<TABLE width=500>
D( v3 N/ k2 I6 w; b: e% a6 I! c; i<TBODY>
" G/ r! H0 C+ P( v, F4 @<TR>
" Y) ?$ r( F0 C$ s+ Q/ I$ B& }<TD><PRE>Method 01 * Q' p w S0 v# Q
=========; u; @6 {! A }1 J+ C- X
}$ c' S; Y2 c7 lThis method of detection of SoftICE (as well as the following one) is
9 K5 {' ?% n1 G- [) C5 M* qused by the majority of packers/encryptors found on Internet.7 q0 ^% y0 T+ J& G" ~# O
It seeks the signature of BoundsChecker in SoftICE
0 J0 U3 ^* l5 L$ |# {; p% u2 L2 Z7 O. q
mov ebp, 04243484Bh ; 'BCHK'2 f k1 S/ a5 g
mov ax, 04h8 l& m1 e' \5 h0 a/ Q2 b; q$ c6 v
int 3 4 Q$ n/ ~- `5 {+ O( E
cmp al,41 [5 f8 b; K2 g; s: G9 O
jnz SoftICE_Detected
- ^% ~$ k* L' w( K+ ^% @9 d
# W; e3 I7 z3 S$ _$ T___________________________________________________________________________- Y5 S& v8 U+ u" _6 _
) S+ D. B& ^% D) C% L' h+ V& kMethod 02
6 y8 \9 O* W c=========$ B$ b2 M! H s& ]2 D. ^+ i! g
& Z# r3 k+ F) q4 f9 q+ f% aStill a method very much used (perhaps the most frequent one). It is used
. N4 A2 x: Z4 ?; x3 h/ k) T6 a, Dto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
+ }0 k( E6 b7 n1 Y- gor execute SoftICE commands...
1 n5 D1 p) V ^* X" FIt is also used to crash SoftICE and to force it to execute any commands* N2 Y/ X, Z& ?, M& L
(HBOOT...) :-(( * p1 M$ S: R" e. j, \
$ d8 e# J! `8 x* B( F3 N
Here is a quick description:8 w, {6 W1 N( I
-AX = 0910h (Display string in SIce windows)
0 g/ m; i K1 i+ E2 ^& P7 J-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
2 K& O: J! t) d" t6 A8 w$ ^0 _-AX = 0912h (Get breakpoint infos)! ]. H- M d u$ o$ k3 P
-AX = 0913h (Set Sice breakpoints)
* }9 P: p% C0 j0 V) C-AX = 0914h (Remove SIce breakoints)
- U' q5 z7 M; d2 h7 b+ h) A- |+ ]1 E+ Q( x* g
Each time you'll meet this trick, you'll see:: M/ W/ Y0 d: B2 M
-SI = 4647h
* v) B3 `3 E2 _( \1 C. f-DI = 4A4Dh
- T4 I) V2 L: u! m3 {Which are the 'magic values' used by SoftIce./ B4 N0 J8 U% \4 Q) P: E' t
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
/ L& W. q R0 b" X# F- g: W- d5 r7 D3 W8 R7 p+ r& A7 a- U& w7 j
Here is one example from the file "Haspinst.exe" which is the dongle HASP: I) e2 u, Z2 G* ]
Envelope utility use to protect DOS applications:
# S) K$ ^9 Z3 W; a" C D7 l
2 ?* J- I% x" u7 s0 w" h( j2 y6 s% E% Q' ]9 z5 ?
4C19:0095 MOV AX,0911 ; execute command.' w+ m2 @4 Y- s3 O3 O
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).1 x2 L0 s) i; j5 O* M! K4 k
4C19:009A MOV SI,4647 ; 1st magic value." C* i2 E8 q8 Q% j# M
4C19:009D MOV DI,4A4D ; 2nd magic value.
- g9 m& C8 y( g% E1 D/ q. R# B S: J4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)- w% U+ n; L2 T, M7 [
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute4 F7 |' d4 L( w; i& X) a2 _; f
4C19:00A4 INC CX
4 V& X* S8 M$ d+ W1 x. t) d( R' u4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
0 r$ C0 `7 l( d7 f4C19:00A8 JB 0095 ; 6 different commands.
% M; G1 K& Y K) Y3 c7 f$ [" _4C19:00AA JMP 0002 ; Bad_Guy jmp back. ]2 D4 U, U" L2 e) W$ [0 m, f
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)4 D: n' V# S- x$ [; T: a( }
7 L7 i3 z' D" h* u, [4 u& k
The program will execute 6 different SIce commands located at ds:dx, which9 s$ C1 a7 i( p+ T
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.- L) ~' D. D% d
& Q* j* v( B9 G% S4 ^
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.; V$ G. \# B& A" W3 ~: O* r/ `
___________________________________________________________________________
' ^+ e, h! @; j. }/ E( ~% K& @4 a& G* K B7 n
( D3 d7 L4 v7 k m: l3 {. TMethod 03/ L7 r5 W9 l g( f3 q
=========
' `0 g; e) c; A0 c; R1 a6 b8 d
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h$ u" h' X6 t6 R2 W
(API Get entry point)
- ]) c3 ]9 D: `4 S
- \$ g" P" Q6 B+ _0 l" c- c" j. S
1 o1 v% Z. h) R9 y& ^) z4 Q- K xor di,di
$ o4 C, M( P5 \% t* p2 H mov es,di! |/ V! Z* P8 @# V. @- T
mov ax, 1684h - J6 P% m' z+ V& r+ X* D
mov bx, 0202h ; VxD ID of winice; H& P; C: o7 C" i1 x2 u; q
int 2Fh
# B3 K4 U1 o: V mov ax, es ; ES:DI -> VxD API entry point
. _0 D2 _7 a; t/ Z, z- V* L- _/ A add ax, di
% `) E% O, i$ {# E test ax,ax
, l# Q( n5 w$ `4 O0 c jnz SoftICE_Detected
4 t% u+ d6 Y) Q- A7 m0 y' @$ B8 Z, f5 o6 _, ]: Y% t
___________________________________________________________________________! g0 d$ @7 e2 S) m0 L: l
N& @2 U7 a9 Q5 `- `' y# {7 p lMethod 04
5 f# ?4 ?; ^& a! M' v=========
9 ?- f% K- q/ Y. d% C7 j$ P: Y4 l* j
Method identical to the preceding one except that it seeks the ID of SoftICE
4 d/ G- Y' F2 G# G) r3 c1 aGFX VxD.! S) |7 q5 D; U
/ f7 w7 w/ i8 j1 D$ ]/ C! s# K. X& j
xor di,di
+ V j: N1 x' \ mov es,di% [/ J) `2 T- ~2 ^3 C! }+ `) t
mov ax, 1684h 9 e; g9 v1 a/ i5 B9 |7 v
mov bx, 7a5Fh ; VxD ID of SIWVID
6 K, ?3 b3 N- e8 B int 2fh* f8 ]5 R# H5 w- q0 d+ }6 @
mov ax, es ; ES:DI -> VxD API entry point3 R& G6 i5 o1 o2 ?) v
add ax, di
! `. j+ L1 H9 [& ]$ ]' b( b test ax,ax- B, \5 c% Z" z5 ^& B' r
jnz SoftICE_Detected1 l) A# m& `1 o1 @1 [6 m0 ]( L
! I1 o& y U- O' H1 S2 f__________________________________________________________________________6 I5 T2 O! ~* T/ Y& ~
5 X% k' l2 t! `. w( q
- x0 O/ {& B* k) UMethod 05
8 H$ t. V9 i/ F. w$ X=========
- [6 u2 n( ~0 x" k" ~0 k) C$ e. s7 Q( N" l; G* o4 ~
Method seeking the 'magic number' 0F386h returned (in ax) by all system
& a7 ^" e( [7 @& X( ~, T3 |; _debugger. It calls the int 41h, function 4Fh.' ?. y* l( I1 F3 T( K$ K: y9 {
There are several alternatives. 4 E1 s6 m( Y( r; n" B% Y0 L
: f/ ^# k5 O( X( e: k w rThe following one is the simplest:7 @8 f. D ~+ R9 m' v0 U" _0 P
7 ?5 z$ y `, W5 n7 e
mov ax,4fh1 E/ o' C& s( e& Q
int 41h
- t7 w( Q; L; A. M+ y' p6 s cmp ax, 0F386
0 U9 ?; [( @: ?- t jz SoftICE_detected8 [+ ~0 Q" i! n% ^( g4 {
1 j% j: [6 Q7 d! a6 I
# q5 m1 b$ l2 x3 @5 z7 n% eNext method as well as the following one are 2 examples from Stone's
. C- S+ l. D0 U' [: z6 w; K"stn-wid.zip" (www.cracking.net):
$ J3 [2 y2 U$ G7 V4 T& o$ }1 w& X* d+ I; V4 u0 m/ J; x, y
mov bx, cs2 n$ [5 e. a9 G" I; ~
lea dx, int41handler2
' X! X. Z P3 x7 {& M; Q xchg dx, es:[41h*4]
2 O! ^4 z; @1 z. c/ S) Y( a M xchg bx, es:[41h*4+2]6 v i9 Q" n" p* X
mov ax,4fh$ t5 n9 n2 E1 B; \
int 41h" ]9 u5 }- t, o2 e& S |% g9 |
xchg dx, es:[41h*4]' n8 f4 d8 q( R2 j- m5 ?
xchg bx, es:[41h*4+2]
1 o# o8 r9 l$ E9 R. u+ g3 P cmp ax, 0f386h
& @0 z, [! `" T' ~/ S+ c+ A jz SoftICE_detected
: _( i4 [( c9 J1 V; B6 c j
) z$ ?; B! \0 k; C3 jint41handler2 PROC u# ?4 E. w. w9 s3 V5 M+ q8 L
iret2 k; j4 ^3 j% G2 u; F
int41handler2 ENDP3 ] c1 ]5 \! c2 q
8 z2 a4 [ v, x1 F/ o6 V9 c
+ [ }! n9 \; O9 [) X3 w. O
_________________________________________________________________________* z& F/ s1 B- r" p* o
8 K) d& p3 E" q
& h. J& V. L8 h+ t" g
Method 06/ g& x/ |# S8 l
=========0 Y8 T; @3 @7 ^ x$ J/ q4 i
8 F, E, b0 j: e$ F
; y; Y @ J. a( ^0 W9 Q* s
2nd method similar to the preceding one but more difficult to detect:
& V! {% ?# } J+ i, ]. t4 y5 F: }' f$ f# U- Z3 o& z# e7 M
. W2 z. @, E9 J/ kint41handler PROC
5 X" M' ?# F/ v( |( C( E mov cl,al4 @5 t9 p$ }, E0 C$ {$ F2 R
iret, v9 _9 M# e# P; h$ j) j$ B4 C
int41handler ENDP
% p. b5 H6 x" b8 \ {& V( A [8 S0 ] Y6 k% U
! {" t! w+ d* p8 | xor ax,ax+ e: E. W) j& d+ G/ V2 M# u1 v
mov es,ax! d4 \& D$ Q' o9 s5 {; C: Y/ `. D
mov bx, cs
" K3 e( E5 A* W% H7 i8 f lea dx, int41handler
+ A) |1 t/ X& s" q' ^/ s5 T xchg dx, es:[41h*4]7 W$ i5 d- U: L! f1 ?
xchg bx, es:[41h*4+2]
, V5 O! M3 ~+ J) ]: C+ O& M in al, 40h( b1 ^3 E P7 u" G
xor cx,cx
3 A8 S" |" O1 R. U% ` int 41h7 h2 m- U* I X% [
xchg dx, es:[41h*4]
8 ?0 [5 c, b, h" h ]7 J xchg bx, es:[41h*4+2]
# ?) Q7 g# I/ o4 v cmp cl,al
# a5 }) T t v% F7 o0 c$ u/ [ jnz SoftICE_detected
+ `) e# q: j- \% S+ g
+ j+ j( }' J+ h4 {3 `0 v3 f_________________________________________________________________________
# o& ~3 J U6 m( c
# U0 e, o8 W/ o9 f; a* K6 o7 {Method 072 ^+ [' q8 ], D) X. [: |- @
=========
, k+ r# k, }& [; P$ b* u/ [! B ]" l: I; B* _ w% k4 X! p
Method of detection of the WinICE handler in the int68h (V86)
8 [3 T. x, N' `! p( z* w9 `2 _. B9 J, u f5 S3 f0 B& c$ r/ o
mov ah,43h4 \ i+ {* t# @' ~5 L i3 X' V
int 68h0 f. W. J) [7 u: }7 r' P; {4 E
cmp ax,0F386h
# B, }; }& F, P) |# V, T% ~ jz SoftICE_Detected! W8 c8 z. Q8 D; V3 T
8 g+ L+ N$ p& E% [2 H% P% s m8 u* }7 d9 n1 T6 u
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit6 ~- g9 W0 Z: @# H0 \7 G. p4 H: z
app like this:0 N0 [5 I5 p2 H# t
' M" v x- B. j6 s BPX exec_int if ax==68
4 p9 [5 K# t& K% t (function called is located at byte ptr [ebp+1Dh] and client eip is* P& }6 B3 W l, z% E' q2 r
located at [ebp+48h] for 32Bit apps): ~9 x/ Y2 i* B4 `
__________________________________________________________________________6 t- I, |4 u3 z% b7 L$ e. I9 J& A
# U7 R# k! S" {
' q5 ?/ ?# v( R; G3 r: o( _Method 08
/ W$ O: H, p5 |# F T4 |=========/ s' n9 r* k5 r. G! r2 J
: W# O5 V( e% b! `# T! C' p
It is not a method of detection of SoftICE but a possibility to crash the" [4 S. E! M% a" d$ J" Y- L
system by intercepting int 01h and int 03h and redirecting them to another' Q8 r5 _( H9 |' F2 V
routine.
* _8 J$ q# O7 }$ KIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
U% s3 i: z2 B8 p# ] Bto the new routine to execute (hangs computer...)
" l2 e# E8 I6 J0 Z9 N+ ]9 k5 J2 Q
mov ah, 25h
5 \ q+ K" D" p6 B/ B. J6 q, e mov al, Int_Number (01h or 03h)
, K4 q0 |$ U+ w4 ?" q9 j8 Z+ n mov dx, offset New_Int_Routine
2 x; u1 G2 I0 N; [( E- Z int 21h
. E' a4 {. j# j- s* p) x% B8 i8 V: N% Y6 k7 T+ {+ T
__________________________________________________________________________ v8 A3 a2 E; {4 U5 n2 H
+ K" A1 e* ?7 v" O
Method 09
' ^7 J, o% l9 I=========
1 O) W) ~1 `; }5 V5 @! o* ~ I
2 c$ E) f: D' _" }3 p$ u, {This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
7 i8 X! L0 t6 L4 bperformed in ring0 (VxD or a ring3 app using the VxdCall).
3 ^) w$ e1 o/ I8 AThe Get_DDB service is used to determine whether or not a VxD is installed' N% |/ t/ z* O6 m
for the specified device and returns a Device Description Block (in ecx) for
# `4 z) g- p/ qthat device if it is installed.( b+ M W' M, o; U6 n- l: f7 O
2 q0 q, u4 X/ ^
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID& ]. [5 \- ^+ y# `! \: q
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
8 i9 v- v! D$ S+ e$ ^ VMMCall Get_DDB* V+ h }0 G- Y+ J7 h
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
! i2 M2 n6 i F8 z5 ^3 Z! B% c. f3 m1 M' e* g( H+ M3 A
Note as well that you can easily detect this method with SoftICE:1 s" f. s/ c+ d$ {
bpx Get_DDB if ax==0202 || ax==7a5fh% ?/ q% E4 H8 _8 U' ?
