<TABLE width=500>
' |7 r1 b) _( q# v( ~6 O$ h4 p0 ?4 h<TBODY>/ H. X7 B% a4 \ w2 t
<TR>- \9 V6 `* d) D T/ x" u2 q
<TD><PRE>Method 01
; x3 D% C1 [7 \* V# `8 [=========. a A3 ^ F% L( f, y; a7 {
% d! W9 @! I# S( `4 y }4 P# _( wThis method of detection of SoftICE (as well as the following one) is! N0 T. Q' f. y' i# Z1 _
used by the majority of packers/encryptors found on Internet.- c! `) S; N9 p8 r9 @! i
It seeks the signature of BoundsChecker in SoftICE* H6 p3 y* W& ]# Y$ G
" m; L( A+ R; ]" u mov ebp, 04243484Bh ; 'BCHK'" e0 Q+ x( l6 K, {' ?
mov ax, 04h! u) A( |/ h+ E5 F4 \( @# _
int 3
4 x X) Z# K' @5 c. U8 k$ R cmp al,4, x. E& N( i- [' O
jnz SoftICE_Detected
6 O# O/ P1 _. M" V1 c, Q. c( X8 s% x7 z8 ?4 l8 l6 Y% c: \' R
___________________________________________________________________________- s5 g' y' h8 J
+ q2 p( p* E- y0 h$ QMethod 02" U/ n' v: `% M5 w
=========
1 z+ h8 m, E3 C) m, Q% m* @( \; J' a# G; W7 `2 f. D( l
Still a method very much used (perhaps the most frequent one). It is used
: o q) Q+ g y, p( B) L3 {1 tto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
% j& j. k1 C7 r$ X0 s1 { Yor execute SoftICE commands...) b7 J# J6 M+ F7 F* X
It is also used to crash SoftICE and to force it to execute any commands% Z/ j4 l1 r( |* y7 v! {" O$ {; [
(HBOOT...) :-((
7 ?& K" I. [# F7 C% z" O. G2 O1 T: l( t4 V# d% o
Here is a quick description:
8 _: @: i) p' w- e; \-AX = 0910h (Display string in SIce windows)3 e, R( M4 w1 M- F3 D, h2 p
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
C0 F) a+ @) ~ o* j; Y-AX = 0912h (Get breakpoint infos)9 t3 d; [+ O/ L! u
-AX = 0913h (Set Sice breakpoints)
' ^) m( F% D2 f% D! m-AX = 0914h (Remove SIce breakoints)
( R' \ `) B+ p9 `, j) F
3 g; r/ ~ W8 A: BEach time you'll meet this trick, you'll see:
0 e( a' D: M: {. g- e/ s4 S-SI = 4647h
' ~) ^5 z% H# g6 ^: E-DI = 4A4Dh2 o6 X* K: v2 ~- i+ x
Which are the 'magic values' used by SoftIce.) y) v7 `% [7 m' `9 B0 o
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.9 y: N# ^, T5 u3 ]2 T/ r
3 ] B% z" @7 J* U5 L0 w+ AHere is one example from the file "Haspinst.exe" which is the dongle HASP
3 `+ ~% n6 l1 [& ?9 NEnvelope utility use to protect DOS applications:
8 h# P9 |) ^& r" g+ J$ I
* J/ H X/ O0 J& R9 V" r' r, Q/ q4 W/ S/ b
4C19:0095 MOV AX,0911 ; execute command. E5 f N/ ? P8 X: }
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
; f Z* T7 m% A/ r, y: Y4C19:009A MOV SI,4647 ; 1st magic value.
6 _ V8 y, R$ W4C19:009D MOV DI,4A4D ; 2nd magic value.
5 V9 [9 A- L9 t) n# u8 ]4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
5 R) e4 m0 l9 O2 ^4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
q/ l; b# H3 a/ T$ d1 Z4C19:00A4 INC CX
( f6 T0 ?* m/ r4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
' m4 Y1 v/ [/ ^6 z6 l4C19:00A8 JB 0095 ; 6 different commands.
