<TABLE width=500>
: U+ Z$ ?; e& y6 z- O' K/ M; G. j$ W<TBODY>
/ I1 D& y( A; w( o& A7 [& X* N1 V) a<TR>
, b$ J& {( ~; |9 ^5 K' Q<TD><PRE>Method 01
- Y( C7 N# r/ P6 G=========
0 r. Z$ q X2 u! p5 \# P9 H" h2 O3 I1 T2 `& j& a2 g
This method of detection of SoftICE (as well as the following one) is; {: q2 C9 I& F% A: o
used by the majority of packers/encryptors found on Internet.% x1 k4 z3 M+ ^+ o
It seeks the signature of BoundsChecker in SoftICE6 q% H4 [* i' O5 l; D4 Y- K
! e# V5 j, j) B& E, o0 }/ }6 q! Z
mov ebp, 04243484Bh ; 'BCHK'
% C1 B4 s: S% y mov ax, 04h
7 v& \" `7 W9 }% Q6 C int 3 ! N: M2 s4 a; V* u; L& H$ ~5 O
cmp al,4
1 M. g2 P/ E' W6 F# U( g jnz SoftICE_Detected
. S3 a& G! U* D- N5 q6 k) V% F& _/ |
1 a7 V$ y7 a# J( ~$ m8 z$ |0 }___________________________________________________________________________
" N: Z/ c9 m: F7 c$ L" j5 @% V5 e3 k0 i( @2 |/ F! i, C& p
Method 02
$ @1 B; O6 K' u; I% M+ ]) r=========
- G9 u6 @' F4 ~5 ]' l2 X1 c0 o2 }+ C# P6 I! Z
Still a method very much used (perhaps the most frequent one). It is used4 k- I1 C& B% h! L6 ~( s o
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
/ V* ]/ e: Y# y( h9 Oor execute SoftICE commands...
9 c$ e# ^! e& g' q. NIt is also used to crash SoftICE and to force it to execute any commands
' s+ i$ r, K; J& W" ~(HBOOT...) :-((
) V9 S6 U+ ?8 F3 u z
7 S4 P) O6 z' z: @9 [2 l: v. XHere is a quick description:
4 a: X, g5 L; |# t-AX = 0910h (Display string in SIce windows)
2 u8 e( }; i# Z-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)! D1 ~, _: I( H C7 C/ q+ B% ]# m% U
-AX = 0912h (Get breakpoint infos)+ h% U6 [6 a3 P1 ^7 C, a3 i# ~
-AX = 0913h (Set Sice breakpoints)* T: B+ k$ O9 q& ^
-AX = 0914h (Remove SIce breakoints)
6 [$ u: R' \3 ~1 ^5 a
& d' ^$ G' y# a) YEach time you'll meet this trick, you'll see:% [0 _+ C/ H* K1 R' v
-SI = 4647h. g8 C! b4 c: q+ \5 D V0 m A
-DI = 4A4Dh
! {. s' X4 E% P' G7 X/ e/ F8 C, LWhich are the 'magic values' used by SoftIce.
: s# N. o) B: [' {6 _0 zFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.4 z+ u2 F% H2 S" U( w
! k% m; S) H0 U3 D X8 J5 iHere is one example from the file "Haspinst.exe" which is the dongle HASP$ E. Q- D4 l* ~. R3 z
Envelope utility use to protect DOS applications:
6 } W/ w, ]* E0 Q% v* a( }6 r, o0 b0 B; J
0 j0 l' R/ F) ]# l! r: S0 U9 M
4C19:0095 MOV AX,0911 ; execute command.
* ?& s+ T N# k. V' P0 k. @. ?4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
: e$ r' ^ r9 H3 t4C19:009A MOV SI,4647 ; 1st magic value.# p+ P( f; E( `+ O4 {
4C19:009D MOV DI,4A4D ; 2nd magic value.. H& b! N. U; [
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)- h. u) m4 v! a" h7 N
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
) [8 ^8 v$ ^- B% M/ Y ~$ }) i4C19:00A4 INC CX4 W+ ~0 }; t$ G2 P2 Z; c1 m! ~
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute0 {1 c2 x0 q% C
4C19:00A8 JB 0095 ; 6 different commands.0 x# ~! g/ f+ m
4C19:00AA JMP 0002 ; Bad_Guy jmp back.
