|
In Softice 3.0 and 3.1 breakpoints are context sensitive. That means that they work only within the "context" of the process within which they are set. While D.S. 3.0 had no option, D.S. 3.1 has an option to have breakpoints operate like they did in former versions of Softice. Those threads you say you reviewed should have made this clear.
Softice also comes with a manual. You should have reviewed the ADDR and ATTACH instructions in that manual. Again those threads explained how these worked. ADDR in on page 8 and ATTACH on page 22.
Reading these threads:
http://66.98.132.48/forum/showthread.php?t=5470
http://www.exetools.com/forum/showthread.php?s=&threadid=2548&highlight=sice
should have explained it to you.
You set ADDR you type ADDR (process name/id), then you should be able to bpx <whatever...>
You can use ATTACH instead of ADDR if you want. "ATTACH <process name/id>" causes an automatic "ADDR <process name/id>" every time you Ctrl+D.
Another good idea reported in those threads is to let the SYMBOL LOADER load the application, stop at the ENTRYPOINT (it does all this automatically) and then put in your breakpoints.
another reported solution was to:
Put a breakpoint at entrypoint (be sure to type first bpint3 in sice), start the program and when it breaks start puting breakpoints for the apis u'r interested to spy. After that replace the CC byte with the original one and press F5. Each time a function u'r bp sice will popup.
Regards,
__________________
JMI
Last edited by JMI; 05-13-2004 at 08:13.
|