<TABLE width=500>) u8 R3 V _* }9 U0 U8 o; y
<TBODY>
& i! Q! B# B+ D<TR>
3 e5 ]) j& K6 [<TD><PRE>Method 01
' o2 h* D1 A# t) l========= [/ P+ d8 M. w3 g) P
6 {7 `$ b; ?. n4 d, pThis method of detection of SoftICE (as well as the following one) is
1 R/ v1 w* b+ z# e% Yused by the majority of packers/encryptors found on Internet.
3 s8 z3 ~& O; t4 o0 KIt seeks the signature of BoundsChecker in SoftICE
2 m8 m, c1 g: q$ N# x/ @
! W' v8 L u; ^: _$ M+ e) Y8 ^ mov ebp, 04243484Bh ; 'BCHK'
: j7 y- I' X7 }8 D8 u mov ax, 04h/ g4 U9 r0 Z9 A4 }
int 3
+ U) X2 ^# _. X cmp al,4
9 d4 X7 H4 n% M5 @/ ~, Y jnz SoftICE_Detected5 j* L' c% z: i" S' `$ q+ H- C
( z+ h- Y+ ~! y# E7 ^
___________________________________________________________________________
& p0 R2 w8 v9 ?4 }$ k$ m4 B
+ r9 a" ^2 p% O6 y% D5 Z6 R+ U% P4 SMethod 026 W% n/ ^. `7 u: J1 d
=========( y! |$ F6 }! w8 d1 `2 W% l0 q( @" o
& Q. }! K6 c5 \" H& J! ~! AStill a method very much used (perhaps the most frequent one). It is used
9 S0 W+ @3 v5 ~! `! D4 A! l4 A" rto get SoftICE 'Back Door commands' which gives infos on Breakpoints,: l! {1 f% a& `/ f; W# z6 I
or execute SoftICE commands...+ D0 `3 S2 L* E5 x
It is also used to crash SoftICE and to force it to execute any commands! `- E( M4 K+ `# p& W
(HBOOT...) :-(( 7 Y1 C8 W/ I9 o- S* t
, \; e! g3 k, c( {
Here is a quick description:
* N5 X! K9 @7 z: x" @! f( n. q-AX = 0910h (Display string in SIce windows)# F2 ~9 |. p" w' ?# P2 u- J( M: ]
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
2 B0 K4 S0 q# m: J; @7 u-AX = 0912h (Get breakpoint infos)! b4 }+ Z& L, \
-AX = 0913h (Set Sice breakpoints)' |8 G B4 c t* z3 @5 e
-AX = 0914h (Remove SIce breakoints)
& e+ G$ ]2 C r9 u6 l. T ^+ M1 p( a, v6 Q( u$ p" s" E
Each time you'll meet this trick, you'll see:) x) f: A+ E7 m) x
-SI = 4647h
' t* V: S- T( Q-DI = 4A4Dh
+ ~+ l) J4 @2 c" p# |Which are the 'magic values' used by SoftIce.
$ l) D, H/ ^+ ~6 P D% M2 \+ IFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.% u& O; w& |' X" H4 T" X
+ E6 U$ P4 C. tHere is one example from the file "Haspinst.exe" which is the dongle HASP
/ _' O% L" z9 l! _Envelope utility use to protect DOS applications:
; ? Y: j6 z6 y: |
2 w! B7 f$ Q5 h2 d4 D! J4 E5 ?# h$ ~0 ]! A1 J# _
4C19:0095 MOV AX,0911 ; execute command.6 F/ [" U/ N$ }
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).9 s; Z @3 v3 a* X
4C19:009A MOV SI,4647 ; 1st magic value.
( S! }7 h8 ^4 Q; }1 |4C19:009D MOV DI,4A4D ; 2nd magic value.
/ _' `' d; h1 H: r4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)3 S* C, a- C. o W8 k$ t; ]
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
6 A% q: ]) b9 W4 {8 G6 N' i+ {4C19:00A4 INC CX
0 W R* o* U& ~( E4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
' i; B0 V4 s m1 ?9 L! A: _; w8 ?4C19:00A8 JB 0095 ; 6 different commands.
