<TABLE width=500>- y5 e% D9 i% C
<TBODY>
! m+ F8 b) ]) l c1 h: r) W9 p<TR>4 W9 [4 C3 A# s+ O
<TD><PRE>Method 01 : H* s) k- r' k6 i% u' C4 g
=========* C9 x* K2 R- A/ A4 y2 J! {0 |
5 O% l$ c: q, ~& u. K
This method of detection of SoftICE (as well as the following one) is
4 g( L: |& ?5 @9 `! V$ B& Sused by the majority of packers/encryptors found on Internet.
- f; x; F9 [( fIt seeks the signature of BoundsChecker in SoftICE/ }" _; v! v7 V1 e8 ^
6 \% ^+ h/ [6 V4 ] W( d& s: R- _- e mov ebp, 04243484Bh ; 'BCHK'
( g4 z: @7 @7 U( f6 D mov ax, 04h% v6 O! ~. K' E* Y. |3 L
int 3 ' x4 @5 r/ h ]% _+ o
cmp al,43 N H) V* w8 d3 L2 n
jnz SoftICE_Detected
. q6 L8 K7 X4 x( b' {
" `) z0 X) Z6 ^% h7 }" u___________________________________________________________________________+ h, }1 e3 S) a4 p/ |! e5 X
$ [! u/ X% B# q, S0 s6 O! p4 r# QMethod 02: u9 ^% \ R. ]9 t) z# w) W( L
=========
, ]- Y8 I7 x3 v) Q1 X+ \3 a
3 L/ H6 b) P$ t! JStill a method very much used (perhaps the most frequent one). It is used
" @. y% L7 H& Q$ Tto get SoftICE 'Back Door commands' which gives infos on Breakpoints, X" O8 T/ j# Q2 x. T) g2 k
or execute SoftICE commands...; [1 T$ r' x) w$ s7 G: T, |
It is also used to crash SoftICE and to force it to execute any commands! j; |; F0 K! e% m# r/ X
(HBOOT...) :-((
b! M: P; H7 D z
# y7 w" `" k wHere is a quick description:' c1 k: J$ Z9 ?. q/ ^
-AX = 0910h (Display string in SIce windows)- m9 |* y B0 m9 v4 ^
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)( B4 @1 h+ y* H3 i
-AX = 0912h (Get breakpoint infos)
* d) w* W5 L- i! b3 D; j9 ~. C9 g-AX = 0913h (Set Sice breakpoints)
* M& w& a( h+ L" Q' H5 @6 f7 y+ u8 Y+ f-AX = 0914h (Remove SIce breakoints)4 }1 C* J( Y4 l: `. a" F3 n
7 @$ F9 t2 W" {6 Z; D, @
Each time you'll meet this trick, you'll see:8 L f7 `8 P. x: r- `0 z0 h* S
-SI = 4647h
# e: Z! N* w: H, G5 K, y: {-DI = 4A4Dh7 m5 I$ |9 t$ q6 b+ U
Which are the 'magic values' used by SoftIce.6 X! N# s, S; W$ V9 b2 }, _& O4 W
For more informations, see "Ralf Brown Interrupt list" chapter int 03h." h% y Q4 x' r F& q) q' F! m
# L0 Q% B+ e/ ^$ A! ^8 z5 e4 z( SHere is one example from the file "Haspinst.exe" which is the dongle HASP7 u! U6 R, B- \3 T
Envelope utility use to protect DOS applications:7 q0 E! F: q$ J) T) S6 E' s* z
7 v# e6 H( |/ d" j* T) O: Y! s5 R, k2 K6 M* ]
4C19:0095 MOV AX,0911 ; execute command.$ Q M1 l0 y8 m) u$ ^; r* j
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).2 e4 t: y% f5 \% |& F! J
4C19:009A MOV SI,4647 ; 1st magic value.8 [6 V/ K. J2 u
4C19:009D MOV DI,4A4D ; 2nd magic value.
