Why SoftICE is crashing with SD2?

Mefeus · #1 27-05-2002, 08:15

Hay there!

A little problem:
If runnin' SoftICE with a Safedisc2-protected game, my comp crashes away (no Messagebox at all). FrogSICE is on, but this won't work enough on SD2 - some told me...

By the way, some exe's r able to crush my W32dasm, when openning them - could this be avoided?

Thanx

ByteMare · #2 28-05-2002, 01:02

It's because SD2 got some really pain-in-the-ass anti-debugging
code, especially against SoftIce....but there are other ways to trick it

Mefeus · #3 28-05-2002, 06:03

Yep, thats, what I thought, as seen my comp crashes down with a little blue touch on screen...

But how to defeat better and make the files run with SI in back?

Newer FrogSICE? - FrogsICE v1.10.beta0 is the last I know.
Newer ICE-Patch? - v2.0 build 2000-02-23 is the last I know here.

R there other "magic values" to change anywhere?

Help me please!
What about the W32dasm - crashes?

Mefeus · #4 28-05-2002, 07:19

Is Imhotep the right Tool to remove such junk or r there other ones for this job?

I guess it would be a damned job, to look for all this topics in a file without a chance to disassemble...

podunkviller · #5 28-05-2002, 07:19

infinite loops are a bad thing to have, arent they?

Mefeus · #6 28-05-2002, 08:50

Look at this page:
hxxp://www.anticrack.de/daemon/

It should take several years, to read (and understand the half) of all that anti-stuff posted there.

So let's try it otherwise:
What is the typical way, to run a SD2-file with SoftICE loaded? (to locate that single problem...)

Anybody knows exactly, how to prevent W32dasm from crushing? If the exe is still shrinked, you see only nothing or shitish code - but why how to prevent from crashing down?

Mefeus · #7 30-05-2002, 01:39

In another forum I have read something about a proggy called MOW.
Does anybody have some experience with it, to smash such anti-disassembling? Is it the tool, I'm looking for?

And I will give ICEDump a chance, my latest version is:
ICEDump V6.021
Is there a newer around?

Thanx all!

DarkSoul · #8 01-06-2002, 07:29

IceDump will not fix your problem. You should only use IcePatch to rename the VxDs and the latest FrogsIce. If your computer still crashes, delete the file idt.bak (or something like that) and play with the FrogsIce settings. Forget the templates... you have to find your own solution. Real good crackers will never show their tricks!

Crackers are like magicans and if you publish your secret tricks you will be banned forever and help copy protection developer to improve their code.

Greetings,
DarkSoul

themis_t · #9 02-06-2002, 13:15

you are right!!

Mefeus · #10 05-06-2002, 01:32

Looking at ICEDump - found a version for SI 4.26.922!

Is there a newer version of SI then 4.05 available? Never have heared about it...
By the way - Look:

ANTI-WDASM trick
mov eax, edx
jmp loc_1
db 0F
loc_1: inc eax
jmp loc_2
db 85
loc_2: call sub_1

Is it possible to crash Wdasm with impossible Assembler-Codes, do they even exist (some combinations of hex-codes, which r not directed to any Assembler-Code)?

themis_t · #11 05-06-2002, 14:19

well,i am not so keen on cracking but where do we get this driver studio?

DeanI · #12 08-06-2002, 05:17

what does driver studio and softice do

bOOls eYe · #13 08-06-2002, 07:37

Yep, Softice rules !!!
Very powerful, stops all Windows activities (even the system clock hangs !), but can be dangerous if you use it in a wrong way... not for newbies.

crispy · #14 08-06-2002, 10:45

Going back to the original post, there are many ways to screw with Softice.
Frogsice is okay but somewhat outdated. It is useful however to log some of an apps methods to defeat sice.
Icedump does a pretty good job at defeating most of them, and if you rename vxds etc with icepatch then at least you have a fighting chance.
There is a good tut around by the main man R!SC which deals with Settlers3 (I think), and how to patch some types of sice detection "on the fly" so to speak. It's a good place to start.
These days many developers are adding heavy anti-debug stuff to prevent reversing of their software, and as mentioned earlier, there are those in the RE scene who keep their methods to themselves. This is not just out of selfishness, but more out of trying to keep the protectionists in the dark about which aspects of their art has been defeated.
In the end it's a rather a waste of time by these guys at Macrovision as cracks/patches appear very quickly after a game is released (and even sometimes before!).
And yes it is a good idea to read, read, and read some more, before installing and messing around with Sice. In the right hands it is extremely powerful, but in inexperienced hands it can cause you problems.

themis_t · #15 09-06-2002, 15:25

yes,but if someone wants to start and learn cracking he will have to download and test many things on softice......