- _2 ]: y0 O1 b u4C19:00AA JMP 0002 ; Bad_Guy jmp back.3 G$ Q) a! I$ z1 H
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
0 S7 Y) Y$ Y1 \8 M& Q0 B4 @0 y6 Q1 K* T
The program will execute 6 different SIce commands located at ds:dx, which/ g, u4 r4 v$ Z5 S# m
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
6 L! J" Q+ f6 F- l+ N
' t, g' g: D3 X- Q: v. C8 V* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.$ v w# ~. _# @7 `2 K9 _
___________________________________________________________________________- r0 F$ D& e3 j, b; F
3 N) h' \8 d- L5 s7 z" @8 N- Z9 f
) R- H' o& V& e; CMethod 03. H( O7 h: j( ]. [4 ?
=========
9 V% i, d+ N; h) P+ f ~$ G( E8 {% B
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
6 W9 T* U; z: T) R/ N! `& o5 D(API Get entry point)% w' H# l! q/ p7 J) ?* j1 d
2 j! N7 C' ~0 O7 ?" m3 P: Q
7 l% N: t& z3 T$ ^2 f
xor di,di
B' g6 _$ I% S7 [+ X' Q$ p mov es,di
9 q# k$ u: I) Z mov ax, 1684h 8 j' S8 Z2 f4 b- u; J
mov bx, 0202h ; VxD ID of winice
, V& S5 j# B1 s' m6 D int 2Fh
8 l# b) {% H3 _) }+ W& W mov ax, es ; ES:DI -> VxD API entry point
" D" w4 d& w' i: h add ax, di8 P" d% x! a( c, X. C; {. }3 ~/ S1 c
test ax,ax6 e4 \- |/ |/ E3 z1 ]$ h! A8 X
jnz SoftICE_Detected
. W% f' t8 k5 }, W ]) k+ i
8 R7 ]7 E! i# @8 t9 F; N, u* F* l___________________________________________________________________________
, j' J" O) N& e: u' u& h
}/ ^% v" e# h3 F: zMethod 04
% {% y0 h" f: j) \% I=========+ t, n: E- H- \: w; G) e2 v0 |: O
0 O) u4 H Q' ?Method identical to the preceding one except that it seeks the ID of SoftICE, h9 a w# }. D) N- m+ j
GFX VxD.8 H" k1 k. s) }' y y7 |6 }( j
6 y _. O. R" M, Q
xor di,di
$ X y' Z. B2 ^2 O5 q" _ mov es,di/ B9 f/ E/ [& ~* T3 j( Q: I
mov ax, 1684h 4 N0 Y3 w( ^' N
mov bx, 7a5Fh ; VxD ID of SIWVID
& F. Z& P0 t/ [ R int 2fh7 J) K1 V8 t* o$ W7 E6 O! T
mov ax, es ; ES:DI -> VxD API entry point3 B8 o7 E2 k" g- u; }
add ax, di7 C3 Q( A: M5 s# ]# i+ v* C
test ax,ax2 t7 R& ]) r5 J C& Y! T
jnz SoftICE_Detected
' y5 i w n( O: g3 f: c, I( O" [8 w9 b- D b9 y3 E5 A# E
__________________________________________________________________________1 T( X/ @( s7 T9 Y7 L; M
2 e$ }! A1 z) R/ P& e
0 `; f7 P: f0 z5 l ZMethod 053 e( {0 z1 R3 ^9 t3 j. W, N
=========
% d, ~3 T1 h+ F9 U- N0 D, e1 ^- n n
Method seeking the 'magic number' 0F386h returned (in ax) by all system; C; {( h) J5 B
debugger. It calls the int 41h, function 4Fh.
