<TABLE width=500>
8 ]1 }1 A3 m! @: c m( G/ v<TBODY>9 f! W+ M& O. A
<TR>
! e; g V" x6 f' \9 @0 `# ^+ M3 C3 ^ A# V<TD><PRE>Method 01 - f+ M4 Y( s0 o0 E
=========
6 p- h$ M7 B4 Q9 ~; Y! Q, O& R2 ^! B- P6 n; ^6 g8 _2 s* I
This method of detection of SoftICE (as well as the following one) is; I; M* D6 T D' N
used by the majority of packers/encryptors found on Internet./ y ^/ b! X# m$ T$ A& }. E) ?, }. n/ v
It seeks the signature of BoundsChecker in SoftICE
! Z. i N6 f: m& l; `
3 W- C6 U* P' y' y6 i mov ebp, 04243484Bh ; 'BCHK'
, G+ }7 o, [6 M k" B: E8 p+ ^ mov ax, 04h. {1 i! Y" ^9 Y# U0 Z: ~' H, ]
int 3 % P, X/ _6 v# v( N0 l \
cmp al,4
; m! C8 U) ^6 l5 L8 @% u jnz SoftICE_Detected; V8 q) }, o0 X' v1 m9 i" p& o
" n- e: L, b i' c' k___________________________________________________________________________
' w5 B" v ~/ \1 O8 L; @4 l6 i3 C" ^+ ^: H" h- F
Method 02
2 _- W) i* @. l6 F8 R. F=========
7 `: e& u& Z D4 @" C: I n; Q$ h, e9 v- k" }; B5 J) o
Still a method very much used (perhaps the most frequent one). It is used! {7 e: A0 k- y/ x5 d+ |
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
! T- R' \: P4 N1 ]1 @5 ior execute SoftICE commands...
$ i/ } a4 V8 ^5 ^( lIt is also used to crash SoftICE and to force it to execute any commands- j7 w4 z S: V$ F
(HBOOT...) :-((
4 x- P' Z1 H6 |, B, y2 f: T) A' e2 j2 u6 F& @4 q
Here is a quick description:/ V- J+ t; [6 y. g! q; \
-AX = 0910h (Display string in SIce windows)
' r% Q% o2 ^; q# K, p& B-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
- V* \2 n5 ^! d; z1 a-AX = 0912h (Get breakpoint infos)
5 t: h( I$ e' x0 z-AX = 0913h (Set Sice breakpoints)
! Z9 H& G* R! N# w-AX = 0914h (Remove SIce breakoints)
# W% E) k, O; [. G% y- ?
% q( F" p/ g; U- a! c' o. j! B. HEach time you'll meet this trick, you'll see:. |6 d* S$ c, a2 c4 ~7 J. q
-SI = 4647h
8 u) g3 N/ O7 L( G/ {-DI = 4A4Dh
9 n0 c5 B Z/ F, n- p0 K9 oWhich are the 'magic values' used by SoftIce.8 n5 E) u2 J' n& B
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
6 X4 {/ g2 Q' C5 I5 O' ?# a' a+ T" N
Here is one example from the file "Haspinst.exe" which is the dongle HASP
# Y7 F) M! ^# t' v; tEnvelope utility use to protect DOS applications:
2 B/ v' Q6 S) R* D" N3 ?% t
4 ] s) [9 Q7 C R: P& C) T- ]; p L/ c+ U
4C19:0095 MOV AX,0911 ; execute command.
6 t3 t p' o9 q! l, Y7 K4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).) S% D- S+ X" c1 G
4C19:009A MOV SI,4647 ; 1st magic value., U+ c6 S5 @2 P6 r9 X2 l) }( v/ M
4C19:009D MOV DI,4A4D ; 2nd magic value.
+ y) g1 M" r$ w3 u: f; Z4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
: E$ N8 b3 `$ `# [4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
5 o9 {& }# H9 V) z% P4C19:00A4 INC CX9 [" n* D; ^- {- E5 u
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
* R6 I& F& J6 m4 g& x4C19:00A8 JB 0095 ; 6 different commands.; f( g3 b B- d2 \) @
4C19:00AA JMP 0002 ; Bad_Guy jmp back. ]3 I" X, k) b# a Y- h8 q2 ]# [& o
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
! l4 M% M& f5 x( @! [; o3 O* ^% {# F9 g; l% W! _5 ] V( ~( Y
The program will execute 6 different SIce commands located at ds:dx, which
0 Y4 ]3 M# \$ Q; _2 i5 Mare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
1 T6 \ j1 p; M: h
7 k) {8 _/ N- r) C& ^ `1 E* Q' j* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.2 @" ^' X6 c( l. E+ p% l- v
___________________________________________________________________________9 \7 A ]% ^) J7 y9 k" c( L
+ a/ C% S4 J& p& g8 q4 J: y. g1 E @& O$ S, ?+ Y) d4 b2 [, O
Method 03
" ^$ b5 T6 j0 G, q. @) `1 X! a=========9 V5 L, B* z1 Y: j' F; |& i7 L* K1 T
6 T+ _6 z5 R* f% P3 d; k
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
; _+ Y) T) ?$ W(API Get entry point)
% i f( V) ~# G g& s: u % {$ ]" M* }: S1 ~/ H7 e
1 h* v! b* ?! L1 _ xor di,di
) y3 j+ y: x1 e0 x mov es,di
! {$ W% Z* T8 V m8 [5 } mov ax, 1684h 4 y6 H" W3 L! u
mov bx, 0202h ; VxD ID of winice+ d4 u! v3 P& p/ s# X
int 2Fh
; r2 A M% o. r3 v3 _5 b5 y+ \4 w8 X mov ax, es ; ES:DI -> VxD API entry point6 W/ L9 R2 j! a$ @
add ax, di% z, D& y2 d: s& X& T
test ax,ax& G& D! {* i2 i# ]
jnz SoftICE_Detected
7 `/ s4 U" C# Q; m W5 `4 }3 k1 e! i
___________________________________________________________________________- `; y7 N8 k, N
- u# V3 \6 @ l: ~5 GMethod 04
{7 C S% w( J& v8 y! e2 \=========- W0 O$ v9 }" o* U# i Q: B# m
# T% [6 q9 j) o3 ^) U, ~; D% gMethod identical to the preceding one except that it seeks the ID of SoftICE# @. b5 }) o; Y
GFX VxD.
& o0 Q0 L( K# p3 q, _' e3 H: D, E. ^6 z( l. ~/ m+ c/ R
xor di,di
- b ]6 m# H2 E6 p, n mov es,di8 F$ u4 b3 C2 ]' R5 j8 R7 |
mov ax, 1684h
- ~3 G2 z+ G* E1 ]9 m mov bx, 7a5Fh ; VxD ID of SIWVID4 I) n/ T* ?$ i- a2 ^+ K
int 2fh
9 B- {' @& y% o3 q, s, G" l mov ax, es ; ES:DI -> VxD API entry point
- c( c3 T3 v0 O& w add ax, di9 Q) J6 W, M. d9 S
test ax,ax0 U% \$ k h4 c3 n6 q
jnz SoftICE_Detected9 X. U& Y: r" C; ?. Q% z' ~; x
& I, y' W8 e0 r$ I/ L: N__________________________________________________________________________6 Q3 w9 g- d. a) Q2 h0 w- c
$ c1 l! \6 F3 p2 k4 i3 J
' `) f" P% o. T$ O! XMethod 053 v1 l) z! T Z9 z! K, t
=========
4 @8 d: z3 v- E3 f$ \
4 y# F' b9 d6 DMethod seeking the 'magic number' 0F386h returned (in ax) by all system
8 f/ k! z* v7 G$ Udebugger. It calls the int 41h, function 4Fh.& j2 j; c K1 t+ G- @( _0 j6 N
There are several alternatives.
