<TABLE width=500>2 X" R* W# ~) V1 K
<TBODY>: b. H; d0 S/ t& [# D
<TR>
0 t: {0 A Q6 t' |+ K' R<TD><PRE>Method 01 9 K# i3 K9 Y9 Z. p0 i3 h
=========8 Y8 h; J2 ?$ B+ L
4 V+ p6 B# m1 i) R, T- N
This method of detection of SoftICE (as well as the following one) is
. d8 Q! u$ ]* I( q. Pused by the majority of packers/encryptors found on Internet.. A0 W( g6 n. w0 M, Y
It seeks the signature of BoundsChecker in SoftICE
+ U4 ?6 @; v$ m2 b4 \) J8 H" O+ b
9 q3 G# {# t$ f( ]& v mov ebp, 04243484Bh ; 'BCHK'8 d; N g* M/ y- N* n. S( }
mov ax, 04h
$ O: n% @. N6 o- p6 C int 3 ! v* Q8 y1 e7 V9 V
cmp al,4/ R0 B' W1 {4 d: D' j
jnz SoftICE_Detected6 H/ g$ K! }5 @/ N% o
+ E. N4 I- X( F5 u1 X___________________________________________________________________________
3 H. p* X8 R C \' Q0 P- O( ^ T5 {1 O( E9 o4 w. O
Method 020 F( H ?: I! g' q1 L" f' K
=========0 M6 `3 [* D4 `$ l
( N+ {1 m4 ]( I5 g! _; z& x) x$ u
Still a method very much used (perhaps the most frequent one). It is used* r1 E s, f" [) f1 ~6 L
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,' z* M/ |" J4 S: j0 C3 q2 C
or execute SoftICE commands...! v8 q/ K: A! N
It is also used to crash SoftICE and to force it to execute any commands/ I0 g% H) w) g% d8 d
(HBOOT...) :-((
; J7 U1 A1 t; w
; B7 B1 ^: I# U' i7 B+ IHere is a quick description:
' \& s; d* ?5 l7 k \7 z; _-AX = 0910h (Display string in SIce windows), D; V$ _0 w: t& ^4 G& R
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)8 V/ A+ y1 [0 y- X& J8 H) v+ I* D
-AX = 0912h (Get breakpoint infos)) }+ Q8 [# W2 ^" W
-AX = 0913h (Set Sice breakpoints)
2 z5 t e2 x8 w, X0 }-AX = 0914h (Remove SIce breakoints)- B9 F) E) C; {! T. q
' o6 V: u& f I9 a% ^Each time you'll meet this trick, you'll see:
9 ^0 ~$ p* p4 l/ M/ Z1 k-SI = 4647h
, Y3 d' L4 L/ }( |-DI = 4A4Dh1 y: f K2 z! q' p2 A6 b- C* |
Which are the 'magic values' used by SoftIce.
! g' c, u i+ Z; [. x; g# H% p, {For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
$ d1 L6 v1 _+ K+ g: [
1 t: C4 |0 h0 {2 s" E% DHere is one example from the file "Haspinst.exe" which is the dongle HASP3 K) M' X* I% ?
Envelope utility use to protect DOS applications:) {2 K6 \3 Y1 f9 f. {3 r# N8 H
$ y+ O; |: n+ }9 r+ m$ k: I# o
9 L" ^ `! Y; X I4 w4C19:0095 MOV AX,0911 ; execute command.! i% p" ?5 A, Z: ]7 a1 G Q
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
4 D7 Z2 d, @# E9 J4C19:009A MOV SI,4647 ; 1st magic value.' b( W& W- a- S6 O2 s+ A
4C19:009D MOV DI,4A4D ; 2nd magic value.
4 o0 u* {& k; y; @/ \4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)2 V1 K0 y7 c3 T3 Z0 o: e
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute! J2 ~6 Y+ `/ K- q* s
4C19:00A4 INC CX6 v3 }$ W8 N7 o$ [8 R2 u
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
* S; p1 B) _; T7 i Z: g* e4 P4C19:00A8 JB 0095 ; 6 different commands.
