<TABLE width=500>" M8 d$ k# p. v
<TBODY>
# H7 m1 d$ Q0 [! h: l, C<TR>/ d: F, V. c9 w4 w% I
<TD><PRE>Method 01
; b8 G- y! F( Z: k=========5 q. i. }5 q6 o6 }* |% z8 b; h
' K* |% B3 |3 HThis method of detection of SoftICE (as well as the following one) is
6 s: ~2 d$ {; r+ o! xused by the majority of packers/encryptors found on Internet.' C1 ]) [3 F7 n0 ^( o
It seeks the signature of BoundsChecker in SoftICE1 \' P' I7 `0 q8 H8 M
- u, {! \, n" c( {. u mov ebp, 04243484Bh ; 'BCHK' G; s. ~4 M9 f" c
mov ax, 04h
, |8 I0 {) Z5 n k int 3 6 b$ K4 p3 a4 s6 L/ x" `$ ^
cmp al,4
; }. k) o; ~" S$ F6 q) s0 I2 s jnz SoftICE_Detected; D' C. N: k: t7 w
/ ^6 Y: \3 \3 I* B5 k7 c9 R
___________________________________________________________________________. f5 H2 l9 X$ i) T2 I
$ A" l2 Q, @8 x5 _Method 02
, k! g w" @: L+ r- P1 L* I=========
0 Y5 Y# B8 }1 }
) V) C- y2 u- {! |Still a method very much used (perhaps the most frequent one). It is used% G1 V1 ]1 t2 E/ p$ b" Z
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
) Q, Z3 z& n# u/ x4 u) nor execute SoftICE commands...
I7 q) t s7 g9 r/ PIt is also used to crash SoftICE and to force it to execute any commands1 x5 ~' _9 n- X" D$ D6 t3 s
(HBOOT...) :-((
4 M/ ]/ ], y" M" |( {% @; C6 T4 H# P- L1 ]7 M- {8 I
Here is a quick description:
! \" P S' h3 c-AX = 0910h (Display string in SIce windows)
2 f8 T7 L! t$ I( U) I-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)- {# y5 Q5 o& i( J' C
-AX = 0912h (Get breakpoint infos)
b3 L/ U5 k0 e- Q-AX = 0913h (Set Sice breakpoints)
% m+ o2 @* p, N) r& o-AX = 0914h (Remove SIce breakoints)
* _, R9 B0 O" {( s o
8 X2 a$ V7 c% V9 W* T4 w4 TEach time you'll meet this trick, you'll see:; C) i. U" g" v. m( N
-SI = 4647h& v; z6 `" E# ]4 l1 r/ s
-DI = 4A4Dh% C T: {6 d; I) X% D
Which are the 'magic values' used by SoftIce.$ H3 P; ^$ x3 |: h( U$ [
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
! E6 P% |/ K" K8 d! V( z: A0 H; ]
; @2 s( [+ F3 r8 G) Q5 rHere is one example from the file "Haspinst.exe" which is the dongle HASP% T4 ^2 Z" X/ n& E
Envelope utility use to protect DOS applications:: f/ H9 @- T* ], ? [# B
2 A6 l3 Y- {4 {( S+ H. J- |0 _+ s8 n* C( S1 I: y1 |
4C19:0095 MOV AX,0911 ; execute command.
2 }' ?* o! w$ J3 l0 B- J) `+ c4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below)." _' ^4 U0 t' R5 c
4C19:009A MOV SI,4647 ; 1st magic value.6 p* _9 X6 t9 r; Z0 D3 o
4C19:009D MOV DI,4A4D ; 2nd magic value.7 e% n0 L0 G, \ a
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
3 W5 R1 M ?) j K' s" w4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute% [, I; H0 |, u/ D8 b
4C19:00A4 INC CX
; E1 h4 m; m$ b2 ?3 E4C19:00A5 CMP CX,06 ; Repeat 6 times to execute5 m0 r0 t: I: r* t& F5 ?/ |
4C19:00A8 JB 0095 ; 6 different commands.' f' K/ u+ c3 n( N* c3 Q
4C19:00AA JMP 0002 ; Bad_Guy jmp back.
: ]+ u k8 ^ p. M& q4C19:00AD MOV BX,SP ; Good_Guy go ahead :). d+ h3 r+ D, G4 A# n' n
( c: C/ w& @, D, l( dThe program will execute 6 different SIce commands located at ds:dx, which
' q2 C" _' D" v c3 `6 b7 Fare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
) S1 f7 q" [: t8 R% ^
0 ^0 Z$ n2 j8 Q8 p4 i! p* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.- @3 n4 _% ?+ K, Z2 F
___________________________________________________________________________( h! y& I c2 r; e$ c4 I, o2 e
. ~6 K1 N9 h$ R
) G. ?0 e) i& f2 u% fMethod 03
2 e9 t4 w9 a+ J- `* f2 C' s4 \* \=========
( \- \) ?5 }& P# [' w7 R5 D$ `5 t. T+ k( m( g: f8 r; \1 Q7 s
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h: P' U% T% |; l
(API Get entry point)5 S( s& ~: c3 h
1 n# z. ~" c- F! U" v
0 k* v0 W F5 V* i1 d2 @0 c8 H xor di,di
$ S/ W) Y j; w# t3 g mov es,di
. k& l1 q- ~% j mov ax, 1684h 0 k- ]4 k& @/ j1 }$ m! ^8 L
mov bx, 0202h ; VxD ID of winice
6 M. C' I* \" o6 U int 2Fh
+ G/ T+ m& e; j+ u mov ax, es ; ES:DI -> VxD API entry point: {5 m. c3 ^$ ~% N9 V% c7 a" P
add ax, di+ Y3 t) E+ E8 `# d# J5 i; X. H, K
test ax,ax" u. T; T8 K6 [5 Q c
jnz SoftICE_Detected4 f6 n) S$ D! _( L
& i# Y; Q: Q4 [* t0 n___________________________________________________________________________
/ I0 W: I4 f4 a1 u# t5 U$ H1 X" r
0 i* F$ N" d' w2 w8 N1 H8 iMethod 04, ]& n7 t8 K% y
=========8 ^7 s5 n; i6 T S( J* R+ W
* s' |1 }1 n. l) G1 v! k+ U6 E0 [Method identical to the preceding one except that it seeks the ID of SoftICE# x! Y4 N. e% W! ~3 ~; e
GFX VxD.
( z/ W0 N! L: g' L( |$ t" K2 F. C, l/ Z& |/ @
xor di,di" a1 \: @0 o, Q" X
mov es,di
/ A* t; v, Y3 L, q1 K mov ax, 1684h
2 ]9 z; i* N% l- C! o; e4 a5 h5 A mov bx, 7a5Fh ; VxD ID of SIWVID$ _2 h$ I" X% O8 B2 b$ z
int 2fh: X, b! r% _0 G8 i( C
mov ax, es ; ES:DI -> VxD API entry point: h; X1 D( t9 T7 Q
add ax, di: T/ ?4 V1 m- h' u2 d# U( D
test ax,ax( H; O* j: ?4 G6 T
jnz SoftICE_Detected
; B1 X" D( Z+ D5 t; e6 u0 S X
__________________________________________________________________________
* B* u: D0 g/ ?2 T2 M& Y$ A& a
$ P/ X, ~7 c2 y1 J, E8 Q! ?. r
, x Z# i+ g% ^: H1 l2 vMethod 05
; m8 d5 H8 E: Y8 Y5 Y=========! S: _4 D* ~* e& h; n( L) {
* V- [3 K( t# T9 G) h& U3 M- eMethod seeking the 'magic number' 0F386h returned (in ax) by all system
! G1 }% Z7 ?; t: W& ^: Edebugger. It calls the int 41h, function 4Fh.4 r( G; M. V$ q9 `& K' _! \
There are several alternatives.
