<TABLE width=500>' D" Q; G) x0 x2 H
<TBODY>! q, p$ X2 N" ?$ Q
<TR>$ k( R, P( Q/ {0 y5 D7 g/ X
<TD><PRE>Method 01
) V) N' w& I8 @6 d( b& n=========
& [; v1 |# v/ v( F* g+ S$ H# K6 F2 B) J5 j
This method of detection of SoftICE (as well as the following one) is
, G' w6 }5 L! H0 H1 e4 kused by the majority of packers/encryptors found on Internet.
# j* {- {: z( H, DIt seeks the signature of BoundsChecker in SoftICE% j( }3 S2 J% z% X. K; ?" @ c
8 ^: ^3 h* T% Y; y: Z mov ebp, 04243484Bh ; 'BCHK'
% S8 D1 z ^5 _7 D mov ax, 04h/ }0 y1 I' V* a5 H/ I6 S
int 3 N* X9 T( e/ J8 ?) x) b7 g
cmp al,41 i, h: M: ]) e/ O! o( `; V( P
jnz SoftICE_Detected/ A" d' e9 K8 J9 I! ?+ J
+ N# \ f; `3 Q# t' G) m7 t
___________________________________________________________________________. ]! W7 u8 J* r$ S! c6 N2 G/ `, g
) l" |) A0 r+ q! w& f* bMethod 029 N |' K: D0 z- @+ ]8 {. j
=========
) {% h( m( e1 `- v% f! j; }- \5 z- y2 ~7 c
Still a method very much used (perhaps the most frequent one). It is used' M. D8 a) Y g: b. f) k* e" Z7 k) A6 W W
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,6 p4 N6 P# H, y& g$ q
or execute SoftICE commands...
" U s: y8 N0 }9 g3 @( rIt is also used to crash SoftICE and to force it to execute any commands- Z; }9 W& x$ ^
(HBOOT...) :-((
0 T6 t/ w$ @) D* m8 R
. p( f' m( ], k: i2 a7 THere is a quick description:( [; h, O" P+ s% U
-AX = 0910h (Display string in SIce windows)
9 v- u6 |" i: v5 T p2 U* u! ?6 l! ~-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
( X9 q5 Z3 m/ e# ^; s/ E2 i- j v) Q. F-AX = 0912h (Get breakpoint infos)
1 e+ o5 O* d/ m+ K3 `3 ~9 ?-AX = 0913h (Set Sice breakpoints)
3 G1 q: {8 u- T+ U+ Z. ]$ z-AX = 0914h (Remove SIce breakoints)6 V7 ]1 L$ h, v! \& V0 M" r3 b1 E# r
+ b# o. ^$ |% B& { m, o% k3 [
Each time you'll meet this trick, you'll see:% h+ L% V8 q) V' A
-SI = 4647h
# Y3 H! R: P% J7 V-DI = 4A4Dh
3 _3 r. ^1 D2 b3 ^5 X2 t# Z- PWhich are the 'magic values' used by SoftIce.4 L- X! [+ T6 U' _* ~: n
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.) J# a( O Y4 F' q8 C
P7 Q' f7 R J$ ^; eHere is one example from the file "Haspinst.exe" which is the dongle HASP1 S' j2 _ J3 m8 X+ q. p( v, z
Envelope utility use to protect DOS applications:3 C1 i# U* ?9 d0 ]# A- C# W
1 L4 Q7 U$ N1 ~4 ]9 h ~
- L; b0 l! l( t
4C19:0095 MOV AX,0911 ; execute command.
. K" Q- `' `: y' G1 b4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
; D2 k6 N4 {1 S4C19:009A MOV SI,4647 ; 1st magic value.* ~ b7 N% l# h! I! _7 c" X* v* m2 R
4C19:009D MOV DI,4A4D ; 2nd magic value.
; {: I/ Y5 y5 b1 D1 H4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)' O" g" N. E1 Z5 l
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute7 N; V$ F3 ~# \$ I- m) @$ [+ L
4C19:00A4 INC CX- y! z' X: f5 x
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
: Z5 z! {. }0 b' `0 ^' f7 W! t4C19:00A8 JB 0095 ; 6 different commands.3 s( g# H$ ?. k5 i
4C19:00AA JMP 0002 ; Bad_Guy jmp back.& C) @! I2 {, Y7 `% o8 |+ n# `
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
( W& o" `; K% v) f1 N2 c% k4 T: k8 W
The program will execute 6 different SIce commands located at ds:dx, which
& L$ V4 u( F# v! c7 hare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.2 e$ u# i9 I9 V) s0 X5 e x. f
( o$ B; L \! X: c2 d4 N* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.9 j j' u2 }, U7 I' _
___________________________________________________________________________0 q- V* h/ w7 c) @- f' x+ \
8 H8 X; g# B# X9 }, ~* L+ S" f, e
: J: e; F, g. [2 S }Method 03; P" ?: k$ j# L! a$ T i n0 g
=========1 q/ ]( r* U- E
2 d8 d3 g( J) ?8 x: wLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
9 ^! D4 o1 Z% i0 Q" O& s& d& ^(API Get entry point)
) W2 R+ [5 j m& t6 Y; z7 ^, }& Q
9 E1 ]' ^: D* m4 g3 W5 I
+ e4 N- L% S7 a xor di,di
$ Y8 v3 M. D L7 i mov es,di: ~/ Z& P4 y6 m6 ]) r
mov ax, 1684h + V9 h) \- |- @8 f( {* `
mov bx, 0202h ; VxD ID of winice
: x' d0 @: f2 l* E% C5 r5 Q l1 _. l int 2Fh& q8 K$ ?! \: n0 A! ^9 d1 o
mov ax, es ; ES:DI -> VxD API entry point
* v. Y8 }. Y/ K8 b add ax, di
) l2 F% N; h: M9 T test ax,ax
# k' E* u1 K" m% B2 I% G. P jnz SoftICE_Detected8 N( E5 f+ d* C2 K& p: e( M
) U, [- k: g K" [: P8 U# j7 R3 d___________________________________________________________________________. I3 ^. r" D" D+ x. r% u+ W
I3 N; s* C" {3 d7 j g( j% \) m
Method 045 Z d& |; Z0 d/ U7 {# E5 B1 r
=========
$ f8 \ W4 G {0 X7 e' v4 ?% d9 y* g- y5 Z' \% u* H. o
Method identical to the preceding one except that it seeks the ID of SoftICE
7 {5 Q( P0 {, L6 RGFX VxD.
5 R. V1 ?' l( Z- [8 g* ^% b! U' _$ ^" o# z) D- @
xor di,di5 i5 l$ B% M2 {0 V5 A, ?# E0 y
mov es,di6 |3 Q+ W7 j! \
mov ax, 1684h
, t. p; ~, B- y3 b mov bx, 7a5Fh ; VxD ID of SIWVID
& q) A3 e9 t, a& l int 2fh# H6 s' A5 d0 g* [
mov ax, es ; ES:DI -> VxD API entry point9 q, A) R3 j: c0 b. c
add ax, di
% E+ X: H; M. L3 U/ y* l! G- Z test ax,ax
8 I6 Q1 A5 Z f+ [ j, ` jnz SoftICE_Detected( [! a1 x2 T4 v. w3 w- Y: n
& d# g- _" u7 U% h
__________________________________________________________________________ m3 `- w9 x3 w3 a
" [9 t9 s, D) h# T4 ^
( o7 d$ ?# z. l
Method 05
9 V- n# h/ W" G7 H. H=========- J& H# ]- s8 y) W" Q! D
' |6 B% M$ N0 R' f9 t6 K* A: F: r! l
Method seeking the 'magic number' 0F386h returned (in ax) by all system2 s+ N4 _3 Y @: F
debugger. It calls the int 41h, function 4Fh.( V; c* V5 x# T0 j
There are several alternatives.
, d# x7 u0 n; K; \1 }. j, _0 s7 K6 G! [$ e
The following one is the simplest:# a' Z: X; R: F; i5 u; g4 j) r
5 C+ H7 w5 k/ d+ z% G Z mov ax,4fh& p' W$ @0 t2 x/ L# b
int 41h
0 I2 ?! G/ p1 Y3 S cmp ax, 0F386. Y: m; W" B$ m: r" l
jz SoftICE_detected# s# ^6 b- C% F7 Z: y0 v. _! w
" b4 f( t+ s9 E
2 O& ?' B8 e" D$ l2 W& sNext method as well as the following one are 2 examples from Stone's 2 i2 {) s7 O2 U0 O, C3 [5 ]( L6 t
"stn-wid.zip" (www.cracking.net):/ Z" `( i: s9 d+ B7 W- Y( K
+ D! ^: r& C9 K) u. ?$ b mov bx, cs
2 v/ m+ `4 N8 [2 k+ c" |" O) K lea dx, int41handler2
/ d# e( P1 e* C: s% v# O- ]6 U xchg dx, es:[41h*4]
9 _9 s2 a: e: M. M6 V/ T) l6 R$ T* ] xchg bx, es:[41h*4+2]7 P' h% r5 t: s+ h# v
mov ax,4fh
0 C9 Z+ \1 l+ j% `6 z8 d" K, K4 S int 41h
V3 V" f! p9 \5 _" t xchg dx, es:[41h*4]
) u5 R5 x/ r& `7 U0 m, V. c, R2 ] xchg bx, es:[41h*4+2]: X& C; F: e# ?) \* d% p
cmp ax, 0f386h, ]! ~) Y, q1 O# c
jz SoftICE_detected
+ C& j! f3 O2 X4 _% S. N3 o* g
: }. D* ] d( rint41handler2 PROC9 x' p( E9 q! H( n0 z0 T
iret% h3 j/ {; W( f& b- ^% F
int41handler2 ENDP
! R1 E) }5 @5 f: e
8 x8 L9 V1 u! z) \3 ^. s( x& [
* Q6 I; @7 N; K ^# u9 ~/ M1 `_________________________________________________________________________
) u c# C, G, i0 B% Y' a6 w: p. P5 w
0 M; y. E% c; H+ A9 JMethod 06
9 u0 o9 z4 L d=========# s& c0 k, {0 s- M3 ~
- K& R$ u) B' F# O4 W& }$ ]
$ B: j4 k3 E* \) C, P! G2nd method similar to the preceding one but more difficult to detect:
2 ?) W% }* z( k+ S, |, x, @
( g( H, Q4 i; ?, `, t" Y+ c. p( x' G$ @
int41handler PROC! H+ d' p: C5 d4 [% ?
mov cl,al
) b' a, b( U$ p5 W. v iret
) N- l t9 i" k+ v' aint41handler ENDP
( Y- x0 u0 ~, \+ R3 h' E/ {6 ~
8 E+ U; h3 N- K# Y: {+ A- W' [7 \ h1 h. d! H) V5 w/ g0 _
xor ax,ax
" j# `, T" t1 t" A, p; s mov es,ax
2 ?' V) |( X. s. S! r; G) h* H mov bx, cs
0 N: h. y7 n* e lea dx, int41handler
8 a1 x2 n- _& ~: M9 o2 O9 f xchg dx, es:[41h*4]+ j+ w+ m7 P; o2 o( z. Y( s
xchg bx, es:[41h*4+2]$ j- ~9 J/ W# d' N2 A
in al, 40h3 n" `$ f9 M+ Q" @$ f
xor cx,cx
T8 H5 R3 c1 H9 c x2 Q int 41h* Q* P& b- l4 e1 _- R" w1 `- Q
xchg dx, es:[41h*4]
4 u' U2 x" e- `0 G7 I6 N- B. k* M0 { xchg bx, es:[41h*4+2]
I0 t; c7 r5 q2 E* a, u cmp cl,al' I9 X9 q$ |- T4 L% k) A. [7 N1 J
jnz SoftICE_detected
/ T! J: p2 H' T( F8 X/ g# G
) B8 c3 }$ @/ V# e; B_________________________________________________________________________
