<TABLE width=500>
" s0 f, \& m9 S2 j* k3 R N<TBODY>3 q0 t" _7 k, y& d) L5 ^0 A" F1 p6 Q
<TR>
8 j, k4 S5 Y r, P/ k<TD><PRE>Method 01 6 {; l$ O; N8 D: E
=========
4 g) g- H. U# S; _. q- Y: _4 A0 y* a8 J5 o& o
This method of detection of SoftICE (as well as the following one) is
X8 T' j$ t2 T! s: _' M$ [0 L/ K8 [used by the majority of packers/encryptors found on Internet.7 W- `+ h# u- h: \! A* `
It seeks the signature of BoundsChecker in SoftICE
$ \; m% l: }- c$ H: N' V
5 d8 a2 K4 `0 ?% b6 E' I mov ebp, 04243484Bh ; 'BCHK'
+ H4 \9 o4 ^8 D* o0 w: }$ o mov ax, 04h
. B, a: ^3 O' i7 e& n int 3 0 b# N8 y4 ?+ O% e9 f
cmp al,4
& m( E( S1 j0 [3 [5 h2 ` h jnz SoftICE_Detected
" l# x: ~7 z2 c0 S
1 C6 m P' ]* m& E___________________________________________________________________________6 B; r5 y8 l2 D; a' U
' c% C, g" N1 d% ]/ MMethod 02$ }% D' c1 W5 j. h7 x
=========
0 q# r5 V' `5 P9 b: `) E
8 m: c7 w. L5 N3 n4 V3 gStill a method very much used (perhaps the most frequent one). It is used
) U2 v7 h% E q3 k6 l" p1 m8 ?to get SoftICE 'Back Door commands' which gives infos on Breakpoints,$ Y/ _" A) z* z4 u
or execute SoftICE commands...0 z% d7 P# q7 T
It is also used to crash SoftICE and to force it to execute any commands' l" Y- N( L( |! i
(HBOOT...) :-((
5 q5 p( {+ C( R% ?! y( ? b8 T' C$ |0 ?0 y: N
Here is a quick description:& G7 ^! }4 ^! T. n
-AX = 0910h (Display string in SIce windows)
& b: r! B/ [& u1 i* i$ J-AX = 0911h (Execute SIce commands -command is displayed is ds:dx) `9 M$ U1 z( O! {0 g) _
-AX = 0912h (Get breakpoint infos)( I& ^3 [9 Y; R6 U/ D8 h3 L3 S
-AX = 0913h (Set Sice breakpoints)3 u" g( t+ H' q* s* G
-AX = 0914h (Remove SIce breakoints)
0 c$ x6 Z2 u+ T) {1 x! j4 \1 x/ Z2 x3 `6 C3 [* ^: b+ |: }0 {- ~- n
Each time you'll meet this trick, you'll see:
6 {1 i; k0 `+ L-SI = 4647h0 p$ V D5 P7 E
-DI = 4A4Dh
! ^% g& s m$ z( \' ?+ lWhich are the 'magic values' used by SoftIce.
: r# \( Q5 _# e1 P6 r2 c9 G* zFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
0 ~6 o, F( t- B0 C0 |3 b
: S, `/ L: u" X: D& I- _, [Here is one example from the file "Haspinst.exe" which is the dongle HASP' e- l( F$ \( c: b e0 R
Envelope utility use to protect DOS applications:# U0 \" V+ P! A) m* y: L' i4 c* ]
7 L- h9 G: `! v- p6 O4 C9 Y0 C" j9 c
: C! W O( x, C5 M5 Z& M2 h `2 X, F2 l' T
4C19:0095 MOV AX,0911 ; execute command.
. ]3 n6 H8 D& P: m* z- ^4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
! ?+ R- t! Q& U4 } ~) Y4C19:009A MOV SI,4647 ; 1st magic value.
