<TABLE width=500>0 O$ z; L" @) Y
<TBODY>
( q) c) F: w9 R _1 L9 h5 [" b<TR>! @& e, D+ w5 a2 Y+ x
<TD><PRE>Method 01
~8 o% }) x% t=========
2 `! }8 [# _. B. @3 r F
. O9 f9 F7 r; dThis method of detection of SoftICE (as well as the following one) is
* d& y3 o; i# q/ Qused by the majority of packers/encryptors found on Internet.$ j V8 S8 Y& x( j( Z% Y; `) d7 r
It seeks the signature of BoundsChecker in SoftICE
3 | n, K/ Q% Z+ K
9 |6 Q2 h. Y. q5 L6 r1 {3 w mov ebp, 04243484Bh ; 'BCHK'
7 @1 s8 y7 n1 C6 u8 g- [' N; j mov ax, 04h
1 _+ T% @0 Y. m: `! { int 3 7 r; f# m! q0 Y B8 j7 P
cmp al,4
& C7 k/ I6 c9 S" A+ ~3 c jnz SoftICE_Detected
; O, U! V6 f5 I, C/ A$ T, s0 V7 G
% @& c u5 I' }6 k) `___________________________________________________________________________
2 `* @2 R% }% a! c
) l }! B9 a8 y5 F) z& r9 m( sMethod 02
7 m9 y+ Z7 O, V5 d=========
3 O5 _' E- l+ D* g2 Q# `0 b$ A w+ z3 r2 ~; q+ ]
Still a method very much used (perhaps the most frequent one). It is used
' P- n% }) v, kto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
) C- P. n! }; Lor execute SoftICE commands..., X9 h% `- j8 t. E
It is also used to crash SoftICE and to force it to execute any commands& {3 W7 V; A7 G3 N& K
(HBOOT...) :-(( - V p* F8 D& ]
5 ^( H( Y2 I+ l; D/ Z+ c% V: UHere is a quick description:3 a6 j7 M6 x1 W1 K Y
-AX = 0910h (Display string in SIce windows)
, V( q4 I2 f# C! D `3 F( O( B6 R-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
; f& r* y! B Q% M/ V) N+ Q-AX = 0912h (Get breakpoint infos)
$ J; o, J1 k/ d-AX = 0913h (Set Sice breakpoints): o2 r0 }- x+ C9 L* P8 Y
-AX = 0914h (Remove SIce breakoints) r' R+ X9 m% o2 C
% m% O+ {, @9 D9 j' o; F. T3 @Each time you'll meet this trick, you'll see:% c3 t' l1 S0 o1 G% N, Z
-SI = 4647h: M# |; q. B- s- P! Q% V* P! K
-DI = 4A4Dh$ ?9 {; N: b, i
Which are the 'magic values' used by SoftIce.' y" P1 o" f3 f* A# O$ j [
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.7 V$ K" y/ P: f. Y3 M
; c) s, R! R7 w1 XHere is one example from the file "Haspinst.exe" which is the dongle HASP* y/ a/ z6 o2 Y
Envelope utility use to protect DOS applications:0 w. t) @, n& h; `- _9 c
( {) B" ~5 o1 w8 o
( d! B1 C- e+ B6 Q
4C19:0095 MOV AX,0911 ; execute command.
5 \# T( O5 s( @/ \2 c4 z' K5 y4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).) h. W) c: q* O4 ]8 E9 [+ `; Y
4C19:009A MOV SI,4647 ; 1st magic value.3 I8 C) }4 z0 p4 t+ g3 R& b
4C19:009D MOV DI,4A4D ; 2nd magic value.
& u, V" |/ t( E, s7 ^4 K6 y4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
: R/ n5 v- M/ _1 r4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute- c* v, Y, @, I3 [% p. l* q$ x
4C19:00A4 INC CX
: t1 x& L* r8 x) I# Y9 f4C19:00A5 CMP CX,06 ; Repeat 6 times to execute9 R3 s/ Q6 e, W/ r5 X
4C19:00A8 JB 0095 ; 6 different commands.
