<TABLE width=500>
* @: Q; x7 U9 Y% t4 w<TBODY>! Y! i- H" ]5 B) q
<TR>
- f6 y5 x7 P! S6 q<TD><PRE>Method 01 $ Y- p, C+ \8 D H
=========2 `( Q6 c5 _# u' m5 f) O" Y
Y/ d1 ]' g& v2 y! Y+ T7 w
This method of detection of SoftICE (as well as the following one) is. i) l, w) R6 o3 m. i6 r- y
used by the majority of packers/encryptors found on Internet.
! G. U& P6 b8 m1 D, f! ZIt seeks the signature of BoundsChecker in SoftICE
: E+ f T0 `" \9 }7 { p7 \& f# \* R- s7 f2 J
mov ebp, 04243484Bh ; 'BCHK'( N" E% t) _% {# [
mov ax, 04h" R9 T( c" F$ s8 ~1 w
int 3
8 K$ ]+ w3 I% Z" P; Q1 L cmp al,4
) C# h2 L/ M) X# b jnz SoftICE_Detected& {1 |6 W3 W/ o6 c% r, G
, q0 @& D( U! ]6 y9 E6 e, ~
___________________________________________________________________________+ I+ |5 X+ M5 r3 W7 U- U, u8 @9 }; T
4 x4 p2 B& W& v0 ?+ _ ]% xMethod 02# S# f6 ^% E% j1 I+ b
=========4 }' p w8 O5 B/ B3 \
% A- O9 M$ y0 |- I s2 M
Still a method very much used (perhaps the most frequent one). It is used; W' z) A: t% z
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,! Z; v$ O1 b. N2 U
or execute SoftICE commands...- i- ^1 A, K% ~; w7 k" r, z) I7 t2 n
It is also used to crash SoftICE and to force it to execute any commands
/ M4 _; w5 c T' P7 [! h(HBOOT...) :-(( $ a7 \5 |- g% Q u' r( q
7 F1 d6 y2 f* E- S+ uHere is a quick description:% q* ?- y# l, I0 Z
-AX = 0910h (Display string in SIce windows)( r5 G0 |! Q' x: ^+ `4 H
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)! ]1 ?1 [1 [8 z7 J6 W8 a
-AX = 0912h (Get breakpoint infos)* n6 f: |* B& `+ Y0 {
-AX = 0913h (Set Sice breakpoints)- I& o/ ^ x$ t
-AX = 0914h (Remove SIce breakoints)
" Q- z6 M& M. s; b: J
: l& L! H# G+ {4 I9 D3 cEach time you'll meet this trick, you'll see:: T( E! A- z+ X( L; E0 J( B+ F Z
-SI = 4647h
' `* I3 D1 M( o0 `7 \$ r-DI = 4A4Dh
4 d. J7 Y* N& {: b7 _; G9 U) FWhich are the 'magic values' used by SoftIce.
