<TABLE width=500>
* V; [. @: ^' a) g9 N7 W<TBODY>$ y, X' k+ a- H" ?
<TR>! { B5 G h4 F5 d# H8 C& e* b* J
<TD><PRE>Method 01
9 y% s7 F& U1 Q0 y; d8 n=========9 a9 \' e+ j8 S ^5 k: j d: W
3 V' O6 P% j) C: Y) w6 k- _
This method of detection of SoftICE (as well as the following one) is
% N. ^, i8 v) z' ~8 k) a) s8 gused by the majority of packers/encryptors found on Internet.
+ p& m" |" \! W+ PIt seeks the signature of BoundsChecker in SoftICE
5 e) |6 V7 f8 t$ ?( M# i) i1 d/ p- z0 Y2 G. z b
mov ebp, 04243484Bh ; 'BCHK'
' M) ]+ I; S0 q3 S7 s4 T8 \ mov ax, 04h7 H6 P A: o! Y
int 3 , W- c H- S+ A( B2 v' J k3 S$ o) I
cmp al,42 F# o8 v5 m4 R ~: l7 w
jnz SoftICE_Detected
% m2 L3 ~. }8 U7 j0 n( i# p5 B( f, A) n# A' V( K7 S
___________________________________________________________________________6 g- Q6 L q$ H
. A9 Q" J- i: F" u. p6 M
Method 02( r; p( H' J7 U$ N
=========2 Q# @- J: N+ b9 {& q9 ^
% a& D! q6 V0 x+ ^5 u
Still a method very much used (perhaps the most frequent one). It is used8 {- {- U' Q& W
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,) w3 o! F, s% s
or execute SoftICE commands...
v0 f& {7 ~( m' j- O1 kIt is also used to crash SoftICE and to force it to execute any commands# `2 D4 O+ `1 D
(HBOOT...) :-((
' d$ S$ X, l2 }* v9 @% k% v2 ~
Here is a quick description:% }. B& [& O9 X5 n; Y5 |
-AX = 0910h (Display string in SIce windows)6 @. B: W6 u; r: T1 @
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx), _7 N5 z; @+ h" c5 j2 @
-AX = 0912h (Get breakpoint infos)
7 x# V! l L# y0 x# W-AX = 0913h (Set Sice breakpoints)
6 @4 d4 C, e- S9 W-AX = 0914h (Remove SIce breakoints)$ ]% V; ~ } o# f4 v
9 g& g# N! \) U) I4 i' jEach time you'll meet this trick, you'll see:8 _0 ^. h8 v$ \/ l9 L; J* o
-SI = 4647h
/ G- N6 k) v j% j% H0 a8 g-DI = 4A4Dh7 {2 c6 u* o- z* g) l* R+ O! z
Which are the 'magic values' used by SoftIce.
4 l# z+ g, ^" H& TFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
) T8 _ S/ b7 |+ w4 q' a& y# j, u* K$ ~( _" s6 i2 C
Here is one example from the file "Haspinst.exe" which is the dongle HASP
, N( [; b* e" N+ o) x# HEnvelope utility use to protect DOS applications:1 d1 S1 b$ y- e' H l& Z
