<TABLE width=500># l" r" Z& _/ K
<TBODY>
1 F( d% U2 r4 A8 p$ u<TR>
3 i# B# s0 K) R<TD><PRE>Method 01
1 M2 _1 |# R: N c8 d I=========
% u' Z8 z8 g' z) Z# _, }2 W3 Q0 e2 ~
This method of detection of SoftICE (as well as the following one) is
0 d/ k5 f9 R s) J, Y3 dused by the majority of packers/encryptors found on Internet., e+ G7 T$ T* m, f! }$ o0 H
It seeks the signature of BoundsChecker in SoftICE
' s/ |% f" _8 y* A. H- N: T C- R7 Y, R$ t
mov ebp, 04243484Bh ; 'BCHK'
5 i3 z8 L8 f L0 l9 V1 B+ _5 T mov ax, 04h! p6 Q* L9 P8 S; X4 F) E( F" A
int 3
0 C. E# Z t3 N& z4 W4 k cmp al,48 Z `, |5 [" V# ]6 b
jnz SoftICE_Detected
/ V, F2 j+ A8 k
, c' u# e( Z4 O, f4 G# ?8 s___________________________________________________________________________; h5 A* Y, i: R, l$ Q" w
' f- X; w" v8 J7 b
Method 020 ^; y+ g$ H4 z- {2 G; e
=========0 W/ v d& w9 y( W6 Z0 r
' `6 L# G0 S6 eStill a method very much used (perhaps the most frequent one). It is used
6 K& o. r5 x5 {0 \' w. nto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
, L5 ^% F5 m0 aor execute SoftICE commands...% I, {" S: V* w" x
It is also used to crash SoftICE and to force it to execute any commands7 G2 B# c$ t- _7 m' U% K( f
(HBOOT...) :-((
# O S. o+ l0 p4 m2 A) K" B& {6 p" b$ i" }
Here is a quick description:
+ ~0 Y" v; a' r+ H+ l+ Y-AX = 0910h (Display string in SIce windows)
. G2 m$ j: k9 l; n2 \/ T4 B-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
1 E3 A* @ h+ c& {# R-AX = 0912h (Get breakpoint infos)
& [: I; J3 ]' B: T" k T7 y0 ?-AX = 0913h (Set Sice breakpoints)' p# i. {* s, s7 n9 k
-AX = 0914h (Remove SIce breakoints)
) h" t# g, u6 L8 O* m& Z# }0 y% G$ B
Each time you'll meet this trick, you'll see:* X6 ?8 M5 o& l
-SI = 4647h- h' ] Z5 `1 Y- _( V9 Z
-DI = 4A4Dh
$ p' R. {- e3 ?4 kWhich are the 'magic values' used by SoftIce.. c. y$ \/ a: y: S8 P- W% { f8 m7 g
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.3 X; O2 `' V2 ?5 y6 d) W4 X* @
% }) D1 e( F9 K8 U ?: N
Here is one example from the file "Haspinst.exe" which is the dongle HASP
& b$ |2 G# T* [# f2 h& gEnvelope utility use to protect DOS applications:" J/ \; j! r0 i
1 P/ m' w2 B3 V* }% g9 R0 t5 o; r+ m* p0 s7 a% m& \. t3 G- N
4C19:0095 MOV AX,0911 ; execute command.' y/ r8 Y: F) L5 V4 I
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).5 Z& b/ u8 G( v3 M H$ G
4C19:009A MOV SI,4647 ; 1st magic value.! Q% v4 l2 E( M
4C19:009D MOV DI,4A4D ; 2nd magic value.
+ |* k6 ~/ ^( H6 d% X4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
% l: t$ ~( `& R' o1 h% J4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute: o8 V# D! V$ f/ p( ?
4C19:00A4 INC CX" G% d! F; ^3 W% d
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
% n5 M+ B# f6 W" K4C19:00A8 JB 0095 ; 6 different commands.! |6 I0 M; v% S8 U* {" G
4C19:00AA JMP 0002 ; Bad_Guy jmp back.
