<TABLE width=500>
# S* W9 o# U" O<TBODY>- H9 V' F( G2 i$ j5 X% R4 @& b
<TR>" t6 ?9 i/ m1 Y
<TD><PRE>Method 01 1 [3 X* ? Z% g* w* p) w2 b
=========8 d: C4 P' O0 h; G
! g/ P/ c/ \: W+ f" M, |' M
This method of detection of SoftICE (as well as the following one) is; |1 d. j2 f- c4 v5 u* A! N
used by the majority of packers/encryptors found on Internet.
# |" o% ]0 s$ ^* y R: D* e. CIt seeks the signature of BoundsChecker in SoftICE, n* h1 U! n8 t& C6 J
" V( J- ?$ L. K! `# w# K
mov ebp, 04243484Bh ; 'BCHK'
0 t0 g6 F& \: {. F mov ax, 04h
' b5 a' _ n8 ^8 u' l int 3
0 D4 i p0 F6 Y8 V/ z; @, ^, k/ J cmp al,4
) @, M0 `9 ^( ]1 |* d& H jnz SoftICE_Detected
. X7 a2 `: t. ]( P0 c+ w h( t& a$ B3 p, s7 P
___________________________________________________________________________
8 M5 Z; ~* L5 o m' z5 L5 d3 `& T& }7 z( t# }
Method 02
6 i' P- L6 I5 l=========
/ y# c& J6 D) \8 W6 l! W2 t
* w+ o9 n, c8 I1 P! Z# R# Y" y- m; jStill a method very much used (perhaps the most frequent one). It is used
3 x0 v) O# x$ [' g* @7 P5 h, fto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
: r k. Y) L& [- G* S' s/ Xor execute SoftICE commands...7 w0 N. G7 a$ w0 s( c1 o+ M
It is also used to crash SoftICE and to force it to execute any commands
4 ^' X+ a# ~ `1 y(HBOOT...) :-((
: g) P/ O5 ~6 i1 n
) I9 N, _" z: t% L! x/ }0 eHere is a quick description:1 a5 N. y& g6 Y
-AX = 0910h (Display string in SIce windows)+ n) | f6 G; p6 ?& C
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)/ u+ P/ X/ q$ n2 P
-AX = 0912h (Get breakpoint infos)2 O4 @: e+ k# M0 V* P
-AX = 0913h (Set Sice breakpoints)7 [! u: }2 G% }2 K
-AX = 0914h (Remove SIce breakoints)7 p/ w4 S% @( P7 W" @0 ~7 V4 j
! D8 t& G& A4 SEach time you'll meet this trick, you'll see:
: y; q3 H. P( k4 w9 Y-SI = 4647h6 n5 ?: M' s% {& s, \
-DI = 4A4Dh( t+ U6 L W! Q: ?
Which are the 'magic values' used by SoftIce.3 u2 j9 u) E2 s2 I/ J
For more informations, see "Ralf Brown Interrupt list" chapter int 03h." P; u6 ?, j7 m! H
& L {. X7 K% Y- }
Here is one example from the file "Haspinst.exe" which is the dongle HASP8 }1 _( g' B" Z$ q2 D) j" n
Envelope utility use to protect DOS applications:" C/ B8 B% n7 e9 q4 c" D
! A/ i, d5 t, k- ^/ y) |" `" g" r/ `
% k4 L5 f. |: B% {- Z, G4C19:0095 MOV AX,0911 ; execute command.8 m7 b3 m4 z2 d6 Q
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
K" o- l. l5 J N2 u/ w4C19:009A MOV SI,4647 ; 1st magic value.
K9 p1 C2 a7 ^) n4C19:009D MOV DI,4A4D ; 2nd magic value.
9 x* V/ J' Z$ K9 I8 F* B7 N1 V4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
+ j+ c& z3 I7 C8 g2 I6 I9 a; ^4 U* i4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
& _- y! y2 ~1 @6 w4C19:00A4 INC CX
2 p1 n2 X. p% i9 ~1 h2 M& d* L( Q4C19:00A5 CMP CX,06 ; Repeat 6 times to execute Y4 ]- _2 J2 }- A' p/ ?
