<TABLE width=500>
& \ e q0 z/ S$ {+ [* { n<TBODY>
' \! U$ F/ k& {<TR>
: |' f: f/ r% S<TD><PRE>Method 01 ( V$ N+ S) [$ Y: O" \& [0 v
=========
8 h ]# m7 m3 k, j; c3 Z% Z. g; Y$ y) n: c$ n
This method of detection of SoftICE (as well as the following one) is
' J, M9 S" D/ a$ T- k+ _+ }used by the majority of packers/encryptors found on Internet.* `7 n& N. j9 G) b: D+ v- e
It seeks the signature of BoundsChecker in SoftICE2 d% N+ u6 b, T9 L
4 D q9 w* f. i mov ebp, 04243484Bh ; 'BCHK'
- j3 q7 _* d! R$ I2 h mov ax, 04h
) v5 X6 f6 F1 R int 3
3 g! }! `5 H3 C% d) C8 F cmp al,4$ V4 R- K5 L4 M8 F6 [3 X' N/ H
jnz SoftICE_Detected
7 G$ `. J7 ?6 i. W# P" P# P+ e
+ d; ]; a8 X# J7 Y( e___________________________________________________________________________
! I) T9 a- [& v; t3 G& ^9 N7 i
8 r D$ m; [4 W0 y# ZMethod 02! q: W) _7 M+ B5 J8 O
=========, K5 i+ u) Z( M- e: ]4 ?' q+ s1 X
0 [+ T/ O$ G& L; B# y
Still a method very much used (perhaps the most frequent one). It is used
4 t& ~( ^( ?4 J. x5 Gto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
4 z5 q6 ]( o1 E! oor execute SoftICE commands.../ C8 O9 m, T3 \# K
It is also used to crash SoftICE and to force it to execute any commands
' v) f5 c H8 y3 p' Y8 W. R7 G1 _(HBOOT...) :-((
6 K; A! }: T+ @- t; J$ r1 R
4 z% o' J0 [# ]/ E- ZHere is a quick description:
6 R( v4 o& i0 D9 N" S2 {: N3 V: ~-AX = 0910h (Display string in SIce windows)
! ]- o, `$ h& B1 W& k-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)0 W2 T; `3 z4 Z* F( V
-AX = 0912h (Get breakpoint infos)
! l) T1 P/ `. ]9 ?; |6 [! G% @-AX = 0913h (Set Sice breakpoints)5 v& Y" M+ n1 x: u) l
-AX = 0914h (Remove SIce breakoints)
* }2 U l3 _5 { N6 m( v$ A, n( }( k7 C3 X
Each time you'll meet this trick, you'll see:& B! {8 R2 S. g; L6 v) M$ |
-SI = 4647h
7 o/ `0 r/ s; W# n: a5 h-DI = 4A4Dh
: V# C& B! C% g" `/ x uWhich are the 'magic values' used by SoftIce.: L' e4 `0 b" B4 b
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.; @; n- L" x( [' m# x5 ~9 r
1 f1 l; c" ~4 |: _8 T% f1 v, EHere is one example from the file "Haspinst.exe" which is the dongle HASP
1 X V7 P' O5 e2 S0 gEnvelope utility use to protect DOS applications:
! h3 f# A' L. H. K3 A* @8 K, g: E/ g' I/ J0 x
8 @; v- o, ~3 f" ]7 _" B
4C19:0095 MOV AX,0911 ; execute command.6 y7 K" `; v1 a& a' [; U" Y4 a
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
3 r- g0 _; W9 P# e& d4C19:009A MOV SI,4647 ; 1st magic value.
) ~2 u8 s$ g) T6 O" `6 a, c1 o4C19:009D MOV DI,4A4D ; 2nd magic value.
9 M) m5 f' H$ ?0 z4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)+ \' b' C/ t7 {" k1 s1 ~& R
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
4 Z( F2 ^ P$ i0 G- i4C19:00A4 INC CX
% m+ e* P- q, r4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
* h# M* ^. v' s4C19:00A8 JB 0095 ; 6 different commands.5 W) E9 }( f5 D" w7 b: t- s
4C19:00AA JMP 0002 ; Bad_Guy jmp back./ l4 j. |% x0 N M
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
; T% y0 } k9 F& Z. @
! G" U6 y: e: S0 C; @6 \9 K3 BThe program will execute 6 different SIce commands located at ds:dx, which- a5 m# r: V- {- N
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
2 }7 E( V U, Q$ J6 H4 {# @
9 P- e+ ~1 t5 m+ i3 @# G* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
( i8 r: Y4 r7 f7 P' T: I, P___________________________________________________________________________
; p. G+ A* ~; g4 b3 e# R F
& f. P$ g" Y. q0 C4 f9 u# X9 o: J+ G* H$ ~; G( J
Method 03
/ L! J) ~* V& v$ ~7 E" v9 I! _9 a=========
/ B0 Q, Z0 X! n7 W/ ^8 S# ^1 v5 h+ f
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
% {& B. d9 R' V, l% A* K; h(API Get entry point)4 z+ C) h# D' l# J
: g/ ]9 n% q, j; t
_' [, m' u% {2 `9 z( t# J xor di,di
; ^1 v7 `' h; p; J$ P7 d8 s mov es,di9 R& }( I; P( E# Y
mov ax, 1684h & S/ i# n; ^, {9 S* U* q- Q j
mov bx, 0202h ; VxD ID of winice
. O/ p* x9 y9 q int 2Fh
% \- b7 G0 n B- D mov ax, es ; ES:DI -> VxD API entry point' m; v N/ ~/ w$ H% q: M0 _
add ax, di
) }* u+ g2 B7 I, v8 e4 V test ax,ax
+ R( o5 }$ I6 U f1 Y& a+ }. m jnz SoftICE_Detected8 \: c2 }* x- H0 T* ^
, ]- g q: i/ }* p8 O___________________________________________________________________________
3 Z v% V! X" n$ w1 U( M5 T
. p5 H& s' r; O+ v! a- [8 FMethod 04) R' E' I6 y; W+ l8 z
=========$ M: x- w: ?0 ?9 S: B2 _) K% N
S" d* ?) x" w* E9 h& bMethod identical to the preceding one except that it seeks the ID of SoftICE
0 w0 z. U: ~% }6 TGFX VxD.
3 g! U5 t# f8 p0 ~* z ]" u5 {% s6 Y6 d+ R' l( ]. p
xor di,di
8 u: A4 ]6 n% A mov es,di
g2 s2 F' c' Y8 x4 T9 J! t8 j o mov ax, 1684h
6 c- ^, s; ?, U3 F! p3 L mov bx, 7a5Fh ; VxD ID of SIWVID
, w/ a$ r2 d7 ]6 u4 u1 p# T5 l int 2fh
" z8 ?6 z) V1 z {8 U4 D9 M! b! n mov ax, es ; ES:DI -> VxD API entry point! D) R+ ^$ r7 V! |6 Z# [
add ax, di
$ _ m% v, r. c+ Y. R0 I test ax,ax3 K' J% t8 ~+ X' g8 D: v
jnz SoftICE_Detected' n" }2 _: d, ~( ~0 p/ C7 ~; P
5 X/ j/ C2 b) l__________________________________________________________________________
. a( m0 N9 N3 ]2 f! x: I- l" |) D
9 T( C! o T, ~, |7 U! |/ g+ B
% X/ h& T9 @% e. X- ^; P: j. dMethod 055 n- T7 M# p+ b
=========& }4 q+ z9 ^$ G t' \
: R- [1 W& y7 P) H
Method seeking the 'magic number' 0F386h returned (in ax) by all system
9 y6 P C/ W9 \' jdebugger. It calls the int 41h, function 4Fh.: q' D% P8 V6 z
There are several alternatives.
