<TABLE width=500>
6 _+ @$ O- d& V6 N<TBODY>
- U, S1 q0 s+ X6 R<TR>4 U, Q Y9 D$ Y% W
<TD><PRE>Method 01
. o% X2 F8 m/ _8 P) A( h' s=========2 e( Z3 Y8 q, v: L
' }. W' \' ?7 d* q; Q& `This method of detection of SoftICE (as well as the following one) is( t- O- p' P8 i' P5 y5 Z4 u
used by the majority of packers/encryptors found on Internet.8 }* C" s. h) f/ l
It seeks the signature of BoundsChecker in SoftICE0 Q. e# z' `. A! G+ L3 w
# ~/ W% l3 z! C/ T: s. P
mov ebp, 04243484Bh ; 'BCHK'
2 R" l5 V9 }( o/ A. w7 M+ | mov ax, 04h
$ Y+ A& [. |2 a int 3 4 a8 E9 C: E$ J. w
cmp al,4
0 o. h g. M9 {$ Y! Q4 U6 i t3 P7 O9 A jnz SoftICE_Detected
/ ?6 p- H$ n# Y7 e3 i3 l
1 ]) f) x' e, D! V/ y( q. o___________________________________________________________________________
! [" H7 j# c/ ?
7 ^. N$ k; j0 n, w6 w1 B( qMethod 024 `; |/ I' p( V' c) p% x7 v6 v/ {
=========3 Y& I3 E/ a( `$ ~
/ P9 f1 X% g6 g' _& q
Still a method very much used (perhaps the most frequent one). It is used
$ t3 C$ k- l& J6 `1 x( Pto get SoftICE 'Back Door commands' which gives infos on Breakpoints,4 o9 _; n. m8 ]
or execute SoftICE commands...
# ~% G* p& N2 E/ U: D! WIt is also used to crash SoftICE and to force it to execute any commands* v2 Z" [# }* G3 b# I( c
(HBOOT...) :-((
# c+ d$ h7 Y6 y
" e& K0 U( x6 OHere is a quick description: @3 D* s7 n# {; ^* v: k
-AX = 0910h (Display string in SIce windows)
. F7 x8 E; M7 \; P! }6 O4 n- x& X t-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
1 P/ E- ~. `8 O& ^6 L-AX = 0912h (Get breakpoint infos)
5 e1 Y( G4 q" Q. k& _6 ~* L- |-AX = 0913h (Set Sice breakpoints)! B8 l! @6 y9 P
-AX = 0914h (Remove SIce breakoints)5 ~# x9 X- B8 n7 `! ?& \4 L1 w
; J% ^. c" C1 X, @4 Z
Each time you'll meet this trick, you'll see:
' C4 s5 w, W2 o& l+ l3 ?, ^9 W-SI = 4647h
6 k8 X& i C/ G, L-DI = 4A4Dh
- r( z- B1 p8 r- u+ Z* u, `6 _5 [Which are the 'magic values' used by SoftIce.
0 a3 \( _: |+ ?, B8 yFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
( _) r" w* b& M2 L& O ]4 E) m0 i# N/ | H9 B
Here is one example from the file "Haspinst.exe" which is the dongle HASP
/ Q# ]9 H! X- K/ S1 ~Envelope utility use to protect DOS applications:' t# ]3 V0 i6 @% ?% C
8 G" d3 r) U B5 L- O& W$ E) t( K1 \0 m. M6 Z0 i7 B
4C19:0095 MOV AX,0911 ; execute command.
9 c* E7 K( C) S1 D+ B) b" {& V _4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).% X4 x2 e1 O* E: Q4 `
4C19:009A MOV SI,4647 ; 1st magic value.
+ m6 H; b% J; ^1 i1 z4C19:009D MOV DI,4A4D ; 2nd magic value.% N6 I- l- T' n/ `& X( s1 G+ ]
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)( d v+ |& V3 z
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
! H3 J4 n+ a! r) A6 j/ n4C19:00A4 INC CX
( o6 V9 F3 ]* v: Z4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
: I2 K+ ?- H, ]* t4 M$ y4C19:00A8 JB 0095 ; 6 different commands.
