<TABLE width=500>2 f: n! s6 ~6 |" G0 g# H& ?0 Q1 ?
<TBODY>3 y5 p- |9 @# V8 ?% `" c4 o
<TR>
9 U1 t5 t5 {6 q, r) G- O7 H, G+ {5 u' T<TD><PRE>Method 01 & z' `/ |7 g/ a5 C' M
=========* R, s, L* J4 N6 @5 Y
; [/ A, \: a, U j( X9 y
This method of detection of SoftICE (as well as the following one) is
0 `0 ^8 M' B. Dused by the majority of packers/encryptors found on Internet.& E3 C6 z% b v0 Z% `: R
It seeks the signature of BoundsChecker in SoftICE+ o c' ?& U9 V
1 N( f6 \* t1 k( `% `. O% }1 H mov ebp, 04243484Bh ; 'BCHK'
- b+ J( L1 t; ~8 n! E2 C, Z2 @ mov ax, 04h0 Y0 f3 A. U3 O6 ^
int 3 2 ]$ ]4 u8 l% Q, u- s/ ^4 c1 H
cmp al,4, `/ P3 T7 N4 k& T( F( b
jnz SoftICE_Detected7 `4 `+ N9 \8 }5 x* o
4 ~# e+ {; I5 l8 h6 l___________________________________________________________________________6 y+ \- ^) Z0 [) O: S) ] H
% p, |4 ^* v! S! }& \/ N
Method 027 G0 `" V5 V6 u1 v, t. V5 I5 r+ y" I
=========7 c6 E7 X& \+ ^8 y
7 _4 g [" s' I. P6 } `6 S" K
Still a method very much used (perhaps the most frequent one). It is used
$ i8 \% K: B1 c# k8 z' j( @" Zto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
! N M" v' G$ {8 u, L( S, m& yor execute SoftICE commands...
% Y5 j! F! I$ k7 Z# v' W; w0 T' gIt is also used to crash SoftICE and to force it to execute any commands0 z( N+ E; x) H, f% Y# A1 X
(HBOOT...) :-((
# G7 ~9 V4 c3 s; r2 V
9 v% ^8 d2 G& W! M4 A# v$ j* x) KHere is a quick description:
; S/ W( c# V4 k& \-AX = 0910h (Display string in SIce windows)$ {: o9 h- b8 U9 d
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx). n7 S, L0 D3 ]! L# T, `
-AX = 0912h (Get breakpoint infos)
. V$ |8 n! l% T; `( n4 p% R-AX = 0913h (Set Sice breakpoints)$ j$ c9 x8 L2 c/ R8 y" r# k/ ~
-AX = 0914h (Remove SIce breakoints)- }5 V/ |7 k5 K% w* p% R$ c7 v+ K* j; m
0 ^- B4 C4 ?5 }: D9 j BEach time you'll meet this trick, you'll see:
: Z5 r9 t3 W* O* b-SI = 4647h. R* o- r9 V Y5 G& u& E1 V
-DI = 4A4Dh# E# p4 f. Y: @. R
Which are the 'magic values' used by SoftIce.! _* f) b5 W" J6 A) F% H
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.# M; X; c# ?* t$ A
. A/ k3 q) c# L8 |6 J; \
Here is one example from the file "Haspinst.exe" which is the dongle HASP
2 t) o/ y$ g% CEnvelope utility use to protect DOS applications:2 {" y. \, K7 d9 s ^/ T
* {/ M u* W3 A% t; L6 f# r5 I/ k
1 t# V& x" X% }5 p( y6 w3 O9 J5 [4C19:0095 MOV AX,0911 ; execute command.# B8 y- k# t0 X6 I/ v% U* C. [
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
6 u4 K' `3 j- Q/ B4C19:009A MOV SI,4647 ; 1st magic value.2 l) [8 E7 P/ |) M! y( _
4C19:009D MOV DI,4A4D ; 2nd magic value.) W1 S3 v3 V; s" q( f5 U
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)) I) ]4 [5 j1 a) p
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute. y; k+ j! |' ~5 E x4 {
4C19:00A4 INC CX1 [: c, P+ l5 s3 @3 u
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute' ?' L( U7 s( @# b3 ^! A' R
4C19:00A8 JB 0095 ; 6 different commands.. S: b4 m! D- e! c) U( T
4C19:00AA JMP 0002 ; Bad_Guy jmp back.