4C19:00A8 JB 0095 ; 6 different commands.
! ?- x+ ~0 W- f* N" A4C19:00AA JMP 0002 ; Bad_Guy jmp back.) {0 W; U2 S' W3 {6 ^! T8 T" y8 V
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
0 [ L6 ]5 H [; i2 ~8 _2 u1 F0 g6 w- a3 ]& e
The program will execute 6 different SIce commands located at ds:dx, which% u( d( c- s5 T4 Q0 E7 Z
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
3 |% F4 }* e6 ?( p9 \
& d) [+ Q8 l) G: q0 D, l9 s* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
m, M# |8 y, v# H# S7 W___________________________________________________________________________
: a6 j) t$ R; a9 F: q: ^* S% `4 a% _! a9 @% [
' P, L/ L% x4 o- z& A5 ]" C
Method 03
7 L2 B2 j7 w, F' h=========
6 x: v0 _% M; z9 k5 y4 _
- ]; t/ N: y5 }/ TLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h$ o, j: ?) W% y
(API Get entry point)
# w1 X: L$ ^3 O
* h; l# ~! n+ I. m7 ^2 J" P& \& g# H' T0 k: ]
xor di,di
- i3 E$ p! \# V, W( I7 \ mov es,di) y( w; \4 J3 {2 B" k [$ u3 }% G
mov ax, 1684h
/ {+ g/ _& n- `( k3 a$ \) K! l' _ mov bx, 0202h ; VxD ID of winice# T+ C3 o: n6 Z: L4 n3 v
int 2Fh
0 [/ k q; A0 | mov ax, es ; ES:DI -> VxD API entry point( A. A. }4 O( s* j0 c$ U; L
add ax, di
5 B( r% E3 Q/ \; a, } test ax,ax4 | N) J2 ], O# C4 F ?4 ?
jnz SoftICE_Detected( b4 w! S* [7 V$ l0 [' T3 ]
9 K" N) I3 C2 G& w
___________________________________________________________________________2 t# Z( ^$ t0 ~
4 ^* w8 Y+ |! G/ E8 q/ UMethod 044 B( v/ t, f8 o8 W) B# S
=========
9 b9 N% b: V) B" g2 _* h+ h: m0 r- p8 O* ], s; P
Method identical to the preceding one except that it seeks the ID of SoftICE
8 F& }% N9 Z$ l2 T) o% yGFX VxD.! V( s5 K q1 @$ f
! K1 z- t3 v, x1 f. M$ H xor di,di" e# c- @9 F+ v' H0 z
mov es,di
3 j; k" S- f9 P4 a mov ax, 1684h ; H& h6 ~! g; J7 A: z
mov bx, 7a5Fh ; VxD ID of SIWVID
. K5 G* c4 H7 f5 s int 2fh9 Q) M' N- R* d5 m+ N
mov ax, es ; ES:DI -> VxD API entry point
4 l+ }' V* Y3 y( k# { add ax, di# V9 \1 M3 K ]; l G+ c
test ax,ax
7 S" l& _4 P; K jnz SoftICE_Detected
/ o0 |/ t* b$ f5 L$ N# { K2 w: ?
' _/ S: e: J+ u7 G. J! S" U__________________________________________________________________________
$ m9 E. k8 B" c* ` o; K. G. q; K
# E* G* b8 P, O
7 F; k, A' R3 @* hMethod 052 Z" f# ^4 M- Q7 v6 Z* r- T/ w$ D
=========! ~" _9 q' t1 I4 A
+ t0 c- n" O, |# gMethod seeking the 'magic number' 0F386h returned (in ax) by all system
: p& D/ w. U4 _7 {5 N! sdebugger. It calls the int 41h, function 4Fh.
' z) l' u- }$ a0 TThere are several alternatives.
