<TABLE width=500> V+ ]' T3 v1 a1 y
<TBODY>1 T( t9 T. ?% E/ Y) B8 D
<TR>
# v! A- g: c* h7 p! |, I9 @<TD><PRE>Method 01
5 ]! j# r+ G" J% m3 t% D========= J: R& i9 U; n A8 u: k$ b
% \. B2 H: V5 g8 V* nThis method of detection of SoftICE (as well as the following one) is
$ S* K1 Y) f0 {1 T9 c `+ ^* Qused by the majority of packers/encryptors found on Internet.
, O: Z+ U O. JIt seeks the signature of BoundsChecker in SoftICE; k, d" _0 j& T" W
6 p! F6 B% r4 o. f: e2 g
mov ebp, 04243484Bh ; 'BCHK'1 X) P. r$ }, @+ V+ j0 a
mov ax, 04h
/ U3 _' ?. S1 k( s int 3
. ]8 @4 C& n. c y/ i, Y+ j cmp al,4
, ~# s" `: J4 C+ M jnz SoftICE_Detected) Q; M( G/ l1 W' Y
1 @6 _. Q6 z* D; k5 [0 p- m s2 ?
___________________________________________________________________________% p/ Z+ M: E- n( f4 y4 Z8 z
1 S# _4 p7 d* g& ~' LMethod 02
+ b$ ^0 T7 P3 \# @1 k' v$ e=========) h: g0 j. J( L Y, \' u" i+ X' |+ ?
0 V, s5 v+ M5 u: _Still a method very much used (perhaps the most frequent one). It is used
( H9 P1 l& `. @: Q- cto get SoftICE 'Back Door commands' which gives infos on Breakpoints,' `% ^& X& O `
or execute SoftICE commands...
$ K/ y0 d/ C7 m4 I9 K. q! B* TIt is also used to crash SoftICE and to force it to execute any commands2 b9 d& D1 i. n0 p/ Y* I4 S
(HBOOT...) :-((
! l' k$ ?9 i) \7 L$ U( l
; `# R2 q8 n N2 w2 Y% gHere is a quick description:
9 y5 i! ]8 H; l. e/ s+ c- B-AX = 0910h (Display string in SIce windows); _! H9 _ O, u$ R4 V
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx) d8 C) }! B) |7 D
-AX = 0912h (Get breakpoint infos)
6 A; k# w Z1 X- \) G, _/ b3 Y-AX = 0913h (Set Sice breakpoints)/ w$ D. s1 s w
-AX = 0914h (Remove SIce breakoints)
9 M8 u4 B K) O: p, M
0 a4 h0 {) n1 U2 Y; q9 f2 V7 A+ ^Each time you'll meet this trick, you'll see:2 B7 V. ^: S7 b5 @! U' H, _
-SI = 4647h6 q6 A% L: B0 @6 d$ L
-DI = 4A4Dh
, W" P) r8 m- D. M3 g2 hWhich are the 'magic values' used by SoftIce.
/ ?' C6 U% l9 K" A$ p( hFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.9 f3 Z+ X, s3 P0 e# p' F
( ?8 V) j. ~: b4 N' M2 w0 u" g6 k
Here is one example from the file "Haspinst.exe" which is the dongle HASP. H* O: j$ W. \0 q
Envelope utility use to protect DOS applications:
( x4 A4 k- [. D" T1 ?% _- Y4 Z5 J+ o+ q! s
% O6 ?0 A" h6 z1 C! ~+ I4C19:0095 MOV AX,0911 ; execute command.
- C( r1 d; _$ J4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
1 T' D7 L! r6 V* E2 G4 l9 g4C19:009A MOV SI,4647 ; 1st magic value.
$ t( ^/ \* Q6 T2 v5 L4C19:009D MOV DI,4A4D ; 2nd magic value.
