<TABLE width=500>
! z( G& S6 k/ ?! T6 G6 N. n& h<TBODY>0 P. l& }$ P8 V' D, R; q: h
<TR>: q4 `& J2 d, \, S7 E
<TD><PRE>Method 01 - F" n5 X0 }) e) |2 f8 X
=========
7 r8 M7 R0 C; \" m; \, R$ ?% @! d' x1 w/ {3 V/ U
This method of detection of SoftICE (as well as the following one) is' s, H. d, H# u1 P& I
used by the majority of packers/encryptors found on Internet.+ K/ r: o4 P6 a6 W# p4 R
It seeks the signature of BoundsChecker in SoftICE
0 ^; \7 }( _ Q& x/ e
: J; u8 b% z# I$ W3 k$ Y) B4 H mov ebp, 04243484Bh ; 'BCHK' `1 m- x i8 ~$ f; E6 G
mov ax, 04h
5 M# O$ c. P5 W4 ~2 r int 3 . [1 g" R, t3 G2 B2 W. ^
cmp al,4
- V/ }7 h; J( |0 {* V jnz SoftICE_Detected
& l6 \6 e3 _! y$ _7 R- \( S5 y. p/ B1 g" p/ W& x- t, {
___________________________________________________________________________
0 n0 C" l+ s9 t9 r5 \3 ?) W
; U. `+ L) u5 _# c9 p' bMethod 02$ _7 j* u- p+ v9 R
=========
, c9 d v- {. g
3 t! {" x) y% ]2 ?9 j xStill a method very much used (perhaps the most frequent one). It is used3 I" v, O$ \' t2 {! Q' l0 d
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
, ]' |+ _: }) ^1 W6 ]" [or execute SoftICE commands...+ v2 x! p N9 e$ T% d+ \, H
It is also used to crash SoftICE and to force it to execute any commands2 ^! p: ^/ @( R& K2 ^! y/ i
(HBOOT...) :-(( % _1 Q+ N& L- p: ]4 i% }% [
* `' C, y3 ? ~' K1 O
Here is a quick description:: d) R& f$ C1 r4 \) u4 d4 f
-AX = 0910h (Display string in SIce windows)
7 F3 K/ ]3 X" m/ Q3 p2 K( ]-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
2 k2 V O# d4 N4 x7 [-AX = 0912h (Get breakpoint infos)
( D- L, Z/ ?) @0 _) `& g) U7 R-AX = 0913h (Set Sice breakpoints)
+ ?) A/ I, ?) @: ]8 c" b-AX = 0914h (Remove SIce breakoints)- h5 c" @3 ?2 N
8 \) I& q, @/ }0 @Each time you'll meet this trick, you'll see:
- X0 ?8 |. _1 ?, x, \0 C6 Z( m4 t-SI = 4647h
3 a2 D' V" v7 ?' q-DI = 4A4Dh/ w9 v: \6 y8 }2 K, e! H
Which are the 'magic values' used by SoftIce.1 A( H. t" P0 ~' r8 V
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
+ ~' x: S3 C5 D+ |4 ?) U
4 E# H k" q0 w; X2 A; YHere is one example from the file "Haspinst.exe" which is the dongle HASP
# {2 L9 M3 U8 J6 {8 \Envelope utility use to protect DOS applications:
6 P3 M' u# ?+ M3 @1 L( P/ Y" b% W% D) S! p
$ t) ~3 Q" R& l6 m7 q
4C19:0095 MOV AX,0911 ; execute command.
9 d4 A! R4 o F' E6 D4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).2 O. L# Y0 k% i5 I' n* {) p
4C19:009A MOV SI,4647 ; 1st magic value.
1 i# C( k- r, [+ I9 ~4 z5 \2 E$ j4C19:009D MOV DI,4A4D ; 2nd magic value.$ E! V$ V) \, A, Z$ y. R
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
; @6 Q' ^' i1 b8 [) V- b: t4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute) m/ o& \1 Y0 A) }% ?" J
4C19:00A4 INC CX
6 s& ?' q |: b7 F6 R2 k1 s4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
0 u6 K% E' ?5 R/ u) H5 e" J4C19:00A8 JB 0095 ; 6 different commands.
