<TABLE width=500>
_" t2 `7 _0 z7 w, x0 H9 G<TBODY>
& Q/ G m; H' L* ^( \<TR>9 @* k4 ^$ p5 |0 u! J! Y, v
<TD><PRE>Method 01 * u* i, e# e7 O; i
=========
/ m# G1 [% B" N# n0 P' s, r0 P( X+ s9 S/ c2 n
This method of detection of SoftICE (as well as the following one) is
7 _! U4 A7 @8 u7 hused by the majority of packers/encryptors found on Internet.
: ?- w, L- `- F' R. X3 OIt seeks the signature of BoundsChecker in SoftICE
/ n( m) h$ j4 ~" }; x7 K& O! l! r, f R# r, _( c8 ?
mov ebp, 04243484Bh ; 'BCHK': ~8 T# l1 f5 B4 b/ G) J
mov ax, 04h
. f( ?* f4 s) [5 L int 3 # }( s; O6 B* S% u) o t+ g6 S
cmp al,4
. u5 W( Z9 b) ^& V jnz SoftICE_Detected/ ?3 ?) ^- n E3 }
1 d# M$ k& D* f U& r___________________________________________________________________________
& d2 K; M# o" M- j
) e! p' Z: e1 \; a8 P3 c; m. L: t/ LMethod 02
' `: t# ]# a2 C6 P- [7 G& ]=========
& o1 [1 z$ m2 p8 r0 ]+ }
# L. x! o+ b+ p2 J' kStill a method very much used (perhaps the most frequent one). It is used
. `6 z2 I5 D4 M4 [& Oto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
$ D9 K$ i0 Q0 y) G- V" Uor execute SoftICE commands...
3 S4 Y! b* X: M1 S4 q+ vIt is also used to crash SoftICE and to force it to execute any commands, S" ~0 C$ X* Q. }4 e3 O
(HBOOT...) :-((
* W6 Z- [( j4 A. s$ x4 }0 w& T, e: |. t+ h
Here is a quick description: B9 d. b& J" b7 J; z- i8 d
-AX = 0910h (Display string in SIce windows)# Y4 y' [+ W4 m+ Y+ q0 x9 @
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
1 m' I4 \0 e2 Y) w-AX = 0912h (Get breakpoint infos)
5 l! u+ L3 N$ U' m4 \, ~$ f-AX = 0913h (Set Sice breakpoints)
( k ~; Q( x6 C-AX = 0914h (Remove SIce breakoints)
8 S. \1 q3 a# Q" o+ V
% b& D, [7 M6 r3 t3 EEach time you'll meet this trick, you'll see:
. r4 l) @- ^% w/ A8 D-SI = 4647h
/ Y) Y+ @3 N+ i. n) I-DI = 4A4Dh( d/ k; ^% Y! Z" `
Which are the 'magic values' used by SoftIce.
4 K' ?9 X1 Y9 C% R4 |& {For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
' K4 z0 C8 ]2 e' K+ A
, U! \ a- k5 C1 O& h6 Z) S" d! \Here is one example from the file "Haspinst.exe" which is the dongle HASP3 I0 G: t8 O- S- H* u" T
Envelope utility use to protect DOS applications:
) h/ }- f; Q& [) w/ @ K5 t- C _
) l; ~, c+ v& B+ \4C19:0095 MOV AX,0911 ; execute command.
2 x4 f1 Q. B h3 ?4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
# P% \& Y, N* e! R4C19:009A MOV SI,4647 ; 1st magic value.& C+ N& F# u" ?" I* ^& V
4C19:009D MOV DI,4A4D ; 2nd magic value.# [- G$ a% w8 c" p h/ R2 \
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
$ p! ~1 v: p4 J, ?4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute8 t$ Z) g! W( K$ n
4C19:00A4 INC CX1 M. w$ ?: o8 }9 S4 E, B
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
N% q# u4 c1 M( _4 |$ J5 p4C19:00A8 JB 0095 ; 6 different commands.6 I) ?9 G2 n- b+ c
4C19:00AA JMP 0002 ; Bad_Guy jmp back.