! s% U2 ~% u3 g7 `' H. W; |5 i1 E% P" x/ j; h# o$ ?, ]
The following one is the simplest:
8 z) F3 O) v% K- M6 w
5 S; S, @. Z- L9 i mov ax,4fh3 J- `' R5 y5 W5 f) \- U; |
int 41h) Q& f/ G4 j) l) Y2 F+ S3 m7 h2 I6 ~& x
cmp ax, 0F386$ K/ o2 S7 q8 ]- U' A, T
jz SoftICE_detected
& o1 X. u, V* \4 V9 b. `" L6 N: _$ g. _* n
* S9 T0 y7 p: KNext method as well as the following one are 2 examples from Stone's
( H9 G, f$ t1 x$ z7 h6 r& O"stn-wid.zip" (www.cracking.net):8 \+ ]9 P; J4 t- L3 Y. T
. R F" O: M! v% W6 C) X mov bx, cs0 {7 u; U+ {2 a* u1 P$ I
lea dx, int41handler2
" q, N- |( t8 R& ]7 ~: o xchg dx, es:[41h*4]
8 H ?7 o! V0 Z9 V xchg bx, es:[41h*4+2]4 G5 _9 F+ R& S/ ]7 m5 L2 q
mov ax,4fh
P' Q. f6 h/ I# W: v- |) R int 41h4 `( X( w% H" [. O
xchg dx, es:[41h*4]
, ~5 b a$ c3 P6 W: e' E xchg bx, es:[41h*4+2], }4 n: Y A% R" q7 t( [; p
cmp ax, 0f386h
& ]& C* ]$ z) h+ a3 v0 o jz SoftICE_detected
; \% Q- N; x; v$ q7 o& _, d z; o# I! X: e
int41handler2 PROC7 T3 Y* q# z8 u8 b+ V0 a9 h
iret# n& ~8 r5 ^* ~4 A/ ^0 p
int41handler2 ENDP
- p; H0 b; u- X g4 w1 _
4 ^2 b B, M0 G; k2 J3 H! E6 x4 x# q; I/ D# e" ^$ q
_________________________________________________________________________% A6 f% ?& H2 Q( c) F7 E# S) w
3 q/ ~+ C( M7 {. W7 S B
( k- x' P8 a% n$ j# h: wMethod 06
# `; [1 Z4 |$ l8 \) O: i=========3 c' f# p- q2 K
9 Z) u" F! W2 L; M' l+ \% m* D( w0 G' C2 D
2nd method similar to the preceding one but more difficult to detect:
3 n6 n6 B; _" ^; ]
/ f4 n8 ^( h; a! A9 ~+ N
* U* T2 x; G dint41handler PROC
# ^; `" Y5 O' ]0 m mov cl,al
# ]0 O. T; `$ q+ Y) Z S0 E iret
! E7 q8 Z7 D0 `0 D* a5 Hint41handler ENDP/ t5 j9 A0 B8 G
" d. g2 F% e* w) M4 A+ K! F9 E) ~% t" S( [# j8 W- F
xor ax,ax b1 B% T5 O/ g) f% X) | x
mov es,ax$ t. d8 W6 w3 Y' m7 u
mov bx, cs
% P, N4 h3 U+ z# f lea dx, int41handler
# B! [3 ?$ S. S xchg dx, es:[41h*4]
- L: W. B, {9 b* }; V* C r6 { xchg bx, es:[41h*4+2]4 ~6 ]" C( U @6 h0 {( l( T, z d
in al, 40h' Y# s) r8 ~1 `! d
xor cx,cx: x0 e k1 F% [6 R/ e
int 41h8 F' [: _; s2 Z# T, B a4 C3 L
xchg dx, es:[41h*4]# G: }. n* B/ f3 Q5 Q/ _/ r
xchg bx, es:[41h*4+2]
' G! I: I4 c* F N cmp cl,al2 _2 A/ O% X. ]
jnz SoftICE_detected
1 y, n4 X' Q' y$ R' r, _: C! h3 | ]+ q1 n- ^
_________________________________________________________________________
+ x. }- x I9 C$ H, }" e" u4 m% m: f
Method 07
# H" u0 Y8 M* Y3 Q+ x2 f7 G- P=========0 `% a1 e7 N% p5 @" V3 L
% E9 F, j( F' \* K! e6 g- ~
Method of detection of the WinICE handler in the int68h (V86)# P! g4 u! |7 t3 l9 V' s
( i0 y0 P. A: S+ M2 V |
mov ah,43h2 S; v( I0 t# I6 e) X0 J: p" ~" \
int 68h: a: d/ H; z7 f, U& D! L
cmp ax,0F386h
$ ?% C, t: B# ]# \ jz SoftICE_Detected) {( s' P# l5 b- r3 n6 u