& F- u8 [( v" P+ U
__________________________________________________________________________0 m1 T* l* J% f: G `7 X2 W6 I- k
! J: H/ g5 d$ I, M. |! K8 rMethod 10, `, K6 ]# d0 ?8 m
=========# \- a& B$ x2 ?0 J0 V
9 e, H1 V* u2 t2 l
=>Disable or clear breakpoints before using this feature. DO NOT trace with
" ]0 ] }+ i! O3 J5 a8 T1 d4 |2 F SoftICE while the option is enable!!
6 D' M3 z' G, v
/ a8 {+ T0 \$ a; ?This trick is very efficient:
. X2 R; I% m7 N0 o5 tby checking the Debug Registers, you can detect if SoftICE is loaded X1 v1 Z5 b; F
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
: H3 p+ }8 r1 `% t* k. nthere are some memory breakpoints set (dr0 to dr3) simply by reading their
, Y4 A6 Z# |( D1 T' }value (in ring0 only). Values can be manipulated and or changed as well
$ @7 r" K8 F# M, N/ ^" [# i(clearing BPMs for instance)9 s. L+ \! U3 q/ G7 E# L) X
* ]# G9 f0 o, P) f' W__________________________________________________________________________
1 h( ^+ e9 e6 s* V# K$ x; ]+ _. J6 P) N; C7 V1 S; {; X
Method 11) D/ I+ b$ b; L' p d0 @
=========4 N9 \$ R1 `4 Z6 R8 Y
0 n3 C3 _( q; z. y5 Q1 c
This method is most known as 'MeltICE' because it has been freely distributed$ C6 Y+ [( k) }
via www.winfiles.com. However it was first used by NuMega people to allow; r* J- w' ]" Z6 o2 E& c! _
Symbol Loader to check if SoftICE was active or not (the code is located
; G4 C, P" m/ c: _* Cinside nmtrans.dll).
: q3 O" y# y- e# \8 F1 Q
; M; c0 }3 m( W6 `The way it works is very simple:
# L- a4 i2 f, q, HIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for3 v5 E4 u \# M
WinNT) with the CreateFileA API.
: ^# ]1 [ D5 M% X* }$ r) F) t* R0 c6 Q ]
Here is a sample (checking for 'SICE'):
* Y5 w7 |7 ~. D& Y% E3 n" U; o. b7 O8 F8 F' G
BOOL IsSoftIce95Loaded()) M" d2 t9 U; \, j
{; H6 A+ z( p! z4 |, H2 B! ~* M$ l X
HANDLE hFile;
, \2 a7 t9 T2 v! B; l hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
3 x) \5 M$ J. m7 d8 m FILE_SHARE_READ | FILE_SHARE_WRITE,
' V- V+ s+ k" \7 i NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);# ?, E1 L# `) i7 N0 E/ Q- F
if( hFile != INVALID_HANDLE_VALUE )0 o8 q' y. N" w
{
, z; V$ \3 n' s2 s: u" X$ C- ?" m CloseHandle(hFile);5 O, \4 d& O% C/ Z, o2 i4 H
return TRUE;3 L7 H* ~5 A Q# f" B7 T3 g
}
0 X& B" T7 l" W# y9 V return FALSE;
0 w( j7 {. _ C2 T}+ Z9 [: h ]; e9 {5 ^# u' D! y& v5 o2 u
8 G5 S: ?2 x6 E0 g3 U. |% g
Although this trick calls the CreateFileA function, don't even expect to be
4 J& W7 u D2 \% a& t- Dable to intercept it by installing a IFS hook: it will not work, no way!
; H3 j' Q, x/ B3 z! @( P# mIn fact, after the call to CreateFileA it will get through VWIN32 0x001F* P: G2 N5 n+ f! w' p
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
+ M5 [( E" p& Aand then browse the DDB list until it find the VxD and its DDB_Control_Proc
+ \0 w) J& a+ X' O5 J, q8 `field.
