Results 1 to 4 of 4

Thread: Question about breakpoint.

  1. #1
    dive2code
    Guest

    Question about breakpoint.

    Hi all,

    Can I set breakpoint on Std. driver routine like as a IRP_MJ_Read in SI?

    thanx in advance...
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  2. #2
    Teach, Not Flame Kayaker's Avatar
    Join Date
    Oct 2000
    Posts
    4,157
    Blog Entries
    5
    Hi

    You should be able to in normal cases. Type DRIVER <name> in Softice, get the address of the IRP_MJ_xx function you want to break on, set a breakpoint, then fire away. I'm able to track IRP_MJ_DEVICE_CONTROL routines this way. You can use something like DriverSpyNT by Jeremy Collake to test for the IRP_MJ functions being used.

    It would depend on how things are implemented as to how you would have to set the BP I would think. It's during the user StartService call that a drivers DriverEntry is called, and it is here that the IRP_MJ_xx Dispatch routines are set up. It is only after this point, or StartService is returned from, that you can find their addresses in Softice. If your IRP_MJ_xx routine is used soon after, you may need to set an intermediate BP in the user app before setting your IRP_ breakpoint.

    Kayaker

  3. #3
    dive2code
    Guest
    yup! you are right, Kayaker.

    OSR's Devietree was also useful.

    I was able to to track IRP_MJ_DEVICE_CONTROL routines,

    although IoCallDevice annoying me :P

    thanx again.
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  4. #4
    <script>alert(0)</script> disavowed's Avatar
    Join Date
    Apr 2002
    Posts
    1,281
    You might also want to check out IrpTracker: http://www.osronline.com/article.cfm?article=199

Similar Threads

  1. breakpoint on non-API function
    By gromozeka in forum OllyDbg Support Forums
    Replies: 3
    Last Post: October 27th, 2005, 07:54
  2. What's log breakpoint & how to use it?
    By achan in forum OllyDbg Support Forums
    Replies: 1
    Last Post: August 3rd, 2005, 11:06
  3. Question on a breakpoint (new to olly and everything else)
    By loopah in forum OllyDbg Support Forums
    Replies: 4
    Last Post: June 11th, 2005, 07:28
  4. breakpoint a var ?
    By Anonymous in forum OllyDbg Support Forums
    Replies: 2
    Last Post: July 16th, 2003, 01:01
  5. breakpoint please help
    By Anonymous in forum OllyDbg Support Forums
    Replies: 1
    Last Post: July 14th, 2003, 13:10

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •