<TABLE width=500>
$ A7 b) }( j0 Y3 o( E<TBODY>
) j6 Z! X4 G2 o9 T' A1 Q! y) l<TR>4 r& p) D" x' C2 ^5 q5 V
<TD><PRE>Method 01 ; v* X( ^7 R1 h8 [8 K" f
=========
' c e- S! S# f5 j' f6 a, L' Y _' Z$ v4 ?
This method of detection of SoftICE (as well as the following one) is8 H% H: @4 i4 g
used by the majority of packers/encryptors found on Internet.
9 C" M. |$ b* Q d8 R9 @It seeks the signature of BoundsChecker in SoftICE$ |! T% D% r8 E: t/ k$ y
& b# |$ V4 z# Q# E( X- @* @8 S
mov ebp, 04243484Bh ; 'BCHK'3 F$ _9 P& v8 d! U$ V0 Q
mov ax, 04h5 G0 j. F0 v8 ?
int 3
% [( d8 X8 M* ]# K/ m; P( x8 o cmp al,4
7 u; g" h5 ?. L7 V) [+ c0 \* h! P+ J jnz SoftICE_Detected$ \; Z: t( Y, x4 G# c+ C
1 O" ]2 M$ c5 y" f8 ~9 f___________________________________________________________________________
* F9 I, F+ U, l" l( o7 j$ g z
2 q9 D) N- s3 {* V, m8 e- |6 {Method 020 \7 E. ]* U; s
=========$ W! C. [- b1 a8 j
( h4 Y6 e: @$ d" A9 ^
Still a method very much used (perhaps the most frequent one). It is used7 j. d0 u. f; j A( L, A
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,# G4 s2 t; u! n& M m( F U
or execute SoftICE commands...
% u1 W2 Y9 o( g D" MIt is also used to crash SoftICE and to force it to execute any commands
# J7 k1 s" H1 o8 A) H" y(HBOOT...) :-((
9 b; B! t8 f. a. ~) _
8 c& M- N9 z/ v! H7 JHere is a quick description:
! x6 ~2 X1 Y6 ~* [8 q, n- C-AX = 0910h (Display string in SIce windows)$ P- b X7 K) K1 \
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)5 J5 Z$ v& _7 ]" Q
-AX = 0912h (Get breakpoint infos)
3 I: p! S* P2 h! Y& {) m-AX = 0913h (Set Sice breakpoints)) h S9 e/ T2 ]: T. E6 [6 z1 g/ e( r
-AX = 0914h (Remove SIce breakoints)
( Q9 g# D0 d9 F4 T5 |( d" D
, W+ b+ w B* w0 z$ VEach time you'll meet this trick, you'll see:7 h7 e: R; D, N4 b* |) U2 g
-SI = 4647h: X& Z# z" I7 s$ v8 ^/ B
-DI = 4A4Dh
. U( w; z% @% b$ |+ I6 t/ MWhich are the 'magic values' used by SoftIce.% ~4 m. |+ K, d! J6 @4 a3 J, W
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
) W% N; j* p/ P) y$ U- f# \( b6 W5 s! d9 L0 J
Here is one example from the file "Haspinst.exe" which is the dongle HASP Q- A; n8 j+ g( I& O- H
Envelope utility use to protect DOS applications:& r8 Z, o8 w% j4 |' K
0 c! j; o: u, x- D4 Q ]
: r$ q/ A6 m! j; ^) p, y+ z: \3 C4C19:0095 MOV AX,0911 ; execute command.* w' G% N9 V8 q L
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).+ I& n: P2 o" `' I& B& _0 H* M
4C19:009A MOV SI,4647 ; 1st magic value.9 l% u: S0 `! ]; z
4C19:009D MOV DI,4A4D ; 2nd magic value.
7 u1 G: t; v- L% Z7 T4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)- } m( B) e- p
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute& v# Y/ w; ^3 q3 ~; q L
4C19:00A4 INC CX
0 {+ ]2 k3 b" c/ L1 K1 U7 [' _4 k4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
- G. \( a& @ _! J7 j: V: ~4C19:00A8 JB 0095 ; 6 different commands.
