<TABLE width=500>: ~& ^( L" A6 J
<TBODY>
: Y0 E# k' L3 R8 q/ [<TR>
+ {, Y4 F1 K4 ?# n& W: T<TD><PRE>Method 01 + j. d: ^+ `* J; i4 L
=========
4 \/ D2 W6 V. M0 j3 D4 V2 a; K# O
6 Z! V; q* w/ T- AThis method of detection of SoftICE (as well as the following one) is
- q5 \. d3 M$ }" Eused by the majority of packers/encryptors found on Internet.
" y# _1 A! I: @$ ZIt seeks the signature of BoundsChecker in SoftICE
/ ?3 Q9 y* t1 |
s, L0 j6 z, `8 \ mov ebp, 04243484Bh ; 'BCHK'
# f9 B, X7 l# O; A8 s! _ mov ax, 04h
: w$ v& |& m" w int 3 4 f3 `- c& }9 J
cmp al,4. e5 Y# K5 L; [$ l2 ^+ }
jnz SoftICE_Detected! G, f8 D+ f% t/ r+ U* Q
) T. j) V" W. {) L
___________________________________________________________________________
% c M3 D3 ?: R$ d. w" b+ m/ W1 \/ m: V* }8 l! K& _. I" k
Method 02/ I G7 n; B3 e5 A3 K* Z
=========' e0 v. p9 M4 y( ?
) O& ^# P8 J3 g, m, O' O
Still a method very much used (perhaps the most frequent one). It is used
& {4 y& l( J% N3 v2 H! ~; H7 r; a! T) @to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
8 }; U; M5 d0 j4 r1 K1 Wor execute SoftICE commands...8 X* K/ p& i* s- h+ U1 g
It is also used to crash SoftICE and to force it to execute any commands
% W p8 v7 L! x: u1 M, e(HBOOT...) :-((
1 k e, g1 A. f0 ?' G$ v! F
u9 _. c% L- O: z( rHere is a quick description:
: _" I' h$ V( e% l8 k S-AX = 0910h (Display string in SIce windows)
7 g6 C' y" L& y" G-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
' W4 ^1 B9 j0 Y, p6 Z) q; I-AX = 0912h (Get breakpoint infos)
" e2 v: ?/ O% @9 H-AX = 0913h (Set Sice breakpoints)4 B, @4 m& O4 ]3 @0 Z0 Q7 @4 g% d" X
-AX = 0914h (Remove SIce breakoints): C; E& F e" p/ X U2 y9 |
/ z; T# z' _3 ~0 b1 t% v0 H
Each time you'll meet this trick, you'll see:! R7 D( ?: F$ Z
-SI = 4647h8 u) ?* U/ y+ j5 d% b a
-DI = 4A4Dh
" p4 a7 X1 f' XWhich are the 'magic values' used by SoftIce.% c9 g2 [) q+ Z
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.1 P% b$ L# r: w+ C/ E
$ ^+ k0 j0 S$ MHere is one example from the file "Haspinst.exe" which is the dongle HASP
4 M4 O( [6 _ ^, `* ]3 h2 F8 M" zEnvelope utility use to protect DOS applications:
. }: H# L D8 F* a1 w+ a
+ s. M9 O; X, ?" F( o
0 h+ D% l3 X$ |' o: p8 Q3 e! s4C19:0095 MOV AX,0911 ; execute command.
) {5 D/ z' c! L4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
- @$ ^$ w; a( J4C19:009A MOV SI,4647 ; 1st magic value.
/ d) @/ H D$ p7 q4C19:009D MOV DI,4A4D ; 2nd magic value.
4 b( ?1 j0 J$ F, ?" M4 `/ J4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
8 S& {7 W% t3 u( u9 A/ a4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
7 ~! T5 |: p9 x4 j9 m# E" e8 q: b4C19:00A4 INC CX
+ a$ N7 Z, [( ]2 \& [9 u4C19:00A5 CMP CX,06 ; Repeat 6 times to execute! r' n/ v! k) T1 h1 P3 ^
4C19:00A8 JB 0095 ; 6 different commands.
