Daemon Kernel Debugger issue

[TippeX]

its simple, dont use your kernel debugger (presumably softice) if you want to use daemon tools 4.x (or higher) or alcohol 120% 1.9.5.x or alcohol 52% (latest) as they all use the sptd interface, which has anti debug built into it and doesn't like kernel debuggers..

if you want to use a kernel debugger and play games from mounted images, then use daemon 3.47, its WELL documented on their forums.

secondly dont try and preach about starforce here, most people here are well aware of it.. and starforce also does not like kernel debuggers either..

so your statements somewhat contradict each other..

[Grumpy]

its simple, dont use your kernel debugger

Hehehe, ive been using Daemon 3.47 since it was released and since I only use it to keep my Battlefield 2 Mini Image permantly mounted I have never had the need to install the newer versions.
I did however realize about the newer versions not likeing Softice etc when I installed Daemon 4.03 on my sons computer, only tonight, so he too can have the BF2 mini image permantly mounted.

So yes after realizing this I guess 'misterious75' problems wont be so hard to fix after all.

Also I failed to see where he was preaching about Starforce, or have I missed somthing?

[TippeX]

starforce preach was ur post.. soz grumpy , but yeh..

if you want to use a kernel debugger (windbg in kernel mode, softice, syser? etc..) then you simply cant use alc/daemon tools latest versions (due to a 'conflict' from sptd.sys.. not really a conflict.. just the sptd coders dont want you to see what they're doing.. although their anti debug is 'bypassable' if you know what you're doing)..

ring 3 (ie not driver based) debuggers like olly etc can be used (though they do have a little anti-debug in the daemon tools / alc exe program... and a vm)

[Grumpy]

@TippeX

starforce preach was ur post.. soz grumpy , but yeh..

Did you not realize it was me or something?? Have you been on the Amber Fluids again?
I am still confused that you thought I was preaching starforce.

But you did say 'most' people are aware of it, that doesnt mean all. And I am aware of most people here.

[ByteMare]

Basically, SF is shit and everybody knows it..their latest move to "kill" DT is more lame...why improve a protection that everybody hates? Like the costumer wanted "improvements"...

Release
crappy game
protection issues
consumer pissed off
excuses
bla bla
more bla bla
patch
fix
excuses
consumer pissed 2 the max
bla bla
protection removed

weee,,,,

[TippeX]

you forgot 'issues when service packs of operating systems were released, which rendered the game unplayable until the sf people released patches' and 'system stability compromised'

[misterious75]

The problem is that Daemon tools, i won't reinstall it.
Now when i was playing The Guild 2 1.0 version i used the image mounted on Daemon 3.47 and everything was ok. Then i upgraded to 1.16 version because lots of bugs denied my enjoy. Tried to use Starforce 7.26 and mounting the image on Daemon 3.47 but i can't play, protection detected (i presume)

Can anyone tell me how to deactivate the bastard kernel debugger or solve this Starforce issue?

Originally Posted by TippeX

its simple, dont use your kernel debugger (presumably softice) if you want to use daemon tools 4.x (or higher) or alcohol 120% 1.9.5.x or alcohol 52% (latest) as they all use the sptd interface, which has anti debug built into it and doesn't like kernel debuggers..

if you want to use a kernel debugger and play games from mounted images, then use daemon 3.47, its WELL documented on their forums.

secondly dont try and preach about starforce here, most people here are well aware of it.. and starforce also does not like kernel debuggers either..

so your statements somewhat contradict each other..

[Grumpy]

Your problem really doesnt belong to these forums!
Ive noticed you have posted on the Daemon Tools forums, and that is where you should be posting.

@TippeX
Looking at all the posts on the Daemon tools forums about SPDT and Kernel Debuggers makes me believe this problem couldnt be 'just' from programs like Softice etc? There seems to be more to it than that?

[TippeX]

totally more to it.. its prevention to stop people reversing their code, 'rootkit' technology kinda.. mark thingie from sysinternals did a report on it.. on the old dt.. now 4.06 is doing a LOT more than it did before.. it filters a lot more data than it 'should' do..

[Muji-FightR]

I'm not totally sure what is being discussed here, SF, Daemon, kernel mode Dbgers ala TRW or Syser (erm lol), SICE whatever

However, I've always had problems getting SICE to run x(
This might be a possible solution for my problem but atm I'm so used to working with ODbg, it doesnt matter anymore switching to SICE...
Development stopped so why bother, I'll just wait for Olly2, hopefully it will come (will it ?), by the time it will come I will not yet be reversing games tho

[TippeX]

yeh but will olly2 be able to debug ring 0... thats the main question... softice is damned handy for seeing 'below the hood' in that respect

and for softice you sometimes need to have to get the osinfo.dat file from the compuware site etc.. and configure some things, once you have it working then you'll need to modify it a little so its 'hidden'

trw is a bit outdated now isn't it.. syser i found pretty decent.. like softice with lipstick (cuter interface)

[Muji-FightR]

I know this is rather annoying for you I guess but would you mind sending me a few links to sites or patches for hiding SICE properly, I'm not the king at such stuff.
It was hard enough for me to get Olly half way hidden from RLP, Execryptor still won't run...
Would be very kewl of you, however, there's no need