Compuware Softice (DbgMsg driver) Local Denial Of Service 
	by Piotr Bania <bania.piotr@gmail.com>
	http://pb.specialised.info

	Original location: 	http://pb.specialised.info/all/adv/sice-adv.txt



	Severity: 		Low / Medium  - BSOD (Blue Screen Of Death) DOS

	Software affected:	Tested on Softice from DriverStudio 3.2 and 3.1.
				However all version with DbgMsg.sys driver installed
				should be marked as vulnerable.


	

	I.  BACKGROUND

	SoftICE is a powerful system-wide debugger that supports source level debugging 
	of any software, driver, service, and most bios code on either a single or dual 
	machine configuration.


	II. DESCRIPTION	

	On NT based operating systems Debug Messages are being sent by executing the 
	OutputDebugString API (ring3 applications) or by executing DbgPrint() function
	(also known as KdPrint(), mostly used by ring0 "applications").

	However not only kernel mode stuff can execute DbgPrint() since it is exported by 
	NTDLL.DLL - so called native calls. If we go forward we will see that actually 
	the final pass of the Debug Message is done by executing INT 2Dh, like following
	example shows:

	
	----// SNIP SNIP //-------------------------------------------------
	
	mov ecx,offset some_string	; Debug Message offset
	xor edx,edx			; second Param (NULL in this case)
	mov eax,1			; Service Type here defined as BREAKPOINT_PRINT (=1)

	int 2dh
	int 3
	nop			   <--- int 2dh returns here not to int 3

	----// SNIP SNIP //-------------------------------------------------

	When Softice is installed - DbgMsg.sys driver is loaded (user should also notice 
	that even when Softice is not active, the system is still vulnerable), executed 
	2d interrupt will be firstly filtered by DbgMsg.sys routine. This is probably 
	provided to capture are flying Debug Messages and display them into the debugger 
	window.

	However the driver doesn't validate the Debug Message pointer properly, this
	can cause an machine crash when the pointer is invalid.

	
	III. IMPACT

	Executing special crafted "int 2dh" request will cause local machine crash on 
	system with DbgMsg.sys driver installed, *even* when Softice is not active.
	This attack can be also used as a very nasty anti-debugging trick against
	Softice users.

	IV. POC CODE

	Sample POC code was developed.