Ring0Crackme

This time, in new article, I’m not going to talk about any comercial protection. This time I will talk about one interesting crackme from www.crackmes.de which was submitted by Ms-Rem. This crackme has a lots of nice features that make it very very interesting, some of them are IDT/SDT hooks, rootkit tricks to hide process, usage of \Device\PhysicalMemory, 2 process execution, APC, etc…

In this tutorial I’ll cover most of stuff handled by crackme and show you my steps for bypassing it. Also you will see some neet tricks when it comes to softice antiJ , also this will maybe help you to understand how SoftICE can coexist with drivers that hook IDT. Anyway, before we start I wanna say that this crackme is real master piece, and big tnx to Ms-Rem for this crackme.