<TABLE width=500>* }( P3 E5 }0 C. t* a9 o3 S
<TBODY>+ S: l1 Y |7 k
<TR>9 @% k. u0 U5 q/ O+ z
<TD><PRE>Method 01 ; U" U) k1 l! q1 O- L4 b
=========
( z5 \% ?- d! l- D
: {; m- z/ E. XThis method of detection of SoftICE (as well as the following one) is; F4 l0 x0 N% e+ [# ^" K4 J
used by the majority of packers/encryptors found on Internet.
! V! ~' \/ H b- ~" t5 B& CIt seeks the signature of BoundsChecker in SoftICE" V2 z* j) X9 c0 b5 X
! L$ \; B8 e( Q0 Y( B' r mov ebp, 04243484Bh ; 'BCHK'
: C( q2 c/ p/ p) q6 F) y. f mov ax, 04h5 V& ?0 n# J$ F
int 3 + M+ y9 q* [9 S
cmp al,4
. C* b' v) U4 _ g+ C- X jnz SoftICE_Detected
, _: B+ f2 Q& T- h) L7 r5 c0 Y- E3 I V
___________________________________________________________________________
5 s5 P1 [$ t8 V' U% v8 F( v
% ]- P5 l2 w0 v; q, Q. lMethod 02
! e8 ?" u* L) Q5 v. V. i! Y' G=========' D% p! `; c( o( l+ P) b
0 I/ n1 h. d6 B# m
Still a method very much used (perhaps the most frequent one). It is used1 B3 e% B2 X# I
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
7 B$ o5 I/ J: b' M3 N# ?or execute SoftICE commands..." D. a# g) P7 Q0 l7 c. P$ u: u
It is also used to crash SoftICE and to force it to execute any commands. V4 |8 N& l. T; E5 b
(HBOOT...) :-((
" F1 P) I* g V/ m: n+ n, Y; {8 a( c$ K, b2 |
Here is a quick description:: ~" T# R" {. x6 r( g0 [5 w
-AX = 0910h (Display string in SIce windows)8 u4 I5 z4 l( n8 `, [( F
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
4 q+ @( X7 g3 h8 K) P-AX = 0912h (Get breakpoint infos)
! T" ` S7 a$ x-AX = 0913h (Set Sice breakpoints)% F/ _$ [, w2 X: ^6 a% R
-AX = 0914h (Remove SIce breakoints): m3 G T$ A, a- Z( [/ a
~+ V, `$ V! o/ t/ w/ i
Each time you'll meet this trick, you'll see:5 T3 I. s! ]( @9 G( }! B G
-SI = 4647h8 x3 y% e( M4 C! n% q4 e( t
-DI = 4A4Dh$ b7 n+ a: z: ?$ b3 z1 j. E
Which are the 'magic values' used by SoftIce.' X3 ^5 m+ E6 u/ A$ G' j
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
2 w6 I# Z6 G6 Z H! G8 s! e2 P/ d: [, V% j. h
Here is one example from the file "Haspinst.exe" which is the dongle HASP
5 G( ~0 z) R( U* V! z C- zEnvelope utility use to protect DOS applications:
: I/ E: r- _1 n1 O2 ^+ K) n6 e$ ^5 Q, D: r1 X( b
* _3 ^; H% X1 r" {, y4C19:0095 MOV AX,0911 ; execute command.
; q9 J- V6 t7 ]8 @" y7 i/ [" ]4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).. k8 w) B' M# u4 v6 I- a5 {
4C19:009A MOV SI,4647 ; 1st magic value., x( P `5 e" g" `& P" r
4C19:009D MOV DI,4A4D ; 2nd magic value.
