<TABLE width=500>
% n! A: Z4 D+ v- }/ L+ w: l<TBODY>2 F- o) w! n* }& f" e! I
<TR>
* C* G2 u: d4 U6 H<TD><PRE>Method 01 % w7 B7 \' p/ t
=========
8 D+ E3 [. Z% T4 _! j. U: `5 u$ G! p" f3 D1 Z' a! S
This method of detection of SoftICE (as well as the following one) is
# D( x' {7 q! Qused by the majority of packers/encryptors found on Internet.
4 d* t2 u! D) @# f( YIt seeks the signature of BoundsChecker in SoftICE
3 _, u9 A+ S5 X$ ~9 q) l& ~. K n# O: f; R# c
mov ebp, 04243484Bh ; 'BCHK'
j2 ?6 O) ]0 {' v mov ax, 04h
! q( o( z j- G' Z5 z int 3
. x) p: \$ i% G1 I) P" Q% \ cmp al,4
. Q0 y% ?7 x4 ~% j% W4 ?, r3 L8 c5 G9 c jnz SoftICE_Detected6 S; k# b6 ^( P! |
8 W0 J: R5 y7 J, e
___________________________________________________________________________
4 J( z' {& A$ b, h: \9 I5 O: Y" F
Method 02: O# n7 V7 M3 x/ c' F( U
=========
0 W- X f0 B: D$ C1 }- B, g0 | H9 U' h) w# `' Y# c" [
Still a method very much used (perhaps the most frequent one). It is used
) [0 ~/ A& k/ k! Eto get SoftICE 'Back Door commands' which gives infos on Breakpoints,, Y% N1 R3 ]6 E& h0 N0 E ~
or execute SoftICE commands...
7 `; ^( z' V! ZIt is also used to crash SoftICE and to force it to execute any commands$ A5 b! d1 g, s" g+ g% h
(HBOOT...) :-((
) j# `. Z! e5 l$ H5 S' c K( k' k4 J( q: \
Here is a quick description:6 V& _+ ^5 C$ g* u6 R2 x
-AX = 0910h (Display string in SIce windows)+ w4 S" i& X* ]$ ^
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
9 B( }7 W9 H: _+ s- g" X8 n-AX = 0912h (Get breakpoint infos)
3 x2 ^0 F& J0 t5 }) W; _' R-AX = 0913h (Set Sice breakpoints)
( w7 X0 y4 K6 K: p-AX = 0914h (Remove SIce breakoints)
* ]$ M" E1 ~; c# u |! A7 ?
- j/ s( T! d1 A* l7 V/ |Each time you'll meet this trick, you'll see:
0 p2 Y: o+ A0 i# e+ h! w9 I1 x/ z-SI = 4647h) E# ]7 m6 M: T7 u+ V/ I
-DI = 4A4Dh
6 G( @# w- v/ G; x7 B* a) U" B- LWhich are the 'magic values' used by SoftIce.
4 ^( o$ G1 G( UFor more informations, see "Ralf Brown Interrupt list" chapter int 03h./ T5 A5 @4 v4 C9 `+ E
* x. J3 T, w( j; [ t. `
Here is one example from the file "Haspinst.exe" which is the dongle HASP
1 S& W9 u0 @+ ?' a) JEnvelope utility use to protect DOS applications:
& @' ]7 ]; _& J, Q
: Z& W& J' a! S# E( Q. ^0 o0 Z( \# G. D3 ~/ A
4C19:0095 MOV AX,0911 ; execute command.
, K# y' W5 f ?$ a0 m9 x; K4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
" s. L5 f1 c+ [0 T" z9 Y4C19:009A MOV SI,4647 ; 1st magic value.
! @, H! g6 |! G4C19:009D MOV DI,4A4D ; 2nd magic value.5 b( o% i% [" K/ f( k( q* b1 a
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)/ Y; w! E0 n9 r6 p
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
% H" C: R- S2 ]" J4C19:00A4 INC CX( j' X5 D& W5 F! V
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute9 g& x2 E8 ^- ]- S3 P: Z
4C19:00A8 JB 0095 ; 6 different commands.
