; ; ; u must have soft-ice loaded !!!!!! .586p .Model Flat extrn ExitProcess : PROC extrn MessageBoxA : PROC .Data caption db "daemon@I.LOVE.YOU.COM",0 text db "You have traced me!",0 text3 db "good boy!!!!",0 text2 db "Hey guy, iam sorry but there occoured an exception!",0 .Code Main: lea eax,tracer ; pointer to my tracer push eax push dword ptr fs:[0] mov dword ptr fs:[0],esp ; set new exception handler int 1 ; cause single step exception lea edx,text xor eax,eax mov eax,dr7 cmp eax,0 jz it_doesnt_worx lea edx,text3 it_doesnt_worx: push 0 push offset caption push edx push 0 terminate_tracer: call MessageBoxA call ExitProcess tracer: mov eax,[esp+04h] ; pointer to exception record mov eax,[eax] ; get exception code cmp eax,80000004h ; was it an single step ??? jne quit mov eax,[esp+0ch] mov ebx,[eax+0b8h] cmp word ptr [ebx],0210fh ; mov ?,dr7 je do_it cmp ebx,offset terminate_tracer ; i don't want to trace my ; api calls je dont_set_trap_flag trap_it:or byte ptr [eax+0c0h+1],00000001b ; enable trap flag dont_set_trap_flag: xor eax,eax ret quit: push 0 push offset caption push offset text2 push 0 call MessageBoxA xor eax,eax ret do_it: pushad mov ebx,[eax+018h] ; get debug register 7 mov [eax+0b0h],ebx ; store value in eax popad jmp trap_it End Main ;End of code, Main is the entrypoint