<TABLE width=500>
. r. j X/ c0 G+ |$ E3 I3 j<TBODY>) K3 O: I6 [* P" J
<TR>9 Z- ^$ s& @ u7 e
<TD><PRE>Method 01
' j5 Y1 E9 _' c7 p- C=========% S% m, b$ [, X/ k% m. {
) K. m$ Q7 @- R8 z
This method of detection of SoftICE (as well as the following one) is5 u" y/ K4 L& x u7 k2 v& G
used by the majority of packers/encryptors found on Internet.
/ Q- {" h* K2 n$ Z% WIt seeks the signature of BoundsChecker in SoftICE9 A6 n+ @! r `/ s( L! Q
" d% j o9 j, Y U' l9 I mov ebp, 04243484Bh ; 'BCHK'4 x6 f% L# j' p' [" m5 r* m
mov ax, 04h
! f6 S3 B2 K! P int 3 5 M8 M l) \2 B$ c$ L
cmp al,46 y2 g2 M/ g# }0 W
jnz SoftICE_Detected
( L& K6 r! b1 u3 L3 y) i
& ]# r$ c* Q1 h# U* s) A7 H5 y___________________________________________________________________________9 C. v" c* p' L5 O5 ?# x
: D. B1 e! n3 ^' T/ ?2 S9 gMethod 02 ]/ }6 w: E& M& m# y% N
=========$ Q% x* R& j- R, C8 ? X- p
& V! h& w% A7 }2 MStill a method very much used (perhaps the most frequent one). It is used/ [ l' L( x% _+ \+ [
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,# U) {: x5 ^) H0 }# ^: N
or execute SoftICE commands...1 k1 J1 a4 C# Q) L
It is also used to crash SoftICE and to force it to execute any commands* r2 k0 l4 a7 b& j3 j5 |
(HBOOT...) :-(( - N' g; l3 `* D
* q. d: P' v1 _Here is a quick description:
/ v7 C" a- L! L& g6 \ D* L/ u; n-AX = 0910h (Display string in SIce windows)/ K" m" X9 z1 H3 T8 Y
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx). b0 z2 M2 X7 t
-AX = 0912h (Get breakpoint infos)
4 m2 J" T- i2 a-AX = 0913h (Set Sice breakpoints)9 P6 R n; b# O3 |3 ?
-AX = 0914h (Remove SIce breakoints)
& l. Z9 Q, v' U$ g( j; F: Y: _0 H, `; s2 w' P
Each time you'll meet this trick, you'll see:
% ]- v9 h s+ L* S) X-SI = 4647h7 E9 |- s, B/ o0 q6 a% t
-DI = 4A4Dh, e7 w6 G$ n) s+ W
Which are the 'magic values' used by SoftIce.& a' D1 w' ]4 m$ o8 n% k& c' f
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
; x- c4 h( D. b- w" {- q* K6 M7 j, b, i
Here is one example from the file "Haspinst.exe" which is the dongle HASP
& L+ x% \# p( tEnvelope utility use to protect DOS applications:
7 C8 z! C) ]: {& A1 P$ W% F8 I( a) o4 y% q2 z5 x5 Q6 D- T
9 V3 ?5 ]0 ]( l
4C19:0095 MOV AX,0911 ; execute command.
. E" B2 a% A2 Z1 |& G! ^2 d" t! T4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
. R0 U$ g$ t: @, z$ h4C19:009A MOV SI,4647 ; 1st magic value.# {6 P- e* C( `7 u
4C19:009D MOV DI,4A4D ; 2nd magic value.
$ t' Y$ G5 H8 B2 v& m8 ^- r4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)+ P2 ]. V* D( O- l8 T" J2 w
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
/ |$ H6 B3 s/ t8 B2 d4C19:00A4 INC CX; J9 c- U8 U" Q# V- l
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
# f" _. _) `0 @3 o# m7 _4C19:00A8 JB 0095 ; 6 different commands.
8 q0 m* o5 O4 |9 u4C19:00AA JMP 0002 ; Bad_Guy jmp back.
, t# b, r( C; E8 J& E P4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
) r6 t6 A! y& P% u4 P; a4 W1 m
. w/ G& ~0 o; K( ZThe program will execute 6 different SIce commands located at ds:dx, which# t F* X! l2 g: m X8 U+ a/ ^/ x
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
% X7 ^3 |* r; t+ g+ x4 ^# R( j7 H8 B V# S
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.+ h( k/ w3 j% g0 Z$ Q2 ^8 v$ F3 e, V1 O
___________________________________________________________________________; K- H Z3 G2 Y7 h, T2 K. ^
C0 E7 O8 H6 O* K
N9 h; S1 S" _4 Z; q) uMethod 039 \: c9 Z$ l- L2 y: \
=========
* A6 o( b2 H+ I0 s8 z2 b9 n5 e5 e3 ]9 C6 ^, W' |- D( s! b
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
9 F8 b/ J! z9 Y2 u5 z(API Get entry point)6 u7 P, \7 r5 N
* g& K1 ~+ {3 j
w3 q$ K( o. O
xor di,di. ~1 }) Y, m- j9 Y! I+ Q" d
mov es,di6 r0 c2 E, j% _* L! ]# e
mov ax, 1684h
. L% _3 x/ T& B H: k# i2 o( U mov bx, 0202h ; VxD ID of winice$ j8 |! `& f# v9 O$ K: S+ c
int 2Fh
! O. x6 _4 B4 Q6 t" P, C5 i, ^ mov ax, es ; ES:DI -> VxD API entry point& p1 R/ A, p# C
add ax, di, o3 x7 O+ c2 `
test ax,ax
6 D. |# d+ K! Y jnz SoftICE_Detected
+ Y8 A' w* n( C* g" O/ A3 G
% C+ y5 ?: o: R___________________________________________________________________________: p6 I: j m- B: q
0 a+ v8 d: y1 \# n2 `9 X1 q1 W
Method 04
6 O! a! }9 z I3 c9 O- H0 @- F* b=========
5 o: K' N0 E/ X1 ~( @% S" h' }. o
! ]6 s/ A- b. o5 |* P6 q( y1 |Method identical to the preceding one except that it seeks the ID of SoftICE
, C; g2 ~% I) m/ dGFX VxD.
$ b& ] v" m9 s: u. Y; s: d+ c! b# H
xor di,di
; T% F) y! b, h4 M7 E" M mov es,di" j* @& @: y1 G( {2 x' v3 Z5 `% {
mov ax, 1684h
- F3 [ l+ O2 r. f! y mov bx, 7a5Fh ; VxD ID of SIWVID( a. Z9 t$ d$ R9 j& p( w6 N% k% ]" ?2 G
int 2fh
7 d6 m% M) z( i/ ?! E. f6 m0 ^4 p mov ax, es ; ES:DI -> VxD API entry point/ \$ V, C4 X6 \/ T4 T2 |
add ax, di
M# d6 h a. ~- F test ax,ax0 L" n$ {; W. N' V; q
jnz SoftICE_Detected
+ t" @8 V& _4 c1 t5 D2 }6 _- z
" a( l* u# R* N' [' O; U__________________________________________________________________________
8 S: j3 o2 ?0 _0 k5 e1 h* n$ f, k3 A G8 p$ K
2 f, I. h I+ e# h2 g7 C( s+ O
Method 05
+ i7 G+ v) x% U/ |9 Q5 m y/ ?8 {=========1 K' m, J1 T# Q3 m3 U
# \6 m5 v* k6 L$ g2 ]2 qMethod seeking the 'magic number' 0F386h returned (in ax) by all system; w( M8 x7 N- D* Z
debugger. It calls the int 41h, function 4Fh.3 M9 \' T& t2 Y. ^% b; e: N
There are several alternatives.
6 P! P- r* {$ b0 j
- t7 H* w1 @& d* o* N2 Y, M/ d; d# WThe following one is the simplest:4 g+ _- n7 z& ?% D
+ m( x2 u+ s' y/ T+ ?4 G, R mov ax,4fh
* Q5 m1 r% v$ L! c, x7 S int 41h
* X- K5 F7 j; v cmp ax, 0F386
6 C6 m- A; u+ `7 Q jz SoftICE_detected! [6 I' ~4 [6 m# j4 u! d% K
+ j; ]3 W3 W: H2 S( d
3 |! v( a, ]( d/ @Next method as well as the following one are 2 examples from Stone's ( I8 [; u7 J$ m3 R
"stn-wid.zip" (www.cracking.net):/ t& ]0 D+ X1 \( m) w8 K
9 u7 |" j! \& L0 E% F- Z
mov bx, cs
4 v7 C' Z/ z0 ~5 Q" d lea dx, int41handler2
4 ?5 x+ D- D2 u4 @ xchg dx, es:[41h*4]( }% Z7 z+ d. v% q
xchg bx, es:[41h*4+2]. m0 G( r- R: A1 {& x+ ?- t7 z
mov ax,4fh, R& L* z2 u- x# Z9 o
int 41h
! C! y2 \1 v+ h0 s* a8 K1 x* s xchg dx, es:[41h*4]% J# ^. a# X" r: J9 ~% y
xchg bx, es:[41h*4+2]
% K* _# W: [. x( m# G, {9 W% O cmp ax, 0f386h
/ ]4 V! ?& N7 p jz SoftICE_detected
' \8 h" x; o7 J4 h/ u- n+ `( }1 ~" }! R! j/ C# v9 U% l
int41handler2 PROC
5 K0 N0 [( j F+ e2 C* b( \ iret
1 n2 J4 S* H" T/ r1 Gint41handler2 ENDP6 S+ D$ S: B8 S | S3 M
# k$ ^4 ] `; ]; Y4 X6 y
9 S" M8 I- `6 i* F+ k% g
_________________________________________________________________________3 }# j6 z9 s3 t) M: _% {8 `1 v
& U8 H4 b3 h) D2 S7 a0 [6 \, ] P u, H$ l
Method 062 i* d3 {3 K# w# x
=========
/ E, F+ _7 p0 A; M5 T! A8 t6 E0 g0 T V( P, c
3 i p; m1 \/ a1 T% O# o# O2nd method similar to the preceding one but more difficult to detect:6 }3 A# l2 |7 t; g" U- k& W
- |( _4 E1 e/ H. H" v3 U) C
$ q7 P1 h% ?9 [8 I& h8 oint41handler PROC4 N$ J7 N$ h0 I# I& e% z a8 x+ ~
mov cl,al
& y6 Q" `; M# s' f" d* D iret
7 {# N* B% |0 U% }( X4 aint41handler ENDP
, q8 z3 C8 z6 v3 z! u) c4 f' |( X0 n$ i; [/ [, b% Z* X
q: P2 u$ p* O5 C' @' |6 X! u xor ax,ax
( v F7 U, Z/ `8 D8 @ mov es,ax
- ~, y; V5 Y9 p% {4 N9 n- t mov bx, cs ]. T1 g4 W6 R& O3 E" g
lea dx, int41handler9 g4 j* k% Y' S5 H7 w
xchg dx, es:[41h*4]6 L& J, N3 H0 S* f* e0 g: u
xchg bx, es:[41h*4+2]! g. e9 V9 ^5 k; {
in al, 40h
- o# \" M! M; M2 S, J/ c xor cx,cx$ m; F9 ]& Z6 D8 n, w
int 41h
: }$ i2 y+ q. { Q1 w0 I J xchg dx, es:[41h*4]
, d q1 o, S) ~ xchg bx, es:[41h*4+2]
; k6 a; I3 @5 d1 p cmp cl,al
- ?4 B5 r, T* `4 a% o, @% ?# u* q jnz SoftICE_detected8 m v7 y, u& }; D7 Z3 J
& s+ P, r" q4 U1 Q- j5 f_________________________________________________________________________, a3 b7 V7 d' ^
u& r5 f6 W; F+ `4 hMethod 07
0 s' j; v+ c. g- \' B3 Q=========8 w- m1 M/ r4 K$ s
+ c) g: A" K7 s5 p; E! r H7 Y. BMethod of detection of the WinICE handler in the int68h (V86)
: D" e( y* X& k5 z3 g9 z: E
7 c M' @$ `* `$ f4 x mov ah,43h8 h4 K& G. a8 U
int 68h
8 b% ]* Z3 Y+ S1 e- a cmp ax,0F386h
0 A) b6 S+ C6 z' K jz SoftICE_Detected
' I' C3 j1 p2 {$ m: w, z
# t s( V3 e3 b6 u- Z
N4 R3 `$ k4 V7 D f9 f=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
. g# r% J) y% T app like this:- C% e! }, h0 q+ d- f
8 R+ h5 k$ Y4 r- A/ y
BPX exec_int if ax==68
* L* J1 t$ q6 {# a) R4 z" j (function called is located at byte ptr [ebp+1Dh] and client eip is
2 V& I' b8 T) I3 {2 C4 O8 L4 s located at [ebp+48h] for 32Bit apps)( p2 x6 L! R6 _. y5 z& W
__________________________________________________________________________& l. e& e) r$ T$ Y5 ]. Z3 |
: E. e4 o. j0 N; R5 E
. ?) \3 I3 I" M/ ?# n
Method 08( l- v i C3 c) F
=========) f9 Z* C* f6 V
& s5 I' j* o1 S8 e; c( F- f
It is not a method of detection of SoftICE but a possibility to crash the" Z: B: P8 r- U+ R: N9 [2 k: J
system by intercepting int 01h and int 03h and redirecting them to another4 K8 o& D) r& A( M" J
routine.
- h; E: I' `( {. _It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
# Z3 G% X* v* L5 R% {- ]to the new routine to execute (hangs computer...)
, v! Q$ x0 V' A8 l, e
8 q9 A5 _0 b% b& f mov ah, 25h# Z2 n+ w- n d. C
mov al, Int_Number (01h or 03h)2 y- q# Z d. \; J
mov dx, offset New_Int_Routine+ \6 Q! r8 a# Z6 f0 V9 H
int 21h# e' ]1 W% Z3 \
) w9 c6 u. o2 V9 f9 r8 y/ z
__________________________________________________________________________
6 n) q2 c1 V3 i: a l
3 _3 I0 c/ q0 v$ h: [4 z; |Method 09, {) h" G7 i+ r0 x/ ?9 a) @# G0 p+ q
=========) x ?7 z# \' V' a+ O1 p
* ^8 ^0 J# [8 b0 {4 OThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
" g3 z- ? H R _! z' Yperformed in ring0 (VxD or a ring3 app using the VxdCall).% |" C# x1 B3 l# m) P
The Get_DDB service is used to determine whether or not a VxD is installed
& \4 a7 s0 K* w: {5 mfor the specified device and returns a Device Description Block (in ecx) for; U- B+ y. R3 m f6 y2 x% W
that device if it is installed.
7 x! O- v2 Y5 l( T1 L2 w- e* j+ e8 Q* d
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID- b. L9 l. ^3 e1 K4 Q: T
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)% T" H1 ~8 Y# P) M* f0 W
VMMCall Get_DDB7 n0 h2 `( \1 s+ B, ]9 I6 o) E: V
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed9 Q! C9 i1 `3 h' H
: A3 j; |5 `% D0 b5 u
Note as well that you can easily detect this method with SoftICE:
9 Y4 q; Q2 J& c, Y/ S7 ?4 a bpx Get_DDB if ax==0202 || ax==7a5fh& L! F1 l; d2 z0 `5 G1 a
, z5 Z( m% e/ R7 b! X* V' V
__________________________________________________________________________9 M1 e# ~- B) n
8 ]3 ^6 K" {1 r. e) ]Method 10
4 K" s4 Z' C- V f9 V- Y1 |=========
3 a# f9 ~1 X( w, r" C/ E8 |/ c
4 a1 R6 Z6 t" t2 b=>Disable or clear breakpoints before using this feature. DO NOT trace with2 a! G5 X4 f7 m4 d+ d5 Q" D. {4 _
SoftICE while the option is enable!!
8 `! C' Q5 r$ P' e W, G/ c+ u7 g, _6 v! w
$ b: F3 i' U4 m# N9 XThis trick is very efficient:
x) {( v% k% o+ Y. {3 Uby checking the Debug Registers, you can detect if SoftICE is loaded6 i- F( s0 @/ K7 Q1 a" Y+ I# s
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
2 J z' u* x! v6 Z9 p& tthere are some memory breakpoints set (dr0 to dr3) simply by reading their$ V9 O& r9 n# ~8 s( U: }, _
value (in ring0 only). Values can be manipulated and or changed as well
! I* b" r# Z! x# @8 T; Z- G(clearing BPMs for instance) Y: I& m2 Q( b* z% d; e2 a. V A
5 p; W% C; J6 d! J7 V5 G
__________________________________________________________________________
2 g7 [) g @- `# p8 n; x# N8 Q. V
% N: Y, X. V4 @" y. DMethod 11. D9 O9 i5 U% i0 O* o( b5 N" Z8 V
=========
: E$ J9 P: V$ h* {. g! Z8 j0 c0 c8 O& {
This method is most known as 'MeltICE' because it has been freely distributed
( I- M" u5 ^& `. d) d, t+ d# i: rvia www.winfiles.com. However it was first used by NuMega people to allow% l6 x$ n! ^& h3 L6 H) ~
Symbol Loader to check if SoftICE was active or not (the code is located
. q2 u3 E4 l8 w h# O1 i+ ^; w3 minside nmtrans.dll).
2 V, h! {2 H4 [/ Z* C% m4 \# l+ M" [0 \! u6 G) q" i+ \4 m0 T
The way it works is very simple:8 |2 O/ {! _/ j% L; O; E5 N
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for, {2 d. w7 m* g0 w4 R1 M
WinNT) with the CreateFileA API.
1 X2 c. e! |$ I$ u1 Z! I
4 T" C) E: V7 @( R6 fHere is a sample (checking for 'SICE'):
2 L' l0 c; s: I9 Y# N$ K
% D- m8 J/ s QBOOL IsSoftIce95Loaded()
! v# d0 q5 M4 l5 i/ J{0 c& @$ L$ S- V: Z1 c4 S8 }* k
HANDLE hFile; 1 `- e4 q7 y" Z; j- F2 z
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,; `# R3 Q& t; G6 j# Q7 x
FILE_SHARE_READ | FILE_SHARE_WRITE,
X" h$ {8 v0 M( @( y6 ~- v9 o NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);- @, B, M9 x: i8 S3 }. O( l9 c
if( hFile != INVALID_HANDLE_VALUE )
u$ O% a; |; O5 Q2 B7 t {2 h8 K& w E/ e3 V7 Z. b
CloseHandle(hFile);* F$ q3 ]3 D2 S( s# \
return TRUE;
3 \- _( n+ u3 n: Z+ M }4 r; `3 J/ l+ K
return FALSE;9 F2 u2 p# ^4 h+ B& z
}* z* h4 C4 `( k
4 h9 a7 p$ z. g4 i4 t2 w) n
Although this trick calls the CreateFileA function, don't even expect to be
) _: ^! f" [9 z+ l+ ?# l7 q8 pable to intercept it by installing a IFS hook: it will not work, no way!
6 S p, c& l& Q2 w: E# F x6 H0 DIn fact, after the call to CreateFileA it will get through VWIN32 0x001F: j& p4 ]* x* F8 I0 o% e m, v
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
( J' j5 L2 e U0 j: ~3 @1 _and then browse the DDB list until it find the VxD and its DDB_Control_Proc7 K$ o$ i, C, M) Z5 Z: I4 G# a/ g
field.3 u- o8 q3 S# b7 K
In fact, its purpose is not to load/unload VxDs but only to send a
3 w! W& f( x% ]! m @W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
1 W/ p: k4 v9 Yto the VxD Control_Dispatch proc (how the hell a shareware soft could try
J( J% S, d. }" Y S- hto load/unload a non-dynamically loadable driver such as SoftICE ;-)., A. V. V, h) y7 L9 }
If the VxD is loaded, it will always clear eax and the Carry flag to allow
! J0 W$ l$ H A# k9 W7 aits handle to be opened and then, will be detected.
& V% g y7 B$ PYou can check that simply by hooking Winice.exe control proc entry point
8 V* ?% Y6 k$ C# F$ }, e# ]while running MeltICE." \' ^; m6 L8 h: @! |" \5 v) t8 e
2 Y$ L' D: }6 f+ [% R
/ ^" ?/ @ [4 w2 x4 y; h1 j 00401067: push 00402025 ; \\.\SICE
{, U4 I( D3 p9 }4 J0 [; u1 I/ c 0040106C: call CreateFileA! H* G0 i2 P2 y. k9 K+ B- k$ T1 w8 I% ~
00401071: cmp eax,-001$ O5 a" g+ J, v
00401074: je 00401091 w$ n# H9 L. I
( @) E- t5 T. W* ^- L6 ^
* c. n* c+ I: j/ k% r5 CThere could be hundreds of BPX you could use to detect this trick.: f7 P; \- v) P/ E
-The most classical one is:
7 |% o' M1 Y* U6 Z BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
; _) Z7 B! i+ I0 w6 | *(esp->4+4)=='NTIC'% V: Q% j3 G# _
* j) w1 F( \: u( U/ w-The most exotic ones (could be very slooooow :-(1 ?) Z. B/ T! {; S' k, |
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') - a0 K# X8 _" T& u6 f+ u6 ~9 v2 N
;will break 3 times :-(
( @ A( o( {5 T/ }% @
0 B& j2 J e6 e& Q$ a* R8 w-or (a bit) faster: 0 d# Y5 g6 {. D6 Y. a# ?. Z/ K
BPINT 30 if (*edi=='SICE' || *edi=='SIWV') r! y5 M3 x) _# @
' g% B- D8 _5 j9 l
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
% W& g0 t/ p) o( n. W) q ;will break 3 times :-($ x/ \$ V, E+ \$ m0 A
' y- V$ A) h3 G2 v' V- t-Much faster:$ @$ T& f. \' o2 Q, p4 o! O
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
`$ A/ D7 A8 h6 @7 A
- a5 e& X+ n# W" }1 v$ tNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
\& P: ?' o4 F, u* [6 r! [function to do the same job:6 f$ l0 u0 L- R7 [3 D
. G: K" Y" E7 w4 R8 q. y
push 00 ; OF_READ
1 `2 e: ~: Z3 x% Z* y( | mov eax,[00656634] ; '\\.\SICE',0% ]$ t8 R+ x ^3 f$ Y. l
push eax
) O+ Q& g3 S/ A) L" H, E) u call KERNEL32!_lopen
B- K( T" ], ^0 d# K inc eax& I6 Q5 R" O0 d$ y; L' P% a
jnz 00650589 ; detected5 O8 W5 c4 A/ M3 W( d4 |
push 00 ; OF_READ& j1 `9 l5 I& k! A$ `" s* Q6 \
mov eax,[00656638] ; '\\.\SICE': `1 A6 t) ~1 k" _+ m; ~4 ]
push eax3 L* P. {* O# c9 n7 s4 h# y0 L$ [2 K
call KERNEL32!_lopen0 j/ r% U0 x; H/ q2 `' g u! `1 F
inc eax
( G+ q! M' v/ f0 N jz 006505ae ; not detected
( _" U* i1 q: V+ c0 l) `6 `* Z& d& y2 A: X X" q6 f0 e
+ M6 i! G7 t8 N! X9 m. {! i' x
__________________________________________________________________________" W$ x. L: @; A+ p9 x
3 p; X; y% b. o% D/ R4 {Method 12$ Q, u, \8 A& S9 S1 v% d
=========
$ ]! j2 m/ P2 a6 g' y( ]
% T, C5 n& ?3 w+ MThis trick is similar to int41h/4fh Debugger installation check (code 05! V: u& h6 i0 ~# E
& 06) but very limited because it's only available for Win95/98 (not NT)
$ [& K2 N( G8 Q! W8 n* w5 Tas it uses the VxDCall backdoor. This detection was found in Bleem Demo.' `) v a1 L+ D7 d3 \, ^6 p
2 Y% h. v4 I. Z K push 0000004fh ; function 4fh% B! e- k! S4 q' w
push 002a002ah ; high word specifies which VxD (VWIN32)
' G3 T) c0 P; E1 n1 a8 c. r" x ; low word specifies which service
- J; \2 u7 n6 g7 _$ C- u$ | (VWIN32_Int41Dispatch)2 T& {. V5 }' f" y& V0 S3 p) p
call Kernel32!ORD_001 ; VxdCall
5 E& u5 F% z) Z& t# ]5 d* Z# a cmp ax, 0f386h ; magic number returned by system debuggers
H' U4 G; k7 \ jz SoftICE_detected
1 _, W* X! ^; B0 L; ?7 [: r6 I+ ~2 ]" @
Here again, several ways to detect it:
R6 {7 _( L" E# @) n! Q6 y* A1 {4 o% y) b/ }' o
BPINT 41 if ax==4f
$ Z/ P$ L/ |7 p2 v' N) n
% _ r2 f5 c- G0 p6 T" h BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one. g# |8 `' Z" b& G+ ^
- _/ _9 \+ T- M7 A, ? BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
! O% Z9 ~1 \5 m. L1 s3 D, C, b% v9 e \) D6 Z# R
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!" k: R! A: x3 o- w
0 q s8 l5 o7 d4 d% T__________________________________________________________________________
7 q/ D" y4 }9 C3 Q4 k
$ ~8 Z2 H6 T5 o) _9 }, o1 rMethod 13
0 r* |# N- j* G. o# `' l=========
2 T/ L! B8 Q, m) ~6 c' W; g
* [- N; |% ~( z# ~Not a real method of detection, but a good way to know if SoftICE is1 S' C2 i, |0 T# c8 S% t' a
installed on a computer and to locate its installation directory.
9 w) ?; {. Y9 H; D2 g6 M* z+ `' p1 DIt is used by few softs which access the following registry keys (usually #2) :
' s6 W2 ~7 b5 Z+ i& }3 E: q% _: n7 O2 i, @* ~6 v5 K) C
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
# G9 W7 H( l2 D/ L1 ~/ \\Uninstall\SoftICE
" I$ R% u( }) F& {6 f-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
' q" r6 `% w! u5 d' v-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
) H& u* s8 _( l/ u1 k\App Paths\Loader32.Exe! f2 c% n& t+ L1 A2 j
R- G: ^8 L- Y) @' }1 F& J0 w; C
* k" q2 Y+ G! zNote that some nasty apps could then erase all files from SoftICE directory8 Z7 |; K8 g; d, N, j9 s
(I faced that once :-(
3 I+ J# ]6 o# O1 X$ p0 v. r' A! s1 }+ y7 b: f# s
Useful breakpoint to detect it:
& ?' K+ A# n* j( `7 E- Q1 i0 R% H- h8 j8 }5 x
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'& Z( b" f+ T* r# p, r
* o/ m- S: }% E; d# q {__________________________________________________________________________' H @& q8 \" h/ Z: \
) m M3 J0 r$ Z" z, ?& b: y
) j8 y. v' D% r+ ~5 B
Method 14 ; ^" A0 |* G* y2 L# R
=========/ R1 v0 W `$ C Q! |. a/ J5 }
- E/ C1 y8 d! U+ i& C( C
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
$ n* Y8 U$ v$ t2 R* u6 ]1 c0 kis to determines whether a debugger is running on your system (ring0 only).
8 |& J5 }; i3 p
+ j* j n- X( A; ^ VMMCall Test_Debug_Installed: P8 n8 p) c1 q5 i/ y3 c# e
je not_installed
- ?5 `2 R7 ^+ p
$ h" E6 R* h! A: u4 w4 g+ L! v- r0 `" @This service just checks a flag.
/ _# E' ^& Q* x0 u</PRE></TD></TR></TBODY></TABLE> |