<TABLE width=500>6 C/ ]7 e/ w4 P" z
<TBODY>
. ~% h: \" w2 L0 U: ~- g) M<TR>! N5 `: _, M$ l/ a) b6 o5 n
<TD><PRE>Method 01
4 w9 C+ f* D. C* Z; R2 f- [" Z=========
: H! z. ?% }0 m) f* ^+ E+ I/ }5 K5 j3 T: U6 O$ s, x
This method of detection of SoftICE (as well as the following one) is
8 C) M" ^4 ]/ @% ^0 I; |, L" d, bused by the majority of packers/encryptors found on Internet.) }! s. z: Q9 J9 R9 l3 }
It seeks the signature of BoundsChecker in SoftICE% i+ Y4 Y A" v# q
B9 E7 `( `" `
mov ebp, 04243484Bh ; 'BCHK'
7 m; a. \! K1 m8 d9 } mov ax, 04h; \/ j- r* B# U. ~/ E
int 3
( x) f* j+ U; w; \% Y& H cmp al,4
5 N# T+ G' x% F) X( Z jnz SoftICE_Detected2 J) l5 w7 p: O) U$ _" c+ T
9 @' `- I1 a+ f" C4 O9 q+ S___________________________________________________________________________7 v5 ^1 J. V0 n! Z1 H
7 ]* V4 f6 h; b1 ?6 i8 Z7 n1 WMethod 020 }$ }/ ]' f# y$ K
=========
; r& ^' A, \0 c ?/ @: N" T& Z0 v4 _( M
Still a method very much used (perhaps the most frequent one). It is used4 A4 O$ D7 d) @6 q. ^4 {
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,' K) t x9 H- {0 ?0 @4 G
or execute SoftICE commands...4 ~) t# J# v( N: U, U" g% q
It is also used to crash SoftICE and to force it to execute any commands+ f, [7 @% n2 A! h# l; \
(HBOOT...) :-(( + x2 f0 g& J7 g0 @/ m) y
- j4 c4 o% g+ R& {
Here is a quick description:
% a3 q) G0 X- G( a$ l-AX = 0910h (Display string in SIce windows)0 q* H& V6 x0 h2 ~1 z0 \
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)$ o6 K# Q. r/ H! b6 [
-AX = 0912h (Get breakpoint infos)
- I5 G4 n: ] `( D7 z-AX = 0913h (Set Sice breakpoints)
% Z* A, m7 G$ ] B9 ?-AX = 0914h (Remove SIce breakoints)3 S& `4 u$ F$ U$ U" ~3 u- `( u, W
+ M; `: \1 X7 H% P" U2 Y$ uEach time you'll meet this trick, you'll see:0 {. R" c. u7 v2 f/ x- N* L* p
-SI = 4647h
9 B8 r& L* ]+ J2 z& Y-DI = 4A4Dh. [6 Q; P3 O' o/ O; H
Which are the 'magic values' used by SoftIce.& b2 E" k% c3 d. A' `, }, H0 x
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.3 e4 O+ i- N' p8 W; k
0 A( l5 T0 v4 J) @4 K) V* }Here is one example from the file "Haspinst.exe" which is the dongle HASP
$ e( z1 G7 Y2 C. eEnvelope utility use to protect DOS applications:+ R* u! u% x S! l$ g- |
1 j# @, ?8 Y6 e# ~% B4 R
; [' ]6 n; R; [; m
4C19:0095 MOV AX,0911 ; execute command." A) H$ @6 ]4 U4 v' U5 U7 Z/ s
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).+ ^& i/ y: B3 [8 Z z& O& W
4C19:009A MOV SI,4647 ; 1st magic value.
' B: }' g9 R% S0 K/ n2 Z/ f3 t5 \' G1 a4C19:009D MOV DI,4A4D ; 2nd magic value.' O1 k4 T4 t9 p% z3 C
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)' K- L2 ~2 V" `
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute% M) I% S8 h3 W2 p/ c2 Y
4C19:00A4 INC CX
6 u9 l& v+ R) s; |$ \& Q& K: j4C19:00A5 CMP CX,06 ; Repeat 6 times to execute0 R E, `% L( y3 V2 {5 v: F' ?- Y
4C19:00A8 JB 0095 ; 6 different commands.
