<TABLE width=500>
6 o- l! i+ O6 f C" }<TBODY>
0 n. z8 F6 C; w# V<TR>
$ N+ {3 s3 a5 I5 z<TD><PRE>Method 01
4 L) ] I( ]- X=========+ [. }( Q/ p+ X1 M% D
# H4 t( B4 I2 Z. _, j
This method of detection of SoftICE (as well as the following one) is
/ z% g4 n8 k/ G X+ B4 A; ]5 _used by the majority of packers/encryptors found on Internet.( E/ J! Q/ Y( Z: i+ B5 B9 d
It seeks the signature of BoundsChecker in SoftICE
3 v7 c" x$ C& Z
5 D% |1 d$ W( z; Q9 B mov ebp, 04243484Bh ; 'BCHK'
0 w* M& T; X$ v9 e# [% @ mov ax, 04h
5 U1 s' s6 u2 l# c& Y' u" N int 3 - O2 v( k6 ^% n% F! b. C2 J9 L
cmp al,4
' M3 g6 N. q& a8 ^& b jnz SoftICE_Detected) `6 a: j8 ^9 t
. \; W2 Z4 E8 L! x* P* P
___________________________________________________________________________
$ e5 c# g9 W/ r4 j5 ?/ \6 R( A" c" r5 D5 L H
Method 029 d( q4 u' H, ?( K6 x4 A: i$ a) Y
=========
: V. B3 o0 H: W8 ]3 K. X* p! ?; G6 Z8 M) E4 h
Still a method very much used (perhaps the most frequent one). It is used
+ q& i4 l6 w, Hto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
# g% E. w q o- i& y7 ?0 Yor execute SoftICE commands...
. B* e5 A$ M" W$ `& V3 b9 O c% WIt is also used to crash SoftICE and to force it to execute any commands+ O& G3 ^0 K+ J7 x& [
(HBOOT...) :-(( # p% [2 ^ y& T/ g. U
8 y+ y6 t$ r; GHere is a quick description:
: C1 U- e, K5 _3 M% y-AX = 0910h (Display string in SIce windows)7 M6 V2 S1 h) z% A. i# Y- ?5 f( @2 {
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
# T; w/ g( Y2 B. Y-AX = 0912h (Get breakpoint infos)+ ?8 }' n u x7 m
-AX = 0913h (Set Sice breakpoints)
0 h$ r/ Z2 W) o [% i7 u+ K$ o-AX = 0914h (Remove SIce breakoints)
3 M# c) }1 q( s+ Y7 p! S
& O% U9 y z, K$ @3 TEach time you'll meet this trick, you'll see:
; E* a9 B( l- a; W5 q& r* J/ W8 R-SI = 4647h$ ^2 `& b4 F0 ~# o9 ~) N
-DI = 4A4Dh) Y# g4 j% |! A, t
Which are the 'magic values' used by SoftIce.
" P, [0 U$ C- E, V, EFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
- j4 o& i3 E8 y0 a' ]
7 k9 X7 \3 ]6 Q8 m8 EHere is one example from the file "Haspinst.exe" which is the dongle HASP
2 s w& F) l5 [- a7 @' yEnvelope utility use to protect DOS applications:
/ g+ t [3 D# p/ l* q5 [7 N. }, r' z$ H$ x
7 |) i1 I! t7 n4C19:0095 MOV AX,0911 ; execute command.) _0 `! ]6 ~" q) [7 G) H
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).- F, f% K1 S8 f
4C19:009A MOV SI,4647 ; 1st magic value.
2 e; L& P5 I, q4C19:009D MOV DI,4A4D ; 2nd magic value.
