<TABLE width=500>* C+ m% _5 o. e6 u
<TBODY>
/ ~) E5 B& k0 K5 q<TR>
, k9 H' v; D) V& p+ I<TD><PRE>Method 01
# b+ C5 i/ P: T/ P3 k- G+ a=========
* ]3 n4 _5 \" X! y5 [; h" i# @4 A+ I# H9 @6 X! `: t" a
This method of detection of SoftICE (as well as the following one) is1 Q3 g. d0 J6 J- r$ Y- ^' a
used by the majority of packers/encryptors found on Internet.
9 ?. z0 j" Y. Z9 f5 n1 X" PIt seeks the signature of BoundsChecker in SoftICE
( u5 f5 t( d F. o( n
4 G, a& @0 W" o mov ebp, 04243484Bh ; 'BCHK'4 m# |( J. F0 r
mov ax, 04h
/ ]) |3 t" W. k9 e int 3
8 s$ N7 b1 Q5 h8 g+ e i' S cmp al,41 e; Q# N0 \4 ]- }& l" l, Y6 B
jnz SoftICE_Detected1 D: u: {8 n& Y# T: R* @
' S7 J0 t) |' K' M: d
___________________________________________________________________________% |7 T, r6 h$ \4 }% c2 q
) ^2 E3 a; x; A. t4 i" a$ n: bMethod 02/ M. |. s; Y5 D4 j! h/ v
=========, n3 p1 h4 E0 E! S4 M% B
. e+ v' `) b* n4 h: o. {
Still a method very much used (perhaps the most frequent one). It is used' O" {1 S% g( b) H/ `( b
to get SoftICE 'Back Door commands' which gives infos on Breakpoints," r9 ?3 X ]3 M7 M/ |/ }
or execute SoftICE commands...
% P# i9 h) \ n1 zIt is also used to crash SoftICE and to force it to execute any commands
8 E4 p6 z' P% Q& H8 R(HBOOT...) :-(( G7 t0 H- |$ l$ e( B/ f
( X1 I# F3 O' W: q+ Q9 s2 E1 MHere is a quick description:6 z0 g8 V5 `4 e7 I
-AX = 0910h (Display string in SIce windows)
; s) Y0 `( J7 F-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
* Z1 J- S, v% R7 F-AX = 0912h (Get breakpoint infos)& R, |0 j. o: I4 R
-AX = 0913h (Set Sice breakpoints)
% J2 v4 T5 V! z$ B1 |- H-AX = 0914h (Remove SIce breakoints)
0 \" z( N9 G' ]6 h, j8 @- j8 H* p
Each time you'll meet this trick, you'll see:
' w( |" ~7 d9 o# I/ S-SI = 4647h
) c# ~6 p5 i& ?3 [7 k. M-DI = 4A4Dh
5 \& M8 K7 q' S& R. pWhich are the 'magic values' used by SoftIce.
- H* Y: Z8 @+ A& @2 Z. SFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
' x* ?) |4 x9 D3 Z& {$ O8 ~8 W0 d+ r. f; O$ Y8 L1 e
Here is one example from the file "Haspinst.exe" which is the dongle HASP
1 d2 d. ], J F; r; O/ C8 O2 h7 Y; vEnvelope utility use to protect DOS applications:7 V. M4 S7 @+ X: B# C
, l. e, y6 h! H+ k! q7 H
5 n0 D6 S2 g5 F' L
4C19:0095 MOV AX,0911 ; execute command.# I0 ^: O" Y' N7 s! H' d+ R
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
* I5 o9 u+ Y% q% Y2 c, g4 `1 E4C19:009A MOV SI,4647 ; 1st magic value.
( v5 R3 [' l5 ^8 _# Q" i r# L4C19:009D MOV DI,4A4D ; 2nd magic value.# E, C0 u2 t2 g! n/ g
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
4 x; M* G1 R, C* t4 m4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
, G* W: Y0 z3 k+ U) U- G W. t5 n) X7 x4C19:00A4 INC CX
5 e; j* x3 `0 F; ~* b: i1 ^% s4C19:00A5 CMP CX,06 ; Repeat 6 times to execute D3 y( W! M6 O/ n& F& r) I' L
4C19:00A8 JB 0095 ; 6 different commands.& l; a, j) {/ {0 s
4C19:00AA JMP 0002 ; Bad_Guy jmp back.
