<TABLE width=500>3 S% R# t9 c5 K5 I
<TBODY>0 M* ]6 ^/ h0 i, z7 g
<TR>2 S5 B3 | G% O; |
<TD><PRE>Method 01 7 W8 l5 e/ S' o) \+ b( x$ k
=========6 [' `" A- O& ^
4 I, G+ b5 `* s
This method of detection of SoftICE (as well as the following one) is+ I0 E6 P' `2 Y3 w1 C+ P
used by the majority of packers/encryptors found on Internet.3 ?( ?, A/ ~+ m( }- o5 S) L
It seeks the signature of BoundsChecker in SoftICE
2 p% P! S8 f% h* x# E. s* u
m f2 _ c" [: j$ d mov ebp, 04243484Bh ; 'BCHK'# |& `/ V( t5 |% N$ W$ h7 w! v
mov ax, 04h h+ R) d" M, ]! ~
int 3
) N) j: A1 C8 ~ cmp al,4
4 q# B- A( W6 ]. ~ jnz SoftICE_Detected+ Y& U! R0 Z- E3 [4 H
* Z0 A2 ^: ]7 R7 l, \' a% h1 q
___________________________________________________________________________4 e2 P5 i) L& _5 y9 e
: k) }0 V g- q, W
Method 02. G" \ Z ^! o, n0 g
=========
7 W) m& R3 V4 Y# G% ~( Y& Y9 j; I* p& q
Still a method very much used (perhaps the most frequent one). It is used
c% M' D' C4 T1 xto get SoftICE 'Back Door commands' which gives infos on Breakpoints,- {* s" O3 j. t5 ?' o
or execute SoftICE commands...
1 W) Q, s& G& ]+ n4 d; B8 J7 ^4 ]- R& _It is also used to crash SoftICE and to force it to execute any commands% U9 h7 l# l4 ^
(HBOOT...) :-((
) X0 L E- a8 m/ X/ a
. h4 g1 s& l3 I* T9 o7 s4 k1 Y! o: kHere is a quick description:. Y; s) U3 O) D' t5 _; F5 t8 z$ H1 U
-AX = 0910h (Display string in SIce windows)7 V5 U O8 Y2 y- S# L) p' D
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
% T c6 G5 A/ M. f y-AX = 0912h (Get breakpoint infos)( B* e9 p4 l7 \' w8 G
-AX = 0913h (Set Sice breakpoints) h ^" F. ^' E+ a8 H0 a$ G
-AX = 0914h (Remove SIce breakoints)( H0 w3 ]( |( Q
2 M: G1 F) ?1 M; xEach time you'll meet this trick, you'll see:
- S8 ?" M" l, {-SI = 4647h
3 j. { @ Q" \- O* K-DI = 4A4Dh
% D ?' [; C! ^6 VWhich are the 'magic values' used by SoftIce. C% _2 m4 A2 S0 p6 E: k1 r+ O! E
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.2 M. I6 \5 T$ o
, ?. ^5 i" N2 G: d. c; j) h9 j
Here is one example from the file "Haspinst.exe" which is the dongle HASP
: o; L' {: p8 e1 }Envelope utility use to protect DOS applications:8 D8 b: @4 d Q) h4 n. p4 k
. K# i& a7 r# _+ @
r+ ?# L! }2 J
4C19:0095 MOV AX,0911 ; execute command.
/ b0 }2 ~9 o# k3 @4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).3 r* s2 o6 Y6 t0 \
4C19:009A MOV SI,4647 ; 1st magic value.% g% v9 N& T( I
4C19:009D MOV DI,4A4D ; 2nd magic value.
; v5 t0 c/ p* k' p4 f4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
1 H: m7 |" l+ p6 |/ m7 I4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute$ ^+ K7 M4 C- X) i! ?9 P* h. e1 J; ]) X
4C19:00A4 INC CX
8 ` ]( R+ w* p: P4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
9 Y3 A, R- M' Y. b: I4C19:00A8 JB 0095 ; 6 different commands.
7 M) E9 ~, y4 U& N4C19:00AA JMP 0002 ; Bad_Guy jmp back.
& W" _. W9 U1 M4C19:00AD MOV BX,SP ; Good_Guy go ahead :)# x) d# Y$ I; T# j5 R- B' A
, a/ f; L1 N0 R0 ?
The program will execute 6 different SIce commands located at ds:dx, which
7 D" X. _) @ E; Q$ eare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
, R) s+ O1 u7 e2 P4 |+ F) k) z5 W
% P: g% W0 M8 `2 r: r2 l* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.8 A/ w! M. |2 R @# P- }# {
___________________________________________________________________________' a) L4 m7 S4 I$ @
, N- H1 q* l; T+ H/ ~3 ]! }
* t6 p h% y0 m) s: B, M3 b bMethod 03
# Z1 |; P$ \& ?5 a=========
0 a2 u4 ?% I+ _% e( Y4 A# Y$ f0 @7 h7 w9 T. E6 B
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
F, {, j/ M/ l3 D(API Get entry point)
# Y3 Z P# T- q* ~
4 v9 ^4 q9 N5 z! O
9 r! h1 s( i) D. b$ h3 x# m3 O9 R xor di,di
1 N! t! i9 A+ }, m mov es,di
1 D& `1 w* V" g+ P" [3 ^7 R mov ax, 1684h
1 n5 W0 T+ Q3 ] mov bx, 0202h ; VxD ID of winice: J, u( } k; \! u2 H1 L
int 2Fh( x3 v/ {; m; Y. o% N( h$ l& z' ]
mov ax, es ; ES:DI -> VxD API entry point
" K, C$ m9 ]2 T; R/ D; O* Q2 a add ax, di9 i# G$ l D% e6 H
test ax,ax% ]* H+ J, n' K7 m) }! }3 x. t8 i
jnz SoftICE_Detected
A7 B6 w8 E2 y3 w! b8 V; i) b- [% r6 V2 }+ Z$ w" ?
___________________________________________________________________________ v& C3 |( h) S/ \; O! J% M- P
% h p* h- c: U1 ]) z; BMethod 042 _2 I: b& n3 f1 T$ P
=========
# K; A4 h. J- j7 k5 _
& R* F+ z& d* I- U9 Q7 }" lMethod identical to the preceding one except that it seeks the ID of SoftICE
9 b3 q, w' p6 y( O0 o% O8 @GFX VxD." ]6 I8 y9 O) }% O. O8 k+ s
# M# N3 M+ X% O' t1 w. b
xor di,di
9 z8 ~; T3 U7 q/ _; `; E- V1 P mov es,di8 L% r, Y7 t$ N6 h
mov ax, 1684h
" x p$ \1 C+ P# a, B* e' r+ B2 v7 Z5 Q mov bx, 7a5Fh ; VxD ID of SIWVID
* | u$ q3 C4 O# {) d int 2fh
2 s9 U& j- N- l3 ]7 j5 a6 o mov ax, es ; ES:DI -> VxD API entry point
' R8 Y, U( g* F5 ^ add ax, di
; R u+ J) i2 j! z test ax,ax/ G1 {2 a+ o' Y- v' h1 t5 H
jnz SoftICE_Detected; T0 @# t7 ?# S4 n
2 _0 X! Y- }* o. V' S1 m
__________________________________________________________________________
; Q. Y" g3 p% j3 p, c: t/ u- _ V/ f+ \# P/ B
4 M1 G1 Y# z4 R. B5 u8 L1 f; E+ ]
Method 05
" j( `9 i; R3 X1 V. J=========
( C2 Z G: }) b+ u9 V. y" m& t
& [# f& B+ u" I u5 t) d% b! zMethod seeking the 'magic number' 0F386h returned (in ax) by all system
8 n1 W# v; K( J# p/ K! c: vdebugger. It calls the int 41h, function 4Fh.- K7 L* w0 g% y$ j% ~3 x3 \
There are several alternatives.
