Community Hub0 Subscribers
Community hub
SoftICE
View on Wikipediafrom Wikipedia
 | This article's tone or style may not reflect the encyclopedic tone used on Wikipedia. (January 2009) |
| SoftICE | |
|---|---|
| Original author | NuMega |
| Developer | Compuware |
| Initial release | 1987 (DOS) |
| Final release | v4.05
/ 2000[1] |
| Operating system | Microsoft Windows |
| Type | Debugger |
| License | Proprietary |
SoftICE is a kernel mode debugger for DOS and Windows up to Windows XP. It is designed to run underneath Windows, so that the operating system is unaware of its presence. Unlike an application debugger, SoftICE is capable of suspending all operations in Windows when instructed. Due to its low-level capabilities, SoftICE is also popular as a software cracking tool.
Microsoft offers two kernel-mode debuggers, WinDbg and KD, without charges. However, the full capabilities of WinDbg and KD are available only when two interlinked computers are used. SoftICE, therefore, is an exceptionally useful tool for difficult driver-related development. The last released version was for Windows XP.
Older versions exist for DOS and compatible operating systems. SoftICE was originally produced by the company NuMega, and was subsequently acquired by Compuware in 1997, which in turn sold the property to Micro Focus in 2009. Currently, Micro Focus owns the source code and patents, but is not actively maintaining SoftICE.
Naming
[edit]"Soft" refers to software, and "ICE" is an allusion to in-circuit emulator.
History
[edit]The original SoftICE for DOS was written in 1987 by NuMega founders Frank Grossman and Jim Moskun. The program, written in 80386 assembly language, played the role of an operating system and ran software in virtual 8086 mode. It sold for $386.
SoftICE/W (for Windows) was developed in the 1990s, and was instrumental in the Writing of "Undocumented Windows", by Andrew Schulman, David Maxey and Matt Pietrek. SoftICE/W was derived from an earlier, lesser known product, SoftICE for NetWare (32-bit protected mode). One of the key advantages it had over Microsoft's debuggers is that it enabled single machine debugging, rather than requiring a second machine to be connected over a serial port.
The principal developers of SoftICE were Dom Basile ('Mr. SoftICE'), Tom Guinther (Kitchen Sink, Symbol Engine), Gerald Ryckman (Video drivers and Kitchen Sink), Ray Hsu (Video drivers for Windows 95), and Dan Babcock (SoftICE/NT 3.1/3.5: Universal video driver, symbol engine), with contributions by a variety of NuMega developers including Frank Grossman, Jim Moskun and Matt Pietrek.
In 1998, the codebase for SoftICE/95 was ported to run on the Windows NT platform.
Newer versions of SoftICE patch deep into Microsoft Windows. As such, old versions of SoftICE are rarely compatible with new versions of Windows. Compuware therefore offered SoftICE as a subscription so that it could be kept up to date and in sync with the latest Microsoft Windows version.
SoftICE was previously offered as part of Compuware's DriverStudio package, but was discontinued in April 2006.
Termination
[edit]As of April 3, 2006, the DriverStudio product family has been discontinued because of "a variety of technical and business issues as well as general market conditions". Maintenance support was offered until March 31, 2007.
Anti-SoftICE measures
[edit]Software vendors have put in place a wide range of countermeasures to protect themselves from people employing SoftICE as a tool to analyse software.
For example, here is code some vendors used to detect the presence of SoftICE running in the same machine as an early countermeasure:
mov eax, dword ptr [pIDT+2]; eax -> IDT
add eax, 8 ; eax -> int 1 vector
mov ebx, [eax] ; ebx == int 1 vector
add eax, 16 ; eax -> int 3 vector
mov eax, [eax] ; eax == int 3 vector
and eax, 0FFFFh ; strip the selector
and ebx, 0FFFFh ; part of it
sub eax, ebx ; find displacement
cmp eax, 10h
jne HackedVector ; not equal, then chances are
; SoftICE had tampered with these vectors
More and better such measures have evolved since. While most of them can only deter the less experienced and determined hackers, SoftICE is no longer a tool of choice for someone new to analysing software.