9 L# i8 ^$ O g/ W! uThere are several alternatives.
1 Q1 e) j: \) N/ R ?( [# R/ X% S8 \4 Z1 W: E
The following one is the simplest:) C5 C7 }" U1 U/ n! ]' {% m" h
0 B: A- a1 f& L9 t5 S8 K7 _
mov ax,4fh! i5 }3 |5 r$ n% J. x8 ]* X
int 41h: X" T4 A4 E- ~ k, U: F5 P, [" D
cmp ax, 0F386
/ ]8 b, p( W' S8 ?/ { jz SoftICE_detected
- G8 c. a% B5 f8 v9 p& g0 @5 L% N6 L+ p ~+ t. e% M& K
: b, \) w4 |" I$ R. E; E
Next method as well as the following one are 2 examples from Stone's
( L ~& z2 e8 N! D9 M"stn-wid.zip" (www.cracking.net):7 B; c2 B* x( C# @. ?$ H
* {. V2 ] J* l mov bx, cs
9 @6 ?( v4 J2 ?1 b) J lea dx, int41handler2( J+ Q/ F9 w# s
xchg dx, es:[41h*4]7 D/ F8 o: \ J
xchg bx, es:[41h*4+2]
0 I# ?& J/ O3 D; j& ^ mov ax,4fh7 [, J& E7 [) _- u
int 41h
4 W, m# I) x' X: v* _4 z; m xchg dx, es:[41h*4], `1 L% R7 q, S4 ?# h4 x
xchg bx, es:[41h*4+2]
% m& Z2 T, [. b0 y3 W9 k( T cmp ax, 0f386h
" r* e& Y1 y* t5 N& H jz SoftICE_detected
" E! C0 z0 y7 g' U. H. |+ h& J" ^, `5 b: S8 F; W
int41handler2 PROC" d$ `& l+ K% o
iret) u# |/ ]2 o; r2 P* f+ m6 ?
int41handler2 ENDP
8 W; E+ ~1 s7 h# T! N+ G2 a1 ~3 i" ^# H# `# }" s
% w8 x0 ?' l& }2 y" v0 @+ [
_________________________________________________________________________
; f8 A F. V( J) k/ n
+ K" w5 d$ ~; G: {9 C* x( V7 Z# m1 c: p3 x$ s
Method 06
y2 e: `$ k& n* {* a6 b=========% Z* A: q( T) Q! A6 b% x
% n5 w h0 n/ y" q: v* U
! h# [7 ^/ P: h; O* z2nd method similar to the preceding one but more difficult to detect: W1 {; ]8 F. L# D: s
8 J# E* c! a! P7 h
- S2 H# I% p# a6 Bint41handler PROC, Z0 z$ z: I) @$ `2 I' b
mov cl,al+ T% M" e, S* j$ @1 G. ^
iret
/ s# d7 }/ H a( m! _/ Kint41handler ENDP+ ]; L9 G# e. G- ]
8 Y/ S" q* F3 i e3 ^' a( u9 o+ \6 ~. j2 {+ P0 @
xor ax,ax2 N8 p( ?. F2 t; a# M
mov es,ax
/ e/ B7 ]8 d3 @* s$ G7 O' Z6 Q mov bx, cs; u2 X9 k6 B0 z4 t& t1 ]3 I
lea dx, int41handler' T* R2 ` {% K5 @
xchg dx, es:[41h*4]; t f1 z3 V; e' A) r* X% B
xchg bx, es:[41h*4+2]
. y! I; W5 q6 e0 F in al, 40h
5 O( X8 p; ]; b' A xor cx,cx9 t1 R/ Z% d5 x T! V, |8 [
int 41h
. {# J s Y: B xchg dx, es:[41h*4]
, M; ~8 u8 s* y0 [( M xchg bx, es:[41h*4+2]7 @8 x1 n e6 h
cmp cl,al% U4 M( V9 X8 _7 w) f, M, s
jnz SoftICE_detected
& n* L) r" i9 a5 V2 s
% i/ S3 ^, J0 L( k7 }_________________________________________________________________________
8 L9 @* L$ a$ k. ^3 i0 I
. Q2 ? A1 d* {: h; AMethod 077 Z1 E1 H8 a* N9 S$ v
=========* F- s* j9 m$ V" K C( r A
: ?8 f1 m* U$ _
Method of detection of the WinICE handler in the int68h (V86)0 e7 S; D# S6 A6 ~" ^. u
4 t4 I; t. ~( ~ mov ah,43h+ M( D9 | }% r4 z* ]2 @# w; T
int 68h0 v1 t$ x8 `/ l; A% X" t
cmp ax,0F386h
+ |3 T# t) Q5 H/ e jz SoftICE_Detected
7 J9 z5 x( S! o- ~; I; O) \. n# n" A
