<TABLE width=500>0 v4 v- h" L- p: h @$ |& _# P
<TBODY>
, t8 Y* J @6 F8 Y# q4 p<TR>% m( q# U9 b" B
<TD><PRE>Method 01
, g6 u: U9 U- p3 L=========) K6 o' K r* I; s. M1 |
, `" e! T; b' T3 Z7 y k3 `
This method of detection of SoftICE (as well as the following one) is
% M$ i/ @* R1 Z, P) G) F- gused by the majority of packers/encryptors found on Internet.( |9 t; N" w( R' A6 q$ I. [2 q
It seeks the signature of BoundsChecker in SoftICE
' s; w$ s1 A* I/ t3 S' l. l2 P) [. t
mov ebp, 04243484Bh ; 'BCHK'* ?/ e9 ?/ N+ l# C
mov ax, 04h
8 B- K+ O" R& |! w& y5 m- Z) Y, K int 3
7 K& W/ t* l5 }- W6 H" X4 u6 z* d" B, x cmp al,4
: @$ @/ M0 `2 A w! T$ S( K m0 o jnz SoftICE_Detected. s8 r3 a% P3 g) y/ {
. p2 Q& @4 [. v) ?& S3 a8 o: C8 e
___________________________________________________________________________' v& A' M! b( e, `+ J$ Q2 \
W) }. ]/ b# [) m2 {' u
Method 02- C( d2 v% Q2 {
=========- E; o6 u7 s, n, a1 n
/ b: R# Z* W) `# }
Still a method very much used (perhaps the most frequent one). It is used) e1 ~" g3 x" P) E5 `4 g
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
" A, Q, w/ W1 z: S4 [or execute SoftICE commands...! v) E, o: q" o8 x& n8 E
It is also used to crash SoftICE and to force it to execute any commands
$ R# q2 z; g7 D3 [4 E. o(HBOOT...) :-((
! P4 Q2 S. U" U* [( c0 U
, C. H# L% P9 [+ R" f) {9 nHere is a quick description:
8 _3 w2 k" ~! M/ W-AX = 0910h (Display string in SIce windows)7 {7 e. z4 m' t2 v0 k
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
! x6 D" o' {0 m3 P3 w-AX = 0912h (Get breakpoint infos)
5 o: G& P% C* Z: K% A-AX = 0913h (Set Sice breakpoints)8 V; c1 r9 v0 F* z( T# L2 ]4 o4 p
-AX = 0914h (Remove SIce breakoints)
! f; ~) K( c3 K* p2 I; i5 F& n* v* r) ^# a5 V
Each time you'll meet this trick, you'll see:
" ~ I5 y/ g5 a6 V" [4 d-SI = 4647h
# ]8 e. i! z2 O, [; G2 l5 v6 ]-DI = 4A4Dh
; R$ q# R5 m2 m( h# `, ?Which are the 'magic values' used by SoftIce.
+ L" m1 A5 c: g8 W# mFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
2 \( \8 p: n+ I3 k; Q/ b4 f& _
. D0 a; f: H- g' Y4 g+ WHere is one example from the file "Haspinst.exe" which is the dongle HASP
5 M1 ?% @/ \: M, LEnvelope utility use to protect DOS applications:6 ]( \; n; A+ _9 V% _' o
- Y' i8 h0 c A
, {! ]' a1 S0 S" ^- s) N+ [4 Q6 V
4C19:0095 MOV AX,0911 ; execute command.
; d0 |; x( i/ Q/ z5 L4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
/ E" Q" G- V2 z+ t& P& a, X1 _4C19:009A MOV SI,4647 ; 1st magic value./ r9 X% e& \) `" I) T- v% c
4C19:009D MOV DI,4A4D ; 2nd magic value.
