<TABLE width=500>) s3 U: q2 N+ w7 v3 p3 r/ \
<TBODY>
2 Z5 w5 ^- u- ?2 N/ h5 a J6 E<TR>* w- C6 L3 y4 g
<TD><PRE>Method 01
; ?: @ K) k- u$ I=========
. m* Q8 d) C. l' V3 r B9 ?
9 o' `$ |2 u8 d0 QThis method of detection of SoftICE (as well as the following one) is8 g) {# ]( c( g3 g" \
used by the majority of packers/encryptors found on Internet.# \( k9 I6 v8 |
It seeks the signature of BoundsChecker in SoftICE
0 V n9 {" L+ c5 H t" R- _* x; K1 T" N. z# H6 z. F0 R0 X3 M
mov ebp, 04243484Bh ; 'BCHK'
* r- r! C0 {+ y- S, v: m. |4 A9 r mov ax, 04h/ z2 v; ~; P" H+ X: x8 ~
int 3
- O/ \1 e; l, n8 ~ cmp al,4
- b4 y, x7 Q2 Q5 _4 L6 `2 g jnz SoftICE_Detected9 l+ d: P3 E6 k% }
, o2 x6 q, K& V# g___________________________________________________________________________1 {7 m' x1 j) g& v8 H; v0 m5 n# ^
6 Q7 {& k2 B6 n5 B+ N9 a- e
Method 024 x- `: B7 P7 c& n6 R5 g+ I: z5 ?4 g
=========
& `; c' Z r0 G& m: K, I/ j( P: z3 z6 ?0 T4 v, B
Still a method very much used (perhaps the most frequent one). It is used( u. J7 q" L3 m/ Q0 y1 O
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,2 g0 j0 e. T+ l8 E
or execute SoftICE commands...
) z- u& r. o# q; _. j$ uIt is also used to crash SoftICE and to force it to execute any commands: J- R" ^% @6 H' { e& C- ^
(HBOOT...) :-(( 3 X7 f4 ]: V( x/ z9 v
$ B+ i8 w9 R( b4 J. D$ F2 IHere is a quick description:
9 I; m# J' E1 e: _-AX = 0910h (Display string in SIce windows); h6 L1 ^9 y o4 g
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)9 o" E+ |* t, t
-AX = 0912h (Get breakpoint infos)
4 S) U3 d! W4 F) b-AX = 0913h (Set Sice breakpoints)/ P- U% \& {% c, p- I
-AX = 0914h (Remove SIce breakoints) s: C: S2 s4 n6 f$ Y7 E
6 L5 p, }! P. X/ }
Each time you'll meet this trick, you'll see:
" ? t0 I. J! d-SI = 4647h
, C+ m0 r4 S% ?( T; ?) N4 J$ {-DI = 4A4Dh
4 h( [9 G q( `& }, H. y+ ]Which are the 'magic values' used by SoftIce.
( g3 b6 \8 S! U/ L$ [" nFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.' ?" G: h Y* }8 I8 K2 H
4 o1 l1 ?3 \1 T1 aHere is one example from the file "Haspinst.exe" which is the dongle HASP
# m& `6 l# F0 q8 ~, }Envelope utility use to protect DOS applications:
# J. z* r H# I
6 d9 W* p2 n* j \0 w. B9 E+ @
, V: U: G- Q% h4C19:0095 MOV AX,0911 ; execute command.
8 F% m. t' v9 u' q5 a$ E4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
( m3 f6 n5 Y# k, _) a6 z" M4C19:009A MOV SI,4647 ; 1st magic value.+ G$ I6 c) H. `
4C19:009D MOV DI,4A4D ; 2nd magic value.
