<TABLE width=500># G7 F( M: h2 H3 r5 D' P
<TBODY>
# q% s R* g. r' s. V2 O<TR>
0 S3 S* T& A0 z9 d6 _<TD><PRE>Method 01
, R" _+ o) l* ?=========
/ P+ V' q3 Y( y3 w% w0 d3 N$ d/ N3 d* \6 n" `
This method of detection of SoftICE (as well as the following one) is
( t* k" u+ G3 h6 H- u0 _' V. j) |0 W I K/ Nused by the majority of packers/encryptors found on Internet.( R2 H7 S6 l9 A: Y7 |: a. N
It seeks the signature of BoundsChecker in SoftICE
/ `6 Q* B/ [" o4 L+ x
" u" p' N3 v5 `+ @- a1 k; B' K( W% o. C mov ebp, 04243484Bh ; 'BCHK'( K( m/ }9 N8 x/ P7 ]+ x0 p
mov ax, 04h1 G- F- r9 r, d; z( [
int 3 6 |* d6 r W! y8 O9 m" m& S( D; n) U
cmp al,4- o8 X# c7 t6 X! d0 o
jnz SoftICE_Detected1 g' e! H2 Q8 L1 F) ~' T5 c
4 n: K9 O( T8 f8 B
___________________________________________________________________________; W3 |' J5 z# q) w# N# T/ H2 g
0 m$ y) S+ C% s) q5 i2 H& XMethod 02
9 X) b- L [+ u5 v% n=========
/ @" i" ?; N6 y% Q$ F9 k/ ]9 ?5 d# q4 o7 [4 M# q9 V
Still a method very much used (perhaps the most frequent one). It is used. |, \7 b) W4 u% U3 m; e0 g+ D
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,! z( h, t6 T) ]+ J0 D5 O( ~% l
or execute SoftICE commands...
2 N% [/ u4 d' J" w& T* oIt is also used to crash SoftICE and to force it to execute any commands
: c @( P9 [& q* K(HBOOT...) :-(( 8 H& }, e( b6 I! C, j+ L& b
$ w- _$ l, c0 z% R6 aHere is a quick description:1 e1 v# r" T& P% Q, `- p" A: [ W
-AX = 0910h (Display string in SIce windows)6 q* R7 u) V4 X* b
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
$ J3 L3 u! y) h& ?9 t" C-AX = 0912h (Get breakpoint infos)
) v# ?. L# O- } a-AX = 0913h (Set Sice breakpoints)
3 r, {9 F$ ]! ~-AX = 0914h (Remove SIce breakoints)
4 Y' B4 d4 M+ o8 c# u7 N+ J0 Y) }! O- q L; I
Each time you'll meet this trick, you'll see:+ ^ E% R9 ?" l7 Y
-SI = 4647h( e# S0 u8 r/ [ x1 f1 [5 w- Y# Y
-DI = 4A4Dh! r0 ] s5 i1 z
Which are the 'magic values' used by SoftIce.) M0 \. q! a8 G
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
& z# X4 q* H, T& P$ l
) `- }# R+ t" Q+ p; P( MHere is one example from the file "Haspinst.exe" which is the dongle HASP$ L" t7 ?) D& t* m( V/ ?; U$ ?5 h) D
Envelope utility use to protect DOS applications:
- ^% W+ {7 M4 Q; a/ B# l! H ~" H% \+ k9 T0 K; X
0 p. D$ [; a Q: }
4C19:0095 MOV AX,0911 ; execute command.
9 L; A- ^ G I. _: z) Y4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
$ d: Q- J9 A6 v4C19:009A MOV SI,4647 ; 1st magic value.5 l0 L1 ~/ Y$ {! } v- }- r& x
4C19:009D MOV DI,4A4D ; 2nd magic value.
