<TABLE width=500>
/ q" J5 D$ `1 }# [3 M<TBODY>
2 u: A, @9 K. c2 _<TR>
! {% a8 j! i) R% U' o- E- w& W<TD><PRE>Method 01
& V$ r0 @% m2 h! k- F6 q$ c=========
|8 ~! p. o( k+ C ~8 d7 H3 p! j: V
This method of detection of SoftICE (as well as the following one) is
$ N e/ ^! C/ N3 z5 Aused by the majority of packers/encryptors found on Internet.4 p+ y' L- `: Z0 L* Y# P
It seeks the signature of BoundsChecker in SoftICE
9 B, ^. P- q1 _. N6 l m
~ m& X% [4 C6 A" G! k mov ebp, 04243484Bh ; 'BCHK'
4 n( L1 ] R3 u8 c mov ax, 04h
3 \+ _& k: f5 o; z int 3 " I5 q/ d5 T! ~
cmp al,42 ?4 D0 F3 L0 _/ L
jnz SoftICE_Detected5 W& B2 p) N5 @
/ Q0 r/ b% j2 d___________________________________________________________________________ R- U/ [6 B$ `
. m: L/ f5 f) x( ^Method 02; ~6 b( n3 L5 w" r/ T
=========+ t7 m( E6 B6 h$ F; t, F# I/ j
( h5 v. I5 P0 X1 k
Still a method very much used (perhaps the most frequent one). It is used
+ r3 o) S* c( o- @, S: F- wto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
, s! A# ^" J; K3 }0 {2 r/ O2 jor execute SoftICE commands...' U1 f/ i* ?5 C2 c$ B" I# f. B
It is also used to crash SoftICE and to force it to execute any commands
3 _9 u. s% B& k(HBOOT...) :-(( - k; q' v3 g4 f0 p4 x. p1 @
! G% C8 F$ z4 t$ S+ GHere is a quick description:8 J( ~9 R7 r3 o$ l) n, D
-AX = 0910h (Display string in SIce windows)
1 v! Y: j9 N( D3 I( i k+ y-AX = 0911h (Execute SIce commands -command is displayed is ds:dx), `* ~; v* T0 ?
-AX = 0912h (Get breakpoint infos)$ Z u1 H L5 }* }
-AX = 0913h (Set Sice breakpoints), A- R% U" B0 @' q3 M
-AX = 0914h (Remove SIce breakoints)
; g9 M) S+ a" K) U0 F; M$ y5 ~% @( W6 k+ d
Each time you'll meet this trick, you'll see:
% I8 d( K ^) d0 |5 Y n-SI = 4647h4 y$ \1 a% `$ ~( ^# M7 E
-DI = 4A4Dh
$ M4 N2 X7 y+ V$ OWhich are the 'magic values' used by SoftIce.
- w2 p( ]! y" dFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.0 i5 H" ?. N7 _, O; i8 f. u
; O2 Y( ?; }7 y% ^5 s* x, M9 QHere is one example from the file "Haspinst.exe" which is the dongle HASP, U! G. ]7 h2 C3 I% a# ~
Envelope utility use to protect DOS applications:
8 d/ {6 E) u- E/ j3 ?7 `/ t0 ?1 n* I) @7 q
) a, \: u4 [2 J, e8 n3 q& ~3 U& R
4C19:0095 MOV AX,0911 ; execute command.
4 N. a+ b' N* ^4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).. u( r5 w- p. e1 b
4C19:009A MOV SI,4647 ; 1st magic value.
7 u0 `3 r: u* K' e4C19:009D MOV DI,4A4D ; 2nd magic value.
0 t" s; @: J. o( p3 w5 ]5 n9 ^2 V4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
! y1 e7 n, z: J, W3 F; f$ P4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
8 {3 P5 ?) {6 {7 ]! |( `! `4C19:00A4 INC CX
4 I0 p* R" X: E* a6 v4C19:00A5 CMP CX,06 ; Repeat 6 times to execute: p4 g3 O2 p$ H' q; j, O% g
4C19:00A8 JB 0095 ; 6 different commands.; e: A+ m K6 A' N5 I/ D
4C19:00AA JMP 0002 ; Bad_Guy jmp back.
