<TABLE width=500>
. J) U2 [, D/ b/ P( q: l3 d<TBODY>
" J% v- F) T1 A/ a<TR>
% L* A) z- S& o% m) ?1 s- t/ l<TD><PRE>Method 01
% Q6 a5 ]8 i3 j0 g* k=========
: ]7 v6 j* [: O% A U2 j/ _. T/ q# I& |% G
This method of detection of SoftICE (as well as the following one) is
1 r7 A$ P0 D/ i- \6 Sused by the majority of packers/encryptors found on Internet.
3 I* H2 H% U4 | a% l5 CIt seeks the signature of BoundsChecker in SoftICE1 l/ W U) m7 u6 u* i' g& M0 M8 A
! x! _! S) c- g g2 g ~
mov ebp, 04243484Bh ; 'BCHK'
w% S/ Q! I' w. s% K# h# h mov ax, 04h" h! O( b! G4 Y l* L2 \+ a, t
int 3
2 }: G1 E8 h6 o8 |9 E cmp al,4) ?/ v, u7 R: Y: Q, K6 z0 p! Q
jnz SoftICE_Detected
! y. ~ R7 }' {5 |- U
. p- v9 t5 u/ z___________________________________________________________________________
0 E' \7 V3 `7 S8 u3 N0 ~# g" s
6 T1 `% p% c- |2 ^: F L# qMethod 024 P' H5 q* J$ I8 o. c
=========- R0 U1 D& | K
- s6 e* V, B6 ?) G0 k
Still a method very much used (perhaps the most frequent one). It is used4 A+ d# H, U( }% h( A
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,: @+ ?# c/ Q4 Q
or execute SoftICE commands...
8 Y* S( R% A' b1 jIt is also used to crash SoftICE and to force it to execute any commands# g' R6 a! h7 E1 }' I' G1 ?- ?
(HBOOT...) :-(( 1 n5 L% d7 _) f) K
6 f; Z7 O( S* Z# A8 ]Here is a quick description:: b2 ?! |4 C/ g
-AX = 0910h (Display string in SIce windows)
! \ v' [+ C( N% i3 [-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)4 E6 q5 m5 i6 K5 f% `% ^+ @5 M0 `
-AX = 0912h (Get breakpoint infos)
' \) X7 ?$ W& v' o-AX = 0913h (Set Sice breakpoints)3 y- K$ Q; J$ p# W* E6 E
-AX = 0914h (Remove SIce breakoints)0 U2 }+ g( Q$ q
& M, c' f: s* C8 ]. ]3 h y
Each time you'll meet this trick, you'll see:
( u" u* @" k' e) i) F2 l-SI = 4647h& S; p! T/ o5 F4 n
-DI = 4A4Dh
9 \0 b" t9 Q3 i5 JWhich are the 'magic values' used by SoftIce.- }( k6 O- R: H* i: ]9 V% \
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
D% \2 J5 m4 W* J* T
- ~9 J' T! L" V* W' w1 SHere is one example from the file "Haspinst.exe" which is the dongle HASP, O2 h* j- N! P! y! ?2 X
Envelope utility use to protect DOS applications:4 Z! M6 O- D, r: a& R
3 k- F: k" ]+ d. H( u1 Y
$ [! ]. L9 b, P+ n0 b
4C19:0095 MOV AX,0911 ; execute command.1 x; r b4 L0 H& p
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
( F! k+ B' F% c" \% O4 B: F& J4C19:009A MOV SI,4647 ; 1st magic value.' K5 t( T& h0 s; G