# g- `7 `5 O* C7 `) C3 Y; f: _. m# H) D+ \2 R3 J [
The following one is the simplest:
; V4 }& h4 o8 G* [0 a# g
5 _ }( e: F5 F5 @1 l- K+ F mov ax,4fh
7 E9 D7 O* B5 ^- t0 I int 41h- F; z8 u8 u" A/ D
cmp ax, 0F3864 M' x3 X ~- B
jz SoftICE_detected* s- C( W: `& z+ @, w
# @% c L8 W* |3 l n2 V, v1 y
) B0 F- o) T. w+ g
Next method as well as the following one are 2 examples from Stone's ( \# a# e% q3 s
"stn-wid.zip" (www.cracking.net):
" A( I- W+ `. D/ r( v2 L+ r U2 P, k, [, Q- v/ _# c
mov bx, cs9 W' R4 [" l" b2 H+ ]1 v3 Q5 {
lea dx, int41handler2
" c1 f, }8 w" W Y5 h1 ]& a- j# a$ G xchg dx, es:[41h*4]
0 m( J/ P4 e0 z6 m, v% ]+ z xchg bx, es:[41h*4+2]
+ ~* _2 u. A2 P5 S+ B4 K mov ax,4fh* c6 o8 o0 _9 c
int 41h; b+ h2 a' _! Y( N8 O5 x
xchg dx, es:[41h*4]
. Y6 l. M4 U& x x! ^4 z8 I xchg bx, es:[41h*4+2]2 G7 W! I* |7 w: ~5 V* }" T
cmp ax, 0f386h
3 ]) `+ I( B' l. I jz SoftICE_detected$ R$ X3 m7 W! Q+ |+ u+ _" w1 q
; H5 z# a( S6 z! {
int41handler2 PROC
?5 h3 z) `: Z( C) p6 U iret% C" t, _2 _& f3 F+ m2 X
int41handler2 ENDP
1 N$ s- Z2 V$ V1 d: q% u
, M" H- C; v. f9 d2 K: i6 x$ ^, X. a7 U
_________________________________________________________________________& }# y! n- [6 o2 X' [8 ~2 Y
6 g9 G% r2 {5 C% G0 X. V: G( w n& k- {+ B; o2 k) B* O5 m0 N
Method 06
_: h! e* a5 S! T=========/ _; n' ]/ a5 { H8 N
6 w1 l( n* E7 w+ G7 o1 y1 ?; A* V7 l& p+ @3 j
2nd method similar to the preceding one but more difficult to detect:
6 }" g a+ N7 n2 z: s3 D# D) p. J2 j* A3 b+ ^2 P% m: f+ j
U- r* N' F, c' @' A* X
int41handler PROC
& ?3 L7 ]- h: S mov cl,al8 ]4 Y& i4 N, E
iret
- n' A9 P. E6 P6 y8 n2 ^7 _int41handler ENDP2 V+ F. \. J x' L
9 b- F; Y% s5 W7 r, K
/ p7 _; [0 M/ e6 [: g8 U" ?5 w! w
xor ax,ax6 {2 T+ V+ e$ q. }# o: k" C0 V
mov es,ax' R7 N* r0 C& O. W3 ^$ i
mov bx, cs
+ l* j; y+ R1 O* b9 k lea dx, int41handler8 n3 y1 {, e8 t9 ]0 }$ u2 z
xchg dx, es:[41h*4]" {. T" f2 a, r% K
xchg bx, es:[41h*4+2], i( [( J8 x( p0 _8 B x
in al, 40h# [- K7 t% X$ _
xor cx,cx+ }) G/ }4 W( b, j! B
int 41h
" w J2 i9 q# i1 t, V: c xchg dx, es:[41h*4]7 M$ G% e6 T1 O, {/ Y6 ~& E: _
xchg bx, es:[41h*4+2]; R8 c& n Q7 \. s4 p
cmp cl,al* r) W" z4 N, t) {" t( g
jnz SoftICE_detected& [! J# u0 @) @/ ~$ v0 x
& U2 ~: F; q' x: c- q
_________________________________________________________________________
" K! @% v, K% o9 ^
+ e1 x3 f2 E- HMethod 07
& P4 H% `1 {( B; M% g=========# a% y3 v6 A6 A2 I1 e1 v$ I5 ?9 ~
( D$ v1 @% g3 M
Method of detection of the WinICE handler in the int68h (V86). ^ t! h6 [7 e
/ \& W1 B2 Q2 k! K" Q mov ah,43h
: P* X% n2 w6 D( Z( O- \1 [9 E3 N int 68h
5 S' r" k3 n& V9 R1 t5 r5 a* J cmp ax,0F386h. k/ J1 R; m9 W; @% G
jz SoftICE_Detected$ o; a1 e" U& ]- _+ _8 F) W5 Y5 B; h
