<TABLE width=500>
X. ]2 M6 a8 }/ x) D" r<TBODY>
0 I# p& O# y9 E/ I6 ~$ E<TR>' n! d- L/ W/ j3 Q
<TD><PRE>Method 01 9 |4 O" p' P* b- z q! m g9 l
=========* `8 c; [& ]1 x: ]4 H }
5 d1 F+ A C, A4 R* X
This method of detection of SoftICE (as well as the following one) is4 s$ ?! ?$ d. l u1 z9 s! J
used by the majority of packers/encryptors found on Internet.
, ^6 B0 I3 E8 ~) r- }* A, S( W0 j; vIt seeks the signature of BoundsChecker in SoftICE1 @; i j) }4 [ J: T& E
- |/ G! g2 `0 k4 ]' s
mov ebp, 04243484Bh ; 'BCHK'* }+ I z/ @& d" d
mov ax, 04h
: b/ S% y8 _1 b i int 3
7 U4 U7 i8 M+ l4 x! p cmp al,4
; [1 |: B1 ~, b* @* T( a: r0 y jnz SoftICE_Detected
* ]' L- S$ [4 x4 \( {, e; j; g$ m0 a( y: I) C: i f" @
___________________________________________________________________________! o; `! Z9 x$ K% [
" v1 T" [) ~1 X& B( Y, Q, k% R
Method 02
$ A( r) F( _2 X% ?7 _# a0 m. H=========$ X; }' B3 R- ]% V6 Z' d* U
( }7 Y) u6 j! f
Still a method very much used (perhaps the most frequent one). It is used+ m, T: f( W" w8 g" x
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,9 {% D! y7 T, V
or execute SoftICE commands...
% F0 \9 s, ^$ N* R2 [# Y0 iIt is also used to crash SoftICE and to force it to execute any commands
" K$ a j2 J: j( n; `(HBOOT...) :-((
+ ?& H6 I& b6 ]/ z* b! w7 Y
" I+ i$ D* _! W2 p3 i0 P# i; ^. U. mHere is a quick description:
% d0 S* R+ Z. Z: `( C-AX = 0910h (Display string in SIce windows)
" {* x+ X+ v. y# n3 ?. w-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
8 O' S- O& x, t-AX = 0912h (Get breakpoint infos)
: R6 f" p4 }! q4 L: L-AX = 0913h (Set Sice breakpoints)# O4 e1 z: n" `7 a6 c& N
-AX = 0914h (Remove SIce breakoints)
! U' n' J5 j" `+ a
1 n: m! w5 M4 O4 k! |* EEach time you'll meet this trick, you'll see:; w4 V) x5 {# l ?- {2 H/ ^5 h
-SI = 4647h
, s( }+ {, M( {* Q7 b+ w( V-DI = 4A4Dh. Z: ~' |- t T2 P2 [! t7 z) ^
Which are the 'magic values' used by SoftIce.! w; C; @2 Q9 t+ L0 c6 K$ H
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.; Q7 ~( O/ q; y. c. L3 c+ `7 a% w
( t% M3 O# z" ^8 x/ wHere is one example from the file "Haspinst.exe" which is the dongle HASP/ A, a a! E" U3 v. F( n6 z
Envelope utility use to protect DOS applications:
2 u" K# ?4 O2 z' p! G7 w, H( Q" T+ U' W* `
0 z, `$ V4 j3 O5 h3 P( o; C0 R# g# f3 l4C19:0095 MOV AX,0911 ; execute command.
& j, n# ]8 y5 [4 A: I. c4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).) R2 Y+ }% e3 {1 `' X* c3 Y* V ^2 d
4C19:009A MOV SI,4647 ; 1st magic value.) n2 }. `. T9 N6 ?
4C19:009D MOV DI,4A4D ; 2nd magic value.% P9 v: K* y& B; _# H1 |
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*); M$ K' Q' h" ]9 P, b
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
, I8 h: B9 n0 u1 M1 O2 _7 j h8 r4C19:00A4 INC CX
7 Q0 Y1 b8 V1 H3 f) w# u: H8 k4C19:00A5 CMP CX,06 ; Repeat 6 times to execute8 G1 S8 u: a' A
4C19:00A8 JB 0095 ; 6 different commands.
