<TABLE width=500>6 X: P# b+ m6 y! ~
<TBODY>
: s# u H6 |+ c<TR>
- T, W" V$ ?$ M n<TD><PRE>Method 01 & @% C. E F/ `. b1 q2 F
=========3 a5 U# B) ^1 Y+ b; u, b
% p9 D5 ~ M) R1 F+ f* QThis method of detection of SoftICE (as well as the following one) is1 @4 T! c! O" \: X
used by the majority of packers/encryptors found on Internet.
$ C& Z; F! p( c; o9 m# G' JIt seeks the signature of BoundsChecker in SoftICE
) P( l L( a2 M1 H3 M1 \; y2 d7 h: U$ l0 G) J, X7 h2 V+ K0 o
mov ebp, 04243484Bh ; 'BCHK' T- `% f0 f. I. G. D- Z$ `8 f' i
mov ax, 04h
% R4 |3 g( `. |. i) h, | int 3
, \$ ]0 c" K0 D w# q4 j cmp al,4: P* G' J6 p, n
jnz SoftICE_Detected' s, t' b! f) s Q( _( n
0 m3 \4 e9 I# e: ^" ]1 S
___________________________________________________________________________7 \: U5 N# P4 v3 o1 J
( \# L+ A0 E" P6 z$ ^/ R7 ?
Method 02
- I. e/ Q" d7 Y2 Z9 b# D=========
* l% G! ~$ k3 U8 \# f5 V" F9 h! h1 `) F: O5 L" }" ?
Still a method very much used (perhaps the most frequent one). It is used
# b2 l7 o. \9 C" qto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
* b6 d. ]$ S! G( u7 P- gor execute SoftICE commands...
- ^$ }# t4 M1 V( C) S6 K$ |It is also used to crash SoftICE and to force it to execute any commands/ b( B2 n0 y( O$ J. b
(HBOOT...) :-((
6 c- b2 g* v. _0 L
7 w9 H+ A2 a1 Z& x* i: {Here is a quick description:2 q) y( d/ w9 z+ R' \
-AX = 0910h (Display string in SIce windows)1 o& Y7 K3 p; }, a+ j. f
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)* v$ j+ [) w' L( X# K( j0 r; L, M2 B
-AX = 0912h (Get breakpoint infos)& r$ s7 z s+ y$ y. R4 j7 W
-AX = 0913h (Set Sice breakpoints)& ^5 T B2 B9 U- Y8 m+ b
-AX = 0914h (Remove SIce breakoints); Y" ?7 U4 K3 `; N; f
' \. O. R/ d# ^: X4 ] dEach time you'll meet this trick, you'll see:4 E) v+ R8 ^1 [& m# s7 q7 R
-SI = 4647h
6 T# [' V* |1 ?& |5 r-DI = 4A4Dh, E- D) U7 @* n7 s9 P( L. Z
Which are the 'magic values' used by SoftIce.6 ?; K0 J% N# }- q/ p
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
+ @2 X, q2 N$ Q
2 |$ u1 h, V8 o Q6 d( DHere is one example from the file "Haspinst.exe" which is the dongle HASP# p: g* \6 j4 A7 r5 o- c
Envelope utility use to protect DOS applications:
) z% d& y+ k& W) a$ c. L2 q% e9 R9 H0 c$ a8 C
# q) }; _2 e" j0 m4C19:0095 MOV AX,0911 ; execute command.
3 v% D5 c9 `% v1 Z0 B& a1 \$ s4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
" T7 i0 f1 C8 T9 Z3 v" V4C19:009A MOV SI,4647 ; 1st magic value.
4 E. |" |/ Z: T7 A/ [7 k+ @# v5 F4C19:009D MOV DI,4A4D ; 2nd magic value.8 J( Y: d2 k+ U. N
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
( O% A$ }* H7 D) H8 W1 V8 F1 B4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute7 `6 R" \' ~" w" K) Z) d" O
4C19:00A4 INC CX& n( m' s+ F1 k6 V4 M( \
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute1 Y5 L7 v1 ^5 @' \5 B
4C19:00A8 JB 0095 ; 6 different commands.