4 H/ @7 i2 I g) ^7 v4 Z
9 L# c0 @+ f) r( a: R& [% F, L4C19:0095 MOV AX,0911 ; execute command.8 }) Q2 R- l6 P7 q% b8 a
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
9 D5 u+ R) m. L& X5 _- |! H4C19:009A MOV SI,4647 ; 1st magic value.
8 f# k r8 L9 d! S ]/ V- l4C19:009D MOV DI,4A4D ; 2nd magic value./ `$ ^" |5 m% z- O* B
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
6 P3 j* H, Q0 g a2 H! A/ o4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
$ n% O. m) Y A6 D2 K4C19:00A4 INC CX
+ V, y {! \8 X$ r5 f3 Z; m- {# o4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
$ t6 C2 m' n: |4C19:00A8 JB 0095 ; 6 different commands.3 _& Z+ l2 S8 u( e* n# V
4C19:00AA JMP 0002 ; Bad_Guy jmp back. k; {1 v+ ^6 Z4 t9 O
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
8 h' A7 F7 k* m( ]' J
+ K' W" C3 Q7 `( C9 eThe program will execute 6 different SIce commands located at ds:dx, which
) S+ F! v2 e9 V1 O* gare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.8 G/ T) x& q4 q+ u5 b
4 c' H- w9 Z2 W
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded./ A7 k1 p. d" b |
___________________________________________________________________________7 q& U3 D3 T4 g% P$ s! b
- z. r" k6 Q! r) B; z' d0 z2 C
( |& C/ q; l$ ]& Z
Method 03
+ b8 K' v F* j& ?, Q9 z=========. O9 o- Y: r4 u+ {" T+ n: s$ H
" g ?5 B/ `, f" ^+ | `# p
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h( m( R5 `1 m- K7 b$ E
(API Get entry point): o* _$ T2 K" Q, L- [
k* E7 D' L( g7 B- B: ^
& C0 B0 h! j2 o* j" ]9 e, l' ]9 ] xor di,di+ L$ _( q+ u9 V& b7 r
mov es,di
5 Y' { q( o. _2 B, g mov ax, 1684h 1 s9 `. t& T" i& ~ A: _& J$ W
mov bx, 0202h ; VxD ID of winice7 w. N" T! x) y+ b. w* ?4 d2 s
int 2Fh3 e/ I+ j8 y& f+ G: q# s
mov ax, es ; ES:DI -> VxD API entry point
# S: v- x( s. X& A" L add ax, di% P, d: k- i; e! u8 M, X6 }
test ax,ax' M# I8 r) j* b( {: s
jnz SoftICE_Detected
$ g$ o+ u. I; S# G5 ]) ?
7 s9 g q2 N/ I/ m* @' z___________________________________________________________________________4 @( @9 |% y! s$ Q
0 P3 ?5 e. w5 H U
Method 04
1 T3 S% m: M+ a3 B# v8 D- i=========
2 L: x! ^$ r) v# u
% w5 z4 h' Z% g1 OMethod identical to the preceding one except that it seeks the ID of SoftICE
/ i& q+ a3 J! z% e( u R" [+ \1 ^GFX VxD.
/ S1 O p8 O0 [& y5 c/ F# \5 V. U+ E* @% k
xor di,di) m `9 V6 I$ r$ C, A: [
mov es,di
1 V' ]- `3 }3 T7 [& F+ ^ mov ax, 1684h
9 H( o9 F/ W# E$ J) `# p3 e mov bx, 7a5Fh ; VxD ID of SIWVID
" _4 z ?2 n0 H6 E, D, L& t3 C( F int 2fh
! L7 H6 ~- W( ?$ C, `4 o" E0 `! f$ t mov ax, es ; ES:DI -> VxD API entry point+ m* @/ T3 y" U3 `' a( _7 f3 K
