<TABLE width=500>
( p* i g9 t9 S1 K4 q<TBODY>
, g: Y+ m1 b3 P2 i1 c<TR>
* M3 {2 g+ D! H$ i- {& e<TD><PRE>Method 01 * b& e2 q" s2 h1 j( X
=========! p- F E+ b3 }7 t0 Q. O
6 t, T2 ~( W9 Z! D/ cThis method of detection of SoftICE (as well as the following one) is
& S" O) g& a" |3 K9 K0 @used by the majority of packers/encryptors found on Internet.% n6 G) D0 r; K+ s0 j" _; g
It seeks the signature of BoundsChecker in SoftICE
: u5 {; N( r/ Z: d3 u/ @2 S5 H6 K# T( Q" s4 z2 l# h' Z! @
mov ebp, 04243484Bh ; 'BCHK'* g: y9 T% `( w3 ^! J# u0 l
mov ax, 04h& F8 [/ e* R* i/ H% Q
int 3 8 k3 N4 s4 ~5 g* I0 y! ^' }' k8 h' J# S
cmp al,4! ]" _+ h; }0 g$ `+ f/ ~
jnz SoftICE_Detected/ t& s( g% k8 Q8 ^! g0 u
- k2 I' C! y& s
___________________________________________________________________________% x8 Y; x6 Q1 ~ X4 E7 ~
6 r' K& C: h6 C8 t, _
Method 022 P9 g( S% W+ _5 n
=========7 e- s Y2 w& @; B9 t/ S& Z! ?
& V& }' l+ T4 J5 B r* z2 O1 N7 D9 v
Still a method very much used (perhaps the most frequent one). It is used
8 ~$ v4 Q# {; r+ b! Vto get SoftICE 'Back Door commands' which gives infos on Breakpoints,# I" Q5 E" d# R$ k. N
or execute SoftICE commands...
* H! W n' E2 `8 l- ~: MIt is also used to crash SoftICE and to force it to execute any commands4 P, E# f5 j B
(HBOOT...) :-((
3 v3 J( G9 @, f, y
* Q* c: y- e4 n' n' M% [ H/ |% t1 o# {Here is a quick description:% ]: J, E S; e2 q! e+ M
-AX = 0910h (Display string in SIce windows)# t `6 |3 n0 f. o* h
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
& N& N, @4 K2 B8 f( }2 s-AX = 0912h (Get breakpoint infos)7 z* P' o( Z" c
-AX = 0913h (Set Sice breakpoints)
' o! i& }6 w0 W% O4 K* N7 {-AX = 0914h (Remove SIce breakoints)
* a( ]% k, {) T+ `
3 m. Q q1 n! oEach time you'll meet this trick, you'll see:
5 E4 f3 k9 [; ~, D5 U& l, i, _8 j% ]-SI = 4647h+ K: @. c& a7 }) e& r- e9 L7 N
-DI = 4A4Dh
7 C. E6 |. A3 g* I E8 lWhich are the 'magic values' used by SoftIce.
0 I3 g8 D" O4 g2 I( wFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.5 V- O) g9 j8 Y0 [( `; Z- k
1 n4 O/ S6 S8 WHere is one example from the file "Haspinst.exe" which is the dongle HASP# d# l$ c% R$ @3 d: K
Envelope utility use to protect DOS applications:7 |' K! K: D3 C5 G! ^( L+ S
! {+ J- [! E7 v2 x
5 Q4 I; j% c$ L7 ~ T- n; H( W4 x0 C4C19:0095 MOV AX,0911 ; execute command.# `7 K( b* ^1 M, E: V5 K6 c
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).6 A4 w, O2 }% k- n$ o C7 t* e* i: a
4C19:009A MOV SI,4647 ; 1st magic value.
