View Single Post
  #21  
Old 08-27-2003, 08:06
Satyric0n
 
Posts: n/a
ntoskrnl.exe symbols

I have just tried what hobgoblin and Lunar_Dust suggested, using Symbol Retriever to get the ntoskrnl.exe symbols and loading them upon boot. I see no difference whatsoever to the way things worked previously for me; you still have to set the appropriate address context before setting a breakpoint, either using ADDR or ATTACH (preferred, and very easy for all you naysayers, since you only have to do this once per process name).

This is the way I have SoftICE set up, and it seems to be working fine (assuming you don't consider the fact that you have to set your breakpoints in the appropriate address context to be a problem, as Squidge and I don't): On the SoftICE Initialization->Exports tab, I simply added the following files in the list:

advapi32.dll
comctl32.dll
comdlg32.dll
gdi32.dll
hal.dll
kernel32.dll
msvcrt.dll
ntdll.dll
ntoskrnl.exe
ole32.dll
shell32.dll
user32.dll
version.dll

And then also some other files that are specific to my machine/configuration.

Again, loading the symbols for ntoskrnl.exe made no difference whatsoever on my machine; everything worked just the same as if I hadn't loaded those symbols.

I realize now that I have always set my exports before using SoftICE, and I have never loaded the symbol for ntoskrnl.exe before. So the fact that loading the symbol for ntoskrnl.exe now made no difference at all makes me wonder if doing that is unnecessary if you just set your exports as I described?
Reply With Quote