( R7 \0 }) c6 v, {! e! f0 h' F4 d* u* Y+ H$ X* n, Z: G
The following one is the simplest:
' o9 S T. v: B
, S) f5 K8 O& L; q1 s3 q mov ax,4fh
9 V e& i$ k3 m% P- D! z int 41h
+ z3 k1 I: Y7 V cmp ax, 0F386
8 b4 C5 M. U+ J* y/ j, J: ? jz SoftICE_detected
! K/ o: Y- w% ^$ t V1 i4 h5 { G% K( c4 H0 G
& T1 @; G" V$ b1 c+ i5 w' A7 |Next method as well as the following one are 2 examples from Stone's 1 t, W+ r% y3 ~ {9 n2 A
"stn-wid.zip" (www.cracking.net):' i' w1 H5 S4 O% x2 c" i
& A* r, p2 a5 R: ^" u mov bx, cs
/ _$ V5 c8 M: J8 {9 t! i lea dx, int41handler2
) B5 z# f. Z4 W, \! s xchg dx, es:[41h*4]2 U. u0 T* q$ R8 ]0 c
xchg bx, es:[41h*4+2]7 @/ V# V' y! y7 q' D
mov ax,4fh
9 ~! K' e; ?* M' h# p6 k* q int 41h
, [. n0 P& t6 r5 S. t xchg dx, es:[41h*4]$ Y; W1 o: ^5 q+ u2 K
xchg bx, es:[41h*4+2]% v% p# _ U$ W! M; T# ^
cmp ax, 0f386h
9 v9 g8 a7 e& A2 a jz SoftICE_detected0 u) l1 q5 h' K( s& v
; Q/ w1 Y* }, f/ U4 j: R
int41handler2 PROC! W7 K- p+ {& d1 ^
iret
% Q: n; q: g9 X, ]* f! Q7 W# Wint41handler2 ENDP
) c0 B5 e; `1 b+ U$ o! W
. m$ e7 u/ g, _$ C' s% M- V3 t+ h9 Y
_________________________________________________________________________
* M4 k, r) y' q0 t5 o$ r
4 M9 j6 M2 o0 J/ ]3 [! |' o) ]% g$ I k
Method 06" j4 ?5 ?" b! X# Q g
=========- Z/ e/ G, a) Q0 ]" P `
% j# b0 z/ w% P4 v
+ W; E5 l( }- B3 Y% ]: D
2nd method similar to the preceding one but more difficult to detect:
, O! C+ e ?& K& `) p( _% e0 x: P+ Z
& N5 I. ~9 | V, X6 j* N
int41handler PROC; H& ?# ~# Z1 B
mov cl,al
' h7 ]$ r2 a' _ L; u E4 Y iret
2 Q1 W2 I; }/ n. `3 jint41handler ENDP1 @( i# B( z4 s4 n* r
- a$ E, \, H) y
6 m# ~: L; O% A/ A4 I" i xor ax,ax
' s+ J6 m9 R- C T! h mov es,ax
4 k- V5 e5 j& h/ R9 x mov bx, cs( z3 M5 H8 C5 M7 @* M! @% E5 O/ e
lea dx, int41handler
+ [( {: G6 _. A( p( U" _ xchg dx, es:[41h*4]% V& E8 h- N+ q# X" Y
xchg bx, es:[41h*4+2]0 W9 a, S3 d0 ~
in al, 40h/ }2 r8 [# w* E, E V" d) K
xor cx,cx& K1 q, h) ^4 w; a l
int 41h$ D& T6 Y s6 N4 h# I
xchg dx, es:[41h*4]
; K- N ?- Q- @" s% \/ S" c( J) k+ A xchg bx, es:[41h*4+2]
9 }7 @/ R6 Y# e) ? cmp cl,al
* {. I. J' p3 z# D+ ?1 O0 k jnz SoftICE_detected
# z% ]# X% ^0 c; G* p7 q \7 B9 V4 u- q
_________________________________________________________________________3 g0 q3 @8 N. {
3 L. u/ E, e( C
Method 07! c, r# \! U& L9 r4 L
=========
, a$ K8 |6 K: E# }9 F$ x0 Y+ I! \' \0 A% t9 ^, M6 a% W, {+ \