- w0 \& R5 D: q. L( C. u4C19:00AA JMP 0002 ; Bad_Guy jmp back.
. N" o% d0 k! D" Z8 e$ ?. v4C19:00AD MOV BX,SP ; Good_Guy go ahead :)/ z3 v$ X0 Y( j+ _
) W) c! }0 M) b; F, O: z2 ?The program will execute 6 different SIce commands located at ds:dx, which
/ i/ X G, n& z }) w Z0 |. zare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
" h6 J7 Q# L8 f& I N
: p ]0 W6 x) n* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
5 O8 _& W; I7 A3 ~8 G1 }___________________________________________________________________________
+ z5 c, i- d: j( k' |: a0 u# t3 {9 H& {/ w7 T" a
0 T- q9 r5 @7 `' G- |# x
Method 03* u7 @' Z/ z. p& d' o% i; a
=========
- W( v/ t- v- `1 ~" `# i/ e" d6 O: r4 e1 s. U
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h2 B7 S5 I' X) x& L/ k
(API Get entry point)
5 T3 J' ` Q3 Z, E. c8 ~ * [4 z: \8 p$ C- t O' p
% l* }7 d7 F/ I7 y; o( r- `! s
xor di,di5 D1 f" ]* n, s& t& {' y3 r1 ^1 [
mov es,di4 k# Q4 H. ]+ D* d- q# `
mov ax, 1684h
, G G1 t; k& I mov bx, 0202h ; VxD ID of winice
5 ?1 p* p3 Q7 V int 2Fh
9 w! D4 w9 ^3 k& z4 z8 X I3 s mov ax, es ; ES:DI -> VxD API entry point- x' A/ d5 {- V2 a0 F
add ax, di
8 W |6 |2 b: N) `+ R7 D8 G: c test ax,ax
9 h9 p' i# Q' G jnz SoftICE_Detected
; @* v3 w8 M8 c) j9 _ B, H% t! J0 q7 S( D+ m3 p8 q1 w
___________________________________________________________________________# D c" S; E4 ] l' b( r0 u7 u
6 r7 e6 d* f' r( R0 S1 _Method 04
+ h/ g3 ]* r* G& D# l5 p=========
" ^7 m. ~5 P2 T& Y, d& q! j6 Q" R( R5 i! O& k/ s8 q: }! k; ?6 x# g
Method identical to the preceding one except that it seeks the ID of SoftICE
8 O) R$ m; @+ ^; H6 `) b' LGFX VxD.
`2 y0 J; A5 _9 V+ q* R. R1 ^9 ~; @! C! `$ W
xor di,di$ n$ i3 b. j& k
mov es,di1 R7 T" `4 C. W+ k' A) P
mov ax, 1684h
& S4 E0 ?8 J3 N mov bx, 7a5Fh ; VxD ID of SIWVID
2 J, m$ B* _& b8 D3 W int 2fh
) ]7 g8 ?, K9 @ mov ax, es ; ES:DI -> VxD API entry point
- g1 L; i+ d5 a7 j" d7 F add ax, di" n* f& k( U m% e, {
test ax,ax9 Y# Q `2 A( t2 _5 \, S! _
jnz SoftICE_Detected
5 h8 t$ s4 q1 n+ Q+ \5 `9 E: L( q: t1 k. Z3 Q
__________________________________________________________________________2 a d: `0 u/ Y$ B3 c+ W7 Q* h
9 H* E: {4 W. d$ z$ _- c- Y! O3 |# q% }% p
Method 05
6 t+ p0 M" y* Z9 R |, P=========, i- v% k" T* ~6 O+ x$ L
% a! @) C8 @& ^9 V( x; FMethod seeking the 'magic number' 0F386h returned (in ax) by all system
) S/ {, i& j3 N0 N# u0 xdebugger. It calls the int 41h, function 4Fh.
3 |$ V3 Y6 d/ v6 @# W) u6 EThere are several alternatives.
