Hello there,

I've been trying to unpack activemark packed executables for a while and after seeing I'm not the only one who's interested in this protection, I've decided to start a thread about it.

First, I must say that I'm a lazy guy so I searched for a tutorial before trying to do the job myself. Found one in russian. The guy used TRW2000 as a debugger but when I tried, I wasn't able to unpack anything using that debugger. So I started working on it myself.

I started SoftICE. What a surprise! The game wouldn't even start up. So I searched on forums if I could find any info about any anti-debugger tricks it used (still lazy guy tendencies)

What I got now is this :

1. It uses MeltICE as it's primary SoftICE detection trick.
2. Next, it tries to find SoftICE using INT3.
3. It also uses the "Crush the Frog" variant of MeltICE to prevent FrogSICE from working.

(Thanks Buntus for the info).

So I fired up ICEDump. BTW, I never was able to get ICEDump to work until I installed Driverstudio 2.6 . Don't ask me why, it just wouldn't hook up with prior versions while it magically hooked up with Driverstudio 2.6 .

I tried again starting the game. Seemed to start but BOOM! Page Fault. I killed the process in SoftICE then GPF in Ring 0 so I did continue and YESSS, BSOD! But this BSOD was kind of harmless so I continued my debugging session.

What was the problem. SoftICE was well hidden. Why did it crash? So I searched and searched and searched. And then I found on hxxp://www.reverse-engineering.net a nice little proggie named BANG! And right in the readme were these lines :


And guess what : Activemark is using this kind of trick too. So I tried firing up BANG! but it wouldn't work with ICEDump already hiding SoftICE; so I unloaded ICEDump first and then I fired up BANG! and YESSS, the game started.

So what was left to do was to make a version of BANG! which wouldn't check whether SoftICE was loaded or not and would do it's trick anyway (in order to start BANG! on top of ICEDump).

The modification is fairly trivial since the source code is included and I leave that up as an exercise to you. Oh yeah, this program is for Win9x only. WinNT and Win2k users you're on your own (but I read on another topic that IceExt works). And WinXP users, what are you waiting to ditch that CrapOS

WARNING : The modification I suggested in the previous paragraph is dangerous and not fully tested. For instance, if you start BANG! two (or more) times in a row and then start an ActiveMark protected executable, there's a high chance your computer is gonna freeze (at least mine did). Fortunately, starting BANG! on top of ICEDump seems to work fine.

Oh yeah, I almost forgot : a great many thanks to r!sc for his program and his info about int01 and int03 displacement.

It seems I celebrated too fast about being able to run the sucker through SoftICE. Trymedia seems to have included some code that corrupts SoftICE. Just try setting a breakpoint and single-stepping, you'll end up in some code in VMM. This behavior occurs even when you set a breakpoint on a windows API. Shut down the Trymedia protected app and SoftICE works Ok again. Start another and whoops.

Nevertheless my previous post remains valid with one exception, Activemark doesn't use the INT3 return value to detect SI, it merely uses the displacement between INT1 and INT3 (in addition to MeltICE).

Does anyone have a solution which would allow to single step in SI while a Trymedia application is active?

Install windows 2K. use IceExt
and concentrate on the real part of the protection.

FF15 / FF25 mangling.

I didn't look at it since the other day, but noone apparently did either.
evaluator, giving up ? :-)

IcePatch v2 + Bang! will hide Sice on Win9x, works fine for me.