<TABLE width=500>9 Z+ {7 p/ y7 B& W
<TBODY>
0 [5 a# C) W& m& q" n/ ?( j<TR>1 Z! R9 m# J+ K I
<TD><PRE>Method 01
* S- g( P# |3 L/ p* d=========6 w0 p$ U6 G. ] @% N6 ]0 r. K \
1 B" h; y) e' E/ ]
This method of detection of SoftICE (as well as the following one) is) k8 j6 a, [# s7 k' N
used by the majority of packers/encryptors found on Internet.
5 D" m/ s& {7 RIt seeks the signature of BoundsChecker in SoftICE5 Z/ E2 T! a) y/ h1 k& W
( h0 v# P5 a- k- L mov ebp, 04243484Bh ; 'BCHK'
" k: W% N) G. o- q: D& K6 D mov ax, 04h9 C8 _: V: I& I! }
int 3 4 `$ }# [5 x9 B: q6 X2 a
cmp al,4 t- |3 {$ }3 r
jnz SoftICE_Detected+ B$ H: D& v* q
# F! z( J2 w' [# W$ ^___________________________________________________________________________
W2 b. N' e( F8 q9 Q b& E5 M X3 d0 D; v' R$ H: f
Method 02$ v9 o7 F3 |9 {- Z: b9 P
=========1 D& y: [- w; H ?5 D- }* [/ y: t
7 s, K4 s8 C% Y2 T2 Y- w# [0 h
Still a method very much used (perhaps the most frequent one). It is used
5 r+ x( a. R7 A4 dto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
' ^7 w8 E- O! T; e8 O" Qor execute SoftICE commands...! {8 ]+ w' X/ h6 w; J @
It is also used to crash SoftICE and to force it to execute any commands
: c# |4 e( h# B, C9 `/ F(HBOOT...) :-((
6 h& N% O0 i- L
% l3 C" U8 B& I0 t8 PHere is a quick description:9 x9 K" G7 c7 {8 m( A- a# y
-AX = 0910h (Display string in SIce windows)1 {* x* B; m, G5 a m
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
: k4 ~' {2 H1 t# b9 R7 w-AX = 0912h (Get breakpoint infos)
% G) k+ j. [/ j- Q" Q-AX = 0913h (Set Sice breakpoints)% [) M6 ~2 ]& Z7 S* U5 \+ V
-AX = 0914h (Remove SIce breakoints)4 Q3 m, I) v! V1 w5 w
' a% K* M) ]% Y- p
Each time you'll meet this trick, you'll see:* i; L- N0 V% \& @$ X5 X
-SI = 4647h
8 m% t3 g- t5 m$ G1 Q-DI = 4A4Dh
8 R6 [! A4 K L6 N S2 UWhich are the 'magic values' used by SoftIce., S y. F. I* q) D' o
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
& H" v3 l, e# X6 \* y/ E4 I* j6 v3 M, S& v+ Q9 G
Here is one example from the file "Haspinst.exe" which is the dongle HASP
}- H2 k2 y' Q6 y+ i$ dEnvelope utility use to protect DOS applications:
6 H- [- N& \+ c( j( W
0 J/ z% W: X9 o: K$ ?' Q2 ~
1 R. G h: {7 H6 Z* S% A6 t0 E4C19:0095 MOV AX,0911 ; execute command.( W# \) g) _6 T" x+ X$ S: R% t/ H
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
) y/ s( M" M5 h+ t3 |8 E# u- L4C19:009A MOV SI,4647 ; 1st magic value.$ D' R$ B+ B) `2 E- I6 o3 ?' x# I1 e
4C19:009D MOV DI,4A4D ; 2nd magic value., T/ a8 l; w# K
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)$ Q9 R& P, [& ^
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute f- _/ u2 B- ^/ v
4C19:00A4 INC CX+ y. m) @& ^9 h) k" |, j
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute$ P1 [" ?- v- A2 g" @& {
4C19:00A8 JB 0095 ; 6 different commands.