! e& ~. u) F/ ]
/ S2 b- `7 h7 R$ Q& ?" iThe following one is the simplest: k- y8 N* s* V) H& }
' M) [# r( e. s+ k mov ax,4fh
$ P H6 k* p4 \0 H% d. [0 Q int 41h9 v3 b: H7 I/ S* O/ ?
cmp ax, 0F386
$ W m( S% Z& x i! X3 b jz SoftICE_detected
! a* D; [; i2 o o* e2 g) [- }. M. N$ M& w* P, `# K- r8 c: e
0 `8 z3 k/ O( INext method as well as the following one are 2 examples from Stone's % b- K6 J7 X/ O8 r. R+ ?
"stn-wid.zip" (www.cracking.net):
) p1 w8 r/ k" n& e- ]
8 ]/ |4 Y0 K/ K& z; Z T# [0 R mov bx, cs
4 c" }2 X0 b5 u, C% S' f lea dx, int41handler2
- Q j. H p- l3 p! T& M7 F xchg dx, es:[41h*4]
' Y7 I8 P2 j& R0 q( ~' I xchg bx, es:[41h*4+2]/ E1 \! o5 j' z# q
mov ax,4fh5 g0 `! e8 l7 ]) X$ Y0 P
int 41h
' O' J( r ?$ D$ e! K9 L; @ xchg dx, es:[41h*4]" R6 h9 {8 u* E
xchg bx, es:[41h*4+2]
8 ]- K3 P2 t; H' H+ H& l cmp ax, 0f386h
( h+ W$ d/ L1 Z' o1 r jz SoftICE_detected L& k2 X6 }8 V% l- _ X" ~: L
, A& b5 D9 e% D% ?* [( lint41handler2 PROC
8 Y. ]7 Q& @) T" t* u iret, ~8 p. }9 J9 Z, Y& s6 S9 \. q
int41handler2 ENDP$ n0 ^/ q( E& Z/ J' {8 U! Y4 V1 m
- B6 b1 O" m1 k; Y* l1 k
# w+ [6 Z0 X3 E
_________________________________________________________________________9 E5 x# V6 R4 `! H; S: g
, ~% K+ U4 P' }3 e* V0 f
0 m9 ^) @ U' Z/ A8 |Method 06* y" P% e4 O4 j5 D/ R# t/ ^
=========2 |9 ~8 c" V* B3 D# \( g* u {6 p; N% m
- g9 h7 U I* k) s; V0 `* V! g! H( @6 _% w( ?1 [" a
2nd method similar to the preceding one but more difficult to detect:. ]7 a& \( k/ C! ^% k
) o- ~. g3 t4 h) G \ p- S$ o7 `
* r8 P2 Q* |0 Q) c% R$ jint41handler PROC
# X# t0 Y* w7 \. _, c mov cl,al# x3 q Q# {3 b( [
iret( Z; i# d0 p9 K- k$ U) V2 r4 p+ U. I
int41handler ENDP+ k5 v+ O/ {6 F# E& j# T5 g
1 \( D1 q8 ?1 a
# |/ z$ |- o" h. w' t; Y xor ax,ax/ {3 b: u/ X8 ^
mov es,ax
. a7 F' N8 P, o mov bx, cs: f( K- }) r) {, J
lea dx, int41handler
7 ?. G0 r8 N" E xchg dx, es:[41h*4] i: q& y! y0 z) ~! \% f1 T
xchg bx, es:[41h*4+2]
- r3 j9 G7 D+ W# Q6 T) R7 M% y in al, 40h4 }0 e I6 T, G3 x- o
xor cx,cx
$ {# Y6 ?& A& m" L int 41h
) P9 _2 ~" D# D9 f6 z; t* Q xchg dx, es:[41h*4], X! h( s9 V( H, i$ v2 F6 y
xchg bx, es:[41h*4+2]; k# [4 G4 X3 T% E& ^3 u9 Y
