<TABLE width=500>7 c' k( F: L# y8 F
<TBODY>
3 l' m) T% r! I) Q<TR>
4 a; g: k: m. L5 ?* j6 j7 l' G! [<TD><PRE>Method 01
. ^, p6 I4 N5 C/ \6 D7 x+ t=========5 x1 E* z N5 [
" S* f: K) V5 y% y. T% Q1 M" P: j% |
This method of detection of SoftICE (as well as the following one) is
7 Y5 V! t j( v0 |$ k, ~2 M6 ]used by the majority of packers/encryptors found on Internet.! W" q9 y+ i- \: e: B- d% X) R& Q
It seeks the signature of BoundsChecker in SoftICE
T! U6 |! N+ J, P2 P4 |4 k
! I/ q* W. P% Z! F u mov ebp, 04243484Bh ; 'BCHK'/ {% i1 v+ g7 D* M# m# T5 x
mov ax, 04h1 p- T7 ` m5 p
int 3
0 K6 |8 m9 i) X- s cmp al,4# Z8 N/ H+ n1 P( r- B
jnz SoftICE_Detected: l* L5 ?+ M% V2 \/ I
: c) w, C7 f. O' y8 A% x; k___________________________________________________________________________8 A4 G( l) \! l+ }
, k; t; h) Z. d7 r* F9 F/ R/ w) TMethod 02
8 |( P' B6 n* C) ]) x=========4 Z# |3 |$ e" f( E
* @9 b; X5 [1 B2 ^. c: v& M* B
Still a method very much used (perhaps the most frequent one). It is used
% N; [( j2 o0 {to get SoftICE 'Back Door commands' which gives infos on Breakpoints,$ ?# n( C) M2 P% I M; G4 m% ]
or execute SoftICE commands...
& w+ s T7 }: J4 g: v* X! e& x6 hIt is also used to crash SoftICE and to force it to execute any commands
2 M, t" U7 ^# g7 m1 o1 ]/ J(HBOOT...) :-(( 6 g a+ J% w% _# L5 Y( X# o
$ e/ o: ` v5 L y, J' a
Here is a quick description:! a) Z6 s% t: g! E% |9 W. f
-AX = 0910h (Display string in SIce windows)% ^' u2 o7 c! N6 ]$ g9 j$ q6 E" S+ ?
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)6 ]' ~# t$ j/ f8 [+ X0 c+ D4 o
-AX = 0912h (Get breakpoint infos)+ B2 \: U: j" v8 A0 A% _9 J3 d
-AX = 0913h (Set Sice breakpoints): q! w K4 o+ b3 R
-AX = 0914h (Remove SIce breakoints)0 r" s. q4 I( r# w! k9 p
" `- Q* o9 [ W! rEach time you'll meet this trick, you'll see:! Y* s; I* T8 M
-SI = 4647h
6 y2 t0 G% Q! C8 c3 `( E-DI = 4A4Dh
% g. u+ t* a8 J3 x4 Z; ]Which are the 'magic values' used by SoftIce.4 R8 ^7 x5 a7 r3 e" I j) h
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
# X2 Y3 l. t" r6 G' F
8 n+ [4 F/ ^9 x2 i6 jHere is one example from the file "Haspinst.exe" which is the dongle HASP
% a$ D/ v) h0 R9 \- g0 [Envelope utility use to protect DOS applications:3 ?+ {( k1 t0 E) R7 [% B0 A" B
; Z. d' w* g6 t0 H {: w
% r5 e4 |; I5 {6 e4C19:0095 MOV AX,0911 ; execute command.
^+ e, K' q( y. |4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
1 r6 C: j: O# {/ t: Q4C19:009A MOV SI,4647 ; 1st magic value.
" k( o4 g D- d+ }4C19:009D MOV DI,4A4D ; 2nd magic value.0 O, y: n& M. F% X! s& L
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)4 r v: r% m9 I$ G1 i! B. [
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
9 j J. c4 A; A; y: W. O9 m4C19:00A4 INC CX
' c! a! y A$ O U' X1 Z4C19:00A5 CMP CX,06 ; Repeat 6 times to execute! V+ `6 a5 [ O7 _$ G
4C19:00A8 JB 0095 ; 6 different commands.