* s* y4 t" b* p" a# ~+ B8 |( X, |% t5 R, K
The following one is the simplest:4 P! s7 t& M" [& [& s
! c( a/ F# z; X) x2 O7 W% d1 a2 }/ k7 g mov ax,4fh
+ V' y) m. Y' w9 W/ h- w int 41h, f: Q+ J; H0 N j
cmp ax, 0F386
! h' v e3 x+ P8 H jz SoftICE_detected! M- T. m0 B+ |+ W6 k: } Y
( p D" E8 w/ s2 ]" I7 G) z
/ e& c# h8 a( p- n. A
Next method as well as the following one are 2 examples from Stone's
( i9 E n6 r1 \"stn-wid.zip" (www.cracking.net):
8 H o' k# [8 ?6 E. D
, b/ U0 k% c4 h* Q, s mov bx, cs% o7 h- ^& Z5 a/ F
lea dx, int41handler2
" ?- V* A2 K* t* f# `* A+ K xchg dx, es:[41h*4], b+ k) B3 d& C* i- Q' q m9 ]4 l
xchg bx, es:[41h*4+2]# u- M! T/ v0 {* ^! L* T0 ?
mov ax,4fh
( `$ ^* H( |! M0 {/ {. [: L- W int 41h
% u& A( n; U: Y- Q" B ] xchg dx, es:[41h*4]
- a- X* H# K8 ?3 {% u xchg bx, es:[41h*4+2]; i6 R- [, x6 W' P9 B
cmp ax, 0f386h4 U. ~8 s- W/ ^/ A$ C- f0 Q! e- B# i
jz SoftICE_detected
' p5 h/ _: ~& i, T/ s6 Z3 h4 l6 y$ o0 U4 {2 R
int41handler2 PROC, L7 S/ N, h. t+ V( A7 G8 H
iret
9 m, {6 k4 R, j* ~int41handler2 ENDP- ~$ Z( U" f+ c* K/ I1 F7 V
) k2 k2 c. Q2 C
. B2 ?! m( u1 k4 z# N- D. O_________________________________________________________________________. \ B: U% h. B) A8 X
/ F& O5 X% _( N- Q6 `+ S! I
7 R+ ?: M( g) a; O
Method 068 }: T, U8 b+ ^8 x: ]5 w% Q
=========5 M! L3 ~! X5 o6 y4 a, n6 Y" l
0 M k1 C* n4 w# D
! |1 ]* l; q4 Z/ _5 H7 \2nd method similar to the preceding one but more difficult to detect:8 P8 C! y: O" M
1 c" t! Z2 o: F8 P9 f; o! X
$ [) I; X. L$ [! O6 h. A- t8 R4 uint41handler PROC
k& I# E1 f& p: c/ _* [( c& v1 u! N mov cl,al
; U$ W- d$ |8 ]: g/ l* B iret
7 B$ J2 c, f" I {int41handler ENDP' i! X# F! N' l8 K6 q$ R
7 M7 B1 \5 G3 ^! m4 M
: j6 H) Y. A' T. r9 D! h5 ^ xor ax,ax
6 ~' O- U# I h8 |$ I" W mov es,ax
+ i w% N1 f& p/ F$ ~ mov bx, cs1 _; D8 Q2 e r: N
lea dx, int41handler
$ z5 t: N9 B3 e' m7 `' H. x xchg dx, es:[41h*4]# V; s: h& b, f* o& r9 m
xchg bx, es:[41h*4+2]2 P5 P7 ?* n9 M1 A: u$ i
in al, 40h* b* }: V1 s K* |( ~
xor cx,cx, p1 ~: l# o5 f Z% L$ [: }9 ~, n
int 41h
, C6 g c! K1 p* {( X xchg dx, es:[41h*4]$ M( Z! j: n! \. h# G0 z4 F2 c6 d
xchg bx, es:[41h*4+2]1 P+ ^- `0 S( c! X7 r, @9 i
cmp cl,al$ H: _* m4 O7 ]7 |2 x