. A$ M* E! b) S% b( h$ k4C19:00AA JMP 0002 ; Bad_Guy jmp back.
q* l- Q1 L+ S; N8 Z4C19:00AD MOV BX,SP ; Good_Guy go ahead :)( ^2 l. m0 J9 {, j" G% z6 M0 m
1 \9 B. n+ F8 c& I% q( m% _; P- H
The program will execute 6 different SIce commands located at ds:dx, which c: H$ C+ z% L2 V5 T5 Q
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT. \" k, V4 x+ x, [# z% G
8 R! `% M7 [/ X/ j' U, {* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
2 v+ P" f' d- e9 }6 m* f___________________________________________________________________________
! o. w' {" c) I6 H1 N; {* E1 M! O3 Q- C- y% } N, F
E) K$ D) X' t( d' }4 k$ y
Method 03
6 g, s' M1 P) `; m! J" V=========
( _: k+ Y+ |0 [6 X# f q0 a- d
2 ~5 C1 r5 v5 j X% v h6 ]* |7 \Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
5 @) l- f2 H8 N. {3 O(API Get entry point)
6 m1 `0 y S$ Q. T + B& x# C# G; ~! F4 A/ R
* z! x4 |( `6 V3 H$ d: y xor di,di
7 `: ]3 G* T; N/ Z6 h R% I) c mov es,di+ G- c/ d: b/ i5 X. R0 J) ^
mov ax, 1684h ! l3 d' w: y9 w. V
mov bx, 0202h ; VxD ID of winice0 P D% r" ]% B9 r9 o% f
int 2Fh
1 T+ |& \+ A4 N/ o mov ax, es ; ES:DI -> VxD API entry point& N6 ?+ D: z) `! {
add ax, di. X0 w; }( Q3 I
test ax,ax2 ?4 v0 E; f8 U c; c' B
jnz SoftICE_Detected1 ^+ C$ @) ^$ r ~8 Y
5 G' @9 s; o7 j, T A8 U___________________________________________________________________________
, p0 ?1 l6 V4 K6 @+ }5 u6 ]' p8 [9 E) u9 Y" \" ^" L3 k, i
Method 04
2 N, R8 m; w. {=========& E5 a5 A: A2 q N
4 y* z- d& U! g9 u0 f
Method identical to the preceding one except that it seeks the ID of SoftICE
# T: o. v; C7 E5 X0 g- RGFX VxD.) z0 r! b+ d t
: f# }0 q+ b* G4 h3 e
xor di,di
3 R8 S! d7 N: G6 b6 O, L mov es,di$ e0 y5 y* K, Y# f
mov ax, 1684h " S r2 R# j) _6 ~0 e% k
mov bx, 7a5Fh ; VxD ID of SIWVID+ C* D1 I5 {2 R
int 2fh4 d; ^. j8 t5 j! s `' T0 J+ o
mov ax, es ; ES:DI -> VxD API entry point
' p- O7 ^/ _! S& c add ax, di8 t& O! Q: z. t% Z
test ax,ax* k, O1 |& c0 Z B. [
jnz SoftICE_Detected
4 r% S$ g1 g8 c8 I' f' T( g
% q4 E4 f/ D8 ?' N__________________________________________________________________________
; T# i3 F% O- ~# E# p9 o/ \# J
3 V* I% r, Z% _- x1 a
( G8 F" n! E! |4 K; Q& rMethod 05! ?) @7 o- V2 _# ]; X1 l
=========. }% I1 ^ ~3 y4 J4 a; l- Y
, l Q5 P' u( V+ Z$ R5 q, }0 `0 YMethod seeking the 'magic number' 0F386h returned (in ax) by all system
) U2 h. \2 M8 ] `, f sdebugger. It calls the int 41h, function 4Fh.
