TR for Win95/98

(ShareWare version)

TR for Win95/98(TRW) is a debugger running in Win95/98. TRW can trace
DOS COM,DOS EXE,DOS protected mode,16bit NE,32bit PE applications,
and trace ring 0 kernel VxD.

TRW run in Win95, OSR2, Win98.

I will update TRW everyday. Any suggestions are appreciated!

	LiuTaoTao
	P.R. China
	liutt@371.net
	ayliutt@hotmail.com
	http://www.netease.com/~ayliutt
WhatsNew
Introduction
Work Modes
Commands
Some Test
Debug Symbol load
Utilities include
Register
Thanks to:
	Slava
	The Owl
	Lx
	__Ice
	Just Stone
	G-Rom
	....

Functions done:
	. load PE runtime
	. hook all API
	. load NE at command line, in full-screen DOS window
	. set options in TRW.ini
	. Ring0 keyboard handler
	. asm
	. file write
	. instance comment
	. BPM BPR BPX
	. dot command
	. load DOS app
	. trace DOS app into protect mode
	. BPIO
	. make PE from memory!
	. press hot key Ctrl+L anytime
	. Get all API func name at runtime
	. Debug Symbol support
	. Get Symbol from IDA pro
	. bp messages

Functions will be done:

	. show more information about Win95
	. add some function like IDA, support IDC
	. add some funtion to auto unshell,auto kickdog...
	. mouse support
	. test mode
	. heap
	.

Whats New

0.73	99.06.02 add debug register breakpoint: BPIO
		support DOS window( not full screen )
		fix some crash bugs
0.72	99.05.14 fix some crush bugs. All file write commands work now.
		D range >file
		U range >file
		PEDUMP
		TRnewTCB and TRnewDOS command in menu
0.71	99.05.07 fix many bugs.
0.70	99.04.23 Change from character mode to GUI mode
		 change command 'bpmodule' to 'pmodule'
		 hotkey Ctrl+M, Ctrl+N
0.68	99.04.14 add command 'S', and fix some bugs
0.67	99.04.09 add bpmsg,bpmodule,F12(pret)
0.66	99.03.10 add tridc.exe,
0.65	99.03.02 add trsym.exe, .SYM support for PE,.VxD
0.64	99.01.18
0.62	98.12.28 fix many bugs
0.60	98.12.18 new command 'vcall',
                 support vxd symbols,'u Get_Cur_VM_Handle'
                 hot key <Ctrl>+M break in Ring0!
0.56	98.12.9  exp module_name!, exp partial_exp_api,
                 display 16bit module exports
0.55	98.12.2  exp module_name, mod,Get all API func name at runtime
0.50	98.11.20 fkey,wmsg,task,mod,proc
                 hot key change to Ctrl+L
		 command G will auto active user prg,
		 break point will auto active TRW
0.40	98.11.6  lines,wc,wd
0.39	98.11.3  hwnd
0.38	98.10.28 hot key 'Ctrl+L', command 'RS',<F4>
0.37	98.10.25 Help more like WinICE
0.36	98.10.4 bp if new_section,pedump
0.35	98.9.30 Conditional breakpoint
0.30	98.9.22	Win98 support
0.25	98.9.19 MKPE, PAGEIN
0.22	98.9.12	BPIO
0.20	98.9.9 	First public version

กก


Introduction

Powerful than WinICE:
. dynamic load, dynamic unload, run when need
. support all video adaptor
. if possible, multi-task running during trace
. file write
. make PE from memory!
.

Some Test

test1: Test Dos Protect Mode app 
1. run TRW
2. begin a dos windows in Win95
3. select 'trnewdos' in TRW's menu
4. run PMODE.EXE in DOS command prompt
5. back to TRW, you will find you are at the beginning of the DOS program.
Now you have 2 choice:
case 1:
	g 342
	t
	g 342
	Press <F8> for some times, now enter 16bit protect mode!
	'g 4dd', Press <F8> for some times, now enter 32bit protect mode!
case 2: or just:
	g if cs<100	;this will run to PM16!
	g if cs!=cs	;try to run to PM32
	g if cs!=cs	;again, and we are in PM32
test2
run NOTEPAD.exe, and "help"|"about notepad", the dialog display.
run TRW , Ctrl+N to active TRW
    hwnd
from the hwnd list, find the hwnd by '(Dialog)'
    bpmsg <the_hwnd> wm_destroy
    bl
    g
In NOTEPAD, press "OK", this will active TRW
we have 2 choice:
case 1:
press F12(pret) some times, we will find this dialog box is called by
	shell32.dll	call	[DialogBoxParamA]
	notepad.exe	call	[ShellAboutA]
case 2:
"pmodule", and we back to notepad.exe quickly, after the "call [ShellAboutA]".
test3:	hotkey Ctrl+N and command 'pmodule'
run TRW
run NOTEPAD.exe, and "help"|"about notepad", the dialog display.
Keep the about dialog foreground window, Ctrl+N to active TRW
We already break in NOTEPAD address context!
run command 'pmodule','ok' the dialog, we will break in notepad quickly,
just after 'call [ShellAboutA]'
test4: new thread catch
select 'trnewtcb' in TRW's menu
Now you can run any 32bit , or 16bit app. TRW will catch the new thread at the first opcode.

