<TABLE width=500>
# T2 @+ W& r/ F$ j2 ]5 @0 G) M<TBODY>
" X2 G n# f. A5 y. v2 I& y<TR>
6 |: k0 O: N2 [. Z; R2 F2 l6 v<TD><PRE>Method 01
: W2 D. y: Y2 x( ^4 V=========, L' h+ Z: X9 Z( \
- d6 F; x0 m; E4 ~2 p- w: D7 I' UThis method of detection of SoftICE (as well as the following one) is& D- u& h, e, F! e0 u f
used by the majority of packers/encryptors found on Internet.) W! ` l4 r t1 ?1 h
It seeks the signature of BoundsChecker in SoftICE
5 [# W5 u2 r i8 T' K6 k& C# c' l5 G! V( D, T3 o4 d t
mov ebp, 04243484Bh ; 'BCHK'
; p9 Z0 d3 w, p1 }* |$ D mov ax, 04h' Z/ w4 b" G1 A6 B( w
int 3
: J) j2 R3 H6 d1 K. A cmp al,4% {5 b# c% X4 v# N( y5 t. X2 H$ w
jnz SoftICE_Detected
& z/ a1 b5 s; C2 A* B" J: F1 R4 i* d b
___________________________________________________________________________
1 B: T: e( q0 V
0 ^3 z9 ^$ v7 x3 k1 F3 ~Method 02
0 q2 Y# ?* i7 s+ y6 `=========! F7 j( `# [+ g6 Q# b
! {' I8 r* f! X, e) ]Still a method very much used (perhaps the most frequent one). It is used4 Z1 {9 g; _; T6 _4 _/ v
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
8 N; g( m2 h+ y% u: Q4 r( F* kor execute SoftICE commands...( N( _7 ]) a8 x6 p
It is also used to crash SoftICE and to force it to execute any commands
6 O% u% I' Y! B( b2 S5 R) \8 v- V9 N(HBOOT...) :-((
; E9 P/ {$ w5 U* m; A' Q! }1 m- ?$ X+ y6 t
Here is a quick description:
R. q/ T8 N, }9 c* L2 o+ x: N-AX = 0910h (Display string in SIce windows)
3 `, d& `- `% V% K6 \5 v3 M$ m+ S B-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)$ z. g7 ~1 a( U' B2 u$ `
-AX = 0912h (Get breakpoint infos)
* ~9 ~0 V4 m3 A, H- p-AX = 0913h (Set Sice breakpoints)
: q7 D9 l4 K7 d; m: S0 i$ q6 H) U-AX = 0914h (Remove SIce breakoints)0 H+ _0 J4 j) Z7 x
+ }9 F6 \( I ?! b8 tEach time you'll meet this trick, you'll see:
$ e! `# G: p! K. T: l-SI = 4647h
, M/ W$ A, F; x1 n3 K& U e0 o-DI = 4A4Dh. ]" h/ Y0 V1 j5 D! x4 m6 V& t
Which are the 'magic values' used by SoftIce.3 ]2 _2 l% Q6 Q. `
For more informations, see "Ralf Brown Interrupt list" chapter int 03h./ Q- N+ l7 k8 U5 {; u2 k" x1 _
- a) o1 e# a2 o8 {& o3 N
Here is one example from the file "Haspinst.exe" which is the dongle HASP
6 e5 t- c( g6 s# pEnvelope utility use to protect DOS applications:
: m' G$ Y0 y; B% v: c6 K' }- _& N. ]/ I. y1 h
$ R# t+ Q9 G6 ~, a! `) ^1 @
4C19:0095 MOV AX,0911 ; execute command.% O# d, {3 ]2 I. R
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
+ t) Q) Y0 ` j8 N) p" m* p# n4C19:009A MOV SI,4647 ; 1st magic value.
/ W' G) i: ~. C7 b' Y4C19:009D MOV DI,4A4D ; 2nd magic value.
; p( s4 `1 R9 B A# |, ]4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)8 X3 n5 _7 v: L5 ?; r7 {
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
( {# M7 O6 y+ c% X2 }4C19:00A4 INC CX
) X, J; t3 X! u- {4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
! f* u9 S+ y) ]! X8 x- w4C19:00A8 JB 0095 ; 6 different commands.' A& M9 B! e7 }; k6 O+ D
4C19:00AA JMP 0002 ; Bad_Guy jmp back." y8 F+ O& Z& o) h
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)7 T7 B3 @, O* r. O" ?8 I4 P
2 I8 ?7 d4 F* D$ u9 a& C9 M
The program will execute 6 different SIce commands located at ds:dx, which! o0 x. r' Q$ R5 N
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT. q* c* L4 D$ w J: m7 v7 o% q
; M( Z' N9 F. j' A# K+ @
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
% R$ H! `7 x+ K* D. G+ p___________________________________________________________________________
; y7 R5 B% T$ z. E& m& J: y' |7 n) b$ N+ l; Y2 L J
( ` g: W' G+ w4 |/ z" l
Method 03! l: j2 a" m$ f9 V; G
=========
) q5 q. a$ N* N) G
8 ~0 X5 D1 a, u# M* ~! {5 nLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h1 c# ~- \$ q H# W8 C* w
(API Get entry point); x) P# g* N- x- d4 b
" }% l# a4 y' W/ p' Q3 ~$ |. l: K& j! O7 g2 V! M" h
xor di,di
+ A3 V9 }8 |* P% S( k) D% y- U mov es,di# b3 F3 G% T, t7 i2 |% r7 c
mov ax, 1684h - b9 E, N3 Z4 L
mov bx, 0202h ; VxD ID of winice+ s( f0 X% A" E: M
int 2Fh, I% W! X3 `0 k, U% \4 E
mov ax, es ; ES:DI -> VxD API entry point8 o) M8 T! H: e- m2 r1 x
add ax, di& o4 A9 \% L9 Y% m# r4 x
test ax,ax9 ]5 g# }0 {6 _5 Z: B" T! J
jnz SoftICE_Detected
- w6 g. K* [) O3 f. [
$ d) J: Z' j: U2 H) J" l___________________________________________________________________________& p0 A q# D( Y! W! Q6 T$ J
' S( S1 r1 c( N' j0 x6 O. sMethod 04
) `, p @# b: |( T! t0 A/ f* [=========- i* R) N. R" v8 ]
1 i5 p( g9 T' H9 ^* F3 R+ b1 B
Method identical to the preceding one except that it seeks the ID of SoftICE
9 R, a4 k1 B9 A: p1 OGFX VxD.9 h# F& @- @4 V+ E* q) q
/ @9 t% p& l* ]* Y) y xor di,di
' ]( R. Z" _) Z( n5 g/ M mov es,di; L1 U# B+ m& `3 D: Z
mov ax, 1684h 6 m3 [ _7 F& u3 D9 u; } }+ @2 A
mov bx, 7a5Fh ; VxD ID of SIWVID
% t; ]3 l8 [, ?$ Z2 N int 2fh
( p" k' R5 |# n" P7 A+ A J, m/ c mov ax, es ; ES:DI -> VxD API entry point# h. V8 T+ g- e( B* Y5 U
add ax, di5 S: H# s% _0 @
test ax,ax
+ n% w4 Q* R/ N2 w5 h jnz SoftICE_Detected$ _6 @( M w' F: c3 k0 O( c& p
2 h7 C0 m+ P: b8 O
__________________________________________________________________________2 V- C% `' W% M9 g2 Y' @: I
/ [( [# Z( j4 j v$ W% `1 W0 \
Method 05
1 k0 v9 n$ k: \# x( j( f=========
- N0 u! n5 Q9 Y i v7 ?
( C7 j0 S( k4 e' W: v1 c+ R1 y$ f. @8 I6 uMethod seeking the 'magic number' 0F386h returned (in ax) by all system! a7 C0 u+ Q) U- a4 U* F7 I% `$ `2 |
debugger. It calls the int 41h, function 4Fh.
