<TABLE width=500>0 n! m. h8 s! v; h2 N& P, F) ]5 e
<TBODY>
2 Y: g' C1 D6 W2 A4 t<TR>
; S! y8 C- |9 k" x+ M# K<TD><PRE>Method 01
$ v- p# B B C=========: c4 b( H! m" C3 G7 e
& F2 V) s- L) y/ S1 j. o9 fThis method of detection of SoftICE (as well as the following one) is
5 i4 J% f1 v4 ?used by the majority of packers/encryptors found on Internet.
( [+ O# X4 T4 ~/ Y- E# }4 i. PIt seeks the signature of BoundsChecker in SoftICE
( n0 O5 u, e' |! V% l& {6 j# V% z+ C8 d
mov ebp, 04243484Bh ; 'BCHK'' R/ E' T1 i Q0 B- m
mov ax, 04h0 [; z0 f0 _' m
int 3 & b6 E# z$ c' X. V! ]
cmp al,4; d+ K ]( @/ J$ n8 `0 M
jnz SoftICE_Detected
5 L, y7 ?& b8 g6 B( B! U6 y5 B" T9 p r! Q0 c0 z
___________________________________________________________________________2 \- j" w0 Q$ ]3 R. A
5 f y) \$ e; k0 s; d+ I; ~
Method 02/ ^& g9 t3 C) D4 T) Y
=========
1 G3 ?2 M9 ?6 J# Y( J5 m( {* W. W8 F% C% a1 i/ I. ^/ W7 U! s
Still a method very much used (perhaps the most frequent one). It is used" E: [' W( }2 Z! E
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,! V1 T3 ~) \$ l4 C4 b4 }$ p
or execute SoftICE commands...( R% S) K8 H( C) J8 e% [& k" j
It is also used to crash SoftICE and to force it to execute any commands
" m2 M, O$ B2 O1 ](HBOOT...) :-(( 2 @- P* ]' _4 o' ^+ J
8 Z% h" p$ L" `1 m/ p+ I5 n3 r
Here is a quick description:
8 `& X( K( ?( b" t! s$ |) @7 |-AX = 0910h (Display string in SIce windows)
0 d8 ^. I( `# d$ K9 _+ r-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)/ V4 Z& W' [! z0 U+ g0 Q4 n
-AX = 0912h (Get breakpoint infos)8 { C, t5 _: z9 r5 c
-AX = 0913h (Set Sice breakpoints)
1 q9 ?2 ?( q! E-AX = 0914h (Remove SIce breakoints)! d6 l1 O: r) G# H! t
% ]8 k0 H# Y& X& b% h
Each time you'll meet this trick, you'll see:0 S8 M7 p0 J% w; y" t
-SI = 4647h
2 Y0 O Y2 _6 T. h; z, I* {! N$ B: l-DI = 4A4Dh
. F A: P0 y; e- nWhich are the 'magic values' used by SoftIce.
, E( j2 c/ M4 k# i, {/ m0 u( o! aFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
9 f/ ~8 j i2 I4 i: C4 P! D7 g' A) G ` k3 ?
Here is one example from the file "Haspinst.exe" which is the dongle HASP
0 \+ u( q7 x& |5 J- NEnvelope utility use to protect DOS applications:
. _/ Q7 ?. {: p1 n' {) V- V/ P3 q- ?/ K
5 v8 C* u0 ~: q+ @4C19:0095 MOV AX,0911 ; execute command.* z1 |/ L( m) E9 n
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
* `0 i" H; w0 L9 w5 o: e" k: l4C19:009A MOV SI,4647 ; 1st magic value.
5 M% m" M# Z+ V) k/ m- B4C19:009D MOV DI,4A4D ; 2nd magic value.. w% D) l8 h& j, V7 s2 ^3 d( @( u9 M
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
0 N" J* Q1 J* i9 R4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute& H, T+ A/ ?" m q1 z5 E0 b
4C19:00A4 INC CX
; z" o. ~9 y" o) M- o$ Y! x4 m+ N8 c4C19:00A5 CMP CX,06 ; Repeat 6 times to execute( t6 K% \9 b7 x$ M
4C19:00A8 JB 0095 ; 6 different commands.
