Вобщем,в эту тему постим парареверсные(во загнул :ab:) заметки,способы отладки и т.д.
Вот первая полезняшка от меня.
Author:RayЗдесь собрана информация о командах SoftIce(version 4.3.2 build 2485),которые
пригодятся в повседневной отладке программ.
----------------------------------------------------------------------------------------
Для изменения размеров окон в SoftIce надо подвести курсор к нижней границе
того окна,размеры которого мы хотим изменить или закрыть его.Нажимаем на левую
кнопку мыши и,для увеличения размера окна,тянем ее вниз,а для уменьшения или
закрытия этого окна - вниз.Чтобы закрыть окно нужно подвести его нижнюю границу
к верхней,в результате чего появится надпись "Close Current Window",и,если
одпустить левую кнопку мыши,то окно закроется.
Скроллинг по строкам можно производить нажимая на маленькие стрелки окна.
По экранам - нажимая на большие стрелки окна.
Ctrl+Alt+C - позиционирование окна SoftIce по центру экрана.
----------------------------------------------------------------------------------------
F1 - H; Help on the specified function
F2 - ^WL; Toggle locals window
F3 - ^SRC; Toggle between source,mixed & code
F4 - ^RS; Restore program screen
F5 - ^X; Return to host debugger or program
F6 - ^EC; Enable/Disable code window
F7 - ^HERE; Go to current cursor line
F8 - ^T; Single step one instruction(Trace into - шаг с входом в Call)
F9 - ^BPX; Breakpoint on execution
F10 - ^P; Step skipping calls,Int,etc.(Step over - шаг без входа в Call)
F11 - ^G *SS:ESP; Get to caller(Переход к месту,откуда был вызван Call)
SF1 - ^DEX 0 ESP.04
SF2 - ^DEX 0 ESP.08
SF3 - ^DEX 0 ESP.0C
SF4 - ^DEX 0 ESP.10
SF5 - ^DEX 0 ESP;
SF6 - ^DEX 0 ESP.00
SF12 - ^CLS; Clear window
CF1 - I3HERE ON;
CF2 - I3HERE OFF;
CF3 - ^FORMAT; Change format of data window
CF4 - SET BREAKINSHAREDMODS ON;
CF5 - SET BREAKINSHAREDMODS OFF;
AF1 - ^WR; Toggle register window
AF2 - ^WW; Toggle watch window
AF3 - ^WD; Toggle data window N - ex: WD.2
AF4 - ^WT; Toggle thread window
AF5 - ^WC; Toggle code window
AF6 - ^WS; Toggle call stack window
AF7 - ^WF; Toggle floating point stack window
AF8 - ^WX; Toggle XMM register window
AF11 - ^DD *(DATAADDR+0);
AF12 - ^DD *(DATAADDR+4);
Знак "сaret" (^), предшествующий команде, делает ее невидимой, точка с
запятой (;) после команды производит перевод строки. Вы можете вывести на
экран текущие назначения функциональных клавиш, введя команду:FKEY
----------------------------------------------------------------------------------------
Setting Breakpoints
^^^^^^^^^^^^^^^^^^^------------------------------------------------------------
BPM BPMB BPMW BPMD - Breakpoint on memory access
BPIO - Breakpoint on I/O port access
BPINT - Breakpoint on interrupt
BPX - Breakpoint on execution
BPLOAD - Breakpoint on module load
BMSG - Breakpoint on Windows message
BSTAT - Breakpoint Statistics
CSIP - Set CS:EIP range qualifier
----------------------------------------------------------------------------------------
Manipulating Break Points
^^^^^^^^^^^^^^^^^^^^^^^^^--------------------------------------------------
BPE - Edit Breakpoint
BPT - Use Breakpoint as a template
BL - List current breakpoints
BC - Clear breakpoint
BD - Disable breakpoint
BE - Enable breakpoint
BH - Breakpoint history
----------------------------------------------------------------------------------------
Display/Change Memory
^^^^^^^^^^^^^^^^^^^^^---------------------------------------------------------
R - Display/Change register contents
U - Un-assembles instructions
D,DB,DW,DD,DS,DL,DT - Display virtual or physical memory
E,EB,EW,ED,ES,EL,ET - Edit memory
PEEK - Read from physical address
POKE - Write to physical address
PAGEIN - Load a page into physical memory(note:not always safe)
H - Help on the specified function
? - Evaluate expression
VER - SoftIce version
WATCH - Add watch
FORMAT - Change format of data window
DATA - Opens and Switches to Data Window N
----------------------------------------------------------------------------------------
Display System Information
^^^^^^^^^^^^^^^^^^^^^^^^^---------------------------------------------------
GDT - Display global descriptor table
LDT - Display local descriptor table
IDT - Display interrupt descriptor table
IRQ - Display hardware IRQ information
TSS - Display task state segment
CPU - Display cpu register information
MSR - Display Model Specific Register information
PCI - Display PCI device information
USB - Display USB device or transaction information
IRB - Display 1394 IRB structures
MOD - Display windows modules list or find module for address
HEAP - Display windows global heap
HEAP32 - Display 32 bit windows heap
LHEAP - Display windows local heap
TASK - Display windows task list
NTCALL - Display NTOSKRNL system calls
WMSG - Display windows messages
PAGE - Display page table information
PHYS - Display all virtual addresses for physical address
STACK - Display call stack
XFRAME - Display active exeption frames
MAPV86 - Display v86 memory map
HWND - Display window handle information
CLASS - Display window class information
THREAD - Display thread information
ADDR - Display/Change address Contexts
MAP32 - Display 32 bit section map
PROC - Display process information
QUERY - Display a processes virtual address space map
PTR - Display symbolic names for a block of memory
WHAT - Identify the type of an expression
NTSTATUS - Identify the header defined mnemonic for an NTSTATUS code
WINERROR - Identify the header defined mnemonic for a WIN32/64 error code
IOCTL - Decodes an ioctl or fsctl control code
OBJTAB - Display user object-table
OBJDIR - Display info about an object directory
DEVICE - Display info about a device
DRIVER - Display info about a driver
DEVNODE - Display info about a device node
FOBJ - Display info about a file object
IRP - Display info about a IRP
FIBER - Display info about a fiber
INTOBJ - Display info about interrupt objects
TIMER - Display info about timer objects
EVENT - Display boundschecker events log
EVMEM - Display boundschecker memory events
EVRES - Display boundschecker resource events
DPC - Display info about Delayed Procedure Calls
APC - Display info about Asynchronous Procedure Calls
ERESOURCE - Display info about ERESOURCE,synchronization objects
KMUTEX - Display info about a Kernel Mutex
KEVENT - Display info about a Kernel Event
KSEM - Display info about a Kernel Semaphore
FMUTEX - Display info about a Mutant
PACKET - Display contents of a packet buffer
! - Execute a kernel debugger extension
----------------------------------------------------------------------------------------
I/O Port Commands
^^^^^^^^^^^^^^^^^---------------------------------------------------------------
I,IB,IW,ID - Input data from I/O port
O,OB,OW,OD - Output data to I/O port
----------------------------------------------------------------------------------------
Flow Control Commands
^^^^^^^^^^^^^^^^^^^^^---------------------------------------------------------
X - Return to host debugger or program
G - Go to address
T - Single step one instruction
P - Step skipping calls,Int,etc.
