<TABLE width=500>1 y; o$ r. X* o" T$ f/ I
<TBODY>
$ I5 {" a5 _& ^$ v5 i3 s. `<TR>
. Z/ }& e, K2 ~- ]- u! D<TD><PRE>Method 01
# L. C9 a# Q% g% Y- X" x=========
- ]+ }0 m1 A, U$ s2 f2 w% ?% E8 r$ U6 _
This method of detection of SoftICE (as well as the following one) is+ I6 R; u* i5 }- N; e- Z
used by the majority of packers/encryptors found on Internet.4 Q7 J/ @ q, J! i
It seeks the signature of BoundsChecker in SoftICE& h- V, P4 E) x) H) t! G
A6 W7 w6 s" B2 x8 p6 h. F mov ebp, 04243484Bh ; 'BCHK'/ H5 s: Y4 `3 T
mov ax, 04h, f u" B U5 {1 M. Z
int 3 ' |1 l4 R8 J7 \6 J( t- v9 Q) J3 [
cmp al,4
5 [: g6 }/ R; ~4 w/ J jnz SoftICE_Detected2 Z( P& V" m) n
7 z+ A. c9 H7 \
___________________________________________________________________________
! u8 i2 F: }! D! t- H
/ ~. {' {% o$ D y# \: Z# jMethod 02! l6 K1 _. N; e: J! T6 }
=========
; q0 K ? C+ m2 \% Q+ Q
# n$ I9 {3 f4 m" c' h, R* kStill a method very much used (perhaps the most frequent one). It is used
1 w- f% u* {$ C' G/ O" hto get SoftICE 'Back Door commands' which gives infos on Breakpoints,4 K- D# P+ j* r8 W" ~! ^/ L
or execute SoftICE commands.../ ?$ n; q7 e# X1 `: G
It is also used to crash SoftICE and to force it to execute any commands
1 G: b9 m, B- p {* \6 x(HBOOT...) :-((
/ z' T P$ \6 A
4 m8 ~$ }2 m8 S0 X+ N/ |5 @Here is a quick description:
) i8 z2 \ B8 F8 V-AX = 0910h (Display string in SIce windows)
3 I1 B# H1 ]7 ]7 P' g* C( }-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)8 D, D% }5 V9 w0 q1 `. j
-AX = 0912h (Get breakpoint infos)
7 k) H2 I4 P+ r) o-AX = 0913h (Set Sice breakpoints)
6 ~, p/ D. O* f, [! D P y-AX = 0914h (Remove SIce breakoints)
: {' ]& ~- s4 I$ X$ H5 H1 D
* b1 I; ^. Z h! M3 [. s" b) Q" oEach time you'll meet this trick, you'll see:
! x) [2 K1 `7 F! z-SI = 4647h! \) H8 d* h6 s7 {; Z. ?
-DI = 4A4Dh' |0 g" b7 i6 t( D* k! e& f
Which are the 'magic values' used by SoftIce.6 L, E( @) ]5 ]) X- V/ y1 Y
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
) s: N2 `! f, @% _4 k- ~2 Y/ A+ ?9 ~9 `* P# Z
Here is one example from the file "Haspinst.exe" which is the dongle HASP
) d) D0 i- }7 t. CEnvelope utility use to protect DOS applications:3 ~" A( p. ?& T( s) R
1 W) F! f' r \8 x3 i5 G
% z! @+ _$ V a, C6 r
4C19:0095 MOV AX,0911 ; execute command.! J q5 @# t2 m
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below)., r/ V0 _7 i6 I
4C19:009A MOV SI,4647 ; 1st magic value.
0 ?# T% w' ^- D2 i( Q8 G' W: m9 z) t1 {4C19:009D MOV DI,4A4D ; 2nd magic value.
5 F% m, e8 }! [' b* `8 L( b$ d. d4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
, @+ `% L, z x& q; a4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
: j0 x& _/ [- ?: K7 m/ e! W1 X4C19:00A4 INC CX0 H2 K( e, B$ j! Z6 {7 j1 Y
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute' O0 a/ H% n s6 e$ r- |2 o
4C19:00A8 JB 0095 ; 6 different commands.
