<TABLE width=500>
: Y. c" L; `; h: a& v<TBODY>
8 o2 \9 Y4 n9 A, Y<TR>
+ v1 S* X2 A: q( r: J/ ?<TD><PRE>Method 01
! W9 |, p: [% S1 d. j. \& i a=========
) l# _+ U3 v& p# ?% d0 @# M; u! O$ V" j8 o; J
This method of detection of SoftICE (as well as the following one) is
7 y1 n/ M6 m+ h% Lused by the majority of packers/encryptors found on Internet.
9 Z2 z; W2 o# N, ^It seeks the signature of BoundsChecker in SoftICE. K" r; ~* u- a" G9 b
% T1 ]( G6 F' S% S! @ mov ebp, 04243484Bh ; 'BCHK'( [$ }' y, t8 O4 E& K
mov ax, 04h. @7 s4 D0 F( \5 s
int 3
( K/ y; w* ? V o cmp al,4
' W a8 N+ D$ r! v& p3 G( e jnz SoftICE_Detected# r4 h5 q1 E7 }5 b k* z
4 W% L/ W. d3 s% @5 x___________________________________________________________________________
3 s% p0 D$ v( O% c: `
/ B+ `$ j; K1 bMethod 02
5 g x/ \! ]2 J- T5 Y+ N=========
. P: d1 a9 V* E, ^! D( a+ F1 a# h; A" z- m9 U
Still a method very much used (perhaps the most frequent one). It is used
" _# g9 P1 _; d1 u; r) z" Oto get SoftICE 'Back Door commands' which gives infos on Breakpoints,- v0 m0 U: b4 [- T7 k
or execute SoftICE commands...
3 i! x6 I. d2 j% C" e e8 I1 GIt is also used to crash SoftICE and to force it to execute any commands
+ H8 y/ q) Z4 Z6 P(HBOOT...) :-((
+ o" T& m `0 F& d. M& d+ c& ?, ]% T3 P5 ^7 l r/ ]% D8 [5 _( }
Here is a quick description:7 ^# [- B& {8 ?! n. j/ g6 \
-AX = 0910h (Display string in SIce windows)
$ r0 f- Q9 W. b0 X2 k3 F2 c-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)* k$ w, {# _0 a' x
-AX = 0912h (Get breakpoint infos)
/ `8 d) H7 i$ D. q-AX = 0913h (Set Sice breakpoints)
; C% r$ B8 V) `( `) U-AX = 0914h (Remove SIce breakoints)" x; z1 V% w5 n0 }, A. y" d3 u6 D5 R
5 d# u6 V8 W% v6 l# [: f
Each time you'll meet this trick, you'll see:$ k5 Y% q$ `& b5 E4 p% J
-SI = 4647h+ I; \ l& r# h( F3 A7 L& Q" Y
-DI = 4A4Dh& O a9 i: ]2 y) `
Which are the 'magic values' used by SoftIce.
) t% n) ~6 _! |$ wFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.0 M4 B& s) J0 I y6 b: \
( y% T2 Y1 J# o1 o. e$ y' S# U% _
Here is one example from the file "Haspinst.exe" which is the dongle HASP
2 a8 W/ V, U& J9 l! K5 F) ]Envelope utility use to protect DOS applications:7 W2 l9 X: o0 A' b' @3 P
2 t' {# N+ q& i
2 |: o9 C8 Q8 a( D
4C19:0095 MOV AX,0911 ; execute command.
0 O: j3 l3 i6 k. e* d y4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).# y5 N2 ?3 x; C6 S R1 }$ e
4C19:009A MOV SI,4647 ; 1st magic value.
. B/ G+ c8 v6 M$ {4 S Q% |4C19:009D MOV DI,4A4D ; 2nd magic value.
8 g: i% |$ h. X* V7 B! I6 d4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
. n' a) k0 {0 p* x9 x- T4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute7 W# J) z, Q* k! l% F% Z8 F
4C19:00A4 INC CX% c' B4 u% {: C3 m/ v* n
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
x% J* \' b& T# F3 r( u4C19:00A8 JB 0095 ; 6 different commands.: `# _: q& N7 n) P, ^
4C19:00AA JMP 0002 ; Bad_Guy jmp back.