add ax, di
4 o# X4 h% `% L# h4 c# a) v: |9 ~ test ax,ax! i0 } G' T$ e* x8 G1 O
jnz SoftICE_Detected
: |$ |1 j+ ?! [+ K/ L/ A; G- a: I% k* _
__________________________________________________________________________
) O. ~: o7 t$ F" t- b) j' k4 P& v$ G/ U& k* I' ^' Y
0 D: W* k* e1 f, EMethod 05
9 H2 \7 E: o1 A3 Z5 b=========
7 L: y* S/ u9 d" ?1 C9 }2 i; l" c+ a8 [5 m4 Y, M- k- D9 m
Method seeking the 'magic number' 0F386h returned (in ax) by all system4 M7 q; _) p8 T4 H. B* H; o
debugger. It calls the int 41h, function 4Fh.( I W, }7 P; @% U
There are several alternatives. 3 s( R8 c: K5 z; A1 S% c
: e7 ~( G7 [8 `
The following one is the simplest:6 S9 J [7 C; h8 `! X) F* ~
( F: S' M% N5 i: h& { mov ax,4fh
7 t- Y7 u/ f: m int 41h
0 S# k6 F# l: S: O1 x+ d. H& K% G0 R cmp ax, 0F386' r7 A3 v, V9 S% h/ p* k
jz SoftICE_detected
# g% ~* {) ~8 g$ l' B/ }% v7 n, W0 W6 K9 A$ h5 y
. {: o2 W- p( J9 M, K( RNext method as well as the following one are 2 examples from Stone's % |& P; ^7 T, P2 q; f% ?7 t& x
"stn-wid.zip" (www.cracking.net):
7 |! U+ u' x; |# U) @
a" A+ o; c* G( ^ mov bx, cs
# |" F! E6 q0 `1 y& Q- _) \ lea dx, int41handler2
( f3 ]6 A( h# \( }+ n7 k xchg dx, es:[41h*4]! E; f6 F" v0 ^5 L6 M) a5 r
xchg bx, es:[41h*4+2]: L! f, y: `5 u5 K0 V
mov ax,4fh: H* @0 K( A9 e: O& `8 i
int 41h
3 J5 f# z! n" F5 v. | xchg dx, es:[41h*4]* D9 y1 a7 E6 @( G4 O
xchg bx, es:[41h*4+2]/ r7 o! x$ k: {, I" B
cmp ax, 0f386h
L O( \( g/ L6 ~& P jz SoftICE_detected; [( ^) m0 D! x, a R+ i# W: n3 o
; T M, M7 ?5 jint41handler2 PROC7 k1 Z4 F" k# X/ R/ J2 p
iret9 w1 f; t0 a c) u9 r+ e; _% E
int41handler2 ENDP
7 ~1 Q7 O: I, i: c8 a3 A( J
1 X: |1 U! {; M. Z& t3 n d! u* j4 o; r; H1 q. M
_________________________________________________________________________
0 e/ m1 U' ?4 _. ~, ^! \9 [9 O, A S( Q% s6 N9 F5 T! \2 n: {
# n8 o) Z' g$ E$ l9 B7 {Method 06
- V" Z( ~5 d, ]# T3 R=========2 F4 d, |3 S0 w, C' k
# F! P& e; {% A5 l/ s9 C+ H- Q
( ~7 @3 ]7 q1 A; Z% f
2nd method similar to the preceding one but more difficult to detect:# `* H6 h2 n' F+ R$ c
7 [2 x9 b( V' ?* Z# ~. P+ r1 S- x
5 o5 x) P1 C F% C3 z; H( I; {
int41handler PROC
( I5 S6 W8 `* l3 w mov cl,al
; }' R5 j/ |9 n, n; C3 v; N- c+ l9 d4 i# G iret+ ]7 y/ U4 L+ ]4 Q0 w! l1 G
int41handler ENDP( y/ j h& D9 e1 g
: P+ B+ E( n+ {
5 f* ^! ^) l/ D3 m4 S" P xor ax,ax8 @: i* Y( R2 Y2 }, x, z# |
mov es,ax6 n! G5 i6 P) s
mov bx, cs
. C: U- ~7 @7 a' Y3 n8 n7 f lea dx, int41handler8 |( Z8 p' Y$ |2 D" c8 I
xchg dx, es:[41h*4] [5 a9 z5 n& }5 U" v
xchg bx, es:[41h*4+2]4 @7 f/ d9 n0 d, ~0 Y
in al, 40h
