<TABLE width=500>
, k7 b+ S1 Z! L# a1 G, I V<TBODY>+ ~" ]; v* E A# |5 G% e. Q& k
<TR>/ H# P# A% ^9 b* ?: o
<TD><PRE>Method 01 ( U' p' k: C) ~8 w5 g1 e% n1 x
=========
2 {9 ^% g c' \9 h& s0 l/ l2 L
8 c G$ [% t) p3 E( B# [0 V, lThis method of detection of SoftICE (as well as the following one) is. N& e/ H. F" P6 C
used by the majority of packers/encryptors found on Internet.3 Y4 w- J8 L; ]- k8 u# R- k
It seeks the signature of BoundsChecker in SoftICE
; q2 M- ?$ X1 p- e9 d' i: w' X! F; c" }& a) ^& C
mov ebp, 04243484Bh ; 'BCHK'
6 y, Y0 G( i, H) | mov ax, 04h3 W0 d+ D9 m4 w
int 3
1 U2 K. q1 ~' X cmp al,4
+ B1 \2 L% N6 O" M& }8 }# s3 i* x5 z jnz SoftICE_Detected5 C' F. V" K4 v5 o6 z
1 }3 F" r% M7 V! s- C, @___________________________________________________________________________' R/ T4 M5 o7 o. r4 J
2 l1 M; b% V- m
Method 02! }9 `8 S/ o+ k+ Q* q5 Z
=========
" b D, j2 ^# a |
q5 c! }6 N8 m$ y$ E6 U2 R3 sStill a method very much used (perhaps the most frequent one). It is used0 |8 ~7 K* f5 }9 [- u& @
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
' P6 s+ E( ^6 E; g/ ^) _" bor execute SoftICE commands...
# Z$ B( g6 h2 g+ r# ]3 KIt is also used to crash SoftICE and to force it to execute any commands
5 G, `+ F$ H. d5 L+ a, d- n(HBOOT...) :-(( ) j4 w; |7 S1 S5 v( v0 J, w
! L1 Q$ r4 w% o# dHere is a quick description:- h$ r, `$ t( {
-AX = 0910h (Display string in SIce windows). E; y# o7 L' P! T5 t
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)! U1 e/ Z1 x! n3 n! K6 {" W. ?0 A. N
-AX = 0912h (Get breakpoint infos)5 Q8 J' |. `: [' T# f6 @& G# o
-AX = 0913h (Set Sice breakpoints)2 f) F! s9 a; P9 g2 b i4 H( n
-AX = 0914h (Remove SIce breakoints)' y' d, _, A. \, T( O
5 U1 P, d. D7 V `5 y# D4 \( p( XEach time you'll meet this trick, you'll see:
' P: G9 r/ o, Z5 O9 B! @7 {/ A-SI = 4647h7 q E2 ]" x8 ]) X8 Q7 {! L
-DI = 4A4Dh: d. g0 | D8 z% @9 M
Which are the 'magic values' used by SoftIce.* T [8 g& t/ C. d
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
' @! Z" _7 ^& T" x6 F
7 O* w2 u u: P. NHere is one example from the file "Haspinst.exe" which is the dongle HASP' u+ W2 v; M1 X
Envelope utility use to protect DOS applications:9 j+ a/ y2 J/ m, I: g
7 B) y5 R$ K* ?- a6 C9 j2 h
$ A) j6 }/ u( w; l2 ]7 m+ B4C19:0095 MOV AX,0911 ; execute command.
5 B/ [7 T9 ]: k2 c8 ^! K9 K4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
+ L5 |& j7 l! b4 p0 J4C19:009A MOV SI,4647 ; 1st magic value.
3 e/ Z% B0 k9 j# U( ]/ _4C19:009D MOV DI,4A4D ; 2nd magic value.
: T! |7 Y4 y2 _% V P4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)2 t; I9 n4 U M: z5 x
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute& K! ~' m. o) r* l7 j: e
4C19:00A4 INC CX4 J* E2 Y. g) ^2 I. E( x
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute( M8 |5 g# Y0 q; ]! n
4C19:00A8 JB 0095 ; 6 different commands.1 ]( n% V2 S4 S6 u* |
4C19:00AA JMP 0002 ; Bad_Guy jmp back.# p& B Q" V3 |! Q
4C19:00AD MOV BX,SP ; Good_Guy go ahead :): e$ j) I7 F( t0 Y$ c |$ C: y3 B. F
$ i- w K3 h# |9 V7 a: \; Z# b
The program will execute 6 different SIce commands located at ds:dx, which. p3 h9 o& T& Q: ?6 s
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.; N7 }. {8 }/ Q2 `. F/ W
3 q, L' K4 Y5 b( p2 Q* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.- O L0 h( f& i% b! L
___________________________________________________________________________
; T& q( z$ [3 ]5 ^8 v: f4 ]# d7 z6 l0 [# d7 S; u
7 W }7 i) }" O+ E, L) hMethod 03
/ R- s: J9 |; O' h=========
0 j& W$ u* A$ N* m* c
6 f- |- l8 n/ f+ cLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h' B2 p5 n9 H% ]1 {' r8 V J8 Q$ K1 t& m
(API Get entry point)7 y. f" R+ ]! |6 k7 L2 b; x% a
# v. H! a! C7 h7 i9 h& C& M9 I9 ^: U% a* U- U; g
xor di,di* a. S6 A; H' c9 h
mov es,di/ a1 `, j1 _" f/ `
mov ax, 1684h
) d- k; A; l: Y% L6 m) c" { mov bx, 0202h ; VxD ID of winice# }, h* q0 j R0 p4 q% l
int 2Fh
5 g, Q P& W6 x' b mov ax, es ; ES:DI -> VxD API entry point9 h# _3 L. @! B" s3 o
add ax, di; B+ {& M' [ n [$ O
test ax,ax2 a# _! J. w/ `( f; A6 d) l
jnz SoftICE_Detected
3 [4 A# r" v$ E% D# P( C+ K
4 G- D f, a+ M5 ____________________________________________________________________________
; g3 T0 P, |6 t2 _" b* Y0 c1 [
2 R- s! }2 u: T5 ~, a3 gMethod 04
3 L$ w) L+ A5 c" p=========2 s7 b5 x5 @# S9 Y% }
2 \- ], _2 _ B0 q/ I( j5 p6 {Method identical to the preceding one except that it seeks the ID of SoftICE: L+ K( X3 B* J# o- d+ c% g! ~' G
GFX VxD.1 C2 P B+ q! Y' S
/ {! E8 Q; `' L) U; u/ Q xor di,di, c( J9 v- g$ \2 F( V
mov es,di
! `+ H, x1 F5 ~+ f mov ax, 1684h 7 ^( x+ M! A1 z% M8 u
mov bx, 7a5Fh ; VxD ID of SIWVID' Z2 ^2 n) y1 L {9 O
int 2fh
" Z$ j6 g/ t: g n% y mov ax, es ; ES:DI -> VxD API entry point) R( l8 ~7 s% g
add ax, di
! o' h# Y5 e& y+ m4 W9 @ test ax,ax
( i: k" K& ~2 H! t E jnz SoftICE_Detected
' q$ I( |, e& ]/ A9 ]2 u& ]" k" L( j0 R/ s* t0 I. C+ J, }; t
__________________________________________________________________________& K$ t* d4 }7 [- g! t, L1 j
4 ^2 h1 Z6 z! h& V3 C8 A. Z, t+ P. m# Q& c: y0 G5 d
Method 05
# Z. [* O1 I; i' ^1 R0 L=========
( O f7 g! `: O- ~4 _, k0 [% t, z3 @4 w& M0 b0 m; G' Y! ^
Method seeking the 'magic number' 0F386h returned (in ax) by all system
- a8 L' |8 F7 \$ M6 h" N; Sdebugger. It calls the int 41h, function 4Fh.( V2 K! i5 f4 P3 y2 |2 q" e2 F! j
There are several alternatives. ' A: R: n- I3 r
) L! u0 {" L& B' C c
The following one is the simplest:
3 X+ D Y! [5 s
0 G/ t7 i% d, g% u mov ax,4fh+ q8 W6 v$ u+ _* o0 Q
int 41h5 U5 m3 r+ X- B+ @- s7 j. I
cmp ax, 0F386
9 D% g/ r( R7 F( w, Q jz SoftICE_detected
* _8 D/ N4 c0 `9 y4 N
3 k5 q8 i/ s9 O! Z9 ]5 ~# I/ ^9 j& B" l* B; G
Next method as well as the following one are 2 examples from Stone's
0 L/ t/ ]! C9 z. }# `) b"stn-wid.zip" (www.cracking.net):: Z8 n& W8 P3 A. h+ I+ Q/ ?
; o [" F& D1 r# b5 ]4 M: _ mov bx, cs
" K, I0 M7 X0 e+ X1 Y; Y: ] lea dx, int41handler2" K; ? m# a/ V* }" a
xchg dx, es:[41h*4]' z# a! A' m' ]+ g. [/ v& W( G
xchg bx, es:[41h*4+2]
* S7 K$ x9 r0 D1 M mov ax,4fh5 f9 W3 h5 t( L S
int 41h2 x# C4 e, H, w9 L2 i5 p
xchg dx, es:[41h*4]$ ^" \# S% R2 z1 W6 s% t
xchg bx, es:[41h*4+2]* N; b Q- g! i7 w. E6 Y5 K) p
cmp ax, 0f386h' { z- E' u) w# Z8 {) A+ }( Q: K
jz SoftICE_detected
. X4 l5 d. `. d2 _* G1 ^, v8 C6 Z: N- b
int41handler2 PROC6 s# _4 J! M. o2 J
iret
" l% D. ^4 A1 Y& E) J. [7 ?int41handler2 ENDP5 r4 v/ u# \, \! Q' S
" r6 h Z- L) w: g% ]
: t, S. [2 L# @) x2 A_________________________________________________________________________" n0 _/ q. X; X
; g/ W1 g2 ]- ~
2 s: t5 M4 ^0 b0 Z0 b/ F
Method 06
" T9 j" `1 @0 l=========
- N ^3 g, [. A! G. T& i9 p( f
0 J( L& ^& H5 B7 g2 }( q
2 n8 ^+ A% r6 N6 g* N, c' w2nd method similar to the preceding one but more difficult to detect:
' _* u' t; v$ _. D* Y, s" a$ j [* `5 H7 @" W2 x/ Z) v
/ _5 ?& T/ T& {- ?5 f, `int41handler PROC
4 }6 R3 E& l4 d3 |4 n mov cl,al5 I) ]3 t" N' }+ o5 S9 t R) w
iret6 [4 Y7 P5 d. c6 ^% C! V1 f3 W& m
int41handler ENDP
8 b6 @2 S; ? M" L( W5 B7 K3 {6 K! a$ @- L) P: x
$ X& ?( w+ f% N" K
xor ax,ax% F4 b3 [1 `+ P
mov es,ax' z* b5 r( i+ \5 p! v
mov bx, cs
) D" x: n) n' _) i* K lea dx, int41handler% ]9 P+ I3 O c' B
xchg dx, es:[41h*4]# H+ t* l* t' H ]1 V2 L% L4 P: ~$ Y
xchg bx, es:[41h*4+2]
3 L- p2 [4 V! D: S" E7 L in al, 40h
% g* B. X% H! M xor cx,cx3 R1 n; B! X4 n1 b
int 41h' H! [+ w; S) L4 h P6 _; h. s6 n ^: Q
xchg dx, es:[41h*4]9 R$ `' p! [0 M, X
xchg bx, es:[41h*4+2]
" g. \+ j) J) ]2 q, H0 {& X; @- r3 @2 h cmp cl,al8 s5 g' g) N- [, g! s& h
jnz SoftICE_detected6 j" i( N& G; v% ~1 L8 N
( I }% ?+ l5 |/ r! E5 L l: \( [
_________________________________________________________________________# W) G) N8 O- Z7 ?8 ~! O, S
& g6 ]/ I6 t) r( e4 T5 |Method 07
; g* }; e Y1 t6 B) x9 t=========8 P6 ~0 p0 ]8 M& i+ t2 p: P
( @- o( r3 W5 D
Method of detection of the WinICE handler in the int68h (V86)# r- ^; `( c" L. Z
5 {! N6 X. s0 E; v# j4 e; F
mov ah,43h8 _! `& k7 p8 b/ h
int 68h6 ]" x- e+ c- p# W2 Z1 {
cmp ax,0F386h
) L2 s$ z K; s ?, N8 n jz SoftICE_Detected