6 n- n1 @6 Z( x- U- R4C19:00AA JMP 0002 ; Bad_Guy jmp back." y9 B0 M7 d7 f& ^; g Q, R
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)/ r2 x I9 ^3 I3 O, v" W
6 t3 E* }0 |% F* |+ l1 _
The program will execute 6 different SIce commands located at ds:dx, which
( C2 z+ z2 R2 qare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
1 n5 h/ B5 r# E0 C- f
# A( I3 n" t' S5 k. E* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.8 m, r- V. ~% }8 S- |4 m
___________________________________________________________________________
7 C, w2 ]# N" ~4 q. k. w# T# x; P. ^2 a/ f; Z2 @' ?
0 r9 I7 D" x& w |/ ]5 M) d
Method 03
& [, w' Z+ b% T" G=========
2 X2 V% O% d# u, [ B$ R0 }# O5 h$ \8 l9 |" F" K
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h! S, C3 l* J0 j# d
(API Get entry point)
c( o7 F- y; k 7 V$ ~+ h7 @9 a$ n& f
. |1 ~+ Y: w, F6 {1 P$ d, H
xor di,di8 u# l4 @5 q, B! K" N+ y0 {7 g6 T/ p
mov es,di7 S) K' ^; [! c: H0 L* ?( s
mov ax, 1684h + p8 K' W. S+ ^ I9 |! N. f
mov bx, 0202h ; VxD ID of winice& N/ s+ U5 K6 M: k+ W( t
int 2Fh
: E. E6 }: j @# X; U4 k, U5 Z1 \ mov ax, es ; ES:DI -> VxD API entry point
`% L7 c0 I" m$ f6 }3 F0 _ add ax, di
, \8 A, {8 |5 S! R0 O5 i4 ^8 b test ax,ax
" ^ p* U$ Z( Y& n8 S- t jnz SoftICE_Detected/ s) [7 U* ^( ~* x3 S
* a1 ?! M1 o. U4 i' Q___________________________________________________________________________* _; y' E( C. G! J8 J9 \; {7 v6 b
% V+ m' k2 L( t" ]Method 04
" ]$ D: k* h6 r! w=========6 g8 o x2 u4 v; e
& ^! B2 Y# Y. ?0 ?0 w/ |
Method identical to the preceding one except that it seeks the ID of SoftICE" v( r) U9 H/ Z, j9 S0 D" g
GFX VxD.6 r! _4 U y1 {
" U8 {, p+ e7 [# X8 z2 t ^
xor di,di
* h1 |3 E4 l! O4 e4 }7 A( f, F0 O mov es,di
^& \ D( }% F mov ax, 1684h
7 z# H. C; l7 D% n) G" f mov bx, 7a5Fh ; VxD ID of SIWVID
# f$ _7 x; h( V! q: J int 2fh9 ` f; F4 I/ h& ~5 |* b$ O
mov ax, es ; ES:DI -> VxD API entry point5 e7 m8 m @" x9 K3 ^
add ax, di
* p0 O! b; L& f% V test ax,ax( {6 X% V% n3 v! _: z9 L4 o
jnz SoftICE_Detected3 @& ]; |7 X8 a7 p. u/ Z
7 K/ m0 s# e1 i+ S
__________________________________________________________________________2 r$ `" s4 e" ]
- {( E) ~6 o/ X5 q, r- B0 n4 T5 i8 o) G4 H! @5 ?8 c5 a
Method 05( C; p* b, a5 |! ]% V$ D1 ~' G
=========
2 u3 v7 [8 {; V4 h# [/ r0 O+ S1 p8 N" B$ k
Method seeking the 'magic number' 0F386h returned (in ax) by all system
" ^. n- l, {/ Ydebugger. It calls the int 41h, function 4Fh.
5 |; X+ D; H$ ?4 R, {5 o+ _There are several alternatives.