; W, W) h O8 H7 M4 Z$ m4C19:00AD MOV BX,SP ; Good_Guy go ahead :): d& H/ U( w7 ~) y2 Z+ w- B! Z
3 S' B" R$ A2 S) N% B/ e9 }
The program will execute 6 different SIce commands located at ds:dx, which5 `5 L! ^( }( K* Y5 P
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.3 H4 R2 R m* j; f8 E5 S3 N
( Y/ b( X5 N C, n4 {& Q- ~% f
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.. B5 ^5 i. D8 \4 U' [
___________________________________________________________________________
( b. F; E' j" O1 C4 e6 f& l% x y; u; {5 P7 s4 g& }6 ]$ k
& P2 e+ _( e4 D
Method 03
: V) r/ v+ t1 y' {; f8 a8 D0 B) x=========8 U/ a" j+ m# O. d) D7 Q
) |7 n4 L* Z( d: L: q2 O, I+ Z* P LLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h. W( t" F0 E/ Q/ K& G. o
(API Get entry point)" d8 C" a+ R0 J( o# j
5 M3 C; ?' C9 [- O2 X. i
8 L, ~6 F! N+ q0 G3 b$ O xor di,di! l. Z* B2 r& I) N5 H7 J; s
mov es,di5 G3 V: B# x- ?1 V* x6 i
mov ax, 1684h 5 o. ]5 Z' a! W7 T
mov bx, 0202h ; VxD ID of winice2 z' N5 l, b8 \% L
int 2Fh/ K+ b! K- c* @ {- n
mov ax, es ; ES:DI -> VxD API entry point! J7 f3 E5 c3 r) z
add ax, di
& R) r- g% q8 s( U9 D0 k2 X, ` test ax,ax
s2 C4 I: ?" a _& y jnz SoftICE_Detected3 ?9 w U- Y( a
9 L ?* A9 d, Z% w9 ]% U3 a" u___________________________________________________________________________
5 q& k' T' A# M5 o, d
* l U# o. g8 W0 m6 i% f. Y" tMethod 04$ }; ^5 v9 n5 z
=========# d$ |# H+ f9 L4 g5 \& ]2 K! v6 y7 [
* J9 j1 Q9 d3 Z0 a8 D5 r
Method identical to the preceding one except that it seeks the ID of SoftICE
8 ^9 b0 E3 E+ b0 j* ~7 UGFX VxD.6 t% J7 \3 i: [& i U
% O5 H$ c3 {& l# }" ]4 \6 ^$ ]1 y xor di,di2 T9 p8 p0 _# h1 w3 Y: n
mov es,di1 c1 C- {" M- w% s4 P& |0 H0 K
mov ax, 1684h
" o( C( h4 ^% i- j mov bx, 7a5Fh ; VxD ID of SIWVID8 R# a& W1 w2 I& \$ g
int 2fh$ c1 f( S8 o( ~& l
mov ax, es ; ES:DI -> VxD API entry point
" `3 a+ r1 ~4 v# p1 P7 L add ax, di
7 s+ L: ?% n8 |8 w7 |0 b test ax,ax
. s' Q, e3 F2 ~: u3 a/ G jnz SoftICE_Detected* \9 {$ ]4 j8 w! b% r$ e
' ]- M5 V$ ?: A) i
__________________________________________________________________________$ b) J" D9 ^& Z0 V5 Y5 j; x }2 d
* c, m8 m" u7 Z, D/ R9 _/ y h$ E" }
Method 05
( U+ n! ]% ]& e=========* y9 Q4 w: T8 i- M: M6 l
, i0 E% L. x- P; pMethod seeking the 'magic number' 0F386h returned (in ax) by all system3 C- H0 n. X9 R5 P$ |( f
debugger. It calls the int 41h, function 4Fh.$ s/ O+ m4 w+ {8 G; t z4 x
There are several alternatives. 2 d$ S- ]3 T: R8 C
( A4 U+ E' G; X/ h+ p# a
The following one is the simplest:& M9 z4 J" ?1 e' m" W* O
& l5 n# _- Y5 x6 k mov ax,4fh
' }) ^7 l1 Y& v1 t$ l int 41h n, N- E9 n/ e0 @
