<TABLE width=500>
7 A- }7 k. h4 M( e1 g) b' T. [<TBODY>
5 ? M9 o# t8 U<TR>
- k0 j# _- {# k) W2 Z<TD><PRE>Method 01 $ D* @ x, v/ U, F3 S
=========
4 K) }$ q% D* E8 W$ Y0 q' B+ H4 _) D* i* H( `! r
This method of detection of SoftICE (as well as the following one) is
( J7 R2 f0 e+ E+ D, ]used by the majority of packers/encryptors found on Internet., ~- L. y% j0 y' o4 s
It seeks the signature of BoundsChecker in SoftICE
% c& r' b8 C- R7 X4 r( P* Y7 P2 b+ t7 W5 o/ C# L% O
mov ebp, 04243484Bh ; 'BCHK'# N" ^, }' Q0 Z! d/ R4 O% M/ Q
mov ax, 04h
, Q4 B; J+ t6 G; i; \, K int 3 $ n& q* X# _& `7 Y8 y7 B* p
cmp al,4
3 A# K0 x4 T# c+ {0 @3 a, X6 F jnz SoftICE_Detected6 H% E3 q4 A0 H8 |& g* e$ M& D3 `* A
# ]1 A7 Y+ l$ T; m+ ~___________________________________________________________________________/ H! i0 W u. t/ J
( I- l" ]& L2 c" B, [/ z2 Z% w8 fMethod 02
8 r0 O x. t8 r _' Q=========' {4 }. M4 e H7 T% R
; i( p+ X% ]8 D1 F2 s2 Z- |Still a method very much used (perhaps the most frequent one). It is used
. p- f0 r1 S6 w2 l% `to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
' W( C* I$ j- H4 q! Xor execute SoftICE commands...
& s Y7 m3 q; X$ F" l1 E# hIt is also used to crash SoftICE and to force it to execute any commands2 s# ]& k8 A8 Q# o
(HBOOT...) :-((
: ~& \2 U. w" E
, P; @3 x, i* _6 f# }4 sHere is a quick description:5 }7 S" g: h, D3 |. V
-AX = 0910h (Display string in SIce windows)
( ]& B s {! Y4 v+ l! J-AX = 0911h (Execute SIce commands -command is displayed is ds:dx) ^5 ~3 n4 z9 {4 k4 K
-AX = 0912h (Get breakpoint infos)
. U Y6 b! Q! V* I' t+ M2 Q' b-AX = 0913h (Set Sice breakpoints) @9 o$ D- b* ?0 Q7 A: H6 ?
-AX = 0914h (Remove SIce breakoints)
. T; }+ W( G- K8 ]" J* G8 x
% g0 e' N- F: ]# t- L7 g* FEach time you'll meet this trick, you'll see:) V- \8 E6 {2 ?5 V
-SI = 4647h
# r! |# ~0 w" m; t-DI = 4A4Dh
( q6 `1 S6 {9 M! A! ?3 M4 H$ D8 }0 `Which are the 'magic values' used by SoftIce.: M' F9 ?) @' t( I/ |! D3 P
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
5 T3 d; d0 L+ W8 ^) Y4 F3 O4 h5 @" I% o* J9 s: a) t
Here is one example from the file "Haspinst.exe" which is the dongle HASP0 N8 f @: S# V) O1 e s; J1 Y" [
Envelope utility use to protect DOS applications:
1 x3 j2 ~9 k% r/ N
0 T0 Z2 d* I/ B# S( s4 W2 l$ n6 p5 H# W8 D, \
4C19:0095 MOV AX,0911 ; execute command., Z5 j" y( R# p
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).8 }0 ]; | `" H/ q9 W( C, O3 f
4C19:009A MOV SI,4647 ; 1st magic value.
& A/ W! o- e5 O# ?# `" h4C19:009D MOV DI,4A4D ; 2nd magic value.5 H5 s6 G2 q& m0 E
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
( R4 Z. ^4 D" n' I$ o4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute# @* m7 @" L1 W0 ^
4C19:00A4 INC CX
s' O* S/ P" u8 S3 |! J& F' I4C19:00A5 CMP CX,06 ; Repeat 6 times to execute" Z4 ~* {7 U3 I( ?3 [- r3 d! U
4C19:00A8 JB 0095 ; 6 different commands.
+ p0 s8 n" U3 d! c0 K6 }3 X0 h4C19:00AA JMP 0002 ; Bad_Guy jmp back.
$ h* S/ N$ R# ^) y7 I4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
: X, I. @% }) s1 r# \: P' K/ B7 s8 x1 a! c+ e' c0 f, h
The program will execute 6 different SIce commands located at ds:dx, which: `) U6 R+ v e
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.8 k( A- a i/ Z
( Y* n- m4 k1 m4 x g& A
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.2 c! W, |) t) m5 E w/ p; K- m1 u
___________________________________________________________________________; i$ N* @; I1 E
7 h1 _% a; |$ ]) X9 N2 \
# X, L- U j, p0 Y( a0 N
Method 03
7 X% [% Z" i4 M. ^& W) e8 O=========+ p' T- D/ m7 u8 ?/ l7 ? y
: t H1 g- g& x! ]
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
6 R5 l" `$ j2 S5 X8 e(API Get entry point)
0 P8 {) W1 o9 V8 V) R3 x( v. R7 V 3 t. J3 q: ~( c& ^% r% |4 j
- s# S" D! {& j
xor di,di. c( @- i: v f' \- i! a
mov es,di0 e" I) p$ d9 Z1 j4 }/ o: k
mov ax, 1684h ' Q& A: N. Z2 D& e1 N6 T! Y/ }
mov bx, 0202h ; VxD ID of winice
E* ^- J5 H# p: T6 H$ ~2 u int 2Fh
! Y+ ]$ t4 M8 n/ R) _ mov ax, es ; ES:DI -> VxD API entry point
7 [! @4 r/ t( X+ T3 u add ax, di9 q# c4 [8 d M& d
test ax,ax' J6 P- K% T8 j6 `
jnz SoftICE_Detected
% l0 m% X9 ?$ i
: A& W/ {! n6 |. }___________________________________________________________________________
3 x! Q8 U0 b0 b1 @( j7 o; _
9 M- P% i6 }! I; P* d: ?; `* kMethod 04
5 {1 \9 K5 Z% C6 \0 {3 ?; j3 a4 o7 b=========1 L2 ^( B# }' @5 S6 } a4 N' a
9 S: {- d$ t- H/ e# }' x [
Method identical to the preceding one except that it seeks the ID of SoftICE7 R0 B9 c$ t. k7 G# |+ L
GFX VxD. E# ~) Z3 _/ m7 K/ A7 x' ]# t
' Z- A0 B7 R2 y# O7 m3 [- k6 x
xor di,di
7 a: h, O: X" N' X8 L mov es,di
$ D8 K" e/ W6 q5 b mov ax, 1684h " j" ~! C) ^: W4 C- j" O
mov bx, 7a5Fh ; VxD ID of SIWVID
! v/ M. e/ G' l: \, R+ L, E5 d6 E int 2fh
9 S4 s7 i& _/ c) } mov ax, es ; ES:DI -> VxD API entry point
* b9 C) g I8 _1 }! z9 ^* U add ax, di
9 ?) q9 q8 v& I) {" v5 U+ w) O test ax,ax
% N R$ n- E8 O; E+ |4 K jnz SoftICE_Detected
) Q+ n- x- c7 A$ Z8 G( X
6 P+ e" f6 ]0 [) l8 [' }, h__________________________________________________________________________
1 H1 r- Z8 k/ I6 ?+ I" L* Y/ E" N5 S