8 b% _% C: z% o: F
: b; y' [+ A' I1 y2 D- fMethod 07# E2 D7 b9 d3 @4 @2 P) r$ N- ^
========= k/ s: T6 v' [# o' j7 X2 K2 [
4 m1 V% a* Q) K0 f
Method of detection of the WinICE handler in the int68h (V86). _) m, H& }' l( ]0 |% [! f0 ?7 R* s
: Y0 E% A( T, h1 g: r& O) _. X
mov ah,43h
5 v% r8 r( M" S. O1 |: a+ ^ int 68h
3 [; h b" T" Q# D5 v cmp ax,0F386h% F5 E6 a2 O E- q i2 P
jz SoftICE_Detected3 P. U$ s [6 _1 J/ N
- [- j2 o9 R' l w' [* N9 G
8 v- C: O/ ?2 ^3 q0 `=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
# R0 W# D9 I8 m% i# w% d app like this:1 M# `. r: `9 b: q/ N8 b# ?5 ?- D
% _+ e& M9 {% ]2 @ BPX exec_int if ax==68
% `8 L% d' x+ x2 ]3 S (function called is located at byte ptr [ebp+1Dh] and client eip is# k3 L9 P' F" s
located at [ebp+48h] for 32Bit apps)
2 \- u% d; m) c! ]: D__________________________________________________________________________
6 J) {+ D! }' Y) M' {% C8 z
/ z( D( c! L& B$ f) n! M% Z4 g8 V& G A' m% L
Method 08
# ?: E/ k- r- ]0 }=========% z' {5 D$ ?5 y( w R
( a& A. e1 A& }. P1 fIt is not a method of detection of SoftICE but a possibility to crash the0 A( z/ W+ T [# c- C5 m! K
system by intercepting int 01h and int 03h and redirecting them to another! q4 J4 [' t* I, ^* O% A
routine.
* m: {- m# Y; T1 M4 b& h. d6 BIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points1 N9 g/ U& J! F1 a+ R. t5 m# W
to the new routine to execute (hangs computer...)6 ?1 X. u# _3 h3 @: } }2 }
/ U& C: F: a# n% e+ Z mov ah, 25h
9 g+ U5 @* k" t7 p! D) b mov al, Int_Number (01h or 03h)
3 [; } v5 Q( Z' F- n: n mov dx, offset New_Int_Routine
# @( o; T/ r$ V" V$ z( w int 21h
8 f3 l$ ?% G3 t9 v3 d" M
# {9 Z0 h5 k: h( C. O3 l+ [__________________________________________________________________________* N% l& p t3 v+ ?
6 M f% J+ {) @0 I, O
Method 09, |( \$ N8 g6 }2 h+ R/ g
=========# W+ s& B& b6 H, X4 S' w V* }
; @3 l) |3 K4 ?, t0 g3 m! w9 a! ^This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
" ] W$ q/ k0 m9 Uperformed in ring0 (VxD or a ring3 app using the VxdCall).
; s0 L Q& |+ A* n7 n& {& O/ s6 PThe Get_DDB service is used to determine whether or not a VxD is installed
& e- N7 _- H6 c4 m$ {* ifor the specified device and returns a Device Description Block (in ecx) for1 c5 i- V/ b. n6 M( J
that device if it is installed.