7 S, a# K' t3 q! M4C19:009D MOV DI,4A4D ; 2nd magic value.
, q7 @& W) K- O7 ?+ Q- h! _4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
* f2 m) d; e$ x% w2 l" v$ s( `4 p4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
7 V+ `. b7 m$ R$ F6 e4C19:00A4 INC CX
( k! F8 H4 A3 s3 x9 R" ^. `4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
2 ^ b- n* \( X* l/ i" [0 J1 N4C19:00A8 JB 0095 ; 6 different commands.+ q& X, {3 c% O% t( H" h4 ^
4C19:00AA JMP 0002 ; Bad_Guy jmp back./ w# Y4 N$ U! B. F) d: Q) r7 }! J) V
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)7 \+ `9 d1 O& C3 ^; M4 d. D
# K+ ~6 c9 a0 V! h) s( `5 c" KThe program will execute 6 different SIce commands located at ds:dx, which
0 k, `+ Y4 W7 R+ q% Q7 F2 G7 hare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
5 G0 \3 w: c# M3 H0 z0 l; c1 p
# K H' w1 d9 S# ^& b' d: W* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.& l8 h! o, e. w) l* W
___________________________________________________________________________0 M, X3 Q; l: |# W. S
1 J7 J7 h; k; P" [5 K# _$ @( ? W$ n6 U* T. \$ H
Method 03+ R- W# ]$ u! P$ n, v
=========
5 [$ V1 L0 A; ?$ r9 ~
) V8 i$ G$ o# NLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
- i( X7 s! ~9 v, f; _4 ^(API Get entry point)
. v4 X; F& l" u! m4 o# V* I1 R0 i " i2 `4 ^1 ^/ i9 V/ C. e
' c+ W9 |9 J/ \+ g5 R$ w3 w
xor di,di
% n* H4 w! A+ R* \ mov es,di
9 w s m7 a0 K( ~ mov ax, 1684h
/ T* F& _+ a" U5 o" Q) g! j' O- G( W mov bx, 0202h ; VxD ID of winice+ I$ U6 H" n. M: W
int 2Fh/ h! ?% }) p( K. a" Q4 X& i5 ^0 A A
mov ax, es ; ES:DI -> VxD API entry point, `9 x% w2 I+ Y
add ax, di
/ C$ f( V& D3 ^: f0 ` test ax,ax/ R* S- b# p; ? |
jnz SoftICE_Detected
5 I0 y* |- V6 _' s# e
8 M ?' V" Q1 q8 X___________________________________________________________________________' g0 L# M5 I+ G$ ^' q! p; A
+ X9 h- s& o( F$ r7 o# c
Method 047 o9 E( p6 I, P* Z: ]3 T8 b# c
=========
+ q }) y: h3 q2 |
3 _. _! z+ J' k' q, F. GMethod identical to the preceding one except that it seeks the ID of SoftICE8 @/ Q) a) R: Y' ]" O
GFX VxD.- p( l2 z! G' I
5 u3 I0 G) Q1 ]5 |/ A
xor di,di, ~2 ` F: o; x# ~
mov es,di; M, O9 y5 I3 F5 D7 l# q) [0 g
mov ax, 1684h
4 u* u1 \. _5 i g/ v& O+ B mov bx, 7a5Fh ; VxD ID of SIWVID
Y- Q1 K3 q5 ~9 n, K int 2fh* q& L- h) b& U! \! b
mov ax, es ; ES:DI -> VxD API entry point
; X! g/ L" ^1 r7 o7 g2 S add ax, di" z% \& h; R8 F
test ax,ax; d# B( M& @9 i0 w; ?2 K& W
jnz SoftICE_Detected6 q2 {6 D3 i& j" P) ~0 }( D
8 l' m, n7 Z, P& X% n$ o
__________________________________________________________________________
4 [, u, o6 ^3 U8 G% ]) }2 A& Y* F
* w& O# v( X# A1 R8 a9 p
' |/ f5 s6 Q# X) ?2 BMethod 05
# Z/ S! P) l% K# F w=========
% u+ g( v- R, M5 D- A: D7 T6 r6 {+ e5 i. G* z/ V- f) T$ P
Method seeking the 'magic number' 0F386h returned (in ax) by all system
$ \0 [, ]( }! hdebugger. It calls the int 41h, function 4Fh.$ z/ }& X/ {$ {
There are several alternatives.