test5:

If right click the TRW icon in systray, I want TRW show a popup menu. But I do not know how to do this.
So I run TRW, right click a user icon in systray, with its popup menu on, Ctrl+N to active TRW.Then do command 'pmodule'.Click anywhere to make the user popup menu close. TRW active and tell me it calls 'TrackPopupMenu'.


Hotkeys

1. Ctrl + M

the Ring0 hot key. Break Win95 in ring0 VMM.vxd.
Do nothing in Win95 DOS window.

2. Ctrl + N

the Ring3 hot key.

In most time, we neednt break in ring0. <ctrl+N> will break the foreground window thread in ring3. I think this is what we really need.

If Ctrl+N pressed in a Win95 DOS window, TRW will break the current running DOS or DPMI program.

If you press Ctrl+N and nothing happened, press any key or move the mouse. And wait to see if anything happen :D


Code Window

In Code Window,

BPX cs:eip

GOX cs:eip

กก


Utilities Include

MakePE

TRSYM

TRIDC

MakePE

provided by G-Rom. MakePE can fix Imports section problem of DUMP1.exe, created by TRW 'PEDUMP' command.

TRSYM.exe

TRSYM.exe is a symbol loader for TRW. It load .SYM file create by MAPSYM from Microsoft
ver>=6.0, or create by TRIDC.exe. Usage:

TRSYM.exe yourfile.sym

The .SYM file can be for 32bit PE programs, or VxD programs,

Almost all compilers will produce .MAP for your application.
For existing apps, you can try to load it in IDA pro, and then

  1. make .MAP from IDA pro.

  2. make .IDC from IDA pro, and then TRIDC to make .SYM

After this, TRW will recognize all debug symbols in .SYM.
Command 'SYM' to display all symbols.

TRIDC.exe

TRIDC.exe convert .IDC produced by IDA pro (>3.8 ?) to .SYM. This .SYM can be used by SoftICE
or any other program, recognized as produced by MAPSYM ver 6.0.

What more, this .SYM include a new 'TRW ' section which is only for TRW. This section include
some more information from .IDC

  1. function begin, function end
  2. comments
  3. additional anterial lines
  4. .... (will add soon)

So, after load this .SYM with TRSYM.exe, TRW can display this info in the code window.

The origin .IDC file can be for 32bit PE programs, or VxD programs,


Commands

BPIO

BPM

BPMSG

BPMX

BPX

CPU

D

EXP

G

GO?

