<TABLE width=500>
' T! M, I3 }% r2 D( |<TBODY>
5 E+ I. F; c8 t' w1 m<TR>7 l& x' P0 W( Q4 M: H% n. ]
<TD><PRE>Method 01 8 y1 N z* D; P" z* u( X; f( z- g
=========
: M+ O! u2 D9 n3 X0 Y4 W+ A6 x, {+ c( Z
This method of detection of SoftICE (as well as the following one) is
$ ?' o/ }$ Q# m7 p9 H; Oused by the majority of packers/encryptors found on Internet.
* k! l# `# s. @( o& r' _' m! UIt seeks the signature of BoundsChecker in SoftICE' W$ l$ v9 F9 `+ p
9 x; q* p+ |2 d$ Z9 c
mov ebp, 04243484Bh ; 'BCHK'
4 V3 q+ Z H- y% I2 N mov ax, 04h# v6 Y) ~$ _7 s% \2 j$ q# B$ B7 Y
int 3 , }' g) J3 |+ g* r3 x
cmp al,40 G3 w6 K4 ]- m
jnz SoftICE_Detected |5 D( d6 U& Z+ B
$ G% l0 T* ~% M, W( H* ?___________________________________________________________________________" q4 D% h U( B
6 E. \5 n/ I# E+ C2 wMethod 02
9 F6 [+ c7 j& s2 r$ W=========
& B6 V3 D' X/ Q) w
, h/ N* b( C* [" _1 e$ tStill a method very much used (perhaps the most frequent one). It is used
- [$ L. P/ t6 u' I' v. Uto get SoftICE 'Back Door commands' which gives infos on Breakpoints,+ Z# @+ D4 m2 E, B; J! r
or execute SoftICE commands.... [' s+ G3 K) X
It is also used to crash SoftICE and to force it to execute any commands( j9 ]6 p. d! w# V
(HBOOT...) :-((
4 b$ L s8 \( c/ j7 t
4 y z6 W& j E9 w- ^% C/ uHere is a quick description:
) e) l1 @: c) {; W-AX = 0910h (Display string in SIce windows)
/ k* j1 ~9 `( `8 p9 L- s- {-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
5 H: i; \6 _, G3 A* s) ]* J-AX = 0912h (Get breakpoint infos)9 ?& J7 W4 N, x: S# j
-AX = 0913h (Set Sice breakpoints)
9 U1 E" U/ F6 R& N* w-AX = 0914h (Remove SIce breakoints)
6 B; Q" L3 W# T% k6 c. s5 b( S
# K. e: ~) [; S ^8 Q) PEach time you'll meet this trick, you'll see:4 S0 G s- \3 f6 h$ e% z7 |
-SI = 4647h0 n! `& O' z8 U7 |
-DI = 4A4Dh
/ N, o/ w# G" a) m, v8 ZWhich are the 'magic values' used by SoftIce.) y* G- t8 B* L& y0 s9 ^
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
F, j7 O1 m+ h$ p* r" Q3 g1 h1 J3 `
Here is one example from the file "Haspinst.exe" which is the dongle HASP
0 ^- g$ Y2 q" |" a% R& PEnvelope utility use to protect DOS applications:
. j3 c+ g% @2 l* E* D" h+ w# N3 m' h! U+ W
: V: ^) d0 E" w* r: d7 w
4C19:0095 MOV AX,0911 ; execute command./ v- R0 H6 z7 i
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below). _+ K+ [, ^1 N; T" E2 N6 z
4C19:009A MOV SI,4647 ; 1st magic value.5 m; q/ I8 N0 B' M: S' E B1 B
4C19:009D MOV DI,4A4D ; 2nd magic value.: n; w) n: _) L4 I- n: {
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*): _4 x" v. x1 S6 ]6 R! ?, C" }
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
7 U4 @8 u" }4 A; {# e* `9 H! c4C19:00A4 INC CX
" |' F3 [; S+ A4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
4 F2 l+ y# J6 ]) q. P# H+ C4C19:00A8 JB 0095 ; 6 different commands.
4 r" d5 Z5 o6 W7 H% l7 h4C19:00AA JMP 0002 ; Bad_Guy jmp back.
- @/ j- }4 ]7 s* l, N a. H) P4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
' N. t0 N+ y' @% o- h
. N" E0 [4 f$ a2 ]The program will execute 6 different SIce commands located at ds:dx, which
0 f- a, T1 e1 |1 z$ rare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
/ f8 L( h, X0 f5 z' u: k( Q0 |& t/ s( P) J, N- q, ~2 A) S! M
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
. s7 G( a* J4 q- t) H) k___________________________________________________________________________3 C/ s4 O. M' J1 c+ E
1 @+ ?' ~6 C2 b( \6 J
/ a, l% K% F$ R" j% {. T/ n# P# J: qMethod 03
' R. S* H3 i$ n" ^- k; T- ?! D=========2 L. Y% V4 E, u4 l; _, O
+ n+ q) k# R* i. ?2 ]
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h2 ?! X+ ~+ s2 h8 }6 |# s- M
(API Get entry point). R. J9 Y0 Q& r
8 e8 |; K& n& w. D& r2 ]
9 C; | W! f3 J' X0 N xor di,di9 W" y6 {! u9 W4 `: n4 s) K
mov es,di
# S8 o* H# z. O1 ` mov ax, 1684h
' o2 O9 o R+ J8 o, @7 K/ l' I: \ mov bx, 0202h ; VxD ID of winice4 ^, G7 y' b$ v
int 2Fh& W- h9 l2 ^# I# f/ V% C7 @
mov ax, es ; ES:DI -> VxD API entry point& ~$ ]) T9 i F' u! W9 h) [! _, }
add ax, di4 h! \: Z$ ?: U8 `! }& t% u- Q _6 O
test ax,ax- O7 Y8 X, Q. [8 w$ B$ b4 g& O
jnz SoftICE_Detected$ B* u8 N$ q9 a, h6 F
4 G$ ~1 n' k7 u4 Q" `___________________________________________________________________________7 p& _( i& g$ m5 `% l0 @6 D0 F
" Z, H: R2 w4 v
Method 04
2 H$ V4 \6 R+ [( _' D8 Z# j=========
+ d/ f5 c0 x) n5 |! A' c7 K. p0 @+ n/ C, U2 ]2 L" l9 c
Method identical to the preceding one except that it seeks the ID of SoftICE
3 j; s) ?, \- ~% w: _0 A4 [GFX VxD.
, T3 b8 e! ?. c$ c& ~
' M, @ }( L) H0 {# k xor di,di$ _& e0 _8 F3 W* {% |3 D
mov es,di
! D& Q n2 }$ \ mov ax, 1684h 4 h# G& N: c0 p2 f/ ~: X1 @
mov bx, 7a5Fh ; VxD ID of SIWVID
3 k/ ]. s2 g, J+ q7 d int 2fh6 e% s- c3 s. ^0 N1 p( f4 i& o
mov ax, es ; ES:DI -> VxD API entry point
3 M) N. P. t9 P( l7 o add ax, di% X% G, ~6 M' b2 f/ N& |# C
test ax,ax! w$ q4 X% Y" @0 w& Y) B/ S7 W
jnz SoftICE_Detected/ @, ]7 I% t8 P( H1 z( g/ i& P, t
5 N# G2 r# @2 h7 S__________________________________________________________________________
" g+ H1 f# }+ L1 B9 n: n, F! z( A9 `
; X3 m W J4 H( `& f
$ W K. T7 Y7 t! G! y1 |( F) _+ f) sMethod 05
0 H8 m. Z. _. J, U=========. V* A' W1 h8 |" d# b& N
, b$ l7 R. V* x1 E7 J4 gMethod seeking the 'magic number' 0F386h returned (in ax) by all system$ e8 H4 g: J+ ~# {: i
debugger. It calls the int 41h, function 4Fh.
. N, S. Y; ]" q- r4 _ V, S* _There are several alternatives.
# J, W7 G9 r" [9 w+ D u" L" J4 u7 w. y
The following one is the simplest:
; w! \9 k8 F6 O/ s5 K2 j8 L6 P2 x7 t1 V9 z! W$ {
mov ax,4fh2 T, p3 |' x: x- w7 a) r; b
int 41h
3 w: X8 k; U2 W ?3 t b) j0 A cmp ax, 0F386, P8 m! @$ H8 I" A. ~
jz SoftICE_detected
4 e9 E3 T6 q" y" @6 w
9 I7 u: p1 ]8 V& l$ x j2 \+ Y) [ Q/ A+ I" I
Next method as well as the following one are 2 examples from Stone's
: F% ^" \0 b9 i1 b"stn-wid.zip" (www.cracking.net):
3 a d4 |+ L' z0 O( G, r4 t* ^. F8 Z( g8 c; f+ z
mov bx, cs9 i0 X! r" S% M7 H7 p
lea dx, int41handler2* c; s/ z0 w( w8 `/ c! q5 Z1 a8 X4 C! {
xchg dx, es:[41h*4] J" H& }7 F% M7 N
xchg bx, es:[41h*4+2]. h2 ]" E7 I% Z7 |
mov ax,4fh
5 Q5 _3 u8 X: p" ^& v int 41h0 s. f0 n7 O8 }0 ]
xchg dx, es:[41h*4]$ J# a0 m2 s7 Z+ o" u
xchg bx, es:[41h*4+2]/ [% J' Q7 y% P& ]: D& v' x! T/ `1 y
cmp ax, 0f386h$ {7 G) }# H! W1 x( p- J9 u) h# v" n# A
jz SoftICE_detected+ I' W$ ]% K5 o3 J; U
# r! O0 V* {+ L) A7 z1 o2 M4 Tint41handler2 PROC
! U6 V9 R9 q* H' w) | iret
. i" H1 t0 T) d, P! U# h. Cint41handler2 ENDP
+ G1 x" Y& A) g
/ Q) e4 g* N+ J9 q/ Z
* W2 w0 N' Y& M: S5 j# T5 u_________________________________________________________________________
2 w* _# N5 x: a% n0 @; e* @4 z8 l% ?1 [$ E1 F
- i# s% {# q8 d+ |( Q( u1 P- j# _9 ZMethod 06
, l' D# I+ F; x/ p3 J& _; d=========8 [, ~* ?* V, ?# x [
4 @+ I4 p; N3 E/ C
& B0 J$ c- b9 R% H2nd method similar to the preceding one but more difficult to detect:: R4 T4 F+ }% e
% d9 t; ]# ]4 v0 b8 i7 ~( K
" v; i5 x0 v- m5 n5 L
int41handler PROC
% ?) }( u# X* h. {8 A mov cl,al
& |; b- i" a# y+ b2 ~( P iret/ X5 ]* V: J" o" Y
int41handler ENDP
; j: i+ r0 l6 | Q
! e3 Y8 r3 i1 o. |; J7 {* G3 J7 l" A1 C) o1 [
xor ax,ax3 N8 l) R& }8 G. Y6 [$ H" F
mov es,ax
" Q5 W! U9 \ g) h, @7 V E2 | mov bx, cs
2 t% W1 _0 E/ q2 k% ]: l2 f lea dx, int41handler G4 e; @1 l6 q/ C' \
xchg dx, es:[41h*4]* ?1 ]% {: v* F$ T8 A$ J8 y) i, @
xchg bx, es:[41h*4+2]
. s6 _( b' [) N in al, 40h
; s0 [ R- w0 | xor cx,cx* M- P7 p5 e" l! x( s, J( R
int 41h
+ {6 V# V8 I% c x; c xchg dx, es:[41h*4]8 y* B+ d }3 d& C- e
xchg bx, es:[41h*4+2]
5 q; O& u, T* M6 V2 V: D, J. _/ a cmp cl,al
. S8 I& |9 c- v1 Z2 ] jnz SoftICE_detected
. `' K9 N) c- V: ?3 q. e7 D' Q+ S. z& R; \- R( ]6 G
_________________________________________________________________________3 s4 ?2 V: |3 M+ ^2 m) U8 c
* t; I" r7 F- X" y o! MMethod 07
8 q7 h$ m) \) R: Z) P=========. e& A( Z; d# y$ K
, F2 H+ V: c: M
Method of detection of the WinICE handler in the int68h (V86)8 ]% k1 |: X$ u- Q' _2 U
; k& }3 T8 J0 D7 q- `! H, f
mov ah,43h. Z6 R6 H4 @* r% G r
int 68h
8 o l7 E8 H1 k, F/ `* m cmp ax,0F386h: t, s: K3 k) E# q8 |8 M
jz SoftICE_Detected1 {, p7 B' C8 H