% G& `' D! Y* E: u) X6 o3 Z8 s, t4C19:00AA JMP 0002 ; Bad_Guy jmp back.
; J: A# b) |" @2 T; q! c6 b5 D4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
: O3 ^( i$ A: W$ y% v* A$ @
6 b0 p" _- d0 H6 J8 YThe program will execute 6 different SIce commands located at ds:dx, which
0 |# F# t, K0 yare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
6 q/ a5 x0 F2 P3 m
$ S' P2 f' P9 z* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.4 B8 s0 A; [0 ?1 F- L
___________________________________________________________________________
, @! O2 b9 q8 ~0 B0 r$ `6 h
- I) s+ g4 j# M: U( [# y; w
7 E7 A4 x) _& M) e, ~, L& o v4 _Method 03
3 r" C$ p C3 @) {' |=========
& ~: f! J2 Y. K- {1 {& `! @
0 w- B4 U4 l$ G( T! E$ M! H- ALess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
) |6 I1 u4 K9 A/ p9 ?7 b(API Get entry point)
; c, V* e1 U; j/ Q % b# W, p1 O6 G& s$ h2 [! d
) W1 w0 x8 o( R$ r- n xor di,di
2 L! O1 C* R1 D ? h2 s mov es,di5 {% r6 ]: z/ j
mov ax, 1684h
) f4 L8 j: z: A M" t3 t0 J% A mov bx, 0202h ; VxD ID of winice1 n3 b9 ?9 Y3 \
int 2Fh' {0 p3 U+ g* c' \: n$ D
mov ax, es ; ES:DI -> VxD API entry point# F* H( ?% C) q3 g X. j( M
add ax, di/ B: j8 ?1 Y3 E
test ax,ax5 ?% V- g5 O9 Q
jnz SoftICE_Detected
% k) O& S" a5 B5 |
. a& a% ?# |1 w( R) V+ H9 m$ F2 m___________________________________________________________________________
; J5 R2 m) [# G: D; k8 S* l- Z) l( m
Method 04 h1 T1 X0 H+ J% p* P5 ]+ B
=========/ L5 [" A6 ]( Z2 _; g+ V1 }' w9 Q) {
+ m! Z8 l6 }+ e( T: n
Method identical to the preceding one except that it seeks the ID of SoftICE
4 v7 C* A2 }/ D+ xGFX VxD.
/ E6 V' b8 o. k% x7 @" ~* s* N( o8 x# J
xor di,di
. u# ? ?; S3 D7 e mov es,di
, L! I. h! }1 k8 w: R- g; C& T mov ax, 1684h * T4 B; |" o5 b* ]
mov bx, 7a5Fh ; VxD ID of SIWVID6 r+ k) A$ b8 v' n3 O |+ [6 G/ |$ }
int 2fh4 i6 |6 s! I: l& Y2 k& Z
mov ax, es ; ES:DI -> VxD API entry point
& o" k% X( m& i, O7 Y add ax, di
1 n9 v" l! W* E E3 ] test ax,ax
4 b! j/ U: u6 l( k0 Z9 R jnz SoftICE_Detected
" K: Z8 k+ S% f7 Y. T# t* q# C& ^/ a! n- c
__________________________________________________________________________7 _* ?" V+ u4 X7 k
, U) f. ^3 g* v: j! Z
5 F( }' f2 Y+ @% Y; l8 L Y
Method 05! F$ {0 K H( h# s
=========# N3 p+ e2 G4 `% [$ \0 o
) f% @0 |0 S) j* q/ p# S+ E" G p
Method seeking the 'magic number' 0F386h returned (in ax) by all system
' Q- P6 f6 a7 \debugger. It calls the int 41h, function 4Fh.
% h1 ~0 F4 S; X7 J; o) l3 J+ CThere are several alternatives.
# m- B6 Q4 }. ?, `8 w9 C4 q; ~7 D% @1 ?, ?, b- O" G" B+ S. ~" O
The following one is the simplest:, N: U4 x2 |- L: l/ T: ?9 ~
/ |# L! U3 A# S& b3 \. z' H% ]. P mov ax,4fh
! E7 s6 w S! c z. E int 41h
" M8 i) d0 ?5 q cmp ax, 0F386
3 g; Y( H: }8 n2 i: O1 q- Z jz SoftICE_detected$ K, `4 ?; b. Y: D$ @0 D
( c# s7 J7 e* g% m$ L$ P6 H8 e! Y: | \4 e+ [; |
Next method as well as the following one are 2 examples from Stone's " i$ Y$ k J' W8 ^6 r& h6 h( J$ u- M* n
"stn-wid.zip" (www.cracking.net):
# P, F' }# V( K! U
, D" T" L/ K$ U mov bx, cs3 I6 c- o6 O" M$ y9 w' w! ^( }
lea dx, int41handler2
% {2 D8 |' @. C- A+ @/ E xchg dx, es:[41h*4]9 j t6 A5 o; e( O+ L% K" H& c
xchg bx, es:[41h*4+2]' Z2 A9 a6 h9 M& x
mov ax,4fh
0 }' a% Q. x' p1 T. o& R int 41h5 U, Z- P& C1 U2 T8 i
xchg dx, es:[41h*4]
" H- k: j& p: E xchg bx, es:[41h*4+2]
: e0 H9 |8 C7 N9 M% A( l8 a4 G cmp ax, 0f386h
5 z+ U3 h& l2 J1 E% o# d' Q! g jz SoftICE_detected; a+ s0 W9 {( _7 I: q, K( b
, R9 Z2 e4 @2 u7 Z! C+ e! Uint41handler2 PROC5 E% n% h! x7 H. e2 b. v
iret5 n3 i$ y( U5 f/ \, _: q6 a! [
int41handler2 ENDP0 r, q# x# b& w q5 B6 X3 Y8 J
( Z' ]7 y1 o& A+ A. g0 \9 d" z5 c+ q2 g- ]+ `4 t
_________________________________________________________________________
& Y/ R" e' u6 g+ |8 u
+ T9 m/ u6 f( R: K. x- E& m4 f% b; X4 }2 b4 |
Method 06
2 t( b4 }7 m8 D9 u9 J% A=========
# x- m; f8 x9 ~9 f9 {
( X+ y' z9 f" h4 F3 r& Q, {( @
1 s$ W. [4 r' q- f0 ]& R2nd method similar to the preceding one but more difficult to detect:! M. T1 C8 H- w/ g
7 Z9 Y" b. P- {* s
1 P; R$ W2 S4 x) v- Aint41handler PROC z- |, L2 R0 U( p5 m% j" i
mov cl,al
* ?. t' u! ?: O$ n+ K iret
& F2 X/ ~, t; D# v2 Pint41handler ENDP
7 n2 g' ?# B+ ^+ k) e+ t9 |+ F/ O( u6 X9 }
& h {* p0 M- I$ Z5 h4 L9 u
xor ax,ax
% Y5 w3 k& H/ C# D2 G; Z1 h mov es,ax8 f$ }+ P7 j. F* ? D u. R
mov bx, cs
. L) N9 S8 Q% Q& B. Z* |8 T lea dx, int41handler( [( X% }. H* x4 p" m
xchg dx, es:[41h*4]9 V8 e1 k+ N, D+ b( a* N
xchg bx, es:[41h*4+2]# v' D+ D/ Q* k; I
in al, 40h2 k! W. M2 p/ c
xor cx,cx( n. S1 v8 l7 w
int 41h7 L) S1 h) u; `. x) ~, M
xchg dx, es:[41h*4]
2 s+ l) |, c* g) W0 e xchg bx, es:[41h*4+2]0 {( ?) J) e2 i9 x$ Z: N$ ` V$ a
cmp cl,al
1 F3 N1 Y* S8 Q/ I% f jnz SoftICE_detected
' O- M5 j# Y: T4 N0 e! d) E. x+ O3 Y; E+ V8 J
_________________________________________________________________________* j$ ]: Z' U9 L# m; t7 T+ P) ~8 c" C
% c6 D# X; L! m6 l
Method 07) G: ^# k! ^7 Z
=========
1 W) e6 D3 K% O' ~1 y
9 a) A3 N. R7 V, UMethod of detection of the WinICE handler in the int68h (V86)# ]* q* u. ]- e) S5 [
7 F0 Q+ w4 P; H) V7 G: i7 a
mov ah,43h1 }: T2 y/ B$ X/ {# @0 ^1 y7 U' M
int 68h; B4 u! n1 D9 U, ^3 d6 V& ?
cmp ax,0F386h
+ }" A: c" ~ Z7 H7 A" v$ X; } jz SoftICE_Detected, m* V. i% T0 a+ z! ^$ U
% N, r; A/ M- ]. c
7 y: e2 b3 {% ?$ T/ _3 k% c- }
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
. A4 g9 M, \ E app like this:
m, S: I: z% _) Z# ~# l
, l9 E( B/ K5 r8 j6 ^ BPX exec_int if ax==68
# E" R, D4 f# L8 A3 } (function called is located at byte ptr [ebp+1Dh] and client eip is
. Z" s8 ~% }) R9 T3 V+ a located at [ebp+48h] for 32Bit apps)
; t3 ^* G5 k) f__________________________________________________________________________% {' E7 p* q) M, L* i+ O
- Q" \( P( x- s3 }$ O5 D$ x; L' s( Y3 B t; D4 y# c. Z
Method 08$ a* K; G4 `& W; v( ?
=========9 D2 _% Y5 E& n6 E+ S# `
# ?6 i0 d/ v7 L4 P/ P4 J: i; \It is not a method of detection of SoftICE but a possibility to crash the( }" D# ~+ R ]
system by intercepting int 01h and int 03h and redirecting them to another
. c% {7 o' V; m; x jroutine.
, x0 E+ X" f8 `/ E+ }( a# q; p' PIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
7 U; g- N* X/ K: s7 v* |to the new routine to execute (hangs computer...)
, E) N7 \# @- d+ F1 I+ \+ t* O- m8 {; L: f
mov ah, 25h; J3 a. b1 k2 d; b
mov al, Int_Number (01h or 03h)
; m! Q8 _. C9 e: Z' I mov dx, offset New_Int_Routine X+ K% C) i6 @) c! M3 [8 ?" A
int 21h1 o. {' Z5 \/ K \$ J* W) R& V
B/ A. {% F* ?; _. c# X
__________________________________________________________________________! E0 H: c( D- m4 \
: {) U. \5 _! r4 s4 ^1 I8 |
Method 090 g4 L, \" e' k/ W( n1 o- a2 X
=========! Z! R0 l) ]! W% q6 B
/ I$ F6 \0 x' A+ {2 b. C- `: x
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
" V5 J B2 I; \performed in ring0 (VxD or a ring3 app using the VxdCall).
O2 X) M6 K+ W2 q R0 }. K( L {The Get_DDB service is used to determine whether or not a VxD is installed
6 K# J" s7 x: Y5 Z L$ Yfor the specified device and returns a Device Description Block (in ecx) for
; T, e' U! P/ z: ^that device if it is installed.
8 B' m8 j3 G. M) w# K2 R) y* p) j& q+ ^; A/ R
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
+ U! ]2 O/ [) A# I mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
, m0 s- ]9 X# l5 T9 u( y VMMCall Get_DDB. R- B4 z2 F7 T0 X% ?. H( n
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
( E+ z1 z. C, N7 ?0 i. _' q
: A0 |) i, L6 v6 p* v$ q2 mNote as well that you can easily detect this method with SoftICE:: e8 v% d$ f. c& ]5 n0 M6 b5 S0 ^
bpx Get_DDB if ax==0202 || ax==7a5fh
2 z' X* @9 J3 A0 E) _ e ]
D/ q$ X) S: |3 i1 ~__________________________________________________________________________
3 j7 l3 h' B6 Q! Z3 [( o d, o* g) e* j$ P( T' r0 w4 z- d# W, H# ]9 ?
Method 10/ J- i/ L' d* d7 e8 T: h4 \
=========2 p4 c" I4 L" m7 o$ ^# ~
# Y0 ` @8 m6 X+ C- W
=>Disable or clear breakpoints before using this feature. DO NOT trace with
* ]8 ]: t& Y* e* S" n* n2 d SoftICE while the option is enable!!, ^" u R; ^" f+ h9 ]% Z$ F
4 B1 \6 O+ z9 q8 J8 v- d2 SThis trick is very efficient:
0 J: N* Y6 N$ ]* |+ E; \( \by checking the Debug Registers, you can detect if SoftICE is loaded$ H* a3 d9 T6 w0 a& S/ }. s
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
8 I, Z5 ^; M" _there are some memory breakpoints set (dr0 to dr3) simply by reading their
$ C: Z8 E4 b7 v& Z! ]" bvalue (in ring0 only). Values can be manipulated and or changed as well
$ o4 D% s) [% H4 o(clearing BPMs for instance)
. r- Z$ w6 W5 F2 q: `+ Q/ N' h$ ^4 \- c n. W
__________________________________________________________________________
6 s& ^1 S0 I2 c k' O! |9 j# n D8 X; ^2 A# ]
Method 11
0 c0 n3 f8 f4 a=========
7 {0 P% l2 M! o+ b: w& a% ^" ^( G' @* _3 y! ]
This method is most known as 'MeltICE' because it has been freely distributed8 X" r5 _4 Q, t8 C0 G: P
via www.winfiles.com. However it was first used by NuMega people to allow
1 g& j. l( {% uSymbol Loader to check if SoftICE was active or not (the code is located& T# z/ n8 J$ i! U" L5 Y0 m
inside nmtrans.dll).3 t$ t# J7 A1 E
; G7 N4 c/ P5 K& R) Y
The way it works is very simple:3 S8 i& I& ^# v: A" ^
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for3 }+ w$ N9 \: o, ]: u% w9 L
WinNT) with the CreateFileA API.
( O6 c$ Z& U5 e7 c: L+ K
% X. M! g! k- S- R5 A- }Here is a sample (checking for 'SICE'):4 k* h7 ~7 d6 U" {9 m# ?
5 `/ F# M. E; q# l5 ]. fBOOL IsSoftIce95Loaded()/ t. X- [* B# H2 p: t8 k
{
$ S% V- {2 J3 M L" s B' i' x8 d HANDLE hFile;
" x% m3 _6 f# o { p2 _ hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
9 D4 z+ Q2 G: J( r; W. ~ B FILE_SHARE_READ | FILE_SHARE_WRITE,$ M8 f! s- U) e$ m/ B9 Y
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);1 k# x2 }4 O2 d7 l! n
if( hFile != INVALID_HANDLE_VALUE )
' E+ F7 \ T3 X7 K {
5 q7 \+ B' Y: r" j% `( U1 P CloseHandle(hFile);
! X4 `! s0 q$ e; L5 e return TRUE;
4 `* |" f, j( x }8 r- V+ V+ j9 Y- Q4 ~% U% V
return FALSE;
0 T" a+ K, X9 b% F: @# s% E8 z}' H% Q2 s) w6 `. a
# [ H4 _$ j. o# W# S! K
Although this trick calls the CreateFileA function, don't even expect to be
/ o$ `5 ]/ N5 P; t8 V4 A% H; Qable to intercept it by installing a IFS hook: it will not work, no way!
" G7 E9 v+ Z1 t7 E- @; fIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
6 T; L; b0 @% G' O6 N' gservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
' @0 v3 L+ b7 ^0 _/ y1 O2 Band then browse the DDB list until it find the VxD and its DDB_Control_Proc
Y) p q& X+ X; I4 j: B$ Zfield.