/ t+ H8 B) O X4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
: y2 d3 S7 e; T, ?# T$ Q0 \9 R8 s
/ L% J* \0 Z# {& n* V; _The program will execute 6 different SIce commands located at ds:dx, which
% a$ A' b& Q8 }- ~& h5 gare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.9 |( i* ^' J3 \3 ]$ q" M
' w& b' y+ `, l& v1 y
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
( p4 K5 v3 h5 \! Y. k, v4 A___________________________________________________________________________
/ T+ d3 H$ f/ ?$ u. b- M- X6 C2 [; W$ P/ \
, G: X2 M1 S; I$ Z% z9 m+ TMethod 03, Z8 ]8 @$ Z1 H( Z2 y% E
=========% A2 T6 v$ s5 n5 v0 e% R
# E2 R1 }1 J" X, _2 T# G( mLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
) @4 O" F' h. A( c3 y% X(API Get entry point)
i- @+ H R! H K3 ^$ e& w , d2 G2 N9 @, g' y
8 ]: F7 F6 J& `' e xor di,di3 O- Y- j X; ?" f3 V% y- F
mov es,di
- U2 k1 s6 ?$ J mov ax, 1684h . k; ]* A C+ ?1 p
mov bx, 0202h ; VxD ID of winice8 h- e$ ?/ u8 O$ P
int 2Fh
3 o0 k& A: ?3 p mov ax, es ; ES:DI -> VxD API entry point( ^4 `. e4 E7 l) ?
add ax, di8 D& S. F* ?4 x+ |
test ax,ax
& y& Q( I* |* g4 C jnz SoftICE_Detected
% i* t: ?6 g1 p [4 ~* H# i5 {& f6 V% w9 w; N" L# f8 v; A8 r+ |/ r
___________________________________________________________________________% m, X: g S5 o5 @
/ F) J7 ^* Q ?/ W ^3 fMethod 04
" Q8 S/ @1 N( E$ y- @, ]=========
5 j2 [6 r% L. h2 U. \( x, I' c) W# C+ }# T7 N8 ^- A
Method identical to the preceding one except that it seeks the ID of SoftICE- X, F6 K. X- p2 b% W
GFX VxD.+ W4 D/ T8 M! z! T
( o9 M8 T# X$ J7 S! T0 q# i: E$ E
xor di,di8 v4 B0 A' }" i
mov es,di
* N/ A: C; Z+ r0 i# _ mov ax, 1684h
+ K3 T! q V+ [4 G6 d; I mov bx, 7a5Fh ; VxD ID of SIWVID
+ q8 D& g& R7 I int 2fh0 c# \- W9 n7 u
mov ax, es ; ES:DI -> VxD API entry point( `& ?$ d7 v) X6 @ C
add ax, di
- ]& v: U l1 A: n* V- d' }! k) B test ax,ax, c5 n9 |$ D' `# ]6 i. L! k3 `
jnz SoftICE_Detected4 l2 n3 ]- V& h* u$ c2 m
/ E8 d* G) i$ m! y
__________________________________________________________________________5 N5 I! e; }, @; F, V) ] N9 @0 ^! d6 F
6 v" l4 n s) G3 q" E! M
* |- t# y- o% EMethod 05% x9 A: ^: }: T) _: M- h
=========
}0 y! R$ Z1 {4 n' A2 z! p8 N, x0 t2 g5 m; L$ \6 m& @
Method seeking the 'magic number' 0F386h returned (in ax) by all system$ N$ u9 t0 l3 N U
debugger. It calls the int 41h, function 4Fh./ C' c4 W' w1 q6 ~) a
There are several alternatives.
