<TABLE width=500>" r" o7 g3 V& ?! T& m
<TBODY>
" G0 \8 @; B" ^1 B- i<TR>5 f. U& v/ y2 d k. u0 I
<TD><PRE>Method 01
9 j& A5 t3 o. M- V=========
! E9 X9 j& V" H2 O6 Y6 P/ }2 f& d1 Y* b- @! P
This method of detection of SoftICE (as well as the following one) is4 G3 z0 i- D: h
used by the majority of packers/encryptors found on Internet.4 G+ O, n7 R) b1 Q) M" @, A3 Z
It seeks the signature of BoundsChecker in SoftICE, J: M& m/ ~) [' z: K5 J
! {# M$ a/ l2 }5 Q" b# _$ s
mov ebp, 04243484Bh ; 'BCHK'0 e( h5 |, b% c- @7 Y2 c
mov ax, 04h
. C, d) e. V- d% I) [* v' `5 b& V% f int 3 6 n. W0 r# h& E {0 b
cmp al,45 F; F$ |* N2 g% o3 [' c3 a
jnz SoftICE_Detected. ~* u! o4 i9 y
; E2 m0 d+ K. V& O: E0 l$ o___________________________________________________________________________. C9 b( }& M9 `) S# u/ W/ K
$ w7 ^" x. k0 S+ o" \% L
Method 02" e& S* G) v1 |$ g) a# [
=========6 U% I1 Y. x7 t! n9 \$ P
o1 f7 o4 r# q
Still a method very much used (perhaps the most frequent one). It is used6 g, y/ E5 }% j: H
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
, b( W0 p- w$ Q. r+ f2 y: n( J. A) Ror execute SoftICE commands...
8 R; ^0 [/ {' a/ iIt is also used to crash SoftICE and to force it to execute any commands
( e( [1 W0 x, g/ D1 v) P(HBOOT...) :-(( * I% c0 p# ~5 a* L6 J0 g0 \
7 {8 S& K, h- b+ [ K
Here is a quick description:" G4 z8 x" b, k5 p$ x" _- E
-AX = 0910h (Display string in SIce windows)
3 r7 \" y2 r9 m& D3 ~: g+ V# ?-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)0 l' J' i$ M& h
-AX = 0912h (Get breakpoint infos)
G" i3 i0 h3 K2 c-AX = 0913h (Set Sice breakpoints)
, F7 u f: }2 I-AX = 0914h (Remove SIce breakoints)
; |' i% K# k8 J1 t) y" Z; r/ Y3 H" W- D- _- F0 j9 ~- m# q3 E& g' W
Each time you'll meet this trick, you'll see:
& @# b2 a7 D3 `-SI = 4647h
- h6 R8 R. Q! D% o, ^. B3 u/ P' r-DI = 4A4Dh6 |# v$ q+ _1 x7 ?" ~+ o& J
Which are the 'magic values' used by SoftIce.- r% E, M7 j6 Q4 R4 E7 v9 S
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.% s2 N$ t! Y5 O+ _, J) J
7 S, p6 @; ]2 z( s* OHere is one example from the file "Haspinst.exe" which is the dongle HASP" t! C& [0 | G1 q
Envelope utility use to protect DOS applications:
7 A- n* X7 L9 A
4 J' n# X( T: C) ?" d
7 |& J# ~; A- o4C19:0095 MOV AX,0911 ; execute command.
. N1 v- P5 n# v) f. l4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
0 j- e6 ?7 Z! p, x2 B: g6 S4C19:009A MOV SI,4647 ; 1st magic value.
% u: Z' g4 p0 [4C19:009D MOV DI,4A4D ; 2nd magic value.
* n5 H$ Y. q& D! p/ T) i$ J. P4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)# k! x4 E4 e% ]' T, c g0 u: ^
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
7 `2 k3 G5 C/ M5 l& t4C19:00A4 INC CX
7 b4 R* R4 P2 i/ {- X4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
3 o T; S/ g4 _# A$ q4C19:00A8 JB 0095 ; 6 different commands.9 G& C3 S/ D- b7 D7 ^! u( Z$ U( X& t
4C19:00AA JMP 0002 ; Bad_Guy jmp back.# G- C1 x5 x% g
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)8 \( H4 ?5 n1 \( {) Q
6 _; n( f6 c; d; o5 MThe program will execute 6 different SIce commands located at ds:dx, which2 `% h- I$ A4 F
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
1 _; H n5 F1 `5 h
$ k# R5 f5 o& \$ a) Z2 c+ k* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.: D; }& `9 h+ I% F( ~
___________________________________________________________________________# S6 y4 h* R2 D; a' }, g$ }5 B
+ v7 {' v1 n6 Q' R# E- Q2 d
0 E0 m; S6 X- c U) ^Method 03- T4 U: ?/ z0 d( x8 k/ g: e" U
=========
% C3 W& o _; G; r; G. @
# u: x' Q7 e4 W% U4 h1 R, KLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
- M' j/ R: r" V; J! z2 R4 N8 V(API Get entry point)
2 K! `8 c. j: |$ P1 ]# R0 h( b" x 1 Z4 j0 h# ~/ I
V0 Z s) r4 {- m# B
xor di,di1 N0 s8 _* @ ~9 ` w$ m
mov es,di( l3 _/ m, o% P7 k; q8 u+ i0 q; }
mov ax, 1684h
) S+ J8 P/ e" q) ?. z mov bx, 0202h ; VxD ID of winice
; X8 O. a9 c( }* r int 2Fh' \4 j x, e, j: Z. L
mov ax, es ; ES:DI -> VxD API entry point
# z. m9 d4 N% Y5 z/ U$ C add ax, di
) c5 J: z, V' f" A& ?3 A test ax,ax
( q3 \2 N) a+ ^ q3 n+ g$ R jnz SoftICE_Detected
6 U) P3 C4 L; X k M7 S
" ~' |- D; W( z0 H0 N- H" ?___________________________________________________________________________) a8 g5 ` e* E
7 N5 A# \; O! o8 r8 C
Method 04! l+ q, A: R% s( K8 [$ U! \
=========7 e7 t$ ^, D0 V7 |5 r3 E5 L
" P7 y2 |3 p; ^. c+ YMethod identical to the preceding one except that it seeks the ID of SoftICE" J, `4 ~, D# `( j4 i
GFX VxD.
! @: y% D! z" o: k# v9 l
! z) y+ T; A4 @8 t$ W3 q xor di,di
O8 V2 A- m6 D4 H' ` mov es,di6 O& P# N4 O; T" E
mov ax, 1684h 7 g) d9 N, n8 P8 j2 Q( y1 {
mov bx, 7a5Fh ; VxD ID of SIWVID
, e: r1 q/ j5 J; d, t3 D int 2fh! \/ n; p) L, b2 n. A
mov ax, es ; ES:DI -> VxD API entry point
8 X t0 ~$ }: `2 j. y add ax, di( n$ E2 g6 r9 r3 G
test ax,ax
2 ^! x" r2 @3 w( u" i$ E jnz SoftICE_Detected
' }, U# ^6 j N9 r7 r1 q4 `% S. N+ Y: F
__________________________________________________________________________
/ s: w8 a6 i# t, [$ ^
; }" [0 y% G' t: W/ R( M% o: I4 |4 M
Method 05: W0 [; q& s q
=========) c+ W. c# e3 i0 G8 X
* d( r8 k1 @, _: U
Method seeking the 'magic number' 0F386h returned (in ax) by all system
7 p) ^! w( P" c3 f! f8 m( edebugger. It calls the int 41h, function 4Fh.' Y# \& L+ \6 i6 M
There are several alternatives.
$ p& j5 [: f- c) X2 D6 b; g: L' O! }
The following one is the simplest:
1 o( z4 _6 w% S1 Y. {# Q C; c6 T$ T% x/ G5 Y8 c8 m
mov ax,4fh
5 U$ J! f. U* z t int 41h4 E: u' g2 W+ t/ a) O$ J% z
cmp ax, 0F386$ @: }4 f1 J, z' T8 F# g3 ?
jz SoftICE_detected
% K7 S3 ?: f8 g t9 V# z
! \& b) n: ~% h- H$ ^( Y8 K6 k2 W4 v8 w' q% d4 j
Next method as well as the following one are 2 examples from Stone's % C6 X8 k0 E' D) }! p/ Y% \+ J$ a
"stn-wid.zip" (www.cracking.net):
, M0 r ?) ?* B/ P B6 v, l- t5 u# \
8 Y8 p/ S3 d7 f Z3 g7 q mov bx, cs
- `; c3 T" ]3 ] lea dx, int41handler24 v9 j0 }7 ^! N4 b; E( p
xchg dx, es:[41h*4]) z% C+ P$ p" G4 M% a6 d7 {! F0 Y7 h3 P
xchg bx, es:[41h*4+2]
! P% D: ^4 K* Z" r+ D7 I mov ax,4fh: _+ G: w% q0 `8 |- k
int 41h
: B/ j$ g6 p. h* {2 r xchg dx, es:[41h*4]3 q( [5 s( q9 s" V5 [: r' n
xchg bx, es:[41h*4+2]
$ T/ n6 i7 z, s' l( } cmp ax, 0f386h) \- e9 L& E# N* ^$ R
jz SoftICE_detected
5 B! w$ f6 i5 X4 }; _3 n, Z3 _2 @1 h" N; J" R( C$ ]
int41handler2 PROC
5 c1 d) `& b) R& B( K iret
3 F6 x& b3 ~) C( }0 g2 C0 Kint41handler2 ENDP
2 W x) e1 G% n" b6 L2 x3 y# F; ~( w/ o6 K; A+ W" z, y) @) S" u
3 s$ l$ P( e% T$ |: u+ l
_________________________________________________________________________2 W8 }. g8 M) @( B( l: y
- O) e: o9 w# l0 j1 g- b
! h+ p7 }& x" A7 y6 R- ~Method 06# j e1 C$ s" l5 o; R( U2 [$ [1 k
=========2 p- H5 ^3 {) r6 ]5 {3 }
* h! p0 k6 A2 ^0 y( g' k3 V" I2 |$ ^7 k! l, }/ r4 H
2nd method similar to the preceding one but more difficult to detect:- K- f# x- V7 w
; ]5 Y# |$ G0 N$ p6 B
/ s3 q: Q5 X w6 k& p5 Dint41handler PROC! l5 H& }3 k U3 k6 v0 A& H
mov cl,al
) m5 x5 y1 ]& T. O9 v iret7 F; U' V1 ^( Y! ?) z
int41handler ENDP( G f4 i" I/ w8 i! r+ F
# v! n% O; k. ] `% g
5 y3 {+ c8 I' H xor ax,ax
% R9 j: i: ]( D0 a) s& t2 G mov es,ax
$ t/ u: [8 @/ h6 m' g mov bx, cs" b# H4 {/ n' o' I1 y! k
lea dx, int41handler+ N- x" u2 ~' {6 V
xchg dx, es:[41h*4]* t" k: T1 o6 G, H
xchg bx, es:[41h*4+2]
' H5 ~4 n. k' f4 }* W7 ^( n in al, 40h
- a1 M o$ o( J) U' k4 y5 a: ^ xor cx,cx
" m9 i; d7 ?& e" `- |& c int 41h
& ~8 i. h5 v8 O( h7 k xchg dx, es:[41h*4]
* l: _8 _6 u; w. Y8 _+ L+ i xchg bx, es:[41h*4+2]8 K; p" T0 f$ `! H- F% @& H
cmp cl,al/ J( r" r( w, }6 w- @# {
jnz SoftICE_detected8 k7 d5 d) S/ `
8 P) I4 I: ~3 n7 W2 t! p3 [, K_________________________________________________________________________
- @9 ~# J, `" H2 ~& t4 }8 O: K% x$ q. s; q4 M- `/ {1 q: `8 e; K
Method 07
+ V5 C Y( x, r0 r& ]=========6 M& ?5 N3 V: j* H
0 ]- w: t7 }0 Y/ f, [1 f+ u
Method of detection of the WinICE handler in the int68h (V86)) }9 K: p4 c: l0 ~4 e
( F' b$ [7 W S4 N& Q$ m C; d+ K mov ah,43h/ o7 `0 t8 H; I! k+ [
int 68h# _% }+ B' t2 [2 v
cmp ax,0F386h! k. p& i8 e' b9 a5 F
jz SoftICE_Detected
1 y& x0 E. {- A+ L5 i" O# z! [, j) d7 }. K5 C/ `
& c, A! G% n# U* X+ R" X=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
- z% t5 S# Z" s3 r+ y# A1 h app like this:$ q8 ~) s( A5 a. N3 H# Y7 j; x
$ J$ u; I4 `3 W, Y. x- P BPX exec_int if ax==680 }7 x4 R4 H/ w; F
(function called is located at byte ptr [ebp+1Dh] and client eip is
: S ~! y7 Q3 q0 d7 t located at [ebp+48h] for 32Bit apps); F2 O: r# F* T& m$ w" G
__________________________________________________________________________' m2 O3 a( [7 i9 @* q; @( `* z
/ N" u# W# a6 i4 J' Y5 [
4 Q5 ] y4 o5 X
Method 08; E" w3 {: c( O* W/ ^$ R7 w& v
=========) }+ @7 [7 p; ]3 \9 l
w( X C. L* d U5 cIt is not a method of detection of SoftICE but a possibility to crash the, K+ k; S6 ^4 H
system by intercepting int 01h and int 03h and redirecting them to another4 O' |7 m# @8 a4 i$ J
routine.
; B; X1 }+ k# TIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points' D1 u1 s& G3 l6 I/ v8 K
to the new routine to execute (hangs computer...)
3 ^1 M/ \+ c( P: K8 x# p
# a W! |3 o8 H3 X0 F mov ah, 25h8 ^; `* o4 W& O- q( O
mov al, Int_Number (01h or 03h); M6 Z+ f# L# w [; m4 j
mov dx, offset New_Int_Routine
* a3 w" c/ z( t int 21h# Z/ s. o3 D! Z5 G
+ s) x, w4 T K/ F- F1 y
__________________________________________________________________________9 f1 | U0 @# P9 ?5 a' y# f5 [
0 ~8 H$ {7 \4 d3 ~3 V7 B) C, m
Method 09
- D7 |% @' Y2 M7 v) |=========% f# X% C5 G7 N9 x! |
6 ]$ c1 I& u8 f1 h% o' z) q+ m
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
5 r1 ?# F" r N* Xperformed in ring0 (VxD or a ring3 app using the VxdCall).5 V3 t) r0 B( X& a+ Y7 j
The Get_DDB service is used to determine whether or not a VxD is installed& p! O! L9 g+ f+ `
for the specified device and returns a Device Description Block (in ecx) for
/ k! Y0 {" E0 \/ J/ E" p2 t, Hthat device if it is installed.
0 O8 `7 G$ i' c; O% j- e3 T/ k" ^- S2 e$ b. F7 B; h7 h) I
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID( P4 L( v# e+ g$ L
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-); Z; u/ y. L i' {$ _
VMMCall Get_DDB
" B$ \! S6 `( r( {4 B8 H mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed( m! C" p( @9 i$ H( t9 i# X
$ B! X9 Z4 g( ~
Note as well that you can easily detect this method with SoftICE:! K1 r( e/ G- O7 b$ H3 D2 i
bpx Get_DDB if ax==0202 || ax==7a5fh, Y7 g" a) M0 O+ L N: ]$ u$ M- p
/ f: {4 ]1 L1 M! J8 U4 T__________________________________________________________________________* @* {1 ~6 b. F+ E2 B, I
7 w* T+ g$ R. q' V! u8 XMethod 10
0 A. A5 ~7 X9 Q/ {1 K; o) D========= R( d7 i* q4 f( P! I& X
8 l4 o' D, n% j5 l) ` w" J) Z) ^4 L
=>Disable or clear breakpoints before using this feature. DO NOT trace with
/ {& v/ h4 k8 k3 t% ^0 @5 Q6 t SoftICE while the option is enable!!
3 P# y4 V+ x+ X8 V3 V9 L* d+ W0 h* r- k# i# f1 \& V8 W" I h" V, W
This trick is very efficient:
8 r- Q7 _6 V4 Fby checking the Debug Registers, you can detect if SoftICE is loaded
. I; \9 ?4 H- f) N( ]+ y(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
`5 F8 P' ?" k @$ l7 R9 zthere are some memory breakpoints set (dr0 to dr3) simply by reading their
7 w6 S6 F/ G6 m8 c2 `value (in ring0 only). Values can be manipulated and or changed as well/ c5 q7 Q8 l5 f. U; R8 R
(clearing BPMs for instance)
8 s8 {+ I0 Y( a" f/ j3 r; P7 Y2 E* U2 z
__________________________________________________________________________
1 h8 a" X: X4 |3 o0 N3 ^8 F2 k) \# _$ s0 M" D# }, U% D
Method 11
2 d' ~+ n! F' }; h' ?( o+ w=========- v' B e# U, l) |
0 y- G1 n% P t2 k+ OThis method is most known as 'MeltICE' because it has been freely distributed- l9 l6 W' k4 E9 S+ J G4 X# B
via www.winfiles.com. However it was first used by NuMega people to allow- A$ _% L2 ?; u3 c4 j, }
Symbol Loader to check if SoftICE was active or not (the code is located
# ~) M- c% i/ }inside nmtrans.dll).( }9 }; ]" D( d9 s" L ?
* z( F) t3 u kThe way it works is very simple:# t7 E; V/ y8 v9 P4 \
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for. x/ M" o) O& W! z. Y* D
WinNT) with the CreateFileA API.
6 {/ X) Y, {, |6 S# z! o3 [# R. b6 x5 X: k: }6 K- S
Here is a sample (checking for 'SICE'):7 [* a% m* j3 W6 h7 J/ r0 c
6 @ @0 w1 T2 ?+ K) z9 YBOOL IsSoftIce95Loaded()
$ v4 q& s) ?) `+ x- w% t{+ N% D5 B. y7 a8 h+ f8 p* L1 v4 A
HANDLE hFile; 8 J4 Y+ c1 o; C) ?2 I/ p
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
7 C8 T' Q8 \* F: v/ j/ t FILE_SHARE_READ | FILE_SHARE_WRITE,6 `) ^# [' }& i/ O, d
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
& L2 R" U8 S1 X2 a; F6 `+ @+ J if( hFile != INVALID_HANDLE_VALUE ) j( [9 t& N& t: l9 ? I
{
K2 W5 L" ]. H CloseHandle(hFile);6 A, |- X4 ^6 t; C. {( A
return TRUE;$ ~: l* Q* N! x- S
}$ x. N! f7 S! M8 s
return FALSE;
& j" b3 N8 j2 J; \0 \3 \}. b& E8 P) X" i. l% z
% G. M4 G: j7 p& a* Q' C m9 W
Although this trick calls the CreateFileA function, don't even expect to be
# ]- E, V5 X6 B! ^- A$ b8 b& w0 w- rable to intercept it by installing a IFS hook: it will not work, no way!7 L3 O' i* \% O0 i% ~! v5 y
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
3 S G4 m7 n2 N/ g' p2 cservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)& n i4 J' G- Q# a6 J# |/ ~' g
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
H/ Y2 [' U1 E1 ] Tfield.( u4 t( G0 t+ D& P
In fact, its purpose is not to load/unload VxDs but only to send a
: }, `; g0 z$ [" u4 Z: l, ^W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
% d0 X& t2 g. {# }) ato the VxD Control_Dispatch proc (how the hell a shareware soft could try8 u# a D9 Q( \4 E
to load/unload a non-dynamically loadable driver such as SoftICE ;-).4 w& p g* Y5 X2 c/ M+ S* o
If the VxD is loaded, it will always clear eax and the Carry flag to allow5 S, O- _6 ^* c/ k0 Z4 `6 F
its handle to be opened and then, will be detected.6 t' ^, x1 r7 w* F7 F
You can check that simply by hooking Winice.exe control proc entry point
8 C# S3 S( c; \; ]' Fwhile running MeltICE.
3 g# g; U: ~1 G& o; Y! r4 t) h+ A
$ N' f% j& U& l* H* _& X9 ?- A5 N
00401067: push 00402025 ; \\.\SICE
- H, }8 ?1 }0 x4 {8 c$ e! W h/ E 0040106C: call CreateFileA
0 m2 r3 ]& Z6 m e4 V `/ E 00401071: cmp eax,-001# ^1 k) s! ?3 P4 G( V
00401074: je 00401091- S, X" V9 F4 T7 d4 y( C: j7 Z+ |. x
3 t7 R/ z. U% }. D+ ^
2 |, y2 D, T$ t& t( eThere could be hundreds of BPX you could use to detect this trick.
. C6 m: b+ N( ]# i, B-The most classical one is:3 j/ N" c) ~, C# b3 [
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||0 [' Q0 T+ Q, T: F1 I4 @
*(esp->4+4)=='NTIC'
" Z8 g; m9 q9 ?# f$ F! W8 p. X4 e) e2 \
-The most exotic ones (could be very slooooow :-(& _ ~ ?' ?# I! X2 T, u
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') / s/ \3 Q5 n$ N# }1 c0 B4 s
;will break 3 times :-(
5 Y2 ?' \9 j! Y' I8 p# n- I0 y0 x) ]/ N5 K' P9 j& p
-or (a bit) faster: * K& c- |. Q- d0 v) i& @# c
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')" C/ y1 k; B' p, U
+ R) p0 w7 e. Y
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
% C$ Q0 m* a8 b0 J1 [1 ^ ;will break 3 times :-(6 y; I6 Y% e; U$ y
0 K; k, `: \ {& V- z6 }4 f-Much faster:
. \- h6 d& {8 d) O BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
/ B# H) U3 p2 C% e9 T n j" b: c R9 V: o+ _
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
0 Y: C7 B3 y4 @1 T k: D$ X' sfunction to do the same job:
* }9 f2 T& A! v5 Q, Q8 A" V' b8 `! R7 P8 P1 s8 Y
push 00 ; OF_READ
! h3 ], y. `( Z4 n" } mov eax,[00656634] ; '\\.\SICE',05 n8 Q. {6 O" M( h! X
push eax
# _; q2 l' L$ o6 f- c: [* E* A call KERNEL32!_lopen
: N {1 Z" ?6 c1 i$ T inc eax
5 ] g/ V) ~4 V- W ^% u jnz 00650589 ; detected) L+ e! d+ b: R, G0 s
push 00 ; OF_READ
^2 c' L8 C- s+ E) u* ~# J6 l mov eax,[00656638] ; '\\.\SICE'& e2 D6 `: K; y- I$ B
push eax, Z; E( A ~' W( `/ ~
call KERNEL32!_lopen+ t# f6 }' h8 H' T! F' g! b
inc eax
0 r( @% f& ?9 \% X0 p7 Q+ \ jz 006505ae ; not detected; i1 ?) d7 Q" L' e* I
9 S3 K% w% F5 [- x( K
, x/ \- R8 m. n: [
__________________________________________________________________________
" e9 A$ S7 R; [: u' d# S r& L, P
Method 12( x* ]- l. K' B: c
=========
5 g' r$ i5 X2 [* `5 g& m: D( m. l) a3 p5 I
This trick is similar to int41h/4fh Debugger installation check (code 054 O8 C9 b" T) }$ p# t# Z
& 06) but very limited because it's only available for Win95/98 (not NT)5 M3 O7 M0 I1 j8 i& Y( r" v
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
) j+ E) y. G# m( j& O ]" C
& ?/ R3 {8 O4 W( |" F' a) n: A push 0000004fh ; function 4fh2 Z. G; F. T6 @, v
push 002a002ah ; high word specifies which VxD (VWIN32), S9 J' x3 U0 u1 q, D6 I' _
; low word specifies which service
1 P: t4 ~. h! t0 A (VWIN32_Int41Dispatch)0 e" s+ a7 T2 r! p+ ^! Y% ^
call Kernel32!ORD_001 ; VxdCall/ Y3 t: Q* B, A- a/ W
cmp ax, 0f386h ; magic number returned by system debuggers- C" U: m* s6 `4 e
jz SoftICE_detected
! f1 q$ A6 H% F5 A4 a" r9 {8 D u7 t4 y7 I9 ^
Here again, several ways to detect it:7 K l& Z, d+ _2 q G
8 p* T9 I4 i3 M BPINT 41 if ax==4f& K- ]. N4 u' U7 i7 X6 I; q8 z
1 j( W1 m) e1 ]' N8 r" c( M6 t
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
3 P/ O9 V. O( M2 q
) `# i, H; ]: D5 u+ q W BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
. }: T# i9 @. B! @- k6 w% q$ ]" z, x
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!7 n% c' X' B( E2 c
; k1 {; ?( z- i0 K0 ^/ l( h- k
__________________________________________________________________________' ?) u& d/ W* y& |
/ T% d O+ l: e7 ]/ C) G2 SMethod 13' ?. v* }. X9 V" W
=========
7 i- i( P* V9 ]6 R0 P. ^$ `" R' r) K; C; w9 k0 \/ d
Not a real method of detection, but a good way to know if SoftICE is
5 M( [# Q% F; T7 dinstalled on a computer and to locate its installation directory.
, M9 i7 i$ S, `5 s: V9 c- K- U6 KIt is used by few softs which access the following registry keys (usually #2) :
8 t/ f. y7 u# \$ u* s' K/ Q0 l4 F: ?4 {3 d v0 |5 y* |
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
+ E9 [ O; V0 S1 k3 y. E\Uninstall\SoftICE+ F" o d& @5 u& p% A; {7 g1 |
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
; s4 L! u( q' y& B0 c' d-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion6 U, b, N) f" m8 Y/ q2 e
\App Paths\Loader32.Exe
: {0 Z% m9 J+ j" _1 N: c' @. y: }! L8 B) s9 M9 R/ s/ a+ `* I( v8 B; k
4 g! Z9 c% [) I# {4 p
Note that some nasty apps could then erase all files from SoftICE directory( s$ M4 n) I" g5 n( d
(I faced that once :-(
6 D2 J' I, T& z6 A7 V
# W7 y/ f) B9 y$ {8 MUseful breakpoint to detect it:1 t9 t8 d! f6 Y9 {4 {4 u
- |. i+ k$ B+ |$ R) C# d BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
. ?5 z. U6 F$ N0 w! O, S, A9 v6 V* m& x$ `! h, O$ U
__________________________________________________________________________" ]0 J4 ?& Y- D
1 k9 S! m) b: l$ Y9 C9 N7 @2 G% ~/ s/ R
Method 14
3 d; q, |% E0 I( O0 `) G! Y=========
0 H+ l- s; i) F+ c
1 w" ?) H# W% c9 ^A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
; q/ I# p) U" U/ Wis to determines whether a debugger is running on your system (ring0 only).
' z9 e, t' h. H C; c U _- ?' a6 q* u+ C- i
VMMCall Test_Debug_Installed
# o$ q1 h4 u4 I; b# i' @( Y je not_installed4 s( w5 o6 q; V* t/ N
2 m4 o3 P+ E3 T% U4 k
This service just checks a flag.
5 [" V+ s5 y A$ s9 F( Y</PRE></TD></TR></TBODY></TABLE> |