<TABLE width=500>3 z+ E* v' ~6 C' `4 C2 _3 L
<TBODY>% [/ Y+ k3 ^6 M. A# v
<TR>8 _ Q6 |. E/ ]
<TD><PRE>Method 01
+ f" L+ f5 e" \8 M. U$ F; x=========3 r3 {6 S% B2 e5 Q
) \2 P; [. w6 o
This method of detection of SoftICE (as well as the following one) is5 q4 p e! Q( }2 E6 E; E/ ~
used by the majority of packers/encryptors found on Internet.
% t9 ]6 k9 S+ x8 Q, V+ c+ r8 ~It seeks the signature of BoundsChecker in SoftICE! Q# A2 ?/ S( Q# u
7 i2 r! l* A0 s X: o
mov ebp, 04243484Bh ; 'BCHK'. m: d; \- D) F8 J
mov ax, 04h) ~) F) ?' K7 D% z# g! t8 j
int 3 - s! B, ?0 w& b2 r
cmp al,43 i5 ]# d2 s$ E
jnz SoftICE_Detected
# T$ V$ |, g3 x! _4 D. X- f4 s% r" k4 Z% I* k; X
___________________________________________________________________________
+ V8 R+ z1 I Q4 p
- _+ ]% A; q6 D% pMethod 02
# m- k- Y$ Q2 G/ w=========
% M) B+ ]3 A; J& q. I# y" D1 \/ D' J! J# c" F
Still a method very much used (perhaps the most frequent one). It is used. H1 x3 h& y2 t& J
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
& }3 ?( Q4 o3 C6 e# L2 P Gor execute SoftICE commands...
* K- |) d9 z+ `+ [% J" PIt is also used to crash SoftICE and to force it to execute any commands+ J7 \/ I: m2 i* \
(HBOOT...) :-(( ) W2 e' G, `3 ?' r
8 y3 {3 h& G; u# {( y4 }8 x$ ^
Here is a quick description:
" u% T: ]+ T- L$ p" l6 A-AX = 0910h (Display string in SIce windows)0 Y8 ?- I P$ l% E
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
8 Y2 Y8 x) A" q3 p8 A# w9 o8 N-AX = 0912h (Get breakpoint infos)
- U9 w r' B( T! v, T-AX = 0913h (Set Sice breakpoints)
* _' `+ f: H2 j! ^3 j-AX = 0914h (Remove SIce breakoints)
6 t! ~- G6 B6 ^; E( q8 w8 G q* a. ?( W B
Each time you'll meet this trick, you'll see:4 I+ }$ S& b+ b( T7 y; I8 x
-SI = 4647h
) T$ M0 ]% h4 g-DI = 4A4Dh. E {+ s/ G7 {7 b% P1 K
Which are the 'magic values' used by SoftIce.
: O9 e, ~! T% Q: G% DFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
6 p) P( x% g: \1 j5 s, l- O& I& A9 ]! T8 e
Here is one example from the file "Haspinst.exe" which is the dongle HASP
) z; r" d4 R# HEnvelope utility use to protect DOS applications:
0 T+ z/ V$ U/ B* n8 F" t6 T
* V$ b P. H2 d* [8 _ R9 G' i) w; l I: G! F% n
4C19:0095 MOV AX,0911 ; execute command./ O3 `, Q+ o$ G( q. q* Z8 a
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
/ e% ?' N/ D! ?! |4C19:009A MOV SI,4647 ; 1st magic value.4 ^3 l: c4 e/ |6 ]
4C19:009D MOV DI,4A4D ; 2nd magic value.
( P* Y7 X- U% p v* k2 g4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)1 G* E3 N6 f" Z% V5 D: m
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute! H3 B" {0 M. _. i5 @; D, p
4C19:00A4 INC CX
, q- e; J# d2 T9 `* _4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
$ x B1 ~0 @, g4C19:00A8 JB 0095 ; 6 different commands.7 p5 i3 _- o' V# O$ T# O/ D
4C19:00AA JMP 0002 ; Bad_Guy jmp back.