3 I, D' R: f9 F1 k$ K0 G4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
2 ?( ?1 l4 G" c4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
: h1 ?3 x l9 \4C19:00A4 INC CX
9 t* Q: o2 s& G g4 _3 J4C19:00A5 CMP CX,06 ; Repeat 6 times to execute* r+ j5 w# j: I' [3 T6 j5 j5 L( ?
4C19:00A8 JB 0095 ; 6 different commands.7 j; S/ w8 `' P, T3 N
4C19:00AA JMP 0002 ; Bad_Guy jmp back.
9 ^& c6 ?, B- X a7 g( @. S2 h4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
1 G7 r; I# l6 I. W( W* v3 w7 D, ^- a F, h& t1 V4 G! Y5 M
The program will execute 6 different SIce commands located at ds:dx, which
( F9 F0 @. z6 x6 qare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
[ V+ l8 s- T" I9 S/ y; o' f1 D; s3 T/ F" p, H2 e4 C
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.3 f! p# q% \1 ]: ?
___________________________________________________________________________
/ `& x' {3 f: [. I( u$ Y8 z8 L
+ p8 K8 W s1 A# M! T4 G4 T( E" I7 Z; k+ Z% E" }
Method 03/ }1 H# [8 R: V8 S- G
=========3 K9 f: E8 C: ]9 ?, _" O
* s* i" t% a; F. m1 Q, m
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h" `( o4 U5 Q. y0 j8 Q: M! K
(API Get entry point)
5 |' G9 r9 C+ \( d9 W7 R) c * z# U. A) f7 s2 @3 i! |, V3 L
' ^- f! G3 J3 v' w1 C4 }
xor di,di6 z: {- W7 Z9 A9 S* A
mov es,di0 S4 U# h* z: K& ]( p; l/ c
mov ax, 1684h
% O! C, J: T: @0 e' F mov bx, 0202h ; VxD ID of winice7 A$ j# N! ?' l% }" v7 [% B
int 2Fh
& k, N! n3 \" z/ L mov ax, es ; ES:DI -> VxD API entry point
1 h0 P8 g0 u9 ~7 X add ax, di
) N( ]6 Q; m7 b# t0 @ test ax,ax4 X% h2 u) [6 e+ q8 Z
jnz SoftICE_Detected w7 G( v# k- u2 Y8 U
G: M6 _3 n2 c
___________________________________________________________________________
4 ]0 z2 Q6 ~% Q6 ]+ ]
3 c' @0 |: g/ v7 U: E d0 R; oMethod 04+ C1 _9 E" f6 {. N
=========: b- D, C: O) _( n
: K7 i% r% G* VMethod identical to the preceding one except that it seeks the ID of SoftICE3 k4 g/ a" Y9 R# h8 j) \! Q+ Q
GFX VxD.$ H7 z3 e- v u
( m/ `6 p& I: J8 X8 r xor di,di
Z; @6 x3 H1 C) x \2 l$ U$ r mov es,di
( s [2 R7 R% R. z3 T9 W mov ax, 1684h 8 O" A- k* {9 [5 j o0 V* c
mov bx, 7a5Fh ; VxD ID of SIWVID& x' h [3 B" T1 M7 d5 ?8 ~
int 2fh O7 M' W, M* N
mov ax, es ; ES:DI -> VxD API entry point
0 M: Z* O" h4 r add ax, di
8 y' K) q3 r3 g6 `# e test ax,ax
* e5 t* K6 ?' v0 } jnz SoftICE_Detected
9 f/ e; |; \. b7 z. v+ A6 Q1 v# d' r8 o- a& e2 b
__________________________________________________________________________( W! k5 b/ w+ \! z
k E h( e% p1 N) D7 B
7 S. e6 l/ t0 MMethod 05
i3 W+ H1 Q* K=========
2 m' B& J$ e7 O3 K8 \
* {4 ^0 P8 ]; P) tMethod seeking the 'magic number' 0F386h returned (in ax) by all system
. {5 d4 x+ P2 K. |debugger. It calls the int 41h, function 4Fh.
% I) n7 Q' _# G5 x: fThere are several alternatives.
" a' j+ w* s- [8 a+ x5 S2 q/ s) ?1 T0 s! }- z2 |3 z% b4 ?
The following one is the simplest:
4 T' @: o9 |! @8 o+ u* i
2 Z! P; _/ c$ b! I6 b, G mov ax,4fh2 D! ^* W3 b" i( z% F, C
int 41h
( P) e8 A. { m cmp ax, 0F386
8 o$ F/ [3 c: w# }( M jz SoftICE_detected
7 ^9 i" W% e. W4 s7 k2 T" j. g. z2 M5 v e0 C
4 h0 I. \8 o( I& mNext method as well as the following one are 2 examples from Stone's 1 a8 x9 R* Y: L9 _, ^9 B
"stn-wid.zip" (www.cracking.net):
: s) P- J" D1 Q2 b3 l! _
2 z$ e- u, U% J0 |) n mov bx, cs) A5 X8 T8 C1 T( m6 i
lea dx, int41handler2# R5 Z2 R9 ]8 u% s, D: {
xchg dx, es:[41h*4]$ k# j. V8 d* I2 [6 e3 r
xchg bx, es:[41h*4+2]3 V3 J7 }- t/ a+ O( }
mov ax,4fh
/ I9 x6 q7 F* G4 i: ?+ Q int 41h: M4 u# Q. i6 L) T
xchg dx, es:[41h*4]
" D: H3 E. _# B# K* @ xchg bx, es:[41h*4+2]
+ z# S2 L: x% U+ |1 g cmp ax, 0f386h( r, E/ ^' r& D/ {* q$ F3 [
jz SoftICE_detected
% g a0 ^ J' N% c+ N Z
) m, J. e Q0 X7 I ~; lint41handler2 PROC
& s: h& D7 g! L% `1 c iret$ E% W$ s( }) ^+ ]
int41handler2 ENDP0 q" m( q2 a3 [" [4 n
G: q% o% ~" `+ _: H+ {( \( N
) l1 L( M: s3 ?& e; }0 c_________________________________________________________________________( N5 w6 @: w4 b) r; A
/ R2 v; s. G6 G$ i
/ N: N9 m/ d8 LMethod 06
! }. m7 }4 T6 O2 ?4 r0 |1 }=========4 b) B% K R" O9 g- A6 N
2 D4 ~: f" W, E+ e
5 t s) K! p* E% x# z" u2nd method similar to the preceding one but more difficult to detect:
3 |0 d" R0 `. @! D) p0 Y& f _& y6 R; @6 g
# V- I9 U* s. |# c
int41handler PROC% k( m# \/ t4 N4 Z8 p+ \; A6 ~
mov cl,al
8 l" w! s" l3 n9 M iret
9 v( [% f2 X% y9 t8 r S: i; A) W2 aint41handler ENDP1 e3 \- L9 M) M- K! Q) a
: y$ [' ~, b' Z( i
; V" V. |$ H$ U2 s. _. j0 S
xor ax,ax" d. q3 `- `8 C. p
mov es,ax
, H1 \4 \; ~$ ]9 C- E mov bx, cs! |9 T2 X( _$ m
lea dx, int41handler
) @ O, D+ @! [5 } v7 Q xchg dx, es:[41h*4]4 ]/ r8 B$ Y; D. _
xchg bx, es:[41h*4+2]. g y \7 I" C; D
in al, 40h7 I5 Z- o2 B* x. Z* g. D4 _5 R! o# B
xor cx,cx
7 n1 L9 X3 W+ }- w int 41h
/ T) s' p- H3 x" l) |% P& } xchg dx, es:[41h*4]
; s p$ |. |! G4 N6 | xchg bx, es:[41h*4+2]* l$ u/ c D% b
cmp cl,al- ]/ K Z4 [; _ L# T+ ] E
jnz SoftICE_detected4 V- j& |! y, E+ ^! j2 {* ^
( Y0 n+ j/ O" r7 H" @6 L3 K_________________________________________________________________________