7 V( V, o \' \( ~There are several alternatives.
* {/ u' V0 u0 Q5 I f
9 i9 p5 @ R- t' pThe following one is the simplest:
8 M! M7 _4 A) b8 k1 f T; |7 @5 B* o g' f+ m
mov ax,4fh' D5 x! d3 z& l
int 41h
" r3 b1 T6 J* C/ n& K7 }4 N' h* M: w cmp ax, 0F3862 j6 \& A9 [7 C. L, A4 W+ ^" y
jz SoftICE_detected
+ F1 ~5 E# j) W! o9 ~# C
8 n, q( M; ~) a1 ?$ F1 f& ~0 u( s& H1 X5 v* P& O; U; z+ y& U
Next method as well as the following one are 2 examples from Stone's * S3 N% {8 M3 I. V
"stn-wid.zip" (www.cracking.net):) v4 K$ S$ h0 z# _5 f$ h8 b. c
* a+ A( t; T' [" M8 k3 W mov bx, cs: ^% w6 A5 |1 o) [7 Q
lea dx, int41handler22 Z/ q+ L {# W& ?3 Z
xchg dx, es:[41h*4]
0 n: Z/ E9 s- h7 Z, L xchg bx, es:[41h*4+2]& _! G. F E0 k' m$ _: \
mov ax,4fh
+ G4 z0 ?. A- L! W& C- o$ M int 41h! ?8 l+ |" b& t! p! F0 l
xchg dx, es:[41h*4]
- e; t5 [8 g3 n4 u xchg bx, es:[41h*4+2]7 w* k; S3 }# Q0 R& m
cmp ax, 0f386h g7 J- L$ [$ E& Z2 [6 b
jz SoftICE_detected- q6 r+ y4 p q$ e2 ^
0 ^ b( o( X+ F, Z8 F
int41handler2 PROC4 K& H1 X2 x$ b3 I# Y
iret
* d2 Y) F- H# l) {& O% d# Z# eint41handler2 ENDP
" S* ~6 M# E& C a1 B
( W- J7 x$ N% k
+ E1 _* ]4 H( [0 x8 A_________________________________________________________________________
. Q: U' l7 `1 o$ c$ t
; ?, b. {1 x: b. c) t, E% l3 J
$ t- y) U! G9 s3 Q9 X1 ~% KMethod 062 w7 F& Y8 X' u3 a
=========3 U" v/ U$ {# ^' g- D
3 L& M# ?8 x4 B% F$ `- O1 Z
4 ~7 n$ }/ P9 B% A2nd method similar to the preceding one but more difficult to detect:# k. a7 x9 g. d% g$ k& a
/ n4 `9 v( I/ G' ~$ ~; d5 u0 M' Q* W
# {. z9 G1 L! F
int41handler PROC
8 x: l" C" t; y! { mov cl,al
$ |3 ~& |5 n+ L1 I% R' m. r; U iret' ~0 f& r0 J$ h$ j( F7 u
int41handler ENDP- Z2 m2 T I$ X: s( @
' e3 t# _3 \) p
+ H8 }" p* d: a9 X: f xor ax,ax
, ]4 B' e) F' u/ F3 Z0 T/ e mov es,ax2 i0 ?4 q5 D6 j- m) V
mov bx, cs
; [* q: h. c( _ lea dx, int41handler' z9 Z3 N, E/ L
xchg dx, es:[41h*4]
4 Z k$ Z, t ~4 a" u xchg bx, es:[41h*4+2]" z8 o0 X3 W. Y7 b9 b$ ^
in al, 40h
3 q- Y0 m1 x" h7 x2 E xor cx,cx
1 G4 }# ^/ u7 }9 q7 e int 41h; [* r6 J2 ]2 V+ ` k: a
xchg dx, es:[41h*4] ~8 k+ C" q" _3 g1 \5 v
xchg bx, es:[41h*4+2]/ R" @. [1 s; L3 w$ N. A
cmp cl,al( Y e& z( X% G' G
jnz SoftICE_detected* q' Y2 x: F+ e
% E7 Y2 F, R: `' n! [2 ?6 R: s_________________________________________________________________________
% L6 W- f" k, |: Q; B) w1 h! u# G, o B" ]- i
Method 07
4 ]( a% B$ J' |# ^=========) s) c R8 N2 V4 K' ^
6 X" n6 v* e9 c* |% Y
Method of detection of the WinICE handler in the int68h (V86)1 Q- v$ O. \4 {9 l C6 e
+ [/ f1 G( f# w! F
mov ah,43h
& w4 |* x9 U' s \* ?, H9 x int 68h
) }' |& p! g$ G cmp ax,0F386h
; u9 w6 N& \. C L$ t jz SoftICE_Detected0 K) p5 O* ~) z- M. M
0 G- L @! |7 A& l; D# O$ }
& H0 \8 E& O4 I8 @0 A. r2 B=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
