<TABLE width=500>
# u, U6 |. d/ w+ z<TBODY>
6 h$ X% b6 R2 R7 L, j; [<TR>
8 }/ C. B9 u/ e+ |7 y' H* q<TD><PRE>Method 01 7 T5 L3 o/ B7 T! u+ C
=========
" U; }( y3 i' a- I
2 k' y9 i0 D1 n% @ p: VThis method of detection of SoftICE (as well as the following one) is
3 ]8 ?, o6 Y& i3 }; C5 d) O6 |5 i$ gused by the majority of packers/encryptors found on Internet.! D7 M( v+ V$ r7 G# {" Q2 v: x
It seeks the signature of BoundsChecker in SoftICE! \9 R# s# C2 q. [; w
* b: \. R' R0 Q8 `# ?6 u9 f4 g- s
mov ebp, 04243484Bh ; 'BCHK'. v- r* e2 c: Z: [8 B+ g2 \- G5 d
mov ax, 04h
3 a% f ^* |% y8 X6 p7 ` int 3
+ @# o8 X" C2 ] cmp al,4" h& A# z m* y3 F5 c: P% h
jnz SoftICE_Detected
9 S: O* E2 x, ], _8 f1 |4 ]% r# p0 ~; G$ e- z
___________________________________________________________________________+ w: B1 f$ z9 C; Z/ _' a% A1 Q {
5 T! V; b9 `, nMethod 02( Z+ ~. b( B8 M' v- \
=========
& x2 A: W ?( ]# w2 H% ]* k6 J- H' O4 B0 E' F0 ^$ [' G9 t9 i
Still a method very much used (perhaps the most frequent one). It is used
; Z4 d) N+ }- \/ Fto get SoftICE 'Back Door commands' which gives infos on Breakpoints,& q7 }) M, Q1 j3 J( F: B! ]
or execute SoftICE commands...
8 ^2 l& K4 ?$ c! fIt is also used to crash SoftICE and to force it to execute any commands
& }5 ^5 W7 l2 H v(HBOOT...) :-((
& n; k6 L1 ~; V
* n, O: M/ c8 S0 a/ y; r3 m" b: aHere is a quick description:
. S( J6 d, {$ x. v-AX = 0910h (Display string in SIce windows)
2 k6 H. U8 b" J) V* e1 x- H# }' T-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)* f% Z4 n+ M& _6 P, D% y8 U& A
-AX = 0912h (Get breakpoint infos)6 O# A+ D4 c3 t* L- [9 p6 b
-AX = 0913h (Set Sice breakpoints)$ u; {: _, [$ n
-AX = 0914h (Remove SIce breakoints), n& P) o" i- u6 ~3 ?5 q8 f, {4 q) h
% Q% i8 g' d) p$ jEach time you'll meet this trick, you'll see:
+ k, [. N% i- o7 N- _7 u8 w-SI = 4647h3 O, k" W! _. Q, V
-DI = 4A4Dh
( ?0 u/ V2 M- g7 m5 }2 R8 i, vWhich are the 'magic values' used by SoftIce.
5 u$ x6 N- c3 k/ x) dFor more informations, see "Ralf Brown Interrupt list" chapter int 03h." @$ I7 Z) {( J& }1 i& _
- `5 {5 r- C! XHere is one example from the file "Haspinst.exe" which is the dongle HASP9 Z4 s! V: e2 M* } w
Envelope utility use to protect DOS applications:
& G9 G1 }& o; i. p& |9 y! z* e5 R" p
" C' I/ O& `0 R" c1 M5 H4C19:0095 MOV AX,0911 ; execute command.
