<TABLE width=500>/ [9 s% [5 X( q6 a m
<TBODY>
0 m' Q% y7 z! C; Y* P+ o; @<TR>
: g y3 S9 D* i0 T6 |% ]% z<TD><PRE>Method 01 ( u; c+ U2 P- e/ }1 b
=========
2 |; f( E2 D [; Q8 S4 d- M. a2 l4 G
This method of detection of SoftICE (as well as the following one) is
% G5 }- l, {9 H5 A& Rused by the majority of packers/encryptors found on Internet., H H/ L* b& @+ N
It seeks the signature of BoundsChecker in SoftICE- ^: X `; v5 m' a( y* s$ `! N
" W/ d2 q2 j3 O! }2 X mov ebp, 04243484Bh ; 'BCHK'
1 T! x! `, i% ~ mov ax, 04h- m: `; ~6 u4 o" {( k# X; h
int 3 : h& z1 l+ Y# d' y6 u
cmp al,41 x. ^% A; o5 Q/ v6 M; O3 @4 y; c
jnz SoftICE_Detected3 |( I) V6 ]) M; N9 j/ z7 O' e
3 ?% Z. Y8 ~! i+ {
___________________________________________________________________________' m% |8 E1 n0 p4 f T* T# f8 j2 e
5 i& K E8 }. ^9 nMethod 02$ S y; \( D o3 P5 d" T
=========
) X& }, ~1 K" G; Q
) m9 u1 Z$ v C# S; JStill a method very much used (perhaps the most frequent one). It is used) z, T; ?* P* |) B. u, I) ?
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,0 s( C `3 ~* O! |
or execute SoftICE commands...! m' n& u9 @. V! ?' x
It is also used to crash SoftICE and to force it to execute any commands
9 T# e, b" ^* |7 o" ](HBOOT...) :-(( ( W/ B$ `- m- N* E8 L J
6 E2 W, p0 w$ ^1 T5 E8 P1 [
Here is a quick description:/ z! Y) d+ A% b8 `* h, ]9 y
-AX = 0910h (Display string in SIce windows)
+ ]! @3 \$ o5 [6 n6 H+ d-AX = 0911h (Execute SIce commands -command is displayed is ds:dx), N8 Q/ `. q4 ?
-AX = 0912h (Get breakpoint infos)
3 T! t- h' w# w. m) f: M-AX = 0913h (Set Sice breakpoints)9 A2 j0 h4 @. p- t
-AX = 0914h (Remove SIce breakoints)9 x( x# q k0 A; }: Q* ~" `
# o! z' f& l% D& D+ r" w
Each time you'll meet this trick, you'll see:/ ]1 W! k7 b; T# T7 A
-SI = 4647h7 {8 M) k$ |8 j8 j
-DI = 4A4Dh
4 \) T4 ^$ @! Q! N% t1 {( }Which are the 'magic values' used by SoftIce.
# L" O2 b; W* uFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.- o7 ^! b! B b
( u2 G3 d' t" q, ~* H' A$ {2 |6 } G \Here is one example from the file "Haspinst.exe" which is the dongle HASP) x- {& y K1 Y, X( r8 Y
Envelope utility use to protect DOS applications:
6 ?& V2 B/ v, i/ H" y1 ?6 F5 b. E" n, q8 _
. w9 q8 L8 @9 q7 g3 ~! k
4C19:0095 MOV AX,0911 ; execute command.
$ @# n) w& }1 |# d# @4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).. v( k$ Y) c! |; K
4C19:009A MOV SI,4647 ; 1st magic value.5 n1 ^' r/ U( F7 X9 t1 I) \
4C19:009D MOV DI,4A4D ; 2nd magic value.
- L4 W5 R2 R0 I% V/ P4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
+ R5 y# y' F" R! ]9 Y4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute: J. E! s0 M* _/ ^6 |
4C19:00A4 INC CX7 R, z; V. i) e# s6 A2 M w
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute& a4 g) Z" P! e0 A
4C19:00A8 JB 0095 ; 6 different commands.& D% }- n) o# d, Q2 a2 K
4C19:00AA JMP 0002 ; Bad_Guy jmp back.
* t. z; ?0 U7 I4C19:00AD MOV BX,SP ; Good_Guy go ahead :)9 D. {" z5 R$ ~
& e% J+ F% @' L
The program will execute 6 different SIce commands located at ds:dx, which/ Z+ b% k# j$ r3 p
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
( S8 U* `8 f1 I( ^6 @% p6 ?7 [6 i0 T1 l" Q& F4 b% c8 h
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
a( U7 R- f# d6 H1 ^4 l7 w* i___________________________________________________________________________; N4 G) R: z# w8 h! w) Z0 @" J7 b
" y$ F# k0 p4 T8 U
6 H, y+ x, g2 E1 X
Method 03
i# {; q! v q( b( j=========' N: ]+ L$ @' U6 ^2 L# E' [
4 j' ~3 z$ u; N3 f* u. B% A- }
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
' c" y; g3 C. P" J3 I: @(API Get entry point)
* J7 b* E$ k# e3 ` ' [8 S0 r2 s8 E( `
, `( _2 H! g& W( [ xor di,di
( k) v4 u0 O0 x& g3 f# I+ I mov es,di
3 T/ O7 X; M: y( m mov ax, 1684h
, B8 V, | I# x3 ` mov bx, 0202h ; VxD ID of winice3 T% e, `5 `/ N; Z
int 2Fh
* w1 J- |8 I; k- j2 S mov ax, es ; ES:DI -> VxD API entry point
, U, Q9 A) l. e Z& ~ H add ax, di4 `( A9 T# j9 |2 X% j5 g2 }# A- \
test ax,ax
8 A) ^ H. M. ?8 K1 e% _. c4 W jnz SoftICE_Detected }& _1 k5 S6 o
% \ _1 h/ U, c& D1 |
___________________________________________________________________________: {/ e9 ?5 s$ ^! g( ?* N
. z l6 w3 }& `0 [ q
Method 04& ~# D' m$ ?+ I
=========
, a5 r; {( r) P ~: x( v0 i8 g; w/ W) u2 k3 x
Method identical to the preceding one except that it seeks the ID of SoftICE) p- {! a# r3 X1 C, A+ X
GFX VxD.
9 G; A3 s+ |. b; [
1 @8 f: [; M. h* Z xor di,di" r$ Y o y8 h/ c
mov es,di j, M0 a# G! a
mov ax, 1684h
# I' B% q |! J$ m mov bx, 7a5Fh ; VxD ID of SIWVID
2 ~) B7 L" h; z. [$ {$ ?) v2 |; @5 V int 2fh) n0 z) a. g% [. ]- v1 a
mov ax, es ; ES:DI -> VxD API entry point. f& I) ]4 n; { w b$ u' q
add ax, di: F1 i9 {' _/ }- h1 F* J
test ax,ax3 f3 W( o1 s! s' q R. I
jnz SoftICE_Detected9 \: R2 j" x3 p e- ?+ n
4 t( S: P g* h
__________________________________________________________________________/ J6 D& L' I& \, K) b
. ~# i8 R7 k4 v: d4 w* q& b+ R; l$ G/ l
Method 05
3 ?: g& `5 I% T, I5 ^/ N=========
/ @) w( I$ A$ }" F, X( c4 k& W9 M. O5 @: @: R! m
Method seeking the 'magic number' 0F386h returned (in ax) by all system6 h7 F* [+ Y6 f8 U
debugger. It calls the int 41h, function 4Fh.
- ]* b) F2 x) o8 L! x& q* I4 ]% WThere are several alternatives. 0 v4 ^8 c/ z. _% ?" Z# Y0 F
9 }$ ]; x+ H/ p* ]
The following one is the simplest:
5 G* r f4 w. h% ~( P5 U5 @. j5 K9 }% [; n: }
mov ax,4fh
: ]. H2 K9 ^0 s; ]9 J int 41h
. r/ J& j9 t* { cmp ax, 0F386
+ ]2 F8 q2 z& U0 h+ H) R% L jz SoftICE_detected$ Z Y U6 Y& P, s3 q: @! B
# M2 L. |9 x; x7 r3 P# h: T0 m" z: x- [% h( @
Next method as well as the following one are 2 examples from Stone's
6 v7 d3 F% k7 g/ p8 G0 S3 ~4 O"stn-wid.zip" (www.cracking.net):% }. p' m( ~7 f T% ~$ s) C+ f
3 u& N4 @, m2 Q! H0 T
mov bx, cs8 Y5 I2 V/ M. q7 o8 J, z
lea dx, int41handler2! s( U. k2 O1 u* O* j
xchg dx, es:[41h*4]
! f& l& Z! a O2 b$ v8 |# A9 ~ xchg bx, es:[41h*4+2]* R7 b- L" o! q; \" @$ Y J7 x
mov ax,4fh
7 k: C; L6 ^* y2 y; A3 }( f int 41h( M' ~; `* s+ s
xchg dx, es:[41h*4]
* R3 q# o8 c0 e xchg bx, es:[41h*4+2]& j' `0 d7 l7 n2 w
cmp ax, 0f386h
; {4 U: K5 R( O) I jz SoftICE_detected
* a+ }! t# [$ Y$ u1 [( C
+ \; C) m2 O/ kint41handler2 PROC
2 h: J, C$ B- o" I: C: y2 a" r iret- z' h4 Z# ^, y8 l
int41handler2 ENDP: w) L, R7 G" u9 q0 q! H
2 p0 m+ s4 [8 W6 A( f/ G
$ `. F3 W# B5 a! _6 p
_________________________________________________________________________# B; d$ M8 q+ x7 }, l
7 {3 s2 K1 n9 `' a1 X' Q4 Q
' K7 B" {: U0 {: d5 g
Method 06) X- T+ W. ~3 _; N, w$ l. p9 A4 U
=========. A7 D( o/ P- B
e" R( M. D: _4 M' Z& G% ^
' w0 f4 S1 H& f/ }3 O% F
2nd method similar to the preceding one but more difficult to detect:9 |9 V, z! C1 |% B! _0 P
+ w7 c+ q5 X3 n' }7 @7 d2 T) K
_1 t ], J Z' L6 g4 Bint41handler PROC
7 H' @5 m- ^* Z& }- _ mov cl,al
+ r& ?( K- R) q2 _0 m5 H8 r iret
+ i9 V. \2 M% h' pint41handler ENDP
1 g5 ~! p$ M+ b/ e4 O4 K& M- b
4 ]- C* u0 D0 Y
! x9 {9 l2 n! r! w1 c xor ax,ax. |# p9 I# _- P1 d/ I. o: K
mov es,ax
6 w9 Q* h- m d. U; D8 x+ |4 v mov bx, cs2 r: _/ }5 i* K6 X/ y- n
lea dx, int41handler7 V& V i4 S5 h% e
xchg dx, es:[41h*4]
k$ Y# X0 G# f% U; U' S4 B5 F. F xchg bx, es:[41h*4+2]) [5 g+ N) K, P
in al, 40h
4 W5 h! } `# Q6 u xor cx,cx
: |1 G+ W- d( [8 i# h1 Z) ~ T4 `! w int 41h
" ?1 @% X% S- M. m9 m xchg dx, es:[41h*4]
; a: j) z7 {% Y( V xchg bx, es:[41h*4+2]
+ G1 d# g1 X0 t; u2 f cmp cl,al$ |2 h' {6 `- Y) [0 l# F8 t4 ]
jnz SoftICE_detected, f) Y- E0 Z e4 M; ]7 k
- l) e7 W5 ~$ i