cmp ax, 0F3867 T- U; ^1 V# B2 E b
jz SoftICE_detected
# e0 Z/ d+ E, ?$ c; e" K/ r5 m% a
2 S4 `2 t2 l+ n' S' s( F% |/ ]
Next method as well as the following one are 2 examples from Stone's - h4 G* S, z+ C8 Z! H
"stn-wid.zip" (www.cracking.net):
& q. x% b f' M. V8 m3 `
" O; G4 m, T0 y; c8 P" ], N mov bx, cs
* m' {5 [2 Y+ k5 P" h lea dx, int41handler2
1 w3 l9 n( ?" ]9 Y xchg dx, es:[41h*4]& d1 P1 R7 O1 }) ^
xchg bx, es:[41h*4+2] M4 ~2 H6 f g; _2 r/ T; D% o6 O; |
mov ax,4fh
; x: n9 u" ~( v, {4 { int 41h
. x7 p+ W. S% B I xchg dx, es:[41h*4]5 p2 d1 A0 L8 y# M
xchg bx, es:[41h*4+2]% z# a8 N* d: U9 L
cmp ax, 0f386h
( O. F0 r% O2 T* [/ O" b% u jz SoftICE_detected
# E5 n6 |+ J4 Q$ r) y- n: D" j f& N' l* {2 f& T
int41handler2 PROC# e2 y6 C3 K/ S! Q2 v
iret
2 \! \" F9 @; ^' d% h, L! _int41handler2 ENDP
& @ r3 h, s4 o) D& E! k- z) T, G( I; q
, a, T1 H+ ?( l
_________________________________________________________________________. N, S9 R& ?$ s) @
. K( A* D9 Q8 F7 y9 [' o
; R/ c. R/ g, v
Method 06) D! ], Y* j" q
=========( A9 M5 ]2 H& p" z: h: z
* z2 S+ O( i9 N+ K* C
. e3 ]4 e( b7 B: d. j9 H- \2nd method similar to the preceding one but more difficult to detect:2 H5 I+ \% ], F7 W' J
* `7 K9 @6 h& `' `# S* Q1 X5 N
- U# u8 R# F1 a- hint41handler PROC
/ u" G- p5 b% f1 b9 e8 H mov cl,al
* A2 g; n5 |. |0 |" F/ k7 a iret- Y9 F2 A. n% ?3 e* O' y3 b! _
int41handler ENDP/ \0 F" i" U) E; ]. Q4 X
4 n% q3 B7 L: W+ n) d
) L& e: C" T4 Z, O3 e9 B xor ax,ax& k# W ]% G# k- ?$ b1 h' |" N
mov es,ax1 y% F! F6 _( k
mov bx, cs
. b6 q7 {) j0 U. Q9 @ lea dx, int41handler& Q( ]0 X/ i# \1 N8 p2 \
xchg dx, es:[41h*4]
3 c" K7 o% |' x1 S xchg bx, es:[41h*4+2]. v }' G$ G6 q
in al, 40h; s6 H- j* S" u, a
xor cx,cx
1 B: A( @% v/ |7 t6 F+ v int 41h
: m9 f* l6 R5 E, q( M4 b xchg dx, es:[41h*4]
3 o3 q5 K6 X! F+ ^% i" V. | xchg bx, es:[41h*4+2]
: n# A- }: d9 D3 [3 ~% Q& M) h cmp cl,al
" U5 ^$ d$ m/ u# J6 n jnz SoftICE_detected2 Y$ r0 P( Y _0 P
- i; {- v! P6 l; Y! j( o
_________________________________________________________________________
7 Y/ u# L! p/ A) ?" Q3 a2 h- c2 p; z' m9 z: n
Method 07# [: V: ^- @6 ^% y: v* h
=========
5 K. ]* N# }: n2 p) u4 J: h+ L. O: W; r1 N! A
Method of detection of the WinICE handler in the int68h (V86)) V: j) J5 w( S4 b& ]
- j0 c7 I, D& h: l
mov ah,43h
: B9 B3 m, N2 i$ [: z3 H) X int 68h
4 q' Z! a1 n: A. V+ k: Y cmp ax,0F386h
S( k) b% S% [( ^6 ` jz SoftICE_Detected: a: W/ L. s4 B7 a9 n# y! \+ y
* w6 G! e9 m, u; R' G
; f8 r; t' p( w4 h- e3 W; K=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit+ r* D" ^* _. W9 ~, `; b W
