Log in

View Full Version : Visual SoftIce


naides
October 28th, 2005, 22:45
I just wanted to comment/ask if anybody has given a try to running Visual SoftIce (4.32) in VmWare and/or two networked computers. . .

I had tried in a VMWARE 5.0 VM running XP sp2 following the tutorial published by Neitsa (referenced somewhere in this board)
At face value it appeared to work, but I did not pursued it too much (Real Life got in the way)
Recently I tried a more complex reversing project and could not make it work:

For instance, bmsg break points do not stick, hardware breakpoints regularly and irreversibly freeze the target system, and above all, it is slow as hell

I figured it was little too much for the system but a P4 with 1.5 GHrtz and 1 gig of ram does not sound like a small system to me, but hey

I tried with two computers/IP connections. . .

Same problems with bp, very slight improvement in speed.
I wonder if in my haste and ignorance I am not setting things right.

has someone tried visual Sice and could give me some pointers?

Yes I read the forking manual.

WaxfordSqueers
October 30th, 2005, 20:03
Quote:
[Originally Posted by naides]I just wanted to comment/ask if anybody has given a try to running Visual SoftIce (4.32) in VmWare and/or two networked computers. .


I was hoping you'd have some replies by now because I'm interested in the scenario you describe. I'm trying to translate Neitsa's article related to it and get the gist of it. Trouble is, I'm running VMWare 5 on a 2 gig Celeron with 512M RAM and it's very slow. I have XP loaded as the guest system and when I try to play a simple game like Spider Solitaire, it's slow and very jerky.

Maybe we should investigate as to whether VMWare 5 has problems first. I have Micro$oft PC 2004 running Win 98, and the Solitaire game on it is very fast. I'm thinking of loading XP on it to see the result.

You may have come across this URL in your own search: h**p://silverstr.ufies.org/lotr0/index.html which is referenced from: h**p://silverstr.ufies.org/lotr0/windbg-vmware.html. Both are using WinDB on a host and setting up for remote debugging on VMWare. They are uaing the same approach as Neitsa, but there are some differences that may be important.

Maybe there is another tute by Neitsa, but the one I found is in French and it doesn't specify exactly what version of Softice he's using. I still haven't found one aimed specifically at Virtual Softice.

naides
October 30th, 2005, 21:56
Hi wax, thank you for your answer.
I will try a smaller OS in the VM and see how it goes.
I understand Neitsa's tut language, and actually, http://silverstr.ufies.org/lotr0/windbg-vmware.html page appears very similar, perhaps based in Neitsa's.

By the way he is setting the target Sice he is not using Visual Softice but the console app. Perhaps that is one of the problems.

WaxfordSqueers
October 31st, 2005, 02:15
Quote:
[Originally Posted by naides]I will try a smaller OS in the VM and see how it goes.---snip---By the way he is setting the target Sice he is not using Visual Softice but the console app. Perhaps that is one of the problems.


It's worth a look through the Visual Softice Manuals. It describes how to set up under VMWare in a fair amount of detail. On page 1 of the 'Using VSI.pdf', it seems to say that VI wont work on the win 9x variety. It seems to be aimed at 2000, XP and the servers, as well as 64-bit apps.

Of course, I was trying to set up with VI on the main machine, and I got everything going OK except it couldn't find the named pipe. By that time, I was getting hits from the net from spammers trying to sell me something. The VI driver seems to be opening up ports, but luckily Sygate caught them. I was using a virtual serial port because I didn't want to mess up my NIC just yet. You might want to check your firewall as a source of interference.

Anyway, look at the document, 'Visual SoftIce Help', and on the first page there are blue highlighted links. Near the bottom of the page, one of them is called 'Using Visual Softice With VMWare'.

It does say somewhere in there that VI can be used with the VM as host. The mistake I may have made was not loading a VI target token on the VM. I don't know if you have to.

LLXX
October 31st, 2005, 02:50
Quote:
[Originally Posted by WaxfordSqueers]I was hoping you'd have some replies by now because I'm interested in the scenario you describe. I'm trying to translate Neitsa's article related to it and get the gist of it. Trouble is, I'm running VMWare 5 on a 2 gig Celeron with 512M RAM and it's very slow. I have XP loaded as the guest system and when I try to play a simple game like Spider Solitaire, it's slow and very jerky.

You may wish to overclock your Celeron to 2.5 or so and expect roughly 25% faster. Unless, of course you've already overclocked it.

WaxfordSqueers
October 31st, 2005, 07:31
Quote:
[Originally Posted by LLXX]You may wish to overclock your Celeron to 2.5 or so and expect roughly 25% faster. Unless, of course you've already overclocked it.


From what I'm seeing in performance from VMWare, on my present machine, I don't think 500 Mhz would make a significant difference. It's like going back to an old 386. I may be dead wrong, and I hope I am, but I feel it's just asking too much of a basically single-threaded machine to do everything asked of it. As I said in a previous post, Win 98 seems to get by, but I ran a game under it once on Microsoft VM and it was jerky and sticky in places.

Also, I mentioned above that I had tried Spider Solitaire on VMWare 5 with XP and it ran incredibly slow. I tried just straight solitaire and it was much more responsive. Maybe Spider is written in bloatware.

----digression----started thinking about what I was saying. I tried to run Spider Solitaire from the XP disk in Win 98 on the Microsoft VM and it wouldn't load. Said it wasn't a valid 32 bit app. I loaded it in IDA and it sure looked like a 32 bit app, with it's MZ header and PE header. But there were exports in the space between the end of the PE header and the start of code

Haven't got time to get into it tonight, but it states at the end of the app's code in a hex editor that it can't be run on Win 95, 98 or Millenium. That's a new one on me. Don't worry, JMI, I'll check the archives in the morning.