<TABLE width=500>
0 e! [, Q$ M! r<TBODY>1 K* o1 ^9 Q2 D4 V' W9 }3 ^; p) H C
<TR>7 c" N" U' x7 o' t# |+ I- O
<TD><PRE>Method 01 ; W% X+ u: ^4 ~/ @1 [# q4 o4 G
=========
7 j% `: n) L( q' y+ s+ y) R3 s. g7 ?: b
This method of detection of SoftICE (as well as the following one) is/ N. V$ D: }7 k1 Z. o
used by the majority of packers/encryptors found on Internet.- k1 H3 m9 H! B
It seeks the signature of BoundsChecker in SoftICE7 S; ^: j$ I+ K, K0 T
" O8 w" s5 v( @1 m0 K2 j mov ebp, 04243484Bh ; 'BCHK'7 f5 `/ `" o. b! r
mov ax, 04h
+ P% q! c/ J1 T$ m9 A- [ int 3 / s4 ^0 i, v h3 _7 h
cmp al,41 A6 J+ A* ], G1 X& W
jnz SoftICE_Detected& U6 X1 D" o$ P% [
+ a: k! ^! g# l* H) q0 u___________________________________________________________________________3 f. `7 v4 P# h! E6 \2 W' _
. w) p/ N! s' q6 c) [% F; d
Method 02) J; U" G" m- v& c8 a" D; |2 n* [
=========9 d* I- H* k- \8 d$ f* {8 H4 {
0 e( L2 X k5 l! c t' W
Still a method very much used (perhaps the most frequent one). It is used
, u: W$ `" b wto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
, @2 q* V9 v* w9 j& F9 ^! Nor execute SoftICE commands...
- `: K! t. Q# [* G3 A8 {5 j1 N& F+ OIt is also used to crash SoftICE and to force it to execute any commands
$ T# O! [, x/ n1 m7 l% R6 G(HBOOT...) :-(( " H8 \& f* v# z K
* r- U0 j; g' F) A8 O4 G" J* c
Here is a quick description:
* s1 J- z9 j, [" ~ T5 b-AX = 0910h (Display string in SIce windows)7 {/ T% D4 j+ y$ D- S
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)+ H. m! v4 M- M
-AX = 0912h (Get breakpoint infos)# H! c7 F" {# h. m K
-AX = 0913h (Set Sice breakpoints)
. L6 i. L. h0 C P6 n g-AX = 0914h (Remove SIce breakoints): k5 G5 `% W M4 q+ |8 }, V
7 `2 P+ O' J1 S* u7 I7 S. Y
Each time you'll meet this trick, you'll see:
5 }9 W9 w; S- l-SI = 4647h
# S# m d+ I) E5 N% R-DI = 4A4Dh
# K2 e' G. O4 }! S# F4 x2 xWhich are the 'magic values' used by SoftIce.8 b4 e1 X) d( U5 A- z4 |
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.9 B6 j& O/ J, B) X
( ~" ^9 q' N) G0 n* o* l$ ]Here is one example from the file "Haspinst.exe" which is the dongle HASP' @* @! m5 L$ j+ h, o2 i# W
Envelope utility use to protect DOS applications:* l5 B; @# u6 a
4 q4 C" {" ]$ u9 S9 J4 r/ m
' Z0 z) B6 F8 g
4C19:0095 MOV AX,0911 ; execute command.; P2 \7 a, ~% Q7 g3 h$ J
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).9 l' C) O% \! H" q
4C19:009A MOV SI,4647 ; 1st magic value.
; i" U/ W1 f) ~2 z4C19:009D MOV DI,4A4D ; 2nd magic value.
! }4 R% j% D3 ^1 X- a4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*); j3 o! p5 \2 Y( C! g) [( B" e# A1 F
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
: O8 p6 x2 }4 H" Y( ^4C19:00A4 INC CX
$ v* u. H$ H$ Q/ d5 N4C19:00A5 CMP CX,06 ; Repeat 6 times to execute. I! P. L7 ^/ |2 J0 D; q9 o" O
4C19:00A8 JB 0095 ; 6 different commands.