# F! T, D4 \. g* j, p2 w1 c! q4C19:00AD MOV BX,SP ; Good_Guy go ahead :)! s* }6 G3 O7 M# }9 `4 ~& o3 K
\* U: j7 m3 T! a4 y. T( [The program will execute 6 different SIce commands located at ds:dx, which
- R7 B ]8 s( Y/ Gare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.& l" w/ j% {, t, b0 ~$ m
9 o6 ]2 F& E$ Z3 Y+ I* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
) M* |3 ` u4 w3 z___________________________________________________________________________$ |2 q: C1 c* I: k7 q6 ~" O
1 e5 P% U1 v z2 e3 z& S% G4 Y
1 n5 Z/ H0 g3 ^" D7 |Method 03* ]# Q7 i+ v1 J( N+ J% G% H
=========
* V5 e% |' Q3 P6 d3 }7 Z! q+ S% P3 c
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h# |6 f* G9 c6 F6 z$ G$ u
(API Get entry point)4 m2 V: N' l( X6 w+ J1 w
, p. h P! ^. O. n+ X, I( A
0 k1 v+ e6 r6 X$ L
xor di,di
' \# c* h- d1 P* { mov es,di/ F5 W& [3 W, G% ]
mov ax, 1684h
0 n1 }2 _+ }" k6 e' k mov bx, 0202h ; VxD ID of winice" I Z# _ Q9 _' a
int 2Fh; y" V1 `6 q* ?, w3 m; w
mov ax, es ; ES:DI -> VxD API entry point
% ]7 r8 d2 w+ l3 F5 ^ add ax, di9 ^4 ~ K8 I4 H8 j- B! ~! y2 n
test ax,ax
0 r( D' C' y8 R jnz SoftICE_Detected; B2 c1 G+ ~" ]$ b5 a$ H* |
5 E8 {# n& ^- o& Y8 R. v
___________________________________________________________________________
( h7 h$ _9 Z( L9 l# Q
- @% H& E5 N% q# z, P) _Method 04
( r' ^+ ]! _) k. ^' V8 X5 D! V' G=========2 n* K ~2 k2 s& o7 L; {0 s, i
3 K; `! q0 E- |! m9 n/ C5 F4 A
Method identical to the preceding one except that it seeks the ID of SoftICE
' @1 g( }# B* ~7 j XGFX VxD.+ y6 V6 c* {, {4 W' s* P
( F/ ^* n& N) t/ G: [6 L" k- V xor di,di
) M; j% R, @/ L& n) k: b+ ] mov es,di
' z- n1 i: ^$ t mov ax, 1684h
1 q7 j6 o) u4 h: j& M! I mov bx, 7a5Fh ; VxD ID of SIWVID
' e E# m4 E5 J9 H! ^ int 2fh# D% [! \! X6 \
mov ax, es ; ES:DI -> VxD API entry point5 }+ H: h6 `; f6 ?& F5 E
add ax, di0 P" [; p6 b1 g& E% n9 \
test ax,ax
- Z2 x& `3 e5 F; J( Q$ T jnz SoftICE_Detected/ R3 b! l1 O# B- { t
- _5 V4 z) i W6 \4 v. L__________________________________________________________________________4 `7 G( `1 m8 ]3 r& \3 }
3 [8 {! C: U4 R
l2 L# W) u# K! [" m& xMethod 05) g0 j4 h) p& c3 u6 h. a2 R2 G) X/ E
=========
: d0 S1 o5 X* ^. N6 Q% e; F6 X2 S' L& H9 o3 b! J# d5 |
Method seeking the 'magic number' 0F386h returned (in ax) by all system/ x4 l8 p3 c! E) x% l
debugger. It calls the int 41h, function 4Fh.