8 }) M7 R8 b- S5 K+ n9 S6 Z5 N4 Y! N4C19:009D MOV DI,4A4D ; 2nd magic value.0 E6 H5 u+ |0 a+ \2 a1 r2 o
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)8 _% c2 n" H+ C J( l: S! c
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute$ B0 Q* G3 M" L& l/ Y* ?, N2 K
4C19:00A4 INC CX1 J2 E8 _2 c- u6 S
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
# w T8 o1 T- O1 p. E1 }4C19:00A8 JB 0095 ; 6 different commands.' R; H, i5 a. e5 p r2 l2 |% |$ I
4C19:00AA JMP 0002 ; Bad_Guy jmp back.
8 x5 ~* P8 W) l4C19:00AD MOV BX,SP ; Good_Guy go ahead :)1 Z9 v! c# T y! k
9 s7 G$ z) A! f
The program will execute 6 different SIce commands located at ds:dx, which
1 }; ~+ E: n0 s! k8 X! Qare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
' h7 \1 \% t0 V {. a) a3 C2 W4 }, Q& K
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
; x: K# [5 O9 b7 L___________________________________________________________________________
7 _% T) I% M0 Q/ ^2 I6 M; g( H1 s7 v) \, z; p: d
! ?" i. W" q- U! p/ KMethod 035 x N" ^% M, Z0 [$ c; f
=========2 u) U8 B: [! y9 [! a- I
9 R( {8 C$ x* gLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
# _1 F; o9 D4 o& m(API Get entry point)! U; U+ g2 E b' F
; Y% J7 N& ~7 B7 o* S
6 H, H% ]' i% ]3 I3 }4 Z6 P
xor di,di
, p6 b& {8 w4 Q1 U1 o, }. x mov es,di: F- ~! ]8 V4 q5 @8 v6 y& W
mov ax, 1684h % k0 s% Z, ]+ ]
mov bx, 0202h ; VxD ID of winice
6 u/ v" [ c1 B int 2Fh
% L$ @1 y9 I6 g- r) J# {$ } mov ax, es ; ES:DI -> VxD API entry point% |- R# s. r0 \. h( M7 q" v. b
add ax, di
+ \5 \* \3 P6 S7 V% L" T* a test ax,ax C( W4 h6 U. O0 h9 q. ?
jnz SoftICE_Detected% `( }1 q8 N" {
" l# L! L) `$ W( j, r2 h
___________________________________________________________________________
6 N8 ]0 Y2 |3 s- Y0 u i# @3 m/ t I0 Q! @* Z
Method 04
y* d; l" X: C& N: V5 x _# z$ h=========+ n6 o& k& _$ o3 d4 _3 i2 d
7 p: C7 s& k0 f9 R- o5 p* HMethod identical to the preceding one except that it seeks the ID of SoftICE! ~) ?0 E# T" \* T
GFX VxD.
7 q; E3 V% E( I
- B: m+ W# J/ X2 _8 B f xor di,di
3 u, v/ [/ B( \" t+ D5 I5 K mov es,di
/ _* d# y4 G0 a& n6 s) G, F mov ax, 1684h
7 `7 x6 L- T R5 @, e% X mov bx, 7a5Fh ; VxD ID of SIWVID
" L. Z2 L) M1 N, M& z4 h- K int 2fh
, l' y% v( ?; {3 @% g6 T mov ax, es ; ES:DI -> VxD API entry point, l3 |3 {: }% O, X# a- {# |- A- v
add ax, di# }! E. H* H# Q
test ax,ax/ ?" n5 @& ]- L( `* K
jnz SoftICE_Detected
& i, }6 l- L6 M1 f5 X* Z
& G9 G/ |' i5 e& }0 | s__________________________________________________________________________! @6 }3 g# j) q4 j
; G/ Q" ]7 z0 p9 u
3 w! _( }2 C( `Method 05( t% |2 q2 ?2 G
=========
+ \: L+ ?0 F9 Q" u0 g L% X8 A V- { t" W
Method seeking the 'magic number' 0F386h returned (in ax) by all system
2 B9 I! ]9 a+ F; s* t% n( xdebugger. It calls the int 41h, function 4Fh.
4 N! @. X% b2 a1 R! W% U) e7 NThere are several alternatives.
8 X! h0 d4 I( I8 P/ T9 ~
$ ] Z! U4 |1 H& ~" ^The following one is the simplest:
, v& X" H2 f3 _# l" _* X8 G N7 Q
) G4 j6 Y4 h) |0 V6 S mov ax,4fh
* ^* h, h& F" ~, e: p+ k+ d int 41h8 Z& L# Z+ J3 t* L
cmp ax, 0F386
1 U$ z R9 ~ {+ x8 h6 {8 I0 @ jz SoftICE_detected
; q2 n5 l3 I4 W
+ T- F5 x( Z; H
0 b U2 l7 o; X0 S. w7 V5 m7 X5 yNext method as well as the following one are 2 examples from Stone's
; c, w* R7 `/ S1 M"stn-wid.zip" (www.cracking.net):( n" M, u1 q. y& A1 F2 U$ I' P' J. f
9 d* r. r& k* @& M: K$ J6 I mov bx, cs
3 d5 f# A$ s! @ lea dx, int41handler2
, _/ w% }, o6 j2 U X xchg dx, es:[41h*4]0 I* }' L& W: L0 X* i
xchg bx, es:[41h*4+2]0 b* h1 u8 L* D0 e9 x4 ]( a
mov ax,4fh: A1 J# O" V: _+ ~; ~
int 41h% U8 ^! |+ g+ p4 X. O" P
xchg dx, es:[41h*4]
T7 j( A H' v$ M8 T/ t( U( W xchg bx, es:[41h*4+2]
+ c4 @# H* u# j( K% S' x& ` cmp ax, 0f386h
/ {2 I; B+ I& }/ M: W# @ jz SoftICE_detected0 b1 A! ]: U2 F3 X
9 D1 U* [( y. s q2 J- F# `/ Y
int41handler2 PROC
& X) q. |! l& ]3 o* R! Q0 N( C' ]- x' v iret
4 n R2 R8 \9 i2 _int41handler2 ENDP
% F* \) X5 }4 d3 L: l
) k: l, `+ b/ e$ z* P) g1 t
. `" S+ \9 O# r1 V_________________________________________________________________________" x+ `7 x. L1 |& R7 Y: I
" b, b0 f1 [+ ~& H
( B2 M8 U5 f& T$ W1 F) P( }) BMethod 06
. c" v) U+ `$ }: R" @ B=========/ h! J- y1 W; d2 w0 K
$ l& x# N$ n/ `! u! |3 s& F! x
( i* E& Z7 V; s" _4 c& z
2nd method similar to the preceding one but more difficult to detect:: Z/ x( I3 |5 v9 y
1 i" ^- I* ~" @6 k1 Q7 V S0 M! t
2 A+ D @% |8 T; W" U. n: {+ Z% k3 @int41handler PROC3 e3 j. v) E" R+ G3 F6 d1 Z
mov cl,al% F1 @3 r. s6 s7 d3 @) B3 M( j
iret
5 Z9 i- a; Q+ A, y) iint41handler ENDP
2 k1 G8 D2 R& a8 H3 \; U
) s! ]5 O: `3 F9 u4 J# y/ P3 J- d# d# a+ Z$ }' t. A& s4 i
xor ax,ax
' J. y& h5 P, I1 O8 }' w4 b mov es,ax
+ n* |8 Y c+ c) |1 | mov bx, cs
' ~9 Q2 Y* A# `% B lea dx, int41handler
/ _6 t& d+ |# b' ?& m3 I xchg dx, es:[41h*4]
" u) K+ m) d# \8 @5 |, Y1 K0 H% j xchg bx, es:[41h*4+2]$ J9 B% ?& x" e0 m# R( {9 G4 w" c5 I
in al, 40h
/ i3 u) z; |% y% N, I xor cx,cx
& _4 ?; @2 X! j* A' S4 y int 41h% T1 k+ S9 e7 I& \8 W" ]
xchg dx, es:[41h*4]
' P0 @! X( ?5 {1 v, { xchg bx, es:[41h*4+2]0 l$ h1 P9 }/ ? `: K9 O' U
cmp cl,al
, T/ z3 Q; T4 y* S7 ^ jnz SoftICE_detected3 g a; \2 R6 f# M
4 [5 Q, y9 i$ g- s
_________________________________________________________________________
- g9 Q, q# S' d9 \; S& T, h3 a
% `' p$ M+ a6 t* V4 cMethod 07
0 `6 \+ E5 O8 l6 [6 L; z=========0 H" b, J! J) d2 e7 i8 Z0 C
" { b' j) U/ O5 U7 CMethod of detection of the WinICE handler in the int68h (V86)+ L) h9 L3 x8 V# o
, k* a* }$ F0 x6 N0 L6 ]6 _