I; s ?3 j8 v0 |! Q4C19:00AD MOV BX,SP ; Good_Guy go ahead :)4 k: p( Z. A0 \% w
& d" \) o% y! l- Z5 r# k+ m1 j: tThe program will execute 6 different SIce commands located at ds:dx, which: ~0 k. p- C- a; K
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
# N2 c9 I% h- a! U
; e- X2 q% p) }+ Z% p( f+ m* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.& h B) d _9 G3 a% g1 I" U
___________________________________________________________________________8 d- Z' U, c" E$ ?: k+ \
. m! }( j" p* m6 z2 |$ Z
$ L, L( u1 ^6 xMethod 03
( |5 ]1 L. h7 v. B=========5 _5 X" j; |: p3 z
& y7 m& c& c) e
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h. {/ o6 [+ A+ _/ O
(API Get entry point)
2 e3 R: H% Z7 r " H% ]5 f' O$ X) P5 `. ?
, q- Z$ N# A" o" Y1 u
xor di,di
. \0 f: @! t/ L+ @8 d, k* } mov es,di
' R6 X/ |! Z; r mov ax, 1684h % O$ S8 D% Z# }% G0 o) |9 u) G6 C2 X
mov bx, 0202h ; VxD ID of winice
: Y: L8 b3 X5 L" j' M) B6 U( N int 2Fh
* s$ \/ b3 a$ u# ` mov ax, es ; ES:DI -> VxD API entry point$ D! z9 B4 h: y& G. R5 o1 i) @5 O
add ax, di b7 N X2 X0 [" b/ _3 p q. G- C
test ax,ax
3 K& {4 h, X/ o5 o jnz SoftICE_Detected
, |1 Q6 L# W9 o! ]- Z+ Z7 k* ^+ q3 q" Y5 Q( T
___________________________________________________________________________4 b3 ?! V" t7 f& @9 t- [$ C2 Q+ o
" |* B! ?5 r$ E( ~% a
Method 04
# ]2 v4 ~6 Y6 @+ X=========
) Y2 x$ \1 x. O
% I' q# R) e9 n: f( v" x$ {Method identical to the preceding one except that it seeks the ID of SoftICE, L+ O: c- l; e/ ~ D( X' r
GFX VxD.
f& `) ? ]; M( _4 @
/ L- N! Q! U- y: A' ~% K" O xor di,di6 g1 I7 ~9 G8 C7 p. G }, _
mov es,di9 o* W) F! f" u; W1 _
mov ax, 1684h
8 f( a3 b6 q v/ T' A* _6 ]1 j mov bx, 7a5Fh ; VxD ID of SIWVID$ @4 `/ K: K& M+ y* e" [
int 2fh7 b) k1 l9 I6 J% F; Y' x
mov ax, es ; ES:DI -> VxD API entry point) W! g( r5 H$ m0 O x
add ax, di( x. h% B" |, n9 U1 _' Q) {- k' `; ^
test ax,ax
5 ^2 N9 p ?1 D$ I" `# D jnz SoftICE_Detected7 f0 @2 J. W. M, {2 ?% T
- ~. p4 B5 s1 Q* a5 L__________________________________________________________________________- C/ y, e1 S. H, ~
_+ T- m3 K/ x$ k; ]4 {
$ }% X4 n9 X) F3 e; a
Method 055 ~6 m) ^ d9 u$ J
=========2 q V- X L: e0 c k/ R) W- z
5 x! R0 j5 A- |6 K8 l; [5 C
Method seeking the 'magic number' 0F386h returned (in ax) by all system
7 ^( U8 [. r9 P- l- p1 W9 Edebugger. It calls the int 41h, function 4Fh.% L7 w0 Q6 \7 ^7 _, t8 [
There are several alternatives.
