<TABLE width=500>
7 y/ Z# i' f% y& n+ [8 O5 o& l<TBODY>. l% u. v4 E N+ r
<TR>$ q. J/ v$ e6 m) K8 k
<TD><PRE>Method 01
5 ]' p/ C* _, J* M=========
' `$ {+ r9 n! _$ H# _( _6 Y* D* |( m0 b
& t \/ [$ G5 ?8 o- x V. v6 Z" yThis method of detection of SoftICE (as well as the following one) is
5 k9 F; U; _1 W/ _ _used by the majority of packers/encryptors found on Internet.
$ {, ^- Y- \0 e7 hIt seeks the signature of BoundsChecker in SoftICE
$ @. Y% Z8 f" ~" x }
. R" A) D7 I7 {) M% q+ j) v mov ebp, 04243484Bh ; 'BCHK'
% N5 q/ H4 E6 x mov ax, 04h
1 o; O, ^# K( G6 G7 L% m( C U; ^9 { int 3
$ T! l/ m8 T( A1 }3 ?4 I- z( L M cmp al,4
' E/ Y( Q+ q$ y8 V* e$ { jnz SoftICE_Detected1 W; I a, G5 Z$ M
( e3 C/ S5 ?$ C# @) f5 [___________________________________________________________________________
; m1 T8 m/ J& f G4 i; j3 A
7 I5 E% w, B4 {5 f/ j9 jMethod 02
. d) X6 L* |: c9 M D=========
5 v- L+ ~) a/ h5 ]- g) |& ?/ M( c# I
Still a method very much used (perhaps the most frequent one). It is used- C' @6 z3 n0 p9 l. v- {
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,: Z/ x# e( F1 R3 l8 d' G
or execute SoftICE commands...
; B1 A# q% q9 QIt is also used to crash SoftICE and to force it to execute any commands
: M( A0 m7 ^# ]1 @* i- d1 X! T(HBOOT...) :-((
) ]; N5 e3 Z5 b" M0 V+ k0 O
: E2 D8 s3 O, i( u3 j( h! |Here is a quick description:9 r ~6 E5 l% Z3 ]$ d; d
-AX = 0910h (Display string in SIce windows)5 G# J4 z ~/ b* b) x
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
h2 k$ w% L P7 b: U6 v% X- ?( e-AX = 0912h (Get breakpoint infos) Q# R$ L& ~8 E" t6 R0 |
-AX = 0913h (Set Sice breakpoints). b& O, E- E4 ?
-AX = 0914h (Remove SIce breakoints)9 _- ^8 J6 f2 n" e% Y) R) i/ j
8 a4 I/ t! P! e5 r/ U7 X& ^Each time you'll meet this trick, you'll see:. s1 w2 f1 n0 J5 Q
-SI = 4647h+ j& l( t- q3 X) l& o8 [% d
-DI = 4A4Dh, Q+ D* g& Y: k
Which are the 'magic values' used by SoftIce.. l+ R% n$ S( g, B& F
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
3 b/ `8 C* B6 h2 R9 z4 w ?! u/ U
5 X- t$ u: t% r( z+ E' u8 I% W# EHere is one example from the file "Haspinst.exe" which is the dongle HASP# M, h+ H X0 w' d
Envelope utility use to protect DOS applications:6 Q7 T# M! Z6 o& R
( |3 S( b+ J3 R
. g" d( Z, |7 \# |
4C19:0095 MOV AX,0911 ; execute command.
