<TABLE width=500>
! f0 W) B" |9 F0 Y0 z! V$ K<TBODY>
8 ?1 A2 E1 Y1 N0 @4 M, C% L$ Z7 w<TR>
. L+ t' h$ F" T7 u( H; B<TD><PRE>Method 01 , \" K- n: G+ B1 Z! D
=========
% Q2 T% {2 }6 W9 ?
& m( b; z! w3 c3 E: Q# n7 g7 zThis method of detection of SoftICE (as well as the following one) is
0 y5 I+ b- f0 n% nused by the majority of packers/encryptors found on Internet.
! ~4 l3 ?8 b8 U. T- g) v1 cIt seeks the signature of BoundsChecker in SoftICE
: O& k9 X7 l4 Q( G+ I8 b W) z. ~6 H( p* S$ N
mov ebp, 04243484Bh ; 'BCHK'
: l2 Q" J) P( S+ d9 b; w5 O; K mov ax, 04h9 x9 J4 ^8 l8 r* j+ M; |
int 3
! w7 R* ]$ O- p& l; G cmp al,4
& ]9 J, |* R2 l0 P3 I* T jnz SoftICE_Detected' ]! h6 {: a0 E5 ~6 a" }
, A1 B- R& g# {! v5 a
___________________________________________________________________________
/ B1 ]: p9 g Y( B0 j( }. Z7 [; R
$ }% o1 Z# j( r. o0 @Method 02
' e: l0 D4 X S=========% j7 ]" }; U% O* L$ r( H
8 a) C! F4 a1 C6 d( n4 O% b- TStill a method very much used (perhaps the most frequent one). It is used& B. H$ J1 [# j0 v/ r
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
3 ?( R/ U0 V$ X$ W) Eor execute SoftICE commands...
+ E" t& U9 M7 Z; b4 Y m1 E: i7 QIt is also used to crash SoftICE and to force it to execute any commands
4 W9 r- X$ q5 o(HBOOT...) :-(( ! E2 u, w+ I, M3 w' N
9 W0 g- {- f! y9 D
Here is a quick description:
- i% n+ ]5 q/ [+ J k( Q/ W-AX = 0910h (Display string in SIce windows)* \- @5 x( ^3 b5 Y; R, H1 {
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)5 z; M. M1 Z$ T+ c& S( x$ y
-AX = 0912h (Get breakpoint infos)0 M$ m! p, _/ S4 h
-AX = 0913h (Set Sice breakpoints)
& X- ~7 W: Y8 n- |5 w0 z" ~6 w-AX = 0914h (Remove SIce breakoints)
, D, B" p; O# p/ I) m1 [4 T" I
: \- E/ f) t4 u8 jEach time you'll meet this trick, you'll see:* E5 ]" }6 q2 d% w9 [7 j. r ^4 Z
-SI = 4647h
; H; D- `% v2 A1 J2 j/ t) b$ D-DI = 4A4Dh
8 K' T. C6 n2 m6 p( _" KWhich are the 'magic values' used by SoftIce.: `" M# L" C0 z+ P) v9 z( F
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
5 D# m8 o- ~" r; u, Q" R8 X! I. R% p' n" {0 M( Z+ }, P7 Z
Here is one example from the file "Haspinst.exe" which is the dongle HASP& A$ [$ L- o) _& r
Envelope utility use to protect DOS applications:
2 O5 s& ^0 R9 J8 q! I- w: H' Y# o- Y' U4 B* S9 t4 ]
" f& {( L2 `; _# v: a; t+ F- d* v
4C19:0095 MOV AX,0911 ; execute command.2 E( t* r: u1 ~+ ^: a1 o
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).' a/ a1 w- O: g+ v' {! Q+ @+ a& j7 r; g
4C19:009A MOV SI,4647 ; 1st magic value.
% ~2 t! M9 C& f, G5 g. ]4C19:009D MOV DI,4A4D ; 2nd magic value.
. G. ~6 U! l& a# W. \, [4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)0 w: k. p1 B( p% X; f
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute# B% J4 ]3 J- }- c- U
4C19:00A4 INC CX
4 S7 l, l' `5 ?0 s' p5 d4C19:00A5 CMP CX,06 ; Repeat 6 times to execute3 x* l1 g0 N. I, ]" i0 M" t
4C19:00A8 JB 0095 ; 6 different commands.
, p7 `4 x: m7 J( ?3 m7 i! l. s* W4C19:00AA JMP 0002 ; Bad_Guy jmp back.
, m' Q* h( U! P9 h# z2 s4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
; e" k& `# }' |1 @* F0 q+ s4 H
# \, P( {1 s; h" ]# kThe program will execute 6 different SIce commands located at ds:dx, which
3 O+ v$ P3 e: ?- t4 o9 X6 r. ]are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
7 E5 L, X) ? F+ W7 F5 b2 J5 L& ^) [& O, D. c8 `
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
+ `$ @! d% c/ y4 s3 K___________________________________________________________________________
8 l3 f: X% n8 O4 M1 ^" K/ M
) L# _- D( F h" s$ S8 y+ U- a& Z* E0 \5 V) e) T# W$ ]
Method 03
2 ?( ]" k% E" }/ L3 b: I0 ?1 c6 r=========
% S% e" s) J0 h) A9 e1 c( b+ ` ?; g3 C1 n: T4 {
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
8 K5 [) T T1 v( ^8 F% `(API Get entry point)
. G% F# a) }; Z
& w' ^4 f3 J+ Z* L4 R2 o4 @
6 }% p1 T+ l) v0 ^! d4 Z' q: U xor di,di
4 T) I( @, `; _5 n3 \$ f6 R/ f5 m" j mov es,di
0 Z( A5 _4 Z+ X {4 ?$ v% q8 h0 [ mov ax, 1684h
$ v' R" C0 B1 ~" A) R# ?1 N mov bx, 0202h ; VxD ID of winice
$ S7 \0 a& O: P9 H0 `$ Z. K( @ int 2Fh6 A& z. S9 L, a
mov ax, es ; ES:DI -> VxD API entry point
+ ^% |8 m: S5 w% g add ax, di9 `9 a/ ~, u; t; ?. \; `! G+ @
test ax,ax
s/ O1 v' r) U* ~1 | jnz SoftICE_Detected( z5 W# e4 W: Q( M
/ P: S& z) I4 p
___________________________________________________________________________
; n1 a- M. D# }+ u8 x
5 G# j7 m2 m' _: K. ^Method 04
$ Y) v* M& {. ?- b6 U=========
9 t w+ q" A/ ]( [7 H+ c1 i$ D( ]) \
Method identical to the preceding one except that it seeks the ID of SoftICE
- m0 L( }$ _! C8 n( O% ] MGFX VxD.
- Q4 S! _( s: Y4 F
9 S" _. h8 i( | z% s& H% o5 s2 i xor di,di
5 o+ S0 B3 J- z2 _; E) z3 x) R4 e- @& j mov es,di
" ^( V' x6 [; i+ n/ [+ R mov ax, 1684h
* y. i1 i' l" l! d mov bx, 7a5Fh ; VxD ID of SIWVID
1 n5 i9 j! x6 W( }5 m int 2fh( e: t# Z8 Y: Z! B
mov ax, es ; ES:DI -> VxD API entry point) V, u; ]; P R J" e! y# Y' P
add ax, di
* u/ F, H9 M. C& M# C& | test ax,ax. o6 c) o/ ]2 ^' M. u/ l
jnz SoftICE_Detected
0 F) u6 f _ ^' ~& s, K0 T8 ?5 r' N* W
__________________________________________________________________________
3 `! Q, [: _, ]& g/ T- k
# y+ K6 Q6 }6 _. o3 r2 c! p
' j- t9 Q _5 uMethod 059 W/ c- u7 j- c% i
=========
~+ T( c3 u; [" J0 }. I
5 ]/ j& s( E9 u0 {Method seeking the 'magic number' 0F386h returned (in ax) by all system* q5 R2 {: p% ], M- M) }+ |0 Z
debugger. It calls the int 41h, function 4Fh.
