Go Back   Exetools > General > General Discussion


Thread Tools Display Modes
Old 04-26-2006, 06:11
Posts: n/a
Dumping images with newer SoftICE versions

For those non experts out there:

If you've ever run into an image that you can't seem to get past anti-debugger measures in Olly; want the unpacking speed offered by SoftICE, but don't have a compatible version for use with IceDump (aka Driver Studio 3.2), the !suspend/!dump functions of IceExt cause errors, or if you're really lazy like I am, and do not want to patch anti-debugging code; IceExt, !protect on ...

Here's a relatively easy technique get a pretty PE to view in IDA using SICE, Process Explorer, PE Tools, and ImpRec.

... Step to your unpacked entrypoint in SICE
... Turn "CODE ON"
... Make note of the first two bytes of the real entrypoint.
... Edit the address in EIP with those two bytes to store them in the command buffer. (EB 401038 55 8B, or whatever the address/bytes are...)
... Assemble "JMP EIP" at EIP. (A EIP, JMP EIP)
... F5 out of SICE
... Use a process management tool like Process Explorer or PsTools to suspend the target.
... CTRL+D back into SICE
... Change contexts back to the target. (addr target_pid)
... Up arrow the command buffer to find the EB command you issued before, and issue it again. (EB 401038 55 8B)
... Make sure everything is proper by viewing the address in the disassembly listing. (U 401038)
... F5 out of SICE and dump/repair imports using Pe Tools and Imprec, or using whatever friendly dumping/repair tools you prefer.

You can always just edit the bytes in your dump after the EBFE step, but for lazy people like me, this is a cleaner faster method not having to calculate rva's to the bytes on disk.
Reply With Quote
Old 02-18-2007, 03:27
cjack's Avatar
cjack cjack is offline
Join Date: Jan 2002
Posts: 139
Rept. Given: 172
Rept. Rcvd 170 Times in 31 Posts
Thanks Given: 268
Thanks Rcvd at 177 Times in 44 Posts
cjack Reputation: 100-199 cjack Reputation: 100-199
Thank's for your trick bone, very nice ;-)
Reply With Quote
Old 02-18-2007, 05:11
NeOXOeN NeOXOeN is offline
Join Date: Jan 2005
Posts: 273
Rept. Given: 2
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 2
Thanks Rcvd at 18 Times in 18 Posts
NeOXOeN Reputation: 3
this trick has been used for 50 years :P

Reply With Quote
Old 02-20-2007, 03:23
deroko's Avatar
deroko deroko is offline
Join Date: Nov 2005
Posts: 217
Rept. Given: 13
Rept. Rcvd 30 Times in 14 Posts
Thanks Given: 7
Thanks Rcvd at 32 Times in 15 Posts
deroko Reputation: 30
he only forgot to mention that you should set priority in ProcessExplorer or TaskManager to idle so jmp $ won't kill your CPU
Reply With Quote

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
Softice not working ... what versions are you using??? yaa General Discussion 5 12-14-2003 05:46
SoftICE Versions Xet General Discussion 14 12-10-2003 09:04
Detailed SoftIce Installation guide for new versions, please aldente General Discussion 3 07-08-2003 04:38

All times are GMT +8. The time now is 01:13.

Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX
( 1998 - 2021 )