<TABLE width=500>
, J, \8 Z5 e6 n) v u/ F<TBODY>
' o+ e: C8 _- v, E: l. c<TR>" r/ ], B; q: f0 n! p
<TD><PRE>Method 01 1 S- F( b5 W( y2 j
=========9 w6 k; ]( T: }! s& p9 r1 X6 y
0 L& V- p9 u& |9 u/ m1 ~& xThis method of detection of SoftICE (as well as the following one) is& h, b' F9 G, T+ {
used by the majority of packers/encryptors found on Internet.
6 w7 ]3 s6 O: I9 o8 A' k# zIt seeks the signature of BoundsChecker in SoftICE+ ]$ o/ \3 T+ _
9 d" M0 N) z8 [. C b# q* W mov ebp, 04243484Bh ; 'BCHK'4 z: B# T/ k) j: V# v$ h: b
mov ax, 04h
. ]! i& L2 G. c5 Q6 e) Z! X int 3 ! f" q1 c% O) L8 b; u$ ^& \
cmp al,4
# l- c7 j( p- H6 o, ^ jnz SoftICE_Detected" e7 N( j: h# f
9 A5 j7 i, g/ Q2 }
___________________________________________________________________________6 Y6 H; i# l5 B( y. L$ z
( i- z9 Z! @8 X a- b. R: GMethod 02# r, w! U9 ?1 g
=========
9 t3 A1 Q1 T4 Q- B# d# y7 y5 [) ~( M0 I, Q) b0 z" v3 q
Still a method very much used (perhaps the most frequent one). It is used6 o( k5 l7 D/ q- O5 o6 p/ `
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,9 D2 X! B. F2 E* }/ L. I
or execute SoftICE commands...
7 Z. c* K& s: Q: r7 l; w4 L2 mIt is also used to crash SoftICE and to force it to execute any commands
; a; _+ A3 u7 z+ d& P(HBOOT...) :-(( % ^3 j8 ]8 L# d7 B5 t8 Q, c7 v. k) u
. e5 K2 @$ i/ e8 p3 e8 c' A5 _
Here is a quick description:
1 |) D3 M; U: i% n. F" l* u; M8 N R-AX = 0910h (Display string in SIce windows)
! {# ?5 t! v& `-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)9 z, f' u& x1 D. X4 R( m1 ~
-AX = 0912h (Get breakpoint infos)
0 v4 O1 Z# [8 H4 O# w6 F-AX = 0913h (Set Sice breakpoints)' ^' P( p U5 ]2 L* K( q, \
-AX = 0914h (Remove SIce breakoints)7 b) H1 n6 h- N1 ^: k
1 H6 Q, L8 L* W0 w
Each time you'll meet this trick, you'll see:% x5 r; w) E# g& d N# E* x: Q
-SI = 4647h
+ Z% c1 I0 U* [* `- i-DI = 4A4Dh/ M/ v- l( ?- f ]
Which are the 'magic values' used by SoftIce.
' |; G* A% S+ Y- I1 G8 qFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
8 ]6 c# L" a" K O! K$ Y5 K+ _* D! M3 c8 b
Here is one example from the file "Haspinst.exe" which is the dongle HASP8 j6 H" \! D. p$ J6 y! b' L
Envelope utility use to protect DOS applications:
; R3 q) A( n# z1 O/ I$ L
( Z/ ~5 S& f+ ], A! p% e% `7 ^, Z
7 A) m/ R8 j3 G4C19:0095 MOV AX,0911 ; execute command.: _) C1 i2 b# M1 i& b
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).( |4 g0 l3 d+ y7 p2 T+ j: u
4C19:009A MOV SI,4647 ; 1st magic value.; p8 M4 m P4 V# b8 R) A9 O, @0 ?( L
4C19:009D MOV DI,4A4D ; 2nd magic value.
