{"id":90,"date":"2006-12-23T11:32:35","date_gmt":"2006-12-23T11:32:35","guid":{"rendered":"https:\/\/driverentry.com.br\/en\/2006\/12\/23\/step-into-kernel-softice\/"},"modified":"2026-07-25T12:48:15","modified_gmt":"2026-07-25T12:48:15","slug":"step-into-kernel-softice","status":"publish","type":"post","link":"https:\/\/driverentry.com.br\/en\/2006\/12\/23\/step-into-kernel-softice\/","title":{"rendered":"Step into Kernel (SoftIce)"},"content":{"rendered":"
\"\"<\/a><\/div>\n

Finally back from vacation. It has been nearly six years that I did not take vacations. Traveling, visiting new places and just relaxing were my main tasks during these last 20 days. Back to work, I’ve just arrived at the company and I was amazed by it. I could not believe they sent that old one away. We exchanged glances and obviously I got butterflies in my stomach. I got close enough to be able to smell it. I looked up and down. Simply perfect and it was an injustice to leave it alone. It didn’t take long and it was under my control. I had to prove everything it had to offer. After all, there were so many choices: Coffee, cappuccino, chocolate, tea with or without sugar. But it was all an illusion. “Oh my… that’s was a horrible coffee.” My friends, appearances can be deceiving. How can so beautiful machine make so bad coffee? I confess I miss the old machine. I didn’t mean that coffee was not so good, because the coffee was really horrible! Now I’m looking for alternative ways to keep my addiction. Perhaps there are caffeine patches to sell out there.<\/p>\n

Don’t worry, this will no longer be an “Off Topic” post about changing coffee machines and the impact caused by them. In this post, which I had started last year and have just finished it now, I’ll take the steps needed to use SoftICE system debugger.<\/p>\n

\"\"<\/p>\n

I still\u00a0was new in SCUA and I was developing a GINA<\/a> for our security product. For those who do not know, Gina is one small screen that appears during the Logon in NT platform. GINA is a DLL that is loaded by winlogon.exe<\/strong> process, which has the function of making the user’s interface to perform the login in the computer. The Msgina.dll GINA is the original one, but we can build our own GINA to provide alternative ways of authentication. A practical example of this is the product True Finger<\/a> sold by SCUA<\/a>. This product changes the system’s GINA, so that, with a biometric sensor help, it makes the system ask for the user’s fingerprint to logon the system. Debug GINA requires a few atypical steps, since to test it is necessary to do Logon, Logoff and things like that. You can also debug it using the Visual Studio\u00a0Remote Debug, but at that time, debugging GINA was the need I had to learn how to use SoftICE.<\/p>\n

\"\"<\/p>\n

There were two development teams, one for Kernel\u00a0drivers and the other for applications.\u00a0I still worked on application\u00a0staff when in a meeting area, the team introduced me to SoftICE as an alternative to solve the problems about Kernel Debug I was facing.\u00a0I was using techniques such as log files and MessageBox to debug GINA.\u00a0You can imagine the MessageBox with the typical messages as “I called the X routine”, “Returning from Y routine.”\u00a0After I learned how to use SoftICE, it solved many things for me. Specially since other Ginas had to be developed and as, the time passed by, I started to develop kernel drivers.<\/p>\n

Most of the application\u00a0team had a panicked about using SoftICE.\u00a0A situation very similar to that described in my previous post.\u00a0They said: “Oh no, using SoftICE is too complicated. I will continue with the MessageBox. If I cannot solve this, then I will use a Kernel Debugger.”\u00a0I think it was just about getting used to it, SoftICE is not a rocket science and nor difficult to use.\u00a0I found it amusing when one part of the team was caught trying to solve a particular problem, that kind of strange bug that nobody could find.\u00a0I went around and asked: “Why don’t you just use SoftICE?”, “No, no, I guess it is not necessary.” they said.\u00a0Later I also\u00a0was called to help tracing the problem, and in most of the time I could, I’d picked up the problem\u00a0that they’d chased for days\u00a0in half an hour of Debug.\u00a0I’m not saying I’m super Debug\u00a0genius, or that they were technically incompetent.\u00a0I’m saying that it is only a matter of using the right tool.\u00a0You could dig a tunnel with a teaspoon, but with a shovel things would be much easier.<\/p>\n

SoftICE is part of a development package called Driver\u00a0Studio<\/strong>, which was sold by Compuware<\/a>.\u00a0For those who still do not know, Compuware has discontinued SoftICE\u00a0and we cannot count on a version of this tool for Windows Vista.\u00a0With SoftICE is possible to debug the kernel using only one machine, but the product still has the resources to do remote debug via serial ports or network adapters.\u00a0Thus, they are also adopted the names Host<\/strong> for the machine that does the Debug and Target<\/strong> for the machine that will suffer the Debug (Similar to WinDbg).\u00a0Here we will adopt the Host <\/strong>name for identifying the machine where we have the compiler and the installation type Host SoftICE. We will not do any remote debug on this post.<\/p>\n

Very briefly, we can say that SoftICE works as it follows. At the Host machine, it is necessary to create a symbol file known as NMS.\u00a0This file is copied along with the driver to be tested to the Target machine.\u00a0In it, we load the symbols and start debugging the driver.\u00a0We will describe these steps in more details next.<\/p>\n

Installing the Host Machine<\/h3>\n
\"\"<\/div>\n

Installing SoftICE on the development machine is necessary for us to generate the NMS file.\u00a0Don’t worry; you will not test your driver on your development machine.\u00a0At least not while you’re sane. During the setup process, you will pass through the typical setup screens until you reach the screen shown above where you select installation\u00a0type you want.\u00a0Because we use only installation\u00a0Host portion, select that option and skip to the next screen. Select only the option “SoftICE Host\u00a0Components”, so that it appears on screen as below.\u00a0The remainder of this process is next, next…<\/p>\n

\"\"<\/div>\n

Installing the Target Machine<\/h3>\n

We will use the test machine in a way that it is not necessary to have two machines to do the debug, and so we will explore this feature that is usually used.\u00a0To do this, select the “Full Instalation” in the first screen,\u00a0then select only “SoftICE Host Components” items\u00a0and “SoftICE Target Components” as it is shown below.<\/p>\n

\"\"<\/div>\n

In this case, at the end of the register and file copy process, we will have to set some debugger\u00a0properties.\u00a0The first group of settings refers to initialization.\u00a0We will select the Manual startup at this moment.\u00a0All these settings can be changed after the product is installed.\u00a0The setup screen should be as shown below.<\/p>\n

\"\"<\/div>\n

The next group will be about general settings.\u00a0In this item, we will change the field “Initialization” to stay with the configuration shown below.\u00a0These are commands that are executed when the debugger is started.\u00a0Each command is separated by a semicolon.\u00a0These commands will make the following changes:<\/p>\n