<TABLE width=500>
" o- s/ _) Y6 i$ O" S9 S+ M, z; _<TBODY>
( u; k* i3 s1 h% f) C1 j<TR>1 h& @) H$ [, e; f
<TD><PRE>Method 01
J; S$ Z- k* f$ N# g=========
$ F M |9 r' L# [( A: ] o* W, V& c9 T4 U! V
This method of detection of SoftICE (as well as the following one) is3 W; x: k6 S9 J
used by the majority of packers/encryptors found on Internet.
8 f/ |. E8 \' W+ L9 @It seeks the signature of BoundsChecker in SoftICE
) A' F4 ]: Y1 t- n4 D: W9 K- @4 J X
mov ebp, 04243484Bh ; 'BCHK'& b/ Q& }! Q3 q( d# z' M2 k
mov ax, 04h
# o/ D- D- L8 k5 w. v- L0 a9 C; c8 t int 3
/ ~9 p5 p- @. L# z. }$ U cmp al,49 M7 V) z5 b& {# t# _
jnz SoftICE_Detected" u0 ^" P; D$ H- B, M
& M: [, y; [% i7 i) H5 A8 a& R___________________________________________________________________________
& R5 J; B: C7 r% O8 i, H
! @* O" i# v$ {Method 02( [9 w! u3 o1 x$ |* m
=========
4 D! y$ ^! {$ A* x1 @
& k, C/ R! N. \2 |2 ~2 X+ XStill a method very much used (perhaps the most frequent one). It is used4 _! i; C$ _. G; p( P! r$ p6 A
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,7 w9 D% |4 \% C+ z5 V/ b) }
or execute SoftICE commands...' [4 ?! W u, @9 g
It is also used to crash SoftICE and to force it to execute any commands
" c1 [$ n, j7 A3 K6 Q(HBOOT...) :-(( Z2 f ?; V7 `1 h
/ C! q. M& k) F" k8 g' x" X
Here is a quick description:
# U. i% F8 X& t b5 |1 k-AX = 0910h (Display string in SIce windows)
' S9 W2 K! U y; s$ e7 L1 s. t-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)2 `" S% a% E! `9 C
-AX = 0912h (Get breakpoint infos)& f- o7 E8 X! \3 {
-AX = 0913h (Set Sice breakpoints)+ D6 N( B" x" {' e
-AX = 0914h (Remove SIce breakoints)
3 [8 |/ h9 [) Q+ O9 A
/ F' f4 O! n. e+ z1 X5 |Each time you'll meet this trick, you'll see:/ r& s/ E" V) n# s
-SI = 4647h# u" }: a. x% ]. C; {, V! c* ?" h! B; s
-DI = 4A4Dh
# g; [7 A5 X- J/ P. s& ^+ SWhich are the 'magic values' used by SoftIce.
& o- Z# r# I+ y: GFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.) M4 i9 j6 O% X$ ~, U& Q3 u
' W: C% \5 h" B& {$ x7 U8 G9 `- Y
Here is one example from the file "Haspinst.exe" which is the dongle HASP) T8 n0 b5 Z7 k0 R) \
Envelope utility use to protect DOS applications:' t; i. Q' T, n' t" A1 |
8 U5 N( Q7 A. [% _
4 i" F: A' H# F4 w. m s9 v$ h2 W4C19:0095 MOV AX,0911 ; execute command.
- [' P* C* G' M& ]% Q$ M. U! p. H4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).; ^1 [. n; x, K) g( E
4C19:009A MOV SI,4647 ; 1st magic value./ s1 x7 s% S: w3 ~" V
4C19:009D MOV DI,4A4D ; 2nd magic value.
. ?9 X! Z( |& s+ m/ @4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
( O- R4 o$ M9 W8 C+ J4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute; Y' s! g( f1 b% l U- F# t! X
4C19:00A4 INC CX; u+ d* Y" S8 g* F7 ~+ p0 G7 Q9 l
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
8 F5 k" |( a( H1 P* ^+ b4C19:00A8 JB 0095 ; 6 different commands.# g; v4 X# i* M1 ?* S5 Z7 f8 w& j
4C19:00AA JMP 0002 ; Bad_Guy jmp back.6 }: S3 l+ r9 I1 c. l
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
$ Y' S' H6 ?1 {9 c4 s0 a0 K# P/ h; ^; _; B3 B {+ z8 A5 E
The program will execute 6 different SIce commands located at ds:dx, which" W) e7 N2 [! D e) [% X
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT./ r; b( ~7 N' ^ a! l
1 E; M: l6 K% Z9 X# l: C6 q* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded. w8 X5 z1 y, {1 ~/ @$ t
___________________________________________________________________________
% b0 A* R* V+ ^7 p6 S' x$ N- Q. U, }! Q4 N' K Q
& P5 h p: n( ], v! f0 Z4 K
Method 03
) P. k. ~1 j+ [! H( }=========
& l% R4 g/ n8 C2 }2 L+ N; ?" j" Q/ B, @
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h, |1 G0 J+ {# J* g9 l+ ^$ P, h
(API Get entry point)/ V w, i0 ?* \* [+ X
$ a0 C* Q& k% X- e
6 [1 y6 o" a+ S. h- `9 d, ` xor di,di
5 U, T4 G, b9 z$ t! L' ]! J mov es,di
% ]- Q( o4 N! D" v mov ax, 1684h
7 \8 I5 ~* O; u8 l mov bx, 0202h ; VxD ID of winice
: r5 h% _* J' y2 r3 |; [ int 2Fh+ G% O5 Z& w9 I! m! S/ {
mov ax, es ; ES:DI -> VxD API entry point4 Q E# @$ y1 O& D8 f2 u+ q
add ax, di
7 B& \5 S, N# I4 F9 w/ h. G test ax,ax g/ C/ k- f7 p8 e& l ?' ?8 q
jnz SoftICE_Detected) o9 p9 h9 a& b' K$ |5 k
& S$ A o/ \7 T! J" `___________________________________________________________________________9 w& u& x4 C4 w) c6 ^( n) I
6 x c2 i7 ~- h3 L+ e- OMethod 04
; s \+ Y$ S! `6 V=========3 n7 B! V$ A1 z6 G
! u7 b, a0 t) d" x7 ^Method identical to the preceding one except that it seeks the ID of SoftICE
/ U! ^/ x( W w( FGFX VxD.) d% s- N' p) i8 K
/ ~4 l* C$ z1 Y, @& P# e
xor di,di0 W9 G7 I0 e) l P
mov es,di
$ O" X* f$ v+ G! i9 v3 J mov ax, 1684h $ y' f* I- A4 T; d% N1 `) R6 o
mov bx, 7a5Fh ; VxD ID of SIWVID
7 U# j- Z! |7 F5 s. b- P int 2fh
* H% t9 U* T. c% P) @ mov ax, es ; ES:DI -> VxD API entry point
) `$ v. U, ~: S! O# \; B8 W add ax, di
/ Q8 O6 A% `/ U test ax,ax) X' ~1 x! r, C* A3 E0 B
jnz SoftICE_Detected
( r. B \; `! s5 W1 c `1 Y# K7 N0 O+ Q/ V% I
__________________________________________________________________________
9 Q2 v! E& ?2 d! o
1 v0 L1 B8 O7 o) h
9 j ~: p3 W* b4 l* n) Y# D# I- fMethod 054 K' _' y0 L! w" T, k) X9 ?# \6 j2 c
=========4 o6 S: M# k! D
/ a. @- j6 r% X+ k
Method seeking the 'magic number' 0F386h returned (in ax) by all system# E5 i, m j9 p! M. L' ]4 f- V- G
debugger. It calls the int 41h, function 4Fh.% K3 }" c$ e6 N. G
There are several alternatives.
+ w- L/ _$ p2 W1 K* g9 W" J
6 `$ ], K* c) L( PThe following one is the simplest:7 p3 e2 A% a% |) y5 z& y
0 R$ s. h! v3 z( b4 H# N
mov ax,4fh& [* h9 G/ Q9 B( M% U i9 y C/ }
int 41h
3 B9 o! w% l+ Q& }, l cmp ax, 0F386
; L$ ?1 Y5 V' M5 l# f* Q, R6 q jz SoftICE_detected6 p' M$ j4 s i
1 k+ S( z+ f" o" Y
( g* z6 M L. h! j" _1 NNext method as well as the following one are 2 examples from Stone's 5 _1 m3 T7 F1 g
"stn-wid.zip" (www.cracking.net):
5 g. B: `; c t s5 {2 P* ~ V2 `, p( q8 z% y, v; V
mov bx, cs3 w9 X0 j' j& J+ U
lea dx, int41handler29 e, h& _, e, h m
xchg dx, es:[41h*4]& N. l& }: y8 ]4 J0 @7 C- N
xchg bx, es:[41h*4+2]
3 k8 o# E1 D: u. l3 @ mov ax,4fh P) k) O$ i. \1 ]
int 41h! @! J& G: a: ~; a' p; K
xchg dx, es:[41h*4]
0 k1 w% U0 a$ W. P xchg bx, es:[41h*4+2]
, g; M5 f4 z5 |+ O3 j2 t* | cmp ax, 0f386h
" \ ]! F/ w7 y* J0 z7 d( k2 t jz SoftICE_detected
# u: M% M" p7 e( v7 j9 c% T
F5 ], O; L& S. Cint41handler2 PROC
; r6 w$ y, f3 | {3 ^% T iret' a/ Y5 |, ?6 b3 x+ Z8 I
int41handler2 ENDP8 a+ N( k0 |$ X7 \
4 u% s/ ~# S/ }
Y f$ k1 w; P1 Y
_________________________________________________________________________
2 d) T+ O3 g: H6 I; G' h, ^* I$ s; ]" o& Q% f
' b* D& H' y* M( B+ Z" [0 y: d/ J+ D* ~
Method 06
& k% G/ e! B' _=========
) G+ ]0 M" q7 p) U& ? [3 E$ e" p( u; R% ^4 O/ g
2 j1 S& C/ B* x x. d/ M
2nd method similar to the preceding one but more difficult to detect:
. K, k$ X% H7 v( H& @! s' h8 H* r- j. t2 s
' \9 R4 I8 o' Y& M7 t/ @int41handler PROC/ `6 j7 M* |, B$ P' D
mov cl,al# ?* M0 n; J4 F; g: f: ~- g" f
iret
4 \3 }5 @8 F9 ?* v9 c( rint41handler ENDP9 L( I# l, O2 ?2 O8 o
$ N5 a# U5 B: B; w& A& d% Y% |6 a/ h1 D! C5 F1 q( i4 q) y
xor ax,ax
2 {# J+ `2 ~' W( R; y! W6 x; S mov es,ax4 b( ]: U+ h, N* y0 {8 h4 p% p& {
mov bx, cs- D" l1 X7 b/ [5 j& z8 ~7 i
lea dx, int41handler
2 \; Z5 `, z) S0 i. b xchg dx, es:[41h*4]2 w8 }: c# @0 X" ?$ E6 J# B
xchg bx, es:[41h*4+2]
" s G5 I+ [7 p5 U6 h/ ~ in al, 40h4 A/ w% U2 C Q8 M' s- I6 O% {
xor cx,cx* n* y, P) q( _, e
int 41h# x9 S, y4 B2 y' T
xchg dx, es:[41h*4]" d0 @2 X. o) I0 X
xchg bx, es:[41h*4+2]
9 P- n' H7 P( z/ j cmp cl,al
& p$ t+ J+ k, [' I- v0 G( N3 T jnz SoftICE_detected1 |% L1 F; @7 i8 U+ W; B! ` O P
' x, w7 R+ \ u9 @8 G
_________________________________________________________________________
! L7 Z( f1 m& }" l3 b2 v. H( L/ W0 J* y, _4 k2 C0 X# Q- F
Method 07
( H. Z+ F% Z4 E8 N. h6 O=========
' v) Y; Q- o3 v! M5 T$ X) l$ }
2 U7 o9 {; c- D0 [Method of detection of the WinICE handler in the int68h (V86)
: f3 Q' c! z4 T2 }. j; k) { _
" s9 @1 l& x) _8 y! s4 A mov ah,43h
, k7 m8 j9 k! K8 P( u: s% d# t* U8 X int 68h% B' ^* D( m: i& X" e! k8 r
cmp ax,0F386h0 O7 s/ c) d- c4 r5 U6 T' ~
jz SoftICE_Detected
/ B5 w7 z: P, f; s0 J+ G! t+ ?- b& z+ N% h7 D+ ~
8 q& P G3 F: i' n, h/ [
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit' {& U( ]0 l$ O& U
app like this:! |& z; ]: L& b6 ^3 g
* ]( ^/ X1 |: r* r
BPX exec_int if ax==68
# k6 x% A5 j8 [4 P; E& p6 B6 C (function called is located at byte ptr [ebp+1Dh] and client eip is
9 M3 U! ^: V B/ u3 n% | located at [ebp+48h] for 32Bit apps)
" O: l2 X- }. n) |" P. d2 l__________________________________________________________________________( j( Y P8 k, Z! _% R1 b
% L& P! g! Q6 l' f, k" {: V, E( w% Y$ Y3 t: \" K# b6 T( T
Method 08
. D1 g. m8 p4 ?- v% [=========( i, h0 {9 _) m( L8 g
- J7 k- ]2 f8 x4 L! f3 J- EIt is not a method of detection of SoftICE but a possibility to crash the7 v' Q S- R3 k0 Y' [6 n
system by intercepting int 01h and int 03h and redirecting them to another
3 Q, \2 J {' t* o6 b, |1 H; eroutine.- P& f0 y% _* A# V1 X
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
, P; i/ t# r$ \% ?: Fto the new routine to execute (hangs computer...)
9 O' @% S3 C. L8 l! o) [. |+ q$ x" v3 N7 K( Z. \6 m# R
mov ah, 25h
0 z* d7 L0 ]* G0 c7 E mov al, Int_Number (01h or 03h)0 p# I* x6 O; N
mov dx, offset New_Int_Routine* B' L" a6 W$ Z3 i8 n5 S; S+ P" [1 U8 M
int 21h% N: d; ]8 t H0 m4 w7 F- D
: b( T9 _* p" \ g1 C& r
__________________________________________________________________________
6 F# S5 Z! I7 ?9 n. t S) X$ L& \3 j. C! v2 t; f5 X
Method 09
) E2 a! o1 b5 K/ O=========4 S! {; i: p1 z7 k0 @
4 n9 T" Y) h( b0 EThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only2 K3 b! n' r/ T) O9 T+ V
performed in ring0 (VxD or a ring3 app using the VxdCall)./ R3 H9 d: I n V f% k; a
The Get_DDB service is used to determine whether or not a VxD is installed
, V" S1 l1 p) v# ]for the specified device and returns a Device Description Block (in ecx) for
/ }( P5 \$ }, p1 F0 W t* Ithat device if it is installed.
4 ^' c7 A2 R& T$ L5 q6 ~
% g% T/ w: x2 _: ^- T mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
5 `! K( c3 e& I% Z3 a1 T+ Y( x mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)& P; ~, ]- x/ o& g/ } D8 Y
VMMCall Get_DDB* ^5 Q$ {1 M$ R* I
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
2 Y& S2 M% D( v. C/ X' v7 z5 Q; @3 a* F
Note as well that you can easily detect this method with SoftICE:
2 |% i% x: }, \* V8 F4 O bpx Get_DDB if ax==0202 || ax==7a5fh
- }; H4 x) s6 d8 q! Y% E: x+ ^; U8 I- U; A' r
__________________________________________________________________________
8 \( W7 k; R0 C" |3 i
( I: I4 Y% u5 i4 i$ e6 Z" OMethod 107 I8 I" r$ {4 ?
=========; _ o0 Z4 ]' K9 T; |
7 X7 ?, [- Z: g( l( d
=>Disable or clear breakpoints before using this feature. DO NOT trace with6 a# b' b! v' e2 ]! R
SoftICE while the option is enable!!
, u& P7 R- j( {, F. T7 k. S
4 o& l" J' R# _# {This trick is very efficient: I- h; j6 p, {3 `( ?# F7 w
by checking the Debug Registers, you can detect if SoftICE is loaded
) i ?1 \, u: `, x# q5 N0 y(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
4 C+ @& ~/ R7 j, Ythere are some memory breakpoints set (dr0 to dr3) simply by reading their. p2 _) b( g9 ^" b
value (in ring0 only). Values can be manipulated and or changed as well
, {- b- N3 c: c( j(clearing BPMs for instance)
' v$ |8 ]4 L @; y9 M- X6 f
/ k3 n: o' u1 G__________________________________________________________________________2 w# |% }3 K: S- q# V
# y6 |- ~* O* D$ E* MMethod 11
5 c" V( k1 t# D% C [) p=========
5 \6 D: P+ w, I7 J. [
% `, ~' A p0 M# n" P3 JThis method is most known as 'MeltICE' because it has been freely distributed. N# ^1 z @ O" K# z
via www.winfiles.com. However it was first used by NuMega people to allow3 o( c7 @) j" m# r& e) C! F
Symbol Loader to check if SoftICE was active or not (the code is located
7 j! B( o% D6 I9 T3 s1 i! Tinside nmtrans.dll).4 |, ?7 J+ S" d9 z5 J" ]4 [
( |0 K7 Y: _- _% d: D1 z8 @; E
The way it works is very simple:
* V, M# X* o6 A9 e( q. Z" g1 zIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for2 j- y" C7 F+ x2 D( j3 M
WinNT) with the CreateFileA API.4 x5 Y# V( q' H7 Z/ {# i8 k$ ]( L
! _6 h7 ~" Z5 @# P, g* _* NHere is a sample (checking for 'SICE'):
2 S$ n. j$ T& l; {+ D
0 j" f" |0 b/ G/ }2 r y. P2 \( XBOOL IsSoftIce95Loaded()+ I5 U1 B- e, g
{
6 |% S. \$ h) _9 c" l7 S HANDLE hFile; # h* l5 ?$ ?6 ^3 ]$ `$ g5 W
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,8 W" C/ C P2 }% Q6 J9 f9 n
FILE_SHARE_READ | FILE_SHARE_WRITE,
7 ^6 R; u0 X. A0 I6 B NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
* h4 E( b1 K7 C/ j if( hFile != INVALID_HANDLE_VALUE )0 H: l* O7 z: I+ v2 x1 g
{+ n. z" p' `( d& k8 h
CloseHandle(hFile);1 n+ ~0 W; A+ K/ f# Q$ E0 x8 [
return TRUE;
1 |' E6 C; V4 M }: E8 q+ Y* o- r; h8 {
return FALSE;: A/ C! r M* ^% ^3 B1 B
}
/ l0 b& ]% j a: T' L) h2 Y) S5 \! l5 h. E/ N. v3 a; X1 I6 a
Although this trick calls the CreateFileA function, don't even expect to be
% t$ q' }6 P: `. t; `7 Y$ sable to intercept it by installing a IFS hook: it will not work, no way!- G+ I o! m" k, E2 i- o8 L
In fact, after the call to CreateFileA it will get through VWIN32 0x001F3 n. @3 U& k, a3 C. y" g6 @
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)- R6 n' X2 v3 `3 f8 f' M
and then browse the DDB list until it find the VxD and its DDB_Control_Proc# |2 [, q7 C0 f. V% d; F: B
field.
