Kayaker might know, he's familiar with the inner working of SI.
Someone offered me an interesting way to examine drivers today. He suggested using Dependency Walker. Load the driver in question in a new directory and copy all the drivers from the windows driver directory into the same directory. I suggested moving the files from system32 into that directory as well. Run DW in that directory and load the driver in question and DW should give you all the imports that are missing.
I have not tried it yet but it sounds interesting. With regard to directdraw, I did a crackme by Silver that involved a DirectX app running a spinning cube in a full screen window. The mouse in the DX window is not the same mouse used in Windows, DX supplies it's own mouse and driver. So you can't use any screen mouse functions to bring it up in SI.
To solve it, I trapped the windows mouse using a hwnd related to LButtonDown then traced the mouse right through ring 0 with SI till it reached the code where the DX mouse was activated. Meantime, I traced from the OEP to just after ShowWindow, where the DX initialization code began. Inside that initialization code was a table where the fullscreen/window mode bit could be toggled, so I was able to turn off full screen and get the DX window in it's own window.
Don't know if DirectDraw can be reached the same way. With the DX crackme, there were video frame buffers that could be accessed.
Don't know if you could do that with windbg. Blabberer would know but he gets hives when you talk about softice.
I have encountered those problems but can't remember how I solved them. Normally I let it run in VGA mode and it was happy.
Since I am working in real windows mode with XP I need a debugger that will trace through ring 0 in real mode, not virtual mode. It is still not clear to me whether windbg will enter ring 0. Blabberer has kindly tried to explain it to me but whenever I try to get past a sysenter call to the system windbg kicks me out the other end without allowing me to trace the code.
I now have remote debugging with real mode/kernel mode capability in W7 and W10 via a serial connection. I have read an article on github wherein someone claims to be able to debug remotely with XP, using windbg.
Ideally, I should be able to start SI in the target and watch it initialize. That is, if SI is not doing something to interfere with windbg operation.
Bookmarks