Reversing : The Hacker's Guide to Reverse Engineering

(ff) #1
Other than stability issues, there are also functional disadvantages to the
local debugging approach. The best example is the code that SoftICE uses for
showing its window—any code that accesses the screen is difficult to step
through in SoftICE because it tries to draw to the screen, while SoftICE is
showing its debugging window.

NOTEMany people wonder about SoftICE’s name, and it is actually quite
interesting. ICE stands for in circuit emulator, which is a popular tool for
performing extremely low-level debugging. The idea is to replace the system’s
CPU with an emulator that acts just like the real CPU and is capable of running
software, except that it can be debugged at the hardware level. This means that
the processor can be stopped and that its state can be observed at any time.
SoftICE stands for a Software ICE, which implies that SoftICE is like a software
implementation of an in circuit emulator.

Figure 4.9 shows what SoftICE looks like when it is opened. The original
Windows screen stays in the background, and the SoftICE window is opened
in the center of the screen. It is easy to notice that the SoftICE window has no
border and is completely detached from the Windows windowing system.

Figure 4.9 NuMega SoftICE running on a Windows 2000 system.

126 Chapter 4

Free download pdf