: @9 [0 _0 ^3 {3 v* T( r4 a, w) b xor cx,cx
# f* y) ] a1 k: E int 41h
" u6 s$ Y+ I* q8 }$ E xchg dx, es:[41h*4], a2 x8 g' [9 X5 r
xchg bx, es:[41h*4+2]" f% ^! j& v) E6 R' g) f1 @. m
cmp cl,al; N8 u1 P% i2 ~0 S$ O
jnz SoftICE_detected
" u1 D2 }& C8 G; K% F, k: v, Q1 o
_________________________________________________________________________0 J8 S) l4 }4 y, q" P8 d x, d
. e9 V: s; d' J5 o, NMethod 07& b" `$ Z, l2 A+ y {
=========* W7 l. L- ^1 x* s
+ W, {5 s. F J+ D& {, ~2 vMethod of detection of the WinICE handler in the int68h (V86)
. x8 \' _. t* J H# Y2 m8 L8 ]& m) j. d- M1 L! Y# W
mov ah,43h
% R# J; _( Z7 o, \+ I int 68h% b3 Q/ L4 S/ k& R2 H( ^7 N$ n5 D
cmp ax,0F386h
8 G3 L( e/ R& u+ _ jz SoftICE_Detected. i7 ]; g: A" d( g/ g
! [8 G1 W& X% ~! @
. |9 i' i7 D$ ^8 Q0 v$ s4 K
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit2 V& f) l- X' p9 H
app like this:
9 {- D8 G' E$ m9 |- ]6 M3 Y8 n0 |
7 f: S% L$ P* _! t. p. o BPX exec_int if ax==68
$ d& P8 `! s& M, _, L; j/ Z (function called is located at byte ptr [ebp+1Dh] and client eip is1 I" x" E9 I$ R
located at [ebp+48h] for 32Bit apps)2 g' x- U: J: M7 g$ p
__________________________________________________________________________
- |) W: q2 _" O ~5 C, Y5 e4 [' d( u; _+ C8 n+ d4 R X( d
+ Q, V* M S& K3 n9 a0 sMethod 082 S4 ]( A% ^( R1 g9 S9 I
=========; n( {5 }' r4 e" ]+ D+ _0 P$ `4 i; e% J
! G9 K! K5 v5 x" ^It is not a method of detection of SoftICE but a possibility to crash the
9 | H8 }: K" F+ o5 L S2 Usystem by intercepting int 01h and int 03h and redirecting them to another
9 U$ M2 @& H+ x" t0 X$ Mroutine.
; M0 m& i% G( x. [; [$ HIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
5 y) h+ \9 J* |2 k; v6 z/ l. yto the new routine to execute (hangs computer...)
/ a3 g" m3 T% j; u9 ?
& _" q; A E* T! W mov ah, 25h
4 Y; n, e0 z2 q/ Z- B mov al, Int_Number (01h or 03h)! }; _. z% G) |" d
mov dx, offset New_Int_Routine
$ {$ g1 n5 C$ F3 S5 k int 21h- P: s& n& f2 O) h% i. f- E8 h
2 S9 a+ C8 I U__________________________________________________________________________' }" W( J' P: z! W. ^
, n* h+ k% F5 d2 i, A
Method 092 _2 M4 d( r8 o! e1 J) u
=========6 W: ]: \- J) f( Z6 Q
( ^( g$ P! ~8 ]4 B& _
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only2 k% G2 v4 j) Q" R6 z
performed in ring0 (VxD or a ring3 app using the VxdCall).
$ i- `& k8 c i5 w5 C' R4 qThe Get_DDB service is used to determine whether or not a VxD is installed1 q6 d0 B/ P2 K ]
for the specified device and returns a Device Description Block (in ecx) for
/ v' \ k0 K4 i1 J. F7 Tthat device if it is installed.