Method of detection of the WinICE handler in the int68h (V86)
# n6 X2 U4 ?9 H: m3 w" J9 F! P0 w% O4 p1 J
mov ah,43h
7 w: |) s: A" `3 j$ @, M/ M$ g8 P int 68h, k. W9 N' h! Z
cmp ax,0F386h' [9 y6 e5 l' W8 q% T' I
jz SoftICE_Detected
5 z& y/ |. T$ a/ q. i3 c$ u
) O( e, ]4 O( B3 ]! b) s, k, i- a) {5 L4 c
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
+ x( \3 N# c1 V' ], g d% n% O app like this:
2 w& X% w4 d/ M( ]2 V- A" G' |, F! u5 W
BPX exec_int if ax==68
% F/ J+ J1 g+ t- X (function called is located at byte ptr [ebp+1Dh] and client eip is( i4 c$ l* Y' z K
located at [ebp+48h] for 32Bit apps). s4 f& ^; L% Z4 i( h5 Z6 h
__________________________________________________________________________
. y1 m" N e+ J i, d0 ]. c0 ^! j' {4 B# U
( t8 K* Y4 x/ n1 N7 l! A2 r7 bMethod 08
1 e2 @6 l' s. D: g8 D# r=========2 j' d6 s6 V; u
' `% k/ v. N }. N& n1 _
It is not a method of detection of SoftICE but a possibility to crash the; A4 W \% f: k; u! E z
system by intercepting int 01h and int 03h and redirecting them to another9 n. x$ k, @7 h6 J* G( T
routine.
/ T( [& w) E% k, y8 KIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
0 t, F. @8 p: K6 G4 U7 E" {to the new routine to execute (hangs computer...)
. h1 L( O# W3 c5 B6 Z7 y9 I" z+ ]" ^7 g+ M" z$ c
mov ah, 25h
( S5 j% B8 @3 a8 s; c mov al, Int_Number (01h or 03h)
: r* I3 T8 |# C) u- V: f& L: N4 \8 @# b mov dx, offset New_Int_Routine
8 ?% x7 L/ s, C2 x int 21h
8 n p9 s! A. t5 v2 h, {6 w' {$ P1 ^' e9 f& O( C
__________________________________________________________________________2 D! M& d+ U4 L' `6 F0 E5 h1 [) [3 N9 r
# H, F5 S. c7 W" N- rMethod 09
$ H6 H$ n: z' s7 t4 |* w' z=========" E" }1 A& N% Y6 v$ i. Q2 q
B% [( s0 F% N; j3 p6 X5 s3 q, T
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only2 v9 b9 J1 @/ o
performed in ring0 (VxD or a ring3 app using the VxdCall).
i1 \, i" A- X3 Y( r" ~0 V3 B0 P( MThe Get_DDB service is used to determine whether or not a VxD is installed1 e) C7 B! T: l5 y
for the specified device and returns a Device Description Block (in ecx) for- E5 D4 V$ ?. @+ c
that device if it is installed.9 x/ G6 _. [' u* o6 a2 \2 P
, ]$ ?' w* D l; Z3 A0 L mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID, a+ z; h+ r4 U
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-): x& z* G0 ~8 [& A; \/ l/ K6 y" ?