Modern software anti-analysis methods are based on more sophisticated packers/protectors, e.g. Themida, Armadillo or ASProtect which pack the program code and tamper with entry point addresses so it is hard to find the program's original entry point (OEP). That is also true for the program's import address table (IAT). However, tools for hiding SoftICE are also available, such as IceStealth and IceExt for Windows NT, or Icedump and IcePatch for Windows 9x.[2]
Reception
[edit]In 1989, BYTE listed Soft-ICE among the "Distinction" winners of the BYTE Awards, stating that, "If you're developing 8086-based applications on an 80386 machine, this is an essential and affordable tool".[3]
Alternatives
[edit]A commercial kernel-level debugger called Syser claims to continue where SoftICE left off.
A shareware debugger, but free to use, OllyDbg is a 32-bit assembler-level debugger from Oleh Yuschuk. However, it can only be used for user-mode debugging.
An open source kernel debugger similar to SoftICE named Rasta Ring 0 Debugger (RR0D) is available.[4][5] It provides low-level debugging for Microsoft Windows, Linux, OpenBSD, NetBSD, and FreeBSD. This project does not seem to be actively maintained. As of June 2016[update], the last change in its GitHub source code repository occurred in December 2008.[6]
A debugger called BugChecker is a 32-bit single-host kernel debugger for Windows 2000 and XP, developed and made available as open source for educational purposes. BugChecker allows users to trace into both user and kernel code, both on uniprocessor and multiprocessor versions of Windows 2000 and XP.[7]
A modern successor to SoftICE named BugChecker (unrelated to the one mentioned above) was released by Vito Plantamura in 2023. Unlike the other local kernel debuggers, it supports Windows XP to Windows 11, both 32-bit and 64-bit. To achieve this, the debugger spoofs the machine as being debugged by a second system by intercepting serial cable communication, and then and draws its display directly to the framebuffer. This method significantly improves stability and compatibility compared to previous approaches, including that of SoftICE itself.[8]
Many hypervisors allow debugging the kernel running in the virtual machine through exposing some kind of debugger interface that can control the virtualized processor directly. This allows debugging even if the kernel does not have native debugging facilities.
References
[edit]- ^ "NuMega SoftICE 4.05 Release Notes". Archived from the original on 2018-01-01. Retrieved 2012-06-04.
- ^ "Category:SoftICE Extensions - Collaborative RCE Tool Library". Woodmann.com. Archived from the original on 2014-07-31. Retrieved 2014-04-24.
- ^ "The BYTE Awards". BYTE. January 1989. p. 327.
- ^ "RR0D/Presentation". Wiki.droids-corp.org. Archived from the original on 2014-04-24. Retrieved 2014-04-24.
- ^ "Rasta Ring 0 Debugger (RR0D) - Collaborative RCE Tool Library". Woodmann.com. 2007-10-18. Archived from the original on 2016-03-04. Retrieved 2014-04-24.
- ^ joe. "ice799/rr0d". Github.com. Archived from the original on 2018-12-22. Retrieved 2016-06-05.
- ^ "BugChecker". BugChecker. Archived from the original on 2011-10-29. Retrieved 2014-04-24.
- ^ "BugChecker". Github.com. Retrieved 2024-04-28.
External links
[edit]- Collection of SoftICE extension
- Pietrek, Matt (2006-04-11). "More on SoftIce, from one of its parents". Archived from the original on 2017-10-10. Retrieved 2017-10-10.
- Using Visual SoftICE Release 1.3.0 for Windows NT / Windows 2000 / Windows XP (PDF). Compuware Corporation. 2003-05-19. Doc. 11581. Archived (PDF) from the original on 2017-10-09. Retrieved 2017-10-09.