, N9 Q9 G+ w3 L; O' V5 I4C19:00AA JMP 0002 ; Bad_Guy jmp back.# g3 v: @3 B5 I
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)/ o5 y7 Z0 `+ e# o8 L2 D
, S, T: r. K* C4 T' Y$ L$ C
The program will execute 6 different SIce commands located at ds:dx, which
$ L% S6 Y, s& Nare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
7 z! n! n4 A8 a8 Q; U8 i+ _( E2 ]% K% h
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.2 I3 G8 D; [+ O5 g
___________________________________________________________________________
5 _0 B& i( H- q- h0 `7 s/ B! Q. N0 d8 L- J' L8 {+ ]
* F5 I% D3 Z5 n. o2 }
Method 03
# J' R& B2 S+ O& V5 `! I% x7 Q% ~. ]=========8 w' d7 A1 f8 F$ ]
8 @9 ~9 U6 H! D6 C0 i* j2 GLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h" m5 b9 L6 x2 B3 h
(API Get entry point)
# h! |9 p2 T) `" ]: N% l2 r' Y4 D
! z- E" M& X& z- S, y6 Y/ m2 z' }
xor di,di
8 m+ V1 F: Q0 w: C( m mov es,di
9 @ q1 D, h. B+ F mov ax, 1684h 0 b+ C5 c0 }- C# m( v0 y
mov bx, 0202h ; VxD ID of winice+ A9 x( \7 `( z( h) w. c/ t- n
int 2Fh4 q( P6 v. I" c6 K" I
mov ax, es ; ES:DI -> VxD API entry point# V$ _3 Q& C3 S3 }2 V/ k
add ax, di
( S; z4 ]- U2 t* d& |, E test ax,ax
/ V0 }# \) G; r& d- `9 e& a( [$ T jnz SoftICE_Detected
8 F% k' [* R8 u+ O
2 I! W6 \* E: ]6 W- O% m0 q* k___________________________________________________________________________- D* m, q3 D/ U) E2 p' Y
/ ?* w1 b6 ?; i: a" |Method 04: k4 v3 [" q$ B1 ]. K2 P3 R: `
=========$ p& e0 ~4 x; o& q; s4 U3 i" J3 X
9 Q/ ]+ G2 F9 Y% w4 FMethod identical to the preceding one except that it seeks the ID of SoftICE
* t- w% p0 f5 lGFX VxD.
8 l2 O* w& ]1 [/ g* J/ W p1 w
- i- D5 D1 ~7 \6 p+ N xor di,di
, C% {( m( j* F4 H- x. D4 X mov es,di
+ R K0 B+ ?! c4 y% M2 l% c mov ax, 1684h . p, A0 `7 [* _8 u
mov bx, 7a5Fh ; VxD ID of SIWVID
. v5 K3 o s' g1 Y4 F6 V3 }# J* h; ~' M int 2fh$ c6 ~; {% W9 U3 q/ ?
mov ax, es ; ES:DI -> VxD API entry point
/ J& ^* D3 k/ ?* M1 c add ax, di, L9 U3 \( t, B
test ax,ax- j! v3 \. C* ] X! }- q! V4 N
jnz SoftICE_Detected
* g5 m% h2 V8 h7 r, U( M$ h; {5 V V+ u- N" K9 u. w
__________________________________________________________________________
9 _) Z' c" I1 v! @1 P( s% J7 H& g9 W
, e# a$ x; ~& Z/ K5 a! DMethod 05
. Q, J) n( e) ] c9 t5 U1 ]=========
6 D$ M( L) i$ K1 M; G. W" V* c- _1 K3 \" p4 ^. f C6 B* m
Method seeking the 'magic number' 0F386h returned (in ax) by all system/ ?; ~. w) X& r# y' |! p
debugger. It calls the int 41h, function 4Fh.9 Z) r" S; y$ @" @% H8 K, r
There are several alternatives. - M% R5 K6 P( W& e5 f
+ W$ O, V* e1 _( i+ G
The following one is the simplest:; u9 X9 h& ?4 H; r: r
; y, M$ G0 f: m* k4 j9 D$ t3 | mov ax,4fh& O" T) o4 v2 F) G
int 41h/ i1 C' O" u: l
cmp ax, 0F386! r! d( \2 A! y; Q9 G4 n2 v
jz SoftICE_detected) O( H0 |+ M& g
4 R0 }9 j) |: r% n" a
# i5 m5 V% q3 P- f
Next method as well as the following one are 2 examples from Stone's 8 k0 s; r9 E# Y
"stn-wid.zip" (www.cracking.net):* z% |3 q- M! z
1 \% J" S; {/ |% r+ ]4 Z% ]) p- h1 n mov bx, cs4 Z, V# T3 Q4 ?+ I$ w
lea dx, int41handler2
1 `0 }5 u5 A4 m0 [+ c4 z" o xchg dx, es:[41h*4]
0 G# T5 x! Y; m3 S7 _5 @5 o xchg bx, es:[41h*4+2]5 i$ J; \' u7 d
mov ax,4fh" e+ ?$ `/ ^1 @" e; |& O
int 41h* L _! I" F; }- R8 r
xchg dx, es:[41h*4]
3 m& ~1 w+ M' A* d4 Z1 R) G xchg bx, es:[41h*4+2]
3 O" {% |" Z# E7 h7 y cmp ax, 0f386h0 F, ]( G+ U. ^6 h; Z
jz SoftICE_detected
" H0 S5 h1 `- x& |2 {& s; u. K- i+ o. A5 v' J; [1 t) s6 \
int41handler2 PROC$ q% E& }( |% j) N: n8 U
iret3 f& r* W, Z- P7 F2 N
int41handler2 ENDP) m; T* ^* t2 s1 o' A
- J7 @; S9 l: G, \8 E% j X, Q, ~
( B9 w# c7 q: j_________________________________________________________________________
# J1 Q B4 z6 u) M \' S5 |5 ^8 c0 e9 }7 t9 L& R
# q/ c8 e9 g$ `6 Y, p
Method 06
8 D6 M6 a, l% N3 M( M2 P=========5 _$ F: `4 z6 O4 ]4 i! }
! q! s3 Y. x, n" |& n
& D4 n. }! k4 ~( E/ l% Q2nd method similar to the preceding one but more difficult to detect:; m( W7 G" V( B; M% A! Z) L( s
4 t% ]6 x$ t; O4 d" t( G' x5 \) N9 ]6 V: d8 v h( h
int41handler PROC1 V6 P/ n. m6 D( Q! W
mov cl,al, `0 F/ A( m/ r# Y/ R
iret, _8 E& d+ {2 ~/ E i" u
int41handler ENDP
# ^0 |2 |5 X3 ], r* `
& Z0 H( T' _3 |" }, d
) ^: K% F! m* F7 Q' e; } n" P xor ax,ax
& I9 L1 b6 ?. a8 m9 M& @ mov es,ax
6 ^1 [0 d7 ?, [$ t& X$ t mov bx, cs$ T4 X) Z, Z9 }% |3 A( |
lea dx, int41handler7 ^. j# s8 |' S$ ?! K
xchg dx, es:[41h*4]
4 r# g6 A% n" G( r# X, D- ^, r xchg bx, es:[41h*4+2]
8 y* r( W W9 j! \- Z3 G' c+ L9 h7 P in al, 40h& T' M5 z# i7 y# u0 v
xor cx,cx5 X% v7 a4 Y, d O4 P. `/ z1 C, n! B
int 41h
1 }( X2 }& s) t# v xchg dx, es:[41h*4]5 a* Z/ \ W: F$ i$ U- w4 ^+ x
xchg bx, es:[41h*4+2]& c# A) c5 u, _4 m6 F) C0 Q9 w: A7 N
cmp cl,al3 G) N H- U, H$ y& Y; c
jnz SoftICE_detected
) _4 k5 ] W2 K
' d! n0 o$ k6 O' ~" i_________________________________________________________________________
6 M2 ^% F h5 w' l/ J' W/ E8 E8 Z1 Q( h9 W( K' {4 G
Method 07
( Z! S2 D! W1 w4 L Q( |========= m% _' n/ t' A4 C
