<TABLE width=500>
* B( Y! y" ?' F8 D: s<TBODY>
" k1 ~: A! L1 p Y+ E5 H0 |<TR>1 O8 t5 S# W) U( T* b5 {/ S
<TD><PRE>Method 01
+ c: c/ J: [ n+ \3 g=========
8 G/ |. q, L! g1 e9 b* g5 K: x1 b6 ^# W$ I* {/ B. B7 _, @+ m
This method of detection of SoftICE (as well as the following one) is) o8 ^7 _% D2 i: R8 M
used by the majority of packers/encryptors found on Internet.
4 s) Y" I, ]* m0 M9 C% d7 }6 [+ VIt seeks the signature of BoundsChecker in SoftICE
3 `" L6 h) H |$ D( n2 a/ D9 l) e6 T" y( g: g- y- K/ q) R, D
mov ebp, 04243484Bh ; 'BCHK': N) W; Z: ^, `" Y% w
mov ax, 04h
# R) f* Q* p2 f int 3 - o( m* @ z1 W) R
cmp al,45 _; G/ {) n' u4 I3 y* @* v& a
jnz SoftICE_Detected
3 z! X5 B) v9 P9 L; N4 r* B
, z/ F% L) E' A3 N6 M6 `___________________________________________________________________________
" Z- Y8 D5 E8 ^2 y" y% e9 P( h M% F; \& ~" u! x. i1 f0 U# t
Method 02- \* B+ r* c# w8 s. D0 r7 }! R; j- c5 Y/ S
=========
! L- d/ F" J& A- O! n" q& ^, B5 c* b3 x" B! G( s
Still a method very much used (perhaps the most frequent one). It is used$ s) Q; I. [; `( m$ H- `% A- w
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,$ x' m) [6 \3 `! X
or execute SoftICE commands...
- J( P5 l9 z1 t5 h4 Q! aIt is also used to crash SoftICE and to force it to execute any commands
! u3 N; P$ \7 x(HBOOT...) :-((
4 a7 K' G7 [( n- Z% \
9 u$ B- o1 @4 F5 [Here is a quick description:* e- R, d& q9 x. u( E( \2 L
-AX = 0910h (Display string in SIce windows)+ ?- R2 t$ m9 p* s
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
' s; R5 O: w. s-AX = 0912h (Get breakpoint infos)
0 L1 w* I" ?% ~) r-AX = 0913h (Set Sice breakpoints)- y& W. Q/ _' ^5 ?5 C) T
-AX = 0914h (Remove SIce breakoints)
8 r# l p$ a6 M. ^5 P, @8 f4 }( P( B/ L9 e3 a
Each time you'll meet this trick, you'll see:
$ p' t' M/ s+ ~* g# V-SI = 4647h7 E7 Q" q! X0 C1 Z. P( Y
-DI = 4A4Dh
, K8 d$ v8 {# f; Z3 zWhich are the 'magic values' used by SoftIce.
0 g) @+ c0 K( N, Y/ BFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
3 q0 S2 X$ E% d
0 ~ P) U8 k* jHere is one example from the file "Haspinst.exe" which is the dongle HASP
/ M' w5 j4 r: YEnvelope utility use to protect DOS applications:
- a+ C+ t$ s1 D# H& _0 j9 B: z
6 ?! K0 M/ j5 X9 s$ Z ~ e
* b+ A% f7 m; G6 g: [2 \ w4C19:0095 MOV AX,0911 ; execute command.' c6 a3 u0 W$ |: [( G/ O, ^3 f
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
7 M+ G/ P: ?+ t/ I9 g3 g. ?1 w4C19:009A MOV SI,4647 ; 1st magic value.
6 M3 Z5 R! I* E3 B! r4C19:009D MOV DI,4A4D ; 2nd magic value.! G/ q, x5 X0 H) s* I
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)/ d/ k) r+ m3 S; @' }$ p
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute: N4 ]& ]' k B
4C19:00A4 INC CX! g7 f- w# d* C. U( a
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
" p/ |; A: D) j$ b! O4C19:00A8 JB 0095 ; 6 different commands.. P! I4 R9 p$ }/ v: c9 g
4C19:00AA JMP 0002 ; Bad_Guy jmp back.
. A3 b( X& f8 b9 M- Y$ v4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
/ f( U( n" }6 K9 g7 D: j/ L' K; j$ j) u8 C2 N: |) d
The program will execute 6 different SIce commands located at ds:dx, which# z w7 d4 R# L! s \, T
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.2 W( S I) q; p5 }
3 d6 C s$ W8 T! }* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.3 p" T2 N! R; }, z1 o
___________________________________________________________________________
$ H' s6 m+ \. e, x: T, q! b F+ r9 m1 w$ M8 o: A3 @; T# ~: C6 K; T
5 g( e, G g3 Q/ P
Method 03
; Q1 e+ s: L* F# f/ F4 k2 ^=========$ p' z9 b( l$ Z
- M8 b5 g6 H$ Q/ R: qLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
1 l5 i# E) {3 S4 R3 d: h(API Get entry point)& z- d& u% o- C( c7 F3 p3 z6 o4 g
& A+ q5 o0 W! m( r4 y) P) l% e
z, u- L' y5 T" [ xor di,di) k% Y- ?0 w8 s; {/ r* W6 I, g
mov es,di# p1 v( c& `, \5 `
mov ax, 1684h # c" V0 B" g" C
mov bx, 0202h ; VxD ID of winice
1 c2 }; k% e" Y int 2Fh. r d3 ~: N6 u+ V. y0 t
mov ax, es ; ES:DI -> VxD API entry point6 `* @4 U9 U5 C G$ I
add ax, di
6 S- ]8 E! I/ r; X7 z" ~, }7 n test ax,ax& k9 Z6 e; [; k u" t! |
jnz SoftICE_Detected" s7 R$ D- H* V& w
. X/ J+ M! Z4 V; x9 Z' ~' a
___________________________________________________________________________
+ N. o# ^" ?. }( F6 w/ y* m/ z4 a! R# n5 N0 b% Y
Method 04: i5 P4 S/ f# E4 r* b
=========
2 R5 L9 j* F) r) ~' ^
+ o2 T. n& P! f# U9 M8 mMethod identical to the preceding one except that it seeks the ID of SoftICE
% p5 c' X3 [' J) E- c% QGFX VxD.2 Q4 s3 j6 U g
# u9 y; w( e4 C; w) |# i xor di,di
6 t& F: q4 Z1 e0 {5 `: \ mov es,di' f! h$ L- Z; g
mov ax, 1684h
; `9 i" {6 M* [+ Z- |- u5 { mov bx, 7a5Fh ; VxD ID of SIWVID
4 L* M6 N/ F3 g9 O6 C' g% C7 ^ int 2fh3 j9 a& A n5 m) [1 y. j
mov ax, es ; ES:DI -> VxD API entry point
% E5 K% W/ |( U2 L3 t$ A add ax, di
. w+ U3 C0 `0 j test ax,ax
+ m& y! E; y8 l6 P! ~% n jnz SoftICE_Detected, A6 v3 F1 i7 m3 T1 R5 Q6 A$ e7 `
" ?/ H, P; u5 o/ |0 A" B__________________________________________________________________________
- L& K& ^4 ?9 E0 x
: B5 q' i# o0 T& |$ b' w
! { L) d9 i* Z4 \( B7 Z9 ZMethod 059 N; O- M0 q! R1 o( W. I
=========! l& i" f5 m6 d: u
3 ~+ r* C7 s7 ?2 D1 j' \0 H0 X$ W# K
Method seeking the 'magic number' 0F386h returned (in ax) by all system$ l; c9 F7 Q2 Z, y
debugger. It calls the int 41h, function 4Fh.; q m2 j8 G# B$ H( o: {# L6 {
There are several alternatives.
K9 u B: s6 [8 m! B/ U; a' _1 n4 V: l# ]! y6 ~! I9 D
The following one is the simplest:
( x8 @7 x9 J) Q" h
3 N6 A4 M' `+ o. a, o# x7 U mov ax,4fh
5 C5 |; l. u& H9 u% Q% l int 41h: p# n) t( O- s+ T* O9 ~0 \
cmp ax, 0F386
" c3 T0 A8 ~ v/ U z8 Y8 b jz SoftICE_detected2 y( O( H9 E& e: d
5 R2 i O& i% F
* @" w( d8 U. G$ B1 p. n, p
Next method as well as the following one are 2 examples from Stone's
1 I! m) p R( F+ q/ G"stn-wid.zip" (www.cracking.net):
2 P& Q1 b. b$ T4 ?7 m' [( H; r
" Z8 v; Q4 q+ a7 F- `6 N4 L6 B mov bx, cs
. P/ t' U0 a8 R# k# z9 Q: ] lea dx, int41handler2
( x5 N- X5 i' j0 y3 b1 O5 P$ |: _ xchg dx, es:[41h*4]% E" }0 w; a' W2 e% J! G, ]0 @) B
xchg bx, es:[41h*4+2]: E2 ^4 o6 E& ], u4 u
mov ax,4fh! I# P) c) D& O) a6 R5 q
int 41h
/ j; I6 A' i' q6 J, q, l+ g8 D xchg dx, es:[41h*4]
1 k) h0 \7 q: `* n4 M( _3 C1 q xchg bx, es:[41h*4+2]+ I; y$ E9 t/ h$ E
cmp ax, 0f386h
n, n8 [/ c/ u! f8 ? jz SoftICE_detected4 E4 n$ k( \, h$ D' t/ u6 ]# g0 _' n
5 Q* C: Q" h! o5 s, `* c
int41handler2 PROC% Y3 N9 s' P* T4 f; c, z
iret! P$ n6 k! Q9 L1 \$ \, D9 g# X
int41handler2 ENDP
( r& _& N! r' q* W3 v& K1 g. i
+ C* R3 q# I' z0 H/ C% n
/ _- W: b3 j8 p6 P; R_________________________________________________________________________3 H* D. k! {) }
; ^1 W1 B/ \# V9 d% ^* T- u# h" B# B1 a
Method 069 d: s/ A0 o* b; W7 Z! Z/ L+ `9 a
=========4 H$ p' I; w6 \$ I
! N" g: r7 k% p- ~2 z; t% n' [6 n. L
0 y4 k q- V+ `4 I2 I2nd method similar to the preceding one but more difficult to detect:
% L! t& E! I" t+ l' m1 I; n7 e' Y. S& U$ b/ s7 C
% N, a) ^* n$ g& ?/ hint41handler PROC: h5 K& l# E3 ~6 `8 M. b
mov cl,al6 a2 b" z- p& Z- L% T! @, C( o/ e
iret" S1 s8 d) T5 M( O* A+ x
int41handler ENDP
- y ?) ^- Z) S1 f9 R9 q5 x; X( n3 {! B+ R
" N0 ^* I$ X# r" r xor ax,ax2 r1 N! O3 c" v9 b3 ?! L- T
mov es,ax
) R7 u' R9 U: { mov bx, cs6 A9 H# e& C9 Q$ ?6 v( R
lea dx, int41handler
O T9 O% t" d) P! f) _ xchg dx, es:[41h*4]2 c6 H0 n! W% ]. U/ C: n0 U$ ]1 b
xchg bx, es:[41h*4+2]
: j0 o8 C# ~0 H1 P in al, 40h$ P4 s( ~1 h/ @
xor cx,cx
) Q e. c0 e$ n: ]( Y int 41h# Q `# s, m3 }+ R% L1 [8 i* I3 ~
xchg dx, es:[41h*4]
, ^5 X7 V$ D" A( H5 u xchg bx, es:[41h*4+2]
; v1 ^8 s% q, H E, |" _ cmp cl,al& L& O W$ [' y8 a3 m/ |
jnz SoftICE_detected5 Z6 _& I; ~9 m0 K) \
( m2 w% y/ W2 @4 I$ n5 N_________________________________________________________________________4 c% Q+ O6 ^" O0 A4 K
" m; s* z y; \7 g1 }! z
Method 07 ]* X# i+ D6 }+ H/ ?4 O) T
=========3 d# V( r8 `* [, m* ?. D4 S: {9 t
( ?8 `$ L, q/ a9 B; V% q+ vMethod of detection of the WinICE handler in the int68h (V86)
7 {1 V9 W/ m4 ]) L
) f0 i" X5 F; E- \4 F: O+ S" j mov ah,43h8 T, B) q: x+ Y& f: I+ y4 t5 `
int 68h
. \$ ]/ s$ G" U! p" ^( A4 c3 G, K0 p6 i cmp ax,0F386h