& P0 }2 y! z+ ]+ S5 a- A
* I* Q) _& z. p7 f1 I. W+ y1 AThe following one is the simplest:
% c; a1 Q7 Q! x/ V8 C9 B! N l
9 o2 e+ X! g0 q: Q5 ^: r mov ax,4fh
+ t* f: {! w) R int 41h
) i* F' D O% y0 @7 k1 B `" V cmp ax, 0F386( r! a) p( {8 }9 |3 J: C
jz SoftICE_detected2 a4 ?; m1 I9 a
- H* Y" |/ a8 N* d6 P9 {
5 h2 f! j% A! I1 ~/ W- C
Next method as well as the following one are 2 examples from Stone's
* j$ r7 D4 x6 D1 K"stn-wid.zip" (www.cracking.net):. p2 ~6 W9 B1 S
% u* ?' W% ?2 Z
mov bx, cs
9 }) ^9 Q0 L9 L lea dx, int41handler2
6 D7 p2 v" b. p6 F- r xchg dx, es:[41h*4]
: Y* }- f' O# |, N v' x( |( i: R+ t xchg bx, es:[41h*4+2]
. E; u4 c# @% y( i+ K1 H- K mov ax,4fh
; R+ e( O+ c# m% @$ m6 f* o int 41h) Y5 ~0 [' {1 j' H4 X/ u& X9 }
xchg dx, es:[41h*4]
) m, U9 V/ g* e6 \8 y; m8 t xchg bx, es:[41h*4+2]
% l. s' t0 o5 ]' ~. T cmp ax, 0f386h7 l" o- V7 y" z9 X* t
jz SoftICE_detected
2 m! A8 `( W' x6 {$ e+ W5 I/ J: ?# |' C+ H2 W8 R0 |
int41handler2 PROC, @5 o3 G, z( s
iret: W/ y& a; h; ] G0 K& J
int41handler2 ENDP" g' S1 D$ \# [% `
3 a' B( Q0 U1 p- V7 f) c" g2 g' A0 P2 b9 t
_________________________________________________________________________. W8 N2 f' z7 {/ t, b: ]' `
& l5 B3 j0 F6 I1 S
& V" j. k7 _$ ]Method 06
5 D! p& Y* n( u, Q* i' d=========+ e! T7 h- }( G1 {. z
* h( \2 z& v0 [9 F) f/ \0 Y# h& n' c& s" `) b1 s
2nd method similar to the preceding one but more difficult to detect:. a7 ~6 f, s- U8 x4 R- r& G: K
; o ]1 j+ E2 k9 P8 h
7 z0 Y3 f- g' Jint41handler PROC
9 P+ V, |% j- C0 e# p( M mov cl,al! \- P0 ? }; A
iret: m& ^7 f% E5 @. F; ~- Z
int41handler ENDP7 {( O. R F7 f7 |2 V7 P
. \$ ^/ V) o8 T, V8 \9 F
! x1 L3 ~( L3 ^' I xor ax,ax
+ Y% j; ?( K9 G: I mov es,ax2 ^& n1 ^( p! J& O1 a% {* H
mov bx, cs
, ?& o: y. e4 ^! w" g lea dx, int41handler; T. U$ T4 r1 d3 v! O
xchg dx, es:[41h*4]$ W7 H+ j; H! O1 V- |! M0 W; X/ u
xchg bx, es:[41h*4+2]
1 ^6 j$ T- _, G7 m* m* V3 F in al, 40h* l! X4 H1 F9 {) g3 e
xor cx,cx( @! E; h& L) j5 |4 _; J7 W
int 41h
X! A) ]0 g3 `" W$ y; a5 B+ l3 O8 H* X xchg dx, es:[41h*4]6 _ x6 z" \( Y# I- z- s: F
xchg bx, es:[41h*4+2]$ b- \( o: I( M E1 b; a* G
cmp cl,al
, [% O; R6 S$ s# T% p jnz SoftICE_detected# C# R1 d6 W$ e8 ?5 }3 E
: A$ z+ ~' g4 {0 {3 b6 B2 `
_________________________________________________________________________
* ?2 Y* c: C( R" T) N x. g7 }: \, a# Z' C$ N7 G2 T4 R
Method 07
- W. X' n6 S9 c# X$ ?7 P=========
8 `( F- t$ E0 `$ F+ f. t7 h# B' I" |+ W3 Z% l- m5 e8 D: z
Method of detection of the WinICE handler in the int68h (V86)
, U9 L H* H l. i" |/ U2 g) G# K
mov ah,43h5 k, M" ?, T9 O( C3 A ~8 q; R
int 68h
% ]- M$ O. A9 v% p4 Q9 J cmp ax,0F386h
9 S7 m# T" u) h) w; M. d9 j jz SoftICE_Detected
7 E+ o3 M" W, X6 ~2 X$ C: x4 V/ Y
+ k8 i! C' K6 v- y2 L+ ]# {1 B; _/ F9 \& f; r1 U8 m6 [' x) ]# ?