. a% Y4 |+ y) G a& ^& B$ ~4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)1 x, k* T7 ^1 U2 w+ X
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
: J/ u+ K) E2 D X; U" V4C19:00A4 INC CX
4 b, P; N7 x; a4 @) U) [( J5 c. Q4C19:00A5 CMP CX,06 ; Repeat 6 times to execute2 H7 E7 p& u# l) D
4C19:00A8 JB 0095 ; 6 different commands.$ E# a3 Y; m( y- z4 a* y+ ? k
4C19:00AA JMP 0002 ; Bad_Guy jmp back.0 e3 J4 O% H0 r r8 n% Z9 C
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)/ V0 _! W" B5 ?% ]8 _
5 y: a/ ^9 A/ i. K6 x6 ^; N' {: QThe program will execute 6 different SIce commands located at ds:dx, which
p: r2 U A: |7 `' `6 l* {are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
0 o+ y' @$ Z' R! U/ C5 B9 a! q. m- `( Z# W3 \
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.. y6 V# s* t6 c2 C: R
___________________________________________________________________________
K2 u, E7 _9 |+ n$ L- Z
+ W: R* b. D; x1 W& m" r
- z& P1 E( v( kMethod 03; C4 t2 r2 Z" L0 {2 a7 D
=========1 G$ v: B% }. L7 w; F# a9 J2 N
4 a4 M- g+ F d! m
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h; b4 X$ \2 w, R
(API Get entry point)/ l) Y, I6 S9 e" d7 ^, Y) p
/ [+ _! s% ^5 i% A/ S
) E( j$ a4 c+ A. ?4 ^# {2 y xor di,di$ |; J& w- x9 h+ v' k4 g8 A n5 j
mov es,di7 X. @" [; f, {# J' {2 g% `
mov ax, 1684h
( [" Z# @ T& ~. l mov bx, 0202h ; VxD ID of winice( b( Y2 t4 }2 W$ y3 M. L8 u
int 2Fh
4 A# S! b& p1 m0 ` mov ax, es ; ES:DI -> VxD API entry point, y& o0 H# i4 P4 a* W
add ax, di
7 |& V5 i7 k+ B3 m* R. I test ax,ax+ e! M9 ~1 v8 L2 e, J
jnz SoftICE_Detected+ x8 v4 |* W7 q% U9 X1 P3 t
6 ]0 k# X3 a0 |$ C___________________________________________________________________________- ~0 |; y2 S6 U2 o& Z3 `
. p: k( p6 d, K! pMethod 04: p# O! D7 h; }
=========
" |9 [+ E; n& H" X! f, G2 \; X. {! w% e) u* ?* I
Method identical to the preceding one except that it seeks the ID of SoftICE
& B2 a& s! A* w' Y$ w. N6 ^GFX VxD.' M- O( P, `; |1 l2 }
; U- {: e% Z4 }: r# M
xor di,di+ |2 J$ I3 L: l, q0 g* i3 K$ t
mov es,di6 J ~1 _; \0 @6 @' o
mov ax, 1684h + Z0 |. j" _6 T# I
mov bx, 7a5Fh ; VxD ID of SIWVID
* Y; h; ~( J9 ]' a: `* N% q int 2fh
7 Z7 ~' i% A0 R. L2 \ mov ax, es ; ES:DI -> VxD API entry point, }( S( V1 a2 ^8 B ]& r" u7 _; Y
add ax, di
% \3 X [7 u+ [* W. ?7 n test ax,ax
; d- h# {/ r y- F jnz SoftICE_Detected( x/ C8 y& H8 H4 w H
" \2 Z ]& C# A" J__________________________________________________________________________& G+ E& ]+ {5 W# j$ p8 i' Q
3 c I2 e" F b# F
5 ?! U+ v" l$ o, u/ t& m5 N$ A
Method 05
+ ?6 B7 @) O7 Q========= N) ]: {2 \& I% Z5 r
5 f+ H0 x" v- a2 ]+ r& H
Method seeking the 'magic number' 0F386h returned (in ax) by all system
: F$ ?2 T6 U# ?' B# X* m. e! `debugger. It calls the int 41h, function 4Fh.4 r/ F0 W2 p# F3 e/ W
There are several alternatives. ; `. V, o4 W5 M( K) z. E/ Z+ L
, @; E# p5 ^; o( I
The following one is the simplest:
0 a; H/ f1 Z% ~) F+ R
3 ~5 O" x# R: P( U7 ] mov ax,4fh$ t3 S# w! S _, F k$ b% Y4 O* T
int 41h3 M j8 @& T5 S4 J6 O+ ]' S# ]+ d. P& u
cmp ax, 0F386' m* d$ ~4 d3 D0 X
jz SoftICE_detected
; S$ J: W9 y& _) E x2 z1 B6 b* ^3 q7 ^ `! R) q5 s+ J- H/ Q' |
" w$ I; O8 D1 A+ F5 i
Next method as well as the following one are 2 examples from Stone's + L: E7 f, m9 n( ]2 ]0 N
"stn-wid.zip" (www.cracking.net):& @0 W+ E" |( T, Z( }, @- v% |* @
, K @3 ]5 S* s
mov bx, cs- b' Y7 s! g- y$ U7 B
lea dx, int41handler2$ M- Z$ l* d- ]
xchg dx, es:[41h*4]
/ ^' Z' s9 N# ]8 h) x: p4 T xchg bx, es:[41h*4+2]7 A* A4 d6 F" a
mov ax,4fh
2 f. K! @* l& E- e int 41h% V: i- R4 {- c& \! L# v0 E' _: Q
xchg dx, es:[41h*4]
& k; K$ t! t$ ^/ _4 h( ]) p' f2 D xchg bx, es:[41h*4+2]
9 T8 m* V P- V) z1 q cmp ax, 0f386h
* v! S) _( n3 b p3 V2 `! D9 b/ J* B jz SoftICE_detected
& K4 W: i. u3 ~* W6 T; g& K. X! K& k
int41handler2 PROC6 Q: h1 d+ y* t5 d/ ^0 A) f; P
iret8 {3 ]. D+ s a1 e/ e' L9 X0 i
int41handler2 ENDP! k+ n; W2 Y. n9 k/ k) G! o
$ I2 E7 A% _- _" o- S+ v% c8 O; f( O0 R: Q
_________________________________________________________________________
; `+ E, x& N' X% y2 u
/ F# D5 y- E1 F" d# J1 y! S! P- E' G3 ^+ M1 }/ \
Method 06( h! L- k% b* i0 ]% m6 ^9 r3 j
=========
3 H9 |, e9 G5 e: y- ~
7 `8 l# V1 i! S5 }/ ?9 q
/ X) q3 L# D5 T- T+ \; \" X$ s* f2nd method similar to the preceding one but more difficult to detect:
6 y7 p$ W' h, p9 J
/ D$ I" g/ L) q/ W7 p% o, H7 e! ~4 K. K8 u, b- S- t
int41handler PROC
# S5 \: e* k' z& j# h4 Q. ~' S mov cl,al: k( G7 f8 t" a" ?: |
iret
- |; [( i9 f1 K" @+ G+ I+ b0 \ @int41handler ENDP
& V# \ S( [7 y7 h% L; H; r" S% _, A/ m/ G* ]0 `& B1 J& c
% g7 z& o( C* `' f" f8 W
xor ax,ax
$ o( s6 g! q; U mov es,ax' X4 b3 ?! ]- K+ c
mov bx, cs* k7 I9 J) G' I. O4 ~
lea dx, int41handler
" O9 O2 V% t3 B& T5 z xchg dx, es:[41h*4]
2 Z# z1 w: {1 q$ ] y8 r xchg bx, es:[41h*4+2]
+ n) O* Y* S. r; t) x* z in al, 40h( ^ y7 }5 ]' r$ v/ W) z/ w
xor cx,cx
# X: K; w+ g4 G int 41h
0 W8 q0 l% t, L: u) Q xchg dx, es:[41h*4]
" `% \+ v* o3 L xchg bx, es:[41h*4+2]
( Y" n) G) v& b cmp cl,al
% F/ L1 ?/ n: h' f* a jnz SoftICE_detected, y' n& m* J7 g X+ n1 I& r( ~
6 y3 G `1 }; V: v6 O_________________________________________________________________________
! K4 `9 ^$ N _( o/ Z! V: D5 Z
9 ]3 r9 `* }1 L* I1 q6 [9 }6 fMethod 07" S. i. n T/ N3 |/ v+ `. ~; L
=========
- E7 c6 R1 ]1 `% ?! u0 u# O s' ~8 Z7 q d( O) m2 ?# W( c0 U+ a8 O
Method of detection of the WinICE handler in the int68h (V86)
0 x G6 H1 r. e' }# e( O3 A
3 q6 u# L/ b. c4 N q" s! R mov ah,43h7 Y; n: c- p4 |$ Q/ W6 V
int 68h: [4 C( e C1 x9 m
cmp ax,0F386h& A2 ?: B6 R% ?/ o; n p: P
jz SoftICE_Detected$ m3 T+ X- Y2 B1 ~; \( ^
% ^% s2 C/ r5 O6 S$ Y* V
% b, R- K/ |6 _9 D) j( X=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
, n: c( \' N& M. |. T8 E5 B& x app like this:
; }' ~+ `. s1 |0 d. j8 Y2 b: x" Z; }
BPX exec_int if ax==68! n! k8 Z1 d- L5 n
(function called is located at byte ptr [ebp+1Dh] and client eip is4 v: H4 \' A& F, h
located at [ebp+48h] for 32Bit apps)
2 c' M3 W; @: a: Q& q- h__________________________________________________________________________; x* U' r3 a4 d c/ o$ g% K
5 R2 N0 P1 G/ y Q6 Y) y8 g( e, M
9 l! y5 h( S y. \, g5 ^Method 08, P5 D+ \3 s' d) M3 |3 H
=========+ j" N# F0 \5 Y' j- a