9 \+ n: \% t+ y) I4C19:00AA JMP 0002 ; Bad_Guy jmp back.
8 @9 V# q/ S) H4C19:00AD MOV BX,SP ; Good_Guy go ahead :), s( @' z3 A) u1 k% `$ D
9 M( q; d; \7 n" Y4 B, K
The program will execute 6 different SIce commands located at ds:dx, which& O1 U" l" i0 \, _8 e1 A0 ~
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
) H) c1 A/ ^5 z/ |( Q! g5 u
: H p, p9 p/ {- E* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
' E- w3 u# G* c- n' D5 J+ D+ B___________________________________________________________________________5 T$ l8 v* e/ s5 Z8 U, T
7 C; i7 E' r, g& L% r. g" b3 n
+ J) h- ^: q' l: D7 ?. SMethod 03" g8 m) R3 k5 q U) f0 L) N' ]
=========
0 ?/ F8 B/ ]1 e3 O# C& q5 y7 N4 l& V
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
; t/ `' b3 f( `. ~(API Get entry point)
. F- ~7 a# k- {" Q4 e3 |: c
0 L3 s8 ~1 s' [( Q; l0 G8 U1 A3 A2 w5 D" d3 z4 n
xor di,di! j/ E! R" y) c9 `
mov es,di6 Z4 f+ ?- z N3 ?5 @4 n4 a; \
mov ax, 1684h
3 y5 u/ M f* d+ V* N7 y# h mov bx, 0202h ; VxD ID of winice, o! ~8 C( e/ I7 o7 L9 D* A) W
int 2Fh
! X v9 t! _# V0 v mov ax, es ; ES:DI -> VxD API entry point3 _: t1 b. p9 |2 T8 j. L
add ax, di
" R1 v' g) e" ` test ax,ax) @4 Q. O/ t0 k4 g
jnz SoftICE_Detected2 i" t' g1 {% Q- Y0 p* ~& k+ E
9 d+ s& ^ p# O* n6 D! o) R. @" U___________________________________________________________________________ L( l+ o9 _2 @
( K2 _) C/ H; |& B# r
Method 045 z) s5 j% J& j7 S' Y' r" {
=========/ h5 B# R& U; R' _
8 F/ @2 Q5 s# l2 H' f9 uMethod identical to the preceding one except that it seeks the ID of SoftICE
: r1 |" K N5 p( Y$ S# G4 y3 o9 kGFX VxD.6 p: V& T* V( g, \; N4 s8 h- c
7 z. G" a+ r+ Y$ u xor di,di
) g/ o9 Z3 m1 h% M- e- v( | mov es,di# n5 |3 w; E' `" f! R
mov ax, 1684h 5 l% R5 u2 x7 M+ u5 Y6 ^
mov bx, 7a5Fh ; VxD ID of SIWVID& J( U" u- O4 e1 _$ o% D
int 2fh
6 M$ k' [* B1 D- B' h mov ax, es ; ES:DI -> VxD API entry point
) b2 P/ W; @+ }3 R# r% ^ add ax, di, F- A5 ]5 M1 T
test ax,ax
6 w) I( h/ D1 A8 [! D jnz SoftICE_Detected
+ c9 O5 I) J% ^. c% s, O7 i
2 M8 z$ k% U' ?$ `. m__________________________________________________________________________4 a* e* O- E$ y6 Y) @) z$ ] K/ ]9 V/ l
0 r7 g; i9 _$ w2 X$ W& R- V( o$ t7 c6 {5 ~( W+ S% o
Method 052 a. ~3 g: Q2 M2 k& V$ ] e
=========
# x& k& {0 C5 P; H; T
1 l4 @& t4 q1 u: qMethod seeking the 'magic number' 0F386h returned (in ax) by all system