. _- _+ c3 F+ ?# k7 G8 c# r# V) d+ N1 r- M# f2 G7 x, P9 T+ c6 i
The following one is the simplest:, W; B. n1 b0 O0 \6 s5 x
. E( S( I5 ?; R9 y* H9 P5 t mov ax,4fh
3 W8 j$ Z; X( ^! S int 41h' a0 V9 Q- p' M8 }$ Q" G$ L
cmp ax, 0F386
" x& P1 G) D7 V9 ]# u jz SoftICE_detected2 @: P$ _7 S* I" j: H% N
0 ~- {% M$ Z$ Q( R6 r+ P! B( g+ |) c4 u3 \ V, c# T: E
Next method as well as the following one are 2 examples from Stone's 4 o% D; L( Z: C5 R9 x r& m
"stn-wid.zip" (www.cracking.net):
1 A1 _3 S7 h- ^8 k4 f" n+ ?4 m; ^5 l0 H- }: ]4 K/ R% ? n* o0 j
mov bx, cs
1 n' S, w1 B. e$ n9 o1 S* H2 ^ lea dx, int41handler2
6 z# D" z: f! S2 |7 F9 \ xchg dx, es:[41h*4]8 A% R5 a- e- j. E F, @3 T
xchg bx, es:[41h*4+2]
' w$ O! m# L' G) V- F6 o/ s mov ax,4fh
6 g% [* s4 r* \6 Y! ]) a# [8 \- e. X int 41h
& v+ R7 p$ w7 a0 {6 I xchg dx, es:[41h*4]
5 [3 e x! J8 `9 E xchg bx, es:[41h*4+2]% u$ b5 f2 m4 m+ s( Z4 |, F2 i9 D
cmp ax, 0f386h
' z: t" X4 ~% Z& C1 a- k8 K$ _ jz SoftICE_detected6 K/ D8 p% a, u
+ O! m$ Q: R. t! M* }8 jint41handler2 PROC
8 I6 W* y! E% t0 h! j iret- k. U' s% J4 l
int41handler2 ENDP
9 k' B# D% ]/ w% s2 G- S
7 m9 ?+ y- U" Y* ^3 b1 y T3 z
) G; j' n# K9 i_________________________________________________________________________
8 h( H" @, t5 v+ P" n ^! Y7 a0 m8 m
! E# _8 N) p! ^
Method 06
% ]# d7 N$ u, @ L2 f8 O5 H( I, `. J=========
3 x8 ~: c4 f' a
$ }* O$ i9 J4 R0 ^
" {- Q3 g6 W. j: C; b7 c% o2nd method similar to the preceding one but more difficult to detect:1 a8 F$ E3 _' U; N( T3 n
c* d# ^0 x. P+ j! E+ p; H1 o& ]
. n' b5 E6 U; a* G; ]0 F' E
int41handler PROC
( v, w6 p0 s3 _ mov cl,al
! L4 w. w- V2 d K iret
7 P3 Y$ x5 Q1 v$ J0 Vint41handler ENDP
% O' k& d& U# o1 ~
- p! ^! L$ z2 z' M5 H: ` O* s2 U
xor ax,ax$ v S- q7 s* T- b! w6 ?
mov es,ax, h! ~9 W1 K6 `' m4 }0 ?
