<TABLE width=500>
3 a- z {, Z5 M- k% L9 M2 ?<TBODY>
& E: ?* \- D- V' Z+ y9 U5 [<TR>
6 n7 [9 r9 ]/ d- P<TD><PRE>Method 01
8 b1 \2 Z$ G9 y7 ^& o=========
4 b3 t2 J$ S' D% ?4 D( E! T d+ F) V: n4 F7 U
This method of detection of SoftICE (as well as the following one) is) w6 v- U" J' L) v( F6 k
used by the majority of packers/encryptors found on Internet.* n- I w/ m# D- `7 e+ e8 h
It seeks the signature of BoundsChecker in SoftICE4 Y- D2 }, P: z0 V& j0 V5 r% s- J
: @ U, B( a; I1 r4 x" q mov ebp, 04243484Bh ; 'BCHK'
) e9 ~. x& ]8 g+ f mov ax, 04h7 h# K# d4 K' T, j1 b
int 3 # I! P g% x5 u& K3 a1 u- g
cmp al,4
. s: _9 D! n: m jnz SoftICE_Detected
! p0 s4 D" ~) x! S; f. m6 a5 g2 K3 t% t. b2 k- n* a
___________________________________________________________________________" J: f( E. i+ E
( q$ j C, f0 n4 Y
Method 02
( T, i6 S; E, B ^: _! H=========, k0 R8 Q; U4 `+ n% V9 y. m+ {
- C, |7 O, y& s% {. {5 D7 V+ ]2 b0 }Still a method very much used (perhaps the most frequent one). It is used
; @% V7 r0 z5 ~8 A4 @to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
$ H( F; X! |- uor execute SoftICE commands...6 Q2 b' ]6 y' `! Y, i6 I$ n5 I
It is also used to crash SoftICE and to force it to execute any commands
* d7 c7 |/ U9 | W(HBOOT...) :-((
, |; i: _3 a1 R5 ^/ l; P
0 Z6 ]1 Q$ a8 Q( G8 {/ [( k/ ~6 Q: kHere is a quick description:$ D8 h$ L( m0 q9 h0 [! g4 G! t. |
-AX = 0910h (Display string in SIce windows)
+ a2 F0 j( |- f/ x* [2 ?-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)8 a6 |5 s) o7 Z' u. U& R3 a
-AX = 0912h (Get breakpoint infos)( k8 v; w- M; {/ V5 w
-AX = 0913h (Set Sice breakpoints)
, F1 }* E, ^8 n4 ^9 {-AX = 0914h (Remove SIce breakoints)
5 e( Z8 c' A- a! x, t, z5 }! V" G- W/ |8 } c
Each time you'll meet this trick, you'll see:
2 F) v& M; V3 r7 T8 s-SI = 4647h
0 }. g, l4 z- W. N7 g. ~-DI = 4A4Dh
6 t& a( q$ Z, o/ C) E7 R4 M+ zWhich are the 'magic values' used by SoftIce.
6 ]* b( G7 Z4 m: _* f2 M* a- h/ pFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.4 W2 F; Y; ^2 L4 \
) v0 ]& _5 }' J- J. ~0 P1 CHere is one example from the file "Haspinst.exe" which is the dongle HASP
( g9 K R6 {0 f+ OEnvelope utility use to protect DOS applications:
. [; z, f2 y( C7 Q$ ?. q, y, O% n" G G- y% Y
( H. z! ~. V7 P$ Z7 A4C19:0095 MOV AX,0911 ; execute command.+ ^' {. U* A5 X) Z
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
3 @3 j7 P+ W, P% R6 K4C19:009A MOV SI,4647 ; 1st magic value.
i* r* A6 k1 V( b1 r1 y+ W$ T4C19:009D MOV DI,4A4D ; 2nd magic value.