) d _' C: w1 @ jz SoftICE_Detected
/ e9 N; z) |% N' [- v1 R
2 X% P) x2 C; N/ c& b- Y0 s+ L/ ]; W9 @
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
5 g3 S- |/ G# G) w0 X- O6 ^3 a app like this:
3 ~0 n$ a5 w k' ]$ m5 P* D1 P3 Y/ |; y# A) B
BPX exec_int if ax==68
5 d, i& _$ k+ n: T1 A (function called is located at byte ptr [ebp+1Dh] and client eip is
- ?, f$ B4 f( e2 G$ o& [: f located at [ebp+48h] for 32Bit apps)
2 D! @# B. u9 I, w- \__________________________________________________________________________1 n, W% k, b) P" q3 j# t
, d' Z" a) I' W- p0 U6 z
# B% Q* @% b) [" tMethod 08" F6 q1 H1 T5 n
=========: U1 T" y% H @7 s7 g# S) w% S' x5 T2 O
/ h2 }- z. ^, Y: \
It is not a method of detection of SoftICE but a possibility to crash the8 w$ ?3 t8 n- }+ d
system by intercepting int 01h and int 03h and redirecting them to another
) f- t( L. |* |+ A; T, o0 nroutine.
/ z; p8 j: l1 `It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
, `+ v, Y4 }! C0 b9 z( r1 E* Zto the new routine to execute (hangs computer...)# M! l2 v: d" d! H
) o2 d; L( j4 ?1 O$ c mov ah, 25h3 B* @3 k9 }4 W
mov al, Int_Number (01h or 03h)/ r% Y6 }7 q0 l' |$ [6 |2 {
mov dx, offset New_Int_Routine. l/ Z3 M) n4 S7 _
int 21h0 J" F8 t( N- j7 M7 i
; B5 U. o; T2 _7 v# [. ?8 X. B__________________________________________________________________________
3 K9 V% ?; T1 _% X) a
8 N% E+ \8 P8 S( j- lMethod 099 _6 ^- @/ t% e. m
=========
6 [& h# ^6 c* }5 ?5 {' B
+ i6 S% M T* F' tThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only& e% T& S* Z. b( c1 ~* W' N& f
performed in ring0 (VxD or a ring3 app using the VxdCall).4 f9 R( T# E& M, R% Y4 R
The Get_DDB service is used to determine whether or not a VxD is installed
+ z$ C# m! C( |& rfor the specified device and returns a Device Description Block (in ecx) for' g- @2 ^0 d \8 l+ T1 @
that device if it is installed.' S& V& T' y6 W/ A
E; A# f+ l% \+ f2 q! k
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID0 d7 j' |2 R5 u
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)7 A6 |3 C8 F& N9 {- Q
VMMCall Get_DDB
" ^6 t1 ~& l ]7 p! P1 @ mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed0 V" y+ t7 M+ S9 I( c
* ?, a! s+ M& n2 L% pNote as well that you can easily detect this method with SoftICE:
- S, K6 \1 n3 V; s bpx Get_DDB if ax==0202 || ax==7a5fh
0 `3 C: e; `( F" n1 S
: S( E/ V' G; [0 v% O# u: b__________________________________________________________________________
, N4 U$ ^2 F" v$ S. y; n" [+ E6 G
, G. i6 |9 X8 u' e- ZMethod 10; v5 o9 ? W+ B
=========
5 c: ^3 }1 F L) C% j1 U) e/ x
+ j' {8 |1 h8 S8 J=>Disable or clear breakpoints before using this feature. DO NOT trace with: ]$ B2 M9 D$ x. v
SoftICE while the option is enable!!