% z- }# ^3 K. O
^& ~2 |6 ?6 x- d" m+ ^' r/ t% dThe following one is the simplest:
8 D" ~' f! z/ z- Z. L# v( a i8 ]
q7 p; r6 m% l+ |' ^# u mov ax,4fh
( t4 d) [. ~. ~% B int 41h
) T8 W) S- m8 J. v6 I cmp ax, 0F3868 O$ |* G( \2 E, N/ ?. N8 B9 k
jz SoftICE_detected
$ d$ C: b% Z. E) r( Q- O2 C- A% ~% r0 ~2 L' e) j
e) s1 Y" N! l- C5 V9 n: p2 [( s
Next method as well as the following one are 2 examples from Stone's
# {" y& ]9 z0 R+ j9 Z"stn-wid.zip" (www.cracking.net):8 W* I/ x* W' n6 h9 x2 h! o+ W' [
8 R* u! y* _ e mov bx, cs) x( U& T: L& l2 B
lea dx, int41handler2
" p& \3 _, ~+ f xchg dx, es:[41h*4]9 w! }6 Y4 F0 L
xchg bx, es:[41h*4+2]2 ~/ N) `# }# j3 D. Z- S3 c8 c0 {# a4 Y
mov ax,4fh
2 i. m1 {4 w r int 41h
# W5 G& ]7 y8 {, G5 M xchg dx, es:[41h*4]& {. D" @. o: U3 o/ P
xchg bx, es:[41h*4+2]
9 B. a7 k3 y% v5 o( D cmp ax, 0f386h* `; ]2 e6 j* a, K: N
jz SoftICE_detected5 L: ]1 K6 g5 f$ g2 b
' ^. V1 y6 Z; X6 r# O& M. Kint41handler2 PROC3 l ]' O) w" I- B! m) r7 B3 \
iret- `- O v) W5 t/ W& D7 n4 A
int41handler2 ENDP* x) Z. x2 S( y$ b" u t
9 \# i0 _' `" a" V9 a: p
# u/ v5 |0 \! w* r0 m" x4 C# D' k
_________________________________________________________________________8 c0 u8 T1 v0 m5 ?7 n
0 s; M# X- W3 J! i
3 E: |3 a5 W& iMethod 066 v( Z) M0 v8 u* j, b
=========
* o, m! L' P2 k8 ~. U1 q7 ?& U3 u0 ?# A) s
/ N- U( p1 I% {3 J. a& f
2nd method similar to the preceding one but more difficult to detect:
1 K% ?2 V+ F/ L7 F9 Z" V( ~4 |& U
8 M ]) O; e q( ] t! g5 f1 G+ o/ Y; g9 E1 O
int41handler PROC% x+ O/ ?1 t: i0 c- q/ L: E# b
mov cl,al
6 @! ^( U6 x: ~! i iret( E1 c) B* Y. |' D* I6 O, s
int41handler ENDP2 h( z* L7 R. w1 M2 n7 S$ [) Q
* B' P7 z. \: m4 {. H* H& d. m+ v5 t4 h* k" R
xor ax,ax# M( e( J I% \( F
mov es,ax
5 j7 g: k$ f, W! w+ m mov bx, cs
" X- j" F. G$ i1 E, Q/ ^6 i lea dx, int41handler8 B; e- _) k4 A# B" |
xchg dx, es:[41h*4]3 _ C! a% A/ T+ _
xchg bx, es:[41h*4+2]" L/ l0 w5 M/ T) R& @2 ^5 f6 Q
in al, 40h- P' b, k6 }( p7 v% C
xor cx,cx0 v" F1 l! @9 ]. v2 m2 W* H
int 41h/ G( X- A9 S9 H1 r# s, B' R$ T
xchg dx, es:[41h*4]3 \& J5 H; R, ?! j1 X, j4 [6 |
xchg bx, es:[41h*4+2]
: r: j/ v8 c K& u/ a0 F cmp cl,al) E9 s' N. `9 k
jnz SoftICE_detected
5 Z* R- U8 l9 _7 Y3 d5 L0 ?2 b2 A" S+ F2 D' l* W1 {9 c; j3 {$ W. y
_________________________________________________________________________ E, K' l1 i+ \
7 y' }+ y& b$ g, N& vMethod 07) A( V! L, h$ R3 R1 @7 c, @+ y
=========
- z$ s9 l' h. w! t3 `6 P( j' L7 U2 O; m7 n
Method of detection of the WinICE handler in the int68h (V86)
" ~1 ?- h" S7 F
+ q9 f) E# K& C0 e1 C# k mov ah,43h' O b$ \2 x' R
int 68h" w9 ?- i! @8 Q" @
cmp ax,0F386h4 S& D* ~# n6 \+ k' d
jz SoftICE_Detected
+ i. t7 j4 [7 v& n1 x
5 l1 X. j# Y! n2 b! J+ N! g& `; T/ _9 z6 F+ M# T; S3 S+ c