+ i$ w W; Z% C6 z app like this:/ y5 x" X7 H, \2 }% _4 ]* ~
+ g- @/ [% l+ k( {% t BPX exec_int if ax==68
$ W2 F- r. L3 P# ~: d# j+ o (function called is located at byte ptr [ebp+1Dh] and client eip is* z8 G1 s1 `1 k# N& e
located at [ebp+48h] for 32Bit apps)+ e d' x0 f, P8 `# T# ?
__________________________________________________________________________$ S- Y' `6 {" d/ _& [9 ~
& N& [& y+ N. e" ?
1 W& K0 T% P- c3 v, P5 e' m
Method 08
# g6 Y D* ^% f2 b i=========
0 |! o3 q. G9 r5 I1 L: n( @: k0 X* t, a" B
It is not a method of detection of SoftICE but a possibility to crash the2 g6 j `( Q' }; C! A
system by intercepting int 01h and int 03h and redirecting them to another# P( U L, j8 T' e9 O
routine.5 q+ [! E) }& B) U+ \! ^# O
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points4 h7 e+ D4 I* \/ o* \+ ] E
to the new routine to execute (hangs computer...)0 Z4 ]2 I2 b, t
6 P4 p% a8 Z8 y) n6 u4 E mov ah, 25h
/ F B" I( m8 n+ e mov al, Int_Number (01h or 03h)/ q4 p N( Q5 Z3 `% c/ C% w3 Q
mov dx, offset New_Int_Routine, d! _7 g$ H* L
int 21h; n1 r2 p# k9 t% m7 }/ P, x6 ~) F4 ]
* G9 H) O/ C7 ]2 h& v6 c__________________________________________________________________________
2 x7 M: l( z. Q0 m$ Z( t
$ K; Y. Z" {( _. [! ]6 m; ]Method 09, r1 f$ Y* v0 {! M( G1 @
=========+ h# d H+ [* s- l: X, l @
2 x6 D4 C- z4 ?8 f1 VThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only0 X2 t( C$ s/ f& [7 |4 r
performed in ring0 (VxD or a ring3 app using the VxdCall).5 O. Z- u6 k' G0 F2 c9 d
The Get_DDB service is used to determine whether or not a VxD is installed
2 e: K) w2 C n s$ W# zfor the specified device and returns a Device Description Block (in ecx) for3 o+ x. D, S$ r, U- w
that device if it is installed.7 G* ^' l% `4 G3 J
8 ~$ z7 A1 f& }, e
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
# o3 Y9 E7 d Q3 l8 v) l/ f/ U mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)' O# }, T# I3 y3 S0 O5 |* w
VMMCall Get_DDB# X- m7 c5 b: Y9 e, i' Q% E" x6 }
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed) d- p/ A8 G$ t
) e, i1 b6 n) T+ Z. G U& {7 vNote as well that you can easily detect this method with SoftICE:
/ _2 n6 Z6 N, k! J. b bpx Get_DDB if ax==0202 || ax==7a5fh
& B# N" n4 ?* p; J( B
, m+ a$ r+ c8 r4 ___________________________________________________________________________
; n0 {; z7 }3 N' f T
9 g" p! ^1 i9 n: jMethod 104 j* z! J* l' v' V6 a; ]1 p5 G
=========' I8 J, z( q$ ~" q
- v8 J% R- F. Z9 R- g=>Disable or clear breakpoints before using this feature. DO NOT trace with) B6 R9 N5 d' f5 k
SoftICE while the option is enable!!3 b% A3 D5 G% A4 |, L/ J! K* g9 s
$ s+ S3 J5 A: V! n& g* i) ]This trick is very efficient:% w. q8 O4 w+ t: \# ^2 R" J7 U3 j