$ _6 o: G: F% A9 T5 ?" |
. G6 ~* i4 P4 t, n
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit" U* N# t- g1 T" A7 F J
app like this:" u/ ]! T$ A1 {
2 p' S+ [% w4 R/ Y BPX exec_int if ax==68
) v- }) H2 |/ E% |+ k" P9 A (function called is located at byte ptr [ebp+1Dh] and client eip is5 f* G- i2 x4 y/ {) N D; }, x
located at [ebp+48h] for 32Bit apps)
$ M9 t0 Q+ `; |2 D3 b8 M__________________________________________________________________________4 S' f, w5 o1 `
, r; V0 ~( @5 l6 u: _
6 q3 ^) ^2 O) e4 rMethod 08
# @% ^9 x+ E, w6 ]& r" X=========7 g2 l' C5 K3 @( B% b. i% d
5 W/ M; v6 A! k# L; c9 i- UIt is not a method of detection of SoftICE but a possibility to crash the
6 d3 ?, |+ t" D9 n; C9 nsystem by intercepting int 01h and int 03h and redirecting them to another1 [9 \% Q/ h4 C; s
routine.
1 W- Q" |3 W# a+ b' eIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points# x- ^8 t5 Z5 ~# W3 E* ]! {
to the new routine to execute (hangs computer...)9 W6 \7 m3 i+ F2 [5 d
5 c! p) M$ c1 x2 V- L) D7 Y6 f
mov ah, 25h
( _ ^$ d4 J$ E, ` mov al, Int_Number (01h or 03h)1 V" g* M t' V; z# j$ c, C6 Y& z& u
mov dx, offset New_Int_Routine
+ v0 l6 K' O( o int 21h: S* I- r* ^" u1 B6 s9 g6 R5 U
7 w, @' R2 d- v) C0 i
__________________________________________________________________________
5 Y& V0 `! k5 J5 ]; w" }- e: J; {$ m" s4 N: i8 |/ [
Method 09% D, e2 f% Q9 `9 P
=========; a0 f" l8 B: F; m
' v. U& K% K- {5 C+ n, X }
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only5 p: N8 H9 ?' P% H4 c; c) ~2 ]
performed in ring0 (VxD or a ring3 app using the VxdCall).2 o! m3 Q* o0 n. V1 {/ j3 P
The Get_DDB service is used to determine whether or not a VxD is installed
7 [. e5 K$ C* q7 o9 O! Lfor the specified device and returns a Device Description Block (in ecx) for! ^' W* A8 z+ @9 w$ C" l
that device if it is installed.4 b7 J9 O9 t3 i5 q
, V2 {2 M$ S9 O. x9 {* i
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
3 b) u4 F' s6 i, w0 s mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
6 `3 M2 ?" {( |6 Q1 q$ ] VMMCall Get_DDB
9 S1 E3 x+ f9 W1 N% V4 a+ s# P7 p/ L mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed2 a3 L4 i V* X( O2 X
3 \6 c3 b$ p. T8 l+ w
Note as well that you can easily detect this method with SoftICE:) ?* _% ?9 M( W" B: ~4 M
bpx Get_DDB if ax==0202 || ax==7a5fh
! i# w4 F+ k3 |* O/ C! J+ A3 K# U% T* {0 a# j. J& Y7 B3 I: M
__________________________________________________________________________
: p0 R% C' y4 b
5 ^: c! z2 }$ KMethod 10
( q+ X0 @9 a$ R8 V1 p=========) s, \, e) j$ V5 {
& r0 H5 Z( j. X% E=>Disable or clear breakpoints before using this feature. DO NOT trace with
; M: O ^4 m, s8 X SoftICE while the option is enable!!