; _) M7 e8 [0 @: D5 G0 d9 \9 }4C19:00AA JMP 0002 ; Bad_Guy jmp back.) r2 k- H$ i7 q6 w& J2 l1 P& T
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
- ~$ @! H( k: V! f
9 c7 Q8 |$ K, Q+ vThe program will execute 6 different SIce commands located at ds:dx, which
3 } A" D+ J. e P' v9 vare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
1 d' H9 z, O) s9 C6 O3 g7 g7 ?/ [, Y* c$ ], H
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.4 s% r2 H+ k- @, [
___________________________________________________________________________7 Z9 w6 j( Y$ m: T
- c/ b; }) m/ p; M9 g( u* W' E6 g& k7 I' _9 C. M7 j
Method 031 v) p# d6 w0 e+ T, I
=========
9 n9 V$ e/ S% \$ b7 q. f. W }* R0 j
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h6 M- w/ r/ u0 G% J2 H3 u& O
(API Get entry point)
U7 E6 ~$ i2 |! ^& W0 @ 6 }4 \5 y$ \% {0 i1 c
0 u, A0 {, t" S* F0 n6 G; @) v `
xor di,di( ?' a% L( w, H( z1 s- U$ R! b ]3 c( ]
mov es,di
; j# V! i/ {- q# P; P/ z mov ax, 1684h - v5 X' G, Q+ G( n3 l: K3 ]3 a" S
mov bx, 0202h ; VxD ID of winice
! R, D: k' g- I3 ~; Z int 2Fh9 o9 d0 l c. x
mov ax, es ; ES:DI -> VxD API entry point
8 I8 t% c( f v9 o add ax, di
; c: G/ j7 `. \4 d5 y6 ^( \3 ` test ax,ax; f3 b. D% h3 |: ~) r) h
jnz SoftICE_Detected
( D. Q# x" v, t1 \( w0 Z
7 \2 N9 _( } t# ~+ O___________________________________________________________________________+ `' j8 X8 N( V/ L( o
, N) P4 V* ~; H; U( J- ]Method 04
, N$ O+ V' Y2 ?# J8 k=========5 n* @1 O( |& L0 s! t; o- D
; m) f4 [3 Z! d$ H" R1 JMethod identical to the preceding one except that it seeks the ID of SoftICE6 B+ n" |& h g0 r. ^
GFX VxD.
! [$ Y* e, D4 _, s5 {. A0 y$ G8 l6 P1 N$ C3 u- T* s' t
xor di,di, Q7 n* p L i3 ` ]' X
mov es,di" D; C7 f0 `# [
mov ax, 1684h ! P8 g- R% |6 Q
mov bx, 7a5Fh ; VxD ID of SIWVID6 E/ |3 x2 R; k! ?; E# z9 T( n7 ^
int 2fh
& [) e. E0 y% [1 v& t2 f mov ax, es ; ES:DI -> VxD API entry point! ~0 ~( y) A; K& y
add ax, di
2 w: x; c. O$ @! D, w5 o test ax,ax; }$ i ~: }! R- t
jnz SoftICE_Detected
/ J# F- Z9 F4 } v$ Q7 {: u0 V! t# l' y N5 [4 Z
__________________________________________________________________________* G+ I+ t, k+ J- s0 M. G, k
7 u) Y' n' u& Y$ _% j0 {
& N: e1 S$ ?$ f% HMethod 05
4 I- m/ Q, ^2 }& Q=========
4 N$ a0 |# v' `3 F ]
/ ]% V# ~7 ^4 C5 L% E" G1 W, i6 hMethod seeking the 'magic number' 0F386h returned (in ax) by all system5 d( ^" A! B1 ~
debugger. It calls the int 41h, function 4Fh.5 F l) L7 O: ^
There are several alternatives.