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit' K) F% Q; y2 n: |
app like this:6 r( g, u% t; q' \. r, z G
0 S9 j( l1 n. y+ F" u$ \ BPX exec_int if ax==68
+ K: z1 o( i0 G (function called is located at byte ptr [ebp+1Dh] and client eip is
2 a+ a( w- l5 d located at [ebp+48h] for 32Bit apps)
( |, @$ [' r7 l: Q; G% Y1 p6 B1 W6 J__________________________________________________________________________2 E {5 Z% Z _. ~2 i9 }
; f+ F) k5 u1 \
' i# R- g g- |5 g% X. v8 L7 t' n
Method 08 L2 X0 W g' D! E% w
=========
8 A7 Z+ E$ T$ `( A% \
" V1 C- u* }, |$ @It is not a method of detection of SoftICE but a possibility to crash the8 l( r. E3 }9 Z5 j: E# Y6 ?! Q
system by intercepting int 01h and int 03h and redirecting them to another
. G$ M" w! }/ f% x4 v) F" z1 @routine.7 ^7 z% t6 e7 @
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
8 p0 |9 D) J" K$ eto the new routine to execute (hangs computer...)
, `/ Q( K8 J Q7 A/ |
* ?! ~& G1 o9 O3 b. v mov ah, 25h
" k# o. |. W+ O8 ^& W* W/ L6 y mov al, Int_Number (01h or 03h)
: u- C5 v/ A: I4 V% X- J& i; X/ U mov dx, offset New_Int_Routine9 K6 i; J' l: }% y1 y8 P
int 21h
" _6 i& {/ s, s$ A* F2 v) A, z G3 G. k4 Q
__________________________________________________________________________8 f& s1 V9 ]& c( {, p
1 \& S( @& ]/ b5 ]3 y3 J4 g5 F9 [ Z0 NMethod 09
' d) {) ?( h+ N6 [% X; a* u7 h5 q=========7 [) i. F, N( u5 T
2 T# o( T5 C8 p! g; r; [' @0 m/ L mThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
# A# z6 a9 q6 G( u9 I* Jperformed in ring0 (VxD or a ring3 app using the VxdCall).. `; Q1 n7 @' A) h
The Get_DDB service is used to determine whether or not a VxD is installed
- W) k8 `% j/ T3 ] yfor the specified device and returns a Device Description Block (in ecx) for. R0 }$ {$ v% g$ L9 h7 }1 t6 l
that device if it is installed.
