SoftIce , . : H (Help) CLASS. (Command Window), , (Locals Window).
H SoftIce , H:
:H CLASS Display window class information CLASS [-x] [task-name] Ex: CLASS USER, , , .
RegisterAppClass , GdiDemo . CLASS GdiDemo:
:CLASS GDIDEMO. : , WNDCLASS, , , . -X.
Handle Class Name Owner WndwProc Styles --------------------------Application Private------------------------------- 5110??? GDIDEMO 2E9F:00000114 07000003 40AC??? GDIDEMO 2E9F:000000FE 07000003 409C??? GDIDEMO 2E9F:000000E8 03000003 3BC4??? GDIDEMO 2E9F:000000D2 03000003 3BB4??? GDIDEMO 2E9F:000000BC 07000003 3A00??? GDIDEMO 2E9F:000000A6 07000003
, SoftIce , . TABLE :
:TABLE GDIDEMO [NM32] 0001044741 Bytes Of Symbol Memory Available. , TABLE , ( ):
:TABLE GDIDEMOSYM , ( , ). - , :
:SYM w*.text (0137:00401000, 000145C1 bytes) 0137:004012E0 WinMain 0137:00405700 WinMainCRTStartup 0137:004013AD WndProc 0137:0040AF50 wcslen 0137:0040C160 wcsncnt 0137:004107A0 wctomb 0137:0040FA50 write_char 0137:0040FAD0 write_multi_char 0137:0040FB20 write_stringw, .text ( , 0137:00401000 0145C1H ), .. - GDIDEMO. .data,.rdata,.idata.
|
|
, GDIDEMO, LockWindowInfo. - , . , :
LockWindowInfo.
, .
, .
LockWindowInfo.
BPX LockWindowInfo . , GDIDEMO , LockWindowInfo, , SoftIce. BL , . X G. LockWindowInfo, SoftIce . , SoftIce, , - . , , POLYDEMO, . ( wininfo.c) , LockWindowInfo HWND (Handle Window) - , - . POLYDEMO, . , :
:HWND GDIDEMO WindowHandle hQueue SZ Qowner ClassName WindowProcedure 0724(1) 10FF 32 GDIDEMO GDIDEMO 365F:000001C4 0728(2) 10FF 32 GDIDEMO MdiClient 17A7:00001988 0734(3) 10FF 32 GDIDEMO BOUNCEDEMO 365F:00000232 0730(3) 10FF 32 GDIDEMO POLYDEMO 365F:000001DA 072C(3) 10FF 32 GDIDEMO DRAWEMO 365F:0000021cPOLYDEMO 0730. , X G, , , , , . , LockWindowInfo 0730. Windows . LockWindowInfo ( ESP, , Display, DD DataWindow , 32-):
ESP = 0055FC00 013F:0055FC00 00404852 00000730 0055FC3C 00008CAA00404852 - , ( ).
|
|
00000730 - POLYDEMO ( , ).
, , . , LockWindowInfo:
:BPE 0:
:BPX LockWindowInfo. , :
IF ESP->4 == 00000730Enter.
:
:BPX LockWindowInfo IF ESP->4 == 00000730, ESP+4 00000730, POLYDEMO. BL, , , .
POLYWINDOW. , LockWindowInfo , - . , LockWindowInfo POLYWINDOW, POLYWINDOW, .
, 57 ( WININFO.C):
:G.5732- ( ) EAX, , BPMD (BreakPoint Memory Dword) EAX, POLYDEMO:
:BPMD EAX. POLYDEMO. BL, .
:BL 00) BPX LOCKWINDOWINFO IF ((ESP->4)==0x00000730) 01) BPMD #015F:0052006C RW DR30 LockWindowInfo 1 #015F:0052006C.
0 BD (Breakpoint Disable):
:BD 0BC, , BD , .. , BE (Breakpoint Enable). .
:BL 00) * BPX LOCKWINDOWINFO IF ((ESP->4)==0x00000730) 01) BPMD #015F:0052006C RW DR3SoftIce X G, POLYDEMO , SoftIce , PolyRedraw PolyDrawBez. nBezTotal, POLYDEMO. POLYDEMO.
: - Intel , , .. SoftIce .
BC * SoftIce.
SoftIce p?
Config.Sys: Device=c:\...\...\S-Ice.Exe
Ldr.Exe <p>. MS-DOS : SP - 2, , . MS-DOS INT 21h AX=4B01h "R SP=SP+2"
SoftIce/Win/W95 p?
WINICE.DAT, DLL-. ( Winice.DAT USER.EXE, KRNL386.EXE, WIN386.EXE)
exp=c:\win\system\user.exe exp=c:\win\system\gdi.exe exp=c:\win\system\krnl386.exe
http://protect.htmlweb.ru/