<TABLE width=500> [0 C. |- {5 A4 i
<TBODY>
5 R; a" I7 f' w2 @- Q: {, @1 ~<TR>1 {2 ]& r3 b4 E2 G3 }
<TD><PRE>Method 01
- \1 e2 K) C! I/ K% C6 R3 D=========
. [4 i6 x& p, z2 ^1 S5 g8 q2 p0 M9 g, r; ^7 z
This method of detection of SoftICE (as well as the following one) is, |& H7 j7 g/ ^5 |6 f; \+ C
used by the majority of packers/encryptors found on Internet. w" p2 F) L7 A" v' J
It seeks the signature of BoundsChecker in SoftICE5 S2 B$ \7 @7 F) O. c
! A+ M! T/ r; D/ g: b/ U mov ebp, 04243484Bh ; 'BCHK'
$ h0 k3 W+ L8 g0 t$ t* f mov ax, 04h: q5 j7 Q4 H" I1 \. d2 `- g
int 3
4 y+ A: [% F; `& s cmp al,4
4 k9 v2 I" O/ Z: X# p, h1 d" `- R2 \ jnz SoftICE_Detected
& _1 Z f; \! C& u% h" z2 h$ x9 s) ~6 Y
___________________________________________________________________________
: B; O3 a4 Y' U2 T8 Y+ @2 C; O b5 T" i# _, C5 F; C
Method 02
* Y3 e, C# q4 r: Z1 \=========
5 a- g; e) l0 f' k
5 ^" n0 ^% p& j: O6 m% k5 _Still a method very much used (perhaps the most frequent one). It is used9 d' X4 d5 e# V" W
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,. U0 l3 w! q) a+ V& B) ~) h {
or execute SoftICE commands..., u$ ]3 K5 i S! F' {4 Q0 B8 c% |
It is also used to crash SoftICE and to force it to execute any commands
9 X& ]1 U: P' E% \/ b9 m(HBOOT...) :-(( $ o) m7 M; i! J7 w4 z N) f
; h! [: |* Z# fHere is a quick description:
0 S5 `8 W4 ]1 c! n4 l-AX = 0910h (Display string in SIce windows)6 E6 _) R1 b* D6 y8 A
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
6 j4 N$ Z9 J3 U' k-AX = 0912h (Get breakpoint infos)1 s" h$ S3 m' c" g$ C
-AX = 0913h (Set Sice breakpoints); S* P" x5 O( Q% V% |! j
-AX = 0914h (Remove SIce breakoints)
9 x G; q3 D/ i: k& F: G0 y* E4 y! I3 y- I
Each time you'll meet this trick, you'll see:
2 Y. M! Q! Y; R N5 h, ~& u% h-SI = 4647h7 F: j, l' i0 K% k' `
-DI = 4A4Dh$ {- ?; k, |2 j& Z
Which are the 'magic values' used by SoftIce.% U5 z: r- z% p$ z' _& X
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
$ f( @2 \2 |: K/ a# W ~
5 ^! l1 y) g' e) C! sHere is one example from the file "Haspinst.exe" which is the dongle HASP, o) ? p) D# \1 E+ q% y8 R. m
Envelope utility use to protect DOS applications:
2 ^8 G5 @6 J! {8 v
+ P0 P8 |& O* h9 ]% Z8 D4 R. i D. X' w
4C19:0095 MOV AX,0911 ; execute command.. W" `9 N3 e" a2 O
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
0 Z* l4 u6 n- A& i4C19:009A MOV SI,4647 ; 1st magic value.: c4 o1 d \& y; h/ c: S
4C19:009D MOV DI,4A4D ; 2nd magic value.
: p% Y+ i: {3 z( x6 V7 X4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)* }8 |; I. Z/ a5 x9 r8 T( a
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
9 f. w$ G+ R( L! \* c+ `% `4C19:00A4 INC CX
1 U p! h3 S1 @: S- e8 p4C19:00A5 CMP CX,06 ; Repeat 6 times to execute+ H7 l& s: l# l
4C19:00A8 JB 0095 ; 6 different commands.
4 t$ F3 }$ k1 g" p3 ?6 ^% ^4C19:00AA JMP 0002 ; Bad_Guy jmp back.
: a. M0 d2 r" ~: g) e/ M# M4C19:00AD MOV BX,SP ; Good_Guy go ahead :)8 ?1 _4 D: d0 L- D
$ `: e9 F3 n# a$ b* ?" v# g
The program will execute 6 different SIce commands located at ds:dx, which
; x1 W& h( \" v7 p" qare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
- x8 K$ T- x' h6 ^" z% @% P( c9 h; E5 e8 S1 p. s
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.! a1 E G# q$ {: f
___________________________________________________________________________. r4 N2 H) y0 ?; W& J% g% r
% B. T* ^8 ?8 a0 E6 k r5 K* z
% S m4 W- g- y& q% [4 ZMethod 03
, t' Z" F" s4 x. i& X; ?( F=========+ f! w( v1 i. Z% l
! b! g5 h7 @% I4 }; g1 i" Y' MLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
8 x% d8 a' L7 g# l5 h1 Z(API Get entry point)& i4 r; j# ]0 k
/ z7 h) Q; s& [) j: i7 L
" @; b3 F' J3 a* R* ]6 w. g xor di,di
4 a4 [6 {; y% I6 b8 ~2 w mov es,di
" g2 j r4 w( [$ u/ i3 C mov ax, 1684h |' [1 X5 ~0 N ]' I) A
mov bx, 0202h ; VxD ID of winice
2 S ]7 f8 i$ K3 z int 2Fh1 W4 l2 ]) g* ]; x( J4 e
mov ax, es ; ES:DI -> VxD API entry point9 R7 y/ {& m" x+ T
add ax, di
) a! ^% `; [8 g* p# z test ax,ax1 u. J+ ~5 @4 B9 ?
jnz SoftICE_Detected( p% d& {+ [: n; s* {5 y z' \( m
4 J* g" _+ o5 u% b" F* N! ~___________________________________________________________________________- F4 u$ h7 b% y
, H7 P# z) M. p/ g7 m) i/ w) Q4 I
Method 04( s2 Y1 Y9 N7 n; L$ d
=========6 ~# O6 F& [' e# a
) \2 H+ ~, I9 u6 P- k) ?Method identical to the preceding one except that it seeks the ID of SoftICE5 _/ c* Y! {& m3 G, _' j5 d1 C1 y
GFX VxD.
, y1 p' Z; v2 K6 C" n- Z
- [2 @4 H4 y/ Y4 v' ]3 R! ~9 \ xor di,di% M7 x+ w; |/ g P; m, S
mov es,di/ {" [+ \5 ]/ _
mov ax, 1684h
5 \% I3 G7 j X$ Y6 d7 H" ~" o5 r mov bx, 7a5Fh ; VxD ID of SIWVID! N4 Y* x, t" w( Q: ]& A' \
int 2fh
) Y4 y( W- }" k, M. w4 l mov ax, es ; ES:DI -> VxD API entry point6 W6 i: K/ f7 Z0 h4 B. u4 Q
add ax, di7 O( g! L( s Y/ O8 {
test ax,ax
9 G" L. ~4 \* H7 p' l& t jnz SoftICE_Detected
% M: J: W- H% R, b9 l
6 O0 R2 R' W4 ~/ s__________________________________________________________________________
( `/ r b) _+ B9 p, {
2 _4 N/ Q9 p K# ^! h, i" ~/ O) w5 \: {! E* T+ I' ]( t
Method 05
7 o( d: E" @. \, N/ b6 u* S=========& w: |; Y, U5 k9 I
, Y5 j* s, Q- _* j
Method seeking the 'magic number' 0F386h returned (in ax) by all system) j0 [, T V% j* Q
debugger. It calls the int 41h, function 4Fh.+ X4 c6 a7 m5 W: I$ n8 s
There are several alternatives. % R8 x% O" A* I ~
6 a4 w; v! W. @5 u
The following one is the simplest:: T( `/ X$ x N4 k. G* h$ u: K8 h! s
% K" A% g; @+ {) D
mov ax,4fh
% b, X6 V" \5 } M1 i0 Y1 Y int 41h
+ y2 ]2 [8 ^' \; d8 g1 y cmp ax, 0F3860 o. @$ ^* f; t$ d+ f4 F X
jz SoftICE_detected0 G1 x! A% [% v7 U' _; `% ~' ?