% B8 v6 p2 Q, [. O. p) _4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
" `: e$ t0 n* ]* Q' A4 @5 m4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute5 j j% Y, t4 s+ U% U) @1 N
4C19:00A4 INC CX9 Z8 D, M: `$ q; d2 Z
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
6 {) l) V6 o3 M* J; Q4C19:00A8 JB 0095 ; 6 different commands./ ^. H x3 D" z6 W0 J8 ^8 ^
4C19:00AA JMP 0002 ; Bad_Guy jmp back.; N2 b ?$ q$ M% K8 s7 `
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)' c# v% G6 o6 a9 O4 r- n2 R& J7 @% R4 ^
$ v0 o& f$ X0 ^The program will execute 6 different SIce commands located at ds:dx, which( {: y" {5 E1 f
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.- E O) A, Z1 V. ^2 t7 a- |
1 b y/ M+ u% o& }- ~
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.' ~; K; M* @' Y. p* `
___________________________________________________________________________
+ Z8 E, T6 L/ \0 U( T- A- |+ a4 b3 H& @3 u: ^1 A
' E. p" C6 f7 ]+ l
Method 03% k* {, N" V& u% o' T3 E3 r) x4 b
=========! J% ~3 S- ~; I e& L' z3 E' G
% f/ c! ~( |- M' s0 n/ F5 l$ }6 {Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
8 X0 x$ n/ G/ ^* H0 Q(API Get entry point)8 T$ T% v' Z1 Y, t5 r1 Q
3 C: U0 I6 \7 p- L+ ]9 I9 t5 ]$ C ?$ S1 p) b
xor di,di
3 X3 v2 x- V, n2 d# |% Y0 J/ {# S mov es,di
: r( r5 i" O, V! e s mov ax, 1684h
+ a- G- a. _0 X- ~4 O; a' m; [1 z; z mov bx, 0202h ; VxD ID of winice* f3 d, A9 h7 B* x; W6 L2 V8 X
int 2Fh
5 g5 |& J, i7 \; @! V. e+ l# w+ z mov ax, es ; ES:DI -> VxD API entry point* g- f0 q7 G* x1 v7 E+ E
add ax, di1 s: c$ r4 t# w' s9 e5 j
test ax,ax4 S: {% V( c' S1 R1 i
jnz SoftICE_Detected6 k \! L) ?8 C; z* O8 q2 @" ~
: p) y- m. j" E h; C4 W$ d___________________________________________________________________________
: ]" ~* u, b7 |4 M5 r0 c0 X8 t" d1 f/ k/ {' w4 H' O
Method 04
0 ^ b) V+ Q* Y6 M=========3 s9 R; t2 b6 N8 x4 X
5 N' Z9 [2 E# f( ]Method identical to the preceding one except that it seeks the ID of SoftICE
( P U/ V" r7 R$ r8 |5 t( t+ ~GFX VxD.) T5 R- G* U/ I8 Y
' e) i& }' S8 h xor di,di0 v- F7 D2 Z2 K+ l, k" g/ f2 a4 Y
mov es,di
' D- ^* }: G5 ^8 s1 x6 Y) k# j/ `# G mov ax, 1684h
' t2 A# s2 _& M4 }: z mov bx, 7a5Fh ; VxD ID of SIWVID
$ Y4 t. j( x! y" p' p5 r. I% x( } int 2fh
$ R; K, }4 I/ L/ a mov ax, es ; ES:DI -> VxD API entry point/ Z. @1 Z( K0 u& m9 ^
add ax, di1 w1 ?( \, ~ n5 ?4 v, o! c& R+ y
test ax,ax
6 e# z' ]! H S8 z8 |8 w jnz SoftICE_Detected7 F5 e m, f/ V$ h' Z( l3 h7 M
1 D+ f- B a& r; y4 x# F__________________________________________________________________________
1 l1 ]" C: g N9 t" Z: N* }" W, K8 D6 k9 Y- [7 B/ K
4 H2 |, a" [+ B$ z' B9 Q h0 x
Method 05) K# M' T" G. m
=========. f5 R9 G6 _+ |! P7 }
& Z0 t; _2 \) c R
Method seeking the 'magic number' 0F386h returned (in ax) by all system
4 ^5 @% U% |4 W' ndebugger. It calls the int 41h, function 4Fh.
