VitoPlantamura.com logo - Click here to go to the site home page... Click here to go to the site home page... Click here to go to the Blog page... Click here to go to the archives page... Click here to go to the about page...
"extremely impressive work"
- Mark Russinovich, www.sysinternals.com
(referring to my BugChecker)
my face...
Homepage of Vito Plantamura (@, LinkedIn), Windows Researcher and Developer. [user=Guest] - updated: August 08, 2007
 ..:: BugChecker Download Page ::..
DISCLAIMER

This software is still under development and hasn't been tested extensively (yet) on a large combination of processor architecture/operating system platform configurations. In fact there is a concrete probability that it will not work on your computer and this means, having been implemented as a kernel driver, that it will may hang your system! For this reason this software is provided 'as-is', without any express or implied warranty. Furthermore in no event will the author be held liable for any damages arising from the use of this software.

DETAILS

Version: 0.9. / Build: 107. / Supported platforms-architectures: Win2000/32bit/SP4 ONLY.

Copyright © 2003/4/5 VPC Research. All rights reserved.

INTRODUCTION

BugChecker is a MS Windows 32-bit kernel-mode SMP debugger (ala SoftICE) that is aimed mainly to reverse engineering enthusiasts. It is still under development and some features, such as full source code symbols support, have been coded but are still not exposed in the debugger itself. The purpose of this release is to give the opportunity for the very curious to evaluate a rather early version of this product.

Please consider only that being an initial version of the software, the only platform supported is Windows 2000 SP4. I'm doing this because I have focused my programming efforts (in this stage of the work) mainly on the architecture aspects of the debugger compatibility (with tests on 32-bit Intel processors) and I have postponed the fixes required to the software for running on the other Microsoft platforms other than Windows 2000 (WindowsXP/2003, Longhorn eventually.).

Consider that I have tested the software mainly on my Pentium-3 equipped machines (a Dell Inspiron 800 with a Pentium3 700MHz and a Supermicro server with two Pentium3 1GHz). I cannot guarantee that it will work (yet) on your computer! If it doesn't, please drop me a line at this address, if you want.

COMPONENTS

BugChecker consists of two components:

     BugChecker Debugger driver: this is the debugger itself. It is implemented as a Windows NT Kernel Driver. This means that you can debug with it both user mode and kernel mode code. The driver is installed in the registry with a startup mode set to "manual". This means that the debugger is not started until the user expressly starts it issuing a "net start vpcice" command.
     BugChecker Video driver: this NT Driver is required in order for the debugger to be used. Its start mode is set to "boot" and it is started when Windows 2000 is booted up. This simple driver (compared to the dubugger driver itself), when started, hooks and patches some DirectDraw API entry points in order to be notified about the current video display mode and the start in kernel protected memory of the display framebuffer. Its hooking features and actions can be inhibited at the system startup keeping pressed the "X" keyboard key (useful in the case of incompatibilities and problems of the hooking technology itself with your system).

INSTALLATION (WIN 2000 SP4)

For installing the debugger on your machine, download the zip file at the bottom of this page, run the installation executable and then click the specified link button under the paragraph named "Installation".


UNINSTALLATION

For uninstalling BugChecker from your machine, run the installation executable contained in the zip file and then click on the specified link button under the paragraph named "Uninstallation".

USAGE/FINAL NOTES

You must restart your system in order to make the Video driver start up properly. Then at the command prompt issue a "net start vpcice" command to start the debugger.

WARNING: I strongly suggest you to download from this location the always useful "sync" utility by Mark Russinovich. You should lauch it from a windows console immediately before issuing the "net start vpcice" command. This will allow to have all the contents of the file system cache of your system flushed to physical disk, in the case of a system crash.

When the debugger is loaded in the system, press "left ctrl + d" for opening it. For further informations and usage of this preliminary version, check out this address.

DOWNLOAD

Download the zip file from this location (292KB).

 Quotes
"Among the Windows experts I know personally, no one can beat Vito Plantamura."
- Francesco Balena, Code Architects SRL

"Your NDIS Monitor application, is amongst the most impressive networking code I have seen on the .Net framework."
- Ben Hakim.
 Photos
Various images from italian conferences and events (keep the mouse on a thumbnail for a short description):
Me at the Microsoft/HP/Intel organized Route64 event in Milan in May 2005, explaining how COM+ behaves on 64-bit Microsoft operating systems. I was there with the friends of Code Architects.
Me at the Microsoft Security Roadshow event in Bari in April 2006, explaining how the logon process works in Windows NT. There were 250 attendees.
Microsoft Security Roadshow 2006 in Treviso. This is an image of the huge 700-seats conference room.
Me at the Microsoft Security Roadshow 2006 in Treviso. This is a moment of the 3-hours session.
 Site login
NOTE: Actually the login feature is used only for administrative and content management purposes.
Username

Password

Everything here (code, binaries, text, graphics, design, html) is © 2010 Vito Plantamura and VPC Technologies SRL (VATID: IT06203700965).
If you download something (compilable or not) from the site, you should read the license policy file.
If you want to contact me via email, write at this address.