<TABLE width=500>) y! m4 d% \2 p. R4 o5 g
<TBODY>
, g4 }5 \( @* R# b( N& W! Y<TR>
1 n5 ]. K1 R$ T& z9 W/ d<TD><PRE>Method 01
! [5 e( @2 G4 P4 T; C _" e=========
6 e) k4 t U$ l: Q+ [" `) p% s! K' k+ V9 r" V0 y
This method of detection of SoftICE (as well as the following one) is
# W9 P' k6 W! w Y% ]7 Hused by the majority of packers/encryptors found on Internet.
9 Z- X6 q0 ? ]' V5 ^It seeks the signature of BoundsChecker in SoftICE# ]# E% E" L% n
6 ?; P6 ~% C0 i" m mov ebp, 04243484Bh ; 'BCHK'
+ ]% Y0 u! f* z0 O+ M7 ^5 P7 } mov ax, 04h$ V1 ~! r5 L- |, Y. T' d
int 3
\6 z0 I/ p: a! {; G$ Q cmp al,40 H% V. [: M- H& z
jnz SoftICE_Detected7 y1 v5 e, w+ ^; B: {) k, s
- O7 e, s; Y4 K' c3 u( r___________________________________________________________________________
. E' s( Y% ? j/ p
6 F2 @7 K# N! S/ c, ?Method 028 x% I$ w3 _* b' Q W1 S1 B- Y
=========4 y4 ?) a. A; q3 D6 `% E
' ~& {8 ^5 \. z+ ^7 d* mStill a method very much used (perhaps the most frequent one). It is used
2 r! X% w" }8 R6 ~to get SoftICE 'Back Door commands' which gives infos on Breakpoints,- P8 D: g0 M$ }* M4 H8 w2 U
or execute SoftICE commands...- X8 W: Q. I' e
It is also used to crash SoftICE and to force it to execute any commands' @* q4 T1 _! Q* n
(HBOOT...) :-((
: H0 J# _) u, ?7 Y
6 m! ^$ a% ]) M2 d% XHere is a quick description:& Y+ O- t2 S1 H
-AX = 0910h (Display string in SIce windows)/ P7 B9 a! x q+ c, U3 H+ e; J: c9 l
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)2 Q% u3 `( Y- f$ ]
-AX = 0912h (Get breakpoint infos)
! ?- V2 C4 S" K5 _ i* C; K-AX = 0913h (Set Sice breakpoints)
: @% w+ `5 E4 s% P-AX = 0914h (Remove SIce breakoints)
v0 e* `/ ^5 ^$ q8 M* t* A
& x5 n- |% T) s. H& LEach time you'll meet this trick, you'll see:
9 q \+ w3 ~! t: _4 [6 ]-SI = 4647h" N9 G2 j4 y# K" r9 g% _% p
-DI = 4A4Dh
: `: A& f( y' A% v' PWhich are the 'magic values' used by SoftIce.
1 Q4 i ?, u: P4 J) z' L) k4 GFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.$ [( L$ X. r' @
! Y* p( c( _% ` P/ a$ r$ C+ n
Here is one example from the file "Haspinst.exe" which is the dongle HASP
6 o8 M- T5 m# M7 m. J. W+ GEnvelope utility use to protect DOS applications:# ]) K( x; W( _# ?0 I9 \. C
# Q5 y1 T q) F; ?2 n9 ^
. Z& `$ q+ P+ |5 w/ n4C19:0095 MOV AX,0911 ; execute command.: S( x5 Y m( {! b" \9 U7 `" g
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
, Z6 S' P) H4 F0 l2 C. Z4C19:009A MOV SI,4647 ; 1st magic value.
, M7 V; s+ |7 u% w9 C3 @0 L. X5 i4C19:009D MOV DI,4A4D ; 2nd magic value.5 d+ y1 r) [ o6 U
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
) d+ U5 \" a* r5 t M4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute" B- b, b+ I' G7 R8 Y3 Q0 _
4C19:00A4 INC CX$ X- E6 W; m" v& m) @( b+ N
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute* @4 i% ~ H0 f, f
4C19:00A8 JB 0095 ; 6 different commands.; x, b, A- x! z6 y4 q7 F. l
4C19:00AA JMP 0002 ; Bad_Guy jmp back.
2 a3 K& o/ Z7 F/ l" @( ~7 F4C19:00AD MOV BX,SP ; Good_Guy go ahead :)5 l6 j( z4 C" ^6 ~6 ?7 L
/ Z3 f% l H% z# m6 U' y$ M* c
The program will execute 6 different SIce commands located at ds:dx, which
9 |7 Q4 r7 b8 g4 c& D" W% k: Eare: LDT, IDT, GDT, TSS, RS, and ...HBOOT., \5 K6 X p$ p
" O9 v+ z1 ^; M5 r" L
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded. y, N/ ]1 \2 ]6 D) C$ i0 W
___________________________________________________________________________6 j( f# u8 m& f: a* {
! o1 @5 X3 T7 S
, Z9 j( G: j5 v& y& sMethod 03
1 f+ J) U1 f; h0 j! V8 C& I9 g8 R( r=========/ P: N$ ?1 H$ g0 y0 C4 x* e
0 K& m4 \7 f4 P& v$ X" J7 k6 {
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
% [8 Q$ z6 l; Y) S% ](API Get entry point)! `- s( E0 W: N7 J) U# I" d: C
+ J& b U! P( T+ H! h7 x
1 |9 @, T: Y9 I( Q xor di,di
& W0 _) Q( {" Q% Y% ? mov es,di. n) Q Z# m x0 E
mov ax, 1684h
; V' B2 i0 l0 ?0 V mov bx, 0202h ; VxD ID of winice
: V1 d! U/ n, @7 i int 2Fh- [# z. v) Z: y9 Z
mov ax, es ; ES:DI -> VxD API entry point
' l+ `1 f8 r4 f* m add ax, di2 p2 w0 N5 M. a! w1 p% k
test ax,ax
" v& ] |# j2 W$ ?1 ~ jnz SoftICE_Detected0 A$ O2 q* {: _/ a/ H" T+ H
7 [3 O+ U! l! L) @& `
___________________________________________________________________________
" j( T: x' @. A6 g. s1 L9 V0 }$ W6 x& M' l
Method 04! X9 A) B Y% F; M
=========5 ~; X" @5 s n- d
( e* t! Z k$ ?
Method identical to the preceding one except that it seeks the ID of SoftICE |0 O" X( R" A1 u3 m* ]8 r" ~/ t$ y
GFX VxD.# S6 U2 w- k5 ], J( {
6 {+ f% g& w5 c) m, E( Z' L1 i& Q
xor di,di5 Y5 t4 P( Z9 g0 W
mov es,di
6 e* V0 P) Q( d3 X% @6 P% x mov ax, 1684h ' S; @' k& b5 s) t! O$ K
mov bx, 7a5Fh ; VxD ID of SIWVID
8 H7 l1 D4 f$ i# x& t int 2fh' Q6 U" U! ?- k* K; D* i: V
mov ax, es ; ES:DI -> VxD API entry point7 b% `& U( c, }! N; [; }0 I
add ax, di+ r1 \5 G* y) @
test ax,ax
4 M0 A8 ]4 _% s2 S; `9 A jnz SoftICE_Detected& L; G! d6 B. V% X8 l+ ]1 v
* I6 `& s! Z& s) {2 D6 T6 t; Z
__________________________________________________________________________& E+ A( x: B4 L( F; W
, {& [$ K$ b5 x9 u. L' ]
+ X3 Y! g ^, n; a
Method 05
& }" N* T0 {- F- M# {9 u; ?6 z7 v=========0 Z; \7 a$ q: ]! Z9 z( i