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
! \$ `% S( g; q7 \. p6 W- N app like this:
& x% D" k' e7 u
$ ^# @, h/ t5 ?* Q9 H BPX exec_int if ax==680 o0 l+ R& r% d4 J, H9 h; k b; F) P; ^* L
(function called is located at byte ptr [ebp+1Dh] and client eip is
' O, r" [: @7 F% |! L# u$ n located at [ebp+48h] for 32Bit apps)
0 k7 y9 V% _3 D9 J__________________________________________________________________________
, U5 L2 ~3 K; |6 r$ \
( U8 w7 L$ j; ~' l8 M, z* \/ E% a$ t- U; i/ E y
Method 08
" v/ R& z8 T _+ ^ }=========
# }$ C8 @0 f0 a, O* O {* i1 Y. L0 h7 b7 f: f `
It is not a method of detection of SoftICE but a possibility to crash the
1 ]" x. ^, \ I, ~0 z8 |! X5 Zsystem by intercepting int 01h and int 03h and redirecting them to another5 l: |/ y7 f& `2 X9 a* X, @
routine.
4 U1 k; U& Q# v5 U: L' r) @, }8 _1 bIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points) M+ d, k4 g3 [
to the new routine to execute (hangs computer...)
$ _( t" B3 l- {4 K4 I( V) @' q0 J& \: O; F. b& j" R( R$ [7 d9 _) w8 ?& Q
mov ah, 25h
6 j% z' f, z1 a, ~# H5 q mov al, Int_Number (01h or 03h)
/ ]2 F5 g- d- E! a mov dx, offset New_Int_Routine. A |% R$ ~) t& d+ g! N0 U
int 21h' e b7 M4 y1 h! j
+ k, [" J7 c2 v
__________________________________________________________________________
W: Q9 o1 j4 u/ k; s
, p: y0 I* s; e5 N9 VMethod 09: a* }( C6 c7 W1 S
=========$ n; a [* ?2 S* F& \0 V
9 e2 H$ r4 a: s: k: J. g7 CThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only. w! ]) f6 K) ~% O
performed in ring0 (VxD or a ring3 app using the VxdCall).
# H" `' Y- _4 C- j. @The Get_DDB service is used to determine whether or not a VxD is installed
8 l4 j& H! l o# W- h3 Qfor the specified device and returns a Device Description Block (in ecx) for
' w( S$ {/ v% Hthat device if it is installed.' D+ @) F9 r5 _; k! I! f
4 U/ r7 h, K4 t" G) j+ Q
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
) L2 z* H0 D, i; z6 L/ \, {3 N mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-), y4 x6 Q1 c' K7 b8 ]; Z% @
VMMCall Get_DDB) d+ a; v2 t8 q$ a6 f' D
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed" Y- J5 n0 E" M6 `, y
8 q2 ?: E8 s* i& h( j/ ?: W3 J aNote as well that you can easily detect this method with SoftICE:+ w3 F7 X0 d) Y0 r* y. {
bpx Get_DDB if ax==0202 || ax==7a5fh4 B, l9 f% @/ }$ W
+ n5 S" n3 G: [0 W. O__________________________________________________________________________
* t+ x, r9 O4 A: ?# r q: L: r( [6 R* J7 @% S! R
Method 10
0 B% h8 m, d* Z" X$ R5 C. ^7 R=========1 Q: \9 F& ~; d! t9 ?9 y3 f# q4 G) ?
6 g8 `; H- t8 W
=>Disable or clear breakpoints before using this feature. DO NOT trace with
! T O/ z# Q& M# S4 A2 {! [ SoftICE while the option is enable!!