4C19:009D MOV DI,4A4D ; 2nd magic value.4 j6 m. P) _. M1 n/ C1 x
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
2 ]8 w* F/ R U+ C2 v$ m* g4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
0 ]- t1 @0 t, w2 X( v* r9 G4C19:00A4 INC CX) g, X: u: Q8 a+ f( [ @
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute4 ^% A, m0 h6 X2 G
4C19:00A8 JB 0095 ; 6 different commands.: D7 p+ P# i6 H7 A3 Q
4C19:00AA JMP 0002 ; Bad_Guy jmp back.' C7 w, `) r: T4 T. w
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
# z1 i; L, ?1 y/ \1 E5 x$ O; r" r5 l \0 E! k
The program will execute 6 different SIce commands located at ds:dx, which
! Y6 ^7 P0 v) K1 T- ^are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
0 G2 c7 e7 S: y6 h
5 P. R$ R% c, j* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.: M" i% X( n, K9 Y: ?
___________________________________________________________________________
" [. O: c% S2 @# A6 x! J
5 \2 C0 {& U4 R4 W* Y
0 x4 h# x1 _4 ?Method 039 V/ L0 [4 o% [: h3 f/ o* l
=========
# y2 i8 r3 m; }/ ~+ P- m: A1 h& t' ?, U$ g- W# L
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h: z# K" B! T5 T2 X
(API Get entry point)
7 p% b: h0 N6 l0 g! p( I( p; T . R2 C" }" H7 m x/ y+ N; `* \% Y
: k5 g( l3 k& `4 j' M4 T
xor di,di
, O; _) [5 t* D* r, ~ mov es,di
- F, M3 x! Q; F. M5 W% z3 T# @ mov ax, 1684h 2 i8 r2 s/ L( s6 z# q
mov bx, 0202h ; VxD ID of winice- D* W5 F' z! M! A
int 2Fh$ g+ m3 e8 p- T8 y( s
mov ax, es ; ES:DI -> VxD API entry point# ?* x+ C9 |/ x, g1 m) Z
add ax, di
+ q, U; B% a7 a test ax,ax
9 @1 | ~& _9 N+ Y jnz SoftICE_Detected
. [, F9 |0 i) X& `, u ?. u
4 U8 \2 T( @/ u: q3 _. n' s___________________________________________________________________________
) b; m1 e. _' I( j2 t8 v: F* O' `4 ~
Method 04
+ b' l: }1 L1 W: Y0 s=========
8 y/ @2 [: |. R. n8 X! T& ?& ]( T9 X% c% E; k+ U" t" P
Method identical to the preceding one except that it seeks the ID of SoftICE
9 p. M! C$ l/ \+ x+ r0 _# \GFX VxD.) G9 b: G5 Q3 O$ G; [) @' d
6 W7 w$ o. r* a% J9 B) [
xor di,di
+ S4 f7 Q. }. F. D# O1 u) s. a mov es,di) H# t/ S$ s9 H" b. O4 ^
mov ax, 1684h ) h4 {6 E3 _7 I. i% }' |3 \
mov bx, 7a5Fh ; VxD ID of SIWVID. B* o6 J H; X: Z% M* N2 G/ z' E
int 2fh; q# u. ~; K1 x- }/ u
mov ax, es ; ES:DI -> VxD API entry point+ X, b% k, e( Q4 d. W
add ax, di1 [/ \& R, a0 \8 S
test ax,ax# e/ \9 \/ P, V
jnz SoftICE_Detected7 b# U. r& i( V; k( c4 G1 G
9 X5 E+ L H! B! d: G
__________________________________________________________________________
4 T( M2 w$ A; ?2 W$ e
