Page 3 of 5 FirstFirst 12345 LastLast
Results 31 to 45 of 64

Thread: soft ice in a VM and Windbg growing pains

  1. #31
    Quote Originally Posted by Kayaker View Post
    Hello? Dumb question, but have you tried BMSG without the firewall? Just a shot in the dark.
    Do you mean with it disabled or completely removed?

  2. #32
    Quote Originally Posted by Kayaker View Post
    The problem now is, can you find and trace a BMSG command?

    http://www.woodmann.com/forum/entry.php?96-IceProbe-SoftIce-Command-Tracer

    Setting up IDA for analysing Softice functions
    http://www.woodmann.com/forum/showthread.php?t=6529
    Excellent stuff kayaker, now I have no excuse for not exploring further. I have been under the impression that you had not released Iceprobe but that you were considering it.

  3. #33
    Teach, Not Flame Kayaker's Avatar
    Join Date
    Oct 2000
    Posts
    4,047
    Blog Entries
    5
    Re IceStealth and the one-time internet connection required to download the pdb files. Elenil can clarify this if he likes. You can download the symbols outside of the VM by copying the files (ntoskrnl/ntkrnlpa, services, etc.) to your real system and grab the pdb's for those specific file versions. I think I used Windbg symchk one time, another time the Softice symbol retriever (which works as standalone without Sice). Then just copy them back to the VM, without ever having opened it to the net.

    IceStealth is good if you need to hide Sice from something, and Elenil did a wonderful job at doing that, great work. You probably want to have a VM with a virgin Sice as well though for other work. I seem to recall not being able to use Loader32 to add modules or dump the history buffer after enabling it (yes, Sice was hidden well, even from itself

  4. #34
    Quote Originally Posted by Elenil View Post
    after this the files in IceStealth\other get patched to your actual os this fix a lot of problems
    I'm having all sorts of problems with icestealth that I never had before on version 1.5.

    When I used the Patch Softice command, I get an error message "NTOSKRNL.PDB File Error While Patch NTICE Code 1".

    I have manually loaded the pdb's for ntoskrnl and services in the 'other folder'. Halaacpi is not on my system but it is in a driver pack as halaacpi.dl_. My system uses hal.dll. I am reluctant to get the pdb for halaacpi because that hal is for a different OS.

    Anyway, I now have all three of the required pdbs in the 'other' folder and I am still getting the same error as above.

    I have suspected that I have hotfixes on my VM system that have changed versions of ntoskrnl. You said later versions of the OS worked OK.

    My current version of ntoskrnl is 5.1.2600.5512 (xpsp.080413-2111).

  5. #35
    Teach, Not Flame Kayaker's Avatar
    Join Date
    Oct 2000
    Posts
    4,047
    Blog Entries
    5
    Well this is funny. I tried IceProbe with the BMSG command. Easy peasy, but the problem is again context. Once you've issued the command and are tracing it in Softice, you're in the IceProbe context. BMSG won't work on any other context (notepad, explorer). However, it also won't work (Invalid window handle message) if you use the IceProbe window as the target, for example 'BMSG <iceprobe hwnd> WM_MENUSELECT'. That BSMG will be set if issued from the Sice window, but not if through IceProbe, if you get the meaning. Not sure why, but as we all know, context is a funny thing.

    In this particular case, what could be done then is to use IceProbe to get the running address of the BMSG command (simply issue the command once and note the address the tracing break begins on). Then use Windbg remote and blabberer's technique and set a BP on that address. Issue your BMSG in Softice and Windbg should break and you can begin tracing from there. The context at least should be correct.

    Please, do try IceProbe for fun, but I think it would difficult to figure out from the BMSG code how Softice is parsing the handle table and why it's not working in your particular situation. You remember the issues we brought up with the related HWND command:

    http://www.woodmann.com/forum/showthread.php?9643-Softice-and-breakpoints-revisited

    Install a virgin Softice/XP, test BMSG on notepad and go from there.

  6. #36
    Quote Originally Posted by Kayaker View Post
    Install a virgin Softice/XP, test BMSG on notepad and go from there.
    Yeah, that's the next step. I just wanted to exhaust all the possibilities before they exhaust me.

    I did uninstall my firewall but it did not help the softice problem. It did solve the icestealth problem. I was able to call out, get it's PDB files, then patch ntice. That's one plus.