- n, }% Y! n* T# iThere are several alternatives.
* L7 V7 f' w* t( b% u2 W# z5 I9 t
The following one is the simplest:* S2 F; ^- p+ r: m; A/ u( _: T z- ]
$ F/ M( n' y; s! l mov ax,4fh7 T2 G8 ~7 }# [& R
int 41h
: x" u8 Y/ D" I/ R8 b cmp ax, 0F386
' m" t8 m B% {1 Z8 v- ~6 f jz SoftICE_detected
9 w. G* ^, h0 d7 I7 o& E0 C: q) R) k+ F: d8 a0 ?
: W! g Z* B* S& ZNext method as well as the following one are 2 examples from Stone's & g, K+ T% K. w+ u0 F t0 l# D
"stn-wid.zip" (www.cracking.net):
; l' ]+ m+ |7 C$ g, m o3 ^& e- }0 B. U7 m; z
mov bx, cs0 p5 { x6 J7 q
lea dx, int41handler25 i9 t5 ?% }- ~- S9 W% o z1 D6 x4 }
xchg dx, es:[41h*4]
W6 G6 m: f6 U( R5 y7 a xchg bx, es:[41h*4+2]# Q8 k& n# i: x/ Y+ \- V
mov ax,4fh
, c9 f) |; f: b( c, {' j int 41h4 \2 |% L8 Q) k' N, u; D7 {( B2 u) L
xchg dx, es:[41h*4]
# g+ N" j5 w: {+ `8 H xchg bx, es:[41h*4+2]9 X" _ N0 {5 ]6 h2 o+ }1 E
cmp ax, 0f386h
/ t& s. T3 a" M" o# X3 m jz SoftICE_detected
; e0 r, n' K( R" C. u5 x+ w
2 m& K- J9 b5 I' Z! W Yint41handler2 PROC4 t! Z |% y. u3 ^
iret! t X z% q; F$ ]4 }
int41handler2 ENDP
/ l% H* v; ], e( z& f2 {. m) k7 R
% N3 S" T2 ^' q" G T$ T
6 C+ G5 @+ L. i5 _) Z& v( f! d6 W_________________________________________________________________________
) T f, K6 N" e+ W3 G
, f# r8 C' h8 T2 c1 \5 S! h2 t. [0 f( m
7 d5 D8 r" M) ^4 J; U% eMethod 06) N) g4 }$ f: @- u" q! ^
=========* n: [, S6 N* q* @6 V3 f& d
/ X; x* I- J$ J! d7 j; O) a
! U! `+ C* t( v! q6 a- Y2 j. z( L
2nd method similar to the preceding one but more difficult to detect:* g4 ^( B! h- m' v; q: c
4 S8 K: K1 p( } [" Q8 G
9 O8 e6 {# W! v7 b& y7 ^+ c; eint41handler PROC# Y, N5 X% _/ N5 e
mov cl,al
' m' W. @5 c. c2 Q iret2 Y! B) X" w6 u9 c. q9 f
int41handler ENDP
* N+ F! s1 a) f$ c! Y$ C; c% B7 s w' K% m% }7 u- q
1 z: |! c3 `; K; I' j& Z xor ax,ax
1 G* T6 J; c0 l) N6 I2 A: T mov es,ax+ {1 Y1 i, C! M* N* K6 V% O* p
mov bx, cs
4 c0 s; X+ y& m lea dx, int41handler( Z [" W, G4 j
xchg dx, es:[41h*4]
# k5 f" s* k, h1 d% `' e xchg bx, es:[41h*4+2]
6 l3 u* e6 d% g1 [ in al, 40h
9 T; |4 H1 n! U- C0 e# p& z xor cx,cx
1 Y: d q* j2 E# t M# s* c9 E& J+ V int 41h1 S6 \' R2 {; @( ?0 `
xchg dx, es:[41h*4]
) m6 R/ S- ^) [3 R6 J xchg bx, es:[41h*4+2]
# e/ I' F: w/ ~+ h' O# _ cmp cl,al9 b# o! _% }7 w) }& S' r
jnz SoftICE_detected, r( B2 s" `/ }% d8 Z
