Text File

Aucbvax.6909 fa.info-vax utzoo!decvax!ucbvax!info-vax Sun Apr 25 10:26:34 1982 Examining .EXE files linked /NOTRACE >From EPS@MIT-AI Sun Apr 25 10:15:53 1982 Most of the stuff that comes from DEC is linked /NOTRACE, so RUN/DEBUG doesn't work. You can use PATCH, but I find DEBUG better suited for general hackery. * * * .title debugable make /NOTRACE image DEBUGable .library /sys:lib/ .psect debugable,nowrt,shr,pic,long .entry debugable,^m clrl -(sp) pushl #<DSC@16>!<DSC@24> pushaq prompt pushaq 4(sp) calls #2,g^lib cmpl r0,#rms bneq 3$ brw done 3$: blbc r0,death fab=exefab,- fns=(sp),fna=@4(sp) fab=exefab blbc r0,death cmpb exefab+fab,#fab beql docon brw notexe docon: movab -512(sp),sp rab=exerab,- rbf=(sp),ubf=(sp) rab=exerab blbc r0,death rab=exerab blbs r0,check death: r0 check: cmpw exerab+rab,#512 bneq notexe cmpw ihd(sp),#^a/02/ bneq notexe cmpb ihd(sp),#ihd bneq notexe bbs #ihd,ihd(sp),noxfer movzwl ihd(sp),r0 addl2 sp,r0 cmpl iha(r0),#sys beql doesst tstl iha(r0) bneq notclr movq iha(r0),iha(r0) movaw @#sys,iha(r0) rab=exerab blbc r0,die1 fab=exefab blbc r0,die1 done: movzwl #1,r0 ret notexe: pushaq notex1 scream: calls #1,g^lib blbs r0,done die1: brw death noxfer: pushaq noxfe1 brb scream doesst: pushaq doess1 brb scream notclr: pushaq notcl1 brb scream .psect constants,nowrt,noexe,shr,long prompt: .ascid /.EXE file: / .align long notex1: .ascid /?Not an executable file/ .align long noxfe1: .ascid /?No transfer address/ .align long doess1: .ascid /?Already DEBUGable/ .align long notcl1: .ascid /?Activation section full/ .psect exefab,wrt,noexe,long exefab:: fac=<BIO,GET,PUT>,- dnm=<.EXE>,- mrs=512,- rfm=fix .psect exerab,wrt,noexe,long exerab:: fab=exefab,- bkt=1,- rop=<BIO>,- usz=512 .end debugable * * * This will not work for .EXE files created by TKB. Since the .EXE file will have no symbols, you should make a 'SYSDEF.COM' file containing lines like DEFINE SYS = ^X80000000 to define all the symbols in SYSVECTOR. Then RUN/DEBUG your .EXE file and type '@SYSDEF' to load the symbols. Most images load at ^X200. I have a program that dumps all the interesting things in .EXE files (everything but the code) so I use that to get the start address and locations of the various image sections. Before you attack a program with DEBUG, an ASCII dump should be made. RUN the program and immediately type ^Y. Then $ EXAMINE/ASCII 200:7FFFFFFF to get a general idea of where things are. You can't do this with programs INSTALLed with privileges; make a copy of the known .EXE and ^Y out of that. Good luck as always.

--Eric

----------------------------------------------------------------- gopher://quux.org/ conversion by John Goerzen <jgoerzen@complete.org> of http://communication.ucsd.edu/A-News/

This Usenet Oldnews Archive article may be copied and distributed freely, provided:

1. There is no money collected for the text(s) of the articles.

2. The following notice remains appended to each copy:

The Usenet Oldnews Archive: Compilation Copyright (C) 1981, 1996 Bruce Jones, Henry Spencer, David Wiseman.