(ShareWare version)
TR for Win95/98(TRW) is a debugger running in Win95/98. TRW can trace DOS COM,DOS EXE,DOS protected mode,16bit NE,32bit PE applications, and trace ring 0 kernel VxD. TRW run in Win95, OSR2, Win98. I will update TRW everyday. Any suggestions are appreciated! LiuTaoTao P.R. China liutt@371.net ayliutt@hotmail.com http://www.netease.com/~ayliutt |
WhatsNew Introduction Work Modes Commands Some Test Debug Symbol load Utilities include Register |
Thanks to: Slava The Owl Lx __Ice Just Stone G-Rom .... Functions done: . load PE runtime . hook all API . load NE at command line, in full-screen DOS window . set options in TRW.ini . Ring0 keyboard handler . asm . file write . instance comment . BPM BPR BPX . dot command . load DOS app . trace DOS app into protect mode . BPIO . make PE from memory! . press hot key Ctrl+L anytime . Get all API func name at runtime . Debug Symbol support . Get Symbol from IDA pro . bp messages Functions will be done: . show more information about Win95 . add some function like IDA, support IDC . add some funtion to auto unshell,auto kickdog... . mouse support . test mode . heap .
0.73 99.06.02 add debug register breakpoint: BPIO
support DOS window( not full screen )
fix some crash bugs
0.72 99.05.14 fix some crush bugs. All file write commands work now.
D range >file
U range >file
PEDUMP
TRnewTCB and TRnewDOS command in menu
0.71 99.05.07 fix many bugs.
0.70 99.04.23 Change from character mode to GUI mode
change command 'bpmodule' to 'pmodule'
hotkey Ctrl+M, Ctrl+N
0.68 99.04.14 add command 'S', and fix some bugs
0.67 99.04.09 add bpmsg,bpmodule,F12(pret)
0.66 99.03.10 add tridc.exe,
0.65 99.03.02 add trsym.exe, .SYM support for PE,.VxD
0.64 99.01.18
0.62 98.12.28 fix many bugs
0.60 98.12.18 new command 'vcall',
support vxd symbols,'u Get_Cur_VM_Handle'
hot key <Ctrl>+M break in Ring0!
0.56 98.12.9 exp module_name!, exp partial_exp_api,
display 16bit module exports
0.55 98.12.2 exp module_name, mod,Get all API func name at runtime
0.50 98.11.20 fkey,wmsg,task,mod,proc
hot key change to Ctrl+L
command G will auto active user prg,
break point will auto active TRW
0.40 98.11.6 lines,wc,wd
0.39 98.11.3 hwnd
0.38 98.10.28 hot key 'Ctrl+L', command 'RS',<F4>
0.37 98.10.25 Help more like WinICE
0.36 98.10.4 bp if new_section,pedump
0.35 98.9.30 Conditional breakpoint
0.30 98.9.22 Win98 support
0.25 98.9.19 MKPE, PAGEIN
0.22 98.9.12 BPIO
0.20 98.9.9 First public version
กก
Powerful than WinICE: . dynamic load, dynamic unload, run when need . support all video adaptor . if possible, multi-task running during trace . file write . make PE from memory! .
test1: Test Dos Protect Mode app
1. run TRW 2. begin a dos windows in Win95 3. select 'trnewdos' in TRW's menu 4. run PMODE.EXE in DOS command prompt 5. back to TRW, you will find you are at the beginning of the DOS program. Now you have 2 choice:case 1: g 342 t g 342 Press <F8> for some times, now enter 16bit protect mode! 'g 4dd', Press <F8> for some times, now enter 32bit protect mode!case 2: or just: g if cs<100 ;this will run to PM16! g if cs!=cs ;try to run to PM32 g if cs!=cs ;again, and we are in PM32
test2
run NOTEPAD.exe, and "help"|"about notepad", the dialog display. run TRW , Ctrl+N to active TRW hwnd from the hwnd list, find the hwnd by '(Dialog)' bpmsg <the_hwnd> wm_destroy bl g In NOTEPAD, press "OK", this will active TRW we have 2 choice: case 1:press F12(pret) some times, we will find this dialog box is called by shell32.dll call [DialogBoxParamA] notepad.exe call [ShellAboutA]case 2:"pmodule", and we back to notepad.exe quickly, after the "call [ShellAboutA]".