2 C& q4 L/ D' N3 Y4C19:00AA JMP 0002 ; Bad_Guy jmp back.& p# O X- f; e/ ]! o9 d* N$ `
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
' S" I+ |* \( [. k
- W: f% C3 H4 `# DThe program will execute 6 different SIce commands located at ds:dx, which$ ?$ E) o5 z1 c! a" w
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
0 R7 ~ d2 y9 G) a; |
: l' d5 p- Y. l, d* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
: ~# H9 e/ w2 F( A( b___________________________________________________________________________$ ]7 O0 J/ ]9 @* t8 h9 d
/ o! C8 m( @2 |% ^4 K3 H
. \1 C2 Q1 v/ ~( [# DMethod 03
8 N6 C* d% J2 M# s, M=========/ H1 X* ~4 \* g( E
4 f( p N- X& F# B/ ^) ]$ BLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
* l: h6 z( X( k6 m(API Get entry point)
' K4 ]/ ]3 t* Z9 O! }
4 |, ^) [4 K/ C* q; s) E+ K! U; F% w1 e
xor di,di, z' n2 a* T8 c
mov es,di4 Q: c, `1 t( ^& ]
mov ax, 1684h ! I/ [/ U( M$ ^- A+ V
mov bx, 0202h ; VxD ID of winice
2 R5 T+ [" B9 C9 S# ` int 2Fh( M! y! P! ]0 p* Y
mov ax, es ; ES:DI -> VxD API entry point$ [' N. O, `3 \# ~$ k* ?- N
add ax, di
! ^% y, ]8 L! m# t9 x5 {( M: ^1 O9 x test ax,ax( b0 y/ d+ A) H; y3 m* x- \9 |+ L( V
jnz SoftICE_Detected
y( p- [. R( G: q% O, h9 K) w
8 J6 p' N9 G1 A0 R" x___________________________________________________________________________+ c! [& U$ Q% k' f6 L: C' p
; V0 }; j) W: y# n) `. t% BMethod 04
* B6 N7 \% ]2 H9 @=========
4 }' |- A) d4 n# C9 E* I o4 l: z
$ g/ Y) }9 F# W* v! L! rMethod identical to the preceding one except that it seeks the ID of SoftICE9 J& s: z9 l# `# _
GFX VxD.
) ]; l! A* n3 X" K
/ B1 L, l6 B; S: X6 o6 S2 R$ ]1 J xor di,di
" J/ {2 _+ d- d* v mov es,di
, O0 f3 L0 n' g. n7 D3 N& N- ?8 w6 A mov ax, 1684h . U ~6 y; h3 B2 q4 r
mov bx, 7a5Fh ; VxD ID of SIWVID$ H5 e- d' ^2 m
int 2fh
" W8 C5 Y+ r. a8 K mov ax, es ; ES:DI -> VxD API entry point
+ Y+ a! c8 o0 W add ax, di
: I2 g; \$ ^- l: L# H( X& G test ax,ax
5 D H/ d# z) v jnz SoftICE_Detected
2 L$ S5 o1 I9 k d$ {9 o+ V7 K. v+ H6 M8 L7 T" ^
__________________________________________________________________________
7 g+ X0 [ o4 h" Q) m; y% C4 n q1 I) I0 p$ U5 u
L4 ]+ r! {( H1 B- bMethod 054 i2 A1 z3 V7 ]% B
=========) k! U. c$ G3 L; A9 L! e; U
4 U1 h0 e4 |2 o1 MMethod seeking the 'magic number' 0F386h returned (in ax) by all system
8 h& I5 N+ r2 K6 j' ~% h% S5 J8 Gdebugger. It calls the int 41h, function 4Fh.
