<TABLE width=500>
) B4 J J8 L, T. T1 Z<TBODY># n& S7 Q! c, N
<TR>4 I- ]1 A, F+ S! C& s2 M
<TD><PRE>Method 01 - y9 V% I/ @6 D2 K" I
=========0 F: D% r9 f. r! B8 ]
/ [) q' s, r' R8 @
This method of detection of SoftICE (as well as the following one) is
) }! |9 D7 r! _- Q& r: U& d6 \: }, X; Uused by the majority of packers/encryptors found on Internet.
4 R8 p; p* U- O9 \& p* fIt seeks the signature of BoundsChecker in SoftICE2 V. s- F' V* O1 R V: x. N+ h
7 Y* Z! l& I0 O& ]! _7 n
mov ebp, 04243484Bh ; 'BCHK'
5 ]) L' G$ c& @7 c. J/ t# H1 h mov ax, 04h0 d$ x7 p6 F: q0 d g7 R6 s; f
int 3
- O3 r) G S2 P) w6 X cmp al,4# m, B' X! |# J1 W- T6 p7 x) l
jnz SoftICE_Detected
: @) y5 C; \0 H$ y
3 `' t2 \" n: r3 V- _2 t5 F9 O___________________________________________________________________________
& i% |; O9 Y1 A1 u' J2 T9 D! ]# d1 K1 Z c, J2 |
Method 02& [+ s8 N( K3 P4 B5 h) d
=========
; G7 A! f( l9 K. F2 F9 n* t T6 w+ h$ N" P& T8 C; o) B
Still a method very much used (perhaps the most frequent one). It is used+ c; k7 i9 K7 j0 N
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
9 P' r* n' V- M: B5 F6 }or execute SoftICE commands...
2 l, M: E& J& h/ F- U* vIt is also used to crash SoftICE and to force it to execute any commands
4 l2 H. x6 ^8 `; J. F(HBOOT...) :-((
) M7 u% G$ B5 r7 ]" |+ h9 F9 a5 J6 c2 w* S: Y1 V
Here is a quick description:' l$ b, J9 n0 d
-AX = 0910h (Display string in SIce windows)$ O- ]# e& }2 Y% P/ k7 c
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)6 t7 M% ~/ S4 s+ r
-AX = 0912h (Get breakpoint infos)- Q) q8 u0 n. z% J ]
-AX = 0913h (Set Sice breakpoints)
' P) M: I8 r' v& {-AX = 0914h (Remove SIce breakoints)- ?9 e$ b p7 [) U- U, L( G
$ r; K( U; T. K" q( U0 B5 K/ ^Each time you'll meet this trick, you'll see:- w. @2 g( Q5 J5 e, H6 g" O8 g
-SI = 4647h3 a% y# w% L- |: Q, g3 ^4 z) S- O! ^/ c; ^
-DI = 4A4Dh; S# y) g/ F2 i: \, s4 Y8 K9 X) V
Which are the 'magic values' used by SoftIce.
) e& t7 ]7 `9 D: ]' K) W/ hFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
7 D% K) w P3 ]* J7 i% p
, N' _; C2 v+ f, w2 ?; N! EHere is one example from the file "Haspinst.exe" which is the dongle HASP( ?) i! j8 j' f* U: N& g
Envelope utility use to protect DOS applications:& C. j5 p9 M4 r: w8 z( n- |
5 r2 n) n3 P) G5 Q4 a1 `% \* Q n
$ k, L) k' \' I) o$ [1 C
4C19:0095 MOV AX,0911 ; execute command.
. g. H& r1 p$ l7 w3 ^3 b4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).% \' G) p. j" D h! I
4C19:009A MOV SI,4647 ; 1st magic value.
7 k$ p/ d3 ^( u) R4C19:009D MOV DI,4A4D ; 2nd magic value.
0 Q6 G' ?1 M9 X4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
3 @4 c0 |8 m. J7 x4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
% ^. G3 R$ f9 X( h9 R4C19:00A4 INC CX
9 e9 X0 _" I8 Q) J9 U# D# d4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
- Q& G7 m- }6 d6 b/ |) D4 R4 u4C19:00A8 JB 0095 ; 6 different commands.3 ?8 |( ?) _+ c" f/ L
4C19:00AA JMP 0002 ; Bad_Guy jmp back.
& {: ~! B1 a Y4C19:00AD MOV BX,SP ; Good_Guy go ahead :): F# ~ t+ O1 Z# A( J
7 H$ Y) }' M7 S( `' vThe program will execute 6 different SIce commands located at ds:dx, which
0 n/ J, M- r1 x- V- C. Y& c$ B$ p& Aare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
p( ]6 I4 T: ] {! P! T) W2 Y5 k7 x: L; z0 `: P# I0 G
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.% ~7 [6 ]2 Z6 j9 s; u4 B
___________________________________________________________________________
F2 G8 h6 U) a
: O+ s! r) D8 \3 B" N4 j g
; B0 `9 a8 I' \: M* F# i" j6 qMethod 034 k, r/ J( P9 C, R% l* S3 O
=========
2 |% }4 ?1 |( R- f$ E7 Y) d
* M$ l! _# L3 Y' jLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h w \3 z8 d; R1 B9 I( A
(API Get entry point)' }# z1 {5 u( X8 {# M
H$ F% _3 B# i/ G
% P0 ^+ ^; d. k2 ^& [( v: P7 V xor di,di
% m5 J2 Y5 ]* v8 |/ g. w; N; F6 b6 D mov es,di
/ l( D P4 @4 l F0 f0 l8 W1 Z mov ax, 1684h
+ S9 ?5 g+ u3 v5 K mov bx, 0202h ; VxD ID of winice7 J# F4 f# ?+ N# j! p! @
int 2Fh
. B! x: m9 y E7 p+ J e mov ax, es ; ES:DI -> VxD API entry point( R# w: |/ c [: D9 \: O4 S
add ax, di
* L' A0 q/ ^; f test ax,ax/ P! {5 s! [! r1 \) M5 t' @
jnz SoftICE_Detected2 @0 ]* {/ b: W8 P* u4 _
& o, q9 C2 K8 \ B
___________________________________________________________________________9 M2 Y: R2 |7 _+ B: L' a$ p
. Q' {9 p3 {4 [: g1 j0 NMethod 044 N9 m {1 z" @5 N$ J; K8 h( o: V
=========
; f2 W2 M6 L: l0 Q( `. P8 p# g9 C+ G' l) L1 k
Method identical to the preceding one except that it seeks the ID of SoftICE
5 f) U. P) I0 c- @3 Z1 Z7 mGFX VxD.6 J3 T" ~0 R3 v. V6 ]4 _
" ?, @" m1 D6 `# D" z9 ]
xor di,di
! K! y# P! e: Q* l1 N& H mov es,di& z0 {, s$ F: V) ?4 l+ F+ ^+ V# b
mov ax, 1684h
2 I& w7 K9 S2 P8 B F9 k mov bx, 7a5Fh ; VxD ID of SIWVID
4 _! F+ D0 B$ @- r( F% W int 2fh
, G* d3 d7 o, Z- _ mov ax, es ; ES:DI -> VxD API entry point" l% T3 _7 R0 r/ i# c3 j
add ax, di( `; b6 ]$ h8 c
test ax,ax. K9 K2 i, E' u! a- A8 w
jnz SoftICE_Detected
# d) v3 \+ j4 s v) }' L
. \7 v% o p' \1 @__________________________________________________________________________3 [9 {3 r- q$ Q
5 a' u5 |" A4 q! `2 N; G) x$ u
6 a$ c. g& h- A6 H) ^Method 05! T+ B0 c+ h1 o3 c+ \, |
=========
, V9 Y: [6 Q' }( l/ `0 {0 r) T4 x$ q4 R. I9 N% q
Method seeking the 'magic number' 0F386h returned (in ax) by all system
( e, h% s' {* xdebugger. It calls the int 41h, function 4Fh.
4 H$ J7 k7 p1 E' p X# l$ Z& L* tThere are several alternatives.
y& o9 N" Q; _ O8 H+ e3 s* k
- M1 _1 _9 l b d- U5 I" mThe following one is the simplest:5 E' L% v! r; p2 I; c
' m- k( F' A& l }) f
mov ax,4fh
7 k2 @& D* A6 \; p int 41h
7 }' Z _1 F9 O$ O cmp ax, 0F386! o ^8 A* L* p5 w) V
jz SoftICE_detected
, F! m% H& S8 z7 q3 H+ d. M# X$ i {3 a; `
" D l, n( s+ QNext method as well as the following one are 2 examples from Stone's
. a2 d) S' s2 @6 ]0 U"stn-wid.zip" (www.cracking.net):
; q1 R$ J( a9 L# C/ n9 r9 \7 T+ V, C% Z) y: a. i
mov bx, cs4 K4 T( Q8 ~2 v+ @
lea dx, int41handler2
3 l: C. `! v+ S) D! U5 e xchg dx, es:[41h*4]
) d# k7 Z( p3 E: ]2 w, o8 Q8 Y xchg bx, es:[41h*4+2]
4 k; K) h" W* E/ w mov ax,4fh
; Z# n o; g; b9 m- s1 V% X( n int 41h5 p( D4 P w2 h4 N; n
xchg dx, es:[41h*4]( Y6 m- \: p+ z+ F7 `5 f
xchg bx, es:[41h*4+2]
! A9 z6 m, C% x: T cmp ax, 0f386h
$ W4 n* [ Z$ |0 z! O4 R jz SoftICE_detected
" J* @8 \. n7 W
* G* I h3 V& {4 F) Q: Qint41handler2 PROC1 F) R- b/ c$ u5 U$ E5 t
iret& A6 S0 u2 I3 r6 e1 T1 ]
int41handler2 ENDP
1 c- v. v* B4 X. W( m9 v e1 ^1 H
: Z0 ], D5 i3 [+ [& P. {" l, O X. K) {$ ?" e0 Y) a- i
_________________________________________________________________________
! n8 h8 W- P# M7 e# q+ p" E3 ]0 a
- W" |: G& s- K1 w% X8 o6 S8 F3 \- G- k) o8 y
Method 06
5 A) H7 b- t& p=========3 @1 w- O5 L; T. a# t- U
; _% {$ G: \3 `. [
, Y4 ^8 i! } f! G7 \2nd method similar to the preceding one but more difficult to detect:2 k6 D) \1 ~( w2 U
% U# }) \7 C# e S$ W0 n9 i* k
( k" \5 Z" D/ i0 X" X- T+ W' t/ Zint41handler PROC
( g9 a' n6 \* A2 G mov cl,al
2 S! t3 j" V# S* H6 } iret8 I3 I8 S7 V9 B# [% m# a$ m
int41handler ENDP
9 N: C, `* l% h9 ~. h
. n' a7 p4 w( \3 A6 a1 W7 i
& M e1 h* D' j& K xor ax,ax4 ^& g1 b# @# G, }2 y$ u- s
mov es,ax. F8 |7 d; ?2 D
mov bx, cs
8 ]2 z+ n. {) a- F, P$ I/ G lea dx, int41handler( l/ R/ X/ f" B5 z
xchg dx, es:[41h*4]( M3 X* o/ b7 `( O
xchg bx, es:[41h*4+2]
$ p7 U. Q% m2 _; o in al, 40h; b% r/ R& B, T6 N: k
xor cx,cx3 Y8 ?0 p0 w3 d+ U
int 41h
: l& j) U; |" f( C& z/ \ xchg dx, es:[41h*4]& n7 L5 [9 ^+ x+ k
xchg bx, es:[41h*4+2]4 T+ _7 ~: h' c( h7 \1 z% m9 p
