|
Try this[^] and add your own software.
|
|
|
|
|
OK, dont forget to lie down afterwards.
Morality is indistinguishable from social proscription
|
|
|
|
|
I have a working app I wrote that uses software breakpoints but read a great article on using hardware breakpoints, advantages - non intrusive and speed. Since both aspects were appealing I undertook a conversion. I began porting the dll I had written to asm and implemented the proper routines. However, I am having some very strange problems that have taken me hours to try and figure out and I'm stumped.
Here's the shorthanded basics...
#define MB MessageBox etc etc
while TRUE
{
ContextFlags = CONTEXT_DEBUG_REGISTERS
GetThreadConext
Dr0 = Addey1
Dr1 = Addey 2
Dr7 = 00000000000000000010001100001111b
SetThreadContext
WaitForDebugEvent
if ( dwDebugEventCode == EXIT_PROCESS_DEBUG_EVENT )
{
MB __T("Process exiting")
break
}
if ( dwDebugEventCode == EXCEPTION_DEBUG_EVENT )
{
if ( ExceptionCode == EXCEPTION_BREAKPOINT )
{
if ( ExceptionAddress == Addey1 )
MB __T("Hello from addey 1")
elseif ExceptionAddress == Addey2 )
MB __T("Hello from addey 2")
// here we clear the Dr regs enable single step in FLAGS, back up EIP
// continue & wait for debug event and then xor FLAGS and continue
// pretty much the same as the working dll that uses 0CCh breaks
}
else
{
ContinueDebugEvent - DBG_CONTINUE
continue
}
} // end EXCEPTION_DEBUG_EVENT
ContinueDebugEvent - DBG_EXCEPTION_NOT_HANDLED
} // end while
Now - the results are. If the app is ran the MB saying "Process exiting" pops up. Load it up in Ollydbg and run it, same result. If I set a breakpoint in Olly at the if EXCEPTION_BREAKPOINT, it hits and single stepping in results in trace into kernel32 which then traces into ntdll which returns back to the app and the proper MB "Hello from Addey x" msg as it is designed to do.
What gives? I have thought possibly that Olly is making a Ring0 call therefore can properly handle the DR reg calculations, but that would mean I would have to create a wdm or sys file runnning in Ring0 just to look at hardware breakpoints? Creating a Callgate to ring0 or manipulate SEH isn't feasible as MS could break such code with a patch, not to mention it's just not reliable from machine to machine.
I really do need the speed of the hardware breakpoint as the current dll is fast but not as fast as is desired, not to mention ReadProc and WriteProc 0cch is costly. I would be prepared to write a device driver but it has to also communicate with Ring3 code i reckon using MemMapping would be best but I'm a newb at the current device driver implementations.
Any help on why this code runs when traced in a debugger using single stepping but just exits when run would be most appreciated.
|
|
|
|
|
Wow, no answer on this yet?
Ok the 2 addresses are the program's send and receive addresses. I listen for the incoming/outgoing packet and read a byte sig and filter that by packet type. I send the data from the packet to another window alerting the user of an event in the case they may be semi-afk or in another window if it's the byte sig we want i.e. "Global announcement: there will be a server reboot in 1 hour!". It's been very useful but I want to speed it up by using hardware breakpoints which I also read is recommended over software operation.
I reworked the code and it is ok on recv but on send the program closes immediately. I have read and read and googled and googled and still cannot find a clear answer. Do I have to be in Ring 0 to manipulate the Dx regs and set them for the remote thread, or can this be done in userland?
|
|
|
|
|
Can anyone please point me to an offline one of these? Something that actually detects the configuration instead of having to capture it would be nice icing on that cake.
Semicolons. the number one seller of ostomy bags world wide. - dan neely
|
|
|
|
|
I must start by saying that am very impressed with the good work potrayed by the administrators and contributors of this solution blessing community  . I've gained and learnt a lot from people's problems and solutions just from watching behind. Now its time to join in the fun by posting my own encounter. I BELIEVE in you guys and thats why I am takng this step.
I am a C# developer(starting on C#1.1) and my skill level is between Beginner and Intermediate(though I have been building Client/Server applications recently) but now, I have just been given an advanced real life project to tackle.
A Filling Station manager wants me to build an application that will track/record the sales of fuel(preferably, as entered by the staff) from the electronic fuel meter pump machines. He wants the tracking to be indicated LIVE in the application which is hosted by a computer remotely(in the same station).
1. Is this possible?
2. If it is, what should be the design architecture & development strategy, deployment process and security considerations?
Please, this is urgent! can someone help me... anybody. 
|
|
|
|
|
Hi friends,
Can anybody help me out in getting good documents on blueTooth and EEPROM API list?
I have to do coding for these devices. Kindly Help me out with good documents which helps me in getting the API list and Code samples for the above said other than MSDN.
Thanks in advance..
poojaaa
|
|
|
|
|
i am assuming this is on a custom piece of hardware?
is the EEPROM IIC or SPI interface?
|
|
|
|
|
Is there some way I could measure the total load on the PSU now featuring as chief suspect in my shut-down problem described below? Maybe if it's an overload, and the unit is delivering close to rated current with low load, I could assume it would be subjected to an above rate current draw when the load increases?
Semicolons. the number one seller of ostomy bags world wide. - dan neely
|
|
|
|
|
Well you could use a plug in power meter which sits between the wall outlet and the PSU. Like the Kill A Watt[^]
//Johannes
|
|
|
|
|
If you have access to a variable transformer or a UPS where you can set the output voltage, you can lower the voltage to the PSU until the computer fails and shuts down.
