<TABLE width=500>8 ?# g4 P4 o! s0 A
<TBODY>! B2 d5 z& O* j& R d* \ G3 F1 q" |
<TR>
( l; `. \5 b# [<TD><PRE>Method 01
; a: q) Y- f* [+ q. k) E=========
# [3 i! S. g( b; Y! |, ?
/ D; b1 a7 W( I, `- aThis method of detection of SoftICE (as well as the following one) is
3 t/ O# x- C/ Z8 A! Xused by the majority of packers/encryptors found on Internet.$ H( e% Z4 Q3 p' u' a
It seeks the signature of BoundsChecker in SoftICE
4 p( C5 \5 }+ y# l F$ L5 M# `# H! ~: B
mov ebp, 04243484Bh ; 'BCHK'6 s J( A: M& a/ N$ D! z5 `. K
mov ax, 04h
4 M8 C+ ~# c4 k" ^ int 3 1 q. T4 v6 v5 r9 \& o, S: O
cmp al,4
/ C/ ?- @4 c/ l( B3 {3 i( M A. p& M3 a3 w jnz SoftICE_Detected. I& Y4 X' l& ]2 `$ Q4 @9 a# C
- Z' ~4 }- W' l0 Q
___________________________________________________________________________# U$ a/ c8 ]# d. |* I1 K
; c+ G7 S7 j9 G& C, v
Method 02; r1 ?+ @5 C( q
=========
# R+ r: v* ^% K+ q6 `2 t4 L2 w; y! A% g
Still a method very much used (perhaps the most frequent one). It is used& ]+ q/ ~7 ?' e
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,% R5 ? j/ V# A* J
or execute SoftICE commands...
G+ g* U! C9 O* }- jIt is also used to crash SoftICE and to force it to execute any commands; g9 D c _1 h6 N
(HBOOT...) :-(( 6 M+ [& m9 i+ K7 ]$ y# O% p
& ]! f8 _2 L9 c. h- Z: A( pHere is a quick description:* c% n8 p V, K) `# b/ {/ p
-AX = 0910h (Display string in SIce windows)
6 \8 F2 ]7 _$ U" u1 W-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)5 b. E- }( q% R2 \5 B: W; u$ E6 J
-AX = 0912h (Get breakpoint infos)
; P/ o: g7 Y* m% Z-AX = 0913h (Set Sice breakpoints)
3 I7 h0 `& b" X( l5 B-AX = 0914h (Remove SIce breakoints)) v# _4 L$ `6 n( Q2 D5 b2 [4 \
# i9 P1 C0 B9 L: F* c# @9 Z' ~Each time you'll meet this trick, you'll see:' p& U, L9 K+ X; t \; J3 J x
-SI = 4647h- k' _- v* {1 {- y/ f6 c6 O4 O
-DI = 4A4Dh
; A4 p$ \7 y4 dWhich are the 'magic values' used by SoftIce.
" y# q" u5 R/ I' Y3 j* P& j; jFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
& s7 N! |5 s/ b9 X$ P$ u( {1 Z+ Z, o) `
Here is one example from the file "Haspinst.exe" which is the dongle HASP
, Q7 X0 X @2 k, u' ~$ UEnvelope utility use to protect DOS applications:
9 G+ H6 j! a: o$ W* j1 E/ Q$ V5 p; V. o/ O: ^1 z: ?
' b) J0 s$ ?! |1 e* ^ l3 V
4C19:0095 MOV AX,0911 ; execute command.
+ s) Q* N0 Z$ {" K3 l8 l, I4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
5 C3 b4 F4 \! s8 I; C. g5 X4C19:009A MOV SI,4647 ; 1st magic value. k* l1 t: \: i* K$ r
4C19:009D MOV DI,4A4D ; 2nd magic value." m# L* N# h2 K% v8 u/ E
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)' o( i! M6 s ?. p7 I' f1 K' V0 C
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
+ g0 Z' D0 Z, Q1 D" l4C19:00A4 INC CX+ [. p5 p/ G C6 L5 h% b: b
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
+ h. Z C9 J& f; Q; ~5 ^7 T& H4C19:00A8 JB 0095 ; 6 different commands.