1 Q) f9 J& M' ^8 \0 A4 Z4C19:00AA JMP 0002 ; Bad_Guy jmp back. g3 N% W/ {. j* E2 Z" R
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
0 {% t/ g9 r8 w# i) ?5 a! h! L. Z' t
The program will execute 6 different SIce commands located at ds:dx, which
5 A& Q f5 U* c! Z! q, E T1 e; Oare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.- X$ u; l! g' C/ ?# E3 k! H
9 b+ b' k) t; I* h* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.5 C9 g8 f+ D& m/ X3 n& P( [
___________________________________________________________________________9 T+ i# z4 P( h" W0 t* T
5 U4 Q; I3 `) {$ ~! c$ Y
% Y8 J$ v) @; B8 I8 A
Method 03; P1 I; D1 S' V: ?/ `7 y
=========! b( [. r* y# h
+ r2 X# S& y) w9 X( N/ @
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h0 X, M. }; U9 M0 V/ j, e3 O: H5 i
(API Get entry point)$ n. ^% `% \& v
6 Y0 D* X7 M/ K& E6 v6 A2 X5 N
( M: m6 o# F+ j+ ]5 G0 j% } xor di,di
9 ^0 H9 D+ q5 C/ p9 m& M mov es,di! r) X0 g. k0 ?
mov ax, 1684h
- O* g- ~* y5 G mov bx, 0202h ; VxD ID of winice& x5 m2 [1 _, h( E7 r$ }" G
int 2Fh. ], G* l, g" G+ \
mov ax, es ; ES:DI -> VxD API entry point6 w( |! p3 j3 r: l( a
add ax, di! c8 l- m$ S) k, p/ a. X
test ax,ax
! ]% r3 C- L8 n' f8 a* r jnz SoftICE_Detected) M( h. b' k% W) G) x
" h' T) P7 n4 y, i* x
___________________________________________________________________________
. D9 D/ I& B3 B1 m$ k/ U
! ]& r. X6 _0 F7 h# I. pMethod 04
& s% W5 w( e& s=========0 B4 l7 K+ T# E- Y
/ ]% Q/ {6 i, U' Z
Method identical to the preceding one except that it seeks the ID of SoftICE# f2 U, C6 P1 y/ M; S+ M1 `2 ^
GFX VxD., W) |* \0 Z2 I& K: H) G
6 t0 l- ?- J7 e( O1 L, A# W; P6 l. p
xor di,di* y* [1 f* v! W* h) n1 I
mov es,di
/ V! b3 h2 P k% J, w# l0 | mov ax, 1684h $ D! I; z" Q: S6 |+ Y0 ^; `
mov bx, 7a5Fh ; VxD ID of SIWVID+ B H! ^( ?6 Z
int 2fh$ w8 X" E' R. b7 W8 h. `
mov ax, es ; ES:DI -> VxD API entry point
0 d0 R: Q; N3 a add ax, di
+ w+ |6 Q: h) S: u* w3 ?+ P: ~" V! [ test ax,ax
+ [1 p. H; s2 l! @; i1 c$ { jnz SoftICE_Detected, P# P* W, k# G; [2 c
# }; J$ u Y+ E2 Q
__________________________________________________________________________
2 m& g5 A9 Z* `3 q; e w7 k4 _* [: l+ Q! O% d( p/ ~
$ l: B2 q# |- N7 C1 yMethod 05 Y" ^6 R2 u( F2 W7 I* {1 o. z" b
=========
/ {% Y7 D) w' V# ]2 B
! k" h) q5 B0 @, c% d4 q9 uMethod seeking the 'magic number' 0F386h returned (in ax) by all system
$ [; W; b+ ?4 B2 O8 x* W! U9 | V2 _debugger. It calls the int 41h, function 4Fh.( r1 K* s k6 D7 c
There are several alternatives.
