<TABLE width=500>
- b& U) I' t5 o ^7 C6 p/ _<TBODY>
Z# ` y+ D2 L, O4 K. u6 ?1 I<TR>
: T% q- t; f8 O) @, A" c<TD><PRE>Method 01 }! l/ M( l9 r9 H) e* S: V* `
=========
: }" i/ x) k6 I4 J6 y K$ A0 V, B# O6 H5 C, M6 z O2 M
This method of detection of SoftICE (as well as the following one) is
3 U! U1 Y. C2 M+ h/ M+ k" {8 n. Pused by the majority of packers/encryptors found on Internet.
+ n Q2 x8 {" O" y1 L* q0 EIt seeks the signature of BoundsChecker in SoftICE( u3 d* S7 |) L/ d: |$ x
& P7 l2 `4 c8 R8 q mov ebp, 04243484Bh ; 'BCHK'7 m' {+ q+ [0 T4 U) X
mov ax, 04h* w0 H2 Y3 B0 Y1 X/ k5 e
int 3
1 x9 e$ m9 c5 D, R. Z8 f cmp al,4' o$ p9 f. @1 t' p; w
jnz SoftICE_Detected- V8 }" \* |% e: ?, b5 y" d9 Q4 H
! e! C" k5 ~! R% K) \
___________________________________________________________________________9 {0 Z. f$ b* \& M' A
7 _3 V+ E5 B/ QMethod 02. d0 k1 W) u9 H8 C+ D8 r
========= g' E/ {( J/ y2 ^! L
, ?4 I# G) @2 R* Y& W
Still a method very much used (perhaps the most frequent one). It is used
- b1 w( V$ o% D% tto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
/ |% }0 p& B: @$ D. A* Bor execute SoftICE commands...
/ O! O# D' ^) K7 }- CIt is also used to crash SoftICE and to force it to execute any commands: O) i: C; g; Q! |% h, b( c& r6 Z
(HBOOT...) :-(( 7 k! T2 a8 r( H0 K! G% N2 U0 M6 {
. @8 K6 S' Y/ r* s4 y1 b
Here is a quick description:
: f; n9 U% L% G% h9 P, x-AX = 0910h (Display string in SIce windows)
$ y; {1 Q' q( {6 l-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)- Y* Z, h" w9 P, M5 z: T; D" T J# N
-AX = 0912h (Get breakpoint infos)
( D: X5 m7 f/ Z8 f-AX = 0913h (Set Sice breakpoints)6 x' B7 Z3 J% {0 p* l3 K f& U
-AX = 0914h (Remove SIce breakoints)
# W r5 }& S: M# i( t9 n
l0 b' i! Q- |; h; YEach time you'll meet this trick, you'll see:" x( P+ H0 g- O5 H4 p* V& p$ W
-SI = 4647h6 M$ A M" l% w7 O6 ~- ^0 X* \
-DI = 4A4Dh
& J& a3 M5 U1 _; lWhich are the 'magic values' used by SoftIce.
, L+ O# T% f4 r# ?- u: r8 pFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
2 v- X/ s5 E* V! y7 z; F L
& `" z/ W' _7 X0 O sHere is one example from the file "Haspinst.exe" which is the dongle HASP
8 \8 L- K0 t4 c8 }- LEnvelope utility use to protect DOS applications:
1 g( l9 r* f7 i( m9 ]% ~8 |0 h0 f" K6 e3 q- H- c4 d
& { \8 f, w4 A) a. F4C19:0095 MOV AX,0911 ; execute command.+ j/ F. w: }9 B* L. J4 k
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below)." I& s, H$ C, J3 {' @
4C19:009A MOV SI,4647 ; 1st magic value.# Y+ E' R* b3 s6 g M7 z# Q
4C19:009D MOV DI,4A4D ; 2nd magic value.
1 B! ^& U1 U; ~9 V+ ?& {4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
2 U; I2 u, m. z8 B! i0 S4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
2 \+ O, h! B; o; w4C19:00A4 INC CX' }7 T4 G4 w4 t
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute5 C, M$ T7 j8 P1 ~1 C0 u
4C19:00A8 JB 0095 ; 6 different commands.
6 |% s5 i: ~0 {/ T: p5 u) K+ T$ ~2 t4C19:00AA JMP 0002 ; Bad_Guy jmp back.7 ?# P6 f/ |( N, J
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
. g* N& S- c; m
* \3 T# u* s8 M. X& Q4 m* hThe program will execute 6 different SIce commands located at ds:dx, which
; l, `! q# u v: n: _2 kare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.% @; X& d- H y" |) I& l
; O! X, b- ?' U* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
$ O* j( L7 x' A( `# Q% b: ]. v___________________________________________________________________________
+ O2 j4 b# D3 H8 Q5 {; e
' q! a p5 V2 L4 y! E; F
( }, l: k$ ~$ L2 ~, D9 tMethod 03
2 |- ]+ ^% i" ^$ L" W# T=========& _. {/ u6 ?6 M. s, W8 E
+ l* Z5 {( ~ `Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h' c+ V+ s0 a5 Z! c' }
(API Get entry point)
- B& u5 V5 v& m* F8 E7 b + A" z" L5 y. V6 l& r" D" V( o
`* [2 x0 `8 q* [
xor di,di# {- p$ L6 `* a" |. ?: z
mov es,di
) Y# L9 h( k8 Q0 a- _, C mov ax, 1684h
/ L5 {& n' ^- M( L0 |6 s mov bx, 0202h ; VxD ID of winice
a. w' Q9 }' ^7 }; D' _ int 2Fh
6 F3 `4 ]3 P. Q! Q; ~ mov ax, es ; ES:DI -> VxD API entry point4 e8 Q% `& o* q! g" ^
add ax, di9 I/ h/ O4 ` ~) ?
test ax,ax/ c) @4 k' a; D- ]2 m0 h* M/ U6 y
jnz SoftICE_Detected! j7 P; q$ S9 G- I' Q' u
9 A6 o/ {) I9 y$ c$ I3 s+ }2 w
___________________________________________________________________________7 K: |4 J0 [0 L3 A- Q. B* J$ A
9 a# l* l* j \5 @7 N4 m% ^ nMethod 04. L/ B* x. F/ `7 a; [5 N( v
=========
6 y1 h( P, ~; w
% j" a) V& [ eMethod identical to the preceding one except that it seeks the ID of SoftICE
: ?# A) [! f$ c5 |) x2 _$ bGFX VxD.& \* p4 |3 z$ D7 y9 k. D" L
% C! k, h( @2 i) W9 J
xor di,di
S( B7 k4 O, H1 m" o: [ mov es,di
1 a, z! i% d' E mov ax, 1684h
; e# [1 l8 h5 ]0 H7 Y/ Y mov bx, 7a5Fh ; VxD ID of SIWVID w/ M8 l T* a7 Y' n0 T; J+ G
int 2fh6 ]9 c3 [# l( a7 `
mov ax, es ; ES:DI -> VxD API entry point" C, a$ x/ l4 M
add ax, di
1 \9 y: n. d$ s7 m: c& y6 E4 d test ax,ax
H. ?6 e9 `+ h( z- q0 O jnz SoftICE_Detected
$ K* F. y1 q6 K) M$ j' N
! G) c8 t! g( K D5 O__________________________________________________________________________9 S( s" T; S7 @0 u
1 ]- p8 }1 I. c, ~: s
* G# K0 \; y8 W. s) g3 i; Q3 Q
Method 05: k8 E( [- m% h! u4 X
=========5 \# P2 C; v' P8 R( ?: E/ p
& ^" b7 f7 k8 j: n. y) t3 XMethod seeking the 'magic number' 0F386h returned (in ax) by all system( X2 z; i5 J6 W& T, {; s
debugger. It calls the int 41h, function 4Fh.$ O6 i( A8 h% H& Z
There are several alternatives.