! l2 `$ W: P3 y- a. N6 {4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)! Z2 ~8 |: n' R" M+ B( P+ Q/ _ R
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute2 Y( O' j# V' S6 i
4C19:00A4 INC CX
9 J7 h1 q C7 |' M4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
. F0 K+ G2 {- Q% X) I) e& h4C19:00A8 JB 0095 ; 6 different commands.
3 X7 g, p8 ~- c/ X1 z, G4C19:00AA JMP 0002 ; Bad_Guy jmp back.* m" E8 l* y5 @+ B, ~# ?3 n; P
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)1 e; U9 T; ~* ]2 ?
' p- y1 [+ [$ u0 _( d& w; |The program will execute 6 different SIce commands located at ds:dx, which- [+ c# [% p5 t
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.& w" B: ~& F5 X
4 r) X# C6 a) {; v5 _4 h$ ~9 y9 m; U- _
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.! _5 b7 ~ v( X. j% S
___________________________________________________________________________
' S) G! v/ `% A# k. N I. X5 ~; ^$ c
# w7 j" a1 o( f& I
Method 03. l# _0 ?( h5 d( O* f+ w
=========; r; b1 J& C) \
" H. `; e. n. g1 t X6 ^' W( ~4 [/ YLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
$ N% F4 P' W' t' m: r6 |7 X6 t* [(API Get entry point)$ ~3 c8 s6 h8 @ n& \# ~, D
; ^ l6 c$ M+ u- {# ^+ s
2 s! S/ i- I0 t- u# s# J* q0 O xor di,di: T/ Q4 s8 V0 W3 M9 Q7 _
mov es,di( w% k: r0 r& _
mov ax, 1684h
" W% |4 m' l+ K) j mov bx, 0202h ; VxD ID of winice
7 K9 o% b* M* X" W int 2Fh
4 N4 K) Y, K* v) I/ h mov ax, es ; ES:DI -> VxD API entry point
* q& ~2 C3 v2 Y; A+ h& R. x: A% D4 u add ax, di. x) C; L- y! g2 Q8 v; \) y
test ax,ax
5 I. C5 D G K- g jnz SoftICE_Detected; J" P# j) H: R: Q
9 R/ \7 g$ L5 V8 \) N7 v* o) c ____________________________________________________________________________- V1 T3 L9 K. E2 O
5 D3 v0 F& A$ G# c( H5 x. s* c
Method 04
: M7 P; S8 |, X M) t+ i! ~$ x=========! L% Z; u, |, f( i( ^2 U/ Y
1 g- z0 m# e$ o1 ]7 C* A7 bMethod identical to the preceding one except that it seeks the ID of SoftICE# E4 q4 F& u7 g2 G/ j% D
GFX VxD.% G# @% t8 _, `: X& d' m
6 w% q3 ]% a" o1 {" V/ s
xor di,di
" }. n. _) d3 V8 p% x! ^ mov es,di6 I3 l: t6 I, ^) f+ I- u# [$ B
mov ax, 1684h # @4 m. n0 a% V8 u
mov bx, 7a5Fh ; VxD ID of SIWVID8 C7 Y1 F# Q3 ^# D& N0 \, S
int 2fh8 T/ I1 E. \: I& f+ Q
mov ax, es ; ES:DI -> VxD API entry point1 @# A. ]$ M2 o
add ax, di, R9 j- D: q/ E: r
test ax,ax9 S" S b0 n# `- h
jnz SoftICE_Detected0 M) G/ J- b P. x* g- q
2 q0 a- }5 y; Y- g0 ]' x
__________________________________________________________________________
}! @6 J5 f7 q8 D' R- ]! L1 S
/ N7 L( j- E. M3 a) z+ l+ L3 K& a( K2 r1 w f" o3 j+ N) G
Method 05
( E* e( w. S3 u' J=========
. ]2 ]* L" E# O: ?# O3 R2 L) G2 b p/ o+ B
Method seeking the 'magic number' 0F386h returned (in ax) by all system
1 Y* I1 B3 b$ m2 d6 }; Zdebugger. It calls the int 41h, function 4Fh.* g# h2 @; P2 E; l6 ~5 `
There are several alternatives.
+ H8 H! Y( N& @& N
/ T4 d; `& P5 n. ~# zThe following one is the simplest:
* w, Q) i" Z9 N' D( }. Z
- z$ v8 E8 m# C% L2 y4 C mov ax,4fh5 K8 I% ^' c4 y- k; u- y
int 41h
6 M! N8 p; B( Q1 E cmp ax, 0F386) J P2 Z5 n( J( |% D0 y5 b H8 n
jz SoftICE_detected
% u/ U: N1 F' R, n h. A$ c- s) [# o: Q: B2 u) C
, G! u; w4 c8 @$ U* h
Next method as well as the following one are 2 examples from Stone's 4 ]% w4 n A$ q
"stn-wid.zip" (www.cracking.net):8 s, L$ A7 f7 X- ]% _- @& u
* W- \- a1 A- u. K3 |$ S mov bx, cs G6 }( a4 |( i- K+ o' @, \ m
lea dx, int41handler2
% Y) O6 N0 z0 A xchg dx, es:[41h*4]
$ D+ s$ l0 Q- E6 Q# j% ?( t3 g$ S xchg bx, es:[41h*4+2]* l. x- \ T+ s3 l6 i
mov ax,4fh
0 {0 k- w8 f# ?, `. A& h; l int 41h; z" ?) c8 L) ?8 Q- R+ J- v- A# W4 K: ~
xchg dx, es:[41h*4]; A% }5 X4 p( Z
xchg bx, es:[41h*4+2]
! {- p; v9 y; P- p+ S1 R cmp ax, 0f386h* b2 t$ @9 {& g9 F+ p
jz SoftICE_detected
3 k! ?4 n$ C9 p) m5 p
6 Z. O- O4 K. B# O0 _' Wint41handler2 PROC/ w5 \* @8 F; `7 n, r1 J, F
iret4 ~9 Z3 R/ q4 n
int41handler2 ENDP8 g/ x0 C7 m# C
/ Q0 L# i$ T! q$ ]. c7 {% z
! v0 U" f6 |& O9 X_________________________________________________________________________
) P5 l3 n1 ?/ {7 y( a3 `( H4 A) f. E5 V, {0 B3 x
1 Z' d. @0 B A8 RMethod 062 O2 h" L: O( _0 g! Y z
=========
# z% }1 M; z. L" _9 Q0 p# T: I! ~. e6 p; s) Q! ~+ t8 _
, C1 }( c! N0 J% H2nd method similar to the preceding one but more difficult to detect:' ^2 v2 E+ ~3 ?; h2 P0 c$ C, [
# J7 q0 K8 c. I, R: m' \4 O
8 y4 l) H/ y1 b% T* iint41handler PROC
; B3 [4 n0 I& p5 Y9 v0 d mov cl,al
$ O* V6 D2 h9 G/ k iret+ K' u# Z; E6 J" v' w3 U- X; y& t
int41handler ENDP
4 J/ \* ~. ]- c0 b; o4 j3 `# x; S* A) d. v. G) V; h
7 |, g8 R+ y" T) Z) q: x
xor ax,ax
0 H* ~) k. M. _2 t- L mov es,ax0 C" Q `9 f5 E+ v" x* ]7 n
mov bx, cs
8 ?2 T$ J$ W A# ^7 X lea dx, int41handler. x3 U- a; i( _8 g/ z! N1 C0 {8 G# R
xchg dx, es:[41h*4]
$ |0 [& p4 W, a7 ?6 U, d& d' S) M xchg bx, es:[41h*4+2]& @% u0 ^" Y1 z/ `+ N
in al, 40h' z" I5 S( I, A1 \$ |) x* c" |
xor cx,cx
( s% d& [# X4 a& F+ j. ~# u, B int 41h# c( P7 v, O( W
xchg dx, es:[41h*4]9 ^1 w/ {; u: {" x) L& x
xchg bx, es:[41h*4+2]
7 O& j; | x) \3 r6 z cmp cl,al% l- S, B7 n, n" x
jnz SoftICE_detected ]: m8 Q! Z" I' Y
. i [3 L$ g0 M! ?7 } p_________________________________________________________________________
9 z# |5 D; U2 e1 {% m: Y |8 J& s" }0 x0 {
Method 07
& Y" E1 L2 C% X; g) G=========
: z4 {% c! b: ]7 H* s3 J( J" m B7 s+ [" X2 e
Method of detection of the WinICE handler in the int68h (V86)
" q" e6 U5 j, q. r/ S+ l8 J5 z7 l5 k. t6 k; c7 {" @
mov ah,43h F# v2 t! R( a* B1 }
int 68h" l2 W) I; c' a
cmp ax,0F386h7 A% a; a: T5 y
jz SoftICE_Detected& Z9 B6 U# f9 J5 z6 n4 y9 x
% m5 ?) L4 {9 {! t2 B2 P8 u2 D7 v
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
% C& f2 ?5 w; }* u v app like this:
6 K J4 G6 j/ M+ u8 B6 X" J- W8 [" X9 V9 d
BPX exec_int if ax==68
) v) b t. f) {" e$ K# h" I6 D) F" S (function called is located at byte ptr [ebp+1Dh] and client eip is
1 p8 |" H6 ^+ D( r, N) y7 ~ located at [ebp+48h] for 32Bit apps)
1 a, |6 N; ?- a' q__________________________________________________________________________5 h% h( b2 v6 J" l# u4 M
+ M) {: v% T: j
6 @5 X) b# k% ^6 P) x8 ^1 T' RMethod 08
^* P9 _0 w& d% }( |========= J! \$ |( L7 _1 R: h; h- ?
$ P9 t, K( e9 K' z: B
It is not a method of detection of SoftICE but a possibility to crash the
$ j' g& g* }& e' \) M# Lsystem by intercepting int 01h and int 03h and redirecting them to another
# ?. D n5 e/ [& M8 _8 Kroutine.
2 N: l$ R% `3 K) t* R# ]It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points6 w* f( S, w u2 L
to the new routine to execute (hangs computer...)
) a+ W0 N% S! v+ _% V0 y; v7 {; l: F3 E* d7 v5 ?2 ]+ P* x
mov ah, 25h
; Y) E1 Z, C3 r1 P mov al, Int_Number (01h or 03h)
. G* G' O. p; V- s3 h4 ` mov dx, offset New_Int_Routine
; |$ f" ]+ i9 Z5 G" @5 H% K7 }4 i" ? int 21h7 S+ t K$ S: Z( i2 `9 M: C
* y7 e' a1 B) t( r$ P7 F1 v3 f__________________________________________________________________________+ ]8 h) n0 T2 H' [* c; K. H
4 X- ^- x/ T" Z6 }6 g/ u! hMethod 09
2 d" G: k" L& f=========
* e! e) y/ Y7 E' Y9 D- U' f' @) a! }7 x' e) P; v% v1 A
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
; y& J) m, t( A0 k2 p9 M b3 G" qperformed in ring0 (VxD or a ring3 app using the VxdCall).
/ P: N, _% i6 B/ eThe Get_DDB service is used to determine whether or not a VxD is installed
* a5 H5 s9 o' N6 [' bfor the specified device and returns a Device Description Block (in ecx) for
8 f& r: _- r( Gthat device if it is installed.) b; |4 ?# h3 J5 @# m E' g
2 d4 M% e/ f6 |' D) R) w
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID0 u; R. W7 B9 {" v: K
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
" k" g- e6 _( L: \3 ] VMMCall Get_DDB. r8 _, i: Y [# ?
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed. Z/ v9 k0 j+ ~ E1 J q
: G9 x( o" z' v. `
Note as well that you can easily detect this method with SoftICE:
6 v M! Z9 q( C; i bpx Get_DDB if ax==0202 || ax==7a5fh2 J' L4 c4 w& e( H& O3 D9 ^
( F# C4 [1 T* d# C' N
__________________________________________________________________________/ J& H1 z/ q* Z/ O/ k$ x" N
" {' o- y6 J& J3 j) x7 c, G4 [- @Method 10
) A( B0 {1 a& G=========- H& q$ D3 @1 L) K" O- _4 H( w
0 o7 }7 t4 ]; A4 p. Z
=>Disable or clear breakpoints before using this feature. DO NOT trace with. l8 R# f$ a4 i" _5 T
SoftICE while the option is enable!!
