<TABLE width=500>
; ?0 P. C: u! M% B$ {<TBODY>
! K: i2 A1 g+ [; n<TR>
" l; K% B$ ]% F# u4 i6 }<TD><PRE>Method 01 ; t! J; Z% o* j: w0 w; q* L1 V1 d
=========
# Y8 b3 ?9 X% w5 ], B' |) ]7 k- p6 F* q# ?8 d
This method of detection of SoftICE (as well as the following one) is
- D# ~' F7 A$ O7 S9 F4 tused by the majority of packers/encryptors found on Internet.
0 P. @( O' B9 c u: `+ @! fIt seeks the signature of BoundsChecker in SoftICE
2 S9 h, j5 k" Q; S: T% G* e; m+ f- H5 `( v9 K) l% U0 `
mov ebp, 04243484Bh ; 'BCHK'4 P( a8 h' ~; g `6 E7 n, @4 i
mov ax, 04h
! A: v$ a% D& s2 B- g int 3
" H# M2 F0 G( O; {& x cmp al,49 A( K$ ~4 O* S' l( F; L4 o
jnz SoftICE_Detected3 D1 ?- Q. {% n
+ D5 p, G8 L# N8 U' |' J/ y___________________________________________________________________________& X1 L3 K" I2 y3 M* g! H, k) Y0 {; E
/ F: ?0 c/ n- J* v
Method 020 p) K$ q8 M( ^ P) j
=========4 C( x& i! n" G" H; [+ n( o
: W: T; l/ u- e# h1 z
Still a method very much used (perhaps the most frequent one). It is used/ e4 C5 _ s# s7 s. R3 @% O
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
& b' M) l! M( _& m7 U4 E( nor execute SoftICE commands...8 l1 I' K" f# C4 ?
It is also used to crash SoftICE and to force it to execute any commands
. q, u L' Z% w: I$ v" x8 Y(HBOOT...) :-((
8 V# h! C5 L/ u1 {5 {! e4 H$ A: v _: @6 S9 _# G5 G
Here is a quick description:6 c+ W; A; S1 y. w1 V
-AX = 0910h (Display string in SIce windows)1 Y7 R0 b W S, Z! v9 i
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)6 D$ p& z2 v5 G2 n
-AX = 0912h (Get breakpoint infos)
1 g/ o$ S5 z% z' W) H) \. s5 ~-AX = 0913h (Set Sice breakpoints)" V# O& x% D. X: j
-AX = 0914h (Remove SIce breakoints)
, Q6 S% N, H3 ]' h+ e; Q' Q
3 k3 |0 G" Q. ]9 VEach time you'll meet this trick, you'll see:: m! t s! p, e- D1 q
-SI = 4647h
0 w0 K( r# Q5 Q. y-DI = 4A4Dh
- D( x7 a8 J) J$ B" LWhich are the 'magic values' used by SoftIce.2 s( p2 P3 z# ]" K& u
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
/ I- q7 X+ _4 J( M2 g7 p' Y1 U
Here is one example from the file "Haspinst.exe" which is the dongle HASP# i2 {( V! M8 w; {9 K2 o- y
Envelope utility use to protect DOS applications:
/ i/ T& {* g& M( F5 O
; t9 y/ Y9 a4 e
# {' a1 t: X& e; |, c4C19:0095 MOV AX,0911 ; execute command.
+ N7 q7 }: R7 Z+ \1 X* H4 a2 R4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
' d5 W1 S; \# D& X( g6 j$ [) ^4C19:009A MOV SI,4647 ; 1st magic value.2 t1 K5 K* C- K" d& P
4C19:009D MOV DI,4A4D ; 2nd magic value.
, R" [$ H' H! H) |3 N5 j. [* c# i4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
! `( C; `/ x1 |& j+ r" H! y4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
5 s1 B; u; L( n4C19:00A4 INC CX5 z: e" n+ a2 h1 [- R1 y) _
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute- E. u* C O0 \! r0 m; E5 o6 Z) g
4C19:00A8 JB 0095 ; 6 different commands.
