<TABLE width=500>
, O3 q$ ~+ i9 H0 g- W$ j& p6 ^5 V<TBODY>
4 y* s! w w$ q/ ^/ x1 O<TR>
8 ]0 j$ W, o) Q% e<TD><PRE>Method 01 . O7 G |! N# q( x6 a8 q* ~
=========
" Y4 ]/ h2 m& ^6 c& |- w, s& ^3 s6 @ B+ Z" c e
This method of detection of SoftICE (as well as the following one) is
, V! d: R/ E t g6 n1 Uused by the majority of packers/encryptors found on Internet." h& W- ^' N) A4 {! ^$ V
It seeks the signature of BoundsChecker in SoftICE
. v+ A2 i- Y- p5 J- k0 P% c* f
3 `$ L5 [ D9 R# ~, h, Y mov ebp, 04243484Bh ; 'BCHK' Q! t6 F9 T; K K
mov ax, 04h
. o6 [ V8 u# |- j* e) E int 3
) H1 P+ i' U5 C. }* i cmp al,4- D* K" X" G3 w* k) Z* Y! P$ f
jnz SoftICE_Detected6 {* ?1 `9 R0 ^7 R
, S- [# i3 g6 ]) M, b8 O
___________________________________________________________________________- d, n; ^$ J! w% j6 K6 j$ {
e) }$ p& ^4 v/ P( p
Method 02' b2 G- ? m7 U( i$ r
=========
$ p. H2 ]5 x, M6 Q- `9 M& d
# b5 K, d8 s) r8 |Still a method very much used (perhaps the most frequent one). It is used
& K8 W `& i( w* X& E. ?6 l' nto get SoftICE 'Back Door commands' which gives infos on Breakpoints,% d/ X7 Z0 G6 ]6 [
or execute SoftICE commands...
5 U2 C) t% ?* s1 JIt is also used to crash SoftICE and to force it to execute any commands
2 T( S0 Y+ Y4 \4 p4 I, C# c(HBOOT...) :-(( W: B$ q' `& b3 g
7 q9 Q, S( L) e+ j3 R# S. CHere is a quick description:5 |5 T& ^2 n* I
-AX = 0910h (Display string in SIce windows)
& X: O: V( E" }0 I2 n* Q4 K7 C& e-AX = 0911h (Execute SIce commands -command is displayed is ds:dx), S" ~5 Q- S1 j0 ^& k+ N0 _
-AX = 0912h (Get breakpoint infos)
$ G9 w |/ k4 Z; E-AX = 0913h (Set Sice breakpoints)
7 C' [1 w: c! e( V9 V( y-AX = 0914h (Remove SIce breakoints) W, W" s3 ^; U' `7 J
4 }; _* q x' H6 v, H. C. w# K
Each time you'll meet this trick, you'll see:3 L6 r2 n* c0 Q9 l( O+ g2 z4 [/ T
-SI = 4647h
4 q0 }' V' C! O& B8 X1 Q-DI = 4A4Dh
6 V* K+ R- o+ u6 PWhich are the 'magic values' used by SoftIce.
6 }. Y; K `9 N/ Q+ {, \$ MFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
3 o0 y4 }4 L6 I
1 I2 O# W# D" x# q4 SHere is one example from the file "Haspinst.exe" which is the dongle HASP
5 C$ a1 M: q0 u( c2 z9 ^+ sEnvelope utility use to protect DOS applications:
3 ~; o7 q% X; N$ e& o' D5 x5 G$ m$ D) m
& c; A( {2 r4 ^/ c. C4C19:0095 MOV AX,0911 ; execute command.# M, A' ?4 [# x# ^6 b
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
$ a1 ], P0 h B# V' R- F" R4C19:009A MOV SI,4647 ; 1st magic value.
/ T' ^, `' r$ |* L4C19:009D MOV DI,4A4D ; 2nd magic value.
6 u& p$ l# Y. z x$ _4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)9 g. A! c# @! r; Q; w
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute% {+ i- ~; m3 ?$ L }
4C19:00A4 INC CX
7 ]" ~: F0 U2 N! {! r) |6 m2 p3 w4C19:00A5 CMP CX,06 ; Repeat 6 times to execute i3 }( F* j# @
4C19:00A8 JB 0095 ; 6 different commands.5 Q1 w1 Q Z& U- g! L
4C19:00AA JMP 0002 ; Bad_Guy jmp back.2 n S5 G& G4 _: y
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
: q, `3 v4 `# ]- U( w2 Z; ^# c% {1 @
% U# m2 ^9 A0 p# C% U2 n' zThe program will execute 6 different SIce commands located at ds:dx, which
1 k* P* J$ v1 I! l% Aare: LDT, IDT, GDT, TSS, RS, and ...HBOOT./ G: e1 f3 _' \# ~; A" u4 I
" F4 }& d# Q1 b5 `" K5 Q* R
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
1 n/ O6 ?- ?0 N, I___________________________________________________________________________1 w0 M/ n% ?! P' B2 z
4 d# r2 H; g9 ~- i* |% q4 h5 P5 r& R: i! d
Method 03
- V" x% p0 x+ v8 t8 q=========" e. G k" `. f$ L9 N4 H/ a
$ ]1 a6 l: {& u. [
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h, A! |: f# K5 h4 A5 c4 x
(API Get entry point)
7 e2 n6 b% C( G9 Q: R) f. w* ^: x4 R 0 ~. e1 b- p8 e0 q4 k; N
|5 d' l# s9 L7 F! N
xor di,di
3 C% I( \! t U+ G mov es,di( G' i' m0 P( Q0 @7 y
mov ax, 1684h
6 o! O1 Z$ q+ Q" i mov bx, 0202h ; VxD ID of winice
* a& f& T4 R" U, V+ z) C* F int 2Fh
6 n3 M3 `% `0 g* D& a. O7 P mov ax, es ; ES:DI -> VxD API entry point, S5 F! q0 z5 h2 l
add ax, di
2 R5 y1 m' N0 R9 E. D3 I' P test ax,ax3 _5 Q2 b, b8 \4 g% d H# @
jnz SoftICE_Detected
+ z# G( M/ X, j
# _3 M: L% R# p; \+ q0 {/ ____________________________________________________________________________
1 ?4 j* F. c& y, P% \* i3 W w3 R
+ m0 a5 e7 ]6 a9 E, lMethod 04
4 ~$ r2 {$ m n+ S$ [& v" Z=========
2 j+ T8 \6 J) x" ^6 q l9 U' \) A5 v x2 p7 v4 L- T" ]
Method identical to the preceding one except that it seeks the ID of SoftICE4 y4 }6 `3 q) c4 V" q
GFX VxD.
) z2 R" v1 F! W+ ~: K9 j
1 V! H7 w R" W- F! e; j8 v% A( ^ xor di,di
+ ~) Z3 e* M5 Y9 M* c! a/ d mov es,di0 D. r$ l3 |8 o2 H8 g \9 M
mov ax, 1684h ( F9 u6 J2 x. i0 a
mov bx, 7a5Fh ; VxD ID of SIWVID8 B% K8 o# q+ c! z
int 2fh
/ r! b2 g: P) A mov ax, es ; ES:DI -> VxD API entry point7 ?; g5 o X1 |
add ax, di' h* D2 ^- G; m+ Y0 ^- ~
test ax,ax6 T3 }, E5 H4 C+ D: {, l0 e% U5 S
jnz SoftICE_Detected
" H9 I, [& c8 Z+ F
, J! M/ o# Q! A2 ^__________________________________________________________________________& a( z2 g+ I2 i6 M6 _1 d! h0 D
* n3 X! z( v9 |9 t1 H$ l- s+ l
! O8 w5 X! E$ Q" y
Method 051 h! h0 V' z) R3 d7 k' }7 A
=========1 [) @' T& x. p3 O. B6 F
: m9 {) H: C" |9 V. e1 W7 k
Method seeking the 'magic number' 0F386h returned (in ax) by all system
- x* [0 b% `# ^, ] F+ Q; Gdebugger. It calls the int 41h, function 4Fh.
0 ^9 `; l& `8 ]" b0 D: aThere are several alternatives. 9 X$ ?4 i5 S0 O7 s S* n3 I/ s
0 G! j1 U+ b; U- @/ H) x* `8 x% Y
The following one is the simplest:
$ c2 v$ ~. f2 }7 c: ?
3 W v- B- W+ S+ U' n! k mov ax,4fh
( m& c. |0 s* s1 p( X3 {% z# f# d int 41h
! U& n' W1 T: |7 k% R1 l cmp ax, 0F386
* H* r7 j+ V- b, A* t7 @ jz SoftICE_detected
( r K; W) o5 j
- e8 s! C" Q1 D2 a: V3 I) g
0 Q$ s8 @( v0 }) Z k' v0 LNext method as well as the following one are 2 examples from Stone's 2 v- K1 B4 X! x/ C# K
"stn-wid.zip" (www.cracking.net):3 N. V) a' q- h" }1 g9 ^0 o
5 Z/ s& h: H0 Q$ f
mov bx, cs! \% _4 Y! [5 F: o9 |3 e- S9 a
lea dx, int41handler20 B# @+ ^" O1 s1 Y# H
xchg dx, es:[41h*4]% o8 f7 L r! i) |
xchg bx, es:[41h*4+2]
# f7 x! l- B- G! B% O& T mov ax,4fh' {# R; W+ f$ v/ f$ h3 p: i( B+ p3 d
int 41h
7 r- `( \) Z n% _ xchg dx, es:[41h*4]
- B* V1 ]& h$ D, A xchg bx, es:[41h*4+2]
! L/ D1 v- w& D. w cmp ax, 0f386h
; J0 F/ K% ^1 ^9 I r" ~9 o" \. l jz SoftICE_detected+ S p7 K* Y8 m: n- b: \3 n" x
6 u- q2 X9 x; l9 Q# P
int41handler2 PROC
/ y0 G3 i2 x$ }( Q/ f, E* k iret- R6 J! j( g7 b- y" v
int41handler2 ENDP+ }+ d/ [# q6 J, N- x; M
. L6 J' r b8 j/ Y7 C- F, \/ | T+ Z: j$ S; q( S' P1 x2 g! Q4 c% m: @
_________________________________________________________________________2 ]8 U9 ]. I' V
: q% x$ ]& K; z$ _7 u: [5 B/ u5 O$ G" ~ w6 v( f9 c2 }- q* U9 K
Method 067 \4 x. D* \" ]+ Y% l/ G# K, I
=========
3 y6 [; m7 w& D/ {7 X
+ ~- k+ n* }9 I
, t" ^4 {$ B; u; `3 s: M. M, d* L2nd method similar to the preceding one but more difficult to detect:
+ ]3 p7 h8 f7 d3 V, }. _; T c$ k9 e) x/ {! ?# i7 T5 W
6 T9 a" z: A. \% m' H1 ~5 ?1 J; n
int41handler PROC
/ c4 i; G* \; d9 z& U( D/ R' G2 q mov cl,al- L6 Z- D+ C$ R* X/ L; t- m
iret
5 C- c9 ^- Y5 M$ S1 ~ W( Dint41handler ENDP) X& V& A: R& ? y
$ C" D8 \8 ?7 I) c; y3 e
9 N* v* `" ~$ {0 l( z
xor ax,ax
% S) x8 @" }6 \; J mov es,ax
0 v; k4 j0 B! o G8 a) x2 B w1 t5 o mov bx, cs, a y, K. ? O% J9 E& U+ d. f
lea dx, int41handler7 a7 r* W5 l: }/ @
xchg dx, es:[41h*4]
6 A6 s" P: C L5 l0 ^0 @: A5 _ xchg bx, es:[41h*4+2]( i4 A; t/ ]0 c* x, K. l5 k: R
in al, 40h" N. g2 u: z+ k5 [6 ]
xor cx,cx
! }7 b. q# {+ R+ m2 M1 c int 41h/ r6 b' H J5 l( i5 [- Q
xchg dx, es:[41h*4]! V* r8 t8 F h4 H# {
xchg bx, es:[41h*4+2]