( ?! J0 \3 O! u" E% K; d5 P4C19:00AA JMP 0002 ; Bad_Guy jmp back.* v0 j& s- \( e: H, z+ O5 f6 F
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
4 |, {4 M7 T9 ?% T4 K, _
" d" _+ x( r- G; xThe program will execute 6 different SIce commands located at ds:dx, which
' ?- o K9 g8 L7 T4 Ware: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
9 l) l2 z5 I+ x2 K- L R( ]* G$ F1 ^9 y. k+ j* E3 U- Z
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.# t) M. u5 J3 q( H) ~2 [) K
___________________________________________________________________________2 J% K) ^7 X H8 e3 a
! r: A. G( U _& Y @
' K5 R4 L) l- R6 N* e! gMethod 03
( m) y# s/ v7 {. }: }5 H=========
" q2 f" ~' ~0 y. Y* t& u- \+ P" e7 l5 r4 _7 H9 B! G* @
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
! R4 [5 j; b$ I4 W6 c) ]) H(API Get entry point): J( l& d2 N% ]$ `5 @! a
1 O+ Q' ^% R; a# |2 P" I. {, B$ j z: c( \- l0 I
xor di,di) |! y, S1 f3 s) A8 I% j3 [) U9 R3 `
mov es,di% S; _/ y! l! u1 s5 c' d2 [$ i; H
mov ax, 1684h
8 ~6 d% Q0 _3 f, g# } e mov bx, 0202h ; VxD ID of winice
% k" i+ W% I A7 S) F: v int 2Fh
3 I6 b3 \9 T! j C+ ~. Q mov ax, es ; ES:DI -> VxD API entry point
* K& E1 p, B. z8 e' H ] add ax, di
/ W" I1 ?* [- L* v2 b test ax,ax# I* k1 J$ r( c
jnz SoftICE_Detected
" ~+ C1 h8 Y7 j* `7 ~1 y; @2 D) A# w" x" c4 ^4 T9 f# r- R
___________________________________________________________________________* O9 k/ V x( v: }. ~0 c9 p- |
) F" Y; z/ }+ t% m( {6 ?
Method 049 o6 e- j- S6 j! `( ?
=========
0 W( |- t: C+ L, w* X! |$ p% |% z
Method identical to the preceding one except that it seeks the ID of SoftICE# n* F' |3 [! W* a8 L8 N
GFX VxD.
; [) f4 u4 E% F2 y
- H- }8 e) P. m3 K* n& o0 _ xor di,di
( Q/ A, X+ M6 T' D mov es,di9 G* }; A* w6 `7 B! j5 H- B$ ?
mov ax, 1684h ; i, E- {3 w* Q- G7 o; ]; t% p* S
mov bx, 7a5Fh ; VxD ID of SIWVID$ x3 F5 r, E" O, X% ]) y" o
int 2fh6 g% A- j0 h* X9 b
mov ax, es ; ES:DI -> VxD API entry point
0 }( W P/ ~, F% K" M C) O add ax, di
' [' n4 L6 r% x9 F" M test ax,ax" Q- Z1 e( t7 f7 f7 t
jnz SoftICE_Detected
) T+ L+ @6 X2 t
3 W; ?) l; k' s; H. ]/ r5 u__________________________________________________________________________5 X) W0 X- p4 b/ Z
2 Q, p$ e( \5 N/ W; }
( G4 {; n: r6 a; Y9 A* G. E/ ? zMethod 05! x; k& C2 j9 c
=========
( f9 Q6 c& J7 I0 x6 `1 g0 r3 u: i. I+ L& ?6 `" j$ X3 v& k. A/ h& r
Method seeking the 'magic number' 0F386h returned (in ax) by all system" ]7 K* g$ j0 v" d& ]' d
debugger. It calls the int 41h, function 4Fh.