app like this:5 g: r; H+ l1 `9 f$ N& m* v
; j8 a( A+ r8 I& n
BPX exec_int if ax==68' B0 V! ^( E8 I& M8 f
(function called is located at byte ptr [ebp+1Dh] and client eip is
& D- e( Y5 \; j3 H, f located at [ebp+48h] for 32Bit apps)5 ^2 E$ t# E) M( h: n! @
__________________________________________________________________________1 m* M: |/ p7 d) X. C, O/ K! j
y" @$ i8 p: A# t8 D4 w3 ]( ~7 q. n# e8 t6 i+ `/ ?: ]
Method 08 R' d3 S7 |* ^. M/ k# V9 k" M
=========
$ ^' M4 b; \6 q" G. m& ^: d' n# `9 ^; y
It is not a method of detection of SoftICE but a possibility to crash the- Q) |1 o0 [4 V2 f. u1 v
system by intercepting int 01h and int 03h and redirecting them to another
* m9 R: C. D% y+ j$ d# oroutine.; X- j( R' F0 S% j: M* P+ o/ D
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points% s' ^% J0 L d
to the new routine to execute (hangs computer...)
, Y& P; ?. E* o# P
4 }- ]' ^ J2 W mov ah, 25h { f4 F D6 C3 g: M7 ~; G
mov al, Int_Number (01h or 03h)1 J9 d8 @/ r7 N3 s' x" k5 x A
mov dx, offset New_Int_Routine
2 P* T6 P! V+ V. U. V3 Z1 n! H$ z int 21h
& O7 ]6 |! u# t4 w' E- t4 u. p/ D) ]- o' f% V2 c9 l5 i b3 r
__________________________________________________________________________; ]8 O3 j. b* `3 E( W) V/ ^+ R
w4 ?8 d- w5 ]9 I5 [3 F
Method 09" H0 Y1 {9 B5 Z
=========+ W. G! d9 V' _% C
. w% T. l3 s( b* gThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
* R: H2 v- {* v7 l9 f0 X, f* Gperformed in ring0 (VxD or a ring3 app using the VxdCall).# |2 E* v# m. X. r
The Get_DDB service is used to determine whether or not a VxD is installed
9 U) p1 @$ P/ Y% Mfor the specified device and returns a Device Description Block (in ecx) for- }% ~. ~/ o2 I# |5 P' P8 ^
that device if it is installed.
/ i- c4 l. I3 g g8 `! l" E2 e* _" @7 e% \4 c5 x% W
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
# g# C {# H) b& [4 R) K mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
9 C( X) W' f( ?+ s+ _8 I! Z' e* q VMMCall Get_DDB5 O w! j6 S: h+ Y) {
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed/ H- j& Y/ ~7 N$ b; D( Z
2 N* a" y4 S; H" kNote as well that you can easily detect this method with SoftICE:
# f! L t* \' O bpx Get_DDB if ax==0202 || ax==7a5fh
0 M+ s# |$ j, N; X0 l! D* s. ^' i v: U# J! j9 G/ ~# i f, w
__________________________________________________________________________
+ b2 t1 W, L1 r, e n5 \$ C* ~& P' _1 q% S
Method 10
$ y( e3 S4 r9 X+ F' ]/ y=========
0 }. @0 M4 V4 M' F& q( Y8 U
4 E8 @4 i7 R5 k8 K$ @=>Disable or clear breakpoints before using this feature. DO NOT trace with
" D, J, j' b7 f SoftICE while the option is enable!!