X( n' L7 D6 f0 PIn fact, its purpose is not to load/unload VxDs but only to send a _/ q/ m* |' L1 x
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
& S$ f: a9 Q2 m% k Kto the VxD Control_Dispatch proc (how the hell a shareware soft could try" R# ^7 d/ V- M6 z- A: p" [1 u( D3 I
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
- |4 f1 g) g% o& @: W4 J M& OIf the VxD is loaded, it will always clear eax and the Carry flag to allow
4 q; E( M' U9 Y5 g! F0 `2 h; m5 Tits handle to be opened and then, will be detected.. ]! v, ?$ ?* c7 F. [6 `
You can check that simply by hooking Winice.exe control proc entry point
2 Z& q6 h ?$ U* I1 c: w) R" cwhile running MeltICE.
* H9 }) Q9 O2 B2 L* @) f7 w/ ?* \) F' l
- G0 x8 l3 R( i# A 00401067: push 00402025 ; \\.\SICE' B9 \: D0 u9 p$ |" u
0040106C: call CreateFileA% u1 H, w' {( h
00401071: cmp eax,-001
. g- m" c; ]) o' g9 z- E 00401074: je 00401091
8 ]' w e! X+ p) J1 F2 x. F# @& t/ s& t7 p( b! }
3 T3 W7 d3 L8 hThere could be hundreds of BPX you could use to detect this trick.3 J( e' T/ c2 G/ Y+ S
-The most classical one is:8 B% A& U# o) w; V. J$ X$ s
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||: m3 s) B& r( r. G9 j
*(esp->4+4)=='NTIC'- n5 |* |0 a2 t! U7 X0 V
6 ^4 x. b- X+ `, `4 W% |& ?-The most exotic ones (could be very slooooow :-(3 }0 e1 X+ S0 y4 q- ? c/ O6 D6 e
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') + \2 `+ O0 L7 p+ ?( x; [% i. ~
;will break 3 times :-(
$ O( F( D+ y" t* r, J( a, i: w: d/ X& p! n
-or (a bit) faster:
! J& y$ C& S9 J BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
% n( k+ v" r. i1 i) F& H$ q2 ^" Y
$ g4 p4 r5 F% a. J: h5 g BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
1 v. K6 D5 O9 b, {- v1 a ;will break 3 times :-(+ c6 k0 v1 a9 i3 a' ]
0 o8 r ~* P9 y0 ~! l& Y( @-Much faster:
( r! ~. H, ~ c! e BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV' x5 N M! q6 K2 r( w9 G
- ?1 J( P. L( b% n5 HNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
& V- p- P; F- u* W% vfunction to do the same job:
4 i9 s; z3 \( L5 W, |7 o% P0 Q# P; e( A* V# _' |% m8 z9 b
push 00 ; OF_READ
- ~$ y" k, k' j- T3 X# g mov eax,[00656634] ; '\\.\SICE',0
' @8 J' m2 v5 ?/ P* | push eax
: y4 D, @8 t! h call KERNEL32!_lopen
. s0 r- [6 j$ E inc eax1 S6 q+ r) g; j! u+ [8 ~, A! V
jnz 00650589 ; detected
/ _& `+ m9 X" V2 T: {6 o# y push 00 ; OF_READ
: A @( @6 w5 m* ]9 K3 @ mov eax,[00656638] ; '\\.\SICE'
4 |$ d6 O0 K' U0 b6 e y, b push eax
* ?% A7 c; ~) R& y, D0 i call KERNEL32!_lopen9 K/ f0 z& q( z* M: @- I" p5 l+ N
inc eax; v c, Y/ _: q- u a7 p
jz 006505ae ; not detected* ]7 {/ F) O6 k. |
; c* z' v1 x+ e: d/ a9 z
6 ]% {0 c8 E, n; J" L__________________________________________________________________________
# G8 v9 A' g3 w
8 J0 m+ e% \+ G4 {7 r2 SMethod 12
# D0 d0 \& J: P) `: s=========9 C D, |& E8 U' z$ U5 b
3 V4 _4 b$ D6 m7 t9 u% Q n) d
This trick is similar to int41h/4fh Debugger installation check (code 05
