TRW2000 Information

TRW2000 for Windows 9x

TRW2000 is an advanced system-level debugger which runs under Windows 9x. What does "system-level" mean? It means that TRW2000 sits between the Operating System and the your computer's hardware. Because of this, TRW2000 can debug and trace any code that is running under Windows (DOS .COM Programs, DOS .EXEs, DOS protected mode programs, old 16-bit "NE" executables, new 32-bit "PE" executables, and even executables that run at Ring 0 (the Windows Kernel, device drivers, VxDs, etc...) including other system-level debuggers!!!

TRW is constantly being improved and updated, so please visit our website http://www.knlsoft.com to get the latest version of TRW, as well as updated information.

Author:

Liutaotao, P.R.China

Zhunanhao, P.R.China

Introduction

  • TRW2000 is more powerful than SoftICE!
  • Designed based on an open-system, plug-ins support. Users can make plug-ins to add more functions.
  • Dynamically loadable, dynamically unloadable! Run it when you need it. Need not reboot!
  • Automatically displays all 32-bit/and 16-bit export function names.
  • Supports all video adaptors.
  • Write out files instantly!
  • Define symbols instantly!
  • New commands:

    PDLL32, PNEWSEC, TRNEWTCB, TRNEWDOS, PMODULE, SUSPEND
    PEDUMP,MAKEPE

MailList

Mail to trw2000-subscribe@egroups.com to join our maillist.


Usage

  1. When you download TRW2000, is comes packaged as a .ZIP file. Create a directory (ex. "\TRW2000") and unzip the files in the package to that directory. For convenience, you might want to make a shortcut to TRW2000.EXE on either the START menu, the Quick Launch Bar (Win98), or on your desktop. You then simply run TRW2000.EXE. There is no additional installation required and there is no need to restart your computer when you want to use TRW2000.
  2. If your mouse is an Intellimouse , please be sure to put the line "INTELLIMOUSE=ON" in your TRW2000.INI file. (Found in the same directory with TRW2000.EXE)
  3. If you find your mouse isn't working or works erratically, you could try putting the line "WINMOUSE=ON" in TRW2000.ini, but this is not recommended because it may cause TRW2000 to become unstable.
  4. If you want to use the internal graphics driver (which causes TRW2000's output to appear as a window on your desktop), you should have the line "GRAPHICS=ON" to your TRW2000.INI file. Without that line, or with "GRAPHICS=OFF" instead, TRW2000 will open on its own screen. (Note: The default TRW2000.INI file has the GRAPHICS set to ON.)
  5. Put the line "HOTKEY=XXXX" (where XXXX = a scan code) in the INI file to change the default Ring-0 hotkey (Ctrl-M) to a different key (ex. HOTKEY=2004 changes the hotkey to Ctrl-D)
  6. Put the line "R3HOTKEY=XXXX" (where XXXX = a scan code) in the INI file to change the default Ring-3 hotkey (Ctrl-N) to a different key (ex. HOTKEY=250B changes the hotkey to Ctrl-K)
  7. Usually, TRW2000 treat all input number as hex. ? and A command default is dec.
  8. Address, &seg:offset force V86 address, and #seg:offset force protected mode address.


TRW2000 commands

Commands

.

?