: D3 r2 x8 V, O$ t: C1 Y$ w* j! K" U1 Q% |: t% i2 [8 V; R
Method 05
* R& O" Q; a1 J/ e=========
' Q. e/ Y3 _( g0 z6 p: u: b$ ?; g9 E# g) q& N/ q" [& s7 J
Method seeking the 'magic number' 0F386h returned (in ax) by all system
: t5 i0 F+ G1 @. {0 _- R+ C/ Vdebugger. It calls the int 41h, function 4Fh.! ], B6 [: w8 j: E( F
There are several alternatives. 7 P, d" ?: M) N+ R2 q7 l) z
4 L$ W$ u O' j& ^, Y+ ?The following one is the simplest:! \# g: C* d( [! b1 s) G1 E
+ p9 q& o2 O [/ k6 F mov ax,4fh p; ]1 N8 k; c1 P8 K4 y1 Y {7 r
int 41h
% v2 W/ G5 C3 h/ }- W# L# I2 y cmp ax, 0F386
& T X4 ?; e4 m- m5 n0 a$ L jz SoftICE_detected$ L8 R. B$ R X& M9 c& u
. A. Q3 w% S3 ?" M S
, B& l& ~* [* O t
Next method as well as the following one are 2 examples from Stone's : r; i+ S- h. e2 E( g5 |$ h& H& s: B
"stn-wid.zip" (www.cracking.net):
X, `3 v' q5 o5 L" w/ Q+ w
3 Y. w* P! }: n/ Y! s" Z4 I k mov bx, cs
; C7 q& B& A0 @- L lea dx, int41handler2
1 M& b" M8 @8 `3 ?' S# r F/ I xchg dx, es:[41h*4]
, u( Y3 V o6 H# `$ e xchg bx, es:[41h*4+2] Z* Z3 K. A, g
mov ax,4fh
# h# d# j% o2 x1 V( ] int 41h$ X% D8 q) ~2 A2 d8 q) }
xchg dx, es:[41h*4]
8 r# X) D2 W; u/ O4 R; w xchg bx, es:[41h*4+2]
7 o6 \ Y, M2 L: m& R& `8 j2 n; O cmp ax, 0f386h
8 [: V7 ~# [. E7 Y( J5 {7 | jz SoftICE_detected$ P6 @# a# q9 s- g
8 m: ?6 s% w( s* w
int41handler2 PROC
/ V8 f7 P8 I% Y iret5 I0 U0 |& E) ]+ y) P/ ~* G9 h5 Q
int41handler2 ENDP8 @5 U( t0 L' ?5 o$ I
) n1 d7 r* ?4 M2 Y6 d
: F) s# Z( m L) a
_________________________________________________________________________3 f$ ~# y/ ]3 n8 Y
( }% m8 c7 Z9 H- b$ N+ \! |4 P8 |- ~2 C5 N5 S
Method 062 Q2 Z. ^: M6 y" T2 \. d; N8 b
=========
3 d, b# h G V/ e
, D% [( j* Z2 V6 W0 i
, O1 n8 q5 V. p! u$ o3 V2nd method similar to the preceding one but more difficult to detect:% f9 Z& g; D: _: }
. Z- _9 G! q' W
0 ? V6 D. A) P7 V
int41handler PROC8 @3 U) t+ \9 e3 M# ~
mov cl,al
) @" }7 z! T; I; q Z7 B: \: D. i iret
( M, J" I6 @, T E; Dint41handler ENDP
H7 Y6 M1 \- p; y8 u/ @' m% _6 i9 {: }3 a6 ? K
7 Y1 s9 J/ S1 ?1 i xor ax,ax
" I6 v$ y" X" j- y. E+ R4 |# n mov es,ax
4 N1 j$ p, v5 v# _/ M6 j mov bx, cs% ~! C+ J5 t- N. q
lea dx, int41handler
; G# J8 e- S8 T: \' w9 _ xchg dx, es:[41h*4]8 Q& {0 v4 |. |
xchg bx, es:[41h*4+2]
