!BC - 清除内存区块中所有的断点
!BL - 列出内存区块中所有的断点
!BPR - 中断在内存范围中
!CP - 设定当前代码页(866 or 1251)
!DUMP - dump内存到磁盘
!DUMPSCREEN - dumpSoftICE屏显成RAW格式到磁盘
!INTSAVE - 存储中断句柄
!INTREST - 恢复中断句柄
!INTXCHG - 置换中断句柄
!INTSHOW - 显示内部中断句柄表
!EB -内存补丁patch byte in memory (restores PTE after patching)
!FONT - 设定屏幕字体
!FPOS - 显示文件指针
!LASTBRANCH - 显示最后的MSR分支信息
!LOADFILE - 打开硬盘文件载入到内存镜像
!PROTECT - 开关 SoftICE 自我保护功能
!HELP - 显示帮助
!SUSPEND - 挂起当前执行的线程(仅ring-3线程)
!RESUME - 唤醒被挂起的线程
!TETRIS - 俄罗斯方块
****************************************************************************
!BC - clear break point on range
!BL - list break points on range
!BPR - break point on range
!CP - set current codepage
!DUMP - dump memory to disk
!DUMPSCREEN - dump SoftICE screen to disk
!EB - edit byte in memory
!FONT - set screen font
!FPOS - display file pointer
!INTSAVE - save interrupt handler
!INTREST - restore interrupt handler
!INTXCHG - exchange interrupt handler
!INTSHOW - show internal interrupt handlers table
!HELP - help on specified function
!LASTBRANCH - show MSR last branch information
!LOADFILE - load disk file to memory
!PROTECT - turn protection on/off
!SUSPEND - suspend thread
!RESUME - resume thread
!TETRIS - tetris game
另外
如果不知道具体的使用方式可以使用!help 命令查询
其中还增加了!if ,!idt
关于在ICEEXT的重新编译需要修改
make.bat和source文件
set SAVEDDIR=%CD%
call %BASEDIR%\bin\setenv.bat %BASEDIR% fre wxp
cd /d %SAVEDDIR%
set SAVEDDIR=
del .\objfre_wxp_x86\i386\*.res
build
rem prefast build
rem prefast list
//
TARGETNAME=IceExt
TARGETPATH=obj
TARGETTYPE=MINIPORT
AXP64_FLAGS=/QA21164
INCLUDES=..\inc;..\..\inc
MSC_WARNING_LEVEL=-W4 -WX
MSC_OPTIMIZATION =-0xs
LINKER_FLAGS=/DEF:IceExt.def /MERGE:.rdata=.data
CBSTRING=;
DDKLIBPATH=$(BASEDIR)\LIB\WXP\i386
/*W2K修改为WXP
# *********************************************************************
# remove ntoskrnlnt4.lib if you don't have it
# I'm using old library for NT4 compability
# *********************************************************************
TARGETLIBS=$(DDKLIBPATH)\ntoskrnl.lib $(DDKLIBPATH)\hal.lib ntice.lib .\libmad\msvc++\Release\libmad.lib
/*ntoskrnlnt4.lib 修改为ntoskrnl.lib
SOURCES=ac97.cpp \
calloc.cpp \
bpr.cpp \
fileio.cpp \
seh.cpp \
pci.cpp \
taskswch.cpp \
util.cpp \
softice.cpp \
Search.cpp \
screen.cpp \
siwvid.cpp \
modules.cpp \
main.cpp \
multicpu.cpp \
mp3.cpp \
pgfault.cpp \
process.cpp \
protect.cpp \
pageinprogress.cpp \
tracer.cpp \
activatehook.cpp \
ntoskrnl.cpp \
cp1251.c \
font08x08ru.c \
font08x14ru.c \
font08x16ru.c \
font10x20ru.c \
cmd_cp.cpp \
cmd_pte.cpp \
cmd_bpr.cpp \
cmd_dump.cpp \
cmd_dumpscreen.cpp \
cmd_eb.cpp \
cmd_help.cpp \
cmd_font.cpp \
cmd_fpos.cpp \
cmd_irql.cpp \
cmd_idt.cpp \
cmd_ifx.cpp \
cmd_int.cpp \
cmd_lastbranch.cpp \
cmd_loadfile.cpp \
cmd_protect.cpp \
cmd_sdt.cpp \
cmd_suspend.cpp \
cmd_test.cpp \
cmd_tetris.cpp \
cmd_unhook.cpp \
iceext.rc
DLLDEF=IceExt.def