by checking the Debug Registers, you can detect if SoftICE is loaded l: o, s& O: f z% n
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if; W; T. T+ F9 Q$ a2 N
there are some memory breakpoints set (dr0 to dr3) simply by reading their+ e7 c9 B/ V n+ |9 j! K
value (in ring0 only). Values can be manipulated and or changed as well
# ^' m. @# T2 |0 O- u( X(clearing BPMs for instance)
1 o) I2 L! \; U+ y1 j( S0 E1 S
8 E: d7 n) H9 T: g__________________________________________________________________________. b) O/ }. [1 c* T% l7 |: s
3 \: `! N: O& R7 w; m" e8 e0 yMethod 110 a( y$ Z: Z* ~" N$ U% i, A4 ?; y
=========
/ V- |1 I+ }$ V& m# f
' K7 c8 @5 \) Q2 HThis method is most known as 'MeltICE' because it has been freely distributed. _3 s2 g( {: Y- M7 ^
via www.winfiles.com. However it was first used by NuMega people to allow
; T4 w* N6 Z5 h( pSymbol Loader to check if SoftICE was active or not (the code is located5 W6 a7 F5 F4 O, L0 v
inside nmtrans.dll).& x P* W$ R) B' G. G, \
3 d* p( J; ?0 m* e, Q# h
The way it works is very simple:- D! N: m) W0 U _4 y
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for* T. @4 R. Z4 U/ ^, ?+ z. s1 @9 ^- K, J
WinNT) with the CreateFileA API.
; Q+ N" E5 g7 Q4 I8 i6 s8 Y* N- i# h1 g$ B9 Y
Here is a sample (checking for 'SICE'):$ O; n! x. h# a* S- o) V
, g% \" N7 s5 M5 s
BOOL IsSoftIce95Loaded()
( \( w- h9 a2 A3 x- T- }{
, D/ E, O' M: e4 @1 J" Z HANDLE hFile;
9 L. H; H. [/ J S0 ] hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
: l/ f" H# ~8 L0 Q FILE_SHARE_READ | FILE_SHARE_WRITE,
$ b; i4 j: I/ x/ a0 V3 g) P6 S NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
: p. J4 `0 |+ `" {# u if( hFile != INVALID_HANDLE_VALUE )" q C; J9 T$ A$ }1 W
{
" Z) j+ ^2 @. s9 Y& R, ^* T( ? CloseHandle(hFile);
/ O4 R Z) P9 U: m" e return TRUE;
* z7 O2 g) z: s( t' I" e; M }* w) t. `% E7 I2 g$ j/ d- I8 c. f
return FALSE;1 p. g$ a) q# }% Y# B
}, w. R+ v9 g, ?5 Z1 E% F2 Y
. s- i" s; }2 a4 ?. `/ ]% h9 kAlthough this trick calls the CreateFileA function, don't even expect to be- O2 Q1 _4 |: L* e+ [
able to intercept it by installing a IFS hook: it will not work, no way!) I% D( ?( ?/ w: y _
In fact, after the call to CreateFileA it will get through VWIN32 0x001F& K/ J$ H, I! O/ E) K
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
1 V$ _1 Z0 x. `and then browse the DDB list until it find the VxD and its DDB_Control_Proc
# \/ s8 @+ @9 p. Y- lfield.. w. Q ?$ P7 [/ P5 l
In fact, its purpose is not to load/unload VxDs but only to send a / A G' E9 P8 A/ x9 x( h
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)+ J/ K; _2 z( B$ \! b; c6 r
to the VxD Control_Dispatch proc (how the hell a shareware soft could try2 _% q% X$ p2 ^, T3 I0 I; A$ X
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