9 B `. l, d: S& O0 h( }4C19:00AA JMP 0002 ; Bad_Guy jmp back., U4 M3 O2 I5 w' W( M
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
8 }3 x4 h/ Y x3 Z( N0 N. R
6 n& O5 Y h h/ a) gThe program will execute 6 different SIce commands located at ds:dx, which
" y; a8 P" i# l% A' R$ I) Pare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.- [3 s$ O8 l( T0 L) [7 S
# @9 T, J5 Y) {) X8 T. L3 B
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
1 k. ]0 }* w5 e4 P7 y6 A; {0 N___________________________________________________________________________( S/ V7 T& o2 _& ?- T8 A; ?+ h% F
2 U8 D- n: v' W0 K2 C. E& U
4 y. Y2 {8 m7 z+ m8 a4 H" u. u
Method 03
( o5 X* P0 B; u=========
+ ~, j4 G( w1 N7 u S- l' b$ [, A$ N% L" i+ r$ W; d6 ^* U
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
5 m3 o, v- c: K U' l# o! y(API Get entry point)' k; t. M- ^' ~& [4 t; w; s
% r G, D6 E! Y2 |
8 q+ e7 C$ D" U( V0 I) s
xor di,di- i0 ?5 \$ U% f) K
mov es,di1 d8 R2 Y+ E. t' Q! y# D) j
mov ax, 1684h * A5 ?6 T g# z: H4 j$ N) d/ I
mov bx, 0202h ; VxD ID of winice
; ~0 u) {+ @7 K% t5 {0 U int 2Fh
" }& U- K! W2 ` mov ax, es ; ES:DI -> VxD API entry point$ Z$ U% j+ D" w+ |8 E) I
add ax, di' [8 A& I/ ^6 x/ `
test ax,ax; ~6 J# n5 M. {: p
jnz SoftICE_Detected
3 ?. m, V, g5 K% J# l; J5 L4 c1 ^7 y. R3 o
___________________________________________________________________________) W2 A- @- T0 }7 ~+ F, O0 h
" x: l6 k( i+ p2 {0 G6 I
Method 041 l9 k$ x# C) h' x9 Z7 D
=========1 m0 D$ }+ j2 G
" N2 F1 @9 |8 p+ oMethod identical to the preceding one except that it seeks the ID of SoftICE
' n j6 J1 z, ]$ n- KGFX VxD.& A! u+ P$ p, d. ~# y
: E8 X$ ]0 w) X a8 ]5 S
xor di,di$ U6 E2 [# l$ p) J
mov es,di1 z) G( n) ~& ?/ D, b2 e3 @
mov ax, 1684h
1 G, q2 L& s/ u mov bx, 7a5Fh ; VxD ID of SIWVID
8 O, w. q, k$ C9 V" t- Z1 ^" y int 2fh6 ]. K/ t s3 t6 f5 d
mov ax, es ; ES:DI -> VxD API entry point
9 ^0 a2 ?1 I* S# ? add ax, di8 N4 r6 h* ^+ P) r% |8 B1 e
test ax,ax4 G* u2 t' A4 \+ g7 I
jnz SoftICE_Detected3 u( @! O; @" t0 a
& l3 \! x e* O- ^4 c3 F$ H# b$ T
__________________________________________________________________________
/ y& o' ?! Z* C, [3 |5 J e0 ~' l8 O+ s' E8 l& r2 ]" O+ [
2 e$ A+ X. B% {4 C, Y6 w; \$ P/ tMethod 05" d5 m7 u3 e- C8 K; H7 i! y. y
=========
) H' T' U- _- P; g9 ^1 e
5 m- ]3 ?: w/ z* O7 G8 g/ t3 ^Method seeking the 'magic number' 0F386h returned (in ax) by all system/ z2 n5 ~' [3 a% ]- j+ M* B
debugger. It calls the int 41h, function 4Fh.- P9 ^: P' b7 n& J1 N
There are several alternatives. 1 a9 i: |& F# f$ h l
! b' F+ C, e% j5 ~
The following one is the simplest: `/ {! S' l: h, o3 [2 ^ c
( _; E1 o' `2 c& |- X: Q
mov ax,4fh
6 {5 H$ d% S4 H2 A8 D6 M int 41h
. ^7 X: e Y( t3 T0 S9 } cmp ax, 0F386( r" g" Y: J8 z8 \ [
jz SoftICE_detected5 [& S6 b4 D! c2 G2 _. I8 d
) {. M# F1 C) G' D" d9 b2 I5 d7 D$ {, ~
Next method as well as the following one are 2 examples from Stone's # W- F$ ?' J4 V6 G% \
"stn-wid.zip" (www.cracking.net):
: w* C7 b3 E/ t$ C' s: @- G8 t- ~5 ~+ h8 |5 y& L! J
mov bx, cs
* O* k4 V7 f+ G! N, ^, y2 j* h1 d! V% l* ~) ~ lea dx, int41handler20 u6 Z4 o+ u4 t/ k2 ?7 I4 E
xchg dx, es:[41h*4]3 S" e& }' |# S( O" p8 _
xchg bx, es:[41h*4+2]
! w) B! z! R8 S5 S5 n4 ]7 p mov ax,4fh
* H+ v1 Q) b% Z: K H int 41h
' y: G# K F7 e7 h/ A( E5 F, p' }- j xchg dx, es:[41h*4]
. }; T7 k- \$ w xchg bx, es:[41h*4+2]
; C9 k4 [* E# j; }: P( L cmp ax, 0f386h
$ m. O* {" G* \1 X" ~/ p6 J jz SoftICE_detected
& y$ \+ `1 \8 Y& p2 \; o3 q+ i. q& K
* T4 e2 t9 R7 n* W. |$ h5 dint41handler2 PROC- _; B- E E' N% Z% t. N( {( N
iret. e' e, a- k+ Q p E( H9 K, K% O$ D
int41handler2 ENDP/ |+ I4 f# N! R$ u( Z" Z6 C8 p
8 F9 r, J* E5 _4 V- a8 `
7 J" `! L6 u5 s/ }& y
_________________________________________________________________________
9 I/ u4 N0 N5 Z9 ~" S8 N5 B) [" z8 X# u4 n: S) ~& w
@! m! D6 z! `7 x, e
Method 063 I7 ~7 e: m. o5 w; N% D0 k& h, |
=========) d& ]* n5 f3 N2 ]5 S) w# v
: t+ O6 n( N; a& r( }' l; }. s H
' r* n; p9 P N/ k
2nd method similar to the preceding one but more difficult to detect:
7 |* r6 N5 E) P4 o4 ^3 @* x3 v/ w/ ~" D* {* M. B) @: @; ^
) m" }; ~' B& E2 e9 z
int41handler PROC
1 T/ y4 t1 ?& @; M mov cl,al! Q" P- ]6 w( V' A
iret. ?) r( J* |: b- K& j+ u
int41handler ENDP
* ~% _1 V/ k( n; E
9 O6 A4 f. u* d; ^
$ k; j U$ a. M) e1 D" Z xor ax,ax
3 y6 V: ~9 K; A4 {! } mov es,ax6 F0 O+ w0 ^) N; h* i! T$ l: }% g9 |7 |
mov bx, cs2 P' W' x: |# A, y
lea dx, int41handler% [3 y6 f9 _6 ]0 r) r$ Q5 z
xchg dx, es:[41h*4]/ |+ l2 F( `2 w! s$ `% Z
xchg bx, es:[41h*4+2]( U' B0 V6 w) F2 y" X5 D# G# F
in al, 40h; t0 V5 C0 h$ C4 N
xor cx,cx
1 ^; r: s& |" ~ int 41h! _# ^7 K, _0 o) i) Z! T+ M2 I1 n
