Detecting debugger like SoftIce

[ommy]

I know that it will still be eventually cracked but I would like to figure out a way to stump these guys for a little while. I've been thinking about ways of detecting debuggers and have been doing research on the subject.

If we can detect these debuggers we can possibly halt cracking! Here is what I have come up with:

Look for the SoftICE registry key: HKEY_LOCAL_MACHINE,"Software\\NuMega\\SoftIce"

On Win9x
- detect a debugger through the Vxd-Backdoor
- detect the WinICE handler in int68h
- detect the 'magic number' 0F386h returned (in ax) by system debuggers through int 41h, function 4Fh

Anyone have any more advice for me?

[TcM]

As for the registry... I don't think that would be effective, because there are too many debuggers out there!