2 _# C( x' t b1 F1 C/ a- g$ q& t& j, W* v
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
& `8 d; q7 Z" b" H mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
/ z' @8 P1 ^! p7 U VMMCall Get_DDB2 d8 n x% ]1 H$ Z
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed, y2 n: h1 t# @ E9 w4 I: S
$ i% q7 X) x- }% _9 d" TNote as well that you can easily detect this method with SoftICE:, T; y- d/ `3 V9 K! u, a3 x
bpx Get_DDB if ax==0202 || ax==7a5fh( z$ r2 I" Z9 @
" F1 h; i3 L1 ^2 W__________________________________________________________________________( X! U1 V7 ?% V* C5 m) V8 J
( o" O, k1 |. B
Method 10" I/ A# s, [+ F, p! K
=========
* F5 ~$ b* C7 R- e4 B5 Z& f2 | a E p
=>Disable or clear breakpoints before using this feature. DO NOT trace with
7 I/ _; L6 V( p SoftICE while the option is enable!!; ?4 F) I: B0 R) E$ T+ P* c
6 X$ F; _- ^+ a1 l% A. X( G$ m
This trick is very efficient:
! w q5 @7 b& ]$ \& c& z/ i& n' Cby checking the Debug Registers, you can detect if SoftICE is loaded8 `4 {4 j! _( t' ^4 N
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if+ b- M1 y. @9 R$ N9 J- o
there are some memory breakpoints set (dr0 to dr3) simply by reading their
4 N, V* f* ]. qvalue (in ring0 only). Values can be manipulated and or changed as well1 s4 f' ^2 Q& |' `: {
(clearing BPMs for instance)" r: [4 e w: n
" B! E4 M4 @$ d, r$ `
__________________________________________________________________________
r: o7 M5 ^7 t- L4 Y! Q; \
) h! o( Y' a& b2 z" A/ J- ? PMethod 11/ z! H& g( Y0 _3 F ^' Y
=========! d. \4 W- g1 F: |5 I7 L1 X ^+ v
4 d q/ @5 p0 P% [* b$ y4 j
This method is most known as 'MeltICE' because it has been freely distributed
+ \) M6 a: e8 B zvia www.winfiles.com. However it was first used by NuMega people to allow
/ M ]" W! {% A, R, y& j2 ?- ySymbol Loader to check if SoftICE was active or not (the code is located1 ]2 c4 }! }: b
inside nmtrans.dll).
7 X. e! Z+ a7 @7 z
* h, W7 K l" J. EThe way it works is very simple:; I, ]( t& E! e; s
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
: I: @9 m4 M8 B: ]% Z! PWinNT) with the CreateFileA API.2 b! q e5 A" [4 x$ g
3 F& }& t* |0 o `Here is a sample (checking for 'SICE'): i3 A* L8 }* `: }- {8 o
( u' q0 y3 |/ H
BOOL IsSoftIce95Loaded()
0 E& ~& S' p5 g{
/ {' X7 `# @) @- Z3 C E) f HANDLE hFile;
/ J1 G& i) h/ h/ _+ k hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
7 h, Z6 L% k% m" A1 X) f! Q! s8 N FILE_SHARE_READ | FILE_SHARE_WRITE,* b: ?1 _7 f7 E! @5 }# }
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
9 q; L6 r4 T; l, A6 i" ` if( hFile != INVALID_HANDLE_VALUE )
5 n) h' ?, G+ F: k& u1 W9 q {' U8 H2 \/ Z4 R, ?1 C
CloseHandle(hFile); T, n3 e X: S6 Z$ ]$ n5 D4 e! H% O
return TRUE;1 u* s+ o) m0 y, }" ^; X+ U9 W
}
3 E7 f5 j$ H) J' } return FALSE;5 x2 a- v9 Z! v1 `: N: Q; x
}
& [+ \; V+ R8 A" L8 S9 E) B' T d& K! J l
Although this trick calls the CreateFileA function, don't even expect to be
9 q6 y7 u; B% a0 b$ h$ Kable to intercept it by installing a IFS hook: it will not work, no way!
; G9 c: c- Y" k# |In fact, after the call to CreateFileA it will get through VWIN32 0x001F
/ I/ d0 z: \- eservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
, d- M( h5 b6 p/ X! c: tand then browse the DDB list until it find the VxD and its DDB_Control_Proc
, h. E. f# R* V& _field.- U# [( y/ ^6 H
In fact, its purpose is not to load/unload VxDs but only to send a
# I4 `/ k2 p2 H5 tW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)" S! S& {% c" v9 f& a0 s: [# _
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
% A; V- c* Q% T" c) Ito load/unload a non-dynamically loadable driver such as SoftICE ;-).
