<TABLE width=500>; d# B# O! f: [( v
<TBODY>& W' }: p5 s) w8 D
<TR>
- ?! m! p+ w: B. j2 f1 ^<TD><PRE>Method 01 3 p2 x6 |- n; s& Y
=========1 N! a! z9 d1 e# R/ G g. T0 p
. X' D6 p; I7 b! C0 Q+ ^
This method of detection of SoftICE (as well as the following one) is2 n2 n, Z% G7 U3 a' ]4 F
used by the majority of packers/encryptors found on Internet., o ?9 i5 T8 W+ ~7 f
It seeks the signature of BoundsChecker in SoftICE. L& P- c& \. r) E7 d' J6 h# {
% z+ D8 J, W) ?# {; m+ m
mov ebp, 04243484Bh ; 'BCHK'' a, I9 v7 c% n& g5 H7 @$ k! T
mov ax, 04h: l2 ]& K4 l; l, G Q& R
int 3 7 p8 A e8 _$ q& V
cmp al,4
# c; W# ~* f G( S. Y jnz SoftICE_Detected
3 X1 \ j K0 X' V# G; V2 T
) I& Z) R3 Y' T$ n/ |. F/ |9 C___________________________________________________________________________
9 T( y8 \- z; z* q. i6 ]& o
- v7 M; t) N9 P+ j& }" JMethod 02* K) a2 `% ?6 I; {
=========6 K( y% U: h+ G$ V- D1 k
2 U3 d% h) h+ b! GStill a method very much used (perhaps the most frequent one). It is used- J/ p4 Q4 R: z5 t# s- E
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
9 S1 [. }7 A6 O5 ?# Bor execute SoftICE commands...
$ q8 z4 X6 d+ L3 CIt is also used to crash SoftICE and to force it to execute any commands2 b3 j: G+ y4 ~: g) U
(HBOOT...) :-((
, l5 \$ A# p2 Y2 h$ t4 p7 L& G$ p
1 }1 W, @/ L* s: M ]0 u* m. }Here is a quick description:
{5 }4 }( |8 d" c7 D-AX = 0910h (Display string in SIce windows)1 v& s% k8 C& q/ ^
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)6 ]! i( b: q" |/ {* M: J/ M$ D/ D% H
-AX = 0912h (Get breakpoint infos)
9 N- g! P4 @3 E-AX = 0913h (Set Sice breakpoints)
7 C. N1 M- K8 v, _. K, c% Z-AX = 0914h (Remove SIce breakoints)
0 S; M' O: Y! Q- p$ a! _
3 A% m2 O7 z$ z( e8 P2 kEach time you'll meet this trick, you'll see:. _0 j+ X9 B0 {) n% S
-SI = 4647h s% E0 f: Q# c9 D& d2 ~7 u, f2 q
-DI = 4A4Dh
( o- l0 c% G8 m9 K; }; v0 T' UWhich are the 'magic values' used by SoftIce.
. T( h% [! d& j, PFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.0 D8 G+ D% x$ I7 Y5 n% n
8 F4 I+ W+ _0 a' p* DHere is one example from the file "Haspinst.exe" which is the dongle HASP
, {9 T8 p Q5 j$ F3 uEnvelope utility use to protect DOS applications:
3 |! `# T& u5 ]7 R
; _5 Y- X Z; v# K, t4 {! j7 w" c0 M& w( L
4C19:0095 MOV AX,0911 ; execute command.% L- P, |, c* v
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
E! W9 f v3 k+ ~4C19:009A MOV SI,4647 ; 1st magic value.' m/ \- a$ @2 m0 @& k$ t) s# m, H
4C19:009D MOV DI,4A4D ; 2nd magic value.
6 p f. P, X5 L9 C2 L4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
8 l: t- f* H! ^4 k4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute2 @4 G4 N/ X8 M) x, |) }
4C19:00A4 INC CX3 x8 w( b. z1 |: n: F# |
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
4 u8 l8 |$ B- z$ y4C19:00A8 JB 0095 ; 6 different commands.' `: r% P: V9 J& o
4C19:00AA JMP 0002 ; Bad_Guy jmp back.
3 ~$ _! }4 a: Q7 ]- p4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
4 f% B- t4 l0 \, a; P7 y( _
% J) K( D9 T; \8 w* ?, L, j8 lThe program will execute 6 different SIce commands located at ds:dx, which! A+ M( @) f6 E1 z( V$ T5 ~
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT., F( t: \$ y" W# ?
; \' M" |* M& P1 T0 H
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
, q! W, O, N0 U, a9 G2 N___________________________________________________________________________: F6 v C/ `4 c6 H* c2 F( @
. P8 Y l, Q- A
" s6 f% Y( b+ L9 H sMethod 031 V" v6 s. I! I0 z/ J" c
=========2 L. e- @0 g& X
$ g; E+ H6 K/ Z9 Z
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
7 @1 c& F: U) l' q, V2 c, g/ t(API Get entry point)
8 @, z, R. X, o4 i ! s1 q. }6 |0 @7 H& R# r
3 Y% b3 h3 b8 g- s: E: _& C xor di,di; G! O9 L i* d$ \3 j7 n( C
mov es,di, j2 s/ _9 u+ w# \8 t+ s* h, w
mov ax, 1684h 6 S% `7 C: m" k1 z9 {
mov bx, 0202h ; VxD ID of winice
5 R' w1 P; c' e" \9 _( K int 2Fh+ M( O' @( l+ W9 M3 k* e- }
mov ax, es ; ES:DI -> VxD API entry point+ [ O3 G" q7 r$ |
add ax, di
% ^. T/ z6 g7 r$ K$ b# }6 Z test ax,ax8 m5 y# y- U) m* _( d; u
jnz SoftICE_Detected5 Q. X; s6 D B$ b- m
' p. x' M7 i4 z- w% N___________________________________________________________________________4 y0 ]4 z8 L+ I, K/ w8 Y3 Q
3 M+ L, V. _3 z* Q0 x( G3 N1 j( gMethod 04
7 n) g; w) F! k4 t* C: L' J" w$ }0 M=========# e& E, I) L$ R0 I
; N9 |% Z/ t) _% {Method identical to the preceding one except that it seeks the ID of SoftICE
8 ]7 e ]+ `3 k% B& @GFX VxD.5 r3 f1 e5 I3 k i5 x
( ]6 n! L/ W# H& o$ I xor di,di: I- |& p$ o, m6 z1 J) O: T2 B
mov es,di
7 O& ?* h+ H# R" Z mov ax, 1684h
9 `! o! T! m, f' g; m( \ mov bx, 7a5Fh ; VxD ID of SIWVID
9 ?. I4 k# C7 ]* s int 2fh
% e; }* s; b) W4 R2 i1 E7 m mov ax, es ; ES:DI -> VxD API entry point
0 X' S+ E6 O7 M( s' X7 [ add ax, di/ P9 f$ e, h7 s$ J
test ax,ax5 N# i% m1 _$ M. ^9 f- I
jnz SoftICE_Detected+ a% T# z$ t5 _0 p' M
; R+ W3 o9 D$ m7 [( z
__________________________________________________________________________. a% m, X% p) x
* E F. i! G$ q. r+ t3 U$ t, Y, s3 ~1 Z, @
Method 05
( {. m: j$ h w7 l9 u3 q/ e=========
) A# b4 U3 r1 |+ Q: T& s, S. {. D( [3 W' L, B4 b
Method seeking the 'magic number' 0F386h returned (in ax) by all system
( U8 D0 T& M3 k1 E* x) F* I7 s |- ydebugger. It calls the int 41h, function 4Fh. [. \. F" y: m* f1 g
There are several alternatives. : q! {) e& G. _; F3 [7 c2 F! g, C, V: L, Y
2 e+ }& A2 i I8 f
The following one is the simplest:
1 A0 l3 W9 t! Y* a( T( ^5 ?; o I# m3 h" \8 d( P! C6 @, o
mov ax,4fh) f- l; J* A# E# j- g3 L
int 41h% r$ M6 t) m" U7 ^( B3 s( w
cmp ax, 0F386