0 R' m0 V. z3 | in al, 40h
( [9 H3 v9 @7 n/ g' S+ J xor cx,cx
4 c) o$ r6 U v- A* @ int 41h
7 ? B0 m- ~0 }7 R6 S xchg dx, es:[41h*4]7 @" O# j9 d* y3 y1 I x
xchg bx, es:[41h*4+2]9 J v+ C F) f8 \# ?! K
cmp cl,al
3 B. u X4 ~* w! v1 }4 H0 ^5 p+ U jnz SoftICE_detected
# U/ g8 E( x& S" \& {* b: ?
7 {+ D( M( m. h' V. I2 l. v_________________________________________________________________________
8 N0 p) `7 f k8 G) |+ i* E- H- f6 V4 ~: R4 q$ j5 J Y
Method 07( A/ b6 l* {3 N0 b) C8 n
=========
5 U1 k) Y# [" x( k" S/ N' U7 y9 J0 h% C+ R: a5 p& u& y. u
Method of detection of the WinICE handler in the int68h (V86)- ~2 ]7 n2 y) l" B# c, p+ k4 u% U
, [8 k% Q Y& Z$ t7 i5 y9 q mov ah,43h1 L& L! `+ k( o
int 68h2 Z$ v0 P( c* L: G* S
cmp ax,0F386h
/ H# U5 w# e0 }! f( e jz SoftICE_Detected
# ? C6 p+ \) p0 e4 E+ J# P8 Q% y4 @3 y
6 b( G6 @- q4 s=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit0 p. B( X9 T& E; D1 d4 O$ y) h5 ?
app like this:; }5 w, w, K" m
E5 [. W- J; S _
BPX exec_int if ax==68
" p9 Y. W r. T (function called is located at byte ptr [ebp+1Dh] and client eip is
& a9 q* p& m3 a7 h" w+ o. T- r located at [ebp+48h] for 32Bit apps)
8 Z. ~5 T1 V( B( R# o__________________________________________________________________________
" f( L2 F! S6 o9 g9 t
: ?/ P$ c) N5 Y& _2 Y' m6 s9 u0 `" j" _4 p9 Z; G
Method 08+ w; e0 i. A5 _
=========+ O3 K! M0 N1 S& ~
6 ~- S0 l) z6 o; K7 D/ H, I; Q
It is not a method of detection of SoftICE but a possibility to crash the
# `8 f! F2 c8 F! G. tsystem by intercepting int 01h and int 03h and redirecting them to another. [1 F, V: F- ?) O
routine.
+ X8 b8 O t& G, i! F, z* @4 \It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points' j8 C! c. @% t! C
to the new routine to execute (hangs computer...)9 v) d7 }" M8 e( n3 {6 N7 x
7 |- M" d9 r" U6 g2 Z
mov ah, 25h& x5 @. z) j9 ` o
mov al, Int_Number (01h or 03h)
" x, s. a7 x3 P, T mov dx, offset New_Int_Routine! K9 l' R, Y2 v, @. [
int 21h
7 A+ s# w2 {9 c
- v( U! E9 n+ \__________________________________________________________________________* e0 n8 V$ Y; h v: ?
7 Z S9 Y+ k: D# c0 P9 q& V
Method 09( l4 T- n, I3 B5 G p3 \4 o
=========
' \/ c2 @' o5 }6 |
* k; f4 A2 Y/ {5 D, mThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only; C8 \. p2 z4 n! `4 y" c
performed in ring0 (VxD or a ring3 app using the VxdCall).8 a$ k5 t) g/ z" k1 W2 G# `+ c
The Get_DDB service is used to determine whether or not a VxD is installed y/ J/ X' U( z) ~ \: V1 X. h' e
for the specified device and returns a Device Description Block (in ecx) for+ [( a' Q$ N9 X: w' T0 x
that device if it is installed.