( u9 w H# o$ s* d3 VIf the VxD is loaded, it will always clear eax and the Carry flag to allow
8 @( w" H- m9 C4 tits handle to be opened and then, will be detected.1 }# n6 h& L4 |, @1 T: d( G W0 R
You can check that simply by hooking Winice.exe control proc entry point8 g% [- K+ F& m$ X
while running MeltICE.
" L0 B9 }! I/ \- ^' P; E e) n; T
& I9 g2 e9 f& j! w
00401067: push 00402025 ; \\.\SICE& z. p3 M0 ^, c- a3 }8 K& Y+ b
0040106C: call CreateFileA! n* ]& N$ q2 N+ N3 X
00401071: cmp eax,-001* F' Q- X& g" S
00401074: je 004010917 G0 O: W/ C% L5 t$ u, A/ e# V
4 w6 D( `' S. ? T+ y# ^
T) \0 L" y3 N' g8 b. tThere could be hundreds of BPX you could use to detect this trick.
! j0 \& V! G) R }( h9 a-The most classical one is:1 S: M9 p& R/ _$ G: m3 `$ `+ ]
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
: V- b) L5 Q% I- b* G- H *(esp->4+4)=='NTIC'
9 x" h( _9 T( h {! N9 M* t& }: F" R/ y* w+ T' e- L6 ^+ e2 Y
-The most exotic ones (could be very slooooow :-(
( I: y3 o6 r( G BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
. W( J+ F0 j8 z ;will break 3 times :-(
2 N* n$ U- y7 u; t9 M" h4 R. h3 h
-or (a bit) faster: & A$ R4 T; d& b U2 q
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')" l6 [; ~$ Y' a4 a6 | K3 C
i1 \4 n& m. h0 p- d BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
' {! r( U. S& z7 n! _3 f ;will break 3 times :-(
. E7 k, s% v6 i7 a4 a G s% u! m. a2 w, M: g$ s5 H9 L
-Much faster:
% N) @ X, U. S BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'4 o( A; v1 v" [! }# F" P# G
+ a3 I$ O+ f5 V* E9 ?5 H2 U4 TNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
& c) E# `- @3 J( r+ |function to do the same job:
4 x5 q& ]0 ^+ S' Z9 M i, E4 J+ o2 p: X7 Y
push 00 ; OF_READ
6 y3 n: L ?# L. h% c u mov eax,[00656634] ; '\\.\SICE',0( i% A( p9 W3 z5 X% v4 L
push eax
2 ~/ I$ y7 F- _: Z% J5 H call KERNEL32!_lopen
( J$ x3 ~) N' S9 a8 @) W1 n% I inc eax! i9 T6 f9 `( k1 P
jnz 00650589 ; detected
% s ^; m2 d: o& V/ p push 00 ; OF_READ
: d: x' e |7 |- O& V2 `* Y5 \2 w mov eax,[00656638] ; '\\.\SICE'+ D1 I w4 D* s. \7 }% a9 {
push eax
) v8 z0 Z( o/ o call KERNEL32!_lopen2 T" J5 t, {, u5 O( ~3 h
inc eax0 q5 _* k$ Q! y! z1 c1 @
jz 006505ae ; not detected
( L; {8 C: Z1 z2 H+ c0 ~
, n+ Z1 M; M1 l# e& N# h+ V
6 r5 X3 I' r4 N& I/ j4 ^__________________________________________________________________________) c3 r2 q$ a& c+ }
. j( \, L: C Z
Method 12
2 X0 F, _- K% V4 J1 U: z8 Q=========
$ Y B$ d5 i, L1 i8 `% I3 @0 t
9 J6 p6 U! r/ D' J9 f2 g. W4 T' oThis trick is similar to int41h/4fh Debugger installation check (code 05
4 g+ {+ L9 A4 t* K& 06) but very limited because it's only available for Win95/98 (not NT)3 @% }; W) Q) l
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.$ H3 @$ D, U( y/ B. J/ E9 P