0 a+ P) L# q/ R- g5 d4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
5 l4 A2 S) R. d$ M( W9 t4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute/ E! U/ B' H. h7 G# M
4C19:00A4 INC CX! y9 k: @$ x, R' Y. I
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute' f/ h3 {; Z3 t
4C19:00A8 JB 0095 ; 6 different commands.: N8 `+ ~% @+ N1 E5 r7 V2 ]
4C19:00AA JMP 0002 ; Bad_Guy jmp back.2 r/ |! M* B* V" X2 t. [
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
3 h. I- L! S( Q/ E4 O& E, m' p( ~* d
3 P7 b' d! k0 z* @The program will execute 6 different SIce commands located at ds:dx, which+ O; A) Z6 e: r0 _: {! @) j
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT., s4 S T" ?. T/ ]1 W* M
; R. J/ \) g, Y, G3 \
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
) l( y: |! y7 p y+ g" ]; ]___________________________________________________________________________
/ M" Z8 T4 J+ ^, B. c, O4 A) `8 x
! \; A' w1 l: p$ j8 C W: X+ G$ |2 Z( c% n. E
Method 03
) W! l. R& o9 S; ~$ Q, |=========
' d" ]7 E* ]6 `9 w
9 ? [: L6 \ c. ~7 ?* U& B5 XLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
. `' M6 P/ X+ a( P E(API Get entry point). Y1 j1 y+ H0 t) m$ J, o6 R
- E# S& h3 |% m+ V
+ Q* L; }! m- X" E0 A4 I: }6 u* ? xor di,di* ~5 w! n6 C5 g* ^6 u8 `/ ?
mov es,di& X4 a2 e+ M0 K% c
mov ax, 1684h % M' z# M$ Y- D2 o- R8 B( G
mov bx, 0202h ; VxD ID of winice$ O9 _5 j; H. Y1 b0 \$ B5 j' I
int 2Fh& ], x C4 b. d; j
mov ax, es ; ES:DI -> VxD API entry point
4 I; K. q/ P: S- h) t! e add ax, di
! i# y: `: o) d z! D7 O- E8 a( Z) g test ax,ax
) ]' |6 X: F) ?* P, v5 g jnz SoftICE_Detected
8 W: O [9 V2 p* d
8 }! X0 y) Z% ^___________________________________________________________________________, k# T1 O1 l: d
0 |3 P; R; r' r& V6 p, NMethod 04( P1 ]1 x4 X8 J% s3 ^) h
=========
C0 X5 y( P, n6 ^9 x" J. m! z
7 }& p1 k: |/ _0 PMethod identical to the preceding one except that it seeks the ID of SoftICE( M$ {( Z- x* C/ z
GFX VxD.
2 e4 c% f$ |( d# @5 X5 @ g6 ^; X% v( ~( h; L2 X, h( |" j
xor di,di7 Z( L, ]% D1 R" Y' E
mov es,di
& e8 h/ S) z k1 R. Y mov ax, 1684h
. f* z! I$ Z, X& m: R mov bx, 7a5Fh ; VxD ID of SIWVID
" G2 [/ w: F" k% ?2 } int 2fh
; A) c; \- a8 O6 W' @ mov ax, es ; ES:DI -> VxD API entry point3 l& ~; a P8 e. E9 T
add ax, di
- k# P0 ]$ S% E6 N1 X& c8 P test ax,ax
& ~' G& p8 W& ]0 u. K jnz SoftICE_Detected
1 a; t; ?# C, q$ c. p# T. |4 g4 G0 b9 D M" X) Y) C: r" | }! b' a( r
__________________________________________________________________________+ s. M: @; G7 B3 _
t( M( N; S( J7 s
( o' t( J3 {& PMethod 05
9 d: _5 [$ Q s8 @=========4 H! K, d4 B6 c, B) U# v W- n# q" k
9 A: n5 ]% X5 f& G) {) ZMethod seeking the 'magic number' 0F386h returned (in ax) by all system- G: l- B' O9 F* c
debugger. It calls the int 41h, function 4Fh.
) P2 J! i9 X# r( {, ?There are several alternatives.