& J- [0 Y: x& V7 d) n. @debugger. It calls the int 41h, function 4Fh.$ c S) k; }6 m
There are several alternatives. 2 Z3 b3 p9 C6 D" q# D3 K! n3 K5 @
. w% L5 x2 ~, W' M1 r* W. P% M7 q
The following one is the simplest:1 A/ M4 b4 ~8 {- K4 C- H
^" V/ G# u; Q( t! O
mov ax,4fh
) K) ]9 e; c8 B5 ~6 f int 41h: l& s' r" s, G+ K% O& `2 ^3 W
cmp ax, 0F386
, h8 x9 a* d* `8 `: j) {, U' [ jz SoftICE_detected
8 ^9 J/ N6 Q1 L! K& M) E, n: t5 D
# G0 e0 v9 a6 r i! [
. [6 }% Z6 D zNext method as well as the following one are 2 examples from Stone's
' g* u( _5 T/ l; B0 v) f& p, p5 O"stn-wid.zip" (www.cracking.net):' z$ I; Q7 |4 W4 k/ ]
: c# U. Y' h4 r3 Y/ E5 a0 G mov bx, cs
o. @4 j. Y. H6 @0 R- ] lea dx, int41handler2
% z+ S1 E: d T8 J9 a. I xchg dx, es:[41h*4]& U" g1 T" l: y, D2 u6 W* o
xchg bx, es:[41h*4+2]
& E0 e( c/ o9 |7 o8 h# Q mov ax,4fh
* e6 |% S T- S J2 w, k int 41h
* [$ J/ R" H: Q8 s) U x xchg dx, es:[41h*4]5 s. J! u, d5 X( M' h' r2 ~
xchg bx, es:[41h*4+2]0 D# [* Q, F, a# K+ w. N
cmp ax, 0f386h
6 X9 W; \6 s* ~! S4 ?- m jz SoftICE_detected- T9 D( d9 J3 z7 f. }& `5 P- |2 l
7 \7 B8 T0 M" P! `/ A
int41handler2 PROC4 E+ Z# `& z S& @) D
iret
7 u/ Q6 q. h3 Y2 {int41handler2 ENDP& L* ?. J D& c
0 ^& I7 R: z9 r
0 ]+ T0 S- v0 b6 c; Y0 u4 Z_________________________________________________________________________
0 r7 i4 `3 w# r
* ~. k, e5 S: W+ ?6 i! F9 X b/ V9 [, h; n1 ^0 w
Method 06' j- K2 f2 q. b% j
=========
) C+ j0 z$ Y. x& o' T6 b( y4 u8 _1 g* A/ p8 q
: y% A: b% s9 s r y ?1 p) t2nd method similar to the preceding one but more difficult to detect:
. y9 _" G5 z. T! x$ Q& z+ o* g2 x( x, z1 H& K S4 T6 V5 Q, z9 b7 `
/ z; l/ n: x) _7 v4 n" Dint41handler PROC
1 I* |0 J* i/ r( a/ i mov cl,al
' s/ {9 ?, f8 e( S! I. }7 a# j iret
' D7 g! l$ `3 O* W% B8 Y: hint41handler ENDP
% ~4 g, i; Y y s) z k; P3 r6 z/ C# T5 v( a; L; h0 A9 q# h; }
2 V& _) R6 G% h7 _% {1 X7 a) N xor ax,ax. |& f* c, u! q3 B/ }4 V
mov es,ax
5 h* ^3 x' H1 u9 ^* x2 {5 q; d) q mov bx, cs
3 b4 ~* \( `9 [; s# B lea dx, int41handler% r9 e4 c7 m' D: j
xchg dx, es:[41h*4]2 m, D5 x) e. }6 c% V. u: M+ a
xchg bx, es:[41h*4+2]! x/ o6 K, `# g+ @0 A
in al, 40h3 ^, D/ z; Z9 o. z9 d& Q# N
xor cx,cx2 x, g4 Y3 G8 S
int 41h
! Z5 N. C. ]4 H( w3 P, v xchg dx, es:[41h*4]9 V, D6 H& I. c
xchg bx, es:[41h*4+2]' Z: f! K' p) j# m! q6 d0 U
cmp cl,al2 P. i) }9 f+ U, K6 p( X7 c
