<TABLE width=500>
% Y2 n* _2 a0 {<TBODY>6 _/ ~% {. g/ {8 X
<TR>3 |% J8 m, O# F* {9 U: Q5 X
<TD><PRE>Method 01
6 I3 o1 Y* W6 k6 o$ M, @4 w% d=========
+ `$ }. |# I# h3 C( N& z5 s/ G* j. I' w) h8 q
This method of detection of SoftICE (as well as the following one) is
0 O- V( P. {4 Y* Qused by the majority of packers/encryptors found on Internet.
8 ]0 d$ x$ k1 I, l! o5 rIt seeks the signature of BoundsChecker in SoftICE
: B% N! D5 X: ^7 g4 W; C2 P. ^- @! J0 h; E0 ~4 ?1 ]2 J
mov ebp, 04243484Bh ; 'BCHK'* V; N& W) |7 |- f/ s) j
mov ax, 04h
7 ?! m' \1 q$ e" u( a int 3
/ b- ?, x4 c- F- B3 {& @6 E( Q. R5 C cmp al,4
- H) j4 G. r; {5 U- l4 y jnz SoftICE_Detected
% C$ f6 Q T3 r$ }( R/ j0 I
# g8 ~3 h6 q( }) q( r( S$ J___________________________________________________________________________! Y7 F+ Q8 [ W# c. z# ?! t- v
0 @) @( | S( t. w; k- Y5 O
Method 023 f& `$ u/ d- F% k
=========
' X4 _$ Q3 m+ C" R O* B% y7 H& P9 G/ ^$ K, C6 p
Still a method very much used (perhaps the most frequent one). It is used
3 u( T# c( `- J2 B' L5 c7 ^to get SoftICE 'Back Door commands' which gives infos on Breakpoints,8 a: b8 l4 n1 r7 ^5 b8 t; k
or execute SoftICE commands.... k/ _6 m) D6 Q- @( p
It is also used to crash SoftICE and to force it to execute any commands
/ Z# ?" e4 l2 i(HBOOT...) :-((
" O- H- V0 _" _
# q$ i) Z" x4 B! y* ~* YHere is a quick description:/ P- Q1 l" h/ o3 ?# I
-AX = 0910h (Display string in SIce windows)
% W7 k7 t/ Z1 q0 R-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)# z R/ ?- }2 s$ P! U
-AX = 0912h (Get breakpoint infos)4 S. |/ l2 B9 L2 d
-AX = 0913h (Set Sice breakpoints)1 T- g9 o# z. h S
-AX = 0914h (Remove SIce breakoints)
c b- \5 i8 k9 U0 l
. ^0 A- }* V- D7 N' F, `2 K! T: dEach time you'll meet this trick, you'll see:, P$ E+ D7 l6 K4 q) O) M( @! s
-SI = 4647h
# e# S& u" i% p! _-DI = 4A4Dh
, p' k& ?0 }: ?+ ~: [Which are the 'magic values' used by SoftIce.
1 ^2 Z# ~2 Y/ x8 XFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
5 }, N5 n6 e3 G/ \4 l
' @9 o; ]0 K7 K8 G) A9 w) ]Here is one example from the file "Haspinst.exe" which is the dongle HASP
( N5 h, P/ w1 B* P7 u' q: E$ nEnvelope utility use to protect DOS applications:
J9 V9 n0 a1 l. u. w1 V6 w( R. b, @) q# A4 f/ i4 R0 {
5 r! `* s# ^5 W9 N
4C19:0095 MOV AX,0911 ; execute command.4 M* B7 y+ t5 _5 x* A4 h& P! u7 _
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below)., g! b# e( [! `+ M
4C19:009A MOV SI,4647 ; 1st magic value.
?+ a: I# n3 ~) U4C19:009D MOV DI,4A4D ; 2nd magic value.
1 n9 Q8 s; @. }; w" _" \& `. c4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
0 M! W6 g* H l9 X3 L6 o4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
! e7 ]- h/ E. H- s t' h4C19:00A4 INC CX' g& ?5 W+ H: l; l2 t- }: T9 J7 l
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute0 Z% T7 r. w6 w' K! s7 w7 b# f
4C19:00A8 JB 0095 ; 6 different commands.
0 r. e/ p: k% I S8 j Z5 z% K( H" q4C19:00AA JMP 0002 ; Bad_Guy jmp back.
& y' V: G" |. `; b( g3 B: I4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
) d3 u5 \* p4 A' \! h
; i. U% v( S3 [# M0 PThe program will execute 6 different SIce commands located at ds:dx, which K; l( _" L5 x6 K
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.$ ^. x& e& \3 |$ ~! }# r
6 D3 d3 s% m8 f5 U9 j& g p4 g6 B
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
* `. l2 O8 [4 f6 `/ H; \7 t7 n; b___________________________________________________________________________
$ k% I U) X. z2 P+ w
( q) D/ Y D% b4 I8 q
4 {0 e i6 P5 m K3 ?' nMethod 03
$ Q" y0 z! i8 S2 H=========
* g, b* J }# N/ p \- h& q a# }' R+ c7 z
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h! Z" I) g8 ~ z" ]- t
(API Get entry point)% x8 K% f5 Q9 h: V% A1 x/ D7 X
+ t( ~3 t+ r; A+ C! S+ P" I2 l, _
xor di,di
% \1 B4 K7 R: b, i mov es,di
$ v, t3 P7 \ t1 X* | mov ax, 1684h
* i6 X o" a* `+ S9 g mov bx, 0202h ; VxD ID of winice
+ S/ w1 e1 h+ r; q8 }4 | int 2Fh
2 u9 F$ S) Z6 p! ?* ^8 V& L mov ax, es ; ES:DI -> VxD API entry point% W S; i; U" ] M- j# K8 w- Z
add ax, di* B1 L* r2 D' B7 Q/ j! L( W
test ax,ax3 m! {0 P2 u8 n
jnz SoftICE_Detected: y( N' P H+ W7 [# m+ j
3 w5 U% D% _. {* s* x$ C! u___________________________________________________________________________$ a1 @ ^6 G" b. w0 b* y7 T
8 ]4 F7 G4 y5 L3 M A% aMethod 04
+ Q/ d2 l8 B( z, ]; \4 O=========
$ x- _; `4 C [2 }& ~
6 W) h6 W* b, R+ F9 n7 z$ f @Method identical to the preceding one except that it seeks the ID of SoftICE `6 `. U' _7 y/ o, j: ~; W
GFX VxD.9 l0 _, K/ I' e. C% y4 z! o' e
% r1 Q/ f: J. K* _
xor di,di% L' t9 A. b# h: l" b/ ?9 s8 W# c# q
mov es,di
5 d* u: u: P2 a mov ax, 1684h % E' _1 U( l5 R# c/ u
mov bx, 7a5Fh ; VxD ID of SIWVID
8 g7 }2 {. l( U2 d2 d( P int 2fh
8 B( v$ T0 Y! g" ^ mov ax, es ; ES:DI -> VxD API entry point
( ]6 |0 \ q+ V$ v add ax, di9 \- A$ W3 l+ j
test ax,ax
. {! f0 l# Y; a+ F, u* f jnz SoftICE_Detected
' c6 B; i# d2 e! A. E8 a6 P. l) J
+ t5 Z# D8 B, }" v* j__________________________________________________________________________7 M. C* S& R5 ?3 _3 z/ s) h
" l" q# r' Z8 s( I& t" |7 u
* V4 o/ B1 t' t% E2 [* {
Method 05
% [5 F5 E% g6 t=========
6 {8 q$ m7 B- q5 g3 S' x) @ v- ~& ^( ]% @
Method seeking the 'magic number' 0F386h returned (in ax) by all system: E, ` a: C8 n# q Q/ i) d
debugger. It calls the int 41h, function 4Fh.9 }) G, t0 _7 t& Y
There are several alternatives.
