<TABLE width=500>7 W) G' M6 \5 S5 V- {
<TBODY>
9 W2 w- ]: ]4 I, R% L% f<TR>
+ ?3 g0 M$ A' e+ K<TD><PRE>Method 01
^9 ^7 R( q- |8 M, O3 o=========4 l5 P. [% W$ f( m" H' }% A
# l8 Q& p- T; J a @5 o4 I7 `! \This method of detection of SoftICE (as well as the following one) is
& i6 j ]; ]" mused by the majority of packers/encryptors found on Internet.
9 z5 |1 J2 f7 i& {2 I0 `+ C6 e+ PIt seeks the signature of BoundsChecker in SoftICE! x6 v+ A1 J. I6 X c( D
: G# ~1 R2 \5 Q% z& b$ L mov ebp, 04243484Bh ; 'BCHK'$ r. t" t4 L* I6 M! \4 W4 X6 I
mov ax, 04h3 ^1 {: N+ ~- r. r
int 3 1 D( h: v+ y# r
cmp al,4
. O& \7 M8 R8 f3 _' C1 [ jnz SoftICE_Detected+ e: G' H! c+ Q2 v) O
) _2 B- f$ M. t0 D+ [( F% i# n
___________________________________________________________________________
' s a; c! z' W) V6 r& R. J+ z3 J% Y5 J6 q3 i2 F5 y
Method 02: a8 k- |6 J8 Q$ _
=========2 ^5 ]1 g0 H# W* P1 d/ b9 s |0 d
# I. D( W. W, B, @! f7 O N
Still a method very much used (perhaps the most frequent one). It is used7 ]# `1 ^2 R( L* ]7 z! n9 Z
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,9 [1 J* l" b7 i( v) w( _
or execute SoftICE commands...
- k8 m( e5 ]& J% c) {; {It is also used to crash SoftICE and to force it to execute any commands
% M! B6 u# E, Z2 M5 l(HBOOT...) :-(( ! h0 _: H- {2 l$ ]
6 d5 W; p8 c6 y% ?- u% x
Here is a quick description:8 L0 `/ i7 F/ W6 u& m* R9 ]
-AX = 0910h (Display string in SIce windows)
/ X- {4 f1 K. C-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
! W4 Q* O9 n) P. y-AX = 0912h (Get breakpoint infos)6 y6 g- V" X* W) d5 R4 x" g4 ?$ B0 S
-AX = 0913h (Set Sice breakpoints) E3 K% }. x1 D7 W7 j
-AX = 0914h (Remove SIce breakoints)" b$ @) X. G4 Q, W; J# ?
9 n. Y$ w7 k7 x2 |Each time you'll meet this trick, you'll see:
" w* W, m$ o5 y3 m: x-SI = 4647h
9 q; j+ T0 X8 w4 t$ ?' M# f-DI = 4A4Dh; m& o- F! c$ o; J
Which are the 'magic values' used by SoftIce.0 P6 S% n0 [ z1 K2 A% n9 P8 u
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.7 e1 J- u! _/ ~. J$ U* q
m% n [: S m2 ^9 PHere is one example from the file "Haspinst.exe" which is the dongle HASP }, J7 Y9 s. n$ u8 b
Envelope utility use to protect DOS applications:
' @0 R4 x: [2 @/ s' r% l
- W9 q4 ^4 X5 O/ O: y+ l, t0 \2 C
4C19:0095 MOV AX,0911 ; execute command.+ P6 {6 p8 ?% A* r& I
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
1 Y z! p: D C6 D% S: ?, ^ {4C19:009A MOV SI,4647 ; 1st magic value., C8 L: F [0 I6 s2 I! L( I4 @
4C19:009D MOV DI,4A4D ; 2nd magic value.
8 t2 y3 L5 R# {! _9 c( ]4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)7 s/ R/ P0 x7 r
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute9 L, k3 B5 [2 G9 [( r, ^
4C19:00A4 INC CX+ F- w, W, D' {4 a
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
; M' P% m$ X# B# v; \3 z! J4C19:00A8 JB 0095 ; 6 different commands.