( ~; c( n$ z v& X" z" Y5 N3 U# }2 e/ }; o4 A
The following one is the simplest:+ g8 a# X1 ~- l% ? ]
$ h$ c6 @3 {/ Q7 ` z3 y( L' u( U. t2 [
mov ax,4fh
4 a0 z! E1 {+ r: @ int 41h
% _# W$ t( k2 m% t# P, M7 X cmp ax, 0F3867 ^% } L5 Y3 t `0 D! y
jz SoftICE_detected
0 M9 o2 ]0 @. r# V: G! u! A- }" J; k: F$ H7 o
; P: j0 h0 Y; ?; ]
Next method as well as the following one are 2 examples from Stone's " F4 Z0 c- s8 k& E# y: p
"stn-wid.zip" (www.cracking.net):
1 S$ W) n \5 p% D# u. R8 L/ _1 A- S' H
mov bx, cs H+ I4 e0 ^# B& q) u! [
lea dx, int41handler2* [0 B" m4 s3 G" k
xchg dx, es:[41h*4]
8 w o( { f+ t' L8 w; T& s xchg bx, es:[41h*4+2]
+ g4 l9 X# C4 f2 ^; X mov ax,4fh8 K9 J- y5 A" w s$ b7 J
int 41h
7 w+ S( b9 }) D7 c% _2 b1 I( n xchg dx, es:[41h*4]9 n- z( D! [: w$ V c% p
xchg bx, es:[41h*4+2]
! q' n6 {5 q, F. B$ C& _' g cmp ax, 0f386h
( N+ A3 r; s4 U jz SoftICE_detected- n: O- @5 S' L
8 y1 z' i4 p+ Uint41handler2 PROC
+ Y- H+ F$ u6 {2 f0 n N* g% a iret. I& [) ~% F; D' b) Z1 H
int41handler2 ENDP
; G8 R1 T3 w: a/ A$ m8 W& h; j4 ], Q* `- c
i6 l6 g( Y1 q+ g# F_________________________________________________________________________& Q. C% K" l! J% n2 C
8 b g* L# F3 V! i3 V
) {7 T/ h: R2 j# y# u- y) f& cMethod 06
0 S4 f9 O) a9 s=========) x7 c2 v0 R- ^
0 d7 A+ B) `9 ~ }/ _5 y' v# p- v
5 m; i$ r% J) y9 n
2nd method similar to the preceding one but more difficult to detect:# T4 D+ u/ N# ]2 s6 L! m4 L
! z0 k. W) R" {. s
6 \' q: S: V: T C5 o5 E5 K
int41handler PROC( }2 Z- s: d1 p: z0 G
mov cl,al
: Y1 F( Z1 e" @. S- e iret) h8 F; r* X2 S9 J
int41handler ENDP
, }( h u8 O: a( j5 M- A' G. s
* B, t8 w |4 @7 C- A5 ?1 i) A8 X0 Q+ j* T6 ?, I; w
xor ax,ax) [7 s7 x7 r0 P% Q& w
mov es,ax2 T0 B# I2 u# I1 Z* l- A
mov bx, cs
1 Y6 H( N0 I! `5 a, u lea dx, int41handler' A( S; T# Z1 s; M% I! G: Z. I5 [
xchg dx, es:[41h*4]8 @& g- y7 n/ C/ V$ L* T, N$ X
xchg bx, es:[41h*4+2]
2 Z% J0 O6 C3 F: t; f0 ^1 K. } in al, 40h( r E" l7 I' Q5 E$ j
xor cx,cx
- C) \+ E1 ^9 x% [" `3 c) } int 41h; C0 {2 E" H* O' ?4 z" s$ Y0 { _
xchg dx, es:[41h*4]! [, V- |" I! H2 k; \% j
xchg bx, es:[41h*4+2]
3 c7 @ O. U2 q9 \# g cmp cl,al
/ F) @, b; l; B" M( T+ }6 b jnz SoftICE_detected
0 w) A5 r. S$ H ?1 }+ _/ b" Q# k3 q6 f5 \
