World Library  
Flag as Inappropriate
Email this Article


Article Id: WHEBN0000051137
Reproduction Date:

Title: SoftICE  
Author: World Heritage Encyclopedia
Language: English
Subject: Software cracking, Comparison of debuggers, Reverse engineering
Publisher: World Heritage Encyclopedia


Developer(s) Nu-Mega Technologies and Compuware
Initial release 1987 (1987) (DOS)
Discontinued v4.05 / 2000 (2000)[1]
Operating system Microsoft Windows
Type Debugger
License Proprietary

SoftICE is a kernel mode debugger for Microsoft Windows. Crucially, it is designed to run underneath Windows such that the operating system is unaware of its presence. Unlike an application debugger, SoftICE is capable of suspending all operations in Windows when instructed. For driver debugging this is critical due to how hardware is accessed and the kernel of the operating system functions. Because of its low-level capabilities, SoftICE is also popular as a software cracking tool.

Microsoft offers two kernel-mode debuggers, WinDbg and KD, for no charge. However, the full capabilities of WinDbg and KD are available only when two interlinked computers are used. SoftICE therefore is an exceptionally useful tool for difficult driver related development. The last released version was for Windows XP. Newer versions of Windows are seemingly unsupported as the tool is no longer listed on Compuware's website.

Older versions exist for DOS and compatible operating systems. SoftICE was originally produced by a company called NuMega, and was subsequently acquired by Compuware in 1997, which in turn sold the property to Micro Focus in 2009. Currently, Micro Focus owns the source code and patents, but is not actively maintaining SoftICE.


"Soft" refers to software, and the "ICE" part of the name is an allusion to in-circuit emulator.


The original SoftICE for DOS was written in 1987 by NuMega founders Frank Grossman and Jim Moskun. The program, written in 80386 assembly language, played the role of an operating system and ran software in virtual 8086 mode. It sold for $386.

SoftICE/W (for Windows) was developed in the 1990s, and was instrumental in the Writing of "Undocumented Windows", by Andrew Schulman, David Maxey and Matt Pietrek. SoftICE/W was derived from an earlier, lesser known product, SoftICE for Netware (32-bit protected mode). One of the key advantages it had over Microsoft's debuggers is that it enabled single machine debugging, rather than requiring a second machine to be connected over a serial port.

The principal developers of SoftICE were Dom Basile ('Mr. SoftICE'), Tom Guinther (Kitchen Sink, Symbol Engine), Gerald Ryckman (Video Drivers and Kitchen Sink), Ray Hsu (Video Drivers W95), and Dan Babcock (SoftICE/NT 3.1/3.5: Universal Video Driver, Symbol Engine), with contributions by a variety of NuMega developers including Frank Grossman, Jim Moskun and Matt Pietrek.

In 1998 the codebase for SoftICE/95 was ported to run on the Windows NT platform.

Newer versions of SoftICE patch deep into Microsoft Windows. As such, old versions of SoftICE are rarely compatible with new versions of Windows. Compuware therefore offered SoftICE as a subscription so that it could be kept up to date and in sync with the latest Microsoft Windows version.

It used to be offered as part of Compuware's DriverStudio package but was discontinued in April 2006.


As of April 3, 2006 the DriverStudio product family has been discontinued because of "a variety of technical and business issues as well as general market conditions". Maintenance support was offered until March 31, 2007.

Anti-SoftICE measures

Software vendors have put in place a wide range of countermeasures to protect themselves from people employing SoftICE as a tool to analyse software.

For example, here is code some vendors used to detect the presence of SoftICE running in the same machine as an early countermeasure:

    mov eax, dword ptr [pIDT+2] ; eax -> IDT
    add eax, 8                  ; eax -> int 1 vector
    mov ebx, [eax]              ; ebx == int 1 vector
    add eax, 16                 ; eax -> int 3 vector
    mov eax, [eax]              ; eax == int 3 vector
    and eax, 0ffffh             ; strip the selector
    and ebx, 0ffffh             ; part of it
    sub eax, ebx                ; find displacement
    cmp eax, 10h                ; 
    jne HackedVector            ; if it isn't equal, then chances are
                                ; SoftICE had tampered with these vectors

More and better such measures have evolved since. While most of them can only deter the less experienced and determined hackers, SoftICE is no longer a tool of choice for someone new to analysing software.

