<TABLE width=500>8 R" D1 P6 Z* n5 `: ~* |
<TBODY>7 B- ]4 u2 V( B7 b Z t3 q
<TR>6 f* M; b7 D- W! T1 D
<TD><PRE>Method 01 $ [' _& b2 h$ ` Y9 V
=========
$ B1 e$ |5 W& v' Z& e, x
6 E; t. D" v5 D' dThis method of detection of SoftICE (as well as the following one) is
^6 j- O& }+ h8 C. e4 O8 G bused by the majority of packers/encryptors found on Internet.
, v0 n- `$ k5 C# lIt seeks the signature of BoundsChecker in SoftICE, f, n# Z+ z- |8 t& R
4 k5 H$ R' ^ r. }; h, E mov ebp, 04243484Bh ; 'BCHK'
4 M( [* r% X: O7 V' N- ? mov ax, 04h* x* |; _) c5 X
int 3 3 E, A# D5 d3 \" n5 b
cmp al,4
1 }! ?$ `( u5 y1 H1 w, P3 o jnz SoftICE_Detected* i. d+ @1 }4 e+ g: |6 k, T
/ E6 |0 E. Y# C* K8 T8 C. E
___________________________________________________________________________' r" Q9 Y8 {# b" ]& _
# f2 M5 V$ @ e. c! J; dMethod 026 }# |7 R+ |, [
=========
& V: [1 k4 o$ @. n! d$ S2 X$ N' `7 X; T* _+ G6 u* f" w
Still a method very much used (perhaps the most frequent one). It is used- X- o# h( S$ F1 F. N( L( S( B
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,* P) n9 E% {9 F
or execute SoftICE commands...! ~9 {9 }0 Z* `; B9 H
It is also used to crash SoftICE and to force it to execute any commands' C8 q* s& B2 O7 q
(HBOOT...) :-(( 6 Z4 C% H" O! r) s! E9 c
9 W j+ Z& P# d9 {: z1 s
Here is a quick description:7 x! ]1 `2 E! |/ c. f# U" X
-AX = 0910h (Display string in SIce windows)- L7 n0 R' p: a% t) f) u A
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
3 ?9 ?+ [9 S% e-AX = 0912h (Get breakpoint infos)
' ^- v9 \1 {* u3 D, r6 d# E) O8 g-AX = 0913h (Set Sice breakpoints)0 w1 Y0 E; `# q/ Q! z0 s
-AX = 0914h (Remove SIce breakoints)8 k5 t" b2 ?+ ?% m
/ o. R3 J, l; g* ~, b# nEach time you'll meet this trick, you'll see:9 S( v9 z$ ~. q- e- q* Z, {" _
-SI = 4647h
! O2 A' D) i. T& F6 r& c1 A-DI = 4A4Dh5 z$ v# C) w/ Q# z& J
Which are the 'magic values' used by SoftIce.
; C: D, o! t. e# bFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.0 V1 ]2 b& D" V' C, s
( N5 _% ?. ^' R; c) I$ r% ^0 r S
Here is one example from the file "Haspinst.exe" which is the dongle HASP! O& y5 j. B7 }" J5 R) J6 ~0 c$ t
Envelope utility use to protect DOS applications:
1 }' }4 G! e' T2 r
; [2 r) H9 _2 h' W1 x% f5 l
( f4 R: F' F# O4C19:0095 MOV AX,0911 ; execute command.. Z/ i- S7 }* O$ x" P
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).4 l4 Q9 a9 T+ P% S- L, P
4C19:009A MOV SI,4647 ; 1st magic value.
" p1 H* n+ D' x8 @5 }4C19:009D MOV DI,4A4D ; 2nd magic value.7 N2 C, E; z3 A Z3 q
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
2 M+ [+ }& Y# r( P$ \8 d$ P4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute! h0 r; H" ^8 r$ H& T" Z
4C19:00A4 INC CX4 y2 N0 I* c& x. H; J
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
! Y+ C9 V2 J. Q( E1 m; J# M+ G4C19:00A8 JB 0095 ; 6 different commands.
% o, ?( V, K+ N+ _1 p4C19:00AA JMP 0002 ; Bad_Guy jmp back.: G" _1 y) e( t; M# T2 k
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)# z, L6 H+ k: G) G: ?+ p
) t: _1 @7 G$ I) d9 m: y/ [
The program will execute 6 different SIce commands located at ds:dx, which3 B) F3 ]6 p( \' B
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.' ~# G+ r3 t) i' \2 P: _
. C4 U9 Y& Y& L" C* S2 V0 n" v
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded./ @- F8 M, ^* P2 D' F' d* F
___________________________________________________________________________0 l) R& s; K" I% g) ]$ J
) ?, {3 g! c7 j: F. V3 M. T% Y H$ A1 U/ {
Method 03
/ a( ?% H6 j! E! ]=========3 ]5 k' e; \' `! J4 v
5 p1 x Q: l, P+ Z0 g
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
5 _4 [. P" X0 ~1 W6 y! {(API Get entry point)
; @! C% ]+ |% S( r: v9 ] 8 E- x! r9 x5 |- x( W) e3 i
2 w' I o8 a+ h) T0 i xor di,di
* ~4 g' N* `! b$ X) y# j T mov es,di, E$ H; ?0 e3 Z( u
mov ax, 1684h / `6 p: Z- \' y# q6 o, `% q
mov bx, 0202h ; VxD ID of winice
1 d) z0 @3 W5 s5 e/ t int 2Fh7 ^7 \! b7 p, v: C# b7 ]) S+ j
mov ax, es ; ES:DI -> VxD API entry point- `% l b! H q! {5 e7 f; h o6 v! r0 d
add ax, di
# ?( A: \! V; z; Z; u: |# D+ p7 j test ax,ax/ P p. E- Y* m+ r/ f+ O' n
jnz SoftICE_Detected0 F, h* @: k1 d* @
: Q# ~, R+ E( Y- p b) ~___________________________________________________________________________
8 ^+ K1 Y- L1 s/ b9 ?4 E* u2 x) R( R' m0 R) `- g& @
Method 04
2 G0 H2 l! r6 r5 i=========+ |! l H# _" e g
+ o) h2 m$ o8 w6 F+ j- ~! p, QMethod identical to the preceding one except that it seeks the ID of SoftICE
S1 O: g) p9 y! t( \) R5 aGFX VxD.
. ? y* _6 e- G7 v4 o# n) p x* V/ x
xor di,di* @$ Y+ Y r \+ P' u* P; J; M
mov es,di
( v* d$ \# u, t( n3 W9 E% j. W mov ax, 1684h
3 z# X% w2 R1 I mov bx, 7a5Fh ; VxD ID of SIWVID- ~+ R% e, [ s
int 2fh- l/ Z N5 a* N u+ l
mov ax, es ; ES:DI -> VxD API entry point
* _; v0 o; p/ y' c u add ax, di
! S6 P% o4 x. I0 g0 Q test ax,ax V) I, ^( t* A
jnz SoftICE_Detected
- `7 ?' t' }6 T$ w \, \2 R# _
0 ~2 M8 o, i3 e ^__________________________________________________________________________
, I7 I: n" K# S2 C8 G/ J) l8 s, E! l" h. Q0 M' Z, x' A
# C- N4 R8 E6 x. t. B. N0 d
Method 05
" B# B" F9 i- z- n% @; _=========0 K* l; s3 M# t/ V; r0 P
5 D. H! D y8 \& G" x/ h* H
Method seeking the 'magic number' 0F386h returned (in ax) by all system% w6 v/ l+ A9 q3 q5 ]
debugger. It calls the int 41h, function 4Fh.
$ a8 U; c3 R! ~6 e+ N3 J, U- uThere are several alternatives.
- _ K. a6 f: H
& @$ ~' Q9 J! K" _1 B/ [/ b5 z; SThe following one is the simplest:
% L& |9 M! Q# I* V4 c& |8 m4 `4 f+ N z1 u# ?8 I5 |) I
mov ax,4fh+ {' w8 G1 p7 s: k$ q
int 41h
6 t; p, ~/ r. z l, g cmp ax, 0F386* |) n8 J& w1 k7 }$ w9 `* \
jz SoftICE_detected' s8 i Q6 e! y1 p& Z1 c. Z6 K' D
: A, y4 ?0 S% K; Q8 t0 E
# H9 H' F: I6 F
Next method as well as the following one are 2 examples from Stone's
% X/ ?1 y; {, F+ ~8 P' x"stn-wid.zip" (www.cracking.net):% Y; u* F9 ?3 p* s4 {
) I' X6 n5 t* m
mov bx, cs& K3 V4 A/ G) @
lea dx, int41handler2
0 i) `" |! ^: u# a% n2 l xchg dx, es:[41h*4]- S2 r: y$ e7 C2 r* A s
xchg bx, es:[41h*4+2]( A* `8 ~' {" j
mov ax,4fh) \. @% D, k" O. o2 |
int 41h
9 o4 O3 T. l9 X$ }/ H( h K xchg dx, es:[41h*4]
6 _6 @8 H. B% e0 b5 ~ xchg bx, es:[41h*4+2]
( x7 U+ t# q" \6 {* K cmp ax, 0f386h
7 e$ F) f0 b" @; U9 \$ W jz SoftICE_detected
% l1 U+ Z7 F# K
- |! `# |6 E; f/ c: w) T: F$ S: nint41handler2 PROC
7 q0 S+ N) H6 f0 s. i iret: o- P" Y2 r" a5 h( B5 P
int41handler2 ENDP& R4 @/ m; i6 W: Q: l6 W1 L7 @3 r
* T( g/ C. D8 y! F0 J
* u2 f7 z9 F F5 H/ h: E9 |
_________________________________________________________________________
4 g% c; ?& _8 n; `' `3 g/ ~- i# A7 i) Q4 V; z& i6 T
: z- S0 f' l/ y$ Q% zMethod 06
2 t( s. a9 @1 t' `! M=========) }- G/ o6 H7 C. J
$ |* x" r$ g2 E7 s
" D+ {) `; B2 t4 p' v: Q( h+ x8 ^! t2nd method similar to the preceding one but more difficult to detect:3 c4 Q" r; ^. V3 S/ z! L9 j; N8 J
F1 z& B. B4 s6 y3 a8 S; Y1 s5 \' H y
int41handler PROC& w6 u/ I6 Q6 w! S' h( o
mov cl,al
^6 ~- I6 x6 J: z5 r. x7 q iret2 N( c; z$ y) p! E
int41handler ENDP
+ T% y; p$ j9 q) U8 c3 Q- B& D1 a1 }" ~* h+ q; t* ]
& @" W' R) ^# b
xor ax,ax
- Z# F+ I x& ~5 B6 q mov es,ax" P3 [; G- ~: j/ Z
mov bx, cs6 w- d! U! S: Z1 e: X2 m3 J
lea dx, int41handler
& S$ W2 q$ e1 I# T xchg dx, es:[41h*4]- r; M. C" d1 Z/ Q2 A! x. F
xchg bx, es:[41h*4+2]' i' b9 h8 _: Y, P3 p& [
in al, 40h; b- m; L; M9 u4 c+ D( f
xor cx,cx# n: a- Y" M. D3 |- \+ p% M
int 41h# l- v( Y2 L8 ~5 _+ T. U$ j
xchg dx, es:[41h*4]
: G S* S5 o9 l) H xchg bx, es:[41h*4+2]
8 x, S" T4 N* J1 }+ u- g* Y cmp cl,al
) j. B/ F8 v2 H. {7 r% n jnz SoftICE_detected
- C) [* p4 h% c% }' k
5 B: e, |9 [4 V_________________________________________________________________________+ k6 s2 i2 [3 P7 _6 y" y7 m
8 j% Z0 {0 [% p( h8 PMethod 07
7 Z! ?8 h5 c; x5 N5 O8 k=========6 H$ k7 k( U6 m# g5 z& y
# p- q" ?, a* F; r. G$ o; C1 NMethod of detection of the WinICE handler in the int68h (V86)7 {8 e; Z0 I& d% W+ ]) `) g
6 Y. U5 q+ P' E
mov ah,43h! d' I8 X; X$ \# b9 I2 |5 m& R
int 68h
/ a4 p. s; V" c) N/ x( @ cmp ax,0F386h. i$ S! d% J% W" z+ K7 Y
jz SoftICE_Detected
. @0 q! n. S1 Y* C" j7 f
& t, K6 F3 P$ H* b( f" x! M) |& X" Q) r) F
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit2 t t6 |1 w9 U* l
app like this:
5 H7 v9 Y8 K9 a
0 k. }9 C+ E5 j) K& @. n BPX exec_int if ax==68, e3 N& f2 |0 c
(function called is located at byte ptr [ebp+1Dh] and client eip is
* n" ~, s; K; s! z* ^$ L6 Z located at [ebp+48h] for 32Bit apps)% |$ _' ^( d, C6 v: b* ~
__________________________________________________________________________$ z2 _- L0 ?1 f2 v4 ~* B5 t2 H7 p( R
# w) A2 g1 g8 D6 O' v+ F- h* ?
4 _* J* N8 i! E+ D
Method 08
/ ] e( k' h A1 r) t1 w* Z=========% N z) t- G2 C+ v) y
( Y. p) h8 j5 A# [! C) Y6 k2 E4 _It is not a method of detection of SoftICE but a possibility to crash the" j- c4 k" M. q6 w. r8 m' Z( o( b
system by intercepting int 01h and int 03h and redirecting them to another5 x6 k1 f" D& ]9 w$ L/ A
routine.
- r- l& O" x# l9 n3 V, iIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points) P+ s" u; B y1 l. M U2 R
to the new routine to execute (hangs computer...)
8 o' f) N/ K% D2 {* l( ? C( W5 p* X: n/ e2 w
mov ah, 25h
/ T+ @7 o6 L& L) Q2 N& z mov al, Int_Number (01h or 03h)+ d' A% N3 I/ i+ w
mov dx, offset New_Int_Routine
/ S. F1 ` C! `: E6 a4 i int 21h
+ i, A& ~! L `; Z* V: q: y
; I3 `6 S0 H) L__________________________________________________________________________
8 H% L y/ f/ `: w5 M; s' C- _! p( U# x5 X/ ~/ g
Method 09" L! o2 x! j: ]2 N% u- [
=========. \, R: M" a- i2 Y% E- C/ q( q
& O* ]" m9 \3 l( uThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
D* P) m; X! V" j2 N) Pperformed in ring0 (VxD or a ring3 app using the VxdCall).
0 I; e# ^* [2 g& W& l. I5 q( FThe Get_DDB service is used to determine whether or not a VxD is installed) J1 j/ i1 s# X/ z
for the specified device and returns a Device Description Block (in ecx) for
: n* s% T/ U1 l i( sthat device if it is installed.
- G; X, F- w3 ~- ^
" b7 L' L' B% z$ M* U mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
3 C% q2 t& [6 D5 b# ?+ I mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)3 u! y+ O" b+ k: |7 l h% A
VMMCall Get_DDB1 T. T; U5 z- k" H
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
- o, G1 o& a, B6 k* q0 F, w9 s8 N7 H
Note as well that you can easily detect this method with SoftICE:. Z* I% X. E4 ?5 T$ I8 P# R( R2 U( K
bpx Get_DDB if ax==0202 || ax==7a5fh
9 n3 t0 |' x, Y0 n6 Q& I, P! [" R
9 W k8 j6 N, c- `' g__________________________________________________________________________4 A( v5 r$ |2 R% W2 F* n- y! ]( X3 O
& b* {+ c6 O0 C2 _% dMethod 10% m$ \2 W) I! d* j( J0 }
=========# G4 {( b& g# `- s9 D0 X
* t6 Y0 J3 H* \! t: w+ I: C9 A=>Disable or clear breakpoints before using this feature. DO NOT trace with7 a; O5 h- E v6 }
SoftICE while the option is enable!!0 I4 P# H: p# o6 C% k- l q
3 q. i( a4 v% J1 c" v
This trick is very efficient:
% t% g8 D: M' G$ Cby checking the Debug Registers, you can detect if SoftICE is loaded0 z3 p& Q1 h: p: d
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
( U1 @ k7 B w9 mthere are some memory breakpoints set (dr0 to dr3) simply by reading their
# X' v; V6 B W8 Ovalue (in ring0 only). Values can be manipulated and or changed as well
7 W3 |! U3 v9 e+ z( y(clearing BPMs for instance)" W+ |# {- @2 D: k8 z- e
% `" |5 N5 @! F) B2 S
__________________________________________________________________________
0 u# \" O# c, s
/ `! ^; N4 B- vMethod 11
4 X2 C0 Q4 k% K- i: E=========" y# r6 s& w" k: A. |
2 i0 R* A% m" n4 f! T6 I
This method is most known as 'MeltICE' because it has been freely distributed$ _4 y: c A7 g4 V& O1 l" y T" \% |
via www.winfiles.com. However it was first used by NuMega people to allow
; o1 @' ]+ L2 JSymbol Loader to check if SoftICE was active or not (the code is located
5 _" Y+ l; m& h3 o$ z: v# l# [) W7 Yinside nmtrans.dll).# D7 ]2 }+ b/ s, g# M W
. e9 i' m5 C1 T/ ^9 R3 {
The way it works is very simple:/ q5 b+ ?9 t1 K9 w" B
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
0 y+ C$ w; N. [* J/ n5 xWinNT) with the CreateFileA API.) T9 c$ s4 H7 M0 m
9 X) B. r1 ^# r
Here is a sample (checking for 'SICE'):! w5 P4 k5 `3 U/ ^
0 ]4 e, ?: U b) k' i3 FBOOL IsSoftIce95Loaded()& E, o) a7 s- ]& }8 M, a2 |
{2 e; \4 y0 q- y# |# |* y. b) u
HANDLE hFile; % Y% {) | Y3 T, j% l
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,# l8 h" b( `% |7 n: ~+ {
FILE_SHARE_READ | FILE_SHARE_WRITE,
& R3 I$ O5 I) O NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);5 Z' o, T* v( Z, ?' X
if( hFile != INVALID_HANDLE_VALUE )
$ C6 R* r P6 Q {4 s2 t4 }8 Q% M Y( w
CloseHandle(hFile);
! v2 I$ F+ J: `0 L return TRUE;3 B3 L7 b0 V* P$ B5 K
}
, Z! k3 m; C9 k5 s8 H8 d return FALSE;& d1 k9 _4 D% z
}9 p# n/ e' W% j2 X( v
3 y! ]; t% D! a tAlthough this trick calls the CreateFileA function, don't even expect to be
* D N: n- _# Yable to intercept it by installing a IFS hook: it will not work, no way!3 [2 L& G6 m4 D% Y: l# K& u2 K) I
In fact, after the call to CreateFileA it will get through VWIN32 0x001F7 f2 Z5 ?1 y2 X, F- n: C
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
- B p/ H- N( i: G0 dand then browse the DDB list until it find the VxD and its DDB_Control_Proc
0 `0 B" W7 }; g: Z: `' l. R E3 ffield.
0 s$ k1 D2 V+ @5 m1 C6 H4 vIn fact, its purpose is not to load/unload VxDs but only to send a
+ J# Y: x/ P8 m1 p2 @7 rW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)3 z! S3 S m% o1 @3 o# [% o) O) |+ K* d
to the VxD Control_Dispatch proc (how the hell a shareware soft could try# f% @0 `( h% x+ P& b
to load/unload a non-dynamically loadable driver such as SoftICE ;-).* O' o' }/ \0 ~
If the VxD is loaded, it will always clear eax and the Carry flag to allow4 J7 |( ^+ j9 O# ]. Y
its handle to be opened and then, will be detected.$ L$ t& o2 x |9 v9 d w$ q- h
You can check that simply by hooking Winice.exe control proc entry point
* ]; A- ~" K4 N! jwhile running MeltICE.
2 R1 ]5 v6 e8 _+ ^. ~/ }( F2 ]2 v7 y. X; ?* P1 ^# l( Y
( ^. h( C! O' ?, w 00401067: push 00402025 ; \\.\SICE
0 g. v; p9 ~9 J. g" `' k; } 0040106C: call CreateFileA
2 b5 X$ F' G$ u' \3 F( J* b 00401071: cmp eax,-0015 ^" X: ?3 z% d* x+ U {
00401074: je 004010919 ] I, O% s9 P3 n4 g/ }4 _
& p& v$ O9 t: i i/ |/ T
; ?- A1 M% k6 {$ {$ f3 |* vThere could be hundreds of BPX you could use to detect this trick.
- ~: d K5 k0 Y9 j) Y5 T) E: F-The most classical one is:
& q2 D+ o: b. p( W BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
. F* J1 j! P( E *(esp->4+4)=='NTIC'5 c3 V1 {# e) i W- A& k7 ~- S
) y7 L. C R6 P @ v, G2 I) t
-The most exotic ones (could be very slooooow :-(5 O& f6 n3 H& [& A* s
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
( a5 Z. v. K% a ;will break 3 times :-(" K. d! y) z& u5 |
- D( ~1 Z7 Y, {1 z1 o9 _ B7 q* E-or (a bit) faster:
5 t. g- {- `$ {/ Q9 ? BPINT 30 if (*edi=='SICE' || *edi=='SIWV')2 z; [* e3 P0 t+ ?' t3 `; m
' T0 d. \8 |4 P: l; g7 F! d0 a/ u
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' 3 h$ ^' f$ w) }$ I7 z6 {
;will break 3 times :-(: r4 G* u7 c5 T( a1 t- c: w
4 m8 y2 [) |8 w- \
-Much faster:
* M8 l, L! \ v4 i7 Y BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
0 N- E' m! D3 Y( [" N
& n# ^( k+ p5 J2 B- f7 ` p0 p) XNote also that some programs (like AZPR3.00) use de old 16-bit _lopen1 r4 R3 ~ o H r( K0 G
function to do the same job:" ?$ G# o0 H' e$ k; z" [5 |
. I |* C, u3 `* M1 S% T push 00 ; OF_READ& C4 H0 t+ ]0 h; H5 x3 a) I
mov eax,[00656634] ; '\\.\SICE',06 ?) c( l x8 `% j. v c
push eax" k% H k* f$ ?& _: v/ Y
call KERNEL32!_lopen" ^* u* Q7 {& U" q2 B; i# _1 ~, u* B
inc eax& f7 K7 j: |. t) \. f
jnz 00650589 ; detected
% @4 r$ g( v! K push 00 ; OF_READ
0 V3 a8 F( m% c7 U9 g" Y! f/ t; F mov eax,[00656638] ; '\\.\SICE'6 P% s" r/ ~, l- K0 d
push eax
/ Q; k1 N3 F1 X call KERNEL32!_lopen
% v7 C$ M+ | M5 t4 u7 Y inc eax
0 ^3 D" ~& c1 C" Q: L. S8 {+ f jz 006505ae ; not detected
& w4 s; [; v9 k7 t: t
! |0 [2 D2 d/ X- Y. p! R2 O C$ L
* t% \! C- s! E4 L6 C__________________________________________________________________________$ C' B/ `8 ], s7 c* J* g; x
7 ~2 r0 @$ S# A+ {# K' W- VMethod 129 P: n% [( J4 s2 T
=========0 z: W$ {# ~0 [ z8 I* d
# p. P. C. ?9 e5 S7 |3 X6 L
This trick is similar to int41h/4fh Debugger installation check (code 057 W- [9 H9 i, \, p/ `- i
& 06) but very limited because it's only available for Win95/98 (not NT)
3 C+ z; z- g: Q5 z% {3 c+ ]" X6 S6 w" gas it uses the VxDCall backdoor. This detection was found in Bleem Demo.$ j9 G" G% ?) r3 z9 ~
$ c+ p# P/ n: ~) s* | push 0000004fh ; function 4fh9 X+ f6 |4 _0 C- e( M
push 002a002ah ; high word specifies which VxD (VWIN32)