# ~& A; T& m1 H, `, D/ y+ ?4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).6 F5 L* B/ M+ S/ H* Y P& U
4C19:009A MOV SI,4647 ; 1st magic value.- s8 a1 }# Y( _2 r( a0 |- j0 |( j
4C19:009D MOV DI,4A4D ; 2nd magic value." M, }/ L y( s5 w. s2 o
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)( D" U5 S/ _1 l: K5 J1 N/ ~
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute/ R# E; S8 e4 }: b$ L. d# |1 y
4C19:00A4 INC CX V% r: u# d2 f& y' O/ m* ]. T
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
6 v: ~' t1 }$ O# |: O4C19:00A8 JB 0095 ; 6 different commands.9 s9 w! S4 C) a7 x4 s) C
4C19:00AA JMP 0002 ; Bad_Guy jmp back.. b$ {$ q9 [: `
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)2 }2 C2 F% m$ V1 c
0 {0 R& T: h5 l5 c. l2 K* { o
The program will execute 6 different SIce commands located at ds:dx, which
7 o0 v4 s) B2 N" Z. r( Nare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.8 `+ E# V6 M8 z9 n
0 P4 c. G+ B0 p+ k* k+ M7 u) t
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
~; D Z2 t3 B @___________________________________________________________________________; a! \8 y) E' [
( [" D* J' f6 ^" t9 ]: h3 h
, X/ l; J3 b# V" QMethod 03
8 r4 Y) Y: _: v0 p=========
, k- C: b3 D3 z9 [! B4 @/ N
6 F! R( l9 v2 m% J, ?Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
; B9 c( ]7 Z* O7 s(API Get entry point). U& S) ~3 L: }* T- C9 ]
1 k. t% D) Q9 ?) K+ S P
; n2 N2 p5 L+ y" G+ N* z( A xor di,di
! T5 }2 `- p v/ t; k e/ a9 | mov es,di$ ~; d9 \$ z" z z" z0 s
mov ax, 1684h - z# m- T8 g$ \+ u& Z" ]
mov bx, 0202h ; VxD ID of winice
. U; W4 i. Q4 f. v; I4 x8 ^ int 2Fh x. w3 F! d. @
mov ax, es ; ES:DI -> VxD API entry point* i/ S$ G+ o2 Y$ ]- Z% u9 O
add ax, di8 K+ F4 \" z+ p, j
test ax,ax# w9 ^ ?4 O) L1 x, S
jnz SoftICE_Detected
; I" G$ Y- l l& l' z0 k5 t( M
# P: ^ x( A3 n1 o2 t; b$ i___________________________________________________________________________; ^& T& Y. z3 C' J
: B6 w v, Q- V
Method 04
2 F! _, }6 p& m! ?! P=========
( R5 s$ [* m: c8 L, ]7 l/ F- u3 C( }
Method identical to the preceding one except that it seeks the ID of SoftICE) E+ H- o! A# w; i; x
GFX VxD.
, L* A7 d" c4 c. `% j5 B6 d
9 q" c# U7 G) @0 k0 W2 r xor di,di
1 d/ Z) Q; @) e3 b) p( z1 R mov es,di
- h8 [) q2 T* n+ r1 ] mov ax, 1684h
* Y a3 c: n8 I4 M; Z! R+ t! u mov bx, 7a5Fh ; VxD ID of SIWVID. M9 |2 Y2 t! s( |* v9 h7 `
int 2fh- X; [- }8 E! D! l3 T
mov ax, es ; ES:DI -> VxD API entry point6 h( h1 R3 j& P4 [$ f5 k
add ax, di
2 G0 b- K6 e' ^1 O* E# ] test ax,ax
( U, f' }) q4 k8 B jnz SoftICE_Detected
3 R) v& _* A/ p3 _& X. G# @, Q+ {- W, Y8 o$ f8 Q$ ?1 q; G0 [; L/ X$ T ]
__________________________________________________________________________( T! G. |3 _; [# n
6 p8 _: @6 I& s$ }
9 A/ n! e" u; M( {0 U. ZMethod 05: o0 U0 S( o9 o( m
=========
3 I9 S) u* l0 D3 p
+ |, F% }" ]+ L2 M8 P2 q3 X0 Z4 SMethod seeking the 'magic number' 0F386h returned (in ax) by all system/ p k6 C' l I% L$ \2 W
debugger. It calls the int 41h, function 4Fh.
6 ^+ D$ Z9 U; |& ?There are several alternatives.