% e0 O8 Y: M1 F+ I; I4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)" I9 u6 i, F$ p' H3 i& _, D
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute+ C% S5 D: V* V( ^; w
4C19:00A4 INC CX" S6 K1 M% `* t0 C0 j) { B
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
" k) ]; l _5 {2 n4C19:00A8 JB 0095 ; 6 different commands.! g8 S4 p/ M! T, f% N
4C19:00AA JMP 0002 ; Bad_Guy jmp back.6 }( C2 H, ^% a2 `# O& o( y
4C19:00AD MOV BX,SP ; Good_Guy go ahead :). z r3 W5 G; a/ A) \7 N! p! ]# A
" d5 s/ z5 p O" |4 P( a& Y
The program will execute 6 different SIce commands located at ds:dx, which
! ]3 x% L& V6 n6 `are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
$ ]. Y' _+ h8 z, b; U$ o+ [
6 n2 c g3 v2 l, B* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.8 J. ^9 e. y' \( S. |( u
___________________________________________________________________________1 b! d" T. S% V/ { V9 F
/ }7 t3 }2 K4 q9 B U3 R
9 N% f% ^; H9 UMethod 03
1 z# r, N5 h2 J=========6 |: r$ r' c D; a2 a+ ?
& Y9 d, i" J6 t6 e1 \# wLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h- E7 a1 h6 b5 f: m2 _6 c) @
(API Get entry point)
2 W, O) Z. m. V; |* X1 I
9 u5 `6 a, ^' S: S; K* k3 k
' \% z" _# q8 O3 `* _3 J xor di,di
, A: Z4 t) @! i3 y mov es,di0 f! x' D b# F( n
mov ax, 1684h 9 G" H; g7 `- e. F
mov bx, 0202h ; VxD ID of winice
" ^6 u& L0 f" f5 I4 o3 ~% E! n* [3 O3 s int 2Fh
( g( x- `! g- i& x& @4 e$ v0 ] mov ax, es ; ES:DI -> VxD API entry point
- [ _; X* X; D* W$ k; A add ax, di# I: `8 f8 \5 Z" P2 w
test ax,ax, v m' i( E" H
jnz SoftICE_Detected2 I% Y, T, Y! ~: F# B" m
% w; W7 w5 {* ?5 x7 \, ?' c
___________________________________________________________________________
+ z0 `# s. G z& k# I, }
, j% k, ~1 q2 n8 w9 X4 v2 o4 ?Method 04- l) T, M1 R4 M7 {: i: s7 d' ~
=========* I+ h1 W+ C. A1 Q, [+ u
) b& H6 S; u' ?* ^1 _) N. Z, |Method identical to the preceding one except that it seeks the ID of SoftICE7 n4 h; i) a M( [
GFX VxD.
0 M* m6 A3 X m* }- g% q2 x7 i9 [4 M5 l: W& H& p9 K, Q
xor di,di
0 m, C( K# M& |, Q mov es,di) _8 c1 U2 M, ?" E* n
mov ax, 1684h - r4 a3 T0 c) F: Y1 X
mov bx, 7a5Fh ; VxD ID of SIWVID
6 n$ ?+ M- _) b8 d6 Y8 ^: a, V int 2fh! {5 M. x3 q* ?, O# f0 p7 I
mov ax, es ; ES:DI -> VxD API entry point
" j- K% P* I! L# g add ax, di& P6 w6 G- u; I
test ax,ax
$ b; y9 \) i' Y c4 u jnz SoftICE_Detected
) T3 [. [, Z0 q% {. W6 B% B
S- ?8 K6 {7 W5 o& r8 u# {__________________________________________________________________________# f. ?. E t. T* U4 m0 w
. G( f) h" N2 e0 @0 A
0 V. z5 p0 I3 q# e% I# J
Method 05) R0 \. \( _1 y) S
=========
4 q9 n1 u0 W: K9 t/ J8 J; d
! R* r6 j7 P+ [3 LMethod seeking the 'magic number' 0F386h returned (in ax) by all system
! J* K9 M- k4 d% G: Rdebugger. It calls the int 41h, function 4Fh.
8 [+ S3 x! b8 p3 Z, k" c& H+ cThere are several alternatives.