( |" X8 R/ a9 O6 F
4 a$ p8 c1 P. h2 h+ n/ s0 yThe following one is the simplest:" ~1 {$ }* H6 L! x! S$ r4 ?: J; F
& a5 ^ W6 Q! R: t: G+ e mov ax,4fh
4 x/ S) |" L" l; s6 W5 v1 t8 R2 e int 41h
* g6 q: ^2 }2 k: i% C cmp ax, 0F386
$ B9 r8 W+ P0 \/ ? jz SoftICE_detected
1 q( e. B" w! v6 L6 i# J; n' r8 h
2 l) O9 }8 z5 BNext method as well as the following one are 2 examples from Stone's - _3 O; |/ P7 G/ ?
"stn-wid.zip" (www.cracking.net):
4 d9 _- D2 c. }8 a) g7 l( p8 j; F5 F* U% y$ P% b2 R7 S# D/ K* J
mov bx, cs4 u! Y5 s. }! c* Y& ^$ |
lea dx, int41handler2$ {0 |, Y9 @ b7 n
xchg dx, es:[41h*4]
8 R" t0 m" ~; E# Z1 n xchg bx, es:[41h*4+2]3 k" i: e+ V3 b1 v
mov ax,4fh* L2 T, D# F# C- E
int 41h
* {7 g0 U- q+ {+ m6 n; H xchg dx, es:[41h*4]+ `$ [! { V M# V
xchg bx, es:[41h*4+2]
- \6 K- _# B* H, V, O, D( q cmp ax, 0f386h; L/ ?& z' {8 ~! L1 s! I
jz SoftICE_detected* v( |. X& ]# y* F, \* b
; `0 q1 k8 [) d7 Lint41handler2 PROC. a8 ~" q b. Q' L! ^7 d7 z* t
iret1 z' z! ^2 U" z4 F {
int41handler2 ENDP( P2 `9 f' G+ a n& D6 j
+ d3 {1 n; _) Z3 b M% J, m$ {
5 s( f5 {) J9 ~+ {! [7 a+ }_________________________________________________________________________: F4 d7 N$ P: \
6 \1 {: h& m& j+ v1 N/ i5 M" ~) @& w' v' l6 A
Method 06 h, f/ l1 \' H$ K+ d
=========2 Q& ` V! u5 ^6 W9 b2 f( T
7 p2 @4 i( B# k$ {* y/ k# l
/ s8 R$ ~3 M* x5 A3 F; W2nd method similar to the preceding one but more difficult to detect: D4 ?! V/ l2 u+ U, \6 `) K
# r/ J; u0 a, N2 q' r1 Q
: B- ~+ M7 V( n+ A% H/ P" E. E0 Q0 p; jint41handler PROC6 v t# E" ^9 N$ a9 y% k* m7 G
mov cl,al
+ P0 @4 R1 l2 f. i* c6 J' S0 P1 j iret. b! J! O1 `' u. ^ I* m1 R4 r( I
int41handler ENDP; S2 H; A! R7 ]; P& H p5 x
$ o$ O* V0 m' g+ J- A) j5 u% f
% B5 \! @& i4 f! J1 i5 x xor ax,ax
& u2 }5 l* ~2 X; j& w mov es,ax
8 W8 X8 h' p: y2 K# j2 {3 ~ mov bx, cs
3 V/ M8 h, x7 k8 x! u0 Q0 z lea dx, int41handler' Y* b& w% `0 J0 p# P$ r8 [; }
xchg dx, es:[41h*4]7 u7 E& L; N% D; M( Z- q/ p3 u
xchg bx, es:[41h*4+2]0 E8 g9 F0 t! R5 S5 x/ t; L6 C. |; A
in al, 40h
; W$ d7 S* G: q1 \; J0 t- C xor cx,cx
* w: l9 ~% g2 T% J: R! D' h9 Y* @ int 41h: `+ s3 k/ `+ L v6 m, N
xchg dx, es:[41h*4]3 e6 Q! x! d9 F) s* V, T. X
xchg bx, es:[41h*4+2]# E4 l; G; Q) }. D+ f5 V8 C
cmp cl,al
5 P B: G N0 k0 g+ V6 K0 A jnz SoftICE_detected7 c! p0 L: f, J2 j+ w' w9 s7 o+ S