9 e( i6 c2 _( P3 @There are several alternatives. & c; z f6 }7 M8 t
7 T9 n! h" H) M6 a% f* ~
The following one is the simplest: L3 [8 `/ r' i7 h8 j J( m0 k4 K
, n* C: Q/ P& T% @* M
mov ax,4fh8 A8 I6 d% \- \' t k0 a% M7 `0 v b
int 41h
, G3 U( \8 q- L% ^3 @/ b1 U3 H% y) [" ~" v cmp ax, 0F386- p" R/ r. q( }5 o) i7 F. i/ B
jz SoftICE_detected# `3 k" `" q0 v8 `. b2 B. \
7 x. a; r$ s+ O+ @
! T \) ?0 O5 H/ ~9 oNext method as well as the following one are 2 examples from Stone's 9 Z5 g: k0 `! f
"stn-wid.zip" (www.cracking.net):3 _$ G% w2 }" `" m1 D' n/ [
4 f$ Q7 Q! w0 r& o" t3 p1 @ mov bx, cs
1 i2 ~6 l j' l8 _ lea dx, int41handler2
& O: a' W+ T' Y. P xchg dx, es:[41h*4]: ?& W$ t+ c8 e$ m; _9 O6 o6 [
xchg bx, es:[41h*4+2]
/ [* K% `0 C6 j/ [5 b* d$ V5 h mov ax,4fh
# j- w$ m0 B, Y' _ p! j- q. x int 41h7 ]) J1 Z9 \: M
xchg dx, es:[41h*4]) H, f: Y5 Q, k0 L8 Z
xchg bx, es:[41h*4+2]( P, D+ P$ O, M: e( c+ T0 o
cmp ax, 0f386h
* l8 t; g6 |6 u3 a, A jz SoftICE_detected/ T" Z, C2 J: v4 X2 a: [; M; u
7 w( U/ J' {7 _, ?8 ]
int41handler2 PROC
: a: g1 g) G4 g3 U) V% f iret4 U3 Q6 D7 q6 Q0 w6 Q0 f
int41handler2 ENDP
G X d2 d+ x4 Z9 k
) J6 r# X# G, k4 ?( \4 j
& K$ C8 Q( w, K8 H/ |; M' k_________________________________________________________________________1 V2 W8 p5 S! h/ ^( r' C9 b
2 r4 ]8 `# h1 ]! g, A
! k" |; k+ q d: G4 S
Method 06
. l( X( m; X* k0 [=========5 X( j: o# ^' y* d' n$ |
# M+ w- y! R4 x
# {3 g A+ ]) P- c1 f3 V2nd method similar to the preceding one but more difficult to detect:
) k( j! |7 W& F4 i7 b4 F# J; m: o/ y! h$ d& O9 p
9 S) I( R' T* Z
int41handler PROC. X! A- `$ r9 b/ M. m: e
mov cl,al( Z5 G$ D. c5 w% Y3 _
iret1 ]1 q" J! ~- u
int41handler ENDP
! { [" Z0 g8 ]3 i: Y0 p3 t
?: t {' {, t+ W! v, E, l8 s- [8 d4 [# _9 g3 x" C, d, t4 S9 b
xor ax,ax/ D4 |- w. L& C4 O; u3 r
mov es,ax
9 n( ^2 }6 y8 x- |9 o mov bx, cs
+ S: G& k$ v9 U3 h8 ~# T lea dx, int41handler
% v# K9 v6 h8 U+ v* I xchg dx, es:[41h*4]
1 H% Y6 G( y1 N+ m. | xchg bx, es:[41h*4+2]
; Z' j4 L% m, U4 s* x# o in al, 40h& O" y' i& P9 m5 c
xor cx,cx5 a6 k) i4 p$ X- z
int 41h- S( X- X& N; c
xchg dx, es:[41h*4]& G9 b2 J1 {/ g7 k
xchg bx, es:[41h*4+2]1 R; Z. R/ { o1 P8 z( R
cmp cl,al w B! q" y8 d4 r9 B
jnz SoftICE_detected
4 A+ r0 c, D, X3 I2 S! j
9 \9 s! X# k7 E' G_________________________________________________________________________
2 |: X1 a6 W Z+ Q# {. x# W; G% O7 M a/ Q- t0 ~
Method 07, Q: L4 a: {1 s# v$ _% m8 W
=========
7 f$ |: b$ x+ q# z0 p# ?& ~% `
; Q4 D( A1 n1 f5 K: f+ D8 ]' R: s4 EMethod of detection of the WinICE handler in the int68h (V86)! V+ y! N9 {% M, L: @
: V. s, u3 i" Q8 L8 j% y
mov ah,43h
: A5 F( ?" Q. Z4 q8 ^% V int 68h
( B! z8 m+ J" h% s% p cmp ax,0F386h
8 Z p% T% C! E' g1 G* M jz SoftICE_Detected' f! f1 j" R/ n! q# w
4 i( E( |* V, U( M8 ] ~
' L$ D2 U: I/ v8 A2 h$ V* v! p0 w, X=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