HERE - Go to current cursor line
EXIT - Force an exit to current DOS/Windows program
GENINT - Generate an interrupt
HBOOT - System boot (total reset)
----------------------------------------------------------------------------------------
Mode Control
^^^^^^^^^^^^-----------------------------------------------------------------------
I1HERE - Direct INT1 to SoftICE
I3HERE - Direct INT3 to SoftICE
ZAP - Zap embedded INT1 or INT3
FAULTS - Enable/Disable SoftICE fault trapping
SET - Change an internal variable
----------------------------------------------------------------------------------------
Customization Commands
^^^^^^^^^^^^^^^^^^^^^^-------------------------------------------------------
PAUSE - Controls display scroll mode
ALTKEY - Set key sequence to invoke window
FKEY - Display/Set function keys
DEX - Display/Assign window data expressions
CODE - Display instruction bytes in code window
COLOR - Display/Set/Reset screen colors
ANSWER - Auto-answer and redirect console to modem
DIAL - Redirect console to modem
NET - Interface to remote debugging
SERIAL - Redirect console
LINES - Set/Display number of lines on screen
WIDTH - Set/Display number of columns on screen
PRN - Set printer output port
PRINT-SCREEN key - Dump screen to printer
MACRO - Defined a named macro command
FILTER - Set a display text filter with optional action
----------------------------------------------------------------------------------------
Utility Commands
^^^^^^^^^^^^^^^^-----------------------------------------------------------------
A - Assemble code
S - Search for data
F - Fill memory with data
M - Move data
C - Compare two data blocks
HS - Search history buffer
OPINFO - Display instruction information
----------------------------------------------------------------------------------------
Line Editor Key Usage
^^^^^^^^^^^^^^^^^^^^^---------------------------------------------------------
^ - Recall previous command line
v - Recall next command line
> - Move cursor right
< - Move cursor left
BKSP - Back over last character
HOME - Start of line
END - End of line
INS - Toggle insert mode
DEL - Delete character
ESC - Cansel current command
----------------------------------------------------------------------------------------
Scrolling Key Usage
^^^^^^^^^^^^^^^^^^^------------------------------------------------------------
PageUp - Display previous page of display history
PageDn - Display next page of display history
Alt-^ - Scroll data window down one line
Alt-v - Scroll data window up one line
Alt-PageUp - Scroll data window down one page
Alt-PageDn - Scroll data window up one page
Ctrl-PageUp - Scroll data window down one page
Ctrl-PageDn - Scroll data window up one page
Ctrl-^ - Scroll data window down one line
Ctrl-v - Scroll data window up one line
----------------------------------------------------------------------------------------
Window Commands
^^^^^^^^^^^^^^^------------------------------------------------------------------
WC - Toggle code window
WD[.N] - Toggle data window N - ex: WD.2
WF - Toggle floating point stack window
WL - Toggle locals window
WR - Toggle register window
WT - Toggle thread window
WS - Toggle call stack window
WW - Toggle watch window
WX - Toggle XMM register window
EC - Enable/Disable code window
. - Locate current instruction
----------------------------------------------------------------------------------------
Window Control
^^^^^^^^^^^^^^--------------------------------------------------------------------
CLS - Clear window
RS - Restore program screen
ALTSCR - Change to alternate display
FLASH - Restore screen during P and T
----------------------------------------------------------------------------------------
Symbol/Source Commands
^^^^^^^^^^^^^^^^^^^^^^-------------------------------------------------------
ATTACH - Sets the default symbol table and address space to [addr]
DETACH - Clears the default symbol table and address space
SYM - Display symbols
SYMLOC - Relocate symbol base
EXP - Display export symbols
SRC - Toggle between source,mixed & code
TABLE - Select/Remove symbol table
FILE - Change/Display current source file
SS - Search source module for string
TYPES - List all types,or display type definition
LOCALS - Display locals currently in scope
NAME - Assign a name to an address
----------------------------------------------------------------------------------------
Special Operators
^^^^^^^^^^^^^^^^^---------------------------------------------------------------
. - Preceding a decimal number specifies a line number
* - Preceding an address specifies a dereference
|