( `3 z2 T, ?' r( u4 X
$ i {" N! D* ]1 C% f3 l=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
- n/ U: x+ K1 A app like this:& t& D4 |. Z9 P8 V4 O
1 @7 r: ~) y5 n1 ]" o BPX exec_int if ax==68
: L2 c# k% V8 f& G4 R (function called is located at byte ptr [ebp+1Dh] and client eip is3 B; u) [ G j7 L
located at [ebp+48h] for 32Bit apps)
u( A; J+ E- {2 L9 }4 E__________________________________________________________________________! o7 j8 K% e% y0 v8 u/ D* R
3 j0 b9 X0 R0 f3 P, F2 @
4 \9 p' a$ R7 a; ]* K" xMethod 08
$ |1 y/ B% k, Z=========1 A8 c7 {) n* S; d4 c$ L v- T1 E
% P, ?, Z! p5 s7 k2 a; HIt is not a method of detection of SoftICE but a possibility to crash the
- L( y1 N7 |6 r( M! b, ?system by intercepting int 01h and int 03h and redirecting them to another+ j1 G# A* i! M- n2 [, f% }- A
routine.
9 E/ ^ w D" Y6 q6 wIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points W3 j* b* X3 K
to the new routine to execute (hangs computer...)+ R. E/ D) v7 U6 R' g# V. k9 H
& i- j9 i- o# ~! R" J
mov ah, 25h" f! D E& D( K+ W2 _, C
mov al, Int_Number (01h or 03h)
4 s* M& c, v( U mov dx, offset New_Int_Routine
' F. e% l" V6 p: B5 g int 21h* b" n9 Y5 Y6 @0 h d
* ~2 W: V* j8 i9 o& d8 H6 G
__________________________________________________________________________
+ n+ X6 ]8 |6 ]6 f) J
$ a9 a! A, V4 i3 UMethod 09
! A! a$ N/ \: d c* b- u=========
% q5 o. i* F' `* A+ A$ K0 o. l: k& C
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only+ E1 l6 A- B. }7 k3 r! X/ G
performed in ring0 (VxD or a ring3 app using the VxdCall).6 u/ h5 L5 ]" _9 g( g! r
The Get_DDB service is used to determine whether or not a VxD is installed; c( W" A, S& \! }8 N# `: Q
for the specified device and returns a Device Description Block (in ecx) for
4 [ A; v ~% W; @( `5 ^+ g0 W' v. Athat device if it is installed.
1 w0 U2 w/ t& q( d; `
$ j7 S" k8 z; p- R mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID" @5 W% c" g0 y# W P
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
1 c* n- a9 T8 }( @! s- b VMMCall Get_DDB
, q" o" ^0 J& Y mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed4 {0 z( C z! z b# Y8 t* q0 A
1 i$ b6 }% B" z1 t MNote as well that you can easily detect this method with SoftICE:& i7 T6 E) ]6 b! V* c
bpx Get_DDB if ax==0202 || ax==7a5fh, a8 Y# {+ m5 n: q0 d5 V
4 E* D: S$ H! _! b9 @/ l__________________________________________________________________________5 v0 c6 T" Y! ^" _% Q$ }2 O2 U% t
( R: P1 ~' e% s y5 z, {2 ^1 g0 ?7 D
Method 10! S7 \; k+ \2 h0 T
=========, ]/ u6 X/ f" g2 r& `3 N
& \) E# g$ D6 k1 H5 u- m
=>Disable or clear breakpoints before using this feature. DO NOT trace with
; a1 e5 n+ A, K5 Z SoftICE while the option is enable!!