: U) i/ a9 G3 Y0 v4C19:00AA JMP 0002 ; Bad_Guy jmp back.
6 i( H X7 `7 X; u3 j; a4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
" C4 B7 n( d" l# @! t: V! L2 \
The program will execute 6 different SIce commands located at ds:dx, which# X/ h9 o4 E( d; Q U
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.$ \- P- q+ k2 C3 y. @( m; e+ U
, W0 B0 a" L9 Q0 T' e6 U* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.* L$ a9 [9 B6 F) Q2 ~* W
___________________________________________________________________________; g+ I* j6 U- K; C- v3 Y8 E
# t* Z( `- \8 W# J2 I! ^7 C" i
% N& D* g% c# T- R2 ~; H" z1 f0 x" @Method 03
- d+ j1 X& q9 O* V2 @* k=========5 |5 S9 ^. G7 m a& y( A( X7 X" H
5 u- j$ Z2 |( ^0 ]# f. O& E: w# pLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h6 [0 |+ f; |6 [) F- [5 ~4 O4 U; [2 e
(API Get entry point): K2 F, C2 X4 M$ D# o' f
/ B4 t7 R( q0 d& I4 m
4 B3 }7 q8 [+ k9 E: M M xor di,di
& e( u' j) t7 D8 Y0 J mov es,di* g3 J1 b% _' {
mov ax, 1684h
' }5 M+ Y w5 P# f O4 `$ J mov bx, 0202h ; VxD ID of winice! b7 U; t/ V( q9 ?9 ?5 x
int 2Fh
& Z) D1 Y% |, _" H' G: T& s% z" T mov ax, es ; ES:DI -> VxD API entry point
, ]- q: |$ Z+ a2 M0 V7 U add ax, di
# A. P1 n |8 p% C3 K& m test ax,ax8 f! X- A6 S/ k3 \. Q
jnz SoftICE_Detected
. s3 U7 e: b6 }8 q) l0 [0 D" w& v" Z0 u- E
___________________________________________________________________________
5 T. g- ?% F5 ]0 _' N g6 V
; N2 U G% s0 ]: N+ ~- z1 MMethod 04
; n3 O) ~* B( e; m) Y& {4 }=========, j* z, U. C# `! i7 N! Q
- z$ ]1 }9 c( z+ B4 ?& K) nMethod identical to the preceding one except that it seeks the ID of SoftICE8 ^& A, i* C0 O+ Y
GFX VxD., N4 T$ x* F4 i# F# D
' x9 Y; y6 p9 i K& N. `2 k
xor di,di( y7 m9 m4 ]0 T
mov es,di2 \, @8 l" s: j! J7 i. h
mov ax, 1684h 8 R' Q6 y: I* I8 f8 q
mov bx, 7a5Fh ; VxD ID of SIWVID: w. u. m7 J6 \/ o
int 2fh: i9 }! u3 D) `1 [7 s
mov ax, es ; ES:DI -> VxD API entry point
0 r) v: O4 j; q add ax, di
( A& [* y5 c8 h4 s ]( Q! g test ax,ax
4 j' s8 @5 j7 B jnz SoftICE_Detected' X( @4 a! u' c8 u$ ^
# v' q: U8 ]+ m, l7 s8 P
__________________________________________________________________________# I+ w3 m. S% X& T
' H) ^! O) |* r! g& J' U
- _4 g7 ^( g- E* c3 f+ b6 d
Method 05
$ B( Q4 M) v5 V. P=========
3 s3 V E1 O4 K
s0 s- I. A- V! t1 b. g( mMethod seeking the 'magic number' 0F386h returned (in ax) by all system% g& _' _2 s K* t0 J
debugger. It calls the int 41h, function 4Fh.+ g; S6 |% k0 S* ^ a* w
There are several alternatives. $ j1 f( A/ W- `- a& B& V
) F2 T0 c# g( A$ [; y% ?: m0 W* JThe following one is the simplest:; K( \! P: i6 g" Z7 Z
R' y* q1 h$ k, z# y ^: ` mov ax,4fh$ V# Q: T# N4 I a2 A3 ~* v. T