+ F: n8 m; a) H$ C, S, C+ f2 ]0 X" q/ |5 A3 L7 E
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
$ r( b6 M" W3 p* b" y' D app like this:
+ {* H. T9 y* {6 i4 l2 s$ [) y$ I/ _8 f
BPX exec_int if ax==68* `; I! ?" i6 h/ f% I0 \" v: F! f
(function called is located at byte ptr [ebp+1Dh] and client eip is
6 z; ?3 V% T* `% T) H0 e4 e. A! x located at [ebp+48h] for 32Bit apps)5 {; O# @2 |4 f. ^; v; q6 K
__________________________________________________________________________
# V7 {$ K/ u- R' K! _ j6 \$ O% Q3 C# ?, s5 V1 o0 J6 ~
0 M3 r0 ^ n9 f4 w( r1 G$ }; xMethod 08
: m: {) A. l/ t: B, a( n) _% L=========
* Q" I$ a; B; Z% z
3 {1 e3 v1 d1 V9 _( [It is not a method of detection of SoftICE but a possibility to crash the& ]3 V4 Q$ _) a" J8 w& n
system by intercepting int 01h and int 03h and redirecting them to another
5 D8 o! ?9 G& l. I) ]; P- E" U9 {% Proutine.
' ?: a6 G. j/ H( `# J7 AIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points8 \! K; R- b+ R8 K8 J
to the new routine to execute (hangs computer...)
) e: e1 e% T c
* ?6 {: \- D5 [) L; q* [1 m, e. u mov ah, 25h
6 x. k0 V% C | mov al, Int_Number (01h or 03h)
) I) i2 f5 Z2 @ mov dx, offset New_Int_Routine6 C, f0 D% t, A3 p
int 21h
2 U9 O. _ N1 } B* d: L9 h
7 H) k- A% Q9 l) n$ H__________________________________________________________________________. O7 H; \# }- w) x9 H/ }5 [7 {" B
9 Y, ]) E0 E! n/ @/ fMethod 09
1 U3 i2 R; _2 C8 ]' B0 G=========/ G1 X7 D7 {+ U% X9 a' ?) e. {
& X' b, s/ i* X3 Z$ C8 N4 m& {This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
! e6 g1 B6 E& P* m8 o1 _1 hperformed in ring0 (VxD or a ring3 app using the VxdCall).
1 K* H' P/ ]( s* M) `" h4 EThe Get_DDB service is used to determine whether or not a VxD is installed
; d' Y- @ z9 k7 s# x( wfor the specified device and returns a Device Description Block (in ecx) for! m$ d# [$ {6 c+ ?+ ^! b# s
that device if it is installed.
^6 `: V5 z( Z# y1 o2 U ~+ P# p' w) ~. H
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
8 u$ v3 o1 c2 g/ ^8 b mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)9 q- s/ t# R' g5 f' o" R4 j
VMMCall Get_DDB
j( g0 a; k9 y& ]1 l mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed' i' e I5 u" g
6 P( k% ~: W: M. ~) z# ZNote as well that you can easily detect this method with SoftICE:- V' Y9 W6 ^$ q0 W0 S
bpx Get_DDB if ax==0202 || ax==7a5fh
A2 F8 {0 a I. _0 Y1 Q3 t0 I+ p1 I9 f4 d% e' B
__________________________________________________________________________. f5 C, j J$ S/ D/ M
# M" n. S6 h- x7 D. r+ U( u1 fMethod 10- J4 H! d( H( v& p B* B
=========/ \1 ~2 W. U: [0 P* f
/ @2 k' L" [8 J+ I/ ?