& w; Y3 V( n# W5 D- e2 S+ ? jz SoftICE_detected8 \2 L* i3 y& O% a* c1 a/ q/ S- ~
+ W7 M' l, S% ~. T$ ~, T4 l
3 r3 O$ s4 }1 m& E0 [3 K! a, t1 L
Next method as well as the following one are 2 examples from Stone's
; [' J% Q6 @; e4 U8 M"stn-wid.zip" (www.cracking.net):; w' @ b8 K, l3 }' G0 c
Q$ e ?6 V1 p K, F8 A* b1 s5 b mov bx, cs
& j5 n% L, T0 Z9 k% K! e& i3 [ lea dx, int41handler2
& O& b9 c& A5 `* e9 b' z xchg dx, es:[41h*4]
$ g/ F5 \1 Z8 P xchg bx, es:[41h*4+2]
$ v) k$ Z7 N+ v- a mov ax,4fh ?: a) M% P' I, L, W" H
int 41h
: u% _+ [1 ^& u8 n5 g* I xchg dx, es:[41h*4]" d. f* H4 C# o- Y! B, e3 N& \
xchg bx, es:[41h*4+2]
$ Q& w& c I8 m/ ?# l+ H cmp ax, 0f386h' b P$ S0 t8 O, A! ^/ C$ t
jz SoftICE_detected7 ]% V1 G; M: l3 N6 Y! [3 \* u6 g
4 ]/ t; u8 f' s; A# W' d
int41handler2 PROC
$ s+ S+ e2 v$ N& v- i# F* ^ iret9 v9 B$ k( S/ B: T F! G" y" n/ ~
int41handler2 ENDP
, b* A! z' d; W) J
) e5 p7 v5 j$ N1 a0 ~) r% g8 \1 O: R! Y& e/ d
_________________________________________________________________________
/ k* Y) A; ], ^# R
5 M) q) q& i) b3 T+ D
7 ~$ ?9 ]3 B/ K# t5 y3 eMethod 06+ y9 m* c5 ]9 V( W( L. T" A
=========0 P( I+ u7 Y+ i
( o: d s8 j$ o; f0 z2 z a1 l) z5 q2 ]# I
2nd method similar to the preceding one but more difficult to detect:
% C$ F- R% U( k/ |% ?0 A5 W" i" _7 o4 I+ ~! z& P" b- t7 ^
) T, |1 @% W& d4 L! Cint41handler PROC
5 [; a* x3 [# ?# R, @5 u. T mov cl,al; K- y; D! g( L8 ~# q( |1 m$ @' G
iret
3 _- r' ]% Y6 o+ mint41handler ENDP1 g8 m( ~7 A* T D4 |
3 \6 k6 B; }( | }/ W; Z+ I0 R$ p3 W
xor ax,ax
7 d4 v6 q5 A1 p" e* k/ C9 Z; n2 ] mov es,ax
3 l1 a& Y, U$ [1 K mov bx, cs/ i: [; L( T0 ?2 c/ m9 Y
lea dx, int41handler5 q' n. d: G y
xchg dx, es:[41h*4]
+ u" x. [$ Y7 S- G* Y: x, ^ xchg bx, es:[41h*4+2]7 v( p+ Z- S; ^" H
in al, 40h
( E& v0 \# w* ~8 a1 ^ xor cx,cx
- V- \& H2 F" C. F. i5 P int 41h( c, Z. H8 J- k1 c4 J0 x" G7 t6 }
xchg dx, es:[41h*4]
8 E% r l5 U7 E! L# |2 @ xchg bx, es:[41h*4+2]
, f4 Y3 ?7 e( Z9 I+ G) O* i cmp cl,al) w* Q. t1 N, e( g. a, X% B
jnz SoftICE_detected- j) [2 y% _5 R7 y! F. D3 E
' p8 T0 }$ `: c: C4 [5 H
_________________________________________________________________________) r# y$ L$ S, c! w0 _ R
6 g) X( X" Z( _5 Q) qMethod 07
g# N% V2 F/ g=========
6 V% s3 l9 A6 v8 ~
$ ^% |; @+ c! z# N: [! |Method of detection of the WinICE handler in the int68h (V86)0 [" O& r, Z5 e
7 d! m% ?( Q' |1 u$ e& o$ ~* V mov ah,43h1 i6 j z( r1 E' Z
int 68h
/ n& s" R0 M- a# j3 E) ? cmp ax,0F386h
' Z4 y% L0 D2 w! B. e2 m jz SoftICE_Detected
' n a) x* x: L: r0 }
. E I/ r( G0 j. j5 y: u) p% b5 h$ M$ J
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit8 v; X& l3 Y* V
app like this:6 ?4 g9 L. `- ~( u
: O8 o% t" [# }% ~
BPX exec_int if ax==68
