Dumping images with newer SoftICE versions

For those non experts out there:

If you've ever run into an image that you can't seem to get past anti-debugger measures in Olly; want the unpacking speed offered by SoftICE, but don't have a compatible version for use with IceDump (aka Driver Studio 3.2), the !suspend/!dump functions of IceExt cause errors, or if you're really lazy like I am, and do not want to patch anti-debugging code; IceExt, !protect on ...

Here's a relatively easy technique get a pretty PE to view in IDA using SICE, Process Explorer, PE Tools, and ImpRec.

... Step to your unpacked entrypoint in SICE
... Turn "CODE ON"
... Make note of the first two bytes of the real entrypoint.
... Edit the address in EIP with those two bytes to store them in the command buffer. (EB 401038 55 8B, or whatever the address/bytes are...)
... Assemble "JMP EIP" at EIP. (A EIP, JMP EIP)
... F5 out of SICE
... Use a process management tool like Process Explorer or PsTools to suspend the target.
... CTRL+D back into SICE
... Change contexts back to the target. (addr target_pid)
... Up arrow the command buffer to find the EB command you issued before, and issue it again. (EB 401038 55 8B)
... Make sure everything is proper by viewing the address in the disassembly listing. (U 401038)
... F5 out of SICE and dump/repair imports using Pe Tools and Imprec, or using whatever friendly dumping/repair tools you prefer.


You can always just edit the bytes in your dump after the EBFE step, but for lazy people like me, this is a cleaner faster method not having to calculate rva's to the bytes on disk.

[cjack]

Thank's for your trick bone, very nice ;-)

[NeOXOeN]

this trick has been used for 50 years :P


bye

[deroko]

he only forgot to mention that you should set priority in ProcessExplorer or TaskManager to idle so jmp $ won't kill your CPU