7 m k1 B0 |& q9 h9 s# C; ^4 N* f! h& 06) but very limited because it's only available for Win95/98 (not NT)! f1 s; E3 Y# B
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
; B( D2 y* ^, p9 o0 z/ j* ~) j/ r1 B5 h7 p9 f: V
push 0000004fh ; function 4fh
M9 X6 n& r" B' r( j. w# t push 002a002ah ; high word specifies which VxD (VWIN32)0 j- T$ P0 g0 w- N4 a
; low word specifies which service! k. V/ X( G8 s
(VWIN32_Int41Dispatch)
5 q [1 L* c1 } G) F C+ W! z call Kernel32!ORD_001 ; VxdCall+ j0 @. e9 u: g- L( H3 Y0 x8 L& v
cmp ax, 0f386h ; magic number returned by system debuggers
( K, N) [! m( G/ C. [ jz SoftICE_detected1 I. n% v) {& D1 y% k0 [# i
7 W5 Z- t# E$ `' T
Here again, several ways to detect it:/ }9 \9 y# q' h) l& r( `
: [6 z1 p+ q3 W
BPINT 41 if ax==4f" x5 L9 ~" ^' m* z9 w
. q' w0 T8 U$ A9 S# Y" C
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one C* ^! r& ` j7 s# k
2 u" u0 s' o& Y& h
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A0 A- `% ?* f7 N T
6 l! S/ _' t# U6 [8 P7 b0 h BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
. I: o R6 e1 n+ l. a4 Z9 w3 W* [3 u/ A: O4 R% `8 }/ m6 D8 z( k
__________________________________________________________________________+ Y3 w" m- V a: D R" Q
; n" x) K! H# s/ @Method 131 l, T' ]5 p5 i) d
=========. P; Z0 I. w0 r2 J) F( ]
2 \; R8 K9 a0 y% ?7 j! |Not a real method of detection, but a good way to know if SoftICE is
( N: H8 F; @7 C& einstalled on a computer and to locate its installation directory.
$ g3 V8 x1 q' L# d! }It is used by few softs which access the following registry keys (usually #2) :1 S ^) k `( \# L/ C
/ A& O2 z# r1 _4 S0 T2 F
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
$ p; ~1 N! d6 Y1 V' |( M3 A, r; b\Uninstall\SoftICE
' ` R9 f9 V7 a7 t-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
+ s+ q! G/ ~3 E* J# m# _-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
E6 ]6 W- x* e% O( B4 u\App Paths\Loader32.Exe
P- V( L* d" {5 Z4 u
n! v4 q7 _6 X8 t" N! R/ ]3 {, _. }: |+ @% I, P* v/ C- a- a N
Note that some nasty apps could then erase all files from SoftICE directory
5 G+ @4 s9 B9 O7 c; J(I faced that once :-(. ^" i% Z) Q! |. y! b3 b
F' C; E! ?: P0 I; E. T) [6 U. rUseful breakpoint to detect it:& _$ K- H/ }% w6 O" ]+ i; x
x. w8 t* X; S' d' U# _3 U# K6 P _ BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'4 B/ N q9 }: y
% T' I7 m+ w7 f$ M) }__________________________________________________________________________
: U7 l" X, a5 r* j5 O l0 {0 D( V; U6 F! x
, E) J2 z) [1 F+ I4 W: q
Method 14
! p9 V( ]% ~7 B/ _5 T h' [7 s=========
/ u7 _6 O" C, B7 l+ @$ o X- u* K( z" Y C% |3 S7 G
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
4 R4 H/ l$ b1 [1 Kis to determines whether a debugger is running on your system (ring0 only)., W: L8 E% n! C+ }& Z
- h$ J) W. `0 A6 O! u$ {: t VMMCall Test_Debug_Installed/ |& u' \$ z/ L* u% F; ]( e! I
je not_installed
# J+ h+ ^1 k! d" Z+ S
& H$ P; _# C, |' d+ f7 b" x) ?& ZThis service just checks a flag.! U8 f2 f: n& B O1 z% @
</PRE></TD></TR></TBODY></TABLE> |