( X/ L. w9 X. f2 a, ^
; v. J+ J2 \7 E& k' w: vThis trick is very efficient:4 C( N( l4 ~6 u; \$ X i" r3 k% w, r
by checking the Debug Registers, you can detect if SoftICE is loaded
* R5 C* i7 @3 I% p$ h/ E, r$ n(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
, j- i% J3 Z# @- K# \0 [there are some memory breakpoints set (dr0 to dr3) simply by reading their
; X6 g( b% U3 v+ k6 Lvalue (in ring0 only). Values can be manipulated and or changed as well
* p: {$ G/ a; e1 q9 r- b1 V(clearing BPMs for instance)( I0 |; {, F0 o# Y) F
4 P# r+ V& B" l& j6 L9 S
__________________________________________________________________________
0 Z, w7 E4 C) Z0 j# {$ M( i* U; b& X8 D3 O
Method 11. s2 N- Q! ]4 u0 ~3 I- n8 ~; ^
=========: t/ B8 ^4 E" [+ [- w
; L9 v( T) c/ }& B- E& O
This method is most known as 'MeltICE' because it has been freely distributed
; S! P$ h% b5 I) |% B2 avia www.winfiles.com. However it was first used by NuMega people to allow
8 U" b* ?( Z+ e+ S, SSymbol Loader to check if SoftICE was active or not (the code is located& V4 q9 W9 F8 @! h# a
inside nmtrans.dll).+ K- J9 o1 K8 z- s4 W# o, l
% r) K' T& H% N: H+ P' qThe way it works is very simple:6 O1 Q* P% o6 N [4 U
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for" [/ x$ t2 B, d+ j8 W
WinNT) with the CreateFileA API.
9 ]) A2 M) M& Q2 Y$ W& S8 a& t' L3 D0 T/ z' |! Q6 W- {
Here is a sample (checking for 'SICE'):: E# L( M+ |: x: {. T
7 T- |6 e5 J2 a/ a9 [5 H k" I; rBOOL IsSoftIce95Loaded()
- s7 v' k; @# ~0 e+ {9 @; A{
. E1 b* d# A2 M; L( f( z HANDLE hFile; * t- j2 K, H* D8 e( m0 _, \
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
# Q6 u+ ?9 M- O FILE_SHARE_READ | FILE_SHARE_WRITE,$ f Y# w5 [9 `2 w* P+ K
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);4 q5 _4 a4 d& T) c: J# l% b
if( hFile != INVALID_HANDLE_VALUE )* W; I7 S; C1 n+ ~ k7 H. |& R
{
+ a5 M, O! E9 L& Y& m% Z CloseHandle(hFile);: b2 \& H2 U0 A% q' l. p/ v
return TRUE;5 l% j4 q) ^0 U; j) i3 j" |
}5 D1 b( b9 P, ~
return FALSE;
1 q+ E: \7 f! h' w* Y$ L# @& f3 A}
" j) ]+ T6 I- V1 P8 |/ e- P& U+ ?5 U8 A" k# y
Although this trick calls the CreateFileA function, don't even expect to be1 P1 R+ S' E* n D) ]; ?9 B
able to intercept it by installing a IFS hook: it will not work, no way!" B6 _" K; z! \5 y/ c
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
( v3 [8 O0 k- ^" Sservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
1 |: F( {$ @$ w0 g9 d3 S1 Gand then browse the DDB list until it find the VxD and its DDB_Control_Proc
3 s, v; B2 v+ {; Y" L0 @7 P; mfield.
* X- V& Y( s! Z2 M3 @, ?4 S6 | yIn fact, its purpose is not to load/unload VxDs but only to send a
6 i( z w6 I) C0 IW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
F: [: L5 X, z4 Y8 pto the VxD Control_Dispatch proc (how the hell a shareware soft could try; Z' t* j$ \1 V% U, o; f
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
8 q; @5 T" `6 b, qIf the VxD is loaded, it will always clear eax and the Carry flag to allow5 _. _" ^) W: L! @8 y/ v3 J
its handle to be opened and then, will be detected.