( Z& j/ N5 R% t M# F _) E% d2 o+ P1 }) a/ m: \
The following one is the simplest:
: f1 V( u0 v8 R! Z) O, M8 O6 |2 o' J$ V" A! P; Z
mov ax,4fh0 l' x9 X/ }* c1 @
int 41h: ?: Y- [5 |6 Z& r1 Y
cmp ax, 0F386
9 M; ~7 Z* l$ J1 j6 U. X" D, p jz SoftICE_detected! o+ ^% z4 P' @
% I; T5 r& j: i4 C
. h" W' D% P# f3 I" b ~- I
Next method as well as the following one are 2 examples from Stone's 5 q9 h) o" X9 U6 ^. H9 _7 r! L
"stn-wid.zip" (www.cracking.net):
) }# D2 j2 e* t" d8 Q1 p& y9 q4 }- N$ J/ w2 `' _
mov bx, cs
5 E0 Z4 _2 ~' W$ ?; Y# O# [* J. h) s lea dx, int41handler2
& T; k; U- k$ c: ? xchg dx, es:[41h*4]
$ s6 g4 ~, t" r# i) p) ^ xchg bx, es:[41h*4+2]3 U. s9 p/ R$ Z' j
mov ax,4fh
+ R+ I, M! z' n2 l7 j4 ` int 41h
) h! p% ?* l6 o1 j xchg dx, es:[41h*4]+ i( K, U' F/ i$ N% _
xchg bx, es:[41h*4+2]/ X8 r- X' u }+ P! G8 J7 u; k
cmp ax, 0f386h
. E% M8 X) k- i5 y2 h2 ] jz SoftICE_detected
[6 p& T, b* m# [6 z4 _9 P' h+ P7 s+ b; b4 X7 x
int41handler2 PROC. S* z- L4 s( P( o$ R2 k5 R; V
iret
' b3 W, \; C% Z% @int41handler2 ENDP
7 b& [) S& K2 s( G- O0 B7 J# K
( D4 `. f( D* N) t7 r# _) y! b: L
_________________________________________________________________________% h' ]/ G5 h5 ]( ~. Z& s
3 p" k" O* l. |/ ^) O
4 v: f+ e, n$ X6 G4 G# u
Method 069 [4 b1 L2 h: x( [
=========. r8 S6 j9 B5 j, t, T
1 A" Z% d# U) x m9 @5 k8 ^) m
T# G0 Q- C t/ N9 R+ m2nd method similar to the preceding one but more difficult to detect:' I M: e2 @ p; N, @
% S. f4 ~$ `3 A [
) i( \: R- q7 b5 @1 ?: m6 ]int41handler PROC
W% L/ M0 [+ `7 A( Y mov cl,al
. Y: |& K; R h; j2 J' X7 |$ Q$ X iret8 x0 G- e1 M: w' E5 s: U
int41handler ENDP
' i- Y, B4 G. m( I0 M% E% `! r1 Y7 E: e/ b
8 g! h ^1 W3 ]
xor ax,ax
7 i( j) Z7 A' L4 ]2 c1 A6 v mov es,ax' t$ b0 J7 E0 c% H2 P! X
mov bx, cs9 q! a" r" u" y
lea dx, int41handler1 d: n( j0 j) g4 F8 `3 p" W
xchg dx, es:[41h*4]: C, y7 {1 h. O/ W' M
xchg bx, es:[41h*4+2]6 U: H Y6 N9 y+ @. t5 @
in al, 40h
& j1 v) X4 H$ |6 a" }8 D xor cx,cx
% G# a1 w( x, I/ I: i& B int 41h
* }2 t0 A" O5 c6 p: ^- k xchg dx, es:[41h*4]4 L; d) \, _' D
xchg bx, es:[41h*4+2], T* Y% ~) ]* S$ c
cmp cl,al( L: u7 l6 q8 {; g- H0 T/ w9 O
jnz SoftICE_detected
/ ^# [% @5 Y( r. a x9 a: b
9 x6 `1 d7 @! Z/ K5 M0 u) Q% D: u_________________________________________________________________________( J' y0 O0 ^2 ~( ?: A. F% C) R: {
! Z1 ?# H0 y/ x Y' s% x C9 r) DMethod 07
# W# L$ r+ x7 [# Y2 J% R=========0 ?4 d% ?- Q$ W1 m: u# m, [; n [
1 l! F- a3 J# G7 {& } x. m% xMethod of detection of the WinICE handler in the int68h (V86)& C- \1 n5 q( [ w
4 V; L4 s( v. W7 v% _# S) l mov ah,43h
1 X/ x& p2 w* Y int 68h
* r' s! Q8 H9 @1 a- [1 ~& H( `6 w cmp ax,0F386h
( i& ^" y# @( }' w& Z, _4 P jz SoftICE_Detected; d2 G0 C# _0 b3 j4 J5 [9 J
; L$ O& T6 h$ l$ n9 H! Y+ V% M8 q$ I. f; g8 F