% k/ m! C- h& v+ ^; E. B, ]There are several alternatives. 0 ]" g, j$ D6 f. A
# j7 o: I% L/ Y9 s1 K# H+ ~
The following one is the simplest:
$ w$ H4 A: ] N9 R( m& n% q! H9 c7 e& x7 L8 k% D
mov ax,4fh1 y" H+ T5 `) y& I5 z8 t+ z
int 41h$ E- }$ W0 q7 X$ _0 l
cmp ax, 0F386
& S5 |. g, T3 \1 ] jz SoftICE_detected
% Y) {1 R0 q L% I7 q* E: g2 R+ H7 p, o
# p, E, l$ n( S. x4 @- ENext method as well as the following one are 2 examples from Stone's 5 L8 n2 p( [+ J3 w
"stn-wid.zip" (www.cracking.net):
2 E8 V/ K0 m$ r
6 S, p% x! S+ Y+ z& M5 `" t mov bx, cs& S5 Z0 i8 o2 `9 l) E9 L& X
lea dx, int41handler2& t2 _0 {) ~8 x1 h+ y6 w% z. g
xchg dx, es:[41h*4]( P$ b6 M4 |$ v9 ^" {* d
xchg bx, es:[41h*4+2]
8 g0 q- g4 v9 o4 ^" U! o9 K mov ax,4fh
% h! A* O! \0 H( K. ~ int 41h
% b5 ~6 s V: T2 u xchg dx, es:[41h*4]
. F, o: d: i8 n2 n& R6 F xchg bx, es:[41h*4+2]
2 N/ m, h$ L( M8 C cmp ax, 0f386h1 r! E" @$ w: Z; x8 Y( ?4 u/ ~, b: g
jz SoftICE_detected
8 c8 S% A, E/ G! v+ Q
8 O2 y0 l0 b0 nint41handler2 PROC
! V! e0 G7 \& F, N6 m( \ iret
8 R8 N9 K7 V# @/ U: Sint41handler2 ENDP/ d7 n7 T- X* ?: i- a* d1 L1 b
7 I+ C# {+ @6 k5 v& |3 N
2 f4 W: `: A C* u" n8 C_________________________________________________________________________
; B+ W* B' Y, L- E0 d, n+ _( z l% k* N A z% ~( A
( W9 E$ Y3 M# `4 I% `$ aMethod 06- c6 l1 O9 {4 @( y0 N
=========, B, J8 ~9 S$ z6 m. `8 b
! D+ y x2 c; G
1 [# z4 i' R3 y1 l) Y5 u+ Z* |& _2nd method similar to the preceding one but more difficult to detect:
9 l5 E0 \3 ^8 C2 P4 J( |1 y: Q% g' D0 t
7 g6 c: k: q* f$ S# ~; G* W
int41handler PROC2 U5 o' B0 L$ n$ M2 t
mov cl,al. s4 ^/ F: D( L0 e" L
iret q, l6 ~, ]1 n
int41handler ENDP4 \7 y: b" c2 {/ k
6 H# E. c5 i, ^5 ^: Z
: ~- P- Y m `& y. h xor ax,ax
2 V' y# c0 V8 y- q; [- a3 _ mov es,ax
+ `! ?% c" g9 U9 S+ c& x; M! f) [ mov bx, cs, g4 H! N" [0 ^$ V
lea dx, int41handler6 i, ] q6 \ Y# o5 a
xchg dx, es:[41h*4]. G- {- M U9 L1 f
xchg bx, es:[41h*4+2]
6 V1 g2 h: l7 ~. Y7 d; i in al, 40h
* E% l, `$ Q {% f" {5 T xor cx,cx
8 d" v( V7 E6 H! U7 A, F5 t2 {" O int 41h
! }" R8 C4 |9 o- W" Q xchg dx, es:[41h*4]
8 d/ {4 E! k; F& |9 | xchg bx, es:[41h*4+2]% I" `- @$ w* J
cmp cl,al
6 {" y: ]% `% \4 w" Q jnz SoftICE_detected1 R9 W9 y* V& f& f2 I3 L: g
7 ~; s- \6 z4 T$ Y! z% {_________________________________________________________________________
. ^$ X! v* |% A- g0 }
1 M. F8 w9 w" G) kMethod 07
; w: I) j6 R: C' @! S2 L; [0 [=========3 J B0 {9 B0 W* D& K5 b: z+ O
. S8 j* D& m5 G }8 g6 q9 d6 U; L6 \$ bMethod of detection of the WinICE handler in the int68h (V86)
' r4 s( G2 e' c$ w- r1 U' [ H Y, L4 k( `4 z/ u b7 ]( a/ |
mov ah,43h1 r, Y. }8 ~; ]8 t& w/ W. W9 q
int 68h
- w" L4 u6 D$ p7 M- E2 @4 H cmp ax,0F386h, Y' t1 u5 f; g6 R* c
jz SoftICE_Detected S4 m+ h: N- ~/ i1 a% l: \
& e' X2 j% x4 s, _) a6 v& u; Z! ~2 B1 n7 Y- V5 l
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit3 j1 w( g5 p3 S; J
app like this:# [+ @: y( i- _. N5 G( M
8 `) m- q: {7 O. H' o+ r( ^/ P
BPX exec_int if ax==68: h7 E" l, w" }
(function called is located at byte ptr [ebp+1Dh] and client eip is F& Z; X: k1 z6 C
located at [ebp+48h] for 32Bit apps)7 i6 F6 p4 e( |5 J' d/ _
__________________________________________________________________________
* [- g6 r. O7 ^: s9 {
/ R; S3 [8 e; k3 z$ F# X
) [) t+ d8 ], W2 NMethod 08
+ I* M P$ Q" }- K4 J=========8 Z, M5 G+ P; N) L
+ m( P4 n2 t0 I* O
It is not a method of detection of SoftICE but a possibility to crash the
0 P& h4 d7 o( S w! Wsystem by intercepting int 01h and int 03h and redirecting them to another) j/ \' ]3 C8 m, z4 [3 ~1 \
routine.
) K+ m/ A/ e+ I1 E0 y( AIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
$ _* z) O4 U) Q0 u2 q- hto the new routine to execute (hangs computer...)
3 Y: Y6 H/ p5 c) U/ p
* q9 ~3 V2 U: r) E5 D1 g mov ah, 25h5 K( S p* I8 i* S; j# [" K N
mov al, Int_Number (01h or 03h); q* z! i Q; K7 I
mov dx, offset New_Int_Routine3 D5 b4 f4 z2 o5 A
int 21h: x! V+ h6 H! z6 C. F) E
2 u$ Z! ^; S; R b% |__________________________________________________________________________' c5 q# z" |$ S. r, z t
8 f) \" C, [! I' }( G
Method 09- f* c5 v2 b9 z+ u# Y1 }
=========& T% Y) @# [4 g0 C0 b2 u: `
" o: G4 i3 I4 d4 A. \0 u" Y' Z/ N
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
, C+ Z2 }3 H7 _, Q4 a) Xperformed in ring0 (VxD or a ring3 app using the VxdCall).