- Official SoftICE documentation from NuMega
SoftICE
View on Grokipediafrom Grokipedia
Overview
Description
SoftICE is a software-based debugger developed by NuMega Technologies for DOS and Microsoft Windows operating systems, providing kernel-mode capabilities for Windows including 95/98/ME and NT/2000/XP.[7][8] It operates in a non-intrusive manner beneath the host operating system, which remains unaware of its presence until activated, enabling real-time inspection of system calls, device drivers, kernel interactions, and low-level code execution without disrupting normal system behavior.[7][8] The primary purpose of SoftICE is to empower developers and security analysts to perform kernel-level debugging on a single machine, eliminating the need for separate hardware probes or remote debugging setups common in traditional environments. Upon encountering a breakpoint or fault, it halts the operating system and presents an interactive, full-screen command-line interface for examining registers, memory, processes, and execution flow, supporting source-level and symbolic debugging with features like hardware-assisted breakpoints. This distinguishes it from user-mode tools, such as WinDbg in local mode, by providing seamless transitions between user and kernel spaces directly on the target system.[8][9] First released in 1987 for DOS, with Windows support added in the 1990s, and later acquired by Compuware in 1997, it targeted the growing need for robust tools in driver and system software analysis.[10] Historically, SoftICE emerged as a software alternative to hardware in-circuit emulators (ICE), which were expensive, bulky devices used for low-level hardware debugging; by implementing ICE-like capabilities entirely in software, it made advanced kernel debugging accessible for Windows development without additional equipment.[9] In basic operation, SoftICE loads as a virtual device driver (VxD for Windows 9x) or kernel-mode driver (e.g., NTICE.SYS for Windows NT) during system boot or via manual commands like "NET START NTICE." It remains dormant until triggered by a breakpoint, at which point pressing Ctrl-D pops up the debugger window; users can then issue commands such as BPX to set execution breakpoints, TABLE to load and manage symbol tables for symbolic debugging, and WR to write values to memory or registers before resuming execution with X or F5.[7][8]Naming and Origins
The name "SoftICE" reflects its software-based nature, with "Soft" indicating a purely programmatic implementation and "ICE" serving as an acronym for In-Circuit Emulator, a hardware debugging technology that emerged in the 1970s for embedded systems. In-Circuit Emulators, pioneered by Intel with the ICE-80 in 1975, enabled real-time microprocessor emulation by substituting a physical pod connected to the CPU socket, offering comprehensive visibility into hardware execution but requiring specialized, costly equipment.[11][12] SoftICE originated as a conceptual response to the practical constraints of hardware ICEs, which demanded invasive physical setups and prohibitive expenses for many developers working on PC-based software in the late 1980s. Developed by NuMega Technologies, it sought to replicate the deep, system-level debugging prowess of these tools through software alone, allowing interception and analysis of code execution without external hardware dependencies. The initial impetus for SoftICE arose from the shortcomings of DOS-era debuggers like Borland's Turbo Debugger, which operated mainly in user mode and struggled with kernel-level access or real-time system monitoring.[13] By providing a lightweight, integrated solution for low-level introspection, SoftICE addressed these gaps, enabling developers to "break out" of running programs via simple keystrokes for on-the-fly examination. NuMega Technologies registered "SoftICE" as a trademark to brand this innovative approach.History
Early Development
NuMega Technologies was founded in 1987 by Frank Grossman and Jim Moskun in Nashua, New Hampshire, with an initial focus on creating advanced debugging tools for MS-DOS environments.[14] The company developed SoftICE as its flagship product, introducing the first version for DOS that year as a software-based alternative to expensive hardware in-circuit emulators (ICE).[10] This early iteration operated in real mode, enabling developers to set unconditional breakpoints, inspect registers, and trace code execution at the hardware level using 80386 protected mode features like paging and breakpoint registers.[15] Development of SoftICE evolved rapidly to address the shift toward graphical operating systems in the mid-1990s. In December 1995, NuMega announced SoftICE for Windows 95, extending its debugging capabilities to support the new protected-mode environment while maintaining seamless integration with DOS applications.[16] This version, building on the DOS foundation, allowed system-level inspection during Windows sessions without rebooting, a significant advancement for debugging 32-bit applications. A key milestone came in 1996 with the release of SoftICE version 2.0, which added full support for Windows 95 and introduced integration with NuMega's BoundsChecker tool for enhanced memory debugging and error detection. Later that summer, NuMega launched SoftICE for Windows NT, adapting the debugger to the operating system's kernel-mode architecture using device drivers to enable transparent debugging of protected-mode processes. These adaptations presented notable challenges, particularly in transitioning from DOS real-mode operations to the ring-protected environments of Windows 9x and NT. For Windows 9x, SoftICE relied on virtual device drivers (VxDs) to hook into the system's interrupt mechanisms and virtualize hardware access, ensuring non-intrusive operation. In contrast, Windows NT required kernel-mode drivers to interact with its stricter security model, demanding careful management of system calls and memory protection to avoid crashes during debugging sessions.Acquisition and Expansion