0 i" h- e% G) y2 p3 ~, Y* \- p, p" D1 \5 G: q6 L
6 s7 B( s' i/ L# P5 x: ^=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
& B( F/ _" ~2 o9 Q app like this: [ G& i$ g: y3 d F
1 V9 H4 L+ \& }, y- m BPX exec_int if ax==68$ p$ V3 F; d: h6 z: ~
(function called is located at byte ptr [ebp+1Dh] and client eip is
6 L" M1 a' `. d1 W4 e8 A- C9 P located at [ebp+48h] for 32Bit apps)& U$ i% t( d, b" q) t" ^
__________________________________________________________________________: T8 ?6 V# v) h& e+ l5 B9 K* H
9 @) d3 Z; w h9 W+ y0 ~ u4 P: u" B9 A( [) c
Method 08
. t! z6 b! A* i, _0 R% e=========' ?2 g! P- m1 x/ N3 Q
0 W+ t9 q# C% J
It is not a method of detection of SoftICE but a possibility to crash the! ~/ G8 W0 M/ |4 p# q) s
system by intercepting int 01h and int 03h and redirecting them to another
" | u% P$ Q5 A J( p$ C. Hroutine.
2 }3 v1 M- t. F6 qIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points! S* g: F u' n" Z) U. B O( F/ F
to the new routine to execute (hangs computer...)' _8 z0 d$ @( ^( {7 U" w( I
2 p J8 f. s, {/ p mov ah, 25h
* j4 b; S& J: }. A* l mov al, Int_Number (01h or 03h)
2 r3 |3 M+ q/ ]/ x mov dx, offset New_Int_Routine
( t# R: M# D" E" D$ Z1 A8 Y" y2 { int 21h
3 E7 o1 C- j9 I5 i
}6 u7 k1 b$ s, `* Z) b__________________________________________________________________________
% L* W H' O$ Y/ @
6 L0 k$ `, M0 X4 t2 U* n6 A" a# vMethod 09
$ n3 a, g2 M- i8 A R=========
' T* R- u8 h6 b8 u% C% J
5 L3 k( f' u# _1 r3 O: E( rThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only: W- D- l5 S" R6 a& J. S5 s
performed in ring0 (VxD or a ring3 app using the VxdCall).
/ U" t; D7 i- [. oThe Get_DDB service is used to determine whether or not a VxD is installed
8 a0 s' S4 Y" T( k; @1 c- Mfor the specified device and returns a Device Description Block (in ecx) for8 I6 c* u- X4 N! S# e3 N- }. Q
that device if it is installed.7 W, J0 i0 z1 D
9 A! B' F2 K/ S! f
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
) F9 ]0 |# N- b; ~0 s4 T$ Z mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
; \ W2 Y7 G, n0 J9 k6 `* K VMMCall Get_DDB
, T1 l N$ U; e3 R mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed5 _- ?/ `% C& G/ G
: t8 Z: ~# ~5 f" b* @1 ]! l5 QNote as well that you can easily detect this method with SoftICE:
$ n% S' k6 U4 D* |/ g bpx Get_DDB if ax==0202 || ax==7a5fh! b0 Z' o, ~! f5 H
. S' i" g1 B0 m9 L9 s. M# v
__________________________________________________________________________
- h. Q. q( A* s+ t$ P# Q3 [2 m# C2 V8 K8 k
Method 10, _# n. e2 P6 X& X' I$ b& h: ?