# t2 B2 l+ |7 x- l0 W) k6 u% M$ }4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
- F' v% Q3 l% ~; D4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
6 z0 X0 t0 V- l& ?' S4C19:00A4 INC CX
: I- F( M1 k% v4 @* J2 q4C19:00A5 CMP CX,06 ; Repeat 6 times to execute- } a: h5 \2 N( y' y* K, A/ Z: I
4C19:00A8 JB 0095 ; 6 different commands.+ v- A- A5 S' _- N$ ~5 s1 ]
4C19:00AA JMP 0002 ; Bad_Guy jmp back.
2 r& v# t0 J! U5 C! {4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
( q5 j7 F0 U, G3 d* b4 `/ U$ ^( M7 g- b$ K
The program will execute 6 different SIce commands located at ds:dx, which$ j( i$ n2 `0 W
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.4 w1 H5 r v* r
4 o6 F6 j* t5 n- J' W
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.' s. y& P5 t/ r7 |) J& R! n
___________________________________________________________________________
* D u2 A7 k0 T! f+ J, _3 s3 p
) x8 c0 ~9 m. f y0 j& v* k0 y5 q
5 [! w- Y6 h4 w& r3 aMethod 03
8 }' U% B5 A& S=========- Q- u& N6 E A% R4 }, W
7 s+ z: v' N0 J; @2 u! W) q! xLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
. N) w& y" S0 ?/ R(API Get entry point)
+ y4 X- e$ j+ X* W4 W; b% {6 g! V; E" D ' s# V4 @0 E% _3 ?5 ]
* h/ t0 F2 M d/ z G6 D7 P
xor di,di: A* m; k( U$ [- f8 R. s0 Y
mov es,di
7 ^% p; z: ^5 w) e mov ax, 1684h
l S2 A; H# t% \" `+ r7 { mov bx, 0202h ; VxD ID of winice% C R: Q& W$ a" _: _3 a
int 2Fh
) d6 Q' y) H9 C8 y7 ?! v mov ax, es ; ES:DI -> VxD API entry point
7 o. W/ N+ |# o( ^ add ax, di
, t9 F% u+ U1 C test ax,ax
' E4 a8 j# B* l7 H0 Q jnz SoftICE_Detected
+ i5 m' g4 _4 Y) o! H7 T ~; u: T; p" p) y
___________________________________________________________________________
: G3 J5 r# U6 T+ M( U, j8 V I% `
) `) `) }# S* w* W# x. gMethod 04
# B, H0 ?( h- t1 F3 G: a B=========
. b+ x2 Y+ x3 S- g8 J v- v2 g
! ~# Z$ L/ B, I# o$ wMethod identical to the preceding one except that it seeks the ID of SoftICE
/ C: V- j( T: rGFX VxD.
% l) v) Z7 `9 L/ e: K6 ? \' a6 k4 e- X. d+ R. V# ~2 l
xor di,di2 p# O! \) f/ w0 }% j z4 c
mov es,di# ^" b0 d, y- `0 n
mov ax, 1684h ; \5 l y$ c: h2 v' q
mov bx, 7a5Fh ; VxD ID of SIWVID
5 D$ h8 C; A1 X int 2fh
: U% K2 C; u9 Z6 Z; P mov ax, es ; ES:DI -> VxD API entry point, J( r5 A# T; q3 K1 w* y
add ax, di% A: k, Q' b7 L( ~. x& |$ q/ b }% a
test ax,ax, J: |: N2 y" V
jnz SoftICE_Detected
2 @6 M6 }" n N. \* \# y# m/ Q
z h5 ~0 i; F2 T9 G" i* H7 i__________________________________________________________________________
2 ^4 u2 S" F. D7 z5 E
+ @" P8 M8 s! I& B
/ j$ I$ ~6 F5 P2 ]# `Method 054 ?: R+ Q1 ?. G( v+ c
=========! ]6 J, a; e1 M0 I; x
( s( } q% ?5 }( SMethod seeking the 'magic number' 0F386h returned (in ax) by all system! S* ~. ?8 v; K6 d3 @
debugger. It calls the int 41h, function 4Fh.
9 o/ ^5 V# X# PThere are several alternatives.
