|
OK. I don't like your idea with Native API app - it is just not reasonable to create even a very small app for the Native API testing, especially if I don't know the parameters of the function.
So, how it worked with previous GOOD soft-ice:
you do Ctrl+D (Soft Ice pops up hell knows where) and set up bpx on shall we say LdrpProcessRelocationBlock. Noone really knows how is it possible to set up the GENERAL breakpoint on ANY process in Windows NT+ (with 9x everything is easy). So, you launch your app and everything is fine - SoftIce pops up on bpx and everything is working. Now what? You can't set uo the bpx on the address context because there is no address context (well, actually in the case of bpx it is but, obviously long before main()), you can't do your ATTACH macro which is, of course, nice but the general behaviour of Ice is so bad now that I just don't know what to do. Pity I don't have enough time to disassemble Ice itself.
|