6 Y9 j; C7 K; b P; a9 a1 J# W7 |4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).5 p& G! h1 m$ O
4C19:009A MOV SI,4647 ; 1st magic value.+ j# I1 u3 w1 u& ]1 b
4C19:009D MOV DI,4A4D ; 2nd magic value.& e8 t& \% P& x/ V
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
6 A2 c& L: z$ a- F. t4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute8 h6 j+ U$ U4 H) W0 L, U
4C19:00A4 INC CX
+ F Z' D- X5 m6 l3 F4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
( n2 h- \+ s2 g! m w. q4C19:00A8 JB 0095 ; 6 different commands.! y! T3 l3 e& ?; J0 ~
4C19:00AA JMP 0002 ; Bad_Guy jmp back.7 v, I" R. }9 K! b% j' V* ]4 n
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
/ Y9 ]8 a- q5 A" D% e/ @2 L5 r% ~4 y
The program will execute 6 different SIce commands located at ds:dx, which! o1 k8 x8 D4 Q# Z' E3 n8 l+ i
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.0 S1 Y+ `. y7 `4 N
3 S% {! a: A3 F: C
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
" w8 [! u1 }' h___________________________________________________________________________
! M: k/ g2 E) _$ u1 _! d1 T/ T3 K8 z `5 L
, U1 h( O- P6 G9 nMethod 03
" A0 W0 I! V2 W& P8 H/ D, {=========: u2 r# ]% V7 H% i2 S
% M; \! O3 }" SLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h: Q5 Z* M( ~$ d4 Y+ Y& x) h
(API Get entry point)
( i1 \- A" _2 N! D" F& }- j 0 j _, W6 r9 h: a) U- Y
( y# L& b1 d; K xor di,di
+ v# C" m2 l$ ^, [8 v mov es,di+ m$ O h+ [# t# L% Y$ V7 F
mov ax, 1684h
! f2 C/ |- V% W0 O. u7 Z mov bx, 0202h ; VxD ID of winice
4 b: o5 Y4 Z$ V W. T* @! S. v* A int 2Fh Y; h+ k, p' Q0 d
mov ax, es ; ES:DI -> VxD API entry point2 p& ?% x& A5 P3 q% M
add ax, di7 s0 J7 G; K4 K& I- D7 k+ y
test ax,ax$ q P, t' H; K5 e% Q# V7 o: ~
jnz SoftICE_Detected; x! k* N2 } v0 I; O# u: V
Z3 r. Z. H# G8 Q3 B' m1 }
___________________________________________________________________________. Z5 S5 L4 w. l: Z2 b: f
D+ O" @! s$ t6 Y, [0 E& y! D' _Method 04( }3 R1 G ~) `8 A4 l ~) H/ Z
=========5 x) }5 R: `9 j8 y5 B
$ D8 | `( _; I! q
Method identical to the preceding one except that it seeks the ID of SoftICE
& _; @ K7 d- f Z/ p+ k5 OGFX VxD.
6 t% A1 m" T7 R: S& {" O) O7 ^9 \! \- J0 E1 e
xor di,di; n9 a+ i: _( e1 k. ~
mov es,di/ R0 T6 q/ Q6 [' T( ]9 ~7 \2 W
mov ax, 1684h
, _6 q) i( m; G9 d |9 G mov bx, 7a5Fh ; VxD ID of SIWVID$ T5 d( J# l- r+ m. u' B2 d
int 2fh
Y! x& }2 g6 j* R4 T3 b mov ax, es ; ES:DI -> VxD API entry point
1 r' \6 @) X* l5 f1 D o9 j: Z8 L4 h add ax, di
5 H# R3 h7 b# M% t. U, c0 K test ax,ax
. D W: X# e0 O& d jnz SoftICE_Detected
M& Z1 g8 h6 M: f2 \1 s. }
* w: M3 r6 Q- c) I& \2 h__________________________________________________________________________
9 ^6 Z, a4 U( v& B+ |
$ l4 ?) `7 a' y* L- q. ]
1 v; W7 \; v9 c# y: }7 LMethod 05
- E# J3 y6 ]* g! M/ t) g=========9 c& `6 Q6 X, r; x
M( W5 }% B+ R) qMethod seeking the 'magic number' 0F386h returned (in ax) by all system! o- ?1 y! H4 a- a
debugger. It calls the int 41h, function 4Fh.
- r+ u( S. j3 b. T4 ^1 TThere are several alternatives.
6 p7 V! z8 n3 H0 t" Y4 J7 k
4 J s0 y$ b0 IThe following one is the simplest:' J# i& @8 C% _- |
/ ?. R1 b" ^' G8 j: Y: l2 Q) T mov ax,4fh4 n, { `8 \% c7 \) m O
int 41h9 Q8 r# R1 d& s. F
cmp ax, 0F386; H) a# y' f( @+ }0 W+ U! S
jz SoftICE_detected
' O f6 f& M% U) {* t1 Y- ]1 |. A y; v
/ @3 }& I: e4 Y6 {1 ONext method as well as the following one are 2 examples from Stone's ( P, H# s3 H1 B+ H5 D8 n6 U
"stn-wid.zip" (www.cracking.net):
5 a; a/ w9 w$ a. ~ P, a @. A+ X, D3 q( A4 d( f2 S. U0 T
mov bx, cs
5 j# K" m- A3 l6 h lea dx, int41handler2
- \* c9 h. d$ u: a+ D xchg dx, es:[41h*4]
# h) T+ o# J! Y5 s5 l xchg bx, es:[41h*4+2]$ F6 \; w& ]1 n% K% `: j
mov ax,4fh9 f9 F( J' Z% `2 _% H5 A
int 41h
6 p: M1 d; W+ h8 L+ ~/ o% @ xchg dx, es:[41h*4]7 Z9 O- @3 B" v/ r; l; E' l# o# A b
xchg bx, es:[41h*4+2]# x. z/ L0 G* ^( ~
cmp ax, 0f386h
8 z2 f' a, {2 C" H' v jz SoftICE_detected3 T% V3 R: r% T8 T( D& Z
, |1 J* @9 g4 ^) J0 m/ pint41handler2 PROC+ w$ n1 R8 D+ V
iret
# [" j) s" N# g: |/ hint41handler2 ENDP
& K `7 Z% A& V+ m" |, F6 z$ ]( p0 b
* U% N. q0 Y" C- \7 a$ ~# E( n; h
_________________________________________________________________________
1 {1 s3 B/ S+ I- y1 H1 O! {9 ~& b/ y/ s1 {: e. p# v" w# P7 p
( W& W0 ]4 H1 n& u+ E, }
Method 06' N8 b! Z4 m7 q
=========+ C* Z2 t0 ~- ]" V9 B
6 Q5 L7 B# Q. ^+ g& e; w
- W; P3 g* H# _0 R4 ?2nd method similar to the preceding one but more difficult to detect:+ v: q0 J1 P) _+ P/ G, w
+ ^) }3 E0 w, A, J. j4 C( F8 J- h
- d+ t( Y# b& }3 Y- jint41handler PROC8 \, Y8 p0 {+ J) u4 Q& I1 w
mov cl,al
1 `7 v0 D) ]/ H d7 X: [) E- f iret* B/ v, f/ I0 W. @: A4 l* |# p
int41handler ENDP$ \1 h/ Y# a! p8 i. x! O
# v8 o# h8 y+ @% ]0 c/ n
9 l8 A4 d( k# m% j" f xor ax,ax
: g) |+ N* Y' }; L mov es,ax
+ a8 z8 m! }$ Q+ N" }2 d/ F mov bx, cs
9 a' i7 G& e& Y lea dx, int41handler7 D& c/ f( I/ P- F0 l3 `
xchg dx, es:[41h*4]
. O4 q6 i5 M+ Z! h* F xchg bx, es:[41h*4+2]8 L; L* H4 n0 d" c3 y4 S
in al, 40h$ m5 L6 m$ K1 m z B3 @* k# ^
xor cx,cx
) G( i% ]3 u9 q! |. { int 41h8 L) `- }- `# S. j, J" C, g2 r
xchg dx, es:[41h*4]0 ~$ {% k8 i0 b7 A
xchg bx, es:[41h*4+2]
; p8 k$ A# |/ x) T cmp cl,al$ `) C, D8 K+ V( i4 W
jnz SoftICE_detected
, A; y# `( E% t# m- u
. f; q5 i; c' Z* K- y' P7 ]_________________________________________________________________________0 c* i* ^; e# }$ L: [! s
, i1 g9 ?7 y) ~$ W s: [ X5 K6 P
Method 07
( P7 G8 F) L: _; b X/ h=========
$ e# L: v2 _0 d6 N3 o1 P" U8 h: S: V+ A$ ?! @9 I
Method of detection of the WinICE handler in the int68h (V86)
% S! q. O+ E8 p3 [0 U" N# b1 |5 K8 P4 y1 c( P9 ^% `
mov ah,43h
, D2 ?- h D# _- ~9 ] int 68h/ W1 P O2 u. f+ D7 b6 W
cmp ax,0F386h
% f' R2 C, E- z5 N# l: d8 v jz SoftICE_Detected
! o* O( F, B7 S$ G
/ n1 \5 J2 e# x; v( H$ X) `6 Z( U