cmp cl,al1 ^) y& Q. O' r. M% { T9 d/ G& G
jnz SoftICE_detected: c! E. N" a# b, m
2 P+ ]7 s& g( t6 A# |2 m5 |_________________________________________________________________________
$ y9 |( z7 N& I: `9 \& n6 x* `; x1 ^0 z6 p# k: o
Method 07
M7 w3 d# ?+ |( p=========, k( A* e( r/ w3 T
1 i w5 A& S7 i8 k- i
Method of detection of the WinICE handler in the int68h (V86)
0 g3 z2 p6 B7 t8 z: G" T& k# [( M9 c
mov ah,43h0 ^$ \( S! E! W( U
int 68h2 K. O1 {% J0 r% |6 r
cmp ax,0F386h
- ~: j6 F; ^& Z5 M/ h1 j jz SoftICE_Detected2 B, O# ` y/ V) l8 ]0 L1 s' `. D7 G
9 d6 J. M4 T1 w7 M- q7 Y
* r' N' E* ^! |& C=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit( f0 ~7 D8 L9 `. C. s) z
app like this:' n! U |8 {) f( r7 h7 F, N
+ n. E7 @& v. \# L5 g. ?0 ^
BPX exec_int if ax==684 D9 q, e. z% |: K4 ~6 b& _# i
(function called is located at byte ptr [ebp+1Dh] and client eip is5 O( K, r4 z% \1 X
located at [ebp+48h] for 32Bit apps)
( N6 t2 ~' M# ~! _2 t__________________________________________________________________________
$ u* v0 h8 y: P' z; Q' m6 o: ?
; T! P0 z. g* W* Z; e$ T/ u6 ~+ U& w( D: w
Method 08' ?3 w8 L8 d# X7 H+ Q% ^
=========
/ F4 [2 [7 z; [- G
! t" u5 U& ?: L8 V( g9 oIt is not a method of detection of SoftICE but a possibility to crash the
# t2 i5 l# u% [7 Nsystem by intercepting int 01h and int 03h and redirecting them to another
5 A( i7 h" a+ ]/ F3 k$ b5 eroutine.* a0 C4 V2 }$ n0 w0 S
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
# I! p( ]/ ]# U& z f8 Q3 @# Wto the new routine to execute (hangs computer...)
3 J% ^- \( E7 n+ t% L; m' B9 C4 T" u T1 j7 y3 q9 g0 O
mov ah, 25h! v: H# g/ b6 O5 j3 {+ S
mov al, Int_Number (01h or 03h)
A( z% `, G* B+ e i% ]- W mov dx, offset New_Int_Routine
9 M6 y9 C$ R f8 D' n5 e) D: S+ o int 21h
$ A! K! D2 \: ?) Q$ t* I h
$ r2 K, R) a+ V1 k4 t; v__________________________________________________________________________
$ J- n8 J: ?' Y$ x$ k& O6 G. u& r% b: c' F/ t& \
Method 09
: t& \: w2 h: K- F9 }: C=========4 c+ J: S2 |: R: x
' d% K, B% z: ~3 O, rThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only# k, d( I; z, W( @8 d
performed in ring0 (VxD or a ring3 app using the VxdCall).
