Foxthree pointed out that he no longer got the "Xhandledexception" message in his softICE logs - at least I didnt get it.

This brought to my attention that I had missed something, so I ran +Splaj's detector and lo behold it detected thru "Int 3 on Kernel32!UnhandledExceptionFilter".

I've removed the UnhandledExceptionFilter reference now, and it's clean (Still, except for int 1).

Get the fix here.

http://www.woodmann.net/forum/showthread.php?s=&threadid=4031

or Here as an attachment


My apologies to everyone who already downloaded.

Speaking of Int 1 detection, couldn't you just write a SI macro that increments the EIP to the right location before continuing...works on evaluator's modifed version of ^Daemon^'s detector. Perhaps would work reliably?

-nt20

kernel32!ZnhandledExceptionFilter
kernel32!ZnhandledExceptionFilter
kernel32!ZnhandledExceptionFilter
kernel32!ZnhandledExceptionFilter
kernel32!ZnhandledExceptionFilter
kernel32!ZnhandledExceptionFilter
kernel32!ZnhandledExceptionFilter
kernel32!ZnhandledExceptionFilter
kernel32!ZnhandledExceptionFilter
TRACER: Entering DriverEntry
TRACER: Initialisation done...
TRACER: Unloaded
kernel32!ZnhandledExceptionFilter
kernel32!ZnhandledExceptionFilter
kernel32!ZnhandledExceptionFilter


???

I wouldnt worry about it. The whole point is to hide SI....nobody said it would work 100% like normal.

You can change the name back if you want to and it wont do that anymore. If you encounter a program that checks for it, you can always change it again.

Dont forget, if you are modifying a system driver you need to correct the checksum after you mod it. Use LordPE.


-nt20

Hi Tesla:

If you refer to my earlier post, I said I did get the "Unhandled Exception Handler" strings in the log window with 2.6 anti-detect patch and that I would test your patch with 2.7 and then let you know. May be typo????

Anywayz, I got caught up in something and couldn't test it but Player's logs shows same stuff! May be not a "problem" per se but just annoying

Signed,
-- FoxThree

@nikolatesla20: Thanks for your job, but I have a problem with that In any situation under 2k I could not manage to make sice 4.2.7 menu visible but it is in there same problem with 4.2.6 and your 4.2.6 patch...in unpatched mode there is no problem. I guess it is related to NTICE.SYS, thanks

um, what do you mean "softice menu" ?

Do you mean the actual softice screen?


If you mean the actual screen, make sure you are patching all 3 files included in the zip. The SoftICE video driver gets a name change, so ntice.sys need to also know the new name to work.



-nt20