8 h$ A' M: H' d! C! ~" }4 \
0 @: E: _( }" x {) n=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit) \% H) t1 a9 ?( W) o
app like this:" p1 \5 W' W P0 ]6 C4 E
; Y; Z- Q% m$ X1 P8 ?, s0 m
BPX exec_int if ax==68
; X% H; ?6 i# b* ` (function called is located at byte ptr [ebp+1Dh] and client eip is
# f8 B1 P/ v5 Z. w) Q. A" b located at [ebp+48h] for 32Bit apps)
! Q/ W. e4 L6 {0 |9 _; N9 G3 Y) d__________________________________________________________________________
9 s( I! A$ \9 m( w) b' E
( p! _/ y) x) R8 [. V
; q% U! v; V" ]3 f4 e0 dMethod 08* n& K; Y: F* v3 r
========= L" k" | E$ s" @
( m/ Q5 f" i j w; G8 p
It is not a method of detection of SoftICE but a possibility to crash the
, ~7 P2 Y9 T, m: Z; q6 c3 }system by intercepting int 01h and int 03h and redirecting them to another
! I; ?$ f! [' K2 F: X" sroutine.
" L5 G, p+ A0 q9 P- k. JIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
; T# x9 K e' U$ z5 lto the new routine to execute (hangs computer...)
2 C( W* X5 [6 w, N! K2 G% i; b4 }+ _& i) r+ s, \. ~( C3 |
mov ah, 25h( T, h: i; G. P) e/ m' ~
mov al, Int_Number (01h or 03h)
9 q6 L* L8 Q+ M8 s1 ` mov dx, offset New_Int_Routine$ Q3 @) f$ c2 z3 u
int 21h
9 R! a6 |4 s5 T1 J. D' d4 |% M* y# J8 U" B$ O/ |2 x
__________________________________________________________________________
! i, m6 A! D# k' b3 r+ L
5 A+ X/ K, d- ?& U8 kMethod 09
5 `. z" g/ S5 L. }=========
) _) _4 P3 T1 p& A* K
) p8 M' f3 q# l% v8 [7 yThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
4 p5 B! h$ t/ Eperformed in ring0 (VxD or a ring3 app using the VxdCall).! @# @( \- A- Z" N. x4 J3 W* H$ w3 m
The Get_DDB service is used to determine whether or not a VxD is installed
4 E2 K2 E1 n! L9 |% _; ]4 e, _- ffor the specified device and returns a Device Description Block (in ecx) for; S) Z1 c0 H% P; h5 ?6 U
that device if it is installed. U f u4 M3 [* K6 R! L& c
7 i6 \" ?" H3 Y
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
% }2 Q$ U6 U, G, m+ L) i4 v, @ mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
+ Y ~, n( Q) P) J$ `! h VMMCall Get_DDB4 C8 z" z6 T; j: W, N& R0 Z
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
. G# m. B' l0 I. p$ `1 p: H! o: @6 H: M' A9 n0 X
Note as well that you can easily detect this method with SoftICE:
3 G2 z4 g* ]% w bpx Get_DDB if ax==0202 || ax==7a5fh, A- \# @( B& ^) a1 j/ u
1 H/ l5 \) W3 A
__________________________________________________________________________) c n3 s/ v3 I+ f K
2 c/ |8 k; C+ @9 P& P* s
Method 10, O) C% f5 I. ?; E
=========! h* ^. w6 O6 Y" }4 q$ b* t
) S$ }$ i) t$ S/ U0 x=>Disable or clear breakpoints before using this feature. DO NOT trace with+ }- X" i1 G7 |1 Y
SoftICE while the option is enable!!