) R% X7 j+ P, n6 n4 j7 c3 x1 C app like this:( a; ~3 \2 j9 @6 s. e
* ?) I5 ~1 C0 V/ N3 | K BPX exec_int if ax==68
, x& ^5 h2 o" l# ?2 Y8 g# o9 x (function called is located at byte ptr [ebp+1Dh] and client eip is
# Q$ N- k9 m$ y3 G located at [ebp+48h] for 32Bit apps)
5 C: j8 ]0 Y1 n__________________________________________________________________________
; c( p1 i& e/ L2 k. R
; M0 a/ a# h4 P( V% b) v ~" s! H2 S j. A4 Y9 i9 b# M2 {
Method 08; d+ r/ N: m+ R }. W8 F
=========
7 l/ a' A) S4 [) c) p5 ~. v) W: _$ }5 Y0 d3 |4 w$ H
It is not a method of detection of SoftICE but a possibility to crash the
1 @5 X @5 r. D H9 L# E/ y5 Lsystem by intercepting int 01h and int 03h and redirecting them to another
0 t! f/ t: C0 _2 p$ ^! i0 g$ Aroutine.5 v* I" u4 r4 @( k
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
! e) v1 U* u4 D' J; Hto the new routine to execute (hangs computer...)5 B1 b8 k1 b4 p" l s
/ n* c! f7 P8 M$ V9 [
mov ah, 25h
+ r! t, S& V: b% _ mov al, Int_Number (01h or 03h)
3 o* {: S9 _3 H mov dx, offset New_Int_Routine% }5 R0 Y# s) }. M, L/ N3 v5 H5 I
int 21h
0 G7 U2 Y h7 @: {% |- U' D+ v. q8 v P4 h* V2 A
__________________________________________________________________________$ k1 v3 h" n, }4 O$ }4 f6 `
' i5 |3 p) L/ w' ]% h- G! QMethod 09
* g/ L4 \" I- ]9 l- O=========
& B, Y& k# M/ O9 p
, I I# b) d" p" h9 IThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only& s% R3 ~6 D8 Q
performed in ring0 (VxD or a ring3 app using the VxdCall).$ q/ v& q) a8 r8 e/ J
The Get_DDB service is used to determine whether or not a VxD is installed
, ?+ j& g) s; Q2 P9 gfor the specified device and returns a Device Description Block (in ecx) for' c) y3 R) e/ y) I4 ^& H+ [8 H& c
that device if it is installed.- l+ M9 ]' T! d
& N2 i; Y- N3 p' d* j
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
. R+ D8 @& v; A* o mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)7 j+ L6 p+ T) D. _ p
VMMCall Get_DDB8 |5 F) r. `8 v* h# l: {# y R& M
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
! m+ A6 l% c* U0 T; H B# ^/ f( Y" o; \1 a* E' Z1 I/ y& @6 v3 U
Note as well that you can easily detect this method with SoftICE:
( M! |" o; _3 h0 W. }+ T7 t bpx Get_DDB if ax==0202 || ax==7a5fh
# x/ C w% |. B! ?. \' s, c d. @! k1 U& |2 P
__________________________________________________________________________
- j' \% L: \3 Q/ d
' F) c" b& d7 o. bMethod 10" K8 I: ]& b. f- o) n' C
=========# R6 z0 r* c" N' E. }8 x
! ?! `' }, ]* }+ ^: ]; @=>Disable or clear breakpoints before using this feature. DO NOT trace with9 P8 O5 f( z* o Y" l
SoftICE while the option is enable!!- T" a9 H5 e, A/ V
- l8 j# X) a8 P1 P* p U
This trick is very efficient:
" l4 H) U# K7 `: xby checking the Debug Registers, you can detect if SoftICE is loaded1 c5 i+ q0 K7 j. q) T