2 G, }3 o4 C* Z/ K1 E9 y8 C) y4C19:00AD MOV BX,SP ; Good_Guy go ahead :)- E& A4 y5 F$ O1 ~+ X
! C6 q& u4 j- }5 F# y+ ]5 O
The program will execute 6 different SIce commands located at ds:dx, which h* f; [7 q* l( y# V0 I: X
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
+ v; m( g. G2 O2 @
% I/ R8 P" b& F# U* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
" }3 |/ {% _9 ]2 c___________________________________________________________________________& P V h% x& V# h) u, u; \+ G
% R. ~9 D4 O1 L; L% x
3 T- y3 ]' m; ^4 S+ p/ G$ M
Method 036 c' [. a1 F" E' H
=========, ]+ b# x3 m* G1 z4 G' z4 e
, v4 K3 m1 W3 T9 GLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
' i7 r$ @/ h X(API Get entry point)' u, A( T' Y2 E. `* E1 v, y
3 |0 o P4 u2 t
/ t8 T5 q; C& C+ H5 R d+ v: z
xor di,di
" h+ |1 N: \4 w% [( \6 j6 j mov es,di: L% x2 D' O! U+ R
mov ax, 1684h 2 k X) w5 ]0 R0 v' O
mov bx, 0202h ; VxD ID of winice
' o& C& w9 l$ U7 ^* h" k: n int 2Fh1 B* K7 c) D2 I4 |1 v
mov ax, es ; ES:DI -> VxD API entry point
/ i6 b6 i) g( X" Q0 R add ax, di
0 p. E8 ?# z' E3 A8 I! r test ax,ax
- T9 a/ a2 I. P0 z4 |- Y jnz SoftICE_Detected$ S2 e4 n# i# q6 G1 M+ g
0 e* Q2 E- R, I; E8 t! x___________________________________________________________________________
% [0 u5 v) m- H1 W8 {. k9 }/ T& v1 Y4 P$ K2 |
Method 04
+ b- h" Y. m. X=========
: w! b! W8 |" U1 Y3 r( a' _+ z! t: s( O
Method identical to the preceding one except that it seeks the ID of SoftICE" Z6 D6 v+ s( s
GFX VxD.
$ u+ i; ?2 d' Z) T6 m* D7 O/ Y: E s' l
xor di,di
0 C. O4 [$ q* A mov es,di9 `3 Y/ L. I2 T1 r1 T2 O
mov ax, 1684h
, i2 {. N4 ?& c( c5 R; L mov bx, 7a5Fh ; VxD ID of SIWVID
, ~# s4 e0 r' G int 2fh5 ]" |9 F6 r+ t3 B
mov ax, es ; ES:DI -> VxD API entry point
. q( p% W- b. Z+ W: w$ V j3 n6 U add ax, di4 |+ X% c% K! }
test ax,ax6 ?, d2 L5 M6 ~) K( j& F+ a
jnz SoftICE_Detected' u6 F3 ?5 y5 o. \6 L9 R# `# U5 U: A/ R
! H) t/ H x1 J# R& F& N/ C) ~( M__________________________________________________________________________. m3 f4 R2 z; i
8 [- y4 [' X" I, k: d% P
* {8 |. U3 n. ~Method 05' d) A5 Y( }* K- h
=========& A5 s. a0 \( c" s
% x/ r% ~& ?6 M3 NMethod seeking the 'magic number' 0F386h returned (in ax) by all system/ ?, O6 q# U |& U( l6 M/ S
debugger. It calls the int 41h, function 4Fh.. }& T9 S9 M3 X6 {- z: e' P
There are several alternatives. 0 h+ o, ?; h7 X7 G1 t+ V" s: o, L1 b
) s: x/ U+ ]& H0 Q3 IThe following one is the simplest:6 j7 ^/ I5 u, I7 N7 N5 {( c+ ]
/ m5 l6 X; B$ U+ k% G5 {9 {" L
mov ax,4fh$ b7 j* M! x0 F c& |: j/ a0 w
int 41h