9 h/ ~* a$ f2 |) L: g( W0 V J! D
4 h# ]- Y' i# i, h% tMethod 05
% N- H* U9 A& S! S' a8 ~) [=========
+ j' z$ L$ m/ }+ u- N4 U
# |) o5 J4 H1 c& [Method seeking the 'magic number' 0F386h returned (in ax) by all system8 E* ]3 H2 ~" A
debugger. It calls the int 41h, function 4Fh.: c2 c5 h1 ^( _; @% c
There are several alternatives. # x- ^3 |8 X9 }0 M
- \2 R/ A8 n4 X `* U5 s
The following one is the simplest:9 d m8 Y* v4 z: ?/ [3 F: d9 b" w- I
, z. H& ?2 F' d- L
mov ax,4fh
& @/ R6 v# x+ K6 i int 41h
. _ j5 X* H8 E& W cmp ax, 0F3869 g3 E$ ]0 c: L A% E3 m
jz SoftICE_detected
: U* H: o; S1 O/ B; n) [8 e* Y& h% Y& R
- N. x& J6 s8 x U8 @* r$ I9 x2 A
Next method as well as the following one are 2 examples from Stone's : m9 m# u& x5 B6 L' l( k! {
"stn-wid.zip" (www.cracking.net):+ I! n# g3 M6 y$ e
( E% o; S/ t1 ?- `% ` mov bx, cs) v0 h0 W; G# ?: @; L
lea dx, int41handler2" {' v4 |" O4 B9 y
xchg dx, es:[41h*4]
; D2 m; z2 v- n5 x0 E8 p& p+ ? xchg bx, es:[41h*4+2]% L3 }4 U! d9 c0 u8 a
mov ax,4fh
/ ]9 ]4 u0 n9 Y7 w6 @ int 41h
! D8 ]" C6 A' |. L xchg dx, es:[41h*4]
9 _/ c- f; f& d7 Z1 ]0 T- K xchg bx, es:[41h*4+2]% d& i3 z% a9 b& P" M
cmp ax, 0f386h. b, y: q/ u6 N* @$ d2 R
jz SoftICE_detected. h! u, X' J8 I
9 K8 M3 f8 ^& J* o6 `
int41handler2 PROC
9 [. ]$ Y: P; |; ~# Q# n( P iret' c+ {: X6 u* D0 j4 O) w u8 z/ X
int41handler2 ENDP
2 K- z- Y6 l! b/ x5 k \, A# i( Y' `$ s/ R
! j3 d; P' j* h0 N
_________________________________________________________________________
2 r* x! O* J: [6 ]: K/ X' T+ c
+ |" _8 l' n; t% Y
$ b* ]6 ~5 `% y1 b/ E7 lMethod 06
: f; l3 r, T% I. k) C0 H9 I=========
2 w$ X2 h. e1 X2 x/ w! [7 g3 R4 Z+ @3 Q! f* Y( C8 p9 H4 g1 K
# k0 `8 q, x9 v. G7 u$ G0 v2nd method similar to the preceding one but more difficult to detect:
) P; n+ J3 T$ w# ~. U
: ~9 U( f) g: o& k7 S4 y( U& w! C4 z1 t6 ^% X* Q
int41handler PROC
# {$ S% L; ]" T* X# P& |' [ mov cl,al
b5 K; o4 D/ Y iret% D4 S3 E# {" F7 B }
int41handler ENDP, j0 V$ y& v) `! O
6 y3 K& Y, Q' B1 @% s, Y
$ x" g" l! v8 [+ M5 t" }2 x xor ax,ax
2 j6 T" K$ B$ L0 @) X* n5 q5 t2 p6 H mov es,ax
# f. u0 Z4 H0 t" U. W$ I( [3 W mov bx, cs
& c4 \, z+ |# A/ x- r6 A lea dx, int41handler! S+ N6 b, J' Z5 j+ @
xchg dx, es:[41h*4]
; Z9 p% z9 n- k7 W4 q i6 s( } xchg bx, es:[41h*4+2]$ K5 x( r* T Z8 E$ B
in al, 40h6 b9 e Q9 m% a. Q: ~9 L0 p! u
xor cx,cx
7 R6 k* V- q& q9 b' i int 41h: b1 D9 I- F N. E' g, T$ x
xchg dx, es:[41h*4]
: {4 | G/ `0 }' d" Z2 R' { xchg bx, es:[41h*4+2]/ ?9 T: a! [% {- A+ \$ O