mov bx, cs; |; {8 u; D% e/ U2 I' v, ]
lea dx, int41handler( g$ u1 C4 e! R, }7 r& b5 O
xchg dx, es:[41h*4]% K1 u$ @ s6 L8 S! Q7 N, N% z
xchg bx, es:[41h*4+2]3 s' ]0 U( B1 i9 l( o: a
in al, 40h
; f5 H: E' ]+ m" q xor cx,cx9 S3 U. j: n+ Q' D4 {: ?9 d: a
int 41h
! f! h& m$ P" q# Z- W xchg dx, es:[41h*4], v9 }3 h9 j( q, p* E3 t
xchg bx, es:[41h*4+2]
( M0 \: A7 ?8 w cmp cl,al$ X0 y9 K5 o5 X# p6 i$ d6 A
jnz SoftICE_detected
# e4 F& T% p! M6 q+ Q5 g2 r
+ A+ e8 u5 t6 J* |4 T_________________________________________________________________________) y. e: c7 H* O5 s$ J4 b/ K
& s$ S E+ J/ d/ HMethod 07" a. h# J1 J. q& u/ d
=========' g/ E# t8 K( \4 s7 |" g% L
6 n! X/ S+ ]" v7 r6 @; q! AMethod of detection of the WinICE handler in the int68h (V86)% u$ s2 ]0 r) Q3 c7 Z
4 A, s1 @9 S0 |" O) Q: _% X& t mov ah,43h6 r& C9 E. Z7 \+ P$ f' I* d& R
int 68h( F$ {, _9 J3 @: i }
cmp ax,0F386h9 U' Q- Q3 y% a& Y: o
jz SoftICE_Detected
; f6 s8 s$ j! v- _- C m$ r/ P* ~0 k
3 V4 r1 n- H+ I4 W- E=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit* v2 u/ [, @* c
app like this:$ i& \- h0 E2 n* q
5 h" S- j5 c; o: Y" O BPX exec_int if ax==68
7 {, e6 T! M% y (function called is located at byte ptr [ebp+1Dh] and client eip is; F2 I1 N$ i% W) @
located at [ebp+48h] for 32Bit apps)
3 H0 ^: u6 f6 Y9 f, _1 G+ a__________________________________________________________________________6 D" @! `" W2 Z& {6 K+ Q
3 n+ n1 ^; o( N
$ p, x7 ` ~9 c( i+ D9 oMethod 08- U7 _4 n m1 u
=========
# u0 ]% X4 Z+ n8 Y0 C4 ?( o- B8 m( y
It is not a method of detection of SoftICE but a possibility to crash the
1 [6 S" K- i' L, a5 |$ y7 Msystem by intercepting int 01h and int 03h and redirecting them to another
, [+ E8 k% W& Kroutine.
# ^2 g. W$ \/ u6 E+ n& M; EIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points( t! x" k# `( P1 j
to the new routine to execute (hangs computer...)8 d3 ]( V8 Q" c$ N" c( D% y
" f2 z# r+ {5 v1 J( r3 E) j: ^ mov ah, 25h
+ k) Z! K+ A5 M- |2 Y" f* T mov al, Int_Number (01h or 03h)+ ^2 Y. R5 C2 S2 J* l% B) g* b/ _
mov dx, offset New_Int_Routine7 a, Q; O$ P7 b0 C+ M
int 21h
$ s8 c4 j' b& s4 G, O: |4 j& e# \
, i# Z4 v8 c5 L' k8 [# L__________________________________________________________________________8 H6 j" d% R* S
1 q4 J4 S/ Q" w) |$ R- q; x
Method 09" ?7 K3 O. Q, q& z: H+ h' `5 ?( x
=========
* U7 o& l5 B( p1 w, F% B/ D
* n! S' q7 u1 V I' J: T/ tThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
4 U6 [* K& b, y# T. \4 b8 {& Vperformed in ring0 (VxD or a ring3 app using the VxdCall).6 Q, }: o% m; N* x+ s0 ?9 @3 y
The Get_DDB service is used to determine whether or not a VxD is installed& o* e$ P( F/ x0 Y6 n% [
for the specified device and returns a Device Description Block (in ecx) for4 l8 [4 w8 \0 W/ [7 b x2 [
that device if it is installed.% }: B. f' q3 S( [. U: ^
8 \! ^4 w4 R9 u
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
, y; n0 Z7 ~. q/ Q mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)5 O: [" K- d. {" c, V4 e- ~8 O- f' g
VMMCall Get_DDB
+ k2 Q- S) w3 ? mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed4 j, a# J5 n/ }* T! y4 W- y
4 T) m& M( o/ M9 l/ t
Note as well that you can easily detect this method with SoftICE:( o# v4 D% j% K* w
bpx Get_DDB if ax==0202 || ax==7a5fh
& B3 ]% Y; K( U* ?1 t$ \1 @) l8 m+ r$ a
__________________________________________________________________________% u0 h7 |1 e& N5 H/ ?
/ ?( o* F6 t! V0 A3 S$ _* }. \% u
Method 103 \. L# A. C0 T& V8 {9 b
=========
: O9 e7 L9 A. g( C) m) H
4 W W$ m0 j9 d& i3 W( a' C+ a=>Disable or clear breakpoints before using this feature. DO NOT trace with- b; A4 `( ]% E: A) B) `
SoftICE while the option is enable!!