mov ah,43h6 L1 E' m+ h5 C
int 68h4 L- L1 p) Q% r! |0 V
cmp ax,0F386h
0 P" s5 V' D. S9 p jz SoftICE_Detected# `! n2 a! H7 E
& ?+ S' s+ D: R! f8 I/ O c; Q
% R' f$ q h& F' W/ E: |=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit) N8 j4 t2 s* W2 f' r! O* F. W" b
app like this:
8 }4 U- K; ~* x$ m, u- [9 K& y& h" J
BPX exec_int if ax==68
# d0 t+ ^: G$ ?# ^2 K/ Y (function called is located at byte ptr [ebp+1Dh] and client eip is0 P0 [- v/ f- |7 h' S1 p! C6 Z- @
located at [ebp+48h] for 32Bit apps)* I- B( l; t3 `! G
__________________________________________________________________________
$ R( O; T5 w% h _" p) e- d3 `; E% N6 G4 f/ r2 L, A5 q" H, O
/ T, Q( n4 F6 A. a$ u3 Y* O0 O: m
Method 087 r+ Y. F Z' |( M: u% f2 _7 L a, v
=========
* w" ?$ h% P \) I" [. p. q2 K! E3 I! H" q
It is not a method of detection of SoftICE but a possibility to crash the! U, [! f2 f- F+ i# i- D% l
system by intercepting int 01h and int 03h and redirecting them to another
: B- d$ g2 S8 l( |( L8 [routine.
: ]$ q: G( ^+ p. W3 X5 o1 V; uIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
4 m9 O$ L1 e( a! T1 k' gto the new routine to execute (hangs computer...)
|. |/ s: h" F8 N( m
4 N7 U! z( l( O! [% W) v9 l mov ah, 25h
- Z) U1 D2 D; w% Y u3 b mov al, Int_Number (01h or 03h)
8 i9 u7 [( i5 m! X/ ~0 | mov dx, offset New_Int_Routine$ f& P- b! o3 I; D- Y0 b$ z/ e
int 21h& |* E) D( P. ]$ O
. k/ n* g; [& D) B4 t
__________________________________________________________________________
3 `0 d# d' x! @- U$ C( w9 W6 T7 d. Q+ ] R% _: x' ~1 D" C* Z. Q4 H
Method 09' K* S( ~3 I7 Z) X
=========
0 E: g+ `# Z" u1 P. N1 D, k! U/ s; H7 w" ?
. }! n. K( C8 @) p6 w }This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
! r% {1 z$ D: y# h; Z$ Hperformed in ring0 (VxD or a ring3 app using the VxdCall).1 g" V( R4 w# v% Y# g* G
The Get_DDB service is used to determine whether or not a VxD is installed
2 v% I; k4 P! Kfor the specified device and returns a Device Description Block (in ecx) for
6 E7 w+ h& W5 sthat device if it is installed.5 g% W6 [& I0 a4 W, _0 d
' u2 o% h0 P2 s* l) ?( I mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID! C0 h# r' u* Y2 x0 y
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)7 {- E9 z/ U. \) u# G6 E
VMMCall Get_DDB
( s4 b0 r4 t5 w, D7 q" F. h! J mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
! T* M/ l: A# w' Y- z1 Y% D( P' \ P% K' z7 k- L# \( d2 z
Note as well that you can easily detect this method with SoftICE: e( Y0 l( a" B' K
bpx Get_DDB if ax==0202 || ax==7a5fh& C9 I4 }8 U7 E; t& }$ X
0 V/ w( J- a2 ^# L9 m' z0 E__________________________________________________________________________$ L+ O7 P) a$ \, W( k4 @
; J% e. f; ~2 E/ n+ J- l' |' f$ w
Method 100 f9 Y9 {4 g6 d, K
=========1 z) l Y+ P w; i
# }+ ^ F% d. s; \1 D. D# z2 C=>Disable or clear breakpoints before using this feature. DO NOT trace with; Y8 j8 v. Z( T
SoftICE while the option is enable!!