9 C* d, u- J4 T_________________________________________________________________________
+ I) C9 u. C+ A0 A# @$ B0 `: a% B; u5 M+ i/ W
Method 07# n5 P% Z2 U' x
=========
3 S; @) p7 H: c3 I& M
$ w# } x% y3 a+ wMethod of detection of the WinICE handler in the int68h (V86)
$ c5 A* P1 \6 q4 x$ P& b6 A" K" s6 c: f$ \7 D# ?4 z. a; R9 n; r
mov ah,43h0 Z$ j$ c% M3 \) o9 K9 L! e
int 68h# Y& T7 w! c6 S z
cmp ax,0F386h
! s/ v. s; s, X/ y jz SoftICE_Detected! f: D' O) k6 _* m1 P+ p# |
; ?1 H T) ?9 C A/ B2 |4 `" [( O& ^: w& U- }2 {: r; F; i7 \6 y) |
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
* W" {3 Y. K c0 B6 o app like this:
7 R. b1 E0 L, `1 ?! O6 f; z( t* |6 L
' |, L. O w& A: Y( Z8 p! A% I BPX exec_int if ax==68. N( H6 _+ o/ S
(function called is located at byte ptr [ebp+1Dh] and client eip is
& Y; t5 {$ v6 j1 f6 t; Q9 O located at [ebp+48h] for 32Bit apps)6 ^; r2 S; T8 E3 V7 H8 @7 k( @
__________________________________________________________________________
, S0 c/ \# f2 m& V6 Z( R4 O, y( c, d1 O9 ?) e
5 U& G2 ]& N' F+ ?& S2 d
Method 08
. q2 {0 i. W: ]. K, p=========7 T8 O3 ^3 U6 ~- f) q) }
5 U; P: Y/ c: ~% p# P/ gIt is not a method of detection of SoftICE but a possibility to crash the
) d0 l4 }& K7 {system by intercepting int 01h and int 03h and redirecting them to another
; T9 a7 [) H. N0 Y1 v2 i& z& ?+ w6 qroutine.
- Q0 j- j: Y% F4 IIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
5 d3 F8 a" v" J3 G1 G! ?7 q! eto the new routine to execute (hangs computer...)
- {5 s# y- i7 ~) I2 e5 o' i/ B- a7 v: z% N( o \2 E
mov ah, 25h
0 D2 d1 V( e; T: S+ O) H. [$ |6 | mov al, Int_Number (01h or 03h): F# t8 @# {; w( A6 O
mov dx, offset New_Int_Routine+ a. ~4 _( ]2 t8 Z- J+ ^6 ~
int 21h
/ ~" C0 L% T/ S! q. N. K! G4 ^% j" {/ r; X& R
__________________________________________________________________________2 z1 D0 Q$ Y" I; c3 z) E1 p
% e' ?8 u7 _+ Y7 c
Method 09
0 v1 s# t6 h" a8 ?! d=========
2 }: a( r" d+ S$ d! R
; g* ~1 G) e8 Q; G2 d7 |! T+ j/ TThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only! v% f2 n' i' I, _+ n
performed in ring0 (VxD or a ring3 app using the VxdCall).
/ R3 D* s- w# U9 p8 o- ^The Get_DDB service is used to determine whether or not a VxD is installed {: t) ^4 Y' y# I+ f: u6 }& S, Z
for the specified device and returns a Device Description Block (in ecx) for
/ H8 Y3 o3 i" ^% Rthat device if it is installed.