+ H8 t) W' e- C9 E4C19:00AA JMP 0002 ; Bad_Guy jmp back.* [* l+ s$ I; g( @
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
* f& Y( M8 ^' |+ |
& ^5 f/ f( C: X. n* }* n. |4 oThe program will execute 6 different SIce commands located at ds:dx, which
) a$ n8 |- B- c4 f1 A! g7 s+ mare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
: r& T3 s5 |% q/ T7 J1 y4 m* V+ Y/ @7 ?/ W! ~
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
- o8 a; ]5 f2 \" r" _# [+ ?+ e. g___________________________________________________________________________
4 {& W/ l8 n2 I9 @
( X0 u3 a l7 K. {% a! e$ q3 K$ {& b6 f+ \4 E u
Method 037 ~2 g9 M% h6 j9 Z
=========
& h7 I" e, g4 `% p: c% ?" ^1 B2 N
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
' C& O X0 L% B( v7 V- x1 z(API Get entry point)
& w' m" C* v5 ~& t. o
) m* {, j1 U# I; O: \+ j( [
1 W! H$ m& y z& V xor di,di
4 i: M2 p) e; ` mov es,di8 }2 j. E- J2 I- J7 w6 y8 O
mov ax, 1684h
! ]" e7 L( a! \/ h( g! G mov bx, 0202h ; VxD ID of winice
$ W5 Q+ k1 l5 u7 U int 2Fh) t5 W; p! e& M
mov ax, es ; ES:DI -> VxD API entry point' R) B! H1 X+ B W2 K( f
add ax, di& L6 \2 z$ [! o2 N
test ax,ax
?( H% i, D! }7 G6 z6 u5 r+ o# Z jnz SoftICE_Detected
: ~2 y2 K+ U: {3 `+ V# B/ b7 f: w- n; H2 m p6 a% i( B- S
___________________________________________________________________________
, O4 O; d: ]- Q5 P
8 q& H# M/ K$ WMethod 04( N- O" P3 V! X$ S5 ~9 H
=========
& ?4 O8 q( K( f4 g" ]- [- U% m6 Q! I, H" ]$ P% N
Method identical to the preceding one except that it seeks the ID of SoftICE! X" P; [6 V/ y/ c4 d5 q
GFX VxD.
8 q |( p( z+ Q) m2 Z- h' |& o0 \. n+ q; D/ Y1 j
xor di,di
( T, ~5 M1 W: r/ E$ @* | mov es,di3 V! ? w4 L0 j& k- g4 M
mov ax, 1684h " Y9 o! w* Y) u
mov bx, 7a5Fh ; VxD ID of SIWVID' w6 `3 W2 }, ^8 o1 Y- i4 S- m0 X
int 2fh
6 C4 S$ a0 p% q1 X/ d mov ax, es ; ES:DI -> VxD API entry point8 E+ d/ z, o- p# `& w0 _# ]
add ax, di
5 Z" i7 m; x3 B E: A2 b test ax,ax3 z6 C+ W }$ {6 e/ |$ K
jnz SoftICE_Detected4 ^' `$ k) ~2 s" z1 w
5 t( j- z2 {) B2 I1 E; @__________________________________________________________________________$ Q7 m: I J0 E: w0 x' {
9 U( e* b0 }+ B7 |' f& g- f' Q) I2 K
4 [/ p! v1 f/ L& `- {Method 05
3 K3 r& r' q w' ^: L1 k" ?=========# n( e% O m6 _; i+ H" P9 y
- K$ r- d9 i! V. Z& A
Method seeking the 'magic number' 0F386h returned (in ax) by all system6 q0 b& b& Q/ B
