(共享版)
TR for Win95(TRW) 是运行于 Win95
下的跟踪调试器,可以跟踪 DOS COM,DOS EXE,DOS
protect mode app(DPMI),16位 NE,32位 PE 程序。还可以跟踪WIN95的ring
0核心VxD. TRW可以运行于Win95, OSR2, Win98。 我会每日更新TRW,请多提宝贵意见。 |
最新更新 Introduction Work Modes 命令列表 Some Test Debug Symbol load Utilities include Register |
0.73 99.06.02 增加硬件 bpio 命令。增加对非全屏幕DOS窗的支持。改正了许多错误。 0.72 99.05.14 fix some crush bugs. All file write commands work now. D range >file U range >file PEDUMP TRnewTCB and TRnewDOS command in menu 0.71 99.05.07 fix many bugs. 0.70 99.04.23 Change from character mode to GUI mode change command 'bpmodule' to 'pmodule' hotkey Ctrl+M, Ctrl+N 0.68 99.04.14 add command 'S', and fix some bugs 0.67 99.04.09 add bpmsg,bpmodule,F12(pret) 0.66 99.03.10 add tridc.exe, 0.65 99.03.02 add trsym.exe, .SYM support for PE,.VxD 0.64 99.01.18 0.62 98.12.28 fix many bugs 0.60 98.12.18 new command 'vcall', support vxd symbols,'u Get_Cur_VM_Handle' hot key <Ctrl>+M break in Ring0! 0.56 98.12.9 exp module_name!, exp partial_exp_api, display 16bit module exports 0.55 98.12.2 exp module_name, mod,Get all API func name at runtime 0.50 98.11.20 fkey,wmsg,task,mod,proc hot key change to Ctrl+L command G will auto active user prg, break point will auto active TRW 0.40 98.11.6 lines,wc,wd 0.39 98.11.3 hwnd 0.38 98.10.28 hot key 'Ctrl+L', command 'RS',<F4> 0.37 98.10.25 Help more like WinICE 0.36 98.10.4 bp if new_section,pedump 0.35 98.9.30 Conditional breakpoint 0.30 98.9.22 Win98 support 0.25 98.9.19 MKPE, PAGEIN 0.22 98.9.12 BPIO 0.20 98.9.9 First public version
Powerful than WinICE: . dynamic load, dynamic unload, run when need . support all video adaptor . if possible, multi-task running during trace . file write . make PE from memory! .
test1: Test Dos Protect Mode app
1. run TRW 2. begin a dos windows in Win95 3. select 'trnewdos' in TRW's menu 4. run PMODE.EXE in DOS command prompt 5. back to TRW, you will find you are at the beginning of the DOS program. Now you have 2 choice:case 1: g 342 t g 342 Press <F8> for some times, now enter 16bit protect mode! 'g 4dd', Press <F8> for some times, now enter 32bit protect mode!case 2: or just: g if cs<100 ;this will run to PM16! g if cs!=cs ;try to run to PM32 g if cs!=cs ;again, and we are in PM32
test2
run NOTEPAD.exe, and "help"|"about notepad", the dialog display. run TRW , Ctrl+N to active TRW hwnd from the hwnd list, find the hwnd by '(Dialog)' bpmsg <the_hwnd> wm_destroy bl g In NOTEPAD, press "OK", this will active TRW we have 2 choice: case 1:press F12(pret) some times, we will find this dialog box is called by shell32.dll call [DialogBoxParamA] notepad.exe call [ShellAboutA]case 2:"pmodule", and we back to notepad.exe quickly, after the "call [ShellAboutA]".
test3: hotkey Ctrl+N and command 'pmodule'
run TRW run NOTEPAD.exe, and "help"|"about notepad", the dialog display. Keep the about dialog foreground window, Ctrl+N to active TRW We already break in NOTEPAD address context! run command 'pmodule','ok' the dialog, we will break in notepad quickly, just after 'call [ShellAboutA]'
test4: new thread catch
select 'trnewtcb' in TRW's menu. Now you can run any 32bit , or 16bit app. TRW will catch the new thread at the first opcode.
test5:
If right click the TRW icon in systray, I want TRW show a popup menu. But I do not know how to do this.
So I run TRW, right click a user icon in systray, with its popup menu on, Ctrl+N to active TRW.Then do command 'pmodule'.Click anywhere to make the user popup menu close. TRW active and tell me it calls 'TrackPopupMenu'.
1. Ctrl + M
the Ring0 hot key. Break Win95 in ring0 VMM.vxd.
Do nothing in Win95 DOS window.
2. Ctrl + N
the Ring3 hot key.
In most time, we neednt break in ring0. <ctrl+N> will break the foreground window thread in ring3. I think this is what we really need.
If Ctrl+N pressed in a Win95 DOS window, TRW will break the current running DOS or DPMI program.
If you press Ctrl+N and nothing happened, press any key or move the mouse. And wait to see if anything happen :D
在代码窗中,
- <F9>:设断点于当前代码,相当于
BPX cs:eip
- <F7>:运行到当前代码,相当于
GOX cs:eip
MakePE | TRIDC |
provided by G-Rom. MakePE can fix Imports section problem of DUMP1.exe, created by TRW 'PEDUMP' command.
TRSYM.exe is a symbol loader for TRW. It load .SYM
file create by MAPSYM from Microsoft
ver>=6.0, or create by TRIDC.exe. Usage:
TRSYM.exe yourfile.sym
The .SYM file can be for 32bit PE programs, or VxD programs,
Almost all compilers will produce .MAP for your
application.
For existing apps, you can try to load it in IDA pro, and then
make .MAP from IDA pro.
make .IDC from IDA pro, and then TRIDC to make .SYM
After this, TRW will recognize all debug symbols
in .SYM.
