Results 1 to 8 of 8

Thread: Symbol Loader doesn't breaks under Win2K

  1. #1
    Plasma
    Guest

    Question Symbol Loader doesn't breaks under Win2K

    hi guys,

    i got some strange problem with symbol loader in Win2K. every time i want to load an executable in it, it doesn't breaks in.
    although i changed the characteristics of the appropriate section to E0000020.
    as far as i can remember it worked for me in win98...

    what am i doing wrong?
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  2. #2

    Same as above

    Are you using the SICE from the Driver Studio?

    If so, you have to go to settings menu on the top and go to the loader everytime.

    ...Have Phun
    Blame Microsoft, get l337 !!

  3. #3
    Plasma
    Guest
    i did install DriverStudio v2.6 with SICE and Symbol Loader.
    now when i want to load an executable in, it loads it and then the program doesnt even start and the errormessage also doesnt appears like it does normally..
    with SICE 4.05 the programs didnt break in, but at least they started

    output:

    ----- Loading symbols for 'D:\Shareware\*.exe' -----
    D:\Shareware\*.exe opened successfully
    Translating file: D:\Shareware\WinISO\WinISO.exe...
    Error: No debug info..
    ----- 'D:\Shareware\*.exe' symbols not loaded -----
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  4. #4
    a little trick to stop at the entry point in Win2k:

    1. use LordPE to get the entry point of your target, assume it's XXXXXXXX.
    2. BPX LoadLibraryA
    3. then use Symbol Loader to load your target. Each time when SICE pops up, just press F12, then check whether we are in the context of RPCRT4.DLL. If so, just clear the breakpoint and type "g XXXXXXXX" to get to the entry point.

    It always works.
    :DWARNING: Shareware authors are reading your detailed discussions without paying you!:D

  5. #5
    roocoon
    Guest
    In my system it works with a simpler way.
    Open up the debugee program with the Softice Loader.
    Go to the Loader's Module/Settings/Debugging.
    The Load Executable and Stop at WinMain should be checked of course.
    If they already are, check the Load Symbols Only, then right after check again Load Executable and click OK.
    Back on the main screen click the Load button.
    No idea why it works like that. It seems that the Loader doesn't initialize its control structure properly with the Load Executable setting and needs a reminder.
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  6. #6
    erm...

    I just use LordPE or PEditor "Break 'n Enter".. works all the time....

  7. #7
    Lbolt99
    Guest
    Originally posted by crUsAdEr
    erm...

    I just use LordPE or PEditor "Break 'n Enter".. works all the time....
    And there I was doing EB FE @ OEP or bpx getversion all the time.. lol.

    Thanks for the tip, works great
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  8. #8
    Plasma
    Guest
    thanks for your posts dudes,

    i tried the solution from roocoon, and it worked!!!
    seems like there's a little bug in SL...

    good work!
    I promise that I have read the FAQ and tried to use the Search to answer my question.

Similar Threads

  1. Symbol Loader not loading from CL
    By micmic in forum Tools of Our Trade (TOT) Messageboard
    Replies: 2
    Last Post: May 2nd, 2004, 09:38
  2. annoying bug of SoftICE Symbol Loader :(
    By Solomon in forum Tools of Our Trade (TOT) Messageboard
    Replies: 1
    Last Post: October 11th, 2002, 02:51
  3. Symbol Loader wont work???
    By crassy in forum Tools of Our Trade (TOT) Messageboard
    Replies: 13
    Last Post: August 26th, 2002, 22:47
  4. Win2k with SoftIce and Symbol Loader....
    By n03l in forum Tools of Our Trade (TOT) Messageboard
    Replies: 0
    Last Post: April 13th, 2001, 15:32
  5. SoftICE Symbol Loader Problem
    By Lou Cypher in forum Malware Analysis and Unpacking Forum
    Replies: 6
    Last Post: April 2nd, 2001, 10:32

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •