<TABLE width=500>
a1 u' v! n o$ n6 ?/ |+ x<TBODY>$ n% ]9 `) [' B* e- C8 U& Q. Z1 @
<TR>( E) K# Z5 U3 n
<TD><PRE>Method 01 3 n, a9 M7 }, K4 B& B
=========2 e- x1 ^7 R- Z8 e b7 Z2 d: W2 j
" S' p: h# g' j' Q+ l# G, p9 g8 iThis method of detection of SoftICE (as well as the following one) is
2 B+ U8 F. e: b# w) s1 w5 P% mused by the majority of packers/encryptors found on Internet.4 Y s4 A) |7 E! L
It seeks the signature of BoundsChecker in SoftICE
% A6 M- @" W T9 Q! E6 [9 n: x3 o! t& ]$ X
mov ebp, 04243484Bh ; 'BCHK'
; _1 i! i# e: D5 X7 h mov ax, 04h
) x- G% h: S+ U* ^$ Y int 3 , ~- R/ k5 [* Q# M' F
cmp al,4
" f: U: N9 E$ M4 [1 X jnz SoftICE_Detected$ s+ X: E8 G. o( ]0 ?( M$ j
* O" \% z6 n) L: c K___________________________________________________________________________
1 l5 q6 n% u2 l& P Y
) q8 S; S6 L6 J% i$ o2 |& A+ TMethod 02
4 |' f6 c+ P$ h" A=========4 s( \+ r, [& |/ B2 A5 t V6 m
" Q( O% `- ^; B) ^* D% c
Still a method very much used (perhaps the most frequent one). It is used
6 ]3 X. w9 u0 X9 `2 `& q, I- ^to get SoftICE 'Back Door commands' which gives infos on Breakpoints,& A; k, u6 L, D* H. U% t- J
or execute SoftICE commands...
5 q0 e% b! [( m; GIt is also used to crash SoftICE and to force it to execute any commands7 N' p% b3 D% ]0 G/ t' D
(HBOOT...) :-((
+ V/ H2 L+ w0 T6 b; |! D/ k5 \" @# Z8 f3 u& r
Here is a quick description:0 \9 C8 W( v$ t$ P5 I0 g* b* d
-AX = 0910h (Display string in SIce windows)
" I. z: m7 U( Z. n, F-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
2 z! a7 Q& y+ n& p" k-AX = 0912h (Get breakpoint infos)
4 f9 x( g" `* v+ f-AX = 0913h (Set Sice breakpoints)# {5 i- z1 s6 N
-AX = 0914h (Remove SIce breakoints)
7 {9 Y9 g6 ?+ w: ^4 i3 i8 r1 b; b B9 V( O$ Y' [7 h
Each time you'll meet this trick, you'll see:
9 G5 W6 p) |4 U; n1 O; u% V-SI = 4647h. ?) y) \; m2 O' h0 g8 L7 l2 s7 p
-DI = 4A4Dh+ W1 T j# G5 F7 |$ v! P# Q
Which are the 'magic values' used by SoftIce.* P4 x3 Q$ ?! ~& }$ P4 C% G
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.4 k7 s6 J( E% H2 c' e
2 @( E) w @+ D4 {. [/ a, D
Here is one example from the file "Haspinst.exe" which is the dongle HASP
% N: d/ v- }3 j9 z7 `3 j2 z2 SEnvelope utility use to protect DOS applications:/ i8 @) M' ?9 I& `9 A1 G6 e7 l
8 C9 A: c) Q8 ~" y+ t6 ~- x
- n" m/ P) \ U" ?' [4C19:0095 MOV AX,0911 ; execute command.1 B: P# \: _, ]
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
( ^( B) }& m: N e$ L4C19:009A MOV SI,4647 ; 1st magic value.2 j/ ?) x9 }1 Y: t, e5 I) s* Y3 ^4 I
4C19:009D MOV DI,4A4D ; 2nd magic value.. W% e" f8 t* ]
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
3 \& L8 f6 f7 X, R0 z4 Y3 W* G4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute% G6 ^1 c' e! u: d
4C19:00A4 INC CX
; R; c6 Y9 h2 v4 j/ B" g. Q4C19:00A5 CMP CX,06 ; Repeat 6 times to execute' k3 q) P' ^: s: C8 g8 \2 n! {9 J$ X
4C19:00A8 JB 0095 ; 6 different commands.; y+ J2 T$ r, X [ W
4C19:00AA JMP 0002 ; Bad_Guy jmp back.
; I& {' |$ a3 x1 V: ?5 ?! d2 ]1 r5 M4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
2 W8 F4 H- {1 x' }3 o0 m0 M5 V1 Z4 k0 }" ^
The program will execute 6 different SIce commands located at ds:dx, which
1 H; ^1 U- n: \6 N/ O2 Oare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
1 ~3 x0 K+ {7 ^$ g
# ]. y ]: U$ ]& y; K! c/ Y* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
) A/ G8 V7 d3 k3 Q' {+ B8 k: T# P___________________________________________________________________________
+ X9 h O2 j8 V( @* Q5 v' o, Q3 r" P" {7 }
( Z7 G( J, [# s0 {/ y- HMethod 03
# M/ d! ^5 _7 X: k% ^6 z=========: _8 w2 A$ x8 c# i4 d0 v) ?
& u8 Z5 \+ K& a
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
4 D4 @; ]- B3 i# b9 E(API Get entry point) V! t& h6 Q" T( [$ O. e2 A( g
8 f# y' w8 j+ d! }2 S5 f' [/ O% f {: ` G$ L1 s1 I
xor di,di
7 k8 q. Q( [7 Y) w: ` mov es,di
+ @5 w! |$ y, f mov ax, 1684h 4 k4 B' d( K! U! V' h' P. m9 d: }
mov bx, 0202h ; VxD ID of winice
& ^0 W3 a* o* U. g int 2Fh
v# a5 B% Y1 }+ m1 x0 p mov ax, es ; ES:DI -> VxD API entry point. a) j5 t5 O' o& U4 m( B# I
add ax, di
! O8 N4 ?0 w/ R( G$ i test ax,ax
, ~0 L( ~7 \3 F3 ^& q1 n jnz SoftICE_Detected
, ?, y5 P3 U& C- n2 r, z
2 g$ t0 o: c4 ? \3 j2 E___________________________________________________________________________8 T! e# p5 l4 o. b
# T& n% a7 y$ A3 eMethod 04; z8 K* V5 L$ ?* ?( |# i# N8 S
=========) t6 E, [( V5 x
9 d; E1 [. B: [0 e3 ?
Method identical to the preceding one except that it seeks the ID of SoftICE
! V7 ?; g+ r- S O' z( CGFX VxD.
, W: n3 N& |9 z, ?$ X s5 \, z# N& u# ]5 ]+ s0 G$ ^6 v
xor di,di+ q8 b H- [: `( H5 |
mov es,di
Z' W, N3 [" a" |" K' K" l mov ax, 1684h
# w' b0 [( x+ o! k7 ~$ E mov bx, 7a5Fh ; VxD ID of SIWVID- w1 b# y1 c, j5 I( ^) B% d$ Z
int 2fh. u' ^6 z4 E; U8 s$ E0 u) _% N& }; `
mov ax, es ; ES:DI -> VxD API entry point
8 }* A- Z0 T- `3 u- N$ y add ax, di
@ p; X+ R3 { test ax,ax
) w6 [4 l3 {. N8 W5 z, F jnz SoftICE_Detected
0 c2 [2 s) K* l, `/ O6 ^
; I1 C H0 n4 E/ L5 z1 H__________________________________________________________________________
9 E+ m2 K ]9 v$ p. [% [2 T
. a/ ~2 f. ~) K/ ]/ a: S' X
. l; j8 X2 a* X, b/ vMethod 05
8 h! t% \! X. ]4 d0 m R=========
0 a H: l( f: Y! b) Y8 g5 r6 A+ c% p ~/ G: G z* A4 w& e
Method seeking the 'magic number' 0F386h returned (in ax) by all system6 S' {1 Z' ?. W7 F" ?7 u& t
debugger. It calls the int 41h, function 4Fh.! S3 G! @) O" J* `& ~8 ]
There are several alternatives. * V% K; t; ?. l# Z. G6 a9 e
/ l4 X* ?, p. m! r5 F$ X2 d
The following one is the simplest:0 | h+ D: u7 k0 M; B3 j
# |# c* X$ R1 \4 E8 T8 a3 h* w+ T
mov ax,4fh
+ D, W$ i0 p3 x& `' ` int 41h' ?0 h: g4 A# L
cmp ax, 0F386/ O I1 @9 t( S7 @( `, L6 K8 f8 J
jz SoftICE_detected
5 `7 I. |0 A7 T
- \; t* I: |2 Z4 a
# j1 b! ^) x0 _Next method as well as the following one are 2 examples from Stone's
! v+ e& ?* a0 I I0 v"stn-wid.zip" (www.cracking.net):& a0 L+ W5 i. M" C, W' t0 D: T
, k/ Y& W6 Y' b- V mov bx, cs. b* L$ j2 Y* A: f& T( e% t
lea dx, int41handler2
5 L/ a; A; v) o3 a7 R/ B- v! `6 A xchg dx, es:[41h*4]
4 X' @" b3 F3 w4 g! f5 {$ Y) m xchg bx, es:[41h*4+2]
' `0 P( N) K8 e mov ax,4fh' r* U, \3 t+ X _
int 41h
' b$ y- K) s$ `, @ xchg dx, es:[41h*4]3 Z& f2 ?- U9 U8 G9 `( j0 Q
xchg bx, es:[41h*4+2]
% n" M* e: M n8 } cmp ax, 0f386h- ]3 ?6 x, `( @* v: {4 s# m
jz SoftICE_detected+ d4 p8 S# U% ^: q" V% [
0 {; @1 P, P; v2 x
int41handler2 PROC
1 q% f0 a/ M# }3 m9 h) ? iret2 z7 c! U$ n7 x
int41handler2 ENDP. Q# C# }# X6 w6 h9 m
: Z$ d' \4 A: t0 Y) q0 j
9 V( o) h% s% I; D0 R# W_________________________________________________________________________' w2 q5 ?+ O- P# o, B2 C9 J
9 t% _8 |5 K0 G" x% h' M2 @
: o6 f% e/ g' ^+ C- }, RMethod 06- P3 k" y: B# Y0 R s
=========: U9 |1 x$ {' @+ I/ G6 @) M- P
! h1 m8 r$ x0 b$ ~( e* l# J" S
9 m: E1 a+ R; a: p, F2nd method similar to the preceding one but more difficult to detect:
- F) g0 L; B1 O* |: Q' p' D% f" `8 X2 |" c* ^0 f. o3 O5 k: u
# L, n* a- Q5 B% v+ g4 E, w/ N
int41handler PROC$ y, ?: a# W. c3 Z7 Y
mov cl,al
0 k; H% M% ~8 U6 Y. u+ ~ s iret
& A+ R, x+ _7 Y) Rint41handler ENDP2 P5 S, b* E" w1 B
) m& k4 g' D R% |7 ?2 L& {5 t4 {
+ k/ }& _6 _9 }$ R9 _$ I, @3 ~ xor ax,ax
& K8 M0 L5 R7 x5 F* w6 _# T: c7 X mov es,ax: ^- g9 h2 L9 ?6 x1 ]
mov bx, cs1 X" W& L7 C5 f$ F1 ^* q
lea dx, int41handler
5 ~5 f5 N; E* E! y xchg dx, es:[41h*4]$ _6 S; X8 S! @" M1 u- U! }
xchg bx, es:[41h*4+2]
/ _5 \1 Z5 ]) i3 K$ Z+ L1 ^ in al, 40h
4 r7 ^8 R8 R" J/ g3 ?# E7 R xor cx,cx- ?1 W0 e2 r3 G8 l! c
int 41h
0 |- w9 X O q1 u9 l xchg dx, es:[41h*4]
1 ?5 Y$ ?" A$ @1 l xchg bx, es:[41h*4+2]& K+ b0 `. D' e. Z/ C& I" ]
cmp cl,al
# o! m/ w6 D) p9 |! X3 i jnz SoftICE_detected
4 S( N8 e" q% j/ _' \* w
! ` I" S$ E0 {0 T_________________________________________________________________________
+ a, h4 E3 t5 O* X$ A2 w u; K3 b0 G/ u0 A
Method 07
7 I/ V; _. v0 j1 P' ?* W=========# i5 i" b, k! n, B3 Y
' F4 m& k7 _. S8 c3 w! cMethod of detection of the WinICE handler in the int68h (V86)! c+ C) F6 K3 W3 w+ h! ^1 T. ]
5 M. o L, w4 ], I, u
mov ah,43h
& W; p3 L6 K3 W2 M int 68h: q3 c! K7 ?1 H* ~7 r- k5 l
cmp ax,0F386h5 s$ L. ?+ ?# G) [
jz SoftICE_Detected
% F7 C0 ~. v! C9 J) [+ L# s4 K+ g0 A3 Y. W4 v; p8 w
6 O' D9 Z) u" E c; u" _/ i$ ]3 S
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
- ]4 V0 H: U9 o0 Y" X app like this:
6 h3 V( L5 t$ F- \/ G7 Z1 }, ?% K5 ? G
BPX exec_int if ax==68# y L0 s. m1 g0 j
(function called is located at byte ptr [ebp+1Dh] and client eip is
- r) o D. N4 H: g4 F+ y located at [ebp+48h] for 32Bit apps). [8 c) d" L% O2 s0 K
__________________________________________________________________________3 g5 ]! Z5 o2 m5 ~. u& N. s6 e
/ m0 L% t( p+ h9 S
! O7 G0 J8 G* T C D0 }9 W0 I
Method 08
9 @% T/ J" w3 K' k/ |) B=========
! C6 d/ L9 z& v; u2 B3 C, j- g3 E
It is not a method of detection of SoftICE but a possibility to crash the" v; `* Q" X7 F+ e* n; H# V
system by intercepting int 01h and int 03h and redirecting them to another( s5 V2 `2 ]" w/ G$ o% d0 x
routine.! r- C( c/ i% c1 P5 [7 l+ k
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
1 `8 [# g2 E5 e+ A# v- ?* Hto the new routine to execute (hangs computer...)
1 W1 w% }! t+ s/ @4 w6 A
" H' Z7 m2 h5 l) j+ T3 k7 r( o mov ah, 25h
8 Z5 c3 Q9 ` S& x: Q) s mov al, Int_Number (01h or 03h)
1 c# B8 r; S8 f. J& c mov dx, offset New_Int_Routine
1 m8 i0 |" t" @; f$ S# V a( j int 21h3 _& G' f$ i$ T1 a) ]
5 T# K! n5 ?% z$ M1 \
__________________________________________________________________________
- i i- t" ]( G9 ^
: E( a3 K+ c6 v3 M+ Y6 ?$ UMethod 091 }9 X& U% b. ]. \; C
=========! |0 @" @& K: A3 s
8 w7 y* P5 u) I4 A: M8 NThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
/ o& o& v+ U3 A5 Y, W7 [performed in ring0 (VxD or a ring3 app using the VxdCall).
, p& | A" r/ Q: {1 `' U% PThe Get_DDB service is used to determine whether or not a VxD is installed% s/ [) d9 Q& A3 b/ i) n# }) T% k
for the specified device and returns a Device Description Block (in ecx) for
5 t E( p* E4 Y) ]. W2 ]' E9 sthat device if it is installed.
3 O& p% {: e _# s( r% Z2 k4 u& [3 V, K- [+ R& V [
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
7 M* Q! f# C- }# i( \1 c mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
* v2 j$ B& [/ R) ]# A! I VMMCall Get_DDB
# C0 ^! C" ^) M Z! s6 @ mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed7 y+ S/ O$ @0 ?9 o. f e
# V1 l- F: B2 y: L7 C9 w4 ?Note as well that you can easily detect this method with SoftICE:
4 x8 g7 e; i4 |& z bpx Get_DDB if ax==0202 || ax==7a5fh" A9 ?1 [9 E$ J
, U# V: O" C( Y: ?. J# V O
__________________________________________________________________________
5 }6 C; K; N, R2 A+ N/ o0 }5 y8 {4 S$ O+ J: W2 R! c
Method 10- z2 g) R) e( B( L, {
=========2 a+ T" T8 P7 M# E A" P
) \3 |: M, `9 o- Y: |0 K
=>Disable or clear breakpoints before using this feature. DO NOT trace with
) R- m: P- n0 j SoftICE while the option is enable!!
$ Q, n) T" N* \! c0 k, D+ F5 |4 w# Q3 Q, B- H5 ~2 F$ n7 D
This trick is very efficient:: l* M' d7 |, [+ e) U
by checking the Debug Registers, you can detect if SoftICE is loaded
U3 ~' r( E7 \2 s1 p3 }: t) U(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
5 d( f3 _. B3 o) Y" r& `) _there are some memory breakpoints set (dr0 to dr3) simply by reading their
9 w U9 n% w3 {9 T7 C& _value (in ring0 only). Values can be manipulated and or changed as well7 o6 b) C9 A' I- Q
(clearing BPMs for instance)9 N+ g: A" Y0 ^7 u" M0 U
" l3 W& ]) h& m" L
__________________________________________________________________________
; b* ]% Y0 I0 j( U
7 i: g' c6 S: g# P! x* \Method 11
/ N+ a& y8 t1 b2 `1 @=========
4 u* { S* b2 `( @4 ~ T5 D4 ]( z$ ~7 i1 d$ [+ f
This method is most known as 'MeltICE' because it has been freely distributed
' N) ?9 m( _1 t# J% Gvia www.winfiles.com. However it was first used by NuMega people to allow5 \- U# ?, M4 ~( t+ P
Symbol Loader to check if SoftICE was active or not (the code is located
! S# |$ y" N, ?9 @8 J& Zinside nmtrans.dll).
$ c) c! a1 o# p
5 m1 p! n2 ?" b3 {The way it works is very simple:* C4 L6 C+ D/ U7 L5 [, `
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for# v+ A3 H4 N7 i- V
WinNT) with the CreateFileA API.
/ W% F0 k/ J, L# n2 N6 W4 p
3 E3 T! N$ R ]- XHere is a sample (checking for 'SICE'):
6 g; v0 L3 W( q, C+ G4 b1 N& t$ u; Y9 u( l
BOOL IsSoftIce95Loaded()
- b) r) ^, e t0 g# u{) ~4 t$ J1 E, E2 L6 H
HANDLE hFile;
0 T" f' q- S) Y/ y5 F# r- A hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,/ w0 w1 H+ K$ Q6 a8 u( C \
FILE_SHARE_READ | FILE_SHARE_WRITE,
' x. K) A# W) p' ]7 Z! |9 n NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);1 E# e( ]0 E+ }: z/ \# T
if( hFile != INVALID_HANDLE_VALUE )
" c5 J7 ]& j! K0 P: p1 T8 n {
! N# f1 L5 a% _& q$ q CloseHandle(hFile);
- ^2 j- K* _5 G+ x& S; M return TRUE;1 J6 i/ }9 K' M$ F6 r
}* @2 R, D3 D/ c. I" {+ u. x
return FALSE;
$ Y% f o$ U7 ~( W* V}# e! H4 i2 ^6 J! e# ]- }3 E
: q, \$ Q+ ~1 t0 ~0 jAlthough this trick calls the CreateFileA function, don't even expect to be
- f# t& L& V" u5 g! P$ `3 Q- B: ^able to intercept it by installing a IFS hook: it will not work, no way!
8 {1 e R a8 nIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
8 ^1 ~, W3 x H4 f0 k5 p8 [service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)4 U5 |; J( E& L0 l. p2 Q' w
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
6 a/ w" l7 ?, | `* w/ Zfield.
1 Q/ z* Q: ?6 F1 [9 n+ AIn fact, its purpose is not to load/unload VxDs but only to send a
% ^" E- b( B0 G$ s. V- qW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
- C3 O2 b; z$ M& n( p5 eto the VxD Control_Dispatch proc (how the hell a shareware soft could try
+ ^4 R* j8 w+ I/ f- G# X5 _to load/unload a non-dynamically loadable driver such as SoftICE ;-).3 B7 h2 M2 r! |" c- V/ l
If the VxD is loaded, it will always clear eax and the Carry flag to allow: [4 C; {- C4 x; j
its handle to be opened and then, will be detected.
* ^, {4 r s9 i, O& L' W( h' mYou can check that simply by hooking Winice.exe control proc entry point
" u \: G( b T9 g+ zwhile running MeltICE.
3 s: e: b0 \0 l/ w7 L" y
- Q' s9 _5 v9 R5 E
1 X2 r" d- X5 @. |8 x9 J 00401067: push 00402025 ; \\.\SICE6 _8 C/ v2 V9 @& K3 x
0040106C: call CreateFileA3 Z+ ^- g2 [" ?( H1 J$ w- }
00401071: cmp eax,-001
8 f* a3 q3 H% x/ Q+ b& _ 00401074: je 00401091
1 G7 [; b& H0 {9 Y1 w1 T; |% \! J: k5 n7 ~
* j+ K# c- W$ p k# hThere could be hundreds of BPX you could use to detect this trick.
0 B$ R+ { v& S, N) G! `, f( y3 x-The most classical one is:
4 {$ m* N9 l5 o BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||7 B( X) b Z% f9 W8 V- ]; K
*(esp->4+4)=='NTIC'
, T' j' W2 l/ U$ x% `/ G# i( T
% D9 l5 a' B8 O# C0 G$ [/ R0 H/ j+ s-The most exotic ones (could be very slooooow :-(, u1 u" o& {% j! G( g9 h |
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
C, T4 N& W2 F2 d ;will break 3 times :-(6 W6 \% M% X. `+ T3 H9 Q6 s& h
" k! }& t, @( e$ S b; x
-or (a bit) faster:
$ T3 E6 E& i$ t" x: U BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
2 D9 I6 @8 r2 _# A( ^7 }
. K0 R4 m4 R( w* [ BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
4 R# {* o7 X$ y# j3 F7 Q* h ;will break 3 times :-(/ c4 d2 R: Q7 l. |+ \
: L# O$ e5 Z* G( t" Q/ F
-Much faster:- `, V( |" c$ L( y2 Z, S
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV', c* r s7 d) T( K0 b
0 N* P( l0 E4 [9 N3 e! J$ C
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
" r2 C4 y! d3 Q+ Kfunction to do the same job:
( R. F3 ^" k: J7 w% F0 }. `( ^. ?% k
push 00 ; OF_READ( C9 F, N0 S2 s6 d5 M
mov eax,[00656634] ; '\\.\SICE',0
. K- U) @3 k8 e1 v% x: m- ` push eax
8 ~& b n1 G2 @0 [1 ^0 m P! B2 S% H call KERNEL32!_lopen
' e e" A/ ^9 m. h+ w inc eax( ?$ y: |/ o/ `4 x0 q, z9 P7 L
jnz 00650589 ; detected4 M! C, ]$ |# Y+ u, y' s
push 00 ; OF_READ
7 R3 c+ v. V6 {6 v mov eax,[00656638] ; '\\.\SICE'9 ~" l- w; A; y7 |% j# H. \
push eax- O& |9 p1 ?: {$ [2 {- m
call KERNEL32!_lopen8 Z7 L( }0 t: U
inc eax! e/ s9 A1 J3 I. N' v
jz 006505ae ; not detected
o, J8 t) i: @$ }! `$ l! b
0 G* n- b0 b+ F v& R% U1 L* |; n' j6 q5 G8 Y. T. g: k1 j) N- ~
__________________________________________________________________________2 P# {5 X$ P( m& I: C
' T# J% h# e2 [" B* o( L) `" X
Method 12
' A) W* R1 q3 H/ N7 a& C=========
- y: ]9 J3 d6 ], T5 M% n0 Q% S3 M$ K; c3 o; m7 { F0 C
This trick is similar to int41h/4fh Debugger installation check (code 05' T% n/ v2 R; j2 q4 D) n
& 06) but very limited because it's only available for Win95/98 (not NT)
8 Z+ [3 r$ d/ ], g, v* j1 x7 Kas it uses the VxDCall backdoor. This detection was found in Bleem Demo. R2 o j9 V. B0 W* ^6 S
0 V) s8 p- m o5 E push 0000004fh ; function 4fh& |0 H, r0 ?0 e' @: H# k9 @
push 002a002ah ; high word specifies which VxD (VWIN32)4 s9 ` E V, h; C
; low word specifies which service
8 P6 @0 C) o3 A (VWIN32_Int41Dispatch)9 T9 T/ E$ k0 H D" t: _ {
call Kernel32!ORD_001 ; VxdCall
7 ~/ {) B3 {' `$ J8 G cmp ax, 0f386h ; magic number returned by system debuggers
- y: I' j9 T0 d3 Q) h jz SoftICE_detected. B$ J$ }/ S( P. u: L6 O; C
7 [2 s1 d/ P- L6 p% B0 gHere again, several ways to detect it:
: P7 [( g& y( o/ F* @4 L5 y1 `
& y7 x, x( K& y' i5 @& w BPINT 41 if ax==4f( x- H G# ^5 ^7 h; |, P
. g* v- q2 C" D% b
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
; f3 O; `* k) g' p; g2 e8 [: t8 I1 y. H$ y/ {+ t4 w. z& @
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A. k+ ^9 j- }+ Y, k& H
5 e/ G8 I* q" E: q4 E
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
* O* {) k/ @, b# i9 U* P' G3 O. Y8 A4 {5 Q0 C$ ?0 I* g2 m
__________________________________________________________________________
0 n3 ^2 p, ?( P. u
' p/ q( r [& i BMethod 13
+ @; \" Q! ^ d$ S& w5 o& ?========= V2 U% G4 X' i2 d2 O
0 n1 F o3 P" J
Not a real method of detection, but a good way to know if SoftICE is+ z( ^; N7 z& O
installed on a computer and to locate its installation directory.1 b* f( [4 [& g' f
It is used by few softs which access the following registry keys (usually #2) :/ M4 C' N8 G' f$ n
( q7 r5 C* H! I% o
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
+ N( G% @" l( _5 |2 o\Uninstall\SoftICE
5 x. A/ m* [4 t6 ~-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE# H, @% Y' V% R8 ]: C* J {
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion+ P+ p2 f4 i9 t9 D8 Q+ Y w
\App Paths\Loader32.Exe1 U" W! ^: I. M4 c& L
; i- F% N; c" s' A
( J/ V1 x7 N; _2 O. [
Note that some nasty apps could then erase all files from SoftICE directory4 k' }1 m, h4 _8 N5 @' c
(I faced that once :-(
0 U7 _' N# z# v, F* l$ u& ^" K' I* F/ a# D; i$ `5 s
Useful breakpoint to detect it:/ q+ g0 K; t* A. Y) t f% v
- ^% I" [! F5 E( |4 u& L9 x& \
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'! l( C$ h& U" X" r; h8 r- p
9 d: Z, r$ n% J% U: ___________________________________________________________________________
5 l. m* W3 {0 J" Z& Y4 R9 C+ G C8 {: l R
% q" j1 J8 X; J" ?
Method 14
3 ^! i9 x6 m" T6 y=========) [. i' O- N8 m. \9 B
9 c, D, j8 Q) X) D7 Y W1 L2 `
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose% o- x- n' D% } w
is to determines whether a debugger is running on your system (ring0 only).
" M7 ^6 M A0 T5 A! y. |2 S
2 s* l, y* B' _- s, [ VMMCall Test_Debug_Installed" [7 C/ h" u) A% [. ] B" ^8 b
je not_installed
; w; U2 ]! D. `2 U o& ^* }1 |/ b' {( Y/ F5 h
This service just checks a flag.4 r1 c' Q/ i' g/ I* S
</PRE></TD></TR></TBODY></TABLE> |