    The firewall is the old Sygate, and I used it because it's a standalone firewall with no other bells and whistles. It's a good one too. There are features on there that would suit the most paranoid of users. Too bad Symantec got into the act. They seem to eat up good apps like Sygate and Partition Magic and discard them.

    Anyway, I need a break. Appreciate your time K., and sorry for continually dragging you into softice issues. Thanks for iceprobe.

    I am still trying to focus on the initial problem with reversing the MFT file on an NTFS system. I have diverged greatly into areas that don't seem related but are related.

    I'll reload XP onto the VM fresh...same with ice. I'll let you know what happens but it'll be a few days.

  7. #37
    Quote Originally Posted by Elenil View Post
    wax have you tryed the "patch ntice" function of icestealth ?
    See my last reply to Kayaker. I got it going but not softice. The patch did not help. Thanks anyway, it was worth the try. I am now satisfied there is something really wrong and I need to install XP and ice again.

  8. #38
    Quote Originally Posted by WaxfordSqueers View Post
    I'm having all sorts of problems with icestealth that I never had before on version 1.5.

    When I used the Patch Softice command, I get an error message "NTOSKRNL.PDB File Error While Patch NTICE Code 1".

    I have manually loaded the pdb's for ntoskrnl and services in the 'other folder'. Halaacpi is not on my system but it is in a driver pack as halaacpi.dl_. My system uses hal.dll. I am reluctant to get the pdb for halaacpi because that hal is for a different OS.

    Anyway, I now have all three of the required pdbs in the 'other' folder and I am still getting the same error as above.

    I have suspected that I have hotfixes on my VM system that have changed versions of ntoskrnl. You said later versions of the OS worked OK.

    My current version of ntoskrnl is 5.1.2600.5512 (xpsp.080413-2111).


    you may take a look on the readmefile
    "if you wanna place the .PDB files manual plz first create a \SYM folder
    then copy your .PDB files in the \sym folder like this : ntoskrnl.pdb\1592B6763F33476B9BB560395B383FA62\ntoskrnl.pdb"

    in other folder icestealth wont find the sym files

    create a \sym - folder (icestealth\sym not icestealth\other)

    be sure you not just copy without checksum its the microsoft dll what searching it this way


    in other case i think a firewall is blocking the microsoft symbol dll "symsrv.dll" it downloads the 3 files manually

    the error just indicates me that it not even loaded the ntoskrnl.pdb file (what i have set to be the first 1 to load)

    the thing with the hal.dll is that if you request the hal.pdb file it will load the halaacpi.pdb file microsoft has some kind of fused pdb file

    ahh and if you have replaced the files you have to make the computer reboot its not enough to have softice not started and start it after the files was replaced
    Last edited by Elenil; August 18th, 2013 at 06:12.

  9. #39
    Super Moderator
    Join Date
    Dec 2004
    Posts
    1,456
    Blog Entries
    15
    Quote Originally Posted by Kayaker View Post
    The interfering I3here can be turned off in winice.dat, i.e.FAULTS OFF; I3HERE OFF;
    thanks that should save a few keypress and round trips

    The problem now is, can you find and trace a BMSG command?
    i think so yes (tell me if you notice anything amiss)

    windbg waiting in host on a pipe to vm
    target xp sp3 vm with siw405nt boot start running
    ctrl+d
    i3here off
    bm hit space auto complete hit enter
    sice tells Parameters Required
    ctrl+d ((we got our clue lets start windbagging)