3 B; |* Z0 e) \2 J! K% j! K6 R2 C7 R ; low word specifies which service
3 D; E8 e. |# ]5 y5 y& K: [ (VWIN32_Int41Dispatch): y" [! r2 [5 i
call Kernel32!ORD_001 ; VxdCall
* X* ]( \* t1 t% g- r3 K0 N' c8 V cmp ax, 0f386h ; magic number returned by system debuggers/ }1 V8 C- _$ @% h! k/ ~
jz SoftICE_detected \0 q) R! A( a1 \
2 w7 t3 G# ^7 y' H( MHere again, several ways to detect it:
5 R* H2 d8 X o- S" S8 r! J% T/ @& U% u+ D
BPINT 41 if ax==4f
9 r# Y8 c* E5 ]% t5 ?( v% v: z$ Z" b& t: o5 F# M" A5 u2 O) R
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
# X- h& K& _8 g% [' \$ f; A2 c' t$ s* D2 S
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A4 R* M" W& y0 D" Y( H; m
& {& Z' y! x2 X* i; t9 \ BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
* t+ H' g/ \" l- m& Q4 T, a/ s' p0 A, U
__________________________________________________________________________- F' w& S" l) w/ F) }* C
9 M9 b7 j0 z$ H' P& Y" z0 Q
Method 133 ?% z9 D4 W/ B8 ~ ^, v3 P, K
=========. I+ a: v# L" Y1 z2 ^6 i1 e; j
0 K+ l/ ]) {; P; W; K
Not a real method of detection, but a good way to know if SoftICE is$ D) K t- F5 M6 \1 ~
installed on a computer and to locate its installation directory.( \. l2 u/ i A' [+ y2 N/ ]
It is used by few softs which access the following registry keys (usually #2) :% ]) X- I' C; q1 g% o) [
# ~6 e" U8 i& b i& n-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion9 O" U. H O# @
\Uninstall\SoftICE0 K# c0 r- {2 z. [5 `( Q
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
9 f8 V# G1 J! U$ |5 j-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
: q1 [& B/ E: b6 y\App Paths\Loader32.Exe x+ O6 g/ A8 m
9 i- M/ c4 h1 x6 l' ] v4 N2 b5 A! R9 g8 R/ H9 _+ j
Note that some nasty apps could then erase all files from SoftICE directory
5 u, v# B0 @$ a$ w! }; e(I faced that once :-(
, K5 n) x4 a8 ~8 |" B" s
9 }" ^' d% B3 D7 a# Q8 {' u- fUseful breakpoint to detect it:, Y* s9 Z4 Z6 O( Z3 l( A
4 w+ j- n6 } K6 x7 J( [ BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
4 {. t5 T h& q5 L' o% c$ ^* U, Z* l9 x" J
__________________________________________________________________________
; ]+ H8 Q7 c& k, a6 O+ F) Q. g" D8 P) W
/ x% v; N9 r1 Y
Method 14
5 W. I! m* u# N7 `* T=========
4 n: c b1 D4 n& i/ z9 N
4 N( t( o. A' ?6 PA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose" `( o X5 I; i, x& N( s
is to determines whether a debugger is running on your system (ring0 only).4 ]+ \ t3 C- O3 y$ a, l
. ^4 o1 ^0 r. c) o
VMMCall Test_Debug_Installed2 @' w0 o. c) b9 c
je not_installed
" r; a# U1 G5 t; f" E+ ^: e+ _( ?* X' Z3 r7 @* A4 I& Y0 K, k
This service just checks a flag.
% D# {- M9 e: f2 ~& J, n</PRE></TD></TR></TBODY></TABLE> |