5 `) _- Z% Q8 Y9 ]3 B! s( lFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
; P1 a k& _( y# S2 |" Q, M8 o Q/ d" u% H; D
Here is one example from the file "Haspinst.exe" which is the dongle HASP7 H$ @4 P7 I" h) W$ k7 {& L4 ]3 ]
Envelope utility use to protect DOS applications:
9 s8 t7 J" z5 n+ \
9 L/ e! P# I) t5 M" O& s( ~( |% y. O6 @! U# U& d
4C19:0095 MOV AX,0911 ; execute command.& I" e0 `* d" C: z4 ?3 ^! [
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).- d D9 ` f, M8 V" c5 {' D7 D
4C19:009A MOV SI,4647 ; 1st magic value.7 e5 p" C% c- G2 Q7 F/ K
4C19:009D MOV DI,4A4D ; 2nd magic value." X/ h' e& {) m
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
0 d% W: o# Y; G9 d4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute/ ^/ e$ v9 }& U# @. S7 J
4C19:00A4 INC CX
/ D/ t( t/ L# K* t1 H% y# X- b2 X6 I" x4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
4 N1 o: t* d( @4C19:00A8 JB 0095 ; 6 different commands., q2 U# F- j1 z1 i7 X
4C19:00AA JMP 0002 ; Bad_Guy jmp back.( A) O! \5 J5 Q# y( `
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
1 Q( J3 }9 Z1 F- d
) x' t7 }/ `. T4 @The program will execute 6 different SIce commands located at ds:dx, which4 }# I* E* G2 d. q
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
6 z+ o% z. r* M3 J! I1 V
4 N4 r+ Z! J+ P+ p* \* V* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.0 U( S* m" @8 o! `! `; d
___________________________________________________________________________" s4 D& ?. U9 T5 Q+ \
1 c5 N( s- c- u9 b) n
, s/ K5 S( W( D% k) U) S
Method 030 L: P$ t W8 a, O2 P5 M
=========
" ~5 | D9 I2 t+ L1 }
H0 N7 m9 h/ r4 ~3 A/ x; O- i, f+ NLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h/ Q, L; Y: ]; ~1 b) ^
(API Get entry point)
; J* Q( w( f6 b0 W
. ^( \' _; Q3 c6 |2 ^" ]7 N' O. t' G% z5 @
xor di,di0 G$ A- R4 l2 b5 H" W+ o
mov es,di& w- p+ l' T1 }0 g
mov ax, 1684h / @6 _0 U1 N+ Z6 g/ D
mov bx, 0202h ; VxD ID of winice$ u7 r, N- O7 \. X" W, g# x
int 2Fh
$ g. O% H( U$ g7 ~; M7 c mov ax, es ; ES:DI -> VxD API entry point
/ M! _7 X- b# T) e5 `9 |' \( s add ax, di% R7 B1 p! X! f: F/ m3 \
test ax,ax% c" g% b: I* k% L% F
jnz SoftICE_Detected4 t* p3 C6 b+ ^
) J& B+ i1 R& f
___________________________________________________________________________
$ b. r& h2 |5 ?/ V. p, d7 z; [. S6 g. A
Method 04, p& b! p/ w* h* s& o
=========
9 b. r- v% S& j% F) T1 u; x( c1 v f6 C7 P5 A# {! K
Method identical to the preceding one except that it seeks the ID of SoftICE- |' N5 c8 ~+ {& F
GFX VxD.' C# w! i1 K% G0 w
/ n. z+ Y* l( ^' P3 Y, @) i4 o
xor di,di0 x9 |( d7 J. u1 U: ~8 r# K
mov es,di, V; d# l6 V0 ~/ e8 _
mov ax, 1684h 5 o; @# M% s0 Q. K$ H% p
mov bx, 7a5Fh ; VxD ID of SIWVID
( t# q9 N5 u) J3 A' j4 A) J int 2fh
/ Y) M& T. G( A6 n( a mov ax, es ; ES:DI -> VxD API entry point
4 Y; Q3 @. F5 H+ v add ax, di
3 j+ b5 `" B1 z4 v; g test ax,ax
]4 m/ E$ z* I% \/ t3 Q1 l2 w7 ? jnz SoftICE_Detected
+ r7 J5 [7 e. P/ O' J1 j, |% P* y
__________________________________________________________________________* F- I( s- T$ a- E
! j2 n! r# A5 ~! u' Y
$ Y& x1 g/ W- O! j t1 L& `Method 05
1 {3 _! R% Y* F3 m$ f. Z7 C. W N# m, x=========+ v8 v/ P% H* f7 ?
! P9 S% G& u5 ]$ w, `, u
Method seeking the 'magic number' 0F386h returned (in ax) by all system( J) G4 p7 p0 J9 ]
debugger. It calls the int 41h, function 4Fh.
: W% A4 F/ {, f7 i/ J; YThere are several alternatives.
