Thread: ms debug

;D

i was* bored* * :


started* messing* around with wolf* 2.60* and* windows* debugger* tools

Microsoft(R) Debugging Tools for Windows(R)
* * * * * * * * Version 6.6 Release Notes

ModLoad: 0a140000 0a1c1000* C:\Program Files\Wolfenstein - Enemy Territory\pb\pbcl.dll
ModLoad: 03370000 03387000* C:\Program Files\Wolfenstein - Enemy Territory\pb\pbag.dll
ModLoad: 0acf0000 0adb1000* C:\Program Files\Wolfenstein - Enemy Territory\pb\pbsv.dll
ModLoad: 40000000 402ed000* C:\Program Files\Wolfenstein - Enemy Territory\etpub\ui_mp_x86.dll
ModLoad: 30000000 33963000* C:\Program Files\Wolfenstein - Enemy Territory\etpub\cgame_mp_x86.dll

not* sure what i* found* but* it* seems* to be* * the* offsets* for* when the dll;s* are* called* ?
so i* was thinkin someone find this useful* ?

to be even more* giving* ,, this maybe* common knowlage* ?
http://www.microsoft.com/whdc/devtoo.../default.mspx*
url to* the* debugger* tool* itself*

what i did* was* started* wolf* with my* bot* ,, opened* this* debugger* C:\Program Files\Debugging Tools for Windows\windbg.exe

atached* to prossess* ET.exe*

thats* about it lol

Code:

*** wait with pending attach
Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path.* * * * * *
* Use .symfix to have the debugger choose a symbol path.* * * * * * * * * *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is: 
ModLoad: 00400000 017dd000* C:\Program Files\Wolfenstein - Enemy Territory\ET.exe
ModLoad: 7c900000 7c9b0000* C:\WINDOWS\system32\ntdll.dll
ModLoad: 7c800000 7c8f4000* C:\WINDOWS\system32\kernel32.dll
ModLoad: 6ce10000 6ce48000* C:\WINDOWS\system32\DINPUT8.dll
ModLoad: 77c10000 77c68000* C:\WINDOWS\system32\msvcrt.dll
ModLoad: 77dd0000 77e6b000* C:\WINDOWS\system32\ADVAPI32.dll
ModLoad: 77e70000 77f01000* C:\WINDOWS\system32\RPCRT4.dll
ModLoad: 77d40000 77dd0000* C:\WINDOWS\system32\USER32.dll
ModLoad: 77f10000 77f57000* C:\WINDOWS\system32\GDI32.dll
ModLoad: 76b40000 76b6d000* C:\WINDOWS\system32\WINMM.dll
ModLoad: 71ad0000 71ad9000* C:\WINDOWS\system32\WSOCK32.dll
ModLoad: 71ab0000 71ac7000* C:\WINDOWS\system32\WS2_32.dll
ModLoad: 71aa0000 71aa8000* C:\WINDOWS\system32\WS2HELP.dll
ModLoad: 76d60000 76d79000* C:\WINDOWS\system32\iphlpapi.dll
ModLoad: 7c9c0000 7d1d5000* C:\WINDOWS\system32\SHELL32.dll
ModLoad: 77f60000 77fd6000* C:\WINDOWS\system32\SHLWAPI.dll
ModLoad: 774e0000 7761d000* C:\WINDOWS\system32\ole32.dll
ModLoad: 773d0000 774d3000* C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll
ModLoad: 5d090000 5d12a000* C:\WINDOWS\system32\comctl32.dll
ModLoad: 10000000 1002f000* C:\Program Files\Microsoft Visual Studio\MyProjects\dthook\Release\dthook.dll
ModLoad: 5ad70000 5ada8000* C:\WINDOWS\system32\uxtheme.dll
ModLoad: 72d20000 72d29000* C:\WINDOWS\system32\wdmaud.drv
ModLoad: 76c30000 76c5e000* C:\WINDOWS\system32\WINTRUST.dll
ModLoad: 77a80000 77b14000* C:\WINDOWS\system32\CRYPT32.dll
ModLoad: 77b20000 77b32000* C:\WINDOWS\system32\MSASN1.dll
ModLoad: 76c90000 76cb8000* C:\WINDOWS\system32\IMAGEHLP.dll
ModLoad: 77fe0000 77ff1000* C:\WINDOWS\system32\Secur32.dll
ModLoad: 5ed00000 5edcc000* C:\WINDOWS\system32\opengl32.dll
ModLoad: 68b20000 68b40000* C:\WINDOWS\system32\GLU32.dll
ModLoad: 73760000 737a9000* C:\WINDOWS\system32\DDRAW.dll
ModLoad: 73bc0000 73bc6000* C:\WINDOWS\system32\DCIMAN32.dll
ModLoad: 72d10000 72d18000* C:\WINDOWS\system32\msacm32.drv
ModLoad: 77be0000 77bf5000* C:\WINDOWS\system32\MSACM32.dll
ModLoad: 69500000 69a76000* C:\WINDOWS\system32\nvoglnt.dll
ModLoad: 77bd0000 77bd7000* C:\WINDOWS\system32\midimap.dll
ModLoad: 76fd0000 7704f000* C:\WINDOWS\system32\CLBCATQ.DLL
ModLoad: 77050000 77115000* C:\WINDOWS\system32\COMRes.dll
ModLoad: 77120000 771ac000* C:\WINDOWS\system32\OLEAUT32.dll
ModLoad: 77c00000 77c08000* C:\WINDOWS\system32\VERSION.dll
ModLoad: 73f10000 73f6c000* C:\WINDOWS\system32\dsound.dll
ModLoad: 73ee0000 73ee4000* C:\WINDOWS\system32\KsUser.dll
ModLoad: 71a50000 71a8f000* C:\WINDOWS\system32\mswsock.dll
ModLoad: 662b0000 66308000* C:\WINDOWS\system32\hnetcfg.dll
ModLoad: 71a90000 71a98000* C:\WINDOWS\System32\wshtcpip.dll
ModLoad: 76f20000 76f47000* C:\WINDOWS\system32\DNSAPI.dll
ModLoad: 76fb0000 76fb8000* C:\WINDOWS\System32\winrnr.dll
ModLoad: 76f60000 76f8c000* C:\WINDOWS\system32\WLDAP32.dll
ModLoad: 76fc0000 76fc6000* C:\WINDOWS\system32\rasadhlp.dll
ModLoad: 0a140000 0a1c1000* C:\Program Files\Wolfenstein - Enemy Territory\pb\pbcl.dll
ModLoad: 03370000 03387000* C:\Program Files\Wolfenstein - Enemy Territory\pb\pbag.dll
ModLoad: 0acf0000 0adb1000* C:\Program Files\Wolfenstein - Enemy Territory\pb\pbsv.dll
ModLoad: 40000000 402ed000* C:\Program Files\Wolfenstein - Enemy Territory\etpub\ui_mp_x86.dll
ModLoad: 30000000 33963000* C:\Program Files\Wolfenstein - Enemy Territory\etpub\cgame_mp_x86.dll
ModLoad: 09920000 09928000* C:\Program Files\VIAudioi\SBADeck\ExtendDll.dll
(cb0.cb4): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000000 ebx=00000004 ecx=000003f1 edx=00000fc4 esi=00000000 edi=0a14bfa0
eip=0a154685 esp=01fd4b4c ebp=01fdfd7c iopl=0* * * * nv up ei pl nz ac po nc
cs=001b* ss=0023* ds=0023* es=0023* fs=003b* gs=0000* * * * * * efl=00010212
*** WARNING: Unable to verify checksum for C:\Program Files\Wolfenstein - Enemy Territory\pb\pbcl.dll
*** ERROR: Symbol file could not be found.* Defaulted to export symbols for C:\Program Files\Wolfenstein - Enemy Territory\pb\pbcl.dll - 
pbcl!ca+0x86e5:
0a154685 f3ab* * * * * * rep stos dword ptr es:[edi]* es:0023:0a14bfa0=6aec8b55

more info as i find it ,,!

That arnt offsets, Ill explain here what these actually are:

Programs* that run under Windows have their own virtual memory space in that process,* this means that for example you can get a value pointed by 0x001 in application X which would be for example "A", and the SAME pointer (0x001) in an other application (Y) which will point for example "B".
Well why does Windows manage the memory on this way ?
- Because its safer: you cannot change by mistake something in an other process.
- Some other reasons too; when an application creates itself it cannot currupt/overwrite already existing memory values that are already usen by other applications.

Windows just grabs all the running processes and calculates the estimated bytes needed + some extra to be safe and tells each process to use that hardware memory values (... dont remember the actual name, was something like phsychik) within a range; like application A: you are allowed to use 0x0000 till 0x9000 (...) .

This is also being done in the actual process for the above reasons (stuff cant overwrite/corrupt stuff)..

ModLoad: 5ed00000 5edcc000* C:\WINDOWS\system32\opengl32.dll
Just means that the process "Enemy Territory" allowes the opengl32.dll to use the virtual memory range from 5ed00000 to 5edcc000.