test3: hotkey Ctrl+N and command 'pmodule'
run TRW run NOTEPAD.exe, and "help"|"about notepad", the dialog display. Keep the about dialog foreground window, Ctrl+N to active TRW We already break in NOTEPAD address context! run command 'pmodule','ok' the dialog, we will break in notepad quickly, just after 'call [ShellAboutA]'
test4: new thread catch
select 'trnewtcb' in TRW's menu Now you can run any 32bit , or 16bit app. TRW will catch the new thread at the first opcode.
test5:
If right click the TRW icon in systray, I want TRW show a popup menu. But I do not know how to do this.
So I run TRW, right click a user icon in systray, with its popup menu on, Ctrl+N to active TRW.Then do command 'pmodule'.Click anywhere to make the user popup menu close. TRW active and tell me it calls 'TrackPopupMenu'.
1. Ctrl + M
the Ring0 hot key. Break Win95 in ring0 VMM.vxd.
Do nothing in Win95 DOS window.
2. Ctrl + N
the Ring3 hot key.
In most time, we neednt break in ring0. <ctrl+N> will break the foreground window thread in ring3. I think this is what we really need.
If Ctrl+N pressed in a Win95 DOS window, TRW will break the current running DOS or DPMI program.
If you press Ctrl+N and nothing happened, press any key or move the mouse. And wait to see if anything happen :D
In Code Window,
- <F9>: set breakpoint at current opcode, same as
BPX cs:eip
- <F7>: run to current opcode, same as
GOX cs:eip
กก
| MakePE | TRIDC |
provided by G-Rom. MakePE can fix Imports section problem of DUMP1.exe, created by TRW 'PEDUMP' command.
TRSYM.exe is a symbol loader for TRW. It load .SYM
file create by MAPSYM from Microsoft
ver>=6.0, or create by TRIDC.exe. Usage:
TRSYM.exe yourfile.sym
The .SYM file can be for 32bit PE programs, or VxD programs,
Almost all compilers will produce .MAP for your
application.
For existing apps, you can try to load it in IDA pro, and then
make .MAP from IDA pro.
make .IDC from IDA pro, and then TRIDC to make .SYM
After this, TRW will recognize all debug symbols
in .SYM.
Command 'SYM' to display all symbols.
TRIDC.exe convert .IDC produced by IDA pro (>3.8 ?) to .SYM.
This .SYM can be used by SoftICE
or any other program, recognized as produced by MAPSYM ver 6.0.
What more, this .SYM include a new 'TRW ' section which is
only for TRW. This section include
some more information from .IDC
- function begin, function end
- comments
- additional anterial lines
- .... (will add soon)
So, after load this .SYM with TRSYM.exe, TRW can display this info in the code window.
The origin .IDC file can be for 32bit PE programs, or VxD programs,
| BPIO | EXP | PRET | TRNEWDOS |
BPIO port Set a debug regsiter breakpoint on port I/O.
BMSG hwnd [msg] BPMSG hwnd [msg] BreakPoint on window message. See also: WMSG Ex: BMSG 12c wm_destroy
BPM address R BPM address W BPM address X set a hardware breapoint with DRx.
BPMX address set a executive breakpoint with DRx. same as 'BPM address X'
BPIO port BreakPoint on port I/O
BPR start_addr end_addr BreakPoint on Range access.
BP [[seg:]address] BPX [[seg:]address] BreakPoint on Execute 'BPX offset' when trace a DOS app will ignore segment. TRW will try to set this Breakpoint with Debug Register. If Debug Register not enough, int3 instead. See also 'BPMX'.