# C+ e. l% I. Q- n. K& S4C19:00AA JMP 0002 ; Bad_Guy jmp back.& A- F# j* R) v* i0 C0 T
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)) Q3 Q: |. E5 j: a- c7 ^8 s) @
. Q* z0 \+ U9 z3 ?The program will execute 6 different SIce commands located at ds:dx, which/ M, }2 Q5 s" `" ?& D
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
& F0 o" V( w( U, ?" F! \: X7 v! V+ B% j g4 ?
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
- ^" Z$ _* S: w, W' J% Q___________________________________________________________________________
4 D+ j; j3 z4 K4 K3 G' N# |4 S" v2 v5 j. E0 \
( x4 m4 z8 t0 C, m; ~$ O" u# BMethod 03
8 m- `" {0 _; d, d d0 }9 _9 s=========
) R e, o) C- s( k% E1 ]. K& ^; y, {
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
5 ?( p2 `+ {, @(API Get entry point)
$ e: o% z* z" L" m, _5 U 6 R; L6 r4 B3 K/ i% f, ]- N
: T2 p0 j. R: x3 R3 e+ a
xor di,di
& j7 `2 ?; d4 A5 C# o mov es,di R5 }# X' C" a) E) I- d" Q1 J
mov ax, 1684h
" ^ F2 @: v$ |, }7 Y mov bx, 0202h ; VxD ID of winice
6 G, M8 Z1 H o8 ]: a# D5 b/ k. ~ int 2Fh
' v8 b0 U& D2 Z' `# l mov ax, es ; ES:DI -> VxD API entry point
' g4 |& k0 e/ X+ Q6 v! O5 K0 A/ t add ax, di* i. f7 x, F% e- M/ o
test ax,ax0 k4 r# S$ q% U P1 `) q
jnz SoftICE_Detected
" I; r n7 p1 r4 E, M: Q" s0 I2 {
___________________________________________________________________________
7 c. d. d" c b, ]6 { b
$ m _4 R1 D( s9 pMethod 04& ]9 g' Y8 U5 J9 x
=========
- U! Z- `' T' L0 T- F2 p3 |
, \- P- X% X2 Q: @ l( N3 t; WMethod identical to the preceding one except that it seeks the ID of SoftICE
9 u. q! R. c* s; BGFX VxD.+ a* @/ L$ i- ~7 P3 l% F
. a- Y5 \( m7 W6 t5 K/ R
xor di,di. b6 h5 }; H0 n. B2 t& x, d$ f Z. K
mov es,di- b7 Z5 Z5 L( J. A! ?
mov ax, 1684h . Q: \6 E b+ K: R* l/ p7 `3 T
mov bx, 7a5Fh ; VxD ID of SIWVID
4 {9 h S% R0 Z4 _( L8 K4 m int 2fh
0 z( |9 I# v, a! `/ n mov ax, es ; ES:DI -> VxD API entry point
3 q# j2 ?5 o5 l( N0 @( c add ax, di& b% u& [# F3 h4 \$ D: Y
test ax,ax6 g) M) x% Z2 B: [# p
jnz SoftICE_Detected
! |: @3 u$ v/ g+ h/ ` q) ]0 C: q" o) `1 _) d
__________________________________________________________________________
+ X1 f b% @7 b2 {$ _0 x9 w, B3 c$ ^0 ~" h5 G2 q
8 U! u2 ]0 H6 ~7 ]: g, B$ P5 qMethod 05) _) `5 C e' ?! F- h- ~
=========
/ t: k+ {* v5 x) J% N3 R. A
9 X' `( g. w, B T' V) y+ n( KMethod seeking the 'magic number' 0F386h returned (in ax) by all system1 y$ Q& A W/ w) L2 w3 T. ^
debugger. It calls the int 41h, function 4Fh.
% h# z/ m( D3 `There are several alternatives.
! e& R( }, s- L: A5 N$ ]3 A- x# H- T/ A- b6 x
The following one is the simplest:4 {8 O5 R/ _ @& U* @
( b) i# p% B- Z
mov ax,4fh
W( r5 i% w# s int 41h/ ]1 e! u, G3 z: q1 ~
cmp ax, 0F386
/ T& x0 ~ X/ @+ g& p2 o6 e jz SoftICE_detected# W& t8 U% A* i- U+ o9 b
7 D% E6 d2 g, ~# @3 a5 H. c; K% ~3 \8 v$ w/ O; i7 H% R
Next method as well as the following one are 2 examples from Stone's ) k. D+ Q3 Y( |; l
"stn-wid.zip" (www.cracking.net):
7 B- [/ P2 Y" N# k X
" h: v `- z+ d mov bx, cs
4 |% e Z" l, W, Z6 E lea dx, int41handler2
- ]* F t" a/ K- e- J f xchg dx, es:[41h*4]" c3 V+ T8 w s! H2 p* p
xchg bx, es:[41h*4+2]
& J: `( a, `4 V' t# q, Q6 ?: _ mov ax,4fh+ d- H9 v9 P7 N& q
int 41h& ^( z1 u' J2 c5 R7 U. r
xchg dx, es:[41h*4]
; X( r% }/ O7 I( T0 ~" L xchg bx, es:[41h*4+2]0 g( {' ], [# t" n6 \
cmp ax, 0f386h
_) O) I/ m: h( }, y/ W3 K jz SoftICE_detected' i$ J/ \1 [- l' t9 s5 q) A
1 ~' H- c0 b+ d' E2 kint41handler2 PROC
, B2 X3 _, ]# z% |% f- e iret# i( b; I( N1 z1 U
int41handler2 ENDP
7 ?8 _1 P2 f5 z' M# y
# G! l& D9 z* D1 O7 s0 U5 G
1 r& r) k& B! }$ Y$ V# S_________________________________________________________________________! H3 |/ x0 \2 |/ Q
! z; @! [9 B3 S$ n. k* \! O0 D0 J6 c2 e! T
Method 06
9 S/ s h( B; j=========
, c* U; G. L# U0 \8 e( t
4 X% v4 q7 _' ~ l2 @8 y1 j; N' t1 {6 n4 N
2nd method similar to the preceding one but more difficult to detect:5 x: ]( e' e9 c+ Y% f
# {4 |& j" O0 ?% v. w6 p, ~
' w$ e5 K9 N b4 W) l3 x9 s0 _5 fint41handler PROC
7 M- u0 N" ]( ]" S. v2 g8 r! Y mov cl,al; X: U' q! ?5 M4 H. u) ?5 {
iret
1 ^0 C0 {4 N. N) q4 Q6 Z/ I3 H( Iint41handler ENDP
, ^/ b9 O2 }- K- s3 e7 U* C% O& s# v9 l4 s$ ?6 o
1 E) c* a5 h0 F4 h5 x$ Y7 c
xor ax,ax
$ X( q# O4 m5 |# h- u- g" }% |3 I mov es,ax% O' V# c. j2 t$ n; R
mov bx, cs4 L( y( o1 w8 S3 l' l# {! s
lea dx, int41handler
$ }8 E5 f0 N, V# r xchg dx, es:[41h*4]7 ?1 s( y3 U! M' C" I- g- M
xchg bx, es:[41h*4+2]
6 u7 q4 ?3 { q T' p in al, 40h+ M1 ?+ u9 j. G2 B* E, x# b) a# H8 {
xor cx,cx
9 [) Y$ A8 B$ ?/ q& I& Q int 41h
$ t9 c+ V$ @9 S' Y8 f9 m- l xchg dx, es:[41h*4]
" k0 z, M2 ~; x; _ i xchg bx, es:[41h*4+2]
+ s1 q: m1 H% O& v cmp cl,al
! M6 }6 b1 ^4 S3 P/ d* W. g$ D jnz SoftICE_detected
( a7 U$ j/ X6 u3 O% m! }9 t- a" u. X* V& q" x- I$ B' F8 A
_________________________________________________________________________
6 i) W& S* q$ [; I9 \' V0 x5 d
. m U$ T" z+ g; z" y5 ] PMethod 07
8 L3 H$ ]* X) y. _+ S6 m$ w=========
& ]& F# ^& K" x5 u" D7 O* b3 q2 d5 E# e
, o8 f: O1 c$ a9 s/ wMethod of detection of the WinICE handler in the int68h (V86)! n8 X& s* u# ?! c- k
3 K+ T6 U1 Q/ |* a: m$ z
mov ah,43h, U0 K* B5 Y+ g/ W
int 68h
, I. D1 J& ~0 l( y! u( v( } cmp ax,0F386h
6 X& r! q1 x' k5 M7 P3 D jz SoftICE_Detected T- S. J- k' U8 D7 Q
6 @* n7 K6 B5 \# d; p
) Z7 h" E* H+ s4 j2 O
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
1 u" }; F. a: O: s; |, M- D! t app like this:$ P+ g7 Q V) _: D- _2 A
3 e) v1 F% [7 d4 U$ n2 z* n* t BPX exec_int if ax==68
- F( _# c0 c& P( t- r( q3 o (function called is located at byte ptr [ebp+1Dh] and client eip is! \. x0 p/ a; c9 K; e* z: L) D
located at [ebp+48h] for 32Bit apps)
9 i+ W; Q- a8 {/ e* j3 g* r__________________________________________________________________________9 A9 ?/ {+ M3 `7 T) y- g3 Z
( x+ d0 P/ R g/ i, g2 N: S3 G7 I
$ F6 A: O! k: M& N' ^1 aMethod 08
2 x& Q# t" O+ S! a: i=========
$ ^& b+ N+ J/ H
( r2 K- ~% o" H9 eIt is not a method of detection of SoftICE but a possibility to crash the
9 J2 r- k2 ^; f* m( y& Dsystem by intercepting int 01h and int 03h and redirecting them to another
2 X% A- t& Z/ D% M# Q: eroutine.3 G0 I) s' g( M6 |: r1 P: t
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
% @' F7 H1 O- ^4 I( ito the new routine to execute (hangs computer...)
9 n2 A! w J3 W
( \ z! [2 s) l8 W7 [* ]4 { mov ah, 25h @# Q+ N' d6 j2 R3 A
mov al, Int_Number (01h or 03h)# `2 ^$ w# P9 T5 @! @
mov dx, offset New_Int_Routine
: m2 R1 r4 S$ l {7 n0 V- W& H int 21h
) Y4 c$ w( S2 `3 r. m+ g* I5 A! Q" l9 ]1 w7 ^
__________________________________________________________________________
9 |0 P- Z# u6 G$ `
& v+ o8 ?; G4 TMethod 09
& \" d1 o& }- v# x) _=========1 E3 X8 [% P2 k3 S
+ R0 `0 I' J% H
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
7 G+ B/ N: ~' O3 n! pperformed in ring0 (VxD or a ring3 app using the VxdCall).0 d+ b* o" C) X8 m/ G# t
The Get_DDB service is used to determine whether or not a VxD is installed) y' J0 o: c* T' C
for the specified device and returns a Device Description Block (in ecx) for) e7 j/ |! B+ |1 L9 q v# G4 l, l4 }& V/ c
that device if it is installed.4 {& k3 i( j8 y2 ^- P" C
9 G& J: x/ F! z5 ?% n% J
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID* x, I: Y; y, D+ n" j
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
2 G1 B. |) V7 y& k* p% n VMMCall Get_DDB
$ d5 z4 C; V8 u# z% Z' R. q: ] mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
7 ?- G6 {- n$ Z4 R0 ^
* M- Q/ e& X) q( f. [Note as well that you can easily detect this method with SoftICE:9 `+ ~/ H" @) U- m
bpx Get_DDB if ax==0202 || ax==7a5fh4 Z% Q4 R4 n) \
) v1 N! I: G2 c& F( T__________________________________________________________________________' t2 J" ~$ L! j& `1 z# K4 Y
* k; R/ E. ? q5 @# \& }/ tMethod 10
2 g" m6 P) X- T1 R: c; O, k=========
@9 O* ?$ f6 O$ u3 H2 N% B
/ _& V# i3 y1 d7 \1 t$ ^3 r3 K=>Disable or clear breakpoints before using this feature. DO NOT trace with r' C7 b ?; x+ t% w( A: P
SoftICE while the option is enable!!
- a! Y! B( [; s' O
# G7 G% k: K' }) HThis trick is very efficient:9 {# L1 u- C$ J4 f! p* r8 B
by checking the Debug Registers, you can detect if SoftICE is loaded0 m7 A& w8 |* [' m
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
. B( Z2 H! x$ O V; tthere are some memory breakpoints set (dr0 to dr3) simply by reading their6 d X% \+ _! |$ a! J2 K% L; v( A
value (in ring0 only). Values can be manipulated and or changed as well
( E0 O1 V3 b! P4 w% l' z: A(clearing BPMs for instance)
; T+ L/ r7 A" C1 |1 U7 b& R' v5 X4 a; R" o
__________________________________________________________________________
9 A, G/ g7 Q# n' T9 W9 D7 C R# c& e
Method 11. F) \( W- s! x" B8 z
=========
4 q" K0 _3 F) N* C; f9 {4 H9 m K
y3 M$ f* s' d% l0 K# tThis method is most known as 'MeltICE' because it has been freely distributed$ T% A4 J1 A, E3 P4 @- \
via www.winfiles.com. However it was first used by NuMega people to allow
; z. H- i- W8 f1 USymbol Loader to check if SoftICE was active or not (the code is located
' J/ t/ r& Q' G3 Rinside nmtrans.dll).
8 S6 I0 k+ a. \$ u% H2 `1 B
+ x# ~4 m9 [ A9 yThe way it works is very simple:
' F; I4 V8 J2 {0 [3 A+ OIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for* }8 m# O/ I6 ^9 x c: D
WinNT) with the CreateFileA API.# e& ]7 }( f& @
' [9 Q2 G( _: O
Here is a sample (checking for 'SICE'):1 e$ Y* l3 b" Q8 C9 T( ^0 U
2 E( |$ K3 K: b: i
BOOL IsSoftIce95Loaded()
, ]# N7 A! u" w) n, \" ?{' u+ D/ } F# g6 k& c% {
HANDLE hFile; - w1 y1 T' d5 |$ y4 u: ^# o
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
6 P8 a- Y+ f4 ] FILE_SHARE_READ | FILE_SHARE_WRITE,
7 z, W* ?$ F4 y" ? F" t+ { NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);( ^: e" G/ B: c* Z4 }( U7 V" `# S: k
if( hFile != INVALID_HANDLE_VALUE )+ k+ U$ n- ]9 l
{
- D- q2 b. U. K5 t5 p. P# d4 l' S. u CloseHandle(hFile);, g. i, y& T5 {( v
return TRUE;
' Q& a4 N+ O* Z0 h$ u }
6 @; s: _7 D0 i return FALSE;
+ U. c! m3 K3 \# s' W+ _. r/ S}
} T8 N# p) `3 X5 `/ M/ C
; N% z# H# |' J n( O, QAlthough this trick calls the CreateFileA function, don't even expect to be
3 A( W; D8 d5 A5 G2 dable to intercept it by installing a IFS hook: it will not work, no way!
* B3 f% ^ A- d: v0 P, XIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
6 s! B' E3 K9 hservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
B, s; }8 T. u# |and then browse the DDB list until it find the VxD and its DDB_Control_Proc' g( U2 G. ~% V8 n( d9 D
field.
y7 |7 X# ^2 |) C5 c3 ~5 VIn fact, its purpose is not to load/unload VxDs but only to send a
* k# K7 y3 H( u& {6 v/ ^3 q8 ?+ [W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
* _9 o% B5 D' I; D0 I: |to the VxD Control_Dispatch proc (how the hell a shareware soft could try
( o, L- t: E P6 W( X! t$ @0 _: G; o% pto load/unload a non-dynamically loadable driver such as SoftICE ;-).
& u$ D3 D; L% S: B8 p4 ^1 ]4 BIf the VxD is loaded, it will always clear eax and the Carry flag to allow
! T% Y$ P) i6 X0 `- o8 ^its handle to be opened and then, will be detected.+ b/ Z7 L0 r7 `( p: |0 |
You can check that simply by hooking Winice.exe control proc entry point: T, {2 i( G7 V0 L8 y, D, s& z+ V
while running MeltICE.
- f4 G3 Q; B6 M" v( a/ E; m: K% p" y( ~' T5 J; ~7 a0 `: x) S
- }3 w$ f. a, N$ N& x# H 00401067: push 00402025 ; \\.\SICE( o1 \3 Y; T6 g, E3 A) v: O
0040106C: call CreateFileA; R7 L2 m2 L1 f0 A' L2 L
00401071: cmp eax,-001
5 B5 p w) H# T7 N2 z) p+ E" U2 O8 L 00401074: je 00401091
' v% P; }- H" E, P# N
1 W3 l/ \/ T+ l. g7 X: p5 q' X4 ?2 J; Q% w' m
There could be hundreds of BPX you could use to detect this trick.+ F9 W4 j- h$ E$ m
-The most classical one is:
# S. ]; y# }2 J7 w3 Q BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||6 ^- p& Q) W7 l% ^. q
*(esp->4+4)=='NTIC' q. H+ I o% {/ i
) T0 N1 l3 v8 X" r& G ^, {( ]-The most exotic ones (could be very slooooow :-(
; k/ B |5 S" u BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') 3 _6 C8 H; f0 F1 \2 h7 a
;will break 3 times :-(2 K& R V! @& I
3 P0 n9 E" H( y4 t2 m
-or (a bit) faster:
. f+ Q% b$ I4 o) r BPINT 30 if (*edi=='SICE' || *edi=='SIWV') E4 m8 n+ v! ~
/ {9 ^( k! w: t: u
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
, v0 L" w, N% ~/ [ ;will break 3 times :-() m2 _- k7 d- }- r# X0 ]$ |: a
3 y) B- `; f7 ^# j3 R( K- V' v-Much faster:% |0 L$ h1 A |+ \8 h
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'8 b/ F; P3 W' {* Y6 a5 }* H
; E+ C4 E% k7 ~7 v
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
+ A0 m. r8 S# h9 e$ R+ cfunction to do the same job:: [$ z; P7 I0 O' K; C
4 N7 K: n, K7 A* h push 00 ; OF_READ7 B0 G7 k8 l7 @; x! w
mov eax,[00656634] ; '\\.\SICE',0
2 s/ V! d: O; }: V( i push eax
`3 R, J) I- e S- n5 @ call KERNEL32!_lopen2 m# C; i& r7 p+ l0 n& W& ^+ v( e, B
inc eax
! v5 @' |8 X5 O) ^. z: O jnz 00650589 ; detected
6 F8 E5 v ^* Z% j7 i push 00 ; OF_READ2 P' J7 g. _, T+ ]
mov eax,[00656638] ; '\\.\SICE'/ X9 r" M* j6 O: I! ]7 v
push eax% b" L) M$ s" t2 R0 P
call KERNEL32!_lopen9 S9 _ \5 b1 `' d5 q7 ?5 v
inc eax
0 S2 j; Q$ J8 V! K0 q$ B jz 006505ae ; not detected
# ~2 r! c9 [$ X4 |# _8 N- `4 n6 h2 h' d6 s% I
/ a, A8 T; R1 N' X/ Z* I__________________________________________________________________________" l7 Q. ]( S! e9 q
( ~5 [: P* H% n6 m) |( n8 Z1 b$ ^
Method 12
, z& t. X6 e6 i1 r=========
; Q2 o, J- [! {) Q
0 T. R. U6 V7 X. F) Y+ r/ G! _This trick is similar to int41h/4fh Debugger installation check (code 05' `. ^9 D5 W3 j) G! U7 y% H' p% l- G+ N; |
& 06) but very limited because it's only available for Win95/98 (not NT)$ p- W6 Z6 a: [8 x) D
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
$ g5 h. x; D$ P7 k! i% p! F7 ?2 L2 [
- E" l3 A4 ~5 u+ J1 E6 A7 O) z push 0000004fh ; function 4fh! W9 @6 w: r8 B# ^3 X" H
push 002a002ah ; high word specifies which VxD (VWIN32)
% _- w8 f- ^% D8 B ; low word specifies which service
% i) Q3 E' S m5 Z( e2 U (VWIN32_Int41Dispatch)
- i8 C) `' C* c _" o call Kernel32!ORD_001 ; VxdCall( ]- N5 @. L) m
cmp ax, 0f386h ; magic number returned by system debuggers6 I% T' f# ]- R6 r7 x& r
jz SoftICE_detected
" u" M5 @- ?6 w# k* @0 V/ N9 m% b, c& b; Y* l3 j
Here again, several ways to detect it:
U0 z# E; i$ t# T) m( ?