cmp cl,al, W: ~ `, S/ v! x. g5 A! w
jnz SoftICE_detected
/ u: @) _' N) f1 k
0 Y( R, j( k; ~3 _' s_________________________________________________________________________8 P7 Q( X9 I% ?8 {1 E+ [: u
, [, D9 O Q# H1 W- jMethod 070 M8 b) S: i2 i* C3 f, j; q& P
=========
7 c0 X: u8 v, N5 P9 f& V/ C/ i8 |3 E9 u9 V# v. \ v
Method of detection of the WinICE handler in the int68h (V86)
6 t0 w6 e! }9 C& a1 S+ ~$ @
+ v5 d+ }* f- a! _: ~* R* e( B mov ah,43h
# S9 x( e. ?" _6 l- K int 68h4 ~% Y. `6 L) n; h8 G
cmp ax,0F386h
% K, c# Z5 d& `2 o B jz SoftICE_Detected
+ o4 u0 l1 F" c( _" A* z
8 j4 V7 N& w) E; f: k2 g2 C
l; f2 w. w2 j$ L- I$ ?1 ~, a- ]=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
$ E6 _0 T- e F app like this:" n9 b2 ]& X ]9 n
1 |% q% U0 |8 } u% m# J- x* B BPX exec_int if ax==68
% r+ f$ i! a2 P$ b0 u (function called is located at byte ptr [ebp+1Dh] and client eip is
/ N$ J7 Y, R4 R- ^1 B T( @! q located at [ebp+48h] for 32Bit apps)
/ o2 d4 m8 z1 w7 k__________________________________________________________________________
2 M" [! w) K: R' x
) s0 `9 M$ j# k3 l% i0 a* ~* ~; a& [( d; c% {$ k% R
Method 08
# o6 ~. b" ^& F6 s=========
' ]" d6 L) b" K0 s, A: j: n2 o% D- q& r
It is not a method of detection of SoftICE but a possibility to crash the3 N5 A" W, @' N9 ]( d* O% q
system by intercepting int 01h and int 03h and redirecting them to another
% c: y5 r( i. R2 T* e4 ^ w: Qroutine.5 ~- |+ b, N; i, r: O- }8 }
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
u' i* Z( i7 o% M+ S5 h1 [7 Eto the new routine to execute (hangs computer...)- h3 l! W- Q) s3 y
/ [* c/ F) m! G5 `% x
mov ah, 25h Y1 F: ^+ n" M8 v& }
mov al, Int_Number (01h or 03h)3 K5 N% C# d' A9 J+ A2 u A
mov dx, offset New_Int_Routine& q6 T$ C1 A/ ~0 m
int 21h
2 z! B# J' v- k) w- M/ X# X, X( M, i: G$ o1 ]
__________________________________________________________________________
# g W: E) `- g4 k" e* l8 E v, }& i; f
Method 09( r1 t* U1 |& b/ A7 ~% m
=========
8 B' S% F8 k3 u6 s$ E7 q4 c0 b3 X% I6 f" o5 x0 G
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only8 G- P( J) v) }6 r6 ?
performed in ring0 (VxD or a ring3 app using the VxdCall).