jnz SoftICE_detected
$ P: c7 A' i* l7 f7 Y$ \2 o- T$ W; [5 Q1 z
_________________________________________________________________________- N$ k$ N5 e/ Z: {7 y% G R
$ s3 [! V/ A" A$ Q* _/ ?# I
Method 07
9 r" P7 ?3 o2 X$ M=========
* s8 V" B7 A2 e& n) {
- z; t) A5 r# ?) j' _- s# }Method of detection of the WinICE handler in the int68h (V86)
& D) d# o: z/ e8 ~
" L) m# D* r8 i4 v$ a mov ah,43h- R! h \" t+ x* F" m( |
int 68h
( i2 S8 X+ v5 i/ \$ U cmp ax,0F386h8 d* C% a' s( M. l
jz SoftICE_Detected
1 o: E" q& r3 C. H
5 m' [, d7 P& ^9 B' J7 }$ g7 h7 h- f0 ]
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
8 A) n2 q% R. Z0 c% E* u3 m$ S4 D0 T app like this:3 H4 _) A( Z5 M) a' k6 e
/ ]+ l. J9 G' T& d+ c
BPX exec_int if ax==689 A9 t8 E: z8 N7 t+ \
(function called is located at byte ptr [ebp+1Dh] and client eip is
3 s4 h' c) ?6 H8 S; x- _ located at [ebp+48h] for 32Bit apps)8 R& b4 f( y8 I: r, v: ^0 d- x, b
__________________________________________________________________________* [& H& Z$ s4 r3 J. m
' E! z1 J) ?6 a6 g9 O
/ i3 J$ P8 P* C/ u
Method 081 H2 A% o/ y9 U v9 J
=========
1 m3 q J- ~$ i5 u) U+ ^
7 {4 D c( ]: {" \* Y; uIt is not a method of detection of SoftICE but a possibility to crash the1 k+ \! Y% b7 t( [# M- J
system by intercepting int 01h and int 03h and redirecting them to another
% y- Y# K) @% \! [6 hroutine.3 J& T4 l! t0 a+ V
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points, a: `) k* g2 E# j1 N" x
to the new routine to execute (hangs computer...)
& s$ s" Z3 G0 P) p$ |. x" D% V6 r: V% Y" o. Y: d4 i% i% T
mov ah, 25h$ ?8 h; J" |, Z/ W0 d7 ?
mov al, Int_Number (01h or 03h)4 D# W& m1 m+ c9 R
mov dx, offset New_Int_Routine
1 Z3 H4 u; J8 f# O; p int 21h& O7 l# g3 p' K0 I: W
- R2 f( U% I' A" s
__________________________________________________________________________
, y& f$ n* x2 J& i
" K) d5 |5 v8 |' O3 PMethod 098 w4 A! A: ~. w7 L' S
========= P) A6 T+ p. [8 s) o: y
+ U* g+ f9 ?/ e: g
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
2 o; b1 d. O) j! tperformed in ring0 (VxD or a ring3 app using the VxdCall).
/ z3 t5 G5 w' Q+ a3 G% {" sThe Get_DDB service is used to determine whether or not a VxD is installed. J/ [' M2 q3 \ i2 C4 U. j8 }
for the specified device and returns a Device Description Block (in ecx) for2 h- o' T N3 E; d% ^0 y( Q$ W
that device if it is installed.