% b5 s) ~' s9 d6 g! T4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
- I2 _. r: x3 k% `9 Z! ^8 n* @* C3 t/ i) F7 q
The program will execute 6 different SIce commands located at ds:dx, which
& a1 o V6 |3 I* K" Hare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.4 j7 u9 Y6 y! _: l, L2 m" l
- k, i% [0 M* r! u" |( X* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
2 Q: j8 ^ _2 ]7 i___________________________________________________________________________+ ]/ Y# I2 @2 Y- v: c. I/ n
, T5 s2 k7 a& r3 E
3 D1 Q; w1 D4 ~$ C* Z5 r7 _Method 03
4 a: u) t) ^& d' S$ M=========
' P K. @; ^/ y/ I8 ]6 T, V& F' P8 V; j, I
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
) {/ S* E) E& t) q2 S(API Get entry point)/ z. R" T8 d" N! Z
* Z' x y; o1 |8 V
8 C% u2 @ |# A xor di,di4 y$ ~5 i) ^9 o) S/ J ^6 K
mov es,di8 \+ H5 J$ U0 l2 L. T5 B
mov ax, 1684h
- V6 C+ N) s+ }/ ^9 [ mov bx, 0202h ; VxD ID of winice. B# f2 D" j% [ u: w# e
int 2Fh
' H: u7 p( v5 H6 e4 ] mov ax, es ; ES:DI -> VxD API entry point
$ r9 ]5 V9 a) F7 D add ax, di
; R8 v% H4 Z5 M' H: a4 R$ n/ K test ax,ax$ B) a! D W, i2 Q5 J# c
jnz SoftICE_Detected
% h2 ^# q- M: B: j2 d8 Q6 g5 z4 u
___________________________________________________________________________4 |& a5 |1 {2 `2 ~9 a2 H& {1 c
* b7 Z0 I8 p/ F6 o
Method 04+ d* F, _4 r2 D* J3 E; ]
=========
8 U9 l7 O: ^& W$ o
: Y/ f6 O4 l/ bMethod identical to the preceding one except that it seeks the ID of SoftICE- W V7 f/ d) Z" _! z
GFX VxD.5 t5 {6 v. i) V+ q/ Y! N2 |' Q
! M, R1 q3 @7 q; v9 F
xor di,di
6 {6 N5 Y7 u2 b. g# ~" W mov es,di
/ J) S& O1 x5 q5 c* e+ q mov ax, 1684h . L; K: b; v1 P# O) O
mov bx, 7a5Fh ; VxD ID of SIWVID) e3 x/ e @" N$ J
int 2fh
( _; J+ `1 l: |" ? u mov ax, es ; ES:DI -> VxD API entry point
; ^$ ^# z1 }* k add ax, di
) s8 U( `. R9 t* h- L2 G% Q1 j test ax,ax
; ~4 k( l/ |1 d jnz SoftICE_Detected3 E* B) ]1 M1 E: f
# [, a% }+ I) x+ K3 Z% I: B
__________________________________________________________________________% r& M- h/ {8 E5 S2 y0 }, I
) S4 a% d+ }& V1 h7 l2 T
$ `2 I7 G! d% KMethod 05
1 M9 h* g, m8 o=========( w9 J% |3 U( y
3 b$ M0 r6 J) L5 V* ~
Method seeking the 'magic number' 0F386h returned (in ax) by all system5 @, _- [% g2 T
debugger. It calls the int 41h, function 4Fh.
+ `2 x3 t% ?) IThere are several alternatives.