0 c, n9 b6 ^: n4 U" ~0 J/ C
0 P" P' A4 n M @% d( dThis trick is very efficient:
1 Y5 j& ^ y- R" v6 Yby checking the Debug Registers, you can detect if SoftICE is loaded
! @- Z2 u; h$ w$ v9 z1 i+ S(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
M3 V* A) B$ o; A4 h2 Dthere are some memory breakpoints set (dr0 to dr3) simply by reading their1 c+ e6 R, S# h% I
value (in ring0 only). Values can be manipulated and or changed as well
- ]0 A1 [0 c4 E! S8 ?8 T* X" _. ^(clearing BPMs for instance)
; m( ]: r% |- v- v+ J
: | s8 _1 m# [__________________________________________________________________________( ? g# p; f3 Z" e
6 b6 B6 D2 `5 ^* _; D! E6 YMethod 115 x/ G) N: _) r& m
=========
6 q2 _* `, v+ h* k4 W$ T
6 d; s# H: v- _+ bThis method is most known as 'MeltICE' because it has been freely distributed
) M8 O! z2 j; [, G K% R! ]via www.winfiles.com. However it was first used by NuMega people to allow; G4 T; E; z( L
Symbol Loader to check if SoftICE was active or not (the code is located+ @2 q1 R4 _3 Y- l" X! j5 W
inside nmtrans.dll).4 `7 V6 V8 m, C& Z6 [
. j y- ^/ @' s. B
The way it works is very simple:
- g: A( a% u4 U% C7 A/ C. oIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for3 F; i) |5 h6 b9 b
WinNT) with the CreateFileA API.
3 b4 `8 _5 d, _5 f, {+ |9 }' O
( `6 O3 M& ~( `Here is a sample (checking for 'SICE'):
# k$ @+ p4 l$ }8 r2 V/ S. b/ S3 f% z0 O& j" o
BOOL IsSoftIce95Loaded()) p5 {, R# ] c" [! m& {. W, z7 g4 @
{
: r4 g7 L1 a5 ?0 L HANDLE hFile; 3 d6 J& _8 R, j) t
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,% l" ]! N9 M" j5 {% S2 \' H
FILE_SHARE_READ | FILE_SHARE_WRITE,6 L! G) o( `! R. u
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
! F& m9 M/ q/ v* D6 m e5 r if( hFile != INVALID_HANDLE_VALUE )
# s( j# g+ L4 K) ~7 K {& H$ ?% K7 [* B; r' |- d8 ~; l4 H
CloseHandle(hFile);* ~- a( `/ Q4 v' X2 {( ?) l
return TRUE;
7 _; w, O \% j4 K4 W9 i }
, } N: H1 G0 a7 S! ~+ u! f return FALSE;
. ~+ m& Z& E0 x& |( M}$ k' t$ t4 M, }5 a8 y/ p. L+ B
8 m& q0 R) d4 [7 P; D8 N# ~
Although this trick calls the CreateFileA function, don't even expect to be
4 s; p3 r. ~; d% M* a$ W4 P9 Cable to intercept it by installing a IFS hook: it will not work, no way!& W9 j/ ]9 g% v8 l
In fact, after the call to CreateFileA it will get through VWIN32 0x001F& u/ w, ]8 ?+ \
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
6 @5 q/ B+ j' X. ? r) n" I6 Aand then browse the DDB list until it find the VxD and its DDB_Control_Proc
" N, w2 c3 N' Cfield.