) m3 H2 w' J/ b7 c) r1 c( d4C19:00AD MOV BX,SP ; Good_Guy go ahead :)& J% b( }" z8 I2 Y
2 u* F4 t( o' l: v: M5 zThe program will execute 6 different SIce commands located at ds:dx, which
! A, R4 f6 I0 P3 v; Hare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
3 e3 n/ y6 |1 N! r
/ A' C, E( }3 H- h% P6 D0 V* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.4 Z% V1 o; @; ]2 s" A. \8 I2 [
___________________________________________________________________________5 k' l( {4 b, r/ q
0 y# ~- w( t8 d( s! @# j# l
- y. \" ~& f" G- {, B5 v4 U
Method 03* F7 J& t" @: f2 m
=========- d8 T6 V9 [+ S1 D1 t
2 L$ l+ J8 X7 I: uLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h2 \$ Q9 H4 w" q" T) D$ e# G
(API Get entry point)& X! W% Y2 c2 }! V
' R. y, ]# t3 o+ c
0 U# d- u+ j z/ F e: M
xor di,di
1 R% G) S0 b6 }+ G* o! N2 s" }- ? mov es,di$ d! _. `$ T2 A
mov ax, 1684h 9 n% V7 j3 v+ o8 Q, u$ A
mov bx, 0202h ; VxD ID of winice
x! e7 r% x' I5 [ int 2Fh+ V7 W7 N, [, G4 a5 a/ e
mov ax, es ; ES:DI -> VxD API entry point# M0 g- n0 [$ T: Z7 ?2 g% Z
add ax, di
L/ N3 r% `; M w test ax,ax0 e; k. d" b% X1 P4 P
jnz SoftICE_Detected6 J- p4 v1 z: g e) ^
- o. k3 k4 H# b
___________________________________________________________________________0 ~4 k4 U& `' j/ ^! I8 N
& ~' e% ?% M% c2 ~' s) f `
Method 04$ L) s2 ^5 @* A" ? q% P u1 }3 p
=========
% G+ ~8 b" H! Q) O/ i9 v8 j1 S( U- g# R, g' U o3 n
Method identical to the preceding one except that it seeks the ID of SoftICE
( z$ j6 r% ?+ S- m8 M: C+ WGFX VxD.
+ X. Y( H! _+ B! Y, K- |+ S6 u1 E5 x# l# b+ W7 V2 P h
xor di,di
/ {- E4 R" D1 k& m9 g7 \: j% j mov es,di* _6 i x# w! \: [ q9 x4 \5 v
mov ax, 1684h
" b* e! F# [6 T mov bx, 7a5Fh ; VxD ID of SIWVID
% V# f* \2 \4 h5 p0 c- q int 2fh0 Z1 l5 p3 e! m( X
mov ax, es ; ES:DI -> VxD API entry point9 x' v% Q. h; b# i% ]: A
add ax, di
- M$ k1 B9 ^9 R) P. I3 ` test ax,ax
$ E' J6 Z1 o2 r' ? jnz SoftICE_Detected
- w6 a& S% j7 |* ]; c. d0 M3 z0 y2 K8 p: f4 t
__________________________________________________________________________8 y, D0 ~( N" G$ w. v
o2 O8 E- \6 d1 {, p! N
. B$ S5 F, W1 L9 q& A! iMethod 05
9 j1 Z% b J8 ^- [7 h/ c' h7 T5 ^ M! \=========
3 j- j3 t2 _( c0 {* g5 b; L B! x. l9 _
Method seeking the 'magic number' 0F386h returned (in ax) by all system
% ]8 U, K3 Q5 d \ Vdebugger. It calls the int 41h, function 4Fh.6 _7 k' B9 A4 n5 i, a7 _' J2 v
There are several alternatives. ' S3 E8 X- x9 d! U' n g0 z
1 f0 V* I7 Y- x) ^
The following one is the simplest:0 s9 Q5 K4 B3 P+ I/ R8 @3 M; X
@. d b; \. W: f( A0 I6 X mov ax,4fh0 v% A% l, k& _' h, r/ |( f- d
int 41h
7 \+ z$ G* i2 k* ]3 }7 K" U cmp ax, 0F386
0 C, |: O# b! Q- v# R- L jz SoftICE_detected9 ^, g. `7 u8 m. e# i
; l# {/ U3 S5 w1 G/ e! x5 ?$ m% ` M/ Z; q
Next method as well as the following one are 2 examples from Stone's
) b3 n. Y* S1 @4 c# X3 }"stn-wid.zip" (www.cracking.net):. M$ F2 G- `/ F, I& d
9 Q- f: |, d: F( U1 t* T mov bx, cs
& r( g- v5 M! b lea dx, int41handler2
M7 c% }8 J8 ]$ U, ?. P/ d1 r; n xchg dx, es:[41h*4]
/ Q$ C8 v0 H, f- V xchg bx, es:[41h*4+2]! e4 V0 Z7 v' K: L4 v' _0 f
mov ax,4fh o: L( r3 o+ Q; T5 i7 [7 d
int 41h
# B) }; x W! j' } xchg dx, es:[41h*4]
: t, J& w7 e9 i: I- y$ Z xchg bx, es:[41h*4+2]
' {. @) d! {+ ^- W" l$ k" j cmp ax, 0f386h
8 ]* q- H8 q8 M' q; Q jz SoftICE_detected
* Z4 r4 b* X, @% q/ d. K: x, O. z2 W5 x0 e) \% M. w
int41handler2 PROC
4 ?7 {: p3 o- ]' H8 _ f iret
O( H/ u6 r) i4 W, C* ?6 o" Eint41handler2 ENDP
( }. _5 m" n6 F" u& S2 a! q9 Y: z$ m$ A: p; {0 W
+ p: ]$ v* _; [. y7 Y4 C! \, \8 |
_________________________________________________________________________! G/ ^5 F# b9 P' L5 m
- X8 \$ C2 {# B; J! U( Q: \6 c
3 A* d( ?- b( u- RMethod 06
) w ~/ i9 U {9 u=========* {9 i0 i, i3 p$ G
/ L4 n, R% n3 ]5 w, V- Q
$ l: Z. E; N- Q. o4 C: w2nd method similar to the preceding one but more difficult to detect:
5 P y2 `; ?7 Y9 V& {" t# l2 L, s T' t& G9 u0 u! v
' k( w8 N6 g3 ]" C
int41handler PROC" A: i2 H. N6 U& }5 t* j- I% {8 x
mov cl,al
8 d8 I- t G6 Q iret# k2 s8 y* P; P& D$ O; W
int41handler ENDP
: k5 |/ v3 H# P+ d# J- h! e ~$ {7 e) `' \- |5 x+ x. j
3 M4 f6 I q4 X1 p! a% n& ~ xor ax,ax
; r# ^: m& D, @- C7 S+ M3 u% k$ ] mov es,ax/ Q [2 @* W, [( Z) k! A
mov bx, cs
- O( _; v6 g( V lea dx, int41handler& | g' a: ]5 U0 }( S
xchg dx, es:[41h*4]
* m5 ?& N2 ]- o7 W xchg bx, es:[41h*4+2]9 ]* R# n6 X2 C4 t
in al, 40h
; Y2 T5 Q& u$ i/ f xor cx,cx! _8 Y. W9 c/ _9 V9 q8 T3 w+ n( w& t
int 41h8 \4 p" M3 k: z
xchg dx, es:[41h*4]5 c5 Z- Y) ~9 s/ s5 Y3 s
xchg bx, es:[41h*4+2]
6 c B, X. @% v& N% U cmp cl,al
. z" h; n2 V l& Y4 N jnz SoftICE_detected
6 W9 f/ V: @4 R$ Q. P5 A* Y# x+ Y d- V: f" Q' Z
_________________________________________________________________________
" P+ S# J7 d% ~* @8 }! c+ D+ e# p! L' x' b
Method 07
) T L D0 i. O6 B=========3 G/ N& U9 T, X- V0 c3 a) z
! |5 b7 x1 t4 [2 L1 B( Y
Method of detection of the WinICE handler in the int68h (V86)
" |' [2 C- U" K1 D: R. l' M
d5 I6 F( p; b6 D1 z2 X- e mov ah,43h2 r' W( F7 u! \3 a8 e
int 68h
, C3 `0 e( {1 j/ l' J* |9 j1 i% X* Z cmp ax,0F386h; M G. w6 N& r% H3 _8 g
jz SoftICE_Detected
) b% j8 U( @. ~) R- p; }# J: w7 a
[8 | J5 N" s* l
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
7 b" Z/ \$ C( p: ?* D- k, Y5 u) o# z/ H app like this:( y3 {7 |3 @0 @" Z" l
' E/ S7 ^; o3 r1 k0 x7 c
BPX exec_int if ax==68
2 g- ~5 P$ [4 z; |9 S (function called is located at byte ptr [ebp+1Dh] and client eip is% A/ v* [ j6 g
located at [ebp+48h] for 32Bit apps)# m0 E( ^" ~( ?1 x6 b6 Z
__________________________________________________________________________3 }6 R$ d: R) E/ ~5 N& c
( u1 |( V5 V' q3 w$ s0 B+ F3 {1 j0 V5 ?. H8 N' e4 i! K; i# k
Method 086 Z7 h9 Z! Q* Y8 V, Y
=========
' `( {6 ?' L" `, ~7 p
" V1 h5 w! i' ]5 WIt is not a method of detection of SoftICE but a possibility to crash the
2 x9 V; }5 _$ osystem by intercepting int 01h and int 03h and redirecting them to another0 r9 V* b9 G/ Q D/ W$ w/ P+ V+ g
routine.
3 d' t7 k% ?# [& p* a' jIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
" q: P: o0 @+ i% o# Bto the new routine to execute (hangs computer...)
7 ]+ T) `! D: s2 c- _- | L2 I: @, ^5 d+ Q
mov ah, 25h$ I$ l- y D$ F% |
mov al, Int_Number (01h or 03h)
8 ^1 [$ v- v, @ mov dx, offset New_Int_Routine; d r/ a$ z# {( q M! d
int 21h4 ~+ T1 ?, o: z- E y0 D! q$ ?
4 V9 ~3 r- u- B0 I# K% f6 k5 w: C/ M
__________________________________________________________________________5 J9 B7 V, L) t& V+ ^
8 Q# {" ]* T0 f. Z7 Y% \ w; tMethod 09- L: ^" O9 x- E0 v. y8 a
=========3 i o6 e7 o1 z0 F& v: t" D& W
, f) r! f# l, r% {4 pThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only9 J' d( K3 \! ?8 e: U% x
performed in ring0 (VxD or a ring3 app using the VxdCall).% `, ~5 [2 r- b
The Get_DDB service is used to determine whether or not a VxD is installed
/ v! w" ~$ `" J( M$ ifor the specified device and returns a Device Description Block (in ecx) for
3 d, h; k# ^# Q c0 s @0 I- Hthat device if it is installed. p) G+ i+ y5 e, g: W
# \* W/ T* x1 M! ^. a
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
! e, C' ]& ~9 ]7 ^; q7 P) @ mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)9 O' c# W% |- a, P7 U! Q p' Y, n
VMMCall Get_DDB
7 A/ e6 S5 W+ [5 p) f3 s mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
5 z3 Z2 _ q- B1 k5 |& c1 O. \, }/ z [! M$ {% A
Note as well that you can easily detect this method with SoftICE:9 u3 U; B, \" U" T; i
bpx Get_DDB if ax==0202 || ax==7a5fh
, R3 l& H% @) H- V" g* I# J, i. \4 v2 J' M9 L7 y4 u8 w
__________________________________________________________________________1 g) i" W4 ~' s9 I) u
7 s+ ?; H& r/ D# ~4 z4 i: f+ ~+ e% tMethod 10
% T# B2 t3 \' O: s=========5 e( z3 I: p' Q9 i Z
7 c( t8 c9 F/ u% |7 A; G
=>Disable or clear breakpoints before using this feature. DO NOT trace with% N4 p# G# E, \8 N# a
SoftICE while the option is enable!!
( T$ ?9 ?2 w1 z/ g8 ^+ x! [3 |+ P% H
This trick is very efficient:( i G+ v/ ?/ {: @8 j7 M2 T
by checking the Debug Registers, you can detect if SoftICE is loaded
" {: Y6 S0 ^/ W' U' F) m5 T6 r* J(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
: d3 d5 z$ I+ C) u' Q# I, O; pthere are some memory breakpoints set (dr0 to dr3) simply by reading their+ e( U0 D, s1 O% E! ]: R4 x. ~
value (in ring0 only). Values can be manipulated and or changed as well" `3 V* x" G; ~- W" E7 O
(clearing BPMs for instance)+ u7 @' S4 G. }1 x q" N
; }$ F2 I3 x! a# e* I$ |
__________________________________________________________________________) b+ A- V4 L: k' ^# @# Z; B; F
/ Y W0 D2 K% u7 t
Method 11
/ z. _, O1 C I/ p$ m6 v=========( U5 b2 L# O. s" N& G; s1 _
* v- r& @" J5 T5 N$ Z6 d: s5 tThis method is most known as 'MeltICE' because it has been freely distributed
4 ^; k. p2 o( |. |! `8 Pvia www.winfiles.com. However it was first used by NuMega people to allow9 t2 m# i; z8 B' d8 D. G
Symbol Loader to check if SoftICE was active or not (the code is located5 ^ F! ~6 `4 y5 ^( f7 p" T/ X" R
inside nmtrans.dll).
$ G K* e7 b, I7 I9 ?/ E
8 E) R; a; G5 r2 l/ \) uThe way it works is very simple:
, f/ u1 c, c: L* l- m/ Q- E7 v0 YIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
! l) H6 C( Q* ~WinNT) with the CreateFileA API.
' d! @; q6 | x
' ?: {9 e* _- m# P7 h. x& |Here is a sample (checking for 'SICE'):
, c% m7 g9 V1 K
# s. x/ J d; n, a; @1 ZBOOL IsSoftIce95Loaded()
" G) [* g, v' v+ D* y: D a- F7 U{: w# t& R/ |1 @5 A; ]5 Z* `
HANDLE hFile; 9 R6 w9 T$ ~! Z8 ~5 v% A/ ]
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,% E8 h- O. f# _8 {; v
FILE_SHARE_READ | FILE_SHARE_WRITE,- H; ?$ m8 t0 m5 K( a' F% W
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);& e' g1 E* |2 N- C
if( hFile != INVALID_HANDLE_VALUE )
% r! [, g* \, S1 W( ~/ z& Z" n3 S {- ^; w$ I( p! J' d# ^: M
CloseHandle(hFile); z9 k9 ~, V$ z* T0 }# P1 X0 h
return TRUE;2 K/ u: u, h) f
}
5 P- G# T5 M( L* g return FALSE;
1 B# b0 b# X5 |6 o; A}# X. ~: p3 E2 l
0 k/ s# l+ l( PAlthough this trick calls the CreateFileA function, don't even expect to be% Q5 z6 f4 ?+ i' u% G3 C
able to intercept it by installing a IFS hook: it will not work, no way!9 N" e: C3 t: D. q' ~
In fact, after the call to CreateFileA it will get through VWIN32 0x001F" o& `8 I- ?0 F' R5 a) x, k
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
2 t# }0 g8 t" @# s) O Qand then browse the DDB list until it find the VxD and its DDB_Control_Proc' ^& b0 E5 N$ L' Q# U
field.' R6 W F& o u" c: }0 Z
In fact, its purpose is not to load/unload VxDs but only to send a 3 }$ d( W3 Z. {2 z5 j
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)/ ?2 J( P) p' @% ~
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
! {/ L, r# s" \6 Y# G/ dto load/unload a non-dynamically loadable driver such as SoftICE ;-).
0 T6 n6 Y" x% y! Z/ ]" BIf the VxD is loaded, it will always clear eax and the Carry flag to allow
2 T, I$ T! k3 ~its handle to be opened and then, will be detected.
& b# V" ~4 H7 m. n6 e) l, sYou can check that simply by hooking Winice.exe control proc entry point
9 y) h) M9 q2 \0 l3 w& t) H' vwhile running MeltICE.
( e6 j2 H$ R2 y: s1 g, K- r2 K0 ]/ {2 A
2 i+ V: W0 s8 c8 T" G
00401067: push 00402025 ; \\.\SICE
; T5 P% W2 ~ t& W) O$ q6 f 0040106C: call CreateFileA
! m. F; ~& P1 p2 l7 K& h' c 00401071: cmp eax,-001* N* B9 J5 x$ {1 `
00401074: je 00401091) T& X' S& k/ Y$ `. P4 E P9 x9 s0 \
+ C& Q ]0 [: [: A; E& \
. p, @% v3 C4 [, w; Q$ J% o( HThere could be hundreds of BPX you could use to detect this trick.
2 n/ | Y. p1 E( B8 ~-The most classical one is:7 {7 ~% S6 c8 q: m) S
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||. @- x- f6 Z4 b5 `* z2 M+ y
*(esp->4+4)=='NTIC'! M4 D+ t1 N2 u, A
8 a E3 N& O3 _- i
-The most exotic ones (could be very slooooow :-(
* z. t2 |, y/ G* L( J: C1 a2 [ D BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
# B+ M5 x( J/ X. j4 V ;will break 3 times :-(
5 e( \4 X) k, t& c. c4 u) `$ c, }
5 O2 I) q# _" V-or (a bit) faster:
% j$ t/ P+ W7 i8 Y6 m& P BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
; K; U6 o9 D' E: a% K* v$ k( ?( d- J# y) f
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' 5 E: ?& l j7 n& x
;will break 3 times :-(1 _' V9 b7 l, W% u
7 K2 O4 a! \( v3 U4 K6 r" i
-Much faster:
- i( F( m: n1 _ BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
- X9 I+ ?. G/ Q% b6 x
/ Z# P+ k- r2 _. ?1 cNote also that some programs (like AZPR3.00) use de old 16-bit _lopen9 {* H! X/ x' Q7 |5 ]
function to do the same job:
# \0 ?# u8 D& T' D$ L# Q6 w
$ e5 Y, S6 M; V) K8 U( I. } push 00 ; OF_READ
( O/ w7 b6 }" U mov eax,[00656634] ; '\\.\SICE',0
; n: I* I M! r# h9 d0 J push eax
' u1 r' U. B8 R' c W- Z/ O% v call KERNEL32!_lopen- Q1 |% d4 u; X( O5 l$ w
inc eax2 D) v$ j3 T7 F" }, z7 u8 ~" F
jnz 00650589 ; detected. N) E" J; j9 v
push 00 ; OF_READ
( b1 {$ w3 g9 Y! V5 S" h- O mov eax,[00656638] ; '\\.\SICE'
9 ^8 R5 |" F: a1 O5 M9 d7 J push eax
& P" o$ H! G. d; } call KERNEL32!_lopen! q4 L4 e5 T+ f, w2 C
inc eax
& I! X, H! Y: z2 R jz 006505ae ; not detected$ z. M( E1 F. @' _3 S0 ?