) c; R4 X [+ `9 T e3 n2 KThe Get_DDB service is used to determine whether or not a VxD is installed
+ l( S& a/ Y; Qfor the specified device and returns a Device Description Block (in ecx) for
6 T9 \% R" t! V! S3 ]3 T- qthat device if it is installed.$ C* N$ f2 D4 i% x$ r, ~& v
% F2 s' P/ z8 a, {% ]: J% e$ { mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID0 x/ f4 b u& w
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
- F( c& X# N! G VMMCall Get_DDB( B; h3 P( s; T. @
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed7 P6 d2 m6 v- q3 r7 ~% g
, X& v3 k9 J. l6 w- ]- Q- D
Note as well that you can easily detect this method with SoftICE:
! |- }0 L, q& T bpx Get_DDB if ax==0202 || ax==7a5fh0 d- P# U$ Q* f
- W! L* V5 |9 X2 C3 L__________________________________________________________________________8 I$ s7 M0 `( w. f5 I
: b; ~: A8 b5 l) v
Method 10
0 `5 Q5 m! _- M5 m& n' ?% x$ X" O3 k=========
4 [: m X! n; g2 S' z* x
: q$ c4 J. a1 I=>Disable or clear breakpoints before using this feature. DO NOT trace with& ~" q4 G( C- F8 J8 F+ }
SoftICE while the option is enable!!' k; ^& \. v3 o
) Q0 L6 s5 V% }, [* w/ T
This trick is very efficient:- C' I6 s7 U& G
by checking the Debug Registers, you can detect if SoftICE is loaded
, |2 o+ G: u; n: A(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if' w" P1 {, s/ g/ p
there are some memory breakpoints set (dr0 to dr3) simply by reading their
4 o1 m5 ] j& S3 k0 rvalue (in ring0 only). Values can be manipulated and or changed as well6 {# b# d) k, h6 {" Z1 v' \3 c* z+ j
(clearing BPMs for instance)& S- v, ?9 E2 f$ B0 [# T
* w$ [3 O6 m) R; H Z1 m& U; R
__________________________________________________________________________
! B9 W' u; ]& W3 F2 O
* g5 J K2 L0 N+ h: CMethod 114 E* _3 V6 R& f8 N% w9 x) h, @9 }0 q
=========
$ Z8 l# O( e& x6 q5 S/ p* B& D( }+ C T2 ^3 t; _
This method is most known as 'MeltICE' because it has been freely distributed
, Y7 c) s' M, {: E; vvia www.winfiles.com. However it was first used by NuMega people to allow/ e8 w y2 H/ X! j) N6 t2 g7 U, I
Symbol Loader to check if SoftICE was active or not (the code is located
( t1 i2 ?* X- ninside nmtrans.dll).) c/ P) \* z0 k: C! E
! }" Z7 c& Y. zThe way it works is very simple:# K, X. V4 e' O0 s+ h) v$ m
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for h5 L8 q# }/ m( W/ ~
WinNT) with the CreateFileA API.
5 p. P- u5 \) V3 w' D
. q7 J. |1 h) @/ I! f, XHere is a sample (checking for 'SICE'):
6 |" z6 E* r1 z I5 F! ]3 O, z* A" t& f( p
BOOL IsSoftIce95Loaded()/ Y" L6 R% f; j* U, a* Z& e
{
8 B9 i0 d w/ L& h HANDLE hFile;
. K9 W* W4 }8 a8 j" c$ y; H hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,- f% O3 a# W* i0 o
FILE_SHARE_READ | FILE_SHARE_WRITE,# X6 j% ]) p* @. R, k9 q. B9 v
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
/ H3 {. r; z) c$ X if( hFile != INVALID_HANDLE_VALUE )
* @. k6 m( a$ ]% k" g {. |8 ~# Y" C3 |% f- e% U2 Z
CloseHandle(hFile);
" Y |1 S3 V3 O; }4 t return TRUE;( ?8 @# T$ P! P" c0 R. ^' T
}
; S1 V u8 P0 A3 n% ~* D) |* f0 i return FALSE;1 g5 B+ E9 e. [
}4 b1 f* d% B' [% m- v0 {
6 c- p( J$ q. l
Although this trick calls the CreateFileA function, don't even expect to be7 l, X1 Q* b/ I5 u; r4 Y
able to intercept it by installing a IFS hook: it will not work, no way!
( H o( E C7 O, ?In fact, after the call to CreateFileA it will get through VWIN32 0x001F2 c- I& }9 @8 b1 D/ Y
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)( @: @; U0 A4 t( m- U1 p( ~3 D5 g
and then browse the DDB list until it find the VxD and its DDB_Control_Proc4 U- u R+ ^9 N6 C1 q; U# K* B, ~
field.
4 W0 x5 h( r: w' b" FIn fact, its purpose is not to load/unload VxDs but only to send a ' u: `3 M6 X8 n7 _* B
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
; W3 k0 o& v( f. `to the VxD Control_Dispatch proc (how the hell a shareware soft could try
9 c1 Q( ?; G$ I w1 F# i& J% tto load/unload a non-dynamically loadable driver such as SoftICE ;-).
0 w- J ?/ C0 S+ }If the VxD is loaded, it will always clear eax and the Carry flag to allow
2 Q* P/ ^! P% S1 oits handle to be opened and then, will be detected.! _5 N" L- a ^
You can check that simply by hooking Winice.exe control proc entry point: K& G/ u+ s5 J7 L; ]
while running MeltICE.! P) a: u/ _3 j5 d$ ^8 f' N/ U
8 Q& T* }( d5 Q
# U; P; D, G2 V+ F 00401067: push 00402025 ; \\.\SICE9 l/ _6 f B0 k; V5 X- J" b
0040106C: call CreateFileA4 P. H- k' D$ s( b" S. [6 l) A
00401071: cmp eax,-001
( c' }. |5 ^" M8 b 00401074: je 00401091& g8 b* d8 R! S
1 e, \# V! s: z# x9 a9 U1 z) H. n$ E( |% n
There could be hundreds of BPX you could use to detect this trick.
/ O7 S. Q8 P3 H. v" I p6 ]5 @-The most classical one is:3 L! [! D' d5 W
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
+ X- |1 W0 D, y5 C: s. h u *(esp->4+4)=='NTIC'/ h# Z, R: ~3 ?4 w
0 E! ?4 L6 {( ]1 L j1 J
-The most exotic ones (could be very slooooow :-(
' Y( Z ?4 x+ m$ G+ g BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
* i: h8 D1 m F% F ;will break 3 times :-(
/ K. q4 O0 L5 e' L9 Q% z2 `+ [) L) G# ^/ l
-or (a bit) faster: 6 w' ?4 P& q# q; d% l9 |. M: w
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')/ z& B( a& D+ k. X: Y8 \9 M
" W+ C) @" E5 C
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
}; ^$ x" X6 k1 `& g6 D ;will break 3 times :-($ }7 D0 \/ H6 ~6 g$ m y7 \
) E) f9 o# o- C: p1 ]- w8 o& [3 s* S
-Much faster:+ C- a, {- M( [0 E/ a
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
" T: I# A; P/ A4 k$ s% i9 q# u" V, ]$ q; t7 i
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
( A# L+ B! O: Q$ @function to do the same job:, E+ L' S& P# {+ o0 [- W
( h. } C% R: l& S1 ~ push 00 ; OF_READ6 e& k( C, q" q1 G2 }( z" ^$ ?% z
mov eax,[00656634] ; '\\.\SICE',0: X* c7 {. {; D
push eax# v+ v; I% K/ e% t
call KERNEL32!_lopen
. Y9 n# u% B% @9 i% D2 J inc eax
' {6 g, X; U' t1 m- a% O jnz 00650589 ; detected
( [# ?6 y3 F: j5 d/ { push 00 ; OF_READ
. d& Z* a/ h8 i4 R mov eax,[00656638] ; '\\.\SICE'
9 O; b) Q2 ]" y push eax2 c! I8 Y# a( x* ~7 ~% e
call KERNEL32!_lopen5 n9 V# L% k7 \% q1 z
inc eax
5 c. y" b7 X! X% V jz 006505ae ; not detected! ]/ P( s: D5 U, ~6 I1 t
: N3 B, ~% I! P& f' l+ N& t5 Y: S
9 ?( Z7 b8 y1 A6 o__________________________________________________________________________5 }4 l) |( {* |% q4 \
! T/ q" y2 Y- |+ V# j: @; B6 L
Method 12
# \8 t1 Q, ]) h0 P1 M# a4 r1 z=========; `+ z; g3 C# U5 ]- W# H: |7 I) h# \
! w. t( V; j0 t& v2 v( I- J% v# EThis trick is similar to int41h/4fh Debugger installation check (code 05; S' Z- Z! K5 o! |9 f1 V
& 06) but very limited because it's only available for Win95/98 (not NT)2 D: U8 J) M' p, w- B% g n
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
( Y7 b/ i* r7 K6 `. J$ V7 t, Q7 g
, G1 e) n% J9 E9 B e, L1 C push 0000004fh ; function 4fh