cmp cl,al
, T5 E2 \0 |3 d3 Z! z4 u jnz SoftICE_detected E! t0 i& x/ F) n) K
* a A5 V; P( ~) f3 p. l+ f2 E1 C: p_________________________________________________________________________' }8 J. R \4 M& |8 r
. Y( \+ C5 k& a- E; P3 t% |
Method 07
% Z/ N) c5 f9 R/ h=========2 s; h8 |5 g6 o; x4 {+ q! w9 ~
2 M, R2 q# o: ^* }8 E7 N6 o
Method of detection of the WinICE handler in the int68h (V86)
& G/ v1 Z- C m$ D0 t
/ `3 r$ H+ w- {8 _ mov ah,43h. V- x4 q& D$ q% h* j% I# y
int 68h6 F3 |( l2 {7 s/ b, H! ]3 Y0 S* o, ~
cmp ax,0F386h1 E7 ]/ m4 E. a8 t$ `5 o
jz SoftICE_Detected
2 J Z/ u* j# M! Z
; ]! Q/ ^$ a1 E' o. R6 M$ P5 b G& [2 S
2 M9 P& n z6 j) ?. v5 D/ I=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit& A2 y: H4 w. }/ A4 I
app like this:
& f$ Q0 m8 Q4 V& S
4 R6 x X0 p/ u* \. R' m. q BPX exec_int if ax==68) X/ v% @; T2 b0 C# Q' d! T
(function called is located at byte ptr [ebp+1Dh] and client eip is: |) v r$ J6 h% \' S& R
located at [ebp+48h] for 32Bit apps)0 [" p1 M& G8 D* E' |
__________________________________________________________________________$ ~$ n1 f+ m. p* R1 Q
3 l& M6 H9 z% |1 }2 @5 y
$ s! l' V1 h4 W( n5 m# ]" |Method 082 p- c0 J1 |' @" V
=========7 i$ K2 y& {, o( `) w( N3 \' b$ C' Q
. g; M! p, B" r4 {5 o, eIt is not a method of detection of SoftICE but a possibility to crash the
4 l( s3 w# H/ l& ` jsystem by intercepting int 01h and int 03h and redirecting them to another* Y: c8 D1 g0 i
routine.
* \# o) v/ k1 F. qIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points {, `3 @1 G: {4 M0 f i3 `$ m, w
to the new routine to execute (hangs computer...)5 V- `+ n* E4 u0 u# _" v3 \3 V
+ b2 p" |. F. T2 z1 p- Y
mov ah, 25h
$ R2 g/ z% H% A) C4 d4 w: D mov al, Int_Number (01h or 03h)
0 j6 ~& ]0 r6 z mov dx, offset New_Int_Routine$ H, s4 [+ b2 j6 k, C. l! @
int 21h
1 ]$ y6 M. R0 Q- n4 u. ]
, ?9 e6 @( S: M' h8 X0 J__________________________________________________________________________* r' I5 N' o& b" y
1 G- _& s& O6 T. c6 a" V8 JMethod 09
" z8 w; D( x# b7 N=========
6 @& Z% t" u$ ]+ f. a7 f; ~2 ~- z, o. W. h+ [& F/ {$ q
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only! a" W- Y N% Y" y
performed in ring0 (VxD or a ring3 app using the VxdCall).0 l* u9 @4 g% Z7 c
The Get_DDB service is used to determine whether or not a VxD is installed
4 ~' O9 l( w2 w. rfor the specified device and returns a Device Description Block (in ecx) for) d& Z* @! R& k+ s! `
that device if it is installed.
0 _, d7 Q5 O; V$ s/ a& C! D, F0 ?- g# H5 W
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID. T" Q$ n# y- _9 l: h2 B2 E$ B
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-): f0 ^% ?% h: {8 f2 F/ t; |" l
VMMCall Get_DDB
: \' k X( D$ b' ~$ F mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed: X' {) e9 e7 b/ r5 `
: h. Z( _% x, ^" l5 P* C) R3 @4 ?6 hNote as well that you can easily detect this method with SoftICE:1 Z, z" S: K, D, \$ B
bpx Get_DDB if ax==0202 || ax==7a5fh
3 I$ f# Q3 C `2 c" a- y% I6 j3 l& I) W2 [) c
__________________________________________________________________________
! R6 c; d% m ?3 I% `+ M8 T8 J# a$ A4 c B g
Method 10
" \" H8 a) [9 f: E) i. D=========* U" ?4 s6 ^9 t& D, c
3 n: A6 Z' R- ?5 B0 ~=>Disable or clear breakpoints before using this feature. DO NOT trace with. z5 X5 b3 ] f1 j( ^% F
SoftICE while the option is enable!!6 O2 {8 T' P/ {; e# {) j
) ]2 W3 h: F- _
This trick is very efficient:
. Y# R Q' H' }! w. u" U5 Hby checking the Debug Registers, you can detect if SoftICE is loaded( g8 R5 x4 X$ N9 M+ X7 S
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
& V. [$ m( @+ O, G9 Othere are some memory breakpoints set (dr0 to dr3) simply by reading their
1 k# n! c, Z7 p" X3 u) e% Gvalue (in ring0 only). Values can be manipulated and or changed as well
" Z, K: a) {$ k( P, U' `3 e(clearing BPMs for instance)
4 ~% v0 w2 A. T! z8 c
- z$ d) `- S9 q! f$ }, E' ^! S__________________________________________________________________________+ w2 W4 l+ h( P" r8 Z+ [( ~
, ~; S* H5 g9 D# t' P
Method 11
/ [7 d8 J6 ?2 W, b=========5 x/ ?2 S- C4 C6 X4 n, N
1 k/ e) l( C' L- h% p% W& w' ^9 uThis method is most known as 'MeltICE' because it has been freely distributed9 x3 J: z% N- F; u$ Z
via www.winfiles.com. However it was first used by NuMega people to allow+ ?- R# |" {& R; Q0 @9 J
Symbol Loader to check if SoftICE was active or not (the code is located
+ |1 W" r6 q, Y9 Q; \inside nmtrans.dll).4 |+ r+ e1 z* l8 E" R9 ?$ n
" {) C5 n# N H* G
The way it works is very simple:& P4 y1 }, D- q( J! C
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
: Q# u: J+ h$ `/ k; ^6 OWinNT) with the CreateFileA API.
! S- j6 e7 K$ R( D* s
. Z' E% U | aHere is a sample (checking for 'SICE'):0 Z: r) Y2 ?+ p2 S
3 N. h8 O" _- w& o+ f- T+ Y5 a
BOOL IsSoftIce95Loaded(). f& k$ _- `2 `; \& o
{
; X# G3 L7 Q6 k0 { O7 v HANDLE hFile; ) o* y5 E- _, j2 c `: ]- G
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,* h; U$ S8 d. _' ~; y! ]. |; d; J
FILE_SHARE_READ | FILE_SHARE_WRITE,3 s! x: {* o. o- I }, x) `
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
$ q' _2 G! [- I4 s7 _" g( K9 y/ q if( hFile != INVALID_HANDLE_VALUE )% i( Z: i0 ~4 q* \# |1 s
{* P$ n! I) Z! i
CloseHandle(hFile);+ a% j; T$ c4 D. b
return TRUE;
4 u: D. h7 X+ Z! `9 Q: j& U6 | }/ }' x) e5 P2 ? \/ G
return FALSE;- V8 {/ p1 {$ O3 ]5 R! e
}
4 [- c( L' Q3 f3 w/ q, @9 c( v3 @, x7 S+ a; u
Although this trick calls the CreateFileA function, don't even expect to be: G' [& W+ `7 \, s+ o) G6 g
able to intercept it by installing a IFS hook: it will not work, no way!
) B. s' }% {, a9 OIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
2 h6 O7 W4 ~1 y! Q8 Cservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
( N0 t, D8 }" G# K( A; [5 I" band then browse the DDB list until it find the VxD and its DDB_Control_Proc
. X% z- ?" I- g$ \, F; G9 K$ Pfield.# j1 k) T& {) D: `) c3 o
In fact, its purpose is not to load/unload VxDs but only to send a
' _' U! O+ c; f8 Y$ nW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)) V% O! I+ X0 D6 o' {7 V# U, K* \( K
to the VxD Control_Dispatch proc (how the hell a shareware soft could try( F/ Y# D, C: r9 G
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
1 }' v$ f0 s% ~+ XIf the VxD is loaded, it will always clear eax and the Carry flag to allow, X' k3 P5 P# d
its handle to be opened and then, will be detected.