9 J- R6 T. b6 E, z4C19:00AD MOV BX,SP ; Good_Guy go ahead :)+ f. `9 D- Q8 H/ w5 X2 [! F6 I" E
- M: K- }8 d; V! i0 j* d/ C
The program will execute 6 different SIce commands located at ds:dx, which
% A8 l, R9 ^9 `) {. {( Zare: LDT, IDT, GDT, TSS, RS, and ...HBOOT." V# Z3 W; K+ H! H* K
. y( f0 _( x7 P' q3 l
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
3 `. J! n! C, o7 P: B___________________________________________________________________________( e/ x8 K+ `9 X( Q9 V" X1 W0 f. w: q3 s
# `8 B* a( k, T9 i2 _1 j2 Y1 B% I0 ?$ _
Method 03
6 D$ ~% `: z0 q; B=========% z2 A# Q9 s" U3 Z" K1 k( i
R3 Y. }3 l- j4 @
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h$ q/ Y% s B" e! ~6 h
(API Get entry point)1 j1 R3 e( C3 D p0 A& [' M
8 B: v! h* O! N$ w! s$ Q+ n3 c
9 p4 Q0 i4 b6 G. E, S4 f' Q
xor di,di
3 i( C, }3 v6 Y3 r, q8 I mov es,di
9 Z9 O# _# Y r+ [" l mov ax, 1684h
" O1 q5 b ~: T: f' f mov bx, 0202h ; VxD ID of winice* _% B& k x; t5 ]1 N
int 2Fh
4 B6 Q/ v0 I B7 D mov ax, es ; ES:DI -> VxD API entry point% B5 L' X0 R8 V7 ]5 U: N
add ax, di0 s9 _- b. h9 j) h5 M" ?
test ax,ax
& v0 h. K/ X& B( A! M, G: ^; e0 ?! @ jnz SoftICE_Detected
" J5 B6 s6 `, _3 Y9 p- i- q4 H. [
___________________________________________________________________________
! ~7 H8 A: [* m1 x2 T
9 M. w3 W% p% i5 I; @Method 040 n0 w r: I: v
=========
H; J, J! ?5 X( Q2 `1 B
) I5 r8 H( M$ I, PMethod identical to the preceding one except that it seeks the ID of SoftICE
* N1 l9 ^) j) X; Z% P2 QGFX VxD./ q% ~6 p X9 h
( B! B" {; F+ j, E% v; m xor di,di
$ ^ O& t5 e- I) T: a3 @ b mov es,di7 K6 }: B: d' p' P( z- q$ e$ o8 r
mov ax, 1684h
* ?8 `. |* V" ` mov bx, 7a5Fh ; VxD ID of SIWVID
7 I! r( m B3 S int 2fh
, G! L" j& r/ ~. A# y, a mov ax, es ; ES:DI -> VxD API entry point
+ O% j8 S1 v/ R# ]# S add ax, di
; i$ ^7 K) q& S4 r( K test ax,ax' k! s& v- V p( {& Q3 |1 X
jnz SoftICE_Detected
$ Q, f+ U/ j) Q8 Y3 ?/ l
8 M& o ?1 Y- i$ M' I7 S__________________________________________________________________________# n- b. `' x3 G# k' @2 W
8 E( ~) `7 E; l2 _# v# q6 R* s
! Z! v+ I1 Z$ X% O0 J- UMethod 05$ H/ _$ q. T4 q' |# x
=========
! D- W" v9 F5 N/ Y' V
" d2 f% W" t" q4 P; E1 T5 gMethod seeking the 'magic number' 0F386h returned (in ax) by all system4 J0 v4 @0 o6 c ^5 @, o
debugger. It calls the int 41h, function 4Fh.1 `. G8 s6 H- _9 a" O# b
There are several alternatives.