$ Y0 M: h: U+ M* P* u5 z' P( l (function called is located at byte ptr [ebp+1Dh] and client eip is( w6 ~% S; o9 E7 S7 ]) M6 s
located at [ebp+48h] for 32Bit apps)
- `7 A' ~% d$ D7 Y Y__________________________________________________________________________
! S( F8 E* @! L/ b! E! j: ~
% V; A( H, ~* y+ m
4 j( i7 j; i7 F" g' JMethod 08/ @% h" n; y8 ^
=========9 a. |# J' N* d$ f( D6 ? d& n
% T& L$ P) s0 ]7 NIt is not a method of detection of SoftICE but a possibility to crash the
) _) t1 t0 {( J5 O/ csystem by intercepting int 01h and int 03h and redirecting them to another7 ]+ L0 ^5 ^/ i
routine.4 j' H0 ^: \' U
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points& s% G1 K2 }6 h. N0 {: e( h4 J
to the new routine to execute (hangs computer...). T: _2 C: v* T: D& U! p
, P( j; o0 L9 \( v mov ah, 25h5 y& j+ e# g0 D, n" B- I2 y3 D
mov al, Int_Number (01h or 03h)
, X7 Z, m/ i3 P2 A% d mov dx, offset New_Int_Routine" R" T9 k7 E; d( r/ B$ t# ~. u
int 21h. M: C2 K1 _. r
* j+ \% x) z/ F6 b/ n__________________________________________________________________________1 i; Q* p- c d: \
+ \( V0 c: g& z# G" ~& N7 JMethod 09
/ I, x( i8 n. k+ d! r=========- g! b& J9 U9 \( D% B
t0 W* ~" z4 F( O( qThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only7 n X# b: I: m$ S( U+ H7 ^
performed in ring0 (VxD or a ring3 app using the VxdCall).5 Y; k, N, e! `& A8 D' j
The Get_DDB service is used to determine whether or not a VxD is installed
: e% F7 O6 J# m( f8 B, C9 J) jfor the specified device and returns a Device Description Block (in ecx) for8 m( I/ |* K% e; n$ Y/ \' q
that device if it is installed.- ^2 `) h- }" H; h
& u; a9 A/ w& e# W mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID8 v+ }4 s: q0 [
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)8 P* a, W: N0 e/ t3 y
VMMCall Get_DDB
, `- @( N' F9 {: S2 z mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed8 r' o' Y7 b- c+ I0 b" F
6 B8 d4 u. j3 m/ s- dNote as well that you can easily detect this method with SoftICE:
& e" A* c; A, o bpx Get_DDB if ax==0202 || ax==7a5fh
: l0 s5 p5 y5 e! x+ ?$ R F0 Q- \% Z, |; i
__________________________________________________________________________
. ]0 w1 m! t) H7 J& A* @& i* h# u+ C S/ }# ]3 W
Method 10
6 V' N* M. `% j2 p4 D# e* R=========
1 A7 j! L% z( L4 ~+ T7 y( @/ P, f4 w4 f$ k+ R$ W R" B
=>Disable or clear breakpoints before using this feature. DO NOT trace with
0 j0 Z: ?" X( H1 Q5 L) t SoftICE while the option is enable!!0 P6 J" q3 x: S! g$ ^
5 ?4 E T+ C9 E9 xThis trick is very efficient:
' ?/ R. r! ? u( L. Iby checking the Debug Registers, you can detect if SoftICE is loaded
+ e+ ^+ I5 }4 N(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if' D' {! r1 U" }