_________________________________________________________________________
5 a: ?9 w, v d/ b, G* _1 E" E, ~ T7 d* \: |3 K( N
Method 07
t3 o3 `3 }) V' I K* b! R' P% X=========# P( S# O- f. \
. {2 L: A- z' B3 KMethod of detection of the WinICE handler in the int68h (V86)
! [8 h8 m; p6 W# C
! c# ^/ Z0 b. s; J" h mov ah,43h3 a8 u4 ]! F& W& ?: A Z
int 68h
j ]9 W$ D/ ` u' w# B cmp ax,0F386h
3 t! z! l& Z4 ?9 r9 W# s jz SoftICE_Detected2 `4 q$ t' F0 J& i \' N
5 f" b4 Z0 m! ?( `% m x. c
% R$ G" N) N& ]" o; r=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
( }1 k1 K! k( m* t" N app like this:, W' c6 {5 t0 v
6 G$ n% L1 j) x3 A: U) |
BPX exec_int if ax==68
8 ? l; L j- x" o( X/ K1 o (function called is located at byte ptr [ebp+1Dh] and client eip is
: o% ^9 b5 m8 l$ M" C; O% l located at [ebp+48h] for 32Bit apps)
& T v; n( e* f__________________________________________________________________________
! f% W9 V K- h( N& {* j7 O- F
2 |% W3 C5 N' m( G M6 R6 K0 b. X$ b, T& W A( }
Method 08
3 Q5 X& p1 u1 s! Z6 k9 F" b=========# r6 R+ k; i# x. p9 }' ?3 _
7 W% m6 K! @7 @0 j; g3 g' Y# UIt is not a method of detection of SoftICE but a possibility to crash the) a+ V7 w% @6 n2 E# W% z
system by intercepting int 01h and int 03h and redirecting them to another
+ e8 b& ]8 t3 p% i7 n2 froutine.9 Y8 l' j( Q+ }* c6 L# z) b& _) S( {
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
: _: C; Q s5 ~# R$ Tto the new routine to execute (hangs computer...)$ x3 o$ b$ K# T, u) b
( c w6 [) L) E% E. q4 h
mov ah, 25h2 `& G0 _* m+ P7 y& y- A4 k% F& a
mov al, Int_Number (01h or 03h)
, i; C" h: ^5 [3 f mov dx, offset New_Int_Routine, D# m8 l7 m! C. _9 }" X
int 21h# }0 Z/ \( L1 R; M C) p
( V' D+ X' e# r+ U, F' y! }
__________________________________________________________________________) V* }4 R# a. Z- u
" e5 u! s9 y' t" }( D0 C6 y2 m; ?4 jMethod 09; |* ]- h8 o: \; C% Y
=========
( y$ |) m! @/ [ A/ e: U: n
9 P. f: F' e3 T# z3 {This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only2 w6 U# ?- C) w! |6 O3 E1 H
performed in ring0 (VxD or a ring3 app using the VxdCall).
8 r7 o; V% V- V; V' D/ yThe Get_DDB service is used to determine whether or not a VxD is installed
3 j( T) D+ a' T; X1 a% V7 ^for the specified device and returns a Device Description Block (in ecx) for