9 {" _9 v& J& B/ u
W9 G5 d. G4 H, A% o mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID4 |7 P s7 D2 i+ e4 M$ [. e
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
m& R/ |; s% i VMMCall Get_DDB. A! i+ T+ I# C- N! {. O4 |
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
2 z ?. j8 _" c7 Z' `: Y
# z, g7 e- J! p% h# y2 \Note as well that you can easily detect this method with SoftICE:( p# j3 ]( {! R9 q) V P1 H9 y
bpx Get_DDB if ax==0202 || ax==7a5fh
+ E9 W+ H# E# ]1 b0 K( j; S
- p [9 |' R* e" o' T__________________________________________________________________________
' h9 j/ [* k: @% h X9 W( r* O+ _+ p. h* j
Method 10- \, }7 X f; r! |1 ^
=========
, f6 V5 z% h# ?3 g, d S. ~3 m6 ?7 o( X+ P
=>Disable or clear breakpoints before using this feature. DO NOT trace with
4 V0 [7 E4 I d6 P' \) r SoftICE while the option is enable!!1 i D/ B5 E2 n1 p) a( f0 |
" {* V2 U( Q2 Q3 }- W) h" A2 G% | G* @This trick is very efficient:$ {4 n. }1 Y& h5 V6 Y! i
by checking the Debug Registers, you can detect if SoftICE is loaded
7 f7 ~ y9 z8 d7 Q) k2 c(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
0 Q, a; |* Z L: ] ]/ i% U2 F; u2 c3 cthere are some memory breakpoints set (dr0 to dr3) simply by reading their
B3 ~$ a- A6 A5 {. n' T4 H1 \value (in ring0 only). Values can be manipulated and or changed as well
4 w& B7 s2 z$ @5 w0 L/ F(clearing BPMs for instance)
0 U: O, X4 _$ k4 ?0 I7 W- _% x# n( O3 {& f" | l! q
__________________________________________________________________________
+ _$ _- j9 Z# P9 ]1 Y9 I
5 F! }, m" U8 M" i# dMethod 11
5 W1 `, }! v" w8 J1 r. U4 ^=========2 k3 t Y1 R2 U( A
, [" X t/ ?) I- C
This method is most known as 'MeltICE' because it has been freely distributed
& d) O+ ~( m4 Q" p1 Svia www.winfiles.com. However it was first used by NuMega people to allow
2 W1 `2 [' }( o+ fSymbol Loader to check if SoftICE was active or not (the code is located( f) _- b3 ^9 j
inside nmtrans.dll).
* h! p1 @0 G6 O4 w) l/ L& Y
8 a0 `. o( k' b. X$ L1 ?6 s/ oThe way it works is very simple:
/ x9 T y; \+ m2 h" kIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
( y5 _% n; r/ O+ ~5 N4 m' FWinNT) with the CreateFileA API./ L2 [5 n& c/ X. a, M5 b2 {3 [& H
1 U1 ?# g4 h. V6 P) ?
Here is a sample (checking for 'SICE'):
2 P' |1 u+ f T; M* `4 j" i
% @# ?- S3 F5 k" b1 U- j0 `BOOL IsSoftIce95Loaded()
/ L! H3 b" {% G' W; B{
4 P6 E& w* K% R; Y+ F4 k HANDLE hFile;
~" n/ I' u6 G8 ^1 r! r0 W$ u) T$ E hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
1 G. g! Q2 ]2 C* l$ D FILE_SHARE_READ | FILE_SHARE_WRITE,5 Y' r, s4 R6 I% Q! S
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
+ g& x/ d$ t* x3 O: D8 W0 ] if( hFile != INVALID_HANDLE_VALUE )) z3 [9 A3 K: a
{
/ x/ B$ x9 V. l: i CloseHandle(hFile);
, U2 U% I2 ?' c; L return TRUE;
0 P, v* F7 t L; x; ` }. u" s% y r8 A1 s
return FALSE;
6 `% t* @: F X$ g0 C: ]} g$ S2 H5 c$ T6 V. Q# N. X7 k
8 u' H! X; q d/ B
Although this trick calls the CreateFileA function, don't even expect to be9 r% T/ ~2 q7 l$ b) i9 t+ \
able to intercept it by installing a IFS hook: it will not work, no way!9 T. W3 S, }( F7 [, h
In fact, after the call to CreateFileA it will get through VWIN32 0x001F1 q9 J3 F* U; @# g+ b
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)( E a; I9 G, v' r' r
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
) U x) l9 G% E7 \# @6 {3 hfield.# x" Q( M1 T2 ]# y
In fact, its purpose is not to load/unload VxDs but only to send a
9 o2 v. g# n7 zW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
9 K( E! w5 X, Z2 m5 {3 c' Mto the VxD Control_Dispatch proc (how the hell a shareware soft could try+ p: A) v H6 Q& L. y7 i6 N
to load/unload a non-dynamically loadable driver such as SoftICE ;-).$ t. W- ]& B9 n9 Z
If the VxD is loaded, it will always clear eax and the Carry flag to allow
1 b4 r H, I9 A1 b9 n8 s: x0 gits handle to be opened and then, will be detected.# \8 j) u1 q5 ?6 B" V9 e- v
You can check that simply by hooking Winice.exe control proc entry point; ?$ i& Z) O3 N! U, ?8 b
while running MeltICE.