jnz SoftICE_detected B0 O3 L! t H: Q6 ?2 v' E) X R9 g
$ \% {: Z8 A" x- t_________________________________________________________________________
6 D9 t; a8 T: Z
$ P) X0 s/ W9 _) ]Method 07/ n& Q, H: t& e
=========1 {' c) a* V8 w
+ L' R. ]; \; lMethod of detection of the WinICE handler in the int68h (V86)
# ~7 Y1 `7 ?6 @4 X9 `! o9 i: n
0 M$ I2 Z5 `* R, v mov ah,43h2 X% ?) ?4 s" j2 d# J, U4 ^* ^+ S9 A
int 68h
# v2 l+ ^9 _5 w; [4 A cmp ax,0F386h
. F% n1 c# z7 t8 M$ s* o6 K, V) B0 ~ jz SoftICE_Detected
( f* x- \, h; b8 `' E# g: [5 S; q5 i; q/ x! i; R& [
v5 F3 L/ @7 K" n7 [/ ?, ^
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
: o. h" i9 E$ ^1 ]2 T( ~( u app like this:
) R" t5 n5 l6 }, V/ a' @
$ s; Q$ O0 D) O- C4 f BPX exec_int if ax==68
% f$ g$ t. ?/ r; k8 z$ l' d7 I: C (function called is located at byte ptr [ebp+1Dh] and client eip is2 R/ H" e( ^; B% t+ P7 e
located at [ebp+48h] for 32Bit apps) l0 `; r1 `( _, w6 v8 j) q D9 s
__________________________________________________________________________
2 C. _2 s) ?. d i+ b' V
7 T3 w* o- c/ z' s( _* \
+ y9 }7 W. c5 G7 U0 J2 S. o% _Method 08
6 h% |! r+ o. W* o4 h: f, _=========
4 t5 d/ A# C% v" v1 g" b7 F2 p- a8 k V
It is not a method of detection of SoftICE but a possibility to crash the3 K0 U1 m; {( d8 W& [+ P
system by intercepting int 01h and int 03h and redirecting them to another8 Z/ T+ e- \" D! ?$ R0 x0 ?
routine.: {" v* R+ S% Q* h8 A' a2 Q
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
$ s, p% D1 r2 N. gto the new routine to execute (hangs computer...)1 f* l1 x$ X" b' l
+ P$ F! l/ P* i$ j3 }( Q
mov ah, 25h
9 w# x) ^7 c+ q- F1 p4 \ mov al, Int_Number (01h or 03h)
; z7 }* _9 o8 t4 g9 A y mov dx, offset New_Int_Routine
8 q; p8 S9 a" e int 21h+ b0 R* \0 v' {: a n8 H% i: y4 i
8 [# P& ]3 ?/ ^5 a. v) V
__________________________________________________________________________# m7 G: }( S& s% {" B- ?' O/ @
! E' P, C1 D+ Y6 J7 d" [* H6 AMethod 09
: |* c5 F( i; S9 ~=========
) [8 ?, R7 D5 S* C3 s4 \7 g
6 q+ b1 e K: q/ Y; nThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only Z5 d* b7 b+ p. l
performed in ring0 (VxD or a ring3 app using the VxdCall).
