(ShareWare version)
TR for Win95(TRW) is a debugger running in Win95. TRW can trace DOS COM,DOS EXE,DOS protect mode app,16bit NE,32bit PE applications, and trace ring 0 kernel VxD. TRW run in Win95, OSR2, Win98. I will update TRW everyday. Any suggestions are appreciated! LiuTaoTao P.R. China liutt@371.net ayliutt@hotmail.com http://www.netease.com/~ayliutt |
WhatsNew Introduction Work Modes Commands Some Test Debug Symbol load Utilities include Register |
Thanks to: Slava The Owl Lx IceMan81 Just Stone G-Rom .... Functions done: . load PE runtime & command line . hook all API . load NE at command line, in full-screen DOS window . set options in TRW.ini . Ring0 keyboard handler . asm . file write . instance comment . BPM BPR BPX . dot command . load DOS app . trace DOS app into protect mode . BPIO . make PE from memory! . press hot key Ctrl+L anytime . Get all API func name at runtime . Debug Symbol support . Get Symbol from IDA pro . bp messages Functions will be done: . show more information about Win95 . add some function like IDA, support IDC . add some funtion to auto unshell,auto kickdog... . mouse support . test mode . heap .
0.68 99.04.14 add command 'S', and fix some bugs 0.67 99.04.09 add bpmsg,bpmodule,F12(pret) 0.66 99.03.10 add tridc.exe, 0.65 99.03.02 add trsym.exe, .SYM support for PE,.VxD 0.64 99.01.18 0.62 98.12.28 fix many bugs 0.60 98.12.18 new command 'vcall', support vxd symbols,'u Get_Cur_VM_Handle' hot key <Ctrl>+M break in Ring0! 0.56 98.12.9 exp module_name!, exp partial_exp_api, display 16bit module exports 0.55 98.12.2 exp module_name, mod,Get all API func name at runtime 0.50 98.11.20 fkey,wmsg,task,mod,proc hot key change to Ctrl+L command G will auto active user prg, break point will auto active TRW 0.40 98.11.6 lines,wc,wd 0.39 98.11.3 hwnd 0.38 98.10.28 hot key 'Ctrl+L', command 'RS',<F4> 0.37 98.10.25 Help more like WinICE 0.36 98.10.4 bp if new_section,pedump 0.35 98.9.30 Conditional breakpoint 0.30 98.9.22 Win98 support 0.25 98.9.19 MKPE, PAGEIN 0.22 98.9.12 BPIO 0.20 98.9.9 First public version
Powerful than WinICE: . dynamic load, dynamic unload, run when need . support all video adaptor . if possible, multi-task running during trace . file write . make PE from memory! .
Test Dos Protect Mode app
1. begin a dos windows in Win95 2. run TRW in another dos windows 3. run 'trnewdos' in TRW 4. in another dos window, run PMODE.EXE 5. back to TRW, you will find you are at the beginning of the DOS program. g 342 t g 342 6. Press <F8> for some times, now enter 16bit protect mode! 7. 'g 4dd', Press <F8> for some times, now enter 32bit protect mode! or just: g if cs<100 ;this will run to PM16! g if cs!=cs ;try to run to PM32 g if cs!=cs ;again, and we are in PM32
Test Make PE from memory
del newpe.exe TRW msg.exe MKPE PEcompare msg.exe newpe.exe or: PESHIELD msg.exe PECRYPT msg.exe PELOCK msg.exe PE?? msg.exe del newpe.exe TRW msg.exe g 4010fd ;this is the entrypoint, I know mkpe ;eip will be the new PE's entrypoint PEcompare origin_msg.exe newpe.exe Always del newpe.exe before 'MKPE', or TRW will append it!