, ]8 F' g" e2 W0 s' I4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
( D7 ~8 v2 I- a3 ]! O3 K4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
, Q3 b$ G& H/ D: N1 M" g4C19:00A4 INC CX
8 y9 F( D' q h6 d& M) _: J9 l- w0 c4C19:00A5 CMP CX,06 ; Repeat 6 times to execute7 w3 F3 c3 I7 I
4C19:00A8 JB 0095 ; 6 different commands.
9 z! R' c3 g% C3 }) I4 G4C19:00AA JMP 0002 ; Bad_Guy jmp back.. Q* k; Z& [7 {7 r& F
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)0 y6 X, i! g" q# Q8 h( m
; G( K& k# D1 J* h# W6 B7 }7 HThe program will execute 6 different SIce commands located at ds:dx, which9 t! c+ V5 v6 N- A3 j$ h H T) X
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
4 q" _1 E; \& Q
; G( F% T+ d9 v, j* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
/ ?7 S' S4 b( |8 e& M___________________________________________________________________________( c7 I/ e+ u. S" ^/ H, Y
( G7 V; ]! {7 R" _
1 C- Z, o' A$ A2 g' G& Q5 s: d: w
Method 03
" ~& i4 {* g2 E9 \% E=========
$ y8 W- f1 i3 k0 x! R+ u- `! f5 g1 Y# z4 A& L* c- D6 s" O4 z8 z6 D& D
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h; Y4 p3 x% m% A
(API Get entry point)( R0 `& K, x2 k4 @+ L0 i7 v
2 P: P( D# `2 Y% F, B& I; ?' J) ]) v; v$ y9 [5 q
xor di,di
4 B4 K4 }7 @) ?0 } mov es,di
$ V: a, M3 _$ M6 p8 h* y mov ax, 1684h - d- h e/ `9 _
mov bx, 0202h ; VxD ID of winice, }9 O& h$ H, i) R( n6 n) f' c w
int 2Fh' _3 }7 O* m: t0 K
mov ax, es ; ES:DI -> VxD API entry point& o o$ V5 n2 k
add ax, di4 }- @( m0 V8 S# c8 F
test ax,ax
, s! V! O. y3 O5 u' F jnz SoftICE_Detected3 B1 ~/ n0 l: w% ?" s( N( C; x$ A# G
5 S! u6 U) z: _- h2 ~+ C
___________________________________________________________________________( t( s7 V2 ?, L8 z5 S
8 G2 }( A0 v z. B6 e% @
Method 04
3 X; W) U5 \( w=========* n" a6 {4 }: u9 E2 I3 v! z' G# v4 M
' f- U) n) U: D
Method identical to the preceding one except that it seeks the ID of SoftICE
2 }3 W: o0 R0 X% ~; jGFX VxD.' M* z; p/ n. |3 \& D
) G* Y3 k0 ~4 _* w; H0 y( R
xor di,di
* x. I( ~, ?+ V [8 b$ u( f6 Q2 B- q mov es,di8 X/ G8 @$ i2 _6 m( s5 T5 ?. j8 P
mov ax, 1684h
& X+ A" p, k' O' n) ]7 E mov bx, 7a5Fh ; VxD ID of SIWVID6 `% ^1 p( b+ q! p: v/ U
int 2fh
2 R) p" @* F. [. G0 | i5 G mov ax, es ; ES:DI -> VxD API entry point
6 e" l$ m/ v; z' a% d; C- | }" X: S add ax, di. h) q( n F$ k) r
test ax,ax) g1 m! `4 O+ |
jnz SoftICE_Detected
, ? P2 F# D Y7 j' `
$ Y1 Z+ ^! `* v0 e; V, B4 S__________________________________________________________________________6 x5 [ d+ K0 s" c: ^
" k3 E1 \4 f; s) G' S6 i8 m( g3 M- G: U7 l7 j8 S
Method 053 G0 H1 Y9 T' V" a+ p
=========4 c; N: W7 Q- M/ @9 X7 [2 W9 T
, _% [% v# y/ |Method seeking the 'magic number' 0F386h returned (in ax) by all system
3 s& K; T/ J1 _8 L Wdebugger. It calls the int 41h, function 4Fh.
) x2 u+ d. {/ x. j; U: x& }6 H5 IThere are several alternatives.