) X5 @0 q0 {/ O# c/ B# P2 k4 }" _- h7 v, |( \* [
The following one is the simplest:
; B9 A5 \. R, e" x) l0 D" g
1 w/ y1 _: T7 Q4 k mov ax,4fh0 c* R6 s9 d7 S) D3 E
int 41h6 l9 }$ B \% k
cmp ax, 0F386
; T: c: g. I4 l# I. D* f jz SoftICE_detected7 L, c( y; ^6 d5 a. Q/ j
& E: e2 e* r3 c: K8 S
3 F6 P1 u+ c8 f& M
Next method as well as the following one are 2 examples from Stone's
- w+ f5 _4 ?6 O9 n, e"stn-wid.zip" (www.cracking.net):
! m$ z( H$ p6 F. P' r+ B W- Q' r/ i ]. i3 Z. Z
mov bx, cs; `- h0 r: |( `% M( I* P
lea dx, int41handler20 Z" P D6 l: O
xchg dx, es:[41h*4], d6 v2 A3 ]* _6 `2 `
xchg bx, es:[41h*4+2]' a' m! V6 ^1 R: Q/ E$ E! P
mov ax,4fh- h/ [) a8 S' G% d, ~
int 41h
, E2 D5 C/ }4 U' X xchg dx, es:[41h*4]
) p0 d1 J4 R+ u$ q xchg bx, es:[41h*4+2]
% c! D3 Q) P8 [$ F. r cmp ax, 0f386h' k( ~& Y$ |7 u, v: k
jz SoftICE_detected n9 d. E& A& x1 m2 P
, Z' I6 y$ {# O: Hint41handler2 PROC, m/ u0 D# d" G5 Z9 }# X
iret) U5 o8 u/ {) ?
int41handler2 ENDP, p$ G2 C8 c9 Q$ I) W% m
+ L0 _' G& p2 Y4 H8 H. J+ I2 r4 U( _" J1 p* z
_________________________________________________________________________: w9 ?2 S1 x& @2 ?3 y, `
; P+ N+ N, a! Q+ J N5 O( w$ Z) H7 z$ G' M$ S/ ]+ h, n
Method 06
+ w5 G" {# D8 [% o- R% i=========1 A0 L" p, C9 i
9 V4 h/ g8 o$ v4 t6 f# Z
1 p: s" y+ E! J# q! }4 ]$ @2nd method similar to the preceding one but more difficult to detect:
; c% P4 U+ `4 N$ B8 P) A
" E9 t1 z9 y Z0 l& v; x" W2 a9 q% @& P. |) L. f. S: j8 h& S& V) S+ l
int41handler PROC8 D: K4 c" Z6 B; g% o, X9 k
mov cl,al
1 d2 I: I* n! z/ ]0 Y+ _ iret
, z0 `; Q6 I8 H: @* e* O) Dint41handler ENDP4 } W" Z, g1 O" u
+ r0 B, m$ Y' h* T6 f4 K. e8 h
; H9 C5 Y+ v5 L xor ax,ax
: F, B7 h+ G. ^, K4 ?( B mov es,ax; B2 A+ b1 e% E% I8 `
mov bx, cs
1 [2 c$ w3 `4 P3 [ lea dx, int41handler0 y7 a0 h' d2 w' `6 y
xchg dx, es:[41h*4]
# d& A; [, i9 b3 b# ^7 \6 L xchg bx, es:[41h*4+2]
+ L" s/ [/ k1 q. M in al, 40h# s1 w7 f) j" f
xor cx,cx
4 M, r6 J1 m" ^. P1 A" x, t2 ] int 41h3 u3 }; T5 i+ p0 C: q
xchg dx, es:[41h*4]- @4 l- d" z% w
xchg bx, es:[41h*4+2]
2 V7 D& q0 M; w! [: u cmp cl,al5 z4 z n* J8 g9 i" x* P8 _" n
jnz SoftICE_detected8 ^6 d6 N2 q1 [6 I: N( V/ |$ @
/ v/ a q; q2 G2 y$ O_________________________________________________________________________) w8 y9 B7 i9 q7 P
$ g0 h1 k( g& [4 y6 y2 {Method 07
) W1 N* f( @/ V=========
[' b/ P0 H4 ]" P: y: C3 N
& x" c/ D* \: ]: r/ t: [0 q( ?Method of detection of the WinICE handler in the int68h (V86)/ M: {" t3 u/ R
* o8 S* _$ z0 {$ d' M6 t mov ah,43h( E- d o! Y1 l/ Y5 h
int 68h
9 z* N9 z. V9 q0 D: p cmp ax,0F386h9 u( d+ C9 K! J
jz SoftICE_Detected5 Z! q3 [( n* f) z+ G# u/ p p