Command 'SYM' to display all symbols.
TRIDC.exe convert .IDC produced by IDA pro (>3.8 ?) to .SYM.
This .SYM can be used by SoftICE
or any other program, recognized as produced by MAPSYM ver 6.0.
What more, this .SYM include a new 'TRW ' section which is
only for TRW. This section include
some more information from .IDC
- function begin, function end
- comments
- additional anterial lines
- .... (will add soon)
So, after load this .SYM with TRSYM.exe, TRW can display this info in the code window.
The origin .IDC file can be for 32bit PE programs, or VxD programs,
BPIO | EXP | PRET | TRNEWDOS |
BPIO port 设置一个硬件断点,当访问该端口时断点生效。 例: bpio 378
BMSG hwnd [msg] BPMSG hwnd [msg] BreakPoint on window message. See also: WMSG Ex: BMSG 12c wm_destroy
BPM address R BPM address W BPM address X set a hardware breapoint with DRx.
BPMX address set a executive breakpoint with DRx. same as 'BPM address X'
BPIO port BreakPoint on port I/O
BPR start_addr end_addr BreakPoint on Range access.
BP [[seg:]address] BPX [[seg:]address] BreakPoint on Execute 'BPX offset' when trace a DOS app will ignore segment. TRW will try to set this Breakpoint with Debug Register. If Debug Register not enough, int3 instead. See also 'BPMX'.
H [command] 显示命令列表,或指定命令的详细用法。
HWND [HWND] 显示当前的窗口列表。
CPU 显示当前CPU各系统寄存器内容。
D [address] D range >filename memory dump in Data Window. or save memory dump to file. d 401000 d cs:402000 d 401000,402000 >myfile d 401000L100 >myfile
EXP ! Exp module-name! Exp partial_export_name display all exports API of a module. search exports API function name in all reference modules. EXP ! Exp kernel32! Exp * Exp Get* Exp *window*
FKEY [function-key strings] Display/Set Function keys ex: FKEY FKEY f10 d 2;U 3:
G Run it. G address ;run to address, same as 'gox address' G if conditions ;run with conditions
GO?
one-time breakpoint series.
each 'BPXX' command can be replaced as 'GOXX' for a one-time break-point. TRW will set this breakpoinnt, go, and clear it. gor fs:0 fs:10 gomd r ds:40000 gox cs:eip
PageIn <address> Load the not present page to memory. PageIn cs:401000
Lines [25 | 43 | 50 | 60] Set/Display screen lines ex: lines 43
MOD Display module list, include 16bit module and 32bit module, or display detail info for specified module. Usage: MOD MOD [hmodule] MOD . ;for current module
MKPE Make a PE program 'newpe.exe' from the memory. Always 'del newpe.exe' before 'MKPE', or TRW will append it! Current EIP will be the new entrypoint. A util in TRW 'PEcompare' can help you compare the origin PE and NewPE to test how TRW work.
PEDUMP Dump PE image memory direct to file 'DUMP1.EXE'. You can use G_Rom's MakePE to rebuild a valid PE.
BP if condition BreakPoint on condition bp if eax>=3456787 bp if dx<543 bp if ch==23 go if ah!=34 go if new_section ;breakpoint if EIP run into a new section in PE image
PMODULE 'pret' until CS:EIP in the module. 一般当我们中断程序运行的时候,我们总是停在WIN95的系统内部,而不是我们感兴趣的 程序。我们可以想象,当前的CS:EIP肯定是在主程序的一个CALL之中。所以,我们可以 用多个'PRET'返回主程序。那么,能不能尽快地返回到主程序的地址空间呢?可以,这 就是TRW独有的'PMODULE'命令。
PRET run until RET,RETF,IRET. shortcut key: F12
RS View User Screen. (F4).
S Search in memory S 0 L -1 'window' S 100,200 'bug12',34
SYM List all debug symbols
TASK Display task list
THREAD Display thread infomation Usage: THREAD [TCB] THREAD . ;for current thread
TRNEWDOS Catch next DOS program.
TRNEWTCB Catch next new thread at the first opcode. Support 32bit,16bit app. Do not run Windows app in DOS command prompt, or TRW will catch START.EXE.
TRTCB Trace a existing thread Usage: TRTCB TCB
U [address] U range >filename disassembly in Code Window. or save output to a file. u 401000 u cs:402000 u 401000,402000 >myfile u 401000L100 >myfile
VCALL Usage: Vcall * -display all VxD calls Vcall num -if num<10000h, diaplay all VxDid calls -if num>10000h, diaplay the VxD call Vcall partial-name Ex: Vcall 0d Vcall 100001 Vcall *sys*
WC [codewindow_lines] Set lines of code window. No parameter will turn it on/off. ex: wc 25 wc
WD [datawindow_lines] Set lines of data window. No parameter will turn it on/off. ex: wd 25 wd
WMSG - Display windows messages usage: WMSG [partial-name] [WMSG-number] Ex: WMSG 12 WMSG wm_destroy
To load Debug Symbols for 32bit PE programs, or VxD programs,
TRSYM.exe yourfile.sym
file .SYM must create by MAPSYM from Microsoft ver>=6.0
Almost all compilers will produce .MAP for your application.
For existing apps, you can try to load it in IDA pro, and then
make .MAP from IDA pro. Or make .IDC from IDA pro, and make .SYM
from .IDC by TRIDC.exe
After this, TRW will recognize all debug symbols
in .SYM.
Command 'SYM' to display all symbols.
请加入我的邮件列表:
This is TR for Win95 (TRW) shareware version. Please register if you like it.
$32 for TRW 0.67, $33 for TRW 0.68, and more & more .... :)
Email me first!
----- the end -----