首页
社区
课程
招聘
SOFTICE Suite 3.0的问题.
2004-10-9 10:02 3954

SOFTICE Suite 3.0的问题.

2004-10-9 10:02
3954
我最近在Win2000 SP4下安装了SOFTICE Suite 3.0,使用的是手动模式(MANUAL)启动,结果启动后死活不能拦截API,比如MessageBoxA,GetDlgItemTextA等等.不知道哪里设置错了.有知道的,请帮帮我...

[培训]《安卓高级研修班(网课)》月薪三万计划,掌握调试、分析还原ollvm、vmp的方法,定制art虚拟机自动化脱壳的方法

收藏
点赞1
打赏
分享
最新回复 (5)
雪    币: 204
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
owlcn 2004-10-9 10:48
2
0
我已经打了DS3.0 for SP4的补丁.还是不能拦截.MessageBoxA,MessageBoxW都不能拦到...
雪    币: 201
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
qinlicang 2004-10-9 12:29
3
0
在SOFTICE 中输入命令 set breakinsharedmods on 就可以了。
雪    币: 233
活跃值: (43)
能力值: ( LV6,RANK:90 )
在线值:
发帖
回帖
粉丝
marxixing 2 2004-10-9 13:03
4
0
最初由 qinlicang 发布
在SOFTICE 中输入命令 set breakinsharedmods on 就可以了。


我试了,它出现了提示 Set Variable not found
雪    币: 204
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
owlcn 2004-10-9 14:37
5
0
我也一样.这个要怎么办才好啊...
请各位老大帮帮忙...那个set breakinsharedmods on 怎么设置啊...
雪    币: 204
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
owlcn 2004-10-9 16:09
6
0
汗...找到原因了.

Operating behavior of breakpoints in shared ring 3 modules. In versions of SoftICE prior to 3.0, breakpoints set in shared ring3 modules would hit according to the description as defined in the Using SoftICE book, Chapter 7, "Understanding Breakpoint Contexts." In 3.0, we changed this so that breakpoints would only hit within the context in which the breakpoints were set. For Version 3.1, we have now added a SoftICE environment variable to toggle the behavior of shared ring3 breakpoints. By default, breakpoints only trigger in the context in which they were set. To change to the pre-3.0 behavior, from the SoftICE command line, issue the command set BreakInSharedMods on. Note that all breakpoints will have to be cleared with a bc * and then reset after changing this value. For shared ring 3 module breakpoints, it is possible for your application (or another application that is sharing the module) to end up crashing. This is due to copies of the physical pages that the code pages reside on being present and SoftICE not tracking these copies. Any such ring 3's left around in memory will cause crashes. There is currently no easy workaround. One possible solution would be to issue the set i3here on command to allow for user mode int3's to trigger SoftICE, and then modify the byte in memory, replacing it with the original code byte.

大概意思就是说3.0版本必须在程序领空设置断点才可以断下来.大家可以这么操作.先bmsg pid WM_LBUTTONDOWN,点一下窗口.断下来后,再下bpx MessageBoxA就ok.
游客
登录 | 注册 方可回帖
返回