<TABLE width=500>
0 B! V& A4 J( }& S4 B<TBODY>
& L/ e3 \" K- E<TR>
1 |6 X! L4 P# y+ e' P/ V( F; R, _<TD><PRE>Method 01 ) s* C6 j- V2 L* ?) }' l& Y
=========4 x n- [. v4 i2 W
1 K3 I. c. V# ^5 v3 ?6 k) {. VThis method of detection of SoftICE (as well as the following one) is
; H' l6 o- J6 e0 Eused by the majority of packers/encryptors found on Internet." z3 a' I+ u' }$ j& L+ [5 K' x. h7 g
It seeks the signature of BoundsChecker in SoftICE
: A- e- z: B& {5 ?5 P5 Z: `& v/ Z7 ^2 A$ J' X' R
mov ebp, 04243484Bh ; 'BCHK'- h5 y3 |% U$ d7 ]) n1 x4 M% U
mov ax, 04h0 _1 \& f2 h8 v$ q& f
int 3 ! o/ L5 b& [6 A
cmp al,4
8 k; E, P, f8 h5 l jnz SoftICE_Detected+ a. }" S; W& [, O s7 Q: r% n
, e! B+ Z5 e, R3 u! Q' l3 s___________________________________________________________________________
* H5 W( }- R+ |. }/ l) t1 p. ?+ @. d
Method 02
$ \, H3 L3 G; l& ?$ ^% ^=========
& P# v$ a% W% J! z
5 Q. v" S2 D4 [* {6 gStill a method very much used (perhaps the most frequent one). It is used
* U/ R3 G+ A7 Xto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
, j ]9 D6 c- d, W# A9 O& ^# ior execute SoftICE commands...& M" g+ k8 t2 k
It is also used to crash SoftICE and to force it to execute any commands/ d% i Y8 F4 C" X
(HBOOT...) :-(( 2 [# e Z! Q+ Z) A' E+ H7 l* n
+ P# Q% i/ J. {9 Q! D- ^Here is a quick description:
- D! K9 @2 ]& _, Z" n-AX = 0910h (Display string in SIce windows)
2 s0 H: f% \7 n( ]2 O( W-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
$ g' F* D y6 x( j2 E-AX = 0912h (Get breakpoint infos)
1 @" [9 w+ g: @4 B-AX = 0913h (Set Sice breakpoints)/ T0 s- H5 E" |; t, \
-AX = 0914h (Remove SIce breakoints)
3 D8 D v/ i) S' c( a; ]+ r W! Y' q. R! @& H* H/ W) E8 H
Each time you'll meet this trick, you'll see:# H- { c7 p( C
-SI = 4647h
& Z' \1 G1 i" r; D3 g-DI = 4A4Dh* S+ O, j2 |( a& o) Z: n5 l C$ G
Which are the 'magic values' used by SoftIce.
3 g" A+ M; r% eFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
) T+ D% [5 N3 n; {: D$ w8 Z: o
9 y- q2 N. H! S8 J1 nHere is one example from the file "Haspinst.exe" which is the dongle HASP
! ?7 P {; `1 uEnvelope utility use to protect DOS applications:
, e2 f4 }2 U' C, ]3 b! g2 q. ^+ ~( O: Y9 ^& r2 a {6 e
& c/ ~7 m y1 i# x, g
4C19:0095 MOV AX,0911 ; execute command.1 a! w( t9 _3 ~/ [* r8 x% j- K6 F- I
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).2 v G1 g6 W& o Y
4C19:009A MOV SI,4647 ; 1st magic value.
" D- [# S% Z+ `. K, q+ g1 `4C19:009D MOV DI,4A4D ; 2nd magic value.
7 ]! Q F7 ?1 a& S& ]$ H4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
5 P- z$ b3 g! A4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute0 |3 J9 ^3 n& B
4C19:00A4 INC CX, y! v/ t) e, f& A8 p2 y" @
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
6 `0 ` _7 ]5 s8 D4C19:00A8 JB 0095 ; 6 different commands.! L i" i( ~; X9 l' Y/ V6 H6 A6 r
4C19:00AA JMP 0002 ; Bad_Guy jmp back.
" h+ U% D* V0 ^" D2 \( W7 M% \" r4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
9 T6 t3 }4 x" E2 {' t% e& i8 W
% F, a' F ?- @2 Q) \The program will execute 6 different SIce commands located at ds:dx, which
1 s4 Q' \2 s+ W6 bare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.! A! L [+ h& g, E' T
2 Q5 T/ \2 L. A; u& R
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
8 H. c# y) {1 Q3 o3 M9 ____________________________________________________________________________
' U0 e8 P2 K/ K, @2 h) @4 E& W3 z( {& j0 Z
& Y* Q) u& F P( m% S- z: V" z gMethod 03) a+ i5 i. I2 I' N. f4 y4 x
=========
2 K4 m; e; m9 d8 X% a
( h5 H( w9 H4 d* G% _9 HLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
, C+ O! Z# Z' P: L(API Get entry point)$ _$ { q. s- L; |1 A6 c
7 k; k4 r& N7 s
& \! M6 ], X+ F W3 l# l xor di,di
; y8 _0 \7 t% B mov es,di
0 w ~7 H: ~( A, {6 N mov ax, 1684h 0 ?# n2 {* X$ Z% f2 E
mov bx, 0202h ; VxD ID of winice
. w4 q) S& b7 t8 e+ Y, a' o6 p int 2Fh8 c' k. P6 {6 x9 C1 {+ u
mov ax, es ; ES:DI -> VxD API entry point( a* X! D+ c7 c, e: O1 D
add ax, di4 |3 M6 h2 H/ j6 F# X
test ax,ax
+ I9 @9 i" W* O, R- _( y0 Z7 ]0 o+ P E jnz SoftICE_Detected
( g5 A5 s; W0 P( h/ ~! I! q. y4 B* Y J- I
___________________________________________________________________________: R! M. _4 ]! [ k& Y! o
. ~& P$ X1 b: H* e& z& w k1 CMethod 04
3 _6 L* X5 U$ V" M5 x- b, G=========- l& D4 O8 d/ d1 c, I8 T! _
$ M1 \6 u- T# i N ]+ c2 w
Method identical to the preceding one except that it seeks the ID of SoftICE3 o! }: Z* L# l' t1 ^* P6 P/ e
GFX VxD.# D& j! i1 R a2 i
7 ]/ h( D) L# J" R
xor di,di2 ^) Z! |5 z9 x0 |8 N
mov es,di
- U$ Y& I) J! E* {. e" d# } mov ax, 1684h * T: g4 W$ c5 w" A7 p% }/ a
mov bx, 7a5Fh ; VxD ID of SIWVID- l' f* x* C- B+ e8 x) _
int 2fh
6 w5 i5 j' u) S; D: R1 b# V mov ax, es ; ES:DI -> VxD API entry point+ K. m; G( o- j4 M( i& }4 I
add ax, di [: w# i4 {2 b" l% [
test ax,ax
9 Z$ |! q2 V( T7 V jnz SoftICE_Detected
" Q/ u) }7 G2 d: o, E, L# s- S, O( D9 |( J
__________________________________________________________________________
$ E5 _" {5 g/ T0 k9 Y5 h* g: |1 |9 g7 t, q# R
+ I3 j8 ?1 R: MMethod 05: t& o) j; k- x/ Y; y& Z) H
========= w1 l7 \! f2 h$ R9 L5 ^) ]