_________________________________________________________________________
\/ A- A: H$ w- H
9 v7 D" F; }- f. f6 VMethod 07( o: P. ~1 R9 T0 G
=========
. E! w8 k+ F1 d$ q( e' K
* O( j3 p, D" gMethod of detection of the WinICE handler in the int68h (V86)# @! C( q- R6 v: v
1 [/ B b( E2 d( j. m S, J' B" h: } mov ah,43h
# E8 i3 n S/ ~! W int 68h% d6 l: b" E8 W4 ^& C( P- h
cmp ax,0F386h
7 G$ G9 C' e& }3 ]5 w L4 s jz SoftICE_Detected
9 z! f Z2 h# m) Y% o. T1 s" u5 u5 Q, }! n- c
0 K/ h) }( {7 B2 o- i% D# J
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit) w( }* ` V2 t; g) R
app like this: n3 P9 z/ Q( I% Q1 Y5 H( X
& F/ _3 M( z& ^1 k BPX exec_int if ax==68
7 O! \2 ^4 W3 T+ M (function called is located at byte ptr [ebp+1Dh] and client eip is
. D M# a2 t3 H located at [ebp+48h] for 32Bit apps)
9 W/ S/ L M7 M) J__________________________________________________________________________9 k) J+ `: J& \2 F( _2 J
8 E0 [* J J5 ~% H. @
# N$ [* t5 `' o* [Method 08
2 S/ f1 Q- C; L$ Q! P=========: o w# K! r0 Z1 [
5 m: p o! k6 t4 _% l4 e7 dIt is not a method of detection of SoftICE but a possibility to crash the
2 I: z4 c0 w6 @' qsystem by intercepting int 01h and int 03h and redirecting them to another+ G* T- A1 B* S. I+ @
routine.+ l# O) v, m; w. T" ^
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points, l' \7 p! Y/ X' g
to the new routine to execute (hangs computer...)
0 c% `4 R% Z. f3 x+ v: {: |) O* g& s1 A
mov ah, 25h3 j% z* o- r- I3 C6 z! b
mov al, Int_Number (01h or 03h)
+ ~) w3 V1 Y/ w( O$ l$ F mov dx, offset New_Int_Routine
0 A6 d- u2 I- X7 x7 \4 y int 21h' c6 ]2 Z1 S* Q7 a4 A: [
, W& n+ s! G7 ? W4 c: }__________________________________________________________________________2 a( Z, q2 `3 q# H
$ n( `! v- G+ ^3 o% L& s- F! n
Method 09
/ b4 A( O1 R3 @" a3 E9 t=========
) g# e) p% K0 h: _0 F' \5 s) o4 O4 t8 b; {
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only9 C5 }1 w2 n5 v1 `! Y4 |; ~7 J5 D
performed in ring0 (VxD or a ring3 app using the VxdCall).1 o: z1 I6 g+ b1 z5 B* a
The Get_DDB service is used to determine whether or not a VxD is installed
4 t& h$ m2 |7 N7 `8 A4 _for the specified device and returns a Device Description Block (in ecx) for! ~1 Z* c2 q" @
that device if it is installed.