$ ^) M" Y% I* ^" v- Z/ k9 [=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
# X" E+ ] @+ Z, ]5 T app like this:
/ T k6 O3 g) f: Y9 Z5 N. q# {) L) ~ C% S: J% g5 U
BPX exec_int if ax==68
. s2 U: F+ p3 K( J& o' E# G (function called is located at byte ptr [ebp+1Dh] and client eip is( Y8 t# k" U6 H& k
located at [ebp+48h] for 32Bit apps)- `% b; [$ S1 F$ m+ K& ~
__________________________________________________________________________5 a& @$ h- H$ `
1 @# N! m% x9 S7 x5 a* J* l/ y/ Q6 {
Method 084 U. k& t& b4 D' t) Q+ k, Y$ Q
=========# R7 ?* ?6 G; _( D3 ~
1 K$ y( x7 E$ H7 _1 t* W3 J/ K1 D4 GIt is not a method of detection of SoftICE but a possibility to crash the
6 b5 u1 T* j3 Ssystem by intercepting int 01h and int 03h and redirecting them to another
- [. s+ j& o( r4 ]' N, Yroutine.
4 O6 g- m2 H( D+ G3 ?+ e1 i# ^9 QIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points/ a2 D2 A0 M4 ?1 ?4 Z" p1 u
to the new routine to execute (hangs computer...)
' g- n8 u4 P" y% o4 \, A3 p
$ z2 ~3 T0 ^, H, _" I3 b( D mov ah, 25h
/ g: x+ f% \' Y/ c9 c! \ mov al, Int_Number (01h or 03h)
9 b" y7 M3 s: C5 L) Q mov dx, offset New_Int_Routine
K3 F& X/ G8 j$ v* w% W: A* Z2 ? int 21h7 j7 F; {% p1 e+ a
4 l& L. o2 B+ A" I$ m# {4 Y
__________________________________________________________________________* ~# B+ T' v P) x: n$ Y: r
, E0 z6 c9 \1 Q. i5 |Method 098 U1 c" d7 w3 a. d& F
=========
' z; \$ n0 f# p3 Y( @
' N# p1 B' i* I2 t2 N* i+ U7 \This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only9 G. _ V' ?" { O# C
performed in ring0 (VxD or a ring3 app using the VxdCall)., U3 Q5 a) R7 C: `3 z4 U! F2 t
The Get_DDB service is used to determine whether or not a VxD is installed
0 `/ D' G/ k$ H: H1 }for the specified device and returns a Device Description Block (in ecx) for
9 W' j: a$ z/ ]' lthat device if it is installed./ C" w! x8 i7 y# b& P S8 I
% H0 n! w8 D2 y' P$ C* X
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
8 |, a; [% R: \: ~8 O# p mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
9 D( o$ l' a/ R* A( t! R6 l- W VMMCall Get_DDB
2 {8 o9 S0 {* s: J. _ mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed" K% W$ P" _. Y* B1 `; U
1 l+ U9 W; c5 C2 ~# vNote as well that you can easily detect this method with SoftICE:# \8 ~" M& Q ]- j+ F, V
bpx Get_DDB if ax==0202 || ax==7a5fh j; f$ |' ^+ L, J% H Q
3 N4 R; Z3 Y" r/ V__________________________________________________________________________/ R0 T: m5 I; _* t; n6 V; G
' a1 `* f) @) d1 }+ `Method 10- H1 k# Q W9 b
=========9 _% @# h3 Q r. J1 y5 f t1 u
6 {7 U; H# L5 M( H! f$ O w5 C
=>Disable or clear breakpoints before using this feature. DO NOT trace with: p$ d7 a9 Q" S& K$ j' Y9 l
SoftICE while the option is enable!!( ?; ]8 P+ I- k7 f! w, R! ~! v
