Another fyi:
If anyone needs to stop on a 16bit program via WinDbg, this will do so
(ABSOLUTELY NO(!!!) HELP AT ALL FROM LOUSY HORRIBLE MICROSOFT!!!):
1. copy \Windows\System32\dosx.exe to the DOSBOX MOUNT DIR
2. using DOSBox, run 'EXEHDR -v dosx.exe'
3. get the Entry Point (ie: 078f:000a in Win7)
4. zap the copy's EP to 078f:0009 (1 back) and also zap in an INT3 (0xcc) there:
DISP 7AF9h (must account for the 200h-byte filler at the front of the program)
VER 00
REP CC
DISP 0014h (the MZ header)
VER 000A
REP 0009
re-run EXEHDR to verify the EP is correct
5. in \System32:
rename dosx.exe to dosxWIN7.exe (so u can put it back when u r done)
copy the zapped version here
will probably have to deal w/security BS!
6. run WinDbg & load your executable
. PF5 (go) until the INT 3 stops in DOSX.exe (the 2nd INT 3):
Loading [C:\windows\system32\DOSX.EXE]
(6c8.42c): Break instruction exception - code 80000003 (first chance)
eax=00000000 ebx=00000000 ecx=000000ff edx=00000529 esi=00000009 edi=00000222
eip=00000009 esp=00000222 ebp=0000091e iopl=0 vif nv up ei pl nz na po nc
cs=0cc8 ss=0ca5 ds=0529 es=0529 fs=0000 gs=0000 efl=000a4202
0cc8:0009 cc int 3 (<== this is what was zapped in step4 above)
. copy the following to \Program Files\Debugging Tools for Windows (x86)\fndint21.txt
t "r? $t1=(@$ip+1) ; r? $t2=(@$ip+2) ; r? $t3=(@$ip+3) ; .if @@((*@$ip == 0x##) && (*@$t1 == 0x##) && (*@$t2 == 0x##) && (*@$t3 == 0x##)) {d $ip l10} .else {$<fndint21.txt}"
|
| <== can also use 'p' if your bytes u r searching for are NOT in a CALL
this will produce MUCH LESS output; however, using this same technique,
u can see the INT21's used in dosx.exe if u want
will probably have to deal w/security BS!
REPLACE THE ABOVE 4 '##' WITH any 4 consecutive bytes in your program near the beginning;
try to pick bytes that aren't very common to, in this case, dosx.exe;
for me, I used: cd213a06
. run the exact same command on the WinDbg command line;
the 1st time, it gets it started:
eax=00000000 ebx=00000000 ecx=000000ff edx=00000529 esi=00000009 edi=00000222
eip=0000000a esp=00000222 ebp=0000091e iopl=0 vif nv up ei pl nz na po nc
cs=0cc8 ss=0ca5 ds=0529 es=0529 fs=0000 gs=0000 efl=000a4202
0cc8:000a b83905 mov ax,539h
the 2nd time (just hit the arrow up key and ENTER) because, for whatever reason, it doesn't work the 1st time!!??
eventually it will stop on the 4 consecutive bytes u r looking for:
FOLLOWING DONE AUTOMATICALLY:
0:000> t "r? $t1=(@$ip+1) ; r? $t2=(@$ip+2) ; r? $t3=(@$ip+3) ; .if @@((*@$ip == 0xcd) && (*@$t1 == 0x21) && (*@$t2 == 0x3a) && (*@$t3 == 0x06)) {d $ip l10} .else {$<fndint21.txt}"
...
0:000> t "r? $t1=(@$ip+1) ; r? $t2=(@$ip+2) ; r? $t3=(@$ip+3) ; .if @@((*@$ip == 0xcd) && (*@$t1 == 0x21) && (*@$t2 == 0x3a) && (*@$t3 == 0x06)) {d $ip l10} .else {$<fndint21.txt}"
0000:e164 cd 21 3a 06 0c 00 74 04-b4 00 eb 03 b8 66 00 b4 .!:...t......f..
=========== (4 consecutive bytes found)
eax=00002a00 ebx=00000010 ecx=000000ff edx=00000e17 esi=00000000 edi=00000400
eip=00000024 esp=00000410 ebp=0000091e iopl=0 vif nv up ei pl nz na po nc
cs=0e14 ss=0e17 ds=0e17 es=0e04 fs=0000 gs=0000 efl=000a4202
0e14:0024 cd21 int 21h
. at this point, u can debug your program
7. rename the original dosx.exe back
ALL THIS BECAUSE MICROSOFT REFUSES TO STOP ON OUR PROGRAMS!!!!!!!!!!!!!!!!!!!!!!!!