3 P2 _2 d6 l9 C D7 d/ G& U& V m( r- U4 e5 F8 E( O- z
The following one is the simplest:
. [( m- k* s& n0 [" j4 X* [% l
; v( c9 h6 W, W4 j5 ?1 h& R& u# @ mov ax,4fh
& p" ~+ e) S1 N S int 41h7 [% G) C x! s5 h+ z2 N2 _- U8 T# L
cmp ax, 0F3860 |8 S+ F+ |3 K! A4 W# _& T
jz SoftICE_detected
3 g, `8 i- t2 {4 s3 V5 o
, S& w/ u2 }6 U( [: i+ s2 _( L! [* o( x% E4 B2 x; P Q
Next method as well as the following one are 2 examples from Stone's " r, S$ J6 z! k; ^9 R
"stn-wid.zip" (www.cracking.net):
/ l9 `2 B% v/ y0 m) o/ P7 m# @5 s9 V
mov bx, cs
8 N4 a2 O4 x+ z- D- I lea dx, int41handler2
, S# R2 i4 J. x. ]6 } xchg dx, es:[41h*4]7 q" y* V H C2 d a- u) C
xchg bx, es:[41h*4+2]0 y+ X1 I) d0 s; a4 J1 E
mov ax,4fh
2 j \/ a% v* R/ b" S [& h" Q int 41h
( h. _) i6 v1 @ xchg dx, es:[41h*4]1 x! ?7 o2 S: T Q! a2 G, }/ K
xchg bx, es:[41h*4+2]
, }5 K x: k3 V7 f* W u; c3 } cmp ax, 0f386h
$ u& X, K! `6 }) M' {3 L5 } jz SoftICE_detected
3 R% X4 J/ g+ B9 B
# y4 C4 I+ ]& }int41handler2 PROC# a2 V- W8 b( }4 N4 r. c/ Y% Y5 B
iret
9 E. p5 O6 b \; x/ {' t& E# {int41handler2 ENDP
2 Y" v! A# q$ P6 r! r' _1 k1 p' x$ J
5 L( @* r7 A" |7 I# w
_________________________________________________________________________
2 U8 h4 y( L5 Q. n2 p4 X) t3 O u$ Q2 l$ |; }# x* t8 x
4 c8 J3 [# m/ E" y6 n2 F- PMethod 06
" V0 }/ ~* S& i& f4 ^/ p. q, L=========- ^. W5 H& v1 ~' N7 W
! X" v" B. N- w' k' n8 F
8 m) M! @/ }; F: c! g2nd method similar to the preceding one but more difficult to detect:/ W6 e8 H/ t: c2 C% X2 _) Q0 x
' F* F0 M, v6 j; I: U
' T& u/ ]& J# I
int41handler PROC( E( V! v/ \0 ^+ }5 c
mov cl,al
9 P6 |. L! m! V' q0 u+ k iret
7 G0 |# `1 v$ Y0 Z/ V O4 A6 Y2 uint41handler ENDP& } a0 f$ F: \) n' b5 V t5 y- J
% `$ r$ y5 {9 ^ v4 {2 \& `
* N* w( _# i9 H, b8 N: A! D xor ax,ax
6 L2 g& }; Z) t/ d2 U mov es,ax
/ M7 C% `/ h w7 G7 M" n mov bx, cs
7 B5 L0 X* Q- f% o2 O% m lea dx, int41handler
( V* }6 A r" }( J1 W xchg dx, es:[41h*4]
" x- r1 [8 d) q, P+ g# R xchg bx, es:[41h*4+2]
+ E. W4 X6 d8 Q, X in al, 40h
8 S8 I: f# a8 w2 x9 R/ t xor cx,cx$ [7 R X$ B% S
int 41h
! m/ Y4 B1 r" t5 b# [/ x: I+ ~ xchg dx, es:[41h*4]
' ?3 m4 ?' N2 B0 ?7 g xchg bx, es:[41h*4+2]
% W% e) d6 K9 w' [ cmp cl,al
! ]6 I0 z+ O8 Z! \; e) S6 H jnz SoftICE_detected
D& U8 J# q% \( ^: Q+ l. Q/ {; m
_________________________________________________________________________
7 p1 F# i) |: G7 k/ g7 `$ R& J8 G2 R L; ~+ `
Method 07
" ?* U2 _' B* n, [5 m/ T=========
3 l: N, C0 ~, @4 |2 O5 ]8 j9 W4 k9 p$ g6 s# T9 O* _: } [8 b
Method of detection of the WinICE handler in the int68h (V86) v2 U7 m6 M% w% n8 V
6 h9 n7 `5 P) B( b+ D' g: [
mov ah,43h
8 f' D" U7 G! N; s+ U int 68h
5 b% U) I" U& f, X: J3 c8 s# C cmp ax,0F386h
" W3 Y- c$ [' ~: Y jz SoftICE_Detected, C7 H6 [5 u0 l5 O+ J; m
+ V: T7 Z! h( [
) }! D" f9 K J5 A=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit5 p5 S$ G: m; L$ c% w
app like this:2 @0 }8 f2 m5 E( t0 P
" B1 N% G1 z# f y& c BPX exec_int if ax==68' D5 u, G c0 e! e' [, o) k
(function called is located at byte ptr [ebp+1Dh] and client eip is% I7 H2 [6 ~/ ~( h0 A. q# b
located at [ebp+48h] for 32Bit apps)
; J2 A. N, l9 g& N7 k6 Z7 A! L__________________________________________________________________________
7 w3 f4 ^, } c$ O5 I
' A: i L4 y- T2 u
' n: A+ X; ~' ~) e! L' d1 cMethod 085 v& ~$ [8 X6 }* ?2 k. V: K
=========
* U k7 C4 Z; N5 S. d- R# ~/ n$ h$ [: \; X/ @
It is not a method of detection of SoftICE but a possibility to crash the
+ R, I1 V' ^% o! fsystem by intercepting int 01h and int 03h and redirecting them to another' u. |( u$ m* }+ |! ?: @. V
routine.
+ h2 J' U1 B! e$ a/ C% w5 ^1 HIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points, x' i8 a0 ]; \; A
to the new routine to execute (hangs computer...)& x; G- @6 S( I+ v
3 m- k3 E9 V; I
mov ah, 25h
% c. X! e# ]/ D7 D; f) b7 ] mov al, Int_Number (01h or 03h)$ i# B' d* C, i
mov dx, offset New_Int_Routine; c+ w6 e: S" h( y5 Z4 {7 @$ j5 ^
int 21h' t8 o' ^! h3 u3 J& D
8 g+ M8 t P. D8 P( x8 Z9 Y- f__________________________________________________________________________
0 E6 Y( F3 v6 ~8 I' T4 Q! @/ P" S' G
Method 09
' H5 x. Z. `; G6 o% {1 {=========
9 M. r& V* q+ Y/ b/ i6 I. z
# T7 h7 l; A9 g ?" z0 FThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
: `7 P! E/ o4 Q7 Tperformed in ring0 (VxD or a ring3 app using the VxdCall).* h" E" E" h8 \- [" |7 V: |
The Get_DDB service is used to determine whether or not a VxD is installed
$ \+ J W" ^( h7 I: m$ O& [for the specified device and returns a Device Description Block (in ecx) for
- u' r* V8 l5 [; w) R( kthat device if it is installed.