! f& g& d9 ?9 UIf the VxD is loaded, it will always clear eax and the Carry flag to allow/ U) J f" Y& |1 U
its handle to be opened and then, will be detected./ E( U4 A+ w6 W8 i' b5 D
You can check that simply by hooking Winice.exe control proc entry point
- Z. W. R1 m B4 D% K$ qwhile running MeltICE.; D% z; ^: Q0 K) x) I
$ v" ~ p& @/ S: u7 J2 M" t
7 _* e2 t' x* y# Y4 {4 _; F- V
00401067: push 00402025 ; \\.\SICE# v# Y& p7 j7 C1 R; F( ]
0040106C: call CreateFileA$ U) X1 E/ d& Y! U3 ], B
00401071: cmp eax,-0018 e) U' k3 {5 Z' x' O
00401074: je 00401091, d3 |; p6 P4 {# A, j
2 U9 J9 ~; B3 l( a+ G- H- S M' v. Y* J0 X8 T/ z: J
There could be hundreds of BPX you could use to detect this trick.# \" S+ U2 t& \$ s! j" ^
-The most classical one is:% S2 J8 l& v% {, o v
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||6 C+ _$ D0 z$ x! u
*(esp->4+4)=='NTIC'
" h8 D5 q+ r. r, G3 B$ Q+ B
' T0 K+ [6 R, b/ B# V q-The most exotic ones (could be very slooooow :-(1 J& Y3 Q% g8 [
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
" f6 ~; b3 |5 q* l* z ;will break 3 times :-(3 K& v4 Y, M9 Y" u. y- F
: `9 U1 k z: m& ?' h0 {
-or (a bit) faster: ! E4 a5 A$ `' o1 M& s
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')7 V* S5 b. @, [! O+ s5 x, i
( F3 n4 t- x" x! N, z R
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' + N: B8 }$ L3 a" i
;will break 3 times :-(
4 j3 R& ~8 E9 }) h3 ^0 J4 m/ p, a+ G/ T$ [2 l- j
-Much faster:2 ^. k/ U+ C; z3 w3 I3 d
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
- @9 E' p3 e( V' A" m- f" R% E" Q. ?8 n$ v
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
' Q; @; }. m" o: [" `* v% T sfunction to do the same job:! E; b- f: }' W
0 B* M* r$ \+ j push 00 ; OF_READ% O0 a: d' r: g9 d+ c
mov eax,[00656634] ; '\\.\SICE',0
( U9 |% o, D2 }) C push eax" B( O8 L+ W' g; {/ l
call KERNEL32!_lopen
/ j! T- o/ F% @ m" v3 w inc eax
# T' Y- d0 `' @ jnz 00650589 ; detected
$ \5 s% s8 ?" |1 } push 00 ; OF_READ
- \" t2 E. u& b! Y' Q0 \5 d mov eax,[00656638] ; '\\.\SICE'
* S1 C, i9 f8 n/ |6 D& ]0 L push eax/ X, r7 W! w) s' ^
call KERNEL32!_lopen
' t( E6 m9 V; ^, V inc eax( _/ a) t* G0 g2 q8 Y# M' L
jz 006505ae ; not detected/ y: h+ b/ ?0 z, E5 t7 ]
4 ^1 I- Z% b; j
' k" `* L2 o( A& ^__________________________________________________________________________% f5 d$ U. _* x" x; d3 ^
) d; X9 [3 a" ~3 a3 t( SMethod 12
3 l4 {+ D$ R3 H=========
6 O: |. ]# ~* m" k4 j( \, X" |5 G
0 T) ~+ |3 f; u. @This trick is similar to int41h/4fh Debugger installation check (code 05
3 c5 M0 x7 M' e( p/ U0 H& 06) but very limited because it's only available for Win95/98 (not NT)
4 M( p+ L# Y. R' L% y" vas it uses the VxDCall backdoor. This detection was found in Bleem Demo./ W0 p4 F' T0 f/ p1 f8 O2 b
" z$ T: ^9 u1 P# I) C' J9 \, J* p