+ @& |4 K$ u* c) U7 G9 Q u$ I I/ _/ {
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
( k6 v/ |% M3 \8 c# ~ mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
. M0 \) o# N) l VMMCall Get_DDB
- V; G: U2 a+ t+ K mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
. t W/ `9 {0 ^4 {! k6 E' w6 ^. z; _/ U: O- n
Note as well that you can easily detect this method with SoftICE:2 q" F% L1 d9 N; q) d1 n
bpx Get_DDB if ax==0202 || ax==7a5fh
, o9 R; Z( E0 K- l" v
- J% d- A7 ?5 }/ c__________________________________________________________________________
8 P$ P0 m- S# c% s) G3 O# ]4 Y7 X0 V
( q' G0 E3 t7 dMethod 10
/ G+ R6 Z9 X7 ?; F& D+ q' B=========
% s. T7 {2 ^! B) E& D! s+ V. e# F* E! o
=>Disable or clear breakpoints before using this feature. DO NOT trace with4 N3 g$ Y, d% p
SoftICE while the option is enable!! x# `3 Z0 ^1 t5 a! [
" T, R: ]* z; s( \ r8 |
This trick is very efficient:
9 p; Z" s3 T; R5 [4 f) aby checking the Debug Registers, you can detect if SoftICE is loaded
8 F; h8 W+ ` L; x0 T(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
8 _8 g9 ]1 o/ k4 n& Z5 }there are some memory breakpoints set (dr0 to dr3) simply by reading their& O0 w( C, \! r2 i2 H: K# h
value (in ring0 only). Values can be manipulated and or changed as well$ N5 w6 v) }/ t$ W' F
(clearing BPMs for instance)8 v' T8 H9 n; ?7 x: ~6 e
5 S; g! Z8 l+ Q9 q6 K! e. [
__________________________________________________________________________, ~; ?/ w1 A, B% O! g0 b' Z
; q2 L- e# `; }1 Z, ]# t
Method 11
' v/ C# A8 t/ Y5 Y9 H& ^# ^=========! L; f$ C4 g% t
1 C4 m8 q9 K N; F* pThis method is most known as 'MeltICE' because it has been freely distributed! s6 k) u! O8 a9 h; l" F. R
via www.winfiles.com. However it was first used by NuMega people to allow
( g3 o3 c4 h( U& `% YSymbol Loader to check if SoftICE was active or not (the code is located
6 c9 U3 ^5 w! V" m0 e; p2 X: T7 hinside nmtrans.dll).
8 ?7 M1 g3 f3 A' M' {
. e* f! ~' ]1 }. }6 X; ^' c2 lThe way it works is very simple:
/ O# l# H9 u; W9 U" U) k# {* cIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for/ V$ \0 X& r1 ]& {( L" n
WinNT) with the CreateFileA API.
0 _/ W8 ~& ~- Q( [ _! ?0 y! J/ L4 d0 F8 Q/ O# M+ o
Here is a sample (checking for 'SICE'):$ G+ ]4 X& D0 ] I1 e+ w, Q- }
8 j# i# M- [6 g- ]3 v; ?5 PBOOL IsSoftIce95Loaded()
% ~" e4 u2 l3 d* a0 y$ [{
/ U6 z, f* Y& w* w. B HANDLE hFile; 1 D4 L- I) x5 ?6 ^- E X& M' D9 t8 d
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,8 I$ x& g. D- S- J7 X7 X8 P
FILE_SHARE_READ | FILE_SHARE_WRITE,! {7 ~1 M5 g3 i1 ~5 H k/ f( v6 U
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
( ~; v4 g3 ] i2 x, K1 E2 N if( hFile != INVALID_HANDLE_VALUE )
! H% `$ N1 W, s6 W" O1 ^ {, V6 s5 b4 L8 j& ~; q* P
CloseHandle(hFile);6 X* Z: Z! r8 P/ p6 @( ^( s
return TRUE;
^! k6 n% Z8 Q. b4 ^4 t }* [# V1 ~/ A8 G" A: L3 P' b
return FALSE;' g. b L! Z F/ b: [) r. o
}1 x! @7 E. W# {) y# S1 U3 ^
4 C# ?1 u$ Z' @
Although this trick calls the CreateFileA function, don't even expect to be, i/ Y0 D( [# K- G' A- V" z
able to intercept it by installing a IFS hook: it will not work, no way!