3 }' ?! K6 ?9 m% `$ A. M, M4C19:00AA JMP 0002 ; Bad_Guy jmp back.
n5 U0 o+ {% s1 u5 c# O9 V! v; W% N4C19:00AD MOV BX,SP ; Good_Guy go ahead :)9 ^. L' {. r' J2 O; n! B
0 }0 E$ N/ ?# o! y5 j T% m: U
The program will execute 6 different SIce commands located at ds:dx, which) t! N) n: \3 D' R8 v+ h% P3 {
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
: N2 @$ j* G0 V* U8 {6 f. E1 f* z( x6 V, U
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.7 H6 ]& G6 B4 ]
___________________________________________________________________________0 T" }& \% p5 O( E2 D" `2 D
. r5 e$ a& _% _! ^8 f9 V) U
# }' s- g( |; N7 x' Y
Method 03
5 ^. ~6 V" k8 G/ }7 b6 M! Y2 j=========7 Q# o `5 b0 L0 R
9 H0 x5 C& ^, H u8 X( W: o. W/ hLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h* `8 @6 I% U1 W! d- _5 s: t
(API Get entry point)3 g: M: K, n k1 T# R
2 [' J7 o0 Q( @
8 W( M! C$ @- R3 N; N! S xor di,di- z1 v4 x) z* \2 @/ `
mov es,di
$ k1 w& p! b+ b |! \+ t mov ax, 1684h : d6 k) M$ h+ d( W1 r* l
mov bx, 0202h ; VxD ID of winice" b1 f' v' l$ \
int 2Fh* K7 W5 }. V8 w
mov ax, es ; ES:DI -> VxD API entry point
. L9 D* ^6 G# _7 [5 y; a add ax, di
9 ~5 q7 r7 L9 ^( o test ax,ax3 A7 A: {6 U( e% Y
jnz SoftICE_Detected. P9 [3 C$ ?0 i$ M
9 T S; m0 Y6 b' `
___________________________________________________________________________8 ~" Z& E* \2 L; c* s
) l" U! z8 N8 k h( W! }% H' f
Method 04
/ H9 r8 H' M$ c- c0 c m=========' g& u; | s# N$ I6 x- z
. F+ Y R1 p4 R5 o! b; ~7 R6 ]1 L, EMethod identical to the preceding one except that it seeks the ID of SoftICE: y1 a/ C8 m4 D8 M' v7 F
GFX VxD.
" p3 O1 n k. v# u
" ~. h0 s. W2 x t3 {6 N xor di,di# ]$ w6 f+ e4 B5 k G0 L
mov es,di
" x0 S+ N* s5 n7 `1 g4 \ d mov ax, 1684h ) |) S) i( e; [0 s
mov bx, 7a5Fh ; VxD ID of SIWVID n' H; D: |4 z, C+ I* ~
int 2fh
8 g- ]* o2 c* U; j mov ax, es ; ES:DI -> VxD API entry point
5 _ j' j7 W9 X% t I$ @, [ add ax, di! C- c# @4 [) B9 z+ I
test ax,ax) V' {1 d: S; M) Y3 Y3 A. ]0 B
jnz SoftICE_Detected7 l( R, Q( B* e% b) p! |
3 d1 C+ k1 C+ }7 Q3 B" z/ C6 V
__________________________________________________________________________
' H8 y8 V. }: k: W( j6 g. n3 W, F
: T- [& D8 B/ | ], |) G& a3 Q7 C* ?! P$ ?
Method 05
* {$ l$ y7 |; \9 U/ y0 w=========" L0 S1 x: A" S+ f @6 l2 S* b# z3 v u
' Q g7 Q. I. l% ]8 p; a ?
Method seeking the 'magic number' 0F386h returned (in ax) by all system2 D7 ^6 B* H; D6 q- P D2 X
debugger. It calls the int 41h, function 4Fh.