$ o# r- k9 _- X, M7 A) d
This trick is very efficient:- ?9 @; K9 V3 l4 F& p/ I: s2 }& z
by checking the Debug Registers, you can detect if SoftICE is loaded' x' G( Y+ n: Q
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if8 i: q- c, D! v3 N
there are some memory breakpoints set (dr0 to dr3) simply by reading their' s9 ~( @0 j4 \2 I
value (in ring0 only). Values can be manipulated and or changed as well
R9 l: P; V9 k1 i(clearing BPMs for instance): H8 E* E7 b6 w' u& M* I/ x2 ], F
4 l1 ]9 V! B8 }' s+ t__________________________________________________________________________ x4 h: X n/ p' f4 n
+ ? K' V3 t$ G2 N; z- @Method 11
' ^$ T* X4 o5 n% j% [$ }. R$ K9 J=========5 t% K, P8 T9 u6 v
: ~: y% A& P. M V
This method is most known as 'MeltICE' because it has been freely distributed
+ k6 \% t2 H6 h! o% L& Wvia www.winfiles.com. However it was first used by NuMega people to allow7 z5 L o( P# q5 b% F
Symbol Loader to check if SoftICE was active or not (the code is located- U3 { t6 K5 V
inside nmtrans.dll).8 ~; X0 T: p* c7 A7 h
$ P, f3 z5 c3 ` {% C/ D) m' c+ HThe way it works is very simple:- Z I$ _+ `+ B$ U- D- s
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for; j: E2 Y4 H6 y0 a/ |
WinNT) with the CreateFileA API.6 P! v# ~9 b5 V0 l( Q4 I/ I5 V
4 ~, V: r+ u7 I' S6 c0 n U( Y
Here is a sample (checking for 'SICE'):
5 r Y4 [. Q0 I1 I# c, o8 A0 {8 @ W6 P% J7 h8 o; J$ t
BOOL IsSoftIce95Loaded()
2 O1 {; x! }/ {6 |8 K0 f{# X- U- h6 x9 J* C
HANDLE hFile; 3 h& I* V) t: L1 L
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
" h1 j: G' i& f7 P FILE_SHARE_READ | FILE_SHARE_WRITE,
7 S- {& ^) }+ D6 M4 T0 D1 w; ] NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
; v9 f8 }" [9 n% n if( hFile != INVALID_HANDLE_VALUE )
t& D8 y; c" B, j9 M/ S {
' b; M( R; j2 X$ g) l0 { CloseHandle(hFile);2 v8 I/ Y9 F6 L5 K# R- d, R
return TRUE;- _: V$ a) D0 W# S
}' C: n- h) ?; x4 y7 w) o f" M2 \9 {5 x
return FALSE;2 k y; Y: i O# O4 _- O2 |8 ]
}! L7 g( ^7 E3 }2 H* s# H# P
; K3 f" j8 J. D
Although this trick calls the CreateFileA function, don't even expect to be
/ p2 ^) {: g! ^+ d2 q4 Sable to intercept it by installing a IFS hook: it will not work, no way!8 H+ c F; W' n+ n
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
0 j: j0 S) O- @. l& S! S sservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
3 ~$ r# S/ | s6 j5 M2 G5 C+ jand then browse the DDB list until it find the VxD and its DDB_Control_Proc
& `8 H. }$ q0 f% B3 Mfield.1 G( w+ ^6 s* S
In fact, its purpose is not to load/unload VxDs but only to send a - s" ~( I" c5 p. f. ^
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
/ w o0 W: Z. p8 i1 [6 Yto the VxD Control_Dispatch proc (how the hell a shareware soft could try0 q$ n: T# s$ S" Q0 c8 W) K6 ?