# u2 z) G. `# m9 zYou can check that simply by hooking Winice.exe control proc entry point7 I9 g$ Y5 l; v8 y$ o- _7 m
while running MeltICE.
9 N7 t- X, ?0 `* F/ G1 X
- L! ` r: m6 J8 A; z- g1 w3 T" m6 l. Z, p3 Z+ U ~/ e
00401067: push 00402025 ; \\.\SICE3 v' f$ k H$ o8 n; b$ n% G8 E8 u
0040106C: call CreateFileA! n4 t' F& M# W L t' Z- O' G
00401071: cmp eax,-001
. Z& D7 r8 A; ^/ L 00401074: je 00401091
7 P* r! g6 }$ j2 B# V4 {1 E) P. x4 ?5 t7 ]7 R: S2 |
2 V! z3 I" a& o9 L' B; G. VThere could be hundreds of BPX you could use to detect this trick.$ P2 D& l% j( [- A @6 @" I4 j' O
-The most classical one is:& b: y ~; U" G% N* u* T
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||; s, V. r6 Y! W: k# J1 R1 v
*(esp->4+4)=='NTIC'' n) i% [3 ?& K6 M' T7 u
* U$ d4 u: j/ [. i+ v7 `-The most exotic ones (could be very slooooow :-(
, k* d( O1 W n- f" E% K) Z( n BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
2 z5 M5 \; Q. E ;will break 3 times :-(: X5 F+ c* F) Q( Y
$ W. Y' L; K; a X-or (a bit) faster: 5 i& a- e& Q9 L" s1 H1 A
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
7 i" A, U6 h0 S) ~
$ L5 h& E+ s- D- v( l BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' + g9 [- Z8 @# l$ P! a: M. y
;will break 3 times :-(
$ i" j) y8 M6 o2 [0 a7 l$ M8 E7 {
; q2 F! A! h6 |4 |; Q; P-Much faster:
% K4 j7 }2 b' @# i3 @ BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
$ B. h& f+ |% i5 |8 n) R( Z6 j9 g' g& u
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen2 H) e H, Z1 j; L1 o8 }/ J2 H$ t
function to do the same job:
8 W5 Y7 S% }5 u4 N2 L M0 A6 G2 p! O+ D1 ^4 U, \3 [$ K, y
push 00 ; OF_READ
4 b( ?- u/ q5 ~- o e( ^. H mov eax,[00656634] ; '\\.\SICE',0# E2 U) i8 E6 o# g, G0 I) y
push eax) V* t" {/ V& w
call KERNEL32!_lopen
* H8 o5 G: ]$ [/ S: g inc eax8 d$ c; L! D7 r- p' `
jnz 00650589 ; detected
4 {: H$ {$ O; O# ? D push 00 ; OF_READ* Z/ V, j5 e8 h- g
mov eax,[00656638] ; '\\.\SICE'# ^& [& \+ ]* n+ _" ^+ `
push eax7 \/ {# {+ d+ z9 a. k
call KERNEL32!_lopen
" m6 W. `- U/ X6 H& A2 H8 U4 M inc eax9 ~$ ^) G- x# d1 s3 |
jz 006505ae ; not detected
# v7 Y% E/ A* p
6 M: H% D5 q, n3 `% _2 D( p- u/ L; b0 _4 J' i5 H3 y. R
__________________________________________________________________________; x, ?+ ]1 A: l3 W3 Q% H d
; q. ~% U( `2 b) ~$ k' gMethod 12* F4 W7 f' Z" k
=========# I e) a N$ J- b! A( U, v" X
7 e1 m* X! b, v2 x
This trick is similar to int41h/4fh Debugger installation check (code 05
( @7 @7 `: W& W+ V& 06) but very limited because it's only available for Win95/98 (not NT)
; D7 E* a* X5 Q! I) x1 k, O Mas it uses the VxDCall backdoor. This detection was found in Bleem Demo.' o& q0 e( h+ D( o( n/ x
3 r0 a5 S" E5 ]; _# f push 0000004fh ; function 4fh