- e9 o& Q$ d- S( F7 G, H
, r7 |/ Q* n+ h* L( {7 c mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID0 a) Y, ^5 o9 q8 q# ^+ j. h& q
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
9 S: h) E& d, Y2 B: B+ V" F- |# d A VMMCall Get_DDB
* e# u1 I$ J" ^5 b' s4 L3 `9 ] mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
; x( ~3 v; l% }6 Y- s8 b+ I# W$ ^) H% G+ S1 w& H7 x
Note as well that you can easily detect this method with SoftICE:
) _" K: R& x w; t+ a bpx Get_DDB if ax==0202 || ax==7a5fh
7 l; b' F6 G# c# r$ \, z( c ^ i; s2 t
__________________________________________________________________________. a1 J; l+ W* P
, N& U4 G" A1 K; K: D; vMethod 10) B9 d; h, B* E: L6 M6 t% F
=========
/ q) V! E4 @& Z# ~
5 ~9 I1 j+ A1 U- r=>Disable or clear breakpoints before using this feature. DO NOT trace with
5 ], g3 U8 s6 E) j3 d SoftICE while the option is enable!!/ x7 b' a; D# t2 Z" h1 }% d0 W
4 h1 F) L: ]4 k) ?0 l) G8 XThis trick is very efficient:
8 P" Z. H1 D' wby checking the Debug Registers, you can detect if SoftICE is loaded
' l, o; j- d+ P! ?. F$ B6 q(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if, m5 w2 R0 T! ?( H* M) h
there are some memory breakpoints set (dr0 to dr3) simply by reading their
% G* ^6 ^+ P- V8 D" U' a) P$ D/ Rvalue (in ring0 only). Values can be manipulated and or changed as well
2 M8 ?% a( y% P* a/ J- x(clearing BPMs for instance)' [9 h$ A: H6 D7 u* c
8 J% C2 H/ |& E+ u: W0 ]__________________________________________________________________________9 F& L+ v3 @% U! j2 H( Z
" z# {% Q. j. W w
Method 117 [: t; ]7 Z% j. Y1 n2 S
=========" [8 K% e( s: e2 e; w
* [/ o/ G t7 g3 m0 n% |! P
This method is most known as 'MeltICE' because it has been freely distributed1 o- f+ H0 X3 Y( M) _* z2 o
via www.winfiles.com. However it was first used by NuMega people to allow
N( C$ [; R/ @" oSymbol Loader to check if SoftICE was active or not (the code is located
4 b9 {$ P( p1 z+ s& l; ]6 K6 Y) s8 pinside nmtrans.dll).8 j/ P' e% v" |9 F
* [; X/ _* a: Y" E# @7 QThe way it works is very simple:
Q; @: I- _. P5 U9 ?$ c' e* VIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
3 Y" E6 X( v- q ~$ JWinNT) with the CreateFileA API. ]7 K/ T; a, n5 F- Y$ b6 w
3 K3 r V# E$ Y- w4 s% QHere is a sample (checking for 'SICE'):
4 K- T, F* a$ k) T9 h. J% z- ~0 \1 \8 `) v
BOOL IsSoftIce95Loaded()# ]3 l v$ s4 x- W# x! w- x) P
{' P6 v8 K/ v, g! e
HANDLE hFile; - Y& z) r' _' D5 ~
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,- Q( B% K! x1 n, O0 g: u5 y
FILE_SHARE_READ | FILE_SHARE_WRITE,
) g. T" I! i5 w! w NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);) M3 T9 A( x/ C: O: T
if( hFile != INVALID_HANDLE_VALUE )/ v+ L2 H7 o# i# L1 V1 _2 R
{8 x8 |2 L. C6 x! C' u* S
CloseHandle(hFile);
+ ]1 d; n, Y6 d- b& I( W; D+ o: ~% Y return TRUE;. I6 T C8 K# s7 P5 I3 n8 l% d
}
: `( R) P( u- Q. m# o+ D return FALSE;. n6 G8 k+ x3 I2 m
}
. \, Z1 Y7 }9 v$ J+ Z% C- ?
/ e% Z/ V# d7 X% K6 v- MAlthough this trick calls the CreateFileA function, don't even expect to be U7 E) Z6 I, j: P
able to intercept it by installing a IFS hook: it will not work, no way!