, n( H7 M: v8 l$ g( L7 f
+ E D# x {9 W* K% ~0 eThis trick is very efficient:
9 l( u/ K" X) ^9 Tby checking the Debug Registers, you can detect if SoftICE is loaded" j+ l6 c8 ?7 B, G
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if1 }; A+ ]3 f& o* N1 k
there are some memory breakpoints set (dr0 to dr3) simply by reading their2 H! M$ B% b- ~* \% F) e2 C7 F
value (in ring0 only). Values can be manipulated and or changed as well
5 Q( u: Z: Q K1 d(clearing BPMs for instance)
& n$ S4 q9 |7 [$ T5 ~( `- ^7 \& Z( I+ p% s/ C
__________________________________________________________________________
" U" ~3 D3 ~1 `6 k K/ G: P0 f, q% r3 Q" Y; ^" Z: _/ _
Method 11) U2 o+ r$ P# ~# c: y! I1 Z; v
=========
5 F2 K& B- I+ d& c9 X
7 P% Z0 L) C$ tThis method is most known as 'MeltICE' because it has been freely distributed
2 {/ g4 w) g5 Vvia www.winfiles.com. However it was first used by NuMega people to allow
0 p) r6 i; G8 x. c; ^/ hSymbol Loader to check if SoftICE was active or not (the code is located; h! H" a3 R% H
inside nmtrans.dll).
6 h1 c. A# U0 P/ C4 {& O i* B0 V1 e/ r/ P5 i9 P9 P( s4 N
The way it works is very simple:
/ R* t) @) o# GIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
0 h+ K- G. p/ t, u, f* q% F4 e8 @WinNT) with the CreateFileA API.
8 g# [* c$ Q, i
' a1 U$ _, p7 b* y: zHere is a sample (checking for 'SICE'):
4 r1 g! s8 n7 }' P: j! g) k
- R5 N" \$ R6 J" w; bBOOL IsSoftIce95Loaded()
$ Y5 H5 e; Q% Y5 Z{' r# t) F3 e3 e1 P' ?# f: K D; C$ ^, ^
HANDLE hFile; $ Y% ?' U$ r7 S P; ]2 q6 T% ]
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,( e( l4 L* s8 k. y+ B9 z3 d& E
FILE_SHARE_READ | FILE_SHARE_WRITE,: \( p: r$ @ ~, d
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
4 s7 c# y- U: h if( hFile != INVALID_HANDLE_VALUE )/ y) X2 C9 R/ _
{
* D' ~3 [3 [. T5 d% y: ` CloseHandle(hFile);
1 Z, N) G) }1 X! X return TRUE;
- B' [8 d, H* A$ j }2 l: ^% i4 H5 o) B1 h
return FALSE;
% g& W7 g7 N; _6 D$ I% R}! m$ |9 H9 b% x1 E/ W- d
, b2 I! G8 ~$ j) ?: HAlthough this trick calls the CreateFileA function, don't even expect to be
! t$ o P7 i; H% y' J$ aable to intercept it by installing a IFS hook: it will not work, no way!
, k- W8 |- a; b- GIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
0 W6 T: k$ y5 s0 mservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)3 t d0 {' S2 R) b6 j: I4 w
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
5 p& B, n/ _" v6 Sfield.