! D% S& _. k; L- P5 f5 L4 EIt is not a method of detection of SoftICE but a possibility to crash the
# L8 ?. s% v* I/ msystem by intercepting int 01h and int 03h and redirecting them to another
/ m! o0 x- F/ Z% _+ q. y: Lroutine.
. F* W. G/ K3 `3 V& m; [It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points4 S' x$ n& z* b7 V
to the new routine to execute (hangs computer...)* p% f) ^$ A! v) g' J
. I, m. k/ a! O4 S" o6 p mov ah, 25h
+ n4 s: i1 ?# z: q' P1 z! x mov al, Int_Number (01h or 03h)
6 H# f0 S; D) p, z mov dx, offset New_Int_Routine
) B: ?, a& g7 C int 21h) @/ {0 k/ C9 y4 q6 h3 [6 U& c5 T
# q$ D3 }: v9 [0 {; Z; Y
__________________________________________________________________________
" E' ~0 h( a' t& e" A3 W( a( v4 A5 K0 S, [. X$ T8 G
Method 09
& B7 h/ o- Y4 s* S/ O: y) h=========
9 z' b: u' U: W: L* ]( x& y O) X3 Q. o
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
7 z- z& u& k3 h ~8 m3 ~performed in ring0 (VxD or a ring3 app using the VxdCall).
+ p: T6 j1 c& w& D) O; \( PThe Get_DDB service is used to determine whether or not a VxD is installed$ B5 n# s5 r3 @% {+ M. G$ m
for the specified device and returns a Device Description Block (in ecx) for
3 y5 D% U( G* ?# q' Ythat device if it is installed.2 }2 [5 g6 @& v6 C; d0 E7 B
! w# y* R4 T( i- Z3 k1 _ mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
3 A0 g1 _2 v; u ^, C- \7 W3 W1 w mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)1 C& Q9 z$ ?" k: T/ { H+ P. j4 B
VMMCall Get_DDB
7 [- a) X h; ? G' B7 J mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
& o: R1 d, o' H/ }9 s0 H" J4 v7 E! M) D
Note as well that you can easily detect this method with SoftICE:
8 P, _ j9 s% V: X+ d) [$ r bpx Get_DDB if ax==0202 || ax==7a5fh
3 y# [2 B- a# S2 R+ _6 F1 p, p4 C! Y, K( ^
__________________________________________________________________________
" \2 o. x6 o1 h# ^, ~6 h$ Y3 X. n ?# N( T$ S
Method 10+ h' t6 t0 s6 ~3 K
=========
; r2 j" d4 {* e1 @% t% c) e
5 j4 t) x# Q: z=>Disable or clear breakpoints before using this feature. DO NOT trace with. W+ ^8 Y$ u) y/ e5 i0 e
SoftICE while the option is enable!!) e- A) b: N6 |, \
% B- X" u3 s+ V5 MThis trick is very efficient:' s5 i! E2 q$ Z4 e! |
by checking the Debug Registers, you can detect if SoftICE is loaded
$ h. r! f$ h/ R. P" i4 ^( A8 f6 s(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if1 k8 a1 s! D4 g# \& t# ~
there are some memory breakpoints set (dr0 to dr3) simply by reading their
7 L. W' X# w1 S1 h3 V* J gvalue (in ring0 only). Values can be manipulated and or changed as well
5 w$ P4 C! j4 m(clearing BPMs for instance)
% q8 B# s' k: z- s0 N7 r# J8 V" ?8 h/ q4 i5 B) {' N
__________________________________________________________________________
/ `( p$ u' z: f/ |
. r8 j- E% ]/ eMethod 11
5 u2 M. Q7 q, Y=========; {5 e7 o, s# e0 x% B4 h* j6 `, x
1 O# @3 [2 q+ qThis method is most known as 'MeltICE' because it has been freely distributed X7 D7 l4 ^- B) X( f
via www.winfiles.com. However it was first used by NuMega people to allow7 }+ e$ t9 ^9 g
Symbol Loader to check if SoftICE was active or not (the code is located. s) @, N( O# _9 r5 O6 `
inside nmtrans.dll).