* n; e- k- t/ y% h# A
_________________________________________________________________________4 }2 Y$ O C6 _7 k! b
3 D" I4 ], t8 @2 ?1 c+ GMethod 07, }' {; E( Q0 t Y1 }2 Z
=========
9 _' ]) L) I1 \' i) `& X
' P7 l( f; ?' d4 i4 BMethod of detection of the WinICE handler in the int68h (V86)
) @( H' @1 K9 l& x/ W1 W' K! J3 j3 N# A W! D# [2 X% _
mov ah,43h
& I$ h+ e7 [/ E& G) r+ K' r int 68h# A6 q3 q2 w' ?- q* ~7 E
cmp ax,0F386h) s7 E3 p4 J1 ?5 l" p
jz SoftICE_Detected
" D( P& m W- d/ v
q/ F" j( O6 h( N9 c G
, V' r+ [1 w" k( `; T3 e=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
! `: A% L! X* O& w/ @ app like this:
' ^) e* ]7 F+ ^! d! o1 G$ ]# I
4 N# v3 t3 }* W) d& l, h: { BPX exec_int if ax==684 F0 A2 b2 m) U4 {
(function called is located at byte ptr [ebp+1Dh] and client eip is
0 ^! N& Y6 I1 @. l, O: t located at [ebp+48h] for 32Bit apps)& {* M6 ^4 a- P: u
__________________________________________________________________________
$ r* Z/ k4 N3 }% }% i4 u7 m/ E8 ^6 x0 D5 l
, y4 S# o% @& z7 {! r# F uMethod 089 o7 i6 X R4 q; M" \4 S; B% p
=========4 I; x' A$ I6 }
3 L" ?% \5 i. h. PIt is not a method of detection of SoftICE but a possibility to crash the
/ J6 O+ F7 o, t! |2 K' ]system by intercepting int 01h and int 03h and redirecting them to another
6 S, Z- p! o1 q8 N* n3 ?routine.
0 U5 B( K" H: IIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
2 V! @& M/ W6 [$ J2 S5 Wto the new routine to execute (hangs computer...)
6 X$ j9 y* }7 J$ S/ ? H n: N7 R) y/ K; N l! c5 I; Q
mov ah, 25h8 E0 o( Y, u7 j
mov al, Int_Number (01h or 03h)
; l2 f+ U4 q$ {' ~ mov dx, offset New_Int_Routine
v8 \3 ?5 _! p) j: n, ]5 K int 21h
. G R1 V5 p+ b4 l- l
( i7 r- ?, z8 `. m5 M0 k__________________________________________________________________________3 g; }+ l( ^) j) N# c S
' L# N/ r: |7 I* ^
Method 09
! H. ]6 s1 o8 K=========
$ ^" i7 N- Y8 Y7 `5 ]1 l& }; \# G% ]; r! N, ^# M9 L" `
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
# Y% a* D# `! G# v' D+ Xperformed in ring0 (VxD or a ring3 app using the VxdCall).
2 y- W5 O' W, \9 ^( _3 i& KThe Get_DDB service is used to determine whether or not a VxD is installed
- g; Y+ h6 `& h+ X$ [" \, afor the specified device and returns a Device Description Block (in ecx) for# U( o( J/ z! s7 M
that device if it is installed.