    ctrl+break

    windbg breaks

    Code:
    .reload /f
    kd> lm m ntic*
    start    end        module name
    fa509000 fa651f40   NTice      (export symbols)       NTice.sys
    kd> s -a fa509000 l?(fa651f40-fa509000) "Parameters requir"
    fa5c88d3  50 61 72 61 6d 65 74 65-72 73 20 72 65 71 75 69  Parameters requi
    kd> # *fa5c88d3 fa509000 l?(fa651f40-fa509000)
    NTice+0x2ebea:
    fa537bea bed3885cfa      mov     esi,offset NTice!initterm+0x36561 (fa5c88d3)
    NTice+0x2ec78:
    fa537c78 bed3885cfa      mov     esi,offset NTice!initterm+0x36561 (fa5c88d3)
    NTice+0x2f5e6:
    fa5385e6 bed3885cfa      mov     esi,offset NTice!initterm+0x36561 (fa5c88d3)
    NTice+0x3125d:
    fa53a25d b8d3885cfa      mov     eax,offset NTice!initterm+0x36561 (fa5c88d3)
    NTice+0x3138b:
    fa53a38b bed3885cfa      mov     esi,offset NTice!initterm+0x36561 (fa5c88d3)
    NTice+0x317a4:
    fa53a7a4 bed3885cfa      mov     esi,offset NTice!initterm+0x36561 (fa5c88d3)
    NTice+0x31d03:
    fa53ad03 bed3885cfa      mov     esi,offset NTice!initterm+0x36561 (fa5c88d3)
    NTice+0x32117:
    fa53b117 bed3885cfa      mov     esi,offset NTice!initterm+0x36561 (fa5c88d3)
    NTice+0x32395:
    fa53b395 bed3885cfa      mov     esi,offset NTice!initterm+0x36561 (fa5c88d3)
    NTice+0x32483:
    fa53b483 bed3885cfa      mov     esi,offset NTice!initterm+0x36561 (fa5c88d3)
    NTice+0x369c7:
    fa53f9c7 b8d3885cfa      mov     eax,offset NTice!initterm+0x36561 (fa5c88d3)
    NTice+0x38417:
    fa541417 b8d3885cfa      mov     eax,offset NTice!initterm+0x36561 (fa5c88d3)
    NTice+0x3e037:
    fa547037 8d05d3885cfa    lea     eax,[NTice!initterm+0x36561 (fa5c88d3)]
    NTice+0x3f034:
    fa548034 8d05d3885cfa    lea     eax,[NTice!initterm+0x36561 (fa5c88d3)]
    
    kd> u fa5385e6 l2
    NTice+0x2f5e6:
    fa5385e6 bed3885cfa      mov     esi,offset NTice!initterm+0x36561 (fa5c88d3)
    fa5385eb e82ab2ffff      call    NTice+0x2a81a (fa53381a)
    kd> u fa53ad03 l2
    NTice+0x31d03:
    fa53ad03 bed3885cfa      mov     esi,offset NTice!initterm+0x36561 (fa5c88d3)
    fa53ad08 e80d8bffff      call    NTice+0x2a81a (fa53381a)
    kd> $ there is a fat chance this function is called from our bmSG lets breakdance
    
    
    kd> bp fa53381a
    kd> g lets do ctrl+d + bm<space><enter> in target vm 
    Breakpoint 0 hit
    eax=00000004 ebx=00000003 ecx=00000000 edx=00001701 esi=fa5b8576 edi=fa5b88d1
    eip=fa53381a esp=fa5aab00 ebp=f9e38d54 iopl=0         nv up ei ng nz ac pe cy
    cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00000297
    NTice+0x2a81a:
    fa53381a 53              push    ebx
    kd> kb
    ChildEBP RetAddr  Args to Child              
    WARNING: Stack unwind information not available. Following frames may be wrong.
    fa5aaafc fa533700 fa5b0901 00000000 00000019 NTice+0x2a81a
    fa5aab18 fa52ac68 97000000 00000003 00000000 NTice+0x2a700
    00000000 00000000 00000000 00000000 00000000 NTice+0x21c68
    
    
    kd> ub fa533700 l2
    NTice+0x2a6f6:
    fa5336f6 be76855bfa      mov     esi,offset NTice!initterm+0x26204 (fa5b8576)
    fa5336fb e81a010000      call    NTice+0x2a81a (fa53381a)
    
    kd> DB fa5b8576
    fa5b8576  3a 62 6d 53 47 00 00 00-00 00 00 00 00 00 00 00  :bmSG...........
    fa5b8586  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
    
    kd> uf fa53381a
    NTice+0x2a81a:
    fa53381a 53              push    ebx
    fa53381b 8a3d15655bfa    mov     bh,byte ptr [NTice!initterm+0x241a3 (fa5b6515)]
    fa533821 e802010000      call    NTice+0x2a928 (fa533928)
    fa533826 5b              pop     ebx
    fa533827 c3              ret
    
    
    kd> uf fa53381a
    NTice+0x2a81a:
    fa53381a 53              push    ebx
    fa53381b 8a3d15655bfa    mov     bh,byte ptr [NTice!initterm+0x241a3 (fa5b6515)]
    fa533821 e802010000      call    NTice+0x2a928 (fa533928)
    fa533826 5b              pop     ebx
    fa533827 c3              ret
    kd> uf fa533928
    NTice+0x2a928:
    fa533928 833dd82663fa00  cmp     dword ptr [NTice!adjust_fdiv+0x1fde8 (fa6326d8)],0
    fa53392f 7401            je      NTice+0x2a932 (fa533932)
    
