TR for Win95/98 说明

(共享版)

TR for Win95(TRW) 是运行于 Win95 下的跟踪调试器,可以跟踪 DOS COM,DOS EXE,DOS protect mode app(DPMI),16位 NE,32位 PE 程序。还可以跟踪WIN95的ring 0核心VxD.

TRW可以运行于Win95, OSR2, Win98。

我会每日更新TRW,请多提宝贵意见。

刘涛涛
liutt@371.net
http://trw.yeah.net

最新更新
Introduction
Work Modes
命令列表
Some Test
Debug Symbol load
Utilities include
Register

 


最新更新

0.73	99.06.02 增加硬件 bpio 命令。增加对非全屏幕DOS窗的支持。改正了许多错误。
0.72	99.05.14 fix some crush bugs. All file write commands work now.
		D range >file
		U range >file
		PEDUMP
		TRnewTCB and TRnewDOS command in menu
0.71	99.05.07 fix many bugs.
0.70	99.04.23 Change from character mode to GUI mode
		 change command 'bpmodule' to 'pmodule'
		 hotkey Ctrl+M, Ctrl+N
0.68	99.04.14 add command 'S', and fix some bugs
0.67	99.04.09 add bpmsg,bpmodule,F12(pret)
0.66	99.03.10 add tridc.exe,
0.65	99.03.02 add trsym.exe, .SYM support for PE,.VxD
0.64	99.01.18
0.62	98.12.28 fix many bugs
0.60	98.12.18 new command 'vcall',
                 support vxd symbols,'u Get_Cur_VM_Handle'
                 hot key <Ctrl>+M break in Ring0!
0.56	98.12.9  exp module_name!, exp partial_exp_api,
                 display 16bit module exports
0.55	98.12.2  exp module_name, mod,Get all API func name at runtime
0.50	98.11.20 fkey,wmsg,task,mod,proc
                 hot key change to Ctrl+L
		 command G will auto active user prg,
		 break point will auto active TRW
0.40	98.11.6  lines,wc,wd
0.39	98.11.3  hwnd
0.38	98.10.28 hot key 'Ctrl+L', command 'RS',<F4>
0.37	98.10.25 Help more like WinICE
0.36	98.10.4 bp if new_section,pedump
0.35	98.9.30 Conditional breakpoint
0.30	98.9.22	Win98 support
0.25	98.9.19 MKPE, PAGEIN
0.22	98.9.12	BPIO
0.20	98.9.9 	First public version

 


Introduction

Powerful than WinICE:
. dynamic load, dynamic unload, run when need
. support all video adaptor
. if possible, multi-task running during trace
. file write
. make PE from memory!
.

Some Test

test1: Test Dos Protect Mode app 
1. run TRW
2. begin a dos windows in Win95
3. select 'trnewdos' in TRW's menu
4. run PMODE.EXE in DOS command prompt
5. back to TRW, you will find you are at the beginning of the DOS program.
Now you have 2 choice:
case 1:
	g 342
	t
	g 342
	Press <F8> for some times, now enter 16bit protect mode!
	'g 4dd', Press <F8> for some times, now enter 32bit protect mode!
case 2: or just:
	g if cs<100	;this will run to PM16!
	g if cs!=cs	;try to run to PM32
	g if cs!=cs	;again, and we are in PM32
test2
run NOTEPAD.exe, and "help"|"about notepad", the dialog display.
run TRW , Ctrl+N to active TRW
    hwnd
from the hwnd list, find the hwnd by '(Dialog)'
    bpmsg <the_hwnd> wm_destroy
    bl
    g
In NOTEPAD, press "OK", this will active TRW
we have 2 choice:
case 1:
press F12(pret) some times, we will find this dialog box is called by
	shell32.dll	call	[DialogBoxParamA]
	notepad.exe	call	[ShellAboutA]
case 2:
"pmodule", and we back to notepad.exe quickly, after the "call [ShellAboutA]".
test3:	hotkey Ctrl+N and command 'pmodule'
run TRW
run NOTEPAD.exe, and "help"|"about notepad", the dialog display.
Keep the about dialog foreground window, Ctrl+N to active TRW
We already break in NOTEPAD address context!
run command 'pmodule','ok' the dialog, we will break in notepad quickly,
just after 'call [ShellAboutA]'
test4: new thread catch
select 'trnewtcb' in TRW's menu.
Now you can run any 32bit , or 16bit app. TRW will catch the new thread at the first opcode.

test5:

If right click the TRW icon in systray, I want TRW show a popup menu. But I do not know how to do this.
So I run TRW, right click a user icon in systray, with its popup menu on, Ctrl+N to active TRW.Then do command 'pmodule'.Click anywhere to make the user popup menu close. TRW active and tell me it calls 'TrackPopupMenu'.