7 O+ c6 ?. v! A7 u% e7 @. F
$ e0 G" Q/ c* a4 Y n% g) j mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID7 o& ]0 l& D0 q* _5 L
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)9 s1 w% Y0 p+ l+ Q3 d
VMMCall Get_DDB, ]; i8 s& ^3 |7 j
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed v0 W2 c& D+ d
4 |0 m5 d) Y, f0 K. A( ~+ p/ C) J
Note as well that you can easily detect this method with SoftICE:
4 F3 P v8 {8 @6 C( z A$ W bpx Get_DDB if ax==0202 || ax==7a5fh7 z; b- I- e- M. S" h7 e
( B0 `1 J' `* V+ q( h7 q5 I+ O__________________________________________________________________________
) l5 _' o) X3 f, X: h' `
; [( U' W1 F, e& `5 zMethod 10
/ E) c6 V: ^2 X& I' H=========
! x0 ^) V7 r4 ?' u8 W: \. b3 f8 e7 m, ?) S4 g
=>Disable or clear breakpoints before using this feature. DO NOT trace with8 D+ A% G/ W: M, ]
SoftICE while the option is enable!!! C( e0 M* H5 T8 O
$ g, m* R5 Q( _2 }: aThis trick is very efficient:- O( U9 s# Q; D# T1 M! q1 b$ f
by checking the Debug Registers, you can detect if SoftICE is loaded
) n6 D+ ]( Z/ {5 f& L: I/ {(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
9 [; M" h% | G6 q8 Ethere are some memory breakpoints set (dr0 to dr3) simply by reading their
- P: S1 @: k) a0 n* x, Y5 l! i+ R9 S2 vvalue (in ring0 only). Values can be manipulated and or changed as well
1 F: `: c- ]3 n Z(clearing BPMs for instance)
8 u3 f {; c; c
: H4 g% o7 U! _6 I3 ?/ W# H__________________________________________________________________________" y% V5 W# {) {: O# [& p& O
+ U. i2 F4 B) r. NMethod 11/ u" H4 N4 F! z) u/ ~3 p
=========( q4 P8 U+ j# h: v! v: o
; m3 t1 J5 X4 VThis method is most known as 'MeltICE' because it has been freely distributed M; A$ t6 G- c7 I O" e3 p: z
via www.winfiles.com. However it was first used by NuMega people to allow
+ H2 r$ A* R, H' ]Symbol Loader to check if SoftICE was active or not (the code is located+ M7 y" z+ T- w, V9 ]
inside nmtrans.dll).0 g% w; [$ ?4 ]9 Y
' A0 y* `2 i% _
The way it works is very simple:
& W$ `9 n; W- u8 V8 a% n: |! kIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for4 u7 C' l- B6 F" X* ]
WinNT) with the CreateFileA API.
% i" o @1 ^* Z8 g, p- U8 A) D
% Y5 [! X( e9 L# G9 hHere is a sample (checking for 'SICE'):
* |2 y2 K, k. P( K* X; _8 [& K& x6 H. e5 ~% z7 b( |
BOOL IsSoftIce95Loaded()
. L3 s5 Y$ Q7 O2 m4 c{
7 h% n6 t& h/ ]) S3 z3 d# Y% Z) ~ HANDLE hFile;
3 m, P' v* A5 l. Q" t4 g hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,& F4 f- `2 t; _9 w- V! n( F
FILE_SHARE_READ | FILE_SHARE_WRITE,
# G& E. e [. _' Y8 G+ }' W NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
) ]3 h! ]; V. {7 N+ C if( hFile != INVALID_HANDLE_VALUE )
# i8 V# h/ N+ {7 I# ]( x6 p {2 i* D$ G6 G9 |! ?( L$ @' i
CloseHandle(hFile);- a. {* g- G" B
return TRUE;! s2 Q# r0 Y- S! R. Q% a* z, i# |
}
$ T, e6 L1 j8 Y' J2 I, Y { return FALSE;4 W" T% F- v/ W4 J# _3 ?/ G
}
- s! |/ u4 q. Z+ L8 b
' S' |6 J! t* \9 I B7 ~/ J2 @/ qAlthough this trick calls the CreateFileA function, don't even expect to be( j# i5 ?8 ]7 B: z& w w
able to intercept it by installing a IFS hook: it will not work, no way!
$ v7 Q# U# X# Y4 N8 ~0 q" i1 iIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
4 R' ]0 R) h2 R+ hservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function); H2 W$ |- o* D( T- Y/ i
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
6 D9 V& [& J9 o* G4 Qfield.
% V3 l5 T3 w- B$ n: [In fact, its purpose is not to load/unload VxDs but only to send a
' |- j) {2 O- R7 T' m, NW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)0 \, ]. A3 W' L& ^ o6 u
to the VxD Control_Dispatch proc (how the hell a shareware soft could try! | ^7 z- a1 ]7 m
to load/unload a non-dynamically loadable driver such as SoftICE ;-).$ g1 e. C. O0 [: |8 p) E
If the VxD is loaded, it will always clear eax and the Carry flag to allow
: ~3 G5 D2 a2 \5 y0 d+ Yits handle to be opened and then, will be detected.
8 W+ H% F# X7 A# D4 d. vYou can check that simply by hooking Winice.exe control proc entry point1 `, a1 |$ n, F/ x# b3 A$ ]- Y+ T
while running MeltICE.
% h, X& t1 G5 D( k# u( d6 e+ C8 e6 a) Q8 ?
, b0 @& j1 v# k0 q% q
00401067: push 00402025 ; \\.\SICE
( `2 [0 @1 n- M' F' | 0040106C: call CreateFileA5 k, o, C# ^8 {, v ?, r. @
00401071: cmp eax,-001
Q2 l- o6 l+ ~; _ 00401074: je 00401091
7 W; `9 C# V) \8 T; t
! u6 o0 v) m' y+ ^" q$ c5 M; e& U, F) C
. d' i ^$ ^/ B9 iThere could be hundreds of BPX you could use to detect this trick.
7 Q# T* M3 Y4 P. g2 D" G2 S' r9 Y% r. u-The most classical one is:
9 Y# N4 |" I7 Y% w9 o# h8 p BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' || b* \$ S9 c4 p+ h5 Z/ j$ g
*(esp->4+4)=='NTIC'
4 `, R4 U- s9 \. F) s5 s3 Y% X% t3 l) B; Z+ l
-The most exotic ones (could be very slooooow :-(* V' A) t2 W' h; C9 N( g: Z* s: V& Y$ K
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
6 L; g+ ^+ R4 i/ x( H2 |6 b5 L ;will break 3 times :-(
, q/ D3 Y$ u) y9 c+ b+ ^: _* x3 E4 ]+ r) y
-or (a bit) faster: X5 [; s2 p6 P
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')& f' W$ i' o+ z" }! R% M* W5 b
8 D& q1 ^* a4 I1 S- K
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
7 y O9 c& y) s8 w( Z* v ;will break 3 times :-(
2 d# A2 P- s$ u+ a1 \# F( r; z( s% E8 v& y" Y4 z) [$ U# X2 ]5 R
-Much faster:) ]; w w6 M* y" }+ \" A
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'/ \& C5 S+ C: w6 }) D
4 k4 a8 o2 _ `, G- S
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
( U @ o6 W, R" f! N; N+ R# w( R0 U% _function to do the same job:/ C: u d0 x, p: d. }( ]: i
1 t4 h7 x! B7 |0 e8 f5 j
push 00 ; OF_READ$ m1 m4 ?. [5 Q) _, E
mov eax,[00656634] ; '\\.\SICE',09 x! c/ J& M5 z) s0 V
push eax$ q* j3 |* b% n+ W, f/ z1 T2 N' N: H- `- b
call KERNEL32!_lopen
% r! M( y: B1 C$ @ inc eax' K9 k$ Z, h) E3 C) e% I4 k: D# s
jnz 00650589 ; detected
# k6 t5 {1 v# Z push 00 ; OF_READ
/ p2 | B2 V# `* y3 w" ~ mov eax,[00656638] ; '\\.\SICE'
# G) E2 I( V7 Z0 U" Q/ J push eax
' F& X v# }2 m call KERNEL32!_lopen
8 }9 b3 ^# d8 L# P; w0 [& r inc eax
& U/ v1 |. @5 p$ u" {- o jz 006505ae ; not detected7 f4 n$ T- ?6 Q) n, K! U" i) h
/ t' K s. `* X, u2 V8 B0 ^, I4 J$ j; R+ w* L' ?8 L8 @2 G& R. j