# J% H& y3 ]# |5 \- }1 b; F! QIn fact, after the call to CreateFileA it will get through VWIN32 0x001F, o! B1 a' R6 Y5 ?# g# \
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)0 l: `( a4 V0 @1 \$ a* T+ ]
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
7 g# I, H0 l% A ifield.& D6 J* y! h( R4 H% r3 J0 Q" G* B% `( P
In fact, its purpose is not to load/unload VxDs but only to send a
( k% O0 g4 h$ O) pW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)9 v1 ~, G1 W. V; u
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
; A# ~( F6 @& Kto load/unload a non-dynamically loadable driver such as SoftICE ;-).0 p @8 m1 R- h# t3 d/ G) v1 t8 m1 e7 a H
If the VxD is loaded, it will always clear eax and the Carry flag to allow
: `" f+ r9 p: G' `3 E; Wits handle to be opened and then, will be detected.5 T. f+ h0 \9 b7 `( E$ o- K
You can check that simply by hooking Winice.exe control proc entry point
1 r* m0 ^8 [' y9 L( b) x$ Lwhile running MeltICE.
+ s* X9 m! P) z: ~3 Y. ^- X# i6 @! g; M( I, I$ Z& H( {
c/ h; L H+ E* i) |
00401067: push 00402025 ; \\.\SICE
. {. {! H Z! {% S* _& {8 A/ ` 0040106C: call CreateFileA* V% q) I8 J8 F; l7 \8 i8 D
00401071: cmp eax,-001
, z1 Z# \* n) l 00401074: je 00401091
% B6 `/ X G6 m
3 O5 a/ \7 ~! A& }
6 j* G3 f& y; X5 e( k; QThere could be hundreds of BPX you could use to detect this trick.5 \+ l9 P2 G* H
-The most classical one is:
' ?- d4 K0 w" S$ U& h% U( W) F* G BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
& |& R; U' }+ v6 f8 i5 ]! v *(esp->4+4)=='NTIC'
, B* m% E( b5 q7 |6 f
; Z6 l- D; D* y' ^-The most exotic ones (could be very slooooow :-(& I5 O5 }* A) H. T* J. i
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
/ g, k& K c, S8 H) k; D6 T ;will break 3 times :-(( l* P/ G* G( R! k; j
$ P; `1 X# v& n" C$ J
-or (a bit) faster:
) T$ ^ [# _. H# ~! m- { BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
; [+ ?% y1 d$ f1 |" C
+ O% ]2 p- x$ d1 @' P& b. y' G BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
3 c8 L. R& g" q* e5 O6 N' V. q0 P ;will break 3 times :-(
) }) g8 d2 N( {! C+ V! `; t
( A0 {, D0 N+ H* C6 T" ^6 I4 Y% G-Much faster:
" G4 F, L) d. i( a7 s BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'5 ]3 u, u+ ~! @
, O, t$ [7 M" X \$ T
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen. H9 O$ i( z/ {
function to do the same job:
+ K9 c) y- l8 o; t0 z& s8 o2 O+ Q5 s! M# V- W" Q& |- n
push 00 ; OF_READ7 T, l. @6 m, s( ^% d) x) ?
mov eax,[00656634] ; '\\.\SICE',0
9 S W6 r0 L* v' }) D push eax0 b5 g* O5 o9 t' J
call KERNEL32!_lopen
) v) w* x, T) o$ Y" b# k; D inc eax
9 X$ P7 w1 v: L2 K' z jnz 00650589 ; detected
' A G: r6 D: F' M1 c push 00 ; OF_READ
$ g: H: } c+ u; Z* n3 a mov eax,[00656638] ; '\\.\SICE'
2 j# P( p" C" P" \. ` push eax" C4 ^7 ~ G$ j5 r5 |7 V
call KERNEL32!_lopen c5 S. e$ s0 s7 N; B: u# F+ F
inc eax
. u# N' Q7 F$ q( q( h+ q! M# K jz 006505ae ; not detected
8 }( S- I1 O, {& d5 N( v. a" P; W6 J, e9 b* x* d
) F _, ]& ^& D* \! k5 q__________________________________________________________________________
0 s' x' y/ b5 C; G6 r) t0 A3 P* o3 g
Method 12$ c# B) l* a H t7 G
=========