! q( o0 U* B2 D. B- ^4 d& ^7 h" R4C19:00AA JMP 0002 ; Bad_Guy jmp back.
3 e& r% _' ~/ X: M) W4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
{3 H( a9 b1 b
5 X% B. Y: u) m9 u) BThe program will execute 6 different SIce commands located at ds:dx, which% k$ T+ c3 r& ^ p" A' f+ S
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
/ g' ^" E4 T% D$ V# a9 A/ g) u- r% }+ R, b& V0 ?( Z/ R
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
6 i! n) R+ C& `( R6 W___________________________________________________________________________
6 J' ~: I( o& M: }: D' x- Z& I, ?) Q; `0 ~% \1 R
6 i( O) c: ?. p+ q( o
Method 03
/ F3 a9 I' q/ p( A+ `=========$ T1 h+ X4 A3 ?7 r- ?
: N1 b# ~4 r' p8 nLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h; i% i* \5 R# `; p$ t$ U
(API Get entry point)
+ l- }( w2 |' F4 _( S ?) h, B " g+ X% [0 m7 o: r9 H* b
* P* S0 V; o8 N; v4 o1 K
xor di,di
4 l' t5 @. |" P. A mov es,di
6 x* U6 ]1 u0 ` mov ax, 1684h
4 f/ r5 o1 D( O: n# t( g mov bx, 0202h ; VxD ID of winice7 x7 t8 z" g- B
int 2Fh/ P2 g g1 `5 ]0 i h" I( A D8 O
mov ax, es ; ES:DI -> VxD API entry point8 o1 q" G- \7 B2 l2 h- R
add ax, di
) P2 A( X6 J$ X. v' m% e+ j1 `, M test ax,ax
& w# E" H9 d& \" d jnz SoftICE_Detected5 V. o5 Q# G6 N' C% N9 g0 S, C0 f
0 L: Q0 v( c, J# C& E @___________________________________________________________________________
) x' ^+ P# r& g5 y+ z" l/ [
' i2 {; M0 E. D4 p7 iMethod 04+ ^& x- a) {& R! H% \- ]' @
=========5 d; m3 O3 `% z! e# l" {8 c+ P
. i4 ~! m Z8 u
Method identical to the preceding one except that it seeks the ID of SoftICE' I6 S3 T1 x3 S: K3 i Z9 {
GFX VxD.7 C; {- [+ k) x% E# x% z G
2 w: O* s% z' o xor di,di' m& Z. i& m) N' ~) C
mov es,di
, i9 Y' N0 L5 W0 W/ K* Q9 ? mov ax, 1684h % L2 \' }8 `: Z
mov bx, 7a5Fh ; VxD ID of SIWVID* u# w- \7 S7 h/ z# ] [
int 2fh
" K& u# A& \9 S) c% b8 L: x mov ax, es ; ES:DI -> VxD API entry point
* u7 K7 U# I- I$ V$ f; y add ax, di! j" e; d: v- C7 J! o! K9 [ g# k- e
test ax,ax9 B9 _5 d9 ]" [) h4 g8 L. |
jnz SoftICE_Detected
& _4 A4 `; F5 Y. p. c4 p8 J! t( Y9 o7 {) r7 |8 U0 T
__________________________________________________________________________7 ]- f7 Z2 v8 \' y0 F; p& U
6 |% s: u' p2 H7 z- V/ N1 S# O8 w- X! z- Z) ?
Method 05* V7 ^$ H- E+ ~+ V
=========
- P0 T" e2 E$ w6 x7 ^& e! l4 Q, s8 m/ |/ C) S$ W
Method seeking the 'magic number' 0F386h returned (in ax) by all system
( [' u [8 C& i1 b5 O/ R3 `6 Ddebugger. It calls the int 41h, function 4Fh.