7 Z, X0 ]! t; @' o, U" |0 W: n3 L2 I" x, j0 J
This trick is very efficient:
* a( T! w) z; x; Iby checking the Debug Registers, you can detect if SoftICE is loaded2 L: H- P% {, {% K- t
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
, t5 p: M3 i" tthere are some memory breakpoints set (dr0 to dr3) simply by reading their
' y- `' ~9 M1 ?4 O/ m+ \value (in ring0 only). Values can be manipulated and or changed as well
( L) }3 U4 y- J# k) f+ F(clearing BPMs for instance)
. V. C) R5 L: D }4 m3 G
# d4 l0 B/ m- K9 S__________________________________________________________________________( w0 h5 f% y2 ]/ o
, R6 ~0 I9 q* j3 oMethod 118 _3 x1 I" m; x8 R# {8 \
=========- O7 x0 B% t' ^& |
4 ^! T. }2 Y: `7 ?" kThis method is most known as 'MeltICE' because it has been freely distributed
$ W* S5 j' Z* d: U; L" xvia www.winfiles.com. However it was first used by NuMega people to allow
8 z. l5 S) Z( D- ^. ZSymbol Loader to check if SoftICE was active or not (the code is located
, I3 A0 F8 W8 q7 q2 Kinside nmtrans.dll).0 h% V8 o0 q. x" W. b" D
5 h$ @. U3 ]1 FThe way it works is very simple:& _# G/ u; q4 U8 S1 L
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for! }, C, H3 D: N8 ]& a6 J
WinNT) with the CreateFileA API.
5 g" v' D) w" \: S1 j
& {: F1 z& `' p- T% zHere is a sample (checking for 'SICE'):: b: j. k6 x7 X1 c
2 e5 Z. P. H/ [) v$ g' S6 R! N1 j
BOOL IsSoftIce95Loaded()1 N* D# }! q) r0 _6 g4 \
{7 s. B9 m9 m: t0 {5 ]8 k! V
HANDLE hFile; 5 L3 o# N7 h! o! _2 M2 l
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
$ q D+ x! g# Q FILE_SHARE_READ | FILE_SHARE_WRITE,8 M2 H0 C1 ^; ?
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);( H, \0 l5 K0 A
if( hFile != INVALID_HANDLE_VALUE )
" S9 r; G9 n% S {- G+ b g1 C# E5 H! y! u$ j
CloseHandle(hFile);
' d" B9 y' k) }: J return TRUE;
; _' M5 H, c7 R+ e: r( l2 f; v9 I \ }
6 S* Z6 e! k2 h% f( J. T* | return FALSE;
3 a; ?2 o4 B: N( g. |: @}
3 {) q; Q* b2 a& {8 Q2 \7 X1 P2 }2 L5 d# X
Although this trick calls the CreateFileA function, don't even expect to be
+ z3 A' E% @5 E; f- @. r5 Rable to intercept it by installing a IFS hook: it will not work, no way!
* U) I5 Z# \1 R/ i+ HIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
4 Z- Q6 M+ c* xservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)7 a) d# y }2 i1 y( O: h$ g
and then browse the DDB list until it find the VxD and its DDB_Control_Proc$ N n& {, |7 T N
field.
