<TABLE width=500>
; A6 @; |& G/ [4 M<TBODY>2 l& K' L' y. q# F, Q
<TR>
- S- m& J) u4 x5 \. D<TD><PRE>Method 01 6 H5 M. y5 m; q
=========
, [* w) K/ B( c. \5 q$ ^9 i' o) j6 b `: }' }" @( Q/ l
This method of detection of SoftICE (as well as the following one) is2 U1 n; d& |. h( E, y
used by the majority of packers/encryptors found on Internet. j' ~9 T; o7 u+ _2 D$ ]1 ?5 }
It seeks the signature of BoundsChecker in SoftICE
9 J/ C d( r4 |' o( [' Y8 s1 O) t3 `- n5 `! x0 I# R7 y, L7 M! K
mov ebp, 04243484Bh ; 'BCHK'2 N# X( K* S! ]4 ]4 m
mov ax, 04h e# ?( X& G# R5 H, K' F
int 3
9 n9 n- ]( E+ n cmp al,4
) P; H; o/ h3 z6 S2 H! K jnz SoftICE_Detected9 Q2 y2 W$ \4 w* i: ?
. e& b' ^7 M# _0 h7 u+ c8 r___________________________________________________________________________" O6 N% W% }+ E* B, r2 p1 W7 p
; m! y# @- v* H$ }# S, w* vMethod 02
9 q5 m4 V, X4 E* W=========' G' K) Z$ f1 k% q
1 F, l& S! ?% b) U
Still a method very much used (perhaps the most frequent one). It is used6 I! |! V; Y7 ~- U7 |
to get SoftICE 'Back Door commands' which gives infos on Breakpoints," B$ o4 J) W% u
or execute SoftICE commands...3 v! T$ m; m, |' {; ^
It is also used to crash SoftICE and to force it to execute any commands
2 ~$ l. a$ a% P$ ^6 u& L4 @5 U(HBOOT...) :-(( & G% R7 F# l/ C' H2 S6 Y
, L& A0 L, C6 V6 vHere is a quick description:" l# V" Z+ [5 x' I( L" b
-AX = 0910h (Display string in SIce windows)/ ~6 p* q! j% P) o0 O
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
$ A; I; R- S! r% z* R* g8 c-AX = 0912h (Get breakpoint infos)
1 d" E9 Z, d1 [9 @# Z-AX = 0913h (Set Sice breakpoints)
. P2 p* D/ F# V, T-AX = 0914h (Remove SIce breakoints)8 q" @: W7 }- R1 q9 P. f
6 Y" W' z/ V+ \8 Q. ]* F. pEach time you'll meet this trick, you'll see:
4 H, r, _" ^1 _2 X; Z% X) u) W-SI = 4647h
7 z1 W; }; A$ X* f-DI = 4A4Dh5 M9 q7 `. h0 B: U. U7 K/ f2 s- w
Which are the 'magic values' used by SoftIce.4 }6 V2 D; O3 z# i+ h8 Y* J
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.7 L1 w6 D$ O+ D" A2 r# `
& f" ^4 ^: N& K8 e
Here is one example from the file "Haspinst.exe" which is the dongle HASP- i8 G: [% B( X' z6 Z; K- u
Envelope utility use to protect DOS applications:2 ^0 E. B7 Z7 \. W2 _/ G- b
1 k) C% S5 z& P& w, _: F
a E w! k" i4 j i0 Y f5 y1 Z4C19:0095 MOV AX,0911 ; execute command.6 `2 p* j8 z7 _0 F3 Q# N( d
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).( J. N' I7 b. k% A6 F- D# E
4C19:009A MOV SI,4647 ; 1st magic value.& x; ]2 [. f. |2 P$ { y0 Q- ]7 R: z$ C
4C19:009D MOV DI,4A4D ; 2nd magic value.
4 G2 a* T9 L. [$ V! c# I4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
9 M+ A2 Y( c* t6 F9 p, h4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute/ M, x G1 b/ c4 t& _
4C19:00A4 INC CX
8 v7 W! k/ _( M4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
- {, @0 I" j# }* n" U& N: n9 ^8 L4C19:00A8 JB 0095 ; 6 different commands.
% U' z8 ~/ ~3 F4C19:00AA JMP 0002 ; Bad_Guy jmp back.7 b y4 o1 ~: h- q% k
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)9 s, ]5 x) h6 P# K6 k
! B( e4 @+ A/ Q, OThe program will execute 6 different SIce commands located at ds:dx, which+ X$ x# ~) W5 {& e7 I& T
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.( j0 L" _7 R7 x
$ P3 z2 n% b3 e% N0 k* `: i) n* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
) s' S; T. r9 P. B" Q___________________________________________________________________________4 L$ B3 W! w) a6 c! U% T; `
. f3 g2 t) H- O4 e8 T5 r
; r# H- N' l' U( I9 q hMethod 03
5 _7 O0 |! U) X/ e=========
) Q5 L, p! ]" ~' _( s" a& j* ]4 x& y1 k! P% b, |
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
4 c/ X( j! P- ~2 ]3 R. J. f(API Get entry point)& _9 s1 v5 f0 ^+ P) \' B# y
. \# U7 T9 G8 J" b$ f
3 `/ f* \# n! L% v3 o xor di,di8 v7 r$ D; H3 G" K
mov es,di7 J0 \0 r& c' U
mov ax, 1684h % s6 Q8 N9 V) {5 h, G
mov bx, 0202h ; VxD ID of winice# ^- e$ i, U$ N& c; o0 n) J
int 2Fh) U0 T+ f$ r( c3 f. Q: M$ Y
mov ax, es ; ES:DI -> VxD API entry point
$ K' z% A$ C4 V% D) K! ^( X$ ^; E add ax, di# x [- R j4 K D) Y
test ax,ax9 x" c6 h5 D* n6 S& w4 o) l
jnz SoftICE_Detected
. i Z. M5 E" h0 N1 u# w4 o# }0 c' t+ ~& [6 t
___________________________________________________________________________
4 h5 _ B2 U, A K9 a
# a4 z6 A" \( ?4 S. `1 x1 C3 s) YMethod 04
! m$ B- l$ A$ S# t=========
7 b T% Z' ~9 e( F4 Z$ m2 n) I8 ]2 |
Method identical to the preceding one except that it seeks the ID of SoftICE2 h5 I$ {% f9 Y% @% q- t
GFX VxD.
$ c# M* P! _7 _0 z4 H# B" M/ C
0 }# `0 i. h" X) @1 S& P# X: N2 I! l xor di,di
1 d, e( {0 @2 K0 |, x! s mov es,di
$ H+ Q8 h) a0 ]3 D mov ax, 1684h * f) k. C; Y5 G! `4 c) H7 M& p
mov bx, 7a5Fh ; VxD ID of SIWVID, b' a M( E2 g4 o
int 2fh0 k/ o& F. H& [# Q- I
mov ax, es ; ES:DI -> VxD API entry point7 p$ r5 U& ]: p
add ax, di
! l8 a* v1 ^$ } test ax,ax# o7 J, l2 K6 s7 s
jnz SoftICE_Detected# n2 T/ m4 D3 p$ c7 D. F
% L: \, D6 S/ X; ^* ?__________________________________________________________________________
) `9 o0 [% [# y+ q& _, O, D8 Y6 {5 V& p& j
+ G1 O% ~5 h; n- cMethod 05) w* I; y8 T/ r" e
=========. h# W7 f+ D/ S+ Y! f
: L# k+ R" f8 h2 _$ ^Method seeking the 'magic number' 0F386h returned (in ax) by all system
0 |1 p( }( \! ~1 i$ R/ Edebugger. It calls the int 41h, function 4Fh.* ]% z2 O1 i6 R0 @; f" i, U
There are several alternatives. 4 A1 l' h9 u3 \5 G W$ x, \
& k4 h8 p" C, K1 Q I3 x# D' Z! b5 qThe following one is the simplest:4 [5 L1 m/ _. \1 t2 l: ]
. F6 c" b' r' H$ R mov ax,4fh8 l `, | ~+ f) Y( Q* _
int 41h
! Z* \$ W6 R- q* m2 h cmp ax, 0F3861 q# ~ H1 g/ e5 v
jz SoftICE_detected
2 c; V A! N/ I1 s& o) w# o
: I& ^. ]. ]9 ]6 ~! x2 ~; ^; P' m& p/ }/ K* ~
Next method as well as the following one are 2 examples from Stone's 9 o( N) P- l. f3 V1 W6 T% ?# ]
"stn-wid.zip" (www.cracking.net):* p$ m% s4 B" C1 Z4 w: ?* J# I
/ p) [/ j& c g [; ^5 j
mov bx, cs% @8 [" y) Z; A' ^: D s; i
lea dx, int41handler2
, j, G; _8 w7 B& G( C1 R xchg dx, es:[41h*4]
9 K: z8 r' V: E) o4 M0 k& y: Q' r xchg bx, es:[41h*4+2]
+ }3 r7 |6 u6 c9 I: G9 n& P$ S4 E mov ax,4fh
/ J5 _. a" {( k8 w2 a+ {+ u3 H3 K int 41h; `2 a: F7 |7 A# Q' D
xchg dx, es:[41h*4]0 K3 `+ s6 r* A/ s* B
xchg bx, es:[41h*4+2]+ _: k; V9 r6 Q' x: O: {7 [) r7 p
cmp ax, 0f386h. r9 z! S( k; I4 I/ |
jz SoftICE_detected9 m, @+ ^* T9 C, d& d3 P
& x1 `6 E. \ O2 D
int41handler2 PROC. n/ g/ o- z/ Q
iret
4 n* v. X& C" U& r# |8 X( |& Bint41handler2 ENDP$ U& w& J+ U$ ]; P& Y
! v+ Q9 h/ z9 k' j% y+ A X+ K e, }/ h
_________________________________________________________________________& L6 P6 Z; A& ?
: K. a: ?: w# Z
3 m6 @' [" q |) W
Method 069 X" i2 t. H, G h( H, _# t
=========* b; F3 \4 I5 ` E' {
% F6 ^8 a/ w r5 ]% S5 T2 I$ D. S0 z$ E0 W
2nd method similar to the preceding one but more difficult to detect:/ e* e, F; s/ m1 l) v1 s$ d6 I8 k, |
! |4 O E5 `8 c: p( ^0 y8 H/ w" ]$ W% [: R' _4 ]) k( S) d4 `
int41handler PROC' V9 `) h3 E6 H7 S7 y, v
mov cl,al
' ] v* z" p6 j iret
" N; u6 I' f4 M k- |) yint41handler ENDP- ~: u3 z" d8 m$ q) C
! E5 M- J* q. V4 i2 g) r
+ f2 { z) H* g7 w4 M+ E) x! ? xor ax,ax5 A; L Q2 G4 c1 @* M- E
mov es,ax
, w1 E( W+ B; n# { mov bx, cs8 l) m! t0 Z- ~% t1 f; \/ z& A$ y: q
lea dx, int41handler" _4 U+ V. q3 r' t: ?" H
xchg dx, es:[41h*4]: g' {0 I- d2 A3 h
xchg bx, es:[41h*4+2]$ l! f! S7 f3 ?" z8 {3 s
in al, 40h
3 z. M( p1 G ]& Y& h" x' J xor cx,cx: a" R7 c% }4 z5 r
int 41h6 s- C8 z: p' t$ ^' [5 c
xchg dx, es:[41h*4]: M7 P% n; H2 C! K
xchg bx, es:[41h*4+2]/ l u) c& m3 E0 y" _, s
cmp cl,al' `# k* m8 I! H1 Y+ [
jnz SoftICE_detected
" Q' W1 X2 W" u+ K& X! w. L
6 Y/ J b& Q! B8 C! P! ]_________________________________________________________________________
5 W& {& F9 {. p) u
* ~+ T# M0 y5 b* g+ D. NMethod 07
. V1 m7 t J* \; P=========
; V1 T4 ]+ _. r
; A0 _' Y* C! z7 h# B8 G6 n' VMethod of detection of the WinICE handler in the int68h (V86) G0 `$ i% a7 o% K6 s0 J
7 C* R$ G; u: a. N
mov ah,43h
3 I: n* c3 T9 f& N0 H2 k int 68h, P. b5 c1 W0 P4 z( J3 t
cmp ax,0F386h
E( R& B; n0 _5 ?3 a B* B jz SoftICE_Detected# i/ `9 X. L2 p$ b; Q" `+ f
% a1 Q. Z4 Z! \
6 I. M5 p! p- I6 u6 t) E8 j' m5 l1 Z* V
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
$ @! [# s- B; ]- h9 F/ n/ J+ e* s app like this:
# h8 Y9 L5 `! Q) s
+ E) r1 m$ E8 }% K$ D I' S" r BPX exec_int if ax==68, _ _4 D. l8 V2 {, ]
(function called is located at byte ptr [ebp+1Dh] and client eip is
( c4 r5 I& j6 d: K3 \) q0 V located at [ebp+48h] for 32Bit apps). ]2 B& Y( q) i' {& }4 u
__________________________________________________________________________
' v: Q8 A& ~/ y+ ?9 k! A9 N# R8 |* h# x3 A) X. F7 P% j
: e Y$ |6 x9 o9 QMethod 087 a6 p9 b0 }8 e V' Z% _' P
=========
" s! d s* C. F N
4 _; \) Q7 g5 p. x# K: S8 H( pIt is not a method of detection of SoftICE but a possibility to crash the. R) ^; R9 }$ R. j3 S0 J4 B! Y
system by intercepting int 01h and int 03h and redirecting them to another; N% Y8 \* h2 l( q
routine.4 {4 T4 k& U) e, j7 W
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points& J9 ]9 w$ r- T) W1 P6 m/ U/ \ ?
to the new routine to execute (hangs computer...)
/ K4 d- Y. W* v2 J# R6 w% I8 P/ _* c: e
mov ah, 25h
6 m: ~: `; |: _ mov al, Int_Number (01h or 03h)- ?1 v7 Z' F, F* ?1 F
mov dx, offset New_Int_Routine
# k- t+ J' @2 ^, A, j* H) u; i int 21h
& U. |' J3 Y# K* s3 i
|) B- ]' ]: g8 g' l" ___________________________________________________________________________7 [8 d# u( E' Y. B2 g' _* P# K
% K& i, c _. {1 o
Method 09" ~1 G8 Y* O0 o' A' J$ _
=========$ J$ o% A3 s/ F6 r4 H7 A" J
8 g5 ]1 m* T5 D+ W6 \
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
2 m( i1 `3 y6 I6 u! Jperformed in ring0 (VxD or a ring3 app using the VxdCall).6 h4 b. x. E- @5 w7 y" t
The Get_DDB service is used to determine whether or not a VxD is installed
/ ~5 ]- B) h' s% w0 [# Rfor the specified device and returns a Device Description Block (in ecx) for3 u3 g6 V% q4 o* N1 D
that device if it is installed.
/ {" \. ?0 z7 D" y4 k n8 R7 V5 Y( T; [$ g
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID4 V' L. Z4 J' H. T4 ?
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
" {( C7 V7 L! B. l) b% h) L VMMCall Get_DDB
b( H6 B0 B, w) s" o& r mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed1 q( `; e+ u- {# O0 o1 w
# B9 n: L- S9 `2 B; b/ v dNote as well that you can easily detect this method with SoftICE:
3 j$ P& C$ p$ Y" x2 {% n% `4 n bpx Get_DDB if ax==0202 || ax==7a5fh4 w' M3 ]7 e H, [7 X+ _' u, Q) _
/ p8 B; n1 P$ J& W4 m__________________________________________________________________________$ {" d. ]$ Q% H- N3 G
/ r* M) F5 Q7 _, T3 B# l+ p8 rMethod 10
( l) r1 x& E9 w8 l7 v( y$ B=========
6 U$ U9 Q2 y, G) Z
. R. ]: A# O$ b=>Disable or clear breakpoints before using this feature. DO NOT trace with
+ ^; Z( w$ {% B& y SoftICE while the option is enable!!
b. h* a6 }# o7 }) @; Y8 U7 H9 k# [2 ~
This trick is very efficient:: M& v7 @8 `1 J& h% a$ i" {) n
by checking the Debug Registers, you can detect if SoftICE is loaded
- A6 p. U9 p* u(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if$ g2 ]0 U( b" ^: F5 u
there are some memory breakpoints set (dr0 to dr3) simply by reading their
. R' H, c J6 M9 @- U! ]value (in ring0 only). Values can be manipulated and or changed as well' f2 J( O+ x* }) W7 Z7 @% j1 V8 s, L6 n
(clearing BPMs for instance)
( @$ U8 p: A# ]7 b. d4 h+ p4 [ r/ U/ x! z% `8 ^4 p
__________________________________________________________________________
8 `2 ?/ A& [: X- B! W% V {$ T$ ]% R
- n ]5 P5 [4 w2 T+ AMethod 11' \; C. y' p3 r1 k/ V4 L
=========
. x/ g* S) n2 Y1 y5 g8 u+ v: ^ a7 O1 x; N. f6 V. i
This method is most known as 'MeltICE' because it has been freely distributed
0 d; H5 C6 r4 q9 i9 r/ O) Pvia www.winfiles.com. However it was first used by NuMega people to allow) X; M& c! W, ~4 Z& z
Symbol Loader to check if SoftICE was active or not (the code is located8 T+ T( M% f, v
inside nmtrans.dll).2 ]: Q1 s( ?( d7 b5 x" _+ X1 A& U
5 L# `. B: o+ |2 H7 l. _
The way it works is very simple:/ R( c$ F% A% j
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
W0 |' g6 {" |/ Y2 ?3 m/ yWinNT) with the CreateFileA API.
# j* x+ P x! w7 G' W& C! G
! k3 C1 X" K7 q& G0 s. m; eHere is a sample (checking for 'SICE'):1 P, t4 C' ]( ~4 S, Y! t# l
: G3 \/ [* u4 }) hBOOL IsSoftIce95Loaded()6 ^/ ?0 y) _0 F# f( L
{1 n$ y9 s) a4 A1 c
HANDLE hFile;
7 r6 E& x# I4 u hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE," U7 b' K) e4 q4 J5 `
FILE_SHARE_READ | FILE_SHARE_WRITE,2 D' [4 t' j1 g" A/ U3 U" |, E
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
( o7 I' Q* R ^" R- |& n' | if( hFile != INVALID_HANDLE_VALUE )
# A2 P U4 o1 ?3 f- O U {
' c# I6 M! ]/ d0 } CloseHandle(hFile);
L8 Z1 e: T9 p: ]7 T return TRUE;) Q W( }- i2 O7 X" _
}; w0 {" _% R' I4 u( S: |& N" f. y" b
return FALSE;
0 O# E4 s; J _5 n" ^}
) ^; @0 |8 _8 c8 W
, } k* X# E- ~Although this trick calls the CreateFileA function, don't even expect to be* i; ]2 K+ n2 I# H/ @
able to intercept it by installing a IFS hook: it will not work, no way!0 D( u+ W% T3 L& i4 w
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
+ o2 J7 @7 A; w n) }service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
9 w- a4 u' D3 f; W. N, Vand then browse the DDB list until it find the VxD and its DDB_Control_Proc
+ p$ o; ~6 S' C$ Yfield.0 X p4 |+ s: l- o2 ]
In fact, its purpose is not to load/unload VxDs but only to send a
# _/ h8 H% m5 V, X2 M* cW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)! @ t4 V: ~1 v( T
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
' j- J% t( c2 I& Pto load/unload a non-dynamically loadable driver such as SoftICE ;-).
' s& U4 ^9 I1 E* P* v* a5 jIf the VxD is loaded, it will always clear eax and the Carry flag to allow; ]2 {3 ^1 Y* M. g. |1 T4 A
its handle to be opened and then, will be detected.! \8 W8 [: q+ S, }
You can check that simply by hooking Winice.exe control proc entry point |6 W' e/ H: e0 h9 O
while running MeltICE.7 a# n" Q+ @: x, Q
9 {. ?( k# A! g2 h
( M$ M$ n7 T Y5 r* F+ u 00401067: push 00402025 ; \\.\SICE( c _7 {0 {0 q0 H2 Q# t
0040106C: call CreateFileA: }$ }$ G; b! q; T+ U+ ?! {7 w
00401071: cmp eax,-001/ F% l5 {, ^" b: `
00401074: je 00401091
* m; O" ?. ~, f1 p5 Z" [6 c) Q/ @) e# R* p- r
+ c+ Y7 P& |& {, V2 L
There could be hundreds of BPX you could use to detect this trick." M3 E) N: }9 A4 a1 |, T
-The most classical one is:/ [# w8 r$ p8 Y
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||1 Q. o0 M4 G, N, J5 {4 t J
*(esp->4+4)=='NTIC'
1 {5 H; c# g& ]8 D% h3 w1 e+ S- y6 K) V( s. n# A& H
-The most exotic ones (could be very slooooow :-(
. D% V4 ~0 c, V# v BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
/ |1 g/ g5 I8 Z! q- a ;will break 3 times :-(
( d* a! j! X' Z6 B( H" z- j0 v6 J: F x6 A
-or (a bit) faster: 7 H9 I! A& ]' C* g
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')0 O9 |, l. m/ }' M
& C, [5 X6 L4 k- V
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' 8 \' c" x( j$ `2 y& U t% v
;will break 3 times :-(# f, P' u8 Z8 W5 C2 N
& v9 { n5 o: B$ c# Y
-Much faster:
% f3 r, a! u: E$ C" Z F1 h BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
, n: b7 A; G8 v; H4 ?
! g1 v( ^6 S2 b/ O. p; B7 P& U9 ]Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
& L! I F4 B5 mfunction to do the same job:
6 V4 t2 w# i. |( P% j
* A6 M- t U0 i5 D* I+ L4 ]+ ^' F push 00 ; OF_READ/ _7 d5 y9 `/ S+ w
mov eax,[00656634] ; '\\.\SICE',02 p% c4 { g9 j5 c) }' V- w
push eax# r v$ b% i' Q8 f" _
call KERNEL32!_lopen
5 \0 J! |, g! a ^. A inc eax3 R& ?* w' u) V' n3 O
jnz 00650589 ; detected! k! E# c* l! h9 R
push 00 ; OF_READ. e" J* K: A/ g( I4 ]2 t: S, C3 J% H
mov eax,[00656638] ; '\\.\SICE'5 _" Z: A3 N* @2 D w: r% @
push eax6 z* p8 W# M* d5 }6 ]( B
call KERNEL32!_lopen
! V: H0 b- n& r4 Y1 L6 N inc eax p- f7 X% l7 x0 |
jz 006505ae ; not detected
: F; m7 V% P* R- Q+ `4 c
9 g* ~* z5 s9 \0 }( t, |' [: i4 ~+ }. b' t- {5 G2 g& |3 |: V0 i
__________________________________________________________________________
% y* r9 z/ ]+ m$ R4 k5 ` X" z; |7 P1 L7 G& J7 H( O
Method 12" s+ C. a0 q* C6 ^6 Z7 Z" c
=========6 t+ t& v$ w6 I# d+ V
# E# y! n' D2 n3 K- v' s0 GThis trick is similar to int41h/4fh Debugger installation check (code 05# b/ q% h' D: D" T: P h
& 06) but very limited because it's only available for Win95/98 (not NT)$ R' o! k& ~6 ?- E+ S1 C- S0 V
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.' w X# ?. A } j; D