. `$ q8 m7 }4 y" M9 N) ^8 K# Y
/ b3 B% ?. M) f' G) j; @' G. }This trick is very efficient:' l9 N. y! |8 b7 e# V. j- n7 O% V
by checking the Debug Registers, you can detect if SoftICE is loaded$ h' |2 ]" c: E
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if1 s3 g+ R/ H! E+ E, O' T+ V! h" \
there are some memory breakpoints set (dr0 to dr3) simply by reading their
( f# T8 r; i1 |; X/ ivalue (in ring0 only). Values can be manipulated and or changed as well
6 d! s0 l6 l& {(clearing BPMs for instance)) C8 }( h. L; C- ^, S @+ X
' p1 n" S. D+ t2 m( u) L- l
__________________________________________________________________________
1 O2 Z3 x8 l9 y- Z6 e( ]; V4 [ z
7 I3 r% H( b* c; K* y! ~* i) zMethod 11" p: d9 ]2 w$ Q: |+ A5 ?
=========
' T. h' Q6 Z; H& d# f1 k H
* g+ t/ y+ V. w# hThis method is most known as 'MeltICE' because it has been freely distributed" \6 a* ^* u8 W2 i
via www.winfiles.com. However it was first used by NuMega people to allow# ]; M: I9 S! S0 K2 B# B
Symbol Loader to check if SoftICE was active or not (the code is located
, c: j9 F& b# P4 Ginside nmtrans.dll).& e: M1 \2 o! ^6 a' L9 O
8 u) P8 S% G* E& x, I
The way it works is very simple:
1 c1 r( v$ z+ ]' M6 z8 ?It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for3 N/ s V; c1 p" C6 {0 R; p& D
WinNT) with the CreateFileA API.
3 z; P, _7 H9 |7 N6 a) ~; x/ P: v
) {- m Y6 R, H0 ]' d, jHere is a sample (checking for 'SICE'):+ o1 O) _) w- h" K i# j: ~
; M2 O8 W- J5 V5 l+ j) G6 k) ^( {9 C
BOOL IsSoftIce95Loaded()2 G( ]3 h$ x n6 L- m
{
4 o8 V. j* o9 N HANDLE hFile;
! x# V4 X! O9 R) ~4 P hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,' e# O/ T! z7 r3 }+ v
FILE_SHARE_READ | FILE_SHARE_WRITE,3 `' M( w: _; A
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
0 K: w1 s- _/ e+ n/ | if( hFile != INVALID_HANDLE_VALUE )/ N4 K; `& Y9 M$ y
{
& J B3 \& n2 s0 E7 } CloseHandle(hFile);
$ o- p, O7 y( J4 J# t4 j' A- [ return TRUE;8 v1 G- q2 s3 t; \. t8 ?
}- q) g6 Z6 G f
return FALSE;8 R5 l2 s/ A1 G0 D( \2 J
}- q! V* k9 a( H1 F* W6 j6 l5 L
E7 I' o( g, U. T0 w
Although this trick calls the CreateFileA function, don't even expect to be5 h+ ^7 t! m' ^2 w0 y* t" g) W9 a
able to intercept it by installing a IFS hook: it will not work, no way!( }2 c! J2 w- o7 y
In fact, after the call to CreateFileA it will get through VWIN32 0x001F7 i, i# v* j. V: R8 n1 ?+ i" C
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
7 |% ~+ f% a8 V) k: aand then browse the DDB list until it find the VxD and its DDB_Control_Proc! l0 Q( j& ~" @$ d6 W' f
field.( b6 f( X0 N! K% P
In fact, its purpose is not to load/unload VxDs but only to send a 1 Z! D" w. ~. z5 E! G+ K' ^
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE) e- c1 l) h/ p( S7 V1 T
to the VxD Control_Dispatch proc (how the hell a shareware soft could try" ~; s2 X1 w/ u n1 [ G
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
6 \ I8 ?+ G+ U2 vIf the VxD is loaded, it will always clear eax and the Carry flag to allow% |$ d' y$ w. r* G0 x' P2 s
its handle to be opened and then, will be detected.; V) f( X3 s4 N$ L/ X3 S# I+ p