8 Q6 ]" C; a' ~& Z' O, _; U: s
The following one is the simplest:
( I) N$ e! Y% t, M6 [9 M9 [( j% `) b3 e) T, {+ |1 }6 U
mov ax,4fh x$ V8 M3 P0 T0 @% _
int 41h
) P/ {4 X' Y8 s: }4 G- m cmp ax, 0F386- Y: S1 Z% N+ a3 \# n1 E5 A; M( [% ^: s
jz SoftICE_detected2 g" k6 A: ^8 ^ }; ~0 G% v
/ z7 G, R) [- \& }# h
( E/ ], o0 n: y% c0 T/ k; b/ UNext method as well as the following one are 2 examples from Stone's j2 f: F# E- `# b3 v5 x* \; m
"stn-wid.zip" (www.cracking.net):; D( I9 \ C' m
) E; u |- _5 ?0 t" @ mov bx, cs
: s8 Y8 Q0 J+ o- R lea dx, int41handler2
1 j* n; O0 m; v, u* n xchg dx, es:[41h*4]( X- F: w1 Q2 D& w
xchg bx, es:[41h*4+2]
& M6 C. ~7 V+ o% H* `: W mov ax,4fh1 P- v/ G7 N- U. M, W# a) Q
int 41h
; n9 z+ P# N4 i% p$ S3 Z5 [9 C+ ] U7 ` xchg dx, es:[41h*4]
4 |6 q- {$ q2 d' g xchg bx, es:[41h*4+2]+ Q8 S0 N! V6 S
cmp ax, 0f386h1 ?2 N$ m2 i( U9 w
jz SoftICE_detected
7 W- H4 q$ @/ f; n7 E' [; y2 }" Z: g/ s; a; L( c
int41handler2 PROC {! T, `3 e: t) Z: F$ F# I
iret
' l. N6 T, t _5 G: L4 ~int41handler2 ENDP y O1 B* _$ _( w; Y$ V
8 {" r5 O" O& \$ Q; r# K' l& c5 J4 M) C5 C
_________________________________________________________________________
8 \# q: R( E( ^! _) D+ O
0 h9 }& ?$ r/ s. S2 V4 B- Q7 |& W
Method 06" e) S5 @2 X8 G$ p: C: c8 o
=========0 c, D8 M0 R9 d6 c' M$ i. u
q% e2 m* z. H- [% c3 m3 h- T h1 ]
) g3 _. E0 J$ l7 H- ?
2nd method similar to the preceding one but more difficult to detect:: [; L1 ~7 H, s9 D- u2 V
" k+ B7 a" E4 x. }8 n$ @
9 S# J% P' A" s+ j* `! l( u
int41handler PROC
8 d' X* S3 b. l5 I1 ]- D mov cl,al* k( b3 L( w2 \: F4 n) J4 N
iret7 J z' o' D# g4 `$ m% e8 f
int41handler ENDP; M2 s* k% |3 @! P/ {$ G
+ Y l8 G6 T9 y2 m7 P, a2 [/ e
. t) S% A- O( B2 C3 p! m; d+ V$ a xor ax,ax
# K2 k* e0 O: D! {% b2 H mov es,ax- f/ U% G9 f( I8 p( w( B$ m
mov bx, cs. w$ c2 t. u h. K
lea dx, int41handler, c3 d+ g: j, W
xchg dx, es:[41h*4]
2 k6 t8 h5 K8 ` xchg bx, es:[41h*4+2]) z& ]( G1 Y! _" A! |5 }
in al, 40h* n" s+ m4 P( Q/ Z. A4 X( u( N
xor cx,cx
& u; X6 p. {7 o+ I0 z int 41h
' j" ^! l8 r9 ]6 D xchg dx, es:[41h*4]
4 u/ v) d+ u6 c+ T6 M xchg bx, es:[41h*4+2]& m$ B! e: p. Q: s$ U0 q) N2 }3 U
cmp cl,al; { x$ {1 C# t; k- b3 S" d* \
jnz SoftICE_detected7 ?8 V$ o. t6 Y' l/ k5 F
) U* s1 a* z b- j4 h& b2 I
_________________________________________________________________________
0 p* m# d$ ^* e+ b$ E8 }7 L7 t4 i9 F+ T. E; T: A
Method 07: S# V. L$ v1 a, h
=========
9 g) X0 K. e+ F1 k0 U
! M r6 N: w/ e1 N* j, aMethod of detection of the WinICE handler in the int68h (V86)
# } _" @1 S! t+ m r
9 b2 c# n6 D* C9 [/ _ mov ah,43h
- j9 w: ~& _5 ^2 _ int 68h
' C1 P2 K: O2 r! M8 T, c* r; q cmp ax,0F386h: Y8 m O' b6 p
jz SoftICE_Detected3 ?* t1 }2 L e# R3 y
1 G1 J1 |$ D; Y e0 {! Z
3 o0 f0 g" Y/ }. n7 h
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit5 }. Q v1 X) t$ u
app like this:% F ^4 \( J* L, T) H; ~3 q! B
- h5 T0 s& v. S6 V- \) N7 W
BPX exec_int if ax==683 @6 ` }5 _2 `/ X3 N2 d
(function called is located at byte ptr [ebp+1Dh] and client eip is
/ z& |) }- C+ T6 [5 A$ ? located at [ebp+48h] for 32Bit apps)
. S( D4 k" E; f P0 L__________________________________________________________________________
6 O7 u6 N; g( v1 O) B# A
" b5 t6 |& g3 A4 w* M( ~0 b: C3 v& J0 l
Method 08
1 k5 P, H" p) {0 {2 a=========* Z1 o9 p! ^0 d5 i. S2 ?
5 {- s/ k' f+ J5 p$ ~
It is not a method of detection of SoftICE but a possibility to crash the- n# R/ z/ _: d/ `9 v! V/ r
system by intercepting int 01h and int 03h and redirecting them to another
+ b6 X/ }3 S% H) hroutine.
% a) m- b4 q& ]: c cIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points! |; N- T# k; ^6 `. G) J
to the new routine to execute (hangs computer...), U# B) C+ J# q" \
1 H' t1 e7 Q+ A0 [8 G mov ah, 25h _2 T4 u3 ^; C" z4 |/ n/ e
mov al, Int_Number (01h or 03h)
% m( S) ~1 v! I. z2 w3 C mov dx, offset New_Int_Routine4 C! n" K' N: J
int 21h
2 }( I, H. S9 j, w- P4 L5 \
5 B' x" J N( N. n__________________________________________________________________________* B0 Z Y$ x* }
( m* R# z4 N& x8 x' N5 M7 [1 vMethod 09( @* F% \/ ~; u' `9 [( d" n O
=========7 V8 U! F6 m3 A4 n
* ]* f: @4 w* Y) C5 Y5 E
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only {4 Q( F3 c( m/ a* N& c
performed in ring0 (VxD or a ring3 app using the VxdCall).4 J4 C8 ~4 b' v& V( Q/ b
The Get_DDB service is used to determine whether or not a VxD is installed
$ ~5 m0 G' S, @* W! ]* r5 kfor the specified device and returns a Device Description Block (in ecx) for
: O2 q1 E8 a9 a4 Uthat device if it is installed.. t" B8 R/ p. f+ r, g+ j2 M
+ t6 G, L' J: l! g1 _& d mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID$ e5 ^) |8 X1 G3 Z
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)4 Y9 H. r' `6 i+ d6 q1 l
VMMCall Get_DDB# E1 I) u- m) ^6 M1 k* A
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
2 V, b) t- L+ b5 {: w1 m
) Q! x5 a4 M: Z t6 dNote as well that you can easily detect this method with SoftICE:+ t1 Z# C; ~4 t$ b
bpx Get_DDB if ax==0202 || ax==7a5fh& K/ x, m& A D. G3 h+ F
6 N4 b( K2 j2 ~! N' l2 P$ D1 V3 c4 n__________________________________________________________________________
* z1 W2 q4 p; R' `! c; W9 j8 A, S3 Q; T
Method 10
- c4 D# ~8 l( ]9 T$ S=========
- n- r- @/ C& j" R9 U1 M& k$ H
) e/ b; T& y; O0 x m6 Y=>Disable or clear breakpoints before using this feature. DO NOT trace with9 c& ^3 \. Z, t6 o2 D: G- f: Q/ b
SoftICE while the option is enable!!
1 J( L% z$ k" u6 q; O. n# H( p- g; Y8 V' y+ @1 N
This trick is very efficient:* [7 q( R+ w0 U6 [/ g& n1 Q
by checking the Debug Registers, you can detect if SoftICE is loaded I7 d9 l8 e: G. p8 ?# l
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if* n8 d: M% y& _ o- s* t
there are some memory breakpoints set (dr0 to dr3) simply by reading their
6 y2 l' K. e8 Hvalue (in ring0 only). Values can be manipulated and or changed as well
7 N. N- A0 F# b(clearing BPMs for instance)
4 ^! x$ x- _$ R$ t) S$ G4 {
, T6 R9 ]( g0 W4 W__________________________________________________________________________
/ }7 u( @3 U5 V `" A+ V( [% P% x( e
Method 11
6 l/ @. O& w# K3 n( x' ?) S: y4 R' W=========" F7 A2 G' a2 e# O8 t
( `' m3 P" u$ JThis method is most known as 'MeltICE' because it has been freely distributed
. e/ i% p y, s _8 y: ^+ xvia www.winfiles.com. However it was first used by NuMega people to allow% {& l$ ?4 P; K2 J; l4 q4 _
Symbol Loader to check if SoftICE was active or not (the code is located0 J% |, }8 M: A4 y
inside nmtrans.dll).$ z. d: J" N, i' Y0 p" x
* y3 c- u% B2 u; c2 w2 rThe way it works is very simple:# ~+ e8 I }" L5 D/ j, m
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
8 S( |$ \/ C2 `$ DWinNT) with the CreateFileA API., B% u% b6 f0 B; Z
3 ?4 w6 C7 f0 o; l+ k% \5 RHere is a sample (checking for 'SICE'):* b! o8 A, `$ k- d& R0 c
4 d, H4 n* x1 |$ ]- sBOOL IsSoftIce95Loaded()
; r( o, r; A* A5 q{
1 n+ f! R6 ~+ y. z7 D0 W( A( q HANDLE hFile;
% v, r7 v$ V# Z! e# [3 d hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
" }2 V& b! ]+ x4 H6 e FILE_SHARE_READ | FILE_SHARE_WRITE,
& `' t. S6 P1 j1 }! Q- o/ \& D5 W3 G NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
) S3 I, R1 B/ `1 i) G/ J7 [ if( hFile != INVALID_HANDLE_VALUE )
, ^. {: i9 k! D1 G9 H& M" G {
; p+ z4 ^' B P0 I CloseHandle(hFile);
+ I% j, b5 h* T5 P, D return TRUE;: G' }- y" ~9 L& o6 l N
}! F" f/ m9 H, E) M( O! C
return FALSE;& B8 j6 d& D2 V8 s& T. w
}" w5 @4 w$ P+ B+ W9 g9 X8 o
0 j: Y2 ]: O. `3 k4 j1 L2 M8 \. g
Although this trick calls the CreateFileA function, don't even expect to be
1 _- | {; W2 Y0 q" O J N# @able to intercept it by installing a IFS hook: it will not work, no way!- q! _. {6 Z6 M& M
In fact, after the call to CreateFileA it will get through VWIN32 0x001F0 Y$ A3 O# \ M% W
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
) P6 E/ ~ s4 t: ]7 b5 ?and then browse the DDB list until it find the VxD and its DDB_Control_Proc! X, o4 q! h; i& V, ^" [) p4 T8 H
field.9 L) f" `% o e7 v; i3 N
In fact, its purpose is not to load/unload VxDs but only to send a
/ _1 `: f( |: ?9 h, _$ X3 W RW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
" q8 ]& s% G# P* F2 {5 bto the VxD Control_Dispatch proc (how the hell a shareware soft could try2 i) C5 w& \) F7 \- r6 i/ i" g
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
4 B" h8 B1 X: a/ [! V! f5 h5 sIf the VxD is loaded, it will always clear eax and the Carry flag to allow
8 F1 z1 }, q8 u; \) Zits handle to be opened and then, will be detected.! F- i7 a5 t! _& E* ]5 V
You can check that simply by hooking Winice.exe control proc entry point, g" Q. [% R) M2 }2 x% ?
while running MeltICE." h. @* Y' s3 U% j
! v- J) f. {( m- {5 X
% J* K3 C) }& t1 \- K2 ^, m+ T- A 00401067: push 00402025 ; \\.\SICE: l9 e& |( Q8 c
0040106C: call CreateFileA( I, A2 r, c3 G* u1 d4 j! ]9 s. {
00401071: cmp eax,-001
, v1 a4 q/ w+ w3 P) x 00401074: je 004010919 T# f' e+ _2 h
! m. @, S2 k% Y4 l: U! W
* I+ G, W' F8 LThere could be hundreds of BPX you could use to detect this trick.
3 q3 z; O( c( g- s-The most classical one is:
, ]' k* _0 ?( Z5 G- |9 I: K BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
! T( P+ k, l7 D! h7 U t: V9 c *(esp->4+4)=='NTIC'$ |0 I3 }+ T/ d3 z$ F) X
) Y7 U( [: _- e0 z
-The most exotic ones (could be very slooooow :-() ]: |8 x, B, x5 ?! d+ ~' i
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
, i& p8 k: H" W4 ] m8 y4 | ;will break 3 times :-() G2 A2 W2 f* r f/ K
' v9 [: t4 W% Q% |& C0 }4 U% \-or (a bit) faster:
/ \9 N6 F6 w$ C BPINT 30 if (*edi=='SICE' || *edi=='SIWV')+ N/ o" A% A4 L* m7 G% \9 ^ x
7 G: S5 c9 E6 o* j o9 {+ n BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' 9 P1 E2 s' r J! o, _& ~' |
;will break 3 times :-(- Q% I( d; c$ Y( x# X
7 `1 [8 n$ l/ ~9 r" r: X; y
-Much faster:
, a) A" e- N+ Q+ s& c6 M BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
- ^5 _1 [5 q2 v# i8 f5 E# y! A1 Z2 ^) M9 N
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
; A! a2 O( _# R6 Y# Ffunction to do the same job:
3 O) ?% j2 E( d( E. {; L: t/ c% D; O7 N* }. o* A5 X
push 00 ; OF_READ
# K n' l8 `9 M; a/ D0 V mov eax,[00656634] ; '\\.\SICE',0
) @8 D- z9 Y$ H# @! ^5 P push eax
- g/ L& i+ |, h; P# f) E7 C call KERNEL32!_lopen# `3 X i+ H9 o z! F5 g$ W% X- j# G
inc eax3 r% }! j' L) Y
jnz 00650589 ; detected, z% f' k5 ]2 [: d" E& i1 B! k
push 00 ; OF_READ# x8 p: l T! z/ Q' v- D0 p, ^
mov eax,[00656638] ; '\\.\SICE'
' a/ R& l X. F, z. P push eax* k& E! r3 f: e3 ]
call KERNEL32!_lopen% V$ l* r5 z% e& m) T+ a9 O! D
inc eax
{; d6 f' X" R0 @( W8 F jz 006505ae ; not detected, ]; V* s- ^3 u; A( {% W6 @' {! q
' d- }5 X8 q; w' g# y8 H( A
% F0 ]7 y! R% b; u__________________________________________________________________________
+ k. r( z6 a6 F) W/ g/ u2 f4 h8 V% T
Method 12
# E6 k- x5 b1 H7 x5 n=========
& L% O3 @$ R/ I" S. ~6 R: ~$ s! y+ d! ~3 c5 _) \* B+ k
This trick is similar to int41h/4fh Debugger installation check (code 05& d6 Q7 A% I4 c" Z2 w k! V. x
& 06) but very limited because it's only available for Win95/98 (not NT)3 |' c4 s* @: G. }8 l
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.! L& P8 `3 i# r6 }
0 o/ Z. S5 t* u9 e2 q; ?