5 I& |8 u0 P8 a# N: m4 w
3 x" I1 M& P, t8 f; t* R* }. E* }; ~8 tThe following one is the simplest:' d* [5 D* X& X5 | k
: t0 T V6 w: F- g" v i mov ax,4fh/ r4 J! ] B" P( o
int 41h3 u- q# ^) @$ B: h c' D' S
cmp ax, 0F386- `8 A/ p5 _! j+ J0 V9 {
jz SoftICE_detected1 O9 o( L$ R/ _+ H
+ x0 u8 F+ v- J, j% j# l( Y; l1 o/ l) ^$ Y+ D2 k: Y: j
Next method as well as the following one are 2 examples from Stone's
' j6 S: a: _- W5 U2 Z" ^"stn-wid.zip" (www.cracking.net):1 _0 B7 W) [& G* t- c
7 I1 I- B- Q9 e: ~1 J mov bx, cs3 F; b4 S8 S9 x1 c
lea dx, int41handler29 R, o; G2 O8 u& \1 {
xchg dx, es:[41h*4]
5 H" A3 a1 }: w3 a; d8 A3 p/ A0 K xchg bx, es:[41h*4+2]- t9 |! Z) K `7 [% g$ u3 A
mov ax,4fh
; n1 V, r; U0 V8 }! [# D1 i int 41h
8 E: |* r( E1 C xchg dx, es:[41h*4]# ^* c. i, D' C2 W$ `# o
xchg bx, es:[41h*4+2]2 Q6 ^3 B' W4 `; v
cmp ax, 0f386h
8 L Q. u, s" p; m7 l jz SoftICE_detected
6 _) d1 I+ n; R: `6 p( @
9 a' }- }+ k& Gint41handler2 PROC
2 ~; R( ~7 E% q8 t7 v8 W iret7 z9 T F4 f' x" \
int41handler2 ENDP% F1 `3 v) I- B. {& z: R9 e
# E1 y2 H% G/ O3 C1 g3 }7 ?; G" U- a" q2 d8 e7 z% L
_________________________________________________________________________
3 A. Z/ E5 Q6 e8 f O/ ~
9 B- [7 v) m0 B# \
l* u; Q; ~$ b9 x+ _" h. bMethod 06
: }! @3 l1 j! T, B2 k=========
# R/ s" k$ d# @: V6 F& B' `# f2 q0 g7 F h9 b1 w$ V8 S
) h/ p- l- e1 z9 b) N
2nd method similar to the preceding one but more difficult to detect:4 N# S1 u. Y4 t. @0 t
! N! b. m5 M4 A% `- y: }" ]2 }
; `7 q0 l0 K! I' u: B" Y
int41handler PROC: [) h4 h+ F% ?* v. n* `8 \
mov cl,al
1 r! K# v: G i$ \5 o iret4 S, w; E. E# d% h3 ?
int41handler ENDP% E& [5 H. [) ^4 J% v
/ p, G- @4 q! l7 ?4 p
, \0 Y$ k8 ?+ j# |, i4 g
xor ax,ax2 Q7 @ }2 A+ ]; ^ `% t5 q9 T7 Q
mov es,ax
1 D7 w2 }8 F8 v& U: n mov bx, cs
" h1 e5 s* G. {$ Q$ g lea dx, int41handler
) S: [6 H5 e- Y xchg dx, es:[41h*4]% t7 p( k+ Q1 Y
xchg bx, es:[41h*4+2]
' x e4 u3 n' t3 M0 Q1 a, {5 a in al, 40h
8 K( S2 N" _2 ~ xor cx,cx
3 d$ N7 S3 q9 p int 41h
6 ^# Z) ]" k( c! _6 N$ I2 ^ xchg dx, es:[41h*4]
7 R! F" I. y8 y$ U. S xchg bx, es:[41h*4+2]' m6 P; j+ S1 ]: [* o2 t) Y
cmp cl,al
$ R: n+ ~/ n" i* s; } jnz SoftICE_detected, f9 A. U3 ]$ V) Y- j- ^: u
- V. t8 I, [# S) c. h
_________________________________________________________________________
$ ^, J- W; L; N5 Z7 Z7 k+ x' w1 j9 s
Method 07& L s2 U$ I/ B3 {4 k! b
=========
& [) @7 `9 Q% y% y" Q; q
7 y9 I) {" g0 d8 fMethod of detection of the WinICE handler in the int68h (V86)8 ^( p2 q5 W) _/ }
/ D0 _4 I. F. z3 n
mov ah,43h; {# J3 k3 r% q& V6 N, G
int 68h$ d! R0 c2 e+ N, \* |( v6 P
cmp ax,0F386h
- q# M- {0 E! R* z) o! [; a jz SoftICE_Detected+ G' T* V9 R- I
' Q1 R4 {; t( u0 h! a y3 u' J
4 l5 z. K7 A( G) U/ k=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit9 W( r! T0 O% Y* a- L' l
app like this:
: @3 x) `( h e4 i; {/ D/ |' P: H6 u! b v5 l n( Z! C6 N
BPX exec_int if ax==68
- R" N ~0 A {9 Z9 W3 b ~ (function called is located at byte ptr [ebp+1Dh] and client eip is
5 Y& F% M0 W' z+ ~' { located at [ebp+48h] for 32Bit apps); t# t$ ^# U& C9 u
__________________________________________________________________________* P$ E" @6 W6 V$ t! c( o, k9 u5 x
# a* R0 V! Y% `/ N" ?, L
: L* w6 s, i, X1 a+ YMethod 08
/ y0 q S4 m! H2 D+ W# n=========
; ~3 B1 F& w4 A) |" T
+ S) t1 a5 U) N AIt is not a method of detection of SoftICE but a possibility to crash the3 i; q) q {8 ~5 n) } g; i/ T
system by intercepting int 01h and int 03h and redirecting them to another! ]/ r$ p( {+ s3 K+ i
routine.( Y/ N! p5 Y$ a$ l* A: o4 [
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
$ Q1 b+ _4 U3 K( Vto the new routine to execute (hangs computer...)# I- `1 }5 K% t: i
* J# p$ M& H4 K+ I mov ah, 25h. l' u3 R: E' O5 N, k( z! @
mov al, Int_Number (01h or 03h)
5 b+ h5 q2 v8 o+ z mov dx, offset New_Int_Routine
% P$ x$ |5 |6 J; ^; w4 f3 J int 21h# u% ]% \ K6 H; E1 ?& s6 P
" `% X, @, S3 ~8 w; v1 h__________________________________________________________________________
7 @; I# N; l+ M4 M. A- I- f4 B8 |' g- c& \ C, `/ i$ ]9 |
Method 09% \% G: W4 U! ~1 x$ r
=========
) P' B5 z. d' [! K* z) ^
9 _1 B4 C# g5 HThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
8 J$ Z: t# F# g0 V$ v; f) e1 gperformed in ring0 (VxD or a ring3 app using the VxdCall).; K. L! }% R) [5 ^
The Get_DDB service is used to determine whether or not a VxD is installed, \; ]1 H3 p3 r& k- O
for the specified device and returns a Device Description Block (in ecx) for
9 S/ [! M$ L/ ^' b% Rthat device if it is installed.
' ?7 X' t7 ^: `" m' ?! Y
: H* F$ [7 \. G mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
$ d6 B7 @" {2 T1 X mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
: |3 }3 Z* t$ D& R1 e! S# { VMMCall Get_DDB
$ W% G' ?1 f4 w mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
# ]+ h& L( e/ ?( g" o& [
* @0 y7 P* R' L) ZNote as well that you can easily detect this method with SoftICE:9 ~( q; l. S) {! ?% Z! ]! N
bpx Get_DDB if ax==0202 || ax==7a5fh
& ]( B: u" I) G/ v% \+ B; w5 N. L# a$ U& B* p$ o
__________________________________________________________________________& i. m* J% p4 {" X7 ~( V' y
. j( P% l; l5 W' B& r% ]; d) f
Method 10: P2 h5 _# H0 s7 n3 n1 _
=========- t8 X; ^9 y) y4 i1 N8 Z
$ B- b9 t C3 e- i O3 r$ L
=>Disable or clear breakpoints before using this feature. DO NOT trace with
( E/ R# @4 a, \% U* x4 y SoftICE while the option is enable!!# G5 W, R3 t5 x; V4 r5 J
! A W9 G/ n; q, F& o
This trick is very efficient:
( y5 M. f& l2 |0 |by checking the Debug Registers, you can detect if SoftICE is loaded" R/ X$ A7 b& S" o; f
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
( c& C8 w: J2 \, T, I7 x+ w, mthere are some memory breakpoints set (dr0 to dr3) simply by reading their0 w/ R9 o- b i* m r
value (in ring0 only). Values can be manipulated and or changed as well
+ ^$ R* z5 s W) E" T9 S( ~; j(clearing BPMs for instance)9 f4 I1 h, f- r8 y& L
1 ^+ d0 T. b8 d
__________________________________________________________________________6 x2 n9 ^( h$ |/ H" m. O
8 w( M9 U! x3 ]5 A- E# Y
Method 11
* ]% p# E1 |5 X" G8 x% O5 K=========7 N* o: ]( z1 w4 B& n0 h4 B8 ^
8 Q' R8 e7 b" i1 L4 O8 l
This method is most known as 'MeltICE' because it has been freely distributed$ W5 y _+ O( p5 q8 I8 B+ B# Z
via www.winfiles.com. However it was first used by NuMega people to allow
4 }: T5 t: g6 t8 Y' zSymbol Loader to check if SoftICE was active or not (the code is located
& H5 f( }3 Y, a0 qinside nmtrans.dll).6 l7 Z% L2 A( A) [& Q9 p3 J8 }
' b1 C3 I" X5 IThe way it works is very simple:( d1 a4 ?4 a( H: X
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
' ?. X3 _1 V5 X3 k5 K j7 H8 vWinNT) with the CreateFileA API.
1 O; m1 Z: {4 h* G" K) N! {4 M; {4 B8 {1 r7 v
Here is a sample (checking for 'SICE'):
c( O) F) F& g; E. t! B* e. ]9 M9 D' p
BOOL IsSoftIce95Loaded()! T- B0 y! x9 s, y2 l
{
% |5 x1 n! H' S; K, q HANDLE hFile; 0 P; f! J4 `0 m. b8 v5 \5 R c
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,+ N) z0 Q0 s1 f3 l2 c/ P
FILE_SHARE_READ | FILE_SHARE_WRITE,
8 |# R3 z- t1 C" b NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);, h3 E H0 g/ {! U) ]
if( hFile != INVALID_HANDLE_VALUE )
/ I0 p. P: i- t {$ z3 \- u x* e6 z
CloseHandle(hFile);- Y" A: N7 a; N1 R5 i, z
return TRUE;6 V1 p f+ M9 I4 j! L* X) i
}% E2 f) { }2 \) Y
return FALSE;* L$ v; t( D8 Y/ b
}
) ~! L7 w0 g3 v1 `5 V
7 v9 g! E# B* V" k7 S( ZAlthough this trick calls the CreateFileA function, don't even expect to be
1 X8 C! g0 e6 Bable to intercept it by installing a IFS hook: it will not work, no way! B! u/ h, m4 W2 z- g) T* Y: y
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
( K/ N+ ~) m5 W/ Wservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)* Z+ R* m) B/ E* r9 Q, i
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
4 i3 f& d$ A5 ^$ H7 Dfield.
+ n. r2 w7 [: x7 {0 V- Q. W! XIn fact, its purpose is not to load/unload VxDs but only to send a ' ?" f0 A) d( S, z
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
3 @: V/ N |$ Oto the VxD Control_Dispatch proc (how the hell a shareware soft could try8 h n q' \6 Z0 B! O
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
1 j( U; C, e! x- ZIf the VxD is loaded, it will always clear eax and the Carry flag to allow
% M. O9 w; ^$ j0 v7 c9 r4 B7 F6 Aits handle to be opened and then, will be detected.
# P2 U# p0 A4 n- iYou can check that simply by hooking Winice.exe control proc entry point0 K5 S. R, F7 z4 _' M: O/ I8 b& D
while running MeltICE.
1 T$ \( x B* _" T2 B# f% L8 X$ E x
J" B; g# R" d- n/ O
$ ~4 z" \1 q# R2 u+ J 00401067: push 00402025 ; \\.\SICE; S F. l, e2 q" d
0040106C: call CreateFileA
' D6 k( G# e6 ?& e1 F 00401071: cmp eax,-0016 Z; `; i. s1 f6 L" t# {
00401074: je 00401091; U q) ?2 r) t# r: I% g- p
& t; G' h$ P9 t. @9 T
' U* @$ \ h# R& r$ z4 EThere could be hundreds of BPX you could use to detect this trick.! x: Y2 e, W1 K5 g- m' G8 ?
-The most classical one is:
# G) X* C: P& @% h! n; T BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||* ~. `# X* g) J6 N) @6 j% r7 y1 w% e$ J* {
*(esp->4+4)=='NTIC'" t! K6 Z3 w$ v4 a, r
- p- w, N+ p% w3 D1 W
-The most exotic ones (could be very slooooow :-(5 [/ k9 }4 j, b& _& P9 ^) j( u
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') ; s+ s* c" c6 o1 g- g9 e5 M6 h
;will break 3 times :-(/ l$ P( O/ Q6 I$ h
6 R! I2 F1 C$ y7 P& l' x8 \+ |
-or (a bit) faster:
# ^( F! F% ?+ T+ [1 Y BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
. p6 y# |4 a6 A1 P) `9 e# Q: ?3 J, N1 C1 E3 i, B+ q. w
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
) _" b t D5 J. y0 i; ? d ;will break 3 times :-(
- h8 H2 F( O& a% V/ I3 J2 ?0 `( y) [0 d' e! a# _
-Much faster:
0 u" F( L$ i8 s6 F2 }$ f" H6 ?( m BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV' g2 Q5 w: L7 Z
7 W* [( C d/ k e; \Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
5 Z( c2 i1 H( G; jfunction to do the same job:. k" i8 ^; p1 M$ O0 n' P5 s
7 G7 G4 k) L$ @6 E push 00 ; OF_READ
: l5 B [( o: u$ c mov eax,[00656634] ; '\\.\SICE',0
1 ^, ]% B5 `" W push eax; g/ H* A- G( O" _1 x" J0 A
call KERNEL32!_lopen6 l, z" N, F( ?! {
inc eax
7 y" e3 T" S3 B/ b# W4 P jnz 00650589 ; detected C% T2 P$ u0 f
push 00 ; OF_READ
. C" V) m. x1 N- k8 P- w+ o+ V mov eax,[00656638] ; '\\.\SICE'
0 V# I* G) l" k; z5 x r/ }% R push eax! [' i; X, p5 _3 \5 r2 o
call KERNEL32!_lopen- \2 p# Z$ ~! f( E. s9 M- s6 t
inc eax
) L. W2 w7 M2 Q jz 006505ae ; not detected
. B- a: Q6 o0 X& f e' e& o$ A ~% k
* S, p- u2 T) \$ A0 t( }
3 b1 ^( i: Z. g: W" j' b! Z! e/ u. J# Z__________________________________________________________________________. D2 z+ \3 v/ ?1 u6 Z+ l
/ s3 T3 J9 ^6 x2 W `
Method 12% M9 `) ]9 U9 @
=========1 S' \+ G7 C5 o$ u' J3 Z( @
5 ]! w& w) W- C0 @7 u. H8 NThis trick is similar to int41h/4fh Debugger installation check (code 059 N$ L, f1 T0 v% c+ G; N
& 06) but very limited because it's only available for Win95/98 (not NT)
0 u; G' p/ G1 D; x, D3 \as it uses the VxDCall backdoor. This detection was found in Bleem Demo.0 A) g8 z/ D1 O: C8 i
+ C) `6 Z4 v) M3 `/ w+ B8 ^
push 0000004fh ; function 4fh