0 p; a3 m- X5 p8 ~7 p6 M: xThe Get_DDB service is used to determine whether or not a VxD is installed
6 D+ L2 @3 o+ N& [2 E! p& T. {4 Kfor the specified device and returns a Device Description Block (in ecx) for9 J, \! ]( ~) e) h4 ^; x/ f
that device if it is installed.0 q* q9 G* V D7 C. X
, m* ^4 c! O, J' _2 q% p mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID5 \. v1 L. R% g9 x% l7 @6 G9 K
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
$ d1 `5 h$ A* v; R- ~ VMMCall Get_DDB& {3 ?( `- H. ]" U2 X: v/ g
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
' \& {5 Y3 D/ e5 `. o* }
1 C+ z% y, G+ e/ ^+ E+ `Note as well that you can easily detect this method with SoftICE: y: j9 N b0 G- P T! V
bpx Get_DDB if ax==0202 || ax==7a5fh$ o" [. W2 A, D0 o
: z5 B. h1 R4 j) G__________________________________________________________________________- |. B9 M' [$ k8 R4 ~/ S. f0 T- @
9 J+ k/ M" w+ i, o9 q
Method 108 @- `/ _- f" G
=========
1 @! S4 C/ |0 U' C/ ]2 P- G$ J4 ^& x! R$ ?% ~* Z
=>Disable or clear breakpoints before using this feature. DO NOT trace with6 O% u# i Q+ f$ i- X8 V& \
SoftICE while the option is enable!!9 Y9 I n: D- i P* N
# B8 |1 t: L6 w# \1 K3 C
This trick is very efficient:
8 u. c* a% i- o" N6 mby checking the Debug Registers, you can detect if SoftICE is loaded
5 j) s# o- }& W* w% W0 `0 E(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if! D+ x6 ^& s9 z' M1 k( Q. M
there are some memory breakpoints set (dr0 to dr3) simply by reading their
1 { z* o3 W! {8 q. |value (in ring0 only). Values can be manipulated and or changed as well. r* L1 x! s0 P4 n& ~* }' R
(clearing BPMs for instance)9 \: O4 ]( ?0 P( j1 G
x4 w$ g! q9 J__________________________________________________________________________' D+ o7 R4 r8 j, c2 C3 e' A
( w- t- Y9 x, q/ y' Y3 S
Method 11: x3 J9 a# f4 x
=========
% X% g3 w0 Z1 X; q. T; n# e/ I3 p2 [6 R
This method is most known as 'MeltICE' because it has been freely distributed$ `6 l7 O/ p& |3 @8 _6 ]% H" b
via www.winfiles.com. However it was first used by NuMega people to allow
0 Q6 I% s: {2 e6 J/ x5 |) B& NSymbol Loader to check if SoftICE was active or not (the code is located, |+ W7 t0 e" E5 K
inside nmtrans.dll).3 B) @" [' @* K8 C; C$ ?- k
9 j& U, z3 N% k( KThe way it works is very simple:8 m$ C0 Y! v* I+ V O+ G$ [
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
$ H# v. i) d" o. z0 L, DWinNT) with the CreateFileA API.2 T% q' M4 O( j% l( p, Z
2 P t/ m* {$ o. l2 MHere is a sample (checking for 'SICE'):
% U4 I0 b% H( m) U7 R0 ^2 P0 j6 s1 ]
. h2 d( H8 X/ }* t/ h8 [BOOL IsSoftIce95Loaded(), b7 b# g% G8 D+ b
{' ^9 {# j6 u# a9 y9 l W
HANDLE hFile; 6 z/ N# @! ] X) E
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
( @* j2 w2 C) `* h& s0 R5 U FILE_SHARE_READ | FILE_SHARE_WRITE,
* A0 k; B, N9 \ NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
8 r+ E6 D6 E3 x# P if( hFile != INVALID_HANDLE_VALUE )2 t8 t/ \& N2 K) F" ~! L6 R3 A. S4 e
{* K8 D! }( } _- P1 G+ L, g) h+ G
CloseHandle(hFile);3 |7 E9 ?0 c) u+ g( G- q
return TRUE;7 d. s8 ?8 i% m$ C
}. k b2 m5 }% a8 {2 w3 x; q
return FALSE;
2 J) t" s( w3 R: w( T, {}
) x$ M* N. _8 b. ~0 \4 L
# |0 @ q y& p1 A2 \1 e" IAlthough this trick calls the CreateFileA function, don't even expect to be
! W5 ]: j& E% n' P' X* [able to intercept it by installing a IFS hook: it will not work, no way!& n4 c$ B; e& H* I
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
! s: O4 g* l, D+ Eservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
, S- R. `; n) Y0 u4 I$ L# a3 @and then browse the DDB list until it find the VxD and its DDB_Control_Proc: b+ o) P' O: E# V7 y, q" g8 P
field.0 d: S4 R( s# N$ U
In fact, its purpose is not to load/unload VxDs but only to send a 2 j. Q0 P$ ~: w% P% j; _- W4 c
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
9 z8 V5 |6 K+ Sto the VxD Control_Dispatch proc (how the hell a shareware soft could try7 h* R3 [) _ O; f$ r
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
9 |% L4 m. A0 d3 F# y- `3 PIf the VxD is loaded, it will always clear eax and the Carry flag to allow
1 Q$ _. G! i% d* P wits handle to be opened and then, will be detected.
+ O! J4 }0 R. W# WYou can check that simply by hooking Winice.exe control proc entry point4 Y2 j( C, T7 a* e4 C
while running MeltICE.