6 p( ]- n- V) K8 a* w2 t0 o: B
Method seeking the 'magic number' 0F386h returned (in ax) by all system4 P/ x$ H8 X( f# O% w/ C5 {3 e
debugger. It calls the int 41h, function 4Fh.0 S( K. @. [" \1 k5 o0 u, {8 |
There are several alternatives. 1 z; ]! h! B% ~5 x/ T4 P
$ R. f( i+ V; d6 @1 l) lThe following one is the simplest:; _ V4 P" ?' K* A( h$ j
3 J1 ]% L: `3 \# a% s [ mov ax,4fh Q3 d- r. |- F3 l1 \& q
int 41h
) Y$ E- p$ @/ v3 h3 H( L% { cmp ax, 0F386
5 a D) D& z% e2 Q jz SoftICE_detected
7 i% j; m( b' m2 w7 ]. t2 D
1 o% u1 W" w, Z) h4 k3 B- S/ x6 ^ I( A, q6 X1 g9 y
Next method as well as the following one are 2 examples from Stone's 4 [$ [% X/ o$ I" A0 S1 ]
"stn-wid.zip" (www.cracking.net):5 `! I- T) g4 C+ K4 w
) ?8 j$ z1 D4 s! W7 z
mov bx, cs
9 Z. X* @. O" s9 e+ d lea dx, int41handler2
/ K8 u' t* F' Q! z$ E xchg dx, es:[41h*4]4 X' |: s: v) g8 e
xchg bx, es:[41h*4+2], n& L% G* V: K2 w9 ?
mov ax,4fh8 ]8 h( H0 W% `! ~
int 41h
+ u1 m' y2 A. i" E; ~. E xchg dx, es:[41h*4]# t& d0 y; S6 \! N4 W! T$ ~ ^
xchg bx, es:[41h*4+2]9 e3 K+ z) R; v* v: E1 y
cmp ax, 0f386h5 x" d4 j- h( e4 _
jz SoftICE_detected7 i. G3 ?8 X" P& w
& e# U, {) U5 u# i: {3 C
int41handler2 PROC2 o. G# g# W% G& m1 ~8 s% G
iret/ M* X8 \5 \1 O- N) s& n; Z
int41handler2 ENDP1 S$ B/ h+ p% m ~/ f7 A W
! r4 i4 }0 c" H+ ?" L& N
1 c. n6 y7 o2 B9 Y9 J% ?4 H
_________________________________________________________________________
- V) [# {* p, S6 C1 W
: E1 {' e' m- I% x! O y
! K( t" I+ i( g/ X' R( N5 x# EMethod 06
5 T& f. E% T5 E6 k+ C& n% b=========
" Y! d$ J) ?) m9 S! p
8 f) A" }* j3 n; c `& B+ l8 `. L1 ~0 f
6 e+ |8 x3 _/ d, F5 N# V4 S2nd method similar to the preceding one but more difficult to detect:
, E3 r* i" V/ n4 R8 c" N8 I4 S+ n4 Z# m% _& C! Z" J1 E
+ X! d( j: T) G. M* z
int41handler PROC
0 B' h6 \6 P8 n/ y3 B4 z mov cl,al! P" ^7 n: W& R- K, G. C
iret0 a6 z& m& n0 k3 l
int41handler ENDP2 F4 m0 t" r6 p
. }! W2 {- v n$ \
6 d R- F. S* H6 S2 v xor ax,ax
4 M6 s1 a. R! w% w mov es,ax0 A; W+ b7 |9 Q; C1 E) d: X
mov bx, cs
" e! {- ^2 d2 x lea dx, int41handler
) ~0 s* S! K$ G V' j xchg dx, es:[41h*4]; j1 k0 c7 d/ ?
xchg bx, es:[41h*4+2]8 B$ v6 G$ G& C0 J% x! t2 X
in al, 40h
8 Q3 z& P( ?2 }+ j xor cx,cx
7 e; ~) a2 O2 k+ x% H6 A0 Z int 41h& ~: d1 W( F% C- |5 H: D; q
xchg dx, es:[41h*4]
1 n: \: g4 ]) ~, H' o. G xchg bx, es:[41h*4+2]; T6 X+ K5 o8 g3 F! M' B
cmp cl,al
* r* f. f' ^/ Q9 C jnz SoftICE_detected
: V2 j& U: B! g0 _4 m" l3 V- h% q4 y! X3 m2 I
_________________________________________________________________________
6 i4 t' q/ y1 X& v0 f
6 h0 p( _4 e7 Y' m) D: v$ U, rMethod 076 i( r$ k) S1 L
=========
5 T3 B$ e; t' H3 t
4 j# [- I' K' f8 y- u/ w) I; FMethod of detection of the WinICE handler in the int68h (V86), l3 f& l& l' \
2 C6 d4 n `* L/ D
mov ah,43h
4 S+ _& Z, \5 Q$ R7 I int 68h
" |; a7 b% X; s5 w5 v0 _% ^ cmp ax,0F386h O& x* A" i I" Z9 i' e
jz SoftICE_Detected8 e/ l/ r' \6 U! h1 u0 u6 i
8 f. n3 S' |9 S' }0 w. O- d% b) z3 }% R1 W
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
- J# [- O' t5 Z9 R( W app like this:
' V8 |8 W w5 k" A5 T1 |! X$ m/ }- H6 B
BPX exec_int if ax==68+ h0 R6 W2 ?: f/ |7 c
(function called is located at byte ptr [ebp+1Dh] and client eip is) R7 f! E1 H7 o
located at [ebp+48h] for 32Bit apps)
- [; ]3 R0 R0 c6 ~9 Z# U4 J__________________________________________________________________________
1 T# G' s+ V: H2 i- e4 r* r
; w4 H( P7 l1 s2 i6 B' J1 P0 _+ K8 z. m3 D
Method 08( [, q0 C& V- N: |! V
=========
: G5 j* t& \4 ?( m, v, m! u( A/ f4 ?& s6 d3 M5 V3 J8 x5 x
It is not a method of detection of SoftICE but a possibility to crash the0 O6 L' L) Z! G9 m# }6 p
system by intercepting int 01h and int 03h and redirecting them to another0 {1 Y4 [ t6 e- g
routine.
' G1 l! d0 M G5 aIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
( ]6 r' K9 d! t' I4 U" Nto the new routine to execute (hangs computer...). M5 y. i+ V& M
7 k4 p/ ?, |7 ]& s* \" @ mov ah, 25h, i0 n- K/ Q* X% e- d2 L$ m5 B' b
mov al, Int_Number (01h or 03h)
3 `. U' u( o1 N6 {- X4 Q mov dx, offset New_Int_Routine
' o) F. F6 p$ z f8 y0 I int 21h
* |8 n* ^1 M, o7 ]; B5 N. x( y! c/ n: [% g# J
__________________________________________________________________________ }+ D% |& g P$ ]! Y( a" o6 c
0 h" l7 o, n6 f% ~Method 09
: U; o! B7 g$ N0 l: @=========; s, Z# D+ X [$ N3 M3 ^% _
) U p' @. S$ hThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only6 j& }4 t* F% n$ } @7 a: h) u
performed in ring0 (VxD or a ring3 app using the VxdCall).
/ C8 C; [4 i. F, M KThe Get_DDB service is used to determine whether or not a VxD is installed
1 P( {) H4 C Wfor the specified device and returns a Device Description Block (in ecx) for. T. G- f% N$ v6 s5 i0 [ x2 O \