% h F( ]- B& A" ` push 002a002ah ; high word specifies which VxD (VWIN32)5 w) b& e7 C( y) }
; low word specifies which service8 Z R7 z4 I5 \8 t! ~. ^: X4 K0 E/ ^
(VWIN32_Int41Dispatch), ]/ L2 k! j' j" ?7 v
call Kernel32!ORD_001 ; VxdCall" S5 B, k2 g$ b
cmp ax, 0f386h ; magic number returned by system debuggers
3 J- t) M, V7 }; U1 ]2 p! r5 | jz SoftICE_detected0 p+ ]5 B0 b7 [# v3 H3 `
% ^( M2 K* S+ a7 i/ o/ B% _. w8 tHere again, several ways to detect it:9 g; x4 V k9 J; X" `/ F' r, N1 Z, J
9 [6 p/ N, L; Q7 v1 u2 S BPINT 41 if ax==4f
# H5 _1 q9 y3 c
. k9 a+ I$ K/ r1 U. E BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
- M4 i! T" f/ O. ?0 q# H/ I. H& r! z/ s$ {
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
) o$ ?" b1 |- E4 O" O
7 A( J& u" v) K; L' \ BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!3 V/ j$ m2 C. q
1 K9 M# L1 j( G1 q8 s
__________________________________________________________________________8 h2 V, i8 {5 q( ~
6 A& ?3 r$ r$ F, |! d5 X
Method 13
0 R e( I' D5 v8 C' t=========% |+ @3 l* U" N% X
% |, I2 `+ K; \Not a real method of detection, but a good way to know if SoftICE is5 n+ @. ?: c8 L1 S! Q: z9 i' p$ U* z
installed on a computer and to locate its installation directory.) P. O; {, V4 m0 a2 ~
It is used by few softs which access the following registry keys (usually #2) :
; S# s/ [& ]: P1 C8 L" ~. Q
. H; q4 W3 ] ? x7 F-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion6 c+ a) _/ u0 \; E: s7 p- C
\Uninstall\SoftICE
% [0 `: {" p# i+ s6 y-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE' l) j" X9 m; o. z$ o: c
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion) {4 u) l j: \# i9 ]3 q+ Z
\App Paths\Loader32.Exe
. ]! e7 b+ H! w, {5 y" w" X9 y2 c7 R) R8 ]2 X
% _0 v# ^. v h2 a+ u% M6 K/ U& [
Note that some nasty apps could then erase all files from SoftICE directory
/ @' U$ b" D8 L- i(I faced that once :-(
" h Q- k+ |3 U
: E% k2 o" a9 S9 I ~6 w* f3 TUseful breakpoint to detect it:
/ z; n/ x& h. ?+ u
6 x; X' Q# b% H7 H: h BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
" S. Z( @( e/ S ]/ [2 V$ [9 T1 v) O& f, F9 h
__________________________________________________________________________, U2 C6 E6 k* U6 G
0 O$ t" _! k! E: F/ K. K3 S9 j: \+ j( d2 z$ H+ A$ s5 {8 H" b
Method 14
! v4 e& r8 C: G, k/ |1 t=========/ O& J* t4 R0 }3 B
( Q2 i8 D( m' G" j6 BA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose" I# F$ B' V- ^4 p" V* o( U
is to determines whether a debugger is running on your system (ring0 only).
; R; a& P# O; P
- ?- k0 M- ?4 n2 h4 r6 r8 ]" }# b VMMCall Test_Debug_Installed
6 n/ Q& @, I' Y7 P9 k4 k6 q je not_installed1 G' a, T3 q/ E. H% k( i
# z6 S8 U! m. Q6 G: y1 i& FThis service just checks a flag./ S2 c2 f8 Z! X
</PRE></TD></TR></TBODY></TABLE> |