<TABLE width=500>
/ p$ S" O- {- Y<TBODY>
) e; { |& Z$ h$ X' B7 X' |5 R8 ?6 V<TR>
+ y. e2 H7 |1 C0 @<TD><PRE>Method 01
& i& h# [* I* F8 F: N=========
' a7 z! c4 \% I( L+ O. t" [" h: {1 q" L3 }8 `: ~4 B
This method of detection of SoftICE (as well as the following one) is
4 N* ^, ]7 E" M" O" X" Iused by the majority of packers/encryptors found on Internet.
- V/ m8 o4 ^$ ?% uIt seeks the signature of BoundsChecker in SoftICE3 S8 @- ]2 c7 O) f5 U5 L' g
1 q) E8 a7 t+ \- [% n$ {2 w! ~
mov ebp, 04243484Bh ; 'BCHK'
# B: r( k; R* W6 \1 I( K2 F1 | mov ax, 04h; ]5 s. O, ]7 D
int 3 3 e, G* B* q# y, Y
cmp al,4
) W! N; \/ X; T: E( f jnz SoftICE_Detected
2 I' _8 A3 Q! a9 P1 F& A: Z& `! u$ ]9 b% X
___________________________________________________________________________8 }* J. m5 C3 [6 l+ I* w# @" s
0 L1 O, K3 P! s, _Method 02* y/ [& ?3 y7 m
=========! N) R! X& R+ N1 Q" _
; a4 M a( G; n: A; B& eStill a method very much used (perhaps the most frequent one). It is used: N+ k# H' |% P4 e
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,% i; t \3 ~$ J: N. `7 P2 \1 k
or execute SoftICE commands...
9 U- G) j3 s8 ]- _2 gIt is also used to crash SoftICE and to force it to execute any commands2 H* e8 o* w# Z( W
(HBOOT...) :-(( # x% ]1 M& |" }6 P' V, I1 ~
7 Q6 h. {7 z ]6 ]! gHere is a quick description:/ U* k: A0 D; Q0 A/ R
-AX = 0910h (Display string in SIce windows)
2 C, C" P" Q% K-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
/ M0 c) ]. O6 F9 S0 p-AX = 0912h (Get breakpoint infos)
) V( |, U. ~8 t-AX = 0913h (Set Sice breakpoints)
5 o4 w, Z( F! F3 n-AX = 0914h (Remove SIce breakoints), R! z; t: g/ ~8 ]
7 G& [6 t' l" {) @# e, ^Each time you'll meet this trick, you'll see:
4 F/ H; J! P+ V-SI = 4647h
/ P( f! m; z( H! Y0 r-DI = 4A4Dh/ g6 W) `) N, j! U9 ~) e h* d0 z
Which are the 'magic values' used by SoftIce.
1 Y; x& e3 P& n$ I2 BFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.1 e$ \/ d. G: v! h9 B0 T, e$ g4 E% p: G
& N$ w! @* `2 S' }# `+ u4 A
Here is one example from the file "Haspinst.exe" which is the dongle HASP
4 G% a3 v5 `. P+ c5 p* [Envelope utility use to protect DOS applications:
0 o3 n3 M5 s/ K% B1 u+ r/ d8 C: `; [+ z; `* x
0 \: G; E4 v. S% s" T/ N
4C19:0095 MOV AX,0911 ; execute command.
& o( Y6 C6 F: p4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).4 W& i' q$ y; I( z; A, S
4C19:009A MOV SI,4647 ; 1st magic value.$ z: j: K5 p) N7 a1 P0 l2 [
4C19:009D MOV DI,4A4D ; 2nd magic value.1 K- |% D$ P; |- `2 v' Z1 R# K
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)5 w; a+ Z3 u% h
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute/ Q% V- d4 k# _% ]
4C19:00A4 INC CX+ W- D$ m$ r; j" S' |% w: H
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute! x; w R+ @: U
4C19:00A8 JB 0095 ; 6 different commands.' n D) q/ C. Z; \3 s
4C19:00AA JMP 0002 ; Bad_Guy jmp back.