& P$ f! j! G/ W. T: V
- B T7 n; j1 u/ SThe following one is the simplest:$ {6 |$ S. e: G0 a9 t, I, e% e: ]
@+ ]4 i/ q2 X4 J M, } mov ax,4fh) Z& y: A2 ~9 G+ h7 Z0 ]5 G
int 41h+ L) U/ {; v- p$ }4 a4 X y
cmp ax, 0F386; A9 J8 c8 }7 D4 g& a6 ~1 W
jz SoftICE_detected
" s! ]# R$ h+ t6 F, Y% Y$ |/ r" m+ `/ h+ o, D
3 D" |' N; @. r. K- G$ eNext method as well as the following one are 2 examples from Stone's ; Q' B5 _8 V; r( b: {+ }% v2 D
"stn-wid.zip" (www.cracking.net):+ c! G9 ~. o* d" N& R5 w2 P
- ~ t4 F! `/ |& R. `. j
mov bx, cs
6 ~5 u* a$ @- `3 O* c* k lea dx, int41handler22 c2 o/ U$ W+ J$ U
xchg dx, es:[41h*4]" M5 o2 R: E/ ?, w& }* z/ Q
xchg bx, es:[41h*4+2]9 V D& Q d. e, u# O- }
mov ax,4fh
% a, x& j; }" v! ^ S( ^ j, G int 41h: J3 i# f# j0 ?4 ~" _. A
xchg dx, es:[41h*4]
! A/ y4 ?( r; F1 X2 t+ U) g xchg bx, es:[41h*4+2]
, \; f; R2 z7 D( ~* b l# G. p cmp ax, 0f386h8 a) S7 t2 c( Z7 n" G
jz SoftICE_detected
! g: a- z2 w& v4 Q$ { N; e- w3 ^% K7 @& j0 O. f$ U: Z, {
int41handler2 PROC
9 k+ u j" s+ F7 y- r iret
- M* Q3 K, b' d3 x; Tint41handler2 ENDP: c O+ j0 w+ f
. B2 ]9 i: z* n* K
5 n9 m8 ^8 [0 ^/ B
_________________________________________________________________________2 v1 D9 Q! ?3 H6 h4 S) W
* }& y$ w( ~/ |' r& [/ Q
( R6 ?1 y Q8 ?$ b. WMethod 060 t# A! i' r- s: B( X
=========
$ j" I- v2 u( a4 f7 h1 E2 a- t: C& p
( s7 x* h! ?% Y( r, ]
2nd method similar to the preceding one but more difficult to detect:
t6 E6 q0 w. |+ {0 u9 t) `1 n; N' U" m. a5 W8 d: Q
' \' r" [* W' T, o/ O% b- ?int41handler PROC
$ x6 l/ b: m% X/ i2 | mov cl,al2 G( R1 ?1 a9 {. n. J
iret
$ |2 h" T m: p: Q: f- y# ]- V) H1 dint41handler ENDP# N6 U8 ]; E7 r4 Q! Q2 w* ^# E
! N+ d& l3 g. t! _9 |
5 W+ m! P& {( v xor ax,ax
" m% L: G8 v% h mov es,ax. u7 H4 F: Z2 H+ }. Z! I
mov bx, cs
2 y: K' g$ W5 R& `2 ? lea dx, int41handler
2 [6 C8 L8 U% M" G H9 x xchg dx, es:[41h*4]
. ~ \, V( `0 F9 d6 w* D( R) X# G xchg bx, es:[41h*4+2]
2 Q9 ]1 n( c! {0 F( r in al, 40h
" _' n" d% @# |3 ?' w3 C8 P xor cx,cx
1 A) V. ?) V6 ^% h3 ^* ` int 41h& I: C3 S8 \2 ^2 N# U- c6 m* i3 s
xchg dx, es:[41h*4]
) B6 d6 a6 s% g5 o* \# k xchg bx, es:[41h*4+2]
8 C0 O2 s& O9 i; w, I cmp cl,al
. e# G1 d, i( |+ ^1 @$ G5 q$ \ jnz SoftICE_detected
6 r3 s+ [! {- c3 B( }0 T) o. C/ M5 U- J/ Q. O
_________________________________________________________________________% I" E5 \; `5 p( V/ D+ _
: v* S5 a2 r) H: @Method 07$ D6 r& J( }7 _) v2 m
=========
7 o3 O6 A" i4 ^# q
, Z, l$ D7 j5 M# s! A* }" h# PMethod of detection of the WinICE handler in the int68h (V86)" E6 e# Y; ~$ H; x l
8 X0 {) Y* D3 {; M, x mov ah,43h1 `2 C% f& O0 b1 B
int 68h. ^4 m6 w: ?$ D, X* j
cmp ax,0F386h
: m/ v: d& F( i& o0 e8 A jz SoftICE_Detected
5 a. s# e' i* |) c/ X! z& c. c I' g& D8 A; D0 P/ O
( B/ q8 c5 P0 K E; m8 I
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
0 S, W; f1 B( S3 U( @& \2 T app like this:' Q4 g& R, D% T: y; M+ ?( E
4 }1 L( |+ o6 [9 D/ z2 v
BPX exec_int if ax==68+ G( @( R' H9 h( x$ y& r
(function called is located at byte ptr [ebp+1Dh] and client eip is7 D. n& m3 W( L4 h; @
located at [ebp+48h] for 32Bit apps)+ e U' k$ G8 x* p
__________________________________________________________________________* h1 Q9 H9 t. J+ T( y
8 C9 m* Z2 r8 [7 y* l/ J, }3 T3 } o. k; K' x5 j
Method 08
+ E1 o6 q3 M2 F3 ~. e, [=========7 n6 }$ Q3 Z$ v
1 x3 u" _8 R) h5 P3 s9 {" _/ w' V( L: d
It is not a method of detection of SoftICE but a possibility to crash the3 s& T1 f4 r$ e: E
system by intercepting int 01h and int 03h and redirecting them to another3 R2 [, \: h+ V7 _: i* W
routine.4 T/ W% j; U/ j& t0 i% }
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
, K9 d, X( c2 t# qto the new routine to execute (hangs computer...)
) m$ }+ z Y) w/ O7 I" |; H! R+ {% L* d0 g/ f
mov ah, 25h- S# X8 R8 O% {& A7 e
mov al, Int_Number (01h or 03h)
$ I. k9 x' I0 S; Q7 x mov dx, offset New_Int_Routine
5 c) F% M* }- m: E3 ~- K& ` int 21h& m5 e2 j& o% E" L. d
S! y! }! Y; {) e9 F- G/ N
__________________________________________________________________________
; _5 `! `% ?& R8 S* C I- l1 f. ?( G4 I. e+ r/ T' N
Method 09
6 E1 D2 Z5 z4 ~. I* n9 H=========% l# ~- \3 q$ m
1 A+ D; _7 B5 Y" m& R
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
" i1 A9 z1 T7 j" gperformed in ring0 (VxD or a ring3 app using the VxdCall)., S! ?$ o5 \: R& Q" m2 K/ U8 S
The Get_DDB service is used to determine whether or not a VxD is installed
% v& F" I, u( i% X0 K; wfor the specified device and returns a Device Description Block (in ecx) for
: W1 B) G% y& H# D/ X! }' Z( v% |that device if it is installed.
) m7 b' z7 ~$ j: v, n$ |% L \
8 \" Z3 ~( ?$ I8 B mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
% Z1 q$ B7 B7 ?1 y' O4 d' { mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-). |: w# Q+ ]$ i+ U
VMMCall Get_DDB' o5 M/ I9 S0 ?" L6 N
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
7 a" A0 D( |2 E" Q2 W0 }. a7 f" T6 k
$ i- T/ K, p& ^/ G2 Y6 _Note as well that you can easily detect this method with SoftICE:
- c% `5 Y5 J: R, j. L8 l6 W! U4 Y bpx Get_DDB if ax==0202 || ax==7a5fh+ O2 n5 m: L9 p9 c$ i
( G& a* ~/ I) x__________________________________________________________________________7 ^0 y$ X/ V1 k, }" n
* T" z6 {: j% D* F0 G4 U% K% PMethod 10$ R M* F5 b! L8 U
=========
- U+ i( T' p8 ]. |
" K# w9 U- t- s( i. h4 ?=>Disable or clear breakpoints before using this feature. DO NOT trace with
: h: |6 B; |1 ] SoftICE while the option is enable!!
. t! v9 J+ t7 C# w5 @/ Y5 B( c, v& K \- e
This trick is very efficient:0 K' y( `( K/ v, M0 t
by checking the Debug Registers, you can detect if SoftICE is loaded1 _2 ]0 n; S9 [# |& ~9 o; z, F
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
$ r0 K& l1 P6 g/ F; m% Q5 s W2 bthere are some memory breakpoints set (dr0 to dr3) simply by reading their) c0 G* L' f3 [, a4 R; X7 [
value (in ring0 only). Values can be manipulated and or changed as well
% H( u2 v( y* d2 F(clearing BPMs for instance)# W9 T3 F) P/ ^; Z! y4 n ?' d
$ G* F: o- D2 C# D$ Y5 N6 r
__________________________________________________________________________
T: L' a5 d" [7 r
$ C7 `6 C4 K9 t) X/ q! K9 UMethod 11
6 R+ d9 W) t* b/ m=========
, R* y8 S! |! k. X: e% |$ s1 {9 B6 B% S5 z' ]. m
This method is most known as 'MeltICE' because it has been freely distributed
8 ^" ^& @$ H4 i* \via www.winfiles.com. However it was first used by NuMega people to allow8 W# |3 Z- ?! J7 [! R9 ^9 _
Symbol Loader to check if SoftICE was active or not (the code is located
d) C& T' X. r0 V) U$ Ninside nmtrans.dll).
- O' y! @6 g4 o/ e2 D: e+ l j0 s1 O+ i. b8 q, ~
The way it works is very simple:1 u, l0 j4 V/ u: {
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for4 Y% w8 T# U' ?5 i
WinNT) with the CreateFileA API.
( [' `9 K, V( u, t$ @7 X! k% e- u* D8 r3 g! @; t. G0 ^& ^% [3 Q5 J
Here is a sample (checking for 'SICE'):
2 S% X5 T Q1 k6 t" @' m
; I6 H8 d2 |0 g# Z/ ~+ YBOOL IsSoftIce95Loaded()
# W( g# f0 Z o+ }- y{
. f: @6 @$ }$ L HANDLE hFile; $ W3 w6 H8 S- D0 N) z; a% a
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,: O. f1 }1 l- b% f
FILE_SHARE_READ | FILE_SHARE_WRITE,3 F- P6 O. g' U
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
0 y3 ^! y1 p' `0 w if( hFile != INVALID_HANDLE_VALUE ): H0 n; c; t' D9 ?. c0 e" K( }
{( }% k+ X9 S2 ?- }/ o1 w8 Y& Y
CloseHandle(hFile);8 K4 D5 B* D* M! D( O o
return TRUE;$ v' M2 [: i8 p
}
' ~! ~' j- ^ D return FALSE;
/ f5 i6 Q% A' L1 {* a4 {" H- c9 t}# [1 r, L# O8 c
8 k& c4 m3 ]( ^1 Z9 x4 KAlthough this trick calls the CreateFileA function, don't even expect to be
6 P. Y8 F* |% d6 kable to intercept it by installing a IFS hook: it will not work, no way!: ]8 p5 s, [0 C! N& d
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
) g% k: e7 b& Wservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)- }6 }; k& G8 I# y2 o( h
and then browse the DDB list until it find the VxD and its DDB_Control_Proc# [' Q. o3 V9 R$ Q, z! V! a
field.
3 K2 L: g5 U: S/ V$ cIn fact, its purpose is not to load/unload VxDs but only to send a # b. l" Q' g' W0 }* |% d
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)7 V* s- ^0 u& r% V, a
to the VxD Control_Dispatch proc (how the hell a shareware soft could try$ Q9 m. r$ M) O' S+ ^
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
3 N- z% E6 `6 `# L8 E: y0 e* k! D) z! kIf the VxD is loaded, it will always clear eax and the Carry flag to allow& i3 N* K6 x# g4 k! E& t9 `
its handle to be opened and then, will be detected.! }+ c5 Q7 S' G- ?) R# w T
You can check that simply by hooking Winice.exe control proc entry point7 B" E7 [5 Z8 [# r. J
while running MeltICE.+ Z7 ]2 w. D. J& O
/ v4 u% W4 }* K$ T$ [1 J, H E
u' M9 t, z# r0 c" }8 k8 c3 T8 b 00401067: push 00402025 ; \\.\SICE9 v5 K: i! \3 q. ?
0040106C: call CreateFileA
( |/ G& K z' J3 t& a 00401071: cmp eax,-001* x! R7 R& b/ K8 d8 J
00401074: je 00401091
|9 E0 N0 u* O. d/ f& o* w) x! P1 F: f* F% W
! S1 B7 p: A* h6 D. m, ], e
There could be hundreds of BPX you could use to detect this trick.
0 x4 F+ t* C8 G* m" S. U-The most classical one is:# }; N1 x% }3 p% L, k5 @
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||6 X( V% T9 C; K, o
*(esp->4+4)=='NTIC'% Z. K2 l: P! L
& @9 r+ W0 M* e0 }! k1 @/ |$ h& e
-The most exotic ones (could be very slooooow :-(
; Q4 o# }& J, b/ w1 H BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
% ]$ ]- J0 A8 ~. \6 R4 t/ ~ ;will break 3 times :-(( v6 m. G/ ]' ~' {+ \+ w- x# {3 i
- r A! H- g9 z-or (a bit) faster: # m6 A4 z# w+ j" i
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')5 Q1 b2 T# ~6 l. x4 i) c0 n
+ n# l) [4 ~1 O) o# H1 j% j BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
: I. ~* Q4 \# Q ;will break 3 times :-(
, F/ C7 `9 j2 n; D. o$ L# _( @% W) f9 e/ Q, O1 @
-Much faster:/ F+ Y; a/ k" k W- ^
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'6 J6 g0 Z. X% C- o: k2 a
* q7 a- T) o( r3 DNote also that some programs (like AZPR3.00) use de old 16-bit _lopen3 x9 u) j0 E$ l. ~1 u2 I
function to do the same job: Z d2 Y! X1 ~0 y4 t
# u: E9 W0 T9 x; P" a8 N6 W0 i4 Y& N
push 00 ; OF_READ1 C* ]% H9 c S5 }( l l# }4 |3 ?" G
mov eax,[00656634] ; '\\.\SICE',07 h- _! Q- \/ E1 {- c5 Y8 t' ]* O- @
push eax0 H5 A2 Q1 h8 q1 \
call KERNEL32!_lopen8 x8 H" s$ g4 B4 {/ H
inc eax( C# M: S; A* I" `) t* A T
jnz 00650589 ; detected
5 h6 q/ S0 `, B0 f0 m0 z* y push 00 ; OF_READ
6 U2 @4 O4 a) V/ _2 _ mov eax,[00656638] ; '\\.\SICE'" ~# \9 g! _; }8 k3 A! q
push eax
/ D0 p6 O9 r9 r# M/ Y" q call KERNEL32!_lopen
7 t6 S/ J2 e& a1 }3 U inc eax* n) p) v; O" ~
jz 006505ae ; not detected
: d' V' p) ^! S+ C0 N1 w* I* C& U9 {) N }' p5 w+ _3 P6 T
: ~2 @- `1 P6 K( u( s+ S7 _* l__________________________________________________________________________+ K- Y2 H/ `" ~$ l k- B
! Y9 e' ~/ P' V# q9 {' m. qMethod 12
& H7 J6 ^7 \4 J X=========$ \( T' V# H. O( a& R3 Y- I
/ a# G" a$ s: a" n$ \. s, a# H( u' Q
This trick is similar to int41h/4fh Debugger installation check (code 05