) |( f7 l% ^6 G3 `( z1 K* ]' J r0 m" l* O! E
The following one is the simplest:
) a% w$ d+ h) D: c- V' r
8 p w& }! y8 Q5 i* g mov ax,4fh+ X3 Q" d+ s5 O( y( m& ~( b
int 41h* ~( o. ?' Q' R* Q
cmp ax, 0F3863 t/ h/ ?* s" T. R
jz SoftICE_detected
7 e9 r0 x+ @1 o" C( {1 J* v, \# ]6 o9 X& M! P. Y7 B# X! x
5 |3 ?8 k( {2 \4 ~0 g
Next method as well as the following one are 2 examples from Stone's 2 C6 k4 \8 o1 K9 f& l' N
"stn-wid.zip" (www.cracking.net):) Y) X7 l! I, ^
# N3 R ^9 c9 _" X9 I
mov bx, cs# g! M. K; ]. O0 n' y
lea dx, int41handler2& f. I9 I# h2 f+ a% e2 N
xchg dx, es:[41h*4]
( \6 F4 | {. t }5 ^9 ?: S xchg bx, es:[41h*4+2], w! J" f" R8 ]1 [; ]3 [
mov ax,4fh
! e2 g2 l' Z, p! I) O/ V int 41h
$ ~0 _- G$ B8 G/ \& y xchg dx, es:[41h*4]
: b! L7 t d& A4 o) s% h+ Z5 M xchg bx, es:[41h*4+2]8 i$ c2 j8 F+ _5 Z
cmp ax, 0f386h. I% E4 d- F4 H# O/ D
jz SoftICE_detected' l. t7 }, q; ~ H. n. s0 \' Q
; x% A/ @9 h: v5 S# l' a2 {int41handler2 PROC
( W1 _& f0 V2 M0 V; I$ u iret9 @0 o% b& n) v( J' d, p
int41handler2 ENDP$ L2 ^% @9 w5 e
# F) P2 T9 \! u: h" L: x1 j8 M) P; v% x5 `( o6 S, O; G
_________________________________________________________________________
/ |6 w( X4 u- {" a9 i- q2 H: I
/ y, P' V* H8 d1 a$ M
u6 m' e5 z9 q( l, g( a8 sMethod 068 g+ z( f3 L8 |, g
=========
7 T. H' b- h$ t; X% Q* t ?* f
5 l+ p. t5 n# a* M; \
5 {3 Q- M" y6 l4 y2 Y6 K2nd method similar to the preceding one but more difficult to detect:
0 r" H- ]$ g: ?( ^# h0 u" Z7 r, Y
& N0 ]6 D& E1 s! @ x' L( r
4 l0 q4 r0 k* V' C/ \int41handler PROC
# g4 |+ S6 {% p- E8 y Q* N$ m mov cl,al
: u5 Z' h1 N# b5 ^) |3 I iret
, V) h% J9 q9 c0 `int41handler ENDP& q5 R6 Y; `3 A9 |, g$ ?0 H b) T" \
/ V7 p5 L4 r: Q3 \7 [( Q! I9 z# c
7 C2 w" ?" A4 Z1 }7 Y W5 l xor ax,ax. O9 X8 m9 |3 m7 h8 Y
mov es,ax* l* {, S, N* z8 @4 `" s! j/ Z
mov bx, cs
* j$ x5 V; C& Q7 f3 I" R% Z lea dx, int41handler
% P7 E/ l5 d) N% f: D/ e xchg dx, es:[41h*4]
$ o/ Y' h: U5 k I5 B# c xchg bx, es:[41h*4+2]
/ M O* N, i. ~ in al, 40h) F/ W! L( l0 g. l% w/ p& S! i/ v
xor cx,cx
: D0 i6 Y% I3 Q; y3 { C3 E int 41h. o. F& k5 C8 e% z. O' u
xchg dx, es:[41h*4]/ B M* L4 B$ b3 |
xchg bx, es:[41h*4+2]
6 j& Y `& d4 r4 z" g. N W" B2 m. D cmp cl,al
; r7 m7 K `0 y0 ^2 O! I* q' o6 a jnz SoftICE_detected
. ]4 a7 }9 a4 n2 r
! r: g7 j4 F1 \8 K9 \7 ]! R$ u_________________________________________________________________________0 Z C2 J9 Y8 y( m