3 \, H$ y0 ]% [ K: }* u: Y
( \8 d9 f/ x# z r6 [" {" m6 Q2 s" l, K
00401067: push 00402025 ; \\.\SICE; ]. i, T0 Q! S% N
0040106C: call CreateFileA0 N* Q8 ^2 m/ B
00401071: cmp eax,-001
% ?* u. W1 H" N: V: H! w( f 00401074: je 004010918 b( [6 e( `+ i2 Z/ W/ H+ t
& s7 D0 A; {/ C+ ^2 q7 {8 S5 e- |6 U$ J
* u( {: H1 a6 gThere could be hundreds of BPX you could use to detect this trick.
# h) t5 ]( Z* f( _* _, t! p2 f( e-The most classical one is:* G3 F# f: i$ ~( k
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||# {% d. s) D$ H" G7 R# j
*(esp->4+4)=='NTIC'. Y' F+ o+ I N+ S& S
; P& o- L$ h% W-The most exotic ones (could be very slooooow :-(
4 f. A' Y8 |( N" k6 X1 H% T( l BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') Y, Y+ U4 v* ]0 P
;will break 3 times :-(: e8 Q3 i# f( R) \, y3 u8 K
! T, m6 m& S! b7 _( G' W* Z
-or (a bit) faster: # j% I) o( @" S( b: H; y) S( J
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')9 f, N- m6 P- X. ]! f% G
+ ~2 k, y4 i8 f! h BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' , j; q3 _5 K, J9 x
;will break 3 times :-(% a6 g) Y* P3 Y7 S" K, v2 v, b/ K& V
% O" o. z3 t' |: }+ n
-Much faster:
% U$ w! I* b9 ]6 y' y BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'3 X2 x9 p! o& c
) r5 ^6 q2 N% w! P* ?
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
2 D' }, n5 x3 p y' F" Wfunction to do the same job:8 P4 E0 q7 h$ m- w' y2 y
5 V7 I. M: P+ ~ push 00 ; OF_READ
( Y/ P5 v2 W, ~! H0 W mov eax,[00656634] ; '\\.\SICE',0" r) _# O5 X& b
push eax" }9 a% r4 y1 O# a
call KERNEL32!_lopen
& }4 C- K9 o$ J+ q inc eax
( H. q D7 v: e9 d) c jnz 00650589 ; detected
( j, g" H# w. g: N- y! y5 O push 00 ; OF_READ W; z, X- o \. O' }' v: q, a
mov eax,[00656638] ; '\\.\SICE'
' j7 f9 u; d) i8 j3 b push eax
! j$ p* S) \, ^2 h8 N/ s8 v* }, x5 F call KERNEL32!_lopen
- B) C+ _5 J5 v( L# A3 S* B; K; \ inc eax0 {" r) c% ?2 u" u5 L6 E2 b
jz 006505ae ; not detected
, x/ M2 S% H$ B7 N; j8 G k
# d! E: e9 A- M* o' N( K. s& i# G4 V. l% `, r) d
__________________________________________________________________________
9 q! j) [5 E; {' O9 H' k+ m' f2 s, J; D, R2 l: j" s" ^! c+ V: {# l
Method 12; @9 M+ Y" i, k! _4 x- o p4 U. ^
=========* s6 [% b0 }2 ]
0 O* Q0 ?3 E6 @# [
This trick is similar to int41h/4fh Debugger installation check (code 054 }( j1 [# {+ X7 |
& 06) but very limited because it's only available for Win95/98 (not NT)' q" w' ~: h* a* u: v4 y
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.# Z7 _. Q2 B& {5 I$ ?- o6 u. I
) O: e3 N3 C/ J* ^' k9 Q push 0000004fh ; function 4fh
+ W5 c2 ?4 t2 Q6 h* G& x( } push 002a002ah ; high word specifies which VxD (VWIN32)
! K2 f% C+ T: j+ P# \2 o- o ; low word specifies which service
! V' I5 d* w+ f (VWIN32_Int41Dispatch)- N- w% [2 \0 L" A/ [- Y
call Kernel32!ORD_001 ; VxdCall) c0 F/ Z8 u( r3 I: p
cmp ax, 0f386h ; magic number returned by system debuggers- U! ]& t) P' m1 R
jz SoftICE_detected5 c) b, ]5 `- |7 U z
! ~& J, { q7 Y/ z1 s uHere again, several ways to detect it:: U# c2 u' T8 W7 ~* E8 T+ V5 B9 ^
6 _4 d. w/ f1 P" M* p
BPINT 41 if ax==4f
7 }: e) R. p1 S5 ?
