<TABLE width=500>
( ]3 d; s# U$ h3 o9 b6 ?<TBODY>
1 s, d" L* f0 Q2 Z8 I<TR>
6 u+ D. W$ x- q& ~<TD><PRE>Method 01 * H0 M2 y% N$ i5 j8 a3 a4 q1 X2 ~
========= c. E8 g4 \/ A* {* v+ _- c
$ \" {! {; N, n$ m; qThis method of detection of SoftICE (as well as the following one) is
2 u" |$ ]2 G" ?+ xused by the majority of packers/encryptors found on Internet.* _; n. |9 ~# s) o
It seeks the signature of BoundsChecker in SoftICE
# P6 H( `- D8 l0 @7 z, Z( o& M* |! C) U9 c' c: i1 o) j- d
mov ebp, 04243484Bh ; 'BCHK'
/ E! L7 ~/ v9 S- D! C- ?- I mov ax, 04h- l) C/ e/ j) v5 x, M( @3 e
int 3
1 ~! F' f- B/ s4 Z& @' ? cmp al,4
# Z" o1 U ^4 o jnz SoftICE_Detected
& N' H8 G1 _, y2 ]" j; ]
* h8 q7 ?5 E- U& N8 Q3 C___________________________________________________________________________
( p- B4 r3 H. ]0 V; m5 l& x. z' c/ Q: f- J. x/ @' d
Method 02# I, D3 ?1 X* s6 D; z
=========' H: |9 [! w- |7 P) l
, O& x/ x8 b! {% ^Still a method very much used (perhaps the most frequent one). It is used
! [- `' D! @6 t1 ~' ^to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
8 P# p$ [# Y) }/ oor execute SoftICE commands...
' I% e4 O% y* \/ ^+ H3 ~4 wIt is also used to crash SoftICE and to force it to execute any commands
7 j# V' G- c# d! S6 h(HBOOT...) :-((
$ C. w( N' P" ` {5 j( h' v
9 Y7 ^7 o. a6 @8 cHere is a quick description:
8 n2 n& u" u/ H6 P2 ]$ {-AX = 0910h (Display string in SIce windows)1 E3 j4 w# @6 B: V) o
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)3 z' p( j, B7 M& K5 ?) y
-AX = 0912h (Get breakpoint infos)7 ~9 M4 K# y+ Q- P* i! A0 B
-AX = 0913h (Set Sice breakpoints)
: `$ B" p0 ` L1 J-AX = 0914h (Remove SIce breakoints)/ m5 ~7 ]5 W9 x' C' v$ z
- C2 g' a) W: ~( |$ _8 p- Q
Each time you'll meet this trick, you'll see:4 @: E( c9 p p( a2 ~
-SI = 4647h/ ?9 y5 ]- Z G9 _, M1 F
-DI = 4A4Dh
( E: P4 B6 E+ ]4 d$ p7 jWhich are the 'magic values' used by SoftIce.7 Q" [+ c; K- t9 Q$ c. ^
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.5 B* b( [) O& Q/ d+ H
, C$ M7 r$ l- K; v& F- y5 o: LHere is one example from the file "Haspinst.exe" which is the dongle HASP `0 u) H8 `2 [; V# c9 t
Envelope utility use to protect DOS applications:; P8 m* |) F$ E- Y
! |5 T" ~' P% O+ x) }2 M
$ F$ \0 t$ b0 `2 T4C19:0095 MOV AX,0911 ; execute command.& d; N5 d! B2 C2 X
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).$ M/ p/ z- I1 _! |) B. E2 }8 l
4C19:009A MOV SI,4647 ; 1st magic value.7 Q# B1 S- h& Z9 M* F0 Y5 c
4C19:009D MOV DI,4A4D ; 2nd magic value.; s! m# C! I7 s) L. L1 u
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
2 ?. b9 N1 n4 }6 S3 ~: n3 N& S( ]4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
U8 h5 N! S% @8 {+ j4C19:00A4 INC CX( O0 h* s9 G' U7 F U+ @ V; z4 j
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute0 j& b: U. |6 g: s, \; O
4C19:00A8 JB 0095 ; 6 different commands.
1 @4 j1 x5 _/ W4 U4C19:00AA JMP 0002 ; Bad_Guy jmp back.
F$ `4 H4 n* n! j+ V G' h7 K! }# C4C19:00AD MOV BX,SP ; Good_Guy go ahead :)3 p% v( H+ t0 z) v
. G" ]4 n: y$ J4 ]- m5 D' d* S( VThe program will execute 6 different SIce commands located at ds:dx, which
$ L) A! ?# Z1 n! m8 k' g tare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.& i6 U0 R; z0 C
3 x6 M: |9 k( ]' d' p9 l
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.6 b# E5 Y$ e+ T
___________________________________________________________________________
0 G% x% e# c! K" z& `- ]
, l' p y! y) m2 T" w7 C$ p* A+ B& i
Method 03& \4 L0 k8 D X% n& g# U
=========
9 B4 v) {* R2 t! r: g. y* p! j
* R5 m: W5 Q+ A% ^Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h9 }- G! m, X3 q. q6 A8 ^
(API Get entry point)3 J& N; \+ q" i7 h2 C$ u/ t$ j
0 O" `) `3 S) Q/ ^
" ^, n/ ]* Y; X6 e, X
xor di,di
0 y3 }1 a4 U$ s/ \1 L mov es,di
( K) j' u0 w* D8 X- t mov ax, 1684h
+ W! P8 C& v* m9 P: ~6 \7 ~ mov bx, 0202h ; VxD ID of winice
# c% E$ _ T: h1 s6 U6 N. n/ A; g int 2Fh
; c- V2 U! r: @ mov ax, es ; ES:DI -> VxD API entry point7 n- z% j' Y+ G$ o; Y1 n, i
add ax, di
+ y. v1 y, Y' l# ?% e7 f1 y8 v test ax,ax8 g2 b. x$ i9 r' C' `& M; S
jnz SoftICE_Detected* `% h$ z/ K$ o3 B8 b9 |0 W
3 f& [# n6 O$ C3 p___________________________________________________________________________7 L* g8 G4 S2 F
/ s" @; e4 u0 @) P$ _
Method 04
7 r! c" t7 x8 N3 k) y O- ?=========/ A5 [9 t7 }; [; p1 G5 d" }
8 P- A- O: `/ T5 q) p# rMethod identical to the preceding one except that it seeks the ID of SoftICE
* \9 m O0 b2 F; WGFX VxD.9 s$ v$ {, B |" }* q
) O( S3 {0 h* b
xor di,di N. o d8 o n
mov es,di
8 Z, A2 v: y, V. i5 k mov ax, 1684h
* V P% H( m1 }1 I! R; [/ } mov bx, 7a5Fh ; VxD ID of SIWVID( i* N5 n: c8 R l
int 2fh3 i" I) _1 ?: A! ^9 x
mov ax, es ; ES:DI -> VxD API entry point; ~# K5 r9 a# t! Y
add ax, di& A ?: l. V& R0 M2 e* U* Z
test ax,ax0 r1 a b) t- I3 @0 I
jnz SoftICE_Detected$ x; m7 P4 \! |
, Z& p, T- T) a% G5 h9 T
__________________________________________________________________________
U% [1 ?# z1 F( Q" r4 l2 K
5 i; ?; n+ L. M& \/ C# J7 ^4 b. H' r
Method 05! k; k3 H1 g0 C$ q( ?- ~2 a: V' x; K
=========- t. s! e# V1 _9 O& ]
* h! v$ L8 G' T/ [* d
Method seeking the 'magic number' 0F386h returned (in ax) by all system3 R( H) u) s. J+ [2 H
debugger. It calls the int 41h, function 4Fh.
5 L5 K- i( J+ j1 r- o6 M3 ?# `0 eThere are several alternatives. 1 \( W, @# o5 J$ ]
' m" y( r5 `& W: s3 {. X: ^0 z& S, \The following one is the simplest:
n7 ^9 }& V. T
9 g# I8 ?9 |* T4 Z- k" Q8 G. ^% s( F( l mov ax,4fh& G5 T3 [" g2 d1 e3 l
int 41h' ?4 f/ ?$ I! ~! H; x/ ]
cmp ax, 0F386
& @+ o* y8 u7 Z' c4 F jz SoftICE_detected6 K- @" v& u8 o, ~
( \3 O5 D% e. k- X- _8 x, w5 Z
! J& X1 ?. s: [- o! ~; `Next method as well as the following one are 2 examples from Stone's
0 I' b- ~! v/ o R4 W+ G. u"stn-wid.zip" (www.cracking.net):
) B. W+ [: R1 d; @5 o9 A
+ E# ^, n( c* x+ @* T+ m% D mov bx, cs
" r$ u: v/ ~1 J$ x lea dx, int41handler2
8 l8 z7 J( ~4 w8 L' ^ xchg dx, es:[41h*4]
$ v- Y3 G4 u. d2 X xchg bx, es:[41h*4+2]
" g% K% H( V1 ^0 L" H! m mov ax,4fh
* r4 E: x0 ]* l) D% G/ g int 41h9 @' ^/ p' S h0 @# y) e( V
xchg dx, es:[41h*4]
+ `$ F+ J6 ]- k2 P! t# X% L xchg bx, es:[41h*4+2]! s: {7 @9 N6 [+ Z6 j8 ^2 x
cmp ax, 0f386h
+ L" I6 H' w* v; c. M. `# o5 K( q6 K/ U jz SoftICE_detected3 I; M3 `% \$ f5 W( }) S9 A& W9 v
, g5 y1 U# T& c/ l8 ^int41handler2 PROC- h7 A% ~# t4 i
iret7 Q& I9 c- m4 L% L3 ?$ S( B8 H
int41handler2 ENDP- W: S& y8 F0 y, E/ S, F, e
6 G& X& L+ J" f$ b
- I; L0 o0 J6 U% F
_________________________________________________________________________
, u6 L" }3 d- c+ f0 \; S x& R# p3 e! n0 E t
0 `, X b1 U* K$ T1 [$ rMethod 06
* Z" g# [7 ?! S9 D& `4 \3 q, K% |=========& W: [9 ?9 R9 b1 o) A5 ]- O
: w4 \& q* N, x' d) y
8 _5 J" O* a3 i+ P% H
2nd method similar to the preceding one but more difficult to detect:" {- a) ]$ R* D& D3 _2 h
) T$ o6 T5 m$ I$ @, J/ J% k D
' ^1 x0 f/ U9 Z- T+ K& M' C0 P
int41handler PROC
d" @, f$ D' U, ^+ E6 a mov cl,al/ b' ^' K. }5 q: t
iret
5 g! n" Y7 ]/ P1 V' f' hint41handler ENDP
% ^2 n" z [5 ~1 {) c' v% w: Y
3 I7 @! F2 P. m
2 T2 P. c: x, r z xor ax,ax) v- E- N1 H- ?( e$ e
mov es,ax. n2 R& V, t' J1 T5 z8 s
mov bx, cs ~7 T9 ~! U& f- h& b8 [6 k
lea dx, int41handler
: x6 c7 _( c9 U! D+ J xchg dx, es:[41h*4]4 k w! [* Y! W1 ~& e8 F5 Y: x
xchg bx, es:[41h*4+2]
5 K# ]% b; p7 {7 M in al, 40h
! I- w+ V2 w) h! W/ `/ ? xor cx,cx
% i$ Y" ]. Y/ |9 b4 R9 K% X int 41h
; ?, F* `+ X# u xchg dx, es:[41h*4]4 p3 W* c, d) a' i
xchg bx, es:[41h*4+2]
) o2 |. i7 j/ _" Q; Q3 | cmp cl,al& _ P" k# ]7 H6 ?
jnz SoftICE_detected
! [. x% N) @* M1 w2 R0 F1 A. K" r" C( R* Y
_________________________________________________________________________% A0 a* |8 u8 E) W7 L: a
+ A$ C' F# A' ^' nMethod 07$ f' y+ I B- e6 x" W
=========8 h6 M/ q7 s: T8 Z6 ~2 W# g
3 h( ^4 e4 |4 |$ R+ S: yMethod of detection of the WinICE handler in the int68h (V86)
$ \, k% D( {6 w; w$ n6 D0 N
& _) Q# d5 g" \" s# ^5 ~ mov ah,43h
& R7 s! ]( z. d/ l" p9 ~' ] int 68h( E# k/ W- ?, M5 D, d0 i
cmp ax,0F386h$ G( d9 H0 A/ I6 r- l" O
jz SoftICE_Detected
; Z0 J; U/ R. _8 L3 F6 h; g) H5 q3 A, V" {& j3 Z% _! p
) }0 P& a, e8 u/ h
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
8 s3 B, t% J# ]2 ~ app like this:
, g. K$ i0 z1 V* p( P2 W$ V' p/ g, H( g: ]3 J9 Y9 H
BPX exec_int if ax==68
0 i# {& q0 c6 d& D; d1 s5 @- v (function called is located at byte ptr [ebp+1Dh] and client eip is
+ l, n! L# k& B3 r/ q located at [ebp+48h] for 32Bit apps)
9 q+ M% V9 P" P Q$ |__________________________________________________________________________, I* ~" h# V4 J9 U$ O Z
, l! M; Q4 \: E1 K) t
J8 u- \9 P+ p; qMethod 08
6 h* e! `( g3 s! `( ?* I' n=========- B2 V F; X' ?( I& J
* L- L' S! |% EIt is not a method of detection of SoftICE but a possibility to crash the
3 |& b0 m% K( z' Q, v0 `! M* bsystem by intercepting int 01h and int 03h and redirecting them to another
9 ~& @ p. o2 \ N+ v) q: y b- Proutine.
\5 B0 e5 @0 ~5 R3 XIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
, \, J% D/ i" k3 W4 ^+ A0 Gto the new routine to execute (hangs computer...)6 g" W7 o w2 h2 V. X
- {# ^6 i3 t: @% `' l& \/ X mov ah, 25h% J! }) Y0 g& ^" T* U7 j# b* G
mov al, Int_Number (01h or 03h)
. [! Q2 ^8 X: a- m E; ? mov dx, offset New_Int_Routine: K4 q3 Z9 l8 s+ Z$ t
int 21h6 H. q+ G$ L4 z2 e
2 h5 x, A' e( o; E$ b* v3 h
__________________________________________________________________________' J9 a& X0 ~$ v. S7 E
5 ^4 @1 X' k0 w* s4 e# x3 l3 KMethod 095 Q9 i6 _) k( x/ a. y3 g
=========6 x/ ]! ], \/ a) G2 k: \' l5 n- {1 e
8 [& ^ [$ G1 w, {/ W1 w, ]
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
6 G9 s; g- ]! L/ ^performed in ring0 (VxD or a ring3 app using the VxdCall).
0 l( T# \4 P$ f4 Y GThe Get_DDB service is used to determine whether or not a VxD is installed3 S. O3 m9 y- W" t
for the specified device and returns a Device Description Block (in ecx) for
) G0 j8 q _: P1 `6 T' Pthat device if it is installed.
/ F7 N8 \" i. q
# j3 {9 u+ |/ h mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID1 c% {4 p: e% l! i; N" B
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
7 }+ ^" W2 X. s1 Q4 @% @) N VMMCall Get_DDB
/ t1 D. X8 x( E1 Z mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed! j# d, p% C6 ~% _$ ]
- `; e; U5 U5 I7 [9 lNote as well that you can easily detect this method with SoftICE:
6 d9 ]& T- A6 ?, f bpx Get_DDB if ax==0202 || ax==7a5fh( ]& ] G, R8 Q1 U8 |" Q0 G
8 b' J- x8 i3 \6 T4 C8 d__________________________________________________________________________
2 h4 y- w* [ }% T; B4 J( w: Y5 W1 }. D- R: ]( l
Method 10
9 Q0 o2 F) o' X6 o5 _1 G* T=========
0 W0 ]6 P! A# G) s- q9 d- c; p& U
=>Disable or clear breakpoints before using this feature. DO NOT trace with5 _7 [: B% W/ j" A) v c
SoftICE while the option is enable!!3 c& m: o4 X3 }+ s$ r
2 G9 `, q- e# L9 ^6 O
This trick is very efficient:. t3 q9 ^ H( A0 c% ]
by checking the Debug Registers, you can detect if SoftICE is loaded' O3 q, k+ o. i8 o
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if! l+ w+ o( j' T4 A
there are some memory breakpoints set (dr0 to dr3) simply by reading their7 @2 a5 O2 v& ~( t6 }) X
value (in ring0 only). Values can be manipulated and or changed as well( l) L4 L' c) G/ k) |
(clearing BPMs for instance)
7 I8 a# _$ Q6 Y$ [2 ~+ }. _# b6 R$ }4 L8 l7 ?5 N5 N \
__________________________________________________________________________
4 c4 l, Q/ e, Q! p) o! y) X" R X7 S; c+ J. u7 R2 |# a! U9 F
Method 11
5 j+ H+ j" I* h8 {: ]# C& I=========
- x( c8 a4 _0 \. l5 S& n$ Y* R. Z% e; Y3 @( @
This method is most known as 'MeltICE' because it has been freely distributed. F* S; W5 |' l5 |
via www.winfiles.com. However it was first used by NuMega people to allow" W& W: S# D3 X- H1 g; ]
Symbol Loader to check if SoftICE was active or not (the code is located3 A+ }! r8 ?7 \, |% h3 x
inside nmtrans.dll).
2 u) x. ~% ^) p9 ], {
3 G$ |/ Y0 A+ \The way it works is very simple:
4 n9 Z4 R: |- m+ l J; \It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for- o6 V+ l/ ]. r- k" L5 _
WinNT) with the CreateFileA API.
) Q9 o6 s" R9 R- J+ b- \/ ^5 Z- O9 `* ?* K* {
Here is a sample (checking for 'SICE'):( R: `1 h( w5 H: K
0 M' K* ?/ M0 {. e4 I
BOOL IsSoftIce95Loaded()
/ F% Z. s% I* B{
9 a8 v: G) \: w* r: R HANDLE hFile; # L+ P) ]% K- K: C0 M- X' l
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,3 c& O7 i: T% G
FILE_SHARE_READ | FILE_SHARE_WRITE,4 U* N) y& |# r3 L$ H6 a( S2 I) R7 i
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
* Y8 t0 D3 p* u. ?3 ]0 i3 X6 h- p if( hFile != INVALID_HANDLE_VALUE )
/ w1 j" z6 _; B: B% D {
& H3 T* s; _" P% \2 q CloseHandle(hFile);
6 M- _3 t; u: |- U; q return TRUE;4 }* m7 S0 Z: g) A& ?3 d
}* L. p; P) ~5 s* d K6 F( T
return FALSE;
* \" j1 u5 E/ |* V}
, W- p4 ?" ?! Q$ b/ Z6 p$ _, S
" i6 A- ]! S7 c6 a$ ~ ^% WAlthough this trick calls the CreateFileA function, don't even expect to be
% r+ L& Q4 ^; c) S( sable to intercept it by installing a IFS hook: it will not work, no way!+ a9 O% Z& E7 s, E
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
( r6 q" V9 E; A! Xservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
9 Z1 l5 n) G' N: |and then browse the DDB list until it find the VxD and its DDB_Control_Proc8 G& c9 A$ P! Z" i6 ]/ H3 U
field.9 |; l6 x5 G$ W( J
In fact, its purpose is not to load/unload VxDs but only to send a
7 Z' U$ B6 b0 Z& D$ OW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)( P4 E2 Q/ }4 F/ }' G7 p
to the VxD Control_Dispatch proc (how the hell a shareware soft could try* O& m: q6 ]2 ~6 ?2 h# y, x
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
% j* ?9 E6 [' b! {1 ~* cIf the VxD is loaded, it will always clear eax and the Carry flag to allow8 P0 j. U7 {) h7 t% p) Y( N
its handle to be opened and then, will be detected." K4 ?- c. M# v. K% s# B! [
You can check that simply by hooking Winice.exe control proc entry point
) d# a% R9 ?1 k% n4 Y/ qwhile running MeltICE.: I- {6 o( a6 y( f
9 ]5 Y1 @: ]5 p" P" z/ f
$ G1 b5 G; l2 v) {6 o' w
00401067: push 00402025 ; \\.\SICE
7 l! g f) U4 u% O6 C8 r 0040106C: call CreateFileA
+ s' v \$ z; A. o/ ] 00401071: cmp eax,-0011 V1 A2 P% h5 H
00401074: je 004010915 i7 c- \0 y/ Q5 z
) L$ q+ O& g# b& [2 W' ?& |& e; m4 H
8 X9 ` B2 X' G( }" j0 XThere could be hundreds of BPX you could use to detect this trick. z0 w0 A9 X# i
-The most classical one is:
' a7 g8 s; H3 w0 y5 Z BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
/ _' e, ?/ ]' r: K5 @8 d% U' D( F *(esp->4+4)=='NTIC'
" Z. {6 a2 c: W' R9 m: e# Z. [: t9 @( l# Z# N& R9 Q8 G$ g1 ^
-The most exotic ones (could be very slooooow :-(( _ g0 b4 x% K3 \3 j2 @; j/ B! T1 ]
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
) ^) W W# x; D5 k) S } ;will break 3 times :-( N2 V3 ~2 y3 ~4 r( r$ `
* N2 Z% }( V. p. r* j+ H. {, P& ?-or (a bit) faster:
- \; a: s$ e1 b" \ BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
P4 ^: z$ [/ l& o; `) \
7 ]. F# m; L6 H Q BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' $ F7 ~4 Q+ w$ G$ e; p
;will break 3 times :-(( S' |$ X1 j w9 C
" P3 Z3 K* b0 x9 b
-Much faster:1 ^4 c: A) F/ \, y
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
1 v( X1 d# B7 t% j# u4 b6 Q7 m2 P7 y# Y! H- f3 t
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen) Z( x. d0 g- Y! @. F$ z
function to do the same job:
& H3 e7 o8 r( f" {
" L/ V% U: m. p. r push 00 ; OF_READ
" E* m; v4 Z# {% b$ v mov eax,[00656634] ; '\\.\SICE',0/ |6 m2 n. R5 w& f0 C5 P9 x
push eax" b3 E" B' K: J5 |- L( q8 v
call KERNEL32!_lopen; Z" j! l( [* x" [. G$ V% ^
inc eax4 }7 B% I/ Z8 q- b! t1 v
jnz 00650589 ; detected
5 S G: L6 I/ q) e/ i, E# N push 00 ; OF_READ
, O2 n k% t& _ mov eax,[00656638] ; '\\.\SICE'
& e) O3 E" S1 A% B- j& n8 N% }2 [ push eax
+ g- s2 g) a, _ call KERNEL32!_lopen
7 G/ `( q7 ~; U+ O+ C3 y! O inc eax% x" s+ C) o6 Z( n- e' y+ n# s
jz 006505ae ; not detected& \/ m; a t" y
! K c& B2 M1 d2 {8 P% y& m! h* t0 S+ d9 a! p
__________________________________________________________________________7 }/ G- h# @5 w; }6 u7 p+ ?
& S) ]8 j" `, e T. M" M" EMethod 12
) W0 ~4 e( z2 l+ p m, h1 f* n=========
( ]( t" w f; G- y* o! H$ X/ V2 e
: {; B8 X5 a; d( `, [7 dThis trick is similar to int41h/4fh Debugger installation check (code 05
5 \- Z$ T8 O6 R" T/ l5 {" B$ C7 S& 06) but very limited because it's only available for Win95/98 (not NT)6 C0 Q7 d1 W" @3 ]' E
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
& O# ^5 O2 Q0 r9 Y+ U
! g1 u9 m# X$ P; [5 Z" t$ ? push 0000004fh ; function 4fh
. |6 u) q; i- c push 002a002ah ; high word specifies which VxD (VWIN32) m. p$ s; i9 {9 m1 O" U2 U
; low word specifies which service
/ J9 ]# C" d; l( R R8 r) L (VWIN32_Int41Dispatch); j) K1 i* X6 y. d( ]
call Kernel32!ORD_001 ; VxdCall9 C H% K9 u+ R e2 r3 ]. Q. L, x: [# u
cmp ax, 0f386h ; magic number returned by system debuggers: ]3 g/ i* J1 m& i( j
jz SoftICE_detected
( F& [5 f. Z' B9 D4 w4 F0 h2 h9 F$ w. e2 ^5 v" P' c! b- P+ O+ A) B. K- h
Here again, several ways to detect it:6 j" R# H6 I2 `% h/ ~ o
. I; p3 H# Q+ h' y l2 i
BPINT 41 if ax==4f: j9 a9 v. F4 X
\+ \8 [; \/ E9 ]* ?4 y BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one5 X" R& h7 [* x$ e1 E
+ I3 G5 E6 \3 H, y$ z
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A2 g6 e' a* @7 k* e
$ _5 m3 g" l$ s9 h5 d D BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!. {; S* O ]. A+ i
( I" P( S1 I* W* G__________________________________________________________________________( l/ o& E2 s) i% m( p* o
# j- d/ q9 _* d" \' c- @* t" g2 rMethod 13/ o2 E$ ]2 }; U8 M* \4 o# h4 F& l% X
=========
; d5 T( j$ ?9 P7 u7 B
1 L i2 o/ B6 l \, ~Not a real method of detection, but a good way to know if SoftICE is J7 ^+ T1 d8 {
installed on a computer and to locate its installation directory.' N, h7 V5 w8 A
It is used by few softs which access the following registry keys (usually #2) :8 n% P. k/ ]3 X/ b' | w/ s
" `8 U' P) V+ H
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion B3 u! {2 @: {; m) k8 n
\Uninstall\SoftICE
( b5 n* m3 T9 d- K/ Q-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
; q K. O4 d1 L c-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
$ Y' }- Q3 u3 w* H& L5 G\App Paths\Loader32.Exe5 e8 Q5 T3 M) k N9 y
7 v) `; F3 m4 `
% a( x; _/ Q9 z* e9 _. G
Note that some nasty apps could then erase all files from SoftICE directory) n* ^! ]/ k* N+ {
(I faced that once :-(
! t! ^( k! x! q3 X$ w- \
! G3 `7 |4 w7 [$ D0 X% B8 `! {Useful breakpoint to detect it:7 \$ F) Q, t5 j. Z' ?, E! C
& [) V: z+ z b( f9 ~) E1 \+ r& t
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
- W" u" ~- G* Z( _4 y% Y. B9 V- j: k9 T( ?$ l" ?
__________________________________________________________________________
) q- \7 }( B% u: b' y: y9 m2 U+ T7 G4 O
. B! c$ w: s* B d/ `# w4 B0 j+ J
Method 14
0 }' v) h* |% R3 I=========
& G0 ]* _1 V2 W# F# _. W/ q! o; I8 F) E* H: e
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose/ i( K' z3 `2 d4 C! Y, P
is to determines whether a debugger is running on your system (ring0 only).
& r- ~. T1 D8 j- \8 N' R) P& x! l% g. r" [1 Z
VMMCall Test_Debug_Installed
% @ g& c0 q1 }- H8 T5 G- j+ D8 J je not_installed
/ G. e; ]1 e/ R0 k# _0 g" K( a: W/ C" A/ _- n# V9 v, @1 ^: g3 Q& }
This service just checks a flag.: \" x3 N3 @/ q8 z/ b
</PRE></TD></TR></TBODY></TABLE> |