0 q; ?9 ^: e& n
Method seeking the 'magic number' 0F386h returned (in ax) by all system
# G8 M' f0 X0 i" Fdebugger. It calls the int 41h, function 4Fh.
- Y# o: w2 y! s% _7 H rThere are several alternatives. # D& W; N- H7 n3 n
& v) k( e# m# z) s. Y2 s3 s( d9 n, yThe following one is the simplest:- Z! e( V; P0 J* J6 ]
) ^( Q7 M! G/ s5 U mov ax,4fh
7 N, m7 l9 H1 |% _9 g int 41h
! ^4 G, a7 P/ W cmp ax, 0F386
8 m) r/ y ]. E) V: N( z jz SoftICE_detected1 v3 g0 K% o9 R" P1 K2 I
# K7 k# M a1 `# I( s7 M( h( V, }; p3 @8 y, n( ~$ ]6 H
Next method as well as the following one are 2 examples from Stone's 6 b( t, s0 \( I, K7 H
"stn-wid.zip" (www.cracking.net):, D" w7 m% C! z1 n
% w% q4 Z+ t; u3 J
mov bx, cs
' N' b# p9 t6 u lea dx, int41handler2* R4 W# z$ {' @6 C0 ^; J1 Z& F
xchg dx, es:[41h*4]" |/ e4 X% \& d6 c" S# L8 [/ x
xchg bx, es:[41h*4+2]
$ u2 W' u8 S+ r- h, q mov ax,4fh- w9 n/ V+ M. _3 |
int 41h
6 D) e. A7 ?9 r* Y, n xchg dx, es:[41h*4]# a/ r- a# C) {6 B `& L
xchg bx, es:[41h*4+2]2 h& |$ D Z2 p; Y
cmp ax, 0f386h
; ^" ?9 k2 y6 O1 L4 O; c7 M jz SoftICE_detected5 N& J4 u6 r3 g' z2 O9 a) T9 w; ]" ]
U& ^# Z6 R V1 Rint41handler2 PROC
3 W- P* ^% M2 o# K, T0 f iret s% H3 |$ j( O* K$ k
int41handler2 ENDP
+ p# r O w. c5 x' o b2 ?3 l/ V1 g5 V) C7 _1 o! W
# c! ]/ f5 C; N. e: c_________________________________________________________________________5 a/ W3 s* P( n0 M7 j3 ], B
4 n# I/ o9 Y0 a3 O' E# t2 V$ i, O& ?4 y
Method 06
9 w* Z% V7 P0 e1 H, S9 a+ z* v=========. X0 Z8 I4 @$ H+ A( }& Q, d
7 g) I9 r S% x& j- h
5 x' t8 {; P, u: R2nd method similar to the preceding one but more difficult to detect:' u; a2 ~5 ^& {4 E2 U' w
. H, v+ {/ T9 T$ F& S* |- r$ B6 C5 X6 P/ J
int41handler PROC
/ m+ O {$ D$ j; S9 g mov cl,al9 ~; V% p( M# U4 Z
iret
+ l- O: Y' b; `3 X% |' _int41handler ENDP: y- ^1 B8 L0 J! d
- ^$ V& M# i9 z+ i+ M$ B2 O
4 n3 O8 I* ]5 N( z8 ]* v8 r xor ax,ax
" K! d% D% P! m0 k7 ?: O mov es,ax" n- y& s3 R5 }: `6 b
mov bx, cs% \, k- F$ W i& U: D
lea dx, int41handler5 H" c/ k' y0 [; J1 C7 R, T5 `! t" t+ Q
xchg dx, es:[41h*4]
9 z; m. A7 D# [4 D& C3 l9 O xchg bx, es:[41h*4+2]$ N$ V; Y( U% Y z0 U: c
in al, 40h. {0 z) u3 ~% l1 e! X) J# O7 P
xor cx,cx5 `- Y1 J' Q" d0 R6 `2 ^
int 41h" Z' @% b& K( ?5 E7 g
xchg dx, es:[41h*4]
; j, c+ w- r0 i% A# f! A xchg bx, es:[41h*4+2]/ j' |6 W5 k' O" h' M: w
cmp cl,al
& M9 v4 P2 r2 A* E jnz SoftICE_detected' R* C& i( K2 |' c* f- p# w y( A
/ O7 s% }. A, C( W
_________________________________________________________________________
- T! \. H" D, V9 o" G0 @: Q" f$ r& A r; K
Method 07
' ]6 |0 C% t' e0 k=========0 k) y8 C8 E8 O: C. C
" `+ q, {7 h# ^/ DMethod of detection of the WinICE handler in the int68h (V86)
9 g' {* p. B2 M' o8 |! e& f7 ^# w) s- m5 U- D6 ~3 A8 U+ \
mov ah,43h
0 B; Q5 i' X1 t4 V. M2 u/ k5 |9 z/ ` int 68h
# R7 i: e8 S. l( M: V$ m cmp ax,0F386h
$ D- l# O K/ L6 z jz SoftICE_Detected