: t) z, _ G Y9 P8 J( S8 E1 i" w" H3 C3 t# j2 C) m
The following one is the simplest:
6 a( r4 M8 D5 i# l- J9 ]
# k3 B) {- \/ L5 o* b' h# {* l- Z/ i; ^ mov ax,4fh
& y! t+ T) M; ~7 W/ V$ z int 41h/ [: J5 p7 j4 f' n3 I9 F( Y
cmp ax, 0F3867 H: @# e6 ^9 T+ G [
jz SoftICE_detected7 b6 K' Q2 n: ?: s- ]
/ P& A! [! _7 Y* ] ]
' ]. k2 d2 }( N
Next method as well as the following one are 2 examples from Stone's 0 G. U: Y. s8 U) X! w: w: P9 s
"stn-wid.zip" (www.cracking.net):
9 E5 J. p. ]+ g% m$ t( A
0 k5 W3 q% N* b4 c! c4 } mov bx, cs; r' l2 Z7 ?/ t7 e2 A
lea dx, int41handler2
+ g, r" m7 |) W xchg dx, es:[41h*4]
( e2 g+ \* B, V- _4 ^ xchg bx, es:[41h*4+2]
5 H2 \: p4 p1 _ mov ax,4fh0 F+ e- g$ G% X" O2 O6 @5 ^/ |
int 41h
, g5 J Z- T2 Q* g) H- G xchg dx, es:[41h*4]
4 W H4 M p0 u4 Z5 ]' o xchg bx, es:[41h*4+2]5 F# M3 ?/ o4 ~* D7 O5 B# t
cmp ax, 0f386h/ K: G0 r- B0 i6 ?0 A
jz SoftICE_detected
8 N. b* T: z. _: T8 I. p5 x8 u2 w
" i7 a A/ I/ |# ]% Bint41handler2 PROC' o( l5 X N( ?5 l5 V6 X* ?
iret
, }& X; X, ?- Q( kint41handler2 ENDP4 d" G- { X5 U% {" y4 g! r
0 C5 P) {- E/ B2 {( y8 F3 p4 E- u3 M: e+ U3 e9 e
_________________________________________________________________________9 F" _5 m) ~ u2 u* h9 C
: n \6 g7 \$ m4 I$ f4 H5 [
C% s9 i6 Y& B( r* C6 H& u" h
Method 06
8 n% ]: d& j2 ~9 z& o=========; L/ E [0 ]& V! q: J" t9 f
0 Z$ ?' ]9 ]8 ]- Q7 g
% a5 i* _. \1 v4 B6 k8 {' R2nd method similar to the preceding one but more difficult to detect:2 O- m% L9 n$ l" M+ K! d, A
: l$ p1 a! U) H! w7 a3 \6 G
4 a5 A$ J i) X# l) x. z
int41handler PROC1 L% k- ]4 G" N0 j
mov cl,al
" U* v2 F) W1 }) J2 O7 u iret$ B1 `6 r# L! Q# Q8 a" {' Z
int41handler ENDP
( e- P+ |& O G8 A' k# C- F$ q+ ]( H" } p3 O
" ?0 D; j5 U! {7 b3 o, P! ^; D0 s5 Z
xor ax,ax$ E6 j" n6 e, ?* i6 I' ^% A$ ]$ {# I
mov es,ax
$ B! f# n N6 D3 [" e( G; k0 s$ l0 l mov bx, cs
; L% l4 W2 y7 `9 ~7 n7 Z9 A lea dx, int41handler
! o. B' U: B8 P) b: w xchg dx, es:[41h*4]* P' |) K' T& t& [' U
xchg bx, es:[41h*4+2]
, m) E0 T% O4 R+ ~5 n8 N5 e3 P8 y in al, 40h
5 M1 X8 v0 s6 d7 F: o, n/ G$ V: b xor cx,cx
( ^% D( W) [: B" W( j5 e9 z" Z$ G int 41h/ Z; v" W, C' m
xchg dx, es:[41h*4]
% f$ m) J/ @5 u' y& H xchg bx, es:[41h*4+2]7 V: V3 W; b- v5 n
cmp cl,al
; t1 B) a+ i. c5 L jnz SoftICE_detected6 {/ k9 v; ?, P6 {
, P! ?8 n# I9 g) ]_________________________________________________________________________
* ]! N# J) z" V8 k/ j. K
8 Y- I3 V, P5 a+ j8 U& p; bMethod 077 x. q) q1 U8 I+ \1 h' O6 W5 @% F) R/ K
=========
+ L) Q' N) {& Y' m" Y% O( R9 L* m
Method of detection of the WinICE handler in the int68h (V86)
% W1 e, G! I# t! b' |; A! v0 n! \& L2 [, e7 s) W0 n0 T6 }
mov ah,43h
) l) z Y3 `% I, q7 r* d$ y5 C int 68h4 J0 N* K8 K) I& E! L+ v( ^4 \) g* l
cmp ax,0F386h
" F) G+ p% B$ E6 q5 D6 ^9 c9 |; a jz SoftICE_Detected) u) I* U& t& {2 G( }: y