: G6 s9 W- }0 F! }8 o7 hThere are several alternatives. 6 u- P$ v5 _2 o: g: B
9 X) n3 H" ]0 u4 m+ E" D& uThe following one is the simplest:; w# q/ A: e1 t/ u2 v- s
9 ^3 v% h' \2 M% R* O( E0 i7 K% S9 Z mov ax,4fh% M: H5 \' W5 W% i
int 41h
6 ^: T1 U- Q% ?3 K3 V$ G cmp ax, 0F386
4 @$ h3 f# f4 L7 Q+ r jz SoftICE_detected
, j, M% q* p; ~2 G/ l
$ g! P. q* V9 |7 w' z s% X) k& ~% s" q! n* n; ?1 i# l
Next method as well as the following one are 2 examples from Stone's % e: P& v9 E6 m+ }7 I4 }5 ?
"stn-wid.zip" (www.cracking.net):
) d& G: P3 o5 W' L( Q# B# l- `, h, d2 z3 B6 M! O
mov bx, cs
5 W7 c) B0 ~* |6 n0 D7 m: C lea dx, int41handler2$ u9 P1 }$ K1 `5 v0 G
xchg dx, es:[41h*4]
* E5 Y# k" O% ~; ]8 K( I xchg bx, es:[41h*4+2]
4 q T- a. y+ O+ ]" B' n( {6 { a7 l# M mov ax,4fh
7 v9 O+ v) w( e) x1 e int 41h9 E- D/ R2 C2 ?* O
xchg dx, es:[41h*4]
) ~" v" @( p P( ^ xchg bx, es:[41h*4+2]
4 z4 \& H' ^) N3 b+ D* q cmp ax, 0f386h! N1 f$ `0 o- L; ]$ C* T
jz SoftICE_detected6 M! m; z) V1 n/ o
( I% z# x+ \2 l' z9 e- v- _& i% l
int41handler2 PROC6 }- z* I, i: S, P: C
iret+ T4 k2 J+ g% h, n
int41handler2 ENDP8 n8 ]8 B4 c2 g( i
/ j( r; k' k9 ]5 }0 B4 @2 J
z, _5 s( K* N' N1 N9 Z3 P" z
_________________________________________________________________________
2 c4 I0 b; D) f* d5 h6 W2 n3 i
: h8 x ~. v1 b2 G0 g( q7 ?/ p9 K
5 m0 E Z' }, b& nMethod 06+ v3 z; i" w2 S4 f* z3 D- J7 I
=========$ |+ s4 N- x" M
( H* R) d! C. S4 I9 |3 M7 X
5 t' T$ @3 @8 l* ~$ {! W5 D1 `
2nd method similar to the preceding one but more difficult to detect:8 T3 T6 j0 L! t* G& {5 `) u+ Y
! S _6 n9 _, J) V( `$ N. x3 P
* y3 b3 P! [! @& Lint41handler PROC+ G W1 w, Q8 `' \& Q
mov cl,al
' l; c0 Q! A* g: S7 ~, v iret; U' K) Q+ D$ g" u. |
int41handler ENDP1 _9 S6 y" ^7 l( ]
2 X0 V# n% c" F+ T9 F
9 T5 R* Z# i4 T: s
xor ax,ax+ a; K ~& n& n, O) H8 O( S; C8 w
mov es,ax) K, C7 }2 H( p3 w- v3 N& ?7 n4 J
mov bx, cs
- E1 V: ?9 X( H1 G/ o: O1 n4 d lea dx, int41handler
! \7 @7 {( |6 ~. n9 U: u9 S xchg dx, es:[41h*4]8 B" y6 n! T$ B$ d ^ a
xchg bx, es:[41h*4+2]
; L% ^3 b6 N0 J* b2 F in al, 40h
O& @( u, y* |* A: N, _/ W; S xor cx,cx# a% s3 P9 v: y4 x4 _6 U
int 41h/ q9 w: ?5 L+ V x5 r+ ~
xchg dx, es:[41h*4]
; f# I" f9 q! ~' G# x6 [# k xchg bx, es:[41h*4+2]
4 R* w6 m" {! F6 f& n6 I* S cmp cl,al
6 ?6 B2 x6 B3 ~4 |$ L; B jnz SoftICE_detected; u$ u' i; a5 B! ?5 e. n
( `( q4 f; r8 }. m7 k* l) R( a
_________________________________________________________________________3 y. R3 F7 c: ~9 O" d4 m, {! Z* d
' O4 \0 t5 n, k/ _3 {& h1 c
Method 07
# c/ @3 t( a; A! G, [=========& a3 A3 J0 N$ o' b2 L! Z5 C+ s
+ K2 {' L( [ u
Method of detection of the WinICE handler in the int68h (V86)6 U. i3 O- C# c% x3 F
, ~ t* y' Z0 A0 I% I mov ah,43h5 S3 S$ }' ^$ T9 F j
int 68h
/ ~! K( T6 a, V/ I* s cmp ax,0F386h
, }. B6 a. r2 Z6 ~' S X4 R+ Y2 K jz SoftICE_Detected
. P r1 K5 J# \$ O) x$ _& \3 ~( f8 j6 N