# ]2 E) w* J- }9 ]2 L, y$ Z" U6 B" Z8 W1 }, }/ E
6 O* f8 b" {: N$ m4 O=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit" S& r, g3 h! V7 M( [7 c
app like this:9 \! ]& O, v- N. @
/ V: u$ |" b4 n, S, B" I BPX exec_int if ax==684 x2 V- L6 d: O! P2 z
(function called is located at byte ptr [ebp+1Dh] and client eip is
I/ W8 n; i* ~ located at [ebp+48h] for 32Bit apps)( C z# m1 a5 }3 b
__________________________________________________________________________& r6 e2 H5 H% T; Y" b; H3 B4 l
0 K* o: e E6 {& w6 a9 I/ o1 {7 i+ k7 v2 O2 Q J( Z
Method 08
5 g8 T" {% ] P% T& Z" A=========
/ L5 Q- v( _4 Q) ~+ s7 n! E( l
7 ^6 n* i$ L8 {; _6 m6 f! ]4 T' YIt is not a method of detection of SoftICE but a possibility to crash the; r0 Y* \7 r- R$ Y. e3 V
system by intercepting int 01h and int 03h and redirecting them to another
# g8 B* w; N1 F" ~* W) vroutine.- `) A8 g4 ]- Y5 R$ P& I$ e
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
% @* k; [3 s2 H- }to the new routine to execute (hangs computer...)& x1 y b6 F- f6 {# |5 @) Y
! U, \2 J1 b& u/ u( E* D* m
mov ah, 25h
5 f( j* Q/ L7 n! L1 B9 V: i" ] d mov al, Int_Number (01h or 03h)5 E( z# }, _0 W' y5 V+ K
mov dx, offset New_Int_Routine% a+ ^: g" i: z( d5 j# ~5 f
int 21h% ]: A) e& i F$ y/ `# V
$ F: D! z9 o& p0 W7 Y o
__________________________________________________________________________( a9 P/ x4 A' e& }6 E
* E, B! g1 B3 r# X) C3 X2 V k# J7 {Method 09% g$ \8 X& Y; R) F; r5 Y
=========, P9 I5 Z8 y2 D2 H. ~
# l* v( h; {' B
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only, j( O' {) B: }# b* d
performed in ring0 (VxD or a ring3 app using the VxdCall).7 C! a7 j& t. k7 r. l1 J
The Get_DDB service is used to determine whether or not a VxD is installed' k$ |& v/ D. Y. a; ^# u: N0 p7 X: l! T
for the specified device and returns a Device Description Block (in ecx) for
& e) l6 v$ O6 d! h& |' y$ f+ ]1 ]that device if it is installed.
1 @2 n! k' g" s! t& c; ?- H
4 c- n8 p$ I6 E mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
1 E2 n+ Q; y! R5 ^- p mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)3 G2 T2 g" U' @% A b- H
VMMCall Get_DDB- J6 J3 C4 y" p) k+ ]
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
; ?4 [2 }# D |$ E& H+ a( U" ^
) C6 l% M7 R7 M* e# \Note as well that you can easily detect this method with SoftICE:! ?2 S1 e& N4 q" W1 c/ F+ g/ B9 w% \. O9 j
bpx Get_DDB if ax==0202 || ax==7a5fh3 ^; ^0 e) n$ j' U N% @
% `5 }8 m6 q. E$ u* C; {: S
__________________________________________________________________________' ~2 k4 K6 I" ^4 M: x
1 s2 w: p7 c! B" ]. E5 G+ OMethod 10 X5 @. T4 j( _ a" c Z" X
=========
/ R7 V8 T0 \ z$ M" U
4 u8 D7 n9 e. v" _=>Disable or clear breakpoints before using this feature. DO NOT trace with
% b: N+ E4 x( x, O& P) W( g SoftICE while the option is enable!!