[$ U7 \3 D$ f4C19:00AA JMP 0002 ; Bad_Guy jmp back.
# s* B4 q/ k/ x# p% E* p5 j4 [4C19:00AD MOV BX,SP ; Good_Guy go ahead :)+ d7 K* X7 q% i" ~ n- Y
/ g3 M6 Z" K5 k/ V% h
The program will execute 6 different SIce commands located at ds:dx, which
+ p) V5 F, d, u: W# tare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
4 l' g# U0 C1 X _( b
' g/ E0 @. n; h& B0 c* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.& j. @4 Q6 V* s% z7 G5 x4 W, S
___________________________________________________________________________5 ^- N. P8 I1 M7 m$ Z
3 G- s& j5 i0 d/ ?! u* S, g4 \5 ?1 t; p; f* c; {
Method 03
7 M$ q/ K6 M9 g) C$ Q=========
0 P: J/ Q9 p7 }* B4 U' s! t/ |) ^% f* e% r; c+ J7 ]
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
+ I. u' J5 t: o: d(API Get entry point)
" W1 ~" p O# Q2 Q7 G5 i* Y
3 n. v: ?- l3 c e1 }+ ~6 }+ k
, M! R+ w/ S9 I4 F9 I2 X. z xor di,di
! r8 ?- e) x0 X, M' s mov es,di
; V0 J$ V0 B; u5 [; O7 D: j mov ax, 1684h - Q! J, q) {" y" Y
mov bx, 0202h ; VxD ID of winice" L! ]- E3 W( `0 Q" ^
int 2Fh( m: r; h# J. k' i0 U% c
mov ax, es ; ES:DI -> VxD API entry point
4 B9 {5 p# ~: w" b9 t add ax, di
% F8 |" I8 Z" s9 O# W9 X) G6 R3 X test ax,ax4 Y9 E& H) z! s
jnz SoftICE_Detected/ h ^. }( z( [; h
4 B2 A7 D9 _' H4 X5 W8 Z___________________________________________________________________________5 t }1 J# a) E
0 J+ L1 C3 i1 j7 t: f8 h/ R5 [0 C! GMethod 04
]+ e( p+ L1 f2 r3 Q$ g2 q2 p=========& E% ~! o7 [9 }3 Q8 j
$ M5 K T p5 g6 J/ F: T5 ]# oMethod identical to the preceding one except that it seeks the ID of SoftICE u) {" z8 T! P( T) {1 m9 B
GFX VxD.7 y5 i0 H- r) V
* [2 k% t( v4 @, z! F& r
xor di,di
* z1 g6 C2 M' f' M mov es,di
. K4 n! `) P4 R; d. [( E. J+ V+ e6 P9 M mov ax, 1684h
& [! |% |' _7 o8 w mov bx, 7a5Fh ; VxD ID of SIWVID1 @, v; T' Y) ?- U5 Y1 @
int 2fh6 T/ ^5 t2 V; w
mov ax, es ; ES:DI -> VxD API entry point5 i' E# C: } H8 D6 M: `& s0 w* c
add ax, di/ M# x' U7 _% `/ y+ y
test ax,ax9 E ?# Z: C, H1 ]5 l w- w: T
jnz SoftICE_Detected
: R, U) x' D: H. V( [
* Z' w) m: A4 D4 U$ N& ___________________________________________________________________________$ `" v* p* }) _9 Z9 I) k; v
: C c$ F& H, z! X7 Z5 u$ h5 V3 T
) Z' S" R( g5 g4 |Method 05
% c4 |- `" P9 m$ v, l" m=========
% i. Y1 |# E& ~! ^" c8 L$ t- [( \* ]
8 f; C/ n6 x1 M2 R, cMethod seeking the 'magic number' 0F386h returned (in ax) by all system
$ `# G0 b/ P5 ]" [& rdebugger. It calls the int 41h, function 4Fh.
