<TABLE width=500>: F$ ^. A0 u# x% o
<TBODY>
' b- m& b2 a1 H% c* \! h* B; o<TR>; z8 A0 q8 L: z; S
<TD><PRE>Method 01
" ]6 m- Z5 Q- K" h4 W=========
j0 O; y4 {% a7 J4 j- N- h2 `" I* M' Q% ~5 x+ R
This method of detection of SoftICE (as well as the following one) is# Q, G+ L' i7 |5 J. U: y
used by the majority of packers/encryptors found on Internet.3 L4 j& j! s; p* |
It seeks the signature of BoundsChecker in SoftICE
0 M+ W' S4 \6 N
, t& P! Q( [+ a C* l mov ebp, 04243484Bh ; 'BCHK'
/ @/ C( C! P% u mov ax, 04h; v6 e9 X* J+ a
int 3 7 x2 O- h7 w2 y9 y8 l1 |- G& _
cmp al,48 M. [- l" q3 E) s8 ~, y
jnz SoftICE_Detected
# Q1 |! }% T' u5 l. u
0 v+ f: M ` H- C8 q___________________________________________________________________________1 A; J2 t3 J. Q3 k% g9 L1 i/ o
: Y V" [* |/ ^* b) A' S1 PMethod 02
( k- d; _( V. k& x=========9 C8 f* i$ k0 G0 j
5 X' v9 A" p6 I6 g) l
Still a method very much used (perhaps the most frequent one). It is used
, J. Y, J/ S% V6 _( Fto get SoftICE 'Back Door commands' which gives infos on Breakpoints,4 P/ N0 J9 E1 I) z9 S1 l# ~2 E, q
or execute SoftICE commands...
* d# I7 U4 x% v2 V: Z# W) nIt is also used to crash SoftICE and to force it to execute any commands
7 `5 F" d- y5 n l* z! w7 ~(HBOOT...) :-(( / I& G# S' R+ B& J2 c# R
. Q f& ?# ]9 |; S8 @! L, T
Here is a quick description:
' F1 | y# r% X" O-AX = 0910h (Display string in SIce windows)
/ ^( z1 l, q' J, }-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
/ {* w0 a: L7 n: Q7 ?& R-AX = 0912h (Get breakpoint infos)& a$ ^" i p/ w; U- W
-AX = 0913h (Set Sice breakpoints)* R" m" M# x& _( P2 D9 W
-AX = 0914h (Remove SIce breakoints)
/ V8 [3 v" p1 |' Y" q. }) }( o- u6 @( A' Z
Each time you'll meet this trick, you'll see:7 F) U) n% J3 ^3 y: r
-SI = 4647h# T& r1 U0 [6 e6 Q
-DI = 4A4Dh
F' u9 D% d. XWhich are the 'magic values' used by SoftIce.9 B6 k! s/ }9 Y
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.4 W4 S0 D+ S3 L2 w4 S- T! O9 G+ a
! k- m( }1 k' o n Z
Here is one example from the file "Haspinst.exe" which is the dongle HASP
6 P$ M3 B" r4 A8 w. W" `' FEnvelope utility use to protect DOS applications:: n' C) V' Q% q: D
# ?" v# b: `7 L- @# j9 V2 O; `
W! t( C7 W) D1 R
4C19:0095 MOV AX,0911 ; execute command.
' H' B4 D( j4 U: q# k/ i4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).# i+ h* V. P+ }9 b1 j0 z
4C19:009A MOV SI,4647 ; 1st magic value.
4 S, {; v/ O& e3 b! H4C19:009D MOV DI,4A4D ; 2nd magic value.6 F7 v8 s4 a) X( U0 Z$ Y7 z: m
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
1 W9 l2 p* {; K$ X6 [1 r+ c" ~1 B4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
/ X3 Z0 {0 g6 z4C19:00A4 INC CX5 Y3 T7 b! d S7 m9 I
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute0 z+ V4 J9 N9 v
4C19:00A8 JB 0095 ; 6 different commands.( _8 N" L6 I" W* y0 a
4C19:00AA JMP 0002 ; Bad_Guy jmp back.
4 T1 F( O: x9 [5 d8 M4C19:00AD MOV BX,SP ; Good_Guy go ahead :)) ~/ Z- X# g2 N% ~& k. n4 e
. a0 n Y$ [9 H2 d, B# f
The program will execute 6 different SIce commands located at ds:dx, which# f7 i r0 M! f
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.$ |+ y& G4 D0 c3 Y# m& {
* C- K6 K$ [6 @1 n2 |& m* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.# j7 S/ M9 [: }3 j l5 A. ]
___________________________________________________________________________" h4 c1 k/ M4 Q; Q
( e& j5 R* j2 S' y4 T- ?3 Y7 X
! T1 Y/ v' e5 G2 t( @Method 03
; c) ]) x$ x K; o7 d; W W+ m* w" @=========' m3 Z' z1 `8 E/ p7 B7 b, d9 ]' h
; d" E: \- S4 E* P/ D$ J" D; CLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
5 R/ a% j2 c, E4 I# [ N. `" {(API Get entry point)
) {3 w) X+ ~/ P. v4 t$ ^/ U- }
/ J( B0 [' {+ r* o4 }" q8 p1 J G4 h( A( _/ ]! [6 a
xor di,di8 l: x2 b! o# q! c# G$ o
mov es,di
7 j% A. v7 O( {$ D. @6 m mov ax, 1684h
+ I4 ~4 U4 v+ K. ]5 G) ]* t% \ l9 j mov bx, 0202h ; VxD ID of winice
0 [4 M, M3 t' j+ K int 2Fh
; G# I' K7 e" F! y [5 d4 [ mov ax, es ; ES:DI -> VxD API entry point
$ M. F# _- q. D2 R add ax, di
5 ]& f$ r' w, }" J# g: q test ax,ax: ?* E( W, |* r; U5 G' j, [
jnz SoftICE_Detected
! ^: e Z( l4 T! m9 h4 g+ R
; I0 N+ p4 `8 U ?6 ]___________________________________________________________________________6 D$ U+ |' r s8 n2 {
' Q2 b+ i) B- H) T( kMethod 04$ K" I! r4 {3 D0 f
=========
7 \1 e% ^' T/ |/ q/ r+ }" R3 d: L$ n1 C1 o1 [! ^0 D7 r! Y+ G
Method identical to the preceding one except that it seeks the ID of SoftICE
+ j U6 A6 q8 [, K1 k% N% }! N4 JGFX VxD.8 E* j4 o. _3 b; \) R" c
& t R! g$ z- B: O' I
xor di,di
: r* l8 D8 r% @" |1 B+ I mov es,di: Y5 z2 D! @" W/ \! l
mov ax, 1684h
, u; A7 F* P' l+ L% k( U4 H mov bx, 7a5Fh ; VxD ID of SIWVID- U% k! d; S8 F! z+ D W% Q2 k3 @/ J
int 2fh
( e' I8 v" o; L+ k9 f mov ax, es ; ES:DI -> VxD API entry point6 v5 O7 s/ H3 [. j( W
add ax, di
! ^( T3 S% i) F: z6 T. ? test ax,ax5 @1 ~+ u5 U% r& l4 S
jnz SoftICE_Detected
! |; }- n' C& a. }, z" G. B0 J4 \- k2 w- y
__________________________________________________________________________8 O) \# v8 N {4 Q7 S( S$ p/ `) D7 A! ^
1 W7 u/ e: N! \. p
" ]) B0 R- `( A7 P! qMethod 057 V' j' ]( k; G; e; c* G0 R
=========
6 U0 U9 ~# |$ C0 M' ~" k( F' i; A
; j6 @% l6 t9 Q8 y! y" i/ T+ NMethod seeking the 'magic number' 0F386h returned (in ax) by all system" e. o, F% H/ y5 ~; h8 f, _! T/ x
debugger. It calls the int 41h, function 4Fh.
# _+ d& f6 B' C5 dThere are several alternatives.
" h+ I5 H$ t4 L0 m" C! p; h9 `( Q0 w9 i; v6 E8 r9 e) ?" d5 o; T; n- @4 e
The following one is the simplest:. H4 w* ?4 O0 U$ O7 ?8 I
; {* x g- C! @6 t+ p
mov ax,4fh
, i ~" l( _, N K- G: F. _' N int 41h$ p9 t9 {( D( Z% z8 E& B8 |% m
cmp ax, 0F3862 T6 ]9 {# f1 L8 T. r$ }! ^$ {
jz SoftICE_detected4 u+ I( g( k- Q
% p- b1 U1 E- G9 u! c- y) H7 q
# ~, Q* }* A3 c/ s( W! {4 |- VNext method as well as the following one are 2 examples from Stone's
: N2 a. }. ?: j4 }9 j- q% ]"stn-wid.zip" (www.cracking.net):/ j4 x- c t" `, H- H: Z, r
( y1 z4 j3 L/ l# j$ ?% w: | mov bx, cs8 D% D: i( @1 `4 A) q! w7 D7 L
lea dx, int41handler2- T0 m# }) ]0 w0 o4 ]- ]
xchg dx, es:[41h*4]! P) y% p1 }" r$ o( s
xchg bx, es:[41h*4+2]
# b4 [7 `& x% n8 v2 _ mov ax,4fh
7 ^3 U( `3 Y: q6 T+ Q# H( w' R" ? int 41h2 _1 l [# `0 N; r$ ?4 A
xchg dx, es:[41h*4]
- X! D* D9 x8 j% A6 D8 ]* W/ m xchg bx, es:[41h*4+2]
4 u7 L' h( u! q7 l7 v* T cmp ax, 0f386h. l) K9 Q* Z, q8 X2 g3 x+ s" B
jz SoftICE_detected7 _7 d1 ?8 ~% P* C8 _! U
2 l8 _" M4 Z- Cint41handler2 PROC
9 H2 r+ B& X y6 ]/ J iret8 E& h& r3 B" x: T- j! ?
int41handler2 ENDP6 `" U' N2 V8 E$ f! K4 s. B( i
5 n$ n3 h3 D! b* N* y+ x( ~
5 a5 D4 m; p9 h9 Y: {1 U0 H_________________________________________________________________________
9 _9 c: y! M4 ?9 B/ M4 z7 ?" w5 H; l! D% ^! W; i
& x6 O' X7 O- b4 b1 U Z. r) T$ sMethod 06
I: x3 x2 l/ F( @! P$ e) G* n=========
/ Y$ q' x: x% E8 w" s) z6 d: l* D: ~) `
0 K9 R/ t% h# Q8 g2nd method similar to the preceding one but more difficult to detect:
! E$ h4 ~0 i3 v6 N
& E0 i) L0 T; A/ |1 q3 @( e
4 M, T1 |8 T; ~9 _, b+ |" @int41handler PROC' y) Z$ c, z6 ?, [% a# c, w* R
mov cl,al3 l6 O6 ^2 w) _5 n8 S, m
iret
% o( Q: j$ B, y" i j( x! Sint41handler ENDP! O1 s7 L# z0 w) }- h* B" ?, y1 z
& W7 J! ]6 H/ v/ T6 Y, B
( V( Z+ O/ i3 {; v! i: A/ q0 H
xor ax,ax
5 n* k; v. c3 ^ mov es,ax; Q2 y8 X- D1 O% U$ S) B
mov bx, cs! N ^& ?6 h6 k6 w) |3 L3 R$ R# a
lea dx, int41handler% g. }) M- V- @$ t0 L
xchg dx, es:[41h*4]
: T- u4 r0 l* D6 g5 [ xchg bx, es:[41h*4+2], o7 b! D, l$ O. b' G
in al, 40h( w/ l* q# V6 Y! \+ [+ K9 D; ?+ @
xor cx,cx
# ^' W- Q, x) W" w& R+ f+ D int 41h- d; a, ^: m! f$ P$ |( p5 n
xchg dx, es:[41h*4]
9 [ [# |+ Y0 x" K+ c xchg bx, es:[41h*4+2]6 v5 ?# X7 K/ o0 t8 {
cmp cl,al. U7 j; ^% b j# _- U/ q0 A# \
jnz SoftICE_detected
5 v4 Z# c$ m+ q3 N$ T" O- z( Q5 @: H
_________________________________________________________________________2 O- S% x; @' H% r- }1 A
- M4 z# W9 M- {) Z0 }9 d
Method 07
8 s6 `! ^8 V6 s2 H* Z* ]=========
8 o# c8 F: m P6 `7 s/ `