VMMCall Get_DDB
0 t9 y$ h( {# u mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed d, a5 O2 E/ f
+ ~8 K9 \1 B" n/ o# }. C1 {6 TNote as well that you can easily detect this method with SoftICE:' P- \ U1 D+ G% P
bpx Get_DDB if ax==0202 || ax==7a5fh
- V+ `2 \$ S& T2 c- s
6 W: G) K$ b/ r. z- ]9 R9 t. c__________________________________________________________________________4 f& Y5 m) f) f2 z$ ~5 E
! p K# i# p- j4 j) aMethod 10# P/ ]- e- i( U& N
=========( `# u2 d. \4 {* [% d7 Q
* M Q# y$ h: ~ d D9 B9 s" R=>Disable or clear breakpoints before using this feature. DO NOT trace with" {1 C0 P3 s$ z0 M
SoftICE while the option is enable!!* M! R0 c0 V) ^# @ j; d
7 }& _ s/ h* P* \& UThis trick is very efficient:3 e. R: m2 v% m! i6 c' Z
by checking the Debug Registers, you can detect if SoftICE is loaded
3 ~; x) j/ S0 @& y(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if. y3 Z: `* j% g! F8 z$ C( f
there are some memory breakpoints set (dr0 to dr3) simply by reading their
# p2 G+ A9 T9 Y6 n& s7 Bvalue (in ring0 only). Values can be manipulated and or changed as well( Q) L; s7 B w3 k) K* `/ K
(clearing BPMs for instance); z# b, P) X- M" @
9 X- F& S) ]% i__________________________________________________________________________
& y5 K4 Z! v( H6 P" K
/ b+ H/ G- X, u. m. n0 PMethod 11
7 y8 W0 k4 Q7 \ A& {2 |=========8 M* `6 G6 c u. |2 E: b$ B. b
4 e: U! ~$ f6 D& V6 j- YThis method is most known as 'MeltICE' because it has been freely distributed
% Q' V# j" o+ y1 g5 h2 |- kvia www.winfiles.com. However it was first used by NuMega people to allow2 _" n3 z4 s7 C) n2 G6 l& }$ S; X
Symbol Loader to check if SoftICE was active or not (the code is located
7 A7 m4 R7 q8 u! F+ Vinside nmtrans.dll).. S6 E' W3 m( c! i' e- j; D; _0 y* {' J
! }% @2 \; u, B7 P2 w6 B) A% oThe way it works is very simple:3 i$ a! l: N* e5 p
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for' w) s5 M5 C3 R6 F5 W9 U3 n
WinNT) with the CreateFileA API.* R; g" W( k8 }6 O" m4 j
' w J- V7 c/ K3 v5 z. U
Here is a sample (checking for 'SICE'):$ R5 I/ U; ^- f' `7 A
: R2 X) ?' d2 n
BOOL IsSoftIce95Loaded()
2 A9 X9 o; u: o2 K" I3 v! s; q* @{
8 \2 J) l* P. k' b8 {6 p HANDLE hFile;
# \# ~" p- R4 E hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
o9 Q6 Y+ @/ _; H$ d FILE_SHARE_READ | FILE_SHARE_WRITE,
$ r3 U" C6 `8 l. J0 Y NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
5 w0 }" e+ x) P1 K! D if( hFile != INVALID_HANDLE_VALUE )
, m/ P2 Q8 B; z1 z# A# E" Q7 B {
. n1 g. w2 k- J& p5 g3 ~& @; U) p CloseHandle(hFile); k1 r8 h6 @1 ]- l1 ]- D/ l
return TRUE;
1 Z( ]3 A' u a* O6 [9 y7 I/ t }0 q& A% F/ x" q5 ^" K6 ] z9 j# k
return FALSE;
, f6 {2 A1 t" }6 C- W( Y) M. \}
" h0 ?- y1 h- F4 G; C7 T+ y$ y; P1 C1 T7 t' M8 t% J7 V
Although this trick calls the CreateFileA function, don't even expect to be
2 k) R! ?9 Y+ E6 H- e+ L# k9 n8 h, Eable to intercept it by installing a IFS hook: it will not work, no way!4 ]1 t2 e; I6 m6 T: s* Z
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
) c& w- c* I+ V3 Cservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)9 `) m8 u# m; T
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
3 W% N* F1 r# N( }7 vfield." e" i5 G @3 T" }9 C8 h1 l$ x
In fact, its purpose is not to load/unload VxDs but only to send a 1 z% C; D, {5 g; F
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)5 z7 K% `0 \2 ]. z8 ~
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
: E3 q$ s% A3 Mto load/unload a non-dynamically loadable driver such as SoftICE ;-)." v2 l3 }2 t# @- R6 k8 H5 K+ [
If the VxD is loaded, it will always clear eax and the Carry flag to allow
6 X, M5 L3 D" j3 \; Z( V: a* Zits handle to be opened and then, will be detected.
0 V3 a, [0 j+ x/ y5 SYou can check that simply by hooking Winice.exe control proc entry point
( ]6 V' p& S# W# w/ C; |while running MeltICE.