/ U$ \3 H! s& h6 K+ U$ I5 _2 u0 b$ Q) k* d9 m0 f) Y
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
* Q1 v% |6 Q. i3 z4 k app like this:0 N4 N1 S6 E9 O i1 ^
9 n5 |: G) D; }9 Y' v& {
BPX exec_int if ax==68
' J' Y( C1 I$ L* C( @* |9 z0 c (function called is located at byte ptr [ebp+1Dh] and client eip is
4 `3 s0 ]9 ?# I- z# F% p located at [ebp+48h] for 32Bit apps)
# o5 w( \$ t7 l; Z! l__________________________________________________________________________
! b: N5 h W$ t4 X8 @: s, e% n( K8 x8 z6 q9 `) _# |( K
# l0 u; V9 X$ J- J7 y. FMethod 08
* Q/ o5 q5 B+ l% W, z7 y( i=========5 O6 z9 k+ S h+ y/ Z, W
0 o! S( `7 F: q& Z- `. jIt is not a method of detection of SoftICE but a possibility to crash the6 G/ I* z) L& e1 `" n
system by intercepting int 01h and int 03h and redirecting them to another
9 m# i7 {& S8 b. a Y) i: J% iroutine.& i& _& j5 g! Q3 f$ s
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points1 y/ i6 a" |$ h/ ?8 M/ S4 t
to the new routine to execute (hangs computer...)3 O- s" U( X- M* v! D. A. r: l
7 v3 x9 _5 T5 c" n. {0 z; h mov ah, 25h
4 L4 } [. @; ?5 N0 v0 u mov al, Int_Number (01h or 03h)
4 ^$ J5 V7 u$ x4 T! n mov dx, offset New_Int_Routine6 v4 l. s9 p, z0 {& f! h( q E; w
int 21h7 _0 G9 N: Z) Y
5 N4 W' e) h5 H1 b4 Y1 o, l
__________________________________________________________________________, {3 Q$ I& K. [( N% ^0 Q$ a
7 }5 O+ C X5 S3 P vMethod 09! l; g! n- V' E- u# m: S. E& x% N
=========
, @, c5 m V% B2 f$ x. {: ]7 `+ D+ ]/ `( @7 A3 b& M* g
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only) F9 q: l$ p1 V! Y
performed in ring0 (VxD or a ring3 app using the VxdCall).. `2 M( _, I4 p5 w$ m
The Get_DDB service is used to determine whether or not a VxD is installed1 d8 H/ p: B, n3 I7 g: q# n+ u
for the specified device and returns a Device Description Block (in ecx) for$ a3 F6 p: Z* T7 `
that device if it is installed., U; k# P0 h ~0 M% V
+ w) w% R6 @- ]( r( f2 O
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID/ k- J+ r( o# f5 x, q% H
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
3 r5 [5 ~- T$ m8 N+ } VMMCall Get_DDB9 g K& [- a- `0 ^! k. L
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
" M' D& p( c) e7 W. A$ e2 s# z- f# Z6 j# ?, N. \3 \- f1 r1 O& c, @
Note as well that you can easily detect this method with SoftICE: G2 ]+ {# E( M; A0 G1 W3 O7 [
bpx Get_DDB if ax==0202 || ax==7a5fh
: G H/ e, n3 j r$ g6 |# h1 W$ E9 b0 X9 d1 a5 |
__________________________________________________________________________
5 S4 [* |) d' ?# T5 j+ T
( I, m6 W+ `) G7 SMethod 10% U7 D% I. [: ]/ I/ v! d. v
=========9 j- @+ L% T" [( ]( W$ ]
7 `; s: D9 a) g