test1:
trw msg.exe <f8>,<f8>,<f8>.... q
test2:
trw msg.exe g
test3:
trw msg.exe <f8>,<f8> <Alt+Tab> ;Now in Win95 desktop, press <Alt+Tab> again to back q
test4:
trw ne.exe <f8>,<f8> g ;you can not 'q' when trace a NE app
test6:
trw msg.exe g GetVersion pret <f8> g
test7:
trw msg.exe bpx messageboxa g bc ;clear all breakpoint g
test8:
trw msg.exe <f8> w cs:eip,eip+70 >dump.txt ;write mem dump to file u cs:eip,eip+20 >asm.txt ;write unasm output to file
test9:
trw msg.exe <f8> bpio 21 r edx 21 e 401112 ec ;in al,dx g 40111f ;bpio will break at 401112 q
test0.67-1
run NOTEPAD.exe, and "help"|"about notepad", the dialog display. TRW hwnd from the hwnd list, find the hwnd by '(Dialog)' bpmsg <the_hwnd> wm_destroy bl switch to NOTEPAD, press "OK", this will active TRW we have 2 choice: case 1:press F12(pret) some times, we will find this dialog box is called by shell32.dll call [DialogBoxParamA] notepad.exe call [ShellAboutA]case 2:"gomodule .", and we back to notepad.exe quickly, after the "call [ShellAboutA]".
TRW has 2 work modes,
1. Free mode
If no program load, or thread is running, TRW.EXE will work in this mode. In this work mode,
- breakpoints are global to all threads
- Breakpoints will only enable when TRW is not foreground.
- When TRW is not foreground, Ctrl + M is enable.
- Command 'TRTCB','TRNEWTCB','TRVM','TRNEWDOS' can make TRW load a thread, and enter Program-Loaded mode.
2. Program loaded mode
TRW work in this mode if it load a no-ring0 thread, and the thread is suspended. In this work mode:
- Command 'G', or some other this kinds of commands, will make the thread resume to run. And TRW will back to Free mode.
- breakpoint only enable after after the thread resume.
- In Free mode, command 'TRlast' to load the last thread.
- Ctrl + M is disable. But TRW can break in Ring0, if breakpoint find in Ring0 of current thread.
- All breakpoint is local, only for current thread
And, from another point, TRW has 2 work mode:
1. share mode
In this work mode, TRW is act as a standard Win32 program. You can Alt-Tab to task switch to other running task, and vice versa.Unless the thread tracing is in critical-section.
2. Ring0 exclusive mode
TRW enter this mode if Ctrl+M pressed, or breakpoint in Ring0. As TRW is tracing a ring0 thread, so we must be in exclusive mode. No other threads are running. Alt-Tab disable. Command 'g' to make it go.
SoftICE only have this work mode.
1. Ctrl + L
Most time, you can Alt+Tab to switch betreen your app and TRW.
If this was disabled, you can press Ctrl+L to back to TRW quickly.
2. Ctrl + M
TRSYM | TRIDC |
TRSYM.exe is a symbol loader for TRW. It load
.SYM file create by MAPSYM from Microsoft
ver>=6.0, or create by TRIDC.exe. Usage:
TRSYM.exe yourfile.sym
The .SYM file can be for 32bit PE programs, or VxD programs,
Almost all compilers will produce .MAP for your
application.
For existing apps, you can try to load it in IDA pro, and then
make .MAP from IDA pro.
make .IDC from IDA pro, and then TRIDC to make .SYM
After this, TRW will recognize all debug symbols
in .SYM.
Command 'SYM' to display all symbols.
TRIDC.exe convert .IDC produced by IDA pro (>3.8 ?) to
.SYM. This .SYM can be used by SoftICE
or any other program, recognized as produced by MAPSYM ver 6.0.
What more, this .SYM include a new 'TRW ' section which is
only for TRW. This section include
some more information from .IDC
- function begin, function end
- comments
- additional anterial lines
- .... (will add soon)
So, after load this .SYM with TRSYM.exe, TRW can display this info in the code window.
The origin .IDC file can be for 32bit PE programs, or VxD programs,
BPMODULE | BPMSG | ||
EXP | |||
MOD | PRET | S | task |
thread | TRTCB | ||
WMSG |
BPMODULE . BPMODULE hmod run until CS:EIP in the module, '.' for current module.