there are some memory breakpoints set (dr0 to dr3) simply by reading their
" s0 W$ b8 ~+ R) @value (in ring0 only). Values can be manipulated and or changed as well2 ]5 Z. \5 j2 H/ ]( @
(clearing BPMs for instance)
1 v- I* ]6 F/ ? G1 ^
3 L4 f* L: A/ { `__________________________________________________________________________7 `8 w1 A# [' g. v2 v; V5 |4 C
* [5 ]- {5 e9 |5 W; z7 B+ f
Method 11" `/ v8 d& d' I# F6 v: I6 Y
=========
* n" I4 d% T% c" x
! T3 J4 g; Z( Y% l9 l8 [This method is most known as 'MeltICE' because it has been freely distributed
; `0 ]5 M" H$ I6 W4 N9 ]; X- j7 bvia www.winfiles.com. However it was first used by NuMega people to allow2 i. @: M2 T) Y5 X
Symbol Loader to check if SoftICE was active or not (the code is located% a2 y4 b' z! a) I* S! Q
inside nmtrans.dll).
; u1 m9 i3 r' x! }, f7 g% L5 U0 l. A1 q
The way it works is very simple:6 S. S. i E# T5 t
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
2 a P& o7 M; h; @WinNT) with the CreateFileA API.
4 \2 v* o* g$ H3 L# d5 l4 \
7 \+ r- Y8 c. m* bHere is a sample (checking for 'SICE'):
& g7 \; O) \6 P
9 S& s- g* c) `BOOL IsSoftIce95Loaded()
O/ U2 r2 ~* v3 R" P{
/ c5 I4 P, m& Q HANDLE hFile;
+ ?) W' w2 A2 s hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,* Y6 C# G! Y* J) T7 n
FILE_SHARE_READ | FILE_SHARE_WRITE,$ K2 r6 k" U/ i& O. u
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);, v; b2 @. B& P3 {
if( hFile != INVALID_HANDLE_VALUE )
9 K( ?4 E0 k$ Z6 ]* t7 u {. Q1 u* i; w- C
CloseHandle(hFile);
2 G1 p: ~/ O5 |3 L return TRUE;; `3 @: U( n0 x7 q' F
}6 z* d% F, G, Z/ h+ d% z
return FALSE;6 c# Q0 ~; h9 u4 O
}5 g* G& A5 j2 [: E' o% y; G
; V8 `+ f0 L2 z @Although this trick calls the CreateFileA function, don't even expect to be
# v. W$ G9 x0 X/ H9 Fable to intercept it by installing a IFS hook: it will not work, no way!
- q) a# g+ D0 [0 l+ s, q. aIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
1 ~, c( `0 C2 `5 G) g7 s6 |service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)! I7 ^- P1 z( a# M L
and then browse the DDB list until it find the VxD and its DDB_Control_Proc( m; J6 V* `2 T3 i7 I. Y
field.
! q& ?8 a9 M8 @) A& }$ W5 C' u6 TIn fact, its purpose is not to load/unload VxDs but only to send a
- w2 R1 T x- Z r) OW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
. P' s# ?7 K' x; [% oto the VxD Control_Dispatch proc (how the hell a shareware soft could try9 S# k( i2 M' H' Y" _! m, b
to load/unload a non-dynamically loadable driver such as SoftICE ;-).8 Q# o& n# V' B# t8 l: ~/ D! D
If the VxD is loaded, it will always clear eax and the Carry flag to allow
c" R2 A4 [4 G+ p5 V. bits handle to be opened and then, will be detected.