xchg dx, es:[41h*4]
& F; s5 U- e. L ^/ f xchg bx, es:[41h*4+2]
! Y2 k5 B& a( A4 Y% \+ Q: h cmp cl,al
5 B6 f' [7 s) f6 c( C7 V jnz SoftICE_detected
5 C" }+ t7 a+ O# l8 ]1 Y+ k' o* @; [3 D0 E* V0 {
_________________________________________________________________________/ u# y0 \& g' N0 R* ^6 M% f6 d% L
# |3 f" E, n: RMethod 07
- S: z, R0 I$ \% v=========: I0 V/ y% S( Q! r x: ]
& L& f2 I. }7 ^' h7 Q5 D# r
Method of detection of the WinICE handler in the int68h (V86)
- Y8 L [" I) R1 } F3 l+ Z p. k" K1 f. A" f2 I
mov ah,43h
/ ^4 b: F, t# l, o" ? int 68h
+ k" Y. N$ {- f+ W. ?4 I1 i cmp ax,0F386h
' I& }& r- X" _$ B jz SoftICE_Detected% l5 D) j ~$ ^; F0 m9 S1 P! o& `- E
/ E! K! k! {% {9 x" [9 V: Q
" O. p" C( Q* T6 z7 P
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
5 F. F, Q1 v0 l( z# V app like this:8 y1 L0 W1 F& \* t
5 p1 t4 X/ {4 `% r6 J; n2 t! V
BPX exec_int if ax==68
0 q# g, s( }/ }+ Y (function called is located at byte ptr [ebp+1Dh] and client eip is' f1 J% X3 {3 K! _% Z6 K$ w) O
located at [ebp+48h] for 32Bit apps)
- D% P' f) I( e' F! j, h__________________________________________________________________________
/ @ J# k* R. Y ^& `+ ~% \' i" }. M1 w+ S+ g8 ~) {/ W
; W @7 L. U7 f" }9 ^* c# Y4 MMethod 08
% n( b1 ~4 n* o. P( N# a=========, S5 ]# c5 W8 u0 C% W0 |
" g( `, ~, X) V. T* k! O' g# xIt is not a method of detection of SoftICE but a possibility to crash the
4 Y/ ^4 y" y) g6 R( w& z: g% y) xsystem by intercepting int 01h and int 03h and redirecting them to another
3 `1 v6 r$ T3 T0 _5 Broutine.
$ H' \2 K/ U2 \6 Y: M3 c) vIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
7 u0 p; E. ?. S% }0 {# {/ Hto the new routine to execute (hangs computer...)/ Z }8 Y1 n. O2 H8 Z2 h
" M' m% Z2 q& }0 g# U mov ah, 25h
( B4 H0 }5 q" j mov al, Int_Number (01h or 03h)
6 ?! |9 f4 v( B' A$ P/ } mov dx, offset New_Int_Routine5 K$ G9 }0 W! B
int 21h- `$ C3 g7 S. v) T9 [" x
: }0 Z- L/ |4 V3 X8 E
__________________________________________________________________________6 J9 \ [1 R& a, I5 j# O
- a. L, e! P! V# r2 F" @
Method 09" T: j t/ }. F; e. v
=========
7 B+ b; t& X# w* D" r% B6 d9 ?) p( }
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only) g" y% G' o) l0 m9 |& m6 d: G5 x
performed in ring0 (VxD or a ring3 app using the VxdCall).