push 0000004fh ; function 4fh
- G, ?) f2 G P! P" I push 002a002ah ; high word specifies which VxD (VWIN32) L: c/ T% S# k9 O
; low word specifies which service! ^2 V3 @2 v- A! B& I
(VWIN32_Int41Dispatch)
; a. i% Z: K1 x$ _ call Kernel32!ORD_001 ; VxdCall' g: h* _2 p. b2 ~
cmp ax, 0f386h ; magic number returned by system debuggers. z4 ?) ]5 O% w! j
jz SoftICE_detected. |" x- Y3 A( E# k* v" _
( `/ m; v! f4 s9 ?3 B. rHere again, several ways to detect it:( R- ]" j0 v# A) s4 d
, [' V6 c- _% d8 S7 }+ H
BPINT 41 if ax==4f) k/ V5 u- Q1 ^. E0 Y
2 q& Y4 ^5 n' @8 `! a. y7 a
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one( K7 {0 F) H2 X2 X2 [" y7 T
4 c, f& o" V/ J4 g7 e4 G BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
3 C! Y9 r7 M; k. F; G+ U4 Y+ y+ Y3 D
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!* y5 p9 G' Q( G( y& u
2 S5 Y6 y! x4 ^* [__________________________________________________________________________# Z/ a: V" N% ]. ]# h( r7 Y
. t3 k& d O$ H* P! B5 @6 JMethod 13
/ x+ d* Q0 s9 {1 K0 _5 g=========* |+ S n5 J( x! V/ E
# `8 _8 ~# P- L1 A- g- z0 E
Not a real method of detection, but a good way to know if SoftICE is
& T6 w0 y5 m7 K; Sinstalled on a computer and to locate its installation directory.$ U8 K" j0 s8 W. C
It is used by few softs which access the following registry keys (usually #2) :
8 v/ d8 `, ~' |3 x, {
, r* ~2 a5 {* n N-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
7 C, l* _) X5 i8 E4 @4 D\Uninstall\SoftICE c- d1 v3 B/ K& ?9 d; \
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE+ t3 P; v1 W6 B' N
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion' \6 r. B! l5 ^5 V' l4 s1 Y% P
\App Paths\Loader32.Exe
3 K' U) i8 `9 h( l- N* l/ Y m$ h) t4 B# ?2 S7 h! O
7 s j( M, d2 n: |% mNote that some nasty apps could then erase all files from SoftICE directory
* Q" c- e/ u2 X4 h(I faced that once :-(. y" y$ f$ z+ |( y$ |
- [ O e- ~) l, l2 A5 e9 b" iUseful breakpoint to detect it:
( C* W* J4 u6 e* p# D0 P8 k
9 v2 D- \# e; h5 U BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
c2 @* F$ ~: m5 Y
* Z) p- x3 s5 p5 G, h__________________________________________________________________________$ ]& p/ ~( s# Y$ q
: N- ~& c% G; x9 `% M( ?- A% L" ^9 S1 Y4 o6 g7 e
Method 14
7 L: f7 j; N4 _: X5 E1 e=========6 n; P. Z8 b& k. Y- s- I
$ K m1 T" Z7 P8 [2 G- s2 K" c
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose: C+ C: _$ d8 {! u
is to determines whether a debugger is running on your system (ring0 only).
7 L; H6 O8 z F7 i2 v6 m' q
& H) m! p" x/ V0 l+ k VMMCall Test_Debug_Installed- m0 @6 B5 {# P$ D8 K
je not_installed! [6 A0 r4 v+ {* o: o' e* l
7 ~/ w3 S' O3 yThis service just checks a flag.
- @9 z: V/ H" w. B; @" o</PRE></TD></TR></TBODY></TABLE> |