You can check that simply by hooking Winice.exe control proc entry point
6 F- W. U) U1 [while running MeltICE.
1 s5 j. v3 `' d, W
. ~( Q8 ]; ~% J: \, K0 h. z5 Y5 }9 l& ]; F6 _, u
00401067: push 00402025 ; \\.\SICE% x) Y8 {" o" K8 G
0040106C: call CreateFileA8 l1 ]( Z8 Q9 t
00401071: cmp eax,-001
% H: e% W" Q. z) A$ F8 c; A" K: [ 00401074: je 00401091
' r: K4 F( X8 e0 x" ], z
) v8 f/ {) ~" S Q! x: I
4 c8 y/ c; y+ _6 e- aThere could be hundreds of BPX you could use to detect this trick.
' ~! s) b' Y, o* O$ T-The most classical one is:
5 w2 s: o E% t' ^ BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||# z; k3 g. W$ G% f; q: B2 A( h0 c
*(esp->4+4)=='NTIC'. u9 p/ @( S' f. p1 G$ U+ s
8 v4 O7 {* R U
-The most exotic ones (could be very slooooow :-(1 o3 O7 X T$ |
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
6 l* ?9 E3 i8 m# z5 ]& r2 A3 O ;will break 3 times :-(: ?; e5 e. f1 z& o8 K3 o2 O3 r
5 m. Q N3 [3 X0 T, \, _* H0 U-or (a bit) faster: 8 l9 D) m- U. u) |7 d' J
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
, a B! M4 a* q2 d1 i
! e3 o6 Y- \- k# s3 } BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
) x& z" c* |3 X( l/ u ;will break 3 times :-(
; }. ^$ A. S$ ?5 M& ^2 {8 Z4 ~/ p; d6 C: e4 k/ g. w
-Much faster:
, F6 X8 C- b% s% R' Z BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
0 ^ N9 Y( D# e8 J" z2 z( q/ Z/ G# \$ h, H3 z) w# [
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
& N5 E# ~* s% ~5 V# U$ \, Nfunction to do the same job:) e F, O5 p2 R" u. W
' Y8 I" g" O- J1 m% g
push 00 ; OF_READ% O0 a+ u, m( Q3 W
mov eax,[00656634] ; '\\.\SICE',0+ R7 @6 E4 m* S6 G$ e
push eax. f! z9 c5 Y# o( f" W
call KERNEL32!_lopen
* I; ~8 L F. r; M) I. g- O inc eax
e h% o# y- W4 d jnz 00650589 ; detected
* c4 E& ^' F/ m3 ~. M" ?' b) Y, y push 00 ; OF_READ
1 _: |0 S! U! b) A. }* I mov eax,[00656638] ; '\\.\SICE'* I) r7 B% v0 P
push eax
( R* \; F9 n$ }3 E- }8 i3 Q, v call KERNEL32!_lopen1 V! c- C% `$ j) W/ N* Q
inc eax+ c( b- c$ V7 l: a$ P$ d
jz 006505ae ; not detected
H5 K" T" ?' C, S/ ]# S$ ]3 D! l( O- m5 B/ Q6 U7 l1 g
0 z% e$ O2 } N# s1 e
__________________________________________________________________________
; @8 \" w; K& i. E' q! t+ J9 l+ i8 E$ \& n
Method 128 H& P. b, B& X4 K p. `
=========3 `8 ?) G+ x% G
$ G: o7 E u! ^This trick is similar to int41h/4fh Debugger installation check (code 05- c& D8 M/ O5 E/ }0 \, ~
& 06) but very limited because it's only available for Win95/98 (not NT)
+ n; k$ B8 A/ v2 ]& x x/ Kas it uses the VxDCall backdoor. This detection was found in Bleem Demo.6 k4 a. {& @+ z- D0 a
9 W* u0 ]4 _( I9 C V# B push 0000004fh ; function 4fh
0 L# Y2 x4 z0 n+ o push 002a002ah ; high word specifies which VxD (VWIN32)! m+ C6 X- ^6 S/ p" i