( C( s G: J/ J% X4 ? I7 [8 D( @There are several alternatives.
1 F4 ?. S7 }3 T' A
; p$ h! J, |8 Z' H& |The following one is the simplest:
9 S0 e3 T! b! ~ O" M; L a" _: B% u& q" m
mov ax,4fh
8 U; q& Z, J* e4 F1 Q5 b* k int 41h U/ E: W4 |' ^: g% G
cmp ax, 0F386
I* N1 N% a+ H* [- \0 n jz SoftICE_detected
8 Q+ _* a- g1 N$ l/ M8 N% K& X* z( J
& I! u) E2 y1 Q: D2 U
Next method as well as the following one are 2 examples from Stone's
4 V. O1 z q# q" o"stn-wid.zip" (www.cracking.net):
/ d* x$ R% H2 ]( X$ a9 w3 k$ W5 p7 s
mov bx, cs! s F9 b! X! z- w
lea dx, int41handler2
/ Y- Y+ b& |: u4 z xchg dx, es:[41h*4]
: j+ D0 y; Q( E7 J; a7 q' d8 P4 K xchg bx, es:[41h*4+2]
! Y, w0 j7 W; Q4 k K( V Q# E mov ax,4fh
) m# l5 `. t6 d3 E @& m% c int 41h8 G1 Z0 @$ C6 P) \! X9 `9 q" d
xchg dx, es:[41h*4]& P/ ]1 R" _0 F% C
xchg bx, es:[41h*4+2]) K# N# w+ N# i! I7 u
cmp ax, 0f386h, ~9 }1 M, R* j) O6 Y/ B* z/ F
jz SoftICE_detected: g1 t5 |3 {- ^1 z9 I
0 a& l, L! Y7 t2 L
int41handler2 PROC0 J0 G. M0 v; V* x* S" o% l% O$ R
iret" m$ C, G3 s+ y( T- P, R
int41handler2 ENDP
$ p9 G9 N Z O" h; d1 O
- U: e! q; U5 L* t. A7 b0 X
y/ F; K3 T/ o8 r3 ?_________________________________________________________________________- O; h/ Q$ \; }7 Q6 U. \
; ^9 J a) H) \% T
& @: G, [4 \: vMethod 06
; |! d. X2 C8 B=========
* P. Z0 e/ T7 }4 t9 u
) \& O: C, O0 g) S3 C \: m
7 k f- F& b* l( i; P* {5 u/ _1 A2nd method similar to the preceding one but more difficult to detect:7 N( [' h* }; |9 `+ u# W" o
+ Q/ O+ r: o% }6 ]
4 E. {$ \7 b7 _! A% S& E0 tint41handler PROC# P$ z) G% T4 S( M' _/ u h& f, r
mov cl,al
- G! d1 m+ @. c6 F( l; b: O iret
1 Y3 S) Q3 J5 _, C& s$ {# Nint41handler ENDP6 C C& \$ f W( E$ r
( y v i5 e% D; a& e8 O
; r, e+ I) x b9 T xor ax,ax
( I3 q8 s+ |5 B& Z; P* ^( Z mov es,ax- w; m: D3 \+ m1 P( O/ p3 K
mov bx, cs
) T% _" _" f3 Q! O" H5 z: x. h lea dx, int41handler3 D, B1 i. ?( w* w0 P& ?% ~6 _
xchg dx, es:[41h*4]
' r& j3 g& a0 N xchg bx, es:[41h*4+2]
& ]- a4 }* q% x8 m in al, 40h
; Y+ p- R( a0 z6 } xor cx,cx' y4 V# l+ W: X {
int 41h, f5 ^* e2 ^% S
xchg dx, es:[41h*4]
7 M: r5 d5 H! N9 z4 \$ F" O$ Z xchg bx, es:[41h*4+2]3 m( L {5 C1 R3 S3 p' I
cmp cl,al
9 w, M8 s4 `% }7 O- _, \* G jnz SoftICE_detected8 `1 T: c. Z( U9 T& r ?