: v( L' V( h& u4C19:00AA JMP 0002 ; Bad_Guy jmp back.+ A7 \, b) C" ?2 m1 F% ~* ]6 _
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)1 q* m7 Z0 U: t' N* ~, ~
: R- O; O2 o k0 R z6 A. w: DThe program will execute 6 different SIce commands located at ds:dx, which2 S' Z& r& n" Y" [4 g3 B7 ?4 O9 c# ^
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.1 f8 p5 o. ^5 G3 h9 Q0 _& R3 X: ]
+ q) a3 T* i6 a, V$ r. w* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
% C( n9 ~3 X- n B___________________________________________________________________________" Y5 k( m0 t4 k$ e3 c: M
7 A, s7 g! Z, E- M) J3 d5 J) F( |
Method 030 f8 F& f% v+ H. ?8 |/ h4 m9 f
=========
! f6 w: j3 @- ?+ F
; t, F, |: \' w) K- gLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h& s) @" b# m7 v* q) A7 \
(API Get entry point)
* o3 m5 @$ `/ [8 Z' l 7 A# S" E) i1 w# f
2 C% m; Q4 Y' \, s. [! d+ a3 T
xor di,di% y# v4 ~2 N% _: q7 M% L/ f
mov es,di
" ] E% c, f# p' w7 I mov ax, 1684h " U# U! l0 E2 @/ d( _
mov bx, 0202h ; VxD ID of winice
7 y4 m3 b% @) g' n0 b3 Q int 2Fh S6 _( k3 A' j4 m/ X9 r$ Q
mov ax, es ; ES:DI -> VxD API entry point
^! Y0 d# H, [/ } ] add ax, di2 d$ B( ~/ v: y8 H
test ax,ax }' S9 E* e' F6 A3 _% s, E6 l2 @
jnz SoftICE_Detected
; n* @$ e7 z ~! J6 z, m
( e) n9 W1 V1 a0 q1 _4 ~; C___________________________________________________________________________% e- d6 R+ U, _+ q! `' E
, }' f$ |' Y7 ~3 x2 T" G
Method 04, O1 n" J3 i0 Z
=========
6 [: D& j n' ^* D( ]
7 e# {! l3 E/ T, t# pMethod identical to the preceding one except that it seeks the ID of SoftICE
2 r1 C, B |0 M* ?- o7 e0 i) dGFX VxD.5 P& m& Q* P3 R! B9 @: x0 ~8 s
2 l1 i& M6 s( d, Z5 [; G# s4 M" N
xor di,di
3 I# r" {, U+ j9 [1 r& A mov es,di. z; q: n; M6 `3 }" i7 T6 O: N
mov ax, 1684h 4 Y! d) @4 y0 O' @# Q a* |
mov bx, 7a5Fh ; VxD ID of SIWVID- S6 }& R) w. _$ n8 c h8 x
int 2fh
/ L2 q- J0 V; f; D3 G mov ax, es ; ES:DI -> VxD API entry point6 u) G W4 V( l/ g! j/ G4 s
add ax, di
1 \: S1 Y0 n7 Z; Y6 t3 J) b test ax,ax
) y k( ^2 p5 Z) n6 }8 v9 H jnz SoftICE_Detected
]! W0 X! x" q7 ^3 ?& y
' C* I- |- i# v__________________________________________________________________________
4 {! H( e% G3 L9 ^) J
/ D/ q9 c5 j6 e9 n% I
! S1 b+ Q9 i9 i; [$ yMethod 05
$ U; M# t. s4 _- U4 ^( E=========
$ ^ w& n8 \4 n5 A$ ?: \+ h
' g4 H& C7 A5 ~( P) W8 T1 yMethod seeking the 'magic number' 0F386h returned (in ax) by all system+ o/ I6 g. i% B- Z
debugger. It calls the int 41h, function 4Fh.
3 y) W+ K; |3 T5 O `$ M! @7 [8 }There are several alternatives.