/ p/ \7 c! \) }/ O) m% T4C19:00AD MOV BX,SP ; Good_Guy go ahead :)' q) V6 ? Z) B( [( S* l" b
0 P, f& f7 h2 R( C0 a' D( ^
The program will execute 6 different SIce commands located at ds:dx, which& s4 |$ P* S" S6 g) p( x) E
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.! ^7 x1 h q0 I
& a: T) }! C# O# `& \) H* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
0 A0 o2 O9 n) `( b2 ____________________________________________________________________________
) q7 B. G7 a7 F6 W. }+ p1 s; ^: ?/ d5 r, m) Y2 W' f; l
# \+ [! g6 X' s$ t8 WMethod 03
$ o: X8 s! ?8 d& }3 ^+ y% L# m=========+ e2 m5 U$ i: D5 |7 H+ C
: W+ V( g* d! d& P7 A x
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h* V+ \+ d: i- l( M. H
(API Get entry point)" K4 k1 V1 g, W6 P+ F2 M
8 N* Q- J7 ~1 r y
! y% s/ p" L' L8 q xor di,di E) P9 _% H6 H5 |5 e
mov es,di
. B' O; \+ ?( @2 ?6 ? mov ax, 1684h 5 \5 j; K \2 g( G
mov bx, 0202h ; VxD ID of winice9 r, K: X1 y% L% C1 Y% C! B
int 2Fh: e; j- p/ ?4 N: E/ @
mov ax, es ; ES:DI -> VxD API entry point6 d2 `9 J; D+ q
add ax, di
6 {$ Q0 v: Y6 ?, r test ax,ax6 f& y/ E* G7 M; d0 c6 o
jnz SoftICE_Detected
; G" W+ U6 r* |- Y* k1 |, L' }4 x' K0 Z* Z* q
___________________________________________________________________________+ j( f! ^$ x! p3 V7 t
/ M' U+ z/ h6 K" y' N4 HMethod 04 u3 ^) ], X8 a: H- t3 q
=========- k9 M. g0 ~* Q# t; t
$ W2 A$ ~- m7 _' JMethod identical to the preceding one except that it seeks the ID of SoftICE0 o0 O( u) k( A# g$ s
GFX VxD.
1 [1 c; b3 l5 U1 N5 \' u) A j, H* E8 R( o& b" F! P. G
xor di,di2 `& O( \- n4 a9 r; {& P2 q
mov es,di1 n$ l% s% W; i6 _' @) s# v3 u
mov ax, 1684h 7 A0 ~* x9 m1 }, W/ i- f/ f. O# Q! n" I
mov bx, 7a5Fh ; VxD ID of SIWVID0 u& U& w$ C/ P3 C2 l0 k1 r
int 2fh, Z6 s" r7 V: [4 \5 H
mov ax, es ; ES:DI -> VxD API entry point
$ j! M" v2 v! c+ ~# S/ u* d P add ax, di. s' m1 c9 [* @! m& G( t
test ax,ax( n2 K+ R* |3 M) d
jnz SoftICE_Detected5 r4 i' h8 V0 @% Z
( Y6 X9 \% g# |5 g- w__________________________________________________________________________7 T- h2 K/ X/ U4 S
) H9 N5 \/ c5 w( U$ b4 h; q. K) Q7 I+ A, p" k
Method 05
! Z3 u! Y, F$ O: O4 c=========
& j5 n' E$ y" O* e7 ]! p9 ?& Z6 s$ O1 d
% x* ~- y* i V$ Q! C3 dMethod seeking the 'magic number' 0F386h returned (in ax) by all system% r7 T+ `6 v7 j. N y; P0 _3 z( M
debugger. It calls the int 41h, function 4Fh.3 C! W0 N/ i3 O% r
There are several alternatives. ! U, E2 l' P7 A( Z0 d- a8 K
: x9 n0 W% ?0 c$ I0 x) `2 t$ l1 H4 P
The following one is the simplest:$ P: b6 a0 I5 [' ^4 T
2 P7 X4 y5 l: I mov ax,4fh
3 I' R/ A" x G1 H0 X p, e int 41h
, R- `& H/ Q3 K' k cmp ax, 0F386
% n: y Z6 `& o; b1 ] jz SoftICE_detected
- z+ S( D, c: t2 y5 S
% ? J3 [/ d* _2 }$ `
0 {" j# I, t7 G. Z8 N- P$ s5 zNext method as well as the following one are 2 examples from Stone's
% @; G% c5 y# ["stn-wid.zip" (www.cracking.net):
" G5 Z! X. m4 W+ @5 |; n1 c% \( Z: @
mov bx, cs
8 J# |+ V6 S" \9 Q c lea dx, int41handler2
4 J$ A- C) @* H" T xchg dx, es:[41h*4]5 ~- M7 I+ o# g$ V! v) z
xchg bx, es:[41h*4+2]$ S$ M4 T8 k* M1 ^; h, T
mov ax,4fh. }7 ]! B3 U: b9 X0 V
int 41h2 U V, w0 l2 a2 l' o" m
xchg dx, es:[41h*4]7 W' s5 J5 n$ r
xchg bx, es:[41h*4+2]
& z% R# @3 x. f$ x: ^( Z! g cmp ax, 0f386h
9 u l* G- U3 ?4 V, k+ o+ Z jz SoftICE_detected' z' {# o% y- J+ |9 q
) ?) v6 m0 O1 s8 P. J
int41handler2 PROC2 v3 s0 ?0 E1 l1 B
iret1 ^- I* V8 ^2 U9 C
int41handler2 ENDP( k: F5 a* D) a+ n
4 ]; U& q/ m! o' _- W& b" ~
* c# o7 f& ?; d: R# \5 O
_________________________________________________________________________
. z1 B/ j" J, I- q% H
$ F$ b( k* Z+ [2 O9 ]9 c* S* ~* [% X* w5 d. R, r7 q
Method 06
' G- T* m& `# l2 n4 N% Z=========
. S& s$ {- B: }+ J2 w, ^( v H T% }9 \
: v1 q7 |8 ]& b7 c% ^8 C2nd method similar to the preceding one but more difficult to detect:
! y! l8 J. l/ B0 Z$ U
$ z2 W+ ]- V; k8 e! }9 _4 x4 S- G# j* \/ m
int41handler PROC% s* R4 q4 E3 |$ h' g; [
mov cl,al6 G) @5 z$ K3 A% H+ {' X% v
iret: f& d% e/ n% X5 y8 ^5 {# y/ H
int41handler ENDP* n/ ]3 E8 C' i
8 l6 F7 w4 S, P
8 W" b7 d( I) m xor ax,ax
! E8 b( Y5 y, s; M! I: U3 x0 h mov es,ax4 n" k+ q x. N
mov bx, cs1 D9 H4 O+ u3 Q5 l5 i
lea dx, int41handler
- W3 ^* I, _7 Z: q( k; P& m xchg dx, es:[41h*4]
' n. ^! o2 C c xchg bx, es:[41h*4+2]' k5 f7 o, N% X. v8 W# @( i
in al, 40h
% K! Q& }1 `. s* \4 I& y xor cx,cx
, N. |2 U* ^6 x; `, ^ int 41h
. O6 R% i- `; h% E9 p& F: N xchg dx, es:[41h*4]% M. d0 h0 I* y R, f3 x! d, j
xchg bx, es:[41h*4+2] @: w" M# Q+ I1 {: y) v+ _
cmp cl,al k0 ^5 G @; x- }/ Y
jnz SoftICE_detected6 [' ?, u; l O! m
7 D$ a" \9 _% }+ s3 `- d
_________________________________________________________________________
. d" |/ o% ]: V4 u4 P z: Z2 y
. {" ?$ @0 J8 HMethod 07
' O7 j: J- S% L% C, p=========( @! Z& S2 w6 F$ m
1 r5 L& S7 T2 X
Method of detection of the WinICE handler in the int68h (V86)
5 [# p \: j: `# @: t7 x% K% T, n+ z F8 `1 B4 M2 s
mov ah,43h
4 i; V6 K ~# | int 68h4 X2 a Q3 L% o6 u
cmp ax,0F386h/ @- z3 f2 o; f. Y
jz SoftICE_Detected6 S7 h( h# Q, k# G( b
1 g0 J/ l5 w6 ]: j* Z
; L4 O3 X; }3 O
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
7 m2 ~2 l, B9 [ t1 u" z9 t0 m app like this:
. [; y& M( i4 c0 Z+ d2 b( R) _
! K; @7 P# J$ \& b# g9 w BPX exec_int if ax==68& W; D$ Y9 e& x2 D& y/ {$ h
(function called is located at byte ptr [ebp+1Dh] and client eip is
3 K) T$ b: B5 }' H located at [ebp+48h] for 32Bit apps)
; K4 u# l; @: ~ D__________________________________________________________________________2 x, V U+ w, A/ F- d& P
9 I1 J5 m3 ~6 f$ C! y: u7 F5 w
* k- k5 M6 h& c" W# J& [ }Method 08( @) f' x4 b' t0 x7 I& }3 w! @
=========
! C; u o2 l& c- p: T {8 n& x7 u* k
It is not a method of detection of SoftICE but a possibility to crash the; R5 m3 X. d0 c' n3 y r
system by intercepting int 01h and int 03h and redirecting them to another. i4 ^8 X& `* ?/ Q' M. n0 F
routine.
% Y7 @) x; d- V3 Y/ @2 f% {/ V' wIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points. m0 l! J& K. r0 h2 D, E9 j6 L, ]
to the new routine to execute (hangs computer...)" s6 s$ _$ H% a2 c1 Z2 t" q" t9 E- G
- t) ~1 u9 J0 N5 W9 X# p D
mov ah, 25h( M/ }0 r1 ]5 ^+ H
mov al, Int_Number (01h or 03h)4 U% o1 e7 ?8 Y: x
mov dx, offset New_Int_Routine
* h6 o9 ]" n$ q' ^ int 21h
+ H3 i* ]' g% X& R: v' R: H
$ g$ Q1 d/ R- Q8 C2 w$ S$ I$ Y__________________________________________________________________________
- h3 X( C" A& b) [: |9 Q1 m- u" A' _1 i( J* X+ c+ t+ p3 ]) o
Method 09$ o: m5 j0 {: d: x
=========
" }* h& [0 Z+ M+ L& V+ Q( @$ O$ m) N5 m1 j8 C
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
6 u( |1 s; J1 a# I5 p& S$ Dperformed in ring0 (VxD or a ring3 app using the VxdCall).) `# D& d: Y0 g P }0 X" L# k
The Get_DDB service is used to determine whether or not a VxD is installed0 n3 w- `$ S" n6 M# K% S# ] C# M
for the specified device and returns a Device Description Block (in ecx) for
; K+ H. T& i. @' _# M/ z' \- [" Cthat device if it is installed.3 l0 B8 i5 h: }' q. ?
) ?8 U+ l5 J. \5 n7 ~
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID" }: m: u7 ^3 I
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
% S/ n9 I6 k# z VMMCall Get_DDB. s# P% F, B9 K6 m% f4 V
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
$ n- x5 Y4 S k' t; E$ \1 b7 i, g" X/ ^' ~. H$ f" l
Note as well that you can easily detect this method with SoftICE:
( y% _) H( t7 J3 L \5 y bpx Get_DDB if ax==0202 || ax==7a5fh
/ Y6 V& |* D7 t9 D. U6 o8 s. X! R, Q* i# @3 M
__________________________________________________________________________
3 C% F7 t' y4 g
/ G5 [' N& L8 ~8 R% w) S. ^$ T4 P3 {Method 10
0 q# w8 b# T1 {8 ?=========2 ^7 e( z: p: }" o! x2 f" f4 @
" b; H" b/ s2 p$ |5 p8 e5 Z
=>Disable or clear breakpoints before using this feature. DO NOT trace with% |. g6 p G0 _5 @8 b+ ^0 Q
SoftICE while the option is enable!!