, ?! [+ I9 p6 U3 j. b
s8 |7 h" _1 E* y7 }The following one is the simplest:; e2 i3 _' a3 M, c
8 p; @3 j. ]3 O8 d7 U4 ~ mov ax,4fh
2 y% } T: \' W0 S, {2 Q int 41h
( Y+ d2 T* Q( K cmp ax, 0F386' N, R& W+ Z0 K2 U9 Q: `
jz SoftICE_detected
S/ k' c3 O/ c/ q) L6 k. K
5 J: I; W2 x9 W. l
. G5 J& A' j: L+ [Next method as well as the following one are 2 examples from Stone's
0 `8 N: O+ J+ n/ S1 y"stn-wid.zip" (www.cracking.net):9 c7 Q, t$ O- y5 l' d! o v
# }* R& @2 @0 t+ I T* k# F! I" r mov bx, cs" w/ f6 a$ N8 r: o7 ] S
lea dx, int41handler2) \0 \, Y7 C7 G+ ~: V* V" u
xchg dx, es:[41h*4]! b2 y6 V& O' d ^( Q% \9 ]
xchg bx, es:[41h*4+2]
2 [0 i- e! D0 C) ?+ l1 E! b' q& K8 i mov ax,4fh; O/ R+ m( g2 t4 b4 Y# K7 s
int 41h
7 W. I2 Y- a3 E& c: T# D xchg dx, es:[41h*4]% l: j" T3 j F/ B" r/ W: }1 E
xchg bx, es:[41h*4+2]0 v/ y5 n! T9 k) M6 e F
cmp ax, 0f386h' k7 V7 `8 G& I8 N" Q* V4 i4 C
jz SoftICE_detected6 I/ J, f5 V( m3 [
9 ^/ g* V7 D( }7 I+ f$ dint41handler2 PROC
; B* m& d; `* \! ^ iret
% x) i0 ?' h' v, Bint41handler2 ENDP
) I6 ?6 |0 j8 K- [& N* V3 O: [ Z u+ D* t% R4 ]. }2 j# y
1 G! f& Z2 ^/ c+ H; y. n_________________________________________________________________________6 t, o# J u! d% B/ B2 k% E; i
2 b1 X$ Q; q2 O4 O1 m5 s# D* m- V) d% w7 c
Method 06
. {3 T+ `: f3 L- r' k" @=========2 I- H- m) Q w7 L" m) c3 \
& B- S5 i1 x5 j; h7 p: b* n' Q, |) |- C% d3 G5 Y; s/ i
2nd method similar to the preceding one but more difficult to detect:$ q5 L! Q0 I: d5 F* F# b7 Y
- B+ u0 i: q7 b/ a: ]7 O3 U1 y2 D" u2 r
int41handler PROC
4 y8 K0 M5 p: |& E mov cl,al
. r( P. |' c3 S9 g; O; V, d+ {4 i iret
0 P6 Y2 H7 G2 d. J' Oint41handler ENDP
9 A# L# X* l5 @2 A5 L1 h1 A# c8 O4 w+ O0 S" }) ]6 }
3 k2 k Y; t( X( c: g2 E3 B; w. a7 Q xor ax,ax$ L* X- v& E) X& n' ?' d( b
mov es,ax
# k- w L/ u5 T7 ^' ?; M7 y+ H mov bx, cs; P2 ?. o7 \$ D! y
lea dx, int41handler4 r) o" _: f$ @. H% f
xchg dx, es:[41h*4]
! J# l$ \2 m( B+ X, c/ D xchg bx, es:[41h*4+2]
+ M; ~4 q4 F' |) K in al, 40h
' |9 [5 L- S& {3 N7 |7 T xor cx,cx* z7 o { W) c/ R6 A8 Y/ d- M% a
int 41h
0 @+ X6 H+ |4 G3 W5 j! C3 Z xchg dx, es:[41h*4]
/ z$ j2 C* W* n* S% Q. x xchg bx, es:[41h*4+2]
5 d3 @1 _! X$ J5 S7 H cmp cl,al
. K7 d% J. m# h jnz SoftICE_detected& a( E; p) h; r- G; I1 }; X3 r
t' `% o9 c3 h/ A/ H
_________________________________________________________________________- J3 F, {: w1 p1 n. o, c
2 ?- B- M5 M" h$ J2 F
Method 07+ j* k+ T+ `8 Q% o% M
=========
$ @- [6 a9 x" U# d2 G3 V
% V; ]; n$ v$ k4 V5 h. ]- HMethod of detection of the WinICE handler in the int68h (V86)8 T3 Z: d/ A) U9 V& N
: U7 P g9 H& p% L9 i& h5 v mov ah,43h3 F6 p) K# \5 E0 b
int 68h3 q9 a% F4 T0 |) z3 z
cmp ax,0F386h0 L4 C) D) V U/ `
jz SoftICE_Detected, `# r$ U j% X) X( r0 I7 K, m ^9 b