. N- Z3 y$ A5 ^) {! W4 G
' u6 Q7 a0 l& P& k=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit/ Q7 q" W% q! f$ Y1 D+ F
app like this:
3 j8 f- H7 E" b" d+ B0 j( Z3 @7 q! L9 d4 y) `+ o
BPX exec_int if ax==686 v8 J) n+ P+ m; x- l/ R5 G
(function called is located at byte ptr [ebp+1Dh] and client eip is9 f- ?. Z+ Y& j0 V1 h4 I$ L
located at [ebp+48h] for 32Bit apps)+ y c% l; r% R W- m7 ]$ \: G
__________________________________________________________________________
- V& `0 T5 E0 V; a. l; P6 v+ P0 l- B; P8 w+ [- `: X# I
' r+ T+ U9 I! z& A$ a: D7 u
Method 08! V7 T( k3 m( [
=========* l9 B; ~ r& L3 T+ d
1 ^7 P% ]$ j, ~0 J' d% U6 r$ v9 JIt is not a method of detection of SoftICE but a possibility to crash the9 w2 N/ ~/ F$ w2 X
system by intercepting int 01h and int 03h and redirecting them to another
9 g' o% R! L. u! C3 k7 Aroutine.+ a) ^2 R& V1 X5 Y/ m
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
- M5 F) {0 X* ]/ b+ p, F: \to the new routine to execute (hangs computer...)4 h' V% d) M. k8 f
3 \( V5 G+ m! `. o
mov ah, 25h
; w1 s# g) t0 n4 ^8 L% y mov al, Int_Number (01h or 03h)
^) K3 \& [- E. k8 i6 X7 c mov dx, offset New_Int_Routine
. z- \$ t. y7 x int 21h9 R+ q; h; w; j
) ?6 U6 w: I8 D+ Q' [" |__________________________________________________________________________/ Y: R* D9 H$ h5 n& w+ s) i- S
& V* T. {8 Y$ e: n- }Method 095 ^* E6 f6 J9 B, ]. ~. H( d/ a
=========4 J/ A; ]4 q( }+ D! u, @
. M) x, z# _& v( l( I: kThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
9 U' N+ R9 h+ n/ J; Uperformed in ring0 (VxD or a ring3 app using the VxdCall).2 R# S6 {! a x6 `# n
The Get_DDB service is used to determine whether or not a VxD is installed5 `1 e; z+ c1 m
for the specified device and returns a Device Description Block (in ecx) for
3 h( v" e% w' v2 R5 n7 E1 ]that device if it is installed.! n. R- L7 }6 J: Q5 u0 \
, g/ R3 Q i( A9 V5 h/ t mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
. c; n# r% Z. U& Q) U' I+ [& @9 E mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
- h4 X* x1 _+ L% } VMMCall Get_DDB, m4 O @2 X9 k1 x+ _3 M& ~
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed1 t$ Q4 T; u) q. A$ E
& N# ^3 b8 j. h$ ]) F' h
Note as well that you can easily detect this method with SoftICE:
* H4 `# B: A4 A. C! t bpx Get_DDB if ax==0202 || ax==7a5fh3 s- T4 j/ K0 g& v- O$ V- |
! C. J# ]3 w2 l, A7 c
__________________________________________________________________________
. ~* k" v- L. ^+ a) D
3 \" |* `5 r+ U1 hMethod 100 o4 o2 B* C+ k8 F0 ]
=========
$ A3 X5 F8 e5 W6 a, Z- l# T) X4 |1 e2 s
=>Disable or clear breakpoints before using this feature. DO NOT trace with
+ N. G+ F( u: z$ m S. ~ SoftICE while the option is enable!!+ l8 R6 ?, C6 R* {, q1 \
6 a3 e# j3 l& k& h( z7 e