9 l: B- @+ b9 G+ v" {9 Z3 C) J, z9 V j, g; q. L9 I0 g9 x
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
& |3 e% Q* q& k mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)7 M0 t1 d7 y( {# N& M
VMMCall Get_DDB
& o, |8 Y; {0 `7 o mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed3 L! g1 L- m `) t- D) G& a
( ]8 c7 J. y& i0 o$ GNote as well that you can easily detect this method with SoftICE:
, \- _* n8 ^& s/ |) X) ~) B5 F bpx Get_DDB if ax==0202 || ax==7a5fh
) ~0 s1 b' H4 T0 ]) }6 U0 q: q/ G3 F6 s
__________________________________________________________________________# x; N- K0 q5 Z8 w% w
: }, u/ J+ G; EMethod 10
- i, e2 Y# n$ L1 G=========' T- @. V' ?8 m" W0 c# M) ~
) a8 d6 f' m# z3 d8 v) ^6 x
=>Disable or clear breakpoints before using this feature. DO NOT trace with8 I8 a1 ?. X- p+ d2 c M
SoftICE while the option is enable!!2 f' P! q% L$ J$ e
% k) B7 s8 _) \! T% h8 Y
This trick is very efficient:. A5 M7 a9 `8 B7 y+ T
by checking the Debug Registers, you can detect if SoftICE is loaded
1 a7 _) J/ Q* a8 M7 ]4 K7 o4 ^(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if7 S3 W) t$ _" F K {+ w
there are some memory breakpoints set (dr0 to dr3) simply by reading their
5 Y& J, a8 E! jvalue (in ring0 only). Values can be manipulated and or changed as well
; Z. _) g/ O! W5 \( B/ d8 J" H(clearing BPMs for instance)+ `4 L" F3 p( q: x
7 a' F9 a4 Q3 [! ]4 {4 v__________________________________________________________________________
7 m6 \1 Q! j, A+ l8 R4 m* t- Q
4 b6 g% ^, {- W" I* ]. KMethod 11; J* C8 ~: D- H& {
=========2 y8 F x k5 E; [
# \; {. A) s+ v5 s/ u0 F( v, N7 ZThis method is most known as 'MeltICE' because it has been freely distributed0 U: U/ [/ R" O) N! r, g
via www.winfiles.com. However it was first used by NuMega people to allow
, q* r0 G1 Y+ k) j" g# t# ^3 vSymbol Loader to check if SoftICE was active or not (the code is located
( U- K7 ^: F# F& z8 ?inside nmtrans.dll).
/ A; z- i% t& h+ H' u$ q
3 o4 T5 n" V/ u, |, E. t7 ?" T* MThe way it works is very simple:
3 M8 O; c5 P. t, E6 o8 z, w: HIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for- L2 a* ~, l3 R4 u2 D
WinNT) with the CreateFileA API.
5 c1 i6 |; N6 w( G# C3 E, Q2 B, u* a L+ p3 P- P' a
Here is a sample (checking for 'SICE'):; S% m5 h* X7 g
5 g! X3 p, {/ r( l
BOOL IsSoftIce95Loaded()' W5 f) o Z5 e7 {
{- o7 E; f. R, S2 A5 p6 ?% f8 p
HANDLE hFile;
5 t2 S& a4 g3 e0 H( c, y" z7 P! T. [ hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,; s7 N3 v5 P$ \! C
FILE_SHARE_READ | FILE_SHARE_WRITE,
+ T2 ~( S" r# v NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);8 ?; k% H7 a: ?$ @2 {+ X: Q3 O
if( hFile != INVALID_HANDLE_VALUE )
) `, `; x" M: A) v8 m/ _7 _1 L \ {2 ^& k& z; P/ m9 S9 A6 y0 D2 d
CloseHandle(hFile);$ D) h f' X& T$ R
return TRUE;$ }0 }5 ]9 x$ ]0 _* N: t
}
# |+ P% x% l/ i. Z& u' \. z2 d return FALSE;
, ~9 U, e/ F% N/ N1 r}
. \0 B! g* v( N! c' o
5 R; I" O3 t. W3 dAlthough this trick calls the CreateFileA function, don't even expect to be6 [- i: ^" l( g- J% Z
able to intercept it by installing a IFS hook: it will not work, no way!
8 K( m* p8 t# e* C' O7 S4 C/ l1 uIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
& u/ |) E' \1 F* |& Mservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)7 |. @8 _9 t, a. {! {* e; _
and then browse the DDB list until it find the VxD and its DDB_Control_Proc1 O: e4 u/ H+ a
field.
. O. Y" r+ j; f6 _& e, ]: IIn fact, its purpose is not to load/unload VxDs but only to send a ( n% V- z2 l% e2 c0 ^* y
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
+ p' V7 K' y/ {- C r9 j! _5 Wto the VxD Control_Dispatch proc (how the hell a shareware soft could try q6 q- N$ n* C4 m
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
2 k$ z% ^0 S- F3 b! gIf the VxD is loaded, it will always clear eax and the Carry flag to allow d' d" G& y- Z6 T/ T) q
its handle to be opened and then, will be detected.
# }; r. t: j* X6 `' O4 F% r& ]9 {You can check that simply by hooking Winice.exe control proc entry point% t! ?$ }* c0 e
while running MeltICE.
- @& |- W5 f# H& w! a* v
/ t' }5 ]0 N/ A% ~4 n) K' }% \, z7 K5 q0 j. A+ ^& R( p0 o( y
00401067: push 00402025 ; \\.\SICE
: j* c0 G9 E, D" L 0040106C: call CreateFileA L1 ~- k" B7 `# D
00401071: cmp eax,-0015 U% @5 R$ I R+ g7 X, V' V7 [6 `1 d
00401074: je 00401091
7 K2 @" I: q8 A( e' d
' a) P! E% {# s0 Y0 T5 d9 G: {: M, m
There could be hundreds of BPX you could use to detect this trick.
+ U0 }& k. i n1 A+ E-The most classical one is:) k ~# z* g% C$ k
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||, j; u! U1 G5 z& O8 ~
*(esp->4+4)=='NTIC'
& C/ C( b8 X2 ~. i9 H, B* _; I% |# c* B
-The most exotic ones (could be very slooooow :-(& {7 F5 y Q; {# T
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') 6 I# Y8 s( ]7 V
;will break 3 times :-(+ T; z s9 W8 Z
" @' b: c8 i. K+ \% G3 [# ]( n
-or (a bit) faster:
' T: f6 f+ R& [7 ^# _: J6 e BPINT 30 if (*edi=='SICE' || *edi=='SIWV')9 I+ M6 t5 d( q: E+ s
3 ]9 J5 \* g7 j, n" p4 E1 N BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' ; p3 q" a/ n( ^4 e2 m
;will break 3 times :-(
( [# V7 Y) _/ @. `4 R: l7 W
% ?1 s1 b% s0 R. C; @-Much faster:
1 A2 o# A9 R6 c N3 \ BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
" `! o: k9 ~: ~. `6 v: Z5 {3 T! ^/ w$ u y0 }
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
$ f r6 h3 y2 L u$ h" Xfunction to do the same job:
6 U2 z) [; t& S. h
/ L& ^+ X- a: _8 P2 i push 00 ; OF_READ
0 W0 }; C0 P/ e mov eax,[00656634] ; '\\.\SICE',0; q5 Q0 \* g, o
push eax) ?' r( d% G1 s0 Z2 F
call KERNEL32!_lopen
3 [7 Z7 J$ `' Z3 H8 H! A9 p inc eax
$ K2 a) f( x) w, e. r) I" x jnz 00650589 ; detected
+ ^/ ~6 L' ?% ?! n+ h push 00 ; OF_READ. I% J+ B: P7 M% R
mov eax,[00656638] ; '\\.\SICE'
. M& w( @3 i& E0 H push eax
, ? n' y% G' S9 d4 A$ {7 T call KERNEL32!_lopen
" K/ s F# Z( A6 t& A0 S. W9 i inc eax
. `0 Y5 z! b5 O2 _. Q" N- t jz 006505ae ; not detected. }% H) y R* ~+ U2 X( z
7 y0 a* S- p' n8 ]4 Z$ L3 _4 G1 G' M# H- B: n
__________________________________________________________________________, T) B" ]" o! G2 @- x" i0 Z* ~4 C
5 j, W# q$ u7 Y
Method 121 n, f% }( R4 L3 j% \$ B2 R
=========
2 @8 r/ g" r% h# u) V* U- F
6 w3 @, x+ k6 |( u/ }2 }2 h( AThis trick is similar to int41h/4fh Debugger installation check (code 051 f' K9 ~: ~! n3 u0 T) b$ R+ A2 Y) S
& 06) but very limited because it's only available for Win95/98 (not NT)