* a9 A) W3 ~, }You can check that simply by hooking Winice.exe control proc entry point. V; h# `: N! o% X- {& D, t
while running MeltICE.4 s; r: B& z% J. a; K( G
x2 i* N, R% ^ C. S4 m
, f, }/ k- r% B8 B" \
00401067: push 00402025 ; \\.\SICE; v- t. z6 {5 c# j- c/ k6 n% F
0040106C: call CreateFileA( W% G" Y0 {& M* b" W
00401071: cmp eax,-001
) g8 N3 v" y7 g9 J& J0 H/ S 00401074: je 00401091" a' O& y% [3 w& y
9 T# d3 C6 ^' l( j1 I2 l, O
" ^. N- |" z( G) f' ^1 x ZThere could be hundreds of BPX you could use to detect this trick.0 ]8 Q& a) t& F6 L! |0 I3 [- j! J9 I
-The most classical one is:
3 J' G& l o0 p- s BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
3 i* I" H8 ^2 i# I( k$ y) i *(esp->4+4)=='NTIC'
0 `7 J9 `. p' D4 P1 ^) ]. D% B/ j
-The most exotic ones (could be very slooooow :-(: y- P# K2 x. t7 U* _ b: Q
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
- F1 x9 Q" c+ t9 H3 ^. O7 | ;will break 3 times :-(- D; |" ^: F) t3 l4 Z
! h3 W7 A K+ z6 k4 |: S
-or (a bit) faster: ) j0 D$ B6 H, ^% i/ y6 u* Y
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
+ F- Q. `# P" F- n+ N m" S2 Q# E4 n: _/ J5 r& G
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' % g \/ r M4 Q4 Z, u4 p4 y: H
;will break 3 times :-(
8 _3 a+ U" @2 v0 [9 _3 I1 G6 ?7 Y
. p. N7 Q3 [0 H8 c) k1 l3 Y# c-Much faster:* `( y% S6 V; o( I+ W# q" l) E( S/ d+ s5 ]
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'. O+ `# D! `% _
: ]- ]- ]5 E1 d0 G/ BNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
8 i* A" i+ S2 h5 u2 U4 Afunction to do the same job:
5 P3 C+ f* r( x; o
3 K w( P2 t( x$ i; n8 P% p- b push 00 ; OF_READ
7 u7 Y4 b+ ?+ {3 u mov eax,[00656634] ; '\\.\SICE',0
9 y% k, Q0 C' U( B push eax
# O( ~' P$ K% \* m call KERNEL32!_lopen
6 N* m8 O/ j1 i; i. Z, q inc eax
6 D' t2 N4 A6 [ jnz 00650589 ; detected
! C6 B/ [3 G* V8 z2 u& o" n+ X push 00 ; OF_READ/ F- i0 T* W$ Y8 F+ U
mov eax,[00656638] ; '\\.\SICE'
" D# Y: v. {; j' y! P* Z push eax6 I5 M/ z" l6 C' P
call KERNEL32!_lopen
+ U# S8 M4 S1 q inc eax
% f3 v: ]- i1 o1 ~& N" {: l$ O4 K9 m jz 006505ae ; not detected$ W4 l/ u5 Y g, j
1 s* |2 X1 o1 Z( u4 m/ |4 {2 P0 t
4 x/ Y) u& y% b% m9 L& ^ g( @__________________________________________________________________________& n2 p# d/ C4 K- y$ B, i7 o3 c
" @8 E. r3 ~2 P2 s0 |* G. [Method 12) U6 z4 Q$ p' W. H+ d, F1 D
=========) S8 l) x% ]. V- p. q
: m( P% Q3 w5 d t/ R
This trick is similar to int41h/4fh Debugger installation check (code 05* k1 O3 d0 e4 d. {( ]1 F% p% Z
& 06) but very limited because it's only available for Win95/98 (not NT)
1 H; f$ o1 ~! ias it uses the VxDCall backdoor. This detection was found in Bleem Demo.7 d4 X% }( N1 o c
& a6 O( r- b* X, y
push 0000004fh ; function 4fh