8 t% e4 G+ u) I0 I& wThe Get_DDB service is used to determine whether or not a VxD is installed
" A! f/ F5 v7 a, Dfor the specified device and returns a Device Description Block (in ecx) for
i3 J ~3 E/ p1 ]that device if it is installed.3 Z" ^1 ^' f5 F$ \
8 V$ q5 b8 {5 P8 {; b
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
- a" v/ ]5 H0 g2 V! h- z mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)9 X% p: E* r6 H: s/ \$ y
VMMCall Get_DDB" F0 C" x: k$ t$ j9 g- j8 V5 E7 t+ C
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed8 Y: o! I' `$ F
2 a4 ^9 M- D1 `0 N- l/ KNote as well that you can easily detect this method with SoftICE:
, I0 W2 ?: t3 |6 `8 x0 h8 @- S9 {* r bpx Get_DDB if ax==0202 || ax==7a5fh
$ \4 D% d" P0 D# B/ F9 I
" l! ]6 p6 e! Z+ e0 A& q__________________________________________________________________________) K$ ?8 D- B. u" z2 j( {( F! N
\" h. l$ m! lMethod 10( R: `* O- y- ?" e# ` G$ u# Y
=========2 {, B9 i1 |+ a
* x7 N! V" E" c( i {/ V
=>Disable or clear breakpoints before using this feature. DO NOT trace with' |9 {8 C0 D9 b' c2 G& i9 n5 F% E
SoftICE while the option is enable!! C+ L7 r4 O0 p# |1 A5 p
# _$ r, c" d: t8 ^This trick is very efficient:
& F5 ^6 ]% S+ ]! pby checking the Debug Registers, you can detect if SoftICE is loaded' b$ I6 H9 J( U) b4 v
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
$ C! n. j% x+ Z& y9 ]# h- Mthere are some memory breakpoints set (dr0 to dr3) simply by reading their# \* H) Y) I: [+ o
value (in ring0 only). Values can be manipulated and or changed as well
) b! B( T' j" q* c4 f' C4 J(clearing BPMs for instance)
+ |. R5 d4 s4 u/ Y& E! g( k! r/ O2 E' ]( ^, b+ [, O0 L' J, F
__________________________________________________________________________
8 o9 }! r4 w* e0 ?$ Y
1 V5 P( u/ i- U6 D5 J* t/ u8 WMethod 11
8 P+ Y z3 B7 _& I! K=========: W, `! U! R+ Y$ G
8 y. z; z3 \: j7 lThis method is most known as 'MeltICE' because it has been freely distributed
! b1 a8 e4 C8 e' evia www.winfiles.com. However it was first used by NuMega people to allow
4 W. d" G) Z) n! JSymbol Loader to check if SoftICE was active or not (the code is located# e7 J# d8 C! O8 ~+ c J
inside nmtrans.dll)./ g+ E0 T5 c$ X a( E+ O' _3 f
% A7 v- y( I9 l, ]8 TThe way it works is very simple:
- M' N# K: K/ U- p# z) w v% @It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for+ q7 O9 f. w: I2 M
WinNT) with the CreateFileA API.
+ S i( d& L. W6 `, }
8 \; ?" e' a! _; l LHere is a sample (checking for 'SICE'):
! `# r; M5 T- W7 ]
- q, X$ R# \. S; m, f3 XBOOL IsSoftIce95Loaded()+ K2 R8 a% ~8 S8 q/ @' b2 U
{
B- p! {' H7 A2 O, F HANDLE hFile;
, _6 N7 q/ @2 ~4 \/ a) L/ N$ G& Z hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,% ]/ s. p4 K2 c$ Z- a
FILE_SHARE_READ | FILE_SHARE_WRITE,) E! N b7 n4 Z- Q* P' Z1 j
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);; A6 H% K1 J' _+ Y7 ^& ?* C
if( hFile != INVALID_HANDLE_VALUE )
# N n, k' T! V4 T9 M {1 I, x7 t% u2 S9 e
CloseHandle(hFile);
1 Z; [5 _6 T! {! b6 V# F return TRUE;
: q$ ^4 O' }% i& ^4 S }- E6 ~+ |: S% n4 l
return FALSE;
: ~+ [& |+ X! t! P9 {6 s& E/ {2 T}
( Z6 Q/ H9 O. G2 L7 }9 A2 m8 U1 P2 k' z/ p
Although this trick calls the CreateFileA function, don't even expect to be
: B8 A6 o" ? j2 ~) q, K A" @- Aable to intercept it by installing a IFS hook: it will not work, no way!8 c7 [1 z" I: z! Z5 r# e- a5 |) n
In fact, after the call to CreateFileA it will get through VWIN32 0x001F. Y& E# q8 M$ x3 P
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
1 E! f! ?( V/ f* e% iand then browse the DDB list until it find the VxD and its DDB_Control_Proc5 P" G1 ]4 g K# f: Z
field.