J! r l- w, h1 U, B
_________________________________________________________________________! w$ S2 x3 c8 @/ t( U7 Y
4 Y* k( W$ ~) K5 j$ eMethod 07
0 d% @+ r4 F$ `7 o. l=========- u8 J1 J; {, @$ _1 t, M
% w' A1 t. W. O$ @Method of detection of the WinICE handler in the int68h (V86)& Q1 U6 h; ^+ ?$ h+ M
/ u( Z G1 b! R8 k) y mov ah,43h# R3 I7 i7 x; e
int 68h7 r |1 m; S e0 ]8 e4 k
cmp ax,0F386h
* e3 I! o! F* K& n3 n' A9 o4 }9 r jz SoftICE_Detected
1 w, J, V( v0 j! t) B0 ^
+ {6 P) c! L" Z# X* S) h* g X0 j1 T
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit0 F. l S& ?, N, s4 v6 V# {2 l: X
app like this:7 _! F. Y+ _- z' w
g! x4 f+ S; B5 m2 u$ v+ l! A+ r BPX exec_int if ax==68
5 |" O3 l4 @9 k* l* ~$ [/ [ (function called is located at byte ptr [ebp+1Dh] and client eip is
G- A1 k3 h7 F. e located at [ebp+48h] for 32Bit apps)
- i/ d b/ n0 l2 N; q__________________________________________________________________________
9 F+ R" R; ?0 w& P5 t1 h# L9 ?0 F
1 n6 B, S9 N$ k& u
* E L+ D/ k( r" [8 c; q& eMethod 08
' \+ Q* z* t! l1 a) C% G$ }- @% r=========
5 o5 t& x/ \% Y( k+ D5 a3 k* W) C7 Y; M, w, o
It is not a method of detection of SoftICE but a possibility to crash the
% k; D( p* f( [" Usystem by intercepting int 01h and int 03h and redirecting them to another1 w# n% }7 u8 @2 d1 T6 i
routine.
, z! U# K9 c2 F7 f0 P( C$ sIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
1 M" o2 t+ }$ d% P [) _4 ~# sto the new routine to execute (hangs computer...)) M- {0 j3 u/ `$ s
6 q5 j' C* E7 B& X, B- r/ Q" |
mov ah, 25h
& `/ ^& b) h( b8 o1 y% f5 } mov al, Int_Number (01h or 03h)) @/ ?, c I9 R1 l# J1 o$ l) y
mov dx, offset New_Int_Routine
" W+ N1 b! y6 l2 x: R; [ int 21h5 ?3 q, w0 N' \3 W
0 c% X) _7 u2 u, W
__________________________________________________________________________
3 Z$ |* |0 g1 T
( `- @& t2 M3 |& [# y& @- NMethod 09, M4 }7 j4 l1 k& {
=========. b4 U! ^5 B4 R; R# B5 l
; t- Z8 [: k6 ~/ e+ I3 s5 g; H
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
7 f- E" E) L9 _- Z# T3 xperformed in ring0 (VxD or a ring3 app using the VxdCall).; s( P8 `5 o1 i, A' S/ w
The Get_DDB service is used to determine whether or not a VxD is installed& O" `7 Y: Y; @. G, `, b$ Z P& k
for the specified device and returns a Device Description Block (in ecx) for
7 @9 M/ n- Q& ?% Z$ bthat device if it is installed.
% Z2 D2 S" Y" D. u' G$ v8 i C8 l' j# w
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
# f, a2 d" v z( m mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
% l ^9 v; h: Z, K VMMCall Get_DDB" \6 P9 u3 B, t# j8 T
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed7 t' i0 C8 K4 {# a
( u6 S& \+ E) y( F e
Note as well that you can easily detect this method with SoftICE:
4 q/ F3 C9 I: _' ~: ]0 B bpx Get_DDB if ax==0202 || ax==7a5fh# Z6 `: j7 m+ z3 ^ D
2 @# p' P3 V4 `2 t2 i/ Q" v
__________________________________________________________________________
3 n' O' Q, I# g9 R& p/ q# X. B: O; X1 W' u4 f
Method 10
, E' }8 K$ _' E=========
$ h' e. r6 G" V; L
$ R8 V' G! U' _9 \=>Disable or clear breakpoints before using this feature. DO NOT trace with( \6 B6 @' ^3 N& _
SoftICE while the option is enable!!