8 T& \, H- z" [; A$ f9 U9 l7 C; c: K8 A% K1 s h9 D
This trick is very efficient:/ @& @0 Z- z; F' q1 m5 _* C
by checking the Debug Registers, you can detect if SoftICE is loaded
! |, N5 \7 \( Z3 p/ J% {& u(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
/ }1 N+ K2 |2 x/ K2 _there are some memory breakpoints set (dr0 to dr3) simply by reading their% S; l/ N, r% Z- h/ v
value (in ring0 only). Values can be manipulated and or changed as well" g/ @% n0 t2 V" ]* h% f
(clearing BPMs for instance)7 x. L* I# @, K' `2 f+ i
7 Y( o* d: M: m8 E+ m0 i7 ?
__________________________________________________________________________% K. i% U5 c! i, S
7 M! o8 N6 [4 Q/ b$ E" X* {Method 11& V V: K; \# x, E; ~# _
=========
0 s3 s$ q% W% w* k' w# E2 ?8 P( G1 e. ^* q) j$ D5 ^8 n( t
This method is most known as 'MeltICE' because it has been freely distributed' N' Z2 Z! P: k
via www.winfiles.com. However it was first used by NuMega people to allow
7 @4 B9 U/ f w m' Y9 f# r" fSymbol Loader to check if SoftICE was active or not (the code is located+ z( {4 L# p: H
inside nmtrans.dll).+ c+ ~6 R- h" r- }2 S. j8 d$ N
A" K" {/ l0 E! _
The way it works is very simple:
! H5 O7 A0 X# {$ B. AIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for# V# q( X% I. g# z4 ]
WinNT) with the CreateFileA API.' t, P; j; E' t- O7 U: T. M5 d
( v, n% p9 Y, R8 o- x
Here is a sample (checking for 'SICE'):
* ^- i8 d% O* ?; g* _& R: _* B$ {3 P* q$ t) F: J! ~
BOOL IsSoftIce95Loaded()! j, Z! g$ E$ u5 N
{
( H3 z& d4 ?. `4 r! y; Y: i HANDLE hFile;
9 H# H9 i$ G* T/ K7 o hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
9 x7 M/ f" V( B; T FILE_SHARE_READ | FILE_SHARE_WRITE,( @3 X4 s" I# F/ |
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
5 j2 F$ t" @9 {0 z* {2 | if( hFile != INVALID_HANDLE_VALUE )3 C }* O, S9 V& q) d
{% C' A% x" w# A$ Z/ e* ^; ^
CloseHandle(hFile);/ y" B! ]' }! D, Q9 |1 n+ V
return TRUE;
! [2 i3 `/ _: I }" a; j& w: C0 u7 O/ q0 `
return FALSE;
6 j; V {7 q: r' x* @}3 s# ]5 l. ~! Z1 ^( o4 q R
# U$ y* I& z/ x/ B
Although this trick calls the CreateFileA function, don't even expect to be
, X5 }7 \1 K3 x8 N6 w' ~able to intercept it by installing a IFS hook: it will not work, no way!
2 q' k+ r6 _6 U% ~/ pIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
+ K0 ~4 o2 K1 cservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function): I/ f$ v9 c+ C+ m
and then browse the DDB list until it find the VxD and its DDB_Control_Proc* u2 h( K% e) D" \# w
field.
: s- i! r" g. L# fIn fact, its purpose is not to load/unload VxDs but only to send a % S- Y$ c( c" |3 G2 z
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
. _& v. e {; D: T$ K7 f8 pto the VxD Control_Dispatch proc (how the hell a shareware soft could try
1 y& U/ Y' @# Q% W& ]to load/unload a non-dynamically loadable driver such as SoftICE ;-).
