SoftICE is a
kernel mode
In computer science, hierarchical protection domains, often called protection rings, are mechanisms to protect data and functionality from faults (by improving fault tolerance) and malicious behavior (by providing computer security).
Computer ...
debugger
A debugger or debugging tool is a computer program used to software testing, test and debugging, debug other programs (the "target" program). The main use of a debugger is to run the target program under controlled conditions that permit the pr ...
for
DOS
DOS is shorthand for the MS-DOS and IBM PC DOS family of operating systems.
DOS may also refer to:
Computing
* Data over signalling (DoS), multiplexing data onto a signalling channel
* Denial-of-service attack (DoS), an attack on a communicat ...
and
Windows
Windows is a group of several proprietary graphical operating system families developed and marketed by Microsoft. Each family caters to a certain sector of the computing industry. For example, Windows NT for consumers, Windows Server for serv ...
up to Windows XP. It is designed to run underneath Windows, so that the
operating system
An operating system (OS) is system software that manages computer hardware, software resources, and provides common services for computer programs.
Time-sharing operating systems schedule tasks for efficient use of the system and may also in ...
is unaware of its presence. Unlike an application debugger, SoftICE is capable of suspending all operations in Windows when instructed. Because of its low-level capabilities, SoftICE is also popular as a
software cracking
Software cracking (known as "breaking" mostly in the 1980s) is the modification of software to remove or disable features which are considered undesirable by the person cracking the software (software cracker), especially copy protection featur ...
tool.
Microsoft offers two
kernel
Kernel may refer to:
Computing
* Kernel (operating system), the central component of most operating systems
* Kernel (image processing), a matrix used for image convolution
* Compute kernel, in GPGPU programming
* Kernel method, in machine learnin ...
-mode debuggers,
WinDbg
WinDbg is a multipurpose debugger for the Microsoft Windows computer operating system, distributed by Microsoft. Debugging is the process of finding and resolving errors in a system; in computing it also includes exploring the internal operation ...
and KD, without charges. However, the full capabilities of WinDbg and KD are available only when two interlinked computers are used. SoftICE, therefore, is an exceptionally useful tool for difficult driver related development. The last released version was for Windows XP.
Older versions exist for
DOS
DOS is shorthand for the MS-DOS and IBM PC DOS family of operating systems.
DOS may also refer to:
Computing
* Data over signalling (DoS), multiplexing data onto a signalling channel
* Denial-of-service attack (DoS), an attack on a communicat ...
and compatible operating systems. SoftICE was originally produced by a company called
NuMega
NuMega Technologies, Inc. (also known as NuMega), was a software company founded in 1987 by Frank Grossman and Jim Moskun in Nashua, New Hampshire. The company developed a Kernel mode debugger, now SoftICE, for DOS and the Windows NT family.Mark R ...
, and was subsequently acquired by
Compuware
Compuware Corporation was an American software company based in Detroit, Michigan. The company offers products aimed at the information technology (IT) departments of large businesses, and its services also include testing, development, automation ...
in 1997, which in turn sold the property to
Micro Focus
Micro Focus International plc is a British multinational software and information technology business based in Newbury, Berkshire, England. The firm provides software and consultancy. The company is listed on the London Stock Exchange and is ...
in 2009. Currently, Micro Focus owns the source code and patents, but is not actively maintaining SoftICE.
Naming
"Soft" refers to software, and "ICE" is an
allusion
Allusion is a figure of speech, in which an object or circumstance from unrelated context is referred to covertly or indirectly. It is left to the audience to make the direct connection. Where the connection is directly and explicitly stated (as ...
to
in-circuit emulator
In-circuit emulation (ICE) is the use of a hardware device or in-circuit emulator used to debug the software of an embedded system. It operates by using a processor with the additional ability to support debugging operations, as well as to carr ...
.
History
The original SoftICE for DOS was written in 1987 by NuMega founders Frank Grossman and Jim Moskun. The program, written in
80386
The Intel 386, originally released as 80386 and later renamed i386, is a 32-bit microprocessor introduced in 1985. The first versions had 275,000 transistors[assembly language
In computer programming, assembly language (or assembler language, or symbolic machine code), often referred to simply as Assembly and commonly abbreviated as ASM or asm, is any low-level programming language with a very strong correspondence be ...]
, played the role of an operating system and ran software in
virtual 8086 mode
In the 80386 microprocessor and later, virtual 8086 mode (also called virtual real mode, V86-mode, or VM86) allows the execution of real mode applications that are incapable of running directly in protected mode while the processor is runnin ...
. It sold for $386.
SoftICE/W (for Windows) was developed in the 1990s, and was instrumental in the Writing of "Undocumented Windows", by Andrew Schulman, David Maxey and
Matt Pietrek
Matt Pietrek (born January 27, 1966) is an American spirits and cocktail writer. Previously, he was a computer specialist and author specializing in Microsoft Windows.
Pietrek also has a keen interest in cocktails and spirits, and he writes a blog ...
. SoftICE/W was derived from an earlier, lesser known product, SoftICE for NetWare (32-bit protected mode). One of the key advantages it had over Microsoft's debuggers is that it enabled single machine debugging, rather than requiring a second machine to be connected over a serial port.