0 D& f7 E- {$ A3 F0 A& 06) but very limited because it's only available for Win95/98 (not NT)$ }8 |8 k" C( `7 Y: U
as it uses the VxDCall backdoor. This detection was found in Bleem Demo./ A, U8 r& }+ W9 e M# [3 C) N
5 V$ Z# F' I: L5 f push 0000004fh ; function 4fh# J) j" K( J) d. |( x
push 002a002ah ; high word specifies which VxD (VWIN32)
3 V2 d& q5 f0 k7 i! ^' S; H. b, e ; low word specifies which service H7 @, d3 D$ _3 I& n* g1 J: c
(VWIN32_Int41Dispatch)5 v: \& R: D1 p) R' t
call Kernel32!ORD_001 ; VxdCall2 d. s( j# W, o2 G$ l8 l6 f$ V# ~
cmp ax, 0f386h ; magic number returned by system debuggers
+ M3 a" u3 D' j jz SoftICE_detected
0 e; i2 b! u- j) `8 W; K
' c- l+ V& ]1 q& r/ V cHere again, several ways to detect it:
1 U8 L! {; ]% s5 g+ W5 M1 |
1 R, ^8 F! x# w( V BPINT 41 if ax==4f, m) x6 a# d' X3 b
& D N4 B6 `0 y- e BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one9 \& Q' w; Q& B8 S
3 Z$ K4 ~, M( `" a4 G
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A. R% x6 ^7 e: v9 g
) f! f! i3 H4 d. Q8 j; ? BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
" V# t3 q+ M% `) x" V7 m. l- ^
$ H! u6 k; B0 ? l& ]__________________________________________________________________________
, _; ~4 l8 a" d, Z
7 P7 C) x' ~4 c- V1 w# p, \: BMethod 13( U, y0 d5 R8 R
=========
/ R) E4 D- `( [# ?0 F) P+ U% v Q, p8 Q# ]$ B2 w. o1 _: Y
Not a real method of detection, but a good way to know if SoftICE is, g/ H7 ~5 V1 [# B
installed on a computer and to locate its installation directory.
$ b0 Q4 e/ B! G9 h) EIt is used by few softs which access the following registry keys (usually #2) :) Q9 Z6 X( k9 d/ W4 y
i6 Y5 w+ Q' ]% ?0 n; @
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
& w" j- A# l: d\Uninstall\SoftICE b- K' R* R, Z; I2 N
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
[! X; c7 t, ?8 G. p% j-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion" a2 }% V& p6 s. Z+ `: R
\App Paths\Loader32.Exe' q3 j6 ]) x. P$ [9 g/ |
$ Y, C7 u* b' d) y7 F; ^" f
* @- C' d2 `, J7 S7 F4 z9 `/ t3 r/ UNote that some nasty apps could then erase all files from SoftICE directory b% e* J7 \0 B4 Q
(I faced that once :-($ n/ N" C0 z: {% Z/ ]
/ x F7 N% F* ~5 n8 mUseful breakpoint to detect it:/ o6 y5 H9 k0 {/ t* p& l
$ D* }, O" F9 V+ x6 c$ i
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
0 T' W4 G7 E4 F1 ^% o6 T4 F2 X( O" M# ]% p! s* J
__________________________________________________________________________ v' |; ?7 R; m$ r6 H
5 U e S- _& e1 s1 f9 e
- t- e) f2 v# e1 L1 h$ d2 P7 ^' `Method 14 # h1 j/ Z; s, {2 k
=========+ q/ A7 h! f, o4 n5 L
% r* r8 b% ~1 c6 K- \. t
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
6 l3 @( m0 u# y/ c# Vis to determines whether a debugger is running on your system (ring0 only).
0 ?2 l* n% H3 X2 x! p5 h) Y2 Z! n6 O& F: B; l; g! H% F+ `+ b
VMMCall Test_Debug_Installed- \- ^! j2 p/ I( F7 t
je not_installed
0 x, y1 m7 a$ y, m: A5 M8 T# T; G
This service just checks a flag./ L* h9 R; q7 M' Y, q8 ~
</PRE></TD></TR></TBODY></TABLE> |