=>Disable or clear breakpoints before using this feature. DO NOT trace with
# \5 [7 Z @1 Z4 {2 q2 s" o: b SoftICE while the option is enable!!2 Z4 T5 i5 O2 F. N1 a
1 c- w. |/ I4 r+ O- N& _1 {This trick is very efficient:
/ W$ s+ M9 ?, Z5 p2 N+ t: \by checking the Debug Registers, you can detect if SoftICE is loaded
4 p. O$ E n! e+ E(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
2 S$ `% g! z2 l7 Othere are some memory breakpoints set (dr0 to dr3) simply by reading their) H# @# F1 S( y% S5 k5 R
value (in ring0 only). Values can be manipulated and or changed as well
* ?, G/ p% k6 x3 S+ U$ } r+ M. Z(clearing BPMs for instance)
8 N4 Y+ v3 [1 ]3 ?9 S5 b( O7 K! u! P; f$ l. t
__________________________________________________________________________ \' w- ?$ z- @ B4 [4 b' A" W6 a
8 {. j- X* [+ u! X6 K" U1 V BMethod 11$ T) c# a4 Z$ G. A
=========
" ^5 u S7 s6 u# v" s' A5 P
' {+ V$ G! d& o# `This method is most known as 'MeltICE' because it has been freely distributed& o- G, i+ H1 k& m9 n, m" q$ C
via www.winfiles.com. However it was first used by NuMega people to allow
0 x$ E( P! X# b3 S, c; kSymbol Loader to check if SoftICE was active or not (the code is located
1 m! U! \9 B" i4 dinside nmtrans.dll).# r4 b6 r0 ?! Z5 H8 @. L
# n& i8 _2 R" J& h j, G0 H
The way it works is very simple:
% v0 R* Y5 R/ V0 kIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for; w( F: D" d) a6 R8 T
WinNT) with the CreateFileA API.
; J6 l2 n; D! T6 V1 l+ O( i- L1 n
9 f. R4 k8 i2 t- d+ f+ mHere is a sample (checking for 'SICE'):; p; L9 W$ \0 M3 O/ d
: f% k0 G& }( \4 L) D& ]
BOOL IsSoftIce95Loaded()
) A! I1 g5 ?9 R+ @3 p% h8 ?4 X Q7 O{
2 F: l4 t5 \ _8 m* o. e1 Z6 X HANDLE hFile; * z/ Y2 j6 j4 n+ j6 D) k
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,2 u4 }4 \$ s0 y& R6 c" a, R9 T
FILE_SHARE_READ | FILE_SHARE_WRITE,
& a3 I2 h" u. P, K) V/ q P NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
1 [4 K$ C i! u! O9 r' C6 ? if( hFile != INVALID_HANDLE_VALUE )8 Q" a( U7 n! ?# b' t
{3 N1 q5 B; Y+ n: q
CloseHandle(hFile);; X; H$ v: F# k
return TRUE;
6 w+ G' v8 @4 \! F+ R0 {. I }
1 ~- ^) k1 {, c$ ` return FALSE;- {; ?: g. J) S' n* E# M; m
}$ I: v: m; m1 O- Z9 }
3 g8 l4 k7 H wAlthough this trick calls the CreateFileA function, don't even expect to be
0 }# |1 R* g! A! s9 ]$ N t9 pable to intercept it by installing a IFS hook: it will not work, no way!
0 |: i0 k7 k& ?; q: a8 R4 C" cIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
% u2 q. ~, Y2 H% jservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)0 f% y3 c' B% Y# A* L
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
# @* ~4 |- R. d" tfield.% \! @0 s3 ]+ G! w; N1 f8 c
In fact, its purpose is not to load/unload VxDs but only to send a 0 l5 e" c; H3 L0 ?