9 m4 T C; C/ S+ f$ g1 M, u) W) _) X, w& Q3 [6 `
The following one is the simplest:
( @ z' E( _% k# _- w) H( B& A$ F/ h/ [/ B
mov ax,4fh# G* o6 L+ W0 a7 |
int 41h3 K" G+ l, n, O) t
cmp ax, 0F386 D; x- @, D1 |2 {, [+ G) i" n
jz SoftICE_detected$ ~0 ?9 r! r' v, c& @$ s7 Z
; V" U! H* n4 O6 p3 G) T# [; n
$ m9 P/ K" Z: L6 s) f. SNext method as well as the following one are 2 examples from Stone's
. P4 E) B. ]/ }! r"stn-wid.zip" (www.cracking.net):
0 c9 q$ e5 S7 d1 N- ~' s1 C& O. Z, `* V; D F o. _7 o
mov bx, cs
7 Y+ ^2 l9 m. u2 ?- |. S$ X lea dx, int41handler29 q0 q* s+ {4 _, L( U, H+ b& A
xchg dx, es:[41h*4]
# A& l0 ]; T! t4 t+ l' K xchg bx, es:[41h*4+2]8 ~! y" ?5 a- p5 U2 N
mov ax,4fh
% r8 ]( u- r% f. c3 Z int 41h
~9 o7 Z! Q3 S! i0 @" l xchg dx, es:[41h*4]% d* v. f) p* C: ~: q6 g
xchg bx, es:[41h*4+2]
* s6 l/ i3 e, K5 ^ P% [* ] cmp ax, 0f386h3 h6 n: J' H" i; y* e3 T
jz SoftICE_detected7 U1 v% i1 K7 S* V5 B2 X7 \
+ l5 b! g) T( ^; d
int41handler2 PROC8 @6 t9 A- ?2 H+ F& f3 v; i" {
iret
1 | G& b1 ~" q4 t e$ |* N/ vint41handler2 ENDP3 n8 P" ]2 T" x7 p, B; l
9 v. |) v/ G. b5 y5 H$ V& g+ E
+ }* u; L, Y0 Q+ E' C; a_________________________________________________________________________ R) b) j# A) V
2 E+ G* g6 I' k7 M5 G* ^, w1 O$ g X0 r: I
Method 06. ^7 N9 H9 ^# q; }: q
=========2 @# l4 h" U( Z
! r% m- d3 C9 k/ y! X. y0 b
1 @$ @* Z1 [6 X$ s+ U3 B( M
2nd method similar to the preceding one but more difficult to detect:/ y% l: Q4 a8 G" o! X7 e9 a
# Z2 b3 F( |* @. Y5 P' a" ^$ G# s0 z$ o" W: ~0 h' M
int41handler PROC
! ~# W8 g, M: C8 \ mov cl,al
* d: X( Z- a1 {; B6 E4 a iret
6 L( j W0 [ _2 Pint41handler ENDP* N5 t& P0 Z0 `5 x" o O
4 K! {7 l# {# }0 d- Y
2 w0 B8 k3 I. ]. Z3 i" {' [2 Z xor ax,ax
. @8 C7 E( K# a9 p' w# T, e mov es,ax
3 i4 j( m# X! X6 o# f0 m ^ P' M mov bx, cs( ^" c3 @) C. X7 f ~
lea dx, int41handler
1 M: h! X, c0 X7 v$ C xchg dx, es:[41h*4]
# k" c7 D* p6 B- N7 q xchg bx, es:[41h*4+2]! m( ^, v& Q2 R+ Y1 n% U6 r- O
in al, 40h
3 g+ ]2 }: L. Z, ^8 a2 } xor cx,cx B6 w6 e S$ d. ]0 X$ p
int 41h
$ ^8 b: Q' \# g; a" t* U" e xchg dx, es:[41h*4] A5 }' C7 `# I1 U( h
xchg bx, es:[41h*4+2]
w/ r& |! B& z7 f" h) Z2 R cmp cl,al
d5 E/ m7 j4 [" }, m P7 m jnz SoftICE_detected
& p) ^6 @' c3 O1 b+ B/ ?0 J! O0 u; X$ v) v% j5 b
_________________________________________________________________________
8 y- c8 }& d2 ^8 D. X v% W0 m# _1 A% U+ |3 O9 l$ V
Method 074 Q! k" u4 V% D$ z2 ~& n
=========' [. F# Z" w8 O% p- g* ^9 S0 u
$ ~4 ], N# a2 M/ k
Method of detection of the WinICE handler in the int68h (V86)
6 K5 p R. {2 `$ o, S e$ `! W3 O4 H
mov ah,43h
- Z y( T' S. c% f5 F int 68h) |& z4 I& n* a$ F2 e
cmp ax,0F386h
1 ~* e& C1 L9 | jz SoftICE_Detected
$ x. H# Y& r a& U& i: n; |1 E. z7 Q" z
