Debuggers

Debuggers

SoftICE 4.01 by NuMega Corp.Updated: 23.XI.1999. Win 9x version: Mirror1. Mirror2. Mirror3. Win NT version: Mirror1. Mirror2. Mirror3. ATI Macxw4.vxd driver fix by HaCkEr^Uk. News: - Event viewing for BoundsChecker events (EVENT command) - Windows 2000 (NT 5.0) Beta 3 support - Remote SoftICE via IP Network Connection - Pentium III opcode support - Support for FPO data and an improved STACK command - Stack Window (WS command) - New Informational Commands - Numerous bug fixes SoftICE, the Advanced Windows Debugger, is the only "all purpose" debugger for C/C++, ASM programmers developing for Windows NT and Windows 95/98. Solving complex Windows problems requires a deeper view into Windows internals. Unlike conventional SDK/DDK tools, only SoftICE gives the absolute system-wide control and visibility programmers need to fix tough software application/system-level problems. With SoftICE, programmers can view, explore or debug any EXE, DLL, device driver or system component with powerful, reliable, source/kernel-mode debugging on a single PC.

TR for Win95 v0.75 by LiuTaoTao. Updated: 02.VIII.1999. News: - added command PDLL32. TR for Win95(TRW) is a debugger running in Win95. TRW can trace DOS COM,DOS EXE,DOS protect mode app,16bit NE,32bit PE applications, and trace ring 0 kernel VxD. TRW run in Win95, OSR2, Win98.

Cool Debugger 1.2 by Wei Bao. Updated: 08.IX.1999. Unassembly upto MMX/P6 opcode. Assembly upto Pentium opcode(without FPU opcode). Hook all imported functions (like system dll call) that are called APIs. All hooked APIs are counted when called. MultiThread enabled. Emulation - Automatic trace through the debugee until a breakpoint is met. Log the API call history. When a value is needed, an expression can be used. (like eax + ebx, [ecx + 3] + ebx). Delphi 3.0 object structure recognizing(only for registered user).

SoftICE tools

FrogsICE v0.43 (80K) by Frog's Print+. Updated: 29.XI.1999. News:  -Improved anti-MeltICE routine to fool programs checking against modifications (PC Guard...). FrogsICE is a VxD (Virtual device driver for Windows, just like a good old TSR for DOS). It allows you to intercept programs (exe or COM, DOS/Win16 or Win32) which would try to detect if SoftICE is loaded. It is particularly useful for packed/encrypted programs.

SoftICE Backdoor Keeper (5K) by Execution. Updated: 07.XII.1999. FrogsICE is able to defend almost all Anti-SI tricks and hide Soft Ice (big thx to +Frogs's Print for that tool!). Just 2 well known ways still exist: the BoundsChecker interface and 'Soft Ice's Backdoor Commands'. Both are executed by Int 03 that can't be hooked when SoftIce is in memory :( and FrogsICE can't detect them. This tool modify WinIce.ExE and switch the BoundsChecker Interface and 'Back Door Commands' off. The progy create a backup of the original WinIce.ExE to WinIce.ExE.org. It should work with all SI-Version (tested on v4.01).

IcePatch (222K) by Lordbyte and The Owl. Updated: 26.V.1999. With the ever increasing number of programs that employ some form of winice detection it is our hope to provide you with at least a basic protection against these methods. Do not expect too much from this little tool as there are really countless ways of both detecting and crashing winice...

IceDump5 (219K) by the owl. Updated: 03.X.1999. Dumper for Softice for Win9x. - nticedump included for the first time, only dumping is supported. - Implemented as an internal Winice/NTice command (PAGEIN). - Subcommands: dump memory to file, load file into memory, dump via Bhrama/Procdump, dump winice screen to file (ascii/html), suspend/resume thread/process, set page table entry flags, change FPU registers, dynamic update of PAGEIN patch, start/stop playing tracks on CD, print usage info ;-) - Simple anti debugger detection code: - Int1/Int3/Int4/Int5 IDT entries will be changed so that simple offset compares would no longer detect winice. - Parser accepts expressions whereever possible. - Supports V86, ring-3/16, ring-3/32 and ring-0/32 protected mode clients whenever possible. - No restrictions for size of memory block and path/name of dump file. - Fool-proof internal parser and dumper (but do RTFM ;-). - Sources are included, now you can even modify them to your liking.

SuperBPM (2K) by EliCZ. Updated: 26.V.1999. Sometimes your breakpoints can be (BPM, BPIO -h, G, HERE, P, P RET) ignored. With SuperBPM everything is all super, zuprgut.

NTDump 1.03 (13K) by EliCZ. Updated: 26.V.1999. Dumper for SoftICE NT.

VA2FO 1.01 (6K) by Iczelion. Updated 18.III.1999. This is a utility from PC Coding Division. Written entirely in win32asm. It's a handy little utility that you can use to convert virtual addresses seen under SoftICE into file offset that you can use in hex editors. You can specify two modes: Virtual Address or RVA.

Interrupter 1.0 (6K) by LaZaRuS. Updated: 10.XII.1999. SoftICE loader doesn't work with certain packed files. This litle program puts CC (which is the opcode for Int03) at the entry point of all PE files. Now you can set a breakpoint "bpint 03" and your problem is solved.