Softice - short introduction
                         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

                                 by Renegade


Using the right keys:
^^^^^^^^^^^^^^^^^^^^
After having set up winice.dat these are some basic keys: 
(by default):

CTRL+D: will pop up Softice itself
X (F5): leave Softice

CTRL+UP : moves window up
CTRL+DOWN : moves window down

UP : displays previous command
DOWN: displays next command

SHIFT+UP : Scroll line up in display
SHIFT+DOWN : Scroll line down in display

EXIT: Forces an exit.Doesn't work in ring0
HBOOT: Will re-boot the computer

D + address + length : will show you the data contained in specified
                       address.default is DS.In the same way you can
                       use DB,DD,DW...

GENINT + INT : Generates an interrupt

WC + size : modifies size of code window

WD + size : modifies size of data window

 -------------------------------------------
|For the rest just give a look at the manual|
 -------------------------------------------



Important API's using Softice:
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

FILES:
^^^^^
CreateFile       ; creates a file
ReadFile         ; reads from file
WriteFile        ; writes to file
SetFilePointer   ; moves file pointer


REGISTRY:
^^^^^^^^
RegCreateKey(Ex) ; creates a key in registry
RegQueryValue    ; gets info on value
RegOpenKey       ; opens key
RegCloseKey      ; closes key


WINDOWS AND DIALOG BOXES:
^^^^^^^^^^^^^^^^^^^^^^^^

createwindow       ; creates window
ShowWindow         ; shows states of window (minimized...)
GetWindowPlacement ; infos about position
CreateDialog       ; creates dialog box
DialogBox          ; creates dialog box resource


MESSAGE BOXES:
^^^^^^^^^^^^^

MessageBox        ; displays msgbox
MessageBeep       ; plays waveform

DIRECTORIES:
^^^^^^^^^^^

GetCurrentDirectory   ; gets info about current dir
GetSystemDirectory    ; gets windows\system dir
GetWindowsDirectory   ; gets \windows dir


GETTING TEXT / DIALOG:
^^^^^^^^^^^^^^^^^^^^^

GetWindowText  ; gets text of current window
GetDlgItemText ; gets text of dialog box

DISPLAYING A TEXT:
^^^^^^^^^^^^^^^^^
Textout     ; writes character string
DrawText    ; displays formatted text
SendMessage ; sends mex to window


CD-ROM DRIVE:
^^^^^^^^^^^^

GetDriveType           ; gets type of drive
GetLogicalDrives       ; infos about available disks
GetLogicalDriveStrings ; get valid drives


GETTING TIME:
^^^^^^^^^^^^
GetLocalTime    ; gets time + date
GetSystemTime   ; "expressed in Coordinated Universal Time (UTC)"
CompareFileTime ; compare times


STRINGS:
^^^^^^^

hmemcpy       ; gets everything's copied
lstrcpy       ; copies string
lstrcat       ; appends string
CompareString ; compares two strings




Practice: Using Softice to crack a program (Example on WinRAR 2.06)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

winrar.exe

Let's set a breakpoint on MessageboxA (bpx) and try to register the program.
Pressing F11 we'll return to this code:

* Possible Reference to String Resource ID=00106: "Registration failed"
:004140FC 6A6A                    push 0000006A
:004140FE E8D25E0000              call 00419FD5
:00414103 59                      pop ecx
:00414104 50                      push eax
:00414105 FF7508                  push [ebp+08]

* Reference To: USER32.MessageBoxA, Ord:0000h
                                  |
:00414108 E83BFE0000              Call 00423F48
:0041410D 33D2                    xor edx, edx

Now we have to search for a compare, a test or something that checks our
entered stuff.

Scroll up and you'll find this interesting piece:

:004140E5 E8F762FFFF              call 0040A3E1
:004140EA 83C408                  add esp, 00000008
:004140ED 85C0                    test eax, eax
:004140EF 7532                    jne 00414123


Now, if you want to change this jump (offset 136eF) you'll see that you'll
get a positive mex after registration, but the program is not registered
at all.This would correspond to a deadlisting with WDASM, following the
registration string reference.
Some features are still not available to the user.

So set a bpx on such a feature,like logging errors to files, we'll return
to:

* Possible Reference to String Resource ID=00051: "Available in registered 
version only"
                                  |
:00413A2A 6A33                    push 00000033
:00413A2C E8A4650000              call 00419FD5
:00413A31 59                      pop ecx
:00413A32 50                      push eax
:00413A33 53                      push ebx

* Reference To: USER32.MessageBoxA, Ord:0000h
                                  |
:00413A34 E80F050100              Call 00423F48
:00413A39 6A00                    push 00000000


Scroll up to the first comparison:

:00413A16 833DE046420000          cmp dword ptr [004246E0], 00000000
:00413A1D 7534                    jne 00413A53

So winRAR compares a memory location.We'll set a breakpoint on it.
BPM 4246e0.

Otherwise you could have changed also the jump, so you will be able to use
all the features of the program.

Anyway, using the bpm method you'll get to a break at startup, where you
should find an AND ECX,00000001
the result of it will be only 1 if both of the operands have the value 1.
So just change to to an OR ECX,00000001, so the result will be always 1.