<TABLE width=500>$ b# r& e* ?( H; A4 V1 }) r; p
<TBODY>6 y7 Y( ^0 Z5 g' J
<TR>8 Z1 ]( t( |: R( v+ k
<TD><PRE>Method 01 # [" ^4 b) q% K% [4 h b
=========
& d0 m9 i6 N/ ~* o) F0 x9 k1 r2 _( B& N7 {" s( M
This method of detection of SoftICE (as well as the following one) is
5 o+ U2 \/ P0 zused by the majority of packers/encryptors found on Internet.
: y8 B" j7 ?' u. q( r3 l# ?It seeks the signature of BoundsChecker in SoftICE( k* b: J: \) f( Z2 f8 O. e
$ Y% ^: [( |* b7 V mov ebp, 04243484Bh ; 'BCHK'2 D0 m( y& Y7 B6 ]; }- t2 Q
mov ax, 04h" N2 ]1 @- v3 p/ \2 O, X0 c& U
int 3
+ F+ w0 R$ Z6 U; e: i* a, q cmp al,4% |# a4 c% f/ o2 h
jnz SoftICE_Detected, m8 V$ \6 P' t1 x( {3 m1 U |0 R
8 u0 ` s; A9 p( {; L- V
___________________________________________________________________________
0 L8 j g$ J4 i! \# ?. g
; W# A+ L- _7 a8 qMethod 02
# \5 n9 p" }, f3 f6 W( V8 I=========
3 G% w% X3 H5 ?* a
6 T+ g1 Q9 D, pStill a method very much used (perhaps the most frequent one). It is used7 F/ {& f8 c4 e/ f* m7 m1 u
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,5 ~$ u$ r7 k. ?: \) d! D& M+ E
or execute SoftICE commands...
+ m+ f6 J ]& a; N9 Y. Y6 f, wIt is also used to crash SoftICE and to force it to execute any commands$ c; B- w( e) @9 i+ l- |% b
(HBOOT...) :-((
4 u) f& n, D/ ?5 s# X3 D& N
" z t- {- X5 G' U+ O4 _8 t6 oHere is a quick description:2 _( N! H1 C5 `+ A& [" q
-AX = 0910h (Display string in SIce windows)+ s; M! X; f5 W U
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)3 h* e0 e$ Y5 m" m! K# |3 J
-AX = 0912h (Get breakpoint infos)
3 d4 }. b; {2 C+ |7 ]( Y-AX = 0913h (Set Sice breakpoints)
7 g8 d; Q- J0 _/ R; X-AX = 0914h (Remove SIce breakoints)
( X& q! d% d% A; P6 C' M5 n9 J" E
Each time you'll meet this trick, you'll see:
: K: w- y. [# G% L q-SI = 4647h
+ h3 s0 {2 i( C/ O-DI = 4A4Dh
1 \2 R& @) R' cWhich are the 'magic values' used by SoftIce.
. V& B* O2 K: L* H+ kFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.+ {/ e/ ` ?7 k
5 j7 z, A- h! E0 {& g5 c& p+ h
Here is one example from the file "Haspinst.exe" which is the dongle HASP
, o( }8 g t' p7 X) T+ s7 B5 N$ pEnvelope utility use to protect DOS applications:' T* H5 E3 q7 F" w H6 y g a
% x. \( f% Z8 }0 E' G r$ z
8 ?# y: s, Z7 m# H. N0 Q: g# o h6 l6 _4C19:0095 MOV AX,0911 ; execute command.
$ `) _# f9 Z7 j$ T4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
/ }, l- e! R s6 X: V$ h! l6 m4C19:009A MOV SI,4647 ; 1st magic value.% F; K% v$ v! w* N4 v P: ^
4C19:009D MOV DI,4A4D ; 2nd magic value.0 ]0 E9 c% H% j# Y
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
( @ `* Y3 l: M( K3 ^4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute6 l# X* ?4 R. I9 P8 Q) b# L
4C19:00A4 INC CX5 u3 B" H! X% s, l
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
9 I4 \2 r% w: l# N4C19:00A8 JB 0095 ; 6 different commands.
1 z& n2 m9 ^. W/ }' S8 S* ?4C19:00AA JMP 0002 ; Bad_Guy jmp back.