% J! @& w6 z6 L& C7 J9 ~) C6 H. K' X) L
The following one is the simplest:' ^9 |* t p9 ~$ ?! W3 m/ G! K$ o: g
" J$ P$ u% I$ \& l% ^
mov ax,4fh- C/ [# _* Z) g5 P+ c( ?
int 41h/ C$ S+ Y+ C4 K8 L( R2 o
cmp ax, 0F386
% f( u4 u& d: W5 }( q# E2 Y' y8 j jz SoftICE_detected
, g; ?1 ]5 y" M' K1 T
4 q4 I! b4 u% B1 y9 ~- f/ H/ a/ d. H) F, H
Next method as well as the following one are 2 examples from Stone's ; i* k, k0 t Q* E: Y
"stn-wid.zip" (www.cracking.net):& g$ G2 ?+ D7 v& K1 x0 X: I+ l
# x& V" S+ r3 U8 H; r8 a- z mov bx, cs9 _- B7 I! X/ H# W& |1 `0 U; w
lea dx, int41handler2
" i$ u- y" O+ r3 u) R8 @$ a xchg dx, es:[41h*4]4 T5 e G K2 P$ @
xchg bx, es:[41h*4+2]
0 W9 A( }0 Q9 o% l mov ax,4fh- F' X- X! @. L8 }1 m; ~) {' f
int 41h
1 N; m2 G$ D3 v9 O: z xchg dx, es:[41h*4]0 C B. d- x% u5 }( v5 i
xchg bx, es:[41h*4+2]' i6 H8 g' U2 P. D( k4 x
cmp ax, 0f386h9 T l2 g! N0 S
jz SoftICE_detected
, O) J( x; t7 r: S0 W( [
# ] n" F4 T5 I5 `int41handler2 PROC
4 y5 p6 X. G, C2 g6 J8 V+ ~ J% J iret# X( A0 d# |* x8 }9 Y1 L" P! w7 O
int41handler2 ENDP
6 H1 A. a* t9 O! z6 i# B( ^# R; q! R9 R. H
3 l& ^+ V8 g6 k* J( L D$ T_________________________________________________________________________
6 V! q F' l8 n6 O4 r; j7 P5 c$ t+ R- T+ k) {
8 z7 A: m$ s1 e
Method 06+ G, w4 Q/ W: S, @) Q" f
=========+ q3 d3 F4 n5 }$ z, S, D
; ^3 y, j. y+ N6 [, W" Z3 I
/ J; t) \& ~2 I2 T3 }+ ^8 C1 z
2nd method similar to the preceding one but more difficult to detect:
! O1 s# }/ A- h+ y, K1 ]
4 ^. q- Z4 Q5 E% E' Y' V
- v( W' P% D' e4 Y9 G' H/ ~2 E% Jint41handler PROC% [7 D6 I8 m5 {
mov cl,al& B! e8 S& T- e/ \, P1 |
iret- l' z1 x/ g5 `2 Y" \2 E0 {
int41handler ENDP
* a4 b& s5 E- d* |# A% J& U
! @2 g0 i5 C' b2 W& L1 C; l! O& d$ O* |. @, q) B
xor ax,ax2 ]( q' `$ E" b3 \/ `$ }; `
mov es,ax
# i% d& Q/ l$ B% q mov bx, cs/ F8 v; b8 W2 [7 O( ^1 a
lea dx, int41handler' c' J% e! {: r c* o
xchg dx, es:[41h*4]" \6 I2 t3 u- ]
xchg bx, es:[41h*4+2]8 [+ d2 \4 k- i, j0 p
in al, 40h# C; a, e# N! |' ~
xor cx,cx
# ? V) u. e2 l int 41h
% f, N( l2 ^' q* _; y. C xchg dx, es:[41h*4]
7 z$ c/ ?1 n6 W+ L9 N& r5 o# Q xchg bx, es:[41h*4+2]; F* W3 Z7 x) V: a
cmp cl,al
' M+ |$ _5 F. r: ^4 T& L jnz SoftICE_detected. l, w" `+ X) Z! r
4 r: K4 |# p. e* d A G" x& ?