& i# L2 y3 t: M; m% N cmp ax, 0F386
* k* {- N' T7 ?% e jz SoftICE_detected
- y* F+ \0 M/ \( D; {
" ?9 U7 k$ X" i' H9 m: H! g( r! i# ~1 k. D
Next method as well as the following one are 2 examples from Stone's
0 w5 ^( p/ m& S+ D"stn-wid.zip" (www.cracking.net):
) q3 E) y4 H1 ~$ V* Y" z3 [; N; {8 ]! B. y+ G4 ~: S
mov bx, cs8 \' E- u( x+ T7 x# `
lea dx, int41handler2
6 |, d# B' O3 m. M% N+ h/ k xchg dx, es:[41h*4]3 W% e3 [) c8 q, t ?$ e) a0 D
xchg bx, es:[41h*4+2]7 J8 b" I" [8 \4 z2 K& T
mov ax,4fh
* D% c7 u$ G" P+ G int 41h
$ ?* ?4 ^. K, @8 f9 |2 F, c/ z! ` xchg dx, es:[41h*4]3 L" v. P. F# @, @* @
xchg bx, es:[41h*4+2]
- J8 }+ O! b& U2 T J# g cmp ax, 0f386h
4 c6 L# ~' b1 e* a6 i5 g$ J2 ~ jz SoftICE_detected" z0 b, g9 l6 l: L5 g `+ `
+ S6 G) v8 }$ hint41handler2 PROC
& ^2 A0 s0 t% O0 S iret
& \( {; N9 F: w5 {' Mint41handler2 ENDP0 g" S* h1 X6 i" \
( A* r, T0 E' G) O: P$ o
5 L' I& K% q0 w/ L
_________________________________________________________________________9 i; W( t- A' c( Q
$ o" _& V. o% n' H6 A
, r) @' E/ J X" X; R S/ qMethod 06
( Z$ D/ Y. J2 r0 h3 h=========
6 v2 N, s! t0 t X+ ~" i( x; t! @& ~) E1 I1 N* P# \
1 f( w9 D& q% K" X/ ]7 _
2nd method similar to the preceding one but more difficult to detect:
( M: D! S( d2 ?7 s5 d% l# R) j& e1 W5 W$ l& i9 u
8 Q" u% B3 _5 w0 m0 k5 yint41handler PROC
! U( T' s6 r& }3 |8 j, e mov cl,al
5 E+ F3 z# `4 f) p6 ] iret" Q- u' a; W6 I4 @
int41handler ENDP. e; e; h$ [, C( a, ^
% V: ~ z5 `9 D D& l6 Q, R+ E' i) ?2 S/ Y7 A
xor ax,ax1 n# f4 x' H; @' T- E+ Y# j
mov es,ax
`" y4 ^) z8 c9 J" a3 G$ C mov bx, cs: g! ~: g# H6 r5 g" _1 u
lea dx, int41handler
9 E- D8 h% I+ O. z xchg dx, es:[41h*4]% b4 ^$ M( o6 O- s' |( h
xchg bx, es:[41h*4+2]$ ?5 n2 g9 q6 f, D7 q3 C) [+ z( i; l K
in al, 40h
/ F* r5 o; A# ?7 ^: l# W9 | xor cx,cx
8 ], A3 t5 L! b int 41h
* h: D1 [' M5 B! `3 U0 M; L xchg dx, es:[41h*4]! [+ N+ x: T1 S" A
xchg bx, es:[41h*4+2]! w" x& r' _ Y. L
cmp cl,al0 U' j/ f3 D1 q
jnz SoftICE_detected% J2 c% Q. [) N) s _5 [; q
; k$ f& i; f/ S8 _& ^* s5 J- x
_________________________________________________________________________
- I7 C. i4 t) c0 _, {# b9 [8 o1 |% R# q
Method 072 F5 \0 o0 H: ~/ H3 ?# N
=========
, N$ s- P4 l) T H2 w5 o. Q
: X! Y! c& z/ I3 e( }) y! ^Method of detection of the WinICE handler in the int68h (V86)
7 h4 V, a1 C( H7 a v1 V" [. \& ?' H) u4 M
mov ah,43h$ N' f( Y/ V' e( W9 p
int 68h
# a, w4 [; q S/ {5 W cmp ax,0F386h" o( F' o+ \$ ]& H. [
jz SoftICE_Detected' C5 A( T2 Q5 n
5 B/ o+ r+ D1 O% u# E
b3 i6 X, |% E7 g# v" V- `3 a6 S' T8 {" k
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
