<TABLE width=500>
0 k+ V- F$ R( @/ U/ w! f0 \1 H9 e<TBODY>" g, e6 o% i& M1 S
<TR>
7 B% Y" E9 r C' e<TD><PRE>Method 01 + T, H# |4 R% Z# B& h, z
=========/ E+ W% y3 \! r' o3 q6 C5 n
7 g; X7 u& C) I1 w7 d( Z& lThis method of detection of SoftICE (as well as the following one) is
. C4 g! Q3 f. j, N8 I; [: I8 H' B K' Sused by the majority of packers/encryptors found on Internet.) Y( S( o6 L7 ^ u( T, K U
It seeks the signature of BoundsChecker in SoftICE. g. ?7 F2 O. u% f
. _+ i" S2 P* k. m& @) G
mov ebp, 04243484Bh ; 'BCHK'$ {- Y* {' I( M# r [9 H! S" _& [
mov ax, 04h" r6 x7 n% V3 V4 O7 _' m
int 3 : _1 |: p% c7 O+ M6 T2 U4 v
cmp al,4 T4 o0 i. j, D, Z$ ^$ v
jnz SoftICE_Detected
0 \" k( B2 c7 N$ w3 v
# {: {! }5 i% U# s% H___________________________________________________________________________; z0 P6 f% n$ t5 a$ J
/ R5 g9 \8 [; H" N+ r3 @! I
Method 02
( {: _9 q9 I* q" h( U( U% z, H=========# H c3 R" H3 ]7 G6 ^8 N
! Q! H* X; I$ N% W: x s, \
Still a method very much used (perhaps the most frequent one). It is used
9 O, B' r8 Z7 I* O7 Sto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
6 O# t6 x" C. k5 y7 t9 For execute SoftICE commands...$ T! n6 U) E2 r ~
It is also used to crash SoftICE and to force it to execute any commands+ I# |$ g/ N c
(HBOOT...) :-(( 3 v+ ?: E3 Z4 l$ y( K' A
: b, X+ j' n( ]2 n4 U8 P
Here is a quick description:
1 Q' D/ k1 U' ^0 ?9 H8 t-AX = 0910h (Display string in SIce windows)
( k2 M# z; Y4 `' X-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
( @$ v8 `# l' p& x-AX = 0912h (Get breakpoint infos)
+ g/ l! ]4 ]0 p-AX = 0913h (Set Sice breakpoints)
$ n7 W! ?' Q, z, Y-AX = 0914h (Remove SIce breakoints)- n) E. S4 H' ]! m. q3 [. S: e
$ E/ J) y( H# m* N" w- iEach time you'll meet this trick, you'll see:$ T1 t/ @6 E! K3 b0 y+ m8 Q
-SI = 4647h$ u$ f" b3 } ^* ^- N- @
-DI = 4A4Dh4 t6 l9 n* Q1 O' F0 \/ C1 R5 {
Which are the 'magic values' used by SoftIce.' J5 X& `4 y6 P
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.& |0 W. \; J5 L* [" v7 r3 P5 A& T8 C
U. q/ y& C! e) m6 |( |Here is one example from the file "Haspinst.exe" which is the dongle HASP
: A: m, P- y P; k! Y fEnvelope utility use to protect DOS applications:4 k" ~* c, r- K% Z& f
# m" d1 |1 T) ?/ ]% e
# V, r8 H% B1 @2 C4C19:0095 MOV AX,0911 ; execute command. Q6 Q0 s% H' G" r3 b- \5 Q
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).! c; J3 s/ P- `' t2 a! q
4C19:009A MOV SI,4647 ; 1st magic value.
$ X6 _ Y8 A7 C( {- p/ D4C19:009D MOV DI,4A4D ; 2nd magic value.
" T+ Z) }+ C8 G$ K9 \! h4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)5 U. a$ Z$ {% ]9 o3 h, _2 T4 |% B+ K
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute# W7 E- M/ |0 t* I1 M# ]
4C19:00A4 INC CX# ^, l* o8 W& B
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute' y+ W" A. m1 X1 q
4C19:00A8 JB 0095 ; 6 different commands.& R7 P; {" A/ ~$ r$ k
4C19:00AA JMP 0002 ; Bad_Guy jmp back.8 K. }5 Q9 D4 J: j D( X; \8 u
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
: X) O* {2 F2 M. F5 F; _- n. }4 a8 t7 J" m+ G. u. k) u
The program will execute 6 different SIce commands located at ds:dx, which
T& l3 p8 \- X9 ^are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.+ D& i+ Q; `1 \! E# D+ g# l1 ?
) a; i8 H1 _' F
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded." }7 Y+ s; d5 l1 y
___________________________________________________________________________5 u0 ?1 U: F8 H6 Q8 W8 K
% u [3 |' K% H: H" [0 M, ^5 o1 \( Z2 X( Z6 c& H. V# [ T
Method 03
" m0 y) K9 @6 x1 [6 |=========% j3 c8 |- s5 |4 F# P
8 s1 C- H [7 P3 \+ P3 W! w
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
3 f) w6 E8 d. }% }: E) B4 |: ]) n(API Get entry point)
0 D8 X; Z5 ?! S2 n5 ^/ [
3 ~: C1 t9 o% c; b2 k) { i5 `6 J, h
xor di,di) A8 s8 G9 f; m1 z x( i; y
mov es,di
% x' J$ r/ o+ H0 D& T mov ax, 1684h
% Z3 }+ n# m5 c7 g8 I; k) f# H$ f2 p mov bx, 0202h ; VxD ID of winice
; ^5 g8 R' A$ s$ ~& t: U3 {; D int 2Fh( s: B7 P6 W, L' f+ h! p; W
mov ax, es ; ES:DI -> VxD API entry point
/ F9 E0 E/ [$ @) }/ L9 [+ y add ax, di! |8 P p+ \' V6 K
test ax,ax7 [6 W: f. w# ^2 K5 r
jnz SoftICE_Detected7 X2 C4 U( Z) ]9 k3 T3 b: O! H
# @/ ] u$ d. m, Z' u
___________________________________________________________________________
: O k3 P. n' l) ~9 _9 Q; @/ [: ?2 s
Method 04
. c4 ]9 G* d6 d4 n* m=========
- w- X& |( L% |: U6 k3 Q) Z9 L2 i- v. \" N8 W
Method identical to the preceding one except that it seeks the ID of SoftICE- ]& S7 X4 @; b
GFX VxD.
# X# K- p( [$ b* @5 ?& z. u- p- s5 G3 r# ^# S1 B
xor di,di# ` Z% g5 l5 v# R* G6 U( v! A( z
mov es,di
. x" H& [: Y% |4 I mov ax, 1684h 1 u6 b' {& U; p3 b/ t0 Z; @
mov bx, 7a5Fh ; VxD ID of SIWVID
2 U' I- I8 t, ?0 x; J3 F int 2fh
# c7 ~/ o: I% G2 d5 y mov ax, es ; ES:DI -> VxD API entry point0 H0 q0 k& o: N! r
add ax, di
' y" D# ~0 D/ g3 U* |' T test ax,ax6 x$ c# _6 L& B! _7 ]3 S1 L$ F2 t7 C
jnz SoftICE_Detected3 _) p3 h; p. |! L
/ J# L. c5 z1 E__________________________________________________________________________3 K6 ^- x* D1 w2 y( y8 O) g
9 w$ \, C* P' a0 L
8 y7 U- d0 o2 j% ~( D! `
Method 05
/ e+ H/ a7 `% H9 R4 o! o! X=========
* R; D# y) ]! O/ x5 t2 S! ]1 a
2 T) K8 V+ u$ z& z: vMethod seeking the 'magic number' 0F386h returned (in ax) by all system
# b- {7 ]' N) x5 Ndebugger. It calls the int 41h, function 4Fh.4 [+ ]4 s" D- F. @
There are several alternatives.
' a! r! F$ j6 g8 i& i5 W+ T; K
! U3 z4 S4 w& i: Q/ hThe following one is the simplest:+ V {8 G: n% r) f2 T# x1 d- t9 v
8 | R, i2 o) ^/ I* R' d* s3 q
mov ax,4fh q" u9 K/ K# G- q: E% z
int 41h
9 M5 ^$ }0 ~- K* O& S cmp ax, 0F386( f. \) r3 y2 [3 B7 c
jz SoftICE_detected
2 V, x* W# _! I. I; m$ p) n w, q5 n0 v
6 y/ i( M: o$ x9 q/ c+ hNext method as well as the following one are 2 examples from Stone's - B: y d- f, v" s2 p
"stn-wid.zip" (www.cracking.net):! ]# X" w' M' g4 K$ n& U
{& v# g- _* ]/ B' F
mov bx, cs
6 P: V( I8 R* H lea dx, int41handler24 ?& C. d! [% B
xchg dx, es:[41h*4]
1 i# Z7 l6 I/ A6 J xchg bx, es:[41h*4+2]
6 A7 Q, y" ?* w1 d! m3 J, w mov ax,4fh& y9 Y2 a- ^5 X
int 41h: F8 x& z# B# T; R C' f4 Q
xchg dx, es:[41h*4]
) N1 N: A6 h/ U/ F xchg bx, es:[41h*4+2]9 a, h9 r- Q* Y% H1 ^
cmp ax, 0f386h9 @$ d/ ?2 M! ^) c
jz SoftICE_detected! n" O+ h5 g$ F
5 K. _4 [1 m8 _( ?6 h
int41handler2 PROC
/ r/ D0 T+ {) u8 W7 y, j# a iret7 x6 `; |3 \* C
int41handler2 ENDP
- M2 |5 [: I$ V) I: ^! Z9 w0 i% {- d2 Y' X& }4 {0 Z p4 e0 z
$ J% s# `' i; __________________________________________________________________________
) ^& Z- P; B5 E8 `: Q% V
# j. a- p" O) T0 |
0 c) n# R" ?( }9 N4 OMethod 06, i9 f d4 l/ l% f7 Z
=========
. {6 z" D* V* J* z) Z1 x
2 }: w' S0 e8 |4 O$ y% |4 h u1 X U7 N: w! `4 @ `+ n$ E
2nd method similar to the preceding one but more difficult to detect:5 O& _/ Z# A& _# r* y2 D3 o
6 ]. K( A' Z4 e( F
( x. h# Q9 P$ A0 r
int41handler PROC+ d9 b. Y0 I! G; f l+ v# ~
mov cl,al
, _6 E" D8 `+ A5 D8 c iret
2 I! G/ R% Z- Q" {3 m) J, ~int41handler ENDP
9 g6 ~: _+ M4 L# R+ g" f4 A2 @! T5 z6 y! {3 \
3 h8 L; P7 e2 g& k# J# A
xor ax,ax$ C3 n/ t* ]7 ?; [
mov es,ax' _; m- P! o2 s0 ^: A$ J
mov bx, cs1 [. o) k4 V* Y. g
lea dx, int41handler
, D6 X# C1 M9 F$ e- A3 Z9 l1 D xchg dx, es:[41h*4]( @0 ^5 E3 i( y( q
xchg bx, es:[41h*4+2]$ i1 V9 C& o6 L* p) H! s/ q Q5 Y
in al, 40h% e: A+ i* }1 m* P- Q1 M
xor cx,cx
& X/ }" c- D9 Q5 t. `5 ^6 S int 41h- p' @# ]; l9 z4 f. z, m& Y
xchg dx, es:[41h*4]
! V5 c. P4 Y$ u2 b7 P xchg bx, es:[41h*4+2]& c4 P' W) Q% p0 x: ` J- Y. c
cmp cl,al
, i+ ]0 z2 e+ w! H7 B jnz SoftICE_detected
5 z; V1 N% R) ~, }$ G9 M
0 d# R3 z4 Y. t: I, E; T5 c_________________________________________________________________________; i9 a9 J+ r: O% X0 J2 S
% [1 f' m/ E- f) S# m6 WMethod 07
) i8 N# W7 q0 K- L) R9 ?' T5 Y9 Q=========# U! |- J' D! t
$ h3 w k, ~! p8 P. e
Method of detection of the WinICE handler in the int68h (V86)
4 B2 X4 I& J% X/ c7 ?
4 E) ~" ^" g1 l7 T) ^6 K mov ah,43h* @" K! b: M S# a$ E- x' s" v
int 68h' u+ v% h8 a8 i
cmp ax,0F386h
" l. b3 u; ?8 U) U# i! [. _ jz SoftICE_Detected
" x0 s5 ~3 J0 }+ R' H/ l0 ` }# j% n$ S9 L3 w5 M0 C0 [$ y2 u4 _; y' @
- ~# H6 x; P* o5 @, K) y# X
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit0 `0 w) ?8 L; j
app like this:
$ e$ K* x3 `& ~: ^9 \+ p. M. B2 N+ z# s9 V; z
BPX exec_int if ax==68
- q7 o2 \8 R2 ^3 b! V4 R+ l (function called is located at byte ptr [ebp+1Dh] and client eip is
6 f" d9 {8 R$ z+ W5 E& S4 {, u located at [ebp+48h] for 32Bit apps)
# b: c1 R7 E- l2 }__________________________________________________________________________7 x. O k8 s* Y& ]0 h2 ^
' J) q7 h# b; f% J$ a% o6 `% W( }1 f8 m! l( {/ d ]! _
Method 08
% i; B6 e, }2 Q$ ^3 g: G9 H: z# M=========
' ?& f/ r `! g1 D P+ { h5 _* W" S: a+ U, N
It is not a method of detection of SoftICE but a possibility to crash the+ P* X7 E% y$ Y2 ?9 Z/ b" c+ t
system by intercepting int 01h and int 03h and redirecting them to another
& I, V& t( U Xroutine.
' C/ U& M8 u E- E( O, @It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points" }1 s3 g; R+ Y% Y' V
to the new routine to execute (hangs computer...)
' T& B! p5 Y- W, H) d
8 F5 T) Z Q6 W. h" H# y mov ah, 25h6 _ _6 @- O! f6 d7 h; N9 T
mov al, Int_Number (01h or 03h)
+ q: k6 E5 u; W& F mov dx, offset New_Int_Routine
; D) z G6 n4 F6 [3 k1 V$ Q( v. y- Z9 m7 k int 21h
! e) j/ O+ Z- V1 u, Z" I% Z/ q* z" j# [+ q
__________________________________________________________________________
0 P2 ?9 L3 D# {, b$ J, ?/ f& p- L' b/ y9 C) o' {2 T
Method 09- ~8 y4 g, _& Z. @* g1 l
=========7 N9 N6 ^- l. d, S: ~" W
1 D& p% K- s1 x ? G9 h2 @
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only& ]$ E7 R3 ]7 s, F
performed in ring0 (VxD or a ring3 app using the VxdCall).9 \* @0 h6 n7 {% }! d) s2 E
The Get_DDB service is used to determine whether or not a VxD is installed6 b1 O1 \7 `. \$ T j& l @; t G
for the specified device and returns a Device Description Block (in ecx) for- X( q+ w( l7 s: f. J
that device if it is installed.( T' n+ @- t7 x" v2 X/ j' \3 @
6 Y6 ]/ _3 I( k8 c1 Q$ A mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
) @+ J& u7 U) Z mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
7 P- O- ^: A/ v1 o% m" n8 n VMMCall Get_DDB
. C0 F6 ?" i! C* P6 j( C* R: ~- Y mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed9 h O' F$ i7 W2 ~7 p- }& z
- `$ r: m ?1 N1 B: yNote as well that you can easily detect this method with SoftICE:- R! H8 p1 `! n
bpx Get_DDB if ax==0202 || ax==7a5fh3 t- ^# w" f U
" |5 X$ h' x* F8 ?& P
__________________________________________________________________________
6 [* @) g* ]# l" | F
9 b8 g" D2 ~# ~Method 10( J8 P8 U V2 r7 o/ l) K
=========
% m) }: s3 t" P/ G# _$ D8 }, @ J6 B- |' z
=>Disable or clear breakpoints before using this feature. DO NOT trace with& I; Z* i) V) H4 @
SoftICE while the option is enable!!
" h. N9 H9 y; q6 {* V& N
# ~1 ], d" R) a$ W; VThis trick is very efficient:
' g- B8 o7 k5 u( j; Hby checking the Debug Registers, you can detect if SoftICE is loaded: R, |0 l- e9 H& x- U5 h
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
( C$ R4 J- T! e/ T: a$ kthere are some memory breakpoints set (dr0 to dr3) simply by reading their+ b U) a! B/ T' H6 t' r2 q: S& O( j# L
value (in ring0 only). Values can be manipulated and or changed as well; q" X) L8 J5 ^1 c
(clearing BPMs for instance)
( O5 u. m# A, B! h0 l
( z4 ~: V- ^) @3 U6 M# r__________________________________________________________________________4 L/ ~0 f) ]/ Y# K, f
+ @) m9 p7 |: b& G9 X# T
Method 11
& b, E" {0 [ I# {=========
5 i* q# N$ D% F( V: q* `
/ E/ ?7 j- O& V7 _, S; `This method is most known as 'MeltICE' because it has been freely distributed
: j( L U# Y% q2 \via www.winfiles.com. However it was first used by NuMega people to allow/ i" ^5 E9 ~4 l) I s3 Q
Symbol Loader to check if SoftICE was active or not (the code is located
" K( A4 U4 {+ K+ c7 q P4 a" dinside nmtrans.dll).& _# _7 W" g, ?0 j
/ Q! f. [' [0 s2 D) C ?8 E
The way it works is very simple:
& n7 [! s+ ^+ d$ n* X+ p I6 AIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for* m% s+ m( K) R) s: p! f
WinNT) with the CreateFileA API.
/ L- |) J' f, Z; a, M+ B& @# O$ L" D1 e; R5 W
Here is a sample (checking for 'SICE'):
6 k ^# o [# A: j+ P2 x9 K6 Y. E+ i1 A! @$ D5 }+ p/ D3 b3 O) c
BOOL IsSoftIce95Loaded()" }# h9 ^8 \5 K+ \/ |' ?
{4 f% n/ ]8 ~. P* q- J: }! I4 Z
HANDLE hFile; ' G# X$ L! v5 y1 G/ z
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
- K5 I { M4 V# g6 K FILE_SHARE_READ | FILE_SHARE_WRITE,9 @5 \8 l9 ]% j
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);! V6 K' u& M, g7 {
if( hFile != INVALID_HANDLE_VALUE )
' K |9 w" q; @ {% Y) I+ n2 s6 h# m q
CloseHandle(hFile);
8 s4 G3 Z; M0 b8 I return TRUE;3 J8 ?* q2 m' l/ _3 d$ ]1 P9 d
}+ A' a [! j0 G% \* V# z
return FALSE;8 m6 r# g V) o) ~0 C* d- `8 u
}
* [ e j7 _& c& d" W4 y+ f
1 V( o! F4 `6 z& K: [+ N) OAlthough this trick calls the CreateFileA function, don't even expect to be* m6 r5 x# r* Q1 Y4 q# l/ T
able to intercept it by installing a IFS hook: it will not work, no way!
3 l% s# M* T6 T+ a Z ^5 tIn fact, after the call to CreateFileA it will get through VWIN32 0x001F' q# l- \4 e8 Y+ l [: D+ A
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)2 x7 D+ t& P. x0 N/ Z
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
( ~3 U; H0 h% X( }5 yfield.. F4 P1 B, D n- Y7 ~2 T& E' s
In fact, its purpose is not to load/unload VxDs but only to send a & P. v4 G2 }! e4 x5 {' }, P' ]6 V
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
1 {/ B; ] o: ~4 T! `3 Kto the VxD Control_Dispatch proc (how the hell a shareware soft could try4 ~7 X# X7 A; |; N5 X
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
6 Q0 A/ M5 O6 p; w) B3 v6 l( w+ E W% qIf the VxD is loaded, it will always clear eax and the Carry flag to allow2 v. A2 E" \$ V! \! l/ S+ u
its handle to be opened and then, will be detected.
7 K3 I E1 T/ IYou can check that simply by hooking Winice.exe control proc entry point
$ i1 M. k; D$ b6 `* Q) ?while running MeltICE.0 M4 Y# }' X; P% m0 }
' }& R7 e* Q# p, y8 U$ s# k: G3 r* F
00401067: push 00402025 ; \\.\SICE5 Y! K! n9 d8 U. y6 I
0040106C: call CreateFileA8 ^% V4 d. U3 h$ ~7 \% ~/ q
00401071: cmp eax,-001
' f9 B" z) {: ^* S$ Z/ ? 00401074: je 004010910 g: T. i% x; Z4 D' h: n5 p0 k) q
8 w" o6 M' i3 A) L+ Q2 Q" |
) \ `7 w1 u, ]" P4 C/ P
There could be hundreds of BPX you could use to detect this trick./ ~& F4 V6 P; l1 A/ [5 J- r1 {+ i
-The most classical one is:' C, P( j7 y+ l$ [; X, }
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
* G4 O8 T* |% t% \- Z- n) Z7 e *(esp->4+4)=='NTIC'1 |4 I1 P9 S7 Y$ I5 D9 m7 J
2 Q2 O" B' C2 X-The most exotic ones (could be very slooooow :-(
/ {$ t+ C+ g, u# t BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') 3 |! A/ M. [8 v; [
;will break 3 times :-( @# ^" i e! F3 d m
4 ~$ H8 p0 w b! t: R
-or (a bit) faster:
1 }* m5 T% ~+ x5 M) b0 ~ BPINT 30 if (*edi=='SICE' || *edi=='SIWV'). D# e1 p- W! V, o0 b