This trick is very efficient:
1 W% R1 R/ W/ t! `: Gby checking the Debug Registers, you can detect if SoftICE is loaded
# K0 S; D; c0 R" _, x3 |/ i; h9 a(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if# C! P6 Q5 O9 q
there are some memory breakpoints set (dr0 to dr3) simply by reading their& n$ Y- \3 o1 T: [" a% j
value (in ring0 only). Values can be manipulated and or changed as well- {6 X1 I s4 i j) U
(clearing BPMs for instance)
9 Z; M: j0 d7 j8 E4 @! Z- p3 @7 J) O8 _2 V4 G. V6 R
__________________________________________________________________________
' Y+ U9 p3 v9 C/ g# L' o8 Q' K. r! N; }1 F
Method 11
$ y) r8 `, h8 G+ J0 F9 G+ H( @6 H3 D, c=========, F- h' s2 Q1 _/ R; l2 |
! B, ~1 }1 X2 s2 t5 X" fThis method is most known as 'MeltICE' because it has been freely distributed
1 w9 c+ W0 F0 K' {5 [via www.winfiles.com. However it was first used by NuMega people to allow
9 m: X1 E. g& G* O2 I. uSymbol Loader to check if SoftICE was active or not (the code is located
6 T) ^6 ^# k4 `inside nmtrans.dll).
& h* _; ^. Z. `( H! |* d
1 K" a: e7 z, tThe way it works is very simple:( K/ n* N9 ^4 U3 N0 F7 X2 }
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
7 q. R% s6 R/ M, K2 O8 S, hWinNT) with the CreateFileA API.7 C: n* O+ i$ ~5 b
9 P+ H3 M# A6 n. A' E4 o5 L
Here is a sample (checking for 'SICE'):, h1 D# c# U/ [5 u, Q( v- \
5 J0 T" P+ ~; e" M) {BOOL IsSoftIce95Loaded()
$ A5 r# z6 p/ X7 W' a{
& i0 n9 U5 D3 V; H; d HANDLE hFile;
% w+ h& l! t% n hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
( s b# |, y: G3 B, d* K FILE_SHARE_READ | FILE_SHARE_WRITE,
1 K( ^( q, H& N" h0 O# K! s NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);- @. b9 ~; X6 ]1 i6 v% L1 i' s
if( hFile != INVALID_HANDLE_VALUE )2 T: W3 Y; E" V/ J
{7 p% K- ~1 o( i2 }8 Y7 R7 y% q- ]
CloseHandle(hFile);3 }2 p' R, X2 ?$ K
return TRUE;
9 {) }1 u5 g' h: p }6 U; q/ d6 G" b9 ?% G1 X
return FALSE;3 b% P2 p1 ?8 P7 \# `+ S% o- h
}
% `9 J. a- M# o9 f/ B7 Y6 f! H) e! }0 F! W
Although this trick calls the CreateFileA function, don't even expect to be# c5 o1 Q6 D% m0 L. c, s" Q
able to intercept it by installing a IFS hook: it will not work, no way!( n7 P! a' b1 g3 v
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
/ b V. o% Q2 Y9 k! tservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
) u2 S$ {5 b) B band then browse the DDB list until it find the VxD and its DDB_Control_Proc
" `8 {0 |. w: Rfield.3 l7 l4 s% u- q( n. m( c
In fact, its purpose is not to load/unload VxDs but only to send a $ }: b% {6 g4 c$ V4 }0 y
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)/ g6 H1 ~. S# g" _1 ~% |! n2 A
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
. q/ B7 S8 v) kto load/unload a non-dynamically loadable driver such as SoftICE ;-). G B: X/ h! X: p% q" x