7 D$ O' {0 b F, Y* {There are several alternatives. " y4 E+ m' C& l1 i( x+ Z. F
+ t. {& m( R+ s4 D8 E5 n8 Z; U UThe following one is the simplest:
8 I; K1 g2 R' P3 W3 s+ W- c5 x# i: g; U0 O+ w
mov ax,4fh
) f5 B4 @9 o1 j int 41h( s( K$ n8 ~% X5 o/ I
cmp ax, 0F386
- X, L% e8 y, s/ n3 V jz SoftICE_detected. a0 c; F& t$ |( j1 v) Y/ P5 k
2 F! g: X2 o" w* t2 P* D4 |
) A( G+ d! [* {" e% n f" {2 @Next method as well as the following one are 2 examples from Stone's ' j: }2 M5 n3 s- i4 Y/ W$ a; d% j
"stn-wid.zip" (www.cracking.net):
1 o9 Q l& t& [+ \2 i) u3 y) g( Q& m1 \1 ]' ^4 c v+ a7 A1 R
mov bx, cs+ _ Y+ \& h; S% I
lea dx, int41handler2. c5 R0 J( h, a8 p7 }
xchg dx, es:[41h*4]& S: O$ ~3 {( s4 N; O
xchg bx, es:[41h*4+2]1 v# ]& N) E& g
mov ax,4fh- t A4 M, \3 z7 E" k# m
int 41h
4 r/ B7 y$ c; v7 ~4 U, Q+ h xchg dx, es:[41h*4]
- H; }. Z9 b; ~ xchg bx, es:[41h*4+2]
1 E) h' f! g7 S/ z% V# E cmp ax, 0f386h+ |( `8 }2 G* X
jz SoftICE_detected
. c& d; O! _0 Z( w8 k# u, f% K5 Q3 v$ o: y/ h5 `6 n5 A \
int41handler2 PROC
5 r. |- @+ m, s6 \- u iret7 F1 R4 m9 i- R( R4 B3 e- H
int41handler2 ENDP+ S8 D) s( m4 k
. v' M, U6 C6 L9 z' T' y5 ^0 }( J% I" `
_________________________________________________________________________: `! g- H, L$ e+ s" Z Y( A: ^1 d
# m4 k2 j5 D' V4 j1 E8 C8 e. @
' [! i. c y( W+ o& j
Method 069 `. t- p) H5 T3 {% S8 I! Z$ ]& U
=========
3 N! P y, z" @+ c: c! M
2 H0 {3 k" V. }- _% J# Q8 f) Z$ I5 U; e: f+ v9 X: x( y
2nd method similar to the preceding one but more difficult to detect:- y$ G5 b9 ?8 r; V# f8 ^# w+ V
. V* g/ O% {0 l4 q6 Q& g: D+ S' k" }
int41handler PROC
, p; t9 ~& R8 F( g5 h( l- ` mov cl,al
) K! K: \* @9 K# [+ t1 h) c6 `1 T iret
" S3 X% Q( ]/ |2 ?- M* j8 Z; e& v7 eint41handler ENDP c" m1 p) \/ N0 M( E
, u0 f [; K9 T$ }, R+ v! H6 S V- Q2 q9 B. n8 N {& o
xor ax,ax
) ^ X4 @1 t6 _( [. K w6 S mov es,ax3 T, ~$ n) i p
mov bx, cs6 u* b g. r2 B1 m4 [
lea dx, int41handler
0 T$ W* Z* w+ n H8 }$ O" }, s xchg dx, es:[41h*4]
# R# A+ ?- G! ^% e3 R& Y/ M xchg bx, es:[41h*4+2]
( a6 J" h% F6 n. T in al, 40h6 W" {* K; f0 ^1 j9 n
xor cx,cx
5 z4 S& O8 i# R' } int 41h( }, N9 Y& N5 F
xchg dx, es:[41h*4]
% ]; S4 \# E( D- D- ?) o xchg bx, es:[41h*4+2]
' k' g& [" r1 n! W7 R cmp cl,al
9 {' r1 C+ z- N/ B" ^' ^ jnz SoftICE_detected
+ o k" v3 Z" j