9 A- k# f8 i" @) c8 H1 H! w7 Y+ u) t4 @5 p* w% c# L. ^
/ y0 J" W" }# Z: V7 d 00401067: push 00402025 ; \\.\SICE
. A6 {& }0 _: \: J* X 0040106C: call CreateFileA4 t: F" A- ?. v9 R
00401071: cmp eax,-001
8 L- y2 J( A9 v1 K# F 00401074: je 00401091
" N" \1 m8 m( j% i2 Q" b% g C2 A( B! T2 ?" g& b( A, R
( P" y& d5 T% a: ~3 E# N3 t
There could be hundreds of BPX you could use to detect this trick.& n6 i& ^2 P9 X0 z2 d( I$ J9 }
-The most classical one is:; U. a1 X" x7 P% n; c$ {% w+ e& M$ P
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
( ^4 b! K! h2 r% M( t( B5 g *(esp->4+4)=='NTIC'2 H9 H! |# [. L" I5 L4 d
7 a5 h1 H9 E7 `- O& |* l9 ]
-The most exotic ones (could be very slooooow :-(
0 q: I) p$ y: _$ \/ r, q5 V2 L BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') ) u! G7 B8 |; h
;will break 3 times :-(+ Y" ?( B$ P/ x: v u$ C+ M; l7 @
, \5 S" L9 P4 J6 B-or (a bit) faster: $ A W" E8 M" u4 A: l: h
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')0 M/ b8 [" c+ R8 r- |) r. w G
/ Y( g/ |# Q; y9 q# y BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' / {* h0 I8 g) T9 i
;will break 3 times :-(5 P7 G4 v6 J1 }5 K
8 g$ s. Z* R& x$ T, K2 X G-Much faster:/ T" K2 c$ `- g- d" v% N
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
# z4 v% C' S6 `) z" M9 o, t& ^4 C% c" t l
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen: b2 I- r7 @; _7 R# c
function to do the same job:
% [1 X6 R5 g1 P4 F ^3 K6 @$ q0 I* g( l7 Q; S
push 00 ; OF_READ
% K: E' R; R. h( r( a mov eax,[00656634] ; '\\.\SICE',0. C- }9 u# @+ b6 P
push eax) R0 Z. s! E# o
call KERNEL32!_lopen7 w; ^3 o, E$ Y- W3 _
inc eax% M3 t" u4 Q, Z5 G
jnz 00650589 ; detected! v) C2 k5 B+ h/ X" S
push 00 ; OF_READ5 Z8 @" j+ c+ Y6 J2 r( m! U* ^
mov eax,[00656638] ; '\\.\SICE'
7 w8 a2 I" d3 D( Q& Y. v. V9 X0 H push eax
8 K! z7 A) a7 c4 m& c) H8 w call KERNEL32!_lopen: B0 `( f3 \4 y3 J. E( J2 p
inc eax
4 q3 k/ y+ D" u. A1 D" x2 V jz 006505ae ; not detected; N3 h+ J$ ~) U: g0 e
' o$ R$ w" l! g! ]4 F4 ?' e; D0 f& e5 R8 [. M5 @
__________________________________________________________________________; [) y# S, X8 R( W/ d9 f8 A( S
: Z6 Z( T; L/ r2 a) S! l, Z AMethod 12
) o+ J4 R5 U* I; f8 ~% g=========
+ N8 h. a" b8 t9 @, L7 s1 {* c9 T6 v5 w' [; d
This trick is similar to int41h/4fh Debugger installation check (code 05
, x- X) R8 @" D9 E* y3 H4 F3 M& 06) but very limited because it's only available for Win95/98 (not NT)
- t/ I- K5 Z9 p' ]' f. Fas it uses the VxDCall backdoor. This detection was found in Bleem Demo.1 b0 j- S% P, x8 m" T/ p$ t
# {1 p& ~/ p' t: g push 0000004fh ; function 4fh
7 Y: \4 O7 u; u8 f N' R1 [ push 002a002ah ; high word specifies which VxD (VWIN32)( J& R1 ^* n$ w- X; R9 L