    NTice+0x2a931:
    fa533931 c3              ret
    
    NTice+0x2a932:
    fa533932 50              push    eax
    fa533933 53              push    ebx
    fa533934 51              push    ecx
    fa533935 52              push    edx
    fa533936 56              push    esi
    fa533937 57              push    edi
    fa533938 e859000000      call    NTice+0x2a996 (fa533996)
    fa53393d 8a3560855bfa    mov     dh,byte ptr [NTice!initterm+0x261ee (fa5b8560)]
    fa533943 0235435e5bfa    add     dh,byte ptr [NTice!initterm+0x23ad1 (fa5b5e43)]
    fa533949 b200            mov     dl,0
    fa53394b b320            mov     bl,20h
    fa53394d 8b0dc4135bfa    mov     ecx,dword ptr [NTice!initterm+0x1f052 (fa5b13c4)]
    fa533953 e85bb4ffff      call    NTice+0x25db3 (fa52edb3)
    fa533958 e841b3ffff      call    NTice+0x25c9e (fa52ec9e)
    fa53395d fe0560855bfa    inc     byte ptr [NTice!initterm+0x261ee (fa5b8560)]
    fa533963 a04e5e5bfa      mov     al,byte ptr [NTice!initterm+0x23adc (fa5b5e4e)]
    fa533968 380560855bfa    cmp     byte ptr [NTice!initterm+0x261ee (fa5b8560)],al
    fa53396e 720b            jb      NTice+0x2a97b (fa53397b)
    
    NTice+0x2a970:
    fa533970 fe0d60855bfa    dec     byte ptr [NTice!initterm+0x261ee (fa5b8560)]
    fa533976 e8e6030000      call    NTice+0x2ad61 (fa533d61)
    
    NTice+0x2a97b:
    fa53397b 5f              pop     edi
    fa53397c 5e              pop     esi
    fa53397d 5a              pop     edx
    fa53397e 59              pop     ecx
    fa53397f 5b              pop     ebx
    fa533980 58              pop     eax
    fa533981 c3              ret
    direct bmSG or wrapper should be nearby somehwre its back to tracing again

    scrape the net for this driver and check with your idb etc

    Code:
    ==================================================
    Filename          : ntice.sys
    MD5               : e9f99bae4269c95190461036c325077a
    SHA1              : 1eb378b984f9ad24afd86f414cc8ca4b83a53339
    CRC32             : c85e8094
    SHA-256           : 9bafdbe77306ef377a6c972acd7deca5e45ccb059843c8bc83809eb10e8eface
    SHA-512           : e3caf20b6915bb76b57800994467363dc4f13ea38d291feeedb4985ced744ede053d7691afb6b0e75db3c321165019dbf4068b205fa4ed5e346ea0a10f7838c3
    Full Path         : C:\Documents and Settings\Admin\Desktop\New Folder (2)\nticexppatch\windows\system32\drivers\ntice.sys
    Modified Time     : 07/11/2001 02:09:10
    Created Time      : 17/08/2013 02:59:56
    File Size         : 1,347,462
    File Version      : 4.2.6 (Build 922)
    Product Version   : 4.2.6 (Build 922)
    Identical         : 
    Extension         : sys
    File Attributes   : A
    ==================================================
    Last edited by blabberer; August 18th, 2013 at 07:12.

  10. #40
    Teach, Not Flame Kayaker's Avatar
    Join Date
    Oct 2000
    Posts
    4,047
    Blog Entries
    5
    Lol, I knew you'd try it. Hence the subtle challenge - social engineering

    Clever using a Bad Cracker message to get inside. Yep, the "Parameters required" string is at offset 000BF8D3, so with your driver base fa509000 + BF8D3 = FA5C88D3.
    You got all the cross references, the one for BMSG would be the one at NTice+0x31d03:, so I think your fat chance is correct.