! O0 u T' d6 q9 ^/ j! R- h6 o4 {# K6 ` `, Z+ V& X6 O
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
/ v2 x* k- h6 `4 C/ r* i2 u app like this:
$ S7 X; K! K. h$ D @4 V' r; W- m/ o7 s& ^ v U2 a
BPX exec_int if ax==68: O: H1 v* o. Y: t& W# d
(function called is located at byte ptr [ebp+1Dh] and client eip is6 s' u3 D3 N2 B( R
located at [ebp+48h] for 32Bit apps)
1 t9 N5 b/ j1 N8 ^: E__________________________________________________________________________
( K% B* M9 [2 w* `
9 ]4 M8 ^1 n4 ?% A7 n( z
, k& j) `& j- JMethod 08: Z. ]' z$ ?: y% Y1 o
=========
" q, E7 q, |2 J! J( {& \( n: I# g; H) D- a' r! o& M- q2 T$ Y( W
It is not a method of detection of SoftICE but a possibility to crash the
+ d# V2 c X7 v% n2 \9 m) _' Asystem by intercepting int 01h and int 03h and redirecting them to another
: O4 N$ k0 _# proutine.
' m w$ L/ _, n7 w9 g; o9 ]It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
8 [0 H) ?1 M+ |2 f5 E1 [/ eto the new routine to execute (hangs computer...)
4 j( ]8 c( [2 B2 E( q5 W
% ?7 u. j7 G# G0 K4 [9 g mov ah, 25h) {9 K/ u3 ]( _) @ V# _, o
mov al, Int_Number (01h or 03h)3 _ ^: v9 t7 Z
mov dx, offset New_Int_Routine
9 K8 z, J0 T4 P- {" p' B$ n int 21h
. i$ \ L" d, |$ H P$ n
" y$ l5 p, c3 Y% }$ ^( I__________________________________________________________________________& @9 Y4 G8 M9 P: N# k
: M& [6 G. |$ b5 ~8 j" L! b+ MMethod 091 J. |7 A5 @* `9 n/ @4 J; u
=========
1 l& e' r2 w+ d* s# E
9 v1 `( R8 |: b# y f# Y8 `This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
+ M% Q4 \* Y2 y4 H/ b% z! l3 nperformed in ring0 (VxD or a ring3 app using the VxdCall).) ]0 @6 m& q2 ?
The Get_DDB service is used to determine whether or not a VxD is installed; ], u6 b0 |' z: D4 B$ X
for the specified device and returns a Device Description Block (in ecx) for
1 q. H" m- A, tthat device if it is installed.5 G6 w) G; a& }9 j/ i: ?4 ?6 G
2 E% P* m2 J4 ]1 @
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID. ^5 ~) I/ ]% ?1 x$ q
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-) t1 {6 X- m3 j" w, P% ~1 `7 p
VMMCall Get_DDB
) w( ~2 g. y" t2 e* P& J* m2 ~ mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed1 ]! m* c$ S4 Q
7 K% L6 R9 t) d! oNote as well that you can easily detect this method with SoftICE:2 E# V3 u! C1 w% N& Q9 H. P4 a5 J
bpx Get_DDB if ax==0202 || ax==7a5fh5 y. ]9 C6 e: s8 q/ |9 w
( q, P9 A ]# Z4 r, ___________________________________________________________________________7 `* T4 {* K0 Z q' o. S
1 M+ a% ]( |% V; d& B ?Method 104 W0 Z0 K. t f, Q) x- ?, ?* W
=========
5 ]- ^' R5 H" i% f. N/ B5 \/ j) X' z* {# |. u
=>Disable or clear breakpoints before using this feature. DO NOT trace with8 W7 {) F* W) Y2 P. t* t
SoftICE while the option is enable!!