debugger. It calls the int 41h, function 4Fh.$ W; G" Z. U9 T" [7 B
There are several alternatives. ( q2 A! B( G; I4 V
7 @9 \1 r# J+ d2 ?) K0 gThe following one is the simplest:: p5 i! C5 ?, ]+ U
$ h2 y6 u0 }$ a6 f6 z3 L6 E8 k T6 ] mov ax,4fh
J& F$ i( q: M5 ?& [- K$ n7 v int 41h: l2 [9 @5 w: X+ H" c
cmp ax, 0F386) Z* w5 v1 i4 D
jz SoftICE_detected. S. h6 B8 A; J3 s
& X% |- }; Z- t2 k# H4 C6 S4 ~( z& O
Next method as well as the following one are 2 examples from Stone's
W7 U6 v$ {. E8 \& A" T"stn-wid.zip" (www.cracking.net):
' ^7 |+ W) l4 N1 p! N' G3 p; U. I) T% u1 j( e' R
mov bx, cs2 Z/ X% B3 k+ B2 v
lea dx, int41handler2
+ g9 o/ U# ?1 z4 ] xchg dx, es:[41h*4]
" ~7 h$ Z% {% B6 O, E5 {* } xchg bx, es:[41h*4+2]3 | m0 Z1 k. C; V7 m4 O8 G
mov ax,4fh4 V+ }1 A) Y$ H! Z! M1 w/ {
int 41h
$ A0 b1 n# X/ |1 Z! u2 i2 K4 j xchg dx, es:[41h*4]( _; ^& W! K3 \4 s! `
xchg bx, es:[41h*4+2]
$ {; W, _7 R) Q" U cmp ax, 0f386h
1 R7 ]5 S8 P# w; O; q jz SoftICE_detected
& R2 {+ u* C/ q& D
3 T" k# X0 F) O/ u0 [% B! {int41handler2 PROC
* x3 X9 X t/ `, Y0 r/ @( d; d% ] iret4 V0 E, B2 F j" X
int41handler2 ENDP6 h2 _. H& C6 g/ R; z' S3 L/ @ K$ y" `
" r* d, E& H' Z( m1 V/ D6 C+ P! Y- l9 \* Q) H' Q y& E
_________________________________________________________________________
0 ^2 m! t' Z) W) Y7 {! y/ J/ `# e' @6 `/ r: Q# z$ y
+ W: o0 M/ u ^8 ^1 S: G
Method 06
2 g4 L7 B7 H+ _/ V=========6 H5 T5 ~, y G6 ~. q/ q. o
! v8 d' ~- v) k5 F! H+ h! h J% @1 j) v' y3 O+ X
2nd method similar to the preceding one but more difficult to detect:- C% c, B0 e" E, J5 C1 f5 Z
( K# F6 b, j$ H! e; _5 P0 ^ k
% ^2 a) Q+ V( T. L& Z2 q
int41handler PROC
9 R# D! m/ ^2 N+ ?0 H1 D mov cl,al
% S$ ]' V0 p% y2 q3 O3 A; j( \: H iret
2 S, z( D- q/ Q5 nint41handler ENDP" B4 H2 w' t1 e; T/ [
5 w! Z& A+ N1 B8 @4 b! r0 m
. L* e( j' u8 k/ }& G6 i xor ax,ax
# q" ?3 a6 N, c$ u+ d mov es,ax, ?9 ?$ \3 \* T9 M0 E
mov bx, cs
: P) Z& |3 Y/ D/ h( ]6 @ lea dx, int41handler
; C7 Y. Z3 ?# G$ B& e! A, T xchg dx, es:[41h*4]6 d/ g! Q9 A& R ]: s! i4 n
xchg bx, es:[41h*4+2]( D1 H( L; S$ g
in al, 40h5 W$ f8 P+ }$ M; m! {5 B
xor cx,cx
1 m. }$ E2 H8 [- b! n p5 S int 41h2 Z% R4 ^" Q: ]3 r
xchg dx, es:[41h*4]
* b/ J# X$ Z: | xchg bx, es:[41h*4+2]
, v3 o H$ Z% c* P. o5 T cmp cl,al
) u0 M0 U7 ?* d1 H6 x jnz SoftICE_detected
2 R- N9 W6 F. P& K2 J5 R: x