3 W. i7 {) l5 y1 \; ]/ g L( `4 ?_________________________________________________________________________
7 [/ q9 F3 h- J1 \3 v6 X* Q3 J# b# I8 W: q i! v9 f$ z
Method 07( I4 ]- ]# b$ q& k
=========
/ ?9 J2 {( @; c/ ^! ^# ^$ R5 n# ^8 g% X7 v% a
Method of detection of the WinICE handler in the int68h (V86)
" D4 O; G$ O' w! \* C) {* D
: I c' x8 v2 J, F mov ah,43h
+ D: E' r# r2 U; e int 68h
6 K. a' A/ o- T; p. I! Z9 A/ w# l cmp ax,0F386h4 ]7 }( \! g3 f i
jz SoftICE_Detected
* y+ t. o% o8 r/ j b8 b4 S1 f: u" {2 L3 j. u, x! x# P
; G6 _8 s: x) ~/ {
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
; n! m1 W% n' A' F' A8 b app like this:0 y2 c$ e% C. k+ g! z- \
# F9 v% L5 l3 H V2 H1 G BPX exec_int if ax==68
x0 x7 z2 d" i5 W( V: r9 ? (function called is located at byte ptr [ebp+1Dh] and client eip is0 \1 Y. ]& l: s0 O/ F
located at [ebp+48h] for 32Bit apps)
7 j6 Y5 x5 o5 g4 K; E0 S__________________________________________________________________________$ a' c L$ P; z* A5 `3 a5 G- z& y
! d' Q% @: f6 b1 p
, |. C# K+ ~ K( o$ l" ^Method 08
" z1 u7 y* ]- Z+ j6 [# x=========& w7 {! K% D! W1 d4 M) q
$ N$ Z. y+ M0 w2 _/ iIt is not a method of detection of SoftICE but a possibility to crash the, T; q7 B+ m5 [# A! P( P! F& {1 F
system by intercepting int 01h and int 03h and redirecting them to another3 ?' Q& d: K+ o
routine.
3 d6 C3 V( u; RIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
# s8 A. a# `! l% uto the new routine to execute (hangs computer...)
* F' k( c# b4 `( D% c# p ]3 n' W: }7 t( {0 E5 L& o. k
mov ah, 25h8 t6 G/ g; J1 Q" D- P( S
mov al, Int_Number (01h or 03h)
+ l! l9 `9 [7 S! `3 @ mov dx, offset New_Int_Routine, }9 a6 Z- L0 v2 X% X0 y; f
int 21h& u) S l. D" V5 _' S
5 j, K. B5 ?: C( E2 n# ], `__________________________________________________________________________
, h/ s4 n$ G- J# U
* S+ S" E' S# Q5 |# cMethod 09
. ^9 S1 t7 m. f=========8 T- q' {2 g% I+ r2 S
$ F2 n% B8 l! CThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only. o) P/ e9 F x$ M% w/ Y
performed in ring0 (VxD or a ring3 app using the VxdCall).
+ N: l- Q$ j' D$ s( cThe Get_DDB service is used to determine whether or not a VxD is installed
, G' |' q" G* {& d3 \' Efor the specified device and returns a Device Description Block (in ecx) for