; z* I0 B2 _* e" z* f5 u/ ]- J
, F/ |2 E/ ]# z! Y5 gThis trick is very efficient:
7 U1 u0 h, D( z( K# e% K' C" Mby checking the Debug Registers, you can detect if SoftICE is loaded8 Z; x: W, k" j" X$ ~. }* @
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if$ T2 [. z. f r* L" d
there are some memory breakpoints set (dr0 to dr3) simply by reading their
( f4 b5 L+ z# d- |$ t$ N! s d6 Q0 pvalue (in ring0 only). Values can be manipulated and or changed as well, o& D1 o; V/ r
(clearing BPMs for instance)( t6 U. G- Q: h
9 w4 C1 Y+ d8 E( {3 m X__________________________________________________________________________
) p$ s2 ?% w8 F; R9 Y, Z
9 d2 U- D' c9 W' H1 e. aMethod 11+ w9 }; i1 B6 l. f2 j' g3 p. K
=========' a6 f/ Y8 O3 y9 B2 a
1 c8 X( }. i9 Q2 t8 Z- iThis method is most known as 'MeltICE' because it has been freely distributed$ R7 r- |- L* c! P2 K
via www.winfiles.com. However it was first used by NuMega people to allow4 }+ k X1 c9 j" ]3 \
Symbol Loader to check if SoftICE was active or not (the code is located6 j5 u* P% Y7 k. ~0 ?7 |+ Q
inside nmtrans.dll).
- t4 g# ~) T/ Q. l( b5 z
+ a7 P$ }! S) E( @3 U. F1 [The way it works is very simple:
( s: p4 |+ ]3 [It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for, ]+ a) k& k4 a4 Z0 i
WinNT) with the CreateFileA API./ f6 W* X$ v- o& P, x* H5 V
8 o& |# Q$ e& V- g) L K( x1 [Here is a sample (checking for 'SICE'):
7 R6 W8 G1 e" b. ?0 m: M
8 Y6 d4 [9 b- F' Z6 N% VBOOL IsSoftIce95Loaded()/ D5 z/ \3 ^) {$ S
{( @ u3 N( H# q! G7 \- ?
HANDLE hFile; % z) n4 M9 _, a% g2 i( F; j' n: p
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,+ T. h. N' U, ~5 m8 p# Q
FILE_SHARE_READ | FILE_SHARE_WRITE,
9 g2 X, T# u" Z, S! \2 u NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);/ [' t. ~8 ~6 m2 S; z, o: L
if( hFile != INVALID_HANDLE_VALUE )
# C; k& Y$ r3 j; v {8 I( K# h% [/ A5 l- x! O
CloseHandle(hFile);9 F7 o" ~# B- a6 l! O9 H9 b
return TRUE;
; U, x) N: v$ u" z6 H. X( [) y' v6 G }# u3 E$ r- I9 `# a
return FALSE;
" Q0 a# e& l" _' n9 i}
# M6 W: a) r- q2 f3 d2 \
& h/ S. H* U8 Z) uAlthough this trick calls the CreateFileA function, don't even expect to be
/ u; h% d. O! |able to intercept it by installing a IFS hook: it will not work, no way!( B- z$ R( w. k/ J* }
In fact, after the call to CreateFileA it will get through VWIN32 0x001F3 P' y8 p: Y% o' Y
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function): ]7 B2 X: T% P6 p; Q: R" f
and then browse the DDB list until it find the VxD and its DDB_Control_Proc5 k2 Q. a2 O: N- q( X
field.
' f& E' _7 @: V I! w$ DIn fact, its purpose is not to load/unload VxDs but only to send a 3 ?# _5 Z+ r* E' `" o$ B6 ^
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)# J. G0 l' V3 P. C8 [& r8 k. P3 Z
to the VxD Control_Dispatch proc (how the hell a shareware soft could try6 H. L. a1 c0 G5 U
to load/unload a non-dynamically loadable driver such as SoftICE ;-).6 h6 `: d( |8 f3 @* B1 {
If the VxD is loaded, it will always clear eax and the Carry flag to allow
/ R% D0 } x0 z& _its handle to be opened and then, will be detected.