/ I7 w/ A+ Z/ m# w: p1 c6 i) ]6 ]2 C6 M
This trick is very efficient:
& S3 k# Y$ v8 A$ f+ j6 Cby checking the Debug Registers, you can detect if SoftICE is loaded
8 b: f/ S/ d4 W1 h(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
9 N8 t% k- Y+ B7 e @3 ^3 c! Ethere are some memory breakpoints set (dr0 to dr3) simply by reading their
m1 G! _& E5 {9 }value (in ring0 only). Values can be manipulated and or changed as well
, { I- q, O' W I+ w0 V1 i3 ^(clearing BPMs for instance)5 A5 p; y. u! e% S
* [' O- l6 g! t__________________________________________________________________________! R2 z; @4 C0 c! h: v0 y
; h4 ~, F, [1 f, ~5 Y2 {* K+ d
Method 11# N/ J% }, k0 J1 }% P
=========
0 R* Z+ a4 S; t0 C# \+ A. ~
3 V& {6 h* s+ k- ]/ gThis method is most known as 'MeltICE' because it has been freely distributed
9 h5 u1 F4 ^3 C2 x0 c) d3 n& r, Ovia www.winfiles.com. However it was first used by NuMega people to allow u) N! H2 [& d1 Y$ I# X2 D/ U
Symbol Loader to check if SoftICE was active or not (the code is located
) `$ Z6 N4 T; c) iinside nmtrans.dll).
2 x2 m3 o+ S2 T" Z$ z
3 L3 ~# M( n. VThe way it works is very simple:
' S( O* X9 C+ R' C, TIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for$ Q* J9 T+ Z# F. D* w
WinNT) with the CreateFileA API./ ~. |" `* y2 ]6 X0 p- I
A6 E2 t' _7 z' a7 NHere is a sample (checking for 'SICE'):
0 [5 Q! X* g% |* z+ ?4 b* O: A- Y$ y; U
BOOL IsSoftIce95Loaded()" Z: r0 n( m7 y ~4 z% |$ `6 Y
{8 r$ v6 d& U# S4 @, z: f5 Y+ w3 D
HANDLE hFile; * y& X, }: |; ~0 S1 U' R9 a' V' j
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,2 A T! [3 S' ~2 ~
FILE_SHARE_READ | FILE_SHARE_WRITE,, _& ]# |+ {- j4 j) q$ a! U
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
6 E7 o. @: Y, v3 }) T$ O if( hFile != INVALID_HANDLE_VALUE )7 N* a: z6 R0 A$ g
{
% ?7 s! j* v* X2 X" z/ m J CloseHandle(hFile);
9 v" w" i7 Q. Q$ A return TRUE;6 H& o3 @6 Q N7 F1 {. X
}
7 }- S* t' G6 O$ j4 D return FALSE;, n, r: a( x' n1 \1 b
}2 g& x4 }0 G( L2 v( { L
% k! W* f" z; w- D' m4 o
Although this trick calls the CreateFileA function, don't even expect to be* M# H; Z& @+ C
able to intercept it by installing a IFS hook: it will not work, no way!
) L+ V+ D( a ~4 yIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
$ X) X- A# b j m: Iservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)6 ]/ o W1 h, U @6 i5 {( X$ k3 _
and then browse the DDB list until it find the VxD and its DDB_Control_Proc) Z9 L. Q- f8 V" Y. W0 @9 |
field.+ I5 H, E; p0 H/ J3 G9 t# Y
In fact, its purpose is not to load/unload VxDs but only to send a
, G' o& G, N4 z: ~- r- A0 Y; ~W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)+ P: q% T2 {: J, N5 t$ {8 P& M
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
, _7 i: s- @+ jto load/unload a non-dynamically loadable driver such as SoftICE ;-).; S% I) x, a# z8 \+ e! ]! H/ \
If the VxD is loaded, it will always clear eax and the Carry flag to allow% ~( ?+ O1 Q3 s8 i9 H9 K* N
its handle to be opened and then, will be detected.