- m3 }8 {+ B& ^" w+ J- {( F2 j cmp cl,al; U% q$ a4 w9 t* G# k; i2 A' |
jnz SoftICE_detected
?7 w8 H, h- s/ y w3 t
: c& O- M$ Z8 O$ q4 A j# _0 x3 c_________________________________________________________________________& a# v C) b! m& Y' D. u
- p( W6 A9 T6 \ {Method 07
5 R' e: g& C" z8 l' n G3 ]5 S=========
3 ?& _+ E' A& h& e3 L1 \; W. ^! _" c3 S! I5 H
Method of detection of the WinICE handler in the int68h (V86)
3 F* k( u! z5 H1 F# s0 h1 e, g! ]; L5 s5 e
mov ah,43h, Z; s' U% ]% C
int 68h
9 V! Z5 S: `( N" h" j cmp ax,0F386h
) z9 Z, x2 o) z h) K6 J! B jz SoftICE_Detected' S' I: {$ R0 A: `8 r3 i' [
9 Z/ Z0 E% Y {! T7 k% i9 l. W2 |7 {4 M+ y. `; a: r
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit, |' ~# n) {! s2 W
app like this:
8 w' ^- y5 _. i, t5 i" p1 G* [ u0 _8 l- u* S- R3 O1 z
BPX exec_int if ax==68% d8 \$ b' N, q( k6 b! U# ?
(function called is located at byte ptr [ebp+1Dh] and client eip is
- p+ `# _ S0 p" Z. b9 \ located at [ebp+48h] for 32Bit apps). Y+ W* t2 b+ g4 z$ \+ {/ Y
__________________________________________________________________________
a" A. y+ P8 y6 c7 \- r5 w
" T- p3 ]4 y+ U4 h& L$ p+ A2 `& U, ^! I( D x& M; X( c, n+ P
Method 089 d8 ^0 T6 F* O# P% }9 d$ T
=========
- i% J e7 ?1 w1 ^" e) N# Q- w
6 i4 O; W5 \+ E9 d! zIt is not a method of detection of SoftICE but a possibility to crash the% V# J$ Y& k. w! S- M& p- S1 {
system by intercepting int 01h and int 03h and redirecting them to another
& Q7 w5 |; t0 [1 c M2 Proutine.
5 x |8 _" Z1 X# oIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
9 r O& B1 Y% ?$ _+ y5 Oto the new routine to execute (hangs computer...)$ [2 c+ p: V% l) C) u% V
) @) n- p8 Y! K' q! [7 t mov ah, 25h
& r4 j" h. D8 e$ d; l7 I% X mov al, Int_Number (01h or 03h)* R3 Z/ H# A+ R+ X, L' o) X
mov dx, offset New_Int_Routine! V8 ~, g" k! o; \
int 21h0 p; P6 R3 B% t: X1 P# h" e
* _+ f, A; W2 j$ d" j; `% O__________________________________________________________________________
% A8 p' R1 v1 p* \" C m |
7 S2 c. k2 y+ V. _4 D9 X4 J2 u2 \Method 097 G$ Q$ W/ y: D% l9 a" m2 t
=========
& E, v5 j; k; Z2 W* V+ x
1 @# V2 V' J) C; A7 [This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only/ f) L# a, V/ Q8 h: w
performed in ring0 (VxD or a ring3 app using the VxdCall).