, S* Q! ?! u1 @! F) f+ [. W1 yThe Get_DDB service is used to determine whether or not a VxD is installed6 u$ S5 Q5 d9 a
for the specified device and returns a Device Description Block (in ecx) for
$ M, ?" |! w8 c8 Athat device if it is installed.# A( X. T! n; `- ]* h5 M
" W: i+ h O/ Z2 ?5 Z3 Q) ^' O- ? mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID. |3 z, b3 E) h6 N/ B. p/ L
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
- x& h% ]& Y+ S! d5 _1 E) w: z VMMCall Get_DDB
0 y# n5 `/ x+ b6 A: I* z mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
. w7 J ?! A9 E/ u5 u7 l! T7 ~- I1 j' k1 r; e
Note as well that you can easily detect this method with SoftICE:
$ K2 e/ i2 z7 @5 | bpx Get_DDB if ax==0202 || ax==7a5fh# W! ~$ ~" Z/ o# S1 x6 \
1 U6 V: [2 Q# B; w__________________________________________________________________________
$ {* k' c; Q4 H8 W n4 ^! z o6 B3 u3 a; N
Method 10
. D& N& T/ P4 F; ?=========' [+ Q+ G% T8 c/ k2 O
% d5 k' \) ~& i( Q# r3 ]& |=>Disable or clear breakpoints before using this feature. DO NOT trace with' } b- `: {4 |) E8 v) v2 b! q: ^
SoftICE while the option is enable!!: U/ e' _; u2 u8 c
$ \3 m& [% S7 s" Y! \. W* X: U! nThis trick is very efficient:
- ~& f8 }8 Q: pby checking the Debug Registers, you can detect if SoftICE is loaded
/ v; Y1 R3 \# j6 \% m(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
% K) [6 h* ^1 l/ bthere are some memory breakpoints set (dr0 to dr3) simply by reading their
/ ~/ @; `' ` ?- M5 ~% Y5 fvalue (in ring0 only). Values can be manipulated and or changed as well/ E5 x/ I, k6 Q# `
(clearing BPMs for instance)" T$ [) v1 z' B- @5 v# m0 j
5 s4 `5 P4 w: p3 L1 k
__________________________________________________________________________# W$ C8 {% I+ t& V
e/ f4 w. m% T7 x' v- `
Method 11$ W6 E0 u3 p! K2 g& }9 O/ q/ d* c
=========
8 k+ @6 n( a5 p0 c8 e% z
2 K# g, `, E$ L& nThis method is most known as 'MeltICE' because it has been freely distributed
" z7 |- [" x9 L3 I5 `# `/ \via www.winfiles.com. However it was first used by NuMega people to allow7 ? T' X$ Z% A% x( j
Symbol Loader to check if SoftICE was active or not (the code is located9 @! i4 y2 K6 ~3 k9 H' T: U8 B4 B7 Q
inside nmtrans.dll).
; U- m+ l% d1 f5 i5 {' x+ G L& ]$ }; D. e$ z2 X5 V
The way it works is very simple:9 v! Q4 a# t ]* ~* D+ u* q
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
4 E7 ?: g$ T" i: q1 gWinNT) with the CreateFileA API.4 s. B0 E2 E9 c5 X9 Y9 R# B8 A! ~
! X: } z$ M3 ~" v# cHere is a sample (checking for 'SICE'):: S# n+ j* g4 j
2 L2 W4 V9 o& V+ s$ y& UBOOL IsSoftIce95Loaded()2 y- i9 @" c5 i( f# F! u8 n
{) H$ I/ [: `4 h( j' R% Q2 D" H
HANDLE hFile;
9 q+ E# r; v: S @. N" @2 q+ U$ s hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,; R& {3 @5 J' h# O1 p. ~
FILE_SHARE_READ | FILE_SHARE_WRITE,; P: o9 d4 X3 {6 `$ X
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
- d: p+ K( D8 Y4 K+ j/ r if( hFile != INVALID_HANDLE_VALUE )$ `- ^& J0 ^9 x' `
{/ [9 \$ y" |7 D- G3 l: i
CloseHandle(hFile);
5 k* `3 A' @& H* h% I5 L3 \' x" { return TRUE;& F9 W2 ?7 m3 m3 q8 ~
}% A/ R+ B6 T8 |3 M# C' g8 `
return FALSE;$ L2 x! I7 I% C7 \
}5 d- @+ L' K6 q0 I- o2 o) l( P( K
' f, F e$ k+ u( C3 uAlthough this trick calls the CreateFileA function, don't even expect to be
3 m- H/ K: {9 _$ A6 yable to intercept it by installing a IFS hook: it will not work, no way!
* j2 }$ X, t1 NIn fact, after the call to CreateFileA it will get through VWIN32 0x001F+ M) ]5 ~- q7 @4 o) K: x, o4 d( d
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
# @. Y7 x# Z5 u A3 Uand then browse the DDB list until it find the VxD and its DDB_Control_Proc5 w8 s r5 L# Y2 Q3 s9 F
field.
8 N7 p8 S) S) g) e7 j2 {In fact, its purpose is not to load/unload VxDs but only to send a
! U6 V' q- k4 a ~. WW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
+ |9 o1 u6 ]7 Y0 S1 P8 tto the VxD Control_Dispatch proc (how the hell a shareware soft could try
4 S5 a2 r4 Z5 w3 }to load/unload a non-dynamically loadable driver such as SoftICE ;-).
+ }4 y9 Y2 r6 ~9 @6 TIf the VxD is loaded, it will always clear eax and the Carry flag to allow
8 v' a$ Y/ V$ j9 |) P! m `* Kits handle to be opened and then, will be detected.
: d4 Y& N4 g( U& y! x- ?* y! EYou can check that simply by hooking Winice.exe control proc entry point& J6 ?, d3 x* ` p
while running MeltICE.4 W* c6 p6 V1 u# Y: }
8 X3 J3 m2 z A2 `' U2 Q t
9 Z0 O( H# A; @! d' P" W 00401067: push 00402025 ; \\.\SICE
2 p% n- a f1 C( p. n 0040106C: call CreateFileA3 Y g7 @- N0 U3 d3 \4 e
00401071: cmp eax,-001
2 U& [! a$ ^/ S4 ~ 00401074: je 00401091/ G" B# a* X i6 d+ v* r% |; q
0 o/ I X& t7 |/ k/ R1 B3 v
( @- v' }* m A& G- qThere could be hundreds of BPX you could use to detect this trick.
" n- b% d7 [( J k-The most classical one is:
0 {% i6 i- _, e) o BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||( s; Y5 Q7 Z! w) k# f/ p
*(esp->4+4)=='NTIC'
: @% Z e: Y8 p
0 k, {3 K, W) ?; D7 W6 o3 S3 w-The most exotic ones (could be very slooooow :-(
/ v* l+ U+ P0 x* ?( }, O6 J BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') # l {; _$ q( Y3 v/ d4 G
;will break 3 times :-(
8 e- [$ Q5 k1 P' k$ p
4 x# a$ d9 l; ]4 F4 f- m-or (a bit) faster: 6 {" v3 X, M$ D7 y5 l0 m/ ]
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')' e5 x/ S+ @! _+ m7 T
9 z' \9 \) u+ \8 ` BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' ! n) j3 L. K- O2 V( D" d2 [5 `
;will break 3 times :-(
% u- w! s0 J9 H- E& W+ m7 D+ H' V6 l; T9 i0 z
-Much faster:
& c, Y) q j' B9 k BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
4 Z- Q5 v- n" w% P9 M6 M/ @# B$ _% l% Q, l; i9 Q# u- v
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen1 B/ S1 `; L' R
function to do the same job:
. O- f3 U! o: v3 z- T7 J$ d$ A7 U C3 d1 [9 S/ |4 S2 l
push 00 ; OF_READ9 A/ i2 g& [8 i: W/ O% y
mov eax,[00656634] ; '\\.\SICE',0
" g% a k a+ r8 M' Y; J push eax
4 |: t. f" _6 w: }1 d" F) k9 o call KERNEL32!_lopen
+ a; q0 ?, D7 e, S. [ inc eax8 [) J( Q% y- b( p, o
jnz 00650589 ; detected0 p" w9 j; V/ T8 F9 ^3 D" A
push 00 ; OF_READ
" j, h8 {% ~3 Y9 g0 M0 [ mov eax,[00656638] ; '\\.\SICE'
* Z6 K* Q- K3 H1 q7 G# T push eax
* h/ l4 o) s) a( |- S4 H call KERNEL32!_lopen
/ n3 w! {/ X n& _ o2 o* l inc eax( V9 C ^4 R$ V9 g; E O
jz 006505ae ; not detected% S! ?( S3 w; Q, I# z
9 I! V2 l6 B6 J; X- ^
( C! J2 e+ ~1 s- i( t__________________________________________________________________________
, [* i5 Y! Q8 h4 [5 K" t' b- W4 y" x7 C+ m
Method 125 {0 W. n$ q5 t ]3 V- Z
=========
6 F, e! ^ M3 q* E r
R7 u* _ u, MThis trick is similar to int41h/4fh Debugger installation check (code 05. w( U7 E* l# y8 t0 _8 z$ ^: W
