debugging longman dictionary

[Laurent Pinchart]

On Monday 25 March 2002 07:31, Eric Pouech wrote:
> > I'd try to implement support for that in wine, but I don't know where to
> > look... I basically need to be able to read/write the interrupt vector
> > table (for int 0x00 here), AND to execute the modified interrupt vector
> > when a division by 0 is executed. Any idea ?
>
> I'm not sure we're really want to inject this type of support in the
> wine tree (very specific, bound to old windows architecture...)
> (this holds true for the DR? support patch)
>
> what I'd do is:
> - simulate (as for DR?) the IDTR read/write (memory/instr)
> - provide our own interrupt table
> - then hook the signal catches to this table (dlls/ntdll/
> - in your case, especially the divide by 0 signal to entry 1 of this
> table
>
> however, I don't think this is the best way to go. It will add lots of
> code to Wine (mainly i386 virtualization), and let programs modify
> things
> they shouldn't normally need to touch.
>
> I'd rather try to test with the NT mode, which shouldn't toy with all
> those parts

I agree with you. I tried NT mode, but unfortunately I'm not sucessful here 
either.

I ran into 3 problems:
1 - NtQueryInformationProcess
2 - int 0x01
3 - Secdrv.vxd

1 - NtQueryInformationProcess is a stub, except when called with 
ProcessInformationClass set to ProcessDebugPort, which is exactly what the 
copy protection does :-), so this is not really a problem. BTW, I found this 
link on the MSDN website while searching for some doc about 
NtQueryInformationProcess

http://msdn.microsoft.com/msdn-files/026/002/137/NTDLL/Source 
Files/ntdll_cpp.asp

Unfortunately the server returns an error, but it might be worth 
investigating :-)

2 - int 0x01 is called from within a try{} block (if I read the assembly code 
correctly), and the copy protection code seems to be looking for a side 
effect: the debugger detection returns false (no debugger present) if some 
memory location (0x00435b90), which has been initialized with the value -1, 
contains 0xc0000005 upon completion of int 0x01. Does this ring a bell to 
someone ?

3 - fixme:win32:DEVICE_Open Unknown/unsupported VxD Secdrv. Try --winver nt40 
or win31 !
I haven't been ablt to find any Secdrv.vxd, but there's a secdrv.sys on the 
CD... Should I disassembly it and add the code to wine ? :-)

Laurent Pinchart