" Q" @- O1 Q8 {7 u3 X u& C
7 _8 W& V% P. |5 C7 F- V! [7 fThe following one is the simplest:* S+ o' ?( Y$ _+ [% U/ j
' Z+ S9 p1 `& A" R8 y% l0 c& `
mov ax,4fh$ X, O7 B. n5 ?( p) u
int 41h$ Y a( Q8 J S# ~; x) J
cmp ax, 0F386* I+ F; J) n7 @6 h4 R
jz SoftICE_detected7 ^$ z+ ~4 y" ~% |9 j, y5 k
; d& a( g4 Z& a# s; v& p" b5 t0 W
, o7 x" o& Z/ VNext method as well as the following one are 2 examples from Stone's 2 A0 k7 B% ~3 D l
"stn-wid.zip" (www.cracking.net):
. b" L( S' C4 ?% i1 B
/ [ K/ b( E( H mov bx, cs' `- I: _+ T6 s4 S& F$ n5 K
lea dx, int41handler2
5 D' ~5 L/ T; \; s& Q xchg dx, es:[41h*4]" W. z$ n2 ^. \" u
xchg bx, es:[41h*4+2]
- m! T( w7 m1 ?. U( {4 t7 h mov ax,4fh
G8 Q/ E9 C6 f/ F' J int 41h; i) S& O% t$ L6 _
xchg dx, es:[41h*4]
4 i* {" c& \: y% y xchg bx, es:[41h*4+2]
/ R) p6 J( v. K" }. S) p cmp ax, 0f386h
2 w8 j6 A# Q; X% N' e* e jz SoftICE_detected+ a6 m: N4 q: [5 e) W5 J
) W& V# S. m: X1 O4 X
int41handler2 PROC
, z5 k* ?. @5 @; a, D4 Z iret
5 h5 H' g9 G6 C' n+ F& U% Iint41handler2 ENDP
7 [* z- q2 Z' k0 ^ h, X, e
' e3 Y% ?, V# |! i( m* }, d b
& x8 [8 U& Z2 A2 k_________________________________________________________________________
( _/ c+ ?$ v; K! v" n7 H9 ~2 N( Q: i) d$ i0 q/ O
; t* E, I: F6 }# j# \% W2 J2 h
Method 06- o. r; ?2 ]; r4 h+ o- \
=========' N% O5 f! q. I* |
! Q8 D" h5 B# M0 o* v q1 q# ~" \; u, T7 L6 X1 e8 C
2nd method similar to the preceding one but more difficult to detect:; {! T% X3 F7 k0 C9 J0 T9 h* A n
& V; u! y. |% P- M/ n/ B# e$ S# E9 t2 \: N" H/ O X; D6 X
int41handler PROC/ K f: r8 ?' h1 m5 R3 M M
mov cl,al
4 r) E' b0 @# G5 H: K2 D iret9 a" g6 F) E. y( J: w
int41handler ENDP$ N: x% m7 W# |" U
Y- V" O2 C+ O# \$ l+ B
$ Z/ x+ z8 G/ w) x( X/ J0 h xor ax,ax* `9 U0 g+ j$ `! Y3 J: I
mov es,ax
( J# q- `6 u t h+ W! v, ~ mov bx, cs- l" r Q" U$ u+ X' k+ k+ ?