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
& C: }+ `6 R( X/ k1 H app like this:
0 {) s3 E$ x) d- g
$ O8 Q, \7 @, S3 { BPX exec_int if ax==686 k$ c$ h7 P) R5 X
(function called is located at byte ptr [ebp+1Dh] and client eip is4 ] m$ @* X: _( Z8 ]& l0 x# x
located at [ebp+48h] for 32Bit apps): m' c8 c f) o2 K4 W2 U) A, I
__________________________________________________________________________
6 I$ W8 ?; p1 I# K& f( F% v
: C+ e: o" ?5 x% U, S% w
6 c4 f+ g- }$ J1 JMethod 08: D/ H ^' _, P3 _" I. X% O" W0 a
=========1 V$ H* Y+ ~- E3 ]6 F1 e' r
& z+ n, ?2 |) qIt is not a method of detection of SoftICE but a possibility to crash the
# i1 h' U+ S% h, x+ Jsystem by intercepting int 01h and int 03h and redirecting them to another2 K* ] ~; [( F- _* g9 k6 p# c9 z
routine.
1 v. D# U, @& Z, Z" O, G( n# \It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points$ _6 r7 ]7 d( Q0 s( ?. r; q- {
to the new routine to execute (hangs computer...); y A3 y& I& o5 Y4 x; p0 o
1 ?; G" A! B% u: \/ A$ W! t
mov ah, 25h0 U0 B( g" h/ D6 w& u" k
mov al, Int_Number (01h or 03h)7 i0 F N) j( {, K( k; X/ s
mov dx, offset New_Int_Routine
) s& v( v1 q3 Y0 F1 n int 21h
; h3 U% q4 Y1 ~& y1 Y6 X, r# r7 k# }4 x
__________________________________________________________________________) C; y; z f' ~9 B
8 f% P7 e H8 c/ \9 _' E6 n; G/ `
Method 09
# m/ T# E' Z$ x1 Z& {2 A+ f/ Y" _=========
; t t, q9 Q) p1 v' i% n$ X) s# D; w! p- F& v+ Z; [, ~
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only: Q7 ^- G8 U* q+ D+ }' ~6 p
performed in ring0 (VxD or a ring3 app using the VxdCall).
6 M( \3 a/ _ d1 IThe Get_DDB service is used to determine whether or not a VxD is installed# u' ^2 o2 I9 J7 b( l9 a
for the specified device and returns a Device Description Block (in ecx) for
6 `( e; |0 e# s6 h$ Q, T& i7 bthat device if it is installed.
4 C+ ~9 ^5 h- A* ^( v! s; J( I5 l. U' E' Q
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID7 m- l: i" S# g) H# E7 W( ?5 |
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)% ~2 I/ e/ P' S0 W3 G
VMMCall Get_DDB4 [/ Z/ {& U" p8 Z2 B' @! Z6 m. V4 k
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
0 f8 X) X$ X- G5 [, m4 ?4 a- A# d0 c9 B4 P
Note as well that you can easily detect this method with SoftICE:9 S. Z d4 k" A+ e
bpx Get_DDB if ax==0202 || ax==7a5fh
# u( V* j6 H8 ~3 D% X6 N/ {5 R0 f
; p" w, W i; v, S8 V7 t: b__________________________________________________________________________
4 W- _% q5 L& Y4 d3 X7 ^& L+ {5 O0 t* R0 v! H
Method 10, [. O% g/ d3 e
=========
" p8 q$ V+ V$ R5 R% H. S9 [7 U1 H+ b x6 A/ x( ]* U& r
=>Disable or clear breakpoints before using this feature. DO NOT trace with
. G9 |- O. B* P" o/ r$ [ SoftICE while the option is enable!!
