PDA

View Full Version : Detect IceDump?

stealthFIGHTER
10-13-2001, 11:18 AM
Hi all,

is it possible to detect IceDump? (I mean something like this: CreateFileA('\\.\SICE'). Any VxD?

Thank you
EtErNaL_L0ser
10-13-2001, 02:56 PM
As far as i know Icedump is free of VxD so its impossible to detect....At least I think so
Unregistered
10-13-2001, 05:08 PM
hehe
L4t1g0
10-13-2001, 10:57 PM
Icedump is not vxd free
Check the docs and the source.

y0 y0 /\/\od3st One !!
ThrawN
10-13-2001, 11:32 PM
Icedump IS a vxd pretty much
self loading.
If you look at it you could code a icedump detector simular method to getting the hotkey opcode in the sice vxd. I dont really see the point tho, a cracker is going to see whats going on and fix this easyily

ThrawN
EtErNaL_L0ser
10-14-2001, 04:43 AM
Gotta update my knowledge
stealthFIGHTER
10-14-2001, 03:18 PM
Another (better ) question ... is it possible to detect Soft-Ice, while IceDump is loaded?

Regards

sF
^DAEMON^
10-15-2001, 09:12 AM
f0dder, better go and check out my protector ))
it has got CLEAN icedump detection...

^DAEMON^
EtErNaL_L0ser
10-16-2001, 06:26 AM
The question is where to get it ^Daemon^ ?

^DAEMON^
10-16-2001, 08:54 AM
http://www.woodmann.net/forum/attachment.php?s=&postid=8939

download it there

^DAEMON^
EtErNaL_L0ser
10-16-2001, 11:39 AM
Good work bud btw you r from EVC as R!sc ?
^DAEMON^
10-17-2001, 01:31 AM
na, not from EVC....

DAEMON -> [UG2000/MYTH]
EtErNaL_L0ser
10-17-2001, 06:16 AM
heheh ok thnx for the info