1 Y( n6 A5 e/ G+ H2 F6 ZThere are several alternatives. ) E3 O# a8 P2 [( H; r, I6 u
! e- E8 J* Y3 N( | UThe following one is the simplest:
4 c( ?- ^$ U2 F0 U* |1 J, ]
9 u4 n+ n/ P* N9 t mov ax,4fh7 q& R8 G9 g" D
int 41h
5 `; P& i, Q* b5 N8 h$ \3 g cmp ax, 0F386
; M- R$ V/ d8 }" G jz SoftICE_detected
: ] V) w# v0 l# n0 B! Y3 z U7 |. D0 l
" S S5 T' y$ j/ {" y* l; x9 I
Next method as well as the following one are 2 examples from Stone's
# A0 J8 ]( z6 C' Y"stn-wid.zip" (www.cracking.net):
" G. p( K) w# \" ~ D) J1 R3 \% q/ H) { o' m0 A
mov bx, cs
% @# b" S, e: l+ W lea dx, int41handler28 R c% ?, I; X+ l* ~" }" q7 B
xchg dx, es:[41h*4]- a4 ]/ z7 ^: i+ P, k$ j$ U
xchg bx, es:[41h*4+2]6 m" e$ k, }7 Z8 D* Z' p1 a) L
mov ax,4fh
: p2 q" j" Z* q* {( f int 41h
7 e" c+ W& M0 L& Y* U xchg dx, es:[41h*4]
4 E: S. E9 d; J* Q xchg bx, es:[41h*4+2]5 |3 P" h5 a# {) A4 s- ~
cmp ax, 0f386h
0 z$ `4 x5 z6 \ D9 Q jz SoftICE_detected9 k2 g. F7 y" j) V* o# W
4 F5 K" Z' r. R7 a* |1 v
int41handler2 PROC: `' _; Z# e5 x! J, \0 D
iret
4 D9 d5 L8 ~$ J0 `int41handler2 ENDP( Z5 B" b8 u( E! B9 z
* |5 v, Z/ B; [
4 \5 l1 f1 I2 ]! C_________________________________________________________________________: B. z$ a7 G2 S
7 f. ^5 W n/ H- f
' D7 A6 p3 F# y2 X# {Method 06
/ {, }/ i/ f6 y3 \, {3 x=========
4 X4 T# g7 L, M
) t! f' d7 z( K5 }, H" W
; k. d# R% z7 m/ A3 ^# c5 @2nd method similar to the preceding one but more difficult to detect:/ y8 P/ a- V0 o
3 a5 d& I4 G0 ^/ K
" R5 O& r9 S/ A7 ~8 Z- S4 ^int41handler PROC
& F& g" c2 y2 M mov cl,al9 P% l. N* q% t
iret
- b, p; o7 i% Vint41handler ENDP, T. D9 ~, i. T! U
+ t/ w) |/ B9 M; ]8 |, ^
% U5 y2 M+ O* P) A
xor ax,ax
4 W4 ]7 | E2 W" y4 y5 [2 o2 x! G3 O mov es,ax
* [" K% @/ Z- M* a$ E \$ y% Z mov bx, cs; }0 C4 N1 c# o' ]9 t+ w
lea dx, int41handler# v5 w$ D; J9 } c+ t* \- ]
xchg dx, es:[41h*4]
! i8 V8 o4 H$ m4 _8 n% f xchg bx, es:[41h*4+2]
' p& C) \/ m- E0 X: g! \ in al, 40h
. `4 L# T8 I, \, Y. f& ] xor cx,cx
7 `& N; [8 }$ ^0 o2 Z int 41h
; q; n ?- j- R; k xchg dx, es:[41h*4]: t# C! G# f N4 f! h
xchg bx, es:[41h*4+2]* |( I' `! w. k' ]( u( t9 k
cmp cl,al" A$ }: Z! _1 W4 _" E4 e# x/ p& Q
jnz SoftICE_detected9 M/ W4 {" U3 _; e
. h2 X3 h" w; g* q! R! z; H
_________________________________________________________________________
/ m* k2 w4 q+ y
8 o+ A# s. o3 }" R: q8 }Method 07
4 E P$ Q) r G( c2 u) K- _=========9 `9 r! x8 j$ s, z) l8 R- @3 g
6 l$ F5 {) ^/ b0 SMethod of detection of the WinICE handler in the int68h (V86)7 g [' j0 F3 p* b; U
0 u4 v+ O6 A) _4 \ mov ah,43h9 ~4 d. }3 g) o9 p" d
int 68h
$ \1 ?7 s% S9 l# W4 I cmp ax,0F386h2 j; K, e L) x- Z6 i4 s9 A: }
jz SoftICE_Detected+ O! a% t! o; X: s% X# y# M& w J
/ v5 b; \$ U8 d- ?9 E0 h3 N
: P' D' y. [) N7 q=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit- l) b/ @9 H' \3 |9 t0 e
app like this:
, @4 R% W9 X( s" G/ `4 G [$ N, z3 {" S: u; U% m
BPX exec_int if ax==68: w5 z8 Q S3 d7 s7 R
(function called is located at byte ptr [ebp+1Dh] and client eip is
' e. M% p3 p9 l L {0 q4 C; z located at [ebp+48h] for 32Bit apps)
9 ^- A; M) M: q2 z__________________________________________________________________________
* d5 U4 O6 P% Z" U: v. U# e
1 b9 S/ T! y" ?$ F! A" h% W7 ?; [) k6 W2 F! o5 U
Method 08
) ^& Y7 w% R7 |5 s9 Z9 X=========
p: N4 T ]- [! T
/ @3 _( z7 \7 Z" v. `4 _# cIt is not a method of detection of SoftICE but a possibility to crash the1 \0 g" r& L7 m+ z' Z/ ^4 ~4 }
system by intercepting int 01h and int 03h and redirecting them to another
( _7 R% _( K- W8 R7 o$ `routine.7 |/ s$ p1 }5 o5 ]3 F
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points2 p( m$ n1 b% I6 _
to the new routine to execute (hangs computer...)
8 S& l6 s) g( W4 ~, s4 g3 x# g4 `+ i; D$ i8 \* \& K) b) u
mov ah, 25h2 o* ^6 R" p$ M4 s7 Z
mov al, Int_Number (01h or 03h)
8 l$ }" s" i, U$ |+ [ mov dx, offset New_Int_Routine
" u. s$ E* Z3 w2 H& q. a int 21h
& Y& [% X8 B$ q- s2 J
6 G( ?( `2 {7 G8 F* O: ^; P4 A" t2 k__________________________________________________________________________
9 V1 I$ a8 ^4 T3 h+ H
# q [; u( k) o. y* X$ zMethod 09
/ Y5 P5 k: a# R& j8 E+ c- x8 l=========& V8 @$ ^' H: z
+ a7 H- T* ]6 w6 J3 o
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only$ u+ j/ `9 Q* K3 x- h6 x- s" A7 B6 _1 I
performed in ring0 (VxD or a ring3 app using the VxdCall).- z1 Z/ g2 ~2 A7 i
The Get_DDB service is used to determine whether or not a VxD is installed
/ s$ m, ]/ f; M" ]for the specified device and returns a Device Description Block (in ecx) for# X- V4 N2 |2 u6 {, D
that device if it is installed.
, M2 v2 h( b+ F) K2 z. k: B. a; ?0 A5 E! K W. F; e) @) I
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
: s. [6 o3 p: p" \& ? mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-) [4 t) g, Q& {* C
VMMCall Get_DDB
, N6 l0 u5 ^5 m0 s ~2 j mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
0 j% B$ p9 r, q% F
- O9 j5 H6 e( l$ ^- ^Note as well that you can easily detect this method with SoftICE:3 }* w. j! T# x9 x* D% R+ P4 `4 m. e
bpx Get_DDB if ax==0202 || ax==7a5fh
0 M5 n2 u7 l6 ?: g% Y5 x
0 L: P4 ?# J' x9 t l& ]__________________________________________________________________________, ^9 V; `; ~# l$ Z; d% |
1 m6 P" n: i' I7 \
Method 10. A8 _8 r( t9 P9 [3 \$ _5 D
=========( U+ N8 Z8 ]! |: d* W
2 X6 ~% w- @; q4 A=>Disable or clear breakpoints before using this feature. DO NOT trace with5 H \* H: I! O, s. V
SoftICE while the option is enable!!; S- F! `. r u; A
! a, D4 q$ r- L3 ?( M: m
This trick is very efficient:
$ b( \& q) P, Nby checking the Debug Registers, you can detect if SoftICE is loaded
. Z1 R( _0 x8 k+ n" i7 v. }(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if3 F' b6 ^( E1 n1 j4 e9 j! V: y3 x8 j4 s
there are some memory breakpoints set (dr0 to dr3) simply by reading their8 |4 m8 K; t: S- K. Z
value (in ring0 only). Values can be manipulated and or changed as well
+ n8 x3 B8 d( B5 b% B, ?(clearing BPMs for instance)6 R3 ?9 _3 E+ j* j' a3 w
: c% H' ^, d7 L/ a9 I+ ~' b- a
__________________________________________________________________________
4 L8 ^9 z. i" ~; a1 P/ N4 p" q! d# @. e4 l5 r" e5 O
Method 11
* |8 o; v D6 a6 n=========2 d6 v4 _4 U1 ?0 `
! X" n! L2 A- C3 p8 B. [This method is most known as 'MeltICE' because it has been freely distributed4 s1 [# r G# A* A" O
via www.winfiles.com. However it was first used by NuMega people to allow
, i( e7 z% `7 C. i# gSymbol Loader to check if SoftICE was active or not (the code is located" e2 \: O) i; D, o" X
inside nmtrans.dll).
* J W/ x4 t% T8 c0 u t' ]8 j; j6 u5 E5 ?
The way it works is very simple:% c3 E' B& ^7 n& B/ ?& z
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
' h! @; B6 u! C0 V1 O3 yWinNT) with the CreateFileA API.
; P( _* S: D6 A
5 b- F7 O7 Y1 }' b3 e4 A3 zHere is a sample (checking for 'SICE'):
; X" J& q. r- B2 H- V* A& H ~' g! `" C) P
BOOL IsSoftIce95Loaded(), v& E4 c0 |: O r8 p! @, k8 L/ b
{
+ ?6 G+ f I0 C2 Y; G HANDLE hFile; 7 }) q" q; b2 r- X- k
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,- O2 i+ y7 D/ U& g. @3 s- v7 J
FILE_SHARE_READ | FILE_SHARE_WRITE,& j, ^# i5 r/ {' O( n5 e' \
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
9 P5 l, ~% u: F1 N- J6 _$ ? if( hFile != INVALID_HANDLE_VALUE )7 n) w7 q3 a: E+ ]7 N+ D: D
{- G# j& A/ d; r
CloseHandle(hFile);/ [' W9 [: o' S0 \! W5 X6 ~4 |
return TRUE;( g; }0 b o& }# \ g
}
3 k D2 x# e2 A/ G4 X; G7 V W# y return FALSE;! ?6 D: J; O' s
}
7 @+ s2 r2 D3 X$ d9 L
8 _+ d6 B7 D9 {- q/ ^3 Y+ x# mAlthough this trick calls the CreateFileA function, don't even expect to be0 r& a1 K7 d* [% i \
able to intercept it by installing a IFS hook: it will not work, no way!
" ^% ^/ p2 e& M4 d8 H# d! H* a8 Y& XIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
' s* }- s. l8 Yservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)1 }0 y/ C. o( q' ~
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
6 Z6 g r, x3 U. w2 G! |* [! Bfield., P. {' m1 h1 m6 U
In fact, its purpose is not to load/unload VxDs but only to send a ; G9 Q/ l4 h. k
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
+ b2 T* b3 Q) i+ E; ~$ k! F( [, Sto the VxD Control_Dispatch proc (how the hell a shareware soft could try3 c2 N; D3 J% t
to load/unload a non-dynamically loadable driver such as SoftICE ;-).; [7 `6 p S8 j H) ^8 [5 o
If the VxD is loaded, it will always clear eax and the Carry flag to allow# ]7 N6 i. G2 ^0 F
its handle to be opened and then, will be detected.) w+ n5 {& R: y, R, _
You can check that simply by hooking Winice.exe control proc entry point
8 G; ^ a+ o# Y( \$ Z9 xwhile running MeltICE.
% F6 N! m, \5 g: K; \# J* l5 w* l1 _- f4 ?3 N% V) ^+ l
2 _. q6 Y3 R; Z3 E9 b) j
00401067: push 00402025 ; \\.\SICE
5 `1 U" \, L, O0 i% j 0040106C: call CreateFileA
$ M1 X0 t# B" k8 e+ F 00401071: cmp eax,-001! l' S4 G& Y0 l/ Z2 e# k( R6 r
00401074: je 00401091
. X! w5 S' [' R; h2 c
. G* @! o% ^+ `& d: B. [# F! ~% t7 @ k( _, R W6 C# c- s: t ~6 `6 O
There could be hundreds of BPX you could use to detect this trick.
# m: O% V8 V( \5 Y" Z-The most classical one is:
) L* ?6 w- }3 Z2 H( H$ C1 k4 A! X0 d BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||! ^1 M4 C* r4 g3 M: @% O5 m
*(esp->4+4)=='NTIC'$ ^, _* ^3 P0 j' `
7 U! V& U9 E1 t6 A2 X' c6 E6 h
-The most exotic ones (could be very slooooow :-(
+ X3 v/ K1 d; K% D3 H0 i BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
% A- x, i! {: a/ G' R3 n5 D ;will break 3 times :-(
( Z6 }! O' o' B* b, W+ h. F3 _+ V! V
8 G9 `% M4 t H6 l- X L-or (a bit) faster: - [. ]) ?4 j# g& n
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
6 }; K: G0 C/ ~2 V
5 v$ r$ u" P: o9 D2 D: n+ { BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' 8 [0 s+ ]$ n4 S6 \3 K3 j" S) @
;will break 3 times :-(
& z/ B0 r( l( _& \
. l1 ~" U, `" \( H7 u5 A# O" F-Much faster:4 h; D$ R* Q. c; z! b# S- [
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'# r5 l0 Y6 C4 p& N% f. ~5 N
+ G4 x0 } y2 E% z& D( y
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
- ^; c$ X, r5 }+ f7 I2 Ofunction to do the same job:; e% N% w l* h
9 m! z: r4 C0 D2 E ] push 00 ; OF_READ
/ Z8 C, C3 y4 A/ t q mov eax,[00656634] ; '\\.\SICE',0
& o4 a3 T/ B2 O0 N" B! K1 E# _ push eax
5 G7 f' [, u. h* F0 J) J4 @ call KERNEL32!_lopen, ?. p! O$ ~* A i+ p) e
inc eax
+ Q- K" G, a% O jnz 00650589 ; detected
/ Q, O3 |- N/ G* y" @3 U7 S push 00 ; OF_READ- q8 |* I% B+ O8 D. U
mov eax,[00656638] ; '\\.\SICE'. i2 a9 U% u+ O8 f# j) G8 ?