& q& W+ \' o& M
3 W0 M$ z4 Z6 n' S* C$ Z. QThis trick is very efficient:
2 o: h0 m: q& t( |- Q( aby checking the Debug Registers, you can detect if SoftICE is loaded
5 C0 b& P: T: a! X* k) g(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
+ W6 S$ G2 U$ x8 nthere are some memory breakpoints set (dr0 to dr3) simply by reading their' q: n% Z+ g0 D% k9 l) \5 e. g2 O
value (in ring0 only). Values can be manipulated and or changed as well
9 J' u* }) R# C& Z7 \# E(clearing BPMs for instance)
1 P3 X( T& B# e: x8 _3 G7 K, u% z0 B1 a0 b
__________________________________________________________________________
5 @. e" \4 O" b% C8 B* h
9 H' T" n) [6 F g5 g4 UMethod 11* i9 B1 C& d/ x* U; i4 |9 h
=========1 t0 q* j' v; ?
# a# s7 W, t2 b* a% P( S
This method is most known as 'MeltICE' because it has been freely distributed& }: G7 f% L. K" O% e) U
via www.winfiles.com. However it was first used by NuMega people to allow/ q9 Q8 {) H: L e3 L
Symbol Loader to check if SoftICE was active or not (the code is located ?' A2 H s- N' _& p8 M$ p; `
inside nmtrans.dll).
& ]4 N! V! R4 @" P7 ~. i
0 I/ O) D9 Y& \1 LThe way it works is very simple:
1 O( s7 g) R2 Z/ }3 JIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for7 t( }7 R& R( }! z2 y: L' Q" V
WinNT) with the CreateFileA API.5 C# v* [$ N* l1 A; \' D2 \
7 T9 d5 v A' o8 d" ?6 f, |Here is a sample (checking for 'SICE'): V3 e" _ ]. @6 J f
. c) A/ F7 ~& L# H( x d! h$ \- s, hBOOL IsSoftIce95Loaded()
0 _( p* o- p c# z{% K* E( l5 i }( l" W# z
HANDLE hFile;
) N* {; z( V* B: i hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,, B! t( o2 }) e- W& G
FILE_SHARE_READ | FILE_SHARE_WRITE,
$ K& w2 b$ @& r, L7 q NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
$ z3 z {, ?- Z8 g' z) M9 \ if( hFile != INVALID_HANDLE_VALUE )1 }" J3 e. V' [4 u; }$ q# w- n
{
+ \ `+ S4 F7 ^& |0 w+ ^" ?; P CloseHandle(hFile);
" W5 w" H- q2 Y1 p$ R& S( B return TRUE;# s( R7 \$ l1 w, G& H6 Q* J5 u
}9 H3 t# J% A# @
return FALSE;8 c$ ` d" l1 D v5 b N
}/ p/ U4 e: D* A {: P* V
' F# x {" t, O/ E- _ @( g
Although this trick calls the CreateFileA function, don't even expect to be2 t3 k3 H0 e& U' u h' w3 s# W
able to intercept it by installing a IFS hook: it will not work, no way!5 o9 p8 P8 c6 p5 K1 T. t
In fact, after the call to CreateFileA it will get through VWIN32 0x001F5 D. q2 F9 D/ O( T& b/ X% ]4 n: P9 K4 M
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)0 b* [1 ^8 \* { Y
and then browse the DDB list until it find the VxD and its DDB_Control_Proc* B% L+ b: k4 ~& t# _
field.