6 s9 n" o: \& `' ^& d6 Y6 j5 VIn fact, its purpose is not to load/unload VxDs but only to send a + A% t8 U5 |1 d% W& k
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
) h" J! }4 v: x; _1 J$ e# Rto the VxD Control_Dispatch proc (how the hell a shareware soft could try$ s2 Z) G& r( L
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
' e- M* c. Z' J V4 GIf the VxD is loaded, it will always clear eax and the Carry flag to allow
' e6 v5 w1 H+ G) |7 X9 tits handle to be opened and then, will be detected.
: L0 \ J% W7 V+ e+ b/ OYou can check that simply by hooking Winice.exe control proc entry point, t7 X6 X1 {( z0 o+ l# X: ` ~
while running MeltICE.' @4 T+ v8 Q( F' {
4 F, u; H, S! ]! Y7 ?0 @8 q" d& j$ K
{- c3 S$ I7 ?- ^0 G& n9 y9 W 00401067: push 00402025 ; \\.\SICE
0 `2 ^" Y% B5 _5 Q% ^5 Q; o! s 0040106C: call CreateFileA
4 i. B0 X$ ?- ]7 x 00401071: cmp eax,-001
0 x; G8 Q1 }/ a9 y 00401074: je 00401091
; c- ]. v0 h$ p9 E" z' ~+ J' F7 P; q1 P9 @7 P7 L; o! x% n5 U
/ a% v+ J: ], }* {( T `There could be hundreds of BPX you could use to detect this trick.( s* `- H( O4 Y9 i4 l6 p q
-The most classical one is:! D( Y$ a0 V' h" E
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
! S+ {9 H3 U1 A9 S0 y *(esp->4+4)=='NTIC'- q; [3 S* r E9 w4 f2 t
- Y$ T2 x& }1 z2 E. T. o3 o6 f* |# [-The most exotic ones (could be very slooooow :-(3 U1 n+ p, J6 Y% W$ j6 c
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') 3 C0 `+ _+ _5 s: V0 Y% B
;will break 3 times :-(
4 _4 d' [4 B7 |% F
& l4 b; j. U9 Q* b+ u-or (a bit) faster: : y7 x; O7 ?3 P
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
7 }4 S( _$ a# Z0 M5 r) o" u" f/ {* S6 z. i8 p2 z4 @
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
6 }( g8 o6 w4 }0 j/ a ;will break 3 times :-(: a' ?5 D& H' S2 E. r. m& S
/ _4 h! R2 N6 u
-Much faster:
6 M5 V& s' U$ D2 i% w0 Q BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'( t3 G3 e/ O2 [
% U5 q! ^8 F1 {' i* H3 R+ bNote also that some programs (like AZPR3.00) use de old 16-bit _lopen7 Q! M t" M$ e
function to do the same job:
( ^* r, H- ~% ^( H& r: v
! x: t9 q- {# y' H& O9 Y0 C push 00 ; OF_READ$ r! W8 }$ J: U1 Z7 g% `
mov eax,[00656634] ; '\\.\SICE',0
0 W0 v* V. `/ i9 j push eax+ j3 `+ Y1 Z% P8 o
call KERNEL32!_lopen
+ Z% ~- o, l" i9 W/ I# s inc eax
1 C" O) Q; x& k" J) n& @2 E jnz 00650589 ; detected
% B: q k, M3 o& f push 00 ; OF_READ
% X+ o) u4 Z% X) ?1 d mov eax,[00656638] ; '\\.\SICE' ?! E9 z. j! |# N+ n" U3 O
push eax
; c( k' a; |1 `% `( B4 O* R1 t$ e8 H call KERNEL32!_lopen
) }" C- O! s5 A3 X0 Q' |) f5 H% S inc eax$ n+ d1 H! A+ s6 t' q8 G0 v) Y5 F
jz 006505ae ; not detected# Z3 Y% K" f) h; r
( |9 W A' S s$ t; ~/ I/ m9 I9 \# C, a$ Z, v2 v( y, T
__________________________________________________________________________
% t0 R& p+ b. U6 ~9 t1 N
. Y% s: Q1 y D, T0 VMethod 12
# F) C, [) L3 s% D$ K=========* P6 |/ I, F. p* r" @ E
* u) X: F# c* d1 T3 x; ]This trick is similar to int41h/4fh Debugger installation check (code 053 \1 m: p, s U4 [