1 G8 P9 k) U% E, f; U/ p# Y1 s0 _( lYou can check that simply by hooking Winice.exe control proc entry point6 V! J, V3 H. Z+ B5 L
while running MeltICE.
, E2 e( Y0 Q; t; c: s
6 t8 R# S0 g% C
p2 Y+ Z" q" y. u# c8 J 00401067: push 00402025 ; \\.\SICE8 ~. R# I: h" p
0040106C: call CreateFileA
4 s% P( i2 z- }/ j. m4 [; U% {% y 00401071: cmp eax,-001
5 L! P% }; ~# X4 d: U6 v6 X U 00401074: je 004010914 D# X" R: c E% z) U' ^6 C
( s0 K+ z. P: D7 ?) p+ h
4 D( y5 P3 z- G6 n9 ^2 sThere could be hundreds of BPX you could use to detect this trick.+ d6 ] J" [. c9 P9 v1 J* ^: c( {
-The most classical one is:
* F1 x; r. Z8 K' D BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||/ d" ~ }# Q9 A5 M$ I# C! x8 H4 m
*(esp->4+4)=='NTIC'+ l$ ^! L+ h( \
% N0 y/ q6 z& \6 {- z8 ]
-The most exotic ones (could be very slooooow :-(. G+ a2 l k6 Q' }6 W
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') ; |/ F9 L( c- ?/ c: r8 Q
;will break 3 times :-(2 j" p) _# ^- s! D6 s! q( W
; Y! w) N; I6 d6 k& l-or (a bit) faster: ; j1 l( i) n k9 g7 f; q5 A3 {( _
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')- g* ^' }1 S& s
( z( N4 g1 ~! x$ \0 H$ e: s5 N
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' 1 y6 n8 t8 z$ N# M* N
;will break 3 times :-(
' a" C4 k" k g' R8 d
( u- I0 i( A; y& W* i-Much faster:
. t0 ^" ?9 ?1 f1 m$ }7 k BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
6 P- Z9 w# L* H5 _5 P6 N
+ d' b- K4 X ^, d* J* D7 uNote also that some programs (like AZPR3.00) use de old 16-bit _lopen+ @, Q" ]& K P* C A2 m/ k; J
function to do the same job:
4 D! c. O" H2 q/ {$ W6 ]# W% z% z% [( Q: j+ W; }4 o
push 00 ; OF_READ
& L) w9 g! F: c- r# h3 s mov eax,[00656634] ; '\\.\SICE',00 ^) q) H3 k( E7 E: J5 L
push eax
, D& X! |3 s9 T2 k0 j call KERNEL32!_lopen6 O4 {4 X3 F( m' v
inc eax
- V" b7 [9 x: @* N, a% q, k+ [; Q jnz 00650589 ; detected
2 D. c; p: S- M [7 L& u push 00 ; OF_READ# N# _7 M( l- Q
mov eax,[00656638] ; '\\.\SICE'
) j1 r2 i/ c$ X. c ]& O Y3 }4 F3 U( x* A push eax
; _% W3 y* i# l( I1 r2 q call KERNEL32!_lopen- ~1 U4 ^" x9 X% [. J
inc eax1 {, e; y0 j2 Y
jz 006505ae ; not detected
2 l* M, K- d. T3 g. `2 H
( R n, {5 ~7 k# f3 ~7 P8 _! u
__________________________________________________________________________
# Y/ t( Q" \0 Q
" W/ O3 ]) O$ Z7 Q4 Y+ wMethod 125 R/ y9 z2 N% k
=========8 Q0 F3 h4 m+ T `7 D
- z7 c. A* [- K. {, M0 l' H" IThis trick is similar to int41h/4fh Debugger installation check (code 05' \% t+ [2 U/ M) d9 L
& 06) but very limited because it's only available for Win95/98 (not NT)7 m5 Y. R1 g9 d3 X- ^3 U. K) H
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.2 u8 _2 @* j: F3 W3 U8 r8 l
+ N$ H/ N# [, Z7 g- z1 C push 0000004fh ; function 4fh" N9 H: i" f# j. D! U