: L R3 R Y2 `1 \0 Z8 y! m app like this:: X- N: n+ @; r2 c
b. _% Y1 X0 m$ k% G" c
BPX exec_int if ax==680 f; d* r' K& |8 B3 R; f# W2 j# i* Z
(function called is located at byte ptr [ebp+1Dh] and client eip is
Y& A* _% {( E+ Q d located at [ebp+48h] for 32Bit apps)
# _" S( Z& x8 f5 K* w__________________________________________________________________________
- o2 k9 m$ s- x, k. Z7 W1 P- B) Y
. A2 K$ l1 Q9 O8 d3 g' O2 BMethod 08& p0 X; y! {8 K: |
=========4 v# v7 ?1 A1 @3 Z
1 C! E6 A5 E( Y1 b/ z7 sIt is not a method of detection of SoftICE but a possibility to crash the
, L3 E$ w5 S/ q" T& Msystem by intercepting int 01h and int 03h and redirecting them to another
7 ?7 v, m9 T+ R! E. Lroutine.
/ l8 k* S- }* L3 B" d& |5 ]It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
) Q7 C7 R/ M A% x# Z- Dto the new routine to execute (hangs computer...)" l6 J! j% k4 ]" V( M
) e3 N& W: u' k
mov ah, 25h* X3 ? I# k0 @+ V. e
mov al, Int_Number (01h or 03h)2 z/ J; v* r4 Y C
mov dx, offset New_Int_Routine& Z5 @: Y" R- k. k- O, Y
int 21h( ^( `* F9 G5 L6 j, c) X" F
( [% T" I4 b( i; ?__________________________________________________________________________& i0 E6 R5 ?' _
7 {$ g- h% A- @, W S/ {% n1 L
Method 09
+ ^/ C8 ~3 a, l, ]% g=========
( i' s' H, c8 \6 O
% ~* s, a' a9 }. i" @( S% _This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only r" e& `; N; D7 f
performed in ring0 (VxD or a ring3 app using the VxdCall).* |- S# U7 {; Z/ y) J
The Get_DDB service is used to determine whether or not a VxD is installed
0 P u+ f$ R# \" Y& Hfor the specified device and returns a Device Description Block (in ecx) for5 i9 N6 T0 r4 o1 I$ M
that device if it is installed.3 y& h; g6 k5 ?& a1 x
6 l$ W* G! W7 p8 k' h4 |4 ~6 @1 ~
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
' ? m( c: Z& i7 ^- X mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)( ] x# H7 n5 Y8 ]
VMMCall Get_DDB+ a; _% X& [3 q" N
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed9 S, B5 C) P7 J; z% ~. @% ]
' k! }8 Y& g3 G9 A* U
Note as well that you can easily detect this method with SoftICE:1 Y" C8 E! `0 |% t- a
bpx Get_DDB if ax==0202 || ax==7a5fh
+ G/ P8 s0 h: E# N/ R1 ~0 x2 h% `, s+ {& X% V( n
__________________________________________________________________________
- U6 j9 m ~3 o
( a; X/ ]! ?7 {' b! d! b( pMethod 10. l; k8 C( H3 h4 d6 m
=========
9 C T3 u, X9 p% Z
s0 I) \0 g) i3 O) @; H5 k$ W=>Disable or clear breakpoints before using this feature. DO NOT trace with
" H1 f! x: Z0 M. y n( L1 K) ~6 l SoftICE while the option is enable!!