4 p4 R8 Y. g7 N$ p0 t) h* F1 H9 s* ]1 n4 M1 X9 S3 {! ^
The following one is the simplest:4 q$ U3 X, {9 c7 M) Y
& X& {4 l5 r3 W- A" G% l mov ax,4fh
# G( D( u5 c2 I5 X* g9 t1 J int 41h8 o( b! ?/ |5 Q- l- h
cmp ax, 0F386& Z* `7 c M4 a
jz SoftICE_detected
7 A: g" V! c! u" \2 I3 B9 e" Q: O$ Z5 p7 Z4 E
. F( ?2 j8 ?8 {" W, z. j, G
Next method as well as the following one are 2 examples from Stone's
, D" F' F! i+ ?9 ]5 S" t% o"stn-wid.zip" (www.cracking.net):3 t) j# b, w0 N: A
! m% [, m2 [5 ` mov bx, cs
9 J% a [: |1 x$ a) f" d. y- l lea dx, int41handler2
) p( X$ \8 w/ e6 _2 K1 Z8 Y xchg dx, es:[41h*4] u* K- E) ?# `6 l9 u
xchg bx, es:[41h*4+2], Q* i! j5 P8 E$ c) A$ _! V
mov ax,4fh. J2 b5 K4 i' u- K
int 41h9 B& L; `. Z. u/ [
xchg dx, es:[41h*4]
8 b6 f1 @& D7 m$ n$ s& F; V xchg bx, es:[41h*4+2]
% V7 r0 j2 u: t9 B7 R; b, s, \ cmp ax, 0f386h6 Z I' [9 b$ F
jz SoftICE_detected# S# I. c& ?$ _& [% z2 E
8 k$ c, @8 _7 L& Rint41handler2 PROC
6 y0 s$ j8 n+ B! Q7 r% D- Q/ i( y iret; z# A+ ]2 o0 J4 W" p+ K( n# _
int41handler2 ENDP# ~8 D- U7 X8 ~+ h6 `
) N9 H* [6 X, s5 T! t
" h1 a: Q1 P" j: c& b_________________________________________________________________________
& n/ [6 Y* t9 t3 K7 @' j R: p k) T# x n! L6 b9 y: [' X! N6 ^
' H0 e" ~* O5 v& R+ I9 h& K8 wMethod 06
% M/ f& X9 C& X5 D=========
5 g* S! m! a/ v% n; n* W
/ r4 w. X" O: ^0 Z- v
/ H5 @) w# B% n. o2nd method similar to the preceding one but more difficult to detect:
1 P7 U1 Z9 o( J) o5 [1 ?/ i% B! h/ q$ B& G
6 b( z+ s8 Y# o+ G( I- Iint41handler PROC
: _( i. X) T* M+ \8 j2 k, f5 G mov cl,al
- a' K b! o. v- B( d iret
; D& v- N+ |* S( r) K. kint41handler ENDP, F0 E$ f7 S$ V, `, `' W- X1 b
# j3 ]4 c: @; X$ Y7 p3 o+ T
" P4 f: B2 L' \$ I6 m xor ax,ax
8 ?. D5 o" a( L. V4 G: e- G. b mov es,ax" N2 t. x4 a1 n4 X F
mov bx, cs
* H! F! C+ n& @' U" l+ J lea dx, int41handler: M0 ^- j! `% \7 X8 ^# E
xchg dx, es:[41h*4]. W. t+ m3 Y3 \+ Y, K t" { B
xchg bx, es:[41h*4+2]# O; t; x+ z6 ?( B6 F# T2 c
in al, 40h
* b9 h& _- C% d5 u, ]1 h/ x$ g xor cx,cx
" i3 a! o! [: ?& Q; L4 [ int 41h$ b9 l# W% t+ U; b5 b
xchg dx, es:[41h*4]
, Z+ u! S. b* T* a xchg bx, es:[41h*4+2]8 c# D1 {1 b9 b, x j1 \
cmp cl,al
9 h5 v3 ~7 a$ x2 P+ t d' I jnz SoftICE_detected. s- g$ m; G9 N
1 {+ ~& B% q6 Y( F" A% S' ^_________________________________________________________________________( g7 ]2 W C5 z! R
5 ^6 t# K1 I; M/ o; [/ b
Method 077 }2 {$ D8 L) W% s
=========
- l5 J; D- a* N0 a' P4 m
( i! U3 d' @ N& XMethod of detection of the WinICE handler in the int68h (V86)8 h0 T0 T3 E) \# U+ K m
$ v5 c4 [2 y7 w9 D mov ah,43h; Q- `: v) z$ \% D3 |4 Z$ ?( ?' {
int 68h
3 q% g+ N$ u" s8 p1 C Q6 f cmp ax,0F386h1 k4 d! y2 ~, t5 G; P
jz SoftICE_Detected
w% ?: K1 [3 i# ^% s4 k& u! h0 W" i% R9 B) l% T
