PDA

View Full Version : Detect IceDump?

stealthFIGHTER
October 13th, 2001, 11:18
Hi all,

is it possible to detect IceDump? (I mean something like this: CreateFileA('\\.\SICE'). Any VxD?

Thank you
EtErNaL_L0ser
October 13th, 2001, 14:56
As far as i know Icedump is free of VxD so its impossible to detect....At least I think so
Unregistered
October 13th, 2001, 17:08
hehe
L4t1g0
October 13th, 2001, 22:57
Icedump is not vxd free
Check the docs and the source.

y0 y0 /\/\od3st One !!
ThrawN
October 13th, 2001, 23:32
Icedump IS a vxd pretty much
self loading.
If you look at it you could code a icedump detector simular method to getting the hotkey opcode in the sice vxd. I dont really see the point tho, a cracker is going to see whats going on and fix this easyily

ThrawN
EtErNaL_L0ser
October 14th, 2001, 04:43
Gotta update my knowledge
stealthFIGHTER
October 14th, 2001, 15:18
Another (better ) question ... is it possible to detect Soft-Ice, while IceDump is loaded?

Regards

sF
^DAEMON^
October 15th, 2001, 09:12
f0dder, better go and check out my protector ))
it has got CLEAN icedump detection...

^DAEMON^
EtErNaL_L0ser
October 16th, 2001, 06:26
The question is where to get it ^Daemon^ ?

^DAEMON^
October 16th, 2001, 08:54
http://www.woodmann.net/forum/attachment.php?s=&postid=8939

download it there

^DAEMON^
EtErNaL_L0ser
October 16th, 2001, 11:39
Good work bud btw you r from EVC as R!sc ?
^DAEMON^
October 17th, 2001, 01:31
na, not from EVC....

DAEMON -> [UG2000/MYTH]
EtErNaL_L0ser
October 17th, 2001, 06:16
heheh ok thnx for the info