; i1 D' z9 }, ~" i" a9 t+ z
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit9 o3 C) V% N9 c0 t8 E6 H/ e
app like this:3 S f. R! E4 N, V' h
& g: G+ }6 [( R% L BPX exec_int if ax==687 [6 L0 f( ~3 O2 z
(function called is located at byte ptr [ebp+1Dh] and client eip is
# N; N9 r1 S7 t! _1 z) g$ g* E located at [ebp+48h] for 32Bit apps)/ i. T3 v. L7 S+ O3 J, k
__________________________________________________________________________
/ s! y. I+ S8 |8 v* j% v9 t& v' r* e
. G1 L; E1 \* I) k* y# W, q
Method 08
- e3 I2 m! o( ^+ k8 Y* D! U=========! D" A. z, ?3 B& @. J3 h' z
- Y2 e; K# m! Y* | ~3 ^- Q
It is not a method of detection of SoftICE but a possibility to crash the0 S, ]/ {7 ~( C! d v& m
system by intercepting int 01h and int 03h and redirecting them to another4 D! B" I. z/ J7 k+ z0 V B6 {
routine.1 T7 ]" {0 Q7 V) y
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points/ B) L! s/ Z3 Q( F1 S2 s
to the new routine to execute (hangs computer...)
8 g4 a/ p/ C# O1 M) \- U' m5 ?1 j* G! W% L; F8 u+ V; s& V
mov ah, 25h2 g7 E3 q1 N0 W) \. o! q3 w
mov al, Int_Number (01h or 03h)' [! q' G% h" k5 M9 ^6 G( @) ^, |% K
mov dx, offset New_Int_Routine! a) h% }1 T, E9 U! v* {% e
int 21h# O# v3 i# l; e8 R t
- V) @* b+ @4 j( {( u1 Y2 `__________________________________________________________________________
, p" e- S& o% J p4 g% W$ r/ G9 e
2 i; o6 W3 N) G* b+ L4 M; F2 zMethod 091 r9 U; r% l. ]* c
=========5 w' `( J! j' l( V g: e# O/ L
E! E g [ c& U( |) u, t' o
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only9 v' R' n9 C- Y2 H9 S
performed in ring0 (VxD or a ring3 app using the VxdCall).8 K5 b3 A: q. M% ]! \8 ^
The Get_DDB service is used to determine whether or not a VxD is installed
9 g( g1 V/ T/ zfor the specified device and returns a Device Description Block (in ecx) for
# K) A# W7 P) p* p+ E8 A j8 _ u: vthat device if it is installed.! ^, F" U& \) X* j: s/ c" ^
& s4 k. b) F* a
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
+ V3 h: D6 w8 P$ |5 B5 b5 Q# D6 ?) c mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
i0 q% i* R- S VMMCall Get_DDB* x3 C( f/ Q( P9 B) g0 w& n7 {7 u
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed9 u h* N6 O t; Q8 i6 ]
% O) R q4 f3 B1 kNote as well that you can easily detect this method with SoftICE:
$ U |- _7 h6 Y. f( q1 k bpx Get_DDB if ax==0202 || ax==7a5fh
' H& g b2 u+ A; D2 Y0 }% L7 Q* a3 C+ [7 C7 T2 S& z2 K9 {
__________________________________________________________________________" }7 f" t, L4 L( x4 \% ^
! c( z, T+ Q: L9 ~1 \1 [$ lMethod 10
6 b# U1 e: N ]* j=========
; s' C0 j6 r, `- T5 P, G' e8 T/ ~- S3 O0 \% q
=>Disable or clear breakpoints before using this feature. DO NOT trace with
# K6 u% d3 T6 {) C" V) X SoftICE while the option is enable!!0 }+ E+ e( E' D7 K
- Y9 U4 w+ T* U! `; R
This trick is very efficient:
$ O& J$ l; o5 [: v' K7 Sby checking the Debug Registers, you can detect if SoftICE is loaded# ~4 P3 T# \, W5 Z0 b0 Z
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
) s; D9 ?/ I% R6 ?2 t" L/ tthere are some memory breakpoints set (dr0 to dr3) simply by reading their$ o" ^& c, X0 P" y0 ?$ \
value (in ring0 only). Values can be manipulated and or changed as well5 A% X8 m! N0 s0 M k, y3 w
(clearing BPMs for instance)
9 R8 ]) [- E \
6 V+ |2 T& e/ x# q" t; _# ?' W__________________________________________________________________________& P& @+ i# A. ~
~ {9 C, \" w3 R, KMethod 11, T7 C& u7 n) v! m+ \
=========0 V& A% Y! w4 | R0 w1 [
! \0 j: H( Z5 V1 hThis method is most known as 'MeltICE' because it has been freely distributed# A+ ^' Z: L1 T! _5 a) Q( ]( f
via www.winfiles.com. However it was first used by NuMega people to allow
. _& H& ?+ g3 ^" HSymbol Loader to check if SoftICE was active or not (the code is located! ?% F4 ]+ S9 B1 }* Q! F
inside nmtrans.dll).
% E% b; m0 ]4 `, h, R3 ^: W3 K! j+ v* O6 M
The way it works is very simple:. O& o' f; }) T
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
q8 ~2 p7 E" B" j! xWinNT) with the CreateFileA API.
, l! N; \7 x4 a+ l5 v. O. w
+ H m0 X7 g+ R5 e+ }Here is a sample (checking for 'SICE'):
6 R! D4 o2 Y% P0 t- D& m q% t0 o$ o* w* q+ E
BOOL IsSoftIce95Loaded()
5 M; A7 [/ p' V2 g) i{4 v0 K: {- m5 }3 c0 U0 S
HANDLE hFile; " O q4 a( b% m# j8 `
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
; a, Z' U& n) s' P4 U6 i FILE_SHARE_READ | FILE_SHARE_WRITE,
0 d' u5 ]2 `5 | NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
7 b% c; e' M* U if( hFile != INVALID_HANDLE_VALUE )
, R, M G9 ]! q: O {0 {( K! {" m6 e( ?
CloseHandle(hFile);
$ I s3 c# r& ~ P' y return TRUE;
9 {/ b- ] b8 }8 l1 P9 p8 x }, P. O% Z9 B" U
return FALSE;
i" r( m- F, f7 F" @3 O4 q}1 ~- O8 o# ^! J8 B0 M/ [4 k
+ g8 }1 W8 X1 P7 sAlthough this trick calls the CreateFileA function, don't even expect to be1 C0 u2 G3 N8 Z% n# a. d5 g
able to intercept it by installing a IFS hook: it will not work, no way!4 [; _6 u0 E' h6 y+ X
In fact, after the call to CreateFileA it will get through VWIN32 0x001F, ]0 E, e+ @* O3 ~) x
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
6 }# Z% p0 [3 i+ Qand then browse the DDB list until it find the VxD and its DDB_Control_Proc
9 J3 O6 S! u5 M) {8 S/ qfield.! @" }0 N* K# k0 ~9 ~4 ]* M
In fact, its purpose is not to load/unload VxDs but only to send a ! m5 u4 D* \2 @
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)+ [0 r4 a+ l7 U v' D
to the VxD Control_Dispatch proc (how the hell a shareware soft could try. }0 q! m5 n6 n
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
- F: Z9 d+ l0 _3 R0 |% w5 Z% FIf the VxD is loaded, it will always clear eax and the Carry flag to allow! B* c5 H1 E: R3 U2 o1 |2 A& {
its handle to be opened and then, will be detected.