push 002a002ah ; high word specifies which VxD (VWIN32) d3 f& _' {8 F; n" n j9 K, J6 Z
; low word specifies which service0 R8 l" l, U8 F* a& M
(VWIN32_Int41Dispatch)2 z$ N/ M5 {' Q: W- ~9 G# G5 i
call Kernel32!ORD_001 ; VxdCall
; I3 r1 }3 Y. ^: N* q- g1 y" u cmp ax, 0f386h ; magic number returned by system debuggers
0 e- p4 a5 \2 g3 a7 e jz SoftICE_detected a0 w: X# c/ E* A# Y1 m
4 i3 s$ n7 ^4 e( s4 V; h. h3 x
Here again, several ways to detect it:
' p) Z& D ?9 d: x- X" K! y# H( [: c* y4 y
BPINT 41 if ax==4f' I! d3 w/ {; w0 O) _) M. J3 o
9 A- e! w9 B6 H8 v/ K5 b0 }1 I BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
1 s' M& T5 T- G/ S# M9 m
# E: ? R8 W4 W BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
+ X X( v& ]& w3 w, Y1 n3 B, K7 h3 V3 {% ~* L6 ~- X
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
3 `! a, W; b$ F) }1 n' \, W/ a
( M' I' Z6 D G! L: p3 p__________________________________________________________________________: X+ c4 \7 C. r4 ]0 u
; Z, U' _$ [, I5 U7 W
Method 13
- L! |3 F6 h+ H% K: a2 h=========
% w- ` r. s5 ]" F
, X- Q$ B$ E H5 YNot a real method of detection, but a good way to know if SoftICE is5 g8 g) c4 Y+ Y" ]* q0 T
installed on a computer and to locate its installation directory./ U+ k) Z7 z& c3 I& u. p
It is used by few softs which access the following registry keys (usually #2) :! V* R. V1 H8 O8 r5 x$ @
9 y5 q6 Q. t n7 ?, |-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
$ G6 L; k/ v6 }* L2 b\Uninstall\SoftICE/ q. a. N* D2 y% T I* v! y5 j
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE4 m/ R/ z N+ ] h* `: Y
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
) e& U7 U/ U6 z) d, Q( R6 c\App Paths\Loader32.Exe
T; U7 z5 K6 S
2 n }) b3 ~, X7 P, ~ d, @
6 u6 M2 h% K. y- j B; YNote that some nasty apps could then erase all files from SoftICE directory
' o( b/ i" u0 ?(I faced that once :-(
1 V# d0 o& N+ |. {
8 n! F- x, T" [Useful breakpoint to detect it:" A2 V; g$ l# ]" S4 n5 b: |6 |! t
9 v0 A# v5 d0 d2 d% F F( D BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'9 M2 d" z1 y5 O3 g; i1 I( k
" `- H& m* ^; M1 A4 _
__________________________________________________________________________
! w w" ] x/ X: c2 y _2 f
+ J- \6 s3 c4 L |- P& s2 [! Y! s7 M6 i. P+ H& r, C
Method 14
9 }5 o9 L. b- w' b O$ t6 y b=========
- M% n( ^7 `; a/ p
$ z0 Z$ _5 ~9 I6 x% s! F* K5 Q& R/ l) S9 SA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
7 v2 j& L0 G, Dis to determines whether a debugger is running on your system (ring0 only).' i" F" k+ Y- Z9 y+ C4 a4 E
, g6 U' Q3 O8 x+ o+ U5 x VMMCall Test_Debug_Installed8 H/ n: h* `7 O4 n: I
je not_installed
$ J' B! C% Y1 ~- h4 Q5 p5 {2 L ?9 @0 O8 n5 E2 I0 p. q3 V {, r$ T
This service just checks a flag.- `3 T, U2 M M, g0 y
</PRE></TD></TR></TBODY></TABLE> |