1 Y2 H' @5 M# ^ O
{* C3 `* s& G0 LThis trick is very efficient:' A K4 H+ o# k
by checking the Debug Registers, you can detect if SoftICE is loaded4 R* d @$ {. A3 H; ?; S
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
- \5 r% s: y* [2 y+ Cthere are some memory breakpoints set (dr0 to dr3) simply by reading their9 {3 m g0 }9 J' T" w; p Q2 Q! s
value (in ring0 only). Values can be manipulated and or changed as well& ^ O9 j" G! I! x
(clearing BPMs for instance)+ b' V1 l @+ R: o/ R1 B
' m, h9 h1 Q k5 w( R
__________________________________________________________________________' o) |: P9 @" w, A
) c1 [) V- S+ n1 P- j S0 u5 L
Method 11
1 ]& k! `- f* V0 D% j========= D" @4 Z5 S# c2 t; ] F: N
! k5 h% y' _0 N( C% O- ]2 L/ S9 W
This method is most known as 'MeltICE' because it has been freely distributed
. J' K/ K a" ?* J; a: }via www.winfiles.com. However it was first used by NuMega people to allow+ \4 u: ?% b! {. V
Symbol Loader to check if SoftICE was active or not (the code is located
1 S* [4 |& Y2 \8 ~! I+ ~, winside nmtrans.dll).
9 i- K7 P* t M8 Y, ?1 W, d% |1 c. X' A& o
The way it works is very simple:
\4 P3 Z/ ?1 N" R; x) o! R, d9 N' cIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
* l( \3 @# A6 l6 sWinNT) with the CreateFileA API.8 p3 e" H' @5 g" C( X3 h
( G3 G1 R6 F# f/ qHere is a sample (checking for 'SICE'):: r. j' @; K$ `3 I
) t( m5 y: b1 @% Y8 Y
BOOL IsSoftIce95Loaded()
5 x8 T: k& O7 @0 C{5 p! z5 w# t0 |' O: t* c+ Q1 `1 L
HANDLE hFile;
5 o. M1 b" v2 g8 p; `; K& G hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,% b. ^+ h% n2 q4 ] C9 _
FILE_SHARE_READ | FILE_SHARE_WRITE,: ?4 n4 R2 _/ v: k, C4 Y" u" @
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
& n3 V! s# m, O$ c if( hFile != INVALID_HANDLE_VALUE )
9 J7 c) C* ]# |' O; \9 p X {
: i2 S. n' [% N- V) ` CloseHandle(hFile);; D' `" n! R% x
return TRUE;
. x d n' A0 s" V7 C }
$ z# \+ T" j# Q- }. _+ j" G) ~7 D return FALSE;
% V% J, h& P+ m7 T5 S# Z* x}2 T' n; p- w7 Q- _7 o# K
2 e3 _, `% B8 i! BAlthough this trick calls the CreateFileA function, don't even expect to be
" F( N6 ]0 P) Dable to intercept it by installing a IFS hook: it will not work, no way!7 \) @, R& p; {/ S
In fact, after the call to CreateFileA it will get through VWIN32 0x001F- ?6 @* g+ F+ o* O f6 s. R
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
' }- @4 Z& l& t1 J7 fand then browse the DDB list until it find the VxD and its DDB_Control_Proc e- x7 Y+ j8 }2 o$ G
field.
7 j) D. X: T0 lIn fact, its purpose is not to load/unload VxDs but only to send a
7 ^" q1 i! X- ^1 _: i; `7 N( cW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
H9 U) D3 s' u7 Gto the VxD Control_Dispatch proc (how the hell a shareware soft could try: a3 x, W7 S4 b1 `/ K: C
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
. m4 m$ P0 G( FIf the VxD is loaded, it will always clear eax and the Carry flag to allow" `" m' ~8 V( p9 E6 J: ~+ `
its handle to be opened and then, will be detected.' p" e- k3 C+ |4 w
You can check that simply by hooking Winice.exe control proc entry point
& x6 h; |' X9 {5 g; p. v( e; Bwhile running MeltICE.
" X. ~, d; h7 k9 ^6 S) s! F6 z/ [$ A& t6 B! l8 |5 D T3 I
' i$ I, C9 H( A 00401067: push 00402025 ; \\.\SICE4 o6 B3 U) X+ ~: o7 I* G6 Y2 u
0040106C: call CreateFileA6 b. B' D3 y/ K" Z9 i
00401071: cmp eax,-0015 E8 S$ S) `9 R' \9 f) J
00401074: je 00401091/ E N( d7 }+ k
3 n2 L0 ?: \( H' B, L
/ H6 c3 d8 j3 c% d' V: w5 r, h
There could be hundreds of BPX you could use to detect this trick.
. G$ P! C) f5 u! o-The most classical one is:
# Q @9 o) u" w# Y8 z: | BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
+ r+ w/ P( y2 y+ i. K7 S/ `, I K2 i *(esp->4+4)=='NTIC'# B( p. H! R6 w
- }$ N! x) l1 l0 p; x- ~-The most exotic ones (could be very slooooow :-(
: R* v8 F2 @9 b* i* d9 c BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
3 {: [ }( Q! k; z. `/ D) B$ S: g ;will break 3 times :-(
" j/ C0 \/ {3 \! v% z: i$ ~2 D2 k* Y* h. G( B
-or (a bit) faster:
! V% P1 [1 v6 C: o! l# ] BPINT 30 if (*edi=='SICE' || *edi=='SIWV')! T) ?* g8 K% k6 N( ~6 k" {' o, n: T3 Y
$ l" D# u% C2 u( Y' @- U* q1 Y
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' # e! z2 F) m2 B7 G2 H
;will break 3 times :-(
. j, _; [: y( X' B; g" [% d7 m
: i& z1 ^# s2 r) E- e-Much faster:- D# Z) i, Z$ V3 j; o
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
& s; a/ c6 |; i! V, q% }/ v
2 i, F0 j7 ^! \. ]' d" l7 XNote also that some programs (like AZPR3.00) use de old 16-bit _lopen7 D3 f. p o. t! @* A( S
function to do the same job:
' E( Z+ B U5 [ O. a9 F' f" i
6 [6 A" ]2 C1 ]" D2 m+ l& [# I push 00 ; OF_READ# U. s! ?2 [/ `* m, n
mov eax,[00656634] ; '\\.\SICE',07 ~& b! M7 P- V- f2 v! S5 S
push eax
& j! h, K0 j+ N: Z' L0 |; i call KERNEL32!_lopen
! | ?0 ]* u" L8 Q! ^- ]; C0 T inc eax
+ ~6 ^" T# V7 q* A9 @" w jnz 00650589 ; detected) \& l/ Z3 h9 K1 F& B; R
push 00 ; OF_READ
' \7 M" L+ g/ ?' _ mov eax,[00656638] ; '\\.\SICE' Y% m- c0 E* d
push eax
7 I9 j9 n7 f. d& E/ e7 p call KERNEL32!_lopen B3 t- I: z% }( {& s5 d& R
inc eax2 C+ x* ?$ g9 N4 ^
jz 006505ae ; not detected
; \$ _; b4 E! X% j+ K
2 i4 X" y4 ~( O+ r2 f; G6 N0 P1 u
+ Y' O8 j( W0 r( [/ P__________________________________________________________________________
4 \5 R6 L+ l- O* t
2 v. [' P/ |7 L$ e( @, YMethod 12
) x: @& R) X. @=========- a6 G: s" S q( ^ |
. ~# U. }5 }6 _0 W7 G MThis trick is similar to int41h/4fh Debugger installation check (code 05
# M7 m+ l" a! r+ M& 06) but very limited because it's only available for Win95/98 (not NT)
2 i/ V7 u' ~1 L* H7 was it uses the VxDCall backdoor. This detection was found in Bleem Demo.9 i. W2 p! i( ^. G
+ T8 w. I# _* Y4 {+ b7 r
push 0000004fh ; function 4fh: [5 `0 n5 d) r/ u' t y4 a
push 002a002ah ; high word specifies which VxD (VWIN32)) t1 m0 f% @. h- @- V