& K% m3 j# b/ H8 CIn fact, its purpose is not to load/unload VxDs but only to send a
/ E. L& L0 i1 G8 g2 X/ u$ sW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
9 r0 d0 h& V+ l2 S, x9 V0 yto the VxD Control_Dispatch proc (how the hell a shareware soft could try
# t# r% a. u6 Y" q2 D% dto load/unload a non-dynamically loadable driver such as SoftICE ;-).
5 a/ {/ b& l1 ?* W) t& S% Q" }If the VxD is loaded, it will always clear eax and the Carry flag to allow& y Y% ~4 H& N/ U' \% B2 V# ?
its handle to be opened and then, will be detected.; W# g% J" P8 g1 k0 s
You can check that simply by hooking Winice.exe control proc entry point
- z2 t7 [6 X" E& W( ]8 q1 |1 hwhile running MeltICE.5 Z4 h2 k; X! O+ i3 p5 z% t' D, F
% v/ p2 P% W" L( P: w8 H' P* t I. c# x! y
00401067: push 00402025 ; \\.\SICE
& c, B4 U) p" e6 X" e0 o+ }. C 0040106C: call CreateFileA
# e) m; x- x0 b- ^ 00401071: cmp eax,-001' \" j' j4 B( v! o( J0 i, Z; @' e9 v
00401074: je 00401091
: r: z, N4 T5 \+ j9 M+ C4 z5 d( d! G0 c( k* O5 T
5 x. `* ] d! H0 @' M m ^6 R! FThere could be hundreds of BPX you could use to detect this trick.& ]9 W) c* ?( C! _
-The most classical one is:: {5 U7 \" f/ L; u0 E" l
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
/ R! W* ?$ w& v *(esp->4+4)=='NTIC'- j" t/ e+ {; U% i T0 c4 c5 S
' g' X+ E0 u0 L% c
-The most exotic ones (could be very slooooow :-(+ K; l6 e( E0 Q' O" @/ |
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
1 q- `/ v6 `# V9 _% K; ^' _5 O ;will break 3 times :-(! I$ y8 l% ]1 H/ ]
. P9 k T0 Z; |1 o3 v1 k-or (a bit) faster: ; `# B5 G N T' K' l2 c! z F
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')+ N/ y' E) D7 L) w4 S4 t7 A3 y2 [
" M. N# T8 A% s1 I. |! ] BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
: S7 I: S5 g+ Y# U+ Q0 v: C ;will break 3 times :-(- K! _1 Y) A! ?) ~. X7 l# r5 V
, s( Y) N; l4 i( e, V; A
-Much faster:
]+ i/ s# H4 c" R% a BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
6 E1 \7 Q; U% ^9 ~ W
& T& h' q T7 SNote also that some programs (like AZPR3.00) use de old 16-bit _lopen q$ z2 `1 j6 V) u6 W8 K
function to do the same job:
' L! e' R- r9 M' s
: L, Y7 R- ^, x U! d2 x push 00 ; OF_READ
/ G: W' |! A: K mov eax,[00656634] ; '\\.\SICE',06 G, k* K$ _& U* U6 j9 F. {
push eax; ^5 @$ R5 b+ ]# C& E% r6 q
call KERNEL32!_lopen, @# [" J; x( L9 h
inc eax
) m4 r5 h/ t2 j1 v# N6 ^ jnz 00650589 ; detected, l3 r& G$ p9 j* {4 a: K
push 00 ; OF_READ
# k! u" n+ H7 ^* q$ W# n8 E9 w mov eax,[00656638] ; '\\.\SICE'! o. B. }+ A& ?
push eax
; t2 _; s! d9 ]& {$ ` call KERNEL32!_lopen
3 K4 m7 f- S# b6 Y1 B+ s" B inc eax
, P5 H9 \5 ~6 }. t jz 006505ae ; not detected
' S, R& A1 X6 C& g8 Q' x, e0 j' @% N
1 [5 t6 L S8 Z7 b
__________________________________________________________________________0 y) Z; w9 m% a, l* o, n& U
% V: H( `4 m! i" }4 m
Method 126 c, L. g. \$ b ]; X+ a
=========* n7 `9 v" E) |% v) a |' T. ?& ~
; _. E+ h; G4 {0 b! i' rThis trick is similar to int41h/4fh Debugger installation check (code 05# N8 Q! ?* i% J/ I/ H. L# ^8 Y
& 06) but very limited because it's only available for Win95/98 (not NT)4 t1 k7 u; z! C: s$ a1 t
as it uses the VxDCall backdoor. This detection was found in Bleem Demo./ g8 E d, t8 q h4 E7 z
2 C& S8 W2 X& H: m( j- n/ J
push 0000004fh ; function 4fh
' u) F+ [- f7 u7 j# v* j# S! I* o push 002a002ah ; high word specifies which VxD (VWIN32)
; Q: O/ P! _1 n, g f d ; low word specifies which service, f# _# Q u/ b$ i' l9 d! d1 Y
(VWIN32_Int41Dispatch)) J Z {# j6 K
call Kernel32!ORD_001 ; VxdCall
3 h2 g3 D6 U. V) O! l1 u cmp ax, 0f386h ; magic number returned by system debuggers
0 f3 Z& H) d" s, \ jz SoftICE_detected
F, z8 x& G) S$ h Z% `% v/ ]: m) {
Here again, several ways to detect it:
& I5 M Z, ?% D% Y3 \0 X+ T4 e% z' Y9 W1 K* Y6 s
BPINT 41 if ax==4f
7 x5 g5 T5 N0 @, d: V4 b( P" s, v }$ V4 E, ?+ _% h" g+ y
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one0 f" t4 X9 {' d( H5 c$ ^5 G# m
& G+ ]! Y% _+ Z: ~3 z3 @ BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A: G2 M6 v$ {& K2 ]! q1 k
L& i% ?) v# N8 e3 X
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!2 I: |% r* n3 h2 e6 e
+ B6 O9 P6 `) C8 }! `9 R) H9 h
__________________________________________________________________________
# X8 v ~! D/ M( J1 ?$ w) x. z& i
# Z1 ]& A% b- o8 D! AMethod 13+ @1 o& `% r! [
=========: A* C$ h+ q+ T3 w, r, t3 v
' U, L, F! v" X. s$ Z5 \; h; [Not a real method of detection, but a good way to know if SoftICE is
% M* g2 [; f+ |6 zinstalled on a computer and to locate its installation directory.
! l$ h2 c( V) GIt is used by few softs which access the following registry keys (usually #2) :. i% Y( i* }: I0 u( Z4 ] p
4 c! z& Z6 \, b* ^6 n-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
6 P9 O9 [" K C I\Uninstall\SoftICE
# t% @# n" p, C4 H/ o" D$ B5 d-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
9 Z: s4 ]/ }" P8 Q- ]3 z-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
) |7 S# I r' P+ k k\App Paths\Loader32.Exe5 o$ w) X5 n! y n5 q
a! X9 |( j R2 s5 U& \1 J( Z
* G$ q) m8 X) J9 vNote that some nasty apps could then erase all files from SoftICE directory9 P5 e0 r4 D1 H" s& Q" U; B
(I faced that once :-(
' K3 O. ?* t# G% E& N; [0 z4 k+ l. l6 c# \' O
Useful breakpoint to detect it:* l3 @$ F3 v3 l2 p* a4 `
6 N$ p3 Z' d7 T# p5 G
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE': P& j- Q- Q! t
! `( I, c7 Q# t% R g4 ?
__________________________________________________________________________
! p' ] _: H6 S; D9 A
1 Q' V& Y/ J0 O: N- d+ G1 K E" Q( `# @
Method 14 3 J0 |. \% v* u: E7 m
=========' y0 U. T7 l6 o/ a% N
# |4 _4 q: K5 s, e+ kA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
. n& S1 w k( ?' q# }& b! ois to determines whether a debugger is running on your system (ring0 only). H B* s! L3 b w) B; c. a: O
! Q2 a/ _2 W. w
VMMCall Test_Debug_Installed
" ?- ?: v/ T1 c" w7 H je not_installed6 M5 c8 p9 g) B q) y* J
3 N/ }; ]; G6 P0 S
This service just checks a flag.
4 u# ?) E; L, T5 l</PRE></TD></TR></TBODY></TABLE> |