; N% S& `- F: ?2 y5 CThe Get_DDB service is used to determine whether or not a VxD is installed& g5 L! i' y, h
for the specified device and returns a Device Description Block (in ecx) for
: e% C) v" J9 L9 a7 jthat device if it is installed.7 f$ ~" {" M) J+ T: T2 m- T
! F0 ]/ l( z- j. c
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID* r3 |0 q3 P# s
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)$ X2 j. w; }( c3 w
VMMCall Get_DDB% a5 o1 F" @) e2 W1 d6 h! ^
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
# M3 B' i/ B3 C# }. r W+ S. _6 x; {
Note as well that you can easily detect this method with SoftICE:
- j* Z2 k) {0 U; C bpx Get_DDB if ax==0202 || ax==7a5fh( C) j, R) r! L6 v
& h, K" B* ]! z8 R8 w__________________________________________________________________________: M4 K( ^0 }5 A1 P$ P& s
* c2 b2 b' l% ]Method 10! T3 d% Q0 }: ^: a
=========& i, D% Q4 ?+ d$ i
, J* I9 ]+ u( H4 U. w/ Q=>Disable or clear breakpoints before using this feature. DO NOT trace with
& n' [/ s; {2 l SoftICE while the option is enable!!$ x; Q* r9 }/ d' X
8 a8 |( [0 E7 d% E2 D6 s% M# p# L
This trick is very efficient:
4 p; s- b! f0 Vby checking the Debug Registers, you can detect if SoftICE is loaded: }6 u5 P! {4 r2 c$ V
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if. p* q9 q/ d; g' ]6 `
there are some memory breakpoints set (dr0 to dr3) simply by reading their
; m. j3 h$ j+ qvalue (in ring0 only). Values can be manipulated and or changed as well
2 m) u) f! `$ I% }(clearing BPMs for instance)
$ b; R1 J3 ^. O, c7 ~5 P4 D% \1 u1 u+ i: i( m: M% [2 a
__________________________________________________________________________7 C! K9 N8 h O
' R( s9 u" D$ v$ V q
Method 115 K- h6 }7 L- x7 o' V
=========% O o. s/ N6 `$ }3 l1 I) T' L
F" T. {0 d. u3 I0 g$ H' X+ QThis method is most known as 'MeltICE' because it has been freely distributed; `2 R# ^; L, p8 y4 `
via www.winfiles.com. However it was first used by NuMega people to allow
6 D, b; B4 N* i* v* |0 i) b+ c+ FSymbol Loader to check if SoftICE was active or not (the code is located
: f1 O Y' `; e& g) Kinside nmtrans.dll).# f" i& K. ?8 Y$ g+ H9 q
: o0 n7 m9 | i. wThe way it works is very simple:
0 V$ [2 s" d; T6 ~- k. o2 pIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
" A# O( h3 C1 v/ s N; d+ R% JWinNT) with the CreateFileA API.* Y6 {8 z" U% t) n& F
" @3 V6 [# m, t' k d$ OHere is a sample (checking for 'SICE'):
9 T/ {% R' V6 i! ]9 _" {2 Q; `- v8 c/ B: U! H
BOOL IsSoftIce95Loaded()
+ o! i- b" }& n, G% K( N, I{3 u" U% q+ n$ L3 w
HANDLE hFile; 4 D1 {2 S- J/ a
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
( p: n( o$ p8 I FILE_SHARE_READ | FILE_SHARE_WRITE,
1 Z' D' V& l4 Q8 N8 N: C) u NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
U* }# y F' T if( hFile != INVALID_HANDLE_VALUE )( Q: S" C( k4 z' g' D) ~; u
{
/ Y" e$ }% W# o; M$ n- H" K CloseHandle(hFile);4 R4 X$ _8 e% w; l
return TRUE;" C* q6 [/ Y% p) ]" p
}
: g* v4 W* v4 u. y0 M7 `0 o return FALSE;0 a% x- |( e. B
}" \3 L: M; x/ Z: W/ f2 x8 B/ t
8 H- F. S/ B: CAlthough this trick calls the CreateFileA function, don't even expect to be9 a, {) m, }' b. v9 G0 F/ R# I0 j* h
able to intercept it by installing a IFS hook: it will not work, no way!' u U8 J3 z w, p) e) u/ }/ X( D
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
1 @" _0 H1 j* D: _$ _% H( e) X) Iservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)- S* K6 ~+ O) @. _# q% q6 C
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
) _2 T: u0 A% g L3 jfield.
/ R: g X3 F3 x: eIn fact, its purpose is not to load/unload VxDs but only to send a
, {9 E( b' W+ w' c# p/ V* Y: }3 LW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)7 e, C7 f; }( l/ ^ _
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
6 h8 W/ w+ o0 H4 z. z! dto load/unload a non-dynamically loadable driver such as SoftICE ;-).
" U! ?. \) g" M9 O( v4 {If the VxD is loaded, it will always clear eax and the Carry flag to allow
. _; w- L+ n# I7 Q- u" T+ g( gits handle to be opened and then, will be detected.
+ F! q7 d- u l/ A* `7 TYou can check that simply by hooking Winice.exe control proc entry point
7 G: ?% I* ?% ]9 `$ Q. T9 B: ^ Hwhile running MeltICE.7 O$ B( G: O( i: o% Y1 a6 C1 G
3 r, F! w* H R. l& ]% H4 e' D3 B' r: \0 L( e U
00401067: push 00402025 ; \\.\SICE/ I4 v p$ H$ p3 b! K8 X. J
0040106C: call CreateFileA
1 P9 a; u: j) X7 n' [ 00401071: cmp eax,-0014 l8 O+ _! Y$ Q3 q) {
00401074: je 00401091( K! @( {6 L; S/ s# R. `
5 E0 t# z* Q5 h; U
- @+ a3 t# d$ `: h/ DThere could be hundreds of BPX you could use to detect this trick.* ~0 ]( c) I, Q& G
-The most classical one is:0 U9 t' q- J" c7 R: [7 R% q, `# d
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' || ^8 T. k5 m: _$ f
*(esp->4+4)=='NTIC'
4 A! k6 |: D3 w F# k7 g6 n
, w3 N3 Y8 t8 U-The most exotic ones (could be very slooooow :-(# P; t8 X5 J3 s1 z! W9 p1 n' Y$ ?7 N
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') " Y8 m+ q: s$ E" S5 G
;will break 3 times :-(9 |; V- d: Y! S. U1 q. k) w
; x& N1 ?: B+ {# i! x
-or (a bit) faster:
& m! X' ?& `( ?+ O3 J9 p1 t BPINT 30 if (*edi=='SICE' || *edi=='SIWV')9 Q! @# m: y$ @
4 M! c1 M& w3 B! b& `& a4 Q% i BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' # K; Y" k$ @5 m
;will break 3 times :-(
& a$ V3 U+ `+ j) k: M; `& V! x8 h2 f. J( d# j4 c
-Much faster:$ x+ L" I" f8 p4 ~
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'- ]6 F8 H& f0 o
: s, {3 t: Q, o: N- W" e5 r x
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
8 F3 R; h& x, y9 n4 {function to do the same job:9 ~. M4 L, i+ G# q
9 q$ F0 } F3 s3 ~ push 00 ; OF_READ5 p z1 m' u" _3 v' H& c2 ]- l% B
mov eax,[00656634] ; '\\.\SICE',08 e4 `5 N) s/ ]7 J/ A
push eax
3 A& H( j j: ~1 }) L call KERNEL32!_lopen
* N- `+ {; c* Y# h) b. g: Y inc eax' x8 m% Y0 J; R
jnz 00650589 ; detected3 W2 T2 F( |" l4 V1 M
push 00 ; OF_READ
# R9 b, N# Y' H8 a1 i3 B4 ~3 ? mov eax,[00656638] ; '\\.\SICE') P' f. |" H- u8 B5 d& H
push eax* R. F! o1 ?9 D! G
call KERNEL32!_lopen
* y+ M e" G1 @% p inc eax. [' q$ i5 m; t
jz 006505ae ; not detected: C/ u- h0 q% o& ~0 [
9 L* e1 v! V! |
( y% d1 n+ {% C' u__________________________________________________________________________
; I- _! h2 }3 P
- x1 l$ _7 E4 K6 r) JMethod 12
. j2 u; B6 A* {% r0 U e _" @=========
7 h# T5 V2 k- _3 ?0 j6 G! m* p1 ?& G1 L7 _ {6 ?# _
This trick is similar to int41h/4fh Debugger installation check (code 05
: N6 o, S1 z4 Q; M7 t( a6 H& 06) but very limited because it's only available for Win95/98 (not NT)* ^1 c& R) H, J
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.8 O6 w) K I2 D# \& Z7 k; w. ]
0 V& X/ Y" F3 K( [7 G& u push 0000004fh ; function 4fh8 m3 h/ I3 r4 Z5 M7 }$ C8 P