4 C# N5 M: ?5 k3 Wthat device if it is installed.
% G. |9 P& P5 Q G3 k! a8 `5 k3 d( R% O( {) H: s2 W
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID! p( g n- D$ r) h: U) A
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
1 v# y8 U8 E8 d- a F" j VMMCall Get_DDB
, i" S6 R# s. n& S, u) y mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
$ U& x" [' H: p0 ^' _% i/ F- i) K. @* v# Y {( K3 i) T8 ?3 X
Note as well that you can easily detect this method with SoftICE:& p! @; X# t. Y
bpx Get_DDB if ax==0202 || ax==7a5fh. o; Z+ T( H; x5 ]
# j1 x* o3 a1 A+ F+ {__________________________________________________________________________' a2 } U6 C$ V; ^& ]
" P7 L4 M @7 d8 r! V
Method 10$ o6 y4 k- k% k' A L! d4 V
=========! [/ ]4 N7 i/ P$ s9 k6 u$ o
$ q9 l* C! L1 @
=>Disable or clear breakpoints before using this feature. DO NOT trace with
* o5 n4 }. N" P2 m1 [4 L SoftICE while the option is enable!!! U) n+ n/ r2 n/ s4 c* \9 N
0 e6 Z7 [6 N9 A+ @This trick is very efficient:; J" \7 R* M1 L3 p
by checking the Debug Registers, you can detect if SoftICE is loaded
7 G; X6 [# m- L6 `(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
/ j E! b/ a3 ythere are some memory breakpoints set (dr0 to dr3) simply by reading their* r( F. Z4 o# ]) T, S9 [8 N
value (in ring0 only). Values can be manipulated and or changed as well1 E' z( Y$ i% N7 K7 F) |
(clearing BPMs for instance)
$ }9 @7 o/ l. j+ v5 ]* k* |$ z! |' u7 l" g" m$ c1 j9 o
__________________________________________________________________________
, S( ~, C' t, x2 {* \" T1 M: \/ T9 t* I3 N6 K! B" ? T7 m' M
Method 112 V$ q M: n$ u9 ]2 V7 g/ l2 a
=========
( V7 l# {" _: U `! e% `) i; r* v
# ]$ N1 z7 U4 ~4 w! Q4 J4 oThis method is most known as 'MeltICE' because it has been freely distributed- [* u, \# R) p
via www.winfiles.com. However it was first used by NuMega people to allow4 P! w& @; }7 M0 |
Symbol Loader to check if SoftICE was active or not (the code is located" f* O# J$ W" p4 S. }
inside nmtrans.dll).
7 j# s! f1 n/ {% F& H4 a- o+ l
' _0 c+ |6 y/ r3 @6 oThe way it works is very simple:9 C! d3 F+ V( A
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for/ d9 m5 e/ i c- [% X& p
WinNT) with the CreateFileA API. J) p: v5 M Y9 q* x1 h
8 t, {$ L! U& Y: L. VHere is a sample (checking for 'SICE'):
& p+ h9 O1 c( Q% ~5 G9 u) c# q. E7 k' b9 a9 |0 B ~. n+ A- r, ]) S6 f
BOOL IsSoftIce95Loaded()# f# o; ^5 G; F# i2 P3 L, p
{9 {2 T# Q6 B# E: @8 c X' Z
HANDLE hFile; % H0 S& \4 b7 C7 H, v* e& Y
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,* ^2 q- n K: D+ p; b' a9 Y
FILE_SHARE_READ | FILE_SHARE_WRITE,4 z6 ^* s0 e: X8 _. b$ \
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
& j8 d" X- v# F% e( R- }8 m if( hFile != INVALID_HANDLE_VALUE )# D, ^( `: E4 }+ v9 c" y1 `
{
9 e8 X) x l" ~6 v4 _( l CloseHandle(hFile);
7 w5 ]7 d- p: D* g; h2 n/ f8 \8 F return TRUE;
' ?* m/ y! z [ }5 W }0 C. a& U4 k ]) M7 {
return FALSE;
% u) N1 e% t3 j1 ~' a}
' L( p9 V* S9 }
) x5 x h5 {3 t& q& eAlthough this trick calls the CreateFileA function, don't even expect to be& \( Q, c G- r% N! F0 \
able to intercept it by installing a IFS hook: it will not work, no way!
- C% ^- K: N' d/ V" K1 n4 eIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
: L' ~! h+ A6 t0 z7 bservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)+ v, m$ N5 S4 ]
and then browse the DDB list until it find the VxD and its DDB_Control_Proc! y9 A1 m! g, ]7 j8 j
field.
, G+ j- k9 i$ |9 CIn fact, its purpose is not to load/unload VxDs but only to send a s3 x9 p7 h: I/ v
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
1 i7 f8 t; L9 C7 T9 L3 p: ?/ b0 hto the VxD Control_Dispatch proc (how the hell a shareware soft could try
3 C, q$ ?7 x* d8 _0 L8 ^- ~to load/unload a non-dynamically loadable driver such as SoftICE ;-).
6 i9 |% w+ ]5 a3 TIf the VxD is loaded, it will always clear eax and the Carry flag to allow
) l- L( {, N1 B0 C. C7 Yits handle to be opened and then, will be detected.