4 u3 T7 F" \1 u% Y f) K BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
1 R' ^' _6 K3 p* U. t/ h, l3 Q8 L& N
, m3 e. O% X! k8 r' K) i: H# v/ T4 L" e BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
- U' t; [+ _! ]% j, D
9 H9 N7 D" H! l- o BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
% T( ?; i7 k1 C7 D/ B3 p2 ^* o! c$ E5 a- F. l% P' P
__________________________________________________________________________
- Y5 Z; v) W% f/ D' K, v
" G2 t8 ]) _8 u+ ?& u- x; e% XMethod 13
( b7 E/ _8 K8 |. H) e! k=========" X- ~! W5 T# Q# r% d8 ~
1 ^2 r2 t3 b0 {: y' P! l' {; c+ e0 h
Not a real method of detection, but a good way to know if SoftICE is2 z% P5 E0 W* J, p |7 ~+ n
installed on a computer and to locate its installation directory.& s; T* q0 u) e' S7 P& l
It is used by few softs which access the following registry keys (usually #2) :) r( ^) p- Z3 e8 n
; r. S% o' k8 T; |
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion) q3 K6 ]/ l. u/ u0 T2 P
\Uninstall\SoftICE( f& r, H' A8 i" U) G9 H0 \- q* Y
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
& i6 R% d3 f E8 _4 G T; H2 U! u-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
* a- S( S! t3 g\App Paths\Loader32.Exe
! e0 q( @' V+ W _* i) U* q1 a% U [# q8 b! k
`3 A1 f% H/ p1 J B$ e) e! [Note that some nasty apps could then erase all files from SoftICE directory
9 W w+ S- ~1 j(I faced that once :-(
j Y. @9 k/ T" E1 w6 A+ Y. l" t8 z1 g8 c/ t5 @6 V; k
Useful breakpoint to detect it:& I5 `" S ?7 y# p& o; d
; m( B' }4 G2 g4 }2 A/ h BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'* D/ S: B! B6 f- z
' Y4 M# P% M1 L__________________________________________________________________________7 h& T. |+ T) R$ y" C. P( m* e
" T" Y' F, l& M+ b3 t2 E1 J
$ H4 n. d9 E0 D/ {$ o5 ?3 t* y
Method 14
$ ?2 x$ k. v% j3 E% Z# v=========9 d _8 g, s3 o1 {8 V E& V6 D
# l& P0 S `* S6 N6 y k; N! E6 DA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
' }# d3 c! z2 } |4 O+ ^- K; r1 uis to determines whether a debugger is running on your system (ring0 only).; ]( H( p7 _3 `& S
0 W* c# c7 O/ i VMMCall Test_Debug_Installed" r. j n4 W. M5 y$ U
je not_installed5 [6 a2 W; C' H8 z! Y b# U+ [
8 x$ G- D- B6 ^/ t W" M) I" o! gThis service just checks a flag.
6 G( t* E) x6 H2 p</PRE></TD></TR></TBODY></TABLE> |