/ M6 j6 |4 M2 _* W2 Q, zIn fact, its purpose is not to load/unload VxDs but only to send a , H k6 w8 d& k0 P
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
$ G7 t2 Y s6 d1 Vto the VxD Control_Dispatch proc (how the hell a shareware soft could try
6 A" t$ ^, U3 F& b* A% o: Y! W+ lto load/unload a non-dynamically loadable driver such as SoftICE ;-).
4 G, ?: N& ^+ q0 N& _: u, ]If the VxD is loaded, it will always clear eax and the Carry flag to allow) W3 f, ^, W8 _. B
its handle to be opened and then, will be detected.
0 {5 z1 r3 u6 h! Y w- YYou can check that simply by hooking Winice.exe control proc entry point# \" \5 I4 w* J6 c& I
while running MeltICE.4 N; m5 m6 g% |" Y) D
* X4 `0 V; N; m; H
; \( W7 r+ b$ y" {' t+ C4 Q 00401067: push 00402025 ; \\.\SICE
9 a; A/ w/ M8 l3 W( F; y& K) x 0040106C: call CreateFileA
# M, n) Y3 \$ `9 }5 x* P1 x 00401071: cmp eax,-0019 T3 c0 [ B0 w2 A5 ^
00401074: je 00401091
: ^3 W. ^/ ?+ x: U5 i- {- k+ f
# J* p, U. U4 n
There could be hundreds of BPX you could use to detect this trick.
6 a# f; T9 R8 K0 p+ _-The most classical one is:) O q% V" J" U
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||1 o9 s. n3 N# C9 ?. w. [* U& b
*(esp->4+4)=='NTIC'
, d7 n* q' p2 W5 @/ e6 e v" y3 c0 K* U5 ]( G, X. |6 A7 Y
-The most exotic ones (could be very slooooow :-(
) _9 y) `) f, O% X* r BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') 6 z# P y- M2 [0 @9 d
;will break 3 times :-(2 L Q5 v) y/ X. ?+ c% H
& ?* e+ S" v1 Z-or (a bit) faster: ( D% F9 l+ N) G/ S0 P
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
. Y7 N& Z& L8 t, w& D$ J9 b: ~8 r& {- m0 ]
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' ' P2 m1 |4 l7 z+ R
;will break 3 times :-(" i, t1 j0 n1 X7 y* x
9 ~( Y* A- k, p
-Much faster:2 @: `6 |3 `. W o8 y0 k* B
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
4 S' |* i" ?8 W1 V$ ^* [5 C; G6 P3 v* k7 k1 N
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
' n) `! C- ?% G- G# mfunction to do the same job:! j/ a. f' b4 {. I( q& e6 s
7 D8 O7 ]+ p4 l$ C6 h r% ~ push 00 ; OF_READ
5 D6 K6 |* [# s0 v7 D mov eax,[00656634] ; '\\.\SICE',0
T: t# k; i2 O push eax
]5 H$ j! Z2 | call KERNEL32!_lopen
. U7 {0 a* \% l3 W5 } O inc eax
9 Y5 S( t5 a2 H6 ^" _( G jnz 00650589 ; detected! E" S6 |/ c7 x, l. q" f6 m4 r S1 K! _
push 00 ; OF_READ5 K2 a( D# F* b$ \' z( L
mov eax,[00656638] ; '\\.\SICE'
6 @, n0 n1 w0 R! d x* ^# z push eax2 x( z8 t$ R, q2 e+ K
call KERNEL32!_lopen
3 v! Y; H ~ o- P- C+ I4 X inc eax# |! |2 @2 T+ @7 k0 B' o# [
jz 006505ae ; not detected
# A6 b& K: E. ?; E' z/ e v
0 L0 p- B0 r7 i2 I9 @ c3 i, `) |/ x) s, P
__________________________________________________________________________5 F( B, V, Y( H4 F3 T" W% N
5 e% _. T9 R* ? y- {5 gMethod 12- \+ O4 H+ j4 ~
=========
' m. S: u3 x, O+ O( R+ {7 K
+ R1 e; K5 V7 ?* k' u- M) aThis trick is similar to int41h/4fh Debugger installation check (code 05
( K v* _& Q0 N8 ^7 s: m" T& 06) but very limited because it's only available for Win95/98 (not NT)
4 g% Q% M" K- ~8 x" x' a: }0 Xas it uses the VxDCall backdoor. This detection was found in Bleem Demo.
# j7 i* I: W z
! z7 X2 k9 }( n5 M0 r push 0000004fh ; function 4fh* }/ F9 f# @, q* b) i6 n) z
push 002a002ah ; high word specifies which VxD (VWIN32)
; F3 G9 k. a" ^8 Z8 T ; low word specifies which service! [0 `1 @- g- e) W. p8 i l
(VWIN32_Int41Dispatch)! {& [; Q" w3 J+ h
call Kernel32!ORD_001 ; VxdCall
6 p6 E- b0 M% ^$ V cmp ax, 0f386h ; magic number returned by system debuggers! [! Y& m, T @3 F* P6 _
jz SoftICE_detected( P ?) n" B3 C0 F+ u/ k7 N8 L, ?' b
6 d8 [: c! `. e8 m! f4 oHere again, several ways to detect it:* b; b8 e& H, p: @; C
; R. Z p8 L+ O6 c2 y. W BPINT 41 if ax==4f& U. e A, u: c( I
4 w7 I) A8 l. d8 u
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
/ m4 c. W p3 L& L. b/ ]. T$ j6 h# q* M4 |
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A% z C* \! I2 {7 q# h
3 }+ _1 h4 v9 T3 \0 t7 q( |
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!9 S' m+ d& q1 ]) o0 D
; q6 E, _) R* d2 U- O; ~
__________________________________________________________________________" d/ L; A2 {' s9 ?7 e# h4 ^. x5 ]
) L0 V) V/ M# MMethod 13
! U7 O' i: m8 [1 `( ?=========
E+ A) ^% ]8 @ ^( i0 B6 Y m& S: P% d" ?
Not a real method of detection, but a good way to know if SoftICE is
, ?4 U1 \1 m+ Y+ |3 F `installed on a computer and to locate its installation directory.4 ^6 j4 W% o0 G6 {6 z) i
It is used by few softs which access the following registry keys (usually #2) :5 W+ q0 a1 o8 H; `+ {5 g/ ?
/ [ |6 S0 N p3 t* x+ M
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion; |; Q4 V: U/ j, j# H8 ^6 z
\Uninstall\SoftICE
* n4 t( B5 n6 z7 n-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
; D2 d' o7 c- t" t( h6 S" c-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
3 F* Y6 \( t1 I, Z8 f \: u( ?$ u\App Paths\Loader32.Exe! t% H1 T; g4 c: x
9 h' r, N% T7 c2 u9 v6 C% q& V2 N
Note that some nasty apps could then erase all files from SoftICE directory
3 \6 O+ g; P/ z, P1 q$ U; Y(I faced that once :-() f1 g) }7 w$ ~
8 m& }" f1 g* s& j6 ~" jUseful breakpoint to detect it:3 d7 e7 Y9 V6 Q1 \
" V5 W. q- C( u) W% l* u BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
5 a. L4 {/ S& H* i/ a
1 P' ~9 @$ P5 U1 o" C__________________________________________________________________________
) [. k+ t) }' _2 i! |% V, }. f ]" q
* F' p4 O% J# w9 [( z. F5 N, n( \+ `6 e
Method 14
6 |8 e. }% G7 q=========
/ z0 T7 u- f8 a) g0 L# V- m" |- c% S
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose, y" o) h3 U& N, h
is to determines whether a debugger is running on your system (ring0 only).6 s0 G1 p) E" g! j
/ X/ j# f, k+ a9 l
VMMCall Test_Debug_Installed) P& |7 j( u; s$ K; _" Z6 X
je not_installed) I0 \6 j0 x% e4 F' Z
/ ^' y1 Q$ {2 ~% u) dThis service just checks a flag.# X# g5 \! o" e: p( q
</PRE></TD></TR></TBODY></TABLE> |