. |1 P- X5 G/ L) @: ^3 C* G6 A8 n5 qThere are several alternatives. 5 h/ ?: K Y6 @ w* x$ ]0 Q
" d" [) T" [) E& @, Z% W# J" XThe following one is the simplest:# }- M0 k$ |# U! U
; D- C, m# o3 c- {; P& V; D
mov ax,4fh7 y# W4 N: o$ y0 ?$ x* K+ A) N) E j
int 41h
% q$ ^' ^9 U+ c4 n cmp ax, 0F386" ?7 \7 I. j, e& O0 z: s! g0 O- i
jz SoftICE_detected
/ \! |! y# ^: r* U' X
6 O$ E* C3 D) s! [
$ v% {/ Y& j n' I9 r8 Y* t5 b8 u% SNext method as well as the following one are 2 examples from Stone's
$ N6 X( P' W1 o7 t1 K( v"stn-wid.zip" (www.cracking.net):
# R' A! Q: u. U) z1 l, P* v2 B3 F
( T2 w3 l2 c, l) _) X" L mov bx, cs. k H; i0 C8 q8 x$ i8 V
lea dx, int41handler2! U) {" |! r4 O# ?% M9 E' j. V
xchg dx, es:[41h*4]+ M* T1 D5 ?7 b J" c5 j
xchg bx, es:[41h*4+2]
0 y# ? ~! M( b, j- ~8 R* r. k mov ax,4fh
. m) i) ~# h0 v3 @6 Q; h) v int 41h8 X5 ?' n6 m8 |' x2 e, {9 b
xchg dx, es:[41h*4]
- `6 T. I+ V# u, x% \( n xchg bx, es:[41h*4+2]
0 S2 x3 ]3 }2 }4 M/ N' O0 H cmp ax, 0f386h
' T+ D6 V5 A/ s' a jz SoftICE_detected
: R5 ^/ X4 i: d, F- P" Y6 J* d0 g* K! S+ S) q! O# R4 K
int41handler2 PROC+ d2 }; Y! h0 c( d
iret
0 q5 N4 s5 ?8 q# V/ Uint41handler2 ENDP1 y6 x- J P& U V9 ?* d9 d' M2 J
5 R# e* @$ `* m
3 w1 r5 N4 x8 G
_________________________________________________________________________2 o" u5 J, Z7 H) I) a
; F' _ ]# O' o3 O$ \6 Z+ W& B1 Q0 S8 ]
Method 06& H) g$ f" v" R4 ?( ^/ K' M
=========7 ?" l' p) F" y! f* l: S
2 P+ T" x- ]2 L1 e+ x" O3 [- s8 r3 V; ^+ L5 B5 W
2nd method similar to the preceding one but more difficult to detect:: h( _" v$ Z% L" i+ Z/ c
; H. \0 s# r- ^$ i* }5 ^
# W2 q$ @: `. Y! M& Y
int41handler PROC4 Q8 S# e, W2 V
mov cl,al
) l; m7 K* ~8 `/ a* M# \- r9 S' c iret2 E E# ~+ w; K: s6 {
int41handler ENDP/ O- z9 C1 u- n# f) `9 q- f
. j/ o; R% k( K3 U6 Z! P5 }6 x. g" F4 ]0 V$ c, n
xor ax,ax
( X+ Z1 X u. p1 G6 D; o( N/ O mov es,ax# C+ c9 ?* b- }
mov bx, cs
3 s9 l) ^7 @6 v7 O1 o" v! P lea dx, int41handler& ~! C' M" S2 r, i' }% t
xchg dx, es:[41h*4]# l9 b4 |7 x9 W
xchg bx, es:[41h*4+2]( k3 z' K; g% W$ ?