! U. @0 z ` {, ~
+ }) p" P; T( h) J$ m mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
; c1 a& W: Y9 I1 i) I' F# T- P mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
" O0 S; A# [0 v* s! u& y Y2 f VMMCall Get_DDB4 W+ k- C# ~7 u4 M
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
+ x. W+ Y: \6 u4 Q" v1 W" U- @3 g3 R$ A; E! Q9 N' k- ]
Note as well that you can easily detect this method with SoftICE:! m4 q$ D2 K& U7 U1 e; U) w N. m( D
bpx Get_DDB if ax==0202 || ax==7a5fh2 s, ?4 G5 O* o5 R7 i* q" x5 D$ z
* V6 u% F( A* ?. f, a* @) x
__________________________________________________________________________
' |+ P' ?7 F9 q- ?' J
0 f; s* P0 `! z+ Y/ P/ K: t, {3 yMethod 10
) L) O% c6 {2 }$ }7 i=========
0 \; Z' H1 j3 Y: q! a7 ^4 D' H1 J3 D4 q
=>Disable or clear breakpoints before using this feature. DO NOT trace with
* M: h: Z* O% g2 g, {9 e SoftICE while the option is enable!!1 \6 O' t% P" N. S* m8 M% Q
; `6 @: ^2 }4 M1 E! o6 y/ ]; T
This trick is very efficient:
8 V2 N0 i4 ?" j) w9 Wby checking the Debug Registers, you can detect if SoftICE is loaded
2 O( \# E0 V1 T$ z8 z5 q1 b) t(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if' t' v+ [' _0 P/ _
there are some memory breakpoints set (dr0 to dr3) simply by reading their
0 m) h/ k" T( ~% P Kvalue (in ring0 only). Values can be manipulated and or changed as well: P- P0 f' Y, ]
(clearing BPMs for instance)7 z* `, e i9 R% t( [6 ?5 W! `
3 |; W# t. p/ q; T
__________________________________________________________________________
( L% ~. Q1 c# `' s4 t: |$ b) ~9 F; i; i: @+ Q
Method 117 C; ]0 e4 L# d
=========: q" z5 E1 j2 R$ x9 a4 I( S
" i0 o- Z+ v) R. q: E+ XThis method is most known as 'MeltICE' because it has been freely distributed
8 J1 r* Q8 u9 m+ E: Z' J! \$ }* j6 Yvia www.winfiles.com. However it was first used by NuMega people to allow
& d4 B' K, N0 P9 D$ T) vSymbol Loader to check if SoftICE was active or not (the code is located8 C/ s/ u7 O. A; _8 U
inside nmtrans.dll).
0 b8 F+ y- `8 h6 W& G) j6 B1 r8 Z% o( s# R) V6 d$ p& X+ X! Z+ ~) W4 f
The way it works is very simple:
3 v6 x1 Q* n( y' `4 `" sIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for' Y# d2 v$ |7 h" f$ c) Z- ]- o
WinNT) with the CreateFileA API.
, O9 A ]4 S G5 f7 c7 d
q; R: Y1 Z4 }" IHere is a sample (checking for 'SICE'):2 r* P, ~' c/ m# n. w+ q( n5 u
6 p, i+ ~4 @* K0 H0 m$ F
BOOL IsSoftIce95Loaded()
" q6 M5 J- O) \$ J{
+ P/ z0 d& n$ t9 x+ y H HANDLE hFile;
* [! Z: o) u3 ?, d hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,6 R5 G* m8 b/ E: p" d
FILE_SHARE_READ | FILE_SHARE_WRITE,
* i+ _% B- D+ e p! f) i# @$ H7 E NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
3 @3 e4 t" V E if( hFile != INVALID_HANDLE_VALUE )& z7 q0 R, u; L! ?% d+ O
{! b5 W- z; W# S" k/ M' J ]
CloseHandle(hFile);
' L0 \4 U- W2 f& b, h: A return TRUE;/ R Y" L) e Y7 @2 u1 M
}
) s* I+ ?: k. c/ k) k return FALSE;
2 @& z0 w" s5 ?9 t! `; R6 w. e}
7 J+ I! l1 V6 `$ m) Z8 ?
X: h" n# s/ v Y" l% J- iAlthough this trick calls the CreateFileA function, don't even expect to be( j1 y" v5 v! p/ a
able to intercept it by installing a IFS hook: it will not work, no way!1 _, {. A8 _* k+ Q+ Y1 b; p/ M
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
5 _3 Z& X; w8 _service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
# Q' Q/ |7 \/ [! z8 h/ Hand then browse the DDB list until it find the VxD and its DDB_Control_Proc' L2 b; `3 F9 ^' U% P! w& w
field.