; low word specifies which service: W8 A1 v/ ]) u% F" w) Q
(VWIN32_Int41Dispatch)
7 X- ^2 z J4 D5 C, z# k9 K call Kernel32!ORD_001 ; VxdCall! E$ H ^, A; ~" Q, i
cmp ax, 0f386h ; magic number returned by system debuggers
# L. o, I& E7 V% \ jz SoftICE_detected7 L& ]7 A+ ?- r
3 {: T2 I/ n$ F( p1 s8 H8 v1 k
Here again, several ways to detect it:- Q& f3 v( K' t. r1 x, n
! n: w5 R0 ]) x& ~: [$ H8 O1 Z
BPINT 41 if ax==4f
. `7 F* i0 V: ]. {
/ F; N/ J# C5 n& i BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
0 I4 _5 Q7 |( v3 F0 I; n8 \1 Q- d8 h7 K' R) m' b; T
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
. F" A5 O3 u+ L
% ^4 u' @6 ` [1 P BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!7 U- i5 ]' S) a9 w9 V7 E8 o
+ O f. @" e6 D! s( T__________________________________________________________________________ `; v/ ]$ R9 T7 T) w2 @4 f3 n
+ ^) R" ~7 F, w3 r7 x
Method 13% O9 m3 F& ?) k
=========
3 q# }4 N) C, A- f' Q, e7 ?" W: g2 b3 u
Not a real method of detection, but a good way to know if SoftICE is/ j3 k, o$ {* v* F3 ]* _* D
installed on a computer and to locate its installation directory.
, A* A! w% s2 I+ ^8 F3 i7 z" rIt is used by few softs which access the following registry keys (usually #2) :1 q6 Y7 H# t3 u" x5 Q
; o! ?0 W3 g6 i' e; X" z: O3 }3 L( I0 z: w
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
; r; \% {5 v3 W o) V. Q8 |\Uninstall\SoftICE
- p/ z/ j# q2 I1 W2 L-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE/ t5 P' K8 O& g' c3 h" W% g
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
. A+ v. Q+ \5 Z\App Paths\Loader32.Exe
! h$ L5 T3 z7 J% U9 {, P8 i. P
: P& i; {1 N( } T# K# ]: ]
7 E( S3 r) }8 p( t5 V: f& ~Note that some nasty apps could then erase all files from SoftICE directory7 r# ~1 M$ ~9 B" X8 a
(I faced that once :-( \+ T/ P9 X5 y4 M/ |- p
+ [3 }" d4 x7 DUseful breakpoint to detect it:
! _5 Z k" T! h
6 g* @9 x H# F% x+ A$ }2 ]8 _3 { BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE' p: _" X& m+ o% A/ M
. O3 u2 `8 s. _' ^$ p, Z" F
__________________________________________________________________________ E' T% z6 w$ Q/ q6 H
6 Q. L! \8 g+ ^" G3 j7 g. Q
- R. x/ ]% r2 k( d f+ xMethod 14 ; I# ~7 `; D1 {( ]
=========
" D/ i( O' K1 g1 s3 \( L! [' c$ Q% X% o* s
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
( r# |+ d/ Z( }; R$ L$ gis to determines whether a debugger is running on your system (ring0 only).
, I5 }" m' Q1 f$ n9 F& R: B
7 `- O9 @/ L8 f B; j7 b VMMCall Test_Debug_Installed3 J! T4 o1 o6 V5 y( p& N% Z g
je not_installed C! v$ i6 Q5 H4 e
4 o. v g1 [5 ~' z; L% _" CThis service just checks a flag.% R9 s$ L: h0 o* {; {$ j2 U
</PRE></TD></TR></TBODY></TABLE> |