5 I' x6 K0 ]; H: Hthat device if it is installed.
+ k- s9 K9 y E- g4 R& o( i! ]6 K/ A" W, r R
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID9 ~) W+ A, T Z6 R0 Z4 M% X
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)! q( @7 j, [: [! J4 {
VMMCall Get_DDB6 f+ u5 y3 K3 ?. x3 t( R7 |8 J
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
2 m; I1 }- v/ l: I' @6 B
7 e# Y& r" L5 P& GNote as well that you can easily detect this method with SoftICE:
+ ^4 B5 |6 P; V& I$ a bpx Get_DDB if ax==0202 || ax==7a5fh4 J3 Q( R* E0 P6 E5 a
$ `. d* k) n6 q: L% f5 J! t
__________________________________________________________________________" d: U9 I% X, Z. t! o( ]/ `. X
, m! Y" I3 S+ P& gMethod 10- A; G5 y0 i6 v2 u1 q Y' v5 C: t
=========0 h) z) y* L% {$ l/ }
, C4 v T$ X7 S* J U7 w; h6 Z! h=>Disable or clear breakpoints before using this feature. DO NOT trace with5 V8 x4 N' k h' V& n
SoftICE while the option is enable!! i, Y$ Y$ |1 f$ d- M4 _
4 o! `4 ] i% E! zThis trick is very efficient:
5 h" F2 @2 [% t1 N" w/ jby checking the Debug Registers, you can detect if SoftICE is loaded
% W Z9 j. K2 x% T( y$ t(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
% q" P8 r4 x+ jthere are some memory breakpoints set (dr0 to dr3) simply by reading their, K# M" L& l: x& E! v
value (in ring0 only). Values can be manipulated and or changed as well3 N7 n0 r, S" ]* r) S
(clearing BPMs for instance) f7 O4 u4 R ?
& A I$ c' `; D9 G' P* _' M__________________________________________________________________________: k/ A H& w# a: _7 j- @# j
) k( q2 N& a2 J) {- yMethod 11
8 ]5 v# a0 g7 k3 a, [$ u$ A=========/ k* l0 K0 ?7 @" T' I, c+ d
8 ~7 l3 ?; \) \0 R
This method is most known as 'MeltICE' because it has been freely distributed: o) T. Z1 w8 U5 ^/ c- S3 D
via www.winfiles.com. However it was first used by NuMega people to allow
$ C* }! i; ?0 f8 c8 L! fSymbol Loader to check if SoftICE was active or not (the code is located5 m4 K' J y/ \
inside nmtrans.dll).
3 {. e9 T& a$ p2 {/ C+ d8 F
* R/ ^! O/ z0 pThe way it works is very simple:* D S4 U1 y! n' N1 ?
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
9 s8 u1 V2 r% x7 O7 BWinNT) with the CreateFileA API.( B( [% z2 |3 q2 P
5 v3 @! _( f i$ q
Here is a sample (checking for 'SICE'):
1 {. y( ]4 ]. r' q5 f8 @ l2 ?* q8 t' U" u) R
BOOL IsSoftIce95Loaded()
. g; _$ k; l1 E+ m{
1 b. K: z. @) O: X0 Y HANDLE hFile; # G1 B7 g8 a3 C2 B# @/ ~( S
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,) I2 `2 v8 \/ F" Q. q& k" E' W
FILE_SHARE_READ | FILE_SHARE_WRITE,* z* P! u5 O; S2 F0 a
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
0 C! R- W% m, s5 \! e5 y1 [ if( hFile != INVALID_HANDLE_VALUE )
8 D/ P, R. n2 Y, ]0 e( E {
( C9 V( h; A. H6 w7 Z) Z CloseHandle(hFile);; N5 e. d2 X2 |
return TRUE;
B" x' D6 W3 n$ n }! m( e! D' x$ ?0 _2 i4 S v& _
return FALSE;) D* G5 j6 b( n
}
4 B. a& J0 e" H9 c# a0 W6 `0 a$ X- ]7 k3 Q- P7 E' l
Although this trick calls the CreateFileA function, don't even expect to be
" ?% P* P6 v+ F W) q4 {/ Hable to intercept it by installing a IFS hook: it will not work, no way!
: z! W# K! M& t0 nIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
/ Y2 Q: c( U; G: I- nservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
, c' h; s. F+ w* ` m |+ t8 nand then browse the DDB list until it find the VxD and its DDB_Control_Proc
# M. x6 a- H. K ^& Z' m+ n3 vfield.5 |$ |! @& X7 n1 m$ v
In fact, its purpose is not to load/unload VxDs but only to send a 2 W% r$ u7 l( v) h/ @
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
( A9 A! ], j7 W; d* h0 Gto the VxD Control_Dispatch proc (how the hell a shareware soft could try; D4 i9 Y3 k6 v9 h: P
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
! z9 u9 c4 D5 g4 z( W% T& K/ YIf the VxD is loaded, it will always clear eax and the Carry flag to allow
8 a6 Y0 ~' l8 k; Cits handle to be opened and then, will be detected.4 l0 O: H1 q7 P$ G4 P1 W# P
You can check that simply by hooking Winice.exe control proc entry point
9 r' K5 X9 [( R8 D# Q: S9 a* ewhile running MeltICE.