: r7 O0 y# U. O) M
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
4 ]; N# I" w) Y( b( @ app like this:, \% X5 z- ^+ Q* k# D# h
, Y! C0 L1 [: D7 X1 ^ ~$ G6 K5 } BPX exec_int if ax==68
: S" u' Y. k3 |3 @& i) x! k( [ (function called is located at byte ptr [ebp+1Dh] and client eip is
3 l0 }% l( Q. z. U H1 J& u located at [ebp+48h] for 32Bit apps)
$ {/ N' d7 x+ H__________________________________________________________________________
* \' m3 Z, v* m& E. Z" K) T5 w8 Y2 t+ P8 e) h/ @. R; Z- E* c
5 G4 L$ ]# K: i9 t; M7 V
Method 08
" t/ x3 [1 Z; N0 \) b' }6 m=========4 Q Z% ]4 } S! o# E2 l
8 W3 V# |( N3 b9 G1 g4 ]It is not a method of detection of SoftICE but a possibility to crash the
[& `# F3 U7 s- [% B5 {system by intercepting int 01h and int 03h and redirecting them to another% t. O5 V% i& b& A; m. ]5 X: g
routine.
& ~0 ~8 w4 S7 {# }0 t5 g+ _* wIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points: R: L% o* I7 |. c9 J( b
to the new routine to execute (hangs computer...)
5 D% ?2 _6 C. T) e& m
% f0 w* M4 Y% g mov ah, 25h H% z8 A- _3 c, J
mov al, Int_Number (01h or 03h)
! X& A& b# M* D6 O" J mov dx, offset New_Int_Routine$ G& w8 B7 w* T
int 21h, M- i6 [9 j2 J: U. u! j7 ]
! ^2 {3 C# `* O1 T( J+ v4 o__________________________________________________________________________ C6 Y: ]5 w4 L, t* p. u: s. N2 ^
) v+ J" n0 E5 R2 l8 _Method 09
+ P1 D8 ^8 |2 }1 t/ P=========! y( G0 ?2 J9 {, `
& T/ [* [3 u# k9 S I8 S3 v. WThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only7 i) `5 H& f4 B
performed in ring0 (VxD or a ring3 app using the VxdCall).
! `! H: D; T+ \. k, i- ?The Get_DDB service is used to determine whether or not a VxD is installed
6 [1 K, z1 C' |! H: j$ T% }for the specified device and returns a Device Description Block (in ecx) for% }3 x7 {" e- j& M; ?9 o
that device if it is installed.
, q6 _0 [9 A" w: K- r) B; E5 t1 H# m5 r
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID% g* \+ T6 d; D: d- J# A" }) [
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
# r- C3 _; A1 k$ s$ [" J D% m% | VMMCall Get_DDB
! [- q# C, p& m: n8 j/ F$ B mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
6 q! _5 g- g2 C1 n: {& T* A: H8 m6 {2 y, P
Note as well that you can easily detect this method with SoftICE:
2 G3 }, U& z* p* k# I3 f& J bpx Get_DDB if ax==0202 || ax==7a5fh6 ^$ l: @3 d6 }# j
3 [% x4 {7 \4 n% e" a( K6 t/ T__________________________________________________________________________
; R3 N( A0 g" H
) e# j/ Z+ j. q/ {7 @Method 109 B7 \) ]3 A8 g$ x! ~. a' \ ~# L
=========
& E. ?) ?+ ~2 g# P8 V. ~0 i7 m
; s: C. o% ^7 Y0 `=>Disable or clear breakpoints before using this feature. DO NOT trace with% c1 w/ r' ]: Y, i U# Q* n
SoftICE while the option is enable!!