& h: \- c' A8 q7 r7 t8 [1 m- t1 J4 XYou can check that simply by hooking Winice.exe control proc entry point
7 D, o4 ]' {( jwhile running MeltICE.
, ^7 s6 J% W% B- j/ ]+ f# r& z( f* b$ F' {# \( u2 |
x8 ^" Z6 [ q$ \0 j' t; x 00401067: push 00402025 ; \\.\SICE% V3 ^. I9 _- g4 U
0040106C: call CreateFileA
4 _% }3 K0 _% s1 s( p/ s; @* x1 Z$ Q 00401071: cmp eax,-001' Q, }: x' V4 P/ h& J
00401074: je 00401091, n1 x* R. d( Y3 l) {
' D+ W, ]; K3 H$ X. e( k1 R! y# j# I* P, ]! t
There could be hundreds of BPX you could use to detect this trick.
( M9 c- j. G5 L$ N1 l4 p-The most classical one is:
: {7 F% I6 f( E4 m BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
1 a4 ]- |. N! x/ R *(esp->4+4)=='NTIC'
0 Q7 Y; {- x6 T3 t ^4 \' ^0 U4 }6 d3 |, w: E7 a
-The most exotic ones (could be very slooooow :-(
& G# ~0 P9 z/ @; ^1 H BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
O# b3 d( Q% p Y% ] ;will break 3 times :-(6 @, f9 [2 u+ J# @( v/ ^1 ~
$ \9 m8 s% E& p Y* x O2 R5 c. |-or (a bit) faster:
; B) V' l# W# w9 c3 s: |0 U Z BPINT 30 if (*edi=='SICE' || *edi=='SIWV'), j+ |# Z6 V; \* \: _. ~- X+ Y- ?
: o& s! |9 R8 e% J7 i/ v0 M( j8 F BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
& u- M% b4 z9 C9 L( X ;will break 3 times :-(
7 F# J" O2 v7 C1 z0 X" V8 z! c
2 Q; Z- x- H4 j6 r5 W-Much faster:
# D, E) X" z2 h6 Q; | BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'' N% k) u2 j: N# w
2 P+ w4 p8 d8 L$ [3 VNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
+ q6 b; f5 [/ o" t' G' y/ cfunction to do the same job:3 t! }) n7 Q f# x/ F# m
% \3 o2 a8 q' y! t, A1 C3 K
push 00 ; OF_READ
) t) O# ^' ^; n6 @. r mov eax,[00656634] ; '\\.\SICE',04 X+ j) s, H1 ] a
push eax
/ [9 d4 l; a4 i+ @) u call KERNEL32!_lopen
6 c2 X, f( K: g; F6 H, E inc eax
- j$ a" q. C+ |" B$ X jnz 00650589 ; detected+ a* C6 |+ t! U+ E4 F
push 00 ; OF_READ
6 E( I+ E* }/ \; j& i mov eax,[00656638] ; '\\.\SICE', ^5 h, y% g; I. ?! V
push eax: L0 Q$ H2 p$ m+ e2 t3 O+ W
call KERNEL32!_lopen8 V. c" x9 h" h1 O4 m: e
inc eax$ ~2 X- _' i# D) f
jz 006505ae ; not detected
h* g% D3 M. @9 A
4 h% j9 {- j/ F# }
+ s. g% e% X+ Y* g__________________________________________________________________________
9 I( K; W2 P. R4 w+ _6 d/ x
6 G$ r! R' S0 M8 iMethod 12" V, u( Q) u6 d; z$ C3 f1 Z/ E
=========
, ~. D9 F( ^/ i$ [, F! }3 W# n6 h' t- Y
This trick is similar to int41h/4fh Debugger installation check (code 05
0 a, f% ?4 C! Q5 k& 06) but very limited because it's only available for Win95/98 (not NT)
2 @: x7 {: i# Ras it uses the VxDCall backdoor. This detection was found in Bleem Demo.7 f0 M. d% c$ Z: e
* g- y- W' f g* S9 K push 0000004fh ; function 4fh
/ i, u) O4 P" u: }) E. J' S3 j push 002a002ah ; high word specifies which VxD (VWIN32)