7 Z) E0 v4 i1 m+ ~" c x, y- D& h* i& v( i7 h2 b' ~6 Q; d- b
6 F4 }# H# c# J" n, k4 Y% B" I
00401067: push 00402025 ; \\.\SICE
; S2 K" J! D8 @( i' e. [ 0040106C: call CreateFileA4 d1 _* B9 L$ G5 I }9 k
00401071: cmp eax,-001
. j! {& d$ p5 k& n Q 00401074: je 00401091
& h, x' h4 C8 k: f9 }* P$ ?( o0 H( p! K
( d. T6 s+ L, i' r( iThere could be hundreds of BPX you could use to detect this trick.
% G" I6 u1 M8 }! E" g; `-The most classical one is:
* H) H5 S/ O- o BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||1 s1 ~2 t% n- ]' R+ O
*(esp->4+4)=='NTIC'3 R9 S ~ n! H0 Y& @1 M
0 ?4 m! V) x& y3 @! h7 K
-The most exotic ones (could be very slooooow :-(
`3 a& H/ ^' l7 C# v* T BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') 5 b8 m! h* b' S
;will break 3 times :-(# v& B1 |3 P) ?$ h
% G# N8 n p5 q4 N* M& }/ p$ h+ L" g& c+ E
-or (a bit) faster: ' i7 W' g4 X' \* w9 S# I# C
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')/ p. `" a8 B M
, T3 |2 ~5 C( D3 f, i BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
6 D; I D" j: ~+ `3 T8 `) i" _! l8 M* H ;will break 3 times :-(
) G4 u# N1 A: ^& C* \ N, D O2 D. f
-Much faster:
$ E; t' [! `( g) {/ n BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
1 W& X5 N9 i3 G9 p2 |6 H
3 j) S/ M/ V5 KNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
8 D* H. x/ @) a4 Pfunction to do the same job:
. H7 A4 K6 P7 ^9 b7 S( o! p8 D2 v0 Y$ d+ S" S
push 00 ; OF_READ; ~2 R/ H& N/ N* T
mov eax,[00656634] ; '\\.\SICE',0( i6 U1 [' u6 k
push eax
+ a8 R0 q: @% `) w call KERNEL32!_lopen' p1 K0 `; c, m9 C7 y! Q
inc eax
; A2 y: n0 r* r5 z9 `0 N/ [* n jnz 00650589 ; detected
8 k8 Q7 T& k) {! g* E6 s8 H$ l push 00 ; OF_READ
% A9 J Y/ u- }6 I mov eax,[00656638] ; '\\.\SICE'! c. c' i$ {8 |# ~ G! X
push eax
" \+ `' a" B/ b; C( D3 Q call KERNEL32!_lopen3 [) }% K$ s: i
inc eax% m0 K6 O, Z% l( x, P
jz 006505ae ; not detected
& Q+ b9 ^6 Z! y* G, M
. y9 j9 i, u; h( \+ P$ f I3 q5 ]7 l# `, x( b7 A/ M+ `
__________________________________________________________________________# [( M _+ t9 V; g# Y/ N
- [+ X( u* D5 {& G" [. V' b a/ bMethod 12
" u; U1 U3 `. g: m& l# `! C=========$ ]* e S. m- D& s
# f+ Z8 n8 Y& Q6 F, b" q% ^' H
This trick is similar to int41h/4fh Debugger installation check (code 052 \/ _( v6 ~3 ^- P
& 06) but very limited because it's only available for Win95/98 (not NT)7 J- e( |1 W/ y1 l* M& c2 C
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
) Z+ I) {8 k* h+ R4 W @
4 Q* p" D8 d; z$ Y3 q' e8 S" j0 p6 ` push 0000004fh ; function 4fh' U- @7 u/ y4 Q$ @
push 002a002ah ; high word specifies which VxD (VWIN32)
! j6 Z: Q. C1 ^6 C2 u+ z1 U) c/ L ; low word specifies which service; Y/ N6 p7 `% Z$ F, _; t, H3 H
(VWIN32_Int41Dispatch)! X6 y) Q1 M* W) ?