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
0 i7 A- m2 \/ ~/ b9 {1 b4 B1 LIf the VxD is loaded, it will always clear eax and the Carry flag to allow# z# E8 }: G, h# d3 `4 r3 o- J: C6 a
its handle to be opened and then, will be detected.
7 R+ b9 u" G1 w3 V6 ]1 G* jYou can check that simply by hooking Winice.exe control proc entry point- m t( W* k, [ b
while running MeltICE.
; A9 E* ?. [5 x' n9 q; a: \$ ]$ [4 v% J$ K
" E9 P' }" `% y6 i/ C
1 t- m. j" W6 C- R 00401067: push 00402025 ; \\.\SICE
- N0 H S+ S4 ~' G! R. }1 X 0040106C: call CreateFileA
; u) m. K y; ^2 o 00401071: cmp eax,-001
8 q3 @, a0 V, @+ {+ _0 K 00401074: je 00401091
9 e f5 G6 `4 r3 ^' u0 f9 K) \; q! Y8 H# A3 a: D
# V" B+ q- D- `! A F2 x
There could be hundreds of BPX you could use to detect this trick./ v2 O+ j G: d% T8 x8 w( c& h) P
-The most classical one is:" V: Y x9 c$ G) ^
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
7 ?8 e7 j; s1 I* G- h. L' c *(esp->4+4)=='NTIC'9 {& [( j0 Q9 N) h" H# G
2 Z6 R9 o( c: r! V' v/ ?-The most exotic ones (could be very slooooow :-(2 O: y j3 k$ ~, ~1 C
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') ' L- C; D ], ~0 ^3 P2 m
;will break 3 times :-($ O5 Q( p# p; g7 ^- h+ z
2 ^0 N7 z& J# X% H( C
-or (a bit) faster: 4 c' q$ I: _% c9 L, B. O
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
2 c: z: T2 u# K* M& w2 Q& K
# Q+ k8 G" g+ n" d' A BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' 9 {; g% S/ |9 C) F$ X, `
;will break 3 times :-(
3 V* ?( O9 {: K6 ~4 h
0 K& W! X3 v" ~8 ?2 w& f+ B-Much faster:
: R; v6 n9 f( J* q% B+ Z BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
0 y2 b: b: |( U; R9 |
$ @2 i! I, t2 J& P# m+ p2 nNote also that some programs (like AZPR3.00) use de old 16-bit _lopen& ?* X8 J( ~; `& O: y6 W
function to do the same job:
9 P& e+ b( E# y1 K# l- H' R$ ]' W% M# x( M
push 00 ; OF_READ
' m" _( i. S7 D mov eax,[00656634] ; '\\.\SICE',0
: z7 a' f" ^& I; J push eax& Q" Z, k1 y2 o B$ O0 I$ U
call KERNEL32!_lopen% u% @* k- `4 H4 W! h
inc eax
) O4 j8 H, H6 p5 ]: f jnz 00650589 ; detected' q3 b3 d2 n& I! G# I& D2 D% r
push 00 ; OF_READ% k0 c. S/ V5 ]+ E3 ~: m
mov eax,[00656638] ; '\\.\SICE'6 X/ B; k' q& _ ]" X3 c
push eax' t$ Z& V6 y5 [
call KERNEL32!_lopen
! e5 p) ~8 O: q& Y8 u" `* c! x2 E inc eax' D; K3 L% C$ W% c+ X
jz 006505ae ; not detected
7 W4 f6 w- ^4 J8 d5 C T3 O" Q' `4 k
, l# q0 x/ s1 G; d7 ?1 I0 k
__________________________________________________________________________
4 s% D% K; E i* P# N
5 e0 v, m1 j! KMethod 12
% i) j4 i, L, V4 K=========: p% J Q7 P+ E4 B9 i
# J) ?& |& O6 i8 ~" a6 R$ A4 f
This trick is similar to int41h/4fh Debugger installation check (code 05* @* t+ b- G" @$ c& L8 B: q
& 06) but very limited because it's only available for Win95/98 (not NT)
8 Z3 Q" P$ c( O. x' h1 J; f' ~as it uses the VxDCall backdoor. This detection was found in Bleem Demo.8 c+ v7 d3 [/ ^! ~6 e6 x