8 y% `+ h7 B5 v+ \2 v* m6 F+ H. b' T2 k/ l$ {& _. b6 U0 r
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
; A7 ^! k: f' a! j mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
2 A" ?( ?# ~: r V( }/ X7 X) P VMMCall Get_DDB
, r( ]7 J( q% r% p+ A mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
4 Z2 n+ Q- q1 x* U# L( V8 U* T* R( |- }" M" c5 {( c
Note as well that you can easily detect this method with SoftICE:
# A1 F' n9 w+ T9 T4 P bpx Get_DDB if ax==0202 || ax==7a5fh4 f5 e/ X8 d8 s5 z) {
" j* X& t* f7 l2 S! O6 n; E, v__________________________________________________________________________
0 R9 o! p$ ]$ f) V6 t! C$ W+ Z% h- x; K. z `; a. K& e2 {) ~, `( t! m
Method 10
. I- K `* k8 \& e i=========
/ T& i9 m+ H5 z" s m1 i; e7 D* D( k/ E0 a
=>Disable or clear breakpoints before using this feature. DO NOT trace with- h) W2 [2 r$ _7 _0 a
SoftICE while the option is enable!!# a# i$ W4 ^7 T# x, ^, I; V1 E
& V' @( C, V8 eThis trick is very efficient:$ A. A. Q& j' D; `. S: p
by checking the Debug Registers, you can detect if SoftICE is loaded7 Y- g2 M) O% G
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if0 h- q; K; i# M" ]5 a: S. ^# `
there are some memory breakpoints set (dr0 to dr3) simply by reading their, ?% s7 y( J$ ]. x0 s
value (in ring0 only). Values can be manipulated and or changed as well) g0 |# B' c4 p+ l5 i
(clearing BPMs for instance)
7 E+ m/ H1 @# g v. |1 \6 c8 d% C
__________________________________________________________________________
8 r) _& k' y5 K, L, S) g$ z
" p( b F5 T, [: I6 v8 @Method 11$ ?$ m4 s6 p& c9 z$ Q; R
=========
* C g* K( W% E0 F% Z/ o5 F8 c
0 q. H Z5 p/ m( PThis method is most known as 'MeltICE' because it has been freely distributed0 v7 M/ T0 ]0 D8 ~" A; e. W! y
via www.winfiles.com. However it was first used by NuMega people to allow
/ k5 a7 {4 J5 w7 y/ `Symbol Loader to check if SoftICE was active or not (the code is located
+ W6 I& {9 ~$ q3 sinside nmtrans.dll).
3 S5 k1 H. _: `7 x1 B0 l
5 C& c5 m- {0 i" i! nThe way it works is very simple:
* g: |( l. ]1 {! V+ S5 P6 @$ FIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for3 b' \& A3 F5 ^
WinNT) with the CreateFileA API.; K2 W5 D( M3 \( x
8 K* ?/ C! Z, c" o! p5 ?Here is a sample (checking for 'SICE'):
! k) H. O: P% f5 r
3 v# I' J6 Q% i4 _BOOL IsSoftIce95Loaded()
$ Q9 z7 ]( A8 P2 S{$ Y+ [& K/ I1 _8 y9 G/ Z8 X- C
HANDLE hFile;
$ }& @: ^6 n' N- P) i hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,6 k: {5 H8 C R m
FILE_SHARE_READ | FILE_SHARE_WRITE,
1 u4 `6 { J' H5 R0 b2 [) w# D& w NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
# c0 f( k5 e0 u+ C2 Y! \ if( hFile != INVALID_HANDLE_VALUE ) S7 h5 }% d9 K& `6 v
{
E) ~( F' @$ S1 K1 [ CloseHandle(hFile);4 D8 |( A% G) A
return TRUE;
+ ~/ L6 e+ v" F# a, j }( p1 g) m1 ~5 `& a0 ^
return FALSE;: H" ~6 a4 V6 C3 L9 ^
}
9 F) }! x( i0 K, O$ Z# y0 [. ?( w6 s k' R
Although this trick calls the CreateFileA function, don't even expect to be1 B" V# s* w1 z2 w7 |
able to intercept it by installing a IFS hook: it will not work, no way!
: ~3 ]+ P# {) t- qIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
$ z7 g$ X3 O7 d, t3 r- w# d' iservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
+ D8 X6 Y1 H! z! B, F* k1 w. pand then browse the DDB list until it find the VxD and its DDB_Control_Proc. n/ _4 m( S6 }1 j7 `
field.
; S6 S2 V3 c$ p- r. p( V- BIn fact, its purpose is not to load/unload VxDs but only to send a % {5 s& |; k7 [: _0 s& n0 K' v
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)5 U" O! F' U7 G" A
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
% l0 b/ k/ v% k" {% n4 Wto load/unload a non-dynamically loadable driver such as SoftICE ;-).
# f9 b% f& g U1 ^" b( yIf the VxD is loaded, it will always clear eax and the Carry flag to allow
. w D4 F# r3 |$ C& L( P) S7 Oits handle to be opened and then, will be detected.
4 r3 M- Q; l) m# }. v; L, |0 CYou can check that simply by hooking Winice.exe control proc entry point
1 y9 t7 Q5 Z- L" ywhile running MeltICE.
# E: V: a7 l- ?4 |9 |, i8 z9 X& e. N" }
: o. T4 {! ^& x9 p* j 00401067: push 00402025 ; \\.\SICE: a& j, f# H: O6 _' J
0040106C: call CreateFileA; ?( {6 Q) W$ v7 J4 \/ ^. a. _
00401071: cmp eax,-001+ F' g m3 k/ |7 S4 \" \; A( e e
00401074: je 00401091
' @5 ~, _; a+ e( F) [) c7 M
( T S" z+ Y; O9 T0 b
0 C; Z5 ~% I. u/ b' |, YThere could be hundreds of BPX you could use to detect this trick.
+ u( r: q" q: ^8 j. }: R) h$ _5 ^-The most classical one is:; r2 r3 X) V* i8 F3 ~0 V
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||- ?+ r" I) ~: z5 {4 W' v
*(esp->4+4)=='NTIC'' e4 t/ @9 Z$ l% ]7 B: t
6 p+ c2 B- l, `-The most exotic ones (could be very slooooow :-(
- @& T2 |( |2 Y' t" R" z BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') ) Q6 {- \, c8 K0 b, z; `4 j
;will break 3 times :-() Y0 Z( v0 P& K& Y/ G7 ^
2 V2 b) T$ i: F5 e4 Y7 i-or (a bit) faster:
. p; l. r/ K5 x/ E" A/ I; z r BPINT 30 if (*edi=='SICE' || *edi=='SIWV')& c; |' b' D% ]! }
1 d( k" S N/ O. t$ |. s BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' % _+ E9 c) Y" C8 W
;will break 3 times :-(! J3 L# Y: l4 ~, L
, t2 i& q7 A* v1 M0 D-Much faster:9 B9 T: I& L( V
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
! j$ j- ~# H. e4 M& i+ z, z3 {! Z+ A
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen/ J" c2 `' L) R' w" f
function to do the same job:
: r+ }/ j3 r9 k* ^; y
' U! \. c# i( l, m- K) p push 00 ; OF_READ
0 p% z1 Z1 c# H/ g. k' d mov eax,[00656634] ; '\\.\SICE',0
9 b' C# o7 d( O; S$ a, o/ h push eax
* B! [+ B+ L( l! s, K2 K X call KERNEL32!_lopen, A, V* O/ K! m# t1 P
inc eax/ k0 c# x- T' P+ {. L
jnz 00650589 ; detected; W- j8 N2 J+ n6 H
push 00 ; OF_READ5 i9 o- J8 P/ h5 g9 K
mov eax,[00656638] ; '\\.\SICE'
; Z; W) N a' l9 B7 @ push eax
* \3 y8 j x7 T( M call KERNEL32!_lopen
7 q3 Q0 D- j1 W" S/ b8 D inc eax
2 ?) q' F" O$ C5 z3 i4 E. N1 ^ jz 006505ae ; not detected% {" b8 Q) o0 ~
" [0 j9 t, Y1 u7 U
1 E( {3 D- z. m. ~' Y
__________________________________________________________________________0 |4 m1 J8 \" L/ l5 }
O# @) P9 y% @7 }7 Z5 C
Method 126 ~: W/ Z4 ` a" B ^! }1 q4 O/ F6 R/ G
=========
x* V2 }* j+ s# [
" b4 \8 U9 g2 B* RThis trick is similar to int41h/4fh Debugger installation check (code 059 p, h4 {, f( {0 c h8 s
& 06) but very limited because it's only available for Win95/98 (not NT)1 b7 }# e0 J& d7 ^0 m" [0 q/ u: u
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
& L6 {* f0 `/ i: _# W% J. U4 I9 ^; R8 B9 W$ q5 {
push 0000004fh ; function 4fh1 w, P. k: N, c