# x' [" G: q$ H2 ^2 v( Q" A/ tIn fact, its purpose is not to load/unload VxDs but only to send a
* |+ z! Q2 T- [1 mW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
: A* G* f3 x' b+ J# kto the VxD Control_Dispatch proc (how the hell a shareware soft could try7 U* j# T6 m, z5 c# o: R' j
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
* T7 r( ^; J6 r& H! O/ l9 XIf the VxD is loaded, it will always clear eax and the Carry flag to allow
% I5 k0 ]" M+ T8 \its handle to be opened and then, will be detected.
! i2 m5 {5 V9 w$ Z. j# G3 T4 p. kYou can check that simply by hooking Winice.exe control proc entry point" D* _- ^( x3 ~: q; r+ W% \) ^' L
while running MeltICE.
& C# h! x( L% k6 H R7 m! a* y8 r8 s) N7 _
, Z" Z+ L+ R- m- ]' q' V 00401067: push 00402025 ; \\.\SICE
- y# C E, f! s! E' S 0040106C: call CreateFileA
, G+ F* a x. a6 y) e 00401071: cmp eax,-0012 Q; Q7 R! n) E6 O5 @! i
00401074: je 004010912 r" a" ~8 j" N7 m' y4 m. ?& I
+ q# S# @: W1 V( j* p, R. _
' j3 R: q# G9 c9 W/ G" u/ fThere could be hundreds of BPX you could use to detect this trick.
8 S# \ ?2 e% ~( X- W& J- N-The most classical one is:3 ?7 } q2 K O6 a/ j$ o
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||0 @8 s- s( }1 _" `
*(esp->4+4)=='NTIC'
j+ c+ P& _) n' y, B! V; `4 _0 ?9 C$ ~6 }1 A4 a5 m
-The most exotic ones (could be very slooooow :-(
9 t) v; u, o# A( I( Q BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
* q) N; @! D7 Q" O+ \ ;will break 3 times :-(8 G& f+ j# E8 v1 r s8 x5 Y: {& \5 }
3 a, e" E+ q' ^4 P6 a2 L$ T5 ]-or (a bit) faster: . D" U; i+ Q' E: w5 `
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')! {8 Y# p1 s6 C. B- _3 U
6 j* e: h) } g% B! O1 J) ^# m BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' 1 E7 ]. p" M3 U5 s
;will break 3 times :-(* U7 o0 _* o5 ^* P
2 b Z4 G9 r- t8 B/ j-Much faster:5 T9 h+ Q5 p( w
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'0 P+ s8 a( e' ^& S0 X R# o
4 k7 I; W: _' C( g! ~
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen$ [7 a. d2 B! p4 x+ D4 B
function to do the same job:
* @" @( M' M( S+ H0 r6 k% s+ P
5 A$ i* s8 [1 V- u, C push 00 ; OF_READ N$ [ c5 J' X6 N
mov eax,[00656634] ; '\\.\SICE',0
$ y+ ~+ t7 v- {* g" u- N push eax
# Z# F l$ L8 s call KERNEL32!_lopen8 U& S, u8 Q/ s' i( N' Q/ m
inc eax) Q2 c: h" P: y
jnz 00650589 ; detected
" O3 N$ E* Y" K5 ] push 00 ; OF_READ
* t# r: V m) i i' p ^5 u7 ?8 L mov eax,[00656638] ; '\\.\SICE'* x* M7 g/ u* H2 s% ~1 A
push eax
/ K9 W3 I$ f6 l2 s `) r call KERNEL32!_lopen
: N; Q; x$ k! N) s: J9 |4 Q5 I& w inc eax
) X; i- v7 e& T0 y/ O jz 006505ae ; not detected' d* R$ V' e+ b! {* u; |
4 k% z9 x! z5 ~' Q: t+ q/ j! N0 J
% W: \- N* Y& V; v) J% Z" f__________________________________________________________________________5 Y/ G W+ E1 d3 _
& o7 B# ?. ~8 ^. @: L& o& X- wMethod 12& I. ]: P& E: N8 i( P; r9 f
=========
' R$ |" m" p. c# J- r
. T7 ?; h g. a" U' vThis trick is similar to int41h/4fh Debugger installation check (code 05# b! j" v) ^8 } O