BMSG hwnd [msg] BPMSG hwnd [msg] BreakPoint on window message. See also: WMSG Ex: BMSG 12c wm_destroy
H [command] display help for all commands, or the given command in detail. HWND [HWND] Display window handle information.
EXP ! Exp module-name! Exp partial_export_name display all exports API of a module. search exports API function name in all reference modules. EXP ! Exp kernel32! Exp * Exp Get* Exp *window* FKEY [function-key strings] Display/Set Function keys ex: FKEY FKEY f10 d 2;U 3:4 PageIn <address> Load the not present page to memory. PageIn cs:401000 Lines [25 | 43 | 50 | 60] Set/Display screen lines ex: lines 43
MOD Display module list, include 16bit module and 32bit module, or display detail info for specified module. Usage: MOD MOD [hmodule] MOD . ;for current module
MKPE Make a PE program 'newpe.exe' from the memory. Always 'del newpe.exe' before 'MKPE', or TRW will append it! Current EIP will be the new entrypoint. A util in TRW 'PEcompare' can help you compare the origin PE and NewPE to test how TRW work. PEDUMP Dump PE image memory direct to file 'PEDUMP.EXE'. You can use G_Rom's MakePE to rebuild a valid PE. BPIO port BreakPoint on port I/O BPR start_addr end_addr BreakPoint on Range access. BP [[seg:]address] BPX [[seg:]address] BreakPoint on Execute 'BPX offset' when trace a DOS app will ignore segment. On tracing a PE thread, this is same as 'BPM X'. One-Time BreakPoint commands each 'BPXX' command can be replaced as 'GOXX' for a one-time break-point. TRW will set this breakpoinnt, go, and clear it. gor fs:0 fs:10 gomd r ds:40000 BP if condition BreakPoint on condition bp if eax>=3456787 bp if dx<543 bp if ch==23 go if ah!=34 go if new_section
PRET run until RET,RETF,IRET. shortcut key: F12
RS Restore User Screen. (F4). In most time, you can Alt+Tab to switch to your APP. Ctrl+L or Alt+Tab to return to TRW.
S Search in memory S 0 L -1 'window' S 100,200 'bug12',34
SYM List all debug symbols TASK Display task list
THREAD Display thread infomation Usage: THREAD [TCB] THREAD . ;for current thread
TRTCB Trace a existing thread Usage: TRTCB TCB
VCALL Usage: Vcall * -display all VxD calls Vcall num -if num<10000h, diaplay all VxDid calls -if num>10000h, diaplay the VxD call Vcall partial-name Ex: Vcall 0d Vcall 100001 Vcall *sys* WC [codewindow_lines] Set lines of code window. No parameter will turn it on/off. ex: wc 25 wc WD [datawindow_lines] Set lines of data window. No parameter will turn it on/off. ex: wd 25 wd
WMSG - Display windows messages usage: WMSG [partial-name] [WMSG-number] Ex: WMSG 12 WMSG wm_destroy
To load Debug Symbols for 32bit PE programs, or VxD programs,
TRSYM.exe yourfile.sym
file .SYM must create by MAPSYM from Microsoft ver>=6.0
Almost all compilers will produce .MAP for your application.
For existing apps, you can try to load it in IDA pro, and then
make .MAP from IDA pro. Or make .IDC from IDA pro, and make .SYM
from .IDC by TRIDC.exe
After this, TRW will recognize all debug symbols
in .SYM.
Command 'SYM' to display all symbols.
Services TRW provides UNASM (and ASM ?) service to DOS programs. Check test1.asm for more.
Please join my friends-only maillist:
This is TR for Win95 (TRW) shareware version. Please register if you like it.
$32 for TRW 0.67, $33 for TRW 0.68, and more & more .... :)
Email me first!
Chinese version of readme comes soon
----- the end -----