& O$ A& X" \- vYou can check that simply by hooking Winice.exe control proc entry point
. L8 x% |9 O1 h. V- ?* p6 ewhile running MeltICE.$ u( n' t* _8 e* D: V7 _* `# {
; U- K9 ?2 ]8 r/ c% h0 q5 B
$ \, G: G( E4 M0 c6 v6 M1 M' w 00401067: push 00402025 ; \\.\SICE
, z- n9 N$ y( h2 P1 I$ K6 X 0040106C: call CreateFileA
' q" z; n6 k1 u 00401071: cmp eax,-001
* i! C1 S& m0 K3 O6 R- R 00401074: je 00401091
: r) u( }8 n3 V6 G, }+ l: @9 e; j6 @' j9 d- N/ p! i) K, ~0 g/ w
; j. N. I9 Y5 s" D3 y. z
There could be hundreds of BPX you could use to detect this trick.6 r% }7 }. \0 S
-The most classical one is:0 {, T' h+ D0 W! a% Z
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||& w, D9 j$ |+ p8 q" c
*(esp->4+4)=='NTIC'
- |- I0 |3 Z9 ]
& L# w3 v+ D3 Q3 S X-The most exotic ones (could be very slooooow :-(
' R5 Y$ S4 V1 }! x' ^/ B5 G- k BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
; e5 @/ `. t1 Q" u ;will break 3 times :-( n/ Y# Q B" J! Z* ]" T( n& \
; o- M+ i3 x2 P4 e& [8 C& ]2 [! `
-or (a bit) faster:
% H$ ?7 y; B, l6 w2 n# H BPINT 30 if (*edi=='SICE' || *edi=='SIWV'); W$ `) c& o. Q% @" x* {9 ]- B
- e5 b2 J6 q2 b( T8 {) e" ` BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' " h* ^3 ^" n( I
;will break 3 times :-(3 M' O# I, M& j9 H M
6 V' B0 H4 M, {4 o8 \7 H1 {+ Q
-Much faster:
2 @8 H( S( `+ k9 `5 K, [7 Q BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'7 ~7 ?( ~4 q6 J' m
1 D8 j% V7 S7 f9 S; ^; `
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen5 `$ q4 y$ Q3 q0 f# M0 Y
function to do the same job:
, n) S) l3 `! M7 I) B' J* A$ Z
! a. i! @/ j% L" _% E( B push 00 ; OF_READ
! g- C8 l0 ?8 z* B2 Q( k1 A' d mov eax,[00656634] ; '\\.\SICE',0" b9 p! m# {8 j6 j0 l: d" _
push eax
G: E4 F" M7 u; }) k% @2 D call KERNEL32!_lopen
+ w* }* f/ H$ H* y7 z2 p* [ inc eax
3 r6 h7 {$ O$ o! T2 H7 O% @ jnz 00650589 ; detected
" D9 T# |; k3 X: s" m* \- [8 a push 00 ; OF_READ5 G% C* _6 H2 {4 \ K4 Z: H
mov eax,[00656638] ; '\\.\SICE'% x$ Q% Z2 w" b. Z
push eax
7 W5 k9 Y. i0 q# c$ [" | call KERNEL32!_lopen
! \* @! \$ X3 H4 }6 W inc eax
% ~+ P+ Q8 ?4 I) ?' r3 T% l, y jz 006505ae ; not detected
4 \5 B" X8 T) v- u; ?* v2 {; F/ P, Z; V+ [! K* L- y
) D% ^/ r* T& E+ s ~2 M% C5 j
__________________________________________________________________________/ C" `8 O7 _, |+ L( G
. s! a) m4 h" M( y$ ~
Method 12
: [ |$ m) ~' Y0 Q=========
- h9 `& @2 d6 V0 O L6 U7 m) B, i( W/ P6 l- d4 J9 Z! k% d
This trick is similar to int41h/4fh Debugger installation check (code 05
5 _$ B# h9 Z" {& 06) but very limited because it's only available for Win95/98 (not NT)+ L: M; {& a! k- O) h7 |
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
+ Q y: ?' s9 R. F9 b+ P' t5 v V6 I+ F5 E
push 0000004fh ; function 4fh8 x- u3 L) m1 F5 F; K4 |