! z. A0 K1 D8 L1 V# a6 ~+ v4 W. j/ z
* ^) |+ b: G& F, dThis trick is very efficient:* i& B& H N" G" L1 N$ o" i5 E. J
by checking the Debug Registers, you can detect if SoftICE is loaded
! D! A7 L" r9 x9 z6 F) S(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if5 ]% b( i- U: |
there are some memory breakpoints set (dr0 to dr3) simply by reading their2 @; Q5 E* U* n7 ]
value (in ring0 only). Values can be manipulated and or changed as well
8 k2 J" q: P3 A2 W% R5 G5 _- d(clearing BPMs for instance)
; t4 F: I, I0 U1 |
* r; s7 {4 p% p7 e1 S) V__________________________________________________________________________% \4 P4 P' V# W4 }
/ U9 y6 M- A8 x8 a% A+ fMethod 11
3 a: G7 `/ V( Y) C; Y4 X2 ~3 N, O4 S=========1 g: v' U4 k& t: a7 @
! k. A) q/ H; a4 f w9 p& PThis method is most known as 'MeltICE' because it has been freely distributed
# |. Z" N' K1 h/ Z$ C1 Evia www.winfiles.com. However it was first used by NuMega people to allow
* {5 R1 T$ L+ x! t a& B: qSymbol Loader to check if SoftICE was active or not (the code is located
3 o. j2 I+ o5 y$ B- _. Z7 t% v& Linside nmtrans.dll).
: I& A& z; F$ D' Z/ @$ o
" j" _9 c, A" N7 X2 fThe way it works is very simple:, b& J. D* P0 @
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
/ F$ y# f% Z$ M u5 gWinNT) with the CreateFileA API.% h# h) {. | G4 b
# w5 x' T: v, |Here is a sample (checking for 'SICE'):
# }! K$ C6 U5 ]' s k6 C3 s5 f0 b" B& a* Y6 m+ s8 [ l3 {8 X6 j# |% y
BOOL IsSoftIce95Loaded()2 ^9 q [' G* n2 z$ v& p- S
{# m+ y' s0 B6 X. U
HANDLE hFile; % K7 ]) q5 K6 N
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
8 @+ J. x/ z5 h: B B T* ] FILE_SHARE_READ | FILE_SHARE_WRITE,, N' f" I" R0 z# l2 Z
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);: p8 O$ B* M T: s" v+ ]3 o
if( hFile != INVALID_HANDLE_VALUE )
& v( Q ~' R+ N( w, y. @7 s9 P' V p( } {1 u/ V, o( g/ _! l
CloseHandle(hFile);" J* @0 P2 f' J/ H
return TRUE;
( B5 ]9 h7 A/ K9 G }# W. u6 K. S2 c& \, Z. l
return FALSE;
6 n1 |! h5 W! j B/ c}* t3 Q" i9 T+ t2 \
( {$ I4 V9 R: V# I. Z8 S/ VAlthough this trick calls the CreateFileA function, don't even expect to be
$ }) f( o# ]7 \1 l8 s6 G. a7 p3 |able to intercept it by installing a IFS hook: it will not work, no way!6 ^+ \: s0 S B, f) A- D, v
In fact, after the call to CreateFileA it will get through VWIN32 0x001F3 ]0 F0 {7 Z$ y- ?
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)- k/ }8 G/ q0 |' e5 W" C+ U$ J+ g
and then browse the DDB list until it find the VxD and its DDB_Control_Proc$ ~. Z( h! i! _, n* k {
field.
2 t% ~ D% v$ @' ^7 p1 l1 B: L& g( h, \In fact, its purpose is not to load/unload VxDs but only to send a
1 k1 |) z- d- r) CW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
/ {' f4 Y- ?$ Qto the VxD Control_Dispatch proc (how the hell a shareware soft could try* f/ o7 E" g. W" x& `; d' }' p( y
to load/unload a non-dynamically loadable driver such as SoftICE ;-).6 l2 O8 O" H3 l t
If the VxD is loaded, it will always clear eax and the Carry flag to allow0 I R: K1 p0 t* N$ Q' y8 h
its handle to be opened and then, will be detected.