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
5 S. D5 D1 Z+ V. zto the VxD Control_Dispatch proc (how the hell a shareware soft could try) r( R& i. V$ O1 d) r
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
: z d& Z% _. b- K( z/ bIf the VxD is loaded, it will always clear eax and the Carry flag to allow
6 m# R8 V/ r2 b* v. C Q3 Qits handle to be opened and then, will be detected.
% M" a; }" V) v, q' a: KYou can check that simply by hooking Winice.exe control proc entry point# T) x- \* }! J- z- m
while running MeltICE.
; O2 K+ F7 n/ a- A( |. P
3 X/ [/ M4 U/ U0 z- o) E5 ?" v' n' {# L! E! g d8 J- S
00401067: push 00402025 ; \\.\SICE! V5 }9 Y% S: b. p$ z9 a* [) v
0040106C: call CreateFileA" q2 d, s3 G6 C. p* Z
00401071: cmp eax,-001
: [; U( \6 D1 l% h/ N m/ \8 e 00401074: je 00401091
# t) h3 P* r7 \/ _. c, l# x
" b2 \; L8 \. |8 A. G- B
4 w' ]+ t7 ^3 t; JThere could be hundreds of BPX you could use to detect this trick.2 S% M# A- ]6 b8 u
-The most classical one is:
! p: t% e5 Y/ {% P7 ~, K9 z BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||* K1 s r b/ u! D
*(esp->4+4)=='NTIC'+ `$ Z% n" K: X! ?
1 Y* ]& C" C3 y( h H7 S& q/ J9 Y
-The most exotic ones (could be very slooooow :-(( g# a( g2 X3 N! F4 a- y
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
2 t- m q. m: w( b$ w ;will break 3 times :-( I6 U1 _1 Z" N* n! j C
) S. ]* r# h5 }: C, y, H
-or (a bit) faster: ' ~# [: M* S& |% ^! t
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')4 n. C8 S! C$ d+ j9 F& l
1 i1 _6 O' L2 h
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
' F0 P; _: R, }1 v9 N: C ;will break 3 times :-(6 U& N- _3 z0 b) R; Z2 d. ~
$ d N, }8 Q5 D
-Much faster:
1 _1 S! @9 f4 K& v; V BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
$ `/ g3 B" f3 w5 e9 h
" @( s g: {8 p: w% f! @Note also that some programs (like AZPR3.00) use de old 16-bit _lopen" p$ ~* p& [4 B) r( F
function to do the same job:* G7 Q, Z) Q! [+ |, k. H
7 A4 `1 ?1 U9 E& Q! N: [ @, s push 00 ; OF_READ5 X4 f$ b: Q' A: M
mov eax,[00656634] ; '\\.\SICE',0# \9 R6 Q8 r2 Y( @# M- z- q
push eax. L. T$ v. ^2 M" n! [
call KERNEL32!_lopen( b9 Z2 V, D8 V! ?2 C0 Z7 i
inc eax
, ]6 T& C! U4 f jnz 00650589 ; detected; P' Z/ J7 P" y$ U p
push 00 ; OF_READ
* Q; O+ Q3 C6 [4 y mov eax,[00656638] ; '\\.\SICE'7 D) K' G$ y0 H+ N9 i, X) R* Z
push eax
2 @ {: U' Y0 {) H call KERNEL32!_lopen4 v8 ^7 m! n0 Q. I; l4 i' A
inc eax
a2 U3 [$ M+ w; @0 m% t jz 006505ae ; not detected3 F8 L1 F+ C$ A5 o: y$ \+ k
' x6 v: X. ]# w3 Q: [, Q/ h( O
( i3 a, J. U6 i2 ]1 N/ g K s__________________________________________________________________________* N" ^! Y# c/ p6 C6 Y1 q* U
4 `5 O4 L; c+ d5 aMethod 12
# U, v+ G" Z d2 y- |1 Y) R; i; m5 a# N=========) ~% C s+ l% Z! {# ]- y' l4 G( v
! @3 v( ?; t: Q# I8 M9 ?This trick is similar to int41h/4fh Debugger installation check (code 05
1 l% t' N& @- a9 `8 x& 06) but very limited because it's only available for Win95/98 (not NT). N3 f4 d/ C# |- c