int 41h* ~$ D5 q7 S) Y* [% K
cmp ax, 0F386
' y2 h/ Z$ h H% s# S" V6 O$ i jz SoftICE_detected- M; m& `% k; p9 q
6 {( V9 o- E6 t. j6 b" `, A$ O2 b! T( z# c4 T9 t
Next method as well as the following one are 2 examples from Stone's
7 |9 o8 F: _" {- \# r- Y/ ?5 U1 J5 Q"stn-wid.zip" (www.cracking.net):, [ z @" G7 s. d3 R# R1 Y+ g! c
0 Z" H% W5 r% \0 T5 m# @ mov bx, cs
8 l$ j9 c- l" Z0 F lea dx, int41handler22 | |2 U& [) X' j3 V+ H
xchg dx, es:[41h*4]/ l7 v$ D" p8 m
xchg bx, es:[41h*4+2]
0 S# B' A: d2 `+ q! ]0 k/ v& f; \ mov ax,4fh
2 P! U3 M. H0 z# ]9 _1 M int 41h1 a4 r4 o, D% L( [8 K* w, Y" F
xchg dx, es:[41h*4]. x$ Q+ _5 h1 a8 d ?: l
xchg bx, es:[41h*4+2]
1 T9 s, U' q" I% z# q7 b. n cmp ax, 0f386h
$ K+ c, |( e( {& ~. z# f) z jz SoftICE_detected
3 \7 H4 V. ~% s& p9 r$ T! `7 ` t) v! `6 R1 V/ F( c! c3 d5 J
int41handler2 PROC
5 O) j$ l- E; o. U# N! v1 I+ a2 K iret, X, \) e# r6 v
int41handler2 ENDP
3 O8 v* c( g9 d/ E# [- M* d. k* O; I% v8 j1 n
3 {% t9 [- f. M5 k: {+ l
_________________________________________________________________________7 `6 s) x: E1 u* h, J4 j
* Y$ c: N0 b4 Z& _9 F# U* U
! \, u- K( K& U) fMethod 06: h" e2 i) }9 N6 g5 t4 z# h! Z3 w
=========
$ o0 t. j0 k4 Z' W. D3 N
& V; E6 P/ ^0 Z4 }
4 J5 r% {4 |$ U6 S F2 n! R. a0 q; x2nd method similar to the preceding one but more difficult to detect:
4 i6 H2 J& e$ T* V& g S0 ~% y+ ]% Y2 [7 s5 @4 `
+ ~( O3 L. @6 f5 O% q. |: c
int41handler PROC3 W+ c# v l8 A' x+ D
mov cl,al
5 R& V r. i4 q. V/ i iret
0 R2 Z% N. Z+ \int41handler ENDP
6 }+ P# i* P. K! j0 n* T4 B% Z% w5 ?# P; G6 v
5 n+ G6 U1 ~7 {6 A7 A
xor ax,ax& h5 H" V" Q" l, ~
mov es,ax
: y2 N! b9 M7 |5 ~0 b mov bx, cs
" }) [$ ~2 Z- J lea dx, int41handler
% K& A1 ^" R5 j' ?/ V xchg dx, es:[41h*4]) @$ A5 w; o4 k l- o. O$ I6 g) D
xchg bx, es:[41h*4+2]0 o% E# M2 d8 g: e P( b
in al, 40h
8 i _, v& R2 g; P' y0 D xor cx,cx
$ n" _$ t5 j0 ]0 X int 41h5 r; ?' @3 H$ d" u* R ^
xchg dx, es:[41h*4]9 ~: e9 v" G& c% ]. }: [
xchg bx, es:[41h*4+2]* \! L$ }/ V/ s6 G/ @, X
cmp cl,al% s0 r/ k/ ~1 B
jnz SoftICE_detected9 p" s3 Q1 M( d9 R+ z3 Y( F
& e2 Y* B) r9 v
_________________________________________________________________________
% K5 y, q8 b( C) o q
7 |! |2 h1 a, H' K# B( ^: FMethod 07
* `; i( t$ R* P0 c=========
5 U8 L0 l+ P0 o$ |; \
# q O7 S; L: ?2 FMethod of detection of the WinICE handler in the int68h (V86), U8 o; t/ r) ^
% B/ R' c+ g' F/ Y& I mov ah,43h
- C- E Q. f# e int 68h
5 e0 r+ H/ D, Y4 U6 T5 P: B! L cmp ax,0F386h" B2 s7 |0 m# X) v' C, a1 ?9 |& {6 J
jz SoftICE_Detected5 Q4 w: S8 Q! m5 I) C! h
+ V2 G* @" s& G" G: l
3 ^, c' f9 J& G7 G: P=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit7 V i7 Q, u0 l" l0 e
app like this:
0 S- |. Q# v& t. k, j/ i2 N# r8 p+ G" b% K. J, Z8 @- i, N/ |; X
BPX exec_int if ax==685 N9 x# \; U* x4 Q# p# s
(function called is located at byte ptr [ebp+1Dh] and client eip is
* {; F/ k* ]0 t- N% m located at [ebp+48h] for 32Bit apps): d. N0 Q# f- G, c: L
__________________________________________________________________________* P' L1 b3 D4 k3 l4 _4 S- m9 E4 ?
& q! a7 P: ~3 q* t
+ b0 f( X. ^4 _& Y r- k
Method 08
( g$ g" |0 w& O+ S& w1 j3 \=========
: V$ w8 X' @6 v: q2 P
5 t6 d6 R- L: F9 VIt is not a method of detection of SoftICE but a possibility to crash the) t% P& ?7 d* I# U
system by intercepting int 01h and int 03h and redirecting them to another
N0 D5 k h, A; H& V; Aroutine.9 [6 [1 ^* f& p$ j( [/ q: ^- c3 J& V
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points2 R8 |+ N' k6 P2 x0 B
to the new routine to execute (hangs computer...)$ I+ t1 s1 |* J0 H2 i& ^
3 G4 R7 a- p* }! [% k
mov ah, 25h8 r7 O& B9 M) _1 f( \2 q& f. H
mov al, Int_Number (01h or 03h)
7 ]6 P9 q) h" W8 ]3 s; f/ H. j- D" S mov dx, offset New_Int_Routine
4 v% m$ x0 D2 q6 f/ \2 z/ p7 C6 _ int 21h1 r* T5 ]- \* Y* {$ n( ^2 J4 d
/ C4 L& [0 T. R__________________________________________________________________________
3 Z& [% W6 B7 Q( c
9 ?7 B% h3 k+ c' {Method 09- z' b$ P5 F1 _' `% M7 i
=========* I' N' y) h/ @% x7 G
; ? k! c( f$ |9 L/ X5 j! y6 aThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only$ I; _# b2 A6 k* j2 A# M9 P
performed in ring0 (VxD or a ring3 app using the VxdCall).
: w% X( Y( `) [. Z, ^The Get_DDB service is used to determine whether or not a VxD is installed
! Y/ m, a. V4 D) w/ X# c) ufor the specified device and returns a Device Description Block (in ecx) for1 }8 J4 x* y! e* C0 s2 V
that device if it is installed./ e1 v" e) ]7 }/ |
+ q# ~2 z6 `% C( o9 J$ m: F mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
4 W# O" q! {( X, c+ C: p mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)& i% @2 d' @( _& L0 C
VMMCall Get_DDB8 H/ w8 h% C6 b& k! W4 W5 @( y
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed" a6 b+ @' G1 q8 J- ~, x4 Z' w! ~+ Z
$ [7 R' Z: u8 g8 N0 i
Note as well that you can easily detect this method with SoftICE:
. C% y% p6 c+ \4 _/ F n bpx Get_DDB if ax==0202 || ax==7a5fh% ?, d; X. S/ t# {0 L* I" V9 }
2 s2 N1 c# u0 W6 l; R. m) J2 B+ |& U# B
__________________________________________________________________________0 x3 q, N! R+ U( x* u$ G
1 _$ ?" w% z. r: v: YMethod 10
8 [" ]4 A4 ]7 g* Y/ h6 L3 M$ z. p=========# |" Y z3 p1 p/ t% N' [5 ~2 M
! m2 D% u$ p# b/ `; e9 O3 _) K. {' Z
=>Disable or clear breakpoints before using this feature. DO NOT trace with