6 T. u- C6 O' N* R' }. R2 x/ a7 ZIn fact, its purpose is not to load/unload VxDs but only to send a
" A" b' P7 g; P3 q$ c4 xW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)) \6 y3 v6 ?& @" E4 P: g T
to the VxD Control_Dispatch proc (how the hell a shareware soft could try4 ?3 j- I3 t$ L+ x+ J& p
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
S0 C% q3 ?+ wIf the VxD is loaded, it will always clear eax and the Carry flag to allow
+ N' ?9 V" O4 P4 Tits handle to be opened and then, will be detected.: Q3 k$ T( L- ]+ T% M% O8 _4 i
You can check that simply by hooking Winice.exe control proc entry point* K4 u% \% F Y/ _7 e! U, O
while running MeltICE.9 t( d: j9 L5 d
0 g% A+ j! d5 C
: B$ q* G; W. t( M
00401067: push 00402025 ; \\.\SICE/ \' k# I) @6 L/ b; ?
0040106C: call CreateFileA( y ^( T* q' z5 K# s
00401071: cmp eax,-001
( \- f3 v1 D1 \, D 00401074: je 00401091
* s5 Q$ z. f7 _ ~- V! v
8 t/ c5 c5 X0 S% v5 @! ^
! p3 q8 w) A* x, {: lThere could be hundreds of BPX you could use to detect this trick.* n# J# i0 {# \( h0 [# g
-The most classical one is:
- A# x: T: U2 c& s& Z8 t BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
5 L! n: b. v6 h8 |% r *(esp->4+4)=='NTIC'
1 m& L" p& n8 t2 G2 `! F" ^8 L" h5 j- L( t- I
-The most exotic ones (could be very slooooow :-(
7 C2 ^1 w; U2 w9 ?+ l- a BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') 2 O) l& k: ?* B/ l" r. q4 P
;will break 3 times :-(0 t8 ~3 `/ b) C/ I; b8 s
+ e; v6 e2 f. s" @0 K2 H-or (a bit) faster:
; I. E" _' u7 N5 A BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
- B# v9 Y" @) d* L
! h8 W' P u+ I- }# @ BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
/ T) {- y ^& f0 m- _ ;will break 3 times :-(
! }+ x! S$ t" e3 l L J) }8 o
* q: g8 G' ^- G. j% }8 _-Much faster:
0 [: W7 T: J; r BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'3 c: h; v( _0 w5 M1 `9 q9 i$ }
j) I0 x4 f! {6 ]. l0 F, ^7 @Note also that some programs (like AZPR3.00) use de old 16-bit _lopen) g: K/ M8 H7 o! {- [- _6 O
function to do the same job:" ~% }9 @3 @! o2 Q0 D- p8 r
! }# z7 n; j& W0 `3 v$ k, h push 00 ; OF_READ. f n% \8 U1 o" W/ s4 I; a
mov eax,[00656634] ; '\\.\SICE',03 g" z# w' A- P7 f6 d! i% |
push eax
1 t4 e* u# k5 J/ Q8 t" |3 E call KERNEL32!_lopen
% J3 X0 Z/ U$ j1 @+ s$ @ inc eax
2 T9 J1 J- z T. O& g1 H% V; L jnz 00650589 ; detected
4 w4 I# Z" o- C% m push 00 ; OF_READ; @9 W5 O& L# L6 Z5 N* r' `
mov eax,[00656638] ; '\\.\SICE'
/ ?* O+ V3 Y( _) ~) Y9 Y push eax; g$ ?7 b% Y1 S% m; Q2 e5 s( @* i$ I
call KERNEL32!_lopen( B* D# x; H) N' j, m
inc eax
6 m$ I; C. e% s4 D) g! W) F3 W2 X" V jz 006505ae ; not detected# |: D" x* x' ? K) _- K2 C& a
! `: D* x; A/ ]5 k. a E
$ t f: S. L2 W2 I% u
__________________________________________________________________________
: N# f8 N3 O) c, a+ G* S& o# _! k" i9 f& e2 i& L6 |6 F. e
Method 12+ r5 q5 m& J+ b% x: Y
=========5 Y: K* O- T( R9 t! w: N/ w
' P. {( ?9 h( L0 HThis trick is similar to int41h/4fh Debugger installation check (code 05& u# }6 Z; }! a; \* C