8 {* f2 T, f! A0 D2 R$ s; y) ^) m
Method 07
/ E0 y% }1 C/ I3 @=========6 m; f o: [1 M
1 y5 `$ _5 \# S# V* f5 CMethod of detection of the WinICE handler in the int68h (V86)1 \$ k s; z0 _" H7 v8 L6 M2 P
4 M1 I# E. T1 j" ]3 U6 m& ^
mov ah,43h
) X! j2 z: @# [9 [0 P! ]0 ?" B0 j/ P int 68h# s/ b% V9 |. s: O0 x* S- @& X
cmp ax,0F386h( R3 E6 U; D( e0 y7 Y
jz SoftICE_Detected* W5 z$ M* q3 U5 w7 e" I
3 W+ }) @ f, S {( W& {
9 ]0 e! u9 e+ P% r {( T=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit( n% Z7 Y P! a( K6 k' U
app like this:
( F7 Q( Q" A5 [; M+ J# f" T3 [. P! G1 I2 |4 e, A
BPX exec_int if ax==68% j1 r( p9 g% P' n& S# g, y
(function called is located at byte ptr [ebp+1Dh] and client eip is( j1 Z7 d; h$ T ?& C$ }
located at [ebp+48h] for 32Bit apps)
) X |- [; ~5 `' k- w__________________________________________________________________________
* p# T& {( L( i! m- S) A7 M6 y8 Z5 W' d9 n% W, U! N
! x5 X5 W" N+ H9 wMethod 08
+ e+ S, ?( G9 l* P! K( m& s=========4 F5 n/ q& M: }8 p0 }) Y# p' Q
4 _8 q, `% X- ?9 m( } e* o; n5 rIt is not a method of detection of SoftICE but a possibility to crash the; o4 }+ J' U# L) P2 h% X. _- F
system by intercepting int 01h and int 03h and redirecting them to another; T9 J* h/ C! x2 T: w
routine.: {) O9 b+ ~. G" T/ n2 Y
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points0 N* l4 m- t% Z* Q7 p
to the new routine to execute (hangs computer...). F' x0 \, m+ {9 z& z% V
6 D7 h* {) S9 X8 w8 J! }: I+ M
mov ah, 25h
0 c9 x ~! w& w' M- C* b5 O7 f mov al, Int_Number (01h or 03h)
% h8 `' Y1 Q7 i8 b mov dx, offset New_Int_Routine
# C: a0 m: x5 g! I; ]4 u int 21h
" x4 A0 N+ @9 B, g! M
0 t, w5 k& E+ e% K__________________________________________________________________________
' j& I- ^: J5 Z# K" J1 v6 n- Z9 g* {4 p# e
Method 09
' H F8 P% X- J5 R. w# g8 u& F=========; W; q( \: T6 k, i( ]$ d3 u: W
" A/ h# p) u1 J0 x. F# d
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only. ]8 m' i( J! j$ ^& u" T
performed in ring0 (VxD or a ring3 app using the VxdCall)./ i4 I% {' v& V7 V$ i
The Get_DDB service is used to determine whether or not a VxD is installed/ d6 z; @) o- ]+ T5 C$ t
for the specified device and returns a Device Description Block (in ecx) for5 d. M, B0 C% y" G) ?% B
that device if it is installed.