( j% u0 C U' i, y3 m# u
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
* [: M0 i0 [8 Z0 r i app like this:! l) i5 _' }- S& M5 G/ j6 V. D
1 X) m/ U1 q0 y% t" A
BPX exec_int if ax==68
# x+ I1 v0 ~8 M! o3 k (function called is located at byte ptr [ebp+1Dh] and client eip is
0 N& [' \% p/ ^! T* [& d& M located at [ebp+48h] for 32Bit apps)& e. x& o! p. x& O1 ~/ E8 u
__________________________________________________________________________
4 D8 u$ K' |3 W% O, b8 `) W9 R
9 S1 Q8 S) |* U% i( q. B' q
0 ]) ^- ~& s% q6 {' J, pMethod 085 J, K/ C* K8 K) W( U
=========
0 P5 d# O q- a* D5 o, p, Q5 j4 K% H" [
It is not a method of detection of SoftICE but a possibility to crash the
6 y m3 ]7 g$ g6 l' ~, B! Vsystem by intercepting int 01h and int 03h and redirecting them to another+ n4 ^5 W: U! w# ~. }+ `* _; R
routine.
7 @! z( Z# P3 M4 ], |It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points: o2 r- k2 I& T0 q, w
to the new routine to execute (hangs computer...)2 Y8 h: j3 F# ~2 A& M1 V$ V
$ _$ {5 L5 o2 C/ Q- Q4 r mov ah, 25h7 j0 ~: W7 Q0 M. R0 z5 q
mov al, Int_Number (01h or 03h)
5 q5 W2 j8 p/ ]( K+ Z7 Z; K$ p mov dx, offset New_Int_Routine
; X6 s- ~0 i: ^' O int 21h% a2 d8 o- B+ [3 p/ u
* b8 h& b6 y) f: a. \
__________________________________________________________________________
4 u( S9 Z8 S: c
& S7 C6 ~, ]% O4 [1 ZMethod 090 s4 e; C" v' Q/ k1 x4 o8 g# B! M
=========. B- d. l1 S& E
$ h/ Q: k2 q: Q8 U( z
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
& m$ U' d9 G3 i; l' g6 t# Zperformed in ring0 (VxD or a ring3 app using the VxdCall).
, H, Q$ |* l0 t8 _The Get_DDB service is used to determine whether or not a VxD is installed
e5 @) c& [7 E N) [1 B( dfor the specified device and returns a Device Description Block (in ecx) for, ` E1 H) v7 j
that device if it is installed.# q7 r1 S: N/ i: A8 ?0 I0 e
) ?* C& x+ V' k9 ?" W mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
) z2 E+ L5 \0 e2 U, c9 n) w% e mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
8 N4 E3 j' v, _/ S0 k4 J! g0 S VMMCall Get_DDB
/ W) G# v5 ^* V( y5 O- z# D mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed, S. i4 |0 ?3 |) U- ^" @
& ~7 M, h8 ]- Q& b+ A _+ cNote as well that you can easily detect this method with SoftICE:0 Y9 e6 T2 j) j0 V; c7 N9 q+ {
bpx Get_DDB if ax==0202 || ax==7a5fh6 |$ w9 X' ~: B3 j
9 a: l/ K% S9 F9 {; S7 ?+ j5 [/ q
__________________________________________________________________________
! c8 l1 A' y3 y5 Y
1 p% P7 A5 Y# a0 C: pMethod 10
5 b+ Q& K2 E9 |& }4 K$ P=========5 o) F# \' f& D% c5 ?/ z
) `- C9 i( H, Z1 K2 T! A& y
=>Disable or clear breakpoints before using this feature. DO NOT trace with% S/ E( P; t5 S6 Q: X" o- q& n