If the VxD is loaded, it will always clear eax and the Carry flag to allow7 H4 l2 E/ S6 V) \: q3 m
its handle to be opened and then, will be detected.( X9 F" N8 W: V# H
You can check that simply by hooking Winice.exe control proc entry point
. L2 p8 e" M+ F) u, swhile running MeltICE.& k4 l; s5 Q2 j8 ?: P3 ?4 e
' I' C: A2 N p" S6 j0 b
( ]! j d+ i( J6 z& b+ Y 00401067: push 00402025 ; \\.\SICE
4 K. x& I( w7 t" D3 x \ 0040106C: call CreateFileA& a" m7 g W# ]# Y( Z7 S
00401071: cmp eax,-001
g: ?% ~: g) c% M( p: a 00401074: je 004010917 u! P. x7 d o! l* j+ D
2 v! `6 g" ?+ b' m
7 M9 |* C3 `$ u0 zThere could be hundreds of BPX you could use to detect this trick.
! w1 U l- S4 E h/ j9 L* ?-The most classical one is:# o. e' G6 j) h0 H
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||7 h& x& J3 I _2 q2 d5 _
*(esp->4+4)=='NTIC'
3 G# b* s! Z* W: u* b; I. i7 _% M
-The most exotic ones (could be very slooooow :-(+ Y$ u- i, y O0 y) M* h$ j
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
! R8 O* S8 E+ F ;will break 3 times :-(2 Z& I& p9 Y+ w7 R, L! G, D1 Q
5 E2 |& ~7 j t3 T( \7 a) ~* ~- _" {4 j-or (a bit) faster:
; t* G d- c' t0 X BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
# C( k1 y7 A* R2 z
0 U" o! \! f6 b$ _ BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' 3 q+ w( U$ s, D1 W5 y3 Q6 r: t
;will break 3 times :-(+ a4 q% V/ B! H0 M7 O6 |$ I
/ K' `# H8 M; r9 i* f-Much faster:
. U% B8 l, b, v3 e, K5 U BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
/ V6 `' ~" r" x
( C7 o# ~8 I2 jNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
! `$ g) Z8 u/ Q/ B: zfunction to do the same job:
: Q/ Y& }" P2 P0 U9 l! k. b
1 c* H! L& l7 c+ U4 t push 00 ; OF_READ
( _( ?2 q( k$ U% I8 ] mov eax,[00656634] ; '\\.\SICE',0
8 S/ ]. f: ?* h# u% Q: x push eax2 A& `: U" H* W( @2 H) I0 h7 t
call KERNEL32!_lopen
( \; T3 J, R$ t. Z% O inc eax, s4 ~- b3 }! D8 J: E* w
jnz 00650589 ; detected# \% L' ^8 v8 N# f: `' O
push 00 ; OF_READ
' ^, d( q+ S. r1 a) c" }0 c mov eax,[00656638] ; '\\.\SICE'7 m6 y5 H6 i$ y: ^0 v; E
push eax
; y8 H5 ~* d# `' F# q2 W call KERNEL32!_lopen! }* P; x) w% V7 r& q
inc eax) D. A9 @- m: h; j
jz 006505ae ; not detected
0 e7 p- m# a5 z% U! m4 Y3 r2 W7 g ^
+ j$ A, s5 ^6 v: B9 q" R6 ?* J! q; D R- [9 W! |
__________________________________________________________________________
/ I5 \1 j; k+ I4 w, m- l7 ~+ t( t3 w6 U( \2 K
Method 121 F" h: g3 q! {8 L# U1 Q' N J
=========3 X# y' F* D6 b, y
" U! D# T+ K" r# [' O: k5 X ~6 b
This trick is similar to int41h/4fh Debugger installation check (code 05
1 g1 v" v$ h: S& {# O% c& 06) but very limited because it's only available for Win95/98 (not NT)
! {5 F% A9 l+ D+ E% ^' X5 Pas it uses the VxDCall backdoor. This detection was found in Bleem Demo.