: h3 U/ s) e2 K! U5 `There are several alternatives. . ]" E8 ]4 p" s: T% c$ ?% v2 E
% @4 X4 ^# p$ E' h# z( N- i- y3 IThe following one is the simplest:! z! z U; A. m0 |) U) [) b4 v
4 s1 o) {0 e5 c* D$ z! f
mov ax,4fh
5 ], f+ F( U9 n% U& k- Z C int 41h
; p; P5 [, n3 @) M# @7 _8 g cmp ax, 0F386
, Q1 p+ v6 U! ~/ Z' k. m; q( e jz SoftICE_detected# d4 a# B* n! j! g
1 O+ K& w! P2 I0 n: l" Y, u
- _" D) E( d% g) D0 T9 I" INext method as well as the following one are 2 examples from Stone's ! `( f- Z! U2 p" i ]; C
"stn-wid.zip" (www.cracking.net):
6 [/ o9 h+ |! I9 _; c# W2 g7 G$ J, P
mov bx, cs
W! @3 v M5 G/ b/ n lea dx, int41handler2. p( i0 m0 E: A2 ]. O. ~
xchg dx, es:[41h*4]( e6 s+ y! v8 C5 ^
xchg bx, es:[41h*4+2]; n9 C H4 _" k: @
mov ax,4fh
2 z; @4 z$ N! Y/ z& {" n3 a int 41h
9 [, ~: a7 L2 R% \ xchg dx, es:[41h*4]
d0 k2 N+ J1 @ xchg bx, es:[41h*4+2]" r" N' f/ Z# h! v0 R
cmp ax, 0f386h
9 z4 D3 }7 M# | jz SoftICE_detected6 `3 t7 I# `0 }1 n [% v1 M
0 C0 D3 b, a8 G. x' }( eint41handler2 PROC
( h% E$ R [% K- J iret
2 C6 ^ Z3 o! ?' ~/ d- v4 d6 Eint41handler2 ENDP4 v2 f9 X' z) [/ p6 J" u
: ^9 ~( R9 D7 Q3 a' z* \4 Q1 U
( D9 r# j+ e- ^0 `/ f_________________________________________________________________________" S* k+ z v0 F2 b
3 {9 _$ O9 p: e1 J
/ M% }) t# \) F; y
Method 06
6 O: V0 m/ h" f2 L* Z+ G=========# c3 J% r9 L) o* u
+ n& K; I3 c) K- u6 z9 x1 |
6 p+ E6 k# |$ }+ G T2nd method similar to the preceding one but more difficult to detect:
4 R4 [+ m3 \9 G+ O6 d" `: I O
. N& d% M' g7 ]9 k( L" l
3 a- f2 g8 Z' `int41handler PROC' t$ e0 \4 x6 w, Y" E3 w
mov cl,al% o0 V& N% w: i e: a
iret
d, w6 ~/ D8 m& x+ ?int41handler ENDP P( g' L# ^- G
& d$ C6 d# S4 h* ^
: X- X; z4 [& E- O$ i9 }
xor ax,ax: p E& |$ ^7 F. S
mov es,ax5 Q5 R% g+ @. z ~
mov bx, cs
) H* J1 [/ V. s% {- r lea dx, int41handler
9 b5 _. \' B% l r xchg dx, es:[41h*4]
% E; l1 F- G3 {/ P7 O xchg bx, es:[41h*4+2]
7 Q1 }$ J( [/ O in al, 40h" a' i/ n% a6 E& T- R! N
xor cx,cx3 F, _) x, U! c7 q
int 41h& C4 r0 ?! k. s, }# r k
xchg dx, es:[41h*4]
0 C8 e, n" ~. s& b; c$ J A xchg bx, es:[41h*4+2]
( J$ P: l. g& d3 h cmp cl,al: l7 b$ B' y; q+ E
jnz SoftICE_detected
v9 G9 j F" j' p; A% Q1 K/ ?( `, Q6 J' s9 _ H3 f( o
_________________________________________________________________________0 l4 F% N- w! I- r
& h" w7 k: T& ~
Method 07 P4 A, V" S. N8 d6 u6 r0 [
=========' Y, P6 a! |! @3 u5 j/ W
6 i8 L8 \& c0 d5 `, l
Method of detection of the WinICE handler in the int68h (V86). D- D' d+ w8 e* }% M t
1 b( V9 w/ f* K0 [0 L% J1 C mov ah,43h
5 V! F* g$ [) J2 X int 68h
+ n# l+ j! X9 u* C" d7 m cmp ax,0F386h% o+ x, B( V9 j. d0 z
jz SoftICE_Detected
- X$ F$ k$ ?8 H* \# a" z8 r" q0 o" }
8 E: Y# @+ T% t# E