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
" Y# @" S5 P4 L4 [! ]! [there are some memory breakpoints set (dr0 to dr3) simply by reading their8 T5 T; g. d$ X! t" U9 R1 h; T
value (in ring0 only). Values can be manipulated and or changed as well
8 s( Y+ O8 E- n1 a; S7 @# a8 a r(clearing BPMs for instance)0 w$ c0 w+ K+ f
4 S2 n8 O- i4 u% n
__________________________________________________________________________. @( P8 b x3 R( u( [7 c8 p& D
0 E; R. @3 x0 |. _0 lMethod 11, S, F( s" m; Q/ C& A0 V7 S
=========
9 z, y1 B! T& _$ x) T: B/ y" a- M; `4 c) ]* U. F; D6 ?
This method is most known as 'MeltICE' because it has been freely distributed+ {* ]! f, y6 Q" I* ~: H# B
via www.winfiles.com. However it was first used by NuMega people to allow D+ i% l+ @+ q$ V! b
Symbol Loader to check if SoftICE was active or not (the code is located
, n1 s9 _9 L6 C binside nmtrans.dll).5 [7 l) H l7 O! P5 o2 p
8 P& f5 W' h+ z; N' e# {8 i
The way it works is very simple:% U% j# n# E7 T& x
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for3 h. y% [" @! i0 A% t" t
WinNT) with the CreateFileA API.
: j& a R7 `7 n7 c0 Q E) I/ k6 K- P4 f- {. b$ M" }
Here is a sample (checking for 'SICE'):# L2 _+ z- T- V$ l8 q' e$ ~
1 V0 u. s# _1 O& J
BOOL IsSoftIce95Loaded()! V6 d! H5 G6 z, q, k
{
# B6 q! q$ \+ Y( T3 |. f HANDLE hFile; ( Q c. H6 N/ X }% t
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
' I& e: n' [/ Y0 i( }7 H, H FILE_SHARE_READ | FILE_SHARE_WRITE,$ b' I7 m$ N; X1 Q6 q% G
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
* b4 o6 [7 k( ~- a if( hFile != INVALID_HANDLE_VALUE )" d6 P3 K* M& Z' O) A5 w# E
{6 m2 X: R4 ?5 C( |8 w- m9 d( [
CloseHandle(hFile);1 b5 o! e6 a2 C$ C" ~+ B) |& }
return TRUE;0 A$ R9 W2 c; j
}
4 C( g- g* p5 x return FALSE;+ ~+ b6 z5 x l; |, f0 y) R
}4 I' x5 w9 _0 ]+ x
/ } ?0 c0 W6 Z( L) B$ PAlthough this trick calls the CreateFileA function, don't even expect to be+ u7 L8 J9 @; s+ F7 X
able to intercept it by installing a IFS hook: it will not work, no way!
* P6 W1 s' c2 k1 E) I( R6 _( PIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
1 z. a( M" y( V/ s' h; A1 F, Yservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
3 [# e! A5 T: ?5 s% ^! \and then browse the DDB list until it find the VxD and its DDB_Control_Proc
! O7 P# N( P- P$ V2 @ I2 Ufield.# I" E. b/ [0 x( v: ?) U7 W
In fact, its purpose is not to load/unload VxDs but only to send a
7 \1 K- w$ ]* i' H- }! X$ \( }W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE). o% J7 }+ d& p7 |
to the VxD Control_Dispatch proc (how the hell a shareware soft could try: o! C+ x; T$ o6 ^7 P
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
& a* A7 L7 l ~! ~" _4 `If the VxD is loaded, it will always clear eax and the Carry flag to allow
/ Z$ \ L& N: ]9 u% S. aits handle to be opened and then, will be detected.