\% p( g9 P4 g: }Method of detection of the WinICE handler in the int68h (V86)
, ?+ w% r; Y/ F
, b. I% t& f! I mov ah,43h( t- m/ y% g4 i& G5 G" M
int 68h
7 g% c {* Z8 c7 O! A7 I1 I: k cmp ax,0F386h
/ ^9 N1 u/ R( L5 a7 ^* w4 K jz SoftICE_Detected e2 d z7 l5 i. k$ [
6 }2 n. |4 R& z( M5 I3 C d- I
9 h' U+ O& X/ i/ A=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit0 S1 {- v( i6 W+ `( F' q2 Q
app like this:
# P7 q5 O L5 n6 D" i
# J, `) g, |6 ?% j2 f BPX exec_int if ax==68
; U v% J- y. m( w, N (function called is located at byte ptr [ebp+1Dh] and client eip is9 D# D H3 R! n9 @- u9 ?) Z
located at [ebp+48h] for 32Bit apps)! {1 ^3 s& k$ j; S7 C1 n
__________________________________________________________________________, B. d* ^% V; a% ]
! p8 Q: F) t" Z. u) ]9 K- h5 f
9 G% O1 J z: I, P: [3 ZMethod 08& g. |# I0 X$ U; E$ R9 a5 O+ z
=========( R. q' J' u3 |' |: T) M2 T& H9 {# _, Q
! S& _% ~+ [% [/ OIt is not a method of detection of SoftICE but a possibility to crash the/ I: d; i/ Z1 \, L' e6 L4 p
system by intercepting int 01h and int 03h and redirecting them to another; ~$ \& Y0 @2 B
routine.
4 }, X- u P8 g7 t, J1 GIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points/ U" p+ \; Y* V! l6 C/ ?% K' S
to the new routine to execute (hangs computer...)
; K* b& P) r: ?1 j+ l( @
: v+ Y: E) `4 g1 } mov ah, 25h
$ l1 M" P- b% h7 F) g; C1 w1 m mov al, Int_Number (01h or 03h)
3 W* y4 U7 y0 d3 T9 \( W# q4 D mov dx, offset New_Int_Routine! `8 U3 {1 z# f0 r
int 21h
+ b& V9 a8 a, N- W- V# M/ F1 D
1 N+ q& f* [1 x5 o__________________________________________________________________________& c& Y& n& l: ~1 m7 }( B
( G9 D0 s" L) ]" x- p/ {+ SMethod 09
2 p2 m5 |1 O1 j7 @% J! l- r=========, I" ]5 y3 t. p+ l" U0 E
2 U0 K+ C2 X$ U4 N$ fThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
4 y# n. b7 f. E0 V, z, {; u: {performed in ring0 (VxD or a ring3 app using the VxdCall).' H7 }9 B) x/ \" M
The Get_DDB service is used to determine whether or not a VxD is installed
9 n7 O% Y3 T0 | ~% P5 Ifor the specified device and returns a Device Description Block (in ecx) for5 K* o0 j, c) X; s) Q1 h6 |. B
that device if it is installed. }8 m5 o' a( l0 u/ u) {1 W
+ J$ t T: G$ Q8 ^
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID% i! @! e2 B) j( v3 C6 e
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)6 ~6 A4 U3 R i0 S1 r% q
VMMCall Get_DDB4 f- Y% L r: F, p1 q
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed& F1 E+ C/ j& ^8 c! i1 u
. Z9 S3 k. p2 m' a4 g5 i
Note as well that you can easily detect this method with SoftICE:/ S. Z; d1 u7 Q7 N$ b
bpx Get_DDB if ax==0202 || ax==7a5fh3 F1 g( ?) J; e9 x3 h1 a! n6 J2 d