5 c9 p' y9 u4 k5 A0 t) G
, b+ E/ n j+ o3 x1 U2 Y: I0 o mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
: C- f7 v+ e7 D0 ]6 L/ s mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)( U5 I) Y6 A3 u4 M
VMMCall Get_DDB
5 f# `0 W. L9 R5 ]' x" @7 S* ~* S mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
- S# S, O. r7 M2 m8 f' |, J$ S+ _" j j! \
Note as well that you can easily detect this method with SoftICE:
5 P8 `$ n4 ^/ [$ [+ c' R bpx Get_DDB if ax==0202 || ax==7a5fh9 J" {' X6 X7 L& ]* h
; r A( H5 P$ U0 Y$ J( m# X
__________________________________________________________________________
0 K1 C, G l+ M+ }8 B3 \$ C1 z: W4 I: w2 n4 {7 `8 [
Method 10
X0 G: A( y9 @: c; r/ e- l=========! c. t7 q9 U* M3 ~1 u8 N
" _7 A. p# Y5 \- `
=>Disable or clear breakpoints before using this feature. DO NOT trace with* a Q( n2 z; r f9 I
SoftICE while the option is enable!!. v* S% {& [0 f ], B2 ?% _3 a
: e" J1 z7 b: L
This trick is very efficient:( R' j) }/ }. q5 T6 N, S# Y
by checking the Debug Registers, you can detect if SoftICE is loaded% a9 B1 }( H, x, x- N: s
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if8 L$ t4 V) B, i4 f% d, \
there are some memory breakpoints set (dr0 to dr3) simply by reading their
3 M2 ~& j% Q# W$ a: x( Mvalue (in ring0 only). Values can be manipulated and or changed as well9 a4 ^5 O2 b: o, D" T
(clearing BPMs for instance) e/ y0 u# g+ j6 w# l
7 f1 ?8 k! A5 G/ S, z, f, H) W+ w- [3 q__________________________________________________________________________
& k) q$ B( X1 w2 I! ~4 m
! y, M2 G0 y3 L3 t; AMethod 11
' g8 ^6 u3 [. g+ g% s F=========9 r# y0 b( Q9 G. z3 X% w8 Z8 j. X
! W# R' T6 f6 T# V; v0 y
This method is most known as 'MeltICE' because it has been freely distributed
, L4 E4 Y, {) \- }4 a5 K1 Cvia www.winfiles.com. However it was first used by NuMega people to allow: D- e0 v2 u- J: l2 r
Symbol Loader to check if SoftICE was active or not (the code is located
) b/ Y1 j8 ]: yinside nmtrans.dll).
' P& v/ d# b! s8 s5 c
. @0 R/ R4 n# P: W- NThe way it works is very simple:% z; \2 C( h6 ~8 _8 X9 C( }; |
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for0 q& i( ?: E- a8 [
WinNT) with the CreateFileA API.
0 @3 }8 p" {: ?
6 l; v; ?- ?' I# s( R* nHere is a sample (checking for 'SICE'):2 A0 t% R3 W$ f! L$ z/ x
* D$ x8 Q0 g) J h9 g w
BOOL IsSoftIce95Loaded()/ i0 z8 H4 @( r9 j0 L# @3 d
{* N2 u7 c: F! y" Y& \7 ^0 h
HANDLE hFile; 0 D+ D- C4 F i) b2 [
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,, d3 J, Z# h, \" a: {8 X
FILE_SHARE_READ | FILE_SHARE_WRITE,
* N' f$ Z3 a- l" G6 P9 D9 H9 j NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
/ u$ O A5 A7 P; u7 X" S# A5 W) k if( hFile != INVALID_HANDLE_VALUE )
! @% c8 S4 G2 e5 g7 R) h) H# L {+ ?9 x! E' F; a# m
CloseHandle(hFile);
( @7 v6 X8 p) L return TRUE;
7 Q9 s8 d; S; N } v I% g) a! }
return FALSE;; Y! d) @- `9 v9 b/ R
}( T' Z, W! @1 {1 ]% V8 b3 p
7 Q: t, P( @' a# { c
Although this trick calls the CreateFileA function, don't even expect to be8 Z: ?% H5 Z9 b
able to intercept it by installing a IFS hook: it will not work, no way!
$ |4 T5 U; H9 F' ZIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
) G. k2 l6 Q' O( g1 \service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)# w5 I! ~$ b- I2 u
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
+ M. f* J! S: f- Z t/ B) H& vfield.