in al, 40h5 T) J* }+ k8 f- z4 L* j3 k! J
xor cx,cx' Z3 A5 u* F4 v
int 41h
c) S0 Y1 o& @, ]1 n. Z xchg dx, es:[41h*4]( g# t/ Y. l" U. c
xchg bx, es:[41h*4+2]- Z" i5 w# f* ^# H u. l. ^
cmp cl,al
7 J5 w9 D5 r) K( h6 M jnz SoftICE_detected" Y% E, Q3 s+ `* s# d: _; q4 B& H& o
7 a2 ]3 S( `/ m& h H* n+ [_________________________________________________________________________
1 j; n/ R% V+ T" @/ c) C) c! X" U) z- W" x
Method 07; d( D- I. u, d) V7 g; A
=========
, {* ~" Y; Q# }! G2 b! p% p* a6 K; s% m) \+ w. ^
Method of detection of the WinICE handler in the int68h (V86) G' O4 F5 T3 K% f" \# b
* }6 i0 [$ V0 E8 O* }. N
mov ah,43h
0 f! |6 ^( f |4 q, t int 68h
( g% o1 T( ~( S% C3 l8 z cmp ax,0F386h
! R B6 a0 {6 t jz SoftICE_Detected
5 Y- O' E8 r; U8 u
2 a* k* k( ? J6 b$ x8 I' j, j0 M+ R/ e2 i: V/ M! j( T, {
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
2 F9 J. M* w* [; F! b" j2 L" u app like this:! J/ q6 C* S9 Z
* W4 F: A4 r5 G
BPX exec_int if ax==68
( E( z& r C h* G0 r) `$ a. i7 ~ (function called is located at byte ptr [ebp+1Dh] and client eip is2 I( t, u# Y) f7 V3 i
located at [ebp+48h] for 32Bit apps)+ s; d# Q8 q- S# T) t% B6 G
__________________________________________________________________________. F/ |, j5 k+ N, }0 R6 d. E
T: W( w n8 ]* Z8 D
' U. }- o g f ~) `Method 08
8 T5 g, ^" F& p3 N. ?" n9 `=========
! g x2 P9 x5 V, F5 d
* ^6 a0 ?: J- p) A7 JIt is not a method of detection of SoftICE but a possibility to crash the, B- B: m* A; \
system by intercepting int 01h and int 03h and redirecting them to another
+ j [! W1 p2 `+ ^' @( a& W qroutine.. Y% O1 O d5 `4 H0 _- |; q5 }
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points7 J0 z8 Q7 L9 Q0 L: B+ d, ~
to the new routine to execute (hangs computer...)5 |9 \' T. X) Y3 e9 G
1 a; t) G4 P# {. Z2 L, ] mov ah, 25h, f( m6 ?) r( j
mov al, Int_Number (01h or 03h)' n D: V. u. Q$ n) x
mov dx, offset New_Int_Routine2 G9 I( L! N& G) V' D
int 21h
7 G: [' @" c) g9 N. [1 g* d' d1 j, A9 A, V; D4 t/ u+ I6 @
__________________________________________________________________________/ ~- z$ |# K+ w/ V+ I, }
# x$ @' z- \8 Z+ {Method 09- G. y% X6 u* l) Q8 v! W) d
=========" Z! S |2 _: N$ E) s, ? @+ { Q
* c8 g" f$ I. ]
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only& E( g+ Q' E4 b5 a% j2 \: z% @) l
performed in ring0 (VxD or a ring3 app using the VxdCall).0 e8 |% p8 z+ Y: K
The Get_DDB service is used to determine whether or not a VxD is installed6 j" n- ?: L5 R
for the specified device and returns a Device Description Block (in ecx) for
" e* \' ?5 w+ O# @; Y1 Y6 Xthat device if it is installed.( Z. m. m; n6 N* }- M; w+ v% g' I
1 G2 r8 q* I" T* q( x mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID! t8 B, x6 x/ q( x6 v$ D! V# |
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
7 G: k1 x" g' |6 C VMMCall Get_DDB
+ a8 _. v# R0 z# w- p1 G mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
; G. w) m$ L+ t+ ~( _" R% r! }; C+ Z0 x- N. o
Note as well that you can easily detect this method with SoftICE:
* I. r1 }, @- X7 a& V5 X- u bpx Get_DDB if ax==0202 || ax==7a5fh
3 X. p4 w! U0 L+ g; h( ^1 ?# D6 A! n& r& e1 [% q
__________________________________________________________________________$ F. s3 h' z4 s) Y
% J6 I+ K3 p8 Q8 WMethod 10
5 w) k: T* k/ c4 J=========6 F1 A3 n" W' A) ?- c
# I$ m% R' D9 z# c. }& a; \=>Disable or clear breakpoints before using this feature. DO NOT trace with, n/ |# a/ v9 \; K9 ~
SoftICE while the option is enable!!2 z& A, r1 S% e) W! ]+ i
, L- l9 ^/ b. S; `2 f1 ]/ N# f+ ?