CPU Display CPU register infomation.
H [command] display help for all commands, or the given command in detail.
HWND [HWND] Display window handle information.
D [address] D range >filename memory dump in Data Window. or save memory dump to file. d 401000 d cs:402000 d 401000,402000 >myfile d 401000L100 >myfile
EXP ! Exp module-name! Exp partial_export_name display all exports API of a module. search exports API function name in all reference modules. EXP ! Exp kernel32! Exp * Exp Get* Exp *window*
FKEY [function-key strings] Display/Set Function keys ex: FKEY FKEY f10 d 2;U 3:
G Run it. G address ;run to address, same as 'gox address' G if conditions ;run with conditions
GO?
one-time breakpoint series.
each 'BPXX' command can be replaced as 'GOXX' for a one-time break-point. TRW will set this breakpoinnt, go, and clear it. gor fs:0 fs:10 gomd r ds:40000 gox cs:eip
PageIn <address> Load the not present page to memory. PageIn cs:401000
Lines [25 | 43 | 50 | 60] Set/Display screen lines ex: lines 43
MOD Display module list, include 16bit module and 32bit module, or display detail info for specified module. Usage: MOD MOD [hmodule] MOD . ;for current module
MKPE Make a PE program 'newpe.exe' from the memory. Always 'del newpe.exe' before 'MKPE', or TRW will append it! Current EIP will be the new entrypoint. A util in TRW 'PEcompare' can help you compare the origin PE and NewPE to test how TRW work.
PEDUMP Dump PE image memory direct to file 'DUMP1.EXE'. You can use G_Rom's MakePE to rebuild a valid PE.
BP if condition BreakPoint on condition bp if eax>=3456787 bp if dx<543 bp if ch==23 go if ah!=34 go if new_section ;breakpoint if EIP run into a new section in PE image
PMODULE 'pret' until CS:EIP in the module.
PRET run until RET,RETF,IRET. shortcut key: F12
RS View User Screen. (F4).
S Search in memory S 0 L -1 'window' S 100,200 'bug12',34
SYM List all debug symbols
TASK Display task list
THREAD
Display thread infomation
Usage:
THREAD [TCB]
THREAD . ;for current thread
TRNEWDOS Catch next DOS program.
TRNEWTCB Catch next new thread at the first opcode. Support 32bit,16bit app. Do not run Windows app in DOS command prompt, or TRW will catch START.EXE.
TRTCB Trace a existing thread Usage: TRTCB TCB
U [address] U range >filename disassembly in Code Window. or save output to a file. u 401000 u cs:402000 u 401000,402000 >myfile u 401000L100 >myfile
VCALL Usage: Vcall * -display all VxD calls Vcall num -if num<10000h, diaplay all VxDid calls -if num>10000h, diaplay the VxD call Vcall partial-name Ex: Vcall 0d Vcall 100001 Vcall *sys*
WC [codewindow_lines] Set lines of code window. No parameter will turn it on/off. ex: wc 25 wc
WD [datawindow_lines] Set lines of data window. No parameter will turn it on/off. ex: wd 25 wd
WMSG - Display windows messages usage: WMSG [partial-name] [WMSG-number] Ex: WMSG 12 WMSG wm_destroy
To load Debug Symbols for 32bit PE programs, or VxD programs,
TRSYM.exe yourfile.sym
file .SYM must create by MAPSYM from Microsoft ver>=6.0
Almost all compilers will produce .MAP for your application.
For existing apps, you can try to load it in IDA pro, and then
make .MAP from IDA pro. Or make .IDC from IDA pro, and make .SYM
from .IDC by TRIDC.exe
After this, TRW will recognize all debug symbols
in .SYM.
Command 'SYM' to display all symbols.
Please join my friends-only maillist:
กก
This is TR for Win95 (TRW) shareware version. Please register if you like it.
$32 for TRW 0.67, $33 for TRW 0.68, and more & more .... :)
Email me first!
Chinese version of readme comes soon
----- the end -----