SoftICE while the option is enable!!) `& x+ a8 ~2 y& k; ~# P
7 F4 {! B7 A# G9 U8 ?
This trick is very efficient:
: s$ y8 a1 ~- p& E( H2 y& bby checking the Debug Registers, you can detect if SoftICE is loaded4 ^2 e* a* ?# U+ y
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if" v" w* O" R' O" r) J! f7 e6 @) m: ^
there are some memory breakpoints set (dr0 to dr3) simply by reading their( v/ q, } c$ g% g+ `5 X
value (in ring0 only). Values can be manipulated and or changed as well8 a3 N# R! O3 T/ t
(clearing BPMs for instance)
, H5 P' H5 v& J% N/ s$ W% ?# B1 V
__________________________________________________________________________* M' D0 \" U) s4 s
. I* {: f1 u4 _' |; F/ y7 G0 yMethod 11
. U9 @) |( [8 l# r/ T( _# ?=========
% t6 I1 q* L" U; g9 S
: f7 B* \; c) `! M: V. Q& qThis method is most known as 'MeltICE' because it has been freely distributed* b; ~5 H8 i @- x& e0 [, X
via www.winfiles.com. However it was first used by NuMega people to allow- l8 w% Q* q! y. `7 `9 X! P5 R, Y `
Symbol Loader to check if SoftICE was active or not (the code is located
( v2 o+ ^" ^8 p/ ^1 a" Xinside nmtrans.dll).
. c# ?2 I6 s0 R: V: ` Y/ j5 _6 o$ g- Q; n/ }# ~1 X8 C3 s
The way it works is very simple:; e- \2 L4 q3 b( u3 Z8 U3 s
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for5 C/ J: s5 z( P7 t+ P
WinNT) with the CreateFileA API., \9 g; h5 I' }- S! k+ |
: ~: \* P9 l0 d
Here is a sample (checking for 'SICE'):
, O- L) }9 W" D/ T& x6 l% S; s8 i( T
BOOL IsSoftIce95Loaded()
8 u; Y% @3 e. ?5 I% K5 z{
- [+ f& X* i$ l+ `! ^6 K HANDLE hFile;
9 z) i5 q* z! n hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
' c! J" ^! C" t# \4 L- @ FILE_SHARE_READ | FILE_SHARE_WRITE," @; t9 h5 p- g
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
# ^, Y5 B B! ~( r' Z* {( f, ? if( hFile != INVALID_HANDLE_VALUE )
$ f+ J* I* a- w% E0 ~ {
) C \( ~; R2 K/ B/ Y8 _ CloseHandle(hFile);
& |1 y9 n: P* u0 ?6 y0 h# _ L9 B4 } return TRUE;9 v+ U( C& P3 H& ^
}, ~, {# Y. M2 ?( e
return FALSE;
/ _# ~" y0 b# ?) L}
0 N% W1 j' }, _7 ?
9 W; {/ @" |* @8 M6 |Although this trick calls the CreateFileA function, don't even expect to be
, O+ W/ ]+ p5 v5 Table to intercept it by installing a IFS hook: it will not work, no way!2 @7 Y S6 C2 W0 T2 v; ~
In fact, after the call to CreateFileA it will get through VWIN32 0x001F6 r4 B0 t0 k1 _; P) }% B
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
$ N$ q3 x# R, cand then browse the DDB list until it find the VxD and its DDB_Control_Proc
% r4 p+ g3 s" s4 b+ Bfield.' k+ e4 ~) j! G9 v! R
In fact, its purpose is not to load/unload VxDs but only to send a 4 [: l$ f. J$ F* a% T) W" t
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
( L- l7 ?& X, pto the VxD Control_Dispatch proc (how the hell a shareware soft could try
* B S0 B, y$ \) i' {to load/unload a non-dynamically loadable driver such as SoftICE ;-).
