<TABLE width=500>% R4 z6 @. D, M; }
<TBODY>! J [4 {* h# |& N$ u. b N3 A
<TR>: c+ G% v5 |, G9 X1 U0 N
<TD><PRE>Method 01 # _! \* O) D: I5 F* b% h
=========
8 i0 S. f8 |& e3 a3 U0 D _6 Q2 e# |. ]7 t* x' r& i, L5 e/ L; i
This method of detection of SoftICE (as well as the following one) is) h& y" ?+ x# l. g. t
used by the majority of packers/encryptors found on Internet.0 H+ R; K- r( X {0 d' n
It seeks the signature of BoundsChecker in SoftICE
. [$ j# n O8 [: c( Q0 d% l+ d: J$ c* |; Z1 }* Z' l
mov ebp, 04243484Bh ; 'BCHK'
7 d3 m4 ]" l8 K3 ~/ O: I mov ax, 04h$ E+ @7 r" L. r- }; o
int 3
8 d' B1 ~3 y- O2 w! n cmp al,4/ |; b* P! M' }* W* n
jnz SoftICE_Detected
% U' @$ L$ G0 O( d3 J2 d7 p/ Q& A
3 j7 Z( t, m2 q5 k" r$ d+ y___________________________________________________________________________5 p4 f. Q9 h& H; M+ b4 ]1 Z) w
" ]6 e$ X) y* k T0 P# m- t
Method 02
9 X5 o y# m+ K3 P; o( D+ @=========
, k6 o4 o7 n1 G$ x Z* l& E& `5 q, _; m, F# W, c
Still a method very much used (perhaps the most frequent one). It is used& B0 t8 f- ]. p7 }
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
) n: }! R6 t. o. | R! cor execute SoftICE commands...
; o w+ n6 H5 p* J: nIt is also used to crash SoftICE and to force it to execute any commands
+ H1 O5 c/ z0 x, u) L2 N$ T6 I; p(HBOOT...) :-((
- }' ]: X9 X! q8 I Z5 c' W# M% a; u" V+ t
Here is a quick description:9 | {( h4 P7 s# }. r
-AX = 0910h (Display string in SIce windows): E5 p) \, o! g1 l
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
( N% E# E+ @1 f! ]3 a* F-AX = 0912h (Get breakpoint infos)
1 U& q `" _& M9 A-AX = 0913h (Set Sice breakpoints)
& N7 j1 z) b7 B. [ A1 [2 K: {-AX = 0914h (Remove SIce breakoints)
+ B. U* i, q9 A# @
! {) k$ N$ F5 n: a( `Each time you'll meet this trick, you'll see:2 i4 e/ u7 i" f+ |2 t! M
-SI = 4647h
7 v. |0 M' B7 C0 X" X6 m-DI = 4A4Dh
( h3 M2 j1 Z: p' X) K- P; a# DWhich are the 'magic values' used by SoftIce.# n3 m+ }9 j% F) P
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
+ v) S1 _0 X, u9 u) y1 Y# ]9 V* Z3 I! `3 C/ }
Here is one example from the file "Haspinst.exe" which is the dongle HASP0 O8 P: J' ]1 K3 C& G' `. i. o# _
Envelope utility use to protect DOS applications:
7 C( R4 B0 c/ K$ \6 M4 T8 s
4 a3 r% F# q8 q5 r! H% y
) P; t$ r: N' U' g4C19:0095 MOV AX,0911 ; execute command.
1 z7 w+ I# ~2 F- Q: Y: p- \) ]3 Q4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
6 x" `* m, b: v% R( Q) i/ i; ]4C19:009A MOV SI,4647 ; 1st magic value.+ q; B% h) \0 _( b+ a$ `
4C19:009D MOV DI,4A4D ; 2nd magic value.