+ f( p; o6 W6 ^. x) P push 0000004fh ; function 4fh
- F3 j% m& |. a" p) M push 002a002ah ; high word specifies which VxD (VWIN32)+ L5 y( M$ a8 C5 v' ~3 C9 z, @
; low word specifies which service4 q- W& x9 ~9 i
(VWIN32_Int41Dispatch). U$ m# S- u+ h2 N& n& B9 e! t
call Kernel32!ORD_001 ; VxdCall
7 A6 n H/ O' ~/ Y cmp ax, 0f386h ; magic number returned by system debuggers
% U& a" O% d6 P, K' | n) m jz SoftICE_detected) c6 e7 Z( c% p
* J. R$ y4 x$ T, {
Here again, several ways to detect it:& a$ m2 M6 |8 v9 r# `; @, v* p3 q* Q/ {
3 x+ f# m, m- J0 l/ q
BPINT 41 if ax==4f- v1 M+ G" x! K. {7 H9 ~( |
* F% t0 }0 D, f% _5 P. T L; p
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one/ Z" h7 Y8 T8 g
5 ^# E: h1 p" P d* x1 z
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
8 Z7 |& y, P( Q- k
3 n( e% t8 m, k4 ~+ u BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
1 ^2 W& }; I, r" f8 V! N- \$ V7 L2 \* _- |+ H
__________________________________________________________________________
) u4 L# U' h" ~7 m) X# T9 a+ r$ l% C4 T Y2 ?
Method 13
3 a' `% a! K6 O& T9 P# B& B0 J' W=========3 x- B6 _+ r: a, n& z% K' H. J
$ h! _% W9 d4 S4 L3 D' l+ j) Q
Not a real method of detection, but a good way to know if SoftICE is4 h0 o( G3 S& E) s
installed on a computer and to locate its installation directory.
% g# o9 t: b% U8 w9 g* v7 }It is used by few softs which access the following registry keys (usually #2) :9 C$ V7 ?* [8 h. Z
8 Z3 q9 k! I v) p. f
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion' w0 y J. g" k+ t4 x
\Uninstall\SoftICE7 b' e7 V4 [: v2 t- K* m- _- C
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE+ _. { ?& F4 o' v* l. U; t
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
# x2 d# X2 R4 H9 K\App Paths\Loader32.Exe6 V, G5 S/ I' G* ?& k, S
3 j+ w) B( C8 c) T7 r/ K4 M" J q/ }. e% k# y M
Note that some nasty apps could then erase all files from SoftICE directory4 \1 v7 ] h. g( O5 j/ R
(I faced that once :-(
s+ h3 U8 r; T6 a) J2 K1 n0 v+ \- q, J0 w/ U1 k( D
Useful breakpoint to detect it:
& p T0 e. m, k' E( q5 B' K3 x* n6 L0 D/ ]" T; S9 a" Z+ e" f
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
, O5 R, u8 k, w( O: q$ l) c( [2 o& r9 M! n
__________________________________________________________________________
0 F( e1 X& @, W4 w$ F$ U- R' Q* B. E; m9 Z" Q5 w/ d, f
* f3 L, M0 {. v8 |
Method 14 : H% h* o8 m: w) {0 Y8 T
=========, v5 L4 B6 }+ a, |
' C+ J6 ?( I* @7 O5 tA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
8 z& ^1 y# W! x# E# _ U* e' Pis to determines whether a debugger is running on your system (ring0 only).
$ ~% V- E9 U2 Z, I4 R( o P' ^& S6 y- p$ \
VMMCall Test_Debug_Installed# i* l/ P! u( I- T7 [2 M0 G- y4 v
je not_installed" E& I, \; \$ ^ T% z
+ P7 R4 ]# K- Q' G/ u# kThis service just checks a flag.. T! M& c1 o" ?" }1 r( ` G& c
</PRE></TD></TR></TBODY></TABLE> |