<TABLE width=500>
5 A; |) b0 H0 w/ c<TBODY>3 h. W, u$ Q* ? c5 ?* R
<TR>
, E2 a$ j% M6 D) L<TD><PRE>Method 01 2 u+ r8 s4 j! i5 s
=========& }! W6 x d( y2 y5 n! ?3 t
2 P9 b+ R1 k/ ]. JThis method of detection of SoftICE (as well as the following one) is3 q3 {$ ?9 j3 W1 t2 O" `
used by the majority of packers/encryptors found on Internet.
" L; L; _) u( hIt seeks the signature of BoundsChecker in SoftICE& Z5 f& l) H0 S% v0 H
/ \" p8 K) r% K$ t J
mov ebp, 04243484Bh ; 'BCHK'! e- _8 t* A( A; F3 D& q$ _1 T/ }
mov ax, 04h
- w5 K0 J0 A/ l3 }) G6 | int 3
4 Z0 x" E% o( z6 V. B cmp al,4+ l/ u& J$ _, Z2 W1 l
jnz SoftICE_Detected- c/ c: r! z, l) J
: r. P9 b: ?2 }, y___________________________________________________________________________
/ i: E7 o# m- r8 L$ @0 ?' [: w( \! [( o: g& S
Method 02$ ]* b9 ~+ u' g) f' [3 ]
=========. W) T/ M K0 |) ]
2 Q& X% K, I, s2 F) k, n
Still a method very much used (perhaps the most frequent one). It is used, h% I5 Y$ C, _1 d: ?* T& ?
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,: M- q) W% F; R: p/ m$ b
or execute SoftICE commands...
1 q# l! t! b* X* U1 [It is also used to crash SoftICE and to force it to execute any commands
; V V1 I, n0 S6 ?: z(HBOOT...) :-((
X1 B2 P7 k& _5 o- A5 O( U& U4 q/ F8 C5 b5 S" |6 |
Here is a quick description:& ?3 j+ R7 S e' i' S# ]7 B2 U( q$ ~, s0 h
-AX = 0910h (Display string in SIce windows). a. m4 h; p" u' C3 J/ y
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)4 r0 s5 o; r( e* f' I
-AX = 0912h (Get breakpoint infos)
" X6 u4 S) A& \0 h- m! {* I- a0 Z& [-AX = 0913h (Set Sice breakpoints)3 U* s9 W0 L7 D; `
-AX = 0914h (Remove SIce breakoints)
2 F: V) x o0 @& p7 [" W
" M) ?: ]. q1 S8 Y7 \- DEach time you'll meet this trick, you'll see:
7 z; [" \, d7 K-SI = 4647h: X) C5 O. T! l$ L. O5 P
-DI = 4A4Dh
& M7 r) w% X( |! CWhich are the 'magic values' used by SoftIce.
+ \& y, B9 m; n8 n! ]3 C1 Z0 EFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
+ C' T5 ~+ A: z& o$ L) T$ @9 x0 p* R1 Q9 @* `6 U
Here is one example from the file "Haspinst.exe" which is the dongle HASP
x* i! {6 i( d2 ]2 mEnvelope utility use to protect DOS applications:6 ~3 h/ i" w6 R* y: z5 `, T% |3 O
, f! o% i6 m2 F" G) Q( P
: U- N/ {1 M3 N" N
4C19:0095 MOV AX,0911 ; execute command.
4 ?* i* X; V% N4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).1 k$ i; m, V* d
4C19:009A MOV SI,4647 ; 1st magic value.6 M: v, ^- Y9 v0 i1 F, W" u. n
4C19:009D MOV DI,4A4D ; 2nd magic value.4 Q, x m3 C( Q
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
2 Q5 Z s o6 X8 [+ P; S8 _4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
+ O N& B1 H) K4C19:00A4 INC CX
$ |3 k* d7 Y. G' Z- E- ~4C19:00A5 CMP CX,06 ; Repeat 6 times to execute5 }' Q$ Y! }4 {2 w' P
4C19:00A8 JB 0095 ; 6 different commands.
