<TABLE width=500>" W ~& e: H. [% ?& I5 F/ |% ]
<TBODY>
; S( r: v: S8 c2 t0 j<TR>
* [$ f7 f- Y, v( ?' i. L; I<TD><PRE>Method 01
1 q! x" {$ d P) k4 T. S& N5 Z/ |=========; _2 f: z+ x- ?
3 [6 e T# A- W# VThis method of detection of SoftICE (as well as the following one) is b$ Q5 D: O0 R! }, G7 o
used by the majority of packers/encryptors found on Internet.
6 F. l8 K$ Q4 w {. E" S( }. XIt seeks the signature of BoundsChecker in SoftICE
/ |, |( w7 T& A: P- V, z0 g+ Z, N. R2 { K/ p
mov ebp, 04243484Bh ; 'BCHK'
5 Y/ C4 N8 a1 W/ E6 Q mov ax, 04h
2 F2 z' @1 U4 t/ T% ?/ a0 ` int 3
2 c0 D+ h3 H/ j, ]8 p; G cmp al,4( K2 I; S- q! o- ?0 |1 w5 d2 \
jnz SoftICE_Detected4 K3 C, `2 _. I4 s9 M) }: P2 w
3 N# }& j8 v" i. P8 x* s; }
___________________________________________________________________________
/ ~# a+ M! t% S0 I; C7 U$ Z) i( C {# U2 A) d# Y' a: E+ W2 z: Q5 t
Method 02
: c% V+ u% G& ~& l# N5 Z=========' m3 P, m8 |2 G D
- E4 {4 P2 ~) N& h/ Y( U
Still a method very much used (perhaps the most frequent one). It is used6 `" T* K9 e1 s; ?: d2 X1 Z6 C T
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,& N$ x2 S( y0 h" a' N
or execute SoftICE commands...* p4 ^* \. F& J
It is also used to crash SoftICE and to force it to execute any commands
" S, Q& q% V# j0 J' J- ?# r(HBOOT...) :-(( 4 m8 @3 V4 Z+ _# M
, e% g+ q: M# c! c' K+ T$ iHere is a quick description:
" g7 o9 Q$ q& d; B-AX = 0910h (Display string in SIce windows)
/ P% p: T Q7 z" @( i-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)! b) c) ~" N. _/ o, V& `
-AX = 0912h (Get breakpoint infos)+ L' U. u2 d0 `3 I; s
-AX = 0913h (Set Sice breakpoints)
8 s9 X; b) Q l1 ], I* J-AX = 0914h (Remove SIce breakoints)
0 P x# A r2 l6 t) C5 N2 ?: p7 b5 \6 s
( ~( E4 h4 w2 I1 |' m$ kEach time you'll meet this trick, you'll see:
p& Y9 f V6 h' v% t-SI = 4647h
% O/ F2 r _4 m; h" q- P- D. Z-DI = 4A4Dh
& @( N) p; T0 i& yWhich are the 'magic values' used by SoftIce.& m+ G" p" w) Y* R f0 P/ x/ \
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
2 t c3 M/ F( F: ~5 ?7 }& z: [* a+ \" ~+ {( H' u1 h
Here is one example from the file "Haspinst.exe" which is the dongle HASP! W& J! P7 D4 z( X7 Q, y9 W
Envelope utility use to protect DOS applications:5 w/ Q K; F- O ?
/ E8 p6 w+ J- _' L1 {/ k
# E9 s! B6 g5 Q6 q( J4C19:0095 MOV AX,0911 ; execute command.) i& F+ p' M2 g! g7 L
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
) ?' x; U. P. l6 Z2 ?4C19:009A MOV SI,4647 ; 1st magic value.( g7 R/ E6 q: ~0 S
4C19:009D MOV DI,4A4D ; 2nd magic value./ K! u& g. \4 H6 r
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)" T8 |7 s$ M$ l% G& ?( t
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute2 ~& _& p' Q3 ?, I5 ?/ y3 y+ S/ a; a
4C19:00A4 INC CX
6 H3 N0 f2 y& I+ B* ?4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
+ A+ x! T- Q) g- w4C19:00A8 JB 0095 ; 6 different commands.