- `3 X" F) [+ `. a g push 002a002ah ; high word specifies which VxD (VWIN32)# `$ M0 `1 e3 B2 S$ N' A
; low word specifies which service3 A- D2 K' s; W6 j
(VWIN32_Int41Dispatch)
# ]' S/ u b- F6 D/ j call Kernel32!ORD_001 ; VxdCall
0 }$ {, d/ g5 k$ T T2 R t cmp ax, 0f386h ; magic number returned by system debuggers7 m- B: U% Y1 u, \ L* G$ Y, t
jz SoftICE_detected* l6 |' P, }# s: ~
; `! R8 X' G' G. q l6 IHere again, several ways to detect it:7 @7 G$ w8 N/ r8 X+ V. h
& A' z+ Z$ H# \9 v/ a BPINT 41 if ax==4f
) G8 g/ I% t8 l6 [. G" k( v
8 S5 f6 v% r% P* a) `5 t3 r BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
7 |6 ?4 P* J0 M$ S2 Y: ~
# A2 }) ] o% w BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
' Q* t6 K5 L" w8 t6 H4 u$ F# A) `
4 `; Z' Y( T, w; o& Z BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
9 N1 n% x2 c ^$ p( _ T
$ n6 c6 h2 X3 O$ Y8 C8 R d" o__________________________________________________________________________# R) W& T5 u! L& f/ z
& w+ v+ z6 e, q
Method 13$ \5 A* m+ S# W7 m: h6 |) c3 o- \& r
=========" I- P4 [- V$ {6 S: L4 i' p
: N$ K+ g( }8 C: p
Not a real method of detection, but a good way to know if SoftICE is' r$ z* d( I* ^7 m
installed on a computer and to locate its installation directory.
5 z6 z8 Q, ?4 C( e) M/ N f/ DIt is used by few softs which access the following registry keys (usually #2) :
5 q: f( D7 {) R$ L1 {) N. \6 h6 C
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
" w( T$ A7 w; l& F: f" x. e\Uninstall\SoftICE/ B( `* z, F$ u' ~. f% V b; `
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE0 W1 h' Y, j( m, b9 ]% Q
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
7 K; M+ G6 W- S\App Paths\Loader32.Exe
" O4 E) Q" Y( y, [, n$ ^* @, F' _. J; v8 H( W" o3 t1 Y! k! U
O# a1 A k5 u t/ C4 K ~Note that some nasty apps could then erase all files from SoftICE directory
2 o# g9 }# F9 E) i/ G1 A( H(I faced that once :-(
4 u2 r; u- Y$ ]( u3 z3 T/ I# _0 ^1 F) R, c0 K6 B3 n1 D
Useful breakpoint to detect it:
F' K6 v/ r) ]1 C6 P \$ Z# _) u1 F8 k9 ]) ^- F3 Y% b
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
5 g: h P$ p) s2 M7 g! B* ^+ n( }8 V6 ^, b4 W
__________________________________________________________________________
% }9 d' m5 ]5 P, [2 ]4 G* A. `& p) A/ ^+ y. C
3 Q {. h6 N0 |- n5 N3 Y: q
Method 14
! m1 ^" ]6 `7 ]7 y" j& `4 f& H; e=========
3 l* ]% C X- }
0 \) B6 ]) I0 f% Q4 B6 ?A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
. `0 |6 k2 O/ l1 n C( E" S- y+ i5 S$ r4 His to determines whether a debugger is running on your system (ring0 only).
+ i8 `# P$ G3 I2 v
* d6 K1 X* i# x, E VMMCall Test_Debug_Installed
7 h) z: g( r4 K" x je not_installed8 u) S5 i1 P6 t" T' k8 P& y
# K2 j/ ^2 X/ J8 v
This service just checks a flag.& M. F; q: }5 J, x8 W' y
</PRE></TD></TR></TBODY></TABLE> |