5 i4 }- Y/ j O( S( U_________________________________________________________________________/ L4 q2 H' y; t( L: x, ^- A
* ?1 s% c; p& p, Q6 B
Method 07
! R5 Y) p) n3 O- g1 T8 V=========
+ `- O) l1 x9 O: U' \, w
( v4 g/ K3 V* ~- e8 }' `Method of detection of the WinICE handler in the int68h (V86)* S" W+ ^6 w' p2 b
3 a& e+ a* d! [7 m+ p* R mov ah,43h
& J& b1 k+ T* j) I' B @1 u int 68h
! j) j6 Z$ }9 K4 z* h3 f$ h! | cmp ax,0F386h5 Z& h6 D7 A8 I2 u# p
jz SoftICE_Detected
1 X. `) K! B" C
\/ x2 m, @/ G5 T8 J8 j0 _* \
4 e6 f' a4 O: u1 I=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
- j+ `2 K; `5 d! w6 m app like this:8 r( t5 z. V7 L
/ ^$ @1 I; D9 A! m1 w3 X
BPX exec_int if ax==68+ \$ O% r8 T4 m$ p( { q( \% ~, Q4 k
(function called is located at byte ptr [ebp+1Dh] and client eip is* t* P8 S+ s/ o7 `8 F1 x8 O* N% s
located at [ebp+48h] for 32Bit apps)
( a! x/ [: M" G5 A( |( d, r__________________________________________________________________________
) R; T6 e! A# |9 u- Z4 ]7 j: c( a9 o7 J! V/ r# O8 |4 @% I! o
" a: Z/ @3 @& H7 f9 nMethod 08
' W8 D U6 I& I6 K3 s=========
" |0 ~( h, f% d' e7 B* v4 i, C# \+ g3 q! j* J8 G$ G$ H. p! K
It is not a method of detection of SoftICE but a possibility to crash the e N; \" {& J$ \2 H& @) f+ n
system by intercepting int 01h and int 03h and redirecting them to another
9 k- a7 k$ v! `. Zroutine.- A" {6 [3 [! _: c; ^
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
* x) n2 T* {7 u' B6 L/ k# bto the new routine to execute (hangs computer...)
: B+ B, j. I+ w6 ], M" f# I8 Q; b
0 s# v7 ~" r% B K8 K/ ? mov ah, 25h* V9 s: G* b9 f) _/ c2 s" d$ ^
mov al, Int_Number (01h or 03h)
# M& m5 H; |& M6 \7 x+ A( B mov dx, offset New_Int_Routine
1 z. B5 J2 l3 P0 c5 `# z int 21h# z! R2 Z) e% X: f/ j
/ _1 O) c# S' Q% [1 J9 l
__________________________________________________________________________
' l: x% {; k$ u; A+ g& g0 ]( U1 \1 I3 u- z% M* W
Method 09' E. g7 r I) o2 S# k: V _
=========
, G) j- f' U8 v' T7 a- ` A4 P- W3 T. _1 w# d
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only8 |/ ]8 R0 w& `2 }6 M* W; o
performed in ring0 (VxD or a ring3 app using the VxdCall).' \* I, D5 A, a$ ?0 s
The Get_DDB service is used to determine whether or not a VxD is installed1 Y& Y6 O3 U& r) g# y8 B; G; l
for the specified device and returns a Device Description Block (in ecx) for% h6 ~; i9 a8 d7 Z* C) I
that device if it is installed.