; low word specifies which service2 ?$ |1 Q" u5 Z# X+ o
(VWIN32_Int41Dispatch)
) v7 _9 c) i( B# {- n* q call Kernel32!ORD_001 ; VxdCall
3 ?$ f, Q5 v/ `: O$ k$ I cmp ax, 0f386h ; magic number returned by system debuggers
6 q1 o2 M" O. x8 S jz SoftICE_detected
- ^: B# }1 x( S+ O- T, R6 b7 U) p/ S& @" P
Here again, several ways to detect it:0 O# l) j% r: Y" j
G3 G0 y/ T4 |8 L$ `
BPINT 41 if ax==4f& q& {2 G) A- o
9 O( y$ u9 |' Y% L. ~4 A* n
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
# e' i3 B7 _# s q# |! J. s
" c+ l. N5 T( w5 O BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
; F& T& s b1 H5 b0 h
# t+ _. i+ }# u2 @( M" p BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!) s( F8 j; P) r4 [+ W
) t2 J1 }! a7 |5 Y# x
__________________________________________________________________________8 W4 O6 `; X) h7 F( j$ B7 M
+ X6 N: W; ^& ^) C H- {Method 13
: u+ V' z8 u( X7 p1 u1 |2 P=========. {6 W9 j9 H5 S" G3 g# }
' V8 Z' N/ T2 B% @Not a real method of detection, but a good way to know if SoftICE is
) P0 j2 `7 B0 }) _) s5 p; Ginstalled on a computer and to locate its installation directory.! O) G8 ]% p1 j' b- x
It is used by few softs which access the following registry keys (usually #2) :
: C5 u) d/ w9 a& T- w3 r4 Z- ?1 |5 ^" J
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
9 _8 C! W) |- Z* Q\Uninstall\SoftICE
! x+ n, k0 @! S8 W-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE) J2 } r. S% `# l% W- @
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
$ T7 u8 b2 J( i6 F1 Y\App Paths\Loader32.Exe
6 A9 Z' U% `+ k8 B" A) V9 U1 V* X2 S; p2 w, w4 V
: O* R# y l' y x" L' ^! B. z* i
Note that some nasty apps could then erase all files from SoftICE directory
( @5 H6 G, P, O0 l/ o' ^9 z(I faced that once :-( C, |! y- C5 S5 Q6 U. G# L
0 o6 O1 m/ a# Z; J; }0 O4 r: qUseful breakpoint to detect it:
K9 X5 ?' e& R$ i; v0 q1 b% e F% M# Y* i" I: v1 Z
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'7 D# o" C1 J! _
@" a* z/ o4 M
__________________________________________________________________________
3 d9 `9 i7 ^+ u A2 U- s1 u* M% ~7 b* Y+ l
; K3 t" ] O5 N Y
Method 14
+ }! a' l: X4 D9 i% l( k& _=========
; p* |) o$ D: q5 _+ O0 [3 g4 b
2 ~* ^: @, ?4 _* Z; ZA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
( ~: w: b8 }, \6 O4 fis to determines whether a debugger is running on your system (ring0 only).
. ]1 \5 W _. ~( h2 O5 \6 w& D1 v; g
VMMCall Test_Debug_Installed
# F3 d) a: v( \+ u) V8 v je not_installed' i, |9 q) c6 r' o8 j. l" O0 o7 V
. F0 E/ u3 ?: [. EThis service just checks a flag.
7 u) N# i% Y1 L% p) Y</PRE></TD></TR></TBODY></TABLE> |