3 f& z+ P/ o* W# ?- EIn fact, its purpose is not to load/unload VxDs but only to send a 8 }) R* o, ?" f/ @. }9 G: M
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE), H( q7 @; Z9 @3 e7 w# D2 w; U7 D6 E
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
& \8 o2 P, m& {6 dto load/unload a non-dynamically loadable driver such as SoftICE ;-).$ R; d$ K# R; C* O; s% h4 [
If the VxD is loaded, it will always clear eax and the Carry flag to allow
, Z9 d; ]3 S6 z+ \( f0 q ^! sits handle to be opened and then, will be detected.% |7 f% q) O+ N- T& k$ n% Q
You can check that simply by hooking Winice.exe control proc entry point
" s6 H( z* @% E& mwhile running MeltICE.
; h$ \: E( J$ n1 @, H+ o( R+ E
2 X' E6 w/ \/ T/ A7 ^7 H( y
00401067: push 00402025 ; \\.\SICE, Z. Y/ J2 J2 b% r2 C
0040106C: call CreateFileA1 G. p' T; T' O$ f, ^
00401071: cmp eax,-0010 d6 j' w+ f/ z6 V" g
00401074: je 00401091" B, T% m) S" d _6 z
' i9 d, }1 z! ~- d# \
6 e: k' J0 g. c* KThere could be hundreds of BPX you could use to detect this trick.
/ D. L7 g( y) k- |# W( [-The most classical one is:1 w9 t4 G7 C, k+ s
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||- Y, C! m4 v' D% c3 V8 j' H
*(esp->4+4)=='NTIC'" |. c( h4 h% @$ X# k6 a
, }) I; U a& [-The most exotic ones (could be very slooooow :-(+ t7 L$ b% n2 X, k& J
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') - W- D; d2 x2 U7 J% W8 E
;will break 3 times :-(0 h7 k2 K4 `8 F6 p
0 ]" j4 F" V0 H4 m8 y9 x" O
-or (a bit) faster:
; p I' m9 r' D1 Q, C1 N BPINT 30 if (*edi=='SICE' || *edi=='SIWV'); u, ^: ]$ x5 q# W# e( g8 ?
/ P9 w" W" d) L7 e2 v4 o BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
& E& _! a+ C( p. g; P ;will break 3 times :-(4 [' N. k) X/ J
2 D4 q: A9 G* w- S6 s) r& R" m. m6 t& @
-Much faster:
- r @# j5 N( y' T9 S4 `7 t BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'& b- ?. u5 k* O
& C) J! C3 f8 ]" C6 j
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
( ?9 J" a1 ?$ ~7 j3 G( jfunction to do the same job:
& m5 ~! Y7 j6 g( ]9 t" n: w' k8 r2 V4 N0 ~, H
push 00 ; OF_READ3 o0 N) q% V; J7 M. d, Q. V" |
mov eax,[00656634] ; '\\.\SICE',0
$ f+ K, J" ~ F+ Z) d: v( n push eax
8 D$ ^- Y6 E' K3 ?9 [1 p: g) h call KERNEL32!_lopen
# \6 e- e# \1 r% O6 k inc eax. H$ x6 r! Z- ^! ~
jnz 00650589 ; detected
; }; V; E( u, q) L! \9 |9 Q, F) M push 00 ; OF_READ
4 X2 g' N: t; N/ i; a ]- [ mov eax,[00656638] ; '\\.\SICE'
" t" T# x# [- T5 F- C push eax
. f! t. D/ [8 k% [ call KERNEL32!_lopen
0 M$ A# E( A( l. k: s3 f inc eax1 `" V6 S3 ~) O7 e, _1 I
jz 006505ae ; not detected9 @, Q0 q* ?8 M) U( x* e; P4 ?