5 a) I) L+ G |9 Q2 J# _9 r
( B0 C- V* r8 v3 wThis trick is very efficient:
# C) `/ H/ m* E, q, G1 `# wby checking the Debug Registers, you can detect if SoftICE is loaded
" z, ~% r2 e6 d(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if- A3 W9 Q0 H3 z! P* d
there are some memory breakpoints set (dr0 to dr3) simply by reading their
3 T5 d5 [" n; o8 E8 u8 zvalue (in ring0 only). Values can be manipulated and or changed as well3 {, Y5 n. _2 M0 C; V2 N. F, g
(clearing BPMs for instance)
& P6 d* R# I% `% b$ t7 P
5 h+ R- ]8 g2 @; y, r; Z; _ W__________________________________________________________________________/ Z X- C. e* v9 C
8 |( |# d' k" z) c: H/ ]2 e" K1 Y, V
Method 11
; T" @7 F2 |+ I' ~2 Z0 o% q1 v=========' B8 C% Q2 w; u
4 ]' h, e. M5 `6 tThis method is most known as 'MeltICE' because it has been freely distributed
! O1 _% [( T% C0 \ _via www.winfiles.com. However it was first used by NuMega people to allow, R' t0 L) |" M# K2 v& h
Symbol Loader to check if SoftICE was active or not (the code is located$ L- U% E' ^7 i
inside nmtrans.dll).
. O, P& r* Z8 t( t c5 V: u6 f2 \/ R: T
The way it works is very simple:
7 V. A0 O; \* yIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for4 R% F- ^& H8 H8 R1 ^) a
WinNT) with the CreateFileA API.* Q: V' R; M7 S) P+ Z% s6 r
. e! w/ b. D, h1 u3 J& b4 [
Here is a sample (checking for 'SICE'):
8 T- l6 A+ ~9 |- M, Y/ F1 H, @ @* m: f3 z z
BOOL IsSoftIce95Loaded()% {) {( e, [! e, p" O7 f; {
{
1 \* h6 e7 V# k* d HANDLE hFile;
* p$ I5 J! i' m- }0 x* o hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
% T0 a. P7 t a0 y( G FILE_SHARE_READ | FILE_SHARE_WRITE,& T3 s! D. O3 b5 m, J5 D3 Q z1 Y6 a
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);) {& \7 S r# g! k
if( hFile != INVALID_HANDLE_VALUE )
% k3 `9 F R1 K, r5 _ {
! A3 U4 y; m& `% d CloseHandle(hFile);& r% Q3 W' I6 P: @: w( C' z! z- W
return TRUE;
; h* s: T% s8 @9 X }3 z$ G( y: I0 y8 E. d" A. [
return FALSE;$ S7 o* o9 T' ]
}! j, C/ s+ R. z/ `' H$ s
% X+ }. R! w- j3 wAlthough this trick calls the CreateFileA function, don't even expect to be) R" W$ P ?; x
able to intercept it by installing a IFS hook: it will not work, no way!8 \. _: z8 b5 u% \) u$ s7 s
In fact, after the call to CreateFileA it will get through VWIN32 0x001F3 O5 }% V1 v, s* M2 A" L
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)% L6 o# f7 b, n% F C* L) n) K
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
4 U/ k! o/ m! x* ?& D2 ~field.. U% r/ o2 J+ T$ j( p
In fact, its purpose is not to load/unload VxDs but only to send a
8 I2 b/ H# U" T* X7 p" [9 G. ?1 B5 tW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE). g% I2 p+ E! L7 v7 ]
to the VxD Control_Dispatch proc (how the hell a shareware soft could try6 q+ v8 ]0 R" |; M4 y; p
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
! j: I% t5 y; V2 _8 }9 R% G2 tIf the VxD is loaded, it will always clear eax and the Carry flag to allow5 A4 g$ k, M4 t, B# d0 A6 ^
its handle to be opened and then, will be detected.