; s0 t. ^" }7 C6 H$ G6 c: X
; A% o9 s- D6 u# h. V9 CMethod 07
* t" x# g) X3 o" D% N. I5 h S=========6 n: F* P' L( |+ Y
! n5 m# ?. z+ EMethod of detection of the WinICE handler in the int68h (V86)
. l2 V& [# N$ a8 {- U7 L: ]& G3 d, S* E# D4 `- Z( t
mov ah,43h
8 R, }5 Y& y( }9 c5 P int 68h3 |1 u2 W. U' f0 c* C) p6 R
cmp ax,0F386h0 S, i9 |3 b8 D3 \# U3 }+ V# F
jz SoftICE_Detected
# D4 b- H! y6 D4 u4 K- n2 G, X: [, V! ?; Q
: g+ J, _8 w$ o5 Z& P; r
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
0 h* C1 ^" A9 r- d: L' g app like this:
3 f! _* e! e: o6 E, k( f& r
( N3 S& x" D1 k7 s6 E' w( p BPX exec_int if ax==68# ~$ Y% c/ U0 B7 F# r0 f
(function called is located at byte ptr [ebp+1Dh] and client eip is
* ?: p* O$ P' i6 U6 X located at [ebp+48h] for 32Bit apps) H0 s5 l. F- a2 C; s4 Q
__________________________________________________________________________
( P: b* b$ ^+ v1 W0 P6 d1 V, l# E
2 s* ?4 u, b' ?* e0 v" g: E) o& O, y& B2 Q$ q4 @& d
Method 086 u, S) b7 L% F8 {
=========
2 s4 u: W4 z( P+ w ~5 d( q( c
It is not a method of detection of SoftICE but a possibility to crash the) @% l8 @2 L+ e! u) T; c- W2 p
system by intercepting int 01h and int 03h and redirecting them to another0 A. c1 e9 `4 n! w
routine.# U) K+ _! n- k* X4 M1 |
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
0 Y4 Y& ^! _" k# ?+ G0 ]) a9 dto the new routine to execute (hangs computer...)5 O( W4 d& P+ m. e: k
9 I3 z% b+ C) M8 F r7 }/ l" ~
mov ah, 25h! H8 S) E3 ~5 W2 m+ j2 w
mov al, Int_Number (01h or 03h)4 \* T! _/ T, L6 k2 ?7 T- \9 M
mov dx, offset New_Int_Routine/ f' T/ g, |/ V! q! y, u
int 21h
. O; N* ?- P3 j8 O7 } W |/ B2 |7 P9 G3 L# f. e- H& w
__________________________________________________________________________
1 g4 p3 Y% [5 O5 c- W3 _, u2 ]
. D) \, r. v- O$ o# OMethod 09 p& ]$ |4 {+ \& l. r
=========6 x) E" }" N: s6 ~5 i
, e- ~" f6 u# z) M7 }+ KThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
( f4 U1 D7 U, h( I2 M/ Hperformed in ring0 (VxD or a ring3 app using the VxdCall).* ~0 ^+ d' x) H6 h
The Get_DDB service is used to determine whether or not a VxD is installed
( D3 E; o+ q7 r, @5 ifor the specified device and returns a Device Description Block (in ecx) for
; E1 W0 ]; }0 A. bthat device if it is installed.
& m6 l3 t! C, j
, A y9 O* u# R1 B- L mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
, Y- l W# _: J( K1 r mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)5 B8 D2 H3 `9 U9 `0 ]# ]
VMMCall Get_DDB! O+ H2 o$ r- v' Z- c
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed$ G8 E- i4 S) j4 F1 f' k, L' t- I
# K5 _* i7 j5 i9 dNote as well that you can easily detect this method with SoftICE:
8 H9 a0 g/ N$ ? bpx Get_DDB if ax==0202 || ax==7a5fh
! P, E6 l; x) Z! B v& q4 k& p& m3 b* F' t5 E" Z
__________________________________________________________________________( b5 [7 @2 J) n* s/ }
# V# w& t o8 b; K6 W+ s8 L# y
Method 105 v. G# B5 P6 y$ V9 ^
=========: {- L" l. \! c5 I' i5 p6 v
7 a" t5 @6 w, Y8 Q) f7 B=>Disable or clear breakpoints before using this feature. DO NOT trace with8 ]" {- I0 M1 X8 E
SoftICE while the option is enable!!: V% c! c' \8 Y
5 v |8 r: _9 {/ s; u6 g
This trick is very efficient: @' x4 M. D6 [ o) ]3 f7 K
by checking the Debug Registers, you can detect if SoftICE is loaded
% [$ L8 ^& C) D+ M8 Y. _; x$ y(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if5 z$ |0 [2 Z7 G+ b- K
there are some memory breakpoints set (dr0 to dr3) simply by reading their7 |, S3 O% v. M6 ^7 b& a
value (in ring0 only). Values can be manipulated and or changed as well
( r% P o% m- `/ g C+ V5 O) O(clearing BPMs for instance)
( K, q, h9 ~% d: e# h( X: L& F7 U4 I8 |
__________________________________________________________________________. F8 X& g' W e; z. }
1 E- I W: A1 d1 `
Method 11
; _0 J( k$ o6 n2 Z7 ]8 H=========
+ G. h- |8 E( t$ F' n
( ]. x: G# j) Q8 xThis method is most known as 'MeltICE' because it has been freely distributed8 ~; D* t/ Q6 V" A( i
via www.winfiles.com. However it was first used by NuMega people to allow
* c- p2 z/ M% z5 pSymbol Loader to check if SoftICE was active or not (the code is located
& x9 I) @5 a. a/ s E( h! winside nmtrans.dll).0 p+ t2 m. ]: r5 J
2 t. v* f$ \9 I4 z; z9 V' t0 \
The way it works is very simple:
) H) Z8 t, y4 p4 F- k/ }$ h! c$ o zIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
& h/ d1 n3 `- Y7 lWinNT) with the CreateFileA API.
; U' V! R# _1 z- r8 s
7 S" W% ]5 u6 v/ w: ~Here is a sample (checking for 'SICE'):! @- h& ]. D3 u% D7 n1 H
% S- `. a) j. X$ tBOOL IsSoftIce95Loaded()
1 U4 R/ g, P! O5 I# R' R Q- l+ V{) ?& p) [; w4 @ Y
HANDLE hFile; ; }. D4 H6 \; h: J
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,. j* k: G$ S) o; E5 [0 [
FILE_SHARE_READ | FILE_SHARE_WRITE,
4 R' I" v- i; l2 c. ` NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);: l. ?" \1 e, M* C: O
if( hFile != INVALID_HANDLE_VALUE )
1 C( H+ q1 e, V( n; i {1 }5 b& V; s, Y/ r2 g) O; d
CloseHandle(hFile);. J) S) n, @. l! n0 j" q# Y2 ^: h
return TRUE;; g7 P+ M) B( h9 _) q2 \
}& }/ r2 P8 O% _( i" o
return FALSE;9 S9 U3 \' q" d6 a! j4 L6 i
}3 \& ~, M6 T: e8 m4 V y: k
% v1 _1 O+ Y# k/ o
Although this trick calls the CreateFileA function, don't even expect to be. F# q. C; |, {! z7 U- e
able to intercept it by installing a IFS hook: it will not work, no way!: U: C" q9 t3 w7 h) W
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
; w8 @* N2 j* yservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
5 @& K% Y- [# a+ A' X2 ?+ {and then browse the DDB list until it find the VxD and its DDB_Control_Proc
8 f$ q6 Y: G! w6 @- f3 c! L7 L# I6 {field.# X0 H. U0 M/ u* b
In fact, its purpose is not to load/unload VxDs but only to send a 4 A( V" d; D+ j/ Y+ x
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)( Z: h1 E i5 F2 t Z5 Q q
to the VxD Control_Dispatch proc (how the hell a shareware soft could try2 x; {# X! `. t8 U4 r# v. P R7 M
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
- T* f x" u* g6 n" NIf the VxD is loaded, it will always clear eax and the Carry flag to allow
* d/ ]: D/ @" h% cits handle to be opened and then, will be detected.