2 n& }0 ]2 z8 c- w# e, S2 ^2 }You can check that simply by hooking Winice.exe control proc entry point4 \; ^$ d; R! T. I; ?$ P6 a- d
while running MeltICE.
' d: @) }, N6 ?- f
; c( l- v- w: v. s& Q5 s/ [& Q
00401067: push 00402025 ; \\.\SICE
0 C' I; q$ a* @ 0040106C: call CreateFileA3 J0 L6 @2 i* O/ O
00401071: cmp eax,-001
2 d, _0 t0 ~# }0 | 00401074: je 00401091
J2 D8 L I3 c' w4 G3 w& m/ W+ ^9 r R9 t
& w1 Y5 P, j+ k3 g
There could be hundreds of BPX you could use to detect this trick.
. k% d4 J% ]/ W-The most classical one is: P+ j5 T! A/ L4 M7 r, V
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
) e9 l7 I/ S- T9 @4 p- y *(esp->4+4)=='NTIC'" }! i7 F- Q1 j9 q* Z3 y0 Y
3 x! U' f) I. H7 \3 m$ i1 t9 ?-The most exotic ones (could be very slooooow :-(
# E. Y% E; i3 e# e; h2 P BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') ' w5 |# r: u% H8 N2 M! E
;will break 3 times :-(
1 I! r" |7 j& _/ ~9 C! D: \& T# V
+ _" b# X, Y8 L$ {# O- ?-or (a bit) faster:
$ J: N( E! G% s E" u L2 b/ c$ z3 B4 Q BPINT 30 if (*edi=='SICE' || *edi=='SIWV'): K. E: X( a8 _9 S) E w- ^8 Y
" `2 R: @1 P6 `3 |7 }
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' - w/ [+ ^, I, \( u& t1 t
;will break 3 times :-(/ ]" t3 G3 o7 p7 A# t$ ?; ]1 y
1 o2 U& u' e0 }& t! \0 |; s% e
-Much faster:
. i/ e' c5 S; U& ]* Q j5 ?. T BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
. Z M; Z/ [4 q) n) s, ~6 s. w
/ e% m/ X- c: Q" W* h, T* |. mNote also that some programs (like AZPR3.00) use de old 16-bit _lopen) h- @7 e8 p V8 x4 a
function to do the same job:
0 ^2 Q* q d* N: d4 R+ |, f) c, m% y3 |! D2 @4 T
push 00 ; OF_READ
9 {2 y3 M/ [8 M) v* A mov eax,[00656634] ; '\\.\SICE',07 }, a# }& m7 ?& Z7 x
push eax
8 z1 D7 A, h6 |! I# { call KERNEL32!_lopen
$ z6 q' `; Q0 X* B1 N; J inc eax
4 f; Y* D: b7 t$ W# L/ ^. A jnz 00650589 ; detected1 Z9 q" q" h# E2 A' g3 p5 ~
push 00 ; OF_READ
4 T2 E* L M" Q; l7 @+ Y mov eax,[00656638] ; '\\.\SICE'8 @0 q; ?" |% K, W
push eax1 O( g# g6 p0 H+ L V
call KERNEL32!_lopen; `% A/ D, f+ u0 p8 u: n
inc eax
1 [+ G& s( H" X( g$ B' C! r jz 006505ae ; not detected
. F" v2 ?* S. ~; m; n; i9 B2 a2 M9 z+ C& p3 a6 c6 \
$ L# ?& W1 N/ O& e) ]$ x3 [__________________________________________________________________________9 C1 @6 ~9 ~1 t$ I
) b1 Z- ~% |1 \+ f: e& Z/ v
Method 12
. v. T& a( R9 ?9 G8 Y1 r- R- Y% o- E=========
& P, z) H0 I/ x$ }3 n% w: O6 k) @7 s$ M, b+ Q ?( M
This trick is similar to int41h/4fh Debugger installation check (code 05* ^ q' r5 p% e# E o9 \2 {. {4 s
& 06) but very limited because it's only available for Win95/98 (not NT)
0 v+ `7 @. w! o9 [, n1 F2 G4 has it uses the VxDCall backdoor. This detection was found in Bleem Demo.