push 002a002ah ; high word specifies which VxD (VWIN32)7 f- C+ A( b) `, X6 n7 e
; low word specifies which service
. J+ H5 [% Q7 Q+ e- l1 A (VWIN32_Int41Dispatch)
# D; ?0 ]! p; E) q0 `6 ~/ h call Kernel32!ORD_001 ; VxdCall8 g) ?9 }6 b5 k2 b; B. n+ `8 d8 j
cmp ax, 0f386h ; magic number returned by system debuggers
) a+ ?- w* b7 e3 Y jz SoftICE_detected& h6 p. _& N& D. k( B4 e2 V+ W$ q6 ]
5 o2 c5 x( L* I$ y) {
Here again, several ways to detect it:4 t' h; x ^& `- M+ y0 Y3 Z
' Y3 H6 S8 v7 f& {
BPINT 41 if ax==4f
% z& a. B" S9 c: ]" @5 ]. M
5 y0 ?5 v/ c9 t) J0 w BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one6 B8 S7 j6 q4 N7 w
4 Z/ B3 {$ D/ l$ x! B8 n: o BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
! t2 m# Y2 V1 {3 b6 }3 `" ]: r- u
1 {2 u7 y* q1 b" O/ u BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!( A( g+ v& o9 b; g0 l
: W. }9 X9 j5 P: Y9 x$ |' y2 s5 U__________________________________________________________________________
5 Z: u7 R8 S+ n' [& n# u# W) i
! H+ j2 }2 \' C5 n. NMethod 13
- S# `4 O0 V' U. F! Z; R8 _; R" r% e=========+ z0 G1 O+ m: i
: j6 h6 _) u: z0 j7 m8 t
Not a real method of detection, but a good way to know if SoftICE is$ g4 X T) R8 ]3 I; Y: t8 o+ O
installed on a computer and to locate its installation directory.# ?5 T) s4 A: A4 ]8 `
It is used by few softs which access the following registry keys (usually #2) :
. y9 C3 Q2 s/ v" |* y" S
( s& t1 d3 f% U1 P* o+ A-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion8 f4 A8 B4 Q. L7 \; P, l
\Uninstall\SoftICE
0 d, e b5 P1 T-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE1 ?2 v' D- J/ u
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion S8 \) Q; D( H4 |) C8 X( v
\App Paths\Loader32.Exe
3 T. |5 C) e8 z X+ N* O
, N: N r, H+ U0 ]3 |
% Y3 X4 B. q8 V4 J9 ^+ eNote that some nasty apps could then erase all files from SoftICE directory Z1 Z! k4 ~1 g3 \5 A
(I faced that once :-(, | v/ w/ d. `- H; j/ U1 a. x
0 K; Y% \! p) j1 M: B# ~Useful breakpoint to detect it:
& t. \1 N) e/ f. o# M* Z7 I# K- n! K1 S( F: r% ?. b- [( B4 \
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
* S/ `# Z$ D0 P$ u; W1 L) N
' U' [' R& V3 S) m H# J% t: ?__________________________________________________________________________1 \' E* z2 z% j7 ~
1 r$ j/ h" p: o6 ^, W
* a& I6 V: U+ k1 f/ hMethod 14 : N- c4 R% b: j/ c
=========
7 K/ S8 U/ ]5 E4 n, `! r0 \
$ \/ t+ D6 D* j9 p8 eA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose2 a, _! _$ B2 b6 Z
is to determines whether a debugger is running on your system (ring0 only).
8 P/ W+ R0 w% M+ V) u% {. X; U; s' i* ~1 o3 B1 N5 c; o
VMMCall Test_Debug_Installed
7 @1 r7 q# q8 B! Y+ K je not_installed) K& P; s" c" R) T' a0 E
( m& Q1 d0 ?- N( s- l7 N
This service just checks a flag.4 J' u! K; k7 x/ m9 C( v% H8 X% K
</PRE></TD></TR></TBODY></TABLE> |