$ U" E/ d4 n0 Z: }6 o( VThe Get_DDB service is used to determine whether or not a VxD is installed9 p X! S5 Y7 Y
for the specified device and returns a Device Description Block (in ecx) for
8 f- R2 g6 b0 wthat device if it is installed.! K. Q4 q, N6 Z$ p" b5 m7 O) P' b
1 s4 g. u) b4 k6 W, p8 v$ @
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
' E4 v) n# p7 G9 r% g mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)$ y0 |4 |4 G+ k
VMMCall Get_DDB
$ ~/ K1 v( o% k t* T mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed# S* T, ]- ]. `0 j8 f, _! N
3 q! c: D3 j( P2 t5 {Note as well that you can easily detect this method with SoftICE:" s$ K5 z( z+ _ E. l* d! U
bpx Get_DDB if ax==0202 || ax==7a5fh
7 ?) P2 i2 t1 [: x2 R
9 O3 R- ]% _2 ^. U__________________________________________________________________________" R5 Y6 ]+ f2 N( @
9 [. d6 j" n, j+ `. F- wMethod 10, v3 G& L" _: p7 ]" [, \
=========
{3 `% `8 U+ |- U( Q, Y3 [1 n6 b: ?2 p% r
=>Disable or clear breakpoints before using this feature. DO NOT trace with
i, u$ F9 u+ D3 A; s SoftICE while the option is enable!!6 W* c4 U0 ^% N; G; D: a) h* V
' t9 A" C( l8 F3 V& [* p! BThis trick is very efficient:! z% d) X/ Y- i4 j3 x
by checking the Debug Registers, you can detect if SoftICE is loaded; l6 c; p) p* L$ L4 \- d/ M7 t+ h
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if3 f! Z$ Y7 r9 Z' G4 u, G
there are some memory breakpoints set (dr0 to dr3) simply by reading their3 V1 `0 |7 [* m0 W5 N/ n; k; F
value (in ring0 only). Values can be manipulated and or changed as well
& z7 o6 t+ \7 W$ G+ C; Y1 \(clearing BPMs for instance). u% i/ J. O- C: T: P# M
6 d; D" w2 m$ V0 }: k
__________________________________________________________________________
, ]& ]+ K, H* q8 F; Z \, e
9 X6 _& |) m2 S) LMethod 11# F6 z! X. }) K; M
=========
) O$ ~9 ?) k! V' M' |% s# j1 s; T% f2 w, z$ `. L; G% [1 C. X7 p
This method is most known as 'MeltICE' because it has been freely distributed
5 @3 f F4 L9 @; P5 X; V Qvia www.winfiles.com. However it was first used by NuMega people to allow) \ X6 |& \% O' P q& [; ?& N
Symbol Loader to check if SoftICE was active or not (the code is located2 @9 S9 x( P4 Q5 q, j: W( g4 J0 n4 |# | v
inside nmtrans.dll).
. W$ y3 B! K, F) i/ k {/ X/ M
7 W9 h2 ]% w; iThe way it works is very simple:
9 n$ H$ F8 \3 E4 L4 MIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for1 }4 f+ d9 ~! ]
WinNT) with the CreateFileA API.
( i5 y$ W4 R4 F6 P( W9 _
1 T) D6 ?/ @7 T- U! R. IHere is a sample (checking for 'SICE'):
7 K# `& U6 L1 g4 j/ _! D
$ [, k$ b( L& Z2 k+ H CBOOL IsSoftIce95Loaded()/ F4 R* {6 f5 |: f1 b
{% g$ a1 f: q, P o9 Y
HANDLE hFile;
7 ?$ p) L# [7 E hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,: U" ?2 D; j0 k B- P
FILE_SHARE_READ | FILE_SHARE_WRITE,
/ l& J8 M# V* V' ^1 z NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
0 ^+ j4 t. ?" x5 D3 n, ]& c0 x& _- c, B if( hFile != INVALID_HANDLE_VALUE )
/ e" C, ]% K) C3 e a2 c9 ]" q6 Q {
* O, x% u+ {% V/ [# { CloseHandle(hFile);7 q, i% L( h" L8 D
return TRUE;
" o) b$ d( v$ H2 w }
% M4 @3 K- V8 G2 q9 i return FALSE;
# h) C1 x' R: M. H) w" b}# E% a1 S. Q3 j% W/ Z8 w+ e+ h
8 ~8 S+ ]' @4 [/ S1 Y" Y
Although this trick calls the CreateFileA function, don't even expect to be
3 M. f+ Y; p: P2 Nable to intercept it by installing a IFS hook: it will not work, no way!
* }8 t( {, E ~6 p; M! I! k6 ?In fact, after the call to CreateFileA it will get through VWIN32 0x001F/ Y- y$ J: y0 Y, n" H8 Q& j& }7 k
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)4 Y! [8 T" q# \" p3 h
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
+ b+ l: G8 W3 N' ~+ j* T5 G7 Dfield.
% X2 B, n, x2 v, q3 cIn fact, its purpose is not to load/unload VxDs but only to send a
* L# l: F6 U- n. G+ Z; jW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)! B% l. S7 Z3 E
to the VxD Control_Dispatch proc (how the hell a shareware soft could try: e/ ^- V3 ^0 s$ p% J
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
) j, |( {5 y0 |- k1 XIf the VxD is loaded, it will always clear eax and the Carry flag to allow
5 ?4 n/ H1 Q" R# Kits handle to be opened and then, will be detected.
3 |3 u" P9 F' C' x& M1 Z, UYou can check that simply by hooking Winice.exe control proc entry point7 r5 i7 ^6 v6 h r' b
while running MeltICE.
0 Z) I1 `. h+ a# g* a: P. d7 C3 m8 H: u3 J {4 _4 z, V
8 d! \. C, i$ {1 m
00401067: push 00402025 ; \\.\SICE
* d( J2 E5 k, N. j 0040106C: call CreateFileA
, `: T' U( U; ?1 q: t$ u 00401071: cmp eax,-001" r: I) V. A: Z, b
00401074: je 00401091( G1 P( V. k1 F2 j
- u' v; R( e- f8 x; ?2 O
+ L2 Y7 T: @1 w2 `+ `# }4 R
There could be hundreds of BPX you could use to detect this trick.
% V: ^' ^8 K) U: y; |2 T8 ]/ Z-The most classical one is:' {0 ?& I( n& s2 D
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||8 \. Z& k2 b. y) c. n+ q
*(esp->4+4)=='NTIC'; l! [1 O O s+ B3 ^! I( G
% D3 v; e0 ?! b' ]4 Z. {
-The most exotic ones (could be very slooooow :-(0 T \0 L+ k4 d2 I
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') 6 L0 H5 _) @. ?# d# J6 e
;will break 3 times :-(
- l. r; ]( z2 r! ?
+ p8 H. m6 o) B8 c8 o-or (a bit) faster: % y3 d8 h* A; s& ]# r" x( m
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')* N5 D, `( v0 P
! R' z/ M- j! l) Y% c7 r, c BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' ( o; J) ~5 k. F* [ `! {& H
;will break 3 times :-(2 x& d' F* }4 v( c8 j5 a
( j. |+ {$ n+ g* S a-Much faster:* a3 ?* ?, f) A1 z1 a
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
8 z, A# t* N1 a8 l Y
# Y7 f% C) h! g1 |1 ] NNote also that some programs (like AZPR3.00) use de old 16-bit _lopen. z9 i/ y1 b/ S5 K) r7 t: h+ a
function to do the same job:
- G$ ^7 U: E6 k' T5 r6 ]; H8 P% }" ^ V
push 00 ; OF_READ: i" J5 {, f+ Q2 h" W# h' l8 E! b( N
mov eax,[00656634] ; '\\.\SICE',01 Q8 W' z. l/ }1 h
push eax
) r- v! X% ^- U6 Y" I/ u call KERNEL32!_lopen
3 A5 [$ H- g2 [ inc eax" i& o- K+ n1 s. e8 a8 [% q. U
jnz 00650589 ; detected7 h y( i: u; _8 \0 s
push 00 ; OF_READ
j1 y0 L7 J* t$ a1 C9 w- y mov eax,[00656638] ; '\\.\SICE'
. V* T7 G5 B, z0 K& @: g push eax
# U( Y: }8 d: ]( W7 o) v! w call KERNEL32!_lopen
# |# ^8 |8 X+ Z9 K/ U inc eax" {9 u+ w' M% l9 S0 ~2 ~
jz 006505ae ; not detected
* c" ]5 V2 R& {* C6 _
" n s4 i0 u5 r4 |- N9 O: v6 F: b% P4 L' d. S* _. G
__________________________________________________________________________- W6 i1 t) t# M; P
7 c# |; A$ ?, i. B9 V
Method 123 n: P! f- k4 Q H! e
=========3 s* j |, A, N7 G: `. q% X5 q; |0 t
( k" I: g' B" I% d" s
This trick is similar to int41h/4fh Debugger installation check (code 05
5 |6 O; y2 T H- ~) B& 06) but very limited because it's only available for Win95/98 (not NT)