lea dx, int41handler5 v9 ~1 ~2 H7 T1 t% d. y
xchg dx, es:[41h*4]
9 Y9 _; k+ u. @; A4 Z8 R1 t" v xchg bx, es:[41h*4+2]) k2 a5 B6 D, B& A4 V5 \5 _9 D
in al, 40h* t* `& @& K9 L
xor cx,cx4 Z, P) k6 \, K; R! i* I2 \' h e
int 41h
: `/ x6 X! V1 J+ _ xchg dx, es:[41h*4]7 L/ U" s" V5 s8 u# |3 z* i
xchg bx, es:[41h*4+2]( W7 j. d# E+ L4 D. O
cmp cl,al6 @% y1 a8 e3 K
jnz SoftICE_detected
0 M j$ s% m" O4 ]* B) L
. ]6 y! a# J9 a, _2 z0 _) R% a_________________________________________________________________________: R9 E! r7 a9 ~, Q5 D
8 F* x. g9 H/ s# s: V& ~9 tMethod 07
! |# V3 l9 W: C7 |) O, P5 D=========1 I) c# v( y/ l% g( O: X5 ?2 B
3 h7 e0 Z$ y. F8 yMethod of detection of the WinICE handler in the int68h (V86)+ g$ w k$ J6 Q) l
2 P Z' f: e- O' C% q mov ah,43h
: D, Y; @" `1 f9 S/ S int 68h7 f5 e; u3 @- C) q3 I$ G. \6 t
cmp ax,0F386h
* x' ~4 e( h5 o- s, b( q9 X jz SoftICE_Detected
4 n8 Q: i* x" ^1 k; H3 M* ^4 D) Q5 x" k
: @2 y( y! A8 H+ K0 C6 I=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
# z3 v- C* }2 G# l" ?, V app like this:
: A P I+ p, [' X( P
R( u/ k! u$ J9 y$ y) [! O1 O BPX exec_int if ax==68% ?# h3 l6 P& ?: G9 E P
(function called is located at byte ptr [ebp+1Dh] and client eip is( Q, A6 U- {) h. N
located at [ebp+48h] for 32Bit apps)
) p1 f3 l) b8 H/ i# g__________________________________________________________________________0 L0 q5 s1 Q p( W
8 Z) A; I8 \, ^( ]( Y- R
4 ?) I( e9 d8 eMethod 08! E; ? v* {* O7 {# V/ Z: U% s3 V
=========
* v: k- E7 E. I9 I( }* _) Q$ f0 v! u) w! J8 W$ q
It is not a method of detection of SoftICE but a possibility to crash the
0 h; D" M$ c& j9 y& {system by intercepting int 01h and int 03h and redirecting them to another0 R. \, d2 n# p( p
routine." o. s) w9 O1 o: ^9 a
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points: U0 D. q' A& C! Y3 y# f, a
to the new routine to execute (hangs computer...)1 l0 x& P; \# V, Y! J* y9 W0 g& C
2 r9 |; y3 f( R mov ah, 25h
8 M2 l- @9 ]; w3 j( u0 L1 F$ R mov al, Int_Number (01h or 03h)
, b3 J+ |; c' c: C1 r5 o mov dx, offset New_Int_Routine
$ O& s" `3 g2 C int 21h
2 }$ O$ I3 I: a7 V& g8 d
Q! h0 }: N0 w/ {1 H( y$ k e__________________________________________________________________________
2 K0 U+ T9 I! ]/ o4 Y Q" G
( h6 C% T- Z' c4 B/ w! XMethod 09
0 t+ U6 ?/ g" W" ]; e/ |! U=========
# \% d$ B. @- U# l. g' Y7 t* _ `. I, [+ F+ ^' j" B
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
" M& g7 l9 C8 jperformed in ring0 (VxD or a ring3 app using the VxdCall).7 e+ A' [5 k0 N$ W% `3 b
The Get_DDB service is used to determine whether or not a VxD is installed6 q7 n; X0 e3 T) i$ f
for the specified device and returns a Device Description Block (in ecx) for
4 Z* M8 \1 v; Y; F) s8 Y# mthat device if it is installed.3 m& h- h) m0 x) W
/ t6 |4 D) G; q! g" `$ l! r mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID' K2 _" A% M' e/ w
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
" p5 I: G* A& K VMMCall Get_DDB7 E' ]0 o) Y# r" _4 T z
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed O6 T9 i% o9 M* p# A
1 L; ?7 B" r5 e- l! r2 c9 U& _
Note as well that you can easily detect this method with SoftICE: K5 m7 R9 P2 D) k3 L
bpx Get_DDB if ax==0202 || ax==7a5fh
7 Z- e# \ V' E6 ]. ?& K( O7 q2 ^* V' Z. t# \) i
__________________________________________________________________________4 p) [! ^" m1 Z0 Q$ N
( ~+ ^5 H/ k7 I4 K' d; ^! {Method 10
/ K* S6 J0 J9 i/ p s=========
5 V6 x+ l+ O" P; e' X% J' H& K) a( p9 _8 E! d7 c5 d
=>Disable or clear breakpoints before using this feature. DO NOT trace with3 h: C# R& G7 D2 R% \
SoftICE while the option is enable!!