5 W" r g# d; R! P3 ~ o4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)! N( n; G7 k9 F1 p9 q, i5 E6 M
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
/ C5 {1 F K ?% e( z8 n4C19:00A4 INC CX
# x1 N5 F1 r# d9 F8 Y o4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
* n6 M0 h/ d0 H) _3 g6 T4C19:00A8 JB 0095 ; 6 different commands.+ F U( _# x0 s; v. O6 P0 P
4C19:00AA JMP 0002 ; Bad_Guy jmp back.- |- d9 u e9 S9 Q X
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
' m" \# J m% |% i- T, y: h, p3 {2 D! x s$ H3 ]6 |" y, G0 Z
The program will execute 6 different SIce commands located at ds:dx, which
4 T" q0 \* e# @: [5 dare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.+ [- O& Y7 m$ E
& s9 F. F! V- I7 U- ]# s* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.5 ~) i( v4 V/ U5 b7 \
___________________________________________________________________________, k2 }) U, q: v7 \# _( B T
. j1 y2 B2 J; R) P% ^6 e- I
: b% g6 V8 y: I1 R1 QMethod 03
$ i1 k: m2 A# \6 A% v' C+ N=========
4 p3 ~4 V: N# H9 [3 v9 C8 J" j2 P8 ?1 j
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h0 A$ I- i- Q/ u R! {
(API Get entry point)! h/ J) C" A+ U
# A, O! y( C; b& J
# B- f& t1 c. @
xor di,di
* {$ H7 o3 E; B4 z mov es,di/ \8 |) A8 j p7 ^
mov ax, 1684h $ N5 a3 i2 ~+ d. I9 G( h9 |9 r% x
mov bx, 0202h ; VxD ID of winice7 A" C3 w% c4 F+ m. f' t- N q
int 2Fh6 K$ D$ T2 k( n8 ~) X5 [6 O
mov ax, es ; ES:DI -> VxD API entry point; `: O% }: V0 J6 N' |
add ax, di
3 m; Q' w/ M6 P3 o- s8 @ test ax,ax
& k# X5 F9 X6 {6 l. b jnz SoftICE_Detected
% I, `' w7 ~# f$ X* D @. u" O& W# K; K( P7 g+ v# x
___________________________________________________________________________0 W+ i; H- N7 `2 U/ b% B/ J
% m2 I& c0 Q8 e4 l4 S* OMethod 04
1 c6 c8 Q) ~& Q. R=========
% }9 a; \3 `5 }. F8 U- A( w0 R' H* x7 t$ ~3 p. @4 c1 s D0 z
Method identical to the preceding one except that it seeks the ID of SoftICE& B& n6 m4 @6 B; p6 g& w1 J. i7 P
GFX VxD.
0 j8 ~9 A( d! I$ h* D3 I* Z! q8 T+ s {; f4 D+ x
xor di,di
( ^3 k8 ~: \9 M# [6 B( \ mov es,di5 C' t. R5 V+ V% V& ~* Y
mov ax, 1684h
* ~* M- f- j& z$ P" o8 Z p/ Y mov bx, 7a5Fh ; VxD ID of SIWVID
& s5 ^: q* M7 s4 @9 a7 a int 2fh" M8 e: o! N, C r" w
mov ax, es ; ES:DI -> VxD API entry point
* s: b m% M- J2 M$ w add ax, di
/ {/ u3 {: O. v5 e& X9 a7 ` test ax,ax$ D$ X- k9 _7 j0 P1 _8 x5 n: l
jnz SoftICE_Detected
" u2 Q" `! d2 \, u: |4 ^
; z3 f0 _0 C+ D$ n__________________________________________________________________________
& m3 r4 M8 Z6 M' E$ r) P: P7 U0 M2 W8 o0 Q4 L3 f
( |$ l5 T& W* k. a' r5 `Method 056 |4 \4 A) B, w- T
=========
2 I F [* J9 p2 T7 A/ T2 M. n3 Z/ r; ^$ d
Method seeking the 'magic number' 0F386h returned (in ax) by all system7 A" ~* c) u) J& l9 I9 s
debugger. It calls the int 41h, function 4Fh.
, m/ k* u$ K% pThere are several alternatives.
9 U* H& I- R3 W: F8 n t1 z7 q: \) Z# a' `4 d
The following one is the simplest:
5 V% d+ @& B! s, e% d# R4 Y, r0 Z8 p; O
mov ax,4fh; ]' a2 ~) D# }! H; Q1 B, K
int 41h2 Y, w+ E4 d/ H
cmp ax, 0F3864 c% U+ Y0 G+ U
jz SoftICE_detected
2 _8 g- |0 \8 P! J% S* S
) s7 W3 e5 i- k
; e6 E) J3 A9 ]# tNext method as well as the following one are 2 examples from Stone's , @4 B) h( j- P/ u/ H
"stn-wid.zip" (www.cracking.net):* N# G9 c* ~4 g2 h$ t4 j
0 I, p8 ?4 D: D1 f$ f) i. f: c8 A mov bx, cs
+ C ` `" f5 V: p, \& \; S lea dx, int41handler25 s6 e! V+ t- ~9 y# l' ]
xchg dx, es:[41h*4]
& {, n1 {( ^1 g7 z( E, a6 F xchg bx, es:[41h*4+2]
$ D3 [& G+ ^" j3 o; c1 o& R) f mov ax,4fh
0 q- w/ L* T1 \1 ~" }' {" x int 41h
( H5 W( E5 [4 r: w$ {% y8 M/ C3 J xchg dx, es:[41h*4]0 y0 M% Q# J) q/ e- @8 [8 H
xchg bx, es:[41h*4+2]
; _0 d5 ~2 k) s5 B0 m/ E" S& d cmp ax, 0f386h' `2 r+ D* z/ `6 F5 {' s1 d5 g3 G
jz SoftICE_detected
, e2 x" i/ {; C% I* b
/ v' w2 s* z) G7 gint41handler2 PROC
& u+ L- V. A! r% W0 A! \/ q iret
n$ R3 C+ B6 V9 S# a: ?int41handler2 ENDP
5 X0 A( I. }: g6 l {
h0 }8 B3 H% T7 Z* d+ N, {7 r) n1 h3 W) N1 J
_________________________________________________________________________" s8 \) y( ^2 N( m' n1 m
# ^6 ~8 j! L* K4 k' g+ J/ k% A: C, }
; Q0 `2 |5 R; } ] l7 {Method 06/ b) L' s% O, h1 V- V
=========+ L+ Y9 d# I- ~
) H t5 [: ?% `, c6 X
/ u- z& w, }- F q ]- l) E2nd method similar to the preceding one but more difficult to detect:1 j$ a8 e& l) s! b
4 F. r5 T' ~, E0 X8 t+ T0 |$ r
2 C" O b/ y/ F1 F1 i6 U8 \& ~int41handler PROC
M# t! G' b9 P0 A ]9 @ mov cl,al
" z' n& L, \* l' |1 V/ _/ l, s iret
; R# H. Q I3 Qint41handler ENDP
) E2 M: N. R* O9 Y
% _) j- ~% V3 z1 j$ p: N8 V4 V; l$ s6 B+ H$ y/ v5 N l* H
xor ax,ax3 j! G" q* P, d
mov es,ax
' q2 [8 @9 h; P. j+ j, j mov bx, cs
; S: t2 v! w2 E6 d' W lea dx, int41handler
1 r2 ^: F! z+ f2 @ xchg dx, es:[41h*4]
3 ?1 }7 j" t2 \& R! A xchg bx, es:[41h*4+2]
% y& c' f. A7 p$ O; V in al, 40h
9 [. R( K8 J0 g2 M! Y1 {4 Q* h xor cx,cx
+ A. }' g1 E3 X C0 m2 B int 41h: D* K; c/ {1 S$ x- n
xchg dx, es:[41h*4]
! u( j7 y/ Z0 {3 V$ f+ R' p xchg bx, es:[41h*4+2]7 D7 H+ t/ |9 Z+ f1 y" \# ]7 b# k" {
cmp cl,al
$ x% W4 c; a) x& f6 S. s: R" } jnz SoftICE_detected
2 x4 v: X: p3 e& o
; z5 b7 I2 \# k: o* g6 k_________________________________________________________________________
+ u- P2 O2 n% i9 ~; `0 Q" `" h& W" ^ G% B$ k( c# n
Method 07
/ K" @, t& t5 ] b/ L" [=========
+ z: S/ T( r; Q9 D" t% P1 M( X) [ O; y2 U9 n. b8 b, P( i' ?
Method of detection of the WinICE handler in the int68h (V86), U3 v$ T* Z! |9 h& A* }, `
# P2 `( h# _ Q3 J! n
mov ah,43h+ i' B: d7 x9 [
int 68h1 k3 l2 N4 P, v0 N4 Z* r; `
cmp ax,0F386h
' c9 s% t9 L$ K) c. S jz SoftICE_Detected2 Y. x5 j4 t8 X0 A% W$ `6 K
* h& ~! l% R) l, l. D# z4 C- U: c' Q
* L' v( B: t( W4 I/ E) w1 }5 b" x U
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit# ]- e! J4 c8 F! f
app like this:
. }) X- H1 Q- e. J& v$ b7 u+ i4 J# Y+ K5 ?2 w. u
BPX exec_int if ax==68! u' g) X. z4 ?+ f: g
(function called is located at byte ptr [ebp+1Dh] and client eip is
4 A7 Z2 H! B0 J* f% ^ located at [ebp+48h] for 32Bit apps)3 H+ |* ^+ h2 M; p. ^
__________________________________________________________________________6 z; w. v! ?- j6 V9 Z' u' X f" k
4 A/ F0 {. \# _0 X% w% j3 b& D
^, j( K' u9 l c5 t/ bMethod 08
2 j. _0 ^* M$ Y=========, j, {5 |6 G' `0 ?) E
5 x6 ?2 S, J9 S6 z- I: L9 n" J2 i6 X" iIt is not a method of detection of SoftICE but a possibility to crash the& V# {( \8 @* _5 {* C
system by intercepting int 01h and int 03h and redirecting them to another
( |6 d6 t: H, [routine.+ Y q3 ~0 `7 e) Y- `# G
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
4 `3 _7 [$ h9 t- D0 X" R! uto the new routine to execute (hangs computer...)% D/ d5 f) }4 w w: U
6 F9 T) H- R$ f mov ah, 25h x' T7 N8 H/ _5 g
mov al, Int_Number (01h or 03h)
+ q) D, u. k A2 @; C mov dx, offset New_Int_Routine% S8 ~0 E+ Y" p
int 21h; V( f( Z0 p- C0 y% R2 S4 q
- [+ _& H, K y. Y6 G__________________________________________________________________________: P: {+ ^- w6 \4 h& [4 U
. d- @1 y) g6 M2 t0 ~" E3 HMethod 09) K% g7 J" g D+ }( s$ I
=========3 g: M- A. y' k# @! O+ `* R9 M7 i4 n' [
, X1 X: H; ^. ]9 |
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only( h& q3 |+ L' r; O5 u; _
performed in ring0 (VxD or a ring3 app using the VxdCall).1 j w8 F5 U G" F4 q0 J
The Get_DDB service is used to determine whether or not a VxD is installed
* _2 u* H1 N a0 M- {( [# @for the specified device and returns a Device Description Block (in ecx) for- \+ E) r% J( V" K' Y' U& T
that device if it is installed.
3 p# u* g; }1 K: j- h$ z; k# ?/ c! z5 G1 K( t
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID! |. U z3 q- H; T
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
7 Z* L, ~6 ^- U" e! Q( a4 ?) V VMMCall Get_DDB
, `3 S* T: K9 W: d# o" o4 K mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
/ o5 V( M5 A" D/ B/ S$ O A
9 c! R h( U) H. F" t7 eNote as well that you can easily detect this method with SoftICE:
& M" x) I/ j5 ^9 o bpx Get_DDB if ax==0202 || ax==7a5fh
; h' P" y. I# y5 b% _' o- Z4 s+ ]/ v5 g
__________________________________________________________________________2 l3 C8 m8 g% E; Y
& N' l N. _# Z
Method 10
* a6 ~( g4 ?( F) l; i=========
4 _5 @& n: k% F3 [- D! z* n3 I/ Q# A9 }
=>Disable or clear breakpoints before using this feature. DO NOT trace with% _7 G: F8 t, b7 c
SoftICE while the option is enable!!* ^3 _5 v/ |4 s- n" Y) u" D' x
% {# g4 }7 I7 h: Q0 OThis trick is very efficient:
0 b& o s( t* N; a5 b! yby checking the Debug Registers, you can detect if SoftICE is loaded2 F* H' I' ?( T5 Q% y; z$ c, O
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
: x5 r+ J3 q4 p- M1 q" [: ]there are some memory breakpoints set (dr0 to dr3) simply by reading their
5 P) l! a/ [+ h# s3 C2 B: `" O0 Zvalue (in ring0 only). Values can be manipulated and or changed as well
% s9 t/ A" {" d# Z4 ^(clearing BPMs for instance)
9 O! ?4 Z0 L$ ?' a: r- n# Z3 e- ~/ Y) E) Z3 d( R
__________________________________________________________________________
$ _$ m T' ?9 {
3 {1 L) i6 |1 s2 v4 w7 ^$ MMethod 11
0 s) |) N5 x2 f- V& i0 a=========7 E+ K2 v9 v* A4 i
/ |# U- i. b1 B! u* o3 V" \This method is most known as 'MeltICE' because it has been freely distributed
8 O" A3 u6 Y; S4 J' K0 Kvia www.winfiles.com. However it was first used by NuMega people to allow( s2 \; `- x5 ^4 [# C1 V4 P
Symbol Loader to check if SoftICE was active or not (the code is located I6 Y" s& p! C) M$ e
inside nmtrans.dll).$ q1 _7 b( B1 S3 T( t Y9 x
9 `2 ]( Z' W( O9 g/ Y e5 M5 M4 r9 RThe way it works is very simple:
: _/ N+ Z3 v7 \( OIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for8 h* M5 b$ G0 J& O, k
WinNT) with the CreateFileA API.( h" @4 X4 d+ q. \2 ?( ~% o I
: ]: {% ^2 ^3 |3 l" C1 iHere is a sample (checking for 'SICE'):
7 R' ^7 B( F5 a' x& b" L% T9 A% l
BOOL IsSoftIce95Loaded()
; \. p3 H2 z: B4 I% B7 {( C{
6 l; a* E* y6 a HANDLE hFile;
5 ]4 i, S) s1 a! ]4 T8 q5 { hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE," J9 Q: q; m a% o% F6 U
FILE_SHARE_READ | FILE_SHARE_WRITE,9 l* n. A* F6 j5 k5 ]
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
( g& ~# y: Q8 \ if( hFile != INVALID_HANDLE_VALUE )
1 Y0 e9 E7 j0 `( K {' J' h1 `6 W+ d: F6 v; A
CloseHandle(hFile);: D5 M/ v: O& j* e
return TRUE;: }* P. p# @# F G5 h
}
# Y# x# ]5 R6 m: h ~& L: z return FALSE;
( `/ i- h; h d$ R) ]/ K}
/ [* a$ c, u( i$ \+ m0 C- B6 u4 \& q/ ^7 T- t) J
Although this trick calls the CreateFileA function, don't even expect to be$ ]3 d9 @- g( d& {" R1 v
able to intercept it by installing a IFS hook: it will not work, no way!
' @/ V, o# O7 a! zIn fact, after the call to CreateFileA it will get through VWIN32 0x001F- D: S- G4 ~: o9 t
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)6 C' x) }) c. N
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
4 t) ?& X1 o: w( k; d& f$ J% ?field.
5 c/ _5 b5 a7 l0 P2 R3 K8 G" eIn fact, its purpose is not to load/unload VxDs but only to send a
: b, l; A$ Q* O: O$ r9 D: LW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
! R$ t) y' b- y. B& K2 i8 ?9 K3 M7 bto the VxD Control_Dispatch proc (how the hell a shareware soft could try
% B3 d; \! j1 _. V0 n7 hto load/unload a non-dynamically loadable driver such as SoftICE ;-).
i4 ~' f+ _6 V& JIf the VxD is loaded, it will always clear eax and the Carry flag to allow
# S. R/ P/ U9 rits handle to be opened and then, will be detected.3 a, `& e* a+ n" D! I5 S
You can check that simply by hooking Winice.exe control proc entry point& ? y& x0 c" g% G/ T4 v1 J
while running MeltICE.2 t2 D6 X2 |% r& ]5 w
9 K7 k7 m" V" r/ p4 r6 D$ V- H* T' T) ]& f/ B1 Y7 C
00401067: push 00402025 ; \\.\SICE+ v; C8 [: a& }. c# m
0040106C: call CreateFileA8 ^* E% Z4 D: [1 b Z
00401071: cmp eax,-001
, q3 h+ Z) i6 ?( ?1 }9 Z4 ]8 c8 [6 N0 _ 00401074: je 00401091
* e6 d) I7 o" T
* b5 q: D4 w+ B
' G' Y( t1 d( u( o; N7 S) E0 lThere could be hundreds of BPX you could use to detect this trick.
, D; W/ i0 m" A5 ]! ^9 D-The most classical one is:% t& b% \- S6 f! h" T+ J8 {
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||3 I$ _( S$ c$ f P7 C+ N) V9 j
*(esp->4+4)=='NTIC'
* F0 h: Z: x! U7 g- o h* V5 u6 ?! z
-The most exotic ones (could be very slooooow :-(
+ e6 U9 K) @; A, ^ BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
7 X5 [3 {4 P- G7 x( \" V ;will break 3 times :-(- d a9 o: s+ z" ?& ]
, C! o( g x- `1 a' T' ?-or (a bit) faster: . H+ S+ K$ v; ?' Y- w( L% P, H
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')$ Q. k: `; l$ y; @0 P* [
7 z5 b6 W2 [8 h! U( M! B0 L2 x$ Z
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
# a: r& g# p1 Y( Q7 z% G7 b! @" a ;will break 3 times :-(# |+ R% \7 [7 E+ H0 g8 M& e) `
& ]5 M* [& B) A9 a-Much faster:
f6 f9 _" a% z3 m BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
9 d% e4 Q. a# _+ V) P# u, b; t g' P: a5 T3 n. J% V
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen6 w- L# l9 _6 |+ s
function to do the same job:
; A L# ~& f, I9 @/ ^* |( e! G6 z: _
V4 y7 m, z5 ?( j* z push 00 ; OF_READ1 |1 Z& J+ @* y+ I- I; N0 l u! F9 \
mov eax,[00656634] ; '\\.\SICE',0
7 G: m' p: ]# E' W push eax2 J- \8 {: o0 T6 A
call KERNEL32!_lopen
' w2 f# b2 d# C inc eax
5 J5 x% Y2 F2 _& ?& @ jnz 00650589 ; detected+ {+ ?/ i4 ]: y3 y8 g/ P
push 00 ; OF_READ
; j2 G* T+ a9 Q H mov eax,[00656638] ; '\\.\SICE'
m- Y$ `0 M8 f" A8 h5 p push eax
" G" C J6 B3 n! K P call KERNEL32!_lopen | I9 t% C: h1 L5 h& x4 @7 x
inc eax
' ~; \ _% i0 m5 E# R8 s# V jz 006505ae ; not detected& W6 |9 X8 ^0 S( e6 w P7 X. B
: v9 ?; u" R+ [+ C% }- S" a/ ~! u; {7 L0 G ]) E
__________________________________________________________________________, t U7 E7 n) f* p: _
2 V; b5 A& F7 u
Method 12$ [! {* [0 I' B! @1 H
=========
8 `0 \/ h5 ~- {! V% h8 d# f$ } S6 g( i
This trick is similar to int41h/4fh Debugger installation check (code 057 `% `- a- U. t% E' `
& 06) but very limited because it's only available for Win95/98 (not NT)