+ C0 q1 i/ I, z6 p9 T; zYou can check that simply by hooking Winice.exe control proc entry point
4 V: l1 Q2 Z0 Swhile running MeltICE.' n0 ^6 I8 C' w0 h
9 k! G2 L n5 F6 e$ m0 \; @9 `
: }* k- y& \& u a& \( a 00401067: push 00402025 ; \\.\SICE
, f1 T1 `( D, B. B2 Q% ? 0040106C: call CreateFileA
% B, z" q7 k3 j; W9 r, t1 r 00401071: cmp eax,-001' t0 u9 a. }8 N7 f9 B$ Z
00401074: je 00401091
9 R4 Y' d( Z& I) _0 W: d. m
1 x0 @4 i7 ]; K, e v( {% p( A0 n r/ ?6 b" w* c
There could be hundreds of BPX you could use to detect this trick.
8 }8 ^% G! G2 @6 x8 T1 p-The most classical one is:6 Y% l+ M/ {" I. A. g
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||6 A5 e- f/ k* z) }7 r- f2 K- r
*(esp->4+4)=='NTIC'
3 w/ Q7 Y, Y. I3 F; }. _. ^
0 G/ o7 f( `% Q, {+ _2 q-The most exotic ones (could be very slooooow :-(: Z5 a9 d$ k0 k6 {0 `- O
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
4 w) ]: e+ U3 r. K$ ?" ? g ;will break 3 times :-(
0 O- {6 ^3 R: W& z/ ^; [- M3 m7 U! g: T* H: D" {/ m
-or (a bit) faster:
5 v) s6 \4 s$ a' l/ r BPINT 30 if (*edi=='SICE' || *edi=='SIWV')4 p! e a' m: u4 n
1 i( f5 T" {$ c/ ^
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' + h( G' f* `: i9 B& D8 U9 `+ Z3 z
;will break 3 times :-(" I7 q- C6 X; x
% E) ?+ G7 p) U) ~4 |1 Y/ ?8 E
-Much faster:8 a$ J; c/ [* w4 b7 s# S
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'% Y+ E0 o: n. N4 e* {, b
x( u9 V8 L0 X2 i; P( a& t
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen; V, A7 Q9 O& G3 n7 P0 t
function to do the same job:. O3 y5 Q* _: G! n, j& E2 w
+ L8 Q/ a# E# p6 i push 00 ; OF_READ
; F, R+ O' s! ` L mov eax,[00656634] ; '\\.\SICE',0
& G5 h8 d' S: `8 @& o" U; }" x push eax
4 y R: B, j! j" N2 M$ t8 }* K call KERNEL32!_lopen2 {+ f7 c9 X! I! j; \. s5 F. d
inc eax
7 ^6 u! o& x4 ^6 c" x jnz 00650589 ; detected/ |! N! A4 H2 s8 Y) @
push 00 ; OF_READ3 J% U2 Y9 D2 J2 M: ?