0 q- x2 D, L5 z0 u push 0000004fh ; function 4fh+ o, G: i5 ^3 U' ?3 w9 w
push 002a002ah ; high word specifies which VxD (VWIN32)/ |3 z, u+ n7 b K
; low word specifies which service
' {* C/ F1 s- ^9 ^2 Z3 j (VWIN32_Int41Dispatch)
- B4 z) \, [7 [/ K) b call Kernel32!ORD_001 ; VxdCall
* _ F* R9 B" q7 Y) o cmp ax, 0f386h ; magic number returned by system debuggers
4 q" y7 t+ c7 _; v6 ~1 G jz SoftICE_detected
) E8 z# @: _! d# L$ ~1 p& W9 @6 W, x, B8 [6 b, |) U ~% m- m h
Here again, several ways to detect it:
7 z) a$ @6 N# ~' h+ A6 z7 u$ c4 Y. ~
BPINT 41 if ax==4f
5 k) B) \; R1 Y7 q7 v0 L0 i; r4 K, I7 }- V0 R7 g
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one |4 i. L, O1 {& o# K3 `' G
3 ^2 o1 J5 B; y/ B; F BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A9 K) k3 ^0 y3 E: z) D( P
2 T6 O3 M: s$ w6 D# I+ F
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!7 I/ D) ^( |* k: e
1 {. M8 U) [' c1 q__________________________________________________________________________
) J& I1 ?9 q* w# _4 A2 [
+ x3 U) d& w: }# hMethod 13
1 r1 c+ |8 E. B8 m. ]3 M=========
+ ?5 A9 @- x5 t+ s
L4 {$ }% f* |+ L4 n! E& mNot a real method of detection, but a good way to know if SoftICE is
1 [+ X, `! b0 j9 o1 B8 minstalled on a computer and to locate its installation directory.
; N5 ?- y' ?4 a" pIt is used by few softs which access the following registry keys (usually #2) :. C. G. `* L% ^
. t6 e, {7 g0 r2 U: p9 Z/ E; D-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion- z- g3 j( ?3 k0 x4 [
\Uninstall\SoftICE
' F* e O3 p) \) W) x1 v' t-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
( Y3 D# C/ r' Z+ W/ U" L! Z-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
' U( J5 ^& }! z7 P! P\App Paths\Loader32.Exe( M/ {0 s1 t( c [0 k
3 t3 I+ J- S& b( p- Z" u
& x, `) e) R/ H- c
Note that some nasty apps could then erase all files from SoftICE directory: z* I! I4 m2 w' _" L1 [
(I faced that once :-(
, y9 o% j2 L( V! _$ @7 N( v
3 b+ L5 |% w- x6 BUseful breakpoint to detect it:
+ A5 N+ P4 s% n0 |; Q1 B9 I9 c4 J* f2 ^* x
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'- \. Y0 f A3 C* z3 f
- ?8 b2 {0 u' g ?* e__________________________________________________________________________
2 ?4 J9 s; U I* s; J! M+ E$ B- R1 ]% J- z/ W
! J; t* l6 S# m# E4 W d5 M, {
Method 14
: E, S& u E5 m A& h$ ?, H* ?=========7 i' ?1 A3 [' }+ T1 l. P$ V
9 `3 x" S$ v' d: aA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
9 H! ]3 B, Y! b3 his to determines whether a debugger is running on your system (ring0 only).
8 w% }8 m$ X6 A8 T2 D# f# g; X6 q# H
VMMCall Test_Debug_Installed g5 E1 @+ s' V& c
je not_installed
7 {. g+ Q9 K M0 k8 W3 J4 d
- e0 A$ \% }7 z4 }, q& R; `This service just checks a flag.8 Y' [: g3 L! q; d
</PRE></TD></TR></TBODY></TABLE> |