push eax
. D, K+ q$ ^4 b" V8 g3 e3 ` call KERNEL32!_lopen
. {' k( F) d* D1 ~3 B$ l. A inc eax @8 @" O8 \9 ]
jz 006505ae ; not detected$ a$ p$ Z/ c! C6 E; a/ }% q
8 B+ b6 f/ t7 E4 R* C: e, P3 f' r
3 Y& p( \* |: {$ i- F! r__________________________________________________________________________& Z4 M- h( h4 s" q# d9 T/ q
W) ^* q4 H$ }
Method 12
2 N/ n. _$ p( Z4 n=========
* }8 G, m& D5 o2 o+ D/ D7 n
$ Q4 f( ?8 w: [+ S# _This trick is similar to int41h/4fh Debugger installation check (code 056 z8 C+ x1 S; W4 }! R6 S6 z
& 06) but very limited because it's only available for Win95/98 (not NT). X6 r' i& s8 x% n7 o) W
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.1 P' p5 `) z3 n; [+ u" W7 Z* a
. o5 E, J4 h4 q! F/ Y. I$ H push 0000004fh ; function 4fh2 Z9 \4 ?1 k: F; u' `
push 002a002ah ; high word specifies which VxD (VWIN32)3 w' y+ _0 n5 M, K9 `
; low word specifies which service+ p3 ?+ D7 j- z: { {
(VWIN32_Int41Dispatch)' ^/ |5 I, Q* A. W6 g9 I3 Y& x8 C
call Kernel32!ORD_001 ; VxdCall7 Y7 b& t; a+ ?4 L7 G% k1 S7 z4 e
cmp ax, 0f386h ; magic number returned by system debuggers
+ B3 P; \# @2 C4 S% L% P jz SoftICE_detected
# d- x4 [1 R% P6 @# @
! F o: k I9 S+ C$ ^Here again, several ways to detect it:: b, c$ \% P$ [( F, B
% |! a3 K4 d' U1 f
BPINT 41 if ax==4f, c0 O+ D: Q$ j' P' i1 V
6 _0 Q; W) |; M& G2 F% C
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one: {+ C) c1 _: f# p% c( k1 n& _# Q
# x4 V8 A% l/ o- |% O3 R
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
" U. L! z5 c; F% N; X! e# c, e; `- @% _5 H, X' k1 d v
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
/ n7 A9 \$ o3 [6 j5 K" q2 [4 x5 t: p, z# G% i! O& Q! V& x
__________________________________________________________________________
' ?. M% f' e6 @
3 O& y( S) u+ Q( \1 NMethod 13
7 {- t4 l( n& z# c=========
( N; P+ q& Y) H0 n9 e9 Z$ x$ Q! j9 X8 ~
Not a real method of detection, but a good way to know if SoftICE is" ?" d+ B* [. m
installed on a computer and to locate its installation directory.. Q1 x2 _% I. A/ r, y; l' d) [4 [& H
It is used by few softs which access the following registry keys (usually #2) :
/ K4 @4 F/ d7 _/ h, \, p* a1 Y% e$ \' x# R8 U/ R+ Y
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
1 o: R3 {$ V' p\Uninstall\SoftICE
9 s! g6 i* Q8 E" i( t" f$ s-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE$ G. f3 O" {3 w5 y0 I% Y( l/ Q
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
3 K6 E0 W. R8 l; \. e `' x\App Paths\Loader32.Exe
+ v: w" U' ] ~) S( ^8 w9 D7 y6 l- o1 K- H/ _
) k. X& x( g2 dNote that some nasty apps could then erase all files from SoftICE directory! L: z+ ^, v6 i; R( c
(I faced that once :-(( F% w" }" w& B; a9 T
8 ]$ V! O" V# { O
Useful breakpoint to detect it:
2 S% m4 e8 W2 M4 j3 R! e1 ~2 B' X! l" D" x% A% ^: k K
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
0 e8 N/ @4 {- T: i% R% t) q6 J2 R" c& w% K6 C, L8 a
__________________________________________________________________________
5 y9 D$ J! K% F, i' R) N, U. ]+ l5 t1 z/ i# E
, p" j2 Z/ Y* V( S1 ]# T) Y2 `; j
Method 14 8 c% `8 j+ u" S S
=========4 L7 k" b8 @2 k% _# X
8 |5 \- Z9 ^) q/ Z5 _( T+ D1 I5 |
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
% U+ ] ?% [% i2 s1 N7 Qis to determines whether a debugger is running on your system (ring0 only).
% N; ?) Z+ u; ?: g* R Y; m! A. X# L& j2 s
VMMCall Test_Debug_Installed
( n; x; t0 I9 M. G3 N* D je not_installed9 }3 g+ K; r0 N8 Z
. f5 i3 ^1 J5 m% J) U vThis service just checks a flag. M6 X$ v. u* E9 }+ W9 S0 V2 Y
</PRE></TD></TR></TBODY></TABLE> |