Hotkeys

1. Ctrl + M

the Ring0 hot key. Break Win95 in ring0 VMM.vxd.
Do nothing in Win95 DOS window.

2. Ctrl + N

the Ring3 hot key.

In most time, we neednt break in ring0. <ctrl+N> will break the foreground window thread in ring3. I think this is what we really need.

If Ctrl+N pressed in a Win95 DOS window, TRW will break the current running DOS or DPMI program.

If you press Ctrl+N and nothing happened, press any key or move the mouse. And wait to see if anything happen :D


代码窗

在代码窗中,

BPX cs:eip

GOX cs:eip

 


Utilities Include

MakePE

TRSYM

TRIDC

MakePE

provided by G-Rom. MakePE can fix Imports section problem of DUMP1.exe, created by TRW 'PEDUMP' command.

TRSYM.exe

TRSYM.exe is a symbol loader for TRW. It load .SYM file create by MAPSYM from Microsoft
ver>=6.0, or create by TRIDC.exe. Usage:

TRSYM.exe yourfile.sym

The .SYM file can be for 32bit PE programs, or VxD programs,

Almost all compilers will produce .MAP for your application.
For existing apps, you can try to load it in IDA pro, and then

  1. make .MAP from IDA pro.

  2. make .IDC from IDA pro, and then TRIDC to make .SYM

After this, TRW will recognize all debug symbols in .SYM.
Command 'SYM' to display all symbols.

TRIDC.exe

TRIDC.exe convert .IDC produced by IDA pro (>3.8 ?) to .SYM. This .SYM can be used by SoftICE
or any other program, recognized as produced by MAPSYM ver 6.0.

What more, this .SYM include a new 'TRW ' section which is only for TRW. This section include
some more information from .IDC

  1. function begin, function end
  2. comments
  3. additional anterial lines
  4. .... (will add soon)

So, after load this .SYM with TRSYM.exe, TRW can display this info in the code window.

The origin .IDC file can be for 32bit PE programs, or VxD programs,


命令列表

BPIO

BPM

BPMSG

BPMX

BPX

CPU

D

EXP

G

GO?

MOD

PageIn

PEDump

PMODULE

PRET

RS

S

SYM

task

thread

TRNEWDOS

TRNEWTCB

TRTCB

U

WMSG

BPIO port
	设置一个硬件断点,当访问该端口时断点生效。
	例:	bpio 378
BMSG hwnd [msg]
BPMSG hwnd [msg]
	BreakPoint on window message.
	See also:	WMSG
	Ex:
		BMSG 12c wm_destroy
BPM address R
BPM address W
BPM address X
	set a hardware breapoint with DRx.
BPMX address
	set a executive breakpoint with DRx.
	same as 'BPM address X'
BPIO port
	BreakPoint on port I/O
BPR start_addr end_addr
	BreakPoint on Range access.
BP  [[seg:]address]
BPX [[seg:]address]
	BreakPoint on Execute
	'BPX offset' when trace a DOS app will ignore segment.
	TRW will try to set this Breakpoint with Debug Register. If Debug Register not enough, int3 instead.
	See also 'BPMX'.
H	[command]
	显示命令列表,或指定命令的详细用法。
HWND	[HWND]
	显示当前的窗口列表。
CPU
	显示当前CPU各系统寄存器内容。
D	[address]
D	range >filename
	memory dump in Data Window. or save memory dump to file.
		d 401000
		d cs:402000
		d 401000,402000 >myfile
		d 401000L100 >myfile
EXP !
Exp module-name!
Exp partial_export_name
	display all exports API of a module.
	search exports API function name in all reference modules.
		EXP !
		Exp kernel32!
		Exp *
		Exp Get*
		Exp *window*
FKEY	[function-key strings]
	Display/Set Function keys
	ex:
		FKEY
		FKEY f10 d 2;U 3:
G
	Run it.
	G address	;run to address, same as 'gox address'
	G if conditions	;run with conditions
GO?
one-time breakpoint series.
each 'BPXX' command can be replaced as 'GOXX' for a one-time break-point.
TRW will set this breakpoinnt, go, and clear it.
	gor fs:0 fs:10
	gomd r ds:40000
	gox cs:eip
PageIn <address>
	Load the not present page to memory.
	PageIn cs:401000
Lines  [25 | 43 | 50 | 60]
	Set/Display screen lines
	ex: lines 43
MOD
	Display module list, include 16bit module and 32bit module,
	or display detail info for specified module.
	Usage:
		MOD
		MOD	[hmodule]
		MOD	.		;for current module
MKPE
	Make a PE program 'newpe.exe' from the memory.
	Always 'del newpe.exe' before 'MKPE', or TRW will append it!
	Current EIP will be the new entrypoint.