- k, q/ N2 N1 g7 m0 f4 P4 KIn fact, its purpose is not to load/unload VxDs but only to send a
. z/ p: I; T. _+ MW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
/ \$ c( [9 V8 Fto the VxD Control_Dispatch proc (how the hell a shareware soft could try9 I) b" ?1 u4 N* b+ d. ^
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
& f3 X1 ^. Q: m/ R6 F. V# ?9 MIf the VxD is loaded, it will always clear eax and the Carry flag to allow8 ^# S5 n9 t8 V0 i. J
its handle to be opened and then, will be detected.
: N4 y, ~/ h. p" BYou can check that simply by hooking Winice.exe control proc entry point' n2 l; c a+ i+ g9 U. L8 y
while running MeltICE.. @/ Z8 W. V3 y
/ a! T, f& O3 D6 f6 V: I
# l& y, d8 m( g) m9 B5 b
00401067: push 00402025 ; \\.\SICE. Z9 q* I4 ~. x6 V" c- C" F
0040106C: call CreateFileA) M/ h' A" Q5 Y: e& I' ~& O# |
00401071: cmp eax,-0015 h/ V& S3 e. z5 w9 M! H
00401074: je 00401091
, V o7 o! `& f5 \& ^5 Z1 V8 A J4 ]: M5 { O' R8 W4 J- q
9 {4 S8 z% q% ^9 {; m* c( H
There could be hundreds of BPX you could use to detect this trick.
% ?7 F" f6 d. _7 B$ e# H* m0 f-The most classical one is:+ }3 ?# g' v8 X: A I4 u; |7 r
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||7 i1 f7 W* s; Z/ a" _) g
*(esp->4+4)=='NTIC'5 [2 S+ i5 E6 A
5 u B+ F1 [: g7 J( N7 ]) \-The most exotic ones (could be very slooooow :-(* |8 e2 w+ O& u% ~: G# J
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') , b: {4 N* J* }! D) C
;will break 3 times :-(4 D* J4 w' W g
" s. a4 S+ Q8 g1 o3 `
-or (a bit) faster: ; h' X. I2 y5 F" D4 v% z: E
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
3 z% Z0 c8 I9 [5 r. o4 t% I. \$ S- R) A5 s" d, A
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
1 g6 E+ Q% f4 M7 ?7 g; }$ z ;will break 3 times :-( b3 O; I& T0 c3 c% I: j X
& k: h; v: O/ l9 z+ t-Much faster:" S+ U7 i4 \" i4 B9 `* @
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV': V9 F$ Y3 x$ i8 Y2 w( E* b z+ Y2 _
5 w* \0 D7 E4 Y. Q0 GNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
! u5 K( `% g: G+ x, Qfunction to do the same job:
6 h9 L! k2 C- }! o1 T e6 d, |) F: f4 n% c
push 00 ; OF_READ6 [0 L0 C' K6 C2 K
mov eax,[00656634] ; '\\.\SICE',05 w# O) c, ~# E4 H9 O- H
push eax
: B1 _" i+ e ?) ]* K! W, m call KERNEL32!_lopen
2 V3 S, S9 G% n% G2 k inc eax5 W6 m, f5 J" e- M! n" b
jnz 00650589 ; detected
% J- E6 o. N$ f push 00 ; OF_READ" a2 E# l5 V4 n# a/ B/ [ w( ?9 \5 m
mov eax,[00656638] ; '\\.\SICE'
: \; K! l- }2 l3 N+ e push eax
5 j" T S, U9 H# N& Q call KERNEL32!_lopen/ r3 s |. r+ F6 _1 a- j% r
inc eax3 g4 n4 Y* T4 R- y6 g8 i
jz 006505ae ; not detected/ p# O6 A) M2 A; U6 O1 Z: m
% b- }( H% H1 ?% K3 w3 B- v
5 J7 @9 {9 a1 S* h* L4 {8 _# _
__________________________________________________________________________
. T# p( q$ e" Y# R- t* p% x" V2 v# X; V' X
Method 12
1 W( x; a( K! o. y6 L5 b- d=========) W3 Y) n" P" e* n+ T# J
% l$ ]& Z3 b6 o6 V% U, D- L
This trick is similar to int41h/4fh Debugger installation check (code 05