=========2 {9 a; I' M3 v" z, J" j1 h8 l* v
$ m$ `4 A- \+ E! s# h, S=>Disable or clear breakpoints before using this feature. DO NOT trace with
4 N7 t4 T: O$ P. E" M6 o SoftICE while the option is enable!!, ^3 P8 y7 c6 V& k: S6 E8 f6 n/ m
* H: S2 W$ U/ U) N/ J
This trick is very efficient:
8 c1 N0 D2 c, D/ |# Xby checking the Debug Registers, you can detect if SoftICE is loaded" D! N8 b0 Q5 i) u$ ~% l
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if) N6 A6 W, X! g5 L3 L) X+ Z) r( A
there are some memory breakpoints set (dr0 to dr3) simply by reading their4 N$ A0 I. U) g; b
value (in ring0 only). Values can be manipulated and or changed as well
4 j5 r! |6 r/ [1 `(clearing BPMs for instance)& Y" h. m) N3 ~4 {
) n- E) `/ I+ ]% N__________________________________________________________________________
; Z& w1 f9 v" v; O: U' L6 b3 B; D( Z
Method 117 S8 F" o* c. d7 p
=========! A* o/ O& C t# y! m! Q# b2 f* s
! u, j2 C8 Q+ dThis method is most known as 'MeltICE' because it has been freely distributed1 K' s! w: l6 F, J
via www.winfiles.com. However it was first used by NuMega people to allow8 C6 _9 C* F- G6 G& S% |* p
Symbol Loader to check if SoftICE was active or not (the code is located* E" [0 j6 b+ } `- u
inside nmtrans.dll).
7 h, g5 [/ \+ R0 c2 _/ r$ j% [1 z0 a q
The way it works is very simple:% E1 L( g: `2 k
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
$ T5 W2 Q9 Y3 j* }) ]. ZWinNT) with the CreateFileA API.+ i, e7 s; N" V/ B; q5 W
# C8 h. R( t2 p" ]- K9 E4 `Here is a sample (checking for 'SICE'):
4 O: E& q/ a. h
8 u: `/ ~+ `1 s3 S9 L! YBOOL IsSoftIce95Loaded()! u* u8 l/ ?9 p) u
{
& \4 S y& O, B" @$ X1 }% O HANDLE hFile;
* h0 f& ]; W4 `0 a) Z3 d hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
! o& x9 b& T, Q* H- I0 P# P2 w FILE_SHARE_READ | FILE_SHARE_WRITE,; s* U" S* c. N7 X4 F
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);% F5 H2 N7 `, X6 q
if( hFile != INVALID_HANDLE_VALUE )
6 Y f5 i" X+ w9 @ {" i+ Z* R8 j/ x
CloseHandle(hFile);6 W7 b$ g8 J1 \
return TRUE;
6 i% m! }3 w) \5 s9 C }' B1 s) y7 @/ Q' A
return FALSE;3 w! g/ V) R, g
}7 @9 t+ d! i- X6 e" p
# m. e' D1 u5 _' ~8 h9 cAlthough this trick calls the CreateFileA function, don't even expect to be
8 ^- r4 p. T2 {& h+ \3 H0 {able to intercept it by installing a IFS hook: it will not work, no way!
2 h6 o- v) U) ^, Y( u9 @$ JIn fact, after the call to CreateFileA it will get through VWIN32 0x001F0 h$ \ m4 r+ s: v5 Y9 C @8 j1 m& N
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)) y* e* e% [# g
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
3 ^; O& C0 }2 Ufield." W( A+ `$ x! e/ }* p
In fact, its purpose is not to load/unload VxDs but only to send a 7 Y& {9 X' o3 T: u: n R w7 x9 K0 S5 ]( o
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
. N' |& V8 L3 D0 V1 N: t& l" r1 Y/ Fto the VxD Control_Dispatch proc (how the hell a shareware soft could try
9 A8 Q3 J" {. a A" i- N8 Rto load/unload a non-dynamically loadable driver such as SoftICE ;-).% o1 f9 H8 x4 T4 W" J+ ]5 f
If the VxD is loaded, it will always clear eax and the Carry flag to allow
5 d" k+ D W3 j& J2 a, j' }its handle to be opened and then, will be detected.
j9 |3 T& D7 i+ s8 n fYou can check that simply by hooking Winice.exe control proc entry point
: \, Y" C, X: Xwhile running MeltICE.
