Exetools  

Go Back   Exetools > General > General Discussion

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 04-26-2006, 06:11
bone
 
Posts: n/a
Dumping images with newer SoftICE versions

For those non experts out there:

If you've ever run into an image that you can't seem to get past anti-debugger measures in Olly; want the unpacking speed offered by SoftICE, but don't have a compatible version for use with IceDump (aka Driver Studio 3.2), the !suspend/!dump functions of IceExt cause errors, or if you're really lazy like I am, and do not want to patch anti-debugging code; IceExt, !protect on ...

Here's a relatively easy technique get a pretty PE to view in IDA using SICE, Process Explorer, PE Tools, and ImpRec.

... Step to your unpacked entrypoint in SICE
... Turn "CODE ON"
... Make note of the first two bytes of the real entrypoint.
... Edit the address in EIP with those two bytes to store them in the command buffer. (EB 401038 55 8B, or whatever the address/bytes are...)
... Assemble "JMP EIP" at EIP. (A EIP, JMP EIP)
... F5 out of SICE
... Use a process management tool like Process Explorer or PsTools to suspend the target.
... CTRL+D back into SICE
... Change contexts back to the target. (addr target_pid)
... Up arrow the command buffer to find the EB command you issued before, and issue it again. (EB 401038 55 8B)
... Make sure everything is proper by viewing the address in the disassembly listing. (U 401038)
... F5 out of SICE and dump/repair imports using Pe Tools and Imprec, or using whatever friendly dumping/repair tools you prefer.


You can always just edit the bytes in your dump after the EBFE step, but for lazy people like me, this is a cleaner faster method not having to calculate rva's to the bytes on disk.
Reply With Quote
  #2  
Old 02-18-2007, 03:27
cjack's Avatar
cjack cjack is offline
Family
 
Join Date: Jan 2002
Posts: 139
Rept. Given: 172
Rept. Rcvd 170 Times in 31 Posts
Thanks Given: 268
Thanks Rcvd at 177 Times in 44 Posts
cjack Reputation: 100-199 cjack Reputation: 100-199
Thank's for your trick bone, very nice ;-)
Reply With Quote
  #3  
Old 02-18-2007, 05:11
NeOXOeN NeOXOeN is offline
Friend
 
Join Date: Jan 2005
Posts: 273
Rept. Given: 2
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 2
Thanks Rcvd at 18 Times in 18 Posts
NeOXOeN Reputation: 3
this trick has been used for 50 years :P


bye
Reply With Quote
  #4  
Old 02-20-2007, 03:23
deroko's Avatar
deroko deroko is offline
cr4zyserb
 
Join Date: Nov 2005
Posts: 217
Rept. Given: 13
Rept. Rcvd 30 Times in 14 Posts
Thanks Given: 7
Thanks Rcvd at 32 Times in 15 Posts
deroko Reputation: 30
he only forgot to mention that you should set priority in ProcessExplorer or TaskManager to idle so jmp $ won't kill your CPU
__________________
http://accessroot.com
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Softice not working ... what versions are you using??? yaa General Discussion 5 12-14-2003 05:46
SoftICE Versions Xet General Discussion 14 12-10-2003 09:04
Detailed SoftIce Installation guide for new versions, please aldente General Discussion 3 07-08-2003 04:38


All times are GMT +8. The time now is 01:13.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX
( 1998 - 2021 )