This trick is very efficient:8 {- A: y2 U. B9 H. \: y" l! U
by checking the Debug Registers, you can detect if SoftICE is loaded$ ]9 e& {+ E# W- y
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
, o: W8 T- w9 X7 j- h# ~: Cthere are some memory breakpoints set (dr0 to dr3) simply by reading their
% a- j/ S/ y/ O" Y- D0 Xvalue (in ring0 only). Values can be manipulated and or changed as well, X. o! Y) l/ [) S
(clearing BPMs for instance)0 ?6 O' S h$ W0 U/ z9 s+ o8 b1 k
- n3 O" ]$ D/ i+ ~: g5 q__________________________________________________________________________( u) {4 C) R1 h0 \4 Z
+ `3 J; F* |1 O, ^Method 11
& ~1 Y- Z3 z" {; u; p' a3 c=========
3 R6 X& `, `6 M- G7 O
4 \! |" A) w( `+ t) u# n( q+ XThis method is most known as 'MeltICE' because it has been freely distributed
# i) t* t5 Z$ H! s! a' Y" Bvia www.winfiles.com. However it was first used by NuMega people to allow
0 n! v( ]9 s$ ^Symbol Loader to check if SoftICE was active or not (the code is located
% D: l+ v. B4 t7 y. A: U' ginside nmtrans.dll).
4 e. d* _/ q8 C z" ] X
* s$ p8 u! m- S) B- X' A; AThe way it works is very simple:
1 t" o% Q% x; SIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
0 i2 ^8 D& B& n" t4 w7 `* BWinNT) with the CreateFileA API.
3 @ d3 e, Q" i9 Y" x
6 s5 d# `2 M# O* \Here is a sample (checking for 'SICE'):
1 R$ B+ L- J. m9 J% x' |* {# x. t8 p- h1 ^1 P
BOOL IsSoftIce95Loaded()
' v: \$ @2 Y2 o; {+ s+ q{
% C) X L% G6 S6 B6 V( ]: A! L( F! D HANDLE hFile; - D; h# P- r+ J9 Q
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
8 R9 w: t [2 b* j$ Y3 @) X FILE_SHARE_READ | FILE_SHARE_WRITE,- m; P K7 |3 O" h
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);1 \" B2 v4 D, Q( F6 Y4 b. T
if( hFile != INVALID_HANDLE_VALUE )
9 H+ I- c" N8 P {
( @7 p. B0 P2 J! m. P/ @ CloseHandle(hFile);; `$ Z" W. p+ x8 w% u% S
return TRUE;( k3 e4 x( `2 }; Q4 N( a
}
) a. _2 Q2 ^( I return FALSE;
1 X8 i8 z% x6 g4 D8 H}
; o- Q' i$ |! r4 u+ V/ k: r/ ^! b& p" s( ?
Although this trick calls the CreateFileA function, don't even expect to be, T7 c3 E6 a. Q0 z/ _
able to intercept it by installing a IFS hook: it will not work, no way!
$ d, g) f; V( ?( U7 D4 {In fact, after the call to CreateFileA it will get through VWIN32 0x001F
7 i9 S3 p) v7 Y/ J/ x+ Y8 W7 m' zservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)0 T- I" Z+ }* Z% }- y9 b5 V. M/ R
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
9 C5 u" X Z( E8 F( y: F" p( E) Pfield.8 \: l' p$ t2 j2 f8 b. D- v
In fact, its purpose is not to load/unload VxDs but only to send a
7 l. y+ | Q- ^W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)# D. V" {$ g0 ~5 S$ t
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
! n+ n3 [; |0 `$ Vto load/unload a non-dynamically loadable driver such as SoftICE ;-).