- p8 q7 I9 X. Q& J* n, q8 j8 `
: |! V# [, t9 B; u% S7 d mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID; q2 L: _( q: G/ z* C
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
6 G3 Y( E" u$ ^: ~$ y$ l3 O) h VMMCall Get_DDB
# W ^- r' m5 e9 |9 D0 e6 r mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
I/ q" F' G3 j5 Z- O; [
$ N, y) q7 F3 n2 O8 HNote as well that you can easily detect this method with SoftICE:
* |9 [3 f5 I4 Z. n5 C, M/ r8 ? bpx Get_DDB if ax==0202 || ax==7a5fh) \2 d# {5 a* t+ v6 W L
/ K" `2 l+ v6 Y! m- A. V& c F
__________________________________________________________________________: U# G8 R: _& N6 V2 u, j
9 v: \+ p$ r- u4 L# T' E+ `6 N
Method 10
& X* z2 ~/ N8 t" c+ O=========+ N+ v) B+ m- X2 \
( V( G" v3 q7 H. C3 {/ B5 G. m
=>Disable or clear breakpoints before using this feature. DO NOT trace with
0 {: ~' I+ u* ~: Z( j& r1 c# b SoftICE while the option is enable!!' q" ?2 z4 s. Z8 _+ X
2 S0 u- M: m' d% T, B
This trick is very efficient:+ Z: d; u/ x! i- ?8 n# L
by checking the Debug Registers, you can detect if SoftICE is loaded
. K4 A1 F+ N* V, T- o, d(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
7 }" ^1 p1 B& L/ N# qthere are some memory breakpoints set (dr0 to dr3) simply by reading their: M6 O2 W% C$ L7 g: g8 `1 i* j
value (in ring0 only). Values can be manipulated and or changed as well
- u w1 T4 g/ L7 T, K(clearing BPMs for instance)
. z# g( M' A* b
4 u# [/ B7 S% `/ G__________________________________________________________________________
) L/ j8 Z; y& _9 G8 q, q9 b% b8 d
' G+ i* f9 g) m- X' @0 uMethod 11
8 x+ J5 Z. x4 p5 R6 t=========
( N, l3 N" z. O5 i3 D/ j. S; ^2 j0 b3 m; G" Y
This method is most known as 'MeltICE' because it has been freely distributed# z: Y5 {2 X" L' q3 v
via www.winfiles.com. However it was first used by NuMega people to allow; p! a# f9 V9 ~/ a0 v
Symbol Loader to check if SoftICE was active or not (the code is located- r6 w! I! e+ G( o" x" H
inside nmtrans.dll).
' F- C4 W- J3 ^; g5 o, k6 ` B# m: u0 ]1 x/ @* ]' A; O" l
The way it works is very simple:
9 ]' U R$ ^4 Y* S# \2 d8 HIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
& L& K4 o. x+ zWinNT) with the CreateFileA API.
7 f9 V) [/ r; Q0 `5 E' n+ g) v: v& r( R( c6 T/ X
Here is a sample (checking for 'SICE'):% G2 R- h Q, ]: B
' R, l- a" w2 ?( k
BOOL IsSoftIce95Loaded()- a6 M% K$ d" S2 T1 M6 q6 W4 E
{
! G( G2 Z k* r3 \8 z: y HANDLE hFile; 7 p) A/ z" M- g4 s
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
) X% ~$ } W' J' ~& k3 l5 g FILE_SHARE_READ | FILE_SHARE_WRITE,
- A! }2 |; U7 q" u NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);7 w4 J: n/ o, s0 t: w2 ~5 b
if( hFile != INVALID_HANDLE_VALUE )
2 \1 y. G" Q2 {% l5 L7 m {- y5 r2 x2 e( [1 X
CloseHandle(hFile);' X) |! u( A" d( n: p0 q
return TRUE;
, X/ V2 X& H* z+ F, _. V }
3 ~; t* a9 r% Z. h* I return FALSE;. Y* \% T! D0 n9 y; d
}% f6 q% l5 a+ s7 i
9 i2 l9 U6 h5 L$ p
Although this trick calls the CreateFileA function, don't even expect to be
* O+ A+ U3 j3 u1 @, i2 a: c, sable to intercept it by installing a IFS hook: it will not work, no way!6 x6 u5 d- P8 i, |: @. x2 ?
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
$ Q2 N5 G+ l' J3 A4 Iservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
# p7 S' l' H* p3 V6 \* oand then browse the DDB list until it find the VxD and its DDB_Control_Proc
3 v7 E& A/ j) s, ^. a afield.
9 q3 p4 }* y+ n; X0 t+ u- }In fact, its purpose is not to load/unload VxDs but only to send a
5 U" ]% q( W+ t& i" F' M h* ZW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
. q$ u8 h% ?3 T$ V% B7 Ato the VxD Control_Dispatch proc (how the hell a shareware soft could try
4 G. U+ n' X( Hto load/unload a non-dynamically loadable driver such as SoftICE ;-).: e$ D1 c& t2 A& }: V
If the VxD is loaded, it will always clear eax and the Carry flag to allow
8 v2 r% h! u" {+ O; ]5 {; Eits handle to be opened and then, will be detected.