' g2 C. m0 R% q! q5 hYou can check that simply by hooking Winice.exe control proc entry point+ |' I f0 [4 \3 q, _
while running MeltICE.: I- l( d" r% D8 S6 w
& M; k+ v$ M& R" E5 V
( [ U& [1 z0 Z/ `1 W 00401067: push 00402025 ; \\.\SICE$ T+ M5 I( x S- ~; l2 {
0040106C: call CreateFileA. g" d$ ?" {5 ]" s. [$ v( W ~5 O9 t, n0 c
00401071: cmp eax,-001* A/ O; {' e' ?& z2 f4 v6 P5 u
00401074: je 00401091 }- N7 I- G' I8 J
3 k5 \7 n3 |4 u7 x; R. R' a
, b* @% f$ S- C9 @6 K7 O
There could be hundreds of BPX you could use to detect this trick.
2 \. E% u( f7 M$ ?-The most classical one is:! L% y6 C2 [$ F
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||: n* `+ g# I- D) p. E
*(esp->4+4)=='NTIC'/ U0 {5 v# @7 o+ b. w
+ `, C! [" R0 F, U* @ b
-The most exotic ones (could be very slooooow :-(! |; R2 q2 p, {- h
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') # N; F( \* o5 D+ Z9 V
;will break 3 times :-(% ]% q; F& P, y0 L
, B( a, ?9 U. E
-or (a bit) faster:
' z3 u- \5 h" V5 u1 x" f; o6 ~ BPINT 30 if (*edi=='SICE' || *edi=='SIWV')5 S; u2 T$ f8 W U' |9 I2 }
! H& m+ p* |0 a6 \ D9 R1 X6 q BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' 0 B0 ^* Q' E2 k1 P
;will break 3 times :-(
2 f3 p' t# k) r6 Y3 D/ h; A& ]+ R0 d6 }4 b- D6 m& a- `
-Much faster:% q! S9 d! H6 E+ v7 F* J: O/ x9 I5 ~" _
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
) ]4 Q4 G* Z. u7 |" y/ V; a
, v; V7 D/ z# I9 }' rNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
( Y( B" k" A1 Z7 \7 |* r& u y( pfunction to do the same job:& a7 d. ~6 t: }: Y! h0 n8 v, H) Q; A
" d5 V0 P+ C) M, N push 00 ; OF_READ
0 c2 p/ y0 |+ p mov eax,[00656634] ; '\\.\SICE',0) f. W. P. r, ~1 i) M" {
push eax
$ a2 K1 c. Z/ R4 l5 x& V call KERNEL32!_lopen
, d1 D# j1 y1 P H* C inc eax
2 f' G2 e4 L6 c7 r- z& u* N `- H jnz 00650589 ; detected
8 M/ |0 r3 b1 k6 |, B7 [/ b! w# J push 00 ; OF_READ
+ m8 ?6 Q% O( y6 J8 [ mov eax,[00656638] ; '\\.\SICE'
{1 K' A! A5 P0 \; Z8 c# f push eax4 \1 S6 j' ^ O7 o. G L
call KERNEL32!_lopen
4 R4 {: v$ T7 I/ J inc eax/ o, X$ q, j9 O" i" M
jz 006505ae ; not detected, |" t0 D4 J4 W0 M# T5 i5 F
' B2 ^ I- I5 Y }( C
: R* {* Y0 r8 P& `. f__________________________________________________________________________; U! H; I$ \5 L! e$ x h: h
9 u3 ]% k$ ]' P2 B
Method 12
% H" R/ `& x7 f( c4 |=========( _5 J' X" J9 t8 w! B
z, `0 B) w. U6 H. ~# ~This trick is similar to int41h/4fh Debugger installation check (code 05' D8 |. i1 a* c* ]8 H6 b& O
& 06) but very limited because it's only available for Win95/98 (not NT)
) b$ ?9 V9 Q9 A( {! Aas it uses the VxDCall backdoor. This detection was found in Bleem Demo.