1 Y5 }4 Y n! M4 L$ ?
7 M1 Y$ k& U. z! _# D4 J6 Z
__________________________________________________________________________
6 X6 n" d+ [' M# r* h- I
A& l1 b1 q* V2 [; V2 n' b9 [7 eMethod 12
, n; T1 k5 J7 ~$ k8 Z=========* ?9 @6 F3 a! F% M/ d9 l2 v0 W
8 Y+ k. h& D9 b5 I/ w1 X# cThis trick is similar to int41h/4fh Debugger installation check (code 05
, W3 o5 A1 ?/ E& 06) but very limited because it's only available for Win95/98 (not NT); V5 _; e8 t& u3 U. Z1 X6 {2 B
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.2 f9 F# m7 ?( O) ^; j5 N U
) ?' `* U: w" w6 @ push 0000004fh ; function 4fh
; ~4 h' I1 p0 G" O8 G+ x push 002a002ah ; high word specifies which VxD (VWIN32)
/ w# Y* x% V4 R( l ; low word specifies which service
R- ^0 j4 Q: |) ? (VWIN32_Int41Dispatch)1 ~, _6 o4 E; I/ p: s9 D, H F U
call Kernel32!ORD_001 ; VxdCall+ Z5 {4 p5 b" X$ q1 r7 w5 y+ b
cmp ax, 0f386h ; magic number returned by system debuggers6 N1 _7 N0 B+ C! Y: j8 h& Y' d* Y2 [
jz SoftICE_detected
. M# b2 ^+ E/ l1 q8 x$ A4 l0 `9 F) Q) q; J# e# ^4 K' K
Here again, several ways to detect it:4 Z& K4 @) A8 h0 n& y* B: \( p
% T3 ~# O+ H7 A- m# s1 t4 Y BPINT 41 if ax==4f; c7 }. W/ t/ c/ i
/ l' {7 u3 m) u1 ?' O+ w, [! a BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one9 f1 L" A4 U4 i
4 X: q4 R6 C$ b; X' b BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A. z& o# ?, s; s" d6 ^( y5 ~
8 N. x( |* _ N, s) d) W6 Q BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
4 K: V6 d+ @7 S3 z2 a8 R4 ^6 g1 v3 \9 n o
__________________________________________________________________________& M$ u9 Q2 r- \0 {8 q0 e0 s B
' }1 O6 l! E% V5 w: a' eMethod 13
2 c1 u7 l# g9 v5 x0 c0 ?=========; Q9 O2 I5 d3 y+ j. k
2 d2 I9 M W) d% _$ _/ fNot a real method of detection, but a good way to know if SoftICE is/ c! K: w- X; S5 J0 s
installed on a computer and to locate its installation directory.; R V* d2 m: ~3 z9 E2 ?
It is used by few softs which access the following registry keys (usually #2) :
7 F" C4 O% ?, ?1 T
7 \' s" y- i1 @-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion9 |7 ~3 H j" N e. C* ?) g+ I
\Uninstall\SoftICE2 [, C7 ~. ?* f0 Y" f+ T
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
. Y* `4 a# r; R! V- \- m9 s. q! o-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
( @9 _5 g, n4 V5 v k7 B9 ^% n% e\App Paths\Loader32.Exe
& m6 e) K0 q$ ^. E' O/ x- V3 U5 c( M+ R u1 ~, m
8 p/ C% k+ L& x( e2 m; \/ iNote that some nasty apps could then erase all files from SoftICE directory
: J: N; y0 P1 E. M! s# f/ F! `; j(I faced that once :-() x9 v- c' ~# v, M" x
$ {* N- v* m. m" R. r& \Useful breakpoint to detect it:
% |. z) d' \/ l3 \9 ^% w2 V% X
H1 |( S4 w, n# o' ]) d4 B; r BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
0 l! v9 b' q$ A/ |! h! B3 h: q, v1 \2 j' _
__________________________________________________________________________5 {: ?" c# S; n( Y
/ j+ a/ g. ^% t" g8 ]$ C
: o8 U8 u9 D6 |0 f) z, m9 P+ H) d0 pMethod 14
0 F7 m* E7 y p5 |4 Y' W) X" z9 p8 A=========
' V( ]" D E+ Q4 l c3 t; z& U4 N" X
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose8 Z; b& I5 a2 E8 b' B
is to determines whether a debugger is running on your system (ring0 only).
' q; w, `! c* D9 O6 ?+ H
; i# h+ S# c& V VMMCall Test_Debug_Installed6 L9 M8 |$ C% t2 K& z- E b/ j
je not_installed) }; A" x$ K4 m
- S( S( c5 R0 {1 b- ^0 O
This service just checks a flag.
9 ~+ r" {- ~ q6 C& X</PRE></TD></TR></TBODY></TABLE> |