, ~* g. z c. Z* {3 p0 i* `" T$ ^7 K0 t0 [
push 0000004fh ; function 4fh
" M3 i& r9 v7 V' }' B push 002a002ah ; high word specifies which VxD (VWIN32)
5 ~& x4 I Z' y) a* @4 Q ; low word specifies which service) f6 U o! G9 t9 g
(VWIN32_Int41Dispatch)
% v Y. F- M) ] call Kernel32!ORD_001 ; VxdCall
. x" Y; X- I% g cmp ax, 0f386h ; magic number returned by system debuggers
$ P& D ^/ Z# u2 g2 F jz SoftICE_detected3 t4 u- ?. H3 v g: O
! N4 [: [6 |: k+ n4 s. P; r) Q2 RHere again, several ways to detect it:
4 [) D9 b8 i# l9 N, D% Q) K$ m) B8 N: |" P- t; o" D
BPINT 41 if ax==4f
5 m. x# J/ x$ F3 ]8 H( c0 i& e4 ~+ T9 i) T
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
0 h; f c# G! X/ a X9 X
+ G5 ~0 v% S) V; i BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
6 I8 C: p: M* D6 z* Z1 J+ W$ W4 D: K1 B
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
# K" a9 n& S F3 f$ B* F3 Y+ l4 D8 a: P
__________________________________________________________________________5 N/ M6 v7 D7 Q7 X" G
# F' e9 @0 O2 N U: x- c) t
Method 13# _' q/ {7 o8 x7 z$ H$ L# `$ [
=========
: i5 u$ M5 C3 S" M [6 a/ d- w' A4 ]3 H/ h! U: ~
Not a real method of detection, but a good way to know if SoftICE is# v0 e5 x4 q+ x/ O
installed on a computer and to locate its installation directory.+ e- U& P6 c/ R# e* R1 _8 Q
It is used by few softs which access the following registry keys (usually #2) :8 _+ P; q: p( b0 d
$ f# e8 H: K+ U) S# }9 e
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
# P1 T% J$ O1 q4 [- R\Uninstall\SoftICE1 `( x4 }" ^4 F) F' P4 `' ]
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE- M: ]; k8 B1 P( X, h) K) Q% r
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
; D2 l' u+ [6 u7 S/ `) Q+ ~\App Paths\Loader32.Exe
! \+ z/ k, k+ p$ u i# p9 l( r% d* M& r9 c* s, ?, Y, T
$ A; I* x$ X4 ~/ i4 fNote that some nasty apps could then erase all files from SoftICE directory
: r7 Z' a8 z6 f/ A2 y. P(I faced that once :-(/ |4 d U, p. |2 y4 g' e" S
1 o. _( U. ~, }+ }3 MUseful breakpoint to detect it:5 L$ @* A$ g6 f0 W
`: s1 g( t% L/ N' x
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'6 f% V, y" ~& i9 _$ {& a G
0 m" V( S! v& s0 d7 T__________________________________________________________________________
1 l! X0 l% L0 ^ K8 q8 o6 A8 G/ N( M$ S+ t' h, J: X7 x) {
. z/ Y4 S1 c6 x! z0 x" \, OMethod 14
; y+ ]8 r/ @2 u9 \: V' B=========$ Q% N9 K# V9 f& q- `* K0 b
/ N4 N7 F) ^( V) B3 s/ H
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
: Q7 P# q4 b5 U- D- Wis to determines whether a debugger is running on your system (ring0 only).
+ a" l$ l( ~% A; y- T3 |' n( K% I- i) D
VMMCall Test_Debug_Installed
/ w% ]/ r: n, V6 q& B& e je not_installed* E1 C0 D/ B* e/ B1 t$ j
) ^/ A6 r; y% f; NThis service just checks a flag.
1 T6 }0 x' U) I# M, @</PRE></TD></TR></TBODY></TABLE> |