call Kernel32!ORD_001 ; VxdCall
2 v9 }: f$ g; r& ` cmp ax, 0f386h ; magic number returned by system debuggers1 k/ E: v* t; \2 y) A5 y
jz SoftICE_detected U$ z, V2 T$ s$ a4 g
6 @) H# q$ q3 I% [- |
Here again, several ways to detect it:
" D. ?! j! k9 R2 ^# H8 H
/ J3 V* W0 c @ BPINT 41 if ax==4f" m* U% u1 `- _7 q
4 m) D3 u, ]2 A$ H9 w: i( I BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
+ J( H* @# w$ j, Z: x; \
- Y( j, C; ~( \- F: B% C: R BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
, a: ~! P( H* l0 Y$ ?0 Y/ f" H4 P5 A4 g1 U6 E: K
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
) z% v5 x, I9 D0 o7 W$ Q9 {2 x# c# a# h+ }: {; a4 t% O% x' K
__________________________________________________________________________3 y0 O; {) q- X7 h
) _5 C& j3 i# h8 U4 e gMethod 13" K3 w. V/ v9 h5 c$ V& r, S
=========
) z8 B; y" z: d
V! O4 W! R2 s% \8 B: g& J0 rNot a real method of detection, but a good way to know if SoftICE is. e4 ?8 O: g. N% o5 q
installed on a computer and to locate its installation directory.5 F4 m/ V6 q4 k% Z) d- a" N( i! Z
It is used by few softs which access the following registry keys (usually #2) :
; [* {* J, M( T7 M; W2 c4 ~
7 |, w- O$ R! k/ O. x-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
& x* C7 \" T4 @\Uninstall\SoftICE1 _4 g9 K8 Z+ E& Q' k
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE9 w- o7 i+ g, ^% p( A
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion' B/ @9 B. n( j5 O+ X A
\App Paths\Loader32.Exe6 j$ ?/ r5 z- ^+ I! F( M
1 d# O0 o( ?& ]
4 { W5 \4 \, H& D7 W1 A4 u" l0 NNote that some nasty apps could then erase all files from SoftICE directory
/ J$ H4 p9 o* G0 _(I faced that once :-(3 |" C0 |1 Q" ~: j. I
; `9 D& E( `9 r, u2 _/ SUseful breakpoint to detect it:# R6 s; g) d3 s5 v, t
, k7 ~& N/ O/ J; J
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'/ |0 o# e5 y8 Q$ E
5 A; L# L) W4 g9 Z6 i/ u
__________________________________________________________________________
z# |# Y( b# M; k$ b5 p8 M- V
8 q; t) g2 P4 R; J* d9 E/ L' W& I& I/ m6 F( l7 _; Z
Method 14 " Q' k( G) f) L
=========
7 b! ?' a1 u0 f0 [" N! x4 F2 r. s* ^2 X$ g
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
' w5 z$ T2 c8 m- r' dis to determines whether a debugger is running on your system (ring0 only).7 b |0 G8 \; E+ K8 _
, N# W" y# Q, B8 U( f( n$ T7 v
VMMCall Test_Debug_Installed( m) A* u2 F. w9 i
je not_installed+ ?4 s; D0 m2 D
3 |/ d! F; t9 Z: T. y
This service just checks a flag.
7 G7 x- i! K- u</PRE></TD></TR></TBODY></TABLE> |