# u5 E0 A* X( r) g7 h" k( t0 W: n9 s" ?
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
3 b" y) n6 l; B* o7 n mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)7 w0 H" f) f; ~' {2 E
VMMCall Get_DDB
. ]" P! d; C3 n mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
. o5 N3 P1 O, N& _7 F2 I# D4 x* U
Note as well that you can easily detect this method with SoftICE:
6 u% H& @8 D0 u bpx Get_DDB if ax==0202 || ax==7a5fh
3 P) p$ K# Q( C! H: d) Q6 D K0 D8 n/ M
__________________________________________________________________________
# T& V! f4 i" e" L7 Q3 W; h# ^
( c; R" N, u" E( m$ J, `% A2 j! cMethod 10
. m/ O) ~( e! E! x7 ]( X0 ]! \2 o=========
; _9 k7 a; d( t1 q2 j# w6 z @8 X" o) ~9 {5 q9 F1 b2 r
=>Disable or clear breakpoints before using this feature. DO NOT trace with
9 Y! v8 z8 q. D# B8 C7 y. I7 Q/ S SoftICE while the option is enable!!9 v3 s6 V/ a* o% x3 }/ a
$ t+ G% c$ T. u, ?( \
This trick is very efficient:4 z6 l) H( N+ a) k/ f% u6 U
by checking the Debug Registers, you can detect if SoftICE is loaded
: g7 t( T- W' O' o(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
: Q6 L3 H/ f( v/ K& P7 a# k( Othere are some memory breakpoints set (dr0 to dr3) simply by reading their' B3 ~/ r, K( ]0 D
value (in ring0 only). Values can be manipulated and or changed as well8 ]! {$ j" R2 K0 f
(clearing BPMs for instance)
9 e' Q2 h( L5 ~3 Q+ T9 y8 c5 v9 q- p" p6 T
__________________________________________________________________________0 |4 O/ J" d4 ?; s6 \
' s8 ?9 {3 |. U# Y3 HMethod 11, u; l! l/ E' ?" m; ]
=========
5 H! N/ ?3 [3 D" u! I) R- o& P/ ?/ G3 J c {
This method is most known as 'MeltICE' because it has been freely distributed
! d! B @( R1 c- C7 |via www.winfiles.com. However it was first used by NuMega people to allow% x/ G/ R& n1 n$ K9 ?: T
Symbol Loader to check if SoftICE was active or not (the code is located' P) u7 @' U" p( ?$ J) Z
inside nmtrans.dll).0 Z+ I* V; i8 H( T1 P0 h* B
5 |9 I7 J4 Q: _- L
The way it works is very simple:
8 q0 u! X3 F9 z. t L! y( L( XIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
+ V+ o3 |3 W+ V6 s. W5 Y' Q- ]2 yWinNT) with the CreateFileA API.' f1 G$ O$ k2 J* S% O* {7 I
' w" j+ ]' V' @ n+ m4 y* q# G
Here is a sample (checking for 'SICE'):, u" Y+ b# Y4 x1 |% `7 A6 G
3 B, [5 X+ h6 b( h- ~2 {9 L! `7 e9 R6 ^
BOOL IsSoftIce95Loaded(). y& k) S$ y; J8 O
{1 n, i, E& i; D' i
HANDLE hFile; / C) e- L. V6 H
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,6 N4 O# i; ^$ N, D+ E
FILE_SHARE_READ | FILE_SHARE_WRITE,
$ s& `6 \4 {1 ]5 G NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
3 o( x8 q ^/ ~ y if( hFile != INVALID_HANDLE_VALUE )
+ g& F& b5 G U. q& J {
! a; E$ a# K1 G0 j: `1 D2 {8 K CloseHandle(hFile);
$ {6 o: k: N( M5 A. {1 z return TRUE;
) B* ^% d1 Z) g3 { }
( `/ O$ k; o+ e3 K; R4 p" C return FALSE;. ?6 `! M# j* I% u% q0 @7 H% d- [8 @
}% _. B6 b D- u& x [( h$ \. p, x
! g' R/ k! ~9 e3 ]! yAlthough this trick calls the CreateFileA function, don't even expect to be( `6 w: h2 ~& O' f( m7 k( X, A
able to intercept it by installing a IFS hook: it will not work, no way!8 e7 T1 n- d2 p' ~9 L4 W
In fact, after the call to CreateFileA it will get through VWIN32 0x001F( {" b7 w# q& n
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)! Z4 P, R+ |; z y3 J+ m
and then browse the DDB list until it find the VxD and its DDB_Control_Proc/ o) p, @ E' @% m! Y. z. M
field.. r1 P& [: C5 n5 |$ ?7 M
In fact, its purpose is not to load/unload VxDs but only to send a ( H$ x2 `) x7 Q% N
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
5 s3 E6 Q8 W2 X& ^; Qto the VxD Control_Dispatch proc (how the hell a shareware soft could try
: f: Q( K% {. H' H! ^, c, ito load/unload a non-dynamically loadable driver such as SoftICE ;-). b! e+ X$ l/ C7 ?6 N! Y; Q
If the VxD is loaded, it will always clear eax and the Carry flag to allow0 ~% {" K8 Y/ D. g; q! n* P
its handle to be opened and then, will be detected.