6 M+ d" ^; g L1 l6 K8 f- U5 F, p6 ~: X% U! g7 n5 G
This trick is similar to int41h/4fh Debugger installation check (code 052 T3 W5 c0 G! y- r4 ~, k, I, m
& 06) but very limited because it's only available for Win95/98 (not NT) U" y; [6 {, x
as it uses the VxDCall backdoor. This detection was found in Bleem Demo. M( R, y5 r* J8 {! z; v
- U' T+ t X- _8 h push 0000004fh ; function 4fh
o$ n( \- o0 [9 c, |0 ?) R push 002a002ah ; high word specifies which VxD (VWIN32)
. Q+ D0 J4 P+ t' j/ W ; low word specifies which service% m5 N3 b. e. `* O: d. x* }
(VWIN32_Int41Dispatch)+ s) _* a3 y l1 e/ ?: w" P. c
call Kernel32!ORD_001 ; VxdCall
1 t4 w: M: ?, X' x0 _ cmp ax, 0f386h ; magic number returned by system debuggers, F( K1 T6 R: ]! G0 y( Z
jz SoftICE_detected
* Z# I# [3 C( n3 Y+ w3 |0 I& d1 d4 w. c3 h# K0 O
Here again, several ways to detect it:
% [$ X# W* f, G
) I& {+ H# d6 `7 s BPINT 41 if ax==4f
" ]/ k9 e5 Z+ J( h( e$ V$ |6 ?
( Q4 R; C! d- m; ~' D# \ BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one) C y( S% A" Y
9 @ O7 _, @1 z9 z BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A/ p) r, m) G& M( j
5 t( c9 X' G; V& u- ~
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
( z/ P- r2 E1 N3 }0 i: y" }- t7 u) b. v0 l
__________________________________________________________________________
7 C* M0 ^# T9 M6 }, B7 P8 c7 ?+ A: u# z l
Method 134 F& {7 M: m V0 Q# {# H
=========$ d3 T9 @: N5 S* t" [2 r
1 F3 ~4 U- t% z. t
Not a real method of detection, but a good way to know if SoftICE is
- P T, Q5 @/ ^! }; n; c. O' Einstalled on a computer and to locate its installation directory.2 d. V& v3 @1 m6 _
It is used by few softs which access the following registry keys (usually #2) :) z4 J+ [) u# q- B& ]4 V7 E
( E( A7 P' A; g" {
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion( V% L6 L0 y, L! U
\Uninstall\SoftICE
" h6 y" C t3 o-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE. B& i3 x" V! z
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
" }; B8 I# P `* c\App Paths\Loader32.Exe* [% T* H$ e0 Q) S! ]
2 k3 {# a; _! ^& v4 g
: J9 c2 S$ D0 [7 KNote that some nasty apps could then erase all files from SoftICE directory
6 q" J. J f) ?5 R(I faced that once :-(
: Q ]7 U W, \& M. ]0 ?9 @* Z- O ]' `/ J2 W5 y; Y
Useful breakpoint to detect it:
) Z8 K7 f- l9 y4 w+ U, Y. N
0 ^. x! @# E: R2 d' K/ S) g BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'1 `1 g: ]4 ?! ~( Y! \# T8 I4 p
% C/ D" k$ D$ ^__________________________________________________________________________8 e# Z! a& s0 m, r; i. [8 @. Q
6 {* X/ U! Y F! z! n
) b5 u1 b/ b, V5 c! W: E) @" F; T+ aMethod 14 $ D. M) y# Z5 F h
=========
( U& l5 i% @) ~+ I- \! u6 X
8 V4 L& l" c+ P- s" y3 y# MA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose6 B L5 b) @+ O! K4 A4 o
is to determines whether a debugger is running on your system (ring0 only).0 k9 |9 y j1 M J% y
0 {# `, i) c% z/ k' m" \8 A; S, D
VMMCall Test_Debug_Installed! s( D' l; b: O) [ V7 _. c8 u2 N
je not_installed2 w4 V# w$ `& m9 u0 a! }& b/ [
7 n% o! F/ E1 k! k- M
This service just checks a flag.0 ~9 ?1 `8 m" @" F6 }
</PRE></TD></TR></TBODY></TABLE> |