' o, }0 o' H" {+ U
1 i; @# h( Q: MThis trick is very efficient:: P3 U# }, l& p
by checking the Debug Registers, you can detect if SoftICE is loaded1 Q+ s% T r4 u3 r9 j
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
* I! K$ \; e6 a5 v3 B3 |there are some memory breakpoints set (dr0 to dr3) simply by reading their: s" K" N9 t" }0 ^; l6 i7 M
value (in ring0 only). Values can be manipulated and or changed as well* w6 @% ~" z( u2 v, c- o' N% I
(clearing BPMs for instance) }7 e$ {+ K3 H3 I w
7 I* ^6 P. [7 X8 q& _' j__________________________________________________________________________
, D5 H/ b9 O. j- S' c- |
4 n3 p( x$ L) o8 a, L! ^- ?+ C# s6 QMethod 113 j; `* H; w! K7 ]% n; c) k" E
=========
' S( h0 y- G ]& @ U+ ] ^
, E0 m6 C( Q7 M8 l8 j( ~This method is most known as 'MeltICE' because it has been freely distributed) X1 [3 s& J" i0 t9 U
via www.winfiles.com. However it was first used by NuMega people to allow
9 @+ K* F4 R6 W1 OSymbol Loader to check if SoftICE was active or not (the code is located
0 Y# i* l" a9 R! _4 h% J$ _1 Vinside nmtrans.dll).2 X3 O6 D* ^( e* j/ L8 n' ~9 z
g9 x4 l0 ]9 N P3 i
The way it works is very simple:
) ?0 S" w) U. e' K K n% Q- C4 gIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
; x1 }9 {6 h }9 e* ~4 o9 _7 I3 IWinNT) with the CreateFileA API.
& R9 e: F; c' b0 p0 j5 ]" [; D' e# Z+ \
Here is a sample (checking for 'SICE'):* C- U# i% n) q$ q4 ~0 q) w
' ?9 R! z b& y5 a( ^BOOL IsSoftIce95Loaded()1 D. t# ]0 O( b( l
{
7 W# x0 V( C" k7 T HANDLE hFile; 5 O( _0 n/ c) u: j# }6 B
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,( P3 G3 r) v3 H! K8 a$ j
FILE_SHARE_READ | FILE_SHARE_WRITE,8 a$ C6 ?* ~0 P: }
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
% |* ?3 j% D3 ~9 v1 F, A if( hFile != INVALID_HANDLE_VALUE )
- e( [7 _5 J" |9 Q7 W {, w2 L/ }; \( i. z
CloseHandle(hFile);% D! U* Y6 v& K2 t9 f) W
return TRUE;0 i; t1 x. s6 I( n7 a
}8 _" C; e7 G2 @, H+ L) P+ h
return FALSE;- \# Y7 j8 p5 v$ {/ W: ]
}# o& j5 m7 B9 x1 s" i1 L: f, K/ M
9 c8 n$ O; ]5 E& a+ x! c
Although this trick calls the CreateFileA function, don't even expect to be
5 A9 P; c# z; x" @1 r; H! d$ xable to intercept it by installing a IFS hook: it will not work, no way!( z: t/ }+ n( e& V8 Y \
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
0 k2 @4 J$ K+ Qservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
# F% p) G- b, G8 i7 M; P6 land then browse the DDB list until it find the VxD and its DDB_Control_Proc
5 g4 o) I* W! Ifield.. b8 d# b0 O1 n4 _1 R' y
In fact, its purpose is not to load/unload VxDs but only to send a . r' e4 _% N! Y
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
7 g6 u/ B0 M7 x. k! b6 j- o4 r0 oto the VxD Control_Dispatch proc (how the hell a shareware soft could try
) n, H0 y z* Y9 Q' Z0 L6 vto load/unload a non-dynamically loadable driver such as SoftICE ;-).