In December 1997, Compuware Corporation acquired NuMega Technologies for approximately $115 million in stock, bringing SoftICE under Compuware's portfolio and integrating it into the DevPartner suite as a core component for advanced debugging capabilities.[17][3] This move allowed Compuware to expand its offerings in software testing and development tools, positioning SoftICE alongside products like BoundsChecker for comprehensive enterprise-level solutions.[18] Post-acquisition, SoftICE underwent significant expansions to support emerging Windows platforms. Version 4.0, released in 1998, introduced compatibility with Windows NT and Windows 2000, enabling full kernel-mode debugging on these operating systems and addressing the growing demand for robust tools in multi-user environments. By 2001, SoftICE was bundled into the newly launched DriverStudio suite, which targeted device driver development and included complementary tools such as DriverWorks for driver framework generation and TrueCoverage for code coverage analysis.[19][1] Under Compuware, SoftICE was repackaged for enterprise adoption, emphasizing features tailored to professional developers. Enhancements included API breakpoints for monitoring Win32 calls, facilitating detailed inspection of system interactions without disrupting application flow. Additionally, Visual SoftICE provided seamless integration with Microsoft Visual Studio, allowing developers to control debugging sessions directly from the IDE and streamline workflows for complex projects.[1][20] During the early 2000s, SoftICE achieved widespread use among developers, particularly for kernel driver debugging as Windows XP gained prominence, supporting critical tasks in system-level programming across thousands of enterprise installations.[21][22]Termination and Aftermath
In early 2006, Compuware announced the discontinuation of SoftICE development, citing a variety of technical and business issues as well as general market conditions.[23] Sales of the product ceased in April 2006, with maintenance support extended until March 31, 2007.[24] Among the technical challenges was SoftICE's incompatibility with 64-bit versions of Windows, as the debugger was designed primarily for 32-bit architectures and lacked updates for emerging 64-bit systems like Windows XP x64.[25] The market had also shifted toward open-source and integrated debugging tools, reducing demand for standalone kernel debuggers like SoftICE.[4] Contributing to the business decision was Compuware's strategic emphasis on mainframe software solutions, particularly for IBM System z environments, which overshadowed investments in Windows development tools acquired through the 1997 purchase of NuMega.[26] Although SoftICE had associations with reverse engineering practices, no official statements linked legal risks directly to the termination. The final release, version 4.05, supported Windows XP (32-bit) and was issued prior to the 2006 announcement, leaving users without updates for subsequent operating systems.[27] In June 2009, Compuware divested its application testing and quality solutions business, including SoftICE and other former NuMega products, to Micro Focus International for $80 million.[5] Micro Focus, acquired by OpenText in January 2023, has not actively maintained or updated SoftICE since the transfer.[6] Following the end of support, SoftICE licenses became invalid, prompting some developers to resort to unauthorized distribution of existing binaries within reverse engineering communities.[28] This period saw immediate migration among users to alternatives such as WinDbg and OllyDbg, which offered similar kernel-level debugging capabilities without the same licensing constraints.[4] Preservation efforts emerged quickly, with reverse engineering enthusiasts archiving installation media and documentation on forums and repositories to maintain access for legacy analysis.[27] Compuware's later divestitures, including the 2019 sale of its mainframe software business to BMC Software, did not include any revival or transfer of SoftICE assets, solidifying its status as an unsupported legacy tool.[29]Technical Features
Core Capabilities
SoftICE's core capabilities centered on its advanced breakpoint system, which enabled precise interruption of program execution at kernel and user levels. It supported hardware breakpoints via the INT 3 instruction using the BPX command, which inserted a software interrupt at specified code addresses for execution tracing, such asBPX function_name. Software breakpoints were facilitated by the BPM command, targeting memory read, write, or execute operations on byte, word, or double-word sizes, limited to four simultaneous instances due to x86 debug registers, as in BPM address RW. API-specific breakpoints employed the BPX command to monitor function calls by setting execution breakpoints on API function names or addresses, particularly useful for Windows API hooks, with all types incorporating conditional expressions based on registers, stack values, or memory contents, exemplified by BPX address IF (eax == value).[30][31]