, ]; v6 j0 }' k9 a+ E1 t5 T
" N4 d% g6 ]! M push 0000004fh ; function 4fh
( E# ~* v' l& |, c6 {: Y. Q push 002a002ah ; high word specifies which VxD (VWIN32)
. _ a# z- m( u0 l ; low word specifies which service
$ x( ^# i5 ~/ [# k) c (VWIN32_Int41Dispatch)
0 J- B( @. `: e3 O9 c3 @ call Kernel32!ORD_001 ; VxdCall
2 |8 m8 ~+ W; g7 B9 Q1 Q cmp ax, 0f386h ; magic number returned by system debuggers/ ~% x8 H- j% m) M0 K& [
jz SoftICE_detected
. B8 G" D- Z: A% F9 o. }- b0 G. u |$ x x
Here again, several ways to detect it:
; r! r! f2 q0 N
H2 M6 A4 W" B* h. F& S( V$ i BPINT 41 if ax==4f; j9 {/ x8 j! o/ ~* ^" w0 m
+ p# P$ S( H6 b5 ?6 G. @4 E
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
, [- M/ Q& H% U3 ]& v9 C0 {, e' E$ }+ p( ]& z0 P3 E; G
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
4 _2 Q/ V( K7 {" h7 Y5 Q: f2 ]# h8 I& ~ s- e, f
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!7 M g* n8 Q9 C/ q
3 C" e3 V# Q2 ^0 @: c% u__________________________________________________________________________
) Z* S, r( f) q" ] U) r
9 |, A. `3 c- Z. L/ Q5 m" P7 |: p# O8 PMethod 13# i& N3 L5 ~7 V6 g' T! l
=========
5 Q8 E8 A: D) ]; H
* B* A+ B, `7 t( u6 @) |, WNot a real method of detection, but a good way to know if SoftICE is
9 [$ e: A0 s# r( }) D+ jinstalled on a computer and to locate its installation directory." W6 {- v: }3 Z* b
It is used by few softs which access the following registry keys (usually #2) :
$ I; U* ] f8 h' j [; q3 j
* A* \5 c* q% i6 Z-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
N: | k. y" I8 }7 r: _\Uninstall\SoftICE
- C* |6 v: Y/ G5 Q; V-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE5 t5 O* Y1 k1 g1 R* {. a5 x: S2 E
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion0 e f, V3 k4 B, n3 U6 H6 ?
\App Paths\Loader32.Exe5 T5 }3 c( s8 D" [
/ h. ?& d8 e$ L7 X
& h8 j, \% _* WNote that some nasty apps could then erase all files from SoftICE directory' q1 Y9 Q% g1 P! i
(I faced that once :-(
* {0 k: g' a( a/ @. h8 \+ k, [8 j% s* _
Useful breakpoint to detect it:3 d6 m7 ^+ h9 Q- M$ \( m7 g; @
; z! j! v6 r% z' n- | BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'# f' K4 n/ q! ^' a% R
- F; H) a# E0 Q8 J" e* B; A__________________________________________________________________________! g) x! ^3 i; m+ f
1 V* f* w) ]/ h& O! m0 \; Z
# d1 P$ G5 W/ ]Method 14 1 Y, {4 U# |& y' n
=========
, Q+ B: A9 v7 l4 Y& u9 Z `. b7 W# W. A& T% e
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose7 i2 E8 _0 e% ], C
is to determines whether a debugger is running on your system (ring0 only).4 f; ?1 d9 Z2 k# ^4 P+ Q: H
- K, u$ j9 P4 [# Q: x2 s
VMMCall Test_Debug_Installed; k. s2 D+ a, j* s$ F
je not_installed6 `. v( ^2 Z) v! Z0 `
" L! [0 ]' B& l. M; Z! QThis service just checks a flag.
; W. R% D0 H1 T: l+ i! u</PRE></TD></TR></TBODY></TABLE> |