' o% i# g- {, {4 ]. k' w6 l
# T7 @ a7 q0 v# M__________________________________________________________________________/ A6 V! N0 y# \" p! }
; O! f- }# G' N
Method 12. n r: T+ r; m/ {( W8 }
=========
. c/ W2 _9 S' R8 u- s* @( ~1 x F1 U, ~: Q I
This trick is similar to int41h/4fh Debugger installation check (code 05
5 R* C+ I6 }' D2 n" w. I' A; b8 f& 06) but very limited because it's only available for Win95/98 (not NT)5 o9 G& |8 @: t0 W; ~
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.5 i( q, {3 U, B
3 V2 G: @% C5 @1 b push 0000004fh ; function 4fh
( R1 l) O- ]: E3 ~ push 002a002ah ; high word specifies which VxD (VWIN32), j9 n; ^1 K( @, o V' r0 k
; low word specifies which service: p0 K' {' A2 k. Z1 ?* f* P
(VWIN32_Int41Dispatch)
% U1 p0 c; j# }/ U$ C- I call Kernel32!ORD_001 ; VxdCall/ t! I. Y, ^3 p. a- @2 d/ t
cmp ax, 0f386h ; magic number returned by system debuggers
$ H2 J( J4 x% c( w+ U jz SoftICE_detected8 z7 D5 I6 ^* C/ l/ n0 T% R+ ?
. o8 U$ ^0 ]) {1 X) z5 S5 |Here again, several ways to detect it:
+ h6 o2 |1 B; Q1 B% x+ @! Q( o& I$ t: X3 r' X7 Y1 y
BPINT 41 if ax==4f
# m; ]- W2 P6 K. }& S; G
0 C7 T3 F/ f v" L BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one0 Z8 a8 z) y. r2 D9 W% Q
2 r3 r k" |+ ^
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
) {) f9 q& | f+ {
* N4 h2 c. Q T0 T$ F1 Y% p BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!# |6 ^( ^ k: H! o
5 E3 a7 k: v: A m% s) f, a3 `. h
__________________________________________________________________________# T3 R$ j+ N; [+ P4 Y7 k% O
+ O4 `2 K* e$ i+ {% ^2 Q% ZMethod 13! ^* ^: M* D( c. N: q
=========
4 o" S% Q S2 m f( O
0 {: G. D E* aNot a real method of detection, but a good way to know if SoftICE is2 V% c/ j. {2 T
installed on a computer and to locate its installation directory.
: Y M% E9 B. p b9 j# W2 DIt is used by few softs which access the following registry keys (usually #2) :; B% R" M: t5 ^3 L+ `4 E* G B" H
* X. w, w$ z( Q6 P5 _-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion5 c% J% K& Q5 o' t
\Uninstall\SoftICE; }- V/ p( @/ N1 ~% ]
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE! U* {2 o3 N [- j
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion$ Y, ~. K" e5 x. g
\App Paths\Loader32.Exe
' t4 k5 D! f( L+ r3 i c
6 S' Z) ~, Z6 S: _. q1 T" J6 I1 m
! I! Y2 a: {! R, N X! l/ X! INote that some nasty apps could then erase all files from SoftICE directory
% Q- n4 `, \: g( V& ~' d" \9 N(I faced that once :-(
6 v+ c, K7 a, @; @& T1 O L3 W3 N. F1 p8 f9 t8 o
Useful breakpoint to detect it:
, j, ]+ ~) Y! {5 n
! }/ K7 q0 y& a* E BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
$ ]- T& z- d( F9 S/ E7 M% F3 }3 A, U5 k- F' I% r
__________________________________________________________________________# T5 v& q% o( m" k9 s& j
! H. h0 [- Q3 v$ p
b8 g% B0 k% TMethod 14 + s% Z6 G6 q& `$ g& D% e
=========
8 b% |) r6 d) m( X0 D5 X! \0 @" m
+ v2 Q, D9 \# ^% i9 ?7 OA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose$ V& U9 B; ?% m
is to determines whether a debugger is running on your system (ring0 only).# c$ f3 a7 ~" v9 R' S$ P; ~% c. ~
P7 Y$ [; u0 }1 r0 I9 F VMMCall Test_Debug_Installed( l# e, V# c+ N: Y s" J! q4 U8 r
je not_installed
0 R Q/ J& e8 O( R; z& A5 g' X! ?9 V( i5 x4 x, F8 J8 \+ u
This service just checks a flag.( M, v2 t, z+ D R4 f. p/ F% @
</PRE></TD></TR></TBODY></TABLE> |