8 X, b% @. q1 g4 w7 V2 {4 _4C19:00AA JMP 0002 ; Bad_Guy jmp back.
% O3 f; o' p) _4 [2 |- k: _4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
5 G/ t6 M3 W6 y
6 o8 i1 R) W8 X" F; F) VThe program will execute 6 different SIce commands located at ds:dx, which2 g1 ]8 A/ d- P; D( Z
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
8 I9 ?# B5 b! N! K; h: M# A! ]' o7 r. F, d
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.% B- {2 d/ R5 Y
___________________________________________________________________________
n+ x7 f$ ]5 w3 j
: G6 N. V% G! l0 m- C: `
# F% ]4 I# ~4 NMethod 039 F1 u d/ M- Y: }& q7 ^( T3 u3 Z
=========
$ k3 d7 o4 s. t- Z; ~. g
1 d+ [) M6 L/ y w5 X( ]: `. ^Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
* N; u+ K; b7 R(API Get entry point)
; m. C O& S @/ M 6 ]+ ~! B" Z* y. P2 e' a: m* t0 B
; e" s) i* ^" {- b xor di,di2 C: v6 b8 s8 \) L( j+ e1 ]
mov es,di
* b8 m' J) j" w! f1 W mov ax, 1684h 3 d8 E% V; c1 ~# z3 m; G$ r
mov bx, 0202h ; VxD ID of winice
: Q! h! A5 M- Z7 _! }2 c int 2Fh. p: ?$ U$ O( ~1 ^4 e- l4 I
mov ax, es ; ES:DI -> VxD API entry point
8 i7 a; `; W9 I7 F6 w% N \0 t2 _ add ax, di9 W+ \ G. R5 }
test ax,ax" S) C0 V: L! x% }, }
jnz SoftICE_Detected
6 \: x( l+ s0 \ ]3 V( Z/ X
$ [3 y# f- |$ G6 _6 W___________________________________________________________________________$ ^& ^9 x$ b H Y7 `5 t
, j& C) `5 o3 F$ W3 r& {8 E
Method 04
+ r. D" B: c* ?" P4 W! V=========/ e/ K+ h1 t* w8 W
# m" v9 l$ D# w! F( T6 ^! [, L0 v0 ~
Method identical to the preceding one except that it seeks the ID of SoftICE+ C$ Y/ R8 e* S' x4 R/ i" U, b2 j
GFX VxD.# J2 V& C" x/ i B2 v- n9 p o& U* F
8 F9 F N7 G7 Q0 i2 V
xor di,di
$ V; |8 x3 [' u! H mov es,di
6 q. H; W4 k, d/ h3 u" h4 j mov ax, 1684h ' B- R( u7 m& ] h
mov bx, 7a5Fh ; VxD ID of SIWVID, n3 X7 t$ n$ T! h; D @6 ?
int 2fh
. x0 b/ C; u8 Q! B. k mov ax, es ; ES:DI -> VxD API entry point
$ D$ x* A0 v5 q5 e; R add ax, di
1 p7 o& r0 R+ c6 w/ @ x test ax,ax, }/ _+ R# Y4 c. _
jnz SoftICE_Detected
6 E5 K4 C `* q; ]: K4 R
( B9 o5 L1 h0 w! n- E__________________________________________________________________________
+ N9 ~ P+ e0 G" I! y6 a$ y+ J q; P% h! C/ Z
5 o- m! T: } Z0 ~
Method 05 u& d% p4 t0 h
=========$ T$ `5 y- l' I6 e( h
# R; H: a" B @) j' f$ M
Method seeking the 'magic number' 0F386h returned (in ax) by all system' D8 ]* U$ A$ ?