9 @& S3 E2 \7 { push 002a002ah ; high word specifies which VxD (VWIN32)
2 l! o7 h! a5 Q0 X& ^! h7 O7 ? ; low word specifies which service+ V$ Y- ^7 R& I- L7 N) B
(VWIN32_Int41Dispatch)
( l: m @" ]- ?! o call Kernel32!ORD_001 ; VxdCall
* T/ U* @3 w6 B' c cmp ax, 0f386h ; magic number returned by system debuggers `$ U, u2 {8 U ? W- a; z
jz SoftICE_detected- d% f6 e/ B' Y7 R: |( E/ X2 ?+ l
/ w1 ~' F+ e4 p* k1 M: _
Here again, several ways to detect it:
2 M: u+ j# g7 ^2 S9 }" i4 X, f1 I* I6 u
BPINT 41 if ax==4f
; R/ X! I; u- v8 y: x4 X8 K9 U5 {& S: [0 @5 C* }* Q& l
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
# }4 p+ g6 B( O
2 v2 ]" S7 S% p* A/ q3 {$ v+ c BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
& I) x+ N# s# l1 j0 V
+ k. b) Y- u G s( s3 \ BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!: B, _0 b- Y2 B; h+ e$ f0 d/ J2 J
8 y' ~( H7 H( x8 C) j3 G. I
__________________________________________________________________________
Z4 g# I# G; g# @ Q: U/ S/ H0 p4 F$ A$ N9 ^% e
Method 13
! X0 P! y5 O$ \. ^' ^=========
% Z q8 j; A5 W: Y4 N+ m3 B
- \" \2 d9 x5 \' INot a real method of detection, but a good way to know if SoftICE is% w8 M4 `5 m5 g: a! [
installed on a computer and to locate its installation directory.
# i* O0 Q: g! yIt is used by few softs which access the following registry keys (usually #2) :
9 g8 Q6 Y" O( ~7 v- Q" c) m. _2 c+ t0 j, R
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
& @1 J+ B9 I g$ m E( w! m# g\Uninstall\SoftICE
' H1 K. n( H0 s$ o% @ B6 Z, Y8 F-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
! Q c4 c) ?% B-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
. t7 h. O) l x9 l# s4 _3 `/ P8 K\App Paths\Loader32.Exe
/ m6 E. y q! a6 e) _
0 @; G$ k/ p! {; I6 W! T' a( w( m
. v6 s6 i" d6 T, r9 GNote that some nasty apps could then erase all files from SoftICE directory: |: j3 ?5 q V5 S9 t/ H
(I faced that once :-(4 h; D. {. X- ?, x; @
: ^, o# q7 U$ s# ]! D7 DUseful breakpoint to detect it:
( S+ \8 c! a; @" G6 h) f. ^& a1 \$ q; X7 V
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
/ Z- C+ h5 O' {, E$ v8 J
( p, t9 u3 y; A__________________________________________________________________________) C T/ P8 W2 j" r
' p0 \7 Y9 `# N* @2 i1 x( V; v9 j" x+ ?0 B0 \
Method 14 2 l4 K! S; z3 h. k+ d! J5 m$ x. R
=========- }& v9 g% z1 O& {! I- _. ~; Z
6 t( H5 v# S( I+ p* q6 gA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
# S1 q- f" l- sis to determines whether a debugger is running on your system (ring0 only).2 h5 @% M1 p( O3 _! U
# G+ D; o8 m- K8 ]1 V
VMMCall Test_Debug_Installed& F# w1 b! w8 m. @& D+ ?& L! R
je not_installed
3 T" u! Y8 K& V: L% l# W* t' V9 w3 g8 f' ^% m* X- i
This service just checks a flag.) F. D) v; M3 y! C" u, n- K: j
</PRE></TD></TR></TBODY></TABLE> |