; P! n' l9 t' Y8 ?& 06) but very limited because it's only available for Win95/98 (not NT)1 A" k/ V* S( U. S! Y! @
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
3 E- L' u" I# g/ g: |
- y' E2 @3 L' y7 X push 0000004fh ; function 4fh$ U" S7 R2 _" P* w0 ~
push 002a002ah ; high word specifies which VxD (VWIN32)% V- H3 j) s( n& p
; low word specifies which service c" x2 G& P4 |+ }
(VWIN32_Int41Dispatch). g" z0 r. k( O
call Kernel32!ORD_001 ; VxdCall
; S% b" {. t6 L; B# Q cmp ax, 0f386h ; magic number returned by system debuggers
4 [) S1 q0 ?0 h! d* k. p( j jz SoftICE_detected& G3 E a7 `4 f5 N/ b- ~
; e a. z0 k( {! f' Q
Here again, several ways to detect it:5 C5 h& P/ n$ O5 k% Q# h# H" O
1 S* E" x: W& ~- v
BPINT 41 if ax==4f
% C9 E6 N" h, i+ p" o( P3 y ~% Z+ }& k, L2 g; W l
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
: s' J9 p) F% f1 m$ t6 B4 p
1 F. h# a- c% E T) N" u, j" C BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
0 X: J4 ]6 Z4 N7 Z' o5 |9 X( g- n5 ]
1 s4 m/ h: |' W$ n2 A3 }+ w BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!6 m& J6 T; X: D5 ]
q& y! P& `& K, r O__________________________________________________________________________# c: D) N' i0 g/ M4 T& S3 S, e
9 y4 T. h0 j! }1 B: IMethod 13
* u, J; q* `0 D k, N4 d=========
' u, ]0 D0 Q% E5 m, J- s% j) j' A, G. s
Not a real method of detection, but a good way to know if SoftICE is
4 _: G# Z& h2 ?5 f/ h. a& einstalled on a computer and to locate its installation directory./ i) r, l* x; t" Z( `% j
It is used by few softs which access the following registry keys (usually #2) :4 }# y' u8 s6 |2 g/ S: c& r1 W) C4 \
" D, g" d0 K1 N" b9 L) L9 H; J
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion( Q' X% f1 I8 H6 q0 \: g- @
\Uninstall\SoftICE
* {6 E) D; P' y* y6 H-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
! d2 a7 @1 {. u% H-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
5 y. G' \* L- |. M( t\App Paths\Loader32.Exe
4 ^- i) }0 A+ p: d. _. R
0 O2 f8 |' u$ S/ b d. V& \: }* p9 B C7 H. R; S
Note that some nasty apps could then erase all files from SoftICE directory
) {4 i6 G5 q8 c Y, a: S" [(I faced that once :-(
" i% F' N# C( Z d. I1 I* G, P% D) f+ f
Useful breakpoint to detect it:
. S3 g0 a4 g2 s: U
: v( B! F U- ]6 G: p2 ?. e BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
* V& n' G; @9 d4 Y: b I4 |( v Y7 a, [ q
__________________________________________________________________________
& \ Q9 `& z7 I; t- k8 L
) ~3 r6 i6 Y8 q) v6 I8 j& Z
) B* D3 ^- N' G- Y$ g% CMethod 14
- e# A9 b5 F7 D0 X1 D) t=========7 F5 Z6 [! n/ _0 P+ x) d
6 |' W/ T `; q) B) MA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
G1 L8 n* h+ i1 {7 ]1 {is to determines whether a debugger is running on your system (ring0 only).
. R, ^! k. J/ Q! |7 V$ N! A3 ]' l% t) K! u! {
VMMCall Test_Debug_Installed
. P, M* n, E6 E) s6 f# A9 H* o je not_installed
/ R, ~1 e* \2 ~( M$ ]+ u5 A
* @: m! W4 M) z- ]* i2 LThis service just checks a flag.+ f. s# {8 b/ X
</PRE></TD></TR></TBODY></TABLE> |