that device if it is installed.+ | s2 P8 W! e" _% U' h" U% l
- o! T( g2 V0 D5 V1 Q mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
; ^9 ?. r0 ?5 w" p! J3 V mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
* p$ Q% q" G2 Y$ Z4 y VMMCall Get_DDB6 l6 l$ D+ A/ [# G" h9 B
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed/ ^ V4 z; |/ ?7 x
6 H* F, t2 r1 ?
Note as well that you can easily detect this method with SoftICE:- t% L7 {3 _7 `$ g' S2 O
bpx Get_DDB if ax==0202 || ax==7a5fh
- F2 a* W5 ]) h" z; l0 q- u2 t2 w. k& F& ~
__________________________________________________________________________! `/ A8 k; p+ u$ n6 w$ \
& \8 K+ v* R. m: U7 R
Method 109 K( i" }% M& ]( V- G
=========
& k& q! J( L8 k1 F- E. o4 O b' T' m1 s! C" J1 }* U
=>Disable or clear breakpoints before using this feature. DO NOT trace with& n8 ?! S: u3 ?+ c7 }
SoftICE while the option is enable!!1 p2 n' \9 C. L$ C- ]% ~
/ }" M9 P3 s8 [: J2 Z, l5 C2 BThis trick is very efficient:6 O8 {+ e X6 l
by checking the Debug Registers, you can detect if SoftICE is loaded" R, m! h! W, D& s: A( A+ F
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
' b4 c0 m+ D# a6 K# M" ]5 Wthere are some memory breakpoints set (dr0 to dr3) simply by reading their
5 l$ U6 A# z$ Y3 O! J" r! ovalue (in ring0 only). Values can be manipulated and or changed as well; S. E/ O; z3 @5 ?/ e& c, E
(clearing BPMs for instance)
a# o/ A- v/ _9 {( U) c+ J" H% L- F7 w9 C
__________________________________________________________________________
. }, f# b6 _ T- D/ Q$ D U1 ?+ A4 N2 P& S% d
Method 11! N5 u+ b0 l7 V& o# Y, V
=========
- B2 M0 W; f' x1 o8 a
- y. {, Z, B8 Y1 zThis method is most known as 'MeltICE' because it has been freely distributed
4 g2 j/ Z+ q3 P5 A& @; Avia www.winfiles.com. However it was first used by NuMega people to allow
7 H: N( u* Z% V8 S. zSymbol Loader to check if SoftICE was active or not (the code is located
/ ^8 Q% ~: q) _2 Einside nmtrans.dll). e1 N; \; v! l- N. ?3 U0 y
6 I6 p# R7 m4 e* {8 D( S- q# jThe way it works is very simple:
5 j6 j' O! c# u0 e# e: cIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
. D1 D5 t- N; u' oWinNT) with the CreateFileA API.! @7 B1 W" B6 ~; \# \8 e& C
* A* {. W) Z0 C" jHere is a sample (checking for 'SICE'):: U3 b! D4 G8 D8 r2 Z5 v8 _/ J
. w# B) B; N( [! ^5 V9 I8 ?* bBOOL IsSoftIce95Loaded()2 c. B1 W( h) ]" Q: }
{
, q2 h( t' J' k2 R, B; J8 e: M4 V8 C HANDLE hFile; - C# Q! ^" T( @3 q+ l
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
' F# y* u& M3 U4 A FILE_SHARE_READ | FILE_SHARE_WRITE,
; l( b* Z+ X1 b0 x1 C NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
$ i8 i/ g9 o7 b ]' E y if( hFile != INVALID_HANDLE_VALUE )+ _: f( c1 z y8 m5 M+ D
{$ _6 p; m8 l% W9 v1 H* Y, O( I: v. ?
CloseHandle(hFile);+ N& a) B% m2 {
return TRUE;
) U# x! k6 L4 l% }1 |' B }: T/ d T+ c* }" a5 c
return FALSE;
( F0 `' Z" m, q9 B$ G3 J}# }& L1 i- U- p% a8 y
, F3 R& ?# ~6 e4 L
Although this trick calls the CreateFileA function, don't even expect to be
( H. D S9 V _9 t0 Dable to intercept it by installing a IFS hook: it will not work, no way!" q+ \0 {; A; T' V J
In fact, after the call to CreateFileA it will get through VWIN32 0x001F% r9 |9 P( G Y2 z: C. N' L4 f
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
# O1 z" l1 r( p; land then browse the DDB list until it find the VxD and its DDB_Control_Proc, {. w0 C6 _) R! |9 I
field.
7 P2 g- K* e2 x3 o" z* hIn fact, its purpose is not to load/unload VxDs but only to send a * }! `/ Q+ p. H- w4 J
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)* v2 v0 S' j3 o- t( J
to the VxD Control_Dispatch proc (how the hell a shareware soft could try& ^# Z2 ~+ M# X1 o; f2 M" ~2 i; m, F
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
% e4 I# y' j& T, ]3 Y0 JIf the VxD is loaded, it will always clear eax and the Carry flag to allow/ ]" ?" p+ ]5 c
its handle to be opened and then, will be detected.
