posted 11 years ago
Trying to reverse engineer an application using a debugger, eh? Yeah that can be fun
Usually the way most applications like these are designed is that you have one thread that waits for connections from clients(let's call it connection thread). When it gets a connection, it hands off the connection to another thread(let's call it communication thread) and then goes back to waiting for another connection. The communication thread that will receive the message and handle it. Generally, if it takes time to process the message, and it has to be done in the background, there might be yet another thread (let's call it the worker thread) that the communication thread will hand the message off too. Another populat thing to do is to have thread pools. So, instead of starting and stopping a thread everytimje, the threads might be started as soon the application starts and might wait for messages to come in. In this case, the message is usually stuck in a queue, and the threads are usually waiting for messages to appear in the queue. If this is so, you will see maybe 1 connection thread, couple of communication threads, and lots more worker threads (if you need them) in your debugger. When the threads in the thread pools are idle they will be in waiting state.
Now, this is the usual way of doing things. The way your application is designed might be differrent
Thread dumps are a great reverse engineering tool. Thread dumps tell you what each thread is doing in form of a stack trace. After you send your ISO message, take thread dumps continiously till you get your response. Look at those thread dumps very closely. You might be able to figure out what the app is doing.