# V8 N) K1 O' t z7 F5 zYou can check that simply by hooking Winice.exe control proc entry point- Z; w, @0 F. L/ f! u( ^5 {
while running MeltICE.
$ e1 n. M1 u" B0 f. g
: \7 [6 @# \1 ~) L8 U; V& x3 v, L/ j ~4 M8 A2 d2 D% K3 z1 K z* k
00401067: push 00402025 ; \\.\SICE
, |& _$ R, T. S/ a0 m& z 0040106C: call CreateFileA
1 H. V1 W+ B( l9 A6 \' y 00401071: cmp eax,-001
" `$ V3 Y* ]* B) z L. e 00401074: je 00401091
: M3 ]2 D; N& M1 G o- b* ^0 Y2 C/ F3 o) Q4 P9 Y( m/ v
, r( T; U6 a* H
There could be hundreds of BPX you could use to detect this trick./ x/ E+ K% v& `3 n
-The most classical one is:
8 [5 y) n+ l5 F4 O& G# ]% M BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||7 o" C, P A2 M
*(esp->4+4)=='NTIC'. U/ e- d) l4 [; {6 o( ~/ [) ?
( i" a3 J% w! \4 s
-The most exotic ones (could be very slooooow :-(
( ]- @+ x& V% O% f, z BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
n3 B* I( A$ B. Q+ O ;will break 3 times :-(8 T: V0 r" e% q3 \
4 ^; H2 O4 Y; X-or (a bit) faster:
3 t* V& y6 B: D* y$ p BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
$ l6 m. l8 t) r7 V' B2 E- t
6 C% ^& l& x5 e1 |" m6 }( O1 G8 ^; H$ A BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
7 I% V; J; G6 v& h9 i' k ;will break 3 times :-(
3 G" P6 V+ o5 y) |3 J& E" s& }1 v: r
& L, N* ]+ k/ F$ U3 ]+ g! p-Much faster:
6 B' C# b2 r* y# z: T( R BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
) r4 g4 a7 |/ }2 b# M8 q! k5 ~: |! {; q0 p. S
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen, E, y$ U/ l$ k8 l! h
function to do the same job:
3 n+ P% u# S, R n P( W8 Q( \0 [' o- O' N$ r% P" h
push 00 ; OF_READ
: l7 _" G4 z, M mov eax,[00656634] ; '\\.\SICE',09 I, K% S2 ?. S1 a5 c0 D1 n, a6 _
push eax9 c6 a/ V9 `7 P7 z; Y. l7 l
call KERNEL32!_lopen
& |8 e7 U0 |9 V( c6 a$ x inc eax) [. T& u/ B% q$ {
jnz 00650589 ; detected
7 y' k7 N- ~+ R" d5 A$ Q3 }& Z. c2 e push 00 ; OF_READ
1 h3 ]2 [! V* e! w; z& [ mov eax,[00656638] ; '\\.\SICE'
" i( x+ C" j- {& r/ o push eax6 p7 O; [0 o) V1 v
call KERNEL32!_lopen
, X0 E1 s9 F- g inc eax
a, E9 `8 W1 N jz 006505ae ; not detected6 n, `/ B1 Q3 ~7 [- U2 E3 S0 g p" ]
- x! m) F3 t( R" g8 @# F
8 M8 J9 L: \+ q- x5 s" v__________________________________________________________________________
8 [3 R( u- k$ ~5 V: @1 a- r! C* N, b: |
Method 125 k! u2 Z$ {" r0 k1 C+ K; ]
=========
+ k* q5 I8 i* o( J' D# i" p) i8 Q8 f- P* c4 z' b4 { j
This trick is similar to int41h/4fh Debugger installation check (code 05 \" d6 O7 F, @
& 06) but very limited because it's only available for Win95/98 (not NT): `: ~/ }; t0 k" y
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
. @. F/ G3 H8 w! u
e3 h3 P* s, }- M push 0000004fh ; function 4fh
