|
WebApp Sec
mailing list archives
Detecting SoftICE ?
From: Bruce Klein <bruce.klein () iovation com>
Date: 10 May 2005 00:11:12 -0000
Hello all,
I am writing a Win32 DLL and am currently trying to detect if SoftICE is present.
I am trying the "classic" detection methods and for my version of SoftICE (4.3.2) under Windows XP, so far no method
has succeeded at detecting it.
The methods I am trying are well described in Viega & Messier's "Secure Programming Cookbook" and all over the net.
One is the "Meltice" technique that looks for a virtual device named "\.\\NTICE"; the other uses the "Boundschecker"
method that uses int 3, with "BCHK"
in a register.
I am having no luck with either method. Perhaps because the methods are obsolete with the current version of SoftICE.
Perhaps because I'm doing something stupid.
Given the above, I have two questions I'm hoping someone can answer:
- Does anyone know a method to detect today's SoftICE?
- Do the other methods even work (and for what versions)?
I'd be happy to post the small source or answer any further questions.
Thanks in advance.
By Date
By Thread
Current thread:
- Detecting SoftICE ? Bruce Klein (May 11)
|