2 |1 u" g, p* q( g5 @2 C" r6 o% V# S! g
Next method as well as the following one are 2 examples from Stone's / P+ O3 u. F9 c: r+ R, ]
"stn-wid.zip" (www.cracking.net):
! F! u1 \( I; [9 a9 r
7 H0 a$ K. f+ o: t% I+ D/ h mov bx, cs& l, _( k8 s/ i/ A4 }7 B6 j
lea dx, int41handler29 k- u9 N0 }& B$ z# e0 w
xchg dx, es:[41h*4]
9 a* Q. f# X0 e% s4 A& a5 }$ W xchg bx, es:[41h*4+2]
5 g+ l. V$ q c2 [ mov ax,4fh
2 s. s h7 V; X1 G6 ]" H int 41h) }8 O B+ B5 m* {# S
xchg dx, es:[41h*4]8 i" K0 T, o: R0 a y9 }
xchg bx, es:[41h*4+2], `9 D" L+ b1 a( N' {4 b" `# |: C
cmp ax, 0f386h
- ?, q5 c, c+ w jz SoftICE_detected1 e# Y# h& u" B+ `5 ?5 S o6 p& k
0 Y0 _$ F3 f) p L
int41handler2 PROC+ ~0 S; d4 i5 F
iret
0 j' x2 u/ ~8 j5 l" h9 j. Oint41handler2 ENDP2 ~ L j0 {! L+ Q* g+ ?2 e- v
4 m; H3 {1 @% N( h: B
6 H$ C' N' z6 S! q" ^
_________________________________________________________________________# y3 [# n- a; w# V9 t: q- D
) ^6 x4 E8 k: ~- z. u/ n/ }; b
: T) D" H' B5 _4 z3 a
Method 06
J1 j* Z- W* u) |' h I- X1 y* W=========
0 n2 J8 m1 f- r2 K/ f
! Q2 N8 _+ s3 S1 P- d
2 O2 `% N0 ]* a3 `4 O2nd method similar to the preceding one but more difficult to detect:
! J8 W( Z F* i. _! V' p- @0 z' C5 [
6 r) y8 F* k7 z& K5 j* x2 E
int41handler PROC
! h8 [- Z% R, K; n2 B) ^ mov cl,al. R. L8 ^5 y) `# T* w
iret* h& `7 h+ _; J5 I4 B
int41handler ENDP
1 N, P7 Q2 s4 O4 j8 J! K0 J# w# j# f2 c/ X+ v" ]0 n
( r, C% f! p# s: G9 u6 e xor ax,ax0 p2 q H9 l, O; s# t! J$ f
mov es,ax
" H7 E& S! W8 s/ j9 M. A mov bx, cs' t$ r7 }, l1 {
lea dx, int41handler- S% R% {+ E; Z' d# n$ M |) b( e0 o
xchg dx, es:[41h*4]( Z" K+ \/ q: U
xchg bx, es:[41h*4+2]
: Y# z- Q. x, `5 ?8 x: X in al, 40h
% s) w# M6 F% x" L3 l; X xor cx,cx; f. N. K- f! @7 Z4 F) s3 W5 B
int 41h
, |4 o1 B4 o$ m, g7 |& `) z0 h+ a xchg dx, es:[41h*4]' I# M* f# Q' Q. b$ Z- L
xchg bx, es:[41h*4+2]
% p. }& G8 L' i9 [" d cmp cl,al
) A: O" T% j8 d! G jnz SoftICE_detected' v( k: Y0 b! ?" m1 L( W7 X5 N3 s
5 L8 X: D( i, `' X+ V_________________________________________________________________________, G" e4 e7 ]) ~+ [
d0 U* G$ [( h
Method 07/ S( n6 {. b8 _$ ?1 E0 @& ^
=========
2 l$ v2 F9 h. _- {" m6 z( P* K4 Y/ @
Method of detection of the WinICE handler in the int68h (V86)
K5 ^& C/ V0 q
+ _. Q6 O# n6 @6 _0 s# a+ W mov ah,43h
" A0 ~$ F' Q. P0 O1 h int 68h6 k3 ?$ S$ S, I4 C
cmp ax,0F386h
6 M2 ^) e) z' _) M0 ] jz SoftICE_Detected" n" T% n- n' I* u/ Z2 V7 Q! J
0 i7 a/ ~6 F" R! Z- F5 Y$ y9 _, {; w `3 e( Y- q4 }/ B
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit2 r1 Q+ X! |& `" S1 \$ x
app like this:
: C* S% d% ^1 r2 G. P, b& v
3 y3 b* J' i* D6 ~# d BPX exec_int if ax==689 r: ?4 p0 M+ e6 X- C. |4 \
(function called is located at byte ptr [ebp+1Dh] and client eip is+ a& v1 W( \/ E
located at [ebp+48h] for 32Bit apps)
. f5 i5 S4 }0 q! T3 W$ S1 i; Z* p! l2 A__________________________________________________________________________2 Q4 r( B+ d" b0 o8 Y8 b
, l8 _4 [& Z& p9 d+ D
" A7 U" `( `5 n% j, P A5 t Z, a
Method 08
0 v7 @1 t. b) i=========
3 v# e" c( y: u
( E: g0 @( Z! y0 \/ lIt is not a method of detection of SoftICE but a possibility to crash the, j5 O. f2 L' T! [- O1 f/ {
system by intercepting int 01h and int 03h and redirecting them to another
# n( x% D( S8 Rroutine.- n: K( U+ X$ W8 [3 s7 W
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
, _* X' E4 E( \) fto the new routine to execute (hangs computer...)1 n5 G: k% G& T
# |0 H+ {* r& B
mov ah, 25h
2 \6 K9 |) P) U5 d8 x+ q, U mov al, Int_Number (01h or 03h)
9 `4 j0 H4 t# {' ^ mov dx, offset New_Int_Routine0 W7 _+ A; R& x2 j
int 21h. D& r; y( {; y8 s A0 H
& H z5 }. g' g9 \6 r4 e/ ___________________________________________________________________________
& ?; Q* b1 i p' v% W# s6 M/ h
) C3 k& J( h$ ^# Q& xMethod 09
, D1 w0 y5 U% g' k# F h$ j=========
5 ?! d& g( d% e( i0 P0 K W3 X( ^9 e
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only7 P" W6 T" A: J. u2 S ^2 @& L
performed in ring0 (VxD or a ring3 app using the VxdCall).
$ S h5 F. n. T& CThe Get_DDB service is used to determine whether or not a VxD is installed& ~3 ]7 N0 a" D5 F
for the specified device and returns a Device Description Block (in ecx) for
- ?7 T/ K& t% ~2 `that device if it is installed.' X5 k/ k' B: k6 C/ k% J1 ]
+ X5 k* L& u* d Y( r+ _. v
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
: R* f" A$ Z9 H: F mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-); o$ z& B R Z7 [/ a
VMMCall Get_DDB
) j/ N% ]& A' @ i' I mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed; z) o9 ?2 |8 {( E
! \5 D9 s/ p. h
Note as well that you can easily detect this method with SoftICE:3 g" R! g, W' l0 K! G) `
bpx Get_DDB if ax==0202 || ax==7a5fh6 ?5 l* l( k* Y( @
9 O% P4 y/ Y0 i( ^) Y/ q# E
__________________________________________________________________________) a0 d7 g9 I9 F: h& b
* y5 O+ E2 p1 E$ tMethod 10
4 h$ T9 g6 [ t( T ?: e=========
; O" P# ]. n) y6 x
1 e0 y0 E: ~6 p2 B=>Disable or clear breakpoints before using this feature. DO NOT trace with; R5 z! L% f! R" [1 s' [
SoftICE while the option is enable!!) k( u2 b. q0 M) a H2 x7 ?
8 U" C) W. ?6 z; x
This trick is very efficient:, r6 k, }9 _5 V) R8 X+ s. u
by checking the Debug Registers, you can detect if SoftICE is loaded5 ?! w+ G( k& @- z% o, ~
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if( p& Z7 s* u7 z# i5 V' N3 D% S" U
there are some memory breakpoints set (dr0 to dr3) simply by reading their
: b _) b0 q: x' Qvalue (in ring0 only). Values can be manipulated and or changed as well
& E1 V. G+ [$ R' v/ ]- `(clearing BPMs for instance)3 a6 i9 T! |1 n1 T0 a
3 B2 w7 c+ {! @0 }$ r- y# o__________________________________________________________________________$ d4 {4 Z- K& v* w9 ~0 o
+ } `$ G* B& k2 g& NMethod 11
' K5 p7 O: S1 F4 x; X" n% L/ P=========
2 s( h9 `( E. l% s, T- Y+ ~& R) i I
) R. ~# s7 [! F& |This method is most known as 'MeltICE' because it has been freely distributed2 `% [% M/ e7 s2 P3 z
via www.winfiles.com. However it was first used by NuMega people to allow R- a2 g( `- }7 k: \% ^
Symbol Loader to check if SoftICE was active or not (the code is located
4 `& c, _1 k& s7 B; S: h7 ^inside nmtrans.dll).
; n3 c+ W. W& p$ y/ {& r1 d5 s* L8 {3 m* ~
The way it works is very simple:9 B9 ?$ t4 l1 H
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
+ ~9 D% y8 K& ^7 {WinNT) with the CreateFileA API.3 f r$ B+ ? L: T# I' [
& \; J! o# S6 m# M4 W1 I6 KHere is a sample (checking for 'SICE'):
7 M! t. e. J/ d, {5 b4 K6 p2 S
+ w6 S# V. s) XBOOL IsSoftIce95Loaded()
8 l4 v) g7 h. {1 K8 N- I{
1 N% `7 U& V" J9 S; z HANDLE hFile;
% @5 j, ]) x3 p- }4 W( h- i/ | hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,& i6 A* ?+ ]6 W* a9 ^2 |) R5 p
FILE_SHARE_READ | FILE_SHARE_WRITE,, ]% R$ x: A: g7 [
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);8 k6 Y5 N C+ S9 a
if( hFile != INVALID_HANDLE_VALUE )
- c& l, \% J1 L$ F# p. H# f! M {
3 C% [* e4 p) O7 L CloseHandle(hFile);2 @% h8 o. A C
return TRUE;
" |- z. x' U5 b1 H+ V, x }
+ t- b, c- x1 d. J return FALSE;
% P+ a y5 ^6 f3 Q& c" ~}5 C6 l; @1 Z# `
/ X% }4 l$ y6 J
Although this trick calls the CreateFileA function, don't even expect to be8 }6 w8 r9 l9 h5 ^5 d. U
able to intercept it by installing a IFS hook: it will not work, no way!
0 {6 }) F9 K- i7 }In fact, after the call to CreateFileA it will get through VWIN32 0x001F
' G: R l3 E- j+ ]- qservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
- W. O' h8 n% t$ H% G! Yand then browse the DDB list until it find the VxD and its DDB_Control_Proc- T+ p: a# S6 y
field. p7 V2 W& U+ U
In fact, its purpose is not to load/unload VxDs but only to send a 5 a5 I% L5 i9 I2 A" W6 }4 r
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)7 k3 M2 Q! ]5 e
to the VxD Control_Dispatch proc (how the hell a shareware soft could try0 C0 I2 d' p) i. p; J9 [' |6 r; [
to load/unload a non-dynamically loadable driver such as SoftICE ;-)./ s$ }& C& f8 b
If the VxD is loaded, it will always clear eax and the Carry flag to allow+ V1 J6 P) k8 c& P" a
its handle to be opened and then, will be detected.( S& H% _ z* R+ o4 I' }
You can check that simply by hooking Winice.exe control proc entry point. u( X( V! `( U% w% o5 v3 v" h. F% ]
while running MeltICE.
9 V, ?1 `" Q" r9 Q; C5 H
6 j8 k9 O/ j9 O6 j& B5 J% e
3 c, s+ M; l' r% n, J 00401067: push 00402025 ; \\.\SICE
$ `) t3 |$ n: Q( a 0040106C: call CreateFileA9 r+ J0 P6 ?+ h; j+ S
00401071: cmp eax,-001
: b- H) L+ S7 X: H# A) l 00401074: je 00401091
- h/ `- ?: `$ z. n! D. j; o4 _* b0 q- V/ ]# p" T9 q: O
0 M$ K9 w+ `; I; d5 M* V7 H; ^There could be hundreds of BPX you could use to detect this trick.
: x/ s7 K' q$ ~* m4 ^-The most classical one is:5 A+ }8 ^5 W+ H! a
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||' |1 }" @: U" X% i" t M C
*(esp->4+4)=='NTIC' Y7 W b+ s! i. e
/ o% {) K, ?! t, E
-The most exotic ones (could be very slooooow :-(: Z% W( k: o5 O1 N2 o
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') ; X5 Q4 g i4 t9 a; u5 }$ m
;will break 3 times :-(
' c( H/ _; g' U
( r, Q) U& c& B s, F-or (a bit) faster:
+ ^6 Q `0 z3 ^6 A* s4 G! \ BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
) y$ j0 z6 o# f ?, u8 f
% _* g% E6 U# p BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
2 z) a7 Z$ Y9 O, P) X N ;will break 3 times :-(" d0 n4 a' [( ^! o$ Q) R
. g4 A/ Y+ N" \
-Much faster:$ I% K0 w8 v, }, n5 R
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV' ?4 s- Y! I. k0 f) C3 c
3 @2 G2 `8 \- T/ jNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
+ M E4 y6 o4 ~3 [4 C, w3 mfunction to do the same job:
3 X4 F V2 a: x+ g! `5 k+ ]3 i, f O. ^1 b" y% u/ k
push 00 ; OF_READ5 X% ?- K4 a+ Y
mov eax,[00656634] ; '\\.\SICE',0
8 _0 R" O" {" @/ D; A push eax w" Q' d9 `7 J! }* y" a
call KERNEL32!_lopen) N2 O- T/ w2 Y- [( B
inc eax3 f5 P8 `+ G) h9 A
jnz 00650589 ; detected
2 C) {4 ]% Y9 U1 Q; b5 K push 00 ; OF_READ3 p! U Y! q" k! @9 o
mov eax,[00656638] ; '\\.\SICE'
5 E6 V5 B% ~/ l$ ^8 C push eax
2 z8 _8 o, Z6 w call KERNEL32!_lopen2 T4 z/ B; ]4 y) U! g; s; m9 O
inc eax( G2 j8 k3 H4 T
jz 006505ae ; not detected
) b6 o0 ]5 d, E; S+ G( k9 A: _2 Q2 g" Z% F
4 q- C6 Y _8 m" n8 m
__________________________________________________________________________1 A- d' K1 b7 ^1 ^1 x
. F; [! K! G& E0 ]- e/ _
Method 12
& U/ Z9 d$ @0 u$ f8 v1 D/ R. z+ t=========( F. S& E" E6 F& q
+ \8 s/ D+ ~1 U! G1 t) u6 @
This trick is similar to int41h/4fh Debugger installation check (code 05( f$ v# O" G: Z$ u$ i
& 06) but very limited because it's only available for Win95/98 (not NT)6 C9 {& U$ b6 }+ q; e
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
! d. b) C) W( F' H, a
: }7 y+ |: G9 n push 0000004fh ; function 4fh# ~8 C+ M' K' B$ u# q' G
push 002a002ah ; high word specifies which VxD (VWIN32)+ H1 f V. c0 |1 g1 v" _) T# F
; low word specifies which service! R+ _6 @4 `6 h9 n4 ?
(VWIN32_Int41Dispatch)& e: U/ W' O( D# t x
call Kernel32!ORD_001 ; VxdCall
5 R8 B2 H- q. M* ?+ v cmp ax, 0f386h ; magic number returned by system debuggers
# U/ J& c. _' E1 ^, I1 X jz SoftICE_detected+ r( g, u7 W4 c& [ D6 B9 T1 g
; [! A6 m; h+ \) ~Here again, several ways to detect it:1 O$ m2 o5 p% _! S4 [
/ P5 u2 j1 i" @. h$ e2 o
BPINT 41 if ax==4f* \$ o5 p0 \. n: ~" S$ P
* ^3 X, l3 o1 Q- v3 c8 l$ R- o" d
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
+ s3 S" w4 q4 I% W. B
3 n+ c! B" l6 ^& ~( V BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
$ v7 _- K6 _! G& r1 h
# Y A! e* b$ y5 `7 v" @ BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
- m( F) {4 }3 z! V4 k K& x1 x+ C: \/ V0 t7 A* a" r
__________________________________________________________________________
' @! n2 h# O }) ]8 j5 W+ K7 M! V3 t1 P( r3 N+ b' B
Method 134 B8 M4 a) @. y) h. A2 x7 e# ^
=========
( [1 L% t5 ~ }% y% J+ T0 Q) O5 o4 }. \: ?0 t
Not a real method of detection, but a good way to know if SoftICE is7 ~6 b+ u( f9 j) c# l/ H! ?
installed on a computer and to locate its installation directory.
* A& F% z" `+ o- |! C+ F# ]It is used by few softs which access the following registry keys (usually #2) :
5 c& N7 t; Q. w) U4 b# P
! o W% Q/ a5 W+ {-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
1 w# Y4 M5 f @- ^ ]7 ]: B\Uninstall\SoftICE
. I8 k/ h1 l* \7 R" M-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE) A8 w2 {* K' s8 u
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion$ }2 r+ |2 L% |5 Z6 k- ^
\App Paths\Loader32.Exe) ]" ?) v/ r/ O" ?. b( L
2 n3 y% R7 |6 m( b+ _% A: V
) e, y4 A7 M" w1 k5 K
Note that some nasty apps could then erase all files from SoftICE directory# O) E) U1 F$ v# x) L5 h8 H$ `
(I faced that once :-(
: F' P8 f3 k8 k3 g5 w$ S8 r+ M( I& `0 B( _9 L
Useful breakpoint to detect it:' f8 c7 g! r2 L7 q: d
4 I D: ?# D |" ^5 S5 X BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'# V j7 [- H8 T0 z- j- R* e
) o8 X( t0 ^. G__________________________________________________________________________
- ~5 G0 |% `# @3 [+ R$ F" T, J/ V0 O
5 | Y# N T4 T5 E0 [; t0 V O* {! ^7 `7 Y9 _0 O0 R7 O8 t3 Z
Method 14
# e J2 N7 L/ n6 N=========" ~6 E# `5 c* Z' U3 g1 ]
, C) o$ T+ @" Y# i' ~A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose4 `0 j5 i" T7 ^! N
is to determines whether a debugger is running on your system (ring0 only).
4 i0 s& W+ i. h X% c# U$ A% q: N. q& q; V6 X
VMMCall Test_Debug_Installed' f+ l) B/ ]$ u' i7 u
je not_installed1 ^3 N4 F- M: I0 W5 r1 q/ Q
5 n$ I$ J; k# t3 ]$ D2 [/ C8 A, ^This service just checks a flag.
9 K u8 K# `6 Z% B</PRE></TD></TR></TBODY></TABLE> |