8 X6 U6 _' j* B5 k& @" J8 i1 {
; r. f6 o* z+ @( E6 \ push 0000004fh ; function 4fh* A& X9 }2 ~1 F) [2 c( f
push 002a002ah ; high word specifies which VxD (VWIN32), \5 c% ^# F5 b6 I D: d8 Z
; low word specifies which service
: J. f/ C7 w" c" N8 b6 G, X, v (VWIN32_Int41Dispatch)( u4 v+ g! I7 `. L, f
call Kernel32!ORD_001 ; VxdCall
# g" S( Y, P& z) E# C# ^# }# d cmp ax, 0f386h ; magic number returned by system debuggers
$ M6 [7 ]1 v* F! Q5 d% `/ T/ g jz SoftICE_detected
/ _5 f% V) q4 [ Y E9 f/ M/ V% Y) u
Here again, several ways to detect it:
% L& U& D' a+ V v
6 L4 x. l8 ]4 d% B BPINT 41 if ax==4f
' W; d: k- ~9 @- ]2 _0 f: {2 F! u- ?% e+ d P7 T
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one5 X1 ~# f$ M4 k6 D/ P9 o# W* W
2 j9 l% i" e3 k# z: q' ^! N% `
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A$ d, e0 X6 L$ f7 T! B2 e5 U4 z; L
+ x; k; O( ]& W4 h BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!# t; L2 e' |; S. l0 Y$ u2 ? ?$ o! ^
8 A- G( d. n' \/ f
__________________________________________________________________________
% N3 }. M+ ?+ L/ k. P( n2 w% E; v
5 L7 V9 p! f0 `& b6 ^" c5 \Method 13
4 Y) S7 p: T) S- D) b=========
# d0 r0 ` }& S6 E6 i* ]. V& l' }) s; A
Not a real method of detection, but a good way to know if SoftICE is8 t% w' v: `& i* c) ]
installed on a computer and to locate its installation directory." K) ?- V: E: \+ D& \; R) C0 u
It is used by few softs which access the following registry keys (usually #2) : F# ~* J1 p- F- G8 G2 O
8 N0 J" @3 X. X8 q; q8 ~
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion$ s; X$ Z$ g! n' n+ H1 A5 B
\Uninstall\SoftICE1 F2 h& P4 d: I- m# \7 a& p/ v
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
! C. y6 y# U1 d: j0 V-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion8 m: z& Y+ q3 P6 X& I1 h3 U
\App Paths\Loader32.Exe0 D8 ~3 C% m4 j4 c( h6 L
+ `/ j( R- L. [# X% K. P* H7 V" u/ n
Note that some nasty apps could then erase all files from SoftICE directory
1 T# c6 h' f5 Y( a- X* V(I faced that once :-(8 z* i4 e, S8 B( n1 |- O
; p6 q1 [5 N: M3 H7 o2 o( R
Useful breakpoint to detect it:
$ Q, T: V6 [; R4 W _ a* h; y3 @4 D \" J7 i, `, B
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
) ~" h, l$ l7 Z
$ N+ ]# S8 h+ G+ H: ~! R0 t__________________________________________________________________________, `+ n- [' }9 U) P) A
/ c3 s! A0 a& \( u- i" p
+ w- v$ ^2 j# m( L7 n/ ]8 A
Method 14
) A" c1 G* }- M' P=========
6 C c5 W+ I* y3 X+ j+ R
9 @/ }# A/ L% j0 X* l/ qA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
0 N# {8 }. t$ i J+ S& |2 }* Lis to determines whether a debugger is running on your system (ring0 only).
) _0 \* z* C- M/ M+ R* W4 B' E/ |5 O! p* N; A6 m& s
VMMCall Test_Debug_Installed) i! Y, I# _/ s! P l S9 k
je not_installed
) F% l" F- D0 M9 k1 D9 `4 @* ?( n! `
; q u4 Z1 G; Z+ C3 g- xThis service just checks a flag.4 O( J3 U: f# w' D$ @/ D
</PRE></TD></TR></TBODY></TABLE> |