mov eax,[00656638] ; '\\.\SICE'
0 c/ v8 H" N7 E2 Y4 ^0 s# Q push eax
. g* }/ k" u Y: P( Q call KERNEL32!_lopen
: ^0 A7 S' b, Q/ z2 C# S+ b inc eax
( o/ I/ H" _5 Q- _# [! J) A jz 006505ae ; not detected5 H; t; s! _6 o
, y/ N; q4 [4 c; C9 |5 s6 }
' L% e# b' X4 _9 R, `/ @2 U__________________________________________________________________________
% G& M% u+ C3 G8 }6 Y6 N4 P9 L, H% b# x
Method 12) t/ Y- {) a3 o; r
=========4 l) r$ t& ~) \% }) h P, G
0 ^- D, a$ g- bThis trick is similar to int41h/4fh Debugger installation check (code 054 V2 o; I% x0 C4 ^# d$ s+ n: `
& 06) but very limited because it's only available for Win95/98 (not NT)" Y3 m+ @+ t$ G9 k& Q" w2 r
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.$ t( x, P/ d2 R1 s( S5 `6 n
" @% n8 [0 H6 R1 `- E
push 0000004fh ; function 4fh& \5 O' M L* d9 m
push 002a002ah ; high word specifies which VxD (VWIN32)/ u2 v- `2 E8 b) X: S
; low word specifies which service. v: K2 B9 e7 e
(VWIN32_Int41Dispatch)* X' M+ L2 _$ b, v: Q y3 i9 l
call Kernel32!ORD_001 ; VxdCall! t, v. R. R8 l
cmp ax, 0f386h ; magic number returned by system debuggers
0 }* [! e% R5 Z6 \7 [ jz SoftICE_detected
. y) J( ?% Z: w3 p: \( o: i
9 _3 }6 c0 d; k& J5 E" Y, L, l4 [Here again, several ways to detect it:
- k2 f) g- z/ X. J) U5 l
2 F$ M5 @7 M( J: Q+ h BPINT 41 if ax==4f/ r @, e# R1 N: @
( P8 k, u" r2 @1 c0 g BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
; V# x3 m% \" W v4 s: ]8 e. {
2 g: [( B8 ]$ T' Y7 Q BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A+ K' a5 f! j7 a; F; C& m2 h1 ^3 I/ k
/ H1 J$ T8 d, V* d& x BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
) u, p/ ^1 E) w! Y4 u- f# E
1 _" n6 d1 V- |3 K8 `8 o__________________________________________________________________________
- `2 n( D% ~% F, g8 ]8 F$ S5 o; O
Method 132 Q& F$ }2 k% ^. i: W1 o% K
=========6 x: X$ X+ O9 t: G4 x( ]( @* x- ?
0 w0 Z7 l) s7 oNot a real method of detection, but a good way to know if SoftICE is$ _! n, m9 m! O3 F& r2 @5 x4 \
installed on a computer and to locate its installation directory.7 n+ G( c* F5 M3 p
It is used by few softs which access the following registry keys (usually #2) :+ o( M! s0 m( K+ P
4 V2 M/ @6 }4 p/ H& q$ _
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
' |( A3 h( O T\Uninstall\SoftICE
* e n+ b* ]# q8 l8 P+ ?* j-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE D" F1 [# I6 J/ R! M( \9 n5 q; O8 @
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
$ G" C7 s) z$ m1 C3 z\App Paths\Loader32.Exe
Y9 X' \" u2 L7 p
. p5 U- V( r# Z1 ?: D* W
& a. i$ a8 x8 j7 HNote that some nasty apps could then erase all files from SoftICE directory( m( @$ Q& a/ o" ]' c- t
(I faced that once :-(* o% D$ ~; U( | m
6 q* d5 S. }0 S H5 h& V* HUseful breakpoint to detect it:
: ^& H& [+ E" n1 e3 o6 _' `. |
1 s/ f# k! o H2 H' ]$ z2 _ BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
7 k7 u/ ?; s7 o$ @) I# A3 ?8 U0 f3 V
__________________________________________________________________________, r' {3 V8 }! @3 ^% D" Y
& D. B+ z0 w( W4 h' l" p$ Q4 v. X' v( W3 K: V$ [
Method 14
8 W6 C+ S6 o1 a=========
0 N4 f) J/ H+ s( \
) _ w/ q8 O1 ?A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose0 a# O8 _. N B) ^
is to determines whether a debugger is running on your system (ring0 only).* a+ U8 v5 v* I3 w# k% v- a
- w; r7 w$ z1 f7 q' x Y R+ G VMMCall Test_Debug_Installed
0 g5 t ~, x. A3 V je not_installed
& n O* U; o3 }( o! s/ M s. T, u" ^0 W% W" e7 U% O
This service just checks a flag.+ w* ^' q9 y7 t/ y4 H1 R1 Z7 z; D
</PRE></TD></TR></TBODY></TABLE> |