& 06) but very limited because it's only available for Win95/98 (not NT)) F/ w0 m+ q. q: C5 u; t
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
* N* Y5 V( V1 ?9 w+ t
9 u" w8 b5 A8 H% m push 0000004fh ; function 4fh; o6 P. {$ ^- u {
push 002a002ah ; high word specifies which VxD (VWIN32)$ Z8 u5 \5 z3 V) i) F; x; X/ _! z' V
; low word specifies which service
* c( o: ^( U5 H% C, @2 t (VWIN32_Int41Dispatch)
' z; R0 g' H2 T: E, z. V6 ~ call Kernel32!ORD_001 ; VxdCall2 _$ A: M2 P' s. k0 F! C
cmp ax, 0f386h ; magic number returned by system debuggers8 k* l j5 ^3 p; W2 {
jz SoftICE_detected: ?; \, Q9 c& K$ ~. I9 g; g& e1 G
G0 A, ]& J; z- D$ u! b
Here again, several ways to detect it:
+ m& t. _; S' O0 S; H8 E! E' \& z4 N' W
BPINT 41 if ax==4f% \. O7 N4 N2 b
& C" B; a" V j# Z& W5 c! f5 @4 y BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one% U* m$ `* Z3 J6 s6 d1 c' R: h
+ P" I' n8 N. I6 n0 q3 w: J' L9 W x
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
@: a* {' r$ N2 N, t4 C
1 i# k4 A# }8 V( F1 o1 w BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!; J0 S8 ~- w# o. S" W+ Z8 j
. {* n* W" C6 C0 s% L1 Y__________________________________________________________________________
. l( F1 Z( [2 _/ y; U; q) M& e, Z+ j: c
Method 135 W2 i" I) y' x9 ~1 R" ?
=========# |% b% T1 h* _5 N) P, _$ y& ]
) ]" v: Z: b& \2 N( N, i
Not a real method of detection, but a good way to know if SoftICE is
! t, Y# Q+ P' C4 i, Ninstalled on a computer and to locate its installation directory.9 J# c! t; j4 m4 [ n# c# R
It is used by few softs which access the following registry keys (usually #2) :
1 v! b, `, x& Q6 Y5 s# X; }) t. J, L# q( T/ ~
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion& a" {% Y* n0 O
\Uninstall\SoftICE! r; u. m* F+ N; @9 g ^; H/ e
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE6 Y1 [( W5 V5 O1 Q1 N, f- y G2 R
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
8 w! e5 q6 B8 ]8 A! s) ]- R- q# }\App Paths\Loader32.Exe
! m/ t9 H5 h" |
7 h5 w3 ~6 ^3 P# k3 _! \6 z. T2 `) {
Note that some nasty apps could then erase all files from SoftICE directory: p8 D. e7 p! Z1 b/ m4 n6 V
(I faced that once :-(, `! k4 n) q' u( P) @
3 f, y/ w6 X; E
Useful breakpoint to detect it:
; i2 c# {2 `, l6 O. Z1 M7 ^( _ H5 r
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
9 a+ L3 h/ Z/ ~7 q# B( O% X. m
; Y8 n0 \0 I6 @+ d__________________________________________________________________________
: d# { w+ S. U$ p) ]
1 H* U( a Q/ R. u' c! @4 x; B7 p) @0 Q8 O! l
Method 14
' `# r$ P. _& Q1 z=========! }. e& }! T) |. ]' O
: y X n+ H s( c
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
' L& u6 n; Q1 n. vis to determines whether a debugger is running on your system (ring0 only)./ A9 M+ m+ P8 ~5 D$ T
+ l; h4 S* R% L/ A, P VMMCall Test_Debug_Installed
8 L. E' v9 s& v4 q/ }" y je not_installed- K6 A: S5 j& h
$ n! Z# V w6 |# b
This service just checks a flag.
9 {. H! j6 F3 W) \: w" k</PRE></TD></TR></TBODY></TABLE> |