# L* Z4 O7 i2 C+ \2 Y1 L4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)& o' L- O7 J% ^; j
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute; L( x- T1 l1 }3 x. [
4C19:00A4 INC CX
2 }) N% o" h; u% N# ~! g: B& S* D4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
9 q+ l$ N$ \0 R- t2 E& F4C19:00A8 JB 0095 ; 6 different commands.: M6 l& A( m" j# Z L
4C19:00AA JMP 0002 ; Bad_Guy jmp back.- w! }7 R5 b* ^, ~
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)/ ~- J6 k! f/ O) _
9 ?9 b( {4 [) W& A- Y9 x0 l% sThe program will execute 6 different SIce commands located at ds:dx, which
6 _ t9 } H1 |" e* H8 G# yare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.) A: @+ ~/ b. k" T- A! J+ ?& N/ j
6 c/ ], h' d/ \! Y* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.# w& h5 k) p, X/ P2 Z
___________________________________________________________________________
; x; v& r7 M; A1 n
9 e3 @) m0 p+ @" L0 h5 T4 d& q: p! C6 L4 z
Method 03
" v/ B: h9 L" t# ~. q=========
# V: v- S2 k) i, Z+ Q9 A
' C! p1 d* ]7 U) H0 K7 pLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h) c# f8 ?8 O7 H( o7 d. x% ]
(API Get entry point)
9 g7 {- Y [( i* S7 i D# @1 Y ( I6 B" @* L9 f* n) [6 X5 M* J
; H# X# x t% _- m5 X1 Q7 v
xor di,di: [1 h7 P, n; W8 q. E( R7 W! \
mov es,di
" R m& Z) e P) F- m0 k2 L mov ax, 1684h
& Y7 b5 U- ^3 k- b; ~ mov bx, 0202h ; VxD ID of winice
% C( V% k' H6 t int 2Fh G1 l7 i2 n2 _; v* E! [
mov ax, es ; ES:DI -> VxD API entry point/ N( p! e3 N! v- b8 `" _
add ax, di1 ~4 Z* C I6 M9 }& a7 s
test ax,ax4 B" o. Z' J; P, e8 t6 w
jnz SoftICE_Detected$ ^# h+ g6 v, X" Z
, }4 o( G. x) L9 q4 H! _+ ]6 ^
___________________________________________________________________________
1 k, ?* N' ]0 [4 p& M: R* y3 O* ?. @0 K% ~8 l, U
Method 04 _) |. |& Y0 l: H1 ~
=========
& K9 F4 J, a6 w3 @3 N6 [
; w: l+ o' m4 r8 _Method identical to the preceding one except that it seeks the ID of SoftICE
( g* @1 `' E! H7 R4 F% {# JGFX VxD./ U* r$ \8 G) R4 u2 w- B
( l& I1 {9 h( N5 ~: i8 u+ @3 ?
xor di,di& k' ]3 ~3 F; [/ c6 F8 B
mov es,di
/ T' L/ u$ C; C! f3 r mov ax, 1684h + [; P: j: j; f R; n
mov bx, 7a5Fh ; VxD ID of SIWVID+ M, }% R4 } ~& }4 f2 s+ A8 |
int 2fh1 Y' P. ]% g3 H( u/ }& T
mov ax, es ; ES:DI -> VxD API entry point
0 b$ }3 b) F; F: C0 P add ax, di& J( V0 s \ B* z
test ax,ax5 s1 ^# t3 u& ?: s# y2 u/ P7 r: f
jnz SoftICE_Detected) u5 ^- G& u0 Y
7 b$ y7 [% F& G, ^! e3 l. G! {, Q+ T__________________________________________________________________________0 C2 N. d7 k. d
; J7 P# H* k$ u$ J, T8 ]8 X
9 ]3 T6 z5 I, E1 j9 F! h' W- i, K! m
Method 05
' a; D0 Z8 j& c, y& p3 G( U$ H" E7 o=========
) y" C& o- o! l+ T
8 D E9 @$ `1 w1 sMethod seeking the 'magic number' 0F386h returned (in ax) by all system! V/ h3 D) W2 k+ w; [* M
debugger. It calls the int 41h, function 4Fh.
3 s) B0 y' S5 r: O7 ]* X0 JThere are several alternatives.
, s; j& W8 s8 v/ p1 ~% g
3 _/ F! |0 ?* w7 ^1 @The following one is the simplest:
0 W) @. @! @5 j. W2 v) \
( d' b" I8 [: N mov ax,4fh
' p$ h8 f# o4 n# s int 41h) T0 q$ K! V0 a) G" |7 O
cmp ax, 0F386
: S: w7 Z& o+ _/ N" r& o$ @ jz SoftICE_detected7 w# N1 }/ \5 i* l" s6 [
; q/ B/ [! }: X4 ~& V1 D) X( k1 o, w# L
Next method as well as the following one are 2 examples from Stone's
; E3 a) i- A3 l- v1 P"stn-wid.zip" (www.cracking.net):9 ?" n' G0 X' o0 J @
7 D! `7 S/ l* E. H; D$ l# e
mov bx, cs
. n! M m* M4 g; J, I lea dx, int41handler2
- X/ @ u! L5 H6 `( k5 W# s( r8 @ xchg dx, es:[41h*4]5 [' w O9 Z' @
xchg bx, es:[41h*4+2]
* n4 }6 V$ L1 K1 P2 y mov ax,4fh
/ W1 k# z, ^' @+ Z+ [ int 41h
' M7 e. f* o& R xchg dx, es:[41h*4]5 e/ ^! T' E" m1 T/ x% G
xchg bx, es:[41h*4+2]4 N- U- v; L' a
cmp ax, 0f386h
+ V. p6 ^% K) y5 O jz SoftICE_detected
% |: E. g/ K, t5 u4 n4 x g1 I5 ]1 \" P. w
int41handler2 PROC
$ \# x% m9 r! @7 k0 V0 r iret2 n" R% h! c8 M6 \0 [! {) R
int41handler2 ENDP( c" R- `8 H9 w3 [; P4 P" q
2 |& z, @% F% _# f3 ]3 ]8 ?2 Q& u+ `
4 s/ K4 x; G* K6 L_________________________________________________________________________
$ q' u5 ^! _& w& {" h' h( x6 h, k' H5 ?7 x9 Z" o/ N
' @, D' O5 M2 x$ K
Method 06
: n5 @- \$ A2 [0 i l1 f: I=========
# t, X4 d8 S: h
9 e& w% R# A1 o: y! ]0 u
1 T' a; B- g8 {: Z0 }% J: R4 s: H2nd method similar to the preceding one but more difficult to detect:- b3 `+ ?6 Y3 o" _+ Q1 T) G Z
3 j4 p ~, m8 k, Y7 {/ \" Q
9 e Q/ [, N7 w
int41handler PROC% L' W4 X6 z- B$ R
mov cl,al
9 l4 x5 K2 X; n5 A( n iret& x; w2 X: U: t# n
int41handler ENDP4 Z# p/ J0 l( Y# Z9 u$ j+ u
1 f- P' p/ v' E+ d; g8 v5 g6 j. m$ g P' T' D6 M
xor ax,ax
! n( K8 t, ~+ e* Z+ r$ G3 d, Q mov es,ax
, e' ]; |- C" r mov bx, cs
0 L4 D" z. t6 ]) l7 P1 R" n- y lea dx, int41handler. a9 w4 Y" N# x0 l
xchg dx, es:[41h*4]) _& n) q1 P7 L1 X1 g8 x+ y0 C
xchg bx, es:[41h*4+2]
- a2 X1 [& ?; L' ~+ u# i in al, 40h
7 s8 f4 Y4 x4 e7 {5 z xor cx,cx
4 B) V5 X) o( \! X int 41h+ {+ s E: z0 D. ?, k* x6 d
xchg dx, es:[41h*4]2 f$ Z6 @. \9 E0 g3 R' V
xchg bx, es:[41h*4+2]
' A2 p) K9 g! j cmp cl,al8 ? n0 k _* l' Z2 @, X
jnz SoftICE_detected9 f! i. d0 I7 w
) [6 A$ E7 w3 _" y) M1 p1 O' m_________________________________________________________________________
5 x' Z1 P: x, J8 k
( a9 j- F# D% [; H& z" ZMethod 07
- [ l: j' _% U3 {=========
+ K& b: u0 g y; P9 a$ a: D8 ]0 N8 `; g7 }3 |8 ]
Method of detection of the WinICE handler in the int68h (V86)2 E \+ q. Z& W! f4 ^* R
9 j2 \0 f( k9 A5 E6 x, f% f* ^: N1 S# [
mov ah,43h6 f" R9 A: k* p
int 68h' H+ H' }4 s7 O/ ?& r
cmp ax,0F386h6 E9 h5 M7 e( }6 G3 R3 M9 G
jz SoftICE_Detected/ O3 r( U4 d; s& s& |4 r/ G
$ t8 b8 q: t4 }) W) P# ^1 W; d K' h2 U, t2 s
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
1 O. R# a' N; @% h app like this:
3 n. W5 z: G2 K* i
1 e# m$ T% u G; d BPX exec_int if ax==68
( K8 I/ n' \7 \2 i (function called is located at byte ptr [ebp+1Dh] and client eip is
' Z, U. b" r4 N) b) f& T* I located at [ebp+48h] for 32Bit apps)
5 @+ b+ M2 B$ ~4 T* F/ P8 d__________________________________________________________________________
% `3 b! k3 j& S: @+ f2 `3 n' I% W5 M2 ~
+ s9 q: s1 m" T& ^3 f6 M# c/ k
Method 08$ M/ H. Q5 |% z; ^& @2 X
=========
) ?8 L* F- Z8 t3 R9 o
4 V6 [6 e( j5 D& t3 ZIt is not a method of detection of SoftICE but a possibility to crash the" D# b- H: F0 h$ q8 O
system by intercepting int 01h and int 03h and redirecting them to another5 U/ _/ |4 h7 f) K0 X% G' K
routine.9 ]; K. v+ ?& E7 K* ~( O; ~' Y& W
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
9 ^3 F' R7 p: Y5 N4 vto the new routine to execute (hangs computer...)
' y. z; G, I+ P/ C+ n. F) f- N
mov ah, 25h
4 `& D* c. _. W$ ?1 R mov al, Int_Number (01h or 03h) e' K; E7 I1 D9 C6 V$ V1 V( \0 d
mov dx, offset New_Int_Routine. ^" z7 ?/ T- O7 K1 y
int 21h7 o! S* z$ X4 A$ x
2 O, ~: _1 V, g6 C, E% Z: w I
__________________________________________________________________________
; C- w; t8 w! t) i |
* Z; C& |) M: c wMethod 09
) v; x! Q% I4 s6 z# h=========- B5 z' x( x; o$ |/ P
9 T- @# W& L7 [
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only6 s H# V: Q0 i7 f0 e- J
performed in ring0 (VxD or a ring3 app using the VxdCall).) P0 w |5 d. q. K
The Get_DDB service is used to determine whether or not a VxD is installed
0 v' l/ ~! ?! tfor the specified device and returns a Device Description Block (in ecx) for/ [4 c* i. D* D) R8 W
that device if it is installed.$ X% y/ o9 W) c. A7 i+ i
0 r8 \' S) m, y, w1 C7 u
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
4 N) C7 I. z6 l, x mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)3 n" |: j) I+ K4 r
VMMCall Get_DDB. I0 F& l3 \% O2 e: ?
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed& S- f6 J- {+ K4 H$ }
2 O5 U; c* H# F+ u
Note as well that you can easily detect this method with SoftICE:
3 n! ^5 e) p- M4 Y( x bpx Get_DDB if ax==0202 || ax==7a5fh
0 R- v* l. i: Z% o' b3 O
* O3 \" Y) o. Q& f1 ~__________________________________________________________________________$ E7 ^% t9 p& b; O* I) ?9 ]* Y
9 T! }0 G- h% ~
Method 105 w) ^; z3 Z* t6 f! d2 F
=========9 E; g6 `* f5 n; q1 N5 C
& Y/ c9 @+ S- b+ {8 T
=>Disable or clear breakpoints before using this feature. DO NOT trace with
1 |; K3 k ~1 _+ n9 w SoftICE while the option is enable!!
' }5 N1 H, Z+ B5 U& U& \
" K5 o& S; H- ^This trick is very efficient:' L* C6 T0 ~' I4 m. b
by checking the Debug Registers, you can detect if SoftICE is loaded
) V7 W* `1 g4 i(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
* I. N' r6 S% y* R& t" |' mthere are some memory breakpoints set (dr0 to dr3) simply by reading their
: g; t8 k. j) avalue (in ring0 only). Values can be manipulated and or changed as well2 P% X- b8 ?$ t* r) `- G+ k
(clearing BPMs for instance)# H: N, _7 W4 {9 P8 w v6 F, K: b
6 e4 v) y+ W2 O/ b6 u6 K
__________________________________________________________________________4 r4 g5 B1 |2 n; K: j% M6 J
+ W6 o' c# K6 L! e; s0 ]
Method 11, }* T' l- S; v6 s/ \( a4 ~: \
=========
1 ^6 b& V$ {2 @3 S3 P
' w% r( G4 T: yThis method is most known as 'MeltICE' because it has been freely distributed0 I9 | z) `. o
via www.winfiles.com. However it was first used by NuMega people to allow7 n( i; C1 l2 T% P/ u& l6 ?3 d4 L
Symbol Loader to check if SoftICE was active or not (the code is located
4 B- H3 N$ c$ H+ J& V- ]6 r/ F2 kinside nmtrans.dll).
X2 G4 N3 ], t& S, h" p0 u+ o; ?2 o7 ?; g: n, h( S
The way it works is very simple:
5 R' H2 Y* j9 u# g* y6 V$ l; BIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
8 j, V) t) \3 l/ @; q2 VWinNT) with the CreateFileA API.
7 v! I! E, V& R' l# g9 e! u& D# U u" k# O& e. T' l
Here is a sample (checking for 'SICE'):( i: W* A1 w6 V# Y2 N3 }8 @9 [: G
1 R& S1 U7 W2 n; A [% cBOOL IsSoftIce95Loaded()& b: O4 {. d7 k. i, m) j
{
! u2 v7 v8 W ?9 h: p9 d1 e0 ]" I HANDLE hFile;
7 O/ f- ~( D' o3 B8 X0 t hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,7 e! d3 b) O6 b) h0 \' }- R: Q8 G
FILE_SHARE_READ | FILE_SHARE_WRITE,$ T. j1 w% P3 G) s
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);& `. g! x- {+ x* A- C
if( hFile != INVALID_HANDLE_VALUE )& I" z' [; @0 |) u! _8 ?
{
; ?6 S2 K: C- R CloseHandle(hFile);
0 U- [; U' ]6 k9 @2 z: V7 R return TRUE;
- @+ D* g8 n% K D$ \8 x; b; n }
% u; l; X& {1 F$ q. k& A return FALSE;9 ^: P1 a. B' O5 I
}! s/ t2 V# w2 c$ R- g
3 L- _& A7 }7 D X" ]6 `- }
Although this trick calls the CreateFileA function, don't even expect to be
0 d9 _# m1 {/ n9 P. p( h% Mable to intercept it by installing a IFS hook: it will not work, no way!
i7 i4 s3 b# F, `6 PIn fact, after the call to CreateFileA it will get through VWIN32 0x001F9 J3 D; ]# g: S/ o7 L
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)2 {2 o' x+ ~( E# x0 P7 \9 j4 V% |
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
6 |; u( k# l9 g7 q. d, c* [1 Z0 Z( u+ Tfield.
* F$ q- i3 w7 G7 ~" qIn fact, its purpose is not to load/unload VxDs but only to send a
' g& ~' ?; I D2 s3 b+ p8 f! TW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)/ i8 n3 h; r" G! q4 t1 y
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
4 a& n! f6 R( |to load/unload a non-dynamically loadable driver such as SoftICE ;-).
( q# v2 @" }8 `% Y+ a9 x4 I5 |+ XIf the VxD is loaded, it will always clear eax and the Carry flag to allow
( Q5 p' y7 D+ v+ N6 Pits handle to be opened and then, will be detected.. c9 i3 G" e/ K7 f
You can check that simply by hooking Winice.exe control proc entry point
7 u* d& y& U) W c6 v! h2 ^& @/ Uwhile running MeltICE.; h% o! h d: \7 ^. f' r2 s$ g# ?. d0 b
) l1 P. W8 _5 B0 g
$ d" f: J& X1 {, f2 j$ e" z" s 00401067: push 00402025 ; \\.\SICE, o& j1 e( X% D& |; I7 [* ^$ ~
0040106C: call CreateFileA
& N" |9 I- n# \$ R5 z. l 00401071: cmp eax,-001
. {0 m" W0 O) L9 k 00401074: je 00401091+ ^# x* | a2 |- J! c! Q+ [
. {2 q6 _" v8 Z o; }$ b; B* ], j3 }4 `
There could be hundreds of BPX you could use to detect this trick.
2 g& _; S; M* @0 |8 q: [-The most classical one is:
$ D5 `' i7 u% u/ X BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
+ Y( N3 r7 k9 O7 V *(esp->4+4)=='NTIC'
/ n! `2 w+ \/ l$ j, `9 Q+ a! D0 j- p f" Z! v6 r, [- l. x9 P0 n1 t
-The most exotic ones (could be very slooooow :-(
" \. G1 Z9 T) Q. `; @# ^ BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') " F$ h$ r& M' U* D
;will break 3 times :-(
3 M8 L. L: I. B) y# M8 H
4 U8 }: V+ k3 S* J' X' g% L-or (a bit) faster: 4 x% _6 y9 i1 C0 O* F4 l0 i3 Q
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')) h9 H: c, _+ y5 K2 e1 \" a6 J0 s
% Y6 q9 b6 ^) t: h0 u6 P
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
~3 G" m; u/ d% j* V; \+ s ;will break 3 times :-(- e+ Y8 `' j- x$ N
4 d8 E" D$ J% [2 L4 X+ x-Much faster:$ ]- f( [* M" c; e7 o
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
# O0 ~! q% G+ e2 V' I0 S k$ P; P2 i" ?4 E5 E* M C/ |' ?
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
( h# C" b! m5 Afunction to do the same job:
7 W1 ?4 w, O% d4 K& s( j
4 n2 W" ?3 } f/ P l" d8 Y2 M- U push 00 ; OF_READ \& C' x$ K% x) d
mov eax,[00656634] ; '\\.\SICE',0
" \( i6 P9 C0 {) k, e3 k push eax, j2 [; j0 [0 }. x9 b L
call KERNEL32!_lopen
% Y. Z* I, w+ m: n4 T7 D1 O inc eax
6 {4 p$ S @! D8 w% b( h( i, E% T jnz 00650589 ; detected
% l: q3 i1 [; F2 M7 J push 00 ; OF_READ' t$ B* Q8 p4 i4 h$ l5 B" T! c6 |; D
mov eax,[00656638] ; '\\.\SICE'
* G# K% ~' b8 d9 V, H push eax# B# Q! }3 h3 h4 j- Q5 H1 g0 M" _
call KERNEL32!_lopen) Y1 f( X- u2 e5 A2 q$ R
inc eax; P" c# J7 M- j, q* p7 n+ q
jz 006505ae ; not detected5 v$ h; s$ }" E) N* G
2 F" H" I' v& n5 u7 T
3 ]7 Z; m8 D- d__________________________________________________________________________
& x8 x2 O+ {+ y2 U, b; F5 b1 i8 G$ H' r! ~, Y; C9 V
Method 12: C1 ]( P. t# h8 }- e. X8 a
=========
" r C4 X" K! G7 i& t9 i
& F$ O ?, n/ K8 ~This trick is similar to int41h/4fh Debugger installation check (code 058 m. ]3 u& o5 @2 s+ D: _) m
& 06) but very limited because it's only available for Win95/98 (not NT)
Q) i0 ]4 S2 M) N4 Vas it uses the VxDCall backdoor. This detection was found in Bleem Demo.