_________________________________________________________________________
, h% h! R8 X! p. Y, l4 w" W& t5 c' I9 E
Method 07" ?5 l1 S+ @( j) k; d' Q7 X- T3 c9 b
=========
4 G! W( f+ [& Z8 d+ n& Y" U+ y4 V
' ]. x D9 f7 w- ?. V' mMethod of detection of the WinICE handler in the int68h (V86)
1 ~( o, u! }; h% ?( J9 f- F j+ x
mov ah,43h
c9 l) ^' z% s6 O int 68h+ a @4 T' E1 R' Z" [
cmp ax,0F386h
) v/ e! \( Z. l* y2 @ jz SoftICE_Detected
, u' I+ R9 W- F- n4 ?: x
6 X9 {' F5 y+ C! y' f: V4 C* V* Y0 d, c& f4 R! P* N: F; R
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit% ?0 N4 X! G/ z5 r1 }2 p
app like this:0 G0 _( ]3 M6 x& I& P
# z" h) {& j( T6 }: s- l A8 X8 q5 C) O BPX exec_int if ax==68& y/ ~, j4 r% G: U" ?
(function called is located at byte ptr [ebp+1Dh] and client eip is
+ y9 a+ a8 ]! k2 d& B9 m located at [ebp+48h] for 32Bit apps)
; \% ]$ i2 _% A3 Y1 d" D- A9 L__________________________________________________________________________
$ R6 l. V+ H1 e3 I) \3 m
/ B; ?# }) ^6 M' H o% r4 ^, \5 D. X, d0 C, t) s
Method 08
$ S2 F) q6 o; S R=========
/ N8 b6 w& M3 a d# f6 J2 ?& e& y9 O% |) P1 v
It is not a method of detection of SoftICE but a possibility to crash the2 `- O$ W: T9 o( W4 L y
system by intercepting int 01h and int 03h and redirecting them to another5 \2 ^: Y7 r: z" q& t
routine.
% N/ j) m* C3 l) ~9 I3 _It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points; B/ q5 d% f7 i" ^5 C
to the new routine to execute (hangs computer...)
$ h% [7 d0 h" c4 {2 j
2 h* n+ Q, R2 ^0 I/ E/ J" m5 c: K( C' q mov ah, 25h
3 t* O. \' n5 Z' j mov al, Int_Number (01h or 03h)
! b$ e1 ^! M2 }+ e9 q mov dx, offset New_Int_Routine
& {% W5 L$ d5 |+ |$ h2 a3 { int 21h
7 M% {. _/ a4 |+ F \& R+ ^5 B. F$ u2 z8 F% d% L9 A
__________________________________________________________________________
- h3 w6 n8 @) z' O
' T' F7 d8 S3 v' c5 hMethod 09
, W( B w- A" o6 |$ U=========/ B( I( _& l6 k. x2 ^+ ?8 v1 \
, z( v, K' D8 l
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only( w2 \ b$ ?/ \+ m5 t: s2 H
performed in ring0 (VxD or a ring3 app using the VxdCall).4 `+ p t6 G* d/ h9 d/ G
The Get_DDB service is used to determine whether or not a VxD is installed4 | P5 d" \3 T N/ t3 Q6 H
for the specified device and returns a Device Description Block (in ecx) for
+ t6 @$ e o. h2 rthat device if it is installed.
+ [9 [/ |$ D* Q2 G2 R( P0 C% \. `1 D% Z3 ?
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID# h+ l4 u0 L2 t
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)2 z$ E; }1 h( G+ z
VMMCall Get_DDB
, x) s& f% Z' j; p- B; \, R8 y5 f mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed1 A- w/ |+ v7 O$ }
( w* u+ p* c- v0 f0 o4 U
Note as well that you can easily detect this method with SoftICE:
% O" D% a+ Z) @3 c) z% {7 T bpx Get_DDB if ax==0202 || ax==7a5fh- Q5 w3 P. ?% [( E
) X& `0 M/ |6 ]0 y5 V) d8 ^( M; B
__________________________________________________________________________
9 }2 z0 R% e+ G( c: ~( E2 ]
4 D4 n& M R. a; ZMethod 10
" p; j% y2 Q' U: }=========0 |, L* W) m& {# ?
, ?+ c% u( ?* w( I
=>Disable or clear breakpoints before using this feature. DO NOT trace with
' q3 ~0 v* ? W2 ]9 o. W SoftICE while the option is enable!!
9 l5 B3 H6 `( [# ?5 l- @! r/ X2 a( _, K
This trick is very efficient:' s; {7 |3 \( Q) [% C5 V
by checking the Debug Registers, you can detect if SoftICE is loaded [* {2 R2 ]3 w/ H4 d+ M
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
/ V1 n! w% ` @6 R# e. Vthere are some memory breakpoints set (dr0 to dr3) simply by reading their- T/ F4 T, O. S6 _
value (in ring0 only). Values can be manipulated and or changed as well/ P+ R5 C0 b5 } r% t6 o& [/ _
(clearing BPMs for instance)3 S U3 S/ U. W* }
. j6 ^; P# g4 [5 t__________________________________________________________________________. b% r5 m0 U6 N9 U8 K
k3 y/ F. Y1 t: e0 F. v2 r# [( m
Method 11
. S2 _, T+ J7 t f* E% `=========
+ j+ N' S0 v9 t3 I' ?, |; g- S# @* f% F( n* ~
This method is most known as 'MeltICE' because it has been freely distributed( x' k! @' S W3 P _/ m1 k0 c n5 x
via www.winfiles.com. However it was first used by NuMega people to allow* Y4 V3 c3 f8 ^8 Q6 y: G5 G
Symbol Loader to check if SoftICE was active or not (the code is located; D* M5 V6 [- z' z5 m
inside nmtrans.dll).
- n6 _+ m# I, T" h5 K% V8 b4 z/ L' R @9 f% T
The way it works is very simple:
/ S8 A/ j8 }7 D, Q- Q2 C0 NIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
+ s5 W& F, H* P1 a- bWinNT) with the CreateFileA API.) w6 B0 J; u* s# J$ t+ ]
; S2 z3 ]. T; ~! E) T
Here is a sample (checking for 'SICE'):
( B% j z6 N3 H B1 M
0 _3 ~# P. d) {' k) G9 {* mBOOL IsSoftIce95Loaded()
) d4 d- m m8 d8 d* [4 n3 w{
8 h0 m& {9 f4 V0 `* H HANDLE hFile;
- A! y9 Q7 b, b k9 K8 n9 u2 d hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
V! z+ e5 ^, K3 r9 a+ U I FILE_SHARE_READ | FILE_SHARE_WRITE,
. D! _& q) t: Z; q, d1 q7 U- x6 o: L0 {, c NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
K8 q$ Q H/ U$ b& E! e if( hFile != INVALID_HANDLE_VALUE )0 i# D& X& P! B+ ~) ~' Y3 I. c+ j
{
( }9 z; C& ^- \9 ]' g1 R/ \ CloseHandle(hFile);, ^- |2 v5 M$ R. q, y
return TRUE;$ j/ k8 P9 m3 q4 o( t+ a
}
# m% @" m" q% j- q8 X4 ~* w return FALSE;
( N* z: A6 B. d2 b u}
! v# F4 e# s3 z: \' D6 @% Q* t6 S! F7 m$ k5 C1 L
Although this trick calls the CreateFileA function, don't even expect to be
, o7 N p! s l% s7 ~1 L1 Oable to intercept it by installing a IFS hook: it will not work, no way!: F9 {7 x y$ W! b: A9 y5 @: c
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
- W# G& K; J+ z5 I9 Oservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)& b+ @# {" W8 ~$ t3 G, E# A* D: {$ Q
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
( o+ r/ {3 Y! z% Qfield.
3 s2 n8 B1 c% k% g% Y" w- v" J% IIn fact, its purpose is not to load/unload VxDs but only to send a ! K" w. f2 o3 I6 l [9 ]( X
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
5 K! ^3 Y$ m! F- N6 C- ~to the VxD Control_Dispatch proc (how the hell a shareware soft could try
" j5 N1 b5 p) I2 m- A' k" s6 g: tto load/unload a non-dynamically loadable driver such as SoftICE ;-).* Q/ W% G/ n, s7 C
If the VxD is loaded, it will always clear eax and the Carry flag to allow$ E/ S f! U( I
its handle to be opened and then, will be detected. j% R G* v& J! ]
You can check that simply by hooking Winice.exe control proc entry point$ l% l) W% [# U; r: M
while running MeltICE.1 p3 x" s& g# t$ \) }& d/ B' q
2 U6 d0 `$ S+ c* _( D2 p0 u7 j, S- R
00401067: push 00402025 ; \\.\SICE- ~8 Y5 e8 F5 b# L, P8 j- H4 Y
0040106C: call CreateFileA
# c6 O; w! e9 e0 T+ B7 a# A 00401071: cmp eax,-001
v6 r3 {% y( q | 00401074: je 00401091- I7 Q' ^( k! n! |, ^' E( [" N: D
. o; N: g' _ c9 H
6 P4 e& d& \0 @. wThere could be hundreds of BPX you could use to detect this trick.% o8 p* w; g0 y/ [7 B+ q
-The most classical one is:$ S# W4 H6 o k$ [! u2 N6 C% O
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
9 a7 M( q8 g. a0 \ *(esp->4+4)=='NTIC'
) \9 j: n4 E, D2 [; f- ?- }3 ?# k9 \" v Y) u( `9 c% W
-The most exotic ones (could be very slooooow :-(
, d4 z7 i# e9 Q' h- b5 v BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
) c5 g- |" F" L( e3 o4 q8 m! ? ;will break 3 times :-() U0 Y5 r: [7 D; {! r" g7 \
8 ?4 B& i! G y1 n+ b/ S
-or (a bit) faster:
1 t% k4 e4 c( F1 r: X. N BPINT 30 if (*edi=='SICE' || *edi=='SIWV')* {5 S5 Q5 O, j" \: H6 [) R: S
# e, S7 W B" X* s! j0 _ BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
- W9 t. \1 v6 F3 f, Q ^ ;will break 3 times :-( s# c2 {$ V6 \: D# M2 p
( M0 `% e. ^/ t/ C( L9 m-Much faster:" l' O( e) U; d$ Q) m" v
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'/ A# H; j1 Q& @9 S" {$ ?; P8 D
1 j% @8 g, X4 r. y) o
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen% j4 n, p. l+ K2 r v R/ C
function to do the same job:
2 E1 U# D- I* V I- ^6 |+ `; z' i) Y/ @: m! E) k! U) G( d
push 00 ; OF_READ- j" |) A; k& n i% G3 o' I( l: ]
mov eax,[00656634] ; '\\.\SICE',05 B( o$ ~5 [: B/ U( T
push eax
) k- Q' }* k$ K1 M9 B3 F) H: q call KERNEL32!_lopen
- V$ A: q5 L6 Y: r; w# D. ? inc eax" Q/ ~) x) R6 }
jnz 00650589 ; detected
& t r+ ?- f, }2 W( N! [ push 00 ; OF_READ
6 B% o; b7 W2 O! \ mov eax,[00656638] ; '\\.\SICE'
* k& u7 S, L" |) C push eax
- Q. W1 ]6 ~, j1 P) b& d2 P/ R+ u call KERNEL32!_lopen. K9 p! z: p$ E9 |. V- S% E
inc eax
9 q( x/ I4 D0 N; @ jz 006505ae ; not detected- h- L6 V6 p, v, S
. ?, Y# E' N& h: P8 V
+ L; b7 o6 u9 p0 i9 ?
__________________________________________________________________________
# {) x8 p& h$ j/ }4 L; c/ I9 d& r/ V5 {, {% x; I% u; z6 ]
Method 125 i2 A* M: N' |1 j o p4 T* Y
=========/ F, b. i+ @' ~) v" i8 o/ ~0 p
: r) R! X% T7 o; u
This trick is similar to int41h/4fh Debugger installation check (code 05
3 K8 o/ T+ C; O1 {4 o& 06) but very limited because it's only available for Win95/98 (not NT)6 {( P; l) w9 x* g' i
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
" e: u5 i s4 R; B* y$ M5 [' C' M5 v) N$ N% A1 c8 H
push 0000004fh ; function 4fh
- B3 e) L, c y- `0 n, ` push 002a002ah ; high word specifies which VxD (VWIN32)2 ~) j" X% A6 n0 x. @% O
; low word specifies which service
8 p; ^3 s" G; U, g% f5 N (VWIN32_Int41Dispatch)* q3 k" z& v/ v9 }$ F, d
call Kernel32!ORD_001 ; VxdCall( z# \; |8 d7 Y% u
cmp ax, 0f386h ; magic number returned by system debuggers: H6 |0 T% R% Q
jz SoftICE_detected; J& u* e- w+ ]0 F! W6 d) G
+ [: L6 t! w2 G( I# s$ OHere again, several ways to detect it:
9 C( F' g% O1 v6 Q/ u2 O. _+ }9 D8 V6 [' I8 ~8 e0 S% \& v
BPINT 41 if ax==4f. F* h0 E& ~" ?3 r0 f
6 [, m1 v, U! `2 e6 ^+ s BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
% `" N% Y" [+ u/ e* p# z) b" w: R0 h
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A1 m3 m% N4 [; b: `
3 {& G( `$ d' U9 N& X' r3 k BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
! b$ [% _. }7 p/ p# m1 w2 W0 {) K0 K& W8 ^$ p# ~! {5 j- O
__________________________________________________________________________' r. E- H2 N, i8 B- u
2 q0 D. {% n* s a7 K
Method 13
9 s. Z, i& }9 H=========
* j$ B" ?# x! X& _( b5 ^+ f& z- K! ?: Y, w. ^
Not a real method of detection, but a good way to know if SoftICE is) e* l$ g3 w" ^
installed on a computer and to locate its installation directory.
& T) F2 F/ R" |2 {, @It is used by few softs which access the following registry keys (usually #2) :
* J8 C+ x% Y# x0 s* o) f% ]2 E. R0 W) r) i8 Y: ?% U
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion/ M, h3 ]8 \/ N5 E ~, |5 c5 D! m
\Uninstall\SoftICE1 B# U$ G6 |3 ~6 S$ S% E6 s. h
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE' U( R0 F5 L9 Q$ \
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion. X3 P& P" B7 A5 X
\App Paths\Loader32.Exe( l! s1 L) H5 w$ p: F* S; J1 U4 k
3 A& R, u- b5 ^2 j# V5 r
& e& P0 Q4 ~( J) T% aNote that some nasty apps could then erase all files from SoftICE directory
- F f2 e! ^8 r5 Y* F! r6 G' N; l v(I faced that once :-() u7 K0 y9 R* c+ @
, O4 {2 `! a* S3 o ^( E
Useful breakpoint to detect it:$ b& [/ b2 c* U& Q* q: g- k" N
+ V! r, P% a2 P' m2 Q# G
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
# ]! [; g& u5 Z0 \: U2 ?" _+ Z
y- Q5 H8 l$ |' g; I__________________________________________________________________________/ Q' u" M3 {2 t9 A- x" K1 z
! G4 k' L6 K' c- c% L5 r' ?. g* O, l) N( o
Method 14 6 h* V& L: O! U9 C! I* B8 `6 X
=========1 k4 W% w( C% b6 N) |
1 ^- y; d0 S- F, Z, J% L' n r' e2 dA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose' F& b7 L1 D3 B5 |! ? [
is to determines whether a debugger is running on your system (ring0 only).
3 V2 }5 U+ q! ^% E) f2 Y: u ~0 s \5 `! {* s
VMMCall Test_Debug_Installed
2 o2 Z- l5 J1 Q6 E0 Y je not_installed( C, f# g) p# q/ V
8 F. J7 j; T- [/ G( s6 V$ A4 k
This service just checks a flag.( d0 x% [# D7 o
</PRE></TD></TR></TBODY></TABLE> |