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
. T* b4 t' G2 B/ j/ B app like this:
# w; ]( Q" x9 k
3 ], u, J/ m# d( m7 I! p+ H BPX exec_int if ax==68
" O* p. o* d: E5 G2 [, Y' Z (function called is located at byte ptr [ebp+1Dh] and client eip is
8 V$ f% R6 h/ Q located at [ebp+48h] for 32Bit apps)
4 e$ [/ c, o6 G2 S- t3 ?0 @__________________________________________________________________________
! r, @9 T' l& e" [* N( H# C1 g$ d6 w6 F0 D# d F
1 r Z5 G; B# J0 \" X a
Method 087 ~% f& Y G4 w
=========
. F$ Q! F3 q0 j. ?5 [
, O. @: S+ N4 _) K T! L% EIt is not a method of detection of SoftICE but a possibility to crash the3 a9 h& j) T0 t
system by intercepting int 01h and int 03h and redirecting them to another
9 o' ]6 j n& H# @- Q9 `2 xroutine." q/ d) _$ L+ b4 k3 r4 G+ }
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points3 |3 y: m# K4 Y: A# D, _: a+ E
to the new routine to execute (hangs computer...)
, O# l. P% `# a. B: A% h
- m8 U- U' x. ^+ y2 V mov ah, 25h
& l; [9 E% _8 ]- A mov al, Int_Number (01h or 03h)" \& {! [) I+ M: w, u4 W) Y
mov dx, offset New_Int_Routine
( P0 I3 V$ k$ X int 21h' u2 f$ ]! q8 g
" ~% N, G! x" Q, z8 w__________________________________________________________________________* G" u$ b$ x" f5 q7 l; N
- ~) _+ c: n/ A3 R2 z6 p: E' F, D: }; pMethod 094 Y% Q6 v/ P" O. C" N
=========
* v+ n0 t9 }) S/ ^& ^5 Z8 Y3 t7 i# @5 Q1 Y, ^ c
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only% t) c! E3 u% o1 u9 P# [% i1 e
performed in ring0 (VxD or a ring3 app using the VxdCall).( ]: ^3 [8 V: w# v
The Get_DDB service is used to determine whether or not a VxD is installed3 u v* [: L) _! W
for the specified device and returns a Device Description Block (in ecx) for
- {2 n. { B# k S8 }% Mthat device if it is installed.9 r* V; |. ^$ y- y9 t
4 k, a8 D0 F; A( |, n4 g mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID K4 _7 x' a9 C8 S1 O
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
9 N) D8 C S1 Y/ | VMMCall Get_DDB
2 ]) }% P1 T1 h+ y! T mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
# o/ }% ]9 O! _7 V& p- q
0 X, l9 K& b) s5 n+ _9 j( s4 DNote as well that you can easily detect this method with SoftICE:; N' i% |8 @3 ~, ^/ R. }- ^
bpx Get_DDB if ax==0202 || ax==7a5fh
. s C7 @; q. }. n4 y) P% Q: u! _4 Y; i/ B
__________________________________________________________________________( b* v; l% Q: @# z k# k
: [8 K- ]! w1 K; q: S2 c2 z; jMethod 10* _2 V0 W3 U( k7 i7 n
=========+ Z) [7 h: @. h. y$ u. E
# }" k) J2 Z/ X5 O/ ~/ u3 I=>Disable or clear breakpoints before using this feature. DO NOT trace with
; T5 K* P, G; n5 T SoftICE while the option is enable!!0 F0 }( }- e, ^9 q) @' H. B