=>Disable or clear breakpoints before using this feature. DO NOT trace with
' ], ~7 b% g! F* ? SoftICE while the option is enable!!) v) w3 r% y( G# p% d
Z% m3 O0 g; ~0 jThis trick is very efficient:8 D: t0 y1 n( v7 z' f+ l* g
by checking the Debug Registers, you can detect if SoftICE is loaded
- Q! y$ I* c5 {9 u& o(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
( X3 f1 ] C! s# y. ]there are some memory breakpoints set (dr0 to dr3) simply by reading their0 p E9 ?0 i) R
value (in ring0 only). Values can be manipulated and or changed as well
( F0 @8 b# u& a(clearing BPMs for instance)
$ U5 Z) t! n7 Y# O6 u" \8 h/ m' w9 ~+ f4 w; J# T
__________________________________________________________________________$ |, K& t4 ?: b$ V% e1 {2 N8 ]
" H p/ e" G/ T- V5 y! X" ~$ g
Method 11# \& x: g" u$ q* c8 q3 T u a9 q
=========# A9 L# d: y+ z4 G5 e ~( [- a
# ^$ ]" ^, G+ Z- ]This method is most known as 'MeltICE' because it has been freely distributed. u2 O A" Q/ v: i% N' g v
via www.winfiles.com. However it was first used by NuMega people to allow
7 L5 D! t! O) i/ f( G! v8 ASymbol Loader to check if SoftICE was active or not (the code is located
; r- ]; L, I3 ?/ xinside nmtrans.dll).2 O8 [) m; P9 f% r+ ~9 R# ^. R. ]/ `! I
S+ h, r( B1 TThe way it works is very simple:' J0 ^4 Q: K0 M I
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
' l, ^" [' U+ P2 J9 TWinNT) with the CreateFileA API.! O! J( J: A% R# G5 p
+ H ?+ U; K) c0 f/ Z9 D
Here is a sample (checking for 'SICE'):
! C0 [) h1 k8 N/ f$ L& X6 p7 o! R; P' n2 l$ r3 X1 S" L B
BOOL IsSoftIce95Loaded()& F' P6 ^: p T; ]6 t8 m/ o
{
5 J, Y5 ?/ Y) q' Z2 v, _/ K HANDLE hFile; 1 N$ q& p0 m+ u# o. x
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,4 V8 r+ y9 j$ j6 @
FILE_SHARE_READ | FILE_SHARE_WRITE,
; Z. M7 b1 d$ K' X NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
% q. D$ E+ h0 V0 ^ if( hFile != INVALID_HANDLE_VALUE )
8 Z+ N3 W* _# f6 @+ ] {. [, b9 u& u( u& M# t. |' I- Y+ E
CloseHandle(hFile);
( B1 a B. U2 b$ B4 q0 n* u return TRUE;0 @+ ^0 {8 l5 E2 X3 L/ Y
}
0 }2 a) {9 `& z9 h6 Q/ { return FALSE;+ H/ u2 `3 j; w5 w) M
}4 I6 t! c+ ~1 V% I( O1 d H8 R
( ^; D8 e- H' F* B; x4 LAlthough this trick calls the CreateFileA function, don't even expect to be, z( V1 S! j0 U7 e
able to intercept it by installing a IFS hook: it will not work, no way!
, |) C8 X6 o. z DIn fact, after the call to CreateFileA it will get through VWIN32 0x001F4 {/ t* g- U0 O! o8 n
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)6 f$ R, [; ?' {
and then browse the DDB list until it find the VxD and its DDB_Control_Proc2 Y4 V' L1 T2 D" T( [ N7 d
field.