2 x; U9 a6 K/ g* J! o1 B- o ; low word specifies which service
8 I: X) y) n5 Q& z! @, R+ h0 w8 R (VWIN32_Int41Dispatch)- b) h) L9 r; [$ l) W6 m
call Kernel32!ORD_001 ; VxdCall6 X5 w7 _+ ]: S/ w
cmp ax, 0f386h ; magic number returned by system debuggers; j( M8 c( k5 A' w
jz SoftICE_detected+ H; I( j) H7 a% c+ v
/ q+ u. `- T) g, Z, a# L# S1 VHere again, several ways to detect it:
: v) v n! e, `* { H# T
: f3 d2 J6 `* [2 D" ]9 [7 B BPINT 41 if ax==4f7 v9 @( B8 m) V
& e6 L6 A5 h Q a; Y9 } BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one4 b3 Q% o/ M( I9 A
* S0 o% A4 \7 _! A2 e3 v BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
1 W: E/ o! [6 S" w- c D% F) t% v" y' m3 R
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!) v* p6 l" |7 x2 s6 u
; p0 R( ?4 r( @% A
__________________________________________________________________________
2 r Y# b! m* r' y4 O* {, i1 B3 p5 A2 o
Method 13
/ r' l8 W6 o3 \4 ?3 k, V3 |=========4 z( L9 r3 s2 N* P' g9 d
/ y8 m4 `: z6 T) `9 L) q% hNot a real method of detection, but a good way to know if SoftICE is* k9 [; y& a5 z' l; j( o( n
installed on a computer and to locate its installation directory.% i# H" }9 i/ l% |! V! ]
It is used by few softs which access the following registry keys (usually #2) :
* i3 r' O7 M1 g2 Y5 J
1 V% G- G% o; K: \* R-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
$ g2 b- }! c, X3 a# a\Uninstall\SoftICE5 D9 I" k7 d$ J& D' {" X5 v
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
* G" O4 N. n* q3 ~-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion& F N& c" d* [6 i& N
\App Paths\Loader32.Exe ?. S# Z# f# Q6 a
, d- r9 J. j3 O1 \6 ?5 X5 y) J4 _9 c
& l6 t) l5 h8 P% yNote that some nasty apps could then erase all files from SoftICE directory
9 _- U2 a- P/ c8 s& }( @( n l" O(I faced that once :-(9 I3 l2 Y: ] l9 E# D" u
/ X) }# J- X, c1 ?& r$ ]
Useful breakpoint to detect it:: S6 G! o+ Y* N, v7 k: V' y' l3 ^
" L, P# h5 H& N9 E) Q4 j
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'! ]/ E# {7 E- w4 g' D
8 Y( M5 ^) b3 j1 m4 |# q1 V0 t' ?
__________________________________________________________________________
* w/ Q7 c' W( M! V E: f! f8 i4 S! L( k/ e5 s7 c, P( y$ m/ ]- l+ n
/ E* e' N5 O% \/ q( fMethod 14 4 }2 g, `9 `- o: _
=========
1 H% q9 ~7 N( R. R e: i" }
$ Z J, o" Z& @' n7 w2 u& mA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
6 @! j% ~% e" `5 T# Dis to determines whether a debugger is running on your system (ring0 only).
* L+ h, ?! j, E! ? q _+ F" e6 T$ |0 Z
VMMCall Test_Debug_Installed% k- Y! Q/ g5 G3 I, j; s
je not_installed3 m- n5 w4 \5 |$ B- h$ x' R" i$ \2 o
( T0 \7 `, T' B7 S; FThis service just checks a flag.
2 [ Q1 p* z T- ~</PRE></TD></TR></TBODY></TABLE> |