) ?6 X# p2 ^0 D SoftICE while the option is enable!!- K+ B: e9 R6 V6 J$ a
' p. A' n( \3 uThis trick is very efficient:* o! a8 e6 P, J8 K3 }: m' ]9 n$ v
by checking the Debug Registers, you can detect if SoftICE is loaded, L" q$ |/ M3 m" @6 s, ?, T
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if7 U/ a4 @+ z8 s5 L+ K4 _
there are some memory breakpoints set (dr0 to dr3) simply by reading their
+ v" f6 X! |9 Y& o2 F5 `5 Vvalue (in ring0 only). Values can be manipulated and or changed as well
- r2 V1 g$ D9 Z(clearing BPMs for instance)6 Q; G8 P- s f8 @ ?' R
0 n4 c; m( I( C; T5 |; i__________________________________________________________________________
8 G+ N. A t+ l2 h3 {( l, t
, \3 h9 @/ H5 M6 R2 HMethod 11# b6 I2 i( }" i
=========
9 J8 C$ o! U+ B- O' @# v9 U$ z/ H2 L5 L9 C# k7 z0 @
This method is most known as 'MeltICE' because it has been freely distributed' r/ R5 l# ^# k6 L4 c/ [9 U& r x
via www.winfiles.com. However it was first used by NuMega people to allow
3 @ R8 j9 s, `: \6 YSymbol Loader to check if SoftICE was active or not (the code is located5 o- \# \5 g- K0 p" o' A$ X
inside nmtrans.dll).
# M) p8 H. G' J* C. I
8 ^0 R$ C9 j7 K" u) r$ [The way it works is very simple:
& S8 m! i7 y7 W$ H3 cIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
1 F2 `( Z2 v* @WinNT) with the CreateFileA API.
( |4 v9 p- E, R2 v( R8 J& U7 N& F
9 A6 i$ Y( h i! q, zHere is a sample (checking for 'SICE'):
; q* i: E# x4 i5 e2 r( }2 z$ n2 x( ~' }5 X* R
BOOL IsSoftIce95Loaded()% i. b9 a2 L2 ^$ r
{, G9 n0 B6 ^+ K2 w
HANDLE hFile; # P, Y+ _5 n* _1 S/ F* b: V
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,7 L) Y! D/ S) n; F2 J
FILE_SHARE_READ | FILE_SHARE_WRITE,
0 Y- }! y1 d& x0 m1 k& g: L NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);" s! b/ P1 k+ t1 u, F" Z6 @( Z) r) n
if( hFile != INVALID_HANDLE_VALUE )% h% b- o' o2 [) i; {
{
6 k# [' U, f' B# z4 Q8 i2 ?+ O' [, Z6 P CloseHandle(hFile);
; z$ j- I- ^ U! T2 Z6 H$ \( D return TRUE;
. l, l0 _1 ] P2 K7 z }/ {9 U7 q6 Q5 O% a* y
return FALSE;# u$ c' T: \6 j3 _
}5 z; S, z* n/ B& r- B5 Q( n. l8 O$ E. G
- }0 P' u( s. N
Although this trick calls the CreateFileA function, don't even expect to be
5 Y* I5 i* d. E/ P, Wable to intercept it by installing a IFS hook: it will not work, no way!
$ H6 j4 H9 }+ K7 U R% kIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
5 B- X& i/ w1 r3 Gservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)$ m" S7 Z4 @8 g1 X
and then browse the DDB list until it find the VxD and its DDB_Control_Proc6 h2 o) m, Q& Y
field.