# ~. D! }7 J- ~. P# N1 d- e
# e3 U- g9 h: _ push 0000004fh ; function 4fh+ ^8 S& m- }- s& M B
push 002a002ah ; high word specifies which VxD (VWIN32)2 x; O4 B" s7 ?' T2 @
; low word specifies which service. a* b1 [- x9 j8 \9 @; s( c; X/ C! W: k
(VWIN32_Int41Dispatch)5 o8 r) M/ ]; B5 M
call Kernel32!ORD_001 ; VxdCall
% m. a& y6 H' |/ z cmp ax, 0f386h ; magic number returned by system debuggers
$ t, [9 q: S2 O4 ^3 C7 }5 R jz SoftICE_detected7 E ]4 Q9 N/ ]
1 c+ c/ \) E& \, i5 f. ]
Here again, several ways to detect it:0 i. t/ {' B! h5 B" x" o( l7 O- L
" d( H/ _) |0 j BPINT 41 if ax==4f; [) E9 u' K& ~9 \9 j% R
+ D7 U! T0 d8 {
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one# `. ^& w( }# ^, k
7 b7 v1 ^0 R* ^/ } BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A, l% J$ {* w p! u2 T
' \) r6 Z: f6 u# L/ D: w# R
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow! _2 D1 ^0 |3 ~1 [0 }0 ~6 c; S
0 i5 ^- r& W% r0 x: R$ k( Z__________________________________________________________________________
) ~8 }( e+ v8 g9 a
, N7 q% Y5 u! C5 l1 PMethod 132 P8 o1 @7 \( ~
=========$ U, a% Z2 V Q+ I* b' e5 R( n l: y
9 `, o) n' K+ H- Z* x8 {/ d/ _2 c8 k! n
Not a real method of detection, but a good way to know if SoftICE is- y- Z. S3 g& A
installed on a computer and to locate its installation directory.
. m9 [' t5 M, e* u; DIt is used by few softs which access the following registry keys (usually #2) :( J* e7 }4 l' q5 F- n* @
6 C* m W2 T6 v-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
8 `0 w$ G. S! m, _/ |3 i\Uninstall\SoftICE
* X$ V$ L O* N7 K5 e( B2 y3 w-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
) }; A- f6 d0 Q$ K- [4 ^+ Y8 w-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion! w% V: ^' D3 Y; G5 m1 h( ~
\App Paths\Loader32.Exe5 |4 A0 Z/ x6 U, ?& e
0 D) _4 X3 m, ]" _6 O3 j
. R) s) w3 q5 g) u1 t
Note that some nasty apps could then erase all files from SoftICE directory7 |8 r5 K/ k3 s4 g( v' Y
(I faced that once :-(
$ O9 w1 h4 y, {2 O; [6 r
0 I4 J4 s z- @- n/ }+ ZUseful breakpoint to detect it:
) ]7 u z9 `- \9 j2 O, K, u3 X$ p; M }7 o1 Z# l
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
1 w+ e3 T% U8 x$ `9 X! K4 | i
5 E! u5 Y! W( P! P__________________________________________________________________________
' [9 ]( ^0 U4 z3 g6 F/ v: W, I6 ]7 O" h( X4 ^+ K
! t# N- Q, t( }& B/ s- U8 V
Method 14 4 A7 g; ~: y* m" o
=========
/ \8 S) E+ W2 y/ Z7 s5 @: Z% Q. |+ M3 y5 f8 a: n1 j# C" d
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose/ V( k0 a; G9 V' x4 K
is to determines whether a debugger is running on your system (ring0 only).
( \$ x6 \/ Y9 b/ F6 X, f/ u+ V
7 {* P4 [& w" ^+ r8 W0 J K! w7 S VMMCall Test_Debug_Installed* J7 Y+ X0 ?/ h( [* S: x4 H2 j
je not_installed2 b5 P7 G( X% y) e, M, H) p
$ n, P$ J' g1 ]: TThis service just checks a flag.! R+ F6 G E p) S. P! O
</PRE></TD></TR></TBODY></TABLE> |