# ]" K+ Y7 }6 E
__________________________________________________________________________% c' @/ ]. y" T) T6 \! s
" H" c& X' s; r- D4 m, f4 ^" |
Method 10
0 D! u% S; h. ^0 j7 i=========) [2 ?$ @! s5 n! f! U) o2 l
8 Y' L+ K- B/ e. T2 d' N=>Disable or clear breakpoints before using this feature. DO NOT trace with
$ J( m; p1 B4 x) i- y2 i1 B SoftICE while the option is enable!!: Z) G6 t- E* n5 z
' e0 X$ O2 f. ]7 y- jThis trick is very efficient:8 F. g) U2 a3 K0 u) K4 `8 B
by checking the Debug Registers, you can detect if SoftICE is loaded Y+ x+ o. s: s1 _( D3 R, V
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
- g3 U7 x0 B8 R, S. Wthere are some memory breakpoints set (dr0 to dr3) simply by reading their0 N6 l2 }5 G: a; t$ O5 x3 ^& P v$ x( @
value (in ring0 only). Values can be manipulated and or changed as well
0 v% Q, ?9 P" V( o) Q! |(clearing BPMs for instance)
7 O' r; O2 k7 N) L
; h& @8 \, w6 b% F# m! r) E) E__________________________________________________________________________ t8 `. Z5 A/ x2 J. ]
7 |- a) t5 C. Z7 uMethod 11' n& p, ^7 o; J
=========
3 `$ L# s0 ~ v: r" x# ~0 I% a( R9 x/ o) c
This method is most known as 'MeltICE' because it has been freely distributed. n7 c @6 G$ e# U' j$ _6 t4 r
via www.winfiles.com. However it was first used by NuMega people to allow( I8 |+ N0 q, t6 a% D; N/ @
Symbol Loader to check if SoftICE was active or not (the code is located$ H# Q. k# F- L0 C
inside nmtrans.dll).
2 b' x& w2 I! U. n: o# X
' N3 \% n$ t0 j4 rThe way it works is very simple:
* E0 }; X8 s( L2 f# vIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
. ]: J$ }8 M; yWinNT) with the CreateFileA API.
# l% ?2 m; P: _0 k# w h2 I
3 H! G4 D$ P- [; X3 g" g) J+ hHere is a sample (checking for 'SICE'):: y/ |8 P/ d* l) _+ U! Y
2 h6 J3 C- {' i: Z7 X* BBOOL IsSoftIce95Loaded()
8 G# p, ?! ?8 R* L# g{
8 \- y5 _' r9 f; p2 R HANDLE hFile; % X ~/ Q: u6 Z8 b& t3 G4 s2 M
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,/ f3 r' i) u. T9 N/ m5 Y+ \- A
FILE_SHARE_READ | FILE_SHARE_WRITE,- I$ i4 f R: D1 b' s
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
4 L* _" b3 p! `4 i2 A$ m if( hFile != INVALID_HANDLE_VALUE )* ?7 ~9 k, G# n2 B% _
{5 s. e% R5 ?8 o; U; o% Z/ i6 j6 N
CloseHandle(hFile);/ p+ b, ?" [3 g# b
return TRUE;* W! W4 t/ P8 [ \5 v
}. _. J' ~% W+ x! K: x& }9 U2 s6 s
return FALSE;$ H. S, r# b/ W+ g7 V( K
}( E' w, j1 {) S6 a5 u0 Q+ v
( N% N- {2 t: q1 B6 P5 G8 A8 k
Although this trick calls the CreateFileA function, don't even expect to be* V0 \6 b v3 C) i
able to intercept it by installing a IFS hook: it will not work, no way!
