i have only come across this problem twice so far, but a new protector has been brought to my attention (non-commercial), that manages to crash /tracex every time. im just interested as to why/how this could be happening. Is it detecting icedump some how ???

NchantA

P.S i might be able to get a copt of a protected file uploaded with permission, if anybody has the want/need

Hi NchantA

Dont need icedump myself ................of course I do Owl , thanks

Maybe the detection is a Timer bomb , single stepping sloooooows the code a lot, so a few appropriate timers in protected codewoods while you have a cup of coffee waiting for the /tracex range to pop ......well, the programmer could do terrible things to his own code if his Timer call returned more than a few milli-secs range ????

I don't see how they can detect 'Icedump' cos it's fully protected against any vxd access (like Bi-Tarts tried that one, duh )


Maybe set a BPX SetTimer ? and trap it. Just a thought :-)

+Spl/\j

in /tracex U R not in SI...... just stepping code slower....it's just a thought about timing detection difference from point 'A' in the code to point 'B' by me. We need the target to play with NchantA

hey maybe we should delete this thread about defeating Icedump !!!

+Spl/\j

Yes NchantA, upload it there. I'll raise the max upload limit to 1meg for non starting members. This file interests me a lot as I am actually exactly protecting rv's tracer against detection.

cia,

tsehp

im waiting for the author to agree to give to u guys s/he probably will, but i take no chances ;P

it is a beta i *think*, and just in case it was a fluke im going to try and tracex it again tonite :P

send me a sd2 cd or prog and I'll tell you

hi dudes, u guys talk bout my protector *GRINS*
oh i can detect icedump (it's really easy)
iam almost sure that u guys already have the file...
so go and destruct it

^DAEMON^ [UG2000/MYTH]