/ | C* A8 e+ z+ ^In fact, its purpose is not to load/unload VxDs but only to send a
3 z0 P% {0 y* nW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
* ~7 n! Y: L% ]2 X: gto the VxD Control_Dispatch proc (how the hell a shareware soft could try$ k- H; Q7 l( O% S' H/ s \
to load/unload a non-dynamically loadable driver such as SoftICE ;-).* Y4 Q# b$ K8 V* r' I0 k. G! f
If the VxD is loaded, it will always clear eax and the Carry flag to allow
) k( K$ o" r; H) D- cits handle to be opened and then, will be detected.! `7 ]5 \4 [: A3 I
You can check that simply by hooking Winice.exe control proc entry point7 ~6 Q/ R7 G* U
while running MeltICE.' ^0 q! Y$ {4 w! m# \% z1 y+ V
+ S, _; j$ c. l$ w+ M
0 J1 k8 _! W g! I1 } 00401067: push 00402025 ; \\.\SICE
! C2 m8 g; H9 F: |) x) S5 \ 0040106C: call CreateFileA" u) {) Q9 g7 l+ `. C# B
00401071: cmp eax,-001( u( m! L7 ^- P3 F
00401074: je 00401091
, ]. [0 t$ ?; Z% _/ b6 y* z% l' P7 }# Y7 l" \9 A) S1 C
7 V$ P9 F- v3 P/ C. W1 |
There could be hundreds of BPX you could use to detect this trick.
9 \4 ^* S# m5 y) u; D4 a/ }) U) q-The most classical one is:+ \8 t% P& L: J$ z
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
+ A" w6 U: T4 }3 Z5 p& M( P# \ *(esp->4+4)=='NTIC'2 M8 S8 ]* G7 `; e h
1 ]. n$ C& s& p+ o5 ?" r2 t a5 u-The most exotic ones (could be very slooooow :-(( N5 `5 E( c h" F5 U5 P! f, D
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
: _/ S1 p2 J2 v1 B1 C ;will break 3 times :-(
6 J0 p$ e/ g0 w
3 o$ ^# L, V2 V% F7 F6 q9 x-or (a bit) faster:
$ T4 O2 U! U( V& f t; [, v BPINT 30 if (*edi=='SICE' || *edi=='SIWV')7 t, w& P) I7 e4 R8 \9 T2 e
4 D# e9 @) N2 @5 Z, _# C
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' 2 G1 i# n8 b' R$ }1 N/ \
;will break 3 times :-(9 w5 H' r, u5 I, V
2 M# A) P4 w4 e5 p& X x
-Much faster:
6 e' p: ~* O }5 \& j6 ?" A) X BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'3 _& t1 x& P$ Y# _. l
, i! r2 w5 u8 L$ ~1 ^Note also that some programs (like AZPR3.00) use de old 16-bit _lopen6 d0 j( m) C& f* I. z6 [: [
function to do the same job:
# @9 }. C) @7 _) S; m0 K
9 H) W( `8 L" x9 {' H push 00 ; OF_READ$ b2 I2 ~0 d1 L* ~
mov eax,[00656634] ; '\\.\SICE',0
/ Y' M" Y; ]1 I" W. t, Z push eax! k5 \8 ]% I+ V4 b @
call KERNEL32!_lopen
0 N+ f( z: |" D# ^ inc eax
7 Y, g2 u! o6 p2 W @8 D jnz 00650589 ; detected$ X8 m4 s' A" s7 ~1 L8 K
push 00 ; OF_READ* m. D% c# w) n$ _2 m
mov eax,[00656638] ; '\\.\SICE'
: a7 @! @- {/ y( |! u push eax
$ N9 h/ c6 L( L6 F call KERNEL32!_lopen: [( R2 n. k0 o; ?: ^
inc eax
! Q( r* A1 ^$ c! i. o jz 006505ae ; not detected
% f& D: f8 X& K" z6 ?; R+ f+ O2 y6 I4 J, _1 ?% J+ b( z# f
& Q& C- A' T6 K
__________________________________________________________________________, M6 y0 I! _% W. \# ?
" r, K T4 a& }% Y+ E; PMethod 12
9 o; {6 t, [. D( C8 O' c. ~9 r=========, M( f" L. k7 `9 t; z
5 u0 M8 [ }3 E% O& u$ K( [This trick is similar to int41h/4fh Debugger installation check (code 05
5 h% l% c6 G4 a& 06) but very limited because it's only available for Win95/98 (not NT)
2 z2 j4 k" a4 _3 g$ c; gas it uses the VxDCall backdoor. This detection was found in Bleem Demo.