The principal developers of SoftICE were Dom Basile ('Mr. SoftICE'), Tom Guinther (Kitchen Sink, Symbol Engine), Gerald Ryckman (Video drivers and ''Kitchen Sink''), Ray Hsu (Video drivers for Windows 95), and Dan Babcock (SoftICE/NT 3.1/3.5: Universal video driver, symbol engine), with contributions by a variety of NuMega developers including Frank Grossman, Jim Moskun and Matt Pietrek.
In 1998, the codebase for SoftICE/95 was ported to run on the Windows NT platform.
Newer versions of SoftICE patch deep into Microsoft Windows. As such, old versions of SoftICE are rarely compatible with new versions of Windows. Compuware therefore offered SoftICE as a subscription so that it could be kept up to date and in sync with the latest Microsoft Windows version.
It used to be offered as part of Compuware's DriverStudio package but was discontinued in April 2006.
Termination
As of April 3, 2006, the DriverStudio product family has been discontinued because of "a variety of technical and business issues as well as general market conditions". Maintenance support was offered until March 31, 2007.
Anti-SoftICE measures
Software vendors have put in place a wide range of countermeasures to protect themselves from people employing SoftICE as a tool to analyse software.
For example, here is code some vendors used to detect the presence of SoftICE running in the same machine as an early countermeasure:
mov eax, dword ptr IDT+2
IDT may refer to:
Technology
* Information and digital technology, a digitally focused information technology landscape
* Interdigital transducer, or interdigitated transducer, a sensor and transmitter for a surface acoustic wave
* Interrupt d ...
eax -> IDT
add eax, 8 ; eax -> int 1 vector
mov ebx, ax ; ebx int 1 vector
add eax, 16 ; eax -> int 3 vector
mov eax, ax ; eax int 3 vector
and eax, 0FFFFh ; strip the selector
and ebx, 0FFFFh ; part of it
sub eax, ebx ; find displacement
cmp eax, 10h
jne HackedVector ; not equal, then chances are
; SoftICE had tampered with these vectors
More and better such measures have evolved since. While most of them can only deter the less experienced and determined hackers, SoftICE is no longer a tool of choice for someone new to analysing software.
Today, vendors' defenses are based on more sophisticated packers/protectors, e.g. Themida, Armadillo or ASProtect which pack the program code and tamper with entry point addresses so it is hard to find the program's original entry point (
OEP). That is also true for the program's
import address table (IAT). However, tools for hiding SoftICE are also available, such as IceStealth and IceExt for Windows NT, or Icedump and IcePatch for Windows 9x.
Reception
In 1989, ''
BYTE
The byte is a unit of digital information that most commonly consists of eight bits. Historically, the byte was the number of bits used to encode a single character of text in a computer and for this reason it is the smallest addressable unit ...
'' listed Soft-ICE among the "Distinction" winners of the BYTE Awards, stating that, "If you're developing 8086-based applications on an 80386 machine, this is an essential and affordable tool".
Alternatives
A commercial kernel-level debugger called Syser claims to continue where SoftICE left off.
A shareware debugger, but free to use,
OllyDbg
OllyDbg (named after its author, Oleh Yuschuk) was an x86 debugger that emphasizes binary code analysis, which is useful when source code is not available. It traces registers, recognizes procedures, API calls, switches, tables, constants a ...
is a 32-bit assembler-level debugger from Oleh Yuschuk. However, it can only be used for user-mode debugging.
An open source kernel debugger similar to SoftICE named ''Rasta Ring 0 Debugger'' (RR0D) is available. It provides low-level debugging for
Microsoft Windows
Windows is a group of several proprietary graphical operating system families developed and marketed by Microsoft. Each family caters to a certain sector of the computing industry. For example, Windows NT for consumers, Windows Server for serv ...
,
Linux
Linux ( or ) is a family of open-source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991, by Linus Torvalds. Linux is typically packaged as a Linux distribution, which ...
,
OpenBSD
OpenBSD is a security-focused, free and open-source, Unix-like operating system based on the Berkeley Software Distribution (BSD). Theo de Raadt created OpenBSD in 1995 by forking NetBSD 1.0. According to the website, the OpenBSD project em ...
,
NetBSD
NetBSD is a free and open-source Unix operating system based on the Berkeley Software Distribution (BSD). It was the first open-source BSD descendant officially released after 386BSD was forked. It continues to be actively developed and is a ...
, and
FreeBSD
FreeBSD is a free and open-source Unix-like operating system descended from the Berkeley Software Distribution (BSD), which was based on Research Unix. The first version of FreeBSD was released in 1993. In 2005, FreeBSD was the most popular ...
. This project does not seem to be actively maintained. , the last change in its
GitHub
GitHub, Inc. () is an Internet hosting service for software development and version control using Git. It provides the distributed version control of Git plus access control, bug tracking, software feature requests, task management, continuous ...
source code repository occurred in December 2008.
A debugger called BugChecker is a 32-bit single-host kernel debugger for Windows 2000 and XP, developed and made available as open source for educational purposes. BugChecker allows users to trace into both user and kernel code, both on uniprocessor and multiprocessor versions of Windows 2000 and XP.
Many hypervisors allow debugging the kernel running in the virtual machine through exposing some kind of debugger interface that can control the virtualized processor directly. This allows debugging even if a kernel does not have native debugging facilities.
References
External links
Collection of SoftICE extension*
*
Official SoftICE documentation from NuMega
{{DEFAULTSORT:Softice
Debuggers
Assembly language software
Micro Focus International