    For your driver version BMSG begins here:

    Code:
    :00031B7E                   c_Bmsg          proc near               ; DATA XREF: .data:000B10BB
    :00031B7E 55                                push    ebp
    :00031B7F 8B EC                             mov     ebp, esp
    :00031B81 83 EC 1C                          sub     esp, 1Ch
    :00031B84 E8 78 7D 01 00                    call    UpdateCurrentContext
    :00031B89 BE 77 F5 0A 00                    mov     esi, offset bUserCommand
    :00031B8E E8 8D 43 FF FF                    call    VerifyString
    :00031B93 E8 F3 A6 FF FF                    call    SkipWord
    :00031B98 0F 82 65 01 00 00                 jb      loc_31D03  // msgParametersRequired

    If you want to confirm, just use IceProbe, it works with Softice 4.05 up to DS32.

    btw, I forgot how glitchy the mouse was in v4.05... yikes.

  11. #41
    Super Moderator
    Join Date
    Dec 2004
    Posts
    1,456
    Blog Entries
    15
    If you want to confirm, just use IceProbe, it works with Softice 4.05 up to DS32.
    heh socimoreengi ?

    well i was going to zero in on that exact function yesterday but didnt

    here is how
    see above i did a db esi and it was ;bmSG notice colon (doubt no 1)
    glancing through fa53381a it doesnt look like it handles windows (gut )
    more like a printf and where the heck is the String ?? Parameters Required
    string isnt anywhere near the top of stack (doubt no 2)

    lets see how many times this gets hit

    go (it get hits exactly two times) woot that is a jackpot without the jack

    lets play casino royale put all the stakes into one poker bluff

    Code:
    kd> bp fa53381a
    kd> g;da esi;kb;
    Breakpoint 0 hit
    fa5b8576  ":bmSG"
    ChildEBP RetAddr  Args to Child              
    WARNING: Stack unwind information not available. Following frames may be wrong.
    00000000 00000000 00000000 00000000 00000000 NTice+0x2a81a
    kd> g;da esi;kb;
    Breakpoint 0 hit
    fa5c88d3  "Parameters required"
    ChildEBP RetAddr  Args to Child              
    WARNING: Stack unwind information not available. Following frames may be wrong.
    fa5aaafc fa53375e fa5b0901 00000000 00000019 NTice+0x2a81a
    00000000 00000000 00000000 00000000 00000000 NTice+0x2a75e
    
    lets repeat encore twice
    
    kd> g;da esi;kb;
    Breakpoint 0 hit
    fa5b8576  ":bmSG"
    ChildEBP RetAddr  Args to Child              
    WARNING: Stack unwind information not available. Following frames may be wrong.
    00000000 00000000 00000000 00000000 00000000 NTice+0x2a81a
    kd> g;da esi;kb;
    Breakpoint 0 hit
    fa5c88d3  "Parameters required"
    ChildEBP RetAddr  Args to Child              
    WARNING: Stack unwind information not available. Following frames may be wrong.
    fa5aaafc fa53375e fa5b0901 00000000 00000019 NTice+0x2a81a
    00000000 00000000 00000000 00000000 00000000 NTice+0x2a75e
    kd> ub fa53375e l2
    NTice+0x2a755:
    fa533755 c1e002          shl     eax,2
    fa533758 ff900f9f5bfa    call    dword ptr NTice!initterm+0x27b9d (fa5b9f0f)[eax]
    kd> r
    eax=000001ac ebx=00000006 ecx=00000000 edx=00001701 esi=fa5c88d3 edi=fa5b8aae
    eip=fa53381a esp=fa5aaadc ebp=fa5aaafc iopl=0         nv up ei pl zr na pe cy
    cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00000247
    NTice+0x2a81a:
    fa53381a 53              push    ebx
    kd> bc *
    kd> bl
    
    kd> bp fa533758
    kd> g
    Breakpoint 0 hit
    NTice+0x2a758:
    fa533758 ff900f9f5bfa    call    dword ptr NTice!initterm+0x27b9d (fa5b9f0f)[eax]
    kd> r
    eax=000001ac ebx=00000006 ecx=00000000 edx=00001701 esi=fa5b8576 edi=fa5b8aae
    eip=fa533758 esp=fa5aab04 ebp=00000000 iopl=0         nv up ei pl nz ac pe nc
    cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00000216
    NTice+0x2a758:
    fa533758 ff900f9f5bfa    call    dword ptr NTice!initterm+0x27b9d (fa5b9f0f)[eax] ds:0023:fa5ba0bb=fa53ab7e
    kd> $ after reading the post i am sure i broke right
    kd> ? ntice+31b7e
    Evaluate expression: -95179906 = fa53ab7e
    ice what cone or cup