A# I6 I, E) v, B/ ?% a6 c, I: s% Q; }3 x
This trick is very efficient:
) t) E4 j! q# C6 w& \5 c0 ~0 vby checking the Debug Registers, you can detect if SoftICE is loaded/ t A! s) T1 l! t5 x6 g
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if8 I& }4 m% Z# ^" H/ g7 _
there are some memory breakpoints set (dr0 to dr3) simply by reading their( J0 x- g- w& l. p9 p- E. O
value (in ring0 only). Values can be manipulated and or changed as well) G" m/ }+ b0 @$ ^2 G0 v) s
(clearing BPMs for instance)$ F3 q: T% u3 ^3 z5 z, @1 u6 u$ z/ W
5 @; B! T! U, S4 J& f/ W
__________________________________________________________________________
: Q& q0 f+ s" T3 \/ r
& M6 R/ f* @; A% BMethod 11
- s4 c) [0 r- v5 [! O' Q% k" B=========
( B5 j2 U* T3 @" ]9 _% @% {( M' J% i/ {* k6 u1 `
This method is most known as 'MeltICE' because it has been freely distributed
+ G; ?; ?1 `* {8 @via www.winfiles.com. However it was first used by NuMega people to allow
4 A$ |. R6 S9 V, C$ A5 gSymbol Loader to check if SoftICE was active or not (the code is located- E" w- k6 C9 g3 p3 Z3 a! \
inside nmtrans.dll).' ^3 X- z2 L+ o
+ v* P* D& R" V+ @* n xThe way it works is very simple:& T+ G! ]. K; K: o" m" r. i
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for% b, f5 B+ e/ }& o/ ?
WinNT) with the CreateFileA API.' A; e/ q8 @+ y5 A/ f9 W& |, G1 [2 c1 o
% k$ ~. m' }" O, F5 J2 CHere is a sample (checking for 'SICE'):2 W* F3 Z5 u6 x4 O$ C% [1 r7 r, N- g
9 S, D* Q6 R' q- O( C
BOOL IsSoftIce95Loaded()$ Z3 o, e, m& \) A" _! l; n
{
2 X' J: c! h4 l$ t) b HANDLE hFile;
' A, s& L; X" |) C7 a& z hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
! S& m/ u6 ~# u* x" t5 P" R- ]! `# |3 \ FILE_SHARE_READ | FILE_SHARE_WRITE,
( A2 @5 N S! P% H. P8 G NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
# R T7 T3 P0 X# R: J) V if( hFile != INVALID_HANDLE_VALUE )' C: n: q1 m4 K# {5 C. @
{* }" M$ P- K8 }
CloseHandle(hFile);
# C h% O2 \ u( k9 X5 V4 S( I return TRUE;! @0 ?9 G1 P8 }4 q0 r7 E
}
1 T9 }4 O: g, ]( Y' Q/ c) N return FALSE;3 i& Z U) D0 P7 T" c
}* g" @" c8 e" z! s
9 }0 b. u* w9 n" A! i
Although this trick calls the CreateFileA function, don't even expect to be
6 R+ `$ W o* ^1 n3 ^. V& r5 Xable to intercept it by installing a IFS hook: it will not work, no way!5 z. b4 i; v! P; n6 ~
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
! S2 A) g! k0 M5 {& tservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
! z" x/ D3 r" n, h/ I; r; g& u1 Q5 M3 Yand then browse the DDB list until it find the VxD and its DDB_Control_Proc6 W, N0 M u* a8 P5 D" M) p
field.
+ _* I; W* e4 I0 \! P3 v& |! ]In fact, its purpose is not to load/unload VxDs but only to send a ( y: A; g# J6 a0 u8 ~. [
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
3 ]9 P7 I; W- s* L: f! Y4 [to the VxD Control_Dispatch proc (how the hell a shareware soft could try5 h. K2 A6 i: C) |3 O) T$ ?. u+ J
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
0 o! H- N9 h1 i2 v' v3 R7 _9 WIf the VxD is loaded, it will always clear eax and the Carry flag to allow1 Z; D, M2 h; T& L3 h
its handle to be opened and then, will be detected.