' j- x2 {( E& v4 o6 a0 jas it uses the VxDCall backdoor. This detection was found in Bleem Demo.: j( h' C" Y e1 d- w
7 L, t8 f4 h; A6 _
push 0000004fh ; function 4fh0 [; x( O& B* n; X9 [$ Y
push 002a002ah ; high word specifies which VxD (VWIN32)
$ ^1 u( w; D+ H ; low word specifies which service
! B$ s* C" A" i" i% N8 U! L9 @, n+ @5 n (VWIN32_Int41Dispatch)
/ K$ ^6 {) W3 L2 x g call Kernel32!ORD_001 ; VxdCall' U( \7 u$ {' P6 V
cmp ax, 0f386h ; magic number returned by system debuggers
2 Z% N* R, J, B* |1 ` jz SoftICE_detected
. L, F/ x. Q4 Y6 o" ~6 ^9 K# ~+ C' Y4 e, ^$ G) Z
Here again, several ways to detect it:
7 B8 }8 [; t, ~- y6 I
% ]3 R( w( W O+ x6 u; J1 G BPINT 41 if ax==4f- C( E1 C& l0 U' n! w! x# `5 x
1 {) j; M- g% ^ BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one O' o* ^$ T+ i$ ]1 N
2 F* U8 m+ H. l3 F# s BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
% ]& n6 w7 T3 c+ d% [
! U7 A3 ]' H4 q: Z9 l) i4 K BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
9 a* L. J8 l+ |. l" V' H* J7 e: K
__________________________________________________________________________
# I6 W5 c% P" V! a! R, H C. X) Q8 _% `0 l' ^
Method 13
- X" F$ P9 ^3 h( G; \* H=========% K9 v1 ]4 i ^: @/ m/ g
) T- T2 J* X9 [, s* ^5 LNot a real method of detection, but a good way to know if SoftICE is
! I, Y( G+ e- g4 V0 ?+ ^- sinstalled on a computer and to locate its installation directory.
: M; }4 ?. u- ~1 B, W6 HIt is used by few softs which access the following registry keys (usually #2) :
3 ^6 O% K f5 p5 r+ D" M1 I4 w( h$ K# R' Y8 u8 p2 V8 P. F
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion7 h# t C M0 Y G% f0 P( @
\Uninstall\SoftICE
! f# v3 e) N4 b6 g e-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE1 e1 W K& y/ R; w# h
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion( ]* h! n/ y3 K1 A/ B
\App Paths\Loader32.Exe& R: v' S4 s! ~- N) Q
% z' z1 T, _2 D
* O( \$ i5 a) |2 i* ?6 ~2 LNote that some nasty apps could then erase all files from SoftICE directory1 \* T* }- g: O4 Y5 [
(I faced that once :-(
. ?% z! l" y3 }* ?) T4 L2 @* U f1 D" d
Useful breakpoint to detect it:, V9 p S) P' ~
0 U7 a, m$ a9 F8 Q* t
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'9 w& o4 j( E* z5 M
( ^; ^' m2 e$ l: L" h) a__________________________________________________________________________2 Z$ {; n$ w P, `% @8 W5 M/ S
. ~0 R( x# G' ?. @; v
: w; [5 k1 g1 a9 U5 s( m0 i2 YMethod 14 3 u n( E6 d5 Z; i' b7 ^
=========
5 f1 {+ P9 X5 y5 ]6 S' T1 j/ e# K/ T# l( W9 ?, D$ I/ v4 R
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
, t! |6 t( b, X* x! V9 S' D) Tis to determines whether a debugger is running on your system (ring0 only).. Z$ v# `0 q3 q4 g0 Q
+ U" [& \' K' L$ J1 `+ Z$ c. q VMMCall Test_Debug_Installed; z# ^: I$ x) t+ G0 b
je not_installed
! a% G4 H& r* N# f7 F% t
& g" \* x4 P* z, SThis service just checks a flag.
6 e; f/ K6 y+ e4 L3 _* p</PRE></TD></TR></TBODY></TABLE> |