& 06) but very limited because it's only available for Win95/98 (not NT)5 f3 q9 H9 i z% d
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.5 x! r: I. l* l- X: J' J6 Z7 @
- r& z9 U5 f( F O% U6 R
push 0000004fh ; function 4fh
b o* ^& w7 u7 G' y% w: t push 002a002ah ; high word specifies which VxD (VWIN32)5 H( {- y9 P1 z2 q
; low word specifies which service0 M: `7 @5 ?+ G4 D; |+ n% u
(VWIN32_Int41Dispatch)6 B1 X8 Z4 f- s( ~) w
call Kernel32!ORD_001 ; VxdCall, [( I& ?& C+ N5 g7 d
cmp ax, 0f386h ; magic number returned by system debuggers
5 `- y7 e: r9 \; U) Y& X& c) z [ jz SoftICE_detected
4 ^% B |4 }. A+ a1 H( M) @0 d( Q0 U3 @, D/ @
Here again, several ways to detect it:
- j4 w" f; @* Z( Q/ b* \) W/ G/ h
3 @3 i* z& g7 c$ F, [( x BPINT 41 if ax==4f, p7 c, K: |; w: @" {% J
6 |0 v9 y* Q4 d: M+ h/ O: b BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
1 g% W1 T4 y6 B' t3 n
1 e l* W% L0 q; z BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A% X8 X# u u- _/ a3 Q, @
: o, |' d( J1 H BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!* `4 Q. a( s; I" I* @
) I9 h- d2 g% |: Z' Y5 P__________________________________________________________________________
/ S2 Q4 r7 N5 @7 f! g" E2 q p+ M$ v7 ]2 A# B' f* k
Method 13
3 \5 [- o4 M: N( h9 ^8 |=========
7 k% ]2 v6 Q/ ^6 ]
# L! ` M$ Q, Y% S( O) ENot a real method of detection, but a good way to know if SoftICE is
7 |/ r$ o8 W0 o- finstalled on a computer and to locate its installation directory.
' k( L# Z7 v7 ~It is used by few softs which access the following registry keys (usually #2) :
) c* y' v" F7 d- K# Y6 G. p5 @7 J
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
2 @: R- J/ m8 Q$ {\Uninstall\SoftICE5 U0 A( E2 c1 h" @8 H/ ]* Q" C
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE `' l7 T. X6 j* F
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion5 p2 @& O0 D& m# [
\App Paths\Loader32.Exe
- ~! Q# q- e7 g5 k" t' p- I1 g) Y. n; \# F
$ ^& K$ n0 S3 t( i( ]: [Note that some nasty apps could then erase all files from SoftICE directory
9 P. e* p' p+ v8 V( o. g: v(I faced that once :-(3 C9 n. u8 T) F( D$ I
Q, N) Q }, J! @4 w6 zUseful breakpoint to detect it:6 u& U- N0 f, `0 D( m
* L/ K, ^; x/ @/ G+ {# q3 y BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
j, M6 g6 n. m o! Y( v. P) b/ n; x4 o
__________________________________________________________________________
6 b6 I2 p! V$ A. ]! z( o8 x {. Q" B& @& N/ z+ X
V8 P" D: J/ p6 i6 `! kMethod 14 5 Z8 V$ _' z# ~) c
=========
% r! l G4 V! J* i! U$ }1 \
; N ?' E' F- I/ n( |6 MA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
* ~' {3 o4 F1 K {: b% tis to determines whether a debugger is running on your system (ring0 only).2 f; L! ~1 m4 v1 c( I5 t
+ h) x1 g5 z& k6 P6 E9 |2 a# j VMMCall Test_Debug_Installed
W4 @4 N- u7 ~! |5 x je not_installed
! O8 ^7 z" c9 j, _8 x$ C3 M6 P2 A F7 x( q4 |+ e' V
This service just checks a flag.
+ b0 c$ J& j; \6 n</PRE></TD></TR></TBODY></TABLE> |