( A& j( C0 O; r9 {4 g& v7 L* \5 r9 ]% qIf the VxD is loaded, it will always clear eax and the Carry flag to allow J) s& [* a, N! s) ?
its handle to be opened and then, will be detected.
, K: G7 l: H* S: vYou can check that simply by hooking Winice.exe control proc entry point" k% [6 R I/ F3 E# a
while running MeltICE.( Q0 _% q4 Y7 i& L) ` t+ [6 V- U
4 m& _1 B; Y5 z& ~9 k- R4 W& T' t" c. _$ f/ z* i r( X1 Y
00401067: push 00402025 ; \\.\SICE
1 k% ~* x* b4 q% i- { 0040106C: call CreateFileA
* K! M5 t* R4 k! ~ 00401071: cmp eax,-001! Q# v% u, L5 x! E$ m9 T4 F# o
00401074: je 004010918 Y% e7 r* o/ x: k# n
# y/ A) N; {6 v3 Q5 d6 D
% b1 r0 @! e4 J1 z; AThere could be hundreds of BPX you could use to detect this trick.% O. @# B$ ]* ?6 b7 @% Q
-The most classical one is:9 B; A6 q& G# n7 t: n% Q- ^3 \
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||; R3 C! B+ j( z1 c$ g4 {/ |
*(esp->4+4)=='NTIC'
' W/ k! P1 k% W/ H8 n$ U- {$ q3 e% Y' D
" d. h/ c0 P+ t-The most exotic ones (could be very slooooow :-(
: V& x. S: u, R$ x7 y' t3 w BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') " w. T( G/ E5 ]
;will break 3 times :-(+ ]5 n' Y' k0 E6 A$ i
5 r) u) C# e7 {1 {& O, Z( ~3 R! {
-or (a bit) faster:
; ~7 c3 ^7 A! E0 I1 z BPINT 30 if (*edi=='SICE' || *edi=='SIWV')7 m g }' Q! \0 a
4 d& l* c+ M( p: E( ?/ J
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
1 u0 Q3 v: n* f; r& Y8 X* B ;will break 3 times :-(2 m3 @( ]; r! d. d* p7 O
8 t! A' {6 C& X5 h- ^) ?* M# y-Much faster:) F* K ]8 n" T9 q' X
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'8 a* a, v( K- b. i
+ I D9 \# z! b0 [. h+ R8 x
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen( C# D9 i( v6 ~/ ]
function to do the same job:# K( B0 N" _+ @5 M
5 B( s; L0 t" M; R push 00 ; OF_READ
$ H" h- X! R/ o: ~' `1 h# X mov eax,[00656634] ; '\\.\SICE',0
% K; |/ \( p6 h' L4 v q" L push eax4 Q# e. v% |- o, D" e
call KERNEL32!_lopen0 M+ Q0 @6 w) O5 O4 p5 r. q0 m
inc eax( J! [ i1 r& e0 z
jnz 00650589 ; detected2 }; y. F v9 C) _# ?- M9 n( b
push 00 ; OF_READ: t+ h4 P3 q, e' i9 Q4 y I6 ?