  12. #42
    Quote Originally Posted by Elenil View Post
    you may take a look on the readmefile
    E....look at the post before this one. I left a message for you saying that I had success getting icestealth working. I think it was a firewall issue. I forgot that the firewall I am using checks drivers and other OS functions.

    I removed the firewall and got icestealth working, but softice still does not accept a valid window's handle. I am going to reinstall win xp in the vm with a fresh install of ice.

    First, I slept for nearly 24 hours. I was exhausted from lack of sleep trying to get this problem solved.

  13. #43
    Quote Originally Posted by blabberer View Post
    i think so yes (tell me if you notice anything amiss)
    Good stuff, Blabs.

    In your setup, are you running softice as a target in the VM, with Windbg as the host on another machine? So, if I am setting up the VM, do I mark in serial port config that the VM end is the target?

    Also, I'm looking into buying a serial port to USB adapter, with the idea of using the USB end on my laptop and the serial port end in my desktop, where the VM resides. That was before setting up the VM and before finding that ice is not working with my new ATI driver. I am still interested in whether the concept will work. Don't know as yet whether Windbg allows output to a USB port aimed at a serial port after the data is converted to serial form..

    I have not bought it yet because I have a query in with the manufacturer as to whether it has full RS 232 handshaking.

  14. #44
    Super Moderator
    Join Date
    Dec 2004
    Posts
    1,456
    Blog Entries
    15
    that the VM end is the target?
    iirc vmware asks if this end is a server or client (msvpc wouldnt want to know which end is what?)

    i dont know if it asks if it is a target now

    you may check my blog entry for photos

    http://www.woodmann.com/forum/entry....ebug-win98-app

    as the title says it was some experiment where i was running two virtual machines on one physical host

    thats is 3 os (one xp which is a physical machine and host for two vms running windows 98 side by side )
    and i managed to connect both the vm for a kernel debuggin session
    that again is windows 98 kernel debugging another windows 98 on a physical host running windows xp

    there i designate one vm as server (other end is vm)
    and other vm as client (other end is vm)

    instead of this i think you should do
    this end is client and other end is physical host in the vm (not sure i dont have vmware installed to provide you correct info)

    but i think you should be able to make out with the above explanation and the photos in the blog entry

    as far as usb debugging is concerned reports are that it doesn't work properly
    it needs a special type of usb cable and even when it has that special cable from authorized and approved by ms hardware vendor it may not work
    is what i gather from the cloud (never used one so no first hand experience)

    reports are that usb debugging works kinda ok only in windows 8.1 preview release few months ago

  15. #45
    Teach, Not Flame Kayaker's Avatar
    Join Date
    Oct 2000
    Posts
    4,047
    Blog Entries
    5
    Quote Originally Posted by blabberer View Post
    ice what cone or cup
    With a cherry on top!

Similar Threads

  1. One soft protect by crypkey.
    By banch in forum The Newbie Forum
    Replies: 10
    Last Post: June 7th, 2013, 06:11
  2. newnie want ollydebug soft
    By ugam in forum OllyDbg Support Forums
    Replies: 2
    Last Post: January 6th, 2006, 08:14
  3. win16 soft over nt
    By potros in forum The Newbie Forum
    Replies: 1
    Last Post: September 23rd, 2005, 19:09
  4. can soft-ice for dos be load in the lower memory
    By robertyonghu in forum Tools of Our Trade (TOT) Messageboard
    Replies: 6
    Last Post: November 10th, 2001, 22:21
  5. Armadillo protected soft
    By LaptoniC in forum Advanced Reversing and Programming
    Replies: 8
    Last Post: May 7th, 2001, 06:57

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •