<TABLE width=500>0 C) ^2 _8 x! l* C2 X( I/ w
<TBODY>
. Z3 @1 l) X3 l8 X# W<TR>+ G* q2 h6 o Y4 O
<TD><PRE>Method 01
1 E3 r$ |1 J n: z- V=========
- b6 _) |: s) f! Q2 D% s
* _7 W4 F* G+ f) O' a, ?5 vThis method of detection of SoftICE (as well as the following one) is
4 b# e3 @4 {/ L* D. j2 pused by the majority of packers/encryptors found on Internet.
9 F8 p' ]3 \1 p2 MIt seeks the signature of BoundsChecker in SoftICE( F: z- x& B3 B, A$ V! A' A& z
2 b G5 R4 l( N( n* H mov ebp, 04243484Bh ; 'BCHK'& G" h& O) F- W" s5 a
mov ax, 04h* t& u$ o% W: o Z
int 3
* e' j- t7 ?8 o) C' i3 |: ^/ u cmp al,4 J9 }! ?$ \* `! m: m( K3 E5 j) h
jnz SoftICE_Detected
5 }; v: d* g5 c6 x9 U2 X) r) ]# i# ~3 D! S) S, R9 _
___________________________________________________________________________3 S$ w' c- H3 q: ?' I) M# z
' }( h2 k( v8 W* M8 I4 ]
Method 020 A* U9 |' l* T) J- D- e
=========- U3 ]- Y8 H1 o. g8 c" e& Q/ F# G
7 E& b/ v6 G3 F7 a& }9 Q' ?" m; e. P
Still a method very much used (perhaps the most frequent one). It is used/ i; P' _; q+ f4 E- o
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
8 ~5 M$ Z! n' xor execute SoftICE commands...
8 u, l! O# m, R5 N9 jIt is also used to crash SoftICE and to force it to execute any commands
! U' e, i' P$ \# ~& g(HBOOT...) :-((
k& _/ ?4 W2 t, E; V; }4 }1 u( P V: f
m1 m1 I2 s) ^# m' jHere is a quick description:
( p- M$ `# e5 c6 u' e-AX = 0910h (Display string in SIce windows)
* N( A5 u4 [5 n+ V) _4 G" B8 ^-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
& v2 G m6 Y e; w& N( N-AX = 0912h (Get breakpoint infos)
. X/ F* l8 R6 k, v- c-AX = 0913h (Set Sice breakpoints)( v4 u- j$ R7 G; t7 p
-AX = 0914h (Remove SIce breakoints)
7 z8 j. s" P6 b2 M1 Q4 W& L: O( D$ R2 S
Each time you'll meet this trick, you'll see:4 d/ g$ D+ @/ S# E0 p4 @
-SI = 4647h; F' _* {8 z e1 T2 ~/ F, V3 }
-DI = 4A4Dh
Q' D* B1 H- ^# rWhich are the 'magic values' used by SoftIce.- O/ x4 L8 I6 _8 I X0 n; Z; W
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.9 x7 L1 M+ h! M/ u! o: R
* \8 c. s' \7 B0 P4 v: Y* G
Here is one example from the file "Haspinst.exe" which is the dongle HASP
/ ~- T3 U5 R+ }& A/ z" rEnvelope utility use to protect DOS applications:
8 n3 @# u! ^* B# L9 E4 }. }+ Z4 K6 x0 D: x- w
% e/ Z D- t" ~5 ~- i4 ]( K4C19:0095 MOV AX,0911 ; execute command.% [) R& F$ |6 P1 q
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).! A/ _' v* L- a) r4 [& X- A6 [, r
4C19:009A MOV SI,4647 ; 1st magic value.* H' S1 b8 Q8 p
4C19:009D MOV DI,4A4D ; 2nd magic value.$ t* K. v6 s" b4 [2 b6 L
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
" r% R: q2 H, R: @$ Z4 s* Q- P4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
9 G3 Y! d/ ]7 J. c4C19:00A4 INC CX
( e+ }; c. f9 ^- ^( f: ]& L4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
" C9 }) a5 K, E: n9 K4C19:00A8 JB 0095 ; 6 different commands.; n+ Q; {( H' m: p
4C19:00AA JMP 0002 ; Bad_Guy jmp back.8 O1 f6 u$ S& a5 P( E4 T
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)) i R' x& Q- u. }( s
6 B; J7 v/ x$ x8 GThe program will execute 6 different SIce commands located at ds:dx, which
0 X" N! a) ^7 Y. ~8 Yare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
3 I4 V# ~! k z* {- M6 v
+ N* U i* n2 E' u ^) k* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.' y i6 Y; h& U# l' O9 w" j
___________________________________________________________________________; V* l9 E; Q- C! @% s2 g
# I4 [. Z& U" h2 s
8 u; {* a- B8 z/ S
Method 03( o2 ?( Z( T: d. f& K- q
=========
: F+ h' s$ q' V I
# D% p9 Q0 r6 D5 HLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
9 O( H, f' m; b! A3 Z$ `9 h(API Get entry point)
- q2 F& x$ b4 [ : w2 {" I$ d# i
3 p* y/ Z" E* a0 }8 G3 k* f xor di,di
# t& y% b# }& {: ]( l7 _7 C mov es,di
* |! Z9 l4 `$ h0 f. A mov ax, 1684h 2 H" P X! R8 K
mov bx, 0202h ; VxD ID of winice
3 \/ a5 N/ u. ?& I int 2Fh
6 a6 h+ n% [5 r9 ?- @8 T mov ax, es ; ES:DI -> VxD API entry point
$ T; M9 t7 y$ H& k add ax, di, X( f2 b |6 C9 N `
test ax,ax
8 x; q& M) H& ]; L+ w jnz SoftICE_Detected3 E5 c6 D, U7 A4 F
; X" N0 I$ c( n- |. K" g
___________________________________________________________________________
0 X1 C1 b' M: h
6 ?. R3 B! B) I: J1 D( KMethod 04" m. v- q, b9 i$ \: q* q6 S! X
=========
4 x3 w3 k# l1 K+ J$ P
% J7 H* g: H& P5 y5 j( VMethod identical to the preceding one except that it seeks the ID of SoftICE5 |9 m3 P* \# i* c- T; _! g/ `
GFX VxD.
9 U: o' L* z* b3 z* S2 t1 S9 W. T0 A# B7 O' S3 A& f. G5 a
xor di,di6 d( q+ z/ G) ~5 t3 o" C9 b/ t
mov es,di
5 M- c E( {; {( ` mov ax, 1684h
1 i2 @* B( h# P- G& W2 q mov bx, 7a5Fh ; VxD ID of SIWVID7 A9 M5 O2 E% ]8 Q5 J) u; I
int 2fh
7 @* o3 H* |+ @/ S% O" m6 Z5 d mov ax, es ; ES:DI -> VxD API entry point8 c% M" Q* [% c7 H& y2 X" o. M
add ax, di
3 \0 k# C( L+ V! N test ax,ax
2 U, l8 X8 p# b' U7 h! R$ C jnz SoftICE_Detected
W7 v- ]! O9 ]* N2 Y1 V- w
7 J4 @" t) y" G. l. f__________________________________________________________________________; D' `( ?& U. a2 d# M8 L
6 Z" g/ S& L8 S0 V0 n
6 ~. m+ E( X) w3 g
Method 05
7 h2 j+ Y) r4 @: k \=========* N! B) m3 x4 [7 u7 i
3 H7 A% v7 c9 _+ M
Method seeking the 'magic number' 0F386h returned (in ax) by all system' |% T- G3 D8 k- C/ _! C
debugger. It calls the int 41h, function 4Fh.
3 ?" @# P, q$ {, f* `" t' O7 ZThere are several alternatives.
\3 u% Y4 I% w7 m% Y8 I [- t9 x
% }2 r4 r# q" eThe following one is the simplest:9 m( q6 r5 I8 n3 F0 L1 N
6 C2 r3 m" M1 W# P% z
mov ax,4fh
+ z( Y) s! {5 W- G" f2 t+ N int 41h$ T) U% E; W( b* y
cmp ax, 0F386
, L! p! s) A. o. V jz SoftICE_detected, O2 m& Q( |% L' O
' A m( n+ A- \8 f- R4 ]/ t
3 D4 U! R) S9 B% O: m- K5 `5 CNext method as well as the following one are 2 examples from Stone's
u, f! A) ]! t; [# Z6 h4 S"stn-wid.zip" (www.cracking.net):: ^! ^! g0 t( H9 C: l
; \/ B1 Q" n7 {0 y1 \
mov bx, cs, L0 H. a( a* k" a1 Y& u/ Z
lea dx, int41handler2: v& x& W! I1 {( r
xchg dx, es:[41h*4]# m' Z( k5 g, a9 g2 G" y& m3 F
xchg bx, es:[41h*4+2]
) V5 f! o0 r, h" B& C mov ax,4fh
5 v- d+ t. `, ` int 41h
6 | b8 C3 G- i ` xchg dx, es:[41h*4]
8 B! m5 U9 ]! c4 d xchg bx, es:[41h*4+2]
. A& W; L$ J% ]5 L; p5 q$ H cmp ax, 0f386h: j& P1 l& n% @6 m
jz SoftICE_detected
+ @9 R! C. z! E7 \0 T/ F/ u" E T2 x; z9 R. a! X5 `+ s. K
int41handler2 PROC
9 G' a- b2 m( k/ I5 | iret3 c# p$ p3 u" ]! ^$ ?; }' S
int41handler2 ENDP
/ p5 r5 h S/ k* L0 }; T" |8 i9 X! S: f# [
: @0 G- P: u# d, ] Z5 j. m6 `
_________________________________________________________________________
# y9 o& H2 L Z5 ^
+ C' g: A; d. y5 K8 {1 f: k1 [3 X/ V* I2 J7 s
Method 06
4 Y9 ]" E3 o7 C=========
* j g: _0 ]: n0 Z( l) H. }! U% |& q0 ~8 {# B* T
5 [, w! t. i [3 \
2nd method similar to the preceding one but more difficult to detect:- j4 @0 {! @- M+ D/ e1 c" `& x
- c% S$ ~) q n) O- h
0 S3 C0 X* B/ p7 h* U6 J5 p1 uint41handler PROC
* w; V, ^; Q+ V, h0 g) T+ B U6 U: K mov cl,al
: [$ I0 l/ r( ^( Z iret
* S/ v' G; x0 d+ R& Y( t) v; tint41handler ENDP
+ J2 t1 ?. n& c; D E0 ]' a9 H' Z9 M7 r! N
- ^2 F" M3 h; N* ] xor ax,ax
/ X8 j. n, F2 t mov es,ax6 s; }. s* M! v5 C
mov bx, cs" r V4 `* R# ]8 e$ A3 ?; \' B
lea dx, int41handler
5 U6 Z3 L& a) u4 K3 W6 T xchg dx, es:[41h*4]6 ~9 w- i3 K X4 Z
xchg bx, es:[41h*4+2]: g* |4 s( H. K
in al, 40h
. v( n! v) x( B9 q xor cx,cx
3 a" {, |8 m) `! [6 ] int 41h, z) X8 p# \* q& Y! h5 z
xchg dx, es:[41h*4]
/ P8 F4 a/ o- a) M( b% I4 @0 K7 v- q xchg bx, es:[41h*4+2]* F' o/ }6 m$ m- W
cmp cl,al4 ]& |' x7 n; V; z3 C" @0 _
jnz SoftICE_detected
" B- J+ z& c, u; i
$ }; G/ E% k5 V. |- ~_________________________________________________________________________3 \" e5 h* X+ k, B X
& @" J. K3 N$ M- ?) gMethod 07
5 u1 s4 g( ?6 y) j, U) u" I4 q=========3 e5 Y! D0 I! c. }, M6 A W& T, e
v8 l8 p- V6 X: Z; k/ ?6 H7 e. ^Method of detection of the WinICE handler in the int68h (V86)- Z+ u5 s2 P2 r- D4 {
. e+ O# p/ m; q2 H" m' ~ E mov ah,43h& v! O7 S# C9 a. }
int 68h# n" c3 C _) f, |
cmp ax,0F386h
; O5 D% h; C$ P" ?# i; E jz SoftICE_Detected+ G" F2 B, j" b. r
3 z1 `7 I( d: J1 |$ X
, \. ~7 @2 v* [ A) v2 O0 n=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit3 N2 W5 x( v2 j& W l, Z1 W. U2 z
app like this:$ L8 g o f- q7 P5 [
& q5 y* |: t* R) h0 O; S+ |* S0 x2 p BPX exec_int if ax==683 {4 ~8 K& f) u1 |- B
(function called is located at byte ptr [ebp+1Dh] and client eip is, ~% M+ u( \7 W# r
located at [ebp+48h] for 32Bit apps)% @5 n8 K: S2 }* ^; u% u, M
__________________________________________________________________________
3 i, A5 K: G+ |, H+ X: @" a" s# M, Y9 X2 }4 Q
1 C3 e( Q' m$ k# T1 S
Method 083 j8 D" g4 @7 |0 j7 [/ O
=========7 ^# x! o2 u: H6 o8 O1 [
- |6 B+ O9 [# fIt is not a method of detection of SoftICE but a possibility to crash the
9 K _ s3 c. T1 w% Ksystem by intercepting int 01h and int 03h and redirecting them to another
7 p% \+ m! M6 s7 l {4 croutine.+ s, z/ A" m. e {5 ^. l
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
1 L8 ?" a- S/ rto the new routine to execute (hangs computer...)0 S! R" B+ f1 G6 \4 g+ z5 I
7 ^! a' ]+ \7 X3 v, b! p mov ah, 25h
) s; g9 G3 Q8 ~" h6 [! D mov al, Int_Number (01h or 03h) h$ `2 D) F: {- X8 r3 a9 ~" B( d
mov dx, offset New_Int_Routine6 k) a& F% d) x! C
int 21h
2 F7 \' w f/ w3 {( V* E4 l' l5 v' p
% s% }3 b: N. {+ H; }( r4 l__________________________________________________________________________4 [- x# Q! E4 F
/ I( L& D# Z! s* v/ z+ sMethod 09
2 X3 C: E0 Z& l4 k# a+ f=========' P* _6 H* T4 B0 x: Z* Z w5 ^$ r
' v+ [! Q' I, f3 h7 ?
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
- r8 G8 X+ M$ @& gperformed in ring0 (VxD or a ring3 app using the VxdCall).
& i# n" z/ b6 |The Get_DDB service is used to determine whether or not a VxD is installed
* Q7 b, E& g: q! Y& o8 i# Cfor the specified device and returns a Device Description Block (in ecx) for
3 s4 @0 ?5 I% y$ T7 Z0 d: k' Z7 Ithat device if it is installed., S" [3 d5 A% ?- i7 s ?
# M. ~1 g9 b9 d" K. s$ Q" b, V, d4 I$ E mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
! M& c- ] f( S1 v4 R$ C mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
( L2 j0 {; L* {* g: B VMMCall Get_DDB
% |! o& h2 l& L9 K8 C% s mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
, I. D$ d) Q9 Y4 a x# b) E8 J! a& I+ p6 {, H! C4 `5 x3 Q
Note as well that you can easily detect this method with SoftICE:( |: l9 j$ X5 `( C- H9 S7 ` [# Q
bpx Get_DDB if ax==0202 || ax==7a5fh
1 e$ U$ e/ p4 X" A4 H; w3 r6 j5 T3 [8 |7 P$ G B: t; V4 ]- A
__________________________________________________________________________5 i- x( M, ?; W2 A" U
- b2 \9 H* f) X U2 p. h
Method 10( T3 t" |* `7 m. b, ^5 |: G8 D7 f9 z
=========7 e2 S- I2 K& B% @4 c! j3 C
n+ G7 V- A \; C1 _% v; [! {=>Disable or clear breakpoints before using this feature. DO NOT trace with/ h. D3 V. [4 {0 n# G
SoftICE while the option is enable!!
" G) O4 P3 |! J r4 x0 i' u3 X" T: N- a
This trick is very efficient:% b( c! p3 g6 w4 Y. |- b
by checking the Debug Registers, you can detect if SoftICE is loaded6 R1 j- S7 j, I' _
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if' E8 e+ K' u1 A2 S: B x
there are some memory breakpoints set (dr0 to dr3) simply by reading their; O7 N" ?, P: K) X& |" W2 q4 c; C: ?
value (in ring0 only). Values can be manipulated and or changed as well
" j+ Z9 V& L3 Z z(clearing BPMs for instance)! u7 g; ^. W9 ~2 A
6 [7 k! I: h+ y6 b6 _5 {
__________________________________________________________________________
; U) c) ^9 Q4 _5 k& c+ _
! ~' T) Z6 j6 K/ E* G, r3 PMethod 11
4 v$ g3 E6 g0 n# U- d) [=========
8 j! C7 u1 T" X+ ^9 x% ^; C0 u! C( y
This method is most known as 'MeltICE' because it has been freely distributed' r, j) h* c0 l+ ]# Z
via www.winfiles.com. However it was first used by NuMega people to allow
% [) _8 r: Y$ `8 A- m- @Symbol Loader to check if SoftICE was active or not (the code is located$ c2 }; O: M& Q5 h5 |! }% z
inside nmtrans.dll).0 C" c, t' Q+ L& R+ Y
/ Q$ }: k4 u% ]1 n1 g, |
The way it works is very simple:4 s2 L: L5 I5 I3 z, H' B; o
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
7 j, D" l# W# w# O! z7 R: S: MWinNT) with the CreateFileA API.: U5 o" Q7 s7 ~; Q w' o+ p* s' X
2 n4 V0 V$ B# N1 T' I+ D& W6 E: F3 FHere is a sample (checking for 'SICE'):
d l& e( e( J6 H! T& S) J Y0 K% L* t. Q. j- X
BOOL IsSoftIce95Loaded()
6 l) R6 w' \( y) b) \{! Q! s7 n$ e2 y8 |- |
HANDLE hFile; 3 o: e& Q+ r5 h9 B4 |1 G. K! S3 E
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE, b% Q. F! l: Y9 W" C5 D5 b, x, K
FILE_SHARE_READ | FILE_SHARE_WRITE,
3 ~, D Y' G% m$ v; T NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);1 l6 X0 P& I) G
if( hFile != INVALID_HANDLE_VALUE )
9 X/ G2 b; R' t& d- d K {0 q0 c2 i0 S, V
CloseHandle(hFile);8 A8 s) ^5 D0 X' s" I( g
return TRUE;* P1 ?; A% Z# F+ J
}; ^+ U0 J9 ^3 y* p8 N1 }; t
return FALSE;
/ @0 B9 @( P% O+ j. [}" _6 O5 e6 f% T& ?6 G4 V3 l
# B% `* S, L- M: }5 j+ H. vAlthough this trick calls the CreateFileA function, don't even expect to be
. x* l; J! q$ r Oable to intercept it by installing a IFS hook: it will not work, no way!