9 L& v* `& n% A) R5 w& dIf the VxD is loaded, it will always clear eax and the Carry flag to allow( d* N* m- K/ j
its handle to be opened and then, will be detected.
7 F6 ]" w2 Y+ z- [* o9 p* I0 CYou can check that simply by hooking Winice.exe control proc entry point
- a& x; r; D; ~4 h' [. l/ lwhile running MeltICE.
: @' M0 s# A; r8 ? V8 s5 c3 h: B) }$ U+ ~; H7 J# [/ X; ?
3 n6 [( ` U+ E" @( k" ~ 00401067: push 00402025 ; \\.\SICE- b9 [+ y4 y# A, ^, k& g
0040106C: call CreateFileA
3 f+ u r- J7 e3 [% a: e; b 00401071: cmp eax,-0010 T/ g! ]- X3 X Z
00401074: je 00401091
, ^5 f) u! {' o
V. k3 L$ `6 f- Y. u2 q. i4 B" j& u7 C
$ J" W4 d1 `/ q# M* B) ?& TThere could be hundreds of BPX you could use to detect this trick.7 n, L: U$ B: H
-The most classical one is:
/ _7 |5 @0 Y3 r% W6 l' c) B BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
2 J! p5 f v2 b0 H, @ *(esp->4+4)=='NTIC'
9 ~# x4 U5 s) {5 K# \/ Z8 a# P
) S( q8 Y! X, T; q8 H% e* B, z4 D-The most exotic ones (could be very slooooow :-(7 W9 [/ P. L! T. `8 }& ]
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') " @! M0 S* o- S
;will break 3 times :-(; Y$ x/ d* Z% d; M
" B7 \3 d0 w3 ~9 ~4 g-or (a bit) faster:
& D# m, k8 T+ O6 P6 M' O BPINT 30 if (*edi=='SICE' || *edi=='SIWV'), Z, }5 N% r% j5 M/ X: O
' N. j5 a5 e. ~- U
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
2 v: l; `* `: u L ;will break 3 times :-(
- f/ \. v5 O$ s* w) n" `
1 X6 S" l6 X% @& X! s. m7 d-Much faster:5 a1 r4 J5 b2 q8 b0 M. `4 ^$ c: S
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
/ h2 l$ ]$ t% }) z
# C4 Q: j) }( W4 UNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
( K0 H8 W9 |5 e7 K& c- x( k5 Pfunction to do the same job:
7 C- T1 Z/ G" p' @# G1 l- e: z2 a _$ f" | C
push 00 ; OF_READ
; R& w$ r3 U0 G5 Y& U6 G& H mov eax,[00656634] ; '\\.\SICE',0
2 d6 z: B; j0 s& [. |2 A' R push eax6 O5 v. ]9 y/ ~. h/ k& n+ p
call KERNEL32!_lopen6 Y Q" m0 N! p+ v. _3 B2 W
inc eax
5 O* X9 b! }2 r( H jnz 00650589 ; detected
) D J8 A) o7 Z. h1 T push 00 ; OF_READ
( l- _" F$ C& p) V mov eax,[00656638] ; '\\.\SICE'
6 X y& M# `' w# y' S( A& I' ^ push eax
# ?4 s0 f' [$ ^# Y: W( p { call KERNEL32!_lopen
$ r; F' O5 Z) n: _& P inc eax
9 l) E/ Q+ q7 M2 d4 p jz 006505ae ; not detected$ Z: f/ E2 x6 R6 r, }7 E
& F* {5 w; Q9 ^8 d, Y
! S! M0 j0 M, r2 I6 t! Q4 u__________________________________________________________________________7 ^) E( w$ c8 F3 v# \
8 x/ g; S$ @ h/ v1 n# ]Method 12
m# m$ Q% C7 G w" i=========/ @# t! Y0 z9 Q5 Z
2 V7 B$ c. ] P) ^5 M* [, l+ H
This trick is similar to int41h/4fh Debugger installation check (code 05
: T% u! \& x( v8 ~0 i$ D9 R$ c& 06) but very limited because it's only available for Win95/98 (not NT) s; y! |8 o% h# I4 G1 t
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
) @1 Z$ _2 _, y
. o* ?. u* m) u# h push 0000004fh ; function 4fh