8 I4 R$ d2 n7 h$ c8 G! o# C t6 N- |' F; |8 X; T
% l0 ~1 F, p0 l9 b ^& e. q9 a& H
00401067: push 00402025 ; \\.\SICE
* d! Z Y+ _! a2 J7 N3 G$ r3 A 0040106C: call CreateFileA: D# i0 B" |- r) K; r
00401071: cmp eax,-001$ A. Z0 j$ m* m" x9 G
00401074: je 00401091
$ m# Z2 f3 ^: e8 A+ I8 o( r4 E9 g9 N9 w
. q q$ m: g! U9 v q& E! K' pThere could be hundreds of BPX you could use to detect this trick./ V# L1 Z/ F$ [/ ^% X: s
-The most classical one is:
* H6 E7 i3 F6 c; H! o& K# w BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||7 e% M& c" d7 W/ J% r6 q
*(esp->4+4)=='NTIC'
4 q! M' [! a/ B! |/ ^" ?# T+ u B7 _3 r# e
-The most exotic ones (could be very slooooow :-(4 j6 v- Q2 G& A6 A% y" y
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') 2 o l7 \! [: ~0 s1 ^- D# Z9 A; a5 N7 e
;will break 3 times :-(: @- z+ T) c; @
B# [) }7 Y* M" N$ [ n-or (a bit) faster: - F! e9 e# O) m: P0 Y, G
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
* p; ? n2 R/ h& \9 p) ? G. y0 J9 q) x
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
E) O. ?9 J. K; {9 H! Q: I0 S ;will break 3 times :-(
: [2 N6 g! t m! w X! o+ ?/ ^7 L5 E
7 w3 T( h6 y2 f8 t0 @-Much faster:
( w( r, U5 ?3 m* v; G6 L3 R( y9 k BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'+ k; r+ u7 ?2 ^- d6 K
G! A8 z& z4 |/ _9 P W: y1 t
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen4 s, m# f$ E. z$ p! X
function to do the same job:3 W0 ~ W! u0 a( v. K0 u2 b
/ q9 l+ X, W% e9 J j0 A
push 00 ; OF_READ# \5 l" v8 ]9 J2 u, l
mov eax,[00656634] ; '\\.\SICE',0
" K- s6 |' @7 {) m2 M7 ] push eax/ z: F2 ^' ]. X6 K3 n0 P) S" i ]
call KERNEL32!_lopen
2 l* I z! N6 {% D inc eax
9 @/ e+ F, r* m$ D( M jnz 00650589 ; detected
t0 ?8 J4 N6 V- T push 00 ; OF_READ5 h. `9 D% o0 S9 q1 R
mov eax,[00656638] ; '\\.\SICE'
$ R, o' Y) ]! F' {" \% D push eax9 h7 L! r! c5 w% c) D; w9 |- S6 {
call KERNEL32!_lopen
4 X' ]: Y* O* J inc eax
4 k n( \. B' `$ z- Z! |$ ~ jz 006505ae ; not detected" {0 X! ]5 p$ M4 ?8 k/ X: ~
) {% X# \ Y8 [7 t
7 [! l6 i& n& L+ ~& S* h__________________________________________________________________________
6 g2 n) L( g d- j* Q7 K
9 e/ W# b, F( f% w8 s; h' bMethod 12
& l8 g8 p7 U: B j$ v. |=========; W% Q( u1 c- I" H8 \$ R: I
5 y5 _! K' S! A# f8 ?* v( s9 {This trick is similar to int41h/4fh Debugger installation check (code 05 L4 Q$ F6 R5 O3 S4 Q
& 06) but very limited because it's only available for Win95/98 (not NT)8 H2 e/ e+ `* Z
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.. p/ w+ T" r5 J
. j+ v6 e' V/ J; v0 [9 ` push 0000004fh ; function 4fh8 x# [- d& Y( c1 J# y
push 002a002ah ; high word specifies which VxD (VWIN32)
4 l2 c$ Z; R2 O' }( f ; low word specifies which service