. b2 ]0 @) f' c# ]3 X1 R& `/ W: H4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
3 _! B2 ~) A) |6 }+ B
. L! a5 F& [3 w) Y) {( c C/ z: _The program will execute 6 different SIce commands located at ds:dx, which
4 J% o: N1 r/ i9 r- dare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
9 {& a: P6 `- ^3 z) I- u2 c$ ]; Z! O- X+ B2 m' \
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
- K7 d% {/ L, p/ B. n4 E0 E___________________________________________________________________________
+ L) U; E$ r0 m# u7 f; H# K+ d" u: D& W; x1 H1 _+ h
! d# Y- p6 E; H; `
Method 03! d+ |5 J8 H- E$ A- W _2 J
=========
# s1 P7 [: D0 r( o: o
9 x* _( A2 n3 I4 xLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
+ }9 ]$ X9 i- A% J( B: |. @) Z(API Get entry point)
' k& B& p1 e" G/ e' [
: h! b" ~1 h0 C& J2 T; J# ~; H/ V4 t/ i
xor di,di
+ @( ?+ h9 S W" A1 i; T _% }! P mov es,di+ X s/ w& \( O
mov ax, 1684h 7 D4 x0 L" C1 M- C3 M
mov bx, 0202h ; VxD ID of winice
' y( N. Q9 x: n+ V9 R5 @7 ] int 2Fh
+ i( G. p* @- s mov ax, es ; ES:DI -> VxD API entry point8 E1 `) k; W- Q6 K0 u: j
add ax, di. W0 B7 i! P3 j7 x4 u! }" X7 D3 M
test ax,ax
; X/ V+ a6 h6 Y9 B7 T( H6 W' w jnz SoftICE_Detected+ O+ X$ w M% u; F% v6 z% C
W+ G% F; l( }2 D! `6 {4 E0 Z___________________________________________________________________________
( E0 r& A+ z8 v0 P2 F2 f" a. ^; N2 z* z
Method 04
3 x, O/ e5 ` C V=========
% q" ^1 X! l0 T
; n. A! H$ z3 |Method identical to the preceding one except that it seeks the ID of SoftICE4 D" q: ?( X6 O4 s% b4 E
GFX VxD.
# _; ^; M$ T3 x% N2 ^4 h- k
- h! h. e* c! T: M2 C xor di,di
- y# c9 G( p% a Y' T! k1 z mov es,di
* i' D; h! v1 }: c0 S. o mov ax, 1684h 9 D6 F" Q8 @7 k E2 n( t( D7 M0 N5 i
mov bx, 7a5Fh ; VxD ID of SIWVID
O( e, Y% t7 ~( h$ Z1 H7 [ int 2fh
4 O {4 t6 b* e6 m* T% E o mov ax, es ; ES:DI -> VxD API entry point
: n9 V) M" U+ {; l# ` add ax, di
/ z9 }3 \+ Y, @6 N9 ~- Z test ax,ax6 L- u8 ]6 c- V$ R; @5 }% K
jnz SoftICE_Detected3 \* g% R4 b1 g% @/ E' Z
: S! h/ |& Q' D# @
__________________________________________________________________________3 C0 R5 \! M7 Z9 v
- U# X$ G1 ?% U; w7 y2 ~0 @
8 t5 y/ z! x7 s- q9 M( P7 RMethod 051 J) y" q$ N" m5 ^
=========# a: V1 E9 a' o; M
. {) D8 u% p5 J, j3 kMethod seeking the 'magic number' 0F386h returned (in ax) by all system# \5 W" A1 {4 `! a1 t: w4 }
debugger. It calls the int 41h, function 4Fh.+ j9 P% z* R' t+ N6 {1 V) Q6 S
There are several alternatives. ) s6 e6 O5 ~$ T( y2 z& ]
. }9 R# D% k# a/ W2 AThe following one is the simplest:5 M2 o7 N- k$ R# ?8 Q' N
% z8 G1 _2 c: K mov ax,4fh
, b' Y( r6 q" f( v int 41h8 Y. v( v( P5 I3 d4 m
cmp ax, 0F386
! ]7 K1 j% j \ C i% V jz SoftICE_detected3 s O) Z- s* o2 r
, r8 ]3 u; s1 ~" ]
t, ^# {( p$ y2 C) E$ P, F
Next method as well as the following one are 2 examples from Stone's
4 l* ]5 m5 C; ?+ M& C" B. i"stn-wid.zip" (www.cracking.net):. J% X. d P3 Q. l4 \ e/ ~4 S
) P! b3 W) [" M% P* E5 r: ?% Z0 |
mov bx, cs- W2 ^/ { t- g) \3 a c/ G( z
lea dx, int41handler2+ a- \) Y0 K5 {
xchg dx, es:[41h*4]
0 o+ v5 @, }# @6 y xchg bx, es:[41h*4+2]$ d9 p. J* t7 i/ Q3 b/ {
mov ax,4fh
' Z) z# ?5 s& X7 I int 41h8 @. M" {- X1 ^ o( g
xchg dx, es:[41h*4]
; U5 {- X. U$ P5 _! L xchg bx, es:[41h*4+2]2 O3 b) d& b. w+ R4 J
cmp ax, 0f386h
: Q3 `& p5 y' P8 Q: Q2 C! `! c jz SoftICE_detected
8 n2 f8 d, |) k3 ?4 k; A% n& E% E; O( t- w
int41handler2 PROC
6 Q0 ^. h$ l6 q iret- u K0 j0 ^! G( z" L. ^
int41handler2 ENDP
7 {4 n' }+ \, y5 c# A2 S/ k: a/ W* a3 m, {" @# j- z
' Q& {# Q+ s+ q& H
_________________________________________________________________________
+ a4 d$ t* n2 ]0 L9 M, K4 m
. @) X& z6 E9 L
( {! q: T1 h4 X) B* U6 R+ pMethod 06- R& ` l( g/ i
=========
- ~% S4 r6 i) u: F7 h4 m( e
+ L, e8 `& v) }2 R) V: Q# O8 q# _
" P. u- q& a9 X' n3 r2nd method similar to the preceding one but more difficult to detect:& O8 p/ v- D: y! ~: _/ M0 i" x
& n" u3 j! A0 p1 R' h5 W6 P( O
! |9 w! J$ {' H& H' E6 i# wint41handler PROC
2 h' j3 U W+ y1 C mov cl,al2 C2 o, Z% N5 U# b; {
iret
& R! a/ b* L- L" ` w* d! pint41handler ENDP
- t9 L u) P- f% _1 r4 Q( C6 U3 i. `
1 \) r5 r* \& j. p1 y
xor ax,ax
' n) r& z8 d9 w5 H+ Z7 B mov es,ax2 w/ ] Z. }' O, ]- d! D! u
mov bx, cs
) g1 W: h% e5 ~$ r) Y6 d/ h( F% \0 u3 N lea dx, int41handler- X/ o; l0 m( F1 M2 s7 @% l; A
xchg dx, es:[41h*4]" X! ~1 G, t; j; T" R6 D
xchg bx, es:[41h*4+2] Q2 _$ G6 ~# g% O- z, l* j
in al, 40h2 X% _' B6 S1 |/ t0 \! s
xor cx,cx2 O# l! H# W& G: d. h' N
int 41h! M. L b2 w: P: `% m
xchg dx, es:[41h*4]2 a, }3 N) m0 f: B$ }# S* X
xchg bx, es:[41h*4+2]
! o! `9 u% @ l: B; _( M8 u; g cmp cl,al9 W8 J3 v; D' G3 B; Q4 ^
jnz SoftICE_detected
* s- k4 g7 W7 F8 v& ~+ o5 ?; N% D) h0 b( x6 C3 |* S
_________________________________________________________________________
# M) a% k( l9 n+ K
7 U" ]; p8 h, f' |Method 078 n q+ g, L1 v
=========; j- W, g, [' s1 a) r( q5 D2 U
& Q; \' B2 U( p9 _3 q! l3 Z0 R( }
Method of detection of the WinICE handler in the int68h (V86)
, }5 G: M h9 Z" M* Y- U( O
- @- U' a) Q8 _) U mov ah,43h
2 c2 }# w4 k& |2 U6 I" U int 68h
9 K W9 z! J. {2 U6 ^( W+ h& c cmp ax,0F386h
5 q" ~- P1 ?' n4 \ jz SoftICE_Detected h6 _) e5 u; O' D
$ Y* q8 I: v8 u% S' L3 @; J& B; k; {; N6 a% c4 F p
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