Inspection tools in SoftICE allowed detailed examination of program state during debugging sessions. The ? command evaluated arithmetic and logical expressions involving registers, memory addresses, or constants, displaying results in hexadecimal, decimal, ASCII, and binary formats, such as ? eax + offset. Memory dumps were handled by DD for double-word hex displays and DA for ASCII interpretations, with length specifiers for targeted views, like DD address L count. The SYMBOL command loaded and managed symbol tables from PDB or MAP files, resolving addresses to function names and enhancing code readability, often integrated during initialization. Additionally, the HISTORY command accessed a trace of execution events and commands for retrospective analysis.[30][31]
Control features provided flexible navigation through code execution. Single-stepping was achieved via the P command to step over instructions or T for stepping into calls, with P RET specifically tracing until a procedure return, bound to hotkeys like F10 and F12 for efficiency. Non-intrusive activation occurred via the Ctrl-D popup, which invoked the SoftICE window from a running system, minimizing disruption to the target application.[30][31]
Unique to SoftICE was its configurable history buffer, with a default size of 256 KB, for logging commands, breakpoints, and execution traces, which could be exported to LOG files for post-session review or external analysis. Integration with the SoftICE Loader facilitated automatic symbol path loading from PDB/MAP files during program startup, streamlining setup for complex binaries. These elements collectively enabled interactive, kernel-level analysis unattainable in user-mode debuggers of the era.[30]
Architecture and Compatibility
SoftICE operates as a kernel-resident debugger designed to run at ring 0, providing unrestricted access to hardware and system resources for comprehensive debugging. In Windows 9x systems, it loads as a Virtual Device Driver (VxD), utilizing components such as WINICE.VXD and SIWVID.386 to integrate seamlessly with the Virtual Machine Manager and enable direct interception of interrupts and system calls.[30] For Windows NT/2000/XP, SoftICE functions as a kernel-mode device driver, loaded through files including NTICE.SYS, SIWVID.SYS, and softice.sys, which grant it the privileges needed to monitor and control kernel execution without requiring a separate host machine.[30] A core element of this architecture is its use of Interrupt Descriptor Table (IDT) hooking to handle traps and breakpoints, such as those triggered by the BPINT command or Int 2E transitions, ensuring that debugging interventions occur transparently to the operating system.[30] Compatibility is limited to 32-bit environments, with full support for Windows 95, 98, and ME in VxD mode, allowing SoftICE to leverage the hybrid 16/32-bit architecture of these systems for ring-0 operations.[30] It also offers complete compatibility with 32-bit Windows NT, 2000, and XP via driver mode, though support for Windows 2000 Server is partial, potentially encountering issues with certain server-specific kernel configurations.[30] No support exists for 64-bit Windows variants or releases post-XP, as these impose mandatory kernel driver signing and enhanced security measures that prevent the loading of SoftICE's unsigned components.[30] Hardware requirements for SoftICE are modest by modern standards but tailored to its era, necessitating x86-compatible processors from Intel or AMD to execute its low-level instructions.[30] A VGA or SVGA graphics adapter is essential for rendering the debugger's popup window interface, while a minimum of 8 MB RAM ensures sufficient memory for symbol loading and breakpoint management.[30] Multi-processor systems pose limitations, with SoftICE capable of debugging only a single CPU, restricting its effectiveness in symmetric multiprocessing (SMP) setups.[30] Installation primarily targets single-machine use, where SoftICE initializes during system boot to hook into the kernel early in the process.[30] For remote debugging, it employs the Network Transfer Interface (NTI) to facilitate stubs over serial or network links, enabling control from a separate host while the target runs uninterrupted.[30] However, the unsigned nature of its drivers frequently leads to conflicts with antivirus software, which may detect them as potential threats and prevent proper loading or operation.[30]Usage and Impact
Role in Software Debugging