: V) o: r8 w# _) o6 @' \. z gIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
" H* o- |5 o: ], K2 _3 _& u+ S7 lservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)& v+ ]0 ]2 w3 w3 n* U; k
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
6 ?% U; T1 k/ Pfield.$ f* \* P9 @6 m- R' j
In fact, its purpose is not to load/unload VxDs but only to send a
2 i& @' f; ?7 Z' }1 I0 qW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
. h* |% u0 b5 b: \' ato the VxD Control_Dispatch proc (how the hell a shareware soft could try
% E& e) E6 {3 v5 `to load/unload a non-dynamically loadable driver such as SoftICE ;-). d8 j* l" z4 I; {- f( w5 o
If the VxD is loaded, it will always clear eax and the Carry flag to allow
9 f; t) G+ O6 i+ C1 }" W Xits handle to be opened and then, will be detected.+ b7 M3 l" m! j' ]: q
You can check that simply by hooking Winice.exe control proc entry point) b, u, \: P0 V/ A6 u* M
while running MeltICE.6 `; l+ N/ z; u. S- h. l
7 x) V& ?, m) E
5 Y9 B6 d6 G7 W( W" x 00401067: push 00402025 ; \\.\SICE
7 y) T- G- l1 y. a7 Q9 Z' l+ M 0040106C: call CreateFileA9 s8 E! Z& h! G* d
00401071: cmp eax,-001! |) |$ R( k- G1 w g, H. n7 e3 U
00401074: je 00401091! ~! m- l3 H4 @
W) q2 O) `) M P
/ Q+ |# ^9 ~/ y) P7 s+ AThere could be hundreds of BPX you could use to detect this trick.
/ Z" I; P+ J; K2 {4 |- }! @5 V# F-The most classical one is:
/ g' ]! V ? h- u BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||8 j. x/ D0 u" T2 u
*(esp->4+4)=='NTIC'5 B0 h! H" |9 d6 J
/ o6 S8 O, r8 M0 \" G-The most exotic ones (could be very slooooow :-(
- |4 @( j0 N) p, Q/ Y BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
! F8 o w& m7 i! C' F, S: E ;will break 3 times :-(
6 G& {( S( ?0 D
- S. n+ s! f/ A% M9 }-or (a bit) faster: 8 x& q( \3 |# ^% t2 i2 X! w
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')' |- b2 c0 p }9 _. Z
( L: q D P5 x( ^7 x J2 o BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
6 n; ?$ K/ G9 }5 l: k+ R# _- c/ w/ | ;will break 3 times :-(
) c! P6 M. Y* L2 B6 w; u
+ I5 i& R) E& `-Much faster:
: |. B$ q4 |6 C6 \" n5 h# T BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
6 y& R7 P- k) m& r! y$ G$ C4 H# W1 g/ ^3 Q
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen9 C5 d4 n. d3 c/ l
function to do the same job:
u" @6 k; D: c! \- F& o
4 {9 E6 U( `9 O5 i' V' `0 {- V- e6 ] push 00 ; OF_READ0 S. X/ j5 s `& a- m* [& Y" l: X
mov eax,[00656634] ; '\\.\SICE',0
, ?1 Q( G6 `# ?' v' i- [ push eax
7 |5 {7 h( L* E& d+ [* l: F call KERNEL32!_lopen
0 u3 f" |6 D" k. f" m$ [4 K inc eax# d7 p1 S+ T9 Z# O8 s. _
jnz 00650589 ; detected
8 A- Y. ]2 s: b8 S5 j; X push 00 ; OF_READ
6 J$ U/ i* T8 x Y mov eax,[00656638] ; '\\.\SICE'# v H* g( c, @4 R
push eax
9 J. [+ K( L5 Y' n; i4 U; G3 W call KERNEL32!_lopen1 I; B" L3 S7 T8 U- l
inc eax
, k. E- U! o' O* U* }! { jz 006505ae ; not detected
# b. x1 E4 j: u* k
9 q- w; \. ^# H( U4 Q/ b& W
6 ^! ^ E$ Y$ C9 m__________________________________________________________________________, K# Z5 Q- r _ n* z/ t" _: g
! ?$ O% a( F7 J$ m( a# aMethod 12( \) }2 b4 t A! `5 r: X
=========- o- T8 ]/ ]9 d2 G2 `8 ]' T
4 ]5 g* o5 c; j' g( @( y0 uThis trick is similar to int41h/4fh Debugger installation check (code 05
) k8 o: U' {' r" H3 d5 w. X& 06) but very limited because it's only available for Win95/98 (not NT)