# D9 L+ j/ M! Y7 [% l2 B9 z9 S app like this:% x" F/ p5 b0 v# t+ ]/ G4 d- U, J
2 Q- L& Y2 }; j1 i# \7 i: N, n
BPX exec_int if ax==68
* _4 L N: `9 b6 n (function called is located at byte ptr [ebp+1Dh] and client eip is
: k, B5 M: G2 V* T0 u9 z5 S( P* n located at [ebp+48h] for 32Bit apps). Q( R- C; @* B0 I
__________________________________________________________________________% I4 S3 l* L. y7 G' d' K' ]
, {( A% I5 h6 B# t0 t5 M, R
; `0 K0 V( |; S0 L0 ]
Method 08
* ` m# H. w. P) Q=========
1 h. k; e1 R' ?) m
! @/ R# ?! l5 ~! I g, H- @( X. P) g" lIt is not a method of detection of SoftICE but a possibility to crash the
6 M/ y6 m$ \" x9 V% u/ R0 ^5 h- Qsystem by intercepting int 01h and int 03h and redirecting them to another# ^) c \9 l; o3 V
routine.
- S: ~) P* {* @- y! LIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points8 I1 z w6 J7 t- n0 K
to the new routine to execute (hangs computer...)" b- N, p& D+ z- D0 F* N
$ F. D: a( q1 X1 ?( j
mov ah, 25h
4 w5 c, l) `1 J5 b+ r" N mov al, Int_Number (01h or 03h); r' j* T' g- k8 u5 d$ S2 L
mov dx, offset New_Int_Routine
6 e, ^- s# c y5 |/ @ int 21h
% U( Q0 C& L6 N7 h. t1 h
* ^5 l; F$ C( I) t__________________________________________________________________________8 i o+ @; J" {! U3 W5 e
; e2 }6 x- M3 ~6 a; M, F1 Q
Method 09
# d1 [9 t1 [4 O6 `1 p' ^=========/ h3 b4 q, y* L
: ] ]: Z3 U& V3 G, }This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only7 @! A. M8 J# C' j
performed in ring0 (VxD or a ring3 app using the VxdCall).
) `6 ?1 p* ~" `: q+ ?The Get_DDB service is used to determine whether or not a VxD is installed
. E( c1 M( w4 x+ n7 u+ {for the specified device and returns a Device Description Block (in ecx) for
c3 W# H2 J0 G _that device if it is installed." G, E9 e* H+ F5 m
( _! \: q J6 U& B P7 x mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
: y, o' ?% T9 L0 H6 r3 Y4 l mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
1 }# f# {7 g3 q$ T2 i& a& x' U VMMCall Get_DDB& m! M* |9 a6 |1 j. |
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
T Q, x. ~# Q+ w& @2 U0 J, x a$ \6 k$ M! n
Note as well that you can easily detect this method with SoftICE:; L# Q/ Z# E x! R
bpx Get_DDB if ax==0202 || ax==7a5fh
4 F. @; Z1 N( o. O$ f. n: z2 Q4 ?& T y
__________________________________________________________________________: l; }- r! t' Y, }) m4 P* g: P
; V2 n/ V D- O& [6 V# [) \' k* |Method 10
5 m( n) \+ c9 D$ H=========* W8 e4 }, j4 u6 g
! [ S6 H0 e. O* q( p
=>Disable or clear breakpoints before using this feature. DO NOT trace with
. X3 q$ F: `8 V, M SoftICE while the option is enable!!
+ f, P/ N. }& I
' M4 |3 o7 Z* q0 K- P2 q$ ~This trick is very efficient:
, [+ T' o7 n8 I3 z3 A$ rby checking the Debug Registers, you can detect if SoftICE is loaded. I8 x5 D6 O/ a/ s+ P
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
7 p7 Y. p; c* [3 D: sthere are some memory breakpoints set (dr0 to dr3) simply by reading their
/ J- H, e* q T ^8 w; z$ nvalue (in ring0 only). Values can be manipulated and or changed as well
/ f: z( t5 ^: J) [8 ^+ C9 k(clearing BPMs for instance), H6 L) H% o' V. h" s- q; C: N
7 N8 A- b: j7 E2 E__________________________________________________________________________7 k4 c( s- P7 B3 }5 t
9 I# p7 a3 i& f4 ]1 m) l
Method 115 x5 O9 m* |; z5 U/ A3 I: c z/ C* e
=========- ?4 v" t/ r$ m* \) Z6 y
]3 V+ C3 r# w3 iThis method is most known as 'MeltICE' because it has been freely distributed: g- z/ k8 K& e% m t
via www.winfiles.com. However it was first used by NuMega people to allow# t2 O _% O, r {9 U
Symbol Loader to check if SoftICE was active or not (the code is located
1 s7 C4 }! L* ?inside nmtrans.dll).
9 Z. z: X/ K" t( ^1 v
! X, O- {6 r- `- M" k9 r! z, pThe way it works is very simple:4 k2 R4 w2 g( o @8 a% l
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
* u; A6 [! {2 B, T8 n) QWinNT) with the CreateFileA API.' h3 L9 U$ e! v
% n, j( |, D' T8 a) s# x7 mHere is a sample (checking for 'SICE'):
0 K7 ]2 c; B2 u/ B `; r9 L7 K' Y7 s/ i( K/ a" }, q+ c
BOOL IsSoftIce95Loaded()' r |$ U1 {0 W# Y
{
. I& e* ]+ X. Q# }' ]+ s. U HANDLE hFile; * F0 ~8 S& ~; i, X- v; f
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
( |3 B7 c4 d0 x' L w; i FILE_SHARE_READ | FILE_SHARE_WRITE,6 ]5 S- a9 J2 [( s0 b
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);" f+ D0 P% x& h# l
if( hFile != INVALID_HANDLE_VALUE )
0 a% Y7 X% @( i {; I2 j6 }5 N. n) A
CloseHandle(hFile);% }+ ?2 l$ `. }: r5 @
return TRUE;
: O4 n" \0 n% O' Y# C; F }
# h- v5 L1 c2 d return FALSE;& O, X5 Z! s4 o
} ~" `6 `: p: ~1 D4 C2 R
G3 _* v U$ g8 O" K6 F( DAlthough this trick calls the CreateFileA function, don't even expect to be5 b4 w2 x, i: ^( [
able to intercept it by installing a IFS hook: it will not work, no way!
3 [1 {6 e6 y: BIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
2 P" L; G9 i8 X) j2 s, }5 rservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function); g4 f8 e! }4 Y7 u7 w/ X5 G- w
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
8 U V5 t9 i; F0 yfield." b! ~# C& [3 a# l5 N8 b
In fact, its purpose is not to load/unload VxDs but only to send a ; e" |2 t) ^0 D' K4 m- H
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)' A; \) i6 j; H" a& q$ I2 F5 d
to the VxD Control_Dispatch proc (how the hell a shareware soft could try8 B; `+ Q n! _2 g
to load/unload a non-dynamically loadable driver such as SoftICE ;-).) |$ Y6 j& E L3 R
If the VxD is loaded, it will always clear eax and the Carry flag to allow- D9 K* ]) H5 o7 g
its handle to be opened and then, will be detected.
- ?: O8 D0 q. S3 X* V3 U6 c/ ?6 _2 bYou can check that simply by hooking Winice.exe control proc entry point
0 X2 ^. |9 y H, X% _9 P, m! Jwhile running MeltICE.5 e; K8 u5 B6 Z# f& r
z9 e1 @. Q( S% g! M3 C9 |9 r# Q; d9 I# v9 G4 Z# l
00401067: push 00402025 ; \\.\SICE
" ^9 ?" q: f% f5 \, {3 T9 p 0040106C: call CreateFileA
3 E* P4 _# n+ _4 K9 m. g; e 00401071: cmp eax,-001: ^, B* \0 B8 w
00401074: je 00401091' X0 S7 g0 v+ z% Q
4 b( ~: s3 t7 b
* c% u& D7 g0 \There could be hundreds of BPX you could use to detect this trick.
: J* e( n0 V- n( V3 M9 \. g-The most classical one is:
0 q7 j. | m: R8 F& ~ BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
: O0 |- y7 [- V( l, B+ P* ~ *(esp->4+4)=='NTIC'
9 ]3 k" O2 ?' K2 W j8 E I8 w. V; _0 P* Z! g' ^7 v$ y0 \$ G
-The most exotic ones (could be very slooooow :-(( o7 u: \9 T2 S/ B
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
. W- E* l/ l: W: O% Q+ q% U/ H9 p ;will break 3 times :-(! o/ a( i( w8 @# i# Q
" Y- x, `# ~7 p) D6 u6 O! A i
-or (a bit) faster: + X; S( V6 y0 F9 D y9 [( C
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')* e0 z' m0 u* |! ]( x5 x7 A
4 I4 \. w7 B% ~5 Z" ~
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' ' _7 B r2 I9 N* I1 ~
;will break 3 times :-(- B0 B7 E K D& `
( ? p5 X: V* g. T-Much faster:. B& K) B1 X4 i" e/ @/ y
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'5 }, W$ |& P0 A8 f' J; S$ i
+ L9 G9 @, c. }# ?
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen, ~" [+ W) V9 f/ n. u; ~, T" c& r
function to do the same job:8 m. T1 {) r# s: x$ Y# x
1 e- B& M+ s. j: M3 r
push 00 ; OF_READ( K" C2 {- _9 @7 a0 M& h
mov eax,[00656634] ; '\\.\SICE',0* E% {: F% A: `5 b' n
push eax: `8 x& X( O s5 m! R
call KERNEL32!_lopen
4 E0 E6 v/ {8 |- i% q+ _; i inc eax
: U3 b+ a: ?9 ~# a# ? jnz 00650589 ; detected, w0 Z$ R7 B5 A* J
push 00 ; OF_READ
i+ z; g# L) B% D9 Z( i4 B/ J! {# D mov eax,[00656638] ; '\\.\SICE'
9 J" Y: n; P4 e$ j4 f push eax
5 O' ~. w X9 U9 l5 N call KERNEL32!_lopen
4 a; x1 ~" m, e8 l inc eax
/ x/ ~2 c- d& D4 f, d4 c2 R jz 006505ae ; not detected- u, Q- E$ I: r$ _6 L R
2 E. |+ U. r& s: H3 S4 i
# H7 c* B4 Y' `7 N9 v__________________________________________________________________________$ D: F+ ?; O2 D8 q0 R
; c3 ]- b* X9 tMethod 12
' C+ i8 f% \/ C% r! Z: u6 W=========
7 G- L' I# E# v: d. f: W1 Q3 D$ x% ?- u8 N
This trick is similar to int41h/4fh Debugger installation check (code 05
5 N& |( ]' u4 T2 P9 d; R" d& 06) but very limited because it's only available for Win95/98 (not NT)
, q% n$ r: C& N$ ]- Has it uses the VxDCall backdoor. This detection was found in Bleem Demo./ a7 v! o0 ?" A; x k5 I. J
! ]. u! r; i, k- g push 0000004fh ; function 4fh/ h0 X! c) z! k7 R
push 002a002ah ; high word specifies which VxD (VWIN32)