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
+ [6 j1 [6 v K. q+ v) v5 P
- s+ \& Q. w4 k) z7 k push 0000004fh ; function 4fh
|0 w0 j8 K* {5 d- f( o push 002a002ah ; high word specifies which VxD (VWIN32)! g* E7 T8 o" z [
; low word specifies which service
* N8 p0 [' y8 y (VWIN32_Int41Dispatch)0 G3 i7 `, i- k6 s% n4 u
call Kernel32!ORD_001 ; VxdCall
% p1 j& A/ t6 Y2 @; L cmp ax, 0f386h ; magic number returned by system debuggers; U+ Q. w; B# T0 s* B' P3 p- M3 P
jz SoftICE_detected0 j( c1 @; s" v( p1 N. }
' Q5 V+ u% {! v0 wHere again, several ways to detect it:9 p: E7 h/ r, a' }/ |( F/ r% r
1 }8 |1 ~: k' p3 j% l& _ w
BPINT 41 if ax==4f
* @) U( a/ i2 `+ H# A
& c5 n8 p/ O& A j( O BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one5 h4 z# E: r6 V) x% B
# H$ E% n @+ R6 Z9 p5 |* D
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A$ S/ q3 A' i o" {; `/ ?
! _- v# F: j$ H' B3 k( Z3 N0 m5 K; c
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
" B0 w' C' ~" V" H- w f4 T9 g) C B$ B7 d
__________________________________________________________________________
: V7 O+ ?0 C" F' |/ P3 v" r, y+ J, t( q/ U) |8 E( \$ ]
Method 13# c6 e$ D7 U( C2 f
=========' f/ t( F) k4 ~
5 T& U* n7 [6 D( J( d
Not a real method of detection, but a good way to know if SoftICE is. ], { B% a- k1 J L
installed on a computer and to locate its installation directory.9 i. [4 [( I9 G) V
It is used by few softs which access the following registry keys (usually #2) :6 e1 z8 U0 }: Q" S9 c$ J) E7 A) E
: _6 @. Q+ F" t5 p5 I. g0 n8 F
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion) D3 [* F6 m' \: h) t! a* Y: x
\Uninstall\SoftICE
$ M9 Z- }% k1 S-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
; k( ]. N$ A& u" l' x$ A, K8 ]% l-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
; z6 c' A+ F/ A1 A3 p, K* l! S2 K\App Paths\Loader32.Exe, c g' H0 i6 E# S* q2 P
+ M7 D5 |, Z# v, S/ P1 m+ ^( q# _7 K
Note that some nasty apps could then erase all files from SoftICE directory C$ u+ [% s5 \1 ]
(I faced that once :-(
* _& r5 V! y0 u# u$ A- [) _9 s2 g( o- p# q$ } s& x
Useful breakpoint to detect it:' G) U* p- F8 W: E4 q
3 u9 P4 {- P% [+ Z @3 y BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
6 P+ f3 g9 K Y. _' a
6 j w# W. y% ^9 N__________________________________________________________________________
4 m0 F0 ~/ g) n) u/ A, n# H' |7 S2 p' q# q/ J0 Q7 I
0 `3 F) P: [' G( w: c' m$ m3 B
Method 14
8 f* T. @% p( |6 Y. l0 j) k0 ^" b3 _=========; y) p% C& C6 J2 h4 e
$ v- A" S3 ? n6 ]
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
# z8 p3 {1 v/ X" I( n0 A4 His to determines whether a debugger is running on your system (ring0 only).0 L; z! M" y" H
, l9 @7 H8 v8 x1 L+ X' y
VMMCall Test_Debug_Installed5 U/ u1 F2 L8 v7 K; N: Y
je not_installed
# d% e' _; ^" W, K" r' t" y! E$ O* M- Z) L/ E3 t! s* A: |
This service just checks a flag.( x/ B4 ?7 c3 m7 @ I
</PRE></TD></TR></TBODY></TABLE> |