/ K6 P" P# |) U- O: ?$ O, GThis trick is very efficient:
6 ?! h) R) `0 G5 V1 J* B0 Vby checking the Debug Registers, you can detect if SoftICE is loaded" `4 ]7 ?$ C& x/ {
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
" D' m, y0 ]: W5 ~there are some memory breakpoints set (dr0 to dr3) simply by reading their
9 V2 z& t1 P# N# I6 Zvalue (in ring0 only). Values can be manipulated and or changed as well, }( x/ F3 b X( m1 W m8 t
(clearing BPMs for instance)
( e3 ^( N: m" r* G9 H0 F, X5 O9 z& q# G" i* [2 Z/ H
__________________________________________________________________________
& @$ X. F1 G1 E, R! n/ g- z, L5 E. i% m4 ^0 ]( ^
Method 11! M% z. x0 K* P, I
=========3 M! m ?' w7 u% M; f
$ s! S, u* e) G$ p# W# J4 {This method is most known as 'MeltICE' because it has been freely distributed
" n+ d6 X! p7 X+ I+ n' Ovia www.winfiles.com. However it was first used by NuMega people to allow6 |% s# N1 H% ~! I# g6 N/ o
Symbol Loader to check if SoftICE was active or not (the code is located
1 E; P: x! y+ g' @inside nmtrans.dll).
" O7 T: R7 C: K8 k6 N& a4 M% F# d& G/ Y% M$ v4 ?
The way it works is very simple:" Q' t. w b; s- w, w
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
( w+ D; S0 x1 G" ~/ z" [7 L& @WinNT) with the CreateFileA API.
7 U! o5 A+ I! r0 J6 D; O$ n' W6 f0 ^! E4 J- @6 z
Here is a sample (checking for 'SICE'):* ]( N! O# ~ y. Z
4 O; _& r G2 P9 j: S( _# ^& H2 n/ I
BOOL IsSoftIce95Loaded()
O% v ~, _1 h" Z% d7 f, w7 x r{3 ^9 z/ h' S+ I# T1 c/ G& F P9 ?
HANDLE hFile;
, ?" E% @5 {6 m( x, \' M hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,! v( V/ ^0 p8 T* D
FILE_SHARE_READ | FILE_SHARE_WRITE,
# M8 Z `! K2 T; I, ? NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
& K# N1 n# p! m1 d# o if( hFile != INVALID_HANDLE_VALUE )" Z2 N- ?! X5 p4 O2 b
{
+ K7 l( {* {2 N/ u CloseHandle(hFile);
7 p; o* Z( j; o: e! J6 l/ f4 Y: V return TRUE;
+ ]' h5 a% T- E# M0 |% D }) v2 ?3 h' ]1 s: g( u
return FALSE;9 J. U0 X9 N& g4 c& o: k) N
}# T- P7 u6 l3 ^1 D! }2 z
, T H' Q1 ~3 Y) o4 ]Although this trick calls the CreateFileA function, don't even expect to be
& ^1 m3 Y! a2 m& D6 `able to intercept it by installing a IFS hook: it will not work, no way!
( X5 X% r. r \( \In fact, after the call to CreateFileA it will get through VWIN32 0x001F
( M2 i N2 w" `6 h/ Q+ [service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)! h- `( {; n4 R* G( b4 q/ ]
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
7 ~, N6 w6 L9 F7 x" O3 bfield.0 ^: e" I: ?' _( ~- q: q
In fact, its purpose is not to load/unload VxDs but only to send a & ]! Y" G- m6 v# e v
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)) p# z6 H+ [$ Q$ K5 d1 M. D! k