1 w4 k4 N" B! BIn fact, its purpose is not to load/unload VxDs but only to send a
9 O7 R( t1 g+ w2 E8 gW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
( q. v; I( f2 U4 \" m0 Zto the VxD Control_Dispatch proc (how the hell a shareware soft could try
9 G/ v" ?0 Q, q( q& z4 Yto load/unload a non-dynamically loadable driver such as SoftICE ;-).6 [5 x) q8 V2 ]1 O* T# }. U; P
If the VxD is loaded, it will always clear eax and the Carry flag to allow
. \& U0 X6 t7 uits handle to be opened and then, will be detected.
: _8 n6 y% s( L2 C% K+ nYou can check that simply by hooking Winice.exe control proc entry point
, d1 e, p5 Y3 N+ r# V+ Pwhile running MeltICE.) ]6 X) p; @' L' I+ m1 O" q0 ^
. L2 I9 @! {7 E" t- T9 D
6 g7 q! z1 e6 U7 j" `# l5 H 00401067: push 00402025 ; \\.\SICE6 _# _4 T- k+ O% g. }& F
0040106C: call CreateFileA: Q# I! y( o6 H; E3 }
00401071: cmp eax,-001& Q2 W: L$ W' L" V i+ ?
00401074: je 00401091% @. z6 I; m' q% T
. }' H' p+ x% V
* n! j( R$ b' q
There could be hundreds of BPX you could use to detect this trick.% [) H- A: T. X. M
-The most classical one is:# o" X+ S+ o# _6 d5 k8 r2 e
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||2 X: L0 G5 E0 G4 J. [6 t j
*(esp->4+4)=='NTIC'% A2 k+ i: [- R7 x( N T
" i# N- h u/ I* ? v' ] H-The most exotic ones (could be very slooooow :-(' Y M+ k0 j7 V: g9 j
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') ' \, [ t( W# G: l$ Q; U- k0 e
;will break 3 times :-(1 Q( c# }- V. k& h% {
8 u2 m& }; S5 ^% D
-or (a bit) faster: ! V* c/ h6 [! J& B' t5 J7 m
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')5 t# o- H* a- Q
6 Z. f$ k4 f* {3 u BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
" d% x4 ` m8 o7 O' }, O y8 A ;will break 3 times :-(
; x3 [6 X0 s3 \. N& e5 q$ w% H0 S- W* @+ x( l: t
-Much faster:' W7 r ^& J0 O& ~+ F
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
g/ b ~& a4 w5 k" `, h
4 E2 P" B e! \% j3 ONote also that some programs (like AZPR3.00) use de old 16-bit _lopen' S9 ^. Z# l2 l
function to do the same job:
2 C! z; Y. ^ F# S9 K' z* Z% }% ?
push 00 ; OF_READ
1 e/ E$ h, y q mov eax,[00656634] ; '\\.\SICE',0
# K+ L* e9 L, d, b' L' Q push eax
1 X/ }+ n0 P* F! c" t call KERNEL32!_lopen% v/ D; H/ Q3 k$ B7 W3 D! V7 v' _
inc eax$ q$ j+ x, Q1 P. F
jnz 00650589 ; detected
a- }5 V$ U" b push 00 ; OF_READ+ u) K+ k" d2 g
mov eax,[00656638] ; '\\.\SICE'
' U% Q+ _# R" f3 ^% ^3 ` push eax
/ L) a+ p5 T( m V$ P j. p4 f0 e call KERNEL32!_lopen# S* s# i; h3 z" w2 G+ D* h
inc eax; f, c" B n0 e3 @5 _
jz 006505ae ; not detected* _4 v9 G9 ]5 ^9 U) Q, u4 z+ E) c
: \% {, G% b6 K% |' ~* K- ]( A* c1 ^& }' J
__________________________________________________________________________9 t4 a" I" { H( D$ |: A3 }* z
5 w8 y" x& }4 `9 b }9 W0 w, y rMethod 124 |: D9 c$ ]& k3 D3 S3 j, C
=========" H: N$ h+ m8 m
: G" A2 P. O" w7 o, [% `This trick is similar to int41h/4fh Debugger installation check (code 05( t% R1 g; D! Z; U