# q( w# T, f. H# I( c* B( _8 pas it uses the VxDCall backdoor. This detection was found in Bleem Demo.
& N& p6 D0 D, \$ ?& b/ Q
. k6 D2 u) c+ m# J2 ~5 `7 @ push 0000004fh ; function 4fh$ {, F) J, z2 I- s( U% [ {
push 002a002ah ; high word specifies which VxD (VWIN32)' y _, M% Q. }7 b' z, D* |* c
; low word specifies which service
5 R( C* H e, N2 a7 A" H. D (VWIN32_Int41Dispatch)9 l, Z3 ~) b B+ O3 U- ~+ B
call Kernel32!ORD_001 ; VxdCall& Z' _9 ]3 f! x3 P/ q
cmp ax, 0f386h ; magic number returned by system debuggers
" h& W- [( h; g% W5 j& n5 W2 ^! o jz SoftICE_detected
( O7 P! B# C0 T& `% c
2 e3 G! W" y) @% j2 ]Here again, several ways to detect it:# t4 n _, f7 a- Q
+ s, F0 i4 ?: B) p+ |; _' i j) l BPINT 41 if ax==4f% h, `1 |3 n4 ]2 Q2 @
) q9 J! J; h2 e. v/ p9 ]& Y
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one+ P+ b5 E' X6 G+ m* X( |; k
* Y1 Z9 `7 p0 t BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
) r- w: q" A8 n+ B4 R
7 F _3 z5 D2 Z) |6 e9 p9 e BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!/ y! t; s/ A( C. ~
8 w3 e* U' v$ Q3 V" r
__________________________________________________________________________4 V8 k4 y% O* z8 q5 H
+ _8 W/ P# t- E1 kMethod 132 [9 A" f5 [/ ]) Q0 q$ K9 h
=========3 w2 p. X: _; e( V
( a0 I o8 y. J( q. l9 E% Q- FNot a real method of detection, but a good way to know if SoftICE is
2 x" A* u! i& s- a% yinstalled on a computer and to locate its installation directory.: [ T) k3 L+ l
It is used by few softs which access the following registry keys (usually #2) :4 J" O' A( B+ w% X- X3 T9 v
3 e2 M1 n- y8 \5 Z2 a0 F: j-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
1 J0 N% R1 o4 e% i. _\Uninstall\SoftICE
; K, E" c( X" _/ d-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
/ a& O3 ^8 i }& S1 W' }6 j-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
' @; w2 @3 ^/ `, _1 h\App Paths\Loader32.Exe
- A0 j: }! c p: Z0 g1 T
4 I3 y4 z" T% ?5 u' @5 _) V5 U+ ]- ]* c* j* ]0 k4 j
Note that some nasty apps could then erase all files from SoftICE directory
/ R4 R! _/ o; ~/ @; V# r) u(I faced that once :-(
1 s8 k( C9 I1 n- C8 p* ^: |; A
8 H( L/ V3 J% P, d1 }9 wUseful breakpoint to detect it:
, i# j) n% r% U" B" A4 f+ a5 f; o
' _+ e+ M' [+ L% c) q BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
) b5 K' ^' E7 d( F$ } U8 P8 N7 u2 e/ W8 R8 Q, q
__________________________________________________________________________
7 b/ y) a5 J* O5 [- R0 s3 e" H5 L: r$ u( C
- C1 T! w: P; A" J; {4 uMethod 14
" H+ _# R9 @2 b. f1 t+ c=========, k; @) _) r/ |" d, O
& b: B S; n$ x% k: _: LA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
, n2 N: D) T, ^# u* Nis to determines whether a debugger is running on your system (ring0 only).) p, z# i/ Z* U0 d2 `6 ~) h
# r! Z. f; R& Q# v
VMMCall Test_Debug_Installed W+ @4 C" q I1 b/ O2 e; E
je not_installed
4 z s; o0 F; h% R1 u+ O+ ~8 B% }( e
This service just checks a flag.: z& w* u8 ?0 d# S) D* H+ O. @
</PRE></TD></TR></TBODY></TABLE> |