9 E# U$ z) X8 E. v& R9 was it uses the VxDCall backdoor. This detection was found in Bleem Demo.
9 c( D* V: S2 {" U; M& x! w# M0 p) @* B% p9 `9 ~. ?& y9 y
push 0000004fh ; function 4fh
! n( @& F; ]2 V5 Y" k/ K9 K push 002a002ah ; high word specifies which VxD (VWIN32); E" k7 B) [' `
; low word specifies which service5 l, ?2 {- s/ U! ^( R2 ~
(VWIN32_Int41Dispatch)
! e5 A8 ^$ E- q$ V# c call Kernel32!ORD_001 ; VxdCall
" T7 Q5 W5 ?# G9 b7 D3 F, c6 F cmp ax, 0f386h ; magic number returned by system debuggers
3 b: M& n' s% @. R jz SoftICE_detected
7 {$ |# o; v" l# y* g% r6 N/ C& n
Here again, several ways to detect it:/ W( ~& O! _3 u5 ?
6 Z# b; C0 S# l BPINT 41 if ax==4f
, D: w0 J& F/ T R, U* x3 |) P/ x1 T; B, Y' z/ z
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one1 V* B) }2 |" |, l5 X( b1 T! G
- @ W8 e) O0 X6 Z8 D& K
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
, w$ k1 [1 T: s/ y
+ X( j N0 p5 K2 P$ U BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
A, f! i) y8 U/ o ?
, l" e G" ?3 e5 a2 v4 P__________________________________________________________________________! V1 l; `- [& J! N
; z$ g% f* C' E- ?0 Y6 U X9 oMethod 13$ {5 U9 N& V4 s) ]
=========
; ]8 `. |( x* x1 [8 a2 j3 a; y
( [; A0 A/ W: V( s$ NNot a real method of detection, but a good way to know if SoftICE is2 U) q) U9 m5 v4 l* J2 `9 r
installed on a computer and to locate its installation directory.8 z+ b/ C, M7 o. c! e
It is used by few softs which access the following registry keys (usually #2) :2 o8 v) X. L9 M! s- q
' ?; Q" i: J v3 {4 q' V' }
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion7 i9 k6 S# ~4 E( A7 l$ ~, k
\Uninstall\SoftICE
4 l& O1 a/ O6 @: J! n-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
* H- J+ D s4 Y W e6 @2 y2 {-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
& @- \/ |2 o6 N) m: J, t, v\App Paths\Loader32.Exe
: y( R6 V0 }9 V- ~7 h
a, F7 @* H& Q: a9 ]( D# I$ R! V) r9 s }( J5 G
Note that some nasty apps could then erase all files from SoftICE directory
$ M0 P# h: j, p(I faced that once :-(
6 B7 J3 F8 y+ ]6 b/ c2 h- P9 ]* w7 x/ s5 ]4 I$ h4 [+ Z
Useful breakpoint to detect it:
+ H+ z& ]+ G# x, \3 v% E
( A: a6 E, E; o j! z+ R BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
3 N/ r% s. _, M1 l4 a6 A u
& ^) F/ P) w* G9 u# h; u8 m4 }" ?! ]__________________________________________________________________________9 R- F+ g/ M6 Z4 T
9 `5 o6 W8 v9 c9 B3 m/ i
, |0 Y- J4 C$ e, |; S& E
Method 14
# N1 Y6 q# J4 v2 x4 v=========1 O1 S! g$ Z" x- u7 g& p! W
5 `/ f1 i1 B. _& l1 x5 C4 h5 w$ wA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
5 y9 Y6 _% K1 xis to determines whether a debugger is running on your system (ring0 only).
1 E7 Y7 ?' m% w. D6 p+ h2 e. k' `4 ~
VMMCall Test_Debug_Installed# m$ |: H# P1 T
je not_installed2 S. |3 M G; K) z( |. {' i$ I. }
: [3 x2 w. M0 } {* \1 w+ M
This service just checks a flag.
4 D( P. N+ Q r0 d3 S. u1 z</PRE></TD></TR></TBODY></TABLE> |