Hiding process from SoftIce

[Athlon]

I need to hide process from SoftIce - possible?
All variants which I have found can not do it. That on this cause gurus think?

[sreehari]

hi .....


this workis for Win 95.... but for the other OS not sure :-D
hope this code snippet helps ya....


Function call

RegisterService(1); //hide the thing!!!

Put this in your header file

//Hide program (Makes it look like a process)
typedef DWORD __stdcall (*TRegis)(DWORD,DWORD);

int RegisterService(int); // hide

//--------------------------------------------------------------------------
-
int RegisterService(int Reg)
{
HINSTANCE hKrnl32;
//This is the location of the kernel32.dll file. It should default to
the
//windows\system directory.
LPCTSTR RspDllName="C:\\Windows\\System\\Kernel32.dll";
LPCTSTR RspName="RegisterServiceProcess";
DWORD Ret;

//Load the kernel32.dll file
hKrnl32 = LoadLibrary(RspDllName);
if (hKrnl32 != NULL)
{
TRegis RegisterServiceProcess = (TRegis) GetProcAddress(hKrnl32,
RspName);
if (RegisterServiceProcess !=NULL)
{

//When you register the process it will not show up in the
//ctrl+alt+del. When you unregister it, it will show up.

Ret = RegisterServiceProcess(NULL, Reg);
}
else
{
return NULL;
}
FreeLibrary(hKrnl32);
return Ret;
}
else
{
return NULL;
}

}


regards...

[Xatrix]

I guess you could somehow hide it from being detected by SoftICE, but what about other debuggers where you explicitly launch a process right in the debugger IDE ? Like OllyDbg for instance. Also, inserting code to detect the presence of SoftICE is rather poinltess as well, because there is of course other plug-ins/tools to hide SoftICE from being detected :rolleyes:

I'm just giving then facts, and the facts state "You can run but you can't hide" ;)