6 e& r5 [2 Z& U! ~In fact, its purpose is not to load/unload VxDs but only to send a
- x: n/ }) r+ q, d5 \7 W! e3 YW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
3 g# }0 i" b% O& s! Sto the VxD Control_Dispatch proc (how the hell a shareware soft could try' J, h8 E' [4 a* \! F" U* d9 A
to load/unload a non-dynamically loadable driver such as SoftICE ;-).8 k- N$ _- c5 n9 I: {
If the VxD is loaded, it will always clear eax and the Carry flag to allow
0 D/ B& `# [, zits handle to be opened and then, will be detected.
1 B0 ]/ v0 d8 U P& _+ o5 Z6 VYou can check that simply by hooking Winice.exe control proc entry point) n6 Z+ R: F5 C9 D' J" V
while running MeltICE.1 p7 }% H3 ]/ K7 a% |' ?
! b O* q1 X; |& L, x8 s" H1 U$ O
3 [4 K( ~/ p5 O0 j& m4 Q: |0 i 00401067: push 00402025 ; \\.\SICE
! B2 b5 k$ L* u7 [% X1 G; h# u- z 0040106C: call CreateFileA, ^! r9 M6 t& O# C6 k" ]" q3 {- S
00401071: cmp eax,-001
- | T! r7 Q' r0 r8 t 00401074: je 00401091
$ d! |# |+ [4 G" v1 p$ G$ H2 n: M+ s! l' y7 d
5 ?# a/ w' _3 Q# j E* S( S6 h
There could be hundreds of BPX you could use to detect this trick.
; B- E- X3 _: Q3 R3 f7 c-The most classical one is:% k; b2 f" ^/ S. H @# q
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||# L8 M" W; Y& Z, g' }) k* W3 x
*(esp->4+4)=='NTIC': t( A9 x) k8 E; f
- O9 d. F) x" z$ a# c8 q7 d-The most exotic ones (could be very slooooow :-(8 g) ?2 ?( a" K6 P5 U& F9 o- D# s
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
. E8 ~/ {' z) f, l0 U- Y1 W ;will break 3 times :-(5 G: s7 S/ w- @1 _1 @* Y
- T0 S( v6 p" z) ?" d1 V-or (a bit) faster: 4 H8 {: k; o+ r1 E6 b$ @
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
! P: {4 A. e% _, F5 T* p: v* f: C- O$ K8 F: X# B" N
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
; L3 ]: J& p; i' b d ;will break 3 times :-(
% I6 H: @: m1 ~) x/ d, ~' Z$ T
' `) ^7 C | q: ?% ]% s. E5 l-Much faster:
/ d* N+ Y# A) Z1 R BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV': z0 B; N& H* ?/ J1 h' a Z. |
) Y- @0 Z( Q8 @
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
8 u/ x R. `2 k1 ]/ @# \function to do the same job:
9 J( H! E+ U3 D4 x# g8 R5 z2 P7 j# z {0 @
push 00 ; OF_READ
" f" |* w' U1 d+ ~7 _$ E- F mov eax,[00656634] ; '\\.\SICE',08 b) |- a; {! d: K- |5 Q* c1 V% s
push eax5 t5 V* d' y( p6 ~) H
call KERNEL32!_lopen
, E4 ?- B7 Q) d8 P5 |" q inc eax/ I) N; J R" r9 y L$ _+ P
jnz 00650589 ; detected* d5 m. S: M: ]) f. s3 @! j5 D4 f G1 D
push 00 ; OF_READ
7 s- G+ w( n9 l7 D mov eax,[00656638] ; '\\.\SICE'
! D- t. i8 o# v* e L push eax* k+ ^ t( B. C" W' N+ a, m
call KERNEL32!_lopen9 S2 r2 S) N$ ?- A' j: t
inc eax
. G: X( b9 f% B( l jz 006505ae ; not detected
. ^" u2 N B& n: v3 ]$ w, A" \0 a2 K+ C3 Q/ I2 [& a
2 }6 R% I0 \" z4 ]; G8 _* S
__________________________________________________________________________; \# r! N8 X! [
) @( E, u) n( Y5 B2 W6 L9 GMethod 12
9 h E& t6 P- F=========
' p) O3 e5 r1 K" t( }
6 q" z5 k! Q" R5 b" h' _+ j" IThis trick is similar to int41h/4fh Debugger installation check (code 05