__________________________________________________________________________! X; Q! |# m& H" N
- e1 L: x L: M4 _8 SMethod 121 D6 i5 }: _* v7 x( s
=========
! k6 g8 T' `' _ @1 T
; W7 o# f4 z- P& m" \7 jThis trick is similar to int41h/4fh Debugger installation check (code 059 {2 R5 x* L0 D. M" R
& 06) but very limited because it's only available for Win95/98 (not NT)& t% X5 f" J) z- V
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
G T; _" K: G' G
& @2 O- R E4 M$ l push 0000004fh ; function 4fh
+ |9 {8 J2 Z- ^ push 002a002ah ; high word specifies which VxD (VWIN32)
. y+ V: |1 L7 L ; low word specifies which service" A Y% n% \) O* s! l$ L
(VWIN32_Int41Dispatch)1 N% J: w8 ~* Q
call Kernel32!ORD_001 ; VxdCall' M+ b8 F# B1 X( u. E5 C9 |
cmp ax, 0f386h ; magic number returned by system debuggers( q9 ^0 \5 K) L/ o
jz SoftICE_detected" y2 X7 L7 U* Q# `9 |/ Z" X
* G. u8 Y9 [! H# h8 v4 iHere again, several ways to detect it:
. _# V0 M0 s$ E ]4 G4 ^- r+ \# s7 g0 W2 c" x& S
BPINT 41 if ax==4f9 z3 j3 H3 X \) p
- O _- E. o2 e' `4 L2 t BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one0 J% `: T: x- f/ V. ^
" T9 P6 ?% W! v1 }6 h9 c BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
4 _- P( R8 Q# G* e, W7 y. h' Q2 z( J* `( x
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
% [, ~4 x( O4 z. H% y, @ J. {* w$ f
__________________________________________________________________________
6 T a& P: y3 J; i0 D' _+ U* e* \/ u4 d2 o% n* Z
Method 13" O7 P5 y! T7 T" |
=========
) [8 B! h8 p2 V( @6 P$ w! Z$ }; Z* H: b) x* {& E ]
Not a real method of detection, but a good way to know if SoftICE is4 l5 y( ?4 }) A- m' U5 V( A
installed on a computer and to locate its installation directory.$ H0 @8 y3 U4 |( N- k, M+ r
It is used by few softs which access the following registry keys (usually #2) :6 ]8 P) @* K3 N+ v3 b
% Q* T3 E3 M$ M* G9 t3 o, T
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
) Q7 H1 T# L; G# W- X3 b. a8 {2 c\Uninstall\SoftICE( r N3 r! U3 V7 ?7 h
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE( ~/ v' Q X" L. |
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
; V1 z. y) s: X( ^* h\App Paths\Loader32.Exe8 z1 N, @7 j7 [
& l; C" h' L1 s" e% o
[; |* o9 O4 H
Note that some nasty apps could then erase all files from SoftICE directory+ |+ N! C1 `4 b n+ I
(I faced that once :-(" }1 X* Z. ^% d& E. o
8 D8 ?0 S7 n0 b n2 A) a: k4 A: k
Useful breakpoint to detect it:
/ I- M7 j( j! I) a2 B! ~! S
1 B0 T. U' [5 \0 Y BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'! q, D2 j* |8 ^% S
# E6 Z* `' v: P h
__________________________________________________________________________3 c2 a9 p/ S a5 f
l, b3 D- ?& ?9 ^. s
1 `$ v7 Z# K+ bMethod 14
4 S+ f7 p/ w1 A3 M=========
3 I* G/ V" |$ |
+ L9 g. X0 x: X6 ^A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
% h8 B" A* T6 P- ?is to determines whether a debugger is running on your system (ring0 only).
: k" h3 ^/ b; E/ a
" `) f0 f# ]& D& U6 C- k' l) ] VMMCall Test_Debug_Installed
1 {2 ~' [) l0 _* @6 D! o je not_installed5 P" N6 |8 K& b7 U6 {! o! M. m
1 J( _' A9 o4 B, b. T9 FThis service just checks a flag.
6 l) x( p' y9 w" _</PRE></TD></TR></TBODY></TABLE> |