" d" J7 o. f) @$ e9 } push 002a002ah ; high word specifies which VxD (VWIN32)0 u9 e0 i5 E7 ?6 B' \' |
; low word specifies which service$ H6 v* r s& s$ U
(VWIN32_Int41Dispatch)1 O7 Z, I. d$ |: O6 ^
call Kernel32!ORD_001 ; VxdCall
6 J% f. B+ a$ ?# E cmp ax, 0f386h ; magic number returned by system debuggers
: |; z; X0 @( G1 ~! k% x jz SoftICE_detected
+ Q6 n7 T' [+ r- ?, w( b4 b5 z- k0 M, a0 ]$ B# D
Here again, several ways to detect it:+ ?3 \) j% `: W! `) `. B' m w! C
: ^2 s# P) b5 U: j) P. Y BPINT 41 if ax==4f$ V# ~1 p' k/ |, C3 ?# w& t5 ]
5 u" P5 V `+ f" ~: g' ^- W. v9 H5 j BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
) O" a- ^9 H7 Y" v) y4 J, {5 `9 d! F% E1 F9 z: F
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
$ Z/ e$ l5 s9 {7 N" k: L2 l( P6 o! t& X+ c4 \
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!5 a f3 @1 d) c' e/ k
n* f" B4 x2 F5 m
__________________________________________________________________________
8 P) p! _( J2 _7 j7 I6 D+ [5 G- P3 x) {0 c. b* i
Method 13* ]8 Q4 d! o _# \7 y' |
=========0 Y, C$ j* z) F6 Z& X! o
: X. ^3 x; q h! x. g1 g6 ^
Not a real method of detection, but a good way to know if SoftICE is
. _1 N t3 d; u$ Ainstalled on a computer and to locate its installation directory." q4 o7 D% e4 D1 D U6 j
It is used by few softs which access the following registry keys (usually #2) :
- U0 V% {4 Z6 f! b
1 z% B- [2 `, i, Y$ j5 S-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion5 i% H' z! N) ?. V5 n _9 D
\Uninstall\SoftICE2 }; E [5 r$ i+ ?% \; `2 T
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE/ R. b; k. K% D1 U+ a) p
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
0 e3 V9 t5 `- y3 R! y: k\App Paths\Loader32.Exe
$ R# n$ [! z% l [
3 B4 ~' ^' q, |) b6 B6 f
p* r7 M" y, o# e% H9 mNote that some nasty apps could then erase all files from SoftICE directory% A, N& m1 _4 i |$ g
(I faced that once :-(
, _( v- F3 P- O# z s9 m/ ^4 O+ f! j: a* y$ X8 j0 q
Useful breakpoint to detect it:
$ o5 N1 u" }& j
2 d1 t3 f: R+ R0 r( t BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'3 ~5 D' H2 i7 T4 v/ P
4 f3 E$ q) h( Q' M
__________________________________________________________________________
+ ]- G' I" F+ r. V) F Z" [) m0 l# h, {6 M5 A5 d" U
/ C9 n7 t9 q; G% v
Method 14 1 ?3 o0 Y3 p, D/ @& w/ n
=========
- v; k" k6 z U9 B9 B! s6 @* [
* Q) n, j8 O' D/ i9 V6 ~A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose6 ?6 Z# V8 i D' G- `" x
is to determines whether a debugger is running on your system (ring0 only).
: J4 p. l6 m) G& d
& H1 Y' @. f% w# @& @ VMMCall Test_Debug_Installed
( f* b3 o* d8 c$ y0 Z" W0 F1 \) L je not_installed
- Z: |3 U( |2 p9 `) k9 }
( b$ A! G, Q: [: H2 DThis service just checks a flag.) Y+ R1 O& s$ x. q6 D3 h' y
</PRE></TD></TR></TBODY></TABLE> |