& 06) but very limited because it's only available for Win95/98 (not NT)% j7 o1 g) D0 F8 U. ]0 K# c
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
8 D' ~& q$ m" d# q% i( N' y
" e# Z1 _9 G H push 0000004fh ; function 4fh9 N+ c6 ]/ @# h9 q
push 002a002ah ; high word specifies which VxD (VWIN32)% N, U7 z" y. |( M5 z9 x9 L
; low word specifies which service
& u' K' W& {9 [8 n (VWIN32_Int41Dispatch)6 [* I' {/ _- P: n5 `
call Kernel32!ORD_001 ; VxdCall2 R5 |5 S! Q* g8 \+ p
cmp ax, 0f386h ; magic number returned by system debuggers
" s3 j, r1 K v$ U' T jz SoftICE_detected
5 B8 s4 {9 t4 H$ m# n2 f4 }& h
! }) U M: j! T8 A/ j4 THere again, several ways to detect it:/ i0 Q% B) M$ O7 c
7 o7 a% R4 @/ \/ h: U BPINT 41 if ax==4f
9 {9 P7 A4 V6 Z7 `$ G
7 K8 @- l& |: Y( X+ j% A. ? BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
: A! P8 J4 o( o) W8 s, N) K! h% a! g( V( p. Z" H/ x
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A# l% q. i0 r& m$ R
4 ^: d, c. o. z8 J
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!( g# M, h3 s! C( J" L# D( n" e3 G2 y' ~
$ i4 ~/ [: Z0 }3 l__________________________________________________________________________
4 L7 z* D3 v$ J1 J8 K9 \2 w C9 s4 m/ @! J/ x* M. O0 N* d
Method 132 u4 ~3 [6 u3 i7 {& S! t
=========
& c& |8 ^1 @3 p" h/ @" Q; S; v# F! K2 ^# Z7 e8 b" Q
Not a real method of detection, but a good way to know if SoftICE is
5 K b' \* t7 d7 k5 K1 Cinstalled on a computer and to locate its installation directory.
. i9 X4 \ o) s7 E) CIt is used by few softs which access the following registry keys (usually #2) :" e1 A: [7 r8 i* z9 s
, K- P! T$ N, Z$ D5 @6 N- W* c-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
0 H- U- i0 } x( p3 J- O\Uninstall\SoftICE
4 N( F% W; d2 j-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE& Z3 B4 L) k p- R C6 F9 F0 r
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
& n: e+ j! R# N, {5 N" Z( p\App Paths\Loader32.Exe( |, w4 i' s1 i
2 I5 \# p5 f( }
2 E6 w6 G' M: s5 q) S5 m% K# }! SNote that some nasty apps could then erase all files from SoftICE directory
" x8 {7 J: ^% ]1 M: }7 M(I faced that once :-(- R$ R: E$ r+ S# C/ {1 G T
& ?0 G5 m' O! `3 o1 }' R
Useful breakpoint to detect it:0 ^9 R1 ?6 D, I( L. }
; k0 b' d& ^9 i, e% o0 k BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'# r6 d5 Q6 w2 R3 B) ], x
( W$ t1 k% g) o; m9 ~' Z Q
__________________________________________________________________________
2 h3 U) P! N$ @) J m& Q+ u$ E+ f6 m. d
* j' I# q3 e+ Y/ z; ]
Method 14
, D: d( T% m( ^=========6 Q* X6 j2 E$ I) J, T* P2 Q
7 J( E* s) P$ ]' _2 [5 T
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
5 K8 W/ u9 R7 s( }/ b) Ris to determines whether a debugger is running on your system (ring0 only).. y% N s. J9 ]6 u- |
6 Z* ` l9 P& b' G4 K* p3 o; K( P VMMCall Test_Debug_Installed
. G5 o# P: r7 T- C. ^2 o- T( v' U je not_installed, O5 Y- g! M# i# H
: n3 |+ _, h2 qThis service just checks a flag.
) S! i, T' O# C! g# m</PRE></TD></TR></TBODY></TABLE> |