; low word specifies which service
& r" Y' H h. p+ q9 ^9 I (VWIN32_Int41Dispatch)2 C' }/ v% E5 M0 b9 `
call Kernel32!ORD_001 ; VxdCall
9 n5 w! w& i1 [, @5 q7 G cmp ax, 0f386h ; magic number returned by system debuggers/ a/ ]5 K) W/ F) ?4 j, D: F. i8 |6 E+ B
jz SoftICE_detected
9 ^8 Z" ^. ~$ k
) n5 [+ k' ~* h; G; g" _Here again, several ways to detect it:' h% N; k% h7 c# u8 Y- \* m0 G7 M0 n U
6 V6 x' ]" X4 j3 a: T) A) {" G BPINT 41 if ax==4f$ H4 H4 } H, Z6 \* j4 e; s$ ]. V
6 r( ?3 U7 n) r4 Y! S
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one: z( n6 f% I8 Q% o: D3 f5 j
% {: {) z0 C* x
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
1 ?: n0 Z9 @" T- A3 v3 G" c$ J( F- R( ]) `- R" t6 x
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
8 \ T6 V; ^0 }( r
$ [% Y2 u/ ~% y8 v; h/ g& S__________________________________________________________________________
, P* ?' x% S6 M5 M7 _/ U
! f4 G: `+ {8 B+ l0 fMethod 13; ^7 D6 W. [" {- Y
=========
+ d4 L& T/ `; ]# E- o5 D; G" N+ q G8 Q9 Z
Not a real method of detection, but a good way to know if SoftICE is
- p7 q9 q8 M {5 }( y7 z% ~installed on a computer and to locate its installation directory.( Q" M. r* [+ e0 g
It is used by few softs which access the following registry keys (usually #2) :5 s3 j$ a' V( R, o* e
9 P" T' d$ U! j4 }-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion: K. F- I) t1 w+ `6 A1 A
\Uninstall\SoftICE
( Q* _4 z1 s# \6 Y& v' q-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE" V+ n7 [2 b7 I4 l& e' b
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion* X+ m! j U( a. c5 E
\App Paths\Loader32.Exe
" h* g6 s3 _' F) {' f3 p4 ] J& y) }5 O( G0 u
I7 X e8 n6 H# a% W o! FNote that some nasty apps could then erase all files from SoftICE directory. t9 K( p! j# W' a$ J1 X, @1 ?
(I faced that once :-(+ u/ y" j: o: e; ]4 D2 w) ?
; {& E, w* S! ~$ ~" z9 t
Useful breakpoint to detect it:
, p, K) c& k+ d7 u* S8 p6 N4 e) [4 Y% m. v
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'6 b ~; m* K# N3 k* v
. v- M+ n, c- T+ J: t; d8 [__________________________________________________________________________5 g7 u. d3 |" q( K
% X4 q" p" x3 p$ I0 q9 G% Z2 {& K6 r* D. O7 d3 \( i) V
Method 14
& y' e: W2 ?4 d7 l3 O=========! ?2 \/ x% M# C, q: ?3 K$ {
! o1 T1 d3 z& O% D+ C5 KA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose) @; h Y- G! h
is to determines whether a debugger is running on your system (ring0 only).2 l% B4 Z) r6 Q, ]9 E+ k( u
) ?& n0 O% q' R: P
VMMCall Test_Debug_Installed1 H- |2 @5 D+ ^' n
je not_installed7 L, R6 H" Q: q8 Q( ?
& b% k- |" T' J2 v/ z! e: ], C) zThis service just checks a flag.5 y7 ^; R- {- ^ K* ^- P) S
</PRE></TD></TR></TBODY></TABLE> |