	A util in TRW 'PEcompare' can help you compare the origin PE
	and NewPE to test how TRW work.
PEDUMP
	Dump PE image memory direct to file 'DUMP1.EXE'.
	You can use G_Rom's MakePE to rebuild a valid PE.
BP if condition
	BreakPoint on condition
	bp if eax>=3456787
	bp if dx<543
	bp if ch==23
	go if ah!=34
	go if new_section	;breakpoint if EIP run into a new section in PE image
PMODULE
	'pret' until CS:EIP in the module.

	一般当我们中断程序运行的时候,我们总是停在WIN95的系统内部,而不是我们感兴趣的
	程序。我们可以想象,当前的CS:EIP肯定是在主程序的一个CALL之中。所以,我们可以
	用多个'PRET'返回主程序。那么,能不能尽快地返回到主程序的地址空间呢?可以,这
	就是TRW独有的'PMODULE'命令。
PRET
	run until RET,RETF,IRET.
	shortcut key: F12
RS
	View User Screen. (F4).
S
	Search in memory
		S 0 L -1 'window'
		S 100,200 'bug12',34
SYM
	List all debug symbols
TASK
	Display task list
THREAD
	Display thread infomation
	Usage:
                THREAD  [TCB]
                THREAD  .               ;for current thread
TRNEWDOS
	Catch next DOS program.
TRNEWTCB
	Catch next new thread at the first opcode.
	Support 32bit,16bit app.
	Do not run Windows app in DOS command prompt, or TRW will catch START.EXE.
TRTCB
	Trace a existing thread
	Usage:
		TRTCB	TCB
U	[address]
U	range >filename
	disassembly in Code Window. or save output to a file.
		u 401000
		u cs:402000
		u 401000,402000 >myfile
		u 401000L100 >myfile
VCALL
	Usage:
	    Vcall *    -display all VxD calls
	    Vcall num  -if num<10000h, diaplay all VxDid calls
	               -if num>10000h, diaplay the VxD call
	    Vcall partial-name
	Ex:
	    Vcall 0d
	    Vcall 100001
	    Vcall *sys*
WC	[codewindow_lines]
	Set lines of code window. No parameter will turn it on/off.
	ex:
		wc 25
		wc
WD	[datawindow_lines]
	Set lines of data window. No parameter will turn it on/off.
	ex:
		wd 25
		wd
WMSG     - Display windows messages
	usage:
	      WMSG     [partial-name] [WMSG-number]
	Ex:
		WMSG	12
		WMSG	wm_destroy

Debug Symbols

To load Debug Symbols for 32bit PE programs, or VxD programs,

TRSYM.exe yourfile.sym

file .SYM must create by MAPSYM from Microsoft ver>=6.0

Almost all compilers will produce .MAP for your application.

For existing apps, you can try to load it in IDA pro, and then
make .MAP from IDA pro. Or make .IDC from IDA pro, and make .SYM
from .IDC by TRIDC.exe

After this, TRW will recognize all debug symbols in .SYM.
Command 'SYM' to display all symbols.


请加入我的邮件列表:

 


Register

This is TR for Win95 (TRW) shareware version. Please register if you like it.

$32 for TRW 0.67, $33 for TRW 0.68, and more & more .... :)

Email me first!


 

							----- the end -----