7 m1 G" w8 p: Q. K# R- T) g. _; I4C19:00AA JMP 0002 ; Bad_Guy jmp back.1 f( _0 ^1 S; l5 `
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)) ?( o* x, t) w: u# A; Q
8 X4 ] w$ n1 C; m0 {5 U& RThe program will execute 6 different SIce commands located at ds:dx, which
9 Q4 |" L# Q" ~0 M" V8 W8 xare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.7 G# H' o6 U7 |
4 M+ X. @& o2 P6 N( J! b0 m' i* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
- [4 q' P7 o) F; f) N' p1 [___________________________________________________________________________
/ y$ Y; I; T9 y6 [" k8 z( r9 ?# ]% q1 R
5 b" V1 a# l* [# |& V7 d* B- Y
Method 03( Q& J. J4 z0 V- J3 P# b; A
=========. |/ [1 U$ f2 g2 y6 x
1 i% z( }$ E9 X u
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
^, ~7 Q, U& o(API Get entry point)
( |8 S, y2 U7 S- {# u3 b0 C
& { W B, R/ F! J8 U9 W4 B# n2 v6 L0 S2 H0 G: t* l: o+ `
xor di,di" [- g# a3 u' M) w& e" r1 b
mov es,di
! a2 U4 j3 z: c) S# k8 J' A" v mov ax, 1684h / k A1 `) Z9 Q' X% z( L* E
mov bx, 0202h ; VxD ID of winice
% ^! K+ k' r1 f1 H2 V4 S# C int 2Fh
?; ]4 m; @, r# s% h- B mov ax, es ; ES:DI -> VxD API entry point
2 z8 {8 V( u. H8 O' j( u6 F add ax, di; U6 P- n' E6 z7 M$ a" S( p( ?9 w, q
test ax,ax
" v$ s/ `* v+ m. x. Z4 a3 i' Y jnz SoftICE_Detected% W' N$ i b5 M U8 P8 z, u
2 [" H: w5 }- E
___________________________________________________________________________/ }: d0 B' t% w+ _
5 N& k D) S6 d
Method 04
+ ]1 U8 z9 |5 i& m=========; |, @( l) D) [ ]/ \
. j( \4 w* m2 i! V$ e
Method identical to the preceding one except that it seeks the ID of SoftICE h% W* g1 H5 E7 K# }
GFX VxD.
6 T5 J8 `+ `/ _3 \- Q
2 q# ~3 m, C, z1 l% A; j xor di,di# m" L" z* X& I% t7 q9 e1 E6 f# r
mov es,di
/ x& S+ T9 R7 l mov ax, 1684h
/ A" k5 U9 G2 r% E7 k mov bx, 7a5Fh ; VxD ID of SIWVID: U# o6 g7 N7 l" u3 W
int 2fh
, |1 W6 g$ ]6 W1 Q$ ]: M mov ax, es ; ES:DI -> VxD API entry point
9 @% C- p4 q0 F7 L( d+ K! } add ax, di
/ A& `2 Y) v( @; Q; ~. i$ } test ax,ax" }0 E, P6 m1 e7 P3 F; c+ M2 j0 M/ c
jnz SoftICE_Detected
% v+ v6 ^; K# q& [( V7 K1 |
' {( ?+ A) b+ W: \7 [/ v2 N: U__________________________________________________________________________
{3 Y1 M' i, L6 K, ?/ R) `2 K. c' M4 n
$ i. H \5 K; o% p6 ]: p8 zMethod 05* Z$ d8 H! X7 k3 J8 P
=========
4 |1 w% g. f8 \* |# B$ J, R% }# H4 E( E' n2 r- }0 y' a8 g
Method seeking the 'magic number' 0F386h returned (in ax) by all system
8 y0 S+ f, b) d9 [/ z7 mdebugger. It calls the int 41h, function 4Fh.
* F! }/ ` o7 @( W3 d2 |4 ZThere are several alternatives.
9 _" U* X0 S2 Z* O
% ?' S% ~. `3 g% eThe following one is the simplest:5 C& g6 J$ t# [, l
5 Q2 i6 K# D7 y( Q: [ mov ax,4fh
4 E. }" d& a+ [# k/ C* x int 41h
* F; K1 p0 a! _, X- W cmp ax, 0F386" W( H# l$ j: |( V+ h9 h
jz SoftICE_detected
& H9 p. J$ E: C' m% {
# b3 s$ _; H" m& r0 x1 w5 T2 \# z1 W5 K( |
Next method as well as the following one are 2 examples from Stone's # R2 D1 ~5 J0 B2 u5 y( f
"stn-wid.zip" (www.cracking.net): e7 |, s1 J( i0 m( }
' t- K; j5 k9 c H2 h
mov bx, cs- X* t" e2 |$ C! _3 y+ I
lea dx, int41handler2
7 M! W5 h1 {- Q* W xchg dx, es:[41h*4]- @' v; m6 T) C
xchg bx, es:[41h*4+2]6 Y/ }0 U, i' z% }
mov ax,4fh* n# I1 v/ Y2 N# t) b
int 41h
* q) P! s; v) _7 x% F xchg dx, es:[41h*4]
, g# j3 _% w$ }/ [" P xchg bx, es:[41h*4+2]
9 X% d/ N8 I9 J cmp ax, 0f386h. h: w: o9 B9 L1 _
jz SoftICE_detected4 h2 a+ r. P2 y3 z
/ ]! H7 C8 O4 P5 ]7 m
int41handler2 PROC: S* E$ v O- V* s
iret' r4 Z9 C2 @* @- E" |( p
int41handler2 ENDP& s) h0 O( X" x/ }. G$ ~
( r8 H8 S% B! _* W& A5 `
9 G# x0 f$ t$ T/ U_________________________________________________________________________1 I. P8 B( f& {( o1 h6 d
& j! X- z. c3 I) |. t! k1 Z" r2 z% y) j) N& v2 k; V' R2 |8 r
Method 06
5 V1 h: |/ a) j! T+ E=========4 E* C# z* N9 z% _2 q4 B7 \/ a! S
; F5 G; e/ @4 S* d5 `
$ f" w2 j3 _2 m( m2nd method similar to the preceding one but more difficult to detect:: p+ r y9 L8 a1 h* |% A
7 h9 r- z- L: R2 }& w; o8 v0 w- M( w9 O' h( q: \2 A3 z
int41handler PROC
t3 f2 G2 L! S* X mov cl,al
# Z2 A4 K7 E* a) O* F0 b2 _ iret. W2 U2 x: M8 e: C$ @! T! y5 J& j- F
int41handler ENDP
' `4 j+ s, ?, r3 C1 a
5 ]$ X# S& i6 \6 K8 Z, p- I
4 B8 x) r& J9 x9 B8 c8 ^ xor ax,ax
) {" [; B3 v+ a( s0 }6 \8 X mov es,ax# L: e: B' a2 k$ ?5 u- }! \
mov bx, cs+ t2 x0 B |/ |
lea dx, int41handler$ v6 u* E0 \. ^0 K
xchg dx, es:[41h*4]# m7 L- q3 X/ B; _: O0 C2 I
xchg bx, es:[41h*4+2]4 x1 i% s: Z! B! Z9 s
in al, 40h- m/ U" Y/ Q2 n0 O0 b3 T
xor cx,cx
: d' Y7 W; Z# g$ y1 t% E int 41h
: _+ o/ ?7 I6 V+ L3 q( L3 u xchg dx, es:[41h*4]
* ~# d# x7 L( n4 T3 K xchg bx, es:[41h*4+2]
8 o; y3 c7 z# w: R cmp cl,al" H1 a# q& m S0 z' {& ]8 t
jnz SoftICE_detected
( e: |" D) k9 B$ \ `+ n& {5 G8 q! `/ ^5 e$ ~. H
_________________________________________________________________________- E% }4 g; o% f* [, \5 L
" c8 J$ q \# x' h
Method 07
: ~* q4 l9 M( X0 A8 t=========
3 w$ V$ M/ L/ h8 w, x/ N. p2 C$ O& }- T% n& f
Method of detection of the WinICE handler in the int68h (V86)
/ D6 A) \: {; s0 s: `" S9 P
/ ?" F$ l) o( | mov ah,43h
7 @( E* |. ^/ D int 68h
0 |' l% e" c* a cmp ax,0F386h
- m& X: S o6 B8 j/ a8 ~: j jz SoftICE_Detected6 }1 l; [, c1 P; o
; J1 ?/ L8 J8 i
9 `0 h' j2 L! l& V=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit1 T( m4 f' z# [
app like this:/ A1 w' h! Z) {
1 X5 @2 ] m7 d, e* m% H) y
BPX exec_int if ax==68
0 V9 a, |# M9 ^' C [) L: k6 f* m (function called is located at byte ptr [ebp+1Dh] and client eip is; a& C: q+ M l P
located at [ebp+48h] for 32Bit apps)
6 J. a2 M) o, z" ?, {2 S( G7 w__________________________________________________________________________1 _8 d; |) a" X6 d9 c: Y- Y f6 m
9 c3 _1 S2 w# y1 E5 z+ Z
$ B* b& j; N3 T v+ ]# ?Method 08+ v; V# ]9 K/ B. |' S2 \' I, l2 z
=========
) ^0 o0 s" g( J ^( Y/ T
- l: {& b7 ?; T4 qIt is not a method of detection of SoftICE but a possibility to crash the
; g% `/ C B9 o8 `2 q' ~* D' Qsystem by intercepting int 01h and int 03h and redirecting them to another: L# h9 N( ]( G: I
routine.
! K+ m& F) R. PIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points+ v% j, g/ I. y1 x7 `' m
to the new routine to execute (hangs computer...)
& s/ ]6 y2 u# h: i C. { t! a
5 E0 M6 T9 `/ ^: N# o2 x( k* C mov ah, 25h
@1 t8 c8 F' B) ]; P* Z8 O9 R mov al, Int_Number (01h or 03h)$ O- P% Y% }1 z" u( X' U5 A
mov dx, offset New_Int_Routine
Z- l5 l4 u/ g5 B7 E& `) S5 v int 21h1 F" Z3 m; S' Q3 j" d" u& ]
1 L+ i; {" m$ X9 m& p- `5 W! O( t__________________________________________________________________________$ k" P2 ^0 X4 d
8 V0 ~- Y! i4 Q9 t* p8 P( tMethod 092 ^+ a: X* k( [# w4 j( |( Y& h
=========$ D/ P$ y% s# Y% a$ U, |
8 f6 v* g+ j: S+ ?- K1 E
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
4 p3 R* B; F; A9 w R9 Q- Yperformed in ring0 (VxD or a ring3 app using the VxdCall).' P+ z1 E$ ? T: R. b! e& v# R
The Get_DDB service is used to determine whether or not a VxD is installed
* d7 c2 z$ D) {. X9 C+ D8 ~for the specified device and returns a Device Description Block (in ecx) for
8 ~' n# P/ m2 r, F+ Fthat device if it is installed.
( W6 f* h$ }" u$ S0 F! n" U9 J, J; ~5 ~5 \: d0 D
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID# w7 L/ l7 \* L( ~: q/ ^* a; F
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
" I1 G4 {7 S8 p% B3 l, F$ q* l VMMCall Get_DDB
2 @2 r" i# u5 u8 {7 n mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed6 }0 H8 [8 s) _- j* {
7 y8 Y+ p W z( }% K6 X# @, ^) h6 \
Note as well that you can easily detect this method with SoftICE:0 c7 X& L9 F- E8 K& t, M: E$ W- c
bpx Get_DDB if ax==0202 || ax==7a5fh; R$ D$ u4 t( A
/ `: H2 H4 F- G5 @
__________________________________________________________________________
9 n' f7 m3 k$ b2 ?7 H1 B5 @$ p7 W# Q7 y3 T6 ^) e6 u
Method 10' R" q5 D: p* `: y3 b& |3 U. X
=========% z& I* E% S1 s' P; a) ~# q
) E. ?5 H, V% g7 \
=>Disable or clear breakpoints before using this feature. DO NOT trace with
' g8 B. m# n( e9 [* X; c* y2 |% W SoftICE while the option is enable!!( w' I6 r* e7 C9 l& ]/ N Q
3 \0 {5 W, ^% r2 n# MThis trick is very efficient:
7 x) N: Z' X7 c( }7 dby checking the Debug Registers, you can detect if SoftICE is loaded; F7 p: _7 x6 z2 ]( {% z: g* F q
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
7 N2 o9 B- u0 h! q3 t9 a: j% othere are some memory breakpoints set (dr0 to dr3) simply by reading their, x1 ^/ g- B3 P6 H& Z+ ~
value (in ring0 only). Values can be manipulated and or changed as well
5 a' U2 }! J! o" Z5 o(clearing BPMs for instance); V/ S9 w5 x G; R e b* l! z
1 Y! g$ a. U% D, Y
__________________________________________________________________________9 P" I! f& ? ]2 J! T1 A2 n+ @) a, F
3 T3 _, m% b/ T4 p( Y. a, \% S
Method 11
( n+ O1 O$ `# S2 {: b=========3 S. E) ?7 ^( e1 l8 [) c6 s) X
! p: j! w% [1 o3 q m8 ^
This method is most known as 'MeltICE' because it has been freely distributed
( p# V" ]3 P: l: D" Y$ j# e0 r: nvia www.winfiles.com. However it was first used by NuMega people to allow
) t" t* u2 Y7 j7 A `; q) @% e. |Symbol Loader to check if SoftICE was active or not (the code is located
* G/ J0 w' b6 @/ I6 c7 n) X$ ainside nmtrans.dll).
9 N L& }8 r- _7 B* f+ \1 J v8 }8 ]( Z& p+ _5 U
The way it works is very simple:
4 L: w9 A _; u7 eIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
5 j( \4 Y) y, JWinNT) with the CreateFileA API.6 t% ]" a4 A6 R3 @! ^
( W% A0 j; s( A. n5 G) H8 HHere is a sample (checking for 'SICE'):
A5 v! G3 e# S9 p. b/ [0 P& k0 N/ `3 Z
BOOL IsSoftIce95Loaded()
3 M& L3 i* h3 B, R4 f{: {5 ^( g! o* s. h! g; K+ \4 K/ i$ O
HANDLE hFile; * y! W, O$ `6 {1 X; r+ W
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
4 i+ V, T1 I' [8 |' f FILE_SHARE_READ | FILE_SHARE_WRITE,
8 m ]5 Y* s% f! o' j0 Q( e9 m" L NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
; K' N% \8 l, F. z: S" ]6 }7 K if( hFile != INVALID_HANDLE_VALUE )( q3 q9 {4 {" t3 \! ?
{
. f9 v; ?3 e$ K8 i2 D) E9 U4 m$ { CloseHandle(hFile);
0 J' G8 V+ Z; z0 g: T D return TRUE;* ]: G3 c, d, w% B, N" j
}
7 T# y8 m1 r5 C- D: I return FALSE;0 T$ L& V9 r5 W; D% W
}& h0 {, s9 p8 g1 L+ }
/ D$ P4 g) o( N2 Q) B+ e7 eAlthough this trick calls the CreateFileA function, don't even expect to be
2 H/ B$ W9 P) ?$ ~6 hable to intercept it by installing a IFS hook: it will not work, no way!7 M4 [4 ]+ j) _/ s8 q
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
, X- w& M+ O Z0 lservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
; a, f0 L+ c% i0 `5 hand then browse the DDB list until it find the VxD and its DDB_Control_Proc
) z* j; C9 S) o7 vfield.& a" W$ h$ F9 W. i! I4 `
In fact, its purpose is not to load/unload VxDs but only to send a
2 }5 n* Q& l( G# ^' ^+ o& y- kW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
- R( i* B( U3 lto the VxD Control_Dispatch proc (how the hell a shareware soft could try- t. m' a s# t" G3 Y3 a
to load/unload a non-dynamically loadable driver such as SoftICE ;-).% C" t- q. C% `6 v% X2 w
If the VxD is loaded, it will always clear eax and the Carry flag to allow
, k; i* E# n0 G. gits handle to be opened and then, will be detected.: d5 C% Y' ~. G: @$ u4 I8 p& `
You can check that simply by hooking Winice.exe control proc entry point
; w& c* r3 } ?while running MeltICE.