- c7 Z0 t( q; x& C7 EMethod of detection of the WinICE handler in the int68h (V86)1 M# v1 F# f! b
9 f4 h' I# k2 D, e& Z0 B
mov ah,43h3 z7 p1 t& ?& O/ ]
int 68h) H6 {$ G- F" E8 M. {+ ?$ d
cmp ax,0F386h8 Z" ?, L# ^. a h& d; H
jz SoftICE_Detected \" L% M) y; Y* x6 d- j5 ~
4 X0 m3 W) f- u' v/ B/ o3 a7 W! T) L. t$ \) L
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit7 l' ~6 y2 q& h& B2 W2 [6 x$ }
app like this:) X5 Z, v- U( p: n
) h6 w- w4 p2 V' z. i- `: p8 I
BPX exec_int if ax==68
H7 o, ^9 H% V" D. U& G (function called is located at byte ptr [ebp+1Dh] and client eip is" H, n0 T) v/ x4 a$ w7 P- U
located at [ebp+48h] for 32Bit apps). I# C3 {8 u# J K. t. \( y2 V
__________________________________________________________________________
% F" n6 Y1 Q" ~9 e6 r+ C2 X, y% G# V; ? n( ~. j2 C/ l
$ ^; X1 G, b5 G1 y1 }
Method 08
7 O; c" c# Z8 t! J+ O=========6 G6 Q3 w8 ]' g- R3 F% C
/ W B+ `! G: m B# u: g; }It is not a method of detection of SoftICE but a possibility to crash the. S) S$ t- I; _! d* z& D; T: k
system by intercepting int 01h and int 03h and redirecting them to another% N7 u% m( ~' A1 M- o U) Z
routine.
* _' V) B# Z2 D3 L. Y1 m* j) rIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
7 S3 c! v+ c4 [4 y* D, bto the new routine to execute (hangs computer...)
! [3 z7 v' k, P" Z* @. e
) C: i7 f& R7 v; \0 q mov ah, 25h
0 C& M, i/ Z4 X/ I/ b% x: } mov al, Int_Number (01h or 03h)
p$ i: ]$ f7 E& ~ mov dx, offset New_Int_Routine
) ^ X ?7 ~; M5 t: F# p3 p int 21h
) }6 G1 Y$ g- X, G6 j. f+ A2 E9 i
3 m) J" d1 K5 r4 t2 L2 h$ R* y__________________________________________________________________________
& K) s6 u# I2 X. \+ C6 E" }* \+ Z5 X) V6 o' v" e
Method 09
% I. q( ~6 B3 C' P y" z=========9 ~! b2 j. o% E
4 t' L" h) [# C+ V8 ]0 `' L! U
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
+ q! [7 y" F, ]+ eperformed in ring0 (VxD or a ring3 app using the VxdCall).
, F8 V8 U$ m/ oThe Get_DDB service is used to determine whether or not a VxD is installed% k2 K6 a* P. K' O, ^ T5 t
for the specified device and returns a Device Description Block (in ecx) for4 d) A5 O" P7 @* R' ?! A7 F7 P
that device if it is installed.( e+ V! f4 b3 a* o5 T
+ N) S2 ?8 A$ ]2 A8 n; D3 x mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID( a/ Q9 W( h" r1 Q
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
" u$ }$ s3 H$ ?( [% {) D) w3 ~) I& i VMMCall Get_DDB
+ i2 M7 }1 W( M# E3 `( \' _ mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed$ D+ |" D5 f1 R, ~5 l
4 v X1 y8 D1 q' m6 E* ANote as well that you can easily detect this method with SoftICE:9 z( x4 Y" H: t* o$ _$ S5 o
bpx Get_DDB if ax==0202 || ax==7a5fh
. p9 q+ s6 b5 d( S, @. P/ y
, z" }, N( N& R7 l/ j__________________________________________________________________________: n& t6 R( V7 B2 K* s' m* C6 c
9 s) o6 V5 O, \& [& I1 v& x) s3 FMethod 10 D( k5 J; Q. s/ _9 O7 G" f" t
=========
9 f0 a2 P9 d; n' |9 j8 U) G+ a) _, A8 [1 r q( J
=>Disable or clear breakpoints before using this feature. DO NOT trace with4 j, m/ K; C3 s/ a2 q0 ?
SoftICE while the option is enable!!4 V2 H6 q6 h6 `9 y
7 q( J0 A+ g/ ]7 D
This trick is very efficient:
$ T& R; s, x$ y9 Q" x& jby checking the Debug Registers, you can detect if SoftICE is loaded
/ ?0 y8 e6 V' }$ l6 V(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if' b1 N9 P* c- M, l
there are some memory breakpoints set (dr0 to dr3) simply by reading their
! Z' P: R$ O! m0 Rvalue (in ring0 only). Values can be manipulated and or changed as well
9 b( k4 v& P- [; p(clearing BPMs for instance)$ J3 M& R( f. c; Y7 \) q
3 t" ?# M B6 n6 P! W__________________________________________________________________________) U( M& g6 N: G
6 n4 o' m! K' t6 L5 M6 s
Method 117 I, }; t: B7 |+ `6 {
=========
1 L: v* Y% B" y8 M& z8 H& T- g$ v7 e+ S% Z
This method is most known as 'MeltICE' because it has been freely distributed2 c. q- a& x4 x- R
via www.winfiles.com. However it was first used by NuMega people to allow
/ E4 y* J+ j- z6 g+ W+ ZSymbol Loader to check if SoftICE was active or not (the code is located( K- H2 [% p- [. P" I1 {/ S& a
inside nmtrans.dll).$ B3 ~# m2 S- `6 L" f. X' G
! i+ d: y3 v8 R6 l J
The way it works is very simple:, x& |& T" }( s% I7 z) ]$ G2 d
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for! }7 }' h9 n# h7 ~- V
WinNT) with the CreateFileA API.' G5 W* K9 b- _# }
% B! D |! A) R
Here is a sample (checking for 'SICE'):
! |- S, H4 A! {0 _& ]/ q6 H- P- j9 i% {
BOOL IsSoftIce95Loaded()4 _% }$ v* e- r, {
{
/ x* z& _ k: i9 ] HANDLE hFile;
: E4 w3 c: }1 l( h- f hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
' w$ f( D$ u- c# e FILE_SHARE_READ | FILE_SHARE_WRITE,
1 N+ ]7 y9 E' u- W* y NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);. S; b: R1 b& }1 B1 U6 n* |- | S
if( hFile != INVALID_HANDLE_VALUE )
1 b' U7 K% J3 Q {
. c/ Y/ ~* j+ S; x/ x! c CloseHandle(hFile);
, }) q; K2 L" \' R7 Z% A return TRUE;- l l) l, f- r* r
}# ^6 `: k) W P! O: p- t! T. i1 ?
return FALSE;% L7 h: N; [+ t' l) n& w+ M0 k+ T) X
}- B- m4 Z4 M% a! ]5 @
6 v! f( v1 H4 h; wAlthough this trick calls the CreateFileA function, don't even expect to be2 S7 i) m6 V, P
able to intercept it by installing a IFS hook: it will not work, no way!
: ?, ^6 ~; Q# X9 T1 S. VIn fact, after the call to CreateFileA it will get through VWIN32 0x001F' }" X4 F9 a0 o6 l
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)' l8 [% _& p" S3 x" g& W0 w! q
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
# W* ]" X7 K, {& @field.% F6 @* t t+ E* q! h
In fact, its purpose is not to load/unload VxDs but only to send a
! W5 B& r \8 ~9 Z1 F- UW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)0 v ?( c0 O2 r9 m
to the VxD Control_Dispatch proc (how the hell a shareware soft could try# a4 }4 X2 ?- n ?5 ]
to load/unload a non-dynamically loadable driver such as SoftICE ;-).3 z6 z, U/ J) p! e: N
If the VxD is loaded, it will always clear eax and the Carry flag to allow
+ s1 T6 N+ U5 v& n4 Pits handle to be opened and then, will be detected.+ l6 w5 N. q" b( e
You can check that simply by hooking Winice.exe control proc entry point
" f# n/ [: G" K3 N2 \while running MeltICE.
& q3 A& _" s0 }4 D6 x* ^/ R, \
* P1 g! {. t! }1 t0 c" D1 W4 |8 C7 f1 g" k$ r. M/ C
00401067: push 00402025 ; \\.\SICE1 q8 E# e! n6 R
0040106C: call CreateFileA- g- \8 |( x! N4 f: ~
00401071: cmp eax,-001
8 n& O: ^( i6 Z3 X- K 00401074: je 00401091 r4 f2 G$ f" b Z
; N' g3 X4 _7 l5 E
/ o+ v3 @: i8 m: @9 c* ?, S( oThere could be hundreds of BPX you could use to detect this trick.. W) ~0 B6 z) H! U: D
-The most classical one is:* Z2 v7 A9 d3 L
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
" p7 |3 y- s( l5 F+ n9 C2 u/ ` *(esp->4+4)=='NTIC'6 D; z2 O: D3 x: j
9 a7 U7 T! p8 a* x
-The most exotic ones (could be very slooooow :-(0 Y P0 N+ A+ O# t
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') + R! D: [ ^8 e2 a" F' y3 U
;will break 3 times :-(
9 W1 J( E# y1 v: @$ b( ]1 D; i4 z0 G- C. l
-or (a bit) faster: . n# j+ d# `7 [+ E% \
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
+ h& I, ^/ p4 ~ m+ P; ^6 Z* S% D# R2 p: N; S
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' , ~; x+ F7 i) Y/ k0 h
;will break 3 times :-(& c7 Q: x) o# o* t8 w0 {
, A% t* A3 A. h9 q
-Much faster:# b- g5 d/ I+ R( G
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
7 j1 H1 X/ `# _7 F- e2 p/ e3 Z: X0 a- C
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen: I& c+ Z8 M. X* ^( O) Z) M
function to do the same job:! Y" m5 h6 \4 u( y9 e- j$ C
4 b ^* e7 Z3 r9 A8 p8 v push 00 ; OF_READ
7 l; |8 W( Y" ^, v0 s mov eax,[00656634] ; '\\.\SICE',0& _% D: I; r: E* p/ L! ]
push eax- t, C ]) Q% s7 Z5 R" T7 ^
call KERNEL32!_lopen
2 c% r6 v4 S$ K& T5 Y# u& F. S inc eax8 t, {2 U/ O) a1 K8 d! x3 l- ^
jnz 00650589 ; detected
: B2 k. _( B4 l; e push 00 ; OF_READ
! ^% ]# D) }% b4 h, ] mov eax,[00656638] ; '\\.\SICE'
, n. m" y5 f! l- |2 U$ N push eax
5 t$ x9 Y/ U( C9 x4 X3 s call KERNEL32!_lopen4 l3 O3 N: o% M$ ^- w
inc eax
$ L( U: p8 s$ X8 M- { n jz 006505ae ; not detected, P' R: c r( T) Z7 L
: |. P d' a$ t7 C" t) ?+ F) M/ q" w. E/ C
__________________________________________________________________________( G: S$ l! Q* y; w, w. N) R
) I/ v1 i, L/ L% Q( H& x6 M
Method 12
' [3 d8 ^7 P2 H8 `, M2 I; C/ O=========
0 ~% }8 ?' `1 i1 a2 x1 u9 v9 I9 T/ Q6 h9 d' a+ W3 @4 d