5 l h k% i; m& D6 r! I, cIf the VxD is loaded, it will always clear eax and the Carry flag to allow( A8 f g' x& w. Z% U7 X- P
its handle to be opened and then, will be detected.
: d* c. q0 J; m3 p) a1 QYou can check that simply by hooking Winice.exe control proc entry point
& o2 B2 m! a* \. F' `while running MeltICE.9 _6 ?, i- N1 J* h0 j& s" |
+ n$ p2 p- ?) e% U
& S F1 X$ ^$ p' ~- l) O0 r/ v5 _ 00401067: push 00402025 ; \\.\SICE7 y: v) [9 z6 N3 I7 S8 q
0040106C: call CreateFileA! k" t. o" t% N+ c* a" P
00401071: cmp eax,-001
' p% p( d+ M) L" P' `5 [- v: v 00401074: je 00401091" T: M# }/ V, i/ n4 Y# W
9 T9 [; J. P$ i7 ^" c* d8 K; f; G% u: |
There could be hundreds of BPX you could use to detect this trick.8 l/ {6 R( r1 s9 ^
-The most classical one is:
- _$ {1 q7 E' K1 x' q5 w BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
1 P- V! C0 `% A9 v; H/ L7 i' F *(esp->4+4)=='NTIC'+ `3 X; \2 o8 R
* v: `0 O- p! x$ B$ k0 O
-The most exotic ones (could be very slooooow :-(
0 [7 p; }) J: F! z BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') 8 x0 \; {, B% Y+ E- `; O* i2 [
;will break 3 times :-(8 S. w$ T: x. C$ f8 f
3 J) M* N# y2 w; [-or (a bit) faster: 1 B4 \! A/ r% \2 N
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')' W. \- m. i: { y1 C" F/ o# q
' ]/ H- g4 A# D2 b# J
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
( N; j0 N2 [8 \. u- W ;will break 3 times :-(6 o) B3 g% O! i
7 A: V7 V# b1 N: n-Much faster:
+ m) g$ @! U; O! s1 \0 @! m( c' } BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'0 B3 D% D( v0 B r
7 W8 O; l; p& V* c9 o, l
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen0 j. b# b: e9 |" q
function to do the same job:2 U. [9 ]. D6 C$ o) h) {) o
" u5 B8 q2 E2 ^' w+ N
push 00 ; OF_READ4 O5 U- a& ?$ q, J% |$ L! z
mov eax,[00656634] ; '\\.\SICE',0
$ C3 F' g" @( M& p) p/ [ push eax3 v2 w$ R7 r1 ]' ]
call KERNEL32!_lopen
R, Q" a- r& o$ L& c inc eax% u/ N% G2 u" g( C
jnz 00650589 ; detected
' x" E3 Q; d8 W& v ~ push 00 ; OF_READ
. M5 c. e( l% ?% {) n0 N8 Q8 P mov eax,[00656638] ; '\\.\SICE'
' ]2 Y- w8 V3 I, s' j, x& C push eax: H$ o" d2 G( {5 o9 O
call KERNEL32!_lopen
9 z1 E4 ]: g$ O8 S inc eax# H; X9 r* a, O8 V" H9 {
jz 006505ae ; not detected1 M7 U4 d$ \; W! d. M4 B
3 i; b* \! Y3 V0 `0 y6 _2 J$ T6 _) O( f. a& }% d
__________________________________________________________________________2 r$ p2 @/ Q4 a" T5 X
9 X. v# q1 u8 ]4 B9 W# ]5 V% qMethod 127 q1 D d1 {# l
=========4 M1 n c! d* G4 f2 a8 {1 j T! q& W- X
Y6 ~. I4 x$ G( e. v, p
This trick is similar to int41h/4fh Debugger installation check (code 056 b2 L2 g+ _ l& l/ i7 N% S+ Z% L3 M
& 06) but very limited because it's only available for Win95/98 (not NT)* p% P* i. a! b/ u# g/ Z; ~
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
8 M' d H5 V/ h" [