MOD

PageIn

PEDump

PMODULE

PRET

RS

S

SYM

task

thread

TRNEWDOS

TRNEWTCB

TRTCB

U

WMSG

BPIO port
	Set a debug regsiter breakpoint on port I/O.
BMSG hwnd [msg]
BPMSG hwnd [msg]
	BreakPoint on window message.
	See also:	WMSG
	Ex:
		BMSG 12c wm_destroy
BPM address R
BPM address W
BPM address X
	set a hardware breapoint with DRx.
BPMX address
	set a executive breakpoint with DRx.
	same as 'BPM address X'
BPIO port
	BreakPoint on port I/O
BPR start_addr end_addr
	BreakPoint on Range access.
BP  [[seg:]address]
BPX [[seg:]address]
	BreakPoint on Execute
	'BPX offset' when trace a DOS app will ignore segment.
	TRW will try to set this Breakpoint with Debug Register. If Debug Register not enough, int3 instead.
	See also 'BPMX'.
CPU
	Display CPU register infomation.
H	[command]
	display help for all commands, or the given command in detail.
HWND	[HWND]
	Display window handle information.
D	[address]
D	range >filename
	memory dump in Data Window. or save memory dump to file.
		d 401000
		d cs:402000
		d 401000,402000 >myfile
		d 401000L100 >myfile
EXP !
Exp module-name!
Exp partial_export_name
	display all exports API of a module.
	search exports API function name in all reference modules.
		EXP !
		Exp kernel32!
		Exp *
		Exp Get*
		Exp *window*
FKEY	[function-key strings]
	Display/Set Function keys
	ex:
		FKEY
		FKEY f10 d 2;U 3:
G
	Run it.
	G address	;run to address, same as 'gox address'
	G if conditions	;run with conditions
GO?
one-time breakpoint series.
each 'BPXX' command can be replaced as 'GOXX' for a one-time break-point.
TRW will set this breakpoinnt, go, and clear it.
	gor fs:0 fs:10
	gomd r ds:40000
	gox cs:eip
PageIn <address>
	Load the not present page to memory.
	PageIn cs:401000
Lines  [25 | 43 | 50 | 60]
	Set/Display screen lines
	ex: lines 43
MOD
	Display module list, include 16bit module and 32bit module,
	or display detail info for specified module.
	Usage:
		MOD
		MOD	[hmodule]
		MOD	.		;for current module
MKPE
	Make a PE program 'newpe.exe' from the memory.
	Always 'del newpe.exe' before 'MKPE', or TRW will append it!
	Current EIP will be the new entrypoint.

	A util in TRW 'PEcompare' can help you compare the origin PE
	and NewPE to test how TRW work.
PEDUMP
	Dump PE image memory direct to file 'DUMP1.EXE'.
	You can use G_Rom's MakePE to rebuild a valid PE.
BP if condition
	BreakPoint on condition
	bp if eax>=3456787
	bp if dx<543
	bp if ch==23
	go if ah!=34
	go if new_section	;breakpoint if EIP run into a new section in PE image
PMODULE
	'pret' until CS:EIP in the module.
PRET
	run until RET,RETF,IRET.
	shortcut key: F12
RS
	View User Screen. (F4).
S
	Search in memory
		S 0 L -1 'window'
		S 100,200 'bug12',34
SYM
	List all debug symbols
TASK
	Display task list
THREAD
	Display thread infomation
	Usage:
                THREAD  [TCB]
                THREAD  .               ;for current thread
TRNEWDOS
	Catch next DOS program.
TRNEWTCB
	Catch next new thread at the first opcode.
	Support 32bit,16bit app.
	Do not run Windows app in DOS command prompt, or TRW will catch START.EXE.
TRTCB
	Trace a existing thread
	Usage:
		TRTCB	TCB
U	[address]
U	range >filename
	disassembly in Code Window. or save output to a file.
		u 401000
		u cs:402000
		u 401000,402000 >myfile
		u 401000L100 >myfile
VCALL
	Usage:
	    Vcall *    -display all VxD calls
	    Vcall num  -if num<10000h, diaplay all VxDid calls
	               -if num>10000h, diaplay the VxD call
	    Vcall partial-name
	Ex:
	    Vcall 0d
	    Vcall 100001
	    Vcall *sys*
WC	[codewindow_lines]
	Set lines of code window. No parameter will turn it on/off.
	ex:
		wc 25
		wc
WD	[datawindow_lines]
	Set lines of data window. No parameter will turn it on/off.
	ex:
		wd 25
		wd
WMSG     - Display windows messages
	usage:
	      WMSG     [partial-name] [WMSG-number]
	Ex:
		WMSG	12
		WMSG	wm_destroy

Debug Symbols

To load Debug Symbols for 32bit PE programs, or VxD programs,

TRSYM.exe yourfile.sym

file .SYM must create by MAPSYM from Microsoft ver>=6.0

Almost all compilers will produce .MAP for your application.

For existing apps, you can try to load it in IDA pro, and then
make .MAP from IDA pro. Or make .IDC from IDA pro, and make .SYM
from .IDC by TRIDC.exe

After this, TRW will recognize all debug symbols in .SYM.
Command 'SYM' to display all symbols.


Please join my friends-only maillist:

กก


Register

This is TR for Win95 (TRW) shareware version. Please register if you like it.

$32 for TRW 0.67, $33 for TRW 0.68, and more & more .... :)

Email me first!


Chinese version of readme comes soon
							----- the end -----