1 H$ M1 e! ?# Q; ]( J BPINT 41 if ax==4f8 ^: b. g& S5 a; x2 u# W' m
2 f; s" i% d& T) P2 y+ c! @2 H7 k7 W
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
- ?5 v$ l0 p+ d" c: k- T5 a' C L% K' X6 p# [
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A& w8 i a) [9 N V, O
6 _3 n p; `' T; S5 q5 E' m. p BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
( ?7 Q/ X3 s0 `+ F
( z7 i' N9 Z4 E4 {( y__________________________________________________________________________
3 v z. x$ b' |) K6 F
/ L7 Y% O7 J8 E# ?$ HMethod 13
' d. @( ~3 K) i: R=========( X+ u2 g! s }1 a# J$ Z6 J5 p
) V/ I. r7 E* c- aNot a real method of detection, but a good way to know if SoftICE is
" w/ l: x) j, R. pinstalled on a computer and to locate its installation directory.6 y {. s7 O* I% i) \) Q' U/ I& I
It is used by few softs which access the following registry keys (usually #2) :
% \8 V( U( V! M. M- L% \
4 T5 A& a6 |- \-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
" y, c1 @( V& [ F2 |# T\Uninstall\SoftICE
& }+ T" ~/ [% @1 H1 C+ c-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE% m- _. A' X' Z! y3 |
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion. ?4 i, i O3 U- {+ D- n( {& i
\App Paths\Loader32.Exe
& o# m& }% a1 W$ a1 u8 c" D6 ~
4 ^# Y* U; a6 Q# [# E/ o* H; F- l4 P: z) y
Note that some nasty apps could then erase all files from SoftICE directory- s G3 k7 ]+ W7 z/ g9 \
(I faced that once :-(2 h3 P/ W3 o% y# ~4 G1 f
/ _3 W+ R' R7 C. n2 T2 hUseful breakpoint to detect it:
( |. f) i2 ?. g/ Q9 g N- g% n4 Q9 U2 J/ \- L6 L& ^- h
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
! o% A A8 |1 n: T* ]$ j
, \9 J! B2 Q2 z2 B6 s; K" ~6 s! ^+ d__________________________________________________________________________2 F* `( F0 H% \
& R B/ J% @* S/ r% M) l
8 e# R: l7 U. f1 x8 I' t8 \$ d& c1 LMethod 14 1 |' u, l1 N7 b% Y
=========! x1 q7 _7 J3 g3 C: M
5 }$ _) p* ?- b9 w8 l
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
- C- {2 f, @6 h0 C) a& His to determines whether a debugger is running on your system (ring0 only).
6 f' M' @8 ]9 w9 I2 Q t* q$ H# d; `7 f8 E3 O2 z, v
VMMCall Test_Debug_Installed+ j- N: b4 r( n6 [* r& q
je not_installed' g4 A! ~4 y: F/ a4 \, e* ^9 \
" k& ?3 f+ L1 S$ \, @# T! J* IThis service just checks a flag.; L( ]& q5 P: m! X
</PRE></TD></TR></TBODY></TABLE> |