& 06) but very limited because it's only available for Win95/98 (not NT)8 J# n: a7 r7 ]/ [5 p7 a
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
! z e" Y4 \4 L$ E$ _6 v* N% C
9 W, K1 t8 ^2 `8 g$ _( y: J push 0000004fh ; function 4fh$ Z# m" [4 D: w M7 h
push 002a002ah ; high word specifies which VxD (VWIN32)
8 ?3 E" Y/ z! W1 y. z6 Q4 F& _ ; low word specifies which service" x2 q6 |! @4 r' p. f- w2 q
(VWIN32_Int41Dispatch)
5 ]; X. s- B$ Z- ^9 _! B0 J call Kernel32!ORD_001 ; VxdCall
; C, S" y8 ~) ` cmp ax, 0f386h ; magic number returned by system debuggers
: K& B1 ^, z, K2 | jz SoftICE_detected1 H& Y7 E/ N6 d8 v: q" }. g) w4 R
3 t: D6 O4 B; o" W) W( N! DHere again, several ways to detect it:( P; A8 w3 y+ Y I+ x
F- P" w2 A2 V7 |5 s- x% r: [
BPINT 41 if ax==4f
, |; f, q. y3 r6 P4 D. {4 k0 u( C# N$ A& f% A. w5 g: s
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
6 u, W! o4 ?1 W$ `9 R
4 G8 U! a4 {/ U& k* h' I1 { BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A6 A5 \8 g/ @( f' ]" L3 l
% K% [6 y E# E0 J& `5 c) b BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!! I! J# T( @- ]9 U7 [
: v& c" W2 r1 ]. [1 B! E
__________________________________________________________________________
p5 u% d& f, J5 r; K$ e, ^. ~, j! ^4 X" L( |& ~
Method 13' R& L: J2 _% R b7 f3 |3 L% E
=========7 _8 c; Q- M+ Q
% H" ~0 v, t/ E8 RNot a real method of detection, but a good way to know if SoftICE is! o7 B% C0 X0 w* x! \
installed on a computer and to locate its installation directory.0 J* |7 c, l1 f" A
It is used by few softs which access the following registry keys (usually #2) :
: q, J" X$ x$ C$ w* O. |9 Q$ I
6 d' l( X E" p7 I( v-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
" Q) c- F" t; e+ H\Uninstall\SoftICE, H: F) L( l; p
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE) g7 x0 |: q/ K9 m5 {& G
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
. V8 h7 W! S) n, `" o- \) m& |\App Paths\Loader32.Exe7 t' y: A# G7 M0 [- f1 V2 u- g, W( i
( k. @, f% M1 i# \* f
. E l: j% ^& k! v. {Note that some nasty apps could then erase all files from SoftICE directory
3 x+ u; A) P* e6 N/ }; @/ n(I faced that once :-(
1 a8 [6 G V- C
5 \% w( c6 I0 {Useful breakpoint to detect it:4 D! A, i3 A# M. _- Q+ H6 w* \
+ B" U5 u+ }8 c$ Q8 e" C9 g. d
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
/ r3 V# D: D* M( r! ?. H/ c
3 _9 }! l2 r# ~! N7 F$ x. y8 g__________________________________________________________________________. t8 j; D* Q o7 Z& P
) |6 N" l+ u9 P: E* }. u( C
# S. p$ \7 I& c4 f+ bMethod 14 , [& |& m3 Y- N: q2 Y' O
=========9 t0 @: X" w5 `' a
7 F0 ?& B, K( Z/ Y
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose0 v. @$ p( r2 B v& e# x
is to determines whether a debugger is running on your system (ring0 only).
# I# e# H4 t& Q( T4 c: ]4 O/ e4 {! Q7 N- b+ y+ D, Z8 A
VMMCall Test_Debug_Installed1 X; P2 g+ ~% f( U) c4 Q
je not_installed
/ v0 ]# \! g4 s8 [
8 J0 S% }, B7 A& ?" `; `2 n- k# zThis service just checks a flag.( y3 q9 o; h0 W- N8 x
</PRE></TD></TR></TBODY></TABLE> |