# q/ A$ f: F2 U9 S* D3 Y x9 s) qYou can check that simply by hooking Winice.exe control proc entry point
! l0 n2 D$ k' qwhile running MeltICE.: b B# i6 v9 M* y, h. B# D
) J( G$ `/ y q) e9 f
/ l. S' g& S8 |- }7 n- j3 y1 P- U 00401067: push 00402025 ; \\.\SICE2 P) R) z5 S" v- k$ d/ x4 i, s
0040106C: call CreateFileA, G3 E8 }0 x+ |/ n' @+ p
00401071: cmp eax,-001
: H, m' v! k7 V$ j 00401074: je 00401091
& j5 S- d) c+ J9 N* E, `" U5 \4 _- p R) u* E+ p8 s& W& f
6 F( A+ K$ @8 c. j2 h0 ZThere could be hundreds of BPX you could use to detect this trick.
2 u; i8 h2 X% N A5 _-The most classical one is:+ y# v" m' R/ p, t
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||( I# j: B2 _/ f
*(esp->4+4)=='NTIC': j" f* a2 }) Q4 U% W
. h, ^2 F" `) O ]# [. [+ }
-The most exotic ones (could be very slooooow :-(; R5 R( Y3 v- G" E" }% c6 T; Q
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') * g. t7 ]) j; X9 e P
;will break 3 times :-(
! \: ?% f o: ^1 k0 F/ E6 N2 Z# G1 r. S- C
-or (a bit) faster:
M% P: T) W8 e0 ~5 ]: {0 M BPINT 30 if (*edi=='SICE' || *edi=='SIWV')8 Z) l: {7 z' [, ^* l
8 X5 Q% x0 A$ u& g3 q+ ]4 l
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
, H. }, I5 ^/ ` ;will break 3 times :-(
# S. k0 ^6 M. I$ ]8 n
/ v# Q( U$ `8 t9 H- N-Much faster:- m- t7 F, s) F' r
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
1 ~7 Y' f7 w5 Q1 W1 d: q4 ~$ @) U
% {! Z8 I" X2 M; z+ [4 hNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
9 Z& g y& v+ H# I. Ifunction to do the same job:' i2 t' ?" I( w2 [0 o
& J0 m+ l/ U \3 \+ |2 I( ]& e; R: W
push 00 ; OF_READ5 @' ?3 M( d& V5 X
mov eax,[00656634] ; '\\.\SICE',0- I$ t9 \1 J+ _5 |
push eax& Q; p2 H8 l6 i6 M* R
call KERNEL32!_lopen0 u9 i5 W; j" t+ v
inc eax7 R# Z" e7 ]/ w' ]
jnz 00650589 ; detected
& {# ]0 j- a' x9 y( G push 00 ; OF_READ6 d7 x7 L2 N/ f* s- E
mov eax,[00656638] ; '\\.\SICE'' w0 {# b3 `( m/ u( P( ?2 j4 J' L& K
push eax. [% |9 b* Z7 H- C
call KERNEL32!_lopen1 l3 w9 `( {6 j/ L" T
inc eax
9 t8 L: |8 @: W' b4 { jz 006505ae ; not detected
6 K7 f7 g* |- e# S6 y
) u) ^' L" Y/ J7 g* g: _8 p& d' e+ \, Q# z: M6 [
__________________________________________________________________________
+ |; Q8 r# n0 Y* w6 J0 L S7 C
! ?; ` w& F- BMethod 12! ]$ a* g( P" a7 C3 @# E
=========
& s5 f% r$ q F/ ]. Q
2 T: T: Z2 @1 Z4 dThis trick is similar to int41h/4fh Debugger installation check (code 05
! n2 ^1 p7 U3 W! U' I. z8 x) n& 06) but very limited because it's only available for Win95/98 (not NT)* I, ]& |/ J# ` d, S' X, x4 Q
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
" @7 \3 J( V$ m2 o+ v$ N7 o
/ W, E& h5 F# c# X6 Q push 0000004fh ; function 4fh/ V9 B+ Z$ z2 v8 A# H
push 002a002ah ; high word specifies which VxD (VWIN32)