/ [: H- N* `6 S7 lIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
5 i$ z' j1 Q$ l; l% O& [service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)" U$ W- }; T& U% v
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
5 H' h1 D' ^) I+ H8 t3 Dfield.1 ^9 q4 W* a" L n
In fact, its purpose is not to load/unload VxDs but only to send a
( e9 b, P- R; U U/ J+ [3 aW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)( ^" ] P( x- \% G4 T: b2 r
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
$ c/ |3 A8 y1 ]to load/unload a non-dynamically loadable driver such as SoftICE ;-).8 u$ e" s$ H' W4 c# X% {- d$ o$ f
If the VxD is loaded, it will always clear eax and the Carry flag to allow% m. H2 {3 a, h, n! x8 @/ N* C
its handle to be opened and then, will be detected.. a0 Z4 F% i) j* O6 g
You can check that simply by hooking Winice.exe control proc entry point' }3 ^0 f3 H' y% W( V+ d: Y
while running MeltICE.
+ T& @1 [: ]# H
' `! U9 ?6 ?$ A; K# ^! P4 ?" H7 n& \5 v* f/ g
00401067: push 00402025 ; \\.\SICE# B: k& C2 D! J0 f& E. l7 g
0040106C: call CreateFileA
3 ~6 P4 c. @; m" Y 00401071: cmp eax,-0010 ~ o6 d2 f( C V+ F, x. ^# E
00401074: je 004010915 D( Q1 R) b& c: q7 ^
. D' x9 W# [- o' A3 `0 S2 B
0 i# X3 a* G4 N8 N% e, MThere could be hundreds of BPX you could use to detect this trick.
/ { }+ l) t) D7 I; g/ w5 q-The most classical one is:
2 a# \7 x) ^6 t1 P- B( ]- V BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
9 Q5 T' N/ G( Y% {0 E& Z *(esp->4+4)=='NTIC'
$ v* J w; _6 Y( k3 t4 R& l
! t6 H5 ^8 o" n/ f0 W. t! X4 l/ {-The most exotic ones (could be very slooooow :-(
2 U1 j) g6 N @7 f- U BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') " B! a3 j7 T: p) n$ B$ c/ S" |- e
;will break 3 times :-(
' r2 z2 z, ^$ \" T
5 M a2 [8 ]( P7 B6 M; B0 s-or (a bit) faster:
3 s8 r' U# D" p, d BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
1 u* ?4 [/ j7 D6 Y8 m/ G i! \% u5 K0 |/ a3 P
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' ; q+ T+ Z1 F# A( x
;will break 3 times :-(
9 k5 _; Y! m9 s7 F6 Y1 @% S" @' F
) j0 a& O L0 K' _( \-Much faster:5 N9 H9 Z+ z) S, U3 B
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'4 y8 v/ N- w6 M U; o$ L
@$ f; b& l1 U6 p+ TNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
' y0 [+ f5 F& N% b: K' T" Sfunction to do the same job:9 v' P% h. G' y( G- L7 B% v0 T
8 k4 ~) T& T! N. y
push 00 ; OF_READ# O4 P# ~" l' `2 X/ h- u
mov eax,[00656634] ; '\\.\SICE',0" J2 ^" C" [* P
push eax8 b% ^& t$ i+ g$ d6 V z
call KERNEL32!_lopen
& `6 o/ e3 i' [- a6 {- ~ inc eax9 B! [: z2 _6 o7 S
jnz 00650589 ; detected1 g6 O! [ i6 X
push 00 ; OF_READ& Y, G/ c0 \+ V$ ~. Y5 b6 F
mov eax,[00656638] ; '\\.\SICE'7 A2 K; r% Y# I" b% N/ U
push eax A V/ d/ _. W: z1 k: ]. u
call KERNEL32!_lopen, {/ ?, @: T6 N
inc eax
! l7 z, Y% |+ Q6 T" B jz 006505ae ; not detected4 E' h2 w# m' \. G# p8 ^2 s
# N+ @, Q- H$ j0 F6 V& s
8 U3 J# g' p1 B' A! j2 N1 p__________________________________________________________________________% d: a. _3 z. v
8 y5 R7 }: k8 [+ @
Method 120 b. l/ W' S+ U5 @
=========
; f, v4 F1 a, p5 z2 f8 P5 h7 v# x( H8 q
