![]() |
|
|
|
#1
|
|||
|
|||
|
ntoskrnl.exe symbols
I have just tried what hobgoblin and Lunar_Dust suggested, using Symbol Retriever to get the ntoskrnl.exe symbols and loading them upon boot. I see no difference whatsoever to the way things worked previously for me; you still have to set the appropriate address context before setting a breakpoint, either using ADDR or ATTACH (preferred, and very easy for all you naysayers, since you only have to do this once per process name).
This is the way I have SoftICE set up, and it seems to be working fine (assuming you don't consider the fact that you have to set your breakpoints in the appropriate address context to be a problem, as Squidge and I don't): On the SoftICE Initialization->Exports tab, I simply added the following files in the list: advapi32.dll comctl32.dll comdlg32.dll gdi32.dll hal.dll kernel32.dll msvcrt.dll ntdll.dll ntoskrnl.exe ole32.dll shell32.dll user32.dll version.dll And then also some other files that are specific to my machine/configuration. Again, loading the symbols for ntoskrnl.exe made no difference whatsoever on my machine; everything worked just the same as if I hadn't loaded those symbols. I realize now that I have always set my exports before using SoftICE, and I have never loaded the symbol for ntoskrnl.exe before. So the fact that loading the symbol for ntoskrnl.exe now made no difference at all makes me wonder if doing that is unnecessary if you just set your exports as I described? |
![]() |
| Thread Tools | |
| Display Modes | |
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| breakpoints not breaking in olly.. | abitofboth | General Discussion | 2 | 11-17-2005 19:13 |
| Breaking DLL with OLLY | Wackyass | General Discussion | 8 | 04-27-2005 16:34 |
| PAL/GAL chip breaking code? | hardsome | General Discussion | 0 | 04-10-2003 19:12 |