0 o) o& I# `* w5 j" Z9 vYou can check that simply by hooking Winice.exe control proc entry point, N. I6 J+ q; ]
while running MeltICE.
' {6 W" C- M8 u5 o$ R: i
1 i( z9 t; ^3 i, `+ x" l% F/ p6 |1 V+ h9 l% V
00401067: push 00402025 ; \\.\SICE
' X* x7 M D Z' a( k 0040106C: call CreateFileA$ a" T b1 ?; ^0 l5 m
00401071: cmp eax,-001
E' o: ^$ S7 h' w7 S! _4 Z 00401074: je 004010910 D7 ^" `: ^' H( @1 A6 `( m( v5 P7 ~
/ M b* H1 [2 ]- A
( G9 _% c5 V5 o+ |' v6 J4 k
There could be hundreds of BPX you could use to detect this trick.) x4 S* [. z. l) Z
-The most classical one is:1 H1 A& t7 H9 \- N+ \
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
" O S Q d) O5 @; j *(esp->4+4)=='NTIC'
: w2 T# e, K4 @! c( @& R
o( o% i# x6 d" B; G8 F( A) q5 D6 U-The most exotic ones (could be very slooooow :-(
: l$ _4 Q5 ]( F* D1 a BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') . i2 p( P) T2 m& M3 d% h+ L5 Q
;will break 3 times :-() S) r& r3 |6 E, K( p
4 @ U9 T- s. u* _0 ~2 k4 c" v5 x% E
-or (a bit) faster:
( q7 d+ O4 y' Y, r2 O! l5 J BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
3 o6 ^; r2 G; `6 B* s) M$ y
0 R& W" a* e- }( E+ M/ G& ? BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
3 d4 m, n5 ~) e) h" S ;will break 3 times :-(
0 `! K6 I$ r4 l5 L' u6 t& e7 g1 L0 H" ^2 I7 Y$ s/ U# O
-Much faster:
& c3 k" P0 L6 D- T- j BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'$ ^% e+ ]9 c7 a3 u" `' w* b0 ?
0 c+ b% J. r8 W! D9 e( z! ~Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
6 f0 z K- m u c) v0 xfunction to do the same job:1 M# q) L6 N' n. C2 [
/ a( e$ K# Q8 p* A7 C- O- h push 00 ; OF_READ
' ^8 K7 {/ ~) a mov eax,[00656634] ; '\\.\SICE',0' M( K' i) O; N3 i
push eax
5 ]2 u7 n y4 I P9 \ call KERNEL32!_lopen
2 c) F+ A/ J: F6 s4 t) O: F inc eax% v( G3 e3 q9 s8 L0 |! c
jnz 00650589 ; detected* B6 V: L4 @3 w/ e: A
push 00 ; OF_READ
0 y( m, h3 _! k3 B mov eax,[00656638] ; '\\.\SICE'/ W N2 ?5 ^& X. K/ C2 {
push eax
# y9 R+ x. y$ P* S- G call KERNEL32!_lopen( g- E1 b* W6 _" J( n& }, E
inc eax
3 \+ Z# x4 U4 G z/ b0 w jz 006505ae ; not detected
! x) I; C" i1 T9 c9 x
1 w, U" K$ j8 ]+ O; v1 |$ ^0 C, f
__________________________________________________________________________
" W6 `% X9 u, g0 w0 t
2 u2 g- U" C5 mMethod 12
; {# i. y# y3 C4 j# o; m4 S; p=========; I5 X0 D0 q) H0 W7 h0 V
1 c. g' L( C: B1 ~# B' ?/ p- M
This trick is similar to int41h/4fh Debugger installation check (code 05
8 | P, c' g. e: ?+ f& 06) but very limited because it's only available for Win95/98 (not NT)
. r! G, s8 U! L9 F( w. fas it uses the VxDCall backdoor. This detection was found in Bleem Demo.