debugger. It calls the int 41h, function 4Fh./ D2 @9 f% c" o4 L1 N
There are several alternatives. 1 e0 M* J' v, w& I5 S& I
* {5 k# c+ j I/ F" T6 AThe following one is the simplest:
( j! F% _ @/ X& J% I
( n0 r7 r& [/ C3 s; l+ H: F: H mov ax,4fh% Y D$ U# w% Z) P
int 41h: K% I I8 o" d2 |- ^2 G
cmp ax, 0F3860 z. K$ g$ s- k: Q- y2 x5 C
jz SoftICE_detected! H6 t$ r+ o5 B9 ~, _: H
. w C6 B1 O4 E3 S/ R
+ L8 a3 n. S2 C& v2 nNext method as well as the following one are 2 examples from Stone's
4 Q, [- T3 n, J7 d& H" m"stn-wid.zip" (www.cracking.net):
' P- H; [, I; B0 U! b* |
& Q- C2 |2 ~' S: M mov bx, cs9 J$ i# x: ]; N8 r. l% ^2 Z* E
lea dx, int41handler2
: \' J# A3 n& w) t xchg dx, es:[41h*4]& s3 Q% S# h# {
xchg bx, es:[41h*4+2]
6 I. e6 }" {4 \/ M* ?% ~6 | mov ax,4fh
1 V. P4 \+ f( o int 41h
) c0 y9 q0 A# [6 Z xchg dx, es:[41h*4]6 d, l5 L) `( Y# K
xchg bx, es:[41h*4+2]9 U$ G) t3 y; p3 V
cmp ax, 0f386h
K# ?1 l2 t* U- @/ Q' W" o( C jz SoftICE_detected8 D% |' w% ^: }0 U/ a: _
) o5 L% K. k8 N( l1 e) ~int41handler2 PROC8 y" q) F# k. ?5 [0 R
iret, v% _% ^- ^. y/ ]
int41handler2 ENDP# F4 g, t+ g6 v% f- p7 L. ~# A
I% C. r3 T8 m6 r
7 X6 {( E6 C! \1 A4 ~% q# A_________________________________________________________________________7 L" t, U. Y2 m* S6 \% R+ ~
5 H" T- h( Y, B5 u; A
9 E9 }* j- w% V" K) c) qMethod 064 {4 {" `! l1 q# U. I5 H% R; V2 w& y
=========
2 k6 B( i8 T( Z$ t# y0 _+ E! a" p0 ~# S) b) P
c* l# x. y. `2 A) _5 K9 P& B2nd method similar to the preceding one but more difficult to detect:0 @ r# e* Z ~# e# ^
8 b1 t( P c1 |/ u; j
( X% `" P5 h+ T H" i' uint41handler PROC8 ~* O7 F& V& z( ]' G& q+ j
mov cl,al- v1 k7 Q* [9 h9 I
iret
+ p8 {* P; g8 `, m Fint41handler ENDP6 }/ o2 w/ |2 }1 ?
& k4 V% `2 m* c; W- g) s9 ~
& [7 J% X8 W( u4 y5 J' P! Y ] xor ax,ax" H; d+ j- ^9 g q4 J- W5 ]) A4 d
mov es,ax, f# B3 d' z: J
mov bx, cs
* z3 c0 M( v4 |; T# e3 W1 g+ q lea dx, int41handler
8 c! U" G. F( e+ ?$ V xchg dx, es:[41h*4]
* ^) w% V! O _4 o. `5 Y xchg bx, es:[41h*4+2]
, x9 J+ o# D5 J3 t: `1 R! q in al, 40h$ q) M3 f, r' Y4 a( j, I/ z* d
xor cx,cx
9 T8 x, M/ S$ q; Q/ I r int 41h. Q0 {3 l* Z3 `- y
xchg dx, es:[41h*4]- I( ?4 y+ z" J8 h
xchg bx, es:[41h*4+2]6 B) w5 w9 c2 e& ]! G) j
cmp cl,al
X! v6 A1 _+ E6 @+ p0 y jnz SoftICE_detected) O, _5 H7 P5 |6 ]! r) \# k4 ~ A
9 h% m* _9 T% \# B' }4 ~4 t4 u
_________________________________________________________________________
, X# g5 u9 f* i* _/ P
7 P; t1 I' Y' R( Q4 n1 IMethod 075 k2 s `6 A" X8 I* l6 F- _
=========; M4 T1 M3 E) z4 J
8 A/ O* q. Z) CMethod of detection of the WinICE handler in the int68h (V86)2 m3 O2 r; }* x
; m& p* H5 B: L- c& |
mov ah,43h6 I# ?/ w% s8 M0 ~$ v, m
int 68h
& E2 ]+ h# W# C1 L* f cmp ax,0F386h
/ }8 R2 i& R$ @. E jz SoftICE_Detected a1 f& M# C/ k3 ^% F
7 c9 M# A! g9 H& N7 P- i. `
) r7 w% T2 n6 j9 C2 { H$ g=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit1 O2 n% O9 H* f
app like this:
2 |! M ]0 f+ q6 K
1 R1 | A% j$ g, x0 V3 _/ K: ` BPX exec_int if ax==68
* J* [* a! k+ Q* |; ~0 b (function called is located at byte ptr [ebp+1Dh] and client eip is& b1 a: n" Z- F8 ?1 D9 F" W
located at [ebp+48h] for 32Bit apps)7 ]8 p/ h! h. X# s3 w
__________________________________________________________________________
- D _3 P1 U, Y9 `& v& d
+ }1 F R( W0 ^" `! k k5 Y# P% Y$ M: a: K! N9 }0 r
Method 085 V9 o- f* H/ k6 ]' v
=========+ K2 ^$ _8 [+ l
0 k; L6 \: U3 K- j& v/ mIt is not a method of detection of SoftICE but a possibility to crash the
5 F+ u! C6 t4 k! m. o5 c# g+ J; gsystem by intercepting int 01h and int 03h and redirecting them to another, N9 [. F& @) c& [0 \8 G
routine.
; c1 U0 M4 |' B* AIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points% m5 k9 O5 ^/ a8 A# {' C# v
to the new routine to execute (hangs computer...)7 q" N3 @, ?6 Q3 ]" l* @" J
9 e' y) w. N, E# e1 _ mov ah, 25h+ K! z0 u- q3 K* Q- {) {2 U- Z: I
mov al, Int_Number (01h or 03h)
) g% w3 _. D. k3 s( A7 f6 a( m# M mov dx, offset New_Int_Routine
6 s" V8 z1 V2 q4 F int 21h' T# g# E7 S% U1 E& L
- `1 @, t! ~0 |, O0 g0 g
__________________________________________________________________________
: J: o, z0 C6 I% s% P7 Q2 G& i2 H4 B: V1 v7 s# K' x9 L
Method 09
3 T. _+ Y+ S, a% H2 s=========: w; d/ W' G0 B2 G: c6 h# t
7 C4 c/ v: g! x3 cThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only6 @! q& b4 L) r% g* R
performed in ring0 (VxD or a ring3 app using the VxdCall).. `/ H. T* E4 D' k
The Get_DDB service is used to determine whether or not a VxD is installed, `2 ~3 H$ F2 e4 P2 h
for the specified device and returns a Device Description Block (in ecx) for
- d; [3 A1 {7 u6 athat device if it is installed.0 P6 ]4 s+ M7 n
; D4 y! @: P. n5 @5 [5 ^
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
( A0 k, |+ W: A3 W mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)5 f& k f5 m7 O7 h! Y9 {) _9 W: _
VMMCall Get_DDB) `2 I9 v d$ h9 r' L
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed6 K3 g$ U7 W o0 b: X& {- O0 [, M
3 Q) Y& H* F6 U8 XNote as well that you can easily detect this method with SoftICE:
, v/ L) `4 t/ R bpx Get_DDB if ax==0202 || ax==7a5fh
) c% D9 D7 C8 w# ~! `' r4 G2 A/ _+ S6 Z+ X- q+ O6 E
__________________________________________________________________________
0 h, K4 b+ {" G. U, ?0 E+ l# K* o: O0 t' a. N z1 a
Method 10! T( E" B) K. P
=========
: }) _! d( n2 }+ {1 S. s, @$ }; \2 \2 _6 O0 F+ G5 U
=>Disable or clear breakpoints before using this feature. DO NOT trace with
3 f+ T; P; N$ S6 P' _) \- O- @ SoftICE while the option is enable!!3 v0 k( p3 n" X) H+ f