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
9 O$ s2 F) d5 g4 O- lto load/unload a non-dynamically loadable driver such as SoftICE ;-).
; e) R, c8 w6 XIf the VxD is loaded, it will always clear eax and the Carry flag to allow
3 B9 W8 k/ L0 D9 c: T6 w a( v7 hits handle to be opened and then, will be detected.
2 K3 ~* m6 m: Y( ~( G1 G0 i# DYou can check that simply by hooking Winice.exe control proc entry point
% d1 R) X# \* {2 M8 `1 b8 V- wwhile running MeltICE.! T' F+ ?: [ L
$ k1 I* M/ n' @* [0 B
9 e6 `; i7 l4 \ 00401067: push 00402025 ; \\.\SICE; m# Q& G" k6 |& \+ R" J
0040106C: call CreateFileA5 e. }9 J$ c: L* G7 X
00401071: cmp eax,-001* g: _5 N) K8 p$ C& Q
00401074: je 004010915 C3 |6 e* G+ h5 S" R; i
6 j6 n" R( l6 s! u5 P
# W t, H; \2 UThere could be hundreds of BPX you could use to detect this trick.( X% V$ C9 q& X/ F
-The most classical one is:% O& X! k, i3 N4 W7 n+ Y( b. G
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
! L5 H0 d% \0 ]. f0 ] *(esp->4+4)=='NTIC'
, u, U+ f) u, l6 r
7 g7 b1 V0 v7 M& O% r3 C/ t: |-The most exotic ones (could be very slooooow :-(! |! F( f+ e- p' Q6 H3 o' H
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') ! N, q/ Z A' q" Q) A+ t* g2 v( z ? ^
;will break 3 times :-(9 W$ Y0 ?; P9 @ H4 V; h- G6 [
( Z4 d4 m h1 ]" R9 f* c-or (a bit) faster:
. \% O7 ~: k8 C BPINT 30 if (*edi=='SICE' || *edi=='SIWV')& _+ H3 [6 T8 l) n
9 ?+ @$ F8 s1 v5 H# q9 W BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
1 w8 \- D2 |4 C ;will break 3 times :-(! \+ f) j- k% ~' V8 B \
6 c( K1 y$ R5 C2 I0 l/ k. j2 p% q/ I% c-Much faster:
8 N2 ]( `8 D# Y0 b2 H' @! I4 ? BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
8 [" \" Q X* J, \5 S
0 H# f% Q$ N$ S5 N% A* xNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
& |3 ^2 e$ P3 w% j2 n, t, _function to do the same job:
$ {0 \( x0 k) e- l) h! w4 E/ {# I( \5 p p) O; f
push 00 ; OF_READ
) s, ^, x1 F- X/ ]: z- N" m" ~ mov eax,[00656634] ; '\\.\SICE',0
8 W8 h- I, p$ G( W) `! f4 e push eax% |) C. ^" U. N- v
call KERNEL32!_lopen
% p8 s9 R8 j" u/ O4 Y inc eax! Q8 A; o b7 v+ r; V: h; C
jnz 00650589 ; detected
# d! {, k1 O9 [/ t4 y* K, h K push 00 ; OF_READ
; @! e ~4 _+ [# n5 o mov eax,[00656638] ; '\\.\SICE'
$ n% @' ~8 x ~1 _' ~% R* Y3 p" O" t7 ` push eax# g" C3 g, G# }+ y/ z$ ]4 a" f
call KERNEL32!_lopen
9 c5 u& b& A$ R y3 x inc eax
" U0 `; H7 X7 X- g' ^ jz 006505ae ; not detected
/ m7 |7 W/ R4 E9 T' u3 m' P! y
3 U2 p8 @# i& s. ?; U, W& J
__________________________________________________________________________4 t3 x6 e2 l% m6 m2 z* r
8 Q- W+ K E1 x6 E, X
Method 12
7 ]& u8 ]! k7 D& c2 S( }=========
2 J P/ q& l+ y9 O( w8 ]! r4 g# Q4 @" z* x+ b; W7 ~
This trick is similar to int41h/4fh Debugger installation check (code 05% z/ e; D$ C( {5 |8 b
& 06) but very limited because it's only available for Win95/98 (not NT)* v. R5 F7 A$ c- \2 C