6 m1 O& E5 _( ]5 F4C19:00AA JMP 0002 ; Bad_Guy jmp back.& Y% O1 G0 D: p9 l$ Y! y
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
- i+ m! L3 d1 V; @$ E7 _+ x2 B
! z: W% o' E" x$ Q8 YThe program will execute 6 different SIce commands located at ds:dx, which
( g7 ^9 W# o- x1 iare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
' d b$ l% k+ F: a! Q/ c/ P
3 ~- x# z8 ^3 z# r0 K* L3 z* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
7 T. p$ \0 n" \. }0 O___________________________________________________________________________
6 a- r& I g/ X7 h- R* o9 a. ?3 q3 n, a5 w A6 J4 l
' j! _7 y# X+ b7 c' K" y. P4 u( m! A! nMethod 03& C$ o6 \( }# M8 `
=========
1 A) Q+ e# O/ E* n: o; d; r/ O# g: S$ c' K: v$ K4 n( U
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
z- G' w. C5 c3 A# x( V" u2 ](API Get entry point)' t; }9 C' ^. F- K7 ?+ s
% R- V( m8 }9 E5 {5 z- ?5 I
) g: }7 H% I- w- T/ B/ b
xor di,di
' y! M$ I7 [! ^$ L5 u% n7 j/ d( c mov es,di
: u$ @' T' z) H mov ax, 1684h 0 t7 j/ ]: r2 n+ [+ o4 p
mov bx, 0202h ; VxD ID of winice
7 V3 l) i. D4 p int 2Fh
3 ?: B# }" }4 ^+ t mov ax, es ; ES:DI -> VxD API entry point- O1 T" \% d8 ?5 R; H' \( R
add ax, di
5 y! a. ?! m' }( B2 F) d P test ax,ax
7 I; m% [/ M$ \2 q9 _ jnz SoftICE_Detected
) J! o9 k# e! q9 M' D: p
' E: K/ t# _- Y___________________________________________________________________________, d. O# a0 G" w3 k
" z+ L( D d0 F6 @8 ?' A) ?Method 04- ~2 D# _ L3 W4 ~, J4 ]# C- [
=========
3 D, g& M8 g3 K2 A! y7 e* U9 b% Y% X& a+ q4 o$ i
Method identical to the preceding one except that it seeks the ID of SoftICE
; `" U) T7 }4 {7 n9 v6 \GFX VxD.
0 ~4 ?4 i) q/ T# h+ @0 S: x6 T$ G9 `
# k9 U9 ` s6 K# |: G- y; O xor di,di
/ Y4 w3 z4 Q9 ? mov es,di) d+ u4 @8 ?8 B- }7 c1 O3 d# \
mov ax, 1684h W3 R0 f7 p J- P4 F
mov bx, 7a5Fh ; VxD ID of SIWVID
2 e6 q; V8 M3 W, E, r7 X* S# b int 2fh
4 o, W9 q' K, T4 r3 p8 t mov ax, es ; ES:DI -> VxD API entry point% ]) ~4 G3 N' [: u0 s2 j
add ax, di3 o- f6 Y) y( s2 U$ N# L
test ax,ax8 ^+ }: \) K3 u6 L+ _: S2 f% j6 ]
jnz SoftICE_Detected B1 a9 b" J* A4 }8 f
( w8 O- q8 F3 y* G9 z0 ~__________________________________________________________________________2 l2 z! r; v% Z2 V
, m0 M4 @& S/ W C$ F; v' c( s9 y+ |
Method 05
; S9 x- ^6 Q" Q1 p# J! V=========
/ f4 ]: A, m3 T7 O9 N
: H9 L/ a! n3 R/ {9 \& I* bMethod seeking the 'magic number' 0F386h returned (in ax) by all system, k$ v) X1 f$ u. h& ?% S1 E
debugger. It calls the int 41h, function 4Fh.5 a0 Q! R2 m6 m8 B n0 v
There are several alternatives. : _+ u2 v2 D b. O& Z% d0 `: B' K
, ^" Q1 l6 `# _- R, W# ]8 ?4 BThe following one is the simplest:/ E/ g0 V7 V" r5 L: r f2 s/ C
$ p0 G4 e# \0 \1 }+ @0 L9 z p: P mov ax,4fh; ?. v- v1 z; t0 X) J