/ c1 J1 `/ W2 UThis trick is very efficient:" Z y- X; I$ S" i* W1 }& ?+ S
by checking the Debug Registers, you can detect if SoftICE is loaded
' l" ]) D; ~( w+ o$ `+ A. Z(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
8 y0 p0 x9 p2 I; C& P( ]6 Xthere are some memory breakpoints set (dr0 to dr3) simply by reading their
$ D2 `3 l% Z. B1 b5 Ivalue (in ring0 only). Values can be manipulated and or changed as well
" j( Q2 u; i2 [; X- l(clearing BPMs for instance)( ~+ ?/ \6 @8 U4 d9 y0 _4 x0 j
1 m' f5 W/ G7 @+ x& S__________________________________________________________________________
9 i2 U( K0 B# J, H1 J$ A' x; `* U* O' M9 V" s L" G k5 o3 L3 y2 a; p
Method 11
* X0 z! ~9 T5 `& g- j=========7 x" e- C! l6 a% l
3 b! p3 b* `* A9 x" Z
This method is most known as 'MeltICE' because it has been freely distributed
/ a( K9 U. X X* Uvia www.winfiles.com. However it was first used by NuMega people to allow* s" A* ^: D( W! h7 K H% F
Symbol Loader to check if SoftICE was active or not (the code is located
7 ]. n4 M& [ finside nmtrans.dll).0 z- i- S! f' ]$ X4 i: s2 [
8 _# o+ x. I$ H9 M" |# wThe way it works is very simple:
( N! c+ A7 `: f1 h; P+ PIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for' `/ ^9 F+ L# B3 b3 A
WinNT) with the CreateFileA API.8 K! O: K8 E- S. S4 N8 _/ h: @1 ^
5 H4 X9 l2 A) _0 l8 |
Here is a sample (checking for 'SICE'):
- U& W0 S z4 `, c9 {2 }" ?" c' K4 k6 s. N( I! D; O) f7 y. M
BOOL IsSoftIce95Loaded()
3 A% R' ]6 [4 S/ Y2 D{4 k7 E: `0 S6 u
HANDLE hFile; # X: z1 N4 G5 V3 y9 x
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
8 B; K; B) b* H) ~ FILE_SHARE_READ | FILE_SHARE_WRITE,: J7 T- a. R$ q, O
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);/ J4 p- y6 X2 F' e( h
if( hFile != INVALID_HANDLE_VALUE )
* ?8 F4 f! ^) J& D, Y8 V {6 [# O9 F2 {9 Z A$ |3 T
CloseHandle(hFile);
9 v, l. c: a/ F return TRUE;1 v. B- ]6 ^- d' O% d4 y: v; }9 x
}0 K+ N. s; W5 m2 ~9 {1 ]+ W
return FALSE;. S# G, |4 u9 |- O8 x
}
9 u7 S' L3 H+ V/ t3 U' g
) E' C3 l& c, u% [; fAlthough this trick calls the CreateFileA function, don't even expect to be
7 a& s; c7 v- U7 ?6 e) k7 ~able to intercept it by installing a IFS hook: it will not work, no way!4 U( }3 K8 M9 R, b
In fact, after the call to CreateFileA it will get through VWIN32 0x001F* ?! f! N3 [8 |9 A
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
( m9 Z1 X, W# Y+ g+ u% b* zand then browse the DDB list until it find the VxD and its DDB_Control_Proc4 m- L t& a& z6 e" L
field.2 L) H6 I. x! Y
In fact, its purpose is not to load/unload VxDs but only to send a 6 d" z- c+ Z* n& K! Z4 t8 p" Z
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
; G5 u* K0 [; P7 ~( Zto the VxD Control_Dispatch proc (how the hell a shareware soft could try