% H% n+ v. `9 w1 O, r
+ G8 _. n y3 E1 \# K# p+ G2 LThis trick is very efficient:1 M/ \/ M2 o1 P; j* H& P* [$ ?9 S
by checking the Debug Registers, you can detect if SoftICE is loaded# P- e7 o( \. R ]6 _
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if5 S& g. ^( i6 U9 U, U
there are some memory breakpoints set (dr0 to dr3) simply by reading their" ~1 E8 ~. X$ w5 M5 A! w# U( b
value (in ring0 only). Values can be manipulated and or changed as well( b3 k( E: [- X
(clearing BPMs for instance)' w+ `$ ]# M5 z5 u2 h m
# M( W. ?! c9 Q: m
__________________________________________________________________________
3 }0 s* w* O4 I
& J" Q: d# v" ^. x( Y. E9 P1 DMethod 11
# U. a5 I/ b5 b- n/ F/ [=========
: f* \1 e; G9 y$ T, V
! n( Q( Y! ?: o+ d8 r( M. oThis method is most known as 'MeltICE' because it has been freely distributed5 e" \0 e( P# E0 ~' l% V% V5 m
via www.winfiles.com. However it was first used by NuMega people to allow
7 e: `3 x2 M( d/ p! n7 C) k5 GSymbol Loader to check if SoftICE was active or not (the code is located5 F- |3 s, h; o" |$ b# g
inside nmtrans.dll).
* w0 T, D2 V. ?; Y0 p- c% v4 f! q) L- {
The way it works is very simple:
" E+ n6 g: A* KIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for1 I7 Y. o- V$ A
WinNT) with the CreateFileA API.
& z# b3 a- T" m2 |1 k4 A& B2 S2 K' H( E
Here is a sample (checking for 'SICE'):
; i/ b. q0 f5 r+ \
! X& I/ K' g' ~2 k$ ^BOOL IsSoftIce95Loaded()
$ |& O" v" Q4 Y/ Q* B0 U1 z8 K0 r9 ^{% R# K/ Q8 U7 R% I8 B9 V- s$ ]
HANDLE hFile; % T$ @. r: k- k g
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
+ E2 C4 a! b- r5 p) T5 P0 A. p M FILE_SHARE_READ | FILE_SHARE_WRITE,8 B% l V) \" J3 X9 u
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);) X0 B3 ]& {+ |# n4 [7 ?
if( hFile != INVALID_HANDLE_VALUE )5 q2 T, t, m' ~$ O- U7 P; f4 G; r
{+ i' z! |7 ~ C% P& p( |7 H, I; M
CloseHandle(hFile);
) @, ]# S b( d/ Z- j: ?1 m3 u return TRUE;) k; F+ m# B2 U ~0 [4 k
}
$ }+ E/ t& V. J$ Z1 e M return FALSE;% e9 w( r& V- C ~- |3 K
}0 u/ M7 \& {4 E& a
, N' t R$ d5 w4 T. @Although this trick calls the CreateFileA function, don't even expect to be8 g- i" v2 `0 B( `/ s
able to intercept it by installing a IFS hook: it will not work, no way!
) F! C' K! C4 O" q5 S8 wIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
$ R7 M7 I1 M3 E# bservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
+ o' L8 t( R! b" l. j) r4 Hand then browse the DDB list until it find the VxD and its DDB_Control_Proc
: i; S6 f& r. G' k* b+ |& wfield.