2 E9 u. X5 H- q9 e" I# Z) w ]In fact, after the call to CreateFileA it will get through VWIN32 0x001F* J& x- A6 O/ c+ x4 t
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)7 p" k n8 X3 p/ x% \6 O8 D( t
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
6 f+ ?1 n0 N: ?) t; qfield.6 J) d9 l3 D7 g4 L( j
In fact, its purpose is not to load/unload VxDs but only to send a 0 u" w+ J3 P2 [) }8 ~
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)2 L' l2 G8 H% ?- i7 T
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
2 C8 J0 X5 P1 G8 V( Eto load/unload a non-dynamically loadable driver such as SoftICE ;-).
) ?. O3 G5 ^6 L; y7 V* e- ~# L3 MIf the VxD is loaded, it will always clear eax and the Carry flag to allow
5 W) ~8 k- J1 J" ?1 w9 t( Bits handle to be opened and then, will be detected.* ]1 @$ t {: T" @! x
You can check that simply by hooking Winice.exe control proc entry point3 u% Q! G, @( ^
while running MeltICE., o9 \* @$ K# S% D! C! s
# N* k% I q$ X2 \. a8 Q' t% J. J/ |0 P% m; `4 P" f* h
00401067: push 00402025 ; \\.\SICE
' q$ t; f4 v2 x8 H: V8 F4 K% | 0040106C: call CreateFileA0 n: O8 w0 y$ u1 t0 G
00401071: cmp eax,-001
+ ~. I4 M" C/ [/ M 00401074: je 004010916 v% s$ C. Y7 U1 |: V" |
5 G9 Y: G% L/ r* W* t. ]- u7 ~/ J- v0 v/ _/ c5 Y
There could be hundreds of BPX you could use to detect this trick.
; w5 A% V6 l% t-The most classical one is:
$ Y' C) d L- z BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
) o6 i3 }0 y( x: S5 t4 E8 f *(esp->4+4)=='NTIC'* F. Q! |, L& o1 z, I1 b9 q/ ?
1 M2 P9 _" _4 @. x; s5 P
-The most exotic ones (could be very slooooow :-(
( \! H- n0 V6 g7 ^% H' B7 X, \' J& C BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
$ [$ w' r% Y, Y3 \4 F( i ;will break 3 times :-(
4 T! Y/ g: l, ?( B. L) Z$ F' S3 c6 c, l
-or (a bit) faster: : h* V5 h: r8 s% U% o7 t N& Z- I
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')7 F$ I$ D3 h) O
; i m( w% C& @, K3 V! f7 ? BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' 1 p" c F( }5 d- b; c! h+ @
;will break 3 times :-(
) h. x2 y7 K9 k6 E( \9 ~8 ]/ h- U6 b; g7 l! r4 U
-Much faster:
* U/ l7 h D( F; [* J! w BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
7 w' t- y0 A8 x- T- g9 R% b9 T- |5 ^, p% M' F
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
0 W% A% z9 |- S9 r! z& tfunction to do the same job:
$ Z! B: `# h( B' s
# \- T7 L( k+ W' W7 F' O$ o* V push 00 ; OF_READ
% s" H4 q$ l2 m- r; X. ?$ p mov eax,[00656634] ; '\\.\SICE',07 [6 p) _5 E& X% `
push eax/ H: z: \. ~3 |1 [
call KERNEL32!_lopen" B) P4 P5 {; R" f* W
inc eax
5 a# b, W( G( L6 f6 w jnz 00650589 ; detected1 z& n( E3 m9 W5 q) _& ~
push 00 ; OF_READ
# s' S/ t# v4 w1 @ mov eax,[00656638] ; '\\.\SICE'
! H2 @2 p. S' ^: b push eax
. s- T- B9 J- s, V1 {* L call KERNEL32!_lopen+ I9 h! n6 o, X" e# k) C
inc eax8 i( [7 ]% n. u1 x: \5 z
jz 006505ae ; not detected0 H) I9 N6 ^0 ^3 S2 v2 R
3 }( M! d: A; J! p$ v8 i% z8 M
# H* J. M* L) v# F' ~__________________________________________________________________________- K$ ?9 x- w- h9 _- _- J
' ^4 w4 b9 Q+ A/ @ o" r/ j9 jMethod 12
+ M4 J% Z& g/ J% K/ t* ?. q=========9 f7 H9 c1 l# `; S4 {
, {2 V# n6 k/ Y9 o& f' a7 k8 h; {