7 Q1 N: Z% C8 L- V5 r- P# Bto load/unload a non-dynamically loadable driver such as SoftICE ;-).
3 g: g6 ~, @, p9 \% |& y. Y, x |, @If the VxD is loaded, it will always clear eax and the Carry flag to allow! l3 U2 s% x! ~* o5 ~$ i& ?# n
its handle to be opened and then, will be detected.0 ?5 i1 i; i8 y
You can check that simply by hooking Winice.exe control proc entry point9 k# A1 \, X& |2 D2 `# C
while running MeltICE.- t1 V; K; O4 ^. G* y
7 g: C) J* f _( R% v: Y& k
' n- B6 o: E. Y1 [1 C( ? 00401067: push 00402025 ; \\.\SICE
2 W5 `2 u/ T- J% h 0040106C: call CreateFileA$ @" o3 M3 c7 E5 g% v5 q* {$ |
00401071: cmp eax,-001
6 C9 E/ `/ ]. A% \0 @* C* Z% d 00401074: je 00401091% }6 {/ F5 E8 |8 m
+ a! V: `3 p( t. w5 D S
- b, q3 X9 a/ k2 _There could be hundreds of BPX you could use to detect this trick.4 _9 I. z, c9 ?/ W7 e7 e
-The most classical one is:/ F/ e, T( F$ t2 w5 Y1 X
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
& E! I: t# ?4 l( v *(esp->4+4)=='NTIC'5 S' \/ [8 S. e/ m( h9 W
, E2 q/ h. H5 s B-The most exotic ones (could be very slooooow :-(
$ ^8 V! H$ f& H+ H; n BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') 2 o. E3 w' u. _4 Q' J7 b
;will break 3 times :-(# t7 w' O, p" z4 L
" ]7 B' H+ r$ }0 c
-or (a bit) faster: + f( \, R8 k* P
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
8 h. f: a% M& g4 Y
# ^( n/ s' e7 T5 Z BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
+ _; u- w( _: ]4 v+ f ` ;will break 3 times :-(- ^( V; p) e+ ^7 K+ l' W
4 i; f4 X; y6 t I3 e! Q
-Much faster:! T2 z' ?, I* u8 M
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
/ Q6 _3 g: X0 l' u7 S: M: J" o
% g, _( Z3 l% x4 WNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
u& F! v( c+ Pfunction to do the same job:6 K% x2 n. B7 U6 c5 K8 d& _
, i# g& a z9 V
push 00 ; OF_READ& } k9 `4 m( B# V- i) Y( J2 R
mov eax,[00656634] ; '\\.\SICE',0
4 e% m, k) H1 T" F) y" J$ Y push eax/ M" r! I/ o1 }; W, R1 S* o# W
call KERNEL32!_lopen
* A! f, l: `3 ]! h inc eax0 R6 f7 V, S- X# G
jnz 00650589 ; detected1 y I' D8 y* h" f0 \
push 00 ; OF_READ" r+ T& l/ R; U& k( t
mov eax,[00656638] ; '\\.\SICE'
! Y: E1 a$ W9 Y+ a push eax# j/ @2 F7 A. }0 E+ w0 T5 h; l* t
call KERNEL32!_lopen3 i# m. ], {. m- ?
inc eax* G9 v+ F" l. u$ h+ d3 K" U* M9 ?