mov eax,[00656638] ; '\\.\SICE'
# D" H6 Y @# c$ n+ ^: b4 E" y, Q push eax
, ^+ }$ k. C: j9 h+ Z call KERNEL32!_lopen: n! o8 W+ S s# ~5 u& n$ G
inc eax1 G( Z) m3 ]3 i3 K
jz 006505ae ; not detected. V& s5 q2 E6 V0 [; |; M, d) W
4 H& j; y7 ?+ X9 e9 V. D L, Y% F
- O9 _1 }& j5 \1 k- e! H
__________________________________________________________________________; O, d& p( s6 v% i, |7 ?" ~' i, j& w
" h: f4 B! l! ]" X: K+ ~: C
Method 12
6 Y+ x6 B h( f=========# J4 ?4 j' t+ y5 g$ L! K
; }8 A) d/ }4 j! `6 h6 q0 H& n3 PThis trick is similar to int41h/4fh Debugger installation check (code 05' y c$ o( D; o) t* _
& 06) but very limited because it's only available for Win95/98 (not NT)
; C, B$ W- ~2 M; Y. l, ^as it uses the VxDCall backdoor. This detection was found in Bleem Demo.3 r# a2 |) P# E8 g
9 o& {) H# {& P1 q+ b! d) Q
push 0000004fh ; function 4fh+ k' V4 l0 U0 T
push 002a002ah ; high word specifies which VxD (VWIN32)
* L; G* O3 z% E+ n( C3 Y1 A% V ; low word specifies which service( o% R1 ?) o9 I0 ~
(VWIN32_Int41Dispatch)9 u4 H4 E4 ^6 Y# P
call Kernel32!ORD_001 ; VxdCall
2 L& R) c6 @- S. `" m, F" M+ i$ h7 r cmp ax, 0f386h ; magic number returned by system debuggers
& }$ R. N. f* r: | jz SoftICE_detected( Z- k! `& q9 A* @7 |+ }" r& y- i
" m% H C \" n2 {9 X3 Q
Here again, several ways to detect it:
' Z; ~6 w5 Z& l
: U$ _8 j ?/ T; L; z BPINT 41 if ax==4f- u& ]% i3 x! K* T
0 s7 q2 @. T! R* m) Z
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
" x7 A; W; D' D7 }. V% d5 T, ^+ \+ G! N. c
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
- c, S& t0 m9 N$ T p ?5 b' n( X" {2 m9 Y& b0 k& Z( M
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!5 u* U B2 ^! |
+ R; M+ x2 E) w
__________________________________________________________________________
% R1 \1 o0 w1 z
7 V0 x) E$ e1 `8 G {Method 133 u/ h& {+ a" f' Z
=========
& \. m8 `) [' L, u$ K+ G% c, W+ M% L& [, [
0 p a! ~6 L8 I/ A1 M+ n7 i! J! SNot a real method of detection, but a good way to know if SoftICE is3 c6 W+ k( F8 Z, C7 I. V5 F
installed on a computer and to locate its installation directory.3 `: _+ b- s( R: F4 C Y8 y
It is used by few softs which access the following registry keys (usually #2) :
0 y* B. w0 A. s/ ]! S' \; `% @$ v8 N# V8 M0 Q7 u2 t) B" A0 W7 W
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
( b9 f1 J, v# A\Uninstall\SoftICE
; j- n1 C O3 j9 \7 \: d-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE+ Y5 M8 n7 l `/ ?# w, h
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion/ i6 b$ G2 B8 L% G0 @; @
\App Paths\Loader32.Exe7 y3 D8 ?. [/ S3 n- _ W
* H S! [- X$ a" r1 K: e0 R/ ?; C& q; }9 d) I
Note that some nasty apps could then erase all files from SoftICE directory4 V& I( z( {4 M* n
(I faced that once :-(
$ I6 `& I6 J6 v( O
- g" `; v+ j5 @& c4 M4 HUseful breakpoint to detect it:" ~5 [0 G9 Y0 {" p2 H( p( l
' a: {8 H; o/ @3 K% H
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'$ L/ @- K5 }* |: S5 v9 L0 B
( A- s4 _& H: G7 ^3 X$ ] M6 F__________________________________________________________________________
; X1 a- o1 W, }% L6 i. k$ E- e! o G4 a/ \( G t, s
8 [+ t) v+ T; Z5 |. ^& I
Method 14
: Y ~4 Z& p7 p5 m/ N=========
$ [. g7 D4 [, t* K3 _+ e9 n4 C, V# S* k* @1 E B0 R
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose/ S+ p) ]* a6 ^* r0 {
is to determines whether a debugger is running on your system (ring0 only).
1 G i- q2 _6 d3 z- }# S! o6 T3 Y- _/ o) I9 J9 b
VMMCall Test_Debug_Installed
3 `; l d+ c8 ^7 m! a: l" u. [8 c je not_installed& r: ^: o; P( z
' V' s. F3 B1 ~This service just checks a flag.
; {+ O& e+ e6 d+ T9 Q</PRE></TD></TR></TBODY></TABLE> |