, d: x3 ^) F# x; ]) w+ D- O4 Q2 E push 0000004fh ; function 4fh8 u! O) u0 s4 @, E( q z5 e) j
push 002a002ah ; high word specifies which VxD (VWIN32)
# }) k/ ~* H8 v: F0 S ; low word specifies which service+ Y8 b" V5 A8 [0 G( E( f8 k
(VWIN32_Int41Dispatch)
" i+ o$ n9 [5 P+ r6 z. z7 s call Kernel32!ORD_001 ; VxdCall
* _1 ?' a+ B! ]3 r n cmp ax, 0f386h ; magic number returned by system debuggers
( _. x& c4 R; |; s) n jz SoftICE_detected5 T# ^' R- R( G2 s
6 m1 P% c0 d5 s: V" q
Here again, several ways to detect it:
2 u! x9 ^6 L9 ^- Q
( f. [& O/ u* d0 ~& _ BPINT 41 if ax==4f" d7 x/ T& _- W0 N1 G+ Q! R; R
. A2 A: @+ S& \6 n) S- P) W
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
N1 U; ^" G! u5 E3 u
. R- U1 S$ ~4 I4 c/ F BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A+ z; b' Z0 K7 y
# w+ t$ k1 { {9 E! b8 I/ l BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!; E% P! `- J; I7 m2 m
6 ~) g. |$ @; Y3 d! x% }
__________________________________________________________________________
6 k/ Q1 S( `5 F- z9 Q% J3 @6 C F( l
`# B0 \; O- \+ F( [! P1 ^+ bMethod 13
1 H( z9 q- T- V1 O=========
: E1 V$ V9 t8 ~9 D) `' M+ e- W% S* O4 x
Not a real method of detection, but a good way to know if SoftICE is
6 Y2 r6 n* `+ i$ O* oinstalled on a computer and to locate its installation directory.
o# g6 J& C$ j) c: DIt is used by few softs which access the following registry keys (usually #2) :8 C, i2 V7 ]( T7 A% Y& ?
" m2 g' e; R' Q; X
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
" C8 |% M, I; w6 N5 d\Uninstall\SoftICE
0 J2 p" o& A' i9 _-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE) t3 H$ Y: F3 V) J$ Z; D
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
( g1 B. m6 p* J\App Paths\Loader32.Exe0 D. w' ?" H# j9 Q! U
4 ^5 }4 T- B# w) G
5 I/ N5 T( F8 _( i, hNote that some nasty apps could then erase all files from SoftICE directory
) X- u" X) D! n3 d: b(I faced that once :-(' f0 ?! ?. y* y2 s* e- ~/ Z
; T) s$ v' U5 X' H5 GUseful breakpoint to detect it:
( W7 t: s; v6 F. M4 H8 _+ o* Y" d4 R
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
4 D, J, Q; I6 G7 w( u: {0 {( q+ e' P$ W
& e! Y g8 v3 d% D; S3 ^: r. D__________________________________________________________________________
' {! r( w U) z+ \9 |+ U" I3 V+ g2 u' B2 v
1 i9 F; ?7 F/ C: o4 V+ E/ l, Q5 |
Method 14 6 [9 P5 Q* E- g1 n( s! e
=========
1 l+ P7 L4 q+ S2 |% w5 c. q+ q* k6 n3 _1 |, E' \6 X
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
: l% D+ j* |. T) P7 bis to determines whether a debugger is running on your system (ring0 only).0 A6 h1 ^; U7 p$ x$ u3 m
9 s; U; z. h% q- c5 n1 E8 c VMMCall Test_Debug_Installed. A5 \9 F+ A/ F! o/ S
je not_installed* s& e+ {% I' m, }3 l/ n/ h0 n
7 B1 ~ ?6 ]/ |* d+ ~
This service just checks a flag.+ ^5 s w$ I% Z9 I$ D
</PRE></TD></TR></TBODY></TABLE> |