push 002a002ah ; high word specifies which VxD (VWIN32)
9 r) O T' r0 a% O! \0 \- L7 P- c ; low word specifies which service4 f! y. ?3 n$ n P1 O# V e' T
(VWIN32_Int41Dispatch)3 B: u( d* g% @8 g
call Kernel32!ORD_001 ; VxdCall' E- i+ P4 }' R9 J. S+ e
cmp ax, 0f386h ; magic number returned by system debuggers$ o, E: v a1 d4 \6 T' J
jz SoftICE_detected {+ g- [$ e) s5 u
2 _' O. s/ T0 H
Here again, several ways to detect it:- Q1 n0 S! d1 e, B! A
& {8 {5 M' B7 [, c/ q0 g' U+ z8 f' g7 q. o BPINT 41 if ax==4f6 w# I0 j; M3 z( Q4 Z" \
O! _9 l5 e; X+ _8 r. Y
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
9 q6 T( r3 k5 i& f I) ?2 P/ _( B) M1 H U7 Z: B- }# n
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A# o( Q% v) B2 V( d8 M" f
+ m5 R8 h% }9 V; B
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!( b- L/ U- u, ?' ?# C; b, ?0 |
: s4 V' I$ H$ E8 ]__________________________________________________________________________- k0 @- p9 Y* I1 E
; Q; J4 v; I+ p
Method 13
9 O/ `/ @9 z6 u O: z( A; \3 z=========% Q2 O- _/ V/ o2 _. K& D* l, Q
" F- |/ _. x7 J, `- BNot a real method of detection, but a good way to know if SoftICE is5 ?5 M' j% y* V& Y: j' \
installed on a computer and to locate its installation directory.8 ?; O0 N7 G- \/ A+ O2 O
It is used by few softs which access the following registry keys (usually #2) :
! y- l3 T* X0 q
9 d2 L' Q; q; P+ @-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
# s2 S# I* U1 E" Q5 d\Uninstall\SoftICE
2 S* ~: X7 S# I( t+ a I4 n4 K& s-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE3 X9 a; I/ X$ B1 A- y2 o/ l, o) N
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
/ Y" H7 N0 |" w7 X2 @% N\App Paths\Loader32.Exe+ ?9 j+ ?+ M3 |
& o4 G- T: L7 k: z' i& J) Z
: G% _# L7 L+ C' O
Note that some nasty apps could then erase all files from SoftICE directory
% G' p5 b) u4 p8 B/ T(I faced that once :-() o! J1 s% _# \- J: y
5 b' h+ ?4 [% b* P3 CUseful breakpoint to detect it:3 B$ X) T$ L; p" n6 g$ `
4 w% j% e8 Z% _" A/ P1 m BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
! t- V# Y; W" t' g
$ z) Y, f0 T$ j* J: \5 I6 Q2 v__________________________________________________________________________3 h. y/ u( G3 j( |/ @
& v9 ?: Y3 |! y- Y7 r2 K' [6 F# O! S. z' Q* L1 L0 p7 S' [3 [4 j
Method 14
8 @! Z% ?4 Q0 n d' ~, |4 Z# V" X=========
( ~( K H4 Q h4 r0 z' L$ c; A+ W4 y7 `
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
+ R# W y2 x, _" J5 {is to determines whether a debugger is running on your system (ring0 only).- U I8 a& k& m+ R/ L i
* w- r w9 `" r3 h5 `" P' J) d/ X VMMCall Test_Debug_Installed
: P% B$ |2 d7 r je not_installed
! Q1 ^! F8 g7 X- ]% I# ?$ \
3 R# a# v0 n0 d; gThis service just checks a flag.
8 X1 g- v) ~7 q/ F</PRE></TD></TR></TBODY></TABLE> |