' e2 G9 j& s% w" C: W- CYou can check that simply by hooking Winice.exe control proc entry point2 u8 \. o m1 w9 m
while running MeltICE." N" s/ n; L! N Y2 ?
' J4 l% w$ ?0 t1 h; E" D1 l
u; K5 X" M/ L 00401067: push 00402025 ; \\.\SICE% H" s8 s2 \) s9 `
0040106C: call CreateFileA
: K- d- R2 k) u6 y 00401071: cmp eax,-001% p# @9 `) ]; A5 s
00401074: je 004010912 `7 a3 r% D1 I* [
( u/ w# B% [) m# ?* r
1 z- x8 \& g+ H; {There could be hundreds of BPX you could use to detect this trick.& P3 c6 X) |% L3 L$ r! b
-The most classical one is:
, ~- O" {! g: {* w BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||- ~( G9 o- O; q* H" R
*(esp->4+4)=='NTIC'0 E/ s8 Q8 t# T% s! f* \4 H
" b9 X2 f. }3 W M2 j
-The most exotic ones (could be very slooooow :-(" o. N4 b4 x3 p6 A
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') 2 h8 x7 w' Q: B0 |, b8 F) f. Z; i
;will break 3 times :-(4 Z6 C- X. O+ L7 O/ f9 N8 O' D& n
' t' C; L+ S( q/ L" z8 D1 d-or (a bit) faster:
+ u) T. [0 J. \7 P/ E' x BPINT 30 if (*edi=='SICE' || *edi=='SIWV')- i- t3 S; R# v4 l4 Y% v* V
6 D* e1 v/ L) d) @
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
7 m8 e" ]$ {$ ?7 k# A; h! d* q ;will break 3 times :-(
: t1 ?6 x0 o4 h9 Y' ^* B2 ?
5 h) }- U8 o5 E# J8 X-Much faster:
+ w5 e! {0 K( ~0 P# u BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'; Y! _' k0 k4 @$ M1 A1 y
0 m! N7 U- z, m9 F
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
) l' y* r+ P: s. Xfunction to do the same job:
, c$ }; M+ y% I" F2 D! L& C0 F ~ b" I& Z$ f; m& D! ]
push 00 ; OF_READ$ t/ g6 F& `$ G @
mov eax,[00656634] ; '\\.\SICE',0
0 L, a9 f7 t5 H4 z4 i; L$ S0 h0 y push eax
" Q! n& U% c; j0 e7 T/ K call KERNEL32!_lopen M0 {" X) H4 ?4 ?2 h
inc eax9 b5 z; h) g; e* b! Z9 b2 L; |
jnz 00650589 ; detected \! h3 g; w9 a. c4 q
push 00 ; OF_READ4 J+ [1 N% c/ k- s* z/ R
mov eax,[00656638] ; '\\.\SICE'" c$ {; c5 k0 ] B7 T
push eax% f9 W/ u+ r/ h$ c: e) Z1 T
call KERNEL32!_lopen8 g5 \: d! }! d( z8 a7 k* x9 `3 D
inc eax! w$ L0 m6 E$ Y. n. _, @- m0 c$ h
jz 006505ae ; not detected
% p: P. g: W: J* A* P5 N% G& V: y! F) \& N0 h1 P7 V
( q* }( W5 X( h3 D Y__________________________________________________________________________
8 J/ i6 p: ?' b3 L/ D2 G
: \- b1 z8 }1 o) d" y1 H6 C" DMethod 120 y5 Z2 _0 n# u# d" ]0 j2 K2 {
=========: h/ a$ h \3 ^
; r% `, N& @" q9 {3 C. }. [This trick is similar to int41h/4fh Debugger installation check (code 05
: G% ~- P4 z2 `# t* B, W( c& 06) but very limited because it's only available for Win95/98 (not NT)! y' v# E+ t- O' l
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.5 I6 ?* \. b/ M7 i- o; V1 l
* W1 T! U9 |/ h6 c
push 0000004fh ; function 4fh
; S/ y: ]; c1 a0 M3 y: b; L4 Y push 002a002ah ; high word specifies which VxD (VWIN32)$ O G6 b' G9 [" F# q