1 P9 g; a) S% d push 0000004fh ; function 4fh
0 V! X2 z% j$ ?* U push 002a002ah ; high word specifies which VxD (VWIN32)
' W! u4 P2 u( a! h6 s ; low word specifies which service
& U) p y7 d! D6 |% q# [ (VWIN32_Int41Dispatch)/ I9 ]. `7 K1 I$ \4 S* l
call Kernel32!ORD_001 ; VxdCall
& T, u2 z2 W6 `' u7 s" b cmp ax, 0f386h ; magic number returned by system debuggers
7 ^9 W. Y5 ~" a g0 o9 _ ? jz SoftICE_detected
& S: w# C6 \# U6 F* p. v- b' t" D6 v9 |3 h- `7 x `; `3 e( `
Here again, several ways to detect it:5 z. v% Q! I% B3 c0 u
& p, x- |: I0 ^8 h8 O' P
BPINT 41 if ax==4f
& @; i! k M5 V/ @5 R9 O/ m+ \" V& t" p6 z3 D
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one# `- l$ I% ^$ a7 M/ X
! p Q& R4 t8 S, w" u* I BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
+ r$ S; g7 Z- @( {: X' l2 G5 J( a% U( n
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!. B5 R* V V1 s0 v# c
# E3 M$ _, O$ G6 N! [__________________________________________________________________________
* e# k3 O+ ^5 A- X. s
6 w# ]5 ?4 ^0 l% S2 eMethod 13& a( A) z$ v" [. \
=========
: A7 ^$ I, I4 g: b1 ~* ^) k0 V( }4 N" S
Not a real method of detection, but a good way to know if SoftICE is
) p$ w/ ~* b# j& `; {, linstalled on a computer and to locate its installation directory.
, m* ~; r; K1 r: tIt is used by few softs which access the following registry keys (usually #2) :0 n* Q( V& \ k* x5 b0 P6 O
* T" W+ [$ [: D* [+ C
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion$ L8 ?- P) ~4 _9 ]
\Uninstall\SoftICE
S7 U& L/ c+ ?-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
% P- }+ R* @- `# g# e-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion3 \ ` {, M( K4 g
\App Paths\Loader32.Exe4 J Z% _7 ^3 r) _; e. m
* v2 l4 z( s2 b2 V+ ?8 @$ L6 Q) u3 C7 B
Note that some nasty apps could then erase all files from SoftICE directory
- k; D7 Q' C: W( I1 |( V& s: D" R(I faced that once :-(
& j0 {6 ^0 C+ n& q5 D% z
" F3 t* v+ i/ ]! SUseful breakpoint to detect it:0 r7 m0 _6 L; T: k, p K
: n) ^ d, K+ \ _$ A( u* C) d BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'& c5 x" j! O, \1 o, m+ @
$ S- O& X1 Z3 x/ U1 r2 X6 q__________________________________________________________________________, B' T/ `2 [- {2 V7 i
# p6 c9 L5 k/ r* O- \
+ T; }8 i3 q, z$ C
Method 14
9 q6 B8 j. B* e# i=========; ]% V4 K6 m3 u) f o$ U
3 g; \0 e8 P5 P! e8 R' o
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
3 r! ?4 G9 o4 r; y/ qis to determines whether a debugger is running on your system (ring0 only).$ |3 l: B5 S. J% W; v6 u
4 A% L: ~+ J" S9 E0 @* | VMMCall Test_Debug_Installed4 Z' e# q& C' `
je not_installed
% a! K- p3 ?& G5 p! `3 d& j+ f* U
; d5 q% y% `6 a u0 eThis service just checks a flag.
% u: `0 d* b. a$ J</PRE></TD></TR></TBODY></TABLE> |