# z' u! z& @$ ~8 ? BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' 6 u. Y# k9 L- i) [ ^3 R2 F
;will break 3 times :-(4 \7 @" P! ~6 V* }0 H
! x5 j9 z$ s, F& R
-Much faster:8 f" v1 z) `# O- d4 d) {$ \" Z
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'! Z+ m% G( Q7 \% e
( r0 m; a% J: |/ y9 G' ?Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
' L( Z( k" Z' x5 `. C6 bfunction to do the same job:& y' Z3 n4 r9 v
0 M0 r3 {2 f A* c. j
push 00 ; OF_READ5 p- h. T+ n1 S" q$ J5 T9 R" H
mov eax,[00656634] ; '\\.\SICE',05 p, B; `" i, M/ W x. _
push eax4 B/ l$ Y0 M; A+ W
call KERNEL32!_lopen, C8 ^& n) \( c a {' @, T, v
inc eax4 _$ y* X8 f3 v( o: p
jnz 00650589 ; detected- }+ P. w+ _3 E3 L. P' ]: R9 a+ |
push 00 ; OF_READ
9 D6 ~+ |* S: s3 t mov eax,[00656638] ; '\\.\SICE'3 M6 P4 i* J) ?
push eax" p- D, \% |* v' s! T
call KERNEL32!_lopen% l1 t) C0 O6 p
inc eax
# [2 s/ o5 f# d' [4 ^7 z jz 006505ae ; not detected
9 v5 R D6 W `; g0 j P* s5 O( z; u' b
7 O* w2 ?8 o0 k
__________________________________________________________________________! x7 D7 U0 z8 P$ g3 u
. |0 A2 U0 L- n- WMethod 129 Q. E1 x& g( y7 o ?7 Q
=========+ \# x3 h6 n& ^6 Y9 N* l: Z/ ^
& v' y; X) j: L' bThis trick is similar to int41h/4fh Debugger installation check (code 05* |. D/ {. S. A& j
& 06) but very limited because it's only available for Win95/98 (not NT)
9 X. ]# l6 x' `as it uses the VxDCall backdoor. This detection was found in Bleem Demo.$ R: F6 n+ Z3 o& H
. l9 ~8 X7 ^; P+ M
push 0000004fh ; function 4fh- j6 B- J! _3 p9 d+ j: ~+ p
push 002a002ah ; high word specifies which VxD (VWIN32)
9 o# [" @ q/ G3 a5 | ; low word specifies which service1 g C* o( v. Y3 d) v( e9 N
(VWIN32_Int41Dispatch)
) @6 G4 y% L/ g" o- | call Kernel32!ORD_001 ; VxdCall
. M9 c% ?+ u5 M% ] cmp ax, 0f386h ; magic number returned by system debuggers
8 A$ h2 K" u! K6 P6 C jz SoftICE_detected
9 l! |( Z, z+ D9 w6 h* G" d6 q
( f; s7 p; A! z2 m% `2 w3 YHere again, several ways to detect it:' f4 o9 W0 y# p
5 [5 M3 ~" P/ P2 F8 p5 E) k$ ?
BPINT 41 if ax==4f) u: c' G& u3 w/ _% _/ h
4 }0 g, J) B) w% x) |' i0 F
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
3 e0 o* ]* x. {' {& d
( g j: ]4 o; z6 D: j3 X- } BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A2 X" _$ `* q) O' x: d0 u
2 z# ?! ~6 R' u6 z) S; n* j/ \ BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
$ T( o1 S# s0 G3 W7 D# A$ o# g9 C. Y8 y' v& q4 O$ L1 H8 Z
__________________________________________________________________________
& W- j+ h1 U: ~. \9 }' J
; k6 s9 f3 ~, A3 d7 ]( a5 K8 Z2 oMethod 13* Y' v8 d0 C7 ], ]# M
=========
9 s* I( w" c, X) Z" |, E' r6 i; i6 E. a. D+ E
Not a real method of detection, but a good way to know if SoftICE is, l& D) Y; P( D
installed on a computer and to locate its installation directory.
: j! q) N+ _+ @* \: _0 IIt is used by few softs which access the following registry keys (usually #2) :( ?+ k$ A& F/ }$ r* U" p
1 a9 V2 l- P2 [1 H
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
3 _' {, B# f+ z H: l\Uninstall\SoftICE& M; A0 p7 M7 H2 N
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
1 f" t+ ?: {* c# w5 n6 `( ]-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
5 \7 N4 T' W' @) t0 t6 B2 F; x\App Paths\Loader32.Exe8 g+ a1 a$ ?! v4 t3 V) {$ [& z
- B8 ?- Y# Z% d# f6 f6 D
# [& | G- O) a! Q. c: L' m; QNote that some nasty apps could then erase all files from SoftICE directory: ]7 `/ A9 Q1 ?0 G" n
(I faced that once :-() R8 X2 c: I% l
: T/ z- k6 T# C* \6 Q! |" b
Useful breakpoint to detect it:
& _: K1 j) A$ u, ?% `% d Z8 B6 P9 y7 m
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'2 n4 g, k- p* k d! ~
0 h. x; N; F! Y+ C5 d0 N( E& T__________________________________________________________________________
. N* o. K/ v i0 C# a0 n, v* q6 l3 D9 A2 x& e
* A8 Y9 }/ F7 U# E, o( x! a9 wMethod 14 2 E2 Q! D( z+ O4 Y' w
=========5 D2 a0 b$ i: T G
$ r) @& c: Y' OA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose4 x& c" u/ m: Z+ F! b, j
is to determines whether a debugger is running on your system (ring0 only).
+ F; B) B# ~& b8 B4 H' f- j1 \" z4 m! x+ R* e3 Y6 k- k0 E/ {
VMMCall Test_Debug_Installed- A! O0 h7 c, w9 B3 h
je not_installed
+ x0 @+ h. u( c1 C0 ~
2 p! {$ ]* V3 U' T$ n0 {This service just checks a flag.9 L% L+ Y, y+ P3 b; p% j M% K
</PRE></TD></TR></TBODY></TABLE> |