Windows on cat /dev/snapshot

Setting up a free Microsoft debugging environment on Windows XP

Wed, 27 Jul 2005 07:45:00 +0200

This is a short guide on how to debug applications or dynamic link libraries created by the post free Microsoft C++ compile environment.

The following tools need to be installed:

Microsoft Debug Tools (13MB): c:\msdev\debug
Windows XP with Service Pack 2 symbols (195MB)

Then extend your environment’s LIB path by adding the Visual Studio .NET 2003 lib folder. Visual Studio .NET 2003 was installed during the former .NET SDK installation, unfortunately the path, specified for the .NET SDK is not taken as installation path for Visual Studio but the usual program folder is used instead, in my case C:\Programme\Microsoft Visual Studio .NET 2003. Find out the path’s short name with dir /X and add the following line with your specific path to the setenv.cmd script below the three call statements:

More Reverse Engineering

Wed, 06 Jul 2005 09:26:00 +0200

I did more reverse engineering on the DataRecorder Windows tool that comes with the TFA Klima-Logger hygrometer in order to find out which serial lines are used as input lines.

The evaluation version of IDA Pro Disassembler and Debugger did a great job here. The only thing I had to do was to load the executable DataRecorder.exe into the disassembler and find the places where the Win32 API function GetCommModemStatus gets called. A search for the function name revealed two sub-routines inside the huge pile of Assembler code. Looking at the references to data segment constants it was quite easy to determine which of the two sub-routines was the Assembler version of CI2CDriver::Sda() and which one was the Assembler version of CI2CDriver::Scl(). The first sub-routine was referencing an error message

Intercepting Win32 API system calls

Sun, 03 Jul 2005 01:04:00 +0200

For reverse-engineering the Windows software of the TFA Klima-Logger I tried to analyze the I2C protocol over the serial line by intercepting Win32 API system calls.

Searching with Google about the topic intercept Win32 function I stumbled over the Microsoft Research tool Detours which was exactly what I was looking for. Version 1.5 of the tool is freely available for download and already comes with an example to intercept serial API system calls which served as a starting point for my serial communication interception library.