A

ADD

ADDR

ADDW

BC

BD

BE

BL

BP

BPE

BPINT3

BPIO

BPM

BPMSG

BPMX

BPX

CLEARDR

CMT

CODE

D

E

EC

 EXP

EXP16

EXP32

FKEY

FILE

FONT

G

GDT

H

HEAP

HBOOT

HELP

HotKey

HWND

IDT

LDT

LINES

MakePE

MOD16

MOD32

NAME

P

 PAGE

PageIn

PDLL32

PEDump

PHYS

PMODULE

PNEWSEC

PRET

PROC

R

RS

S

SRC

SRCLINES

SS

Suspend

SYM

T

TABLE

task

 thread

TRNEWDOS

TRNEWTCB

TRTCB

U

VCALL

VER

VM

VXD

VXDSYM

W

WC

WD

WMSG

WR

WS

X

.
    display current instruction, same as 'U cs:eip'
?
    This is the expression evaluation command. Try your expression in decimal
    first. If that fails, try it in hex.
        ? 123+34
        ? 4d2h+9
        ? esi/4
        ? (3+2)<<1
A [address]
    Assemble code. Only available in register version.
ADD   STACK|DATA|DASM
    create a new stack/data/disassemble window
    ADD STACK
    ADD DATA
    ADD DASM
ADDR
    Display context list.
ADDW [pos] L|R|T|B REG|DATA|DASM
 Add a reg/data/disassembler window in the current CPU window.
 Position is of the form Left|Right|Top|Bottom
 ex:
 ADDW 2 L DATA
 ADDW 2 2 T REG
 ADDW R DASM
BC list|*
    Break point clear
BD list|*
    Break point disable
BE list|*
    Break point enable
BL list|*
    Break point list
BPINT3 address
    Set a break point by inserting an int 3(0xcc) into user code.
BPIO port
    Set a debug register breakpoint on port I/O.
    See also: BreakPoint Overview
BMSG hwnd [msg]
BPMSG hwnd [msg]
    Set a breakpoint on a window message.
    See also:
     WMSG
     BreakPoint Overview
    Ex:
     BMSG 12c wm_destroy
BPM address R
BPM address W
BPM address X
    Sets a hardware breakpoint with DRx.
    See also: BreakPoint Overview
BPMX address
    Sets an executive breakpoint with DRx.
    This is the same as 'BPM address X'
BP [[seg:]address] [if (conditions)]
BPX [[seg:]address] [if (conditions)]
    Set a breakpoint on execute
    TRW will try Debug register first. If that fails, it will insert a
    int3(0xcc) into the user code.

    As a special case, if omit address, with only conditions,
        g if (conditions)
    TRW2000 will run the program step by step, check the condition for
    each step.
        g if ((byte)*eip==c3&&eip<402000)
    See also:
        BreakPoint Overview BPMX
        BPINT3
D [address]
D range >filename
    Perform a memory dump to the data window, or save a memory dump to file.
         d 401000
         d cs:402000
         d 401000,402000 >myfile
         d 401000 L 100 >myfile
E [address [partern]]
    Edit memory
    E ds:edi 'nothing',0
EC
    focus to code window or command window. Usually define as hotkey F6 .
EXP !
Exp module-name!
Exp partial_export_name
    Display all matching exported API calls.
    Searches all of the exported API function names in all referenced modules.
     EXP !
     Exp kernel32!
     Exp *
     Exp Get*
     Exp *window*
FILE [source-filename]
     Select/Display source file
FKEY [function-key strings]
     Display/Set Function keys
     ex:
     FKEY
     FKEY f10 "d 2;U 3;"
FONT 1|2
    select TRW2000 graphics display font.
G
 Run.
 G address ;run to address, same as 'gox address'
 G if conditions ;run with conditions
H [command]
HELP [command]
 Display help for all commands, or the referenced command in detail.
HOTKEY
 Display current hot keys, and allow you press a new key to display.
 See also:
 Hot Keys
HWND [HWND]
 Display window handle information.
PageIn <address>
 Load the not present page to memory.
 PageIn cs:401000
LINES [25 | 43 | 50 | 60]
 Set/Display screen lines
 ex: lines 43
 See also:
 Ini file
MOD16 [hmod|mod_name]
 Display 16bit module list,
 or display detail info for specified module.
 Usage:
 MOD16
 MOD16 1cf
 MOD16 KERNEL
 MOD16 . ;for current module
PDLL32
 Run until 32bit DLL entrypoint.
 Usage:
 PDLL32 mydll32.dll
PEDUMP
 Dump PE image memory direct to file 'DUMP1.EXE'.
 You can use G_Rom's MakePE to rebuild a valid PE.
BP if condition
 Set a breakpoint on a condition
 bp if (eax>=3456787)
 bp if (dx<543)
 bp if (ch==23)
 go if (ah!=34)
PNEWSEC
 Go until entering a new section in PE image
PMODULE
 'pret' until CS:EIP in the module.
PRET
 Run until RET,RETF,IRET.
 shortcut key: F12
RS
 View User Screen. (F4).
S
 Search in memory
 S 0 L -1 'window'
 S 100,200 'bug12',34
SRC
 Toggle source mode, can be Source|Mixed|Code
SUSPEND
 Suspend current thread, and leave TRW2000. Hot keys to back.
SYM
 List all debug symbols
TABLE [table name]
 Select/Display a symbol table
TRNEWDOS
 Catch next DOS program.
TRNEWTCB
    Catch next new thread at the first opcode.
    Supports 32-bit and 16-bit apps.
    Note: Do not run a Windows app from a DOS command prompt, or TRW2000 will
    catch START.EXE.
TRTCB <thread_handle>
 Trace a existing thread
U [address]
U range >filename
 Disassemble in Code Window, or save disassembly output to a file.
 u 401000
 u cs:402000
 u 401000,402000 >myfile
 u 401000 L 100 >myfile
VCALL
 Usage:
 Vcall * -display all VxD calls
 Vcall num -if num<10000h, diaplay all VxDid calls
 -if num>10000h, diaplay the VxD call
 Vcall partial-name
 Ex:
 Vcall 0d
 Vcall 100001
 Vcall *sys*
W range filename
 Write memory to file
 w ds:401000,402000 myfile
 w 401000 L 100 c:\myfile.bin
WC [codewindow_lines]
 Set the length, in lines, of the code window. No parameter will turn it on/off.
 ex:
 wc 25
 wc
WD [datawindow_lines]
 Set the length, in lines, of the data window. No parameter will turn it on/off.
 ex:
 wd 25
 wd
WMSG - Display windows messages
 usage:
 WMSG [partial-name] [WMSG-number]
 Ex:
 WMSG 12
 WMSG wm_destroy


cmd: makepe

command: MAKEPE

syntax: MAKEPE filename [imte]

Make a valid PE file from program's memory image. Current EIP will be entrypoint of new PE.

For DLL, you must specify its imte. Command 'mod32 dllname' will show its imte.

Only available in register version.

ex:

MAKEPE d:\new.exe
MAKEPE d:\newpe.exe c1234567

see also:

PEDUMP


cmd: mod32

command: MOD32

syntax: MOD32 [.|hmod|mod_name]

Display 32bit module list, or display detail info for specified module.

ex:

MOD32
MOD32 .
MOD32 e7f
MOD32 kernel32

see also:

MOD
MOD16


cmd: proc

command: PROC

syntax: PROC

Display process list.

output:

:proc
Process  pProcess ID       Threads Context
-------- -------- -------- ------- --------
   Trw2k 81641D9C FFFB0415       1 C8070F70
Iexplore 81638644 FFFC9FCD       4 C80EA130
WINOLDAP 81636FE0 FFFC7669       1 C17D9E80
 Spool32 8162C990 FFFDD019       2 C80711A0
KERNEL32 81702204 FFEF3B8D       8 C151CEA0
     Mdm 8161B708 FFFEAE81       2 C17E4DC0
     Osa 81615458 FFFE4DD1       1 C17DC0D0
  RUNDLL 816239D8 FFFD2051       1 C807C010
Internat 8161A9A4 FFFEB02D       1 C17D5140
 Systray 81616B5C FFFE72D5       1 C17C1E10
 Taskmon 81616080 FFFE7909       1 C17B9790
Explorer 8160E6A0 FFFFFF29       4 C153FCC0
  Mstask 8160D390 FFFFCA19       2 C152C9E0
  Mprexe 8160720C FFFF6B85       1 C15274F0
MSGSRV32 8160603C FFFF79B5       1 C1442F90


cmd: task

command: TASK

syntax: TASK

Display task list.

output:

:task
W16TDB  TaskName  THCB     Ring0TCB TDBX
------  --------  -------- -------- --------
 39E6   Trw2k     81643454 C8095D30 C8092650
 3EAE   WINOLDAP  816371E4 C80BC9F0 C17DC9E0
 0FCE   Spool32   8162CB7C C152A970 C8081730
 00CF   KERNEL32  817022DC C29202B0 C1415CF0
 2FCE   Mdm       8161B930 C17E4EF0 C17DEE40
 2A16   Osa       81625884 C17DC290 C17DC170
 2E56   RUNDLL    8161FD80 C807C1D0 C807C0A0
 305E   Internat  8161ABA0 C17D5320 C17D51F0
 21DE   Systray   81616D00 C17C1BC0 C17C1EC0
 226E   Taskmon   81616294 C17B9970 C17B9840
 2466   Explorer  8160E8B0 C153FEA0 C153FD70
 265E   Mstask    8160D5A8 C152AE60 C152A150
 1D8E   Mprexe    81607434 C1528AB0 C1526C40
 1FC6   MSGSRV32  8160620C C144B0A0 C14D1390


cmd: thread

command: THREAD

usage: THREAD [.|hTCB]

display thread list.

ex:

THREAD
THREAD . ;indicate current thread
THREAD c1547690

output:

:thread
Ring0TCB  ID  Context  Ring3TCB ThreadID Process  TaskDB PDB  SZ  Owner
c1574d40   7f c1574b60 81641d88 fffb069b 81641b68 1BEE   1BE7 32 *Trw2k
c152cbb0   2a c152ca60 8162a678 fffdbd6b 8160fee0 2CAE   2C7F 16 *WINOLDAP
c1547690   21 c1548cc0 81623a94 fffd2187 8162383c 307E   3077 16 *RUNDLL
c15245b0    8 c1431fc0 8160b2b4 ffffa9a7 81709204 00C7   00D7 32  KERNEL32
c14167d0    2
c29202b0    1 c1431fc0 817092dc ffef89cf 81709204 00C7   00D7 32  VM 1
c65202b0   2b                                                     VM 2

:thread c1547690
Ring0TCB  ID  Context  Ring3TCB ThreadID Process  TaskDB PDB  SZ  Owner
c1547690   21 c1548cc0 81623a94 fffd2187 8162383c 307E   3077 16 *RUNDLL
Thread Flag = 00511401
              00000001 ????
              00000400 THFLAG_THREAD_BLOCKED
              00001000 ????
              00010000 THFLAG_OEM
              00100000 ????
              00400000 ????
ClientPtr   = C5BF3F70
TDBX        = C1548DD0


Bug Report

If you have any problem using TRW2000, please report to us:

TRW2000 version:
The problem occurs when:
If you selected "I run some command in the debug window", please tell us what command caused the problem:
Please tell us the details of the problem:
Please tell us your display adapter type, your Windows version, etc...


Debug Symbol

Debug Symbols:

TRW2000 will automatically load any *.SYM file that it finds in its directory. You can also load a new .SYM file with the 'LOAD' button on the TRW main window. If the .SYM file contains line number information, TRW2000 will try to load the source files. Use Microsoft MAPSYM 6.0 to make .SYM files.

After you download DBGLOAD plug-in and install, TRW2000 will support COFF debug information in PE files.

See also:

commands TABLE,FILE,SRC,SYM


Screen Layout

You can drag a file, or a icon to TRW2000 window.

The Code Window

In the code window,

  • Press <F9> to set a breakpoint at the current opcode. This is the same as

BPX cs:eip

  • Press <F7> to run to the current opcode. This is the same as

GOX cs:eip

  • Ctrl+Z zoom code window


What's New

1999.12,25 First release version (1.00)
2000. 1.19 1.05
2000. 4.26 1.20
2000. 5.23 1.22

fix some bugs:

  • [ebp-4] data error

  • ps2 mouse drag bug

  • DOS address bug

Change help to .chm format.


Some Tests

Test 1: Debug a DOS Protected Mode App Using Conditional Commands

1.Run TRW2000.
2.Begin a dos window under Win9x.
3.Select 'trnewdos' from TRW2000's menu.
4.Run PMODE.EXE at the DOS command prompt.
5.Switch back to TRW2000, and you will find you are at the beginning of the DOS program.
Now you have 2 choices:
choice 1,
g 342
t
g 342
Press <F8> a few times and you'll see the program enter 16bit protected mode!
g 4dd
press <F8> a few more times, and now you'll see the program enter 32bit protected mode!
choice 2, use TRW2000's powerful conditional commands
g if cs<100 ;this will run to PM16!
g if cs!=cs ;this will try to run to PM32
g if cs!=cs ;do this again, and we are in PM32

Test 2: The "pmodule" command.

1.Run the program NOTEPAD.EXE
2.From the menu, select "Help" and then "About Notepad"
3.When the "About" dialog displays, run TRW-2000.
4.Press the Ring-3 hotkey (Ctrl-N) to activate TRW2000.
We now have 2 choices:
Using the "hwnd" list:
From the hwnd list (use the command "hwnd"), find the window handle
by '(Dialog)'. Set a message breakpoint on the window to catch
when it is destroyed ("bpmsg <the_hwnd> wm_destroy")
Type the command "bl" to see our breakpoint list.
Type "g" to continue execution.
In NOTEPAD, press "OK", this will re-activate TRW2000 at the point
that the dialog received the WM_DESTROY message.
press F12 ("pret") several times, and we will finally find the point
where this dialog box was called by
shell32.dll	call [DialogBoxParamA]
notepad.exe	call [ShellAboutA]
Or, using the powerful "pmodule" command:
run "pmodule" command and it will skip ahead until we're back to the
notepad.exe module, after the
    call [ShellAboutA]

Test3: The Ring 3 hotkey (Ctrl-N) and the command "SUSPEND"

  1. Run TRW2000.
  2. Run NOTEPAD.EXE.
  3. Press the Ring 3 hotkey (Ctrl-N) to activate TRW2000.
  4. Give TRW2000 the command "PMODULE" (run until finding a RET to module code).
  5. When TRW returns, we break in NOTEPAD.EXE's address context!
  6. Give TRW the command 'SUSPEND' and we'll return back to Windows, where you'll find that NOTEPAD is suspended!!!
  7. Now, you can do anything in Windows you need to do (read .doc files, run another program, etc...) except something that would cause NOTEPAD.EXE to close.
  8. Press Ctrl-N again, and you'll return to debugging NOTEPAD, right where you left off.

Test4: Catch a new thread

  1. Select 'trnewtcb' in TRW2000's menu.
  2. Now, you can run any 32-bit , or 16-bit app and TRW2000 will catch the new thread at the first opcode.

Test5: Finding out how a program operates.

Let's say I'm writing a new program. When I right click on my program's icon in the system tray, I want it to show a popup menu (like TRW2000 does), but I'm not sure how to do it.

So I run TRW2000, right click on a user icon in system tray, and when its popup menu displays, I hit Ctrl-N to activate TRW. I then give TRW the command "pmodule" (which tells TRW to step through the program until it encounters a RET to module code). Then, I use the TRW command "X" to return to Windows from TRW. Next, I just click anywhere to make the user popup menu close. TRW2000 pops back up and tells me that it just returned from the system call "TrackPopupMenu".


Break Point

BreakPoint Overview

For almost all breakpoints, the setting command takes the format:

BP?? <parameters> [IF ( conditions )] [DO " statement "]

and the first 2 character 'BP' can be replaced with 'GO':

GO?? <parameters> [IF ( conditions )] [DO " statement "]

to set a single instance breakpoint. TRW2000 will set the breakpoint, go, and clear it after the break.

conditions:

Conditions must be enclosed in (). The condition support

Operator      Meaning

==            Logical Equal
!=            Logical Not equal
>             Logical Greater than
>=            Logical Greater than or equal to
<             Logical Less than
<=            Logical Less than or equal to

&             Bit and
|             Bit or
^             Bit xor

>>            Bit shift right
<<            Bit shift left

    ;not support !   Logical NOT
&&            Logical AND
||            Logical OR

+             add
-             sub
*             mul
/             division
%             mod

()            parenthesis

(byte)
(word)
(dword)
*             get value from point
+             positive
-             negative
Ex:
g if ((byte)*eip==c2)
g if (*esp==ebx)
go if (eip>401000&&eip<<10000000)
For unregister version, the condition expression can not be very long.

Do statement:

The <statement> can be any valid TRW2000 command. It must enclosed in quotation marks.

Ex:

BPX cs:401000 if (eax>200) do "d eax"
GOX 401000 if (cs!=28) do "d ss:esp"
G if (eip<1000)

soft break point

TRW2000 support soft breakpoint like

g if (conditions)
go if (conditions)
bp if (conditions)

that is, breakpoint without address, with only conditions. If you set a this kind of breakpoint and run, TRW2000 will run the program step by step, and check the condition for each step.


Hot Key

Hotkeys

1.Ctrl-M

This is TRW2000's Ring-0 hotkey. It will break Win95 immediately, wherever it is currently executing code. More often than not, it will drop you into the middle of kernel routines.
Note: This is the same as Soft-ICE's hotkey Ctrl-D.

2.Ctrl-N

This is TRW2000's Ring-3 hotkey.

Most of the time, we needn't break at Ring-0 because we're not interested in stopping code execution in the middle of a routine (ie. the Window's kernel) running at Ring-0. <Ctrl-N> will break the foreground task (usually the active window) in ring3. This is most often the point that we really need.

If Ctrl-N is pressed while you're in a Win95 DOS window, TRW will break the current running DOS or DPMI program.

If Ctrl-N is pressed in full-screen DOS, nothing will happen.
If you press Ctrl-N and nothing happens, try pressing any key or moving the mouse. to see if anything happens

See also:

Command HotKey


Ini File

TRW2000.ini must be in the same directory with TRW2000.EXE.

This is a sample:

; TRW2000 Initialize file

; Please modify it as your habit .

;PLUGS=C:\MY_PLUGS\HELLO.SYS

F1=^HELP ; Command length CAN'T be longer than 15 characters !
 ; This command length is 5 charcaters .
F3=^SRC
F4=^RS
F5=^X
F6=^EC
F7=^HERE
F8=^T
F9=^BPX
F10=^P
F12=^PRET

;HOTKEY=320D ;Ctrl+M
;R3HOTKEY=310E ;Ctrl-N

GRAPHICS=ON
;INTELLIMOUSE=OFF
WINMOUSE=ON

LINES=50 ;in dec


Register TRW2000

Why register ?

  • not all commands / functions available in unregister version.
  • more technical support.

How to Register ?

Please visit http://www.knlsoft.com

Online register support.