4 i, _; ?5 w, C8 \8 \# sIf the VxD is loaded, it will always clear eax and the Carry flag to allow/ {) O& G! h7 l7 L. e
its handle to be opened and then, will be detected.3 x: D5 r7 B9 K8 _4 G Z
You can check that simply by hooking Winice.exe control proc entry point; H$ I7 ^- `- _
while running MeltICE.: o6 a L1 h z9 r& j
) x% ?9 d. o. m
2 l8 e1 t- R, s! n5 w 00401067: push 00402025 ; \\.\SICE' U- h. x* u I S
0040106C: call CreateFileA& B: m5 C' H7 n2 F7 m) n- X0 y
00401071: cmp eax,-0013 h- E& S' }9 K
00401074: je 00401091% c" k8 N% |( o
$ ~# ?. p9 K( F
: g# m9 T% ?% y/ {( ^5 ]There could be hundreds of BPX you could use to detect this trick.
1 y" @) `( N& G$ Z& ]; r2 h-The most classical one is:+ U+ U! F6 ? C# N/ C9 K# S
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||9 Y* {0 Q) x- z2 r0 y& g
*(esp->4+4)=='NTIC'
2 ~$ q) M6 l. `% D3 U& |2 q" n! d7 |+ I* x' S/ y
-The most exotic ones (could be very slooooow :-(
0 t1 a: Q% ^; }0 P. p8 f$ h BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
6 [: ?2 ?, C" v/ U3 J- z6 T ;will break 3 times :-(
0 ]2 @% C+ U; _
' x) e( b& {) r: I5 [-or (a bit) faster:
5 g! k7 C0 O3 M2 b& [ BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
. v$ w5 f% b( ]6 ^, ^' e. a' F* G
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
: u1 v. ~% |) t& k a- Y% ? ;will break 3 times :-(
( K/ v6 R8 Q6 T! _% K% [- z4 I& b. C0 V* @8 [. l
-Much faster:, Y* W" B) K0 O, \6 u1 ?, h
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'& N9 @- ~# o7 M" V' k
4 L- f6 _# _2 v# G; P
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen8 ^( Q2 S4 r) `% c/ t
function to do the same job:
, _+ X; k" l; P6 O5 G$ m$ t* _; K$ X
push 00 ; OF_READ6 f" V M2 C) ]% _5 Q9 J8 q
mov eax,[00656634] ; '\\.\SICE',0: _ m7 ^4 E! v6 ~, {
push eax) ^+ @- S( M0 I( i4 q+ z
call KERNEL32!_lopen6 r) H1 M9 E; r, G/ l; G" G3 _
inc eax7 |5 p9 n5 R9 d3 i$ a
jnz 00650589 ; detected3 {: X" h+ J, R& e
push 00 ; OF_READ
' i3 ~3 G- Z6 g: w mov eax,[00656638] ; '\\.\SICE'2 l- o3 G* u6 {3 V
push eax9 n1 Z! ^: ]: I( A, |
call KERNEL32!_lopen2 S5 B( b1 R& H- w% R
inc eax
; J$ o' |# p$ d& B jz 006505ae ; not detected) C8 @0 P$ g- S- Y) }1 l8 q
2 N% z3 p% f; Q j1 e/ o: A- `' z( w
__________________________________________________________________________# E/ O! k9 ^/ c; p' K
! G& k- @* i5 i) N" K. ^8 y
Method 12
I8 s6 M* o/ b9 x=========
( \8 i* J6 b! M0 W0 I+ K3 E) D
; f9 B1 }/ L1 F* g5 L6 ]This trick is similar to int41h/4fh Debugger installation check (code 05
) D: g, `5 \4 N: ~1 o) b# Q; G& 06) but very limited because it's only available for Win95/98 (not NT)! J6 K3 b' V' o- ]# i" K! }9 ]
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
, B) j* U( u# z( ~" v, a( _9 D: j+ O+ w$ k, `' t: i
push 0000004fh ; function 4fh* @; m! p) N: L* h' J
