Modify Softice to escape the testing method in 2000 / XP from here http://www.woodmann.com/upload/showthread.php?s=&threadid=1806 Here I want to talk about my own modification experience, in fact, basics The contents of the above posts are the same. Just adding a little ourselves in order to escape to Softice in 2000 / XP, we need to modify three files. Where ntice.sys and siwvid.sys are located in the% Windir% / System32 / Drivers directory. NMTRANS.DLL is located in the installation directory of Si First, we must understand which methods in 2000 / XP to detect Softice, the most important method is to detect Ntice and SiwvidStart in the way, which is 2000 / XP to open the device. Drive method. There is also the use of int 1 and int 3 and GF .... MJ check. Here, we only say how to escape the monitoring of these methods. As for the counter-step tracking, you need your own debugging skills, not in the scope of this article. Here is how to modify the three files, let our Softice have an Anti Detect feature. Reminder !! Two driver files ntice.sys and siwvid.sys must be modified to fix their papers and checksum, which can be done using Lordpe. Otherwise, the system starts will fail! NTICE.SYS modification 1. Find the GFU * F string, modified to XFU * f, the subsequent MJ modified to XJ