jz 006505ae ; not detected ^9 [/ E- X1 T E0 H
9 A3 y2 r- K, L1 _& H2 Z
1 x6 p; o/ ~1 C* L! B' V__________________________________________________________________________
% x; H% ]/ K/ {' _8 }: |0 k7 r& V+ d* K4 G' m/ V
Method 12' P" ~9 ^6 s" d( u4 v: ^' q
=========+ n$ L, [( q* W* X
/ z( N" O: Z7 Y5 i2 dThis trick is similar to int41h/4fh Debugger installation check (code 05
( V2 C1 V1 C5 p7 l$ H9 Z& 06) but very limited because it's only available for Win95/98 (not NT)
0 @( w3 |4 n& g; l; V& Jas it uses the VxDCall backdoor. This detection was found in Bleem Demo.3 N' U" @* ? y4 D
2 z; G. [/ X, S# K/ G push 0000004fh ; function 4fh% w' _6 Z- r' _
push 002a002ah ; high word specifies which VxD (VWIN32)" I: S7 }9 j; V2 W
; low word specifies which service- g% |: I& U( v* W
(VWIN32_Int41Dispatch)7 L, z7 \) g& R b j
call Kernel32!ORD_001 ; VxdCall% G+ N% e; j' F9 Z6 V
cmp ax, 0f386h ; magic number returned by system debuggers9 R: ]6 J# y( Y1 C
jz SoftICE_detected! A( d( f, h: x' \' p( N2 I
) Q6 `# T. D" V
Here again, several ways to detect it:
W- h9 O5 O) }) a: u( q5 R0 C
$ g y4 c; Y' s" D BPINT 41 if ax==4f/ x6 |& i, T! y! _3 h3 H
) ]6 h! g, w- ~ BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
V% y% B- d! l8 ]. S
0 k. M0 w5 U2 @, @" d BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A" T0 z6 i( `+ d2 b f' L
- i& v# B" E4 \' J
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!: m$ C: v) ?& y" l( {
( h+ w e% h) p0 v* [
__________________________________________________________________________& D! p+ A# _; ]
- ?6 X4 O# L, r% J9 P+ l
Method 13, ]5 V: B' m8 I: Z
=========
% v0 H" h& j( A1 Q3 O/ i8 B7 y
2 r$ F/ W/ C& S, R0 _Not a real method of detection, but a good way to know if SoftICE is
' \/ ?; I: H5 j: vinstalled on a computer and to locate its installation directory.
7 {$ D1 m6 y4 k) N2 J7 OIt is used by few softs which access the following registry keys (usually #2) :
$ d$ F9 s+ N( N* f0 J+ F) p' ^7 S9 i' [0 A
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion A8 {" D, {5 }$ z, F1 H0 H( C# f+ `
\Uninstall\SoftICE
: u; j d8 Y: R1 q-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
# @' p' p- z' ~* i* O-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion8 t7 L1 N7 ~ h2 i" M: d. w
\App Paths\Loader32.Exe
( D7 z+ I5 P" X- G9 u( E. Q. K: l
# r8 U* {( w3 Z' _* v/ t9 ]+ ?* d
Note that some nasty apps could then erase all files from SoftICE directory
! Y- |# M4 w/ c# z8 T(I faced that once :-(
$ @/ R" W/ s2 b M* R2 r7 K0 ^% A% \4 p! {2 d
Useful breakpoint to detect it:0 e0 d# z: Y- s% `" k
" C+ {1 ^; V( N1 r5 C! o BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'4 h$ F O4 m" Q8 A/ w) T0 Q
3 ?+ ]! X/ i" e
__________________________________________________________________________
/ u, u5 R; M$ _4 E) G/ V
- Q1 Q6 k) K+ c" }* |
( H7 U a3 e0 B" Y, E" Z5 b3 IMethod 14
/ W' L6 _) @ G% [=========, O5 L2 K3 H, s' S2 C+ W. G
2 {- i r1 }6 g0 Z+ g
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose# ]: I0 R5 w% v# [% G2 C! @5 q
is to determines whether a debugger is running on your system (ring0 only).
/ A5 R3 N( ?2 b- ^! e
" @ Y' V+ ~5 ^$ f, F VMMCall Test_Debug_Installed8 u3 Z% ^4 y, D K% X. a* p9 Q' L
je not_installed; p: f9 @4 k* @* n2 U2 N5 d: {- n
. ]/ j: m/ g0 F2 Z: S
This service just checks a flag.% Q% a2 E9 C/ j; A g* ~
</PRE></TD></TR></TBODY></TABLE> |