4 }% c( P1 S6 [' U- Y" e7 h; ^You can check that simply by hooking Winice.exe control proc entry point0 m0 `3 d$ s4 O8 E, w& i* S9 s
while running MeltICE.$ ?- E& `$ b- G" n
1 h% V- J! o6 ]" w/ V
8 O, T$ A) K$ ~/ o6 U
00401067: push 00402025 ; \\.\SICE- o0 L `( @; u
0040106C: call CreateFileA
8 P# O. Q( L' u6 O5 q( m 00401071: cmp eax,-001
1 I4 e2 ]3 I9 G' c 00401074: je 00401091, X5 t/ s( c; Z8 y
- ]" j4 T( ^* J% ?$ Q
4 H8 r) f: p& @% `3 G0 dThere could be hundreds of BPX you could use to detect this trick./ d4 F) f$ o4 f: j: ?
-The most classical one is:
. V' M/ i- B! k% ?9 d BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
9 O3 _2 i6 p- ]/ y* H& d *(esp->4+4)=='NTIC'- D5 U0 s- a* Y( v% G' P" N
3 ~4 o+ C# f2 ~' z w& e' G-The most exotic ones (could be very slooooow :-(2 @) }3 W7 L8 p3 H
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') , J& K7 l9 O# o. Q
;will break 3 times :-(
- J& n: C: @* j6 B
4 b$ b3 l) i" E3 K9 H-or (a bit) faster:
1 f v1 q, ~/ y5 D( K BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
3 x+ H7 v c, [4 T: r" ^3 t
% `9 U" m, I- z, n) Z BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
9 c" b+ H/ S& F" A0 s ;will break 3 times :-(
3 c4 U( x2 X( T4 F. }& R) {2 h# w* P
-Much faster:
2 [% s5 }' H- z& Q. J BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'3 u, V) n: S6 [; \' H7 s! V v
! V2 x$ ]" b) ~2 q0 a
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
, L% n8 Q, v8 ^5 w+ ?/ Ufunction to do the same job:
9 \& A9 P4 H7 ]2 m; |! V# E7 b5 a$ s1 ?% g- O
push 00 ; OF_READ
! Q. E* T' f0 Q+ J mov eax,[00656634] ; '\\.\SICE',0' L7 Z' A$ d0 C& G- r4 M
push eax
! b" K0 n- y* c- X call KERNEL32!_lopen4 D, w* u3 E* n: v
inc eax+ [5 I6 c G" z5 N$ a
jnz 00650589 ; detected( w1 G) j" ?" S+ d$ p& S
push 00 ; OF_READ
3 a+ r5 ]) ~2 M mov eax,[00656638] ; '\\.\SICE'+ C4 ~ n# C% W* I
push eax$ k7 a; S( h+ |/ N
call KERNEL32!_lopen
2 l9 N4 C" A, _0 n/ e inc eax
p8 Z+ Z% L3 c+ r: R5 a jz 006505ae ; not detected
. z# H: p" e$ W6 w; a- s8 U' e5 o7 {6 z. f. R8 v9 \# D h
: k9 J7 Q* G- I' P9 _% {__________________________________________________________________________
: U& Z" L% l4 M+ x3 M3 i! N) J2 z; Q( q" v$ B5 m0 p, F; w
Method 12
9 {+ F& N: ^+ r3 Z=========
0 [+ V" Y: H9 b& ]3 O T+ \" X( K" m. C$ t k6 q1 `0 A$ e0 j' g1 q
This trick is similar to int41h/4fh Debugger installation check (code 05
' M- Q( P+ b; u; N- `. R/ f, L& 06) but very limited because it's only available for Win95/98 (not NT)5 r( X2 x2 V$ c8 B1 z
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.: m; h! ]6 j8 X ~# } s9 s
* D" L& g7 ]+ a. }1 w( Z
push 0000004fh ; function 4fh
+ x" X2 K9 a. x; O* v$ ] push 002a002ah ; high word specifies which VxD (VWIN32)
