                Log Branches via MSR...
                
Simple trick to get where was last eip redirection before HWBP is hit.
SoftICE sometimes displays wrong data, probably resulted by not setting
LBR in CtlDebugMSR at exception properly.

In example you will see how to find where was last EIP, someone at our
forum asked how to find where was exit to main when main() used ret to
kernel32 stored at entry of each thread. Here is example how to do it,
set HWBP on ret-to-kernel32 and run code, now watch in DebugView data
printed to the screen :) 

You shold get output similar to this (test.exe):

.text___:00402000 start:
.text___:00402000                 push    offset sehhandle
.text___:00402005                 push    dword ptr fs:0
.text___:0040200B                 mov     fs:0, esp
.text___:0040200B ; ------------------------------------------------
.text___:00402011                 db  0Fh                 ; ud2
.text___:00402012                 db  0Bh
.text___:00402013 ; ------------------------------------------------
.text___:00402013                 pop     dword ptr fs:0
.text___:00402019                 add     esp, 4
.text___:0040201C                 push    0
.text___:0040201E                 push    0
.text___:00402020                 push    0
.text___:00402022                 push    0
.text___:00402024                 call    MessageBoxA
.text___:0040202A                 retn
.text___:0040202B ; ------------------------------------------------
.text___:0040202B
.text___:0040202B sehhandle:                              
.text___:0040202B                 mov     eax, [esp+0Ch]
.text___:0040202F                 add     dword ptr [eax+0B8h], 2
.text___:00402036                 xor     eax, eax
.text___:00402038                 retn


DebugView log:

00000000	0.00000000	LastBranchFromIp = 0x0040202A	
00000001	0.00001453	LastBranchToIp   = 0x7C816FF7	

There is last EIP transfer or retn address.


                                        deroko of ARTeam