9 R e, ?. v7 u) sYou can check that simply by hooking Winice.exe control proc entry point( j2 @( |9 `# v! L; @5 | I2 v# P+ B; p
while running MeltICE.
3 ~3 e* |1 {2 i5 h+ {. ^ q/ P- C' A1 a
+ ^4 k( {' \; i+ T9 ] 00401067: push 00402025 ; \\.\SICE
# ^) l; y. G$ x# V" d( o8 ^ 0040106C: call CreateFileA
7 F# G1 [! R3 N 00401071: cmp eax,-001
6 [- F" {0 n3 n 00401074: je 004010918 ^% ?# b1 `) z/ k( {' _5 F
4 U4 q3 {9 | S8 x' A9 u+ ?
1 ^' {. N) e( n6 Q4 ^5 x
There could be hundreds of BPX you could use to detect this trick.
5 S: D8 }' B. ]2 n2 b# l' @-The most classical one is:: q5 ~3 z+ w+ ], ~0 ?* L- F
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||, p9 y! G7 s1 K0 L
*(esp->4+4)=='NTIC'
" y6 g9 U \& `% }
" @* ?+ G3 i. a6 I-The most exotic ones (could be very slooooow :-(
$ v1 _" l! `! W5 G BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
# _) v" l% G" p, r. V ;will break 3 times :-(/ a+ N: O" m+ _" B
9 Q( f& f7 B) t' v/ `
-or (a bit) faster:
9 A k( V, o. H7 m" y7 f BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
, B I8 l- h0 f$ W9 N) g1 q* E/ }" c2 {) y
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
0 m' X' \" @) g! c$ Y6 ]& T ;will break 3 times :-(
* _( L2 @- f1 a6 C z/ ?5 M. o0 d, A, }! l6 V Z( R$ f/ X
-Much faster:
' m$ p, U3 |- ^ X3 D BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
) m; Y z/ f& }# I$ ^) R8 T% y, z( O0 R
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
8 \2 C% L/ }( }) \1 Lfunction to do the same job:
! J, A4 a$ b; C9 e: B, H
+ m% x1 N2 L% i7 k1 M: S, T Y push 00 ; OF_READ! f# m0 R! v; `; Q; Q
mov eax,[00656634] ; '\\.\SICE',0
9 K/ [2 W: X) H: L push eax
$ @1 T1 d ^% d% \' ?# u call KERNEL32!_lopen
8 U& K1 [5 g. I0 U0 P0 B1 ] inc eax; f, K3 n- i K. Z: M
jnz 00650589 ; detected# u* C" k/ ^0 J
push 00 ; OF_READ
! W! l) P# ]" ]/ X mov eax,[00656638] ; '\\.\SICE'8 o( v8 |3 c U: T, s9 L3 M
push eax
6 t* w- e9 W* l9 M/ s, z call KERNEL32!_lopen8 s- G: {& s! t: O$ I( J
inc eax3 a$ ^3 d! H% I
jz 006505ae ; not detected4 R& D% P+ Y1 g) U( j; J1 v2 _
- o0 T4 z8 W& z' U3 e3 K
0 _. z1 Z+ d9 J* Z$ J
__________________________________________________________________________
( F5 i" Y4 K% A3 C3 ^0 H* a" v3 b: b2 h+ w. O4 `. `3 J- K
Method 12
. [9 R% B7 h0 g; ?=========4 E' \, E+ o4 y1 k2 g
6 D( k+ H& G$ M) _# e4 M
This trick is similar to int41h/4fh Debugger installation check (code 05
9 F, Z6 x0 ]1 E- J4 x& 06) but very limited because it's only available for Win95/98 (not NT)% E* |7 b( H6 W8 [
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.. C8 x$ k( ~6 p6 t: o# C
( V; |8 c' c5 T1 A2 B+ u5 ], x8 x/ l
push 0000004fh ; function 4fh2 _+ h( i/ W: O0 L) v' I/ W