! C& B$ e; Z- u4 O. o" n# r% D7 c$ n, _: R2 u, L) }% x3 Y
This trick is very efficient:8 f K" q! K5 {/ Q& S5 t
by checking the Debug Registers, you can detect if SoftICE is loaded+ c0 r9 G- q# x+ e; @8 j- p8 L
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
! r# `) w6 B7 e5 k% k6 K2 U; i1 Z) S8 jthere are some memory breakpoints set (dr0 to dr3) simply by reading their
- q! D$ m3 Z- }+ R, Avalue (in ring0 only). Values can be manipulated and or changed as well, r2 g/ s# e9 h% k2 g3 O
(clearing BPMs for instance)
" `1 P+ R) r5 B$ c+ v- ], @! _+ \% h0 z. L6 \, I
__________________________________________________________________________7 s- z) I O9 q8 F: i
; s5 f. ~: f. K* U9 M$ EMethod 11
5 k8 I% ^" J( E3 M! t" m=========2 S5 g0 J/ u; }7 i
3 S7 d( [* x2 H% ?) SThis method is most known as 'MeltICE' because it has been freely distributed+ J2 p, F. a# t0 p. s& u B
via www.winfiles.com. However it was first used by NuMega people to allow7 [* e( f, W. f+ P' s
Symbol Loader to check if SoftICE was active or not (the code is located
) W8 X& ~; S& Y6 qinside nmtrans.dll).
* I. n* w8 \& y; V; q7 R( S( \6 R
The way it works is very simple:
1 T, o S6 S& U- IIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for% Q6 z0 @* [( e; k/ g3 O. |
WinNT) with the CreateFileA API.
5 L7 x2 o# D% N$ {" M( W, ~# T D' E; q* S0 f; A' J8 D: y& I
Here is a sample (checking for 'SICE'):0 j4 B" O( t% s' j% P& \
* ~3 i. i' u5 @- z4 ~9 ?BOOL IsSoftIce95Loaded()
/ S5 @3 i/ E4 z# Z% h% g a2 s. S{& O8 E- \. L4 u6 M$ j- b
HANDLE hFile;
/ ^1 [; c8 N/ `% |: n b2 Q hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
3 e* x2 Y7 ~+ {* Q3 j* P' Z9 Q FILE_SHARE_READ | FILE_SHARE_WRITE," Z) t6 v/ W; ` Z0 l/ X
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);" `! Y7 }9 k+ N) v! D3 D
if( hFile != INVALID_HANDLE_VALUE )
& ^! n$ g2 r! B/ w+ w0 K- V {7 ~. W9 d% p; K9 n/ ^2 f; I, p
CloseHandle(hFile);
. F* |& F9 e. y! k5 y0 q/ l9 p return TRUE;6 o( W0 Y0 D/ \2 \# a, A
}
0 Z; K5 x- L# x* A/ \( e j return FALSE;
' m3 F$ f) q! k/ U! z7 s}; _7 ]) h$ d4 W, n; z7 ?, }3 k
! y0 }# n3 O: O* c7 HAlthough this trick calls the CreateFileA function, don't even expect to be; {' {& J" M: J* x/ w4 F5 e
able to intercept it by installing a IFS hook: it will not work, no way!1 ?) W/ v$ u( Q
In fact, after the call to CreateFileA it will get through VWIN32 0x001F- \1 E( X8 ~5 Q( h E
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
0 r7 O7 ?2 r, Qand then browse the DDB list until it find the VxD and its DDB_Control_Proc
* O! U% f! e% K4 `' v, q/ ifield.! t& o/ r T+ H2 Z
In fact, its purpose is not to load/unload VxDs but only to send a : m* T' a O$ o# L: B
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)& e; L! |1 T9 d# @& {2 W9 K ?