; low word specifies which service
5 |- U( D) X% o3 I. ?# T3 }0 |7 t (VWIN32_Int41Dispatch), n- x8 i" e$ M n4 l2 n
call Kernel32!ORD_001 ; VxdCall
- P, A3 d& l9 ^9 l" S cmp ax, 0f386h ; magic number returned by system debuggers
/ N; ?8 K6 K* z, T9 Z% h jz SoftICE_detected( ]6 u7 c: U* Y0 o' } a
( q* Z. v3 e+ S d
Here again, several ways to detect it:9 t- n% r: ^/ L4 O7 }7 j$ }
, s2 P' F9 C' h3 A5 m BPINT 41 if ax==4f
! d; _6 i0 l0 N/ A. O% L6 V6 ? ^" q% X
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one# D2 Q/ C) E( [6 E p
' d/ x' B' O. `; v( n BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A$ ]5 O" l7 J4 M
# V, o/ }6 @: C1 ~
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!# A& U8 g0 ]9 d, T3 [8 T7 v
& k/ ]8 ~/ f8 Y, a__________________________________________________________________________+ r. j3 W, w5 R2 i2 Y1 e
! E5 F* m% j8 S. [+ p2 z2 M& q6 t
Method 13
/ F8 j# t9 ]3 N* g" A. l=========
$ P k9 d f; H4 C& {4 i0 F: u" }
5 B! c4 ]* e( h/ J* CNot a real method of detection, but a good way to know if SoftICE is# p+ _- p( H. Q8 [& I& W
installed on a computer and to locate its installation directory.
+ x3 {) C6 r* f6 e- Q, T% CIt is used by few softs which access the following registry keys (usually #2) :# A+ Y# C) \5 {9 H2 W6 c# j% V
0 G; L! B5 C7 }, k3 {" n
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion* X7 I# x: U- O2 P/ n
\Uninstall\SoftICE
4 G2 @. j' i( j3 s$ z-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE' Q3 Q; z/ B1 b, F) F9 l7 O
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
7 y* u/ x) H$ f& F3 `1 z9 o2 W! N\App Paths\Loader32.Exe
/ w5 x# o& F& [* B, l" Y L. \0 s/ d% {; N
4 K Y* I. @! P9 G g. f, f8 q
Note that some nasty apps could then erase all files from SoftICE directory
2 J7 i; R# V9 y- m6 o9 m* P(I faced that once :-(
) o7 J# B- z' B1 O1 b) i/ l; b
% \2 |1 _1 j$ Q' c, P$ t8 vUseful breakpoint to detect it:+ ~: R" q6 w; ^- y0 J
) Q- c- A0 G+ u, C% m- d; X
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
0 ~3 P5 n6 B; R; d7 e
% i7 v" ^: P; U9 d$ [8 H+ c0 o__________________________________________________________________________
/ v5 m3 W+ C* ?6 R: p. i8 `. A Q: R& p, I' k* s' W- ~) T
6 r n( Z1 S( O2 z9 xMethod 14 - e: [ [/ x( r' ?7 ~5 L2 t; F- A5 R
=========( Z( w' `. r7 P4 m) f8 b
/ b _4 Z2 w* E$ g- K
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
, J8 y6 t, @) ?! f: e) X+ O- t+ Bis to determines whether a debugger is running on your system (ring0 only).) ]4 w& _5 R3 d, g
d, b2 `4 B+ z$ ~' m( o+ X VMMCall Test_Debug_Installed
5 g6 g6 b( _& J0 t3 }+ G4 l) d je not_installed
. H9 A$ x! ~. W& H, a1 j3 K0 m3 N0 z& X) e$ O$ u
This service just checks a flag.
0 ~/ ]5 z/ s' C* j ^</PRE></TD></TR></TBODY></TABLE> |