i3 h8 Z q1 N& u0 M* F ; low word specifies which service3 t, B* y' t3 w
(VWIN32_Int41Dispatch)
7 P" S; {5 F, u$ M% `4 R! t call Kernel32!ORD_001 ; VxdCall1 k' E6 `0 m1 S" ?% \$ h
cmp ax, 0f386h ; magic number returned by system debuggers
$ E0 f* Q/ s6 e |7 g; P jz SoftICE_detected$ Q$ ]! a! S9 D1 i+ P2 R' L0 o
! T; k8 G/ F8 \Here again, several ways to detect it:! a0 _; k+ F9 @
5 S8 y! d4 X9 p/ F4 Z, ` BPINT 41 if ax==4f# U+ V( c9 H2 y% Y. `" X5 N' F
* |; U1 c- V, ?* Q+ ~1 X3 f, B4 q
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one% i$ P; l; [1 v0 N4 K9 O- [2 t
+ V+ W& D. I: X! V7 M5 ` BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
+ w! T8 [' e, i2 c" I Q/ n8 E# q! C( E# f
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!& Z7 }5 {& W2 O
8 e8 A; U. S1 ~& O1 S! e4 q__________________________________________________________________________8 y! S* }& v/ L9 C9 T
+ S6 a9 `* j. S9 p2 P KMethod 135 J% s$ E3 B# {" f3 ?$ N
=========5 @/ G5 C2 P% t1 G0 @% d+ m \
4 n3 e& g$ ` h3 YNot a real method of detection, but a good way to know if SoftICE is
7 z, B; K8 M6 q; Z! `installed on a computer and to locate its installation directory.
4 R3 g( r6 n+ h7 m1 W& ?$ UIt is used by few softs which access the following registry keys (usually #2) :5 z) Y; M5 }9 V
0 i; Z3 z! u7 |6 }5 c l-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion9 ]/ A4 K/ v% v; ~9 B* ^* e/ q
\Uninstall\SoftICE
# x7 F7 m" _( |7 y- ` l-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
( t9 R0 J7 u/ m0 c+ g& I0 @+ }-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion/ i, ~9 x+ U6 t& ^
\App Paths\Loader32.Exe
1 s, y Z' o0 {) q1 O+ N% `' t6 L' ^1 d9 a4 p* m0 h* q
2 c8 i4 A5 j# \Note that some nasty apps could then erase all files from SoftICE directory- v/ t/ W7 Y0 G' Q2 m: V b
(I faced that once :-(
! n5 w, A( g t! U) o! ~
$ |8 W; u4 b* jUseful breakpoint to detect it:6 m9 w/ f$ \: k* ~7 q ~* S$ S) t% H6 i
* W0 E7 K& t; x+ P2 v5 d' l
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'- d' r3 a, p/ b
' {- u1 h! Q8 z/ y5 M+ J: [* [__________________________________________________________________________
- H/ u+ B- q& j8 Y
% P8 P6 u% F" K% R) |' K
6 V4 m, y" \3 Y( T+ _" ^: _% E3 @Method 14
7 F6 X! A, r/ i% v4 E, m=========& o" d& u' o. U: V' m
' A+ p1 q8 }; B( ?A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose h x/ {9 Y8 D1 }0 ^' _
is to determines whether a debugger is running on your system (ring0 only).
n; c. r( w6 A2 t6 Z
5 {4 ~ k( |: W+ |8 O" Y VMMCall Test_Debug_Installed
" ?/ J1 }9 y$ J% k/ A: Y9 z je not_installed
/ @9 }& M% A g+ F: }1 H s; E
1 D0 E+ K2 Y: x0 C uThis service just checks a flag.2 j" J8 `, a' r" h. E M' ^
</PRE></TD></TR></TBODY></TABLE> |