h/ a, S! g" u, V* R9 |( @5 i ; low word specifies which service' _9 U/ J6 o* I) ]1 r# n, Y4 y
(VWIN32_Int41Dispatch)# W4 t7 u' \" t( R
call Kernel32!ORD_001 ; VxdCall' f3 {, Q1 a& R& f
cmp ax, 0f386h ; magic number returned by system debuggers6 d4 z o4 l8 |; T- c( m b3 |2 J
jz SoftICE_detected$ w, ^$ [! `3 Z+ c# S
) s8 M6 B* P' B7 G. x, T vHere again, several ways to detect it:
. A2 N8 l, M- Q) j) w
7 x3 W# ^! V% Y5 c- q ^' X, c BPINT 41 if ax==4f# P' d3 p. d( G$ _
) J* y# e# h$ z1 Y' h' c BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
4 ^5 r. J0 k% r- ?, v# p1 H8 [' S6 a! o# e+ n' ^0 @& e( b x7 f
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
( ?3 p) u/ F' |2 q6 G! G
7 H4 [5 Q) V, d; Q5 c# d% F- j BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
8 N f4 @" U% r- M. `6 H& }* t; Y( Z) g1 j0 o
__________________________________________________________________________9 R' `5 k6 j! _1 }% `1 d! ?9 X X
6 C* l# I2 ~( R) j
Method 13 U% {# H, z3 U! {4 u z6 ^
=========% r# F5 N/ m2 \; g
1 Z$ M* D) _$ _7 g2 M/ @ gNot a real method of detection, but a good way to know if SoftICE is
( I% S) y8 V; y9 Uinstalled on a computer and to locate its installation directory.
) r$ _9 K) e$ U- O6 e% ~4 u: wIt is used by few softs which access the following registry keys (usually #2) :6 F0 S3 n2 G+ }3 @2 _) D
! x$ l. e: n/ X+ Q! y/ c-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
`* |: b& d+ Q% d2 |+ y; \2 I\Uninstall\SoftICE
+ r# ?2 ~+ K/ S+ P* |" [-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE8 w, I: @- I4 X$ l: P
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion' L5 l0 U: R7 n; ]2 ] S4 E5 ^
\App Paths\Loader32.Exe: e/ y3 |4 w9 l$ O' ]' \
$ _) y6 R; Q% L8 J: U' l" N7 D, H! _
Note that some nasty apps could then erase all files from SoftICE directory, X( y% G- w5 [/ F. o6 ~3 l
(I faced that once :-(( X$ O z3 \9 @0 e9 J
$ m5 F* \1 L* o! D! OUseful breakpoint to detect it:8 p1 p. r. p# D q
- q% `( i+ l+ h. @/ C, k. O9 J BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'1 U. p5 {% ?" q
" f& F) Q8 T- u
__________________________________________________________________________" \/ R+ ^2 p; j! z
" \& c4 I: H; {$ k( e; H; j( X* }8 @' t- ^5 W" v
Method 14 + \8 C% G& K) e+ x" ]7 i$ t/ l9 F
=========3 s1 S# R% x/ m6 ~+ M
. [' X- i2 ^( ]4 v) b9 [* qA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose+ X+ L8 J! b/ X7 Q7 J, w, S7 W
is to determines whether a debugger is running on your system (ring0 only).
4 t7 i/ G( ~8 I, k; X0 H d$ u8 b% Z# {
VMMCall Test_Debug_Installed' s9 D' o; z' R l7 \8 \
je not_installed. m5 P$ u( N1 r" ^) ?( P- b
" m- D) x" B: H" qThis service just checks a flag.
9 `5 ]$ k0 j5 L1 i3 G% L</PRE></TD></TR></TBODY></TABLE> |