push 002a002ah ; high word specifies which VxD (VWIN32)
5 Y/ U: j$ j. T$ s ; low word specifies which service; W8 U! j. c; R3 v9 l0 T9 @
(VWIN32_Int41Dispatch)
* E4 h, F9 E5 j: `. l2 r8 z; H: N call Kernel32!ORD_001 ; VxdCall
& i7 T3 A/ R$ ~ cmp ax, 0f386h ; magic number returned by system debuggers
% [" B* D0 o+ w0 H L jz SoftICE_detected
" R0 _* f0 |" s, Y7 M1 F2 d
1 {! A7 |# O1 PHere again, several ways to detect it:
3 D3 ]8 y' q6 m" D/ _
a8 R( D. r8 U+ X6 K) X; a# R BPINT 41 if ax==4f
) r, q- y0 I' ?/ {& T: K. Q) X7 h8 W& p! c3 d7 w
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
2 H. I- W# M8 d+ V! j8 Q2 b# D" ^: D. R! s1 }
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
8 x7 [+ L0 i5 d: a G7 t0 G' Z I; J. R% S
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
2 M$ }& R6 b9 D; E" _& w* j+ w& u, Y0 j+ d g# {" P
__________________________________________________________________________. P/ I7 }2 d! E6 K1 s1 `" V% l
1 c7 v8 ?; U( \. Y1 }Method 13
2 ]* s- G1 O1 A$ a9 c4 W$ R=========7 q4 ], H1 C( e2 E; A$ @1 N9 t$ h( j; M3 a
# @' T4 l( c' T- L8 z6 \
Not a real method of detection, but a good way to know if SoftICE is
" r& T1 w+ l4 j( z' Qinstalled on a computer and to locate its installation directory.0 g ?3 R: @( I5 P8 g. H" o9 C
It is used by few softs which access the following registry keys (usually #2) :
) P& { e" w) @5 Y4 O/ B
) |# X' G5 P2 C9 D* H7 U-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion# _" J% S, o' B1 ~
\Uninstall\SoftICE
0 j8 y# d# z8 @2 X-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
5 f- d3 z U) @) c6 `. L-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
7 w1 a* V; ~$ R\App Paths\Loader32.Exe9 C' q9 e+ I9 c1 P6 h
6 k" R9 L* Y3 L9 y
+ ]- s0 [. T A, D+ G: V3 |
Note that some nasty apps could then erase all files from SoftICE directory# K3 P5 y% S8 B7 o" P
(I faced that once :-(
3 L2 A4 ?4 k& P9 G" {& I" a @' _: S3 ]& M$ U% x
Useful breakpoint to detect it:7 m' Y4 r! w6 l
5 N) ^- ^% M( `+ \6 J: F: B' s
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
% F& ]* A* q: r5 M, t. y' r3 E" o- g* |% f3 g4 G
__________________________________________________________________________
0 Y3 {; ^( Z$ y* N! r! N4 h( `
! H: n* w1 U& z7 m6 k; ~
3 f! a0 Y- ?0 U6 IMethod 14 - ]; ^ a. B8 W& A( p8 M
=========, W8 ?' H0 Z+ `; B
! B" h9 i% Y( d" F
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
, j. w; G1 F4 F( E8 ^6 R' jis to determines whether a debugger is running on your system (ring0 only).
& u1 p7 k) h9 K8 f/ I0 j' R
3 w' k! b9 h( e4 y$ X) G: U2 E VMMCall Test_Debug_Installed1 P8 \9 L* }# Z# s& T, W
je not_installed g: @, W" T/ n0 i: [2 s% e" X- W
5 `4 s& E) n7 ^- P- H2 H7 h6 IThis service just checks a flag.
5 x# W2 W* w$ c</PRE></TD></TR></TBODY></TABLE> |