3 B, f& n* G& S. w6 q ; low word specifies which service6 M7 v5 M5 e( l2 g- ^' u
(VWIN32_Int41Dispatch)
- A2 x l' i8 [9 o3 n; t5 \# [, d call Kernel32!ORD_001 ; VxdCall
- J8 |: J2 W* {; a1 S" H" n cmp ax, 0f386h ; magic number returned by system debuggers
3 P# D/ y5 t9 ^6 G jz SoftICE_detected
) o" V4 @$ o- A' d5 I2 n* a+ i
$ |9 r* l! w/ _& E" YHere again, several ways to detect it:
$ ~- I0 K) H' e+ T, G3 V# k0 I0 u$ [7 e* K
BPINT 41 if ax==4f
5 W( D: j) V8 u1 G. d& q& `
- X+ G1 P8 ]# }9 D% `5 a$ d# \, q$ R BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one! p& |/ A% |% ?% d0 Q5 R$ F
& ]$ V, q/ ?" V8 v$ T- Q BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
/ F# }: N; g$ R' Z
2 P1 g- S" c5 z! N" J$ e' T1 Z BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!1 Z% J/ u. L4 R/ h* H3 R
8 s* c, A$ F& m% z" U$ J9 Y1 S) w__________________________________________________________________________! o! A+ l$ P2 f
3 Q0 G4 o. T- y n. F( S8 K, \Method 13
" U- _% A7 z/ t$ W# }=========& t2 o4 a: ^2 R" ]9 a) `
; q* m! q8 N" J8 u5 ~! s, K. t' {! zNot a real method of detection, but a good way to know if SoftICE is
( w0 T0 ^( ~& c- @# U7 S9 f* Tinstalled on a computer and to locate its installation directory.
9 w7 y6 H x& K4 vIt is used by few softs which access the following registry keys (usually #2) :
0 i) ]" p& w+ z/ Y0 j5 x1 `2 F- Q; N" F
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion* h, y3 x5 s* r9 N( W
\Uninstall\SoftICE: J, Q5 s' }( h! v8 Y6 K: X9 `
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE9 C5 c( N. Y5 W( t, R+ ^ _8 u
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion3 U; b3 o9 O0 U0 }
\App Paths\Loader32.Exe
+ e' o# B7 x( f
+ V( C6 {" }1 l
; l2 _& L! J6 l! @7 Q& e2 ^Note that some nasty apps could then erase all files from SoftICE directory
. n8 }! ]1 v; w) w0 X2 k(I faced that once :-(' }+ j- v3 N, }5 Z
) d/ x" g! L7 w8 o8 W
Useful breakpoint to detect it:' R$ W7 N) m2 m2 A: Z" t0 e
8 B/ V6 [7 }1 N0 O, F
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'7 i: h: |* h, M+ `3 N
; B+ _; `, M* T
__________________________________________________________________________
; {3 ^- E$ v7 \9 d" G- z- _9 ~3 |9 {0 U
# d9 J. V! M4 ZMethod 14
' u+ @# x7 B# ~: Q, k/ l=========9 w6 E/ ~6 U% c. h, C
% {1 o& ?# A% T% ]" I% q
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
; E: A% B$ m! Ais to determines whether a debugger is running on your system (ring0 only).
$ v( F0 v& D3 d1 P/ {, J% ^! N
VMMCall Test_Debug_Installed
: B0 T: o! }" y3 W. N6 ]) C je not_installed* m4 T0 e1 w7 J4 {
' t8 Y. R$ U2 C7 U4 d2 j& Y8 G& FThis service just checks a flag.
4 L* N5 p7 E( |0 h9 |</PRE></TD></TR></TBODY></TABLE> |