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
0 R3 B* M: [/ O9 D1 i }) Jto load/unload a non-dynamically loadable driver such as SoftICE ;-).
H/ M( N3 f6 H4 Z; t7 nIf the VxD is loaded, it will always clear eax and the Carry flag to allow$ P, S9 }! P( n# L! |9 @
its handle to be opened and then, will be detected.
# H" h1 c O( V! U% w5 E C4 bYou can check that simply by hooking Winice.exe control proc entry point3 [. x9 i) p6 Z2 Y
while running MeltICE." f ?- t" W2 Z% X/ Q! z' `, x
, N6 b9 Y3 @% b. o, D, S: }
) l( k7 t: V% h8 ^( D2 J
00401067: push 00402025 ; \\.\SICE j1 i$ C, e2 @2 N( o- c- F
0040106C: call CreateFileA
2 y; f: x6 v/ b) \# I# K3 [ 00401071: cmp eax,-001* o" T" X, _6 W" C" J& [8 ~2 l
00401074: je 00401091
3 g/ U' C1 _, K& `$ `( }' H' t
a% s: k) p+ m) k I7 j9 Q n9 u# I% V- Y) a
There could be hundreds of BPX you could use to detect this trick.* I4 Z# f, n. t* r0 C3 [0 l7 R5 |
-The most classical one is:2 d% G" z. M. i% l* R; p' U. I& A3 ?
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
! B7 \" N- E# ~* M *(esp->4+4)=='NTIC'
1 L$ \! O: e" Y# Z* O; f. o
i, {+ j) o( h4 J( D, X/ g-The most exotic ones (could be very slooooow :-() k% u) b% L; m. O5 U* Q
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
4 G9 F) v8 O; ^6 W+ h ;will break 3 times :-( m( c$ L( \% K7 ^8 v
- S1 j% {' o$ s0 y# U-or (a bit) faster: , Z- O. N' P2 Z# i3 A ?$ {: x. Y
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')5 K! F: m/ ~, J) y' U, a( x0 v
: W/ V$ G) T5 }1 P$ l- k9 \
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' 0 ~8 q( B* z) c! W. @3 q
;will break 3 times :-(, f; m+ t3 B. P& t q; Q5 X' t7 ?
- _' y7 P: m4 Q9 O6 v) [-Much faster:
9 B% A7 ]9 i+ e! U1 T0 m BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'9 ~" B$ }* G2 e5 W
# B$ Y5 a e6 F2 w2 D2 ^3 w* {8 S" k
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
5 o( s3 a7 g% h9 F; ^) b( dfunction to do the same job:3 e. W( J% \; M2 N- L+ I# B
8 S( |3 ]: _& x. q3 o1 X
push 00 ; OF_READ
, p% n7 b: u1 W0 S mov eax,[00656634] ; '\\.\SICE',0
+ f; d9 v! x W. X( t9 Q push eax5 m( q8 Z! W* F! D/ F: X* \
call KERNEL32!_lopen- B. J6 P; R0 l
inc eax
" o( X9 \- y5 D6 q2 R jnz 00650589 ; detected
# l- T* U( m! F# L* C3 N/ f8 j! l/ t push 00 ; OF_READ" F% X) Z% _. m- G8 S7 ^9 h3 g
mov eax,[00656638] ; '\\.\SICE'
) m# o% s2 s" t! C. o q push eax p7 S( Q7 ^. j2 r
call KERNEL32!_lopen
d# b& p7 Q# q1 @2 J6 ` inc eax" t) }+ L1 S# x& \
jz 006505ae ; not detected
2 M! h# }0 q; o" g; X7 ^# G1 J. B2 W5 _2 A# ^ `
$ W& b+ {. j' H) }6 C__________________________________________________________________________
; |3 H4 A( e. ?2 B
9 q7 q# Z; X/ q- \7 ~" _/ A! Y" B) DMethod 122 g$ @- l. z& B$ [2 n
=========
9 V c7 P! u- d+ L; `& Q6 g- c* g0 H- Z3 ]! w, P
This trick is similar to int41h/4fh Debugger installation check (code 05