) O* o7 }. \, Z8 q' P. O" G8 ?* MYou can check that simply by hooking Winice.exe control proc entry point# n+ @7 D! O |, V' o4 g6 O% K
while running MeltICE.: i# r, S4 N2 l0 o( s1 w- k
3 J; y( }4 g2 Y' F V' O- i
3 Z2 n, j1 h! N! S! o' I# T' r 00401067: push 00402025 ; \\.\SICE% |) M0 H1 I) \4 o
0040106C: call CreateFileA3 U; o1 O5 \4 v3 m9 z. R
00401071: cmp eax,-0019 F6 a% ~( ~) h8 ^
00401074: je 004010910 R& I" a1 U# m& n9 H
+ q6 [! X. P. i& k0 l2 j& u* V# h6 ^9 U7 t, ]4 t% ?" C/ `
There could be hundreds of BPX you could use to detect this trick.2 _& D0 a+ w' D2 R- F& W
-The most classical one is:* s2 ^* o* S1 `, Q) `9 V; E
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||) `6 b" x& P- J( s& J7 D& Z# S
*(esp->4+4)=='NTIC'8 Q8 N& E$ u, o: f( t
3 j7 r" K- {- l |5 A: v
-The most exotic ones (could be very slooooow :-(
0 K# V& r4 v+ l) |, O% t BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') ; t' r" W; n" g7 c7 q% [6 J
;will break 3 times :-(
& D2 M* t( ]% G: Z
" n- B# v( P: U0 j& r2 t W-or (a bit) faster: 6 t1 s1 o; i2 N1 `
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')' a) g; c; ~: z3 y2 q. _$ s- J/ |
9 D: Y/ \9 [3 p. k2 M BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
4 d; D) i Y& N ;will break 3 times :-(9 D1 j/ Z! T: C% d
; Q: T* u+ q7 \-Much faster:* |% w( j* n0 e
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV' L7 s0 c, |) b) }, G
: R* H( u0 i3 ~! Q/ Y
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen! I0 s8 m. b! j& _# N
function to do the same job:
3 R# Y$ E& ^/ }+ d4 Q" t# a1 u& |/ b6 v( p5 X0 v& d# ^8 }2 e; M3 m
push 00 ; OF_READ
% u7 N) Q) G8 |% J; f mov eax,[00656634] ; '\\.\SICE',0, e- ?3 e/ g$ n- d: f. I4 G
push eax
, u: A* R* T6 V call KERNEL32!_lopen
# k) m: M* y3 N; o4 \ inc eax
) n6 f- P0 X; T8 l* Q+ f/ @ jnz 00650589 ; detected
" o L4 N6 u' v push 00 ; OF_READ! I% {" h {/ ~- x. ^' x' G5 S
mov eax,[00656638] ; '\\.\SICE'0 b, b) w, ^! R; F4 e/ o
push eax
& b9 o" p9 X. V- i* L call KERNEL32!_lopen( h9 ^7 x/ F- H. j. i
inc eax
: a& G, i. Y) @4 {$ G! f jz 006505ae ; not detected+ @/ `1 T4 J/ ?; s+ f# j3 v, F
) v' m" b* H5 V$ e
4 H1 W' l6 u& Y- }
__________________________________________________________________________
- x5 l o0 o$ w- {/ f# G/ ^3 x
( |2 D) i# w, X) qMethod 12# P i5 [. K6 O( X& ]8 `* g
=========3 C! i1 R- _4 V2 }& b z
) {! v$ |. \ Q1 c' l! _This trick is similar to int41h/4fh Debugger installation check (code 05
2 k, R# b, \0 d2 {& 06) but very limited because it's only available for Win95/98 (not NT)
. R+ j$ v' j$ l( v: U% u' H) T3 ?as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
3 w7 L4 G: X, f( M* U: x( A- x' @* \5 S7 b$ s. H' G/ ?5 H
push 0000004fh ; function 4fh O& C) I) N, ~0 _5 K3 i