) `5 E% K4 j3 \& X! @/ y% Z (VWIN32_Int41Dispatch)* N- q/ y" n8 c: I! Z( Q, w
call Kernel32!ORD_001 ; VxdCall
% C7 i3 i% r+ t$ Y+ `, S Y cmp ax, 0f386h ; magic number returned by system debuggers
7 `2 S. r: o L4 c jz SoftICE_detected$ I, d/ g2 s9 L+ s
; p! f0 A* f9 t/ i% D2 R# kHere again, several ways to detect it: H# u2 O2 l" R7 N4 {' n
8 [# P3 O# F# O) f BPINT 41 if ax==4f* g/ x# s6 Y2 f( k6 G7 s. x
" y6 D+ f( j" j/ c4 i# G" f0 U8 D- Y
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one3 J. e8 A) F* h8 {! q9 @/ d
6 e0 M- n! y. S9 |4 u2 j BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A1 ]7 g! N$ j m, g6 W1 R' H
+ h) s/ E* g2 V
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!5 B# O2 T9 D; _5 W: X
, d7 [) T3 ]1 P) Z1 V
__________________________________________________________________________. m% l- C, n/ f1 c
: S+ I: f/ g; J. \
Method 13( ~) r2 v/ B* F) o x0 c! [
=========9 b$ ?' Q7 j( F2 Q' X9 ^
! \$ M9 U2 V8 D$ p HNot a real method of detection, but a good way to know if SoftICE is ]: o. {2 Q# `6 E H) m7 v) d3 N. u
installed on a computer and to locate its installation directory.- s8 ?4 S; c5 l' h' q0 E" }
It is used by few softs which access the following registry keys (usually #2) :6 l0 V# P5 b, |3 H
. _5 z. B# J, y1 L& J
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion# u6 ^( W [! V# m Z+ n+ S1 r
\Uninstall\SoftICE" ?: D! {5 o0 s R! A+ V9 K
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
0 E- u! A: u# L; l ^-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
8 j6 ?( t) `, t$ ?( `\App Paths\Loader32.Exe
, d% P& d, H6 p2 V0 \8 G1 T7 v4 g, _2 V, s: q3 ?, b: R- d
9 C+ ?5 s7 C. s; w/ vNote that some nasty apps could then erase all files from SoftICE directory$ g. f9 w1 |3 `* I1 K/ Q
(I faced that once :-(; ]; Z k7 z; E- Q8 f2 l( ~4 E; ^
# |; y X* ]" K4 P, m' M
Useful breakpoint to detect it:7 E+ D- f- T' O1 e# T
. P J; d% w: o$ t1 b( U W BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
4 I* Q6 N* m% p
5 L5 Z9 Q, ^6 m: A( M__________________________________________________________________________
7 W7 ?; U/ D4 ~
3 S7 s, }( R+ r8 }2 n8 G9 d' i3 O7 J9 L1 a: J% L
Method 14 ' t; i( X3 Z* ^; w
=========
' Z; o |. i$ ?/ X' l% l0 J+ V4 e6 V# t+ H. i
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
* j9 \. ]; S6 p" E: |is to determines whether a debugger is running on your system (ring0 only).7 ^0 z* |" D+ k% v# t5 z) [
! f% n; J t! T" Z9 U
VMMCall Test_Debug_Installed$ e7 j% ?6 L2 K9 c6 a8 w2 g
je not_installed' J4 X# F1 E- t3 i2 f; a
( Y/ d+ {, d |1 L3 R5 G
This service just checks a flag.. q6 e8 t4 ?, g3 x5 x9 `7 }9 ~5 r# K
</PRE></TD></TR></TBODY></TABLE> |