SoftICE played a pivotal role in professional software debugging, particularly for kernel-level and driver development on Windows systems during the 1990s and 2000s. It enabled developers to test Windows Driver Model (WDM) and NT drivers by setting execution breakpoints (e.g., BPX on specific addresses), memory breakpoints (BPM) to monitor variables, and port breakpoints (BPIO) for I/O operations, allowing real-time tracing of driver behavior without requiring a separate debugging machine.[1] Tools like DriverStudio integrated SoftICE with BoundsChecker and TrueCoverage, facilitating the detection of Interrupt Request Level (IRQL) violations through conditional breakpoints (e.g., BPX myaddr IF (IRQL > 2)) and the tracing of Input/Output Control (IOCTL) calls via API breakpoints (e.g., BPX NtCreateFile).[32] This made it indispensable for identifying issues in driver initialization, resource allocation, and hardware interactions.[1] In kernel troubleshooting, SoftICE excelled at diagnosing Blue Screen of Death (BSOD) causes and memory-related errors by providing full access to system internals upon activation, which halts the operating system for inspection. Developers used commands like the BugCheck Script to automate analysis on BSOD events, examining Interrupt Descriptor Table (IDT) vectors (e.g., 2 and 8 for common faults) and thread states to pinpoint crashes.[1] For heap corruption, integration with BoundsChecker allowed SoftICE to stop execution on detected anomalies, with the HEAP command (e.g., :heap -b explorer.exe) revealing block details and BPM tracing modifications to corrupted regions.[1] Additionally, it supported system call hooking without rebooting, such as setting breakpoints on native APIs like NtCreateFile to monitor kernel transitions in a single-machine environment.[32] SoftICE's workflow integration with development environments like Visual C++ enhanced source-level debugging by loading PDB or DBG symbol files (via ADDSYM or SET SYMPATH) and opening source code directly (FILE command), enabling breakpoints on exports and stepping across user and kernel modes.[1] This single-machine approach offered superior responsiveness over remote tools like WinDbg, avoiding serial cable delays while scanning memory or capturing debug output.[9] In industry adoption, it became essential for embedded systems developers debugging interrupt routines with INT 1/3 breakpoints and physical memory (PHYS command), as well as game developers in the 1990s-2000s inspecting DirectX interactions and video driver initialization in dual-monitor setups via Visual SoftICE.[1] Network stack issues were similarly addressed through API tracing, underscoring its value in complex, real-time environments before modern hypervisor-based alternatives emerged.[32]Applications in Reverse Engineering
SoftICE played a pivotal role in binary analysis within reverse engineering by enabling real-time inspection and modification of executing code in memory. Reverse engineers utilized its kernel-mode capabilities to set dynamic breakpoints and trace unpacked malware, allowing them to step through obfuscated sections without disrupting the program's flow. For instance, commands likebpx for execution breakpoints and bpm for memory access points facilitated the identification and alteration of malicious payloads during runtime analysis.[2][33]
In binary patching, SoftICE supported direct memory editing to neutralize protective mechanisms, such as replacing anti-debug checks with NOP instructions via the e command for hex edits or a for assembling new code at specific addresses. This technique proved essential for dissecting packed executables, where engineers could trace decryption routines and patch them on-the-fly to expose underlying logic. A common application involved stepping through instructions with t or p commands to isolate and modify branches enforcing security validations.[2]
For malware analysis, SoftICE excelled in kernel-level investigations, particularly for rootkits that manipulated system structures like the System Service Dispatch Table (SSDT). Analysts hooked the SSDT to inspect hidden processes and services, dumping the table with SoftICE commands to reveal alterations made by rootkits, such as redirected system calls for concealment. In early antivirus research, it enabled single-system kernel debugging to trace rootkit behaviors, like SSDT modifications that hid files or network activity, without requiring a separate host machine. This approach was instrumental in revealing trojans like SubSeven, where breakpoints on API calls (e.g., bpx recv) exposed hardcoded credentials and communication protocols during execution.[34][35]
Cracking techniques leveraging SoftICE focused on API tracing to bypass software protections in shareware applications. Engineers set breakpoints on Windows API functions to monitor serial validation flows, such as intercepting calls like GetWindowText to alter dialog inputs or trace registration checks. Community-developed extensions automated these processes, enhancing SoftICE's utility for scripting repetitive traces and patches in protection schemes.[2][33]
Despite its value in security research, SoftICE's prominence raised ethical concerns, as its ease in bypassing protections prompted vendors to impose restrictions via end-user license agreements (EULAs). Many EULAs explicitly prohibited reverse engineering tools like SoftICE to safeguard intellectual property, leading to legal scrutiny under frameworks like the DMCA. Books on Windows internals frequently referenced SoftICE traces for educational dissection of system behaviors, underscoring its dual role in legitimate analysis while highlighting the tensions with proprietary software protections.[35]