If the shutdown voltage is above the standard -15% of nominal voltage, you want a new PSU.
Keep in mind that this might be a destructive test of the PSU.
|
|
|
|
|
Make sure you read the specsheet on the PSU before making a judgement. Better quality PSUs are designed tolerate larger deviations than cheap ones. Better quality new models can take Japanese 100v, us 110v, European 220V, or anything in between without having to flip a hardware switch.
You know, every time I tried to win a bar-bet about being able to count to 1000 using my fingers I always got punched out when I reached 4....
-- El Corazon
|
|
|
|
|
Wow, how long has it been since I even heard mention of a variac, let alone have seen one.
Semicolons. the number one seller of ostomy bags world wide. - dan neely
|
|
|
|
|
I actually have one. So I only use it once a year or so. But you can test things you wouldn't be able to otherwise.
I learned about the importance of voltage quality already as a kid. Whenever our farming neighbour used his welding equipment (Sized like a small nuclear plant) we had brownouts and the tv would break. My dad kept on complaining about bad quality tv-brands until the power company finally installed a new area transformer. Problems gone!
|
|
|
|
|
Brady Kelly wrote: Semicolons. the number one seller of ostomy bags world wide. - dan neely
Quote Selected Text
Could I have a capital T and perhaps a colon added to this?
You know, every time I tried to win a bar-bet about being able to count to 1000 using my fingers I always got punched out when I reached 4....
-- El Corazon
|
|
|
|
|
Sure. 
Semicolons: The number one seller of ostomy bags world wide. - dan neely
|
|
|
|
|
TY
You know, every time I tried to win a bar-bet about being able to count to 1000 using my fingers I always got punched out when I reached 4....
-- El Corazon
|
|
|
|
|
I am trying to diagnose a random shut-down problem on a friend's PC. This morning I blew out the CPU heatsink, and added an 80mm case fan, extracting, next to the CPU. I have just received work that it has again shut down, and I would like to establish more on whether temperature is still playing a role or not.
I want to log CPU temperature constantly, and observer whether shut-downs occur during upward trends in temperature. If not, I can forget more cooling and pay attention to other areas. How could I go about polling the CPU temperature?
|
|
|
|
|
Look for a BSOD in the windows dir, or a minidump in the minidump dir. If its overheating the dump will tell.
Morality is indistinguishable from social proscription
|
|
|
|
|
Would a negative result be definitive there? Overclocking driven overheating can cause random bitrot in the core and I'd assume the same could happen even at standard specs, while I assume windows could only properly log a temperature warning (on die or on mobo sensor) related failure correctly.
You know, every time I tried to win a bar-bet about being able to count to 1000 using my fingers I always got punched out when I reached 4....
-- El Corazon
|
|
|
|
|
Hi there people,
I have problem running the following driver code. It worked for sometime
but without no obvious reason whenever I try to stop the driver service
a BSOD appears with the PAGE_FAULT_IN_NON_PAGED_AREA error.
I found out that when I remove the set DriverName code the problem disappears
but the question is why.
I'm desperate I cant find a way to fix this thing. I load the driver
with the instdrv.In the Debug Viewer only the HI message apperars Any ideas?
Here is the code
VOID UnLoadMe(IN PDRIVER_OBJECT obj);<br />
UNICODE_STRING us;<br />
<br />
NTSTATUS DriverEntry ( IN PDRIVER_OBJECT theDriverObject, IN PUNICODE_STRING theRegistryPath )<br />
{<br />
<br />
DbgPrint("HELLO");<br />
RtlInitUnicodeString( &us, L"TEST\0" );<br />
theDriverObject->DriverName=us;<br />
theDriverObject->DriverUnload=UnLoadMe;<br />
return STATUS_SUCCESS;<br />
}<br />
<br />
<br />
VOID UnLoadMe(IN PDRIVER_OBJECT obj)<br />
{<br />
DbgPrint("BYE");<br />
}
|
|
|
|
|
You shouldnt set the driver name, its given to you, its the name in the services key of your drivers entry. (Like 'serial', 'tcp', etc).
Morality is indistinguishable from social proscription
|
|
|
|
|
First, listen to fat-boy - he's correct!!
However, to help understand what is causing your problem ...
Given that error (which is very precise in telling you what the problem is), my guess is that your us variable is stored in a paged data area. You have to be careful with global variables in drivers that they are stored how you think they are stored. There may be a pragma in effect putting all code and data into paged-pool - this is quite common for initialization code.
Judy
|
|
|
|
|
Unless he didnt paste all his code in (ie he is using the PAGED pragma) then all driver code is memory resident, and global vars.
But, since DriverEntry runs at passive level you can access paged out code without any problem. This is probably one of those odd errors where the error used doesnt really reflect what went on. Probably, its read only memory, or the unicode string actually points to part of the registry file or some such.
Morality is indistinguishable from social proscription
|
|
|
|
|
fat_boy wrote: Unless he didnt paste all his code in (ie he is using the PAGED pragma)
That is what I was suspecting and was referring to when I talked about a pragma asociated with the initialization code. My guess on the crash is that after the OP changes the driver name to use that paged variable and DriverEntry returns, the page fault occurs as soon as the driver object is used somewhere not at Passive level since it references paged memory.
Judy
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