int 41h, @2 |- ?. Z( \7 ?/ u
cmp ax, 0F386
0 I1 U/ y! h/ K jz SoftICE_detected
. V- F6 B B1 w7 f$ m: ]; ?' V( o2 a# m
) i- R+ j8 O. f* A6 h4 C9 h- Z8 E
Next method as well as the following one are 2 examples from Stone's
1 n" N$ v5 K: S5 R! [8 m% e( G"stn-wid.zip" (www.cracking.net):+ K9 Y+ v3 n! {# _2 ~
a6 Z3 v% r6 G I% ?3 Y/ H mov bx, cs
2 s1 g2 R* Z3 z3 s9 d U) O lea dx, int41handler2
% O( {$ V9 e( R: c' v" r& J xchg dx, es:[41h*4]
9 @4 r& B: ~8 k2 i( M* P; i4 j xchg bx, es:[41h*4+2]9 A* r! Q8 h) b) B z' X' `- h6 l
mov ax,4fh9 E7 n8 i& _/ V# Y( o+ Z
int 41h4 [; c* v6 V- X J" H$ m
xchg dx, es:[41h*4]9 O9 ^) x' B# f( N
xchg bx, es:[41h*4+2]
/ ?1 |# R# h' b% |* [5 I5 L cmp ax, 0f386h
' z" I& }( H- k7 J, c& g5 ] jz SoftICE_detected
4 L; J! P! V4 P; A1 |& i
5 e" v$ H- D! [+ D7 l2 Yint41handler2 PROC
: V9 _6 g; g) R" W( Y3 j iret7 f' b5 a; T0 F q- Z y1 I
int41handler2 ENDP6 I" C" f; U* ^! a
0 R1 [9 h* O2 G( H2 a" ?4 u/ h, Y5 }" _# z: y& L9 d( l- e T! G
_________________________________________________________________________
( d5 a& ~7 D7 h- p I
T5 R, K3 I, } Q' j4 i2 ^9 }! s& X
Method 065 P0 I& j g2 n5 g2 @$ q
=========. b, `( C, ?+ l0 V2 @. b* {" X
! H4 {$ E. i6 f, E/ M
5 W' ]- `8 m5 b- q5 `& T. r6 [
2nd method similar to the preceding one but more difficult to detect:$ u* s/ i, w. W, {
3 u8 n) O2 {+ {& j% o; v' D* r5 E1 g6 k5 ], m3 t
int41handler PROC
" H0 A9 y/ \5 ^. {- L mov cl,al8 M1 r! M+ u' W G9 ?! s3 Q
iret3 `6 G# x3 z5 M2 S- A$ b
int41handler ENDP
; `; V+ V( c& ~
. C' e1 g4 j( z0 a* C: p4 [% \( M( s$ ^# n/ X
xor ax,ax* w* L/ b$ L( s) z2 ~ n s' y1 f3 p. ^
mov es,ax
! c$ J. z7 p- }8 ^* r mov bx, cs
. r. n/ R3 n( Z# w. G% q" i G lea dx, int41handler m; u8 R. A: g2 {) f/ g# Q
xchg dx, es:[41h*4]( [) G" O( x2 F1 k/ u1 M
xchg bx, es:[41h*4+2]
/ O; L) P8 i' C5 @, V, P* ` in al, 40h
/ D! u) P2 ^: K8 o, a xor cx,cx
: s7 R: p2 C5 J4 L int 41h3 P3 Q/ a# w1 ]$ u2 s; q4 h' D
xchg dx, es:[41h*4]
: R7 Q- z/ |- l5 } xchg bx, es:[41h*4+2]
7 v) V' a4 ?4 n& \ cmp cl,al
$ d5 e$ Z0 T7 p8 M jnz SoftICE_detected8 y/ W& S- z% G) y3 `0 G
+ q0 u! h8 R% w
_________________________________________________________________________8 g) T) R0 p* A. s
S9 `- Y) f! I' a1 V9 _( P0 ^; O3 a
Method 07
' y/ f+ } f5 [: E4 B=========- \, T, M9 x( ]7 p1 O
6 s" ?7 t; V, W# D6 ?Method of detection of the WinICE handler in the int68h (V86)
8 m+ c P9 v. |% w# H' @- X3 N0 i+ o% w& Y' E
mov ah,43h
; M" g& x4 _3 L4 e" Y- ]8 Y int 68h2 J' f$ d3 A$ T
cmp ax,0F386h* l: i& t: P% l5 Y1 f& U
jz SoftICE_Detected
# I* w7 [& A) @# q1 f0 C7 @9 D, U5 N% g! Z! W2 z3 E y
2 [' L0 q3 l! u$ G" }# x* D=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit8 T7 \; P# h. E
app like this:
4 P/ `: ~$ J" L2 T: c
: j) R9 y3 K7 _ k2 C" |: k0 o5 g BPX exec_int if ax==68
2 X2 P b. N! p: J6 z1 O; X (function called is located at byte ptr [ebp+1Dh] and client eip is
/ r( i( l0 ^ m located at [ebp+48h] for 32Bit apps)
3 l+ U D: D3 e' p: ]% Q__________________________________________________________________________- v2 V; A7 v8 X5 ?, }+ ]" J& p" N5 K
! ]/ n5 m9 w) L7 N9 @
$ |/ _6 ] J4 z* o9 k4 U- JMethod 08
3 R9 |% W# S3 u( _* H=========( G; v, T: ~. ^, p+ G
# L5 N% _. T$ s# n; n% cIt is not a method of detection of SoftICE but a possibility to crash the; j( i ]% U! d6 E- Y0 H( U6 C
system by intercepting int 01h and int 03h and redirecting them to another' L& H$ ]. u# D8 P9 m9 h
routine.
) M* L8 s% [/ ~3 v& O5 y9 SIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points" @ T. Z$ N6 v O
to the new routine to execute (hangs computer...), X" @8 [! n. H" X2 G& P
! R( \" ~3 o% s% \& N$ \
mov ah, 25h) v: ]. k7 _+ Q# w
mov al, Int_Number (01h or 03h)# F+ |6 \) Q/ [6 g- W4 G) @. @
mov dx, offset New_Int_Routine+ l; F( D, [/ Q: K4 K( |- B* D
int 21h9 ~# @8 N, e2 F0 T7 w' b
' S3 g8 |6 f$ F" c" w' v
__________________________________________________________________________
- I; e# o6 G1 Y2 ~0 W) e; y
1 N3 L$ T4 w9 G" @" a) C1 TMethod 09$ y: j. J c" Y1 u8 Q% M
=========
( P ?8 c+ K4 \6 V! ^# \9 \' E- C; `& K1 o9 {
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only( J! h* d# s/ y( h$ S
performed in ring0 (VxD or a ring3 app using the VxdCall).
, m1 m1 @. O; i. V/ YThe Get_DDB service is used to determine whether or not a VxD is installed
4 C: `" s' }4 W6 ?1 I1 A- \ pfor the specified device and returns a Device Description Block (in ecx) for9 l# Q ~% i) k
that device if it is installed.
! ?6 g# @7 |( @9 n+ e$ N2 ~, D& ` ]) n2 g( K2 n% F1 l M2 p
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID, k1 j& C7 W6 G* M- s, {6 u
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)' X# ^- n3 G* |0 }* S2 Q
VMMCall Get_DDB
. l' D1 S& G* ~3 S# b& u) M mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
& G. A; e: h7 A7 ^0 j J3 N5 o* e ]* L- \) `, ?$ m* I7 |6 g
Note as well that you can easily detect this method with SoftICE:
, n9 d1 f! A' U( X" J" ~& t bpx Get_DDB if ax==0202 || ax==7a5fh
$ I; b M: B- V, z* z% ^6 S1 U
4 V& I* D2 E+ O- ^7 V( E: W: z4 G2 |# {" K__________________________________________________________________________
" R7 F, b+ C2 N
% u4 T, A; {+ S" ~ w$ l) PMethod 10
* Z x$ m5 U6 C% P% _; x( L' I' m=========
3 r5 _& I) O K- ~: d0 }3 ]2 c( [ J
=>Disable or clear breakpoints before using this feature. DO NOT trace with' x) X8 k6 w0 N5 H( a7 \0 p; G& S
SoftICE while the option is enable!!
% _6 x6 u+ d1 N
% w0 ]* _# Q2 V( }! a# z: I( yThis trick is very efficient: X8 F3 z. m- B* E4 Q$ G
by checking the Debug Registers, you can detect if SoftICE is loaded
( o) C0 ^, b4 `) ^% a# V2 c5 r(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
' \% J3 _2 Q2 j& v# O! t. Q/ wthere are some memory breakpoints set (dr0 to dr3) simply by reading their x6 K( W0 V. r& l7 O' Y5 O4 `
value (in ring0 only). Values can be manipulated and or changed as well
5 y/ M/ R3 a6 Z& Y# y" C( O, J(clearing BPMs for instance)
5 i4 m" `3 ^2 ]3 w
c( k5 W: Z" {; ^' u3 l, R__________________________________________________________________________, l' d. e" f- f# ~
' [# q: `# A& f! U4 L* l7 vMethod 11
# l- C; V G2 z=========' A8 M+ D9 N+ a- T9 G
2 r8 m B: R6 W& h6 F2 M0 N0 X) n( O
This method is most known as 'MeltICE' because it has been freely distributed) @/ Y) K5 D, ?3 r& M1 h M
via www.winfiles.com. However it was first used by NuMega people to allow
$ V5 F5 M6 M- n' F- O/ DSymbol Loader to check if SoftICE was active or not (the code is located; H8 C i- F6 J% }
inside nmtrans.dll).
) w3 T5 A6 s( c* E
; l; B4 y; J( {( BThe way it works is very simple:
) n% J+ y- b E+ d& WIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for" g& \* K. S1 u% O
WinNT) with the CreateFileA API.
3 l4 }9 y. h( j, w
k$ k( b: b: m6 cHere is a sample (checking for 'SICE'):
, J# j' t# l- k& w' ~$ K
+ h# C; ?# j- qBOOL IsSoftIce95Loaded()' q' P: A* r0 r$ q
{
- y- t0 W c8 |3 U0 k- \* s( { HANDLE hFile; : n d3 H% R# m
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,2 x& R# W0 [% g0 j6 W) w; _& r
FILE_SHARE_READ | FILE_SHARE_WRITE,$ w8 R5 J! J6 u4 |1 d1 k7 I
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
* ]( \2 o; N! v/ S7 O9 B if( hFile != INVALID_HANDLE_VALUE )
) z# P3 V7 p, _) _" y! D {
8 x- }5 _8 l8 |7 N; E# P5 T CloseHandle(hFile);
3 O: i, X" D R4 Z return TRUE;. ?" O- h6 Q$ R
}
2 {" A l0 T: K8 U6 ?& o return FALSE;
4 P7 p j; b& s o8 ^}
2 `# g4 j3 \* q2 O6 w; h
" B( H1 l+ x: d& o4 ]2 ]$ S3 T1 eAlthough this trick calls the CreateFileA function, don't even expect to be
0 N* s! }% V1 ?! \, A* Yable to intercept it by installing a IFS hook: it will not work, no way!
/ t6 E- ~- _+ X% n! S8 w% {2 XIn fact, after the call to CreateFileA it will get through VWIN32 0x001F- e$ I6 i4 P( A: X5 Q! w
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
' |4 y0 X% |1 Rand then browse the DDB list until it find the VxD and its DDB_Control_Proc% |4 \+ M- |; _
field.0 M- [6 A* p( f3 V2 g& `9 o
In fact, its purpose is not to load/unload VxDs but only to send a
0 F0 p4 X$ c. N" kW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
% g: C# E( f1 y% R. ~3 sto the VxD Control_Dispatch proc (how the hell a shareware soft could try
( U% O b7 v, ?$ A+ [% jto load/unload a non-dynamically loadable driver such as SoftICE ;-).
+ |* ~6 h! {0 b3 H! _If the VxD is loaded, it will always clear eax and the Carry flag to allow$ n) l) p* ?& n( H* C0 @
its handle to be opened and then, will be detected.
7 a' f* G3 l/ d# m' s+ GYou can check that simply by hooking Winice.exe control proc entry point7 x$ v2 t- i- x4 l" u
while running MeltICE.
& ~6 R) ~2 X! M1 J7 T9 Z( {4 u$ {) J$ W! ]3 J! c
( k( Z# ?( H, k# |8 I. |
00401067: push 00402025 ; \\.\SICE ^% @5 g3 S* u) G
0040106C: call CreateFileA* X" b' W: ]! U
00401071: cmp eax,-001
$ V1 b; Y! {. C! F: ` 00401074: je 00401091
# I/ U) W4 n- p8 \$ \$ T) e: Q# t9 Y9 u5 ~/ y
' G! B! \! x w: \$ b" A8 NThere could be hundreds of BPX you could use to detect this trick.
$ w* ^" H3 B; j0 ]1 w# x% b$ `-The most classical one is:& o9 [( j3 x; Z' [9 o
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
5 R! W m% W% O& G. ? *(esp->4+4)=='NTIC'
4 T) z8 |+ U7 S3 b6 B' T, E2 T! z2 P6 ^
-The most exotic ones (could be very slooooow :-(
5 ~1 V1 n/ l. Y8 w BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
* K/ ~* h- s7 T/ U, V ;will break 3 times :-(
, E. G9 i0 s* x% c( v, ^4 z( {* N; s) T+ A; b( w+ B
-or (a bit) faster: ( @$ i, K" u% x; H8 M- h( ~
BPINT 30 if (*edi=='SICE' || *edi=='SIWV'): {7 |* q( j1 f! i# e
4 X8 d/ a2 I' F
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
& k/ L/ q# W( F ^6 U ;will break 3 times :-(. Z' Y* C8 j, }( m7 \8 M
" C& |7 U" U, m
-Much faster:
, A4 h& F) U! g' v) Z BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV' Z) v* R1 P1 t) c( C5 z3 z5 h' a4 _' n
0 v$ T* o1 I# c2 K! ^$ w4 o; aNote also that some programs (like AZPR3.00) use de old 16-bit _lopen2 u$ b; O. ]& q7 q
function to do the same job:, \- y; n- O( T
0 }8 \3 P: o+ L; I* F* @2 N
push 00 ; OF_READ5 J- U! }6 ^: C: h
mov eax,[00656634] ; '\\.\SICE',0
4 x. Z5 L3 S. d push eax
8 D3 V+ b" b) M- z0 z( D6 Y call KERNEL32!_lopen6 ~, I) M$ x& q4 \
inc eax
& ^1 v! X h# r/ e# V5 B; I5 J& E jnz 00650589 ; detected
% i C* R3 B" H7 Z2 e- ^ push 00 ; OF_READ
' o/ H2 ]' V# A# d' r" O mov eax,[00656638] ; '\\.\SICE'
% u7 |- W! @ a) Q. S7 O push eax
' q( _& C& g) ~0 B; S call KERNEL32!_lopen
5 O; m8 @4 N$ ~' t2 T. y inc eax! q% c' `& y |& ^ \% D
jz 006505ae ; not detected5 Y; y! E7 n2 b# P+ O" J
1 o) K, e# D+ R" M# e: g1 r
9 e5 e6 V1 d! m__________________________________________________________________________
6 I/ Y. o. }( v0 l
/ W0 F6 O) [- XMethod 121 g8 x6 f3 d- j$ I
=========
0 s3 O, \7 ~6 F% L& q: w0 Q+ c& x" v
This trick is similar to int41h/4fh Debugger installation check (code 055 ~) v& ^' a* t" R8 w; _
& 06) but very limited because it's only available for Win95/98 (not NT)% Y+ M9 C% G/ n1 z8 m4 s
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.8 A4 Z4 Q1 n8 @+ Q$ a" w4 L" }2 K0 S
) S; A0 j3 l2 }/ ?4 c, R( j! D' E5 Z push 0000004fh ; function 4fh
