<TABLE width=500>
! J2 S w: z: m% w<TBODY>
) {' m. x9 I3 ]- o: k<TR>
- G; k5 n+ _4 A<TD><PRE>Method 01
# B' y% i$ L9 g0 M+ w- a=========2 P; q$ l$ z, Q2 H+ w2 \
, N# e) `' `' t# A& `$ v* y
This method of detection of SoftICE (as well as the following one) is& r, h5 l. g- F: P$ z. P6 O: \
used by the majority of packers/encryptors found on Internet.
1 V: {+ C7 w; \: t3 N8 ~( rIt seeks the signature of BoundsChecker in SoftICE
1 s% `2 i* \" R( p8 k8 N& B# V L' Q# K: a: W8 N, h
mov ebp, 04243484Bh ; 'BCHK'
/ P# G" Q8 E8 m! Y mov ax, 04h
3 Q/ u. H( |% o& I int 3
- N) a3 J" e3 b! j8 x" \) S1 ~ cmp al,42 l/ y, E! y6 s7 g% I
jnz SoftICE_Detected, C) M2 f# `$ F
" n3 `) g2 Z8 O
___________________________________________________________________________1 \7 v4 j5 {0 N( E3 {% k
' }) a# x1 i0 ?# c0 P( u% T: _
Method 020 x% p: U: D8 d. c5 S
=========0 r7 v m& D6 C
, v6 V/ J9 u$ M, a! Y$ ?
Still a method very much used (perhaps the most frequent one). It is used! y& g; y+ J' \: U+ {" X
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
6 d+ D$ p! G4 A8 J3 W, {* Yor execute SoftICE commands...6 H+ F1 ]9 x- q
It is also used to crash SoftICE and to force it to execute any commands
+ ]1 o x b, r(HBOOT...) :-(( * @5 g4 Z% ?. ?% l
" E! _( q4 C, l$ \' \5 a$ g% R
Here is a quick description:; }( e. R' m3 C/ |
-AX = 0910h (Display string in SIce windows)1 v- h- Y, u* Y5 h$ o* q# Q
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)4 x* u# X8 C5 H5 @6 n3 \
-AX = 0912h (Get breakpoint infos); V+ _( c$ h; y- O g. D. s
-AX = 0913h (Set Sice breakpoints)3 O+ L; f+ u& l8 P$ c" e6 ~
-AX = 0914h (Remove SIce breakoints)! p4 c* k! e4 r/ U; b! a
+ f9 N* y9 ]3 h# A8 A" nEach time you'll meet this trick, you'll see:3 L% P( L" d( m9 z, ]9 j8 x+ |) u
-SI = 4647h/ d! _5 i! Y, U: b) h c1 J* K
-DI = 4A4Dh
U6 o& m! L/ [1 ~- @( }Which are the 'magic values' used by SoftIce.
- `8 n, ^5 e/ XFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.; b, t# K2 j5 A, W# i$ \
% b( t9 C& m# v9 @
Here is one example from the file "Haspinst.exe" which is the dongle HASP
# w. M+ b2 p6 a$ NEnvelope utility use to protect DOS applications:( [: R) ^. P$ s* C
/ A0 [; w* e _
; l3 n* W2 }& |+ C! m
4C19:0095 MOV AX,0911 ; execute command. D1 }- Z$ I* |0 J1 g3 k7 X
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
' p" Y9 K/ d, D# S4C19:009A MOV SI,4647 ; 1st magic value.* K1 J1 \9 A, k8 o
4C19:009D MOV DI,4A4D ; 2nd magic value.
1 c3 l, G) y# D+ A4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
/ R% e2 Z' X1 F: E) j' v; \2 S4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
3 }- u3 B+ {( q1 e& O1 D3 ~1 t4C19:00A4 INC CX7 h# P# G( I: `/ K8 y; d9 q2 D
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute( u. {4 k* V) q% t. h8 n8 a
4C19:00A8 JB 0095 ; 6 different commands.
2 F/ B5 |6 V) _7 @( j, B4C19:00AA JMP 0002 ; Bad_Guy jmp back./ H# f7 G7 v0 j8 O5 o
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
" M1 c" ]9 Q, ~" b
0 N6 Y9 S0 T! ^0 yThe program will execute 6 different SIce commands located at ds:dx, which
& J: j* z$ O; r ^+ a3 B; j* Y+ Q: bare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
# x! Z8 @. Z& l, J- `" C+ g# E$ M$ T2 N3 [6 r% B
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.+ p# M1 O2 E9 J7 Q2 h
___________________________________________________________________________4 U4 s( ` _" K
' i( K! `7 c0 R
5 c& U' \5 _" ~6 N7 }" H( u
Method 03
M2 `. x0 l3 E9 g=========
* I# h# _- T' h( x, K2 {& Z; a, j' ^* [" V0 M" L8 s/ F/ M
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
- F& M2 V5 F% L; q7 q3 {(API Get entry point). K/ {* V5 D! U" a$ h
, z- \0 y; z7 L7 W
; t* M" A+ F3 _% q xor di,di
9 E$ X* N* k9 G+ J( j" { mov es,di) h! O; o+ x6 E$ @
mov ax, 1684h
! C1 U5 I- M. i: ?1 I @6 |( L, V mov bx, 0202h ; VxD ID of winice) F5 a2 z' ~3 H' j" O
int 2Fh
$ o \: ]: y. z! W" M3 l. _, ~( c mov ax, es ; ES:DI -> VxD API entry point
$ y0 X" @. e$ | f add ax, di
& o2 b+ q' W) R* v: K test ax,ax% N4 y: e; f" u' D/ `/ Z# q
jnz SoftICE_Detected
7 W3 ?( e% D1 D& T3 c. N% G# l2 d
___________________________________________________________________________) j4 _' v+ V& w# O) P+ ?
) w8 V* a9 v$ u+ _: L B# i# n
Method 04
, h$ `2 H! X, g, U=========
# X" r* g( l4 E/ X5 S1 h& S# @* `1 b f
Method identical to the preceding one except that it seeks the ID of SoftICE
6 n' L2 q0 A& Q% F) R9 JGFX VxD.. w8 I, @9 ~/ y4 }; A$ p3 o U
0 m* P4 } V; `9 {, S
xor di,di9 b3 D6 }# a, @. Y
mov es,di
6 }, \2 J3 q: r. [ mov ax, 1684h
& C* r: G6 y- e mov bx, 7a5Fh ; VxD ID of SIWVID
: O- R$ i# m2 C/ E$ n% Q9 n# ? int 2fh/ y7 L7 T/ S2 U5 d: g0 ?7 O
mov ax, es ; ES:DI -> VxD API entry point* Z. W* L# v/ V7 D) @ Z
add ax, di) R1 f: H) s1 h0 l: C
test ax,ax
* N; E! c1 |" l; \- F4 v7 b# F jnz SoftICE_Detected
) V8 P7 W/ A, f4 j. v
, D3 }( W. e6 p0 n- S& d__________________________________________________________________________
) h9 C5 \( \! m/ V7 P4 F. e [
( p. b, `) j5 p6 M0 {4 _. Z8 r, h5 q( q6 M! f
Method 05
) z8 r; ]% t/ s; Z- `& M% \=========2 g# M4 ^- z0 m
& o9 k1 C2 K; M* M7 s
Method seeking the 'magic number' 0F386h returned (in ax) by all system" O K0 l9 {6 \- u! r
debugger. It calls the int 41h, function 4Fh.7 W2 c9 S' p/ m. o" i" s: Y
There are several alternatives. & W+ O4 }) f& V4 t3 E
# ^0 h" {& r, j, K% tThe following one is the simplest:3 {. _0 J: y/ A% v6 m: e+ r" c
$ Z7 q* q. I& r: I" K c" O, L3 s1 S
mov ax,4fh9 e+ I$ Q. Y Z, V. q! `
int 41h
4 F/ M0 c; v) d3 }2 s* `; [ cmp ax, 0F386
7 _! R8 Y* \; {0 W jz SoftICE_detected
# e4 w& H$ |' [. `9 d
& O$ N/ `4 M0 r$ s7 ]
7 z/ r2 k( c3 a. {7 dNext method as well as the following one are 2 examples from Stone's + s7 W4 O4 G7 J9 B
"stn-wid.zip" (www.cracking.net): v: b0 y9 _& M2 k4 V+ P% T
+ m# J R$ _, D3 W' Z0 q4 h mov bx, cs
/ x+ y+ X7 Y0 V! V lea dx, int41handler27 i5 ~! u% q z4 J# x6 Q
xchg dx, es:[41h*4]
: [: b2 y+ t% e$ G' d; z$ U7 B" R" Y xchg bx, es:[41h*4+2]2 x9 d# M. ]$ ~ T
mov ax,4fh
$ M5 q9 o% P; U o: J S: _! s int 41h
; W+ U5 z) a- X4 a' j4 g0 z; x xchg dx, es:[41h*4]8 P' }1 N- K. f; g( H4 k
xchg bx, es:[41h*4+2]8 ?% v( S0 a" R5 H" N2 A2 `
cmp ax, 0f386h9 V7 n( B; E8 M
jz SoftICE_detected
* W6 J* N( J3 b
" O& x" B! P- E- B5 Rint41handler2 PROC
) n- |+ D+ Z2 y# H5 U iret& W. j P+ N6 m6 m3 Z
int41handler2 ENDP4 g0 \* x3 y+ o, R' K
2 N* l6 R& V3 M5 n8 s
+ B7 S0 ]% ?' T4 d0 Z7 w/ f" Y_________________________________________________________________________
. x9 R j9 i! ?) ~8 X$ b1 x7 |: X& T7 d9 V9 _% j1 u: k9 c" \: ]
& A' Z0 U$ p. M) T9 w! QMethod 06
1 g ?, X0 k! S% k=========9 q; U) K. t9 T3 E$ M" K$ r! q
3 \; U0 n9 G+ t& l
) x% o0 x; W9 e9 ^+ H& s; ?2nd method similar to the preceding one but more difficult to detect:
$ i0 m+ B' ]2 b( s5 x; C1 h
) k9 K8 i$ J, l/ c1 n- K! _- p, a9 A" K
int41handler PROC
% J$ x8 L7 ]' K- I& U mov cl,al' J5 d$ P- V. a* ~1 Y
iret. c Q/ V7 R ^3 ]
int41handler ENDP- ?, ^* @1 J7 @
k! C& ]8 u& E6 X7 u8 h
& K5 l) p1 l% \' P5 P xor ax,ax
& x! u- i+ O: j2 R1 ~ mov es,ax
+ i8 N+ s( b' c1 C6 q mov bx, cs G$ ]; s. z) z! ]" A8 Z; V+ o* x
lea dx, int41handler' L8 V( E; v; J- H9 P
xchg dx, es:[41h*4]$ `- C* f+ u1 ?9 `# B }$ q
xchg bx, es:[41h*4+2]
1 f- s( u# W! u% t in al, 40h8 K* H* R; c2 v
xor cx,cx
& {3 s ^# N/ w% D3 [) I) V7 l int 41h
: G' w8 r& Y9 i2 q% }+ S& w xchg dx, es:[41h*4]* x/ B! P$ b9 G, I2 \" f! w
xchg bx, es:[41h*4+2]6 y! q- K7 ^/ F4 J
cmp cl,al4 ~6 q: Y$ D* Y! x# d8 c
jnz SoftICE_detected
3 ` b9 C, f- M, T( g4 _0 d8 c; u5 G: A% ~0 [0 F
_________________________________________________________________________
l2 B8 [0 i% I" J& d- M! a% i
5 B: |! m; N7 n9 N1 ?- j% F; |Method 07
! R+ _5 j6 O, w- S4 Y=========! O- e2 g) O4 f; ?
% v7 l; p: G% I' U; n
Method of detection of the WinICE handler in the int68h (V86)
4 R- H, ^+ a& `) p0 S4 Q0 m
: q2 [# z X7 Z. q: m& d mov ah,43h
E p5 c9 ^% a3 U( `- [+ T& z int 68h
0 Z! A' V. o4 w4 j4 M cmp ax,0F386h
4 ~2 e6 \: W. C& b) p2 K. S jz SoftICE_Detected
' d* `: I$ ?/ q3 Z ^0 I8 Z
) @7 a6 C5 c( g9 m
( j& n9 g$ o/ x4 u+ C=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit' x9 }' b+ B5 G# [% L7 {4 C+ H8 Q
app like this:
: z5 t% m# Y7 M f p9 N4 F, r7 g0 e# v5 h# w; m2 r5 g
BPX exec_int if ax==68
" ^/ Z2 O: p6 ]( G (function called is located at byte ptr [ebp+1Dh] and client eip is
1 y! M% `7 E# \) c located at [ebp+48h] for 32Bit apps): I' j* A4 G3 ]8 l0 G$ g/ B% I8 _( S
__________________________________________________________________________7 n# l* v# `+ O) r9 t/ Q# v
+ H& x; n B( f. I7 V' H% V0 o8 e' W7 s( b+ w) S5 A( r7 _6 g
Method 08
* a4 G% i- M4 o# ]5 }=========
: @; i3 O P7 X4 o; a6 c* n p: [. t
It is not a method of detection of SoftICE but a possibility to crash the9 y- G) b5 `6 m' Z7 i! d9 C
system by intercepting int 01h and int 03h and redirecting them to another* ]( d, y/ d; w) U; k
routine.
9 g# _9 ]! D1 aIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points' Z+ e- }. Y: m
to the new routine to execute (hangs computer...)4 k# J$ X& y% F0 F. H9 [# I0 Q# T
, w! j( q% z4 D8 @ mov ah, 25h& ~. v V: s9 ~' y+ y
mov al, Int_Number (01h or 03h)2 `0 m0 b' _+ C* f6 B9 T2 P
mov dx, offset New_Int_Routine
: G' _6 m0 o! B5 _) k* H int 21h
4 e/ R# p+ {$ ~& h0 k2 V- ~% }( K2 _4 z' [+ W" K+ `( j
__________________________________________________________________________
- Q5 m! c, h, {4 X9 d( Q/ W" q0 x% ]
Method 09
; G8 Z; L& A+ X% X& t) k=========: ? @/ C! z* Y/ S8 b- s, i9 h
% J5 |% V. r: b! y0 g$ a/ _
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only$ i+ r0 R$ z3 a6 m
performed in ring0 (VxD or a ring3 app using the VxdCall).
Y( A+ i, s" n |The Get_DDB service is used to determine whether or not a VxD is installed
9 k$ f; g* L. n% h% b: Nfor the specified device and returns a Device Description Block (in ecx) for
8 c7 F1 _/ }( r- ?that device if it is installed.3 O: Y9 K7 {2 {3 [: @/ F, k: e! W
9 h( t3 \- [0 m% b3 i$ f
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID' Z6 j% w' N' n1 j9 h5 t# X. M
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)3 [2 s8 s) ?1 u
VMMCall Get_DDB
! ?1 H1 O2 ~2 X3 V6 g& E& L mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed7 Y7 `' G2 {. L3 h) N4 T, p5 y3 q
9 E% `. q' | b8 [3 `- C2 v: \
Note as well that you can easily detect this method with SoftICE:" v$ a& }$ Z- g4 M2 D' K: ~& J
bpx Get_DDB if ax==0202 || ax==7a5fh
4 \! G7 F( v/ u _8 N) @+ P
4 [8 {' b: M, m' s+ ^__________________________________________________________________________. ?. A8 E) ^/ l5 K& d) i
: k0 j! Y$ v1 r1 U6 @
Method 10
4 ^( u. u" P z$ o; f1 W/ a=========# @; H" N8 S$ O! X6 }5 y
/ [ ?' c+ P j
=>Disable or clear breakpoints before using this feature. DO NOT trace with
8 s+ H! @5 q3 B! u d* B n7 P SoftICE while the option is enable!!7 J% J! N" u9 r6 K8 x6 k4 G! X
8 \8 T# v, r$ ^This trick is very efficient:
, @4 i( g7 U) X/ |' I9 i& Gby checking the Debug Registers, you can detect if SoftICE is loaded& }) R4 ]5 `; D# t3 h9 C% S
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
8 j& j- l' ]( W ?+ L1 |: H8 z5 ethere are some memory breakpoints set (dr0 to dr3) simply by reading their
2 f8 R- [1 e0 M& Fvalue (in ring0 only). Values can be manipulated and or changed as well1 A4 M5 c; C2 v3 z0 P! [6 t
(clearing BPMs for instance)
9 f5 f, _; s$ A8 A/ y- V! n& ?2 X/ M2 b/ v' N% T
__________________________________________________________________________
6 V2 g) W0 b; K1 a1 H1 F
6 z" o% V4 M) ^7 [3 ]1 n6 uMethod 11
) U/ {; Q# C# }* s: g=========
2 X3 v: b+ z4 _9 [6 p4 F+ ?) u; e3 e% h8 Z* ~1 A, j
This method is most known as 'MeltICE' because it has been freely distributed4 u' d6 M$ a/ ~' M; {0 F
via www.winfiles.com. However it was first used by NuMega people to allow
' l' b6 s. B4 JSymbol Loader to check if SoftICE was active or not (the code is located
% S5 i, [$ y7 j* ]' Cinside nmtrans.dll).
: @( O0 C+ S* p- k8 ?$ a6 r1 I, L g: b" B: H4 t& r
The way it works is very simple:
\0 c5 S3 j# U6 h* V' TIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for }: ~9 u" Q0 [. R5 T
WinNT) with the CreateFileA API.0 P: ?7 e: X" A/ ?5 g1 E1 `
7 O$ s- i- H1 V3 H' L* RHere is a sample (checking for 'SICE'):
* k3 ~+ G# F) _1 u- e' e! W/ t# @, ~
BOOL IsSoftIce95Loaded()3 F& ~4 R& O) c) W
{. D a- ?; V' X- o: c/ ^# T2 j
HANDLE hFile;
7 v5 l5 N0 [- o" }8 w hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,2 Z. m" I7 G) t; t; p) K/ _( J
FILE_SHARE_READ | FILE_SHARE_WRITE,; j3 j' N- w+ x0 d' W
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
. G9 I4 ?8 v: L( @ if( hFile != INVALID_HANDLE_VALUE )( g0 p" C0 }- @9 U
{1 b/ q8 f: [+ a5 V
CloseHandle(hFile);
0 @3 L7 k+ r8 I. U1 b9 [ return TRUE;
1 C; R/ \/ @* }4 [/ ~# L0 i }% F! {7 w2 i( O! T$ I
return FALSE;
3 Y: S/ Q) I$ ]% j/ o8 q}
# H* q5 x$ w& m4 T# i
& @) E9 [5 O0 @# @, CAlthough this trick calls the CreateFileA function, don't even expect to be
, V5 Z- D7 E o" U' yable to intercept it by installing a IFS hook: it will not work, no way!
. T# E1 T% n& O# QIn fact, after the call to CreateFileA it will get through VWIN32 0x001F/ r' B; R8 X3 ^/ G0 X
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)1 C! _" q" q4 O% h, `1 Z; s5 ~
and then browse the DDB list until it find the VxD and its DDB_Control_Proc, `( @3 g2 a g) R6 i) T0 K
field.8 J& U: E9 a3 j k( _( `
In fact, its purpose is not to load/unload VxDs but only to send a
! q! m6 N3 d8 K x- xW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)$ y4 j2 Q, U8 n; _0 J. p9 I
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
8 P; S# {+ r$ M* c5 D7 Mto load/unload a non-dynamically loadable driver such as SoftICE ;-).
; u5 h; f/ W2 |. S: HIf the VxD is loaded, it will always clear eax and the Carry flag to allow% t4 _6 h/ Y( f. C- Y& x
its handle to be opened and then, will be detected.
1 \! a3 q s2 [8 `& GYou can check that simply by hooking Winice.exe control proc entry point3 s8 x! H% g9 p \! F$ i# t
while running MeltICE.# r1 d6 s3 P! T* }2 f$ Z: A6 |
. ~, R8 \ D( B8 R
( T, Y; i o4 _% B' [" h 00401067: push 00402025 ; \\.\SICE
7 J* E8 j8 ]! J9 w4 {3 @ 0040106C: call CreateFileA) U! N) J! j1 Y: \) |' |1 y
00401071: cmp eax,-0014 C8 n9 {, Y* S- j
00401074: je 00401091. {# b" Z2 v7 A. `: G- A9 q7 n
- B/ q( Q! l5 P; z4 _8 v0 @6 I
; y5 q% {7 O' d' d' WThere could be hundreds of BPX you could use to detect this trick.0 C# K. P2 }+ d. `, u- ]8 o- Y
-The most classical one is:
1 J8 v- I% q- ~ BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
0 @- W* V6 b+ Y( o) J *(esp->4+4)=='NTIC'
% Z. r3 ? G6 X2 `5 m0 Q, X8 Q; l L+ d% u" ~7 V
-The most exotic ones (could be very slooooow :-(
. ~1 m& ]% p! e4 S BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
) `' i- x& `" E, c, o$ B+ Y ;will break 3 times :-(
% x3 e' l# S" s% m8 l- d" P0 B4 \1 C% h! l9 ?; L8 n/ A
-or (a bit) faster: / P& W r t- O" f0 a; q$ W
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
8 e4 r2 K/ D% t0 J( k& Y" H. f# h9 l, r/ c, ^/ @
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
# I) ~0 S& C5 f n- z' W& e* @ ;will break 3 times :-(
1 {; y) K3 @9 L! J3 N# v$ w2 n; z6 U
-Much faster:
, h6 a2 Y; h6 E2 s- S BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
4 s) a p. r% S9 d6 b0 R
3 t8 I8 g5 a; P" G' ~- D; GNote also that some programs (like AZPR3.00) use de old 16-bit _lopen0 z' N& p, Y% `- H
function to do the same job:
% U0 a! |: ?+ d% _% G3 s! `2 K. {
push 00 ; OF_READ
$ m$ n$ L- O3 T* u( t) f8 g( v mov eax,[00656634] ; '\\.\SICE',0; I& Z% u( k$ P# V' D# \
push eax* v, e# d# E9 j" q4 g ^* z- h
call KERNEL32!_lopen8 D( I: _4 L" r; c8 ]$ t& } O
inc eax+ O# r+ \3 h( l# O0 [ G M
jnz 00650589 ; detected& B( \# L" I5 Z# A2 t* h" E- @
push 00 ; OF_READ
" `( V9 G: c" p mov eax,[00656638] ; '\\.\SICE'. a, B" a0 B/ \
push eax
; o- d9 ?) h& Z' M6 k h. S4 _- l call KERNEL32!_lopen
* _# @1 F: F1 S/ @' a% l0 ~ S inc eax3 R. L' _# s# t+ X5 W0 X) _% O
jz 006505ae ; not detected" I3 K) I% r [1 O1 U1 _7 M2 L$ J
5 H3 T4 W" }0 ]0 G/ K- ]% z; R' ?' X; ^) Q& ?1 Y' M
__________________________________________________________________________6 c8 O* ~- l4 ?, ~
* @' e, u% |/ p
Method 12- W# r3 _# T8 g D4 S3 Q* U
=========# O0 k- a; Q+ C2 z8 R0 L6 W+ o
1 @: y8 M @/ ]- y7 b# r" wThis trick is similar to int41h/4fh Debugger installation check (code 053 G1 w/ w, ?+ u Z9 ?1 K- G2 ]0 B
& 06) but very limited because it's only available for Win95/98 (not NT)" b6 M6 B1 \7 h; N7 T* S* }' m3 R' F3 E
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
8 u3 u" ~4 F. \0 f5 B- k# K: d" Q1 |8 d: |5 v
push 0000004fh ; function 4fh
! V& `1 P7 K/ w push 002a002ah ; high word specifies which VxD (VWIN32)
" @# c" `8 q; h1 A/ h ; low word specifies which service
; j1 J2 O0 L& N. `- b$ K% c (VWIN32_Int41Dispatch)" e/ Y% F% ^ }! U- J. P/ h
call Kernel32!ORD_001 ; VxdCall$ r9 x( a6 M7 o, T3 Y
cmp ax, 0f386h ; magic number returned by system debuggers
: k6 C2 _0 A, V; S jz SoftICE_detected
2 H- v, W, P" z9 J3 H9 Y! O9 R$ g& r$ K; e2 i. ~2 g2 P
Here again, several ways to detect it:
5 t' y" p0 ~$ Z: K5 a) }' x8 l
/ }' y0 f) ]# A7 r4 P! m- @2 l BPINT 41 if ax==4f% `2 n4 Z- U: v! m0 P# D! @& i
4 v! }0 l4 ^/ s& }6 X8 e BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
" a) f0 q+ j6 ?+ D. ^3 k6 w$ t/ L7 H- Q) q: O% B# A
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
) O( ^2 z$ e9 w' `$ w( T4 b+ i9 Q
7 _* r: Q* b9 |+ S/ g% ] BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
6 F7 h) Q' Y5 X: T, C( A
0 V6 H) B6 T6 c2 W a3 z__________________________________________________________________________! D- p% z" X9 J `0 q
% l# P: t+ m6 q7 E2 i8 T7 {4 [
Method 13
v* ]% o U p! w4 e6 r ?" P. G=========+ X; m. T( i: U; `
6 J, q! F/ M( E* F$ n. f+ [
Not a real method of detection, but a good way to know if SoftICE is
) s7 \) s5 Y4 s5 j! q* {installed on a computer and to locate its installation directory." c, D* X$ N& l$ A
It is used by few softs which access the following registry keys (usually #2) :( C. [3 t4 |: Q o M$ C
d. U5 r% u3 i2 N, I- L3 P-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion/ u9 W/ q4 ^: b8 C
\Uninstall\SoftICE2 C2 R& G1 b/ c1 o$ w8 S
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE2 N6 h. q! I$ ?$ w2 W6 ^
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion/ P. ~0 f4 l/ M; a' i
\App Paths\Loader32.Exe# G3 H& w7 Y# b% {2 n. h% w
5 j* y1 D% s8 ~0 a6 X z& O @
+ K& ]2 z1 X0 v+ }2 T7 V4 M% @4 ~# SNote that some nasty apps could then erase all files from SoftICE directory) u# H3 w$ ^/ F( \5 ]/ L. [
(I faced that once :-(" }( b$ X& d! p/ G; G) N
& U* p. o8 t& p* f: n
Useful breakpoint to detect it:
7 t+ A! o# F* t: F4 W/ Q D7 o" l+ y; A; q5 S
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE') G, D( e1 x# j9 Y' \
- h* A- X2 f5 t__________________________________________________________________________
& @& i' I3 F- Q. A) A7 K6 g
$ K3 Q: N2 A i; ^2 l' I! S4 n/ D# j+ U, S" ~* t
Method 14
; G& Q% |2 A4 e, ~: Q3 B; E8 d( M=========7 I( s# z- g& E0 q; ^4 s5 G5 D
9 O% C0 {$ f* I
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose/ E k+ y3 j5 P6 Q1 I
is to determines whether a debugger is running on your system (ring0 only).
) a; u* p2 f* U6 F
2 X/ m* D! h5 t0 \$ s% G% r% S% j4 J VMMCall Test_Debug_Installed/ L7 W4 E0 c7 N( U, e3 I, N( r, K
je not_installed, I9 b3 g7 a7 r9 T9 ^
7 F7 x' m' y0 G, \3 e: S+ Z1 j4 _: R
This service just checks a flag.7 H n: d( J4 X5 h
</PRE></TD></TR></TBODY></TABLE> |