/ C! {0 {& f' p( b4 Q
6 x; z3 m) s7 e; {; SThis trick is very efficient:
! t% u( P. \: }( t* c0 @1 Uby checking the Debug Registers, you can detect if SoftICE is loaded
5 y& P; H$ S" J( a(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if% }: J1 N( d( ?! N! f
there are some memory breakpoints set (dr0 to dr3) simply by reading their. a" E8 G; m6 M% h- V
value (in ring0 only). Values can be manipulated and or changed as well
! H- Y. x+ ~9 Z, y" g- o(clearing BPMs for instance)
$ X" F9 ~% H3 u1 I" D
) m& W6 i. F& z$ v( s__________________________________________________________________________
& I( Y6 T' _" Y& }" E# L" K% F" R% R+ b* q
Method 11
/ G! B( c8 X( d+ ]8 J=========/ f' c' f1 i: A' f. [( h, n2 c
( }) d9 X9 Z! _1 LThis method is most known as 'MeltICE' because it has been freely distributed: l$ Q! Y( c% i- w A0 u' `
via www.winfiles.com. However it was first used by NuMega people to allow9 t& H9 m- m4 b% G' _3 J; ?
Symbol Loader to check if SoftICE was active or not (the code is located
0 s# x1 L; o* ~inside nmtrans.dll).
2 D: }# p" A, H$ t& M
, `4 U; q0 Y3 |9 D- O4 AThe way it works is very simple:
" J+ l9 ? o- nIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
; s( I4 q# ~4 b3 j7 G6 }WinNT) with the CreateFileA API.
. v) U! z* Z- I. |# T6 ?& {6 W3 T7 r& T+ y/ C" ?0 K
Here is a sample (checking for 'SICE'):+ B3 @+ V) ?4 _6 s4 h5 u ?
. C! s* I2 i" J, f s1 }8 _BOOL IsSoftIce95Loaded()# a3 h5 g7 l) Z8 D
{
; n0 h& N" ~, j* N9 ] HANDLE hFile;
* e* x/ e! v; n1 w hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
0 k8 ?9 s) F1 q) j1 u | FILE_SHARE_READ | FILE_SHARE_WRITE,3 u2 b0 Q( q p8 Z/ w. x
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);0 [; l4 A: g1 P; e4 _
if( hFile != INVALID_HANDLE_VALUE )( J0 D5 R" q& H% z/ Q3 d% x! }
{" {/ d" e0 U$ X3 W
CloseHandle(hFile);
; |5 n- S$ P: W" s return TRUE;
. H+ d- \/ b' u# E }
j4 ?) w: Z+ r+ |% x6 Q return FALSE;" W* @+ d% o- Z! k
}$ O, o( f4 z R1 m4 j& k6 l
7 p: d9 ~$ w* {& d) D2 e' N
Although this trick calls the CreateFileA function, don't even expect to be. ^# d. u5 Q; U; U& X: B# p3 t. J5 {
able to intercept it by installing a IFS hook: it will not work, no way!
8 `& f' ~' d* x" O! KIn fact, after the call to CreateFileA it will get through VWIN32 0x001F/ S/ p# @, d% R8 z, E
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
! M0 l6 Y# I6 e, S2 o, t$ S3 X1 aand then browse the DDB list until it find the VxD and its DDB_Control_Proc
$ j: u+ V* ?7 ^field.8 R: N8 [6 l; p5 X! m) d
In fact, its purpose is not to load/unload VxDs but only to send a
4 Z0 Q) K* v0 P8 X* K/ G7 aW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)" B! S2 y% w7 D+ }5 s' o( U
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
+ z- H6 P# W6 u2 t9 Q. c2 gto load/unload a non-dynamically loadable driver such as SoftICE ;-)." \; f& o( e& L+ A, H
If the VxD is loaded, it will always clear eax and the Carry flag to allow
( s4 ] q9 w% W8 U+ B/ L0 Qits handle to be opened and then, will be detected.
T' y4 ?4 R( k$ g/ F* cYou can check that simply by hooking Winice.exe control proc entry point
6 U2 u+ H3 T( ^1 w, b; ]while running MeltICE.
( B, q- K- Q# f2 m# k" j
8 x! {$ y" i4 ?5 W" A) c( \( y# u, [7 q" s
00401067: push 00402025 ; \\.\SICE: b. h& K- h0 f% S: h
0040106C: call CreateFileA( f m! k: q$ f0 x0 i
00401071: cmp eax,-001. M# @( A! h8 z: A" Y- G# }
00401074: je 004010912 }2 K0 Z: @9 z: y3 L; {& I
. V4 S" l, J1 i
& o8 U4 C( F: g( V: I( V. J1 x; ]There could be hundreds of BPX you could use to detect this trick.* J) d3 M9 @+ _( l, ?& S
-The most classical one is:
3 c: c0 ^5 i7 i' F BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||( l" x& V* S0 j# ?$ R6 F( Z
*(esp->4+4)=='NTIC': ? x1 j: O$ h/ A( r
2 L1 s1 q# h) r
-The most exotic ones (could be very slooooow :-(9 @8 S& g& i8 a% a# ?" J& k
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
: K8 U2 ^. P, r4 H ;will break 3 times :-(
$ S6 H) [6 A: y6 I' Y. k' u0 D# n) }) v
-or (a bit) faster:
$ T6 D2 U% M$ D; d BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
- q! P. Y! u) H) x/ y+ Q
" s# P- `6 ?+ S+ s BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' $ Y- d6 C; e$ b5 B8 b; N% @* F2 ^
;will break 3 times :-(+ G5 I. E7 N9 ?- ^* Q, f1 _- E
; _8 z# T# S3 t, m
-Much faster:
9 I& }# T4 Y' C6 _* T7 R BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
) _, H* k# x* N" b
, H w: w" _1 B1 iNote also that some programs (like AZPR3.00) use de old 16-bit _lopen9 B6 U' o) n6 B4 L5 A
function to do the same job:
! {4 V/ L; Z( E) Q# Y: K- b% W& ?! O X I" m" n% O* F
push 00 ; OF_READ/ f$ l& y5 `& F% `
mov eax,[00656634] ; '\\.\SICE',0
0 m$ u$ P4 Y0 L5 u push eax2 ~* X# w: V0 {3 A! T* V! ?! Y
call KERNEL32!_lopen7 j g8 ?7 r, n8 O- _ Z4 E, r1 B( _
inc eax
4 d! O. n5 C/ u8 j9 F jnz 00650589 ; detected
- a0 ~7 Q" w' g6 w/ ~3 b push 00 ; OF_READ" Q6 \- t7 U7 Z+ v8 H' ^/ H1 J, ^
mov eax,[00656638] ; '\\.\SICE'
% k( G9 a& H/ q. U+ ^& T/ s K push eax6 I* H6 |4 Y7 i8 Y4 I; ?
call KERNEL32!_lopen0 T% m3 A' |" u7 s/ k
inc eax
2 l- r5 Y5 N- r- g0 Y" \ jz 006505ae ; not detected
- v8 c* M6 t$ U
" ?3 B# P: V1 e5 ]% K
* ]* k, f# k( o6 r0 d__________________________________________________________________________
$ L: f! R( c8 _* z
6 V/ ^" F" `$ A ~8 yMethod 12# I- ]* ~2 {8 b1 _
=========7 w/ Z* _) E) q: d
8 {0 j; P* v" e5 c. q1 s8 iThis trick is similar to int41h/4fh Debugger installation check (code 05
: `1 v& f6 z1 |/ {; V4 a3 i) S7 f& 06) but very limited because it's only available for Win95/98 (not NT)
1 i. }+ t2 ^. \; [, m; X/ zas it uses the VxDCall backdoor. This detection was found in Bleem Demo.
+ P' \& `5 S4 i- m! U/ U
+ ]3 s4 F! r9 e5 u4 p; _ push 0000004fh ; function 4fh4 L* v v* ]. U# Y) |
push 002a002ah ; high word specifies which VxD (VWIN32)
0 a' Q+ Y7 e, `, k3 }) W ; low word specifies which service( B1 K" Y |6 I
(VWIN32_Int41Dispatch)
* {5 V3 D% e9 g* n: ~$ m4 C call Kernel32!ORD_001 ; VxdCall
& |8 ]' a8 |# H cmp ax, 0f386h ; magic number returned by system debuggers
: U, A$ S* a9 y+ S5 N jz SoftICE_detected! {: l6 b# P0 \- x. W6 S
c+ @2 E7 [: Y ?
Here again, several ways to detect it:3 z' a" o/ ~7 Q9 W! ?& O
' A- Z* f; _" C BPINT 41 if ax==4f6 l& X4 R' w5 h9 Y9 K
0 f# S1 [$ ^2 M5 f) R9 S. y% ? BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
% B g# Y- M5 p, S7 R
4 B6 f B4 @# N BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
9 c! m. m9 |* c! }1 t; z1 F/ m9 B K/ [6 h: o! ?
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
; Y1 n4 u& M! \( m# E
, m5 Z8 Y- M# s& \__________________________________________________________________________
: \/ t3 i& L+ G# X! b' h8 {5 S
7 {/ D$ D H4 B5 i/ I* ^Method 13
i$ a, u2 o1 V* M; O=========
/ i( X$ g7 }1 [' a9 h# x, D
$ @ u! B; O; \) @Not a real method of detection, but a good way to know if SoftICE is
5 d3 x" U1 U6 p9 C* l% B% f/ B* winstalled on a computer and to locate its installation directory.* J0 j1 J+ Y/ Y% f4 C( H3 F+ r
It is used by few softs which access the following registry keys (usually #2) :$ S/ s9 b5 P1 Z
a- Q( |+ f9 e! ]
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion9 k6 _# \) z3 N2 S
\Uninstall\SoftICE2 P. {7 M, A E( _8 Q- T9 @8 }
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE5 C0 I* ?8 c, B" g! F( ?/ d1 w( _$ R6 n
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
7 K4 m# t! L5 Q8 F, j8 q; R+ b6 _\App Paths\Loader32.Exe2 C; F$ ~0 n1 A! i6 [
# t. a S6 ]9 B
2 p$ U" x' W0 _( G0 WNote that some nasty apps could then erase all files from SoftICE directory: @ n( g5 W/ B3 Z/ c& I! z
(I faced that once :-(; f) P* w4 N5 _$ d q4 Z4 {! F
, x5 G/ V+ i! s( g' dUseful breakpoint to detect it:6 j+ ~8 S$ X5 `
N9 I0 [+ Z2 K' i; G8 s
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
8 {' a" X( s) ]' r( \6 l* B. v: c* f( U( F6 @8 {+ `0 V. W
__________________________________________________________________________ X8 C% \. ], \) ?- n. Z- {
; |6 S! g) @' C/ ~$ K
$ d' @ d5 d" }# e) z6 n+ ZMethod 14
4 l" M( Y" A" h& _0 l5 Y) o=========
. Y) C% u: @9 [0 J6 v" `# e
q. u! a2 b ?! ^' pA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
5 T4 `+ \% u. U9 ^+ a0 lis to determines whether a debugger is running on your system (ring0 only).& a) Z/ |! ~& e' |% x! _" S
Q" [4 B. h9 ?0 z; ]& o7 ^ m: J VMMCall Test_Debug_Installed
, g, s; W: d9 K5 d7 N% s je not_installed0 n6 c+ m I M% z2 N: h. E, B
* y* A, _( i4 p$ b2 D8 k
This service just checks a flag.. e% W4 ]4 G7 A" S
</PRE></TD></TR></TBODY></TABLE> |