/ [% t4 n2 `: J( x push 002a002ah ; high word specifies which VxD (VWIN32)
0 z% J1 J+ B* ]( q ; low word specifies which service3 D t% L: O9 t# J2 K8 M# o
(VWIN32_Int41Dispatch)# l; z% w$ D4 a* r) `0 f
call Kernel32!ORD_001 ; VxdCall
2 n7 n# ^( |. m4 d+ t& d cmp ax, 0f386h ; magic number returned by system debuggers
; c) `; g8 H" \# ]0 S jz SoftICE_detected
7 |' x/ f+ d4 B$ F J: a9 b$ T3 G" K A# _. M! V- e) M, G
Here again, several ways to detect it:/ P8 C8 j4 N1 X0 `
8 V! |5 A- P+ R. ?# W% Y
BPINT 41 if ax==4f8 ~! [- @$ O) r6 R
" h; A; r0 Y: C2 e7 u
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one0 q0 }$ }' e# e' j. n% F
; W" v* O. Y6 ~) y BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A. f) Q5 d2 B3 R0 z ]" ?
: j8 [! A, X1 f1 w BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!( x. p* U( g' R8 r+ r5 b' ~
) B# C, ]) \8 x% |8 L5 f5 ]/ f__________________________________________________________________________6 i( `$ e' B4 {' Y3 B) p# d
; o+ L$ Q- j! T' g# `Method 13
6 f! ?; M! g- [. X" v=========+ W0 W |5 D* y7 D
4 `" u" m3 Z8 i) V
Not a real method of detection, but a good way to know if SoftICE is; l% J+ E z f- o. [, I
installed on a computer and to locate its installation directory.0 P' e! h- I7 S" Q" g; r
It is used by few softs which access the following registry keys (usually #2) :, p4 A& j' o' a9 O: U9 B4 b1 y3 L
3 M S/ }" J$ M% y7 [9 x0 N-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion; i9 u) Q+ C0 ? H; O9 n
\Uninstall\SoftICE% K3 H! `" T& u' L
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
5 s9 I4 f! X! E6 y. z" L; {-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion" ?" \1 _) w3 o) U7 y9 T
\App Paths\Loader32.Exe) {3 A& C+ m- V+ N. g+ h
" h; o2 k7 N# g T" o6 _
6 p. Q8 ]* Y+ c7 N2 `! b3 @Note that some nasty apps could then erase all files from SoftICE directory! e2 M# i Y7 M* W2 ]) \( U
(I faced that once :-(# h5 j" `/ r7 O. {
) _ a* K& G- g1 H3 DUseful breakpoint to detect it:
# M' E. t: S$ i) ?( v
- L& g, L9 ?) P: g$ K! u, L BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'+ J* y1 Q+ i- q. M8 g) Z" W
' T S8 c1 a3 J7 M4 P0 A__________________________________________________________________________1 f/ B1 X2 C( V, |) s y
4 q9 Q2 c' U6 f# d1 j5 o, p) ^/ o
Method 14 8 M6 @4 q5 p+ p
=========; B; q4 u8 k9 M' E% F7 P1 U
/ K, L% ]/ |3 a! Z; QA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
/ y, e0 E0 s$ K- G4 B" Zis to determines whether a debugger is running on your system (ring0 only).; R! t8 I: q8 Z& t! o! ^. t
. K- o9 W% v7 w0 \ VMMCall Test_Debug_Installed$ R& g; e" Z) @2 |0 h4 n) _4 @
je not_installed8 f- @1 L* }8 K+ ^, N( |6 I7 v
* ]9 y; A/ X: {% [# F
This service just checks a flag.
" x' r7 s* N& e# D7 ]4 O</PRE></TD></TR></TBODY></TABLE> |