2 q! r, J* r; D" A, |In fact, its purpose is not to load/unload VxDs but only to send a 1 c( b+ c0 T3 z. `" J6 C
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
! L' c( z* E( sto the VxD Control_Dispatch proc (how the hell a shareware soft could try& r* }2 [( s$ v. ?: C' u
to load/unload a non-dynamically loadable driver such as SoftICE ;-).) n' E: T" V5 b5 j
If the VxD is loaded, it will always clear eax and the Carry flag to allow0 h* D k& n6 F V1 x/ E) B
its handle to be opened and then, will be detected.
6 A K. p, g) _! M, a* tYou can check that simply by hooking Winice.exe control proc entry point
1 z1 w& s3 E3 X) j" R" Gwhile running MeltICE.$ e+ T. f N' I7 c8 C" ^& D( G
; H4 k4 ^8 j2 G N& n
; E" p* O1 F- }# L 00401067: push 00402025 ; \\.\SICE5 ]; S: {7 J/ c
0040106C: call CreateFileA
+ `* u) O* |: @$ s7 Y. ^/ c5 ^/ y 00401071: cmp eax,-0013 G9 D0 p' }0 \0 ^1 ?
00401074: je 00401091
, R8 O: C' A0 D! U0 ^% D$ d3 ]+ e4 g" z2 w
6 w \$ L0 r0 g" t9 g
There could be hundreds of BPX you could use to detect this trick., x: y* D1 ? `
-The most classical one is:
" ]+ i2 b- H# ?5 E N BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||7 [. T/ m; |- s9 c Y
*(esp->4+4)=='NTIC'8 T. g; M C" ]8 H5 P6 V% L
' C, c5 t- O- z
-The most exotic ones (could be very slooooow :-(! F5 b- j3 e9 c/ }8 {7 C
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
1 g7 G& t! l2 X1 A4 W ;will break 3 times :-(+ I# g1 H# R( V; S; p: N( {/ x
* h% V; C' A* z- n0 G-or (a bit) faster:
# ?9 {! x8 N7 w# x) ^( _ BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
' N e! v f5 T8 M# {! x% L8 g6 S# f" ?( h; [
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
0 ~% X& ?0 x0 r* r3 ]* D% O! T ;will break 3 times :-($ J+ e( ~$ D# t/ J- N4 Y
2 t4 f8 _" r& s: w4 J. U% \
-Much faster:
( S$ A- g# l8 M% E5 t' l BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'/ T5 u* d. p6 I" Z
: `/ k) h* h$ \! ~0 ~; R
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
( F" z+ B1 ]0 \; C& h7 afunction to do the same job:" V! `- v/ y* u3 y3 J
: X: S# G$ H( J; W& Y
push 00 ; OF_READ3 @+ z# q6 s- v0 a+ q, o
mov eax,[00656634] ; '\\.\SICE',0
8 e6 m( }& R* S8 h1 \# n9 g push eax
- k K+ s7 \* T call KERNEL32!_lopen
9 o/ @9 Y. _5 g4 F/ Z$ R( C! r inc eax" l% X# P B& v! W2 A4 e
jnz 00650589 ; detected
# w& l) ~* Z3 T) I+ g' j; L push 00 ; OF_READ$ R: ~# I0 J( o0 G z4 L$ j
mov eax,[00656638] ; '\\.\SICE'$ u( D, J: e+ ^6 p+ O
push eax& v- R9 G: {0 m$ X7 ? z# K/ p8 L p
call KERNEL32!_lopen
2 s; I, _' } H2 f4 [ inc eax
: N3 a9 h0 R; x: U4 b3 ? jz 006505ae ; not detected: x5 |: Y+ d! z
v& W! G' Q, |
2 g# U; }( _* s7 ^8 `__________________________________________________________________________4 l4 U$ E) B- O1 [
% B, u' Y1 [& e, V* AMethod 12
$ C- W+ d% }1 Q' j=========
, g8 h- }" w+ ~" H: ~; [8 L
! F1 y% k. ^; J* a" @0 \0 u6 RThis trick is similar to int41h/4fh Debugger installation check (code 05% g3 S: `1 W2 e
& 06) but very limited because it's only available for Win95/98 (not NT)
9 f+ h. t) E: m6 `* Mas it uses the VxDCall backdoor. This detection was found in Bleem Demo.