# @5 N1 n% \6 m- h- I' {' O( s2 Q& 06) but very limited because it's only available for Win95/98 (not NT)
+ c c: {) S. _" Z' Aas it uses the VxDCall backdoor. This detection was found in Bleem Demo.8 p) P% m' m% o9 @% x
" S9 ^' I2 J3 p2 m
push 0000004fh ; function 4fh/ n K6 t4 A3 Y$ Q$ C% H# t
push 002a002ah ; high word specifies which VxD (VWIN32), L- {8 s; q+ {$ r! T
; low word specifies which service
- X; J, z: `7 M3 ~ (VWIN32_Int41Dispatch)
/ a! C |1 p# t( j& L call Kernel32!ORD_001 ; VxdCall
: t- B; o% z8 ~8 Y3 y( ` cmp ax, 0f386h ; magic number returned by system debuggers, U: v8 q- p( J; L8 h7 h
jz SoftICE_detected
3 G2 `1 S+ Z) ?" N
% p7 s/ a" w1 C7 v& zHere again, several ways to detect it:
* l5 s6 X( q/ i6 j; j
2 R$ C. t* P, x6 e! C BPINT 41 if ax==4f
, \& I* }0 k2 N3 S5 y5 p* d" j& ~! p: C7 w
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
, i: D; [8 `7 ?4 G8 Y0 P2 H& d- I5 O1 T, o
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A: n& i5 q: c" H7 n/ O
5 P; Y0 C4 a, k& E) O2 ]
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
A8 w7 m0 q) h# [# K1 k' U$ ^1 C6 [ }$ g8 S q [
__________________________________________________________________________( [+ C- @9 b% ]* d/ i: \
3 v& u0 ]1 N: R+ W
Method 13
/ O5 I v% g. [=========
/ [ R6 t+ i2 {+ z
1 T- L- m9 i. y. U O$ i2 INot a real method of detection, but a good way to know if SoftICE is, i A% Z6 @3 E, _! g* l" K
installed on a computer and to locate its installation directory.( p' J: e& ^: |4 e( K, |
It is used by few softs which access the following registry keys (usually #2) :
6 T' x3 x3 j0 ?; s6 `2 a1 U% k) a4 A& |6 c' Y, u
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
5 v | T, F2 m! c2 o1 i\Uninstall\SoftICE
9 z/ \+ L3 ^) S( S8 q+ \-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE. Z I6 |0 p8 q: x& W
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
2 a P8 G( }9 A0 P6 }0 K\App Paths\Loader32.Exe- E3 D ?0 G# ~( w; ^
: t; p' K+ y$ R8 s2 K/ J1 g. \+ _1 P7 i0 a. P1 s
Note that some nasty apps could then erase all files from SoftICE directory
2 T! _( E0 G K/ G(I faced that once :-(2 e1 Z) q6 I9 X( d; Q0 J" A [
9 j2 T P5 p4 r& v- wUseful breakpoint to detect it:3 H$ E( V2 E0 |% F0 M, Z/ T
9 K# U& K+ A. R% V7 I6 B$ } BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
% K4 m* G# L5 _# P; S# p, T, k9 n: f8 _( m$ M8 A0 R) d
__________________________________________________________________________
8 }4 D9 `9 E9 u8 o2 X% o, H0 t( }, z* h
* o- F) w. ^1 ^" x# o" ?" ~: gMethod 14
% n9 O; w+ H- O6 F=========% l) v& D U: Y! L, ~
: m# L% a9 e6 K" |$ b' B0 X
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose+ ]; Y9 m7 o# H" F
is to determines whether a debugger is running on your system (ring0 only).
6 h- c5 W& w, P' i2 ^. Y! g! `$ c! F0 _+ p k6 ]
VMMCall Test_Debug_Installed- W5 Q8 Y; {6 ^" ]! x$ @4 T4 [
je not_installed( m7 M; e5 c# [- X7 f5 @& I
% |5 j4 G7 I8 y& [. p# VThis service just checks a flag.
# i; n3 I+ I( k4 H* B$ ^8 i4 R8 s! g</PRE></TD></TR></TBODY></TABLE> |