push 002a002ah ; high word specifies which VxD (VWIN32)& Q0 H9 `% y( a3 a. m6 @ v& M
; low word specifies which service; q4 l5 {# T2 p) [% @
(VWIN32_Int41Dispatch)) d0 q0 M6 `) T$ B4 _' E" T
call Kernel32!ORD_001 ; VxdCall( h( r+ k! i& K* o) `. F. s1 H6 Y
cmp ax, 0f386h ; magic number returned by system debuggers0 z, ^3 ?9 R# q* ^
jz SoftICE_detected
3 R$ Y- `5 E% x/ q+ j* A* n8 ?. i- c
Here again, several ways to detect it:1 M+ |3 d! d# [5 n8 v W
' I) D7 P- D# z K/ [0 W9 @
BPINT 41 if ax==4f X. l [4 D) r0 C( h9 O
7 f4 K4 W* f' D$ c( B BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one- J& v& M( {! B/ |+ M/ E
/ j8 ?! @3 r) e BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A, e* W' ]' G$ f1 a
: H$ v% g5 l% S& m% l
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!' J: d, P ]& f3 \' a5 p. Y
) F, Z/ g/ i% Q+ B- t& [
__________________________________________________________________________& f# m- U, V5 T" k# o7 w
$ a/ @6 C5 B" C! k" uMethod 13& p' c/ l3 x7 J; m
=========
- D; P! e+ t$ n n1 n+ U. S- m" J5 h
6 M2 H6 U' G) T/ F2 O4 D, [Not a real method of detection, but a good way to know if SoftICE is. ^3 L6 ` n; m' d
installed on a computer and to locate its installation directory.9 r: p4 V9 \9 U4 G% N
It is used by few softs which access the following registry keys (usually #2) :2 _4 B% f1 c; G: [$ s; Z
4 T/ b+ l# F/ e! i1 f8 S
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion& R7 y- p3 X3 z8 Q9 n
\Uninstall\SoftICE* }0 h% Q) ]7 h: P" L7 d
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE8 z+ J, w. m+ Z1 e5 x9 z$ ]
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion' T, p0 L# V* E& `$ Y
\App Paths\Loader32.Exe+ y- |( f0 D7 f# h
$ c( w1 U/ J: X6 M* }" w8 R7 l, A+ A; C2 F) P2 ]
Note that some nasty apps could then erase all files from SoftICE directory x8 \5 ]/ ~( p. i8 _ L
(I faced that once :-(; J' q& L( B6 i
?5 q; o) }, v& g6 @4 Y% H' Q: hUseful breakpoint to detect it:
1 f( M' f0 a" T1 M# Q9 v. j7 T9 O4 G$ W8 E" G
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'+ w5 i* G. p2 ]' t* r
9 D4 ^( }% c0 x__________________________________________________________________________
* c+ S) o6 U4 B1 I* P& J- ^1 K
6 y/ ]3 Q: Y4 r/ a/ c
0 b0 B1 I2 O' eMethod 14 4 @9 V5 J% o6 j$ _ Q
=========3 s4 a# c, b- A" E, F8 e$ k
" |9 H- i. [+ j( CA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
. l$ Z7 g4 k. F) F' a, D, Tis to determines whether a debugger is running on your system (ring0 only).3 W. y/ Q0 L5 p" u0 r1 ]
$ _' M8 W% Y# E- k! S' w% a
VMMCall Test_Debug_Installed" d7 Z) P3 @# e% S
je not_installed" b, ~' H3 }" I2 s& X
7 s3 E3 E4 o$ L w* B( n& K& q5 aThis service just checks a flag.
1 t9 q5 V) {' y! ~</PRE></TD></TR></TBODY></TABLE> |