) ~7 \# M7 y. ?3 D o* L6 {9 T: r8 ?. ]3 D9 \
push 0000004fh ; function 4fh
u$ G1 Q) w5 e4 s# T push 002a002ah ; high word specifies which VxD (VWIN32)
# m( c4 C+ v5 }8 c ; low word specifies which service: N7 o2 D5 O' m1 k: [1 Z
(VWIN32_Int41Dispatch)
, L, Z/ J2 } x7 k call Kernel32!ORD_001 ; VxdCall8 S$ A# V) r2 F' D$ j! v. x3 F! U0 V
cmp ax, 0f386h ; magic number returned by system debuggers
: f$ d9 a1 ^( H3 w, l9 I jz SoftICE_detected* a S! Q* h2 h6 N
9 K' p) v, Z! ?! A2 H' E
Here again, several ways to detect it:
1 ~' l/ X- @' j2 H+ d) X3 ^
; q) g9 T* f: M BPINT 41 if ax==4f* P' K' v7 c9 [, a: w3 ]
3 O4 ?+ `3 m( r& g. A5 F, E5 e BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
: @! A* o- ?6 d( t( ]
, s' ]2 B' R" l% q, D2 c BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A" g. x. T2 d/ V. a0 F8 ]; P
# a) c+ q5 ?% M! F$ Z% B BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!+ w- C& {3 C4 s; n' z3 o1 I1 S
/ E9 w7 P! v; g) F) B$ F
__________________________________________________________________________
3 o8 T! I% g* [- ^- d5 r6 O9 B, k
Method 13& s7 s# o- C9 v/ r* p
=========( U1 z' x! \6 |, z
* ]" q7 A! a+ c$ eNot a real method of detection, but a good way to know if SoftICE is
+ X0 p6 N$ ]+ M! B7 uinstalled on a computer and to locate its installation directory. I. [, ~7 e8 U: o1 J: ?* N
It is used by few softs which access the following registry keys (usually #2) :
% H( \. a5 i. x' `% |# W; k; q7 b( ?8 A9 O0 R" f
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
1 X. p3 n& l" Y; X\Uninstall\SoftICE4 [8 b: e. u" M+ Z5 d' _
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE3 l6 P+ }# [& U2 p3 U. \" b
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion& ~+ k4 s s2 U! C& \0 \" r. X
\App Paths\Loader32.Exe3 C% r L8 z4 M8 a7 d5 B5 ?) ?
9 m: ]% ~' `; N2 C
% W7 h' s* S% G2 ?4 V
Note that some nasty apps could then erase all files from SoftICE directory* _8 C4 \9 R: n; G+ a
(I faced that once :-(
1 \' p7 c- e7 c! S, x3 G/ u8 x8 w7 N1 ~, k
Useful breakpoint to detect it:
, a1 }7 A/ c3 U3 ], l9 e2 Y ?3 M( W
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
* L9 d8 n& n* `1 S$ D& [( A: E9 d
__________________________________________________________________________
( i3 h* g; e& T1 o# e9 B0 g
5 O: z& _, W0 G N, J/ g0 p- m1 }5 j- D' ]5 r$ }* S1 h, ^
Method 14 & U4 P1 m+ K1 F1 \* Q- \
=========
, I2 S* i" U, t3 T0 l. c, J, A3 e
% j+ E, U! I" ]2 PA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
& _8 \# p5 }, o8 `is to determines whether a debugger is running on your system (ring0 only).5 P o" e5 f. y
* G8 ?) I" Q2 u0 `# T VMMCall Test_Debug_Installed, P L7 P- y9 m
je not_installed; P/ Y/ a5 M+ i) Q& ^
1 Z( e0 W% v6 T& G
This service just checks a flag.6 x- G( B& X- n9 L
</PRE></TD></TR></TBODY></TABLE> |