This trick is similar to int41h/4fh Debugger installation check (code 05
; C% b( D( b- E& 06) but very limited because it's only available for Win95/98 (not NT)# Y8 j5 f# l' S. N$ X2 T
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
4 s* B9 O/ h1 c6 |* b2 d7 u( {2 x% z$ t8 [+ }( E: {6 v
push 0000004fh ; function 4fh4 ]9 y+ d, C7 ]. }
push 002a002ah ; high word specifies which VxD (VWIN32)
7 L% K U8 Q$ S- H9 P$ O ; low word specifies which service$ U- B: `: Q" u( n) @* x
(VWIN32_Int41Dispatch)
5 q: i% j4 Z) }( i call Kernel32!ORD_001 ; VxdCall
7 t& q! D; p* |! c. @ cmp ax, 0f386h ; magic number returned by system debuggers/ B. o+ @2 A1 ]
jz SoftICE_detected
- x1 t- ^, t ^1 x) u* r
9 u" [6 X. C# y# u/ b3 C) N' WHere again, several ways to detect it:
( G$ k2 N: K' A/ W* O; h
) _7 C+ Q2 ]! h0 `" k) k1 k BPINT 41 if ax==4f, \1 t: P* b) O) i F- B
, ?' x" E8 {1 R; L2 p: [
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one0 |6 d3 P2 z7 h! z- {
& f# w$ `$ r2 Y8 M
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A3 ~! p9 m$ L0 U+ R5 A) U$ W+ g5 I
* C# d" |/ ~# O u. Z
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
% `$ A/ ^) t: O/ I& f* P! P2 w+ R( S! a/ d( Y, a) [' ^
__________________________________________________________________________9 |. `6 X8 c. I; |3 ]
, K4 j4 ?% A/ ^( i$ S# | X% _0 J- B
Method 13& Z% J' B6 V9 ]; q# ]; z4 |/ f* d
=========$ f3 q/ n- H& A& `
% _ a2 N$ M; G7 [9 m4 ONot a real method of detection, but a good way to know if SoftICE is7 t4 f& ~( x9 I R0 A
installed on a computer and to locate its installation directory.
% [0 Y, e; s. ?7 VIt is used by few softs which access the following registry keys (usually #2) :# v8 r* d( C" q q" L N' ]7 Y
7 C# c S) T2 A8 P1 ]
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
! u r- I" N7 w- q- N\Uninstall\SoftICE: ~' s; r; t+ E9 k2 \- @! w
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE! u8 n: j0 F+ a0 |, w' n3 p+ I( c
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
: O5 O2 g% ]" z$ {' O\App Paths\Loader32.Exe( v# q) _! l5 H+ X$ D5 Z
" B# i1 n: L6 D8 @. K" Y# I* p: n9 r
# [6 b% a/ T% hNote that some nasty apps could then erase all files from SoftICE directory% w7 X% f0 i k! j9 I3 X9 L
(I faced that once :-(
h3 g4 Q3 ^' A& m
3 Q K1 A4 y3 O8 f! B6 e: q @2 jUseful breakpoint to detect it:
( G. k; v' P+ M6 U2 a4 ~# o# x. T2 S7 a- O
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
* _5 ?; y- K, e, ^7 r
# S- m. E9 h; E* o' }. l__________________________________________________________________________7 l" C9 g6 `0 ^2 `
. b5 P' U7 P% m7 B! d% D! y: D( D" s
Method 14
) [* z7 W4 u0 i( G8 g=========
5 ^/ Y6 {2 e# u9 K
3 G f/ G) j7 O- D. v, ^" WA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose! ?+ R# f! S0 {" p
is to determines whether a debugger is running on your system (ring0 only).
F$ L' j+ M: L( H0 v2 K; C; r4 Y, G$ h+ ]
VMMCall Test_Debug_Installed
i! J' |: [9 y( G* X2 z2 m je not_installed( W& Y& B0 T+ r4 F [; `2 o3 C
4 c, x& a1 O! `/ j. ^
This service just checks a flag.
' K* X4 J5 ]7 l4 {/ V) Q</PRE></TD></TR></TBODY></TABLE> |