This trick is similar to int41h/4fh Debugger installation check (code 05
: p" n; X8 t& W# e9 J& 06) but very limited because it's only available for Win95/98 (not NT)) W; a. O: c. X
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.- E3 H) `& B7 R
" e' L1 L; f+ c- l8 `) b push 0000004fh ; function 4fh% g* O. L! ~; o7 K9 B7 G# Q' K
push 002a002ah ; high word specifies which VxD (VWIN32)+ Z. O7 d# {8 I: A
; low word specifies which service
3 m9 v1 Y0 z8 ?5 j, o; r (VWIN32_Int41Dispatch)
( ?$ ^4 L. I) ^! b" N. a$ |# ^ call Kernel32!ORD_001 ; VxdCall
, B9 `# T% a: _- B! h cmp ax, 0f386h ; magic number returned by system debuggers
& D6 {1 L2 A: | ^$ g {1 L jz SoftICE_detected
9 V; N5 V$ F- _/ M9 |. r. I% I
Here again, several ways to detect it:6 d; W: Z5 G- H+ d, y$ B" p: a
. w6 a2 j1 E( X+ D. U* e0 Z BPINT 41 if ax==4f
6 w, n& U6 U$ G# n# q) V( r5 Q; V" o: |( k& {, X; B
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one* o7 g' w `0 N- M! Y
+ q. [' @- ~* \3 e
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A' E* W" B7 k4 |3 U8 {3 F4 |
# x8 K+ C" s+ V) ^6 L& G% R BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
3 C( ^6 f/ z8 b7 V8 D( |( r% n. f# K5 Z! k# m. x
__________________________________________________________________________
5 x0 j$ j' ~, ]/ h( Q% U& M4 [1 J, z. A) K
Method 132 _ ~ K. u+ _ \# ]
=========
: r* c& p7 {& E# {) e% p) U7 r- d$ X1 D& V& D6 K4 n
Not a real method of detection, but a good way to know if SoftICE is5 E4 c' j& _5 `8 I! z! K9 M
installed on a computer and to locate its installation directory.
3 D# E6 B( P. v# d6 V/ OIt is used by few softs which access the following registry keys (usually #2) :6 R P2 Y# w/ P* o2 U
& b9 e9 O" \4 Y% \2 h9 y7 K-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
( {! h4 Q7 a& Q9 h$ K\Uninstall\SoftICE' D$ ]9 @' p. g
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
; j* ^! H2 c8 m8 |1 l-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion3 ?* Z0 y* k. J/ A* F! _
\App Paths\Loader32.Exe
6 J* v4 c: u W5 Y0 K3 o5 K
4 k9 Z _. x- Z" V6 G2 ~% ?- h/ ^- _# O. i7 T' x
Note that some nasty apps could then erase all files from SoftICE directory& M! p- L% R& ^/ ~! D
(I faced that once :-(
; n4 E4 H2 K1 d( v5 e6 @; g: S K7 y$ }- l
Useful breakpoint to detect it:1 A& I$ W* r3 ~ |; h$ G
1 {; J2 _: Q# ~6 O& w/ L& O BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'* j. F7 l1 z5 t' ]# u7 @. P
% C/ I( N+ }2 {9 V+ \__________________________________________________________________________: d! d% q3 n; s) {
9 G! s( N& O: Y; |1 `
5 ]+ Q( d' D# o9 f# Q2 XMethod 14
2 S* g' m, j0 v" d; ~/ Y=========: X8 m6 _6 M, d& _; V5 j2 y
{- Q4 m5 L! v) m3 a7 @) {
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
5 W& I) x ~- k: ~7 S$ xis to determines whether a debugger is running on your system (ring0 only).
- b3 u0 Y; \) ^. ?5 S L3 n5 J' C1 [+ y
VMMCall Test_Debug_Installed( Y6 y3 y" { `9 F0 Y5 M) i
je not_installed3 ?1 N. ^; A* v+ e- `2 c9 _7 h2 i6 k
: Z# K7 W! H D* f( O0 D% TThis service just checks a flag.& R# s9 |/ j+ ?" ~
</PRE></TD></TR></TBODY></TABLE> |