push 002a002ah ; high word specifies which VxD (VWIN32)# c) W: @& y; @" i4 `6 R/ {5 X
; low word specifies which service
% _% N# n; s1 [5 k1 A (VWIN32_Int41Dispatch)' J% k& [8 f) f; x6 \4 H
call Kernel32!ORD_001 ; VxdCall: R! i' V! a! }. x
cmp ax, 0f386h ; magic number returned by system debuggers8 F" S8 `/ ]4 W6 y7 i4 E% K
jz SoftICE_detected2 _9 @( j" L# [7 j( J7 T
2 _* X( @5 ~# ]: r7 X' a1 H
Here again, several ways to detect it:7 |0 \( n% K+ K
L! Y( P& _# a" @: D
BPINT 41 if ax==4f
, R8 C6 b: ?9 K" V9 H5 q7 u* A( p' F6 {
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
2 [( D. G/ C, V# C1 h8 X7 X. B; c+ \6 l* J) r
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A% i, H5 n: K: s% _; [: E
0 `. E+ n& }+ ^4 m$ g9 W
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!* t. w1 o3 E' b8 U) ]
1 E, t8 [" Z/ W1 ]9 y
__________________________________________________________________________' I* A0 e8 N% Z2 n4 v3 v8 n
8 r: h: \4 I! z$ s
Method 13* Y6 i' L- }8 a8 I9 @6 P2 P0 q0 j- _
=========
5 l! z8 w# M E; A# Z7 J
; [( B( S/ w: w+ GNot a real method of detection, but a good way to know if SoftICE is3 d4 V% V' R9 a1 r. u- f, l! ^
installed on a computer and to locate its installation directory.) b' ~" a p- r( n% A
It is used by few softs which access the following registry keys (usually #2) :
K& R5 B# t) n- l( _" S% v2 m. i( P: C& d% v
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion3 s9 B4 i9 F2 Z( H9 \
\Uninstall\SoftICE
9 U/ r0 K- U9 b1 I-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
v9 M6 Q# g$ R$ u0 p* }/ x! \-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
/ A: \0 m0 @8 R- U\App Paths\Loader32.Exe$ X" q6 \0 }5 h" J
2 y, d% y, @$ h+ U1 ~7 _ X
: U0 A& V$ x! U2 VNote that some nasty apps could then erase all files from SoftICE directory) W; y, s* N( M# J" `2 C
(I faced that once :-(
& ?5 x; f* [$ L) H% p: `4 q) F" ]" e
p# ` W' b; w1 BUseful breakpoint to detect it:
* n4 ?. a% y5 \+ K
# h8 c+ z" T$ H& u BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'7 \ Y: s) Q' I8 V [- d* \
# u: `8 \ D q4 I c k. Q
__________________________________________________________________________
! }$ n" ?, y2 E1 r0 [/ q8 b: @4 o% n
; h. G. |3 B( U) y7 b' w# s! h5 @( p9 IMethod 14 9 ?$ p# l" c% K$ A" Q3 H+ y
=========4 s7 [4 w$ ^5 h# t# r
7 d$ c# i. {. A# H \A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose: c ^4 z! r/ d9 q+ G& @
is to determines whether a debugger is running on your system (ring0 only).2 W5 ?& F, U0 ]: b9 {% Q1 e, j
' o1 {. b+ r. r4 j* q6 R( M
VMMCall Test_Debug_Installed
2 g3 Y$ K7 G8 w je not_installed! h* D% K: @$ T# Z0 C
; L/ l. Q9 F* |6 w
This service just checks a flag.1 f. s: i) m" c# P3 M. g8 j; g4 \
</PRE></TD></TR></TBODY></TABLE> |