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
( B7 g1 z# f( @) s( R, L! q
+ H3 e# w7 u2 S, `6 L/ |2 N push 0000004fh ; function 4fh' L$ T# g3 x M( P" k# M7 O
push 002a002ah ; high word specifies which VxD (VWIN32)
5 p3 F2 D+ z( u8 ?0 |$ T1 h ; low word specifies which service
% P4 u0 L% M% S (VWIN32_Int41Dispatch)
4 ?; F7 k9 s% L! L$ F' A! A call Kernel32!ORD_001 ; VxdCall9 ?( K8 R: ]: M+ t! j" q
cmp ax, 0f386h ; magic number returned by system debuggers
/ y1 r& W, _' p! x6 O: J jz SoftICE_detected
/ {) u, q- @8 |2 H! E+ [ X5 Q1 U9 |4 T
Here again, several ways to detect it:3 X* w. U D$ w* }5 v
* @" b1 f; o5 A9 d
BPINT 41 if ax==4f
2 g' h" d. D$ O) e$ U! o( U- a+ M
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
9 _ m( ^& e. p* F: X
% j: ~- E4 m* y7 I4 Z0 R, b BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
/ n8 L4 ?) J8 I/ p
* e$ U$ [% W5 ]/ l( s BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
. F. x! A" n0 k% m& j3 R" t0 r
2 ]" H; b3 `6 Q__________________________________________________________________________
, U2 E/ Q; |7 h3 D/ v# h8 C3 F& B y n3 c" E# D o. g
Method 130 [; ^2 b! t: c
=========% ~7 d( y% B6 d. M& ^, a6 h
5 j% ~7 s: h7 T. r5 aNot a real method of detection, but a good way to know if SoftICE is2 X& x/ S+ @1 ^
installed on a computer and to locate its installation directory.
: ^4 R) g7 K1 M' _* H+ x% ^It is used by few softs which access the following registry keys (usually #2) :
2 a0 ~* }5 g. Z
/ E9 i+ E1 h/ G% L7 @, U6 u: ~' f* I-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion+ ]5 x+ ]) k7 n0 @
\Uninstall\SoftICE9 ~( L% Y: f6 |+ A9 K* M
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE) f: }+ h; W2 ~ F
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
2 u/ W$ p+ ]# I d( a- b; X\App Paths\Loader32.Exe
2 @: F+ d# j6 z' ?5 B* f/ S, s$ s5 E2 \5 O' t
- Y2 Q' k% ~. h9 i k
Note that some nasty apps could then erase all files from SoftICE directory1 N4 {7 G2 N. c B
(I faced that once :-(1 Z" Q" {* }$ t; B5 ?9 j( b4 w( }
; |- [' h+ B6 k0 T- HUseful breakpoint to detect it:
4 x, ^9 P" g* D7 l8 Z; k( P; `4 y u& G b$ ^
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'5 {8 j! L [9 v& a
, d- q! n2 O/ S7 G/ L__________________________________________________________________________8 K; J' L5 o9 ~7 `! y
! v9 i2 k% ^$ x: g2 P8 c: D6 I" t7 C7 P* J# J' t
Method 14
, K0 p2 \# n' u% Z=========
2 Z: w7 I( T! i; @. O2 X
: f: v. H; \9 [1 i3 fA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose! v/ Q/ h! C8 ?7 l3 k2 d" F1 O
is to determines whether a debugger is running on your system (ring0 only).
, N0 c5 X1 ~" t' ^1 J4 b' @2 ~/ S# M: ]- N: i! b; m
VMMCall Test_Debug_Installed9 Q5 a! B+ S E/ H. e. `
je not_installed4 N! n! n) j: P* E8 F: y8 |% Q
H) U9 r& b# t( x9 q" R8 b
This service just checks a flag.1 g. f' g2 B. |3 E) |
</PRE></TD></TR></TBODY></TABLE> |