push 0000004fh ; function 4fh/ j3 z5 f8 w( ^
push 002a002ah ; high word specifies which VxD (VWIN32)
8 f5 v; \9 R. c- r, `* B3 ?* { ; low word specifies which service
1 L% g& ^6 R% X6 [ (VWIN32_Int41Dispatch)
% x# y( m7 c. f7 _5 m call Kernel32!ORD_001 ; VxdCall: i" I. c. r3 I7 x( {' {9 q+ w* x
cmp ax, 0f386h ; magic number returned by system debuggers; ~. l5 r4 m8 W- n. L
jz SoftICE_detected+ s, e/ T: p7 n
U1 f; ^6 o- N# o m" C4 d
Here again, several ways to detect it:. s( v$ H6 I! y$ N& h
2 c; Q0 w5 L7 q8 H BPINT 41 if ax==4f8 M* m1 H3 L5 Q( G& J0 Q Y
) J3 s1 S& s/ S, `) O! U
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one% k) _. x% k8 J
' v7 s/ R, t7 d; D
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A. B+ @9 t7 f* X6 W2 t# q2 b1 P
; [2 e5 ?+ t) ?7 b2 o BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
* {$ w# {6 Y- }: s# |1 A
3 X+ }9 s, r% a0 n2 f__________________________________________________________________________
+ e# Y n a( Z7 [7 `, ~
9 n* _7 }) p2 p# t' o8 x" KMethod 135 B6 Z" j- [. E5 o2 Z% r
=========
- v! G7 [! [+ q/ D" Q% \! b/ g: W) q. v6 w/ X- N7 B8 c7 w
Not a real method of detection, but a good way to know if SoftICE is
- d5 \! h" D4 P U7 f4 z3 Winstalled on a computer and to locate its installation directory.# ^( V( l' T0 @& j& F
It is used by few softs which access the following registry keys (usually #2) :
/ i. f4 _, y6 G
. y+ f4 M9 \6 _6 o-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
4 j2 l) k! Y! f* c\Uninstall\SoftICE8 E( \8 g+ a: m( W8 ^7 B
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
1 n4 v' y- K0 R! }" ~7 q* W0 u- {# Z-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion6 i3 L w, T5 E
\App Paths\Loader32.Exe+ G4 d+ x4 _: u
2 \& R' ~' L4 \+ S. H8 [4 Y3 n
2 I* l! d4 W/ j0 n: P
Note that some nasty apps could then erase all files from SoftICE directory+ u5 X( B" H& V2 p* j+ u% l
(I faced that once :-(
" V* ^# a# u( E+ [, Z: w- Z/ `( c1 d# g" J
Useful breakpoint to detect it:
" q, T( |8 v5 N6 G" |8 w% z% `& d6 I8 Z
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
$ d& V4 S/ u( x1 d" ^+ c+ x7 \, e9 d' {* P2 q j
__________________________________________________________________________
9 R" N1 y/ B3 l* T3 I' s t& s
/ U2 K2 V6 _8 l! V( }, Q- s; h- a4 u- _
Method 14 8 n% q3 B* L; L" L- z
=========: Y7 b) m" M L& N' _/ \
. M0 K. o; j+ H( S: `A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
: `9 a! Q3 X# A8 w2 |is to determines whether a debugger is running on your system (ring0 only). M6 b! H2 H# h- [
0 V, V5 \6 `; R
VMMCall Test_Debug_Installed
' h m; T7 E! C) G je not_installed n. a k) z) ^! H
7 c X8 \$ g6 l, H2 q1 QThis service just checks a flag.) s! B$ x3 Y0 }! W
</PRE></TD></TR></TBODY></TABLE> |