This trick is similar to int41h/4fh Debugger installation check (code 051 H: s) s4 y6 C+ [$ ?2 v% P5 I C2 m& f; I
& 06) but very limited because it's only available for Win95/98 (not NT)8 I9 k" O$ `7 h& k9 B+ T3 P( T
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
( c# p+ l) L- k5 Z. m8 y
6 R$ f3 @* [, D) `( {' e push 0000004fh ; function 4fh
' ^! s! x2 v; X9 m push 002a002ah ; high word specifies which VxD (VWIN32)% i2 K% ]7 ^& a3 _ i
; low word specifies which service2 X" f$ v) k5 o6 m. I) p, Z
(VWIN32_Int41Dispatch)
. T% S. V- f- L/ k8 R7 ]3 Z call Kernel32!ORD_001 ; VxdCall8 {4 F# S0 \7 U9 h* F
cmp ax, 0f386h ; magic number returned by system debuggers5 ?; }1 H* `4 |( R0 `4 {) {
jz SoftICE_detected
3 q8 b, p/ m M* N
, `' i- g+ ]# ?7 oHere again, several ways to detect it:
) ]: W+ G+ ^4 J) q6 ^+ c
# d* j& I; D4 @. z. K" J. N$ d BPINT 41 if ax==4f
* L0 b; H2 Q$ N; A" x1 x9 ?; n1 i U2 J/ z0 x# W- u
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
7 @/ b7 b9 h- x, j% w& I( J/ b& X0 r8 ]/ v+ i
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A7 j6 V! l) C: G9 F6 Q
; Y7 N3 v# X4 l
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
$ S4 A2 [2 J; i7 }; p' K/ M! O% ~
' U& I$ s' w) U- X. z/ `, V__________________________________________________________________________
- D2 ?2 r- G; t) V( D3 F4 z1 J# @
) f" ]& }$ C7 v$ S" |9 c3 iMethod 13
9 D; n# Q) w- r9 `1 E( o=========
3 x# |6 Y2 e& `9 p1 t N
, p, p" w. y1 E& @Not a real method of detection, but a good way to know if SoftICE is
, f) X8 N9 D5 j* ]/ C. {installed on a computer and to locate its installation directory.) Q/ ?7 O, q7 k3 k5 w
It is used by few softs which access the following registry keys (usually #2) :3 i8 |! r+ Y5 K- T l
! t+ d8 U5 K+ k2 D4 E8 `
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
! E! n; A/ e' I5 N6 W$ l+ ~\Uninstall\SoftICE
6 R4 m7 C1 m! Q; s-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
" P& Q7 R7 K( Q$ F3 e$ n2 M-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
) U8 i& ]/ B3 J2 y% V+ E\App Paths\Loader32.Exe
( x4 }) V* ~/ b; b8 H, D9 J( K% N/ O" X+ O6 E7 U+ v; A, [
7 D! b: i9 _8 v/ s7 e* C
Note that some nasty apps could then erase all files from SoftICE directory; C$ R, N6 V: T9 M
(I faced that once :-(
% M8 X7 ]0 m( v4 v5 ]. B
5 ?) X4 G6 Y% T/ x4 G( | d7 _Useful breakpoint to detect it:3 @3 I" |% a! S2 }* z, s
1 o( ^, f' _# k3 G3 W BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'# T3 ] x4 }. v1 ?8 n" u
+ A7 |3 t$ u% B$ N+ H& S& A7 _. z
__________________________________________________________________________
: Z' o1 x% S6 e% W7 K& X5 w8 ^, \" o! l' A8 g) i1 f8 s4 [- u
! E l' ^0 H& oMethod 14 l7 s+ ]; s7 D, _5 a* X' Z
=========( h7 k9 k5 |, \ v& L7 q( C: s4 a9 u
2 Y+ k; d9 b4 i3 ^
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose9 K6 J$ `7 v' Q" t* N; J
is to determines whether a debugger is running on your system (ring0 only).
; h- r, G; L: K$ L: w, U& h/ P, ^7 n& S
VMMCall Test_Debug_Installed
9 D! m+ O) A) O4 L% `4 p& _ je not_installed
' V, ~8 p% N+ ?0 G* [8 Z, g5 ~ z9 l( o" {3 W( {. }
This service just checks a flag.( `. N( h' o+ w$ `$ a! s
</PRE></TD></TR></TBODY></TABLE> |