& 06) but very limited because it's only available for Win95/98 (not NT)6 h o% g; Y) _! b
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.) H* S6 B% C l& a' l4 f
, N* s- X6 r+ r) A
push 0000004fh ; function 4fh
+ H; r% N6 K6 I* q5 q/ O" U push 002a002ah ; high word specifies which VxD (VWIN32)
% d4 }' J. | l( Z8 P; ~& R4 I ; low word specifies which service- q: |# h; p8 E9 T+ Q
(VWIN32_Int41Dispatch)% D. J4 l) P, W; B+ R
call Kernel32!ORD_001 ; VxdCall
, i& a4 T8 X3 S3 y8 ?) }5 e) X cmp ax, 0f386h ; magic number returned by system debuggers, i9 N+ l/ }: m( Z- |. l3 A
jz SoftICE_detected$ f: Z/ C2 ?. [4 d$ ?9 z* M/ p7 l
( T: r/ N8 q% }7 s* Q9 h9 H; W, mHere again, several ways to detect it:# U; L. q7 `) j
% s7 L; K' ?! k7 c4 C" Q+ ? BPINT 41 if ax==4f
U5 O3 i" ] [( ^# E
# i7 o6 l4 i" Z+ m BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
; k/ ~/ p4 J F; M5 c) c. V4 o
( l+ g1 X, ?: c1 f/ O BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A. @5 _3 e% N2 t" [
/ S' g2 J, T6 @! R BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!% f$ D( u, A: W L1 A! c) a6 P
! B) h% ?5 }! |; J8 `( y# ]9 Q
__________________________________________________________________________
7 s5 g/ Y3 t- T' U. L) p1 z- y) U( E) @+ f- c2 v6 F/ S# _$ `9 ]
Method 13
1 E( m( y9 q* ?: H3 |/ W0 M$ t; Z=========( I3 Z2 P! a5 K! u+ T9 Y
! f a* X1 i$ u" e# ^9 A0 |4 o+ z% ?7 zNot a real method of detection, but a good way to know if SoftICE is
# V; j9 c$ B! ?installed on a computer and to locate its installation directory.
' M% D/ w! a0 IIt is used by few softs which access the following registry keys (usually #2) :
2 @. v; B4 P. @5 @! m/ V
3 q9 G5 @1 U! G/ c5 W+ b. k8 Y-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion1 z$ J ]$ ^7 C+ G: Z! r
\Uninstall\SoftICE
- o: a* b( d4 t& a7 `-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
+ w5 w$ m$ @# j5 m8 F8 F1 T4 y-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion' }2 X. w! [* v
\App Paths\Loader32.Exe2 {1 b! X7 L! O
3 t- V; w e8 z7 b) e/ _0 X
: x( T0 w0 @5 Y
Note that some nasty apps could then erase all files from SoftICE directory
5 @* v- Q3 @; M3 d: Q(I faced that once :-(
( Q( a$ z, \0 D9 V3 Y
- l4 M1 z, O( k% M1 r) gUseful breakpoint to detect it:# S0 H. w: |' Z( `* b( i& e. {
" Q0 t- n T& D BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
\: d; k. }9 C2 Y+ w) R$ c( q2 K
+ R0 E* m% V; q4 W3 A3 {" }* R__________________________________________________________________________
; w; m0 l; \$ I$ l
) z6 c( Q. S; e6 l! D7 Y! M# w
Method 14 " f7 K/ Q" s( n7 `) f- P
=========
6 g Q. i4 F3 _8 h8 a5 v; z' x9 ?2 L" e) x
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose- o& v. k0 H8 M, U
is to determines whether a debugger is running on your system (ring0 only).
* s& N% T. I6 \+ p- {; j
' l: H( a" U/ ]- v: f VMMCall Test_Debug_Installed
2 t) C$ ~8 z, z- j je not_installed3 J" n& q) Y# K$ ~: U% d* h
. E$ Q) l- H. b* N8 x
This service just checks a flag.
( j& U1 u* h& r) }, @</PRE></TD></TR></TBODY></TABLE> |