<TABLE width=500>
# |3 R! O% t6 a2 {6 T- l# T<TBODY>
* k+ U5 J( {; Q4 x$ R4 G3 H% v# w<TR>
0 r6 K4 ~( `$ }4 t<TD><PRE>Method 01 ( `" m. u3 ^- o2 Y5 \
=========
) M6 P# t; C9 [8 k6 x. \) T: l6 h( k! m' g7 v B
This method of detection of SoftICE (as well as the following one) is1 P4 |7 z4 R4 d& I' j2 S P
used by the majority of packers/encryptors found on Internet.
/ v# ?7 ^0 T$ x, Z" N2 CIt seeks the signature of BoundsChecker in SoftICE
1 G, k2 Y+ G0 [
- q8 R& Y9 [: S/ L" G, Q' U) N5 N mov ebp, 04243484Bh ; 'BCHK'
' _" e- \( Y8 u9 l A# s/ z4 v mov ax, 04h
3 N. v3 x2 n4 f6 S: H! l8 n+ { int 3 6 s7 a8 R3 K3 P0 J% A# Z% J
cmp al,4
. Q9 d* `$ | [, Y$ x; z jnz SoftICE_Detected, M! l. ^" _6 \( ^1 s& M* c
?4 O0 B, P% q i( T$ v___________________________________________________________________________7 e# F0 u# Z3 P0 Q3 x5 x7 `) H
2 i& \1 [; l. F4 B5 J) Z+ Q7 hMethod 02: y9 T* a& q/ x% l2 k, I7 D1 ~
=========
$ ]1 ~* D* u! t3 k1 x+ [7 x
6 {1 `- p7 x% W2 f m' ~7 TStill a method very much used (perhaps the most frequent one). It is used; _# g; g" o4 n
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,' Q( T* g3 s N/ Z: ?
or execute SoftICE commands...- A; c' v/ W6 c, w
It is also used to crash SoftICE and to force it to execute any commands/ o1 Q( ~4 p& Z9 d
(HBOOT...) :-((
D! w% g8 r( U, t4 m/ |
9 G! _6 e4 \6 }7 }( I6 @Here is a quick description:& q8 l0 b! b/ V6 r& B/ t8 q
-AX = 0910h (Display string in SIce windows)* A- Z5 A7 X3 h) B
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx), l7 C P" |. g! s9 A2 J: b
-AX = 0912h (Get breakpoint infos)" V5 x" a5 c: R2 k" _/ _; C) Y
-AX = 0913h (Set Sice breakpoints)
* p: w4 z0 Z, L% Z6 u2 S$ l+ W6 y-AX = 0914h (Remove SIce breakoints)
" N& ~* u, L% k- t, F% D
; i/ y% w6 v ~# R! CEach time you'll meet this trick, you'll see:
( X& H. }# ]4 z( M8 J-SI = 4647h
% G9 W; P( v6 F! F$ b-DI = 4A4Dh
" k( O& d$ {% f0 M2 |Which are the 'magic values' used by SoftIce.+ V* t+ l" R7 u* L# B& V1 [
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.: j9 x: E, [# p
" d/ e% ]1 y& M3 ?+ JHere is one example from the file "Haspinst.exe" which is the dongle HASP
4 t) b$ j* j, _Envelope utility use to protect DOS applications:% o2 n h( x6 D$ m, c6 F
! k. o5 ~! v4 q- J/ i7 @
2 }: `$ c* L# F3 y8 m5 h4C19:0095 MOV AX,0911 ; execute command.
9 ?, o; X$ v0 V3 x, J, ^4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below)./ J, C% b3 s( B# ?
4C19:009A MOV SI,4647 ; 1st magic value.! ^& O) K( k! {# ?* l
4C19:009D MOV DI,4A4D ; 2nd magic value.0 q6 ]/ y% V+ ?6 q* N$ z
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)" q5 Y- a0 _* ]
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute2 @& Q# o6 V$ B% ?
4C19:00A4 INC CX
% ?! E% ?( p8 x: u+ ]# p& d4C19:00A5 CMP CX,06 ; Repeat 6 times to execute# g. |1 F6 ]) o9 X. M8 H. ?& W0 T4 W
4C19:00A8 JB 0095 ; 6 different commands.$ L: w" I/ e' l& T
4C19:00AA JMP 0002 ; Bad_Guy jmp back.
) a: x; y% N1 |) L; X# ?! s* |4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
7 w3 k! W6 T5 w# @! v' g; }$ _% m
r3 ?# p* G2 r+ O7 l: _+ zThe program will execute 6 different SIce commands located at ds:dx, which* n( V' e8 k" V
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.! K9 g0 u6 p: s2 D+ |: s9 o
4 P- Z' `: A& G- o* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.$ [2 v7 n, k a% M" M5 J
___________________________________________________________________________
* e5 \' {6 q6 ?% t. o7 G9 m! o) G/ i* ]$ s5 O7 ~$ Q
* E8 K# S+ c! ]/ C! j, ?Method 03
$ A* b2 O5 Y# R# v% s. V5 g=========9 P3 a* X$ u5 K6 r d/ {3 I
% V7 l2 b: o" @2 v
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h: F; Z& ?; Q0 @
(API Get entry point)
8 e% L1 F6 a9 s
- d( e8 U, b5 Y$ ?! z. n
7 R' ?3 i, o! X! ? xor di,di
; j& p G S2 Z ^ mov es,di
9 d( j" g! B9 _$ ]% } mov ax, 1684h . `5 ~% G, [# t X" j5 ~# r
mov bx, 0202h ; VxD ID of winice5 D$ T, ]; h8 N$ W& B- b; j
int 2Fh
( e7 ~/ |# T; b5 u7 m6 `) E* V mov ax, es ; ES:DI -> VxD API entry point9 r' v! `( `8 y
add ax, di
* @# C: h+ w5 }$ Y. B1 f( D test ax,ax
: u* ~; K6 @9 n( A. Z jnz SoftICE_Detected
; r1 G0 m6 |# h# f/ K: K+ E/ E5 m+ K9 C" \- m" H9 j3 |
___________________________________________________________________________
& \+ A( F% g+ ^7 q! p5 K: M, Z- ~# ]3 p$ X% y4 E' A# ^+ B
Method 04
' p/ t, a- T) p- m; b A; J=========' z% Z( a3 B4 X* l6 X( {
% ]# a1 K! A5 M+ L' ~7 R lMethod identical to the preceding one except that it seeks the ID of SoftICE
6 v. Q3 z( u7 O0 {8 [& nGFX VxD.
5 A5 p5 {" t/ _: o5 `5 [* c6 W* k$ H& M& E( W
xor di,di
6 ~1 D* i# i/ e* `6 [+ O; n mov es,di2 [3 ^4 e- e0 N5 x0 X! l3 L
mov ax, 1684h
3 h4 s" `9 D7 E1 p& h- W mov bx, 7a5Fh ; VxD ID of SIWVID
2 I& ]7 l3 J4 L( x/ S int 2fh2 i, A8 R e* `# j6 [! |7 U# [& X K
mov ax, es ; ES:DI -> VxD API entry point* y( ]: M5 |" U8 C+ @! }
add ax, di& I" V; G) W9 T! f# z6 H
test ax,ax) ~$ ^# {3 R- x5 t2 [
jnz SoftICE_Detected( ^2 Y9 J' D! A+ t$ d0 y6 ?- A/ b/ P
6 A0 R2 f, p' X( R- f0 N1 D U
__________________________________________________________________________
+ b- }: q" {! q- D1 M- `5 q& [% ~' R
2 K7 l/ b9 Y, v# h5 O2 D
Method 05# N. V- h3 f3 T2 x3 j- B
=========
, {8 s0 _0 U2 ^
+ p# v) H7 \8 H/ [3 z) [Method seeking the 'magic number' 0F386h returned (in ax) by all system0 D K4 |- k: n/ i' H
debugger. It calls the int 41h, function 4Fh.$ T6 {" Z' }: |/ f' N& y$ \
There are several alternatives.
- S6 t F' n& r7 M, b& R( q& R+ h" j5 q) @2 O. u# V6 s
The following one is the simplest:
* D' M0 U/ i" X9 U4 ?. H ~) q
" }+ v+ s. C3 b2 W c6 L Y7 w mov ax,4fh& {9 b e# ]- T% f, [6 D6 y
int 41h" l5 T5 D; f2 Z- _
cmp ax, 0F386
( ^# P) P5 Z, U$ y) A% Q# t$ W jz SoftICE_detected
& S( c) N2 ]' S4 f2 P/ P9 f* f r# S% o/ w, s
3 g" }7 }6 V$ v( z" e" z. I
Next method as well as the following one are 2 examples from Stone's
7 a% i# V( F. R4 a4 D"stn-wid.zip" (www.cracking.net):& c+ Y. R( J! c; J
7 ^0 x, E9 ^& O" t, J
mov bx, cs
4 a( @% }2 x* Z# c% F lea dx, int41handler22 k" f; A1 ^2 ?5 ], i9 N+ ^5 j0 I
xchg dx, es:[41h*4]" T4 a& W9 s/ Y7 r* y
xchg bx, es:[41h*4+2]
0 V/ U$ E) p" \ mov ax,4fh
; x$ u* v" @- R" Y. n# w4 S6 s int 41h
* I: d/ s1 ]( e! g5 w$ P xchg dx, es:[41h*4]4 |2 L$ P+ l+ U: J5 J4 a
xchg bx, es:[41h*4+2]2 F6 c3 H: r' @
cmp ax, 0f386h
$ S3 ~" Z( V/ D: @ jz SoftICE_detected9 @! z* h) x( w, v# ~' J2 R
2 Z9 z' U2 t1 W6 u! m- _" W' p+ nint41handler2 PROC1 ?6 m% ]3 w% H% J
iret
: k6 W* a7 Q0 Nint41handler2 ENDP
; f1 ]/ }% M' H3 K: ` o
$ w2 @9 M: V, @' E
; a; p6 D4 b( J) S5 X_________________________________________________________________________' U' o- v: x& O3 D& _: _& p+ I7 d
`6 K6 I! t/ e3 F) k
4 f! X! D+ V# nMethod 06
2 T. K' z( o e=========8 L2 [4 x. ?' E2 s4 ~% ?
9 j& s/ d2 Y5 M; e$ G/ r3 h+ Z u c4 x1 x* ?. Y3 g
2nd method similar to the preceding one but more difficult to detect:
# `0 l0 m) ]" s: B; e- K5 U1 U: A6 I. s1 k" C6 m2 P
7 k- d, J$ y8 h/ b! h3 ]( Cint41handler PROC4 T3 y9 j. w& A* e% N! Q
mov cl,al0 M B* p) D3 X7 v
iret8 U( m$ t0 L3 j# n3 |, @
int41handler ENDP
6 Z& C6 \# [1 K8 r' |; z, u0 C* m
( n* R8 o. ~2 L
xor ax,ax
' p/ `7 c6 q/ R- x mov es,ax& V! ?6 l% c2 S+ ]; }
mov bx, cs
W: t( |) o5 g, Q( a" e lea dx, int41handler
( T! g* ~9 C; ]! @- ? xchg dx, es:[41h*4]- \% {! Z* t% c1 r/ o
xchg bx, es:[41h*4+2]
! [) j$ }7 o. x, L8 K9 i* M: B% _$ E in al, 40h' F- r9 L, [% a3 T( y# x* i: t! B/ G
xor cx,cx
8 e5 @3 Z' V/ l7 n& | int 41h
7 b* r8 f1 s8 ~+ _+ M/ { xchg dx, es:[41h*4]; h# ~7 l8 E- g2 Q, h1 ~
xchg bx, es:[41h*4+2]% S; k! |# ?6 @ w3 K" S1 ]
cmp cl,al
/ @! E. ~$ i6 f8 b) w5 _ jnz SoftICE_detected
( R; y% ]( `7 Z: F: h+ Q, B! |& N( w& {' |3 T- l4 Y$ g
_________________________________________________________________________# k6 s* e, G4 Z; v; c+ r U( ^
9 z' [( Q/ Q0 S6 B3 {5 A7 q( h
Method 07
' @1 E+ P0 @) _/ j! P=========
* q$ }3 {$ x' h5 I
) n+ f8 b5 p9 \( C" \/ aMethod of detection of the WinICE handler in the int68h (V86)
w1 v6 Y7 m4 a9 ]; q% a+ h2 _4 P# U; {5 ]4 X# z
mov ah,43h
% c0 i) i E9 O4 p- S0 _3 A int 68h* C; s, l8 S9 Y
cmp ax,0F386h) K3 W" G* F+ j
jz SoftICE_Detected$ [# O8 w4 F" W8 h) Z
' Z7 s5 p' \7 G# I* A9 e( Y7 t% k/ A8 b3 h
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit9 C! o9 L: L" A2 L
app like this:5 M/ s* ]; q. l9 s s
/ @& J8 W! I5 m BPX exec_int if ax==68
' {- ^" A9 `- n2 |* x (function called is located at byte ptr [ebp+1Dh] and client eip is
' W' n5 U% L1 J8 k located at [ebp+48h] for 32Bit apps)4 V! B, l8 |7 I8 w( n" n9 ?
__________________________________________________________________________ E3 N: y+ y9 a: F) C+ }+ w: Z6 a
$ v9 d- A) X$ W& c7 v$ N3 R7 m1 G# ^) b
Method 087 Z/ g" {2 s3 i' |6 D' O' t7 c
=========
: M) H5 r' g# [2 V% r8 {! g& L1 ]- {9 w8 ~1 Q) U
It is not a method of detection of SoftICE but a possibility to crash the8 V% H) `" J$ k) e: |& X" l
system by intercepting int 01h and int 03h and redirecting them to another- M4 j. f& E- D5 d) U7 l: |+ X! a7 U
routine.1 j. `! v6 t! Q% @ g0 C
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points& h0 l% y& r! L: `
to the new routine to execute (hangs computer...)
6 D; r7 T3 U9 I8 {5 i
8 l- r$ {. z) Z mov ah, 25h
5 j0 e8 u8 x* g/ j* y2 _ mov al, Int_Number (01h or 03h)
' @* T3 \$ B+ T3 F6 y mov dx, offset New_Int_Routine
/ y# T+ e7 R1 P0 O; e int 21h' z' B* ]; G8 v5 J
6 u+ k6 R, \+ S4 Q; L* B1 G# c/ F
__________________________________________________________________________0 H5 x& a8 \+ e% f3 v0 X9 }! F3 m
8 G) X' S7 g- m8 K# ?7 ~, L& q
Method 09
, w( E" C/ W; i/ ? Q$ ^=========3 a9 y' ], n& b9 i' d% l1 n
' B: \3 }" r/ Z i" M1 p
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
: w8 j. j/ G# A* Nperformed in ring0 (VxD or a ring3 app using the VxdCall).
% ~, ?" c! Q% } A) _The Get_DDB service is used to determine whether or not a VxD is installed- ~9 M* J% a; R- a1 o1 ]" d
for the specified device and returns a Device Description Block (in ecx) for C+ x( ?( r+ c x& p4 }2 A) [
that device if it is installed.
, g; x1 n7 V- ?7 [, S R
; c- H* x2 H/ l5 q b mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
- N- I% J# u* ^. L mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
- t- i0 |) R# M! P VMMCall Get_DDB
) E( F+ N9 t' }; A mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
1 ]- J4 V. Z6 l3 T/ K+ p
- q! p8 V) @8 n2 U- ZNote as well that you can easily detect this method with SoftICE:. X& j4 i( H6 {. {
bpx Get_DDB if ax==0202 || ax==7a5fh
. ~2 n3 T: S. z: J# j- c& D8 }, _
__________________________________________________________________________
# t5 W# ^' f# H o% ~: q8 |8 T( d( w& p5 @
Method 10
4 R' k3 G( z- H% o=========
2 r5 L6 R) C; T
5 x# ~ V/ ~' a0 ^=>Disable or clear breakpoints before using this feature. DO NOT trace with4 M- V' _1 P- t! e# }- |
SoftICE while the option is enable!!
9 H0 Y$ g1 e/ ~& e* e
. J2 a/ I: n5 ?- g9 MThis trick is very efficient:
3 l: N* L: j% B* s. Jby checking the Debug Registers, you can detect if SoftICE is loaded8 f! u, H/ p) e4 J
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
e1 N h8 |0 k3 u! hthere are some memory breakpoints set (dr0 to dr3) simply by reading their( U v7 C) _0 O1 X7 _4 N
value (in ring0 only). Values can be manipulated and or changed as well
" G7 E9 K$ ~' O/ S. p3 {9 a(clearing BPMs for instance)) v) r0 E5 y& E- Z+ x
* _* Q* r6 {3 q7 }+ j" @8 y. F__________________________________________________________________________9 [: G1 m, e" M* M/ y
" W7 @5 V) _7 G! I; O7 A# S
Method 11
/ ]: G+ ~! P0 }2 K. |$ W=========" E+ i- f4 y) K+ P& @; N* k
4 M$ O. W6 n: ~! n) m$ \
This method is most known as 'MeltICE' because it has been freely distributed
1 Y% \7 E1 ?1 n$ {$ jvia www.winfiles.com. However it was first used by NuMega people to allow& G% V' w( D& Y8 t+ t6 E. [
Symbol Loader to check if SoftICE was active or not (the code is located/ S" s3 W- _( x$ j, g) A7 M' {: _
inside nmtrans.dll).5 l9 X9 f4 ~( K. S% O7 `$ E
& \# G% W* {2 f) U( H* gThe way it works is very simple:
, U/ E; N/ O' C; l6 iIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for6 i) ^. e9 S3 o* j* n8 q7 x
WinNT) with the CreateFileA API.
P6 w3 t) N2 L* ^7 T! e+ V7 J& q @( j% N0 j" \$ w$ Y0 [4 z4 u. T
Here is a sample (checking for 'SICE'):
1 E8 d, |0 w+ Y/ y6 P; s
# }" f2 ]- u9 O6 v+ h WBOOL IsSoftIce95Loaded()* [- M) ^" B) w3 |" W: B6 @, A
{
! g q L7 J3 L+ W% o HANDLE hFile;
; p4 J" t, Y3 X* @9 A2 a7 \' s hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
0 i2 s+ |5 v1 ^% N8 c# x FILE_SHARE_READ | FILE_SHARE_WRITE,0 K1 E; W# D! L" ]( g
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL); r1 W9 ]9 w0 y( e6 N7 z4 U
if( hFile != INVALID_HANDLE_VALUE )
8 |; c- [, T- X; }/ D' Q$ }2 v4 N: I {" ~7 }$ N* ]% U" f+ x4 R
CloseHandle(hFile);
" G) _) A; y: m2 i, n return TRUE;
. v( i; ] l1 G. ^5 ~! h% }8 u: V6 L }4 z: U. A8 T4 i2 Z
return FALSE;
0 Y# ]) X. m$ ^! e$ |0 s}' v( \( C( U+ v& n C1 J
2 V' Z Q% y5 g' E
Although this trick calls the CreateFileA function, don't even expect to be5 S) C5 R6 j6 f
able to intercept it by installing a IFS hook: it will not work, no way!
, J9 v5 {( {; v4 D( kIn fact, after the call to CreateFileA it will get through VWIN32 0x001F3 D6 L+ ?1 y( y& [3 G8 c3 l
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)7 a0 ?) j! n E
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
- @" l3 T0 _0 b+ ]field.0 w; p) A4 U6 s& n
In fact, its purpose is not to load/unload VxDs but only to send a
9 P2 m" {; R5 C. s4 nW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
/ ^$ O! n2 z- f2 L* `9 qto the VxD Control_Dispatch proc (how the hell a shareware soft could try5 F, {" E: _9 H5 p6 z2 e( I8 k
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
* }4 y* C# ]3 ?% j- h& bIf the VxD is loaded, it will always clear eax and the Carry flag to allow- S2 \4 I" U) i" J9 v, L
its handle to be opened and then, will be detected.
7 r7 a; @; z8 `; q, c- G; @8 cYou can check that simply by hooking Winice.exe control proc entry point
4 R U5 V, ^9 Y8 B9 k* X8 W- d# M6 fwhile running MeltICE.! L) p' n+ X% c2 V% w, u! s3 u5 p
7 F! o \$ m6 _% s7 b+ I6 H8 e6 W
2 v! q S4 Z8 Z- _
00401067: push 00402025 ; \\.\SICE% U3 S5 G, L, s4 e. s
0040106C: call CreateFileA
; u8 A9 ~- U [4 z2 I 00401071: cmp eax,-001
& P7 ~. X$ \# v3 b* k 00401074: je 00401091
5 N3 s- l/ \0 E$ G5 W- [9 y0 v; M6 B4 W/ F1 z" o9 f
. u1 _% x( R0 K b
There could be hundreds of BPX you could use to detect this trick.$ N I" K7 i% X$ ^# Q2 D; U" V
-The most classical one is:' s$ ?, X2 k' m) [9 f0 C7 d
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
. u9 N1 K4 s0 [# l( U! i. z *(esp->4+4)=='NTIC'' i/ V+ t7 U0 |
4 N3 }( g, h+ A$ N& C9 s& Y
-The most exotic ones (could be very slooooow :-(
* x+ L1 O% @' k. P5 [ BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
& q. G$ V( v; k3 c- F ;will break 3 times :-(
" E/ W2 O' q! P# x
- I P- N4 X, l' W9 ^-or (a bit) faster:
: B7 y o5 N5 d BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
1 ]9 N( S1 A( r0 n3 }* d' u; i$ K/ L" }% y: q
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
/ r1 O0 j, @. W/ A ;will break 3 times :-(- D% y6 D* Y* A7 r
' `! E' y! @4 ]" z" r; e-Much faster:9 @$ p( h6 j! ?
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'/ H, c# A4 x% c$ Z+ g( V) {/ X
% A) d, p( Q7 \4 w( H& `+ |Note also that some programs (like AZPR3.00) use de old 16-bit _lopen2 T. l. p7 K* X" _. Z
function to do the same job:! E' u R9 _! h% `) y5 \
2 t2 l5 n, Y$ n8 e
push 00 ; OF_READ3 d2 n T$ q% `/ V* n
mov eax,[00656634] ; '\\.\SICE',0
5 g$ t1 |7 b/ w- K push eax
) Q+ _7 @% R* { call KERNEL32!_lopen" I, Q! [9 b* ?9 O N" T
inc eax
. s* p% ]& G/ J) G! J/ r jnz 00650589 ; detected
& {" T: N D" K* \* N push 00 ; OF_READ; p2 q9 _5 g; f
mov eax,[00656638] ; '\\.\SICE'
* s! z) ?1 ?% u; K: }9 [, f push eax
$ c2 i i3 {: L call KERNEL32!_lopen# G, Z3 z. E' M& l
inc eax
N" O' e# B [6 @ jz 006505ae ; not detected
' J3 [/ H/ b4 p6 [6 w+ i6 ?
. Z7 Y7 k( m- a) a
: I9 ?" {7 m0 ` K: X( v, f__________________________________________________________________________4 @0 U$ V! T, ^& _
4 _; a2 I1 z% }, I% ^
Method 12
! w" g8 V$ x) Z4 {4 `=========$ v( j6 ^& h) w) G, Y# M
, T6 Z$ R( {& Y) K0 j0 y, V yThis trick is similar to int41h/4fh Debugger installation check (code 051 C# w. L9 I$ ^ s' \
& 06) but very limited because it's only available for Win95/98 (not NT)8 T5 M" y) Q5 x: i
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
) Z& `8 T; I( O$ j( @% _' b; q4 ^
4 E v# e. w5 L# y push 0000004fh ; function 4fh8 j s6 P1 _% _* T
push 002a002ah ; high word specifies which VxD (VWIN32)
( W7 h5 I& Y: m( |, t ; low word specifies which service1 E: v3 e" n9 I# g/ B) J9 C$ C4 P
(VWIN32_Int41Dispatch)
n/ T5 V; Z; q+ H t call Kernel32!ORD_001 ; VxdCall9 Q! T; v; O* w0 x6 h
cmp ax, 0f386h ; magic number returned by system debuggers7 J4 m# z* E P, I
jz SoftICE_detected0 r3 k. \# j: ~& y5 G T, ~2 f( F
& M, l( g0 a8 M
Here again, several ways to detect it:
M- G A3 O. |1 O; s5 y3 J; c2 x2 W R/ B, l- |2 e- z+ l
BPINT 41 if ax==4f
/ G. }$ e6 o4 W' d- X* K# a6 _( ^6 {7 I
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
- {! C) k8 h2 R: n7 V d# m$ l1 b
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A) n/ ]; L. B/ y$ h7 Z, a9 A5 I2 `
5 h' L! \ P- ]4 T9 U BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!3 m5 B6 h( }3 P7 D _& x6 g# r
) {) \, j. F5 A( N# S( B- ~# k__________________________________________________________________________! W: ?! y. v$ S; \! x
" d8 I; m: n0 l7 [ l
Method 130 D4 m5 @2 o" ]8 T6 P& H
=========
1 ?' T, i- m9 N4 \7 r2 Z/ s) _/ x# Y7 J t% Z. M. h
Not a real method of detection, but a good way to know if SoftICE is
2 C& I {6 U$ o% F" T1 S0 Ginstalled on a computer and to locate its installation directory.
; `1 [2 p/ P8 {& h! @It is used by few softs which access the following registry keys (usually #2) :
$ j# o$ D+ ^6 t- A. D: R, b) a& \
) r; P' l& a0 ^+ _+ r-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion, a$ S" v! s, p% D
\Uninstall\SoftICE( s$ @% H ?9 K% l& r( \
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE5 |, K5 D/ R9 G0 ]7 w+ O! E) [9 k5 j" L( v
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
, I/ C4 V+ y1 \ _\App Paths\Loader32.Exe# T- O+ t& d/ H0 b: C
0 O0 @2 S4 @7 f- ^& o/ g/ t4 V
; Q! `- c3 W- |
Note that some nasty apps could then erase all files from SoftICE directory9 O8 o3 m2 T) b
(I faced that once :-(
- i- J$ V' M: o$ j$ B' h- E( S2 \$ X
6 s) m% P R9 a& LUseful breakpoint to detect it:
* @" P$ A, |4 M) s& D0 P3 K. O6 |0 z6 u; A r
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'# I8 H+ g- g2 f1 p2 e
; @4 x/ G/ H; w& ~5 R__________________________________________________________________________
2 \: A3 U) U+ K$ o& c
7 d( r. p' g# q
5 k! b# n J% w* i* wMethod 14
% y: j2 m6 Z$ ^% k9 V9 z O+ U% V=========
) }8 L$ Y" Y8 o" N+ c4 Q" w2 j4 P3 ^
8 v% l5 `0 Z) F ^" K& iA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
/ Y" n) j g6 u7 E5 J0 f# u: Yis to determines whether a debugger is running on your system (ring0 only).
2 k1 G3 n3 x3 M- e( K9 y2 O5 \2 d5 X0 W4 l1 B q
VMMCall Test_Debug_Installed
, e4 Q0 K- V: }5 y& b" d; ?1 } je not_installed
0 v5 s1 A4 e$ q# }6 r/ O- m4 M+ J- v
This service just checks a flag.9 T! B4 t$ ?3 G( a5 N8 s6 u' b1 G
</PRE></TD></TR></TBODY></TABLE> |