# T1 i. q7 ^- |" m& 06) but very limited because it's only available for Win95/98 (not NT) c1 E. {" U0 D$ U: x
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
+ e, d. g* H+ Z, U- B! f z2 U4 x+ W9 c: D- R$ w3 A+ Y
push 0000004fh ; function 4fh, e5 {* V; N1 e |$ x
push 002a002ah ; high word specifies which VxD (VWIN32)& b2 V+ E0 C) j/ z3 r+ U. a
; low word specifies which service
- l2 U% Y% ?! i& A+ Y3 i* E (VWIN32_Int41Dispatch)9 x8 j$ m+ h% |! C5 H
call Kernel32!ORD_001 ; VxdCall) X% e! E. I& J$ d$ U' ]
cmp ax, 0f386h ; magic number returned by system debuggers& @! i0 z. j# Z2 f
jz SoftICE_detected; }) W/ G9 j* C
( Y9 c( c2 ^! B1 @
Here again, several ways to detect it:& g5 D9 u7 W# B
5 y9 ^$ Q; H2 V BPINT 41 if ax==4f
( W6 ^' D- o" O* ?! B. f) M
7 C, U; i, k* s& B7 y {$ ^8 ^ BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one: Q T% x: n4 ^' ]$ g/ j
% G) I/ _9 i8 I/ K' d. i7 Z BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A8 n* Z' Q1 f+ q g
( s& G% q f$ J3 K BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!: e, M) o+ L! u9 J
' K3 v6 ~5 u7 E; F; M
__________________________________________________________________________3 G) B4 [# }$ `$ w+ X8 o6 g% x
1 a1 C P& {8 V' w0 X- T
Method 13- m: g0 t1 M$ s6 K$ |0 L1 |3 R
=========
, @ {7 ~ o: z- y5 F, E4 K7 c- U; N; K# Q, I/ p
Not a real method of detection, but a good way to know if SoftICE is" l& A: K5 o7 z9 P8 ^
installed on a computer and to locate its installation directory." F) d r- B5 \" `, ]2 e4 w9 d
It is used by few softs which access the following registry keys (usually #2) :
# e( ]) o" Z; |- u* z0 _9 u+ G. y d: @! C
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion8 A* Z2 i" P2 s8 A9 u* {7 t! }+ X
\Uninstall\SoftICE# w; f) b! h8 H9 h/ a N7 j
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
t* p8 A+ B+ U( j" J-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
3 g1 p) p% n/ w\App Paths\Loader32.Exe0 u0 [- Y9 Z' I" l/ Y0 r
5 k. y: E) R( b& S- `# ?. l' }& J: a% G3 P/ n
Note that some nasty apps could then erase all files from SoftICE directory
8 U @, S+ E6 B2 q# m(I faced that once :-(. D8 P+ |9 L6 n* S' e$ l0 J: i3 I
7 s" G; Y0 n5 a9 i* @ M9 \) T
Useful breakpoint to detect it:3 w0 \2 P* X, X; ?# p
, A: f* f1 _7 @: B BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
" [; L; B0 ]1 j5 p/ Z) s! r* Z- u" L% f
__________________________________________________________________________( c* S, I0 [- s: a/ b
1 w- A1 {" H C1 c
. r: N+ h+ B7 L! h, w8 ZMethod 14
! G# D+ U) F5 a0 p. c=========) q. r! i; K9 {7 y% w
" X% e2 k5 A" R8 n& V8 Q4 Y
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose2 x- E; s% w0 m* K
is to determines whether a debugger is running on your system (ring0 only).8 p: ?) A' i7 c: Y
% s' h. y9 V4 b. J3 n
VMMCall Test_Debug_Installed
- v: P$ J3 c' i6 C5 w. Z2 Q/ ` je not_installed
) ?5 F) ?1 b5 l! S9 B0 c/ Q) }6 f" C5 {! e2 O9 n+ O
This service just checks a flag.# C) k2 n- b# V8 _
</PRE></TD></TR></TBODY></TABLE> |