* e, Q8 L9 }( H push 002a002ah ; high word specifies which VxD (VWIN32)
8 G9 X4 J: _! L0 n$ R ; low word specifies which service
# o" [8 w4 x0 y# G" e- ^$ H: V/ w8 f (VWIN32_Int41Dispatch)
3 o, s' s! z/ {6 ?) N8 \/ u% m$ { call Kernel32!ORD_001 ; VxdCall
1 z3 u4 N0 ]8 v3 Y' _: H% u. Q cmp ax, 0f386h ; magic number returned by system debuggers" I/ _9 w: `1 U. a' m
jz SoftICE_detected
$ f! `7 q4 t2 z8 @
$ x$ ]+ J, a' PHere again, several ways to detect it:# Q! Z' B2 u4 q |' A q
$ ~8 C, ?7 U; Q' o4 X. w+ d2 C% k BPINT 41 if ax==4f
% L4 O' R) j1 ^1 h$ c% o) J+ Y) i
. x! n8 d6 o2 P7 E BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one+ s6 Y+ e2 K+ q" }% _' G
/ T7 Y6 \" l5 l3 v
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
; |' _% ^9 m; C" A# I" ~+ g
; [$ b7 X; y, S1 ] K/ E+ _. I BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!% h- S- ?! N T
/ Q( ^. B5 B" W. `, { ^
__________________________________________________________________________
) Z; E8 p8 ~" d2 A
# ~, o' n7 ?& X3 Y6 E1 s0 ?Method 13
) z) Z, h& T. c# J=========5 c3 l1 W( F) U( V* x2 {8 H
3 O) _: O/ d: m' n$ Z% N' SNot a real method of detection, but a good way to know if SoftICE is
* G% X; L- |0 x B6 q) k) Einstalled on a computer and to locate its installation directory.
, W/ f' @/ e) ]It is used by few softs which access the following registry keys (usually #2) :
+ A' W) y' p4 _6 v. {) f( ]& ]9 J
1 \+ g; C! G% D-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
/ V' {; _# B7 f9 Z/ O' E2 g. o7 H\Uninstall\SoftICE
. l: }, `% z8 W1 q-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
: l; [: i7 K5 r# Z: b+ q$ \- o0 i-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
8 V, g/ Z/ } p1 f+ o\App Paths\Loader32.Exe: r# @0 A8 r1 k! d' J6 R1 T5 s. o
; B- C3 ~! G6 a! L
8 o4 B i! @3 ~5 ~/ e
Note that some nasty apps could then erase all files from SoftICE directory
7 x) u" U) F( F# Q3 Y* ?4 F(I faced that once :-(: s2 N* l2 F h9 ~; G! X* M/ m
) I$ n; f" J$ u" z2 y' [1 q' WUseful breakpoint to detect it:
# D- x- B1 Y/ {- t
, g/ {2 N' W3 K, z1 n BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
% p1 X0 {' w2 M7 l- v: M: q8 I& u+ f8 z) R) k! u, B
__________________________________________________________________________6 }: h# U- q/ {* u% _4 ?7 _' U @
3 j9 Q: t s/ ^$ x. y f. y/ a5 b, {+ E( x9 s
Method 14
! J8 Y) x0 q* o. z! ?# u=========
7 J; f( K) m3 K3 H& b0 F" L: r) U0 j7 Y/ |
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
/ ]0 c; z: V6 j( O3 s. i5 l$ Iis to determines whether a debugger is running on your system (ring0 only).
8 W5 |2 [% E8 E& y% Y9 A Z" O! u7 k5 {7 \# L6 x7 d% z- b
VMMCall Test_Debug_Installed2 R, N/ L0 ~5 R/ Z6 e, [
je not_installed
, f" b* Z. S p0 E. ~; \: ?2 i8 u( q% l9 U. n' V6 @
This service just checks a flag.
. ^8 c! T0 ^! Z. {! [3 A5 O</PRE></TD></TR></TBODY></TABLE> |