push 002a002ah ; high word specifies which VxD (VWIN32)8 Z* y, m. N4 B6 w' T
; low word specifies which service4 _8 V% E. S3 |/ R; A# u
(VWIN32_Int41Dispatch)6 n& ^! s- d2 w5 s6 B, Q0 n/ x
call Kernel32!ORD_001 ; VxdCall! M8 r! S7 W+ W) G
cmp ax, 0f386h ; magic number returned by system debuggers
3 V+ `! b+ p3 { jz SoftICE_detected3 N- v, b$ c; a3 p
{) p( u; g2 o8 a( WHere again, several ways to detect it:
# S' \# D( w8 r k6 J+ s- G$ A+ l7 b. p9 W3 _! w
BPINT 41 if ax==4f
, K; ~" H+ X; P6 p. U9 {) w0 }
9 X9 d6 B9 Z2 f# M BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one, K' P) e! A* {( F4 K$ R3 _
6 c9 R( D) P* h BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
; s/ {7 q. ^% _+ V8 b2 S/ [, x' r# |& m0 ]. d7 N. H! V3 c
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
6 A# |0 f! h, a1 h* p) W! t& M* t3 Y7 x. m4 F: ~
__________________________________________________________________________
& ^ z" d K5 ]% b
! C* m1 |* ]/ n4 J& fMethod 13- `6 W& K/ ] F5 x5 v+ _( V
=========; l& n7 ?' L9 ?; F8 ]
2 u. K% c( [' k" Y* k
Not a real method of detection, but a good way to know if SoftICE is
+ I/ N; d; A# linstalled on a computer and to locate its installation directory.$ D' c9 M* T5 a2 p* Y4 T) F% S
It is used by few softs which access the following registry keys (usually #2) :
" z1 l8 d9 D' f
4 s1 D1 W$ m5 Y H/ S-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion# }) _2 h0 V, Z/ x
\Uninstall\SoftICE
! ~/ E! M! {; O9 W-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
& R5 f8 r3 b/ R0 }5 U5 ^" A-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
' U5 |( W4 o- `7 f" [/ w& P( T\App Paths\Loader32.Exe( `3 T/ _3 b$ P- ^4 L( [) F
& _# m5 E2 |8 g" q
l' @% O% c8 w* p
Note that some nasty apps could then erase all files from SoftICE directory9 O3 N" i7 T& z- c; K7 L9 ?
(I faced that once :-(3 M' D! Y6 C% N! |8 S
- e V% K5 O( L, I) |) zUseful breakpoint to detect it:" y. a1 u" h$ [' z5 c
3 _8 y% @% T- E: a8 J; b( |% I
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
) ?* E1 k2 y( m% ]4 r1 }0 y/ w4 Z) }8 E' Y& z
__________________________________________________________________________
. v4 ~; I B- I- x# ?, [, h. w7 J0 }8 F2 p2 {* d& z
' _% \/ r9 `$ i) L/ `
Method 14
. f1 {: p, i* G=========
* Z! u g# m4 W% B1 @; r5 c! K' p7 f4 q! P& q& ~
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose' h4 p5 `- `2 X- k m4 |0 y5 d
is to determines whether a debugger is running on your system (ring0 only).
3 v5 h) x5 Q3 E. q! H3 j! f4 T* `: ]
% l3 J# u+ F9 j/ M, X P9 e% ? VMMCall Test_Debug_Installed
) r1 L% s9 e# n/ U, }9 o( L je not_installed* b9 l/ i" Y0 F: x$ t5 O+ V
! H5 m; X: e$ x" ]8 U) }3 w4 WThis service just checks a flag.7 ~) c' I0 V3 L1 |3 j; y& ^6 w
</PRE></TD></TR></TBODY></TABLE> |