Today vendor's defenses are based on more sophisticated packers/protectors, e.g. Themida, Armadillo or ASProtect which pack the program code and tamper with entry point addresses so it is hard to find the program's original entry point (OEP). That is also true for the program's import address table (IAT). However tools for hiding SoftICE are also available, such as IceStealth and IceExt for Windows NT, or Icedump and IcePatch for Windows 9x.[2]


A commercial kernel-level debugger called Syser claims to continue where SoftICE left off.

A shareware but free to use OllyDbg is a 32-bit assembler level debugger from Oleh Yuschuk. However, it can only be used for user-mode debugging.

An open source kernel debugger similar to SoftICE named Rasta Ring 0 Debugger (RR0D) is available;[3][4] it provides low level debugging for Microsoft Windows, Linux, OpenBSD, NetBSD, and FreeBSD. This project does not seem to be actively maintained; as of April 2014, the last change in its GitHub source code repository occurred in December 2008.[5] LinICE is another kernel level debugger with SoftICE look and feel, also as of 2011 not updated for several years.[6] HyperDBG is a kernel-level debugger leveraging hardware-assisted virtualization, as of 2011 last uploaded in May 2010.[7]

A debugger called BugChecker is a 32-bit single-host kernel debugger for Windows 2000 and XP developed and made available as open-source for educational purposes. BugChecker allows users to trace into both user and kernel code, both on uniprocessor and multiprocessor versions of Windows 2000 and XP.[8]


  1. ^ NuMega SoftICE 4.05 Release Notes
  2. ^ "Category:SoftICE Extensions - Collaborative RCE Tool Library". Retrieved 2014-04-24. 
  3. ^ "RR0D/Presentation - Wikidroids". Retrieved 2014-04-24. 
  4. ^ "Rasta Ring 0 Debugger (RR0D) - Collaborative RCE Tool Library". 2007-10-18. Retrieved 2014-04-24. 
  5. ^ joe. "ice799/rr0d". Retrieved 2014-04-24. 
  6. ^ "The Leading Li Nice Site on the Net". Retrieved 2014-04-24. 
  7. ^ "hyperdbg - A kernel debugger that leverages hardware-assisted virtualization - Google Project Hosting". Retrieved 2014-04-24. 
  8. ^ "BugChecker". BugChecker. Retrieved 2014-04-24. 

External links

  • Eulogy for SoftIce
  • Collection of SoftICE extension
This article was sourced from Creative Commons Attribution-ShareAlike License; additional terms may apply. World Heritage Encyclopedia content is assembled from numerous content providers, Open Access Publishing, and in compliance with The Fair Access to Science and Technology Research Act (FASTR), Wikimedia Foundation, Inc., Public Library of Science, The Encyclopedia of Life, Open Book Publishers (OBP), PubMed, U.S. National Library of Medicine, National Center for Biotechnology Information, U.S. National Library of Medicine, National Institutes of Health (NIH), U.S. Department of Health & Human Services, and, which sources content from all federal, state, local, tribal, and territorial government publication portals (.gov, .mil, .edu). Funding for and content contributors is made possible from the U.S. Congress, E-Government Act of 2002.
Crowd sourced content that is contributed to World Heritage Encyclopedia is peer reviewed and edited by our editorial staff to ensure quality scholarly research articles.
By using this site, you agree to the Terms of Use and Privacy Policy. World Heritage Encyclopedia™ is a registered trademark of the World Public Library Association, a non-profit organization.

Copyright © World Library Foundation. All rights reserved. eBooks from Project Gutenberg are sponsored by the World Library Foundation,
a 501c(4) Member's Support Non-Profit Organization, and is NOT affiliated with any governmental agency or department.