! r* | }2 x9 v! E push 002a002ah ; high word specifies which VxD (VWIN32)7 u5 b6 g( u0 ~
; low word specifies which service8 V2 A/ ?- `" M o+ ~, V
(VWIN32_Int41Dispatch)
+ I" |2 M, c0 V8 ]. e) A2 {# ^' P' x G call Kernel32!ORD_001 ; VxdCall/ |2 X5 q4 g3 I* k$ `: I3 A
cmp ax, 0f386h ; magic number returned by system debuggers! f; x- k$ s7 E+ O5 h4 s
jz SoftICE_detected
2 ~' n/ [' i. O$ j) t6 e! [ A0 G- s+ y' G% {7 Y& X; p
Here again, several ways to detect it:5 @' l3 w5 q9 F
! R* y- E, r* X4 y' p( G0 D BPINT 41 if ax==4f2 A3 d3 b; i4 M4 I$ \
}( r2 w0 k9 T( q( @2 x% J( N0 t
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one0 n" H$ O7 l/ ? }# z/ _
, R, [( T$ U- {, t" q; V2 u$ S BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A" `, I/ w' {# |0 ^: p
% ?8 ], m8 K) c g BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
; w$ C0 r. {4 ]6 c1 e" V: q2 U4 t! I' |8 g' }2 J: l/ ]
__________________________________________________________________________
# o; P% k" Q4 M$ }2 D3 b) m z2 j7 P
Method 13
9 Y& ]# _. d% t' I" g=========
0 q3 \& I& ]5 j$ ]3 @8 Z, Y7 j6 z0 O1 I
Not a real method of detection, but a good way to know if SoftICE is" M# v$ A1 Y/ s$ v4 s; q! p* k
installed on a computer and to locate its installation directory.
1 D7 y$ d; D( m0 ]- \3 x4 z( u. CIt is used by few softs which access the following registry keys (usually #2) :
2 Y* `$ X9 ~6 L
, t- c5 n) r$ i+ E-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
9 @8 U. ?6 I! M5 ]* Y\Uninstall\SoftICE
- S8 o" ~' G2 F, O4 M1 w) Z( s! W-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE9 h" j* i- O- _! r6 V: Y3 S
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion/ Q9 Z' X6 Y* D
\App Paths\Loader32.Exe$ R- \7 M. |' n: i% |; _7 l
; O* Z. [* q# G+ Z# i$ b# j0 I6 y) W; r1 {% h/ \
Note that some nasty apps could then erase all files from SoftICE directory( \# x) u) L9 b+ w7 p) X8 U
(I faced that once :-($ R4 y# H7 E! K/ p* E1 j# B
5 L0 U8 o5 Y) Q/ d
Useful breakpoint to detect it:
& L0 c6 e r3 ~2 X: R) X6 z1 c: ?( R+ e% c; n ?
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
& E2 M; ?! N1 [4 L5 n4 S# V+ G7 X
' H' C7 t1 T" k+ P__________________________________________________________________________- z0 U6 d% y, {6 Y# y7 ?
# R( v) N m6 ~8 |, b0 {, b/ b4 d( {& k% c' Q) e/ M
Method 14
; D9 }8 ~) r& g, B2 P- f=========) x1 J6 X) `, A9 ^4 k2 k
/ T9 E: U1 i$ m6 o7 E$ ^
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
1 Z8 B |$ Q! I$ Qis to determines whether a debugger is running on your system (ring0 only).* L7 S8 g# N! \* d! K; b
" M/ r% m2 C U$ W: N5 p& M VMMCall Test_Debug_Installed
' ^! ?( G+ Y6 e# C% Z je not_installed
- G8 O0 F# H4 Y. u
* f4 t5 r7 p& Q) t k3 @& AThis service just checks a flag.1 e! s, [* J, q7 H& m0 x2 A
</PRE></TD></TR></TBODY></TABLE> |