2 g$ a5 ~: J2 L
! k1 h: m' E4 H' k: v, g2 r push 0000004fh ; function 4fh
+ y, Q* S' E6 d1 ?( E$ I push 002a002ah ; high word specifies which VxD (VWIN32)* H9 d& K6 z7 \+ d! G! R! z* O
; low word specifies which service
% b! H7 _* n a. _' J+ Y) Z8 @: J9 f (VWIN32_Int41Dispatch)
; |- U4 B) M; A: [9 Q call Kernel32!ORD_001 ; VxdCall0 e, b' `: Y- h7 b' i5 e4 [% {
cmp ax, 0f386h ; magic number returned by system debuggers
, u& U6 h1 Y% z" D% B. Q jz SoftICE_detected* l+ D3 o( X% o4 C# W% t. s9 Z" x3 A2 Z
! @. } E& M; ~" x
Here again, several ways to detect it:& R7 Y& i3 b: d) Q n C& t9 F/ @
5 e$ `5 U/ p" Z
BPINT 41 if ax==4f6 E* }4 P: C0 y# J2 C
! y7 b, D0 I% l# ?) X BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
: H; h6 D- `8 F9 L5 ~ J$ t- W' g* L+ e w5 x
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A7 M- j* S/ Y5 J" c6 n+ A" k
8 t# B D* t$ H% B; A BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
6 P7 D7 G) ?# {
5 F1 w$ Y8 T& ^9 H; @__________________________________________________________________________
) D! j+ W' H% I) G v9 R
9 o4 N" d! g7 o4 }1 t3 YMethod 13( I8 q$ `" @, N
=========3 n0 e z9 e3 {, D* d
& C* d, _% ^% _. wNot a real method of detection, but a good way to know if SoftICE is
$ Q! d+ S" H$ n) r3 E* X1 [9 b& oinstalled on a computer and to locate its installation directory.
4 [! H9 @! Y |! ~' j. ]9 U4 P) h* JIt is used by few softs which access the following registry keys (usually #2) :
2 ^ g8 }5 d5 R. t/ n7 n8 o& o3 P4 K) }8 X/ r% l; j9 ?0 V3 I0 f
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
* m( ]& Z% H/ l3 S, v\Uninstall\SoftICE
$ T3 S j$ C4 ~0 }% X9 \8 U-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
5 k8 L0 r7 _8 U9 D5 G6 X-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion6 X( ^, ~) `* ~. }% ~
\App Paths\Loader32.Exe
! O% E6 ?2 M; Z9 W6 K+ `% G6 e2 w1 A7 j! w; B
7 h9 P# P; H, C! _" sNote that some nasty apps could then erase all files from SoftICE directory
$ b- v: G4 A; K) c0 Q; U(I faced that once :-(
0 c3 m' U' O& y, m) T3 i0 k* l9 h: Y8 z. u
Useful breakpoint to detect it:2 N; u0 P* d$ v* h* w, v
, f3 P4 {# x/ [+ e
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
' O6 @* T& ~/ N! N9 z5 w( Y3 Q0 \1 \% s3 ~. R
__________________________________________________________________________
* s) u8 e5 f1 E( \4 _1 T
% n* W) l& |5 X) ^5 K% [" H# s
6 n$ A! R) ]8 j4 v* N8 RMethod 14
/ F3 h8 v) i- c3 V=========: S- D* G9 x; G* z
9 E, r1 z6 U9 e. Q4 RA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
! E! I! M6 T4 Z: Lis to determines whether a debugger is running on your system (ring0 only).% |! p* \9 E, ~3 Z
1 [2 `4 z5 X' v8 o1 _ VMMCall Test_Debug_Installed
$ Z! y5 n% P( J* l( C je not_installed
! w4 t% [" b7 w1 g! M. ]7 k. F5 t# i8 P
; E! \! l n3 R8 \9 ?, F1 ZThis service just checks a flag.) h, H! z2 F. C# H% B9 y
</PRE></TD></TR></TBODY></TABLE> |