3 F1 D' a8 p; }# f0 c' X/ P7 o. h) ?0 R0 p6 H( i: p! F; T, @& ^! g
/ A- h, u/ v3 ~- l5 `2 b 00401067: push 00402025 ; \\.\SICE, d& [( {0 t* t7 P/ p
0040106C: call CreateFileA( O/ L( S' A$ I7 P' y1 W: K- r
00401071: cmp eax,-001
6 U/ |+ m: N, F" d: f% a. R 00401074: je 00401091% B# v0 O% [/ i2 t
+ G/ B" z1 n3 v: x |2 B o
5 I) _2 Y& {( p5 V: I3 h* EThere could be hundreds of BPX you could use to detect this trick.
7 A4 e7 h# ]: _+ T, n7 y-The most classical one is:
h# {1 M( y7 ` BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
0 c0 }; v6 R; j5 W4 ? *(esp->4+4)=='NTIC'5 x! L$ A9 K; _/ s/ D# M
7 O. ~6 U& v; m7 y" U# P. m-The most exotic ones (could be very slooooow :-(
- `3 n* ~; t0 n1 W9 r- [ BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
; C' q, \" J! N' P* W& K ;will break 3 times :-(7 A3 n3 q! H, u
. _$ K& L7 k' Y1 i
-or (a bit) faster:
9 ^. X k6 o7 W x BPINT 30 if (*edi=='SICE' || *edi=='SIWV')2 a1 m/ U1 [" f2 C8 S9 _ \
; A# a5 S, V. U7 H) b% V BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' / C1 H) j6 {+ Z1 D7 O- {
;will break 3 times :-(* z# |% k9 ^4 H/ k* k
- B) y$ f6 [" X0 u- H
-Much faster:
% w5 G' z: u' ~' F BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'! o" ]" q: W, k- W
3 s9 @1 f$ j H3 k2 ~/ ]3 b/ lNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
: o: V; v; t( g/ g! _3 Vfunction to do the same job:
- Q8 c. k- ^$ Z1 Z
0 b+ J6 s% p4 d" L( Q push 00 ; OF_READ- G; v' N4 S7 J% E! k. j1 A5 U
mov eax,[00656634] ; '\\.\SICE',0
* w7 d8 T5 E" r0 q8 A9 ]% o push eax
9 `+ Y8 N1 ] y' J% e: S+ u call KERNEL32!_lopen
0 T8 s) e4 i3 c6 F7 N inc eax+ t2 d4 R: t" N* J
jnz 00650589 ; detected
4 Q4 A6 l, P, X% Y g push 00 ; OF_READ
5 G# H+ t9 k( y mov eax,[00656638] ; '\\.\SICE'
% h, s: J& f# T' p" b) }" @+ Y( Z push eax
# B( q+ O5 r8 j% A" U3 n5 O( Y call KERNEL32!_lopen
2 X5 Z, I$ G4 `0 x inc eax5 i( ~) a9 U. Q
jz 006505ae ; not detected- b& K7 ]3 ^5 B, K" F" `
5 S% G( N) ~& P6 o+ M6 O0 Z$ \; q" S8 g- J; a" t
__________________________________________________________________________ x9 H1 q2 f. m! {# H
. U, |4 m1 h' b* \6 c
Method 12( g7 p7 u5 Y/ K. R) s
=========
$ Y+ T1 W# l% f1 c: Y6 |9 j8 g) K
This trick is similar to int41h/4fh Debugger installation check (code 05
2 K9 }' m& g4 _' j% u& 06) but very limited because it's only available for Win95/98 (not NT)
/ Y& e) Y- p" h# g/ d& tas it uses the VxDCall backdoor. This detection was found in Bleem Demo./ _* T5 ~8 w, z
& V( W% ^( Q- Y0 @) p
push 0000004fh ; function 4fh
% O/ L: f- s3 E9 ?, B push 002a002ah ; high word specifies which VxD (VWIN32)! I% R3 y- t: m9 e' i
; low word specifies which service8 b& W- k5 Q; _# H# p7 i
(VWIN32_Int41Dispatch)! Z: f- N# W5 `0 o- _
call Kernel32!ORD_001 ; VxdCall
6 ~+ |/ l' s/ l C, q" c6 P( { cmp ax, 0f386h ; magic number returned by system debuggers
" H0 {: f5 ~! |* B( Z6 d jz SoftICE_detected
1 k3 q+ z; ?4 U# r0 o2 a# q8 @( o8 c0 Q9 o1 q
Here again, several ways to detect it:# h$ ?" ^) O. W+ t
6 W1 y) b5 n) w4 x# Z; g4 O1 H BPINT 41 if ax==4f
" a6 K m- t6 D% y6 D7 ^) u) Y% z+ _5 u8 @
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
1 m2 L0 Y. I8 O# @4 b: k- g0 E; W4 U
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A6 T0 L. l1 L, W2 R
+ r4 i6 Y" b t, g d3 l N BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
% e, {. w) \9 Z8 c/ Q
- U$ Z& W% `/ v: n! A__________________________________________________________________________0 R7 n6 P, {" }( o' k4 m
1 a" P" d/ E( H1 N( h: ?
Method 13- U9 [5 t8 V$ X$ J; G
=========
* l1 n, H" q; j# f
7 |, Z7 }5 O- o( bNot a real method of detection, but a good way to know if SoftICE is
+ r3 a3 B: t8 f( }2 @installed on a computer and to locate its installation directory.3 p! \+ J" n/ ?5 F/ V0 e9 J; n
It is used by few softs which access the following registry keys (usually #2) :' K% g- X1 _: o% v
( I8 }5 ?! c6 m" S& ?& B7 Q-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
! j, }$ {2 r# f1 K: S- _. s3 v5 B\Uninstall\SoftICE
2 W R0 N: z! a3 m$ v/ K& {. B-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE7 `( @ W7 ?5 B$ C
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion9 w. S) h( b5 O. Z2 Z
\App Paths\Loader32.Exe! c; x6 A. T, S! i7 x- L X
- f4 d8 F' g7 W& Y! k% P' p
0 C" E# U8 P6 R6 d' n( \; {- _Note that some nasty apps could then erase all files from SoftICE directory
' f/ u/ D! F/ L(I faced that once :-(( g3 t3 ~9 M/ @( o2 C0 H
: ^* ]' \) |& o! uUseful breakpoint to detect it:( i+ X5 R( x% F! a
/ a5 d8 M. w- J1 c# V% ^( h$ [
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'7 F8 S: y: R8 A# [" K& q; W
0 M' m5 c8 F) J1 T8 r0 ~+ x) m; H
__________________________________________________________________________
% I3 E& {% d& Z( j7 d1 z2 q3 \
( Q; k+ `( p" _) ~
7 T2 D- l; E0 m9 ]. q8 A9 z) t7 mMethod 14
) M% n/ E: g* {4 C1 [$ S8 o=========; S$ w/ } D5 j! W: q
, @, C; Y9 w: @0 @! O" AA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
$ V2 N( F' z5 B- @( }# zis to determines whether a debugger is running on your system (ring0 only).4 n( \. ?0 H. w; N/ l; M
' f! t. _" U; Y- D0 u, x: L VMMCall Test_Debug_Installed3 f) L1 `" N9 `8 |6 }5 r
je not_installed, ~( n! V! d/ Y9 s8 g9 E0 D5 x
3 t1 h M2 ?% D3 gThis service just checks a flag.
, A% w0 s; |, j$ h; c</PRE></TD></TR></TBODY></TABLE> |