# y/ I# K* {9 ~2 O4 j7 X, zas it uses the VxDCall backdoor. This detection was found in Bleem Demo.
1 J/ k' q$ a. a" m/ W3 \! y6 Y" j7 m
push 0000004fh ; function 4fh. j& U6 [5 \: Y. n
push 002a002ah ; high word specifies which VxD (VWIN32)& D7 x1 w/ t6 V( T5 _! }( k3 v
; low word specifies which service
3 M$ W7 F2 g4 ], B q4 } (VWIN32_Int41Dispatch)5 B- R! X0 \: @ o8 R9 ^
call Kernel32!ORD_001 ; VxdCall8 i* I; a! t9 T& k# F
cmp ax, 0f386h ; magic number returned by system debuggers, O" T x/ W$ v
jz SoftICE_detected
" w: e' z& @) i# `! ^. j
; S6 _6 G4 G; [* X* UHere again, several ways to detect it:
' h' M9 j0 k, k0 ^6 m; U$ j0 L$ a* ?9 S
BPINT 41 if ax==4f- {0 R6 {' `9 N# t* p5 h3 o
" W8 W, Q% s. u' j* H! `
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one( j1 [/ M F3 ~! {" O6 d& e
- o5 ~! G. s4 `* a3 p$ E
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
$ M+ ~1 ^- l+ L! d- a% c
1 O. a: b2 [5 P. w BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
4 s9 A6 N G! i, t. ]2 j+ ~8 O5 E6 F4 x
__________________________________________________________________________9 P# ]! B" K. o' s
& h& N! F- Q& M1 q9 VMethod 13
. r) n- u' ~) [$ T8 ^2 Q+ n=========& G/ I( E7 w+ q6 k
4 J' N# d/ Q: Q* g1 b: ^
Not a real method of detection, but a good way to know if SoftICE is! `# G0 x' F* `- h# O
installed on a computer and to locate its installation directory.% [; g' k1 v. ]: [7 J. k, y- ?$ o
It is used by few softs which access the following registry keys (usually #2) :: w7 p4 Q5 a4 [& S
9 Z9 S" E5 @+ e! F# F" {
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion2 O& `* \' R0 P# [; s- Z- Q1 T3 |
\Uninstall\SoftICE
% u# P( U; b, U; [. k0 y' V& Q-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
5 E7 E0 w3 x7 V( t/ t-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
; c7 v2 ?: k3 f# E9 ]8 i: V\App Paths\Loader32.Exe! i- S! t# _' c: q3 d
" D4 ]6 t+ G/ p
; N: [& ]* s: N ]& u. VNote that some nasty apps could then erase all files from SoftICE directory+ x5 ]$ z5 k+ ]) ^5 @7 c! x5 z
(I faced that once :-(
# j" H9 F- ]4 f4 U; c, G! }. ` h3 f6 }, d5 B+ N
Useful breakpoint to detect it:9 u* G9 ~% s# h7 S* d
# I, @1 q' N7 c& w BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
# m6 L, |1 | C* c: z
2 |4 i4 m+ L( y7 S7 o9 |9 M) m__________________________________________________________________________
7 L0 x8 s0 V! y- g" s3 I7 T
2 p+ t1 G1 P. ~
; q, l" C9 S! d3 lMethod 14 7 l, M" ?4 \3 `6 M
=========
7 w9 s5 B8 p4 ~) ]# K/ ]$ p2 P6 O! ^3 R3 S, X [6 D; o- s0 |" ~" Q
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
) ?3 ~4 F9 }0 T& n! tis to determines whether a debugger is running on your system (ring0 only).
5 j, v% Y5 K+ X$ Q' {4 y5 i( A$ B& Y( X. o
VMMCall Test_Debug_Installed( B' J+ q- R/ [7 d! @4 k
je not_installed! \( E7 O: S* ^' o1 [- ~7 N1 j
& t! @4 R1 G' YThis service just checks a flag.7 m0 T5 X/ Z& p5 `
</PRE></TD></TR></TBODY></TABLE> |