" S$ V; {6 W5 \In fact, its purpose is not to load/unload VxDs but only to send a
7 P4 J9 y M0 \0 s# _" t% J$ y) ^W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)8 I1 j# q$ E3 @% B
to the VxD Control_Dispatch proc (how the hell a shareware soft could try4 B. M- |, V0 W5 H9 [5 T8 C
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
$ G5 O6 [8 f* m, d1 [! mIf the VxD is loaded, it will always clear eax and the Carry flag to allow# y. I; K+ N# z* ? p8 J7 G9 a6 W
its handle to be opened and then, will be detected.7 D) w g& ^! O/ Z1 [: c/ H
You can check that simply by hooking Winice.exe control proc entry point* l' v0 K! C4 o& E
while running MeltICE.
6 f! ^) Z% e, E9 O0 @7 a: g O! C% W: E, a- x
0 U! r! ~. S- m 00401067: push 00402025 ; \\.\SICE
6 `! J0 }! I3 E 0040106C: call CreateFileA
" f9 p% K6 P. a. n9 R0 E# A7 N' | 00401071: cmp eax,-001
8 _# t4 n2 {0 f 00401074: je 004010913 k7 F a3 k& }6 k( \* I
4 `8 K! }$ _3 D) h
8 l U3 C' Y+ M3 c/ r+ j. n" y
There could be hundreds of BPX you could use to detect this trick." \9 q: u& v1 m( f
-The most classical one is:
5 n3 m% i/ B/ k6 m0 \/ w BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
& b) d; o5 A+ N- a( ^ *(esp->4+4)=='NTIC'7 ]0 ^9 R# T1 J7 E
. W& Q ^0 B0 a* e6 n7 I+ T# u-The most exotic ones (could be very slooooow :-(1 q4 Y1 A% R" O
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
' [" B# u* V1 V0 `1 ` ;will break 3 times :-(0 _$ M# q" M( E# {" i" P) _
7 ~! h: S, L+ t2 V
-or (a bit) faster:
5 u4 t2 n, a4 y BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
" p) ^; |2 _ L. K8 g2 J# b- b+ ]2 P5 I
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' - M! g( Y; W% o8 ?
;will break 3 times :-(
- O* a8 h+ I8 L, t( x$ I- {. `
9 E- y$ |; R: S-Much faster:
' P: G: d/ d4 C* ~2 j BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
2 j% K. x+ W% J
6 h/ l F+ q5 O, v( g/ eNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
) d' y) G4 w$ h9 \0 n$ Tfunction to do the same job:$ r1 w5 q# e' A7 s! `+ x
, _: @5 M! b' x2 A8 z
push 00 ; OF_READ
- ?3 Q8 |5 d0 D. L' l% O0 } mov eax,[00656634] ; '\\.\SICE',08 z- D/ R8 ~4 N
push eax
; [% E: K4 N0 ?2 ^# R call KERNEL32!_lopen$ Y) K/ y" { |) g( }6 j3 K+ S
inc eax
3 s8 J$ l2 s: O/ S2 |, M9 c jnz 00650589 ; detected9 G, B/ ~) ~* P; I% [3 b+ Y% F( V+ M
push 00 ; OF_READ
1 b! I" y4 n Z. W mov eax,[00656638] ; '\\.\SICE'
: ?/ ^7 x& {5 z% Y push eax
# J5 G H# j+ g0 P, Y( @ call KERNEL32!_lopen
( Q& V) s, r) ^# c0 f( I& U9 P inc eax: ^0 m0 E+ N/ y1 p
jz 006505ae ; not detected
& Z) ~7 a% M7 ?' D" b" ^$ e/ i6 s8 l7 e* _
$ N0 T2 y0 T8 x; k2 f6 I: z__________________________________________________________________________
4 D6 ^' W/ b3 t3 i! F% z
" A9 }) B3 C, [3 B* A7 @+ LMethod 12
9 U, f1 V! n. p) c3 ^& h. _=========. c0 E* x/ F7 ]6 l6 e- U/ x
6 K' x; H4 G% V) B5 h8 i4 Z
This trick is similar to int41h/4fh Debugger installation check (code 05; j& n7 }) Z4 F7 z" v5 ^
& 06) but very limited because it's only available for Win95/98 (not NT): b7 e* H3 s9 K7 M
