarts (10 or more) it stopped breaking on a program and started to break a program on a message that displays SoftIce "An error occurred during symbol translation/load. Load executable anyway?"

You have breakpoints on messageboxA and CreateDialogParamA. The SoftIce Symbol loader uses those API to display its messages. The API calls may be not thread specific, so surprise, you are just breaking on a Windows API

. . .after you re-load a program. I rebooted PC, but now it doesn’t break on any of these calls, even they are there and SoftIce is loaded.

But perhaps the symbol loader is not loaded, right?
. . . And this is not for the first time. It has happened to me before on different PCs with different programs. Please can you tell me what am I doing wrong?

The key to the erratic behavoir is the use of the Symbol Loader. Get used to it and it will be your friend. Also learn the concept of thread specifc versus global BPX and things may make more sense

Thanx for any help.

robson
December 20th, 2004, 11:07
Quote:
[Originally Posted by naides]I read your Post more carefully, see coments in red


I clarify it little bit more. I used SoftIce symbol loader. It worked for a while (it broke program on a messagebox call), and then it simply stopped (It didn't breake on messagebox in a program, but it did on message box of the symbol loader.)
After I rebooted a pc I started a symbol loader and loaded the applic again. Softice driver was set to load with windows automatically. I set up a break point on messageboxa, but I didn't work at all.

I just outline the way how I used a symbol loader and how I set up a break point. I loaded a applic from the symbol loader and then the message appered "An error occurred during symbol translation/load. Load executable anyway?" I clicked OK and landed in softice window. I typed bpx messageboxa and pressed enter followed by ctrl+D.
Is there anything I did wrong what explains that behaviour?

naides
December 20th, 2004, 11:24
Quote:
[Originally Posted by robson]I clarify it little bit more. I used SoftIce symbol loader. It worked for a while (it broke program on a messagebox call), and then it simply stopped (It didn't breake on messagebox in a program, but it did on message box of the symbol loader.)
After I rebooted a pc I started a symbol loader and loaded the applic again. Softice driver was set to load with windows automatically. I set up a break point on messageboxa, but I didn't work at all.

For messageboxA, or other API breakpoint to "work", it has to be set in the right "address context": If you look at the lower right corner of the Sice window you will see which address context you are standing in. Also, when you use Symbol Loader, it will break for the first time within the address context of your App. Search the board on Address context and you will see other posts about it

I just outline the way how I used a symbol loader and how I set up a break point. I loaded a applic from the symbol loader and then the message appered "An error occurred during symbol translation/load. Load executable anyway?"

Pay no attention to this message, you have no debug symbols for a regular app

I clicked OK and landed in softice window. I typed bpx messageboxa and pressed enter followed by ctrl+D.

This sounds like I would do


Is there anything I did wrong what explains that behaviour?


Cheers

robson
December 22nd, 2004, 10:29
I want to thank everybody who replied and pointed me at the right direction. I have studied all articles posted to the forum about the address content and I tested it again, with AC in the mind and yes it worked. I can't see, what I did wrong before, but now it works as it should and I'm happy.
Thanks.

naides
December 22nd, 2004, 11:00
Quote:
[Originally Posted by robson] but now it works as it should and I'm happy.
Thanks.



Happy Holidays, May the Gods keep you from getting married in 2005.

JMI
December 22nd, 2004, 13:21
Well it appears that "noboby" is unhappy about their state of marital bliss. And I doubt the "Gods" take responsibility for such choices. We have "nobody" to blame, but ourselves.

Regards,

dELTA
December 23rd, 2004, 18:41
Quote:
[Originally Posted by naides]May the Gods keep you from getting married in 2005.
Does that mean we will never get to hear about the solution to that "different execution path on different computers" problem?

naides
December 23rd, 2004, 19:33
That deal is with the girlfriend, a different story all together

JMI
December 23rd, 2004, 21:16
Wait until you have both a wife and a girlfriend to deal with.

Regards,

naides
December 25th, 2004, 11:36
I do have a wife and a girlfriend, but for some strange reason, they don't like each other, and now They both are mad at me. . .

How come? Go figure!

JMI
December 25th, 2004, 21:50
Yes, but at least they both agree on that one point. Such is generally the way of such things.

Regards,