! c) s/ K, S* t" p6 c9 j4 @# F, g, m' Y4 f4 b6 J! Y h( b7 @
push 0000004fh ; function 4fh
9 u8 D' Z) R8 L" A0 y2 P8 D$ y push 002a002ah ; high word specifies which VxD (VWIN32)! U) w- X [# @# j
; low word specifies which service
: G6 n8 j! Z: f0 D K" h. I7 a( W (VWIN32_Int41Dispatch). c2 H, k) S7 j
call Kernel32!ORD_001 ; VxdCall
' f0 w" h+ O* G+ H( P cmp ax, 0f386h ; magic number returned by system debuggers
0 W0 |8 z' E0 h jz SoftICE_detected1 e+ ~ T$ ^/ y B7 x
5 S6 Z, n1 k0 \, t% l
Here again, several ways to detect it:
! l Z7 d8 i( s; @
+ |. D* ?3 m5 |; p. Z5 N BPINT 41 if ax==4f
+ j8 G0 R3 u+ x x
& B* `% U _- s# a2 e h BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one' l2 r7 D0 @- X+ F( }( P& h( j
1 J9 J7 T: A+ L4 C BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
5 ]1 H- T/ O: k
@$ u. K$ S6 S& m' f! [+ n BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
0 l: z1 b& s/ y8 y: y4 I- w
2 d6 e0 B5 q: u, o5 M+ b__________________________________________________________________________4 d: q! v0 ~3 e+ e
$ e) i* O1 N2 o: P$ W
Method 139 x4 X) K" g; ?8 ~4 W D
========= n1 W, q- f3 c5 E3 i& K m2 G5 g
( a$ h% J; ?9 A: D" ]5 `Not a real method of detection, but a good way to know if SoftICE is
* r( Z' t9 F1 \; D9 T1 Minstalled on a computer and to locate its installation directory.
# o ?% m6 ^) x" I+ G9 LIt is used by few softs which access the following registry keys (usually #2) :6 j2 W5 M3 V+ b/ n/ Y- G0 @; Q) m7 n
; R- O: I% `6 p$ B0 u
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
' @; Q% m6 s3 n) Y" k7 y; h6 B\Uninstall\SoftICE
% g3 T0 g5 b6 v' [-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE+ b: }) \( L* J. z$ k
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion. d$ | R3 H2 i. k; h) N5 A
\App Paths\Loader32.Exe
) I; U6 R' Q) d, V8 u9 I. v" p- u. b& t8 `0 h, A8 H4 M
' v5 g) X6 a" Q! M) |Note that some nasty apps could then erase all files from SoftICE directory, l0 W8 U" F! y( F8 j0 u
(I faced that once :-(& m2 m: s. P5 f: h
# K1 b0 p6 t: F2 \7 E8 I! O# NUseful breakpoint to detect it:, O" P" y! g2 |7 l" R
1 l% \& O/ h! u2 c: w1 g+ p5 B2 C9 p BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
; E2 i& _ y, F3 N* p% N" v0 f, s% ^; F7 M- z
__________________________________________________________________________) G/ `. N! m7 X( P/ x
" q- p# s! }9 a T( M
$ {& W6 V# k; R; n
Method 14 , l' p4 C F' N+ |- N
=========, _$ e. v6 z% r- T# E! E
4 E. k! B/ t: _* }A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose6 ? V) X9 o& y5 K
is to determines whether a debugger is running on your system (ring0 only).: f$ t( W! v/ Z& E; y9 k5 W) B( ]0 W
' r2 L" X1 x+ K* z* Z2 m" Z: | c
VMMCall Test_Debug_Installed/ H0 o9 ?7 O$ j8 R- M7 p/ R) Y
je not_installed" P# p. ?& n! R# X% l* |
9 B$ M- `3 {5 W1 v P$ G
This service just checks a flag.& T4 }: L3 P4 Q: ^6 G( t
</PRE></TD></TR></TBODY></TABLE> |