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
+ F! y" x* \7 S; W2 `6 H7 [
5 R; `* Y% J9 r4 d push 0000004fh ; function 4fh
( R: K) o4 Z i push 002a002ah ; high word specifies which VxD (VWIN32)+ y m. E* T) A" c. t0 b% N
; low word specifies which service/ S/ Q" S9 c- t: _
(VWIN32_Int41Dispatch)
3 v9 I/ s1 @4 _: Z call Kernel32!ORD_001 ; VxdCall
+ x n+ J# E7 r* _$ H$ Q cmp ax, 0f386h ; magic number returned by system debuggers
" s9 e( d2 {* o4 m jz SoftICE_detected( _9 [$ m1 B7 D0 k) U' k
, ~6 i" h( _# G* I: ?Here again, several ways to detect it:
7 F- d/ F& W7 X; }5 I8 }
* X& K" n$ d9 }. z. g7 L BPINT 41 if ax==4f
" f7 p8 I' s0 u3 ^; B
( o) U" Q2 m' M% j2 i% c BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one5 g! j" h( D; H0 d3 ~: t
9 o+ |9 `( s, B: X BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A- V2 `0 x i( Q4 u: V5 _/ s
6 G' `8 J1 F' H' C. t; C3 S BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!9 q' k% @$ a( e( s/ ^
h9 [& x0 q ]$ j* {' }__________________________________________________________________________: e# _& F' i- Z# i/ }* R" [! _
+ Y6 ~* ~0 i; l4 g: m
Method 13' ~; h+ y* R' y6 F3 ?
=========
% b" U1 a" Y# z F# l
7 x$ C: R" L3 s9 @( _7 }# nNot a real method of detection, but a good way to know if SoftICE is
* s5 x2 f( f) L6 L3 x+ Finstalled on a computer and to locate its installation directory." v8 _( [2 V( D; u3 B. K
It is used by few softs which access the following registry keys (usually #2) :- [( E- s1 I& r. l
0 h+ Q: B/ K \- z3 d7 c0 x* u- l
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion6 g8 y5 ]+ D: ^8 i# k! ^( X P( Z
\Uninstall\SoftICE. q9 @+ G* B v1 w
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
3 K9 V" W8 ^2 r-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
. }; L$ v/ T* G9 I$ t: ]+ @( v\App Paths\Loader32.Exe/ \- O6 m# [: p( K- X- }: ? d
2 L0 z, F9 c2 _' ?9 @7 V
# N! ?0 i5 d+ A9 E+ aNote that some nasty apps could then erase all files from SoftICE directory. B" M( n5 e, r( S0 ~% w% r
(I faced that once :-(- R3 t) x* G! w, U+ T$ w; j8 m
9 d ?8 x: u: r- v# e* }, t6 [Useful breakpoint to detect it:- n/ j# I( D$ W# ?- z
" s( i. {9 ^; S3 b8 d! `: S- V
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
; L, p5 `# Q1 b( O; i7 o5 Z! m0 V U* w: n( j4 p
__________________________________________________________________________, B1 k8 p. [& T9 b+ K7 k
+ t! R+ ~5 L' k" I0 L; u& b
8 l. ?4 ]! l+ B1 G( q; M9 M1 s( W* {Method 14
. F3 h. `& @& W' ^ E+ ?) z/ g=========
1 i8 q( U6 l& [9 c) v1 D+ d' R' z7 F$ a: a+ b; \- `9 O0 F* [. W# E
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose( W1 Z ^/ j$ o" r/ Z9 f* @+ ^. x
is to determines whether a debugger is running on your system (ring0 only).! t; j& g5 r! S
( r1 o( k( n" p* I6 r1 X VMMCall Test_Debug_Installed/ x6 Y$ c- A1 G& W# p* N
je not_installed
1 E( V1 V$ C, A& Y0 d" n" @5 M6 ~
' X# x1 h! u5 d5 ^. g9 ^7 n! H: fThis service just checks a flag.
* O+ F2 e/ c) I6 ~7 ~</PRE></TD></TR></TBODY></TABLE> |