/ c( R# B9 V; Q+ c8 M8 W' u: ^% n0 o
3 h: A* o0 E. h4 d8 E
00401067: push 00402025 ; \\.\SICE; u) C! R% q+ |+ h
0040106C: call CreateFileA
# k; L/ i4 d- n X3 _5 ` 00401071: cmp eax,-001% \$ G( T* ]3 H
00401074: je 00401091
8 l; ]. M5 H, S, w7 j a" [. k9 D2 [* p. K2 {3 {8 H. @
+ o7 O7 o% o; R# ]
There could be hundreds of BPX you could use to detect this trick.
( }( e( D# J" \9 }7 I-The most classical one is:$ P9 z1 T+ d- L! F8 j2 N$ H
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
- g0 Y" i3 o4 R8 O *(esp->4+4)=='NTIC'
+ p1 z; p: X, q. I, \& _/ Z% S
1 n9 W2 M0 y! s* i, [0 |-The most exotic ones (could be very slooooow :-(/ M1 G' b4 N ^- U2 B% [& k
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
! A6 l- {# T% \( J) r. F. c ;will break 3 times :-(4 X7 \& w' R! j4 S
5 e9 {7 w$ x1 ]
-or (a bit) faster: $ I! M$ H. [ Z+ k3 ^6 b
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
9 |- S1 p* i/ ~$ F9 f6 L! B1 P
, Y' g. o5 e' h8 ? T. } BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' ' h } y& v+ ?/ E9 y7 ~
;will break 3 times :-(& E% r S% i4 h: Z% E* w
, T4 Q! p% ]" Y: I0 I6 x/ P% d
-Much faster:* F# Y9 d( G) U3 G/ D
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'' \. I$ Z$ s9 | F7 n$ t) o
. O% `% n$ k5 Y) H
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen1 ]9 b( o! o" E1 r+ o
function to do the same job:6 y, i4 b2 ?% Z3 E( Q7 r k
# ^& I: B9 i4 o% G: z6 [ push 00 ; OF_READ" d* y U& d, w5 C* ~9 V* d! \' _
mov eax,[00656634] ; '\\.\SICE',0, T0 J2 e. E; R) _- L
push eax( I7 s/ |* {0 S x; l3 L
call KERNEL32!_lopen8 V5 o6 W7 B- p, f3 u
inc eax
" l9 g* l7 v5 Y* b6 B jnz 00650589 ; detected2 k9 d- u; W% Z% i/ ~
push 00 ; OF_READ
5 m M- ]% I3 ]! y2 j* n0 E mov eax,[00656638] ; '\\.\SICE'
% o2 c7 {7 a }4 i7 B5 Z' t- E: \3 B push eax$ ]2 L1 ?% k) d' v9 b C
call KERNEL32!_lopen3 e# Y+ C3 N q3 H1 W
inc eax, A1 l" j, V' u! d! L
jz 006505ae ; not detected4 r2 H: o+ J! v6 ]% A0 [
" L" G- c3 c; d( I# r% C! b
/ e2 J% \# x- j* `2 C3 b* u
__________________________________________________________________________; w/ W6 |& c% _
" K2 p b7 \, H$ S- }) }1 E5 s
Method 12
, o" a# @* x( p: Y! y=========
( v6 }' p! k1 d; N& k5 a; o( m! R
$ U: t! c1 Q: v0 R, |/ B3 `This trick is similar to int41h/4fh Debugger installation check (code 05
% }# a# l, I; d0 S: W8 V0 O& |& 06) but very limited because it's only available for Win95/98 (not NT)
# E! _9 Y- a. n2 l" Has it uses the VxDCall backdoor. This detection was found in Bleem Demo.- L) W* O0 {; q4 H. N6 t. g G
+ o% A% |' x$ w3 L% S/ R3 y# [# \ push 0000004fh ; function 4fh
! H W5 w0 X0 ^5 `& x' |+ x5 f) j push 002a002ah ; high word specifies which VxD (VWIN32)- e$ L8 i! E) i/ l( O
; low word specifies which service
' `) k2 G8 f# _& T! s: u2 | (VWIN32_Int41Dispatch)
# C- j; A" S& f) q" I. `5 D) x call Kernel32!ORD_001 ; VxdCall+ h ?( l3 J& y
cmp ax, 0f386h ; magic number returned by system debuggers$ v4 G1 p- a1 u6 { P* Z6 `
jz SoftICE_detected( }- U9 p* O+ i2 U+ i
- M& _4 V: |5 Y8 M" pHere again, several ways to detect it:
4 ]6 I* g6 g1 F* I( O
2 l! n) y, l- X0 ^$ I7 M! S BPINT 41 if ax==4f
# J7 i4 J+ t2 Z' E
; q/ v5 U/ b" ]2 o. b6 m/ b BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
% h! q* O' E$ o2 V6 I; i+ R2 K" [9 @' k! \6 l- S Z
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
5 E( s' A$ P7 `; F$ l2 u0 r3 c! ]4 O7 z
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!7 D4 x4 _6 x+ `( k2 O3 e" j
3 u" [% v; X% p9 w+ p__________________________________________________________________________; E" \9 x5 a6 _; {# J
! `% R4 H( J5 {& b8 s
Method 13
+ a; {/ V6 y$ l+ Z6 {=========; \8 [ f h2 [/ C' r: l) X
2 c8 i: ^4 @0 D0 \, Q4 x: m# D
Not a real method of detection, but a good way to know if SoftICE is
3 ~: ~7 }" ^/ Q& ]% V! P2 ~installed on a computer and to locate its installation directory.( B0 }$ A6 J) O. c
It is used by few softs which access the following registry keys (usually #2) :, Y7 d, U' Q- }( _9 x, N! F# u
* ?2 Z' t' d7 k, G0 Z-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
9 b% W9 V$ ?2 Q1 i7 f% x\Uninstall\SoftICE! r/ G$ q* ~9 S' H
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
6 [, E/ c* k1 D; R. C- c7 [0 T-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion: `, f& ]5 B. p6 {
\App Paths\Loader32.Exe/ M2 |6 m- l: j5 H8 f* F
& e% K2 Z( v2 \; e
1 B# B& G$ z) Z0 O3 |# c: V: zNote that some nasty apps could then erase all files from SoftICE directory
# I4 @& l( t# Y8 @, j(I faced that once :-(9 x5 S. f, ^; P( b3 i% ^
! S* m3 z: l. M7 t
Useful breakpoint to detect it:, \& |6 f) O2 }! N S
' G8 E: [3 U# Y- u! _1 |" d
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE') ]- c) {5 E& H) R f) ~4 ^
( u! d; X: ~! V__________________________________________________________________________+ W) P. _6 t5 g6 K0 t
" C! W! j2 `9 W/ x5 t- o9 x7 L( ?: N8 u0 |+ R
Method 14
) H/ M3 w8 i" h! w0 {- l=========
& k* J$ {2 Y5 K, W6 z/ j
8 l( ]7 ^$ a! x( x' FA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose- C0 Z+ _- M( V; p! {6 }* c. x
is to determines whether a debugger is running on your system (ring0 only).
& O$ o( _$ F f/ T. O2 z' d' Y( K2 y. I9 Q( l9 p# [
VMMCall Test_Debug_Installed- I$ D# q3 f/ Q/ _; v; P
je not_installed8 Q1 f- J8 B. G T' E' p5 i
6 h& {% o& Q% g; Z8 C: f! e
This service just checks a flag.' ~- ?5 t" [" z! `! P
</PRE></TD></TR></TBODY></TABLE> |