' I7 u3 u. y% @( W/ g0 |0 ]
5 F4 L. O$ w' J* {# E; bThe way it works is very simple:
' k9 Y }. a3 h0 ?6 kIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
! e: U ~* I& L2 z( P! zWinNT) with the CreateFileA API.
8 }* F- O" E2 _- C
# G& U; ?) o1 ~' g+ _Here is a sample (checking for 'SICE'):& C" }8 w7 w; m# h) `( e2 N6 L9 n0 m
|4 B. I3 W2 Y& ^5 T
BOOL IsSoftIce95Loaded()
% U- |3 ]' `& S0 U- f{
d! h# k8 s) g8 g HANDLE hFile;
7 ?2 ]1 |" W! k! x7 h hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE, {* j: s: Z% c* E. s5 C$ q
FILE_SHARE_READ | FILE_SHARE_WRITE,3 D5 F/ s% B; l; ^
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
# L* w. S7 V+ @* o$ g5 _. H if( hFile != INVALID_HANDLE_VALUE )
0 ]: L9 ?5 Q/ Q6 G) H3 T {; \% J2 z* A3 c: _& K1 Q3 A
CloseHandle(hFile);! \6 g. J# ?, n1 i
return TRUE;
- [. U% S# W6 s+ U4 M }2 V1 M2 Y8 g! C2 T' o1 E
return FALSE;
! _! O, S( y# j7 s/ r. ^: I}: s7 T# L/ x2 L/ x# T9 D5 n3 a- X0 Z
: v3 {9 \6 q1 X( e- o
Although this trick calls the CreateFileA function, don't even expect to be
1 R3 T2 ^" A8 K6 b5 yable to intercept it by installing a IFS hook: it will not work, no way!& o- Z* I6 Z; k% ?% w
In fact, after the call to CreateFileA it will get through VWIN32 0x001F0 P: H, o; ]/ N4 A
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
6 I: I y. Y- d* Z3 t) jand then browse the DDB list until it find the VxD and its DDB_Control_Proc; O1 d5 m* R1 ]& C/ h
field.- A* J2 S3 T; ~4 z9 z; h2 [; Y
In fact, its purpose is not to load/unload VxDs but only to send a
2 R, s/ |1 w9 f) hW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
0 ?# o R8 G; |$ Wto the VxD Control_Dispatch proc (how the hell a shareware soft could try
7 w/ ~" J9 ?( e/ ] s! nto load/unload a non-dynamically loadable driver such as SoftICE ;-).
* _! V j( F2 G8 JIf the VxD is loaded, it will always clear eax and the Carry flag to allow: Y) K1 z% ]1 @# p2 u9 z
its handle to be opened and then, will be detected.% A" i2 w" W$ x$ X
You can check that simply by hooking Winice.exe control proc entry point9 z0 n( q: A+ p5 L; c# X" z5 a, q
while running MeltICE.+ L) i) \8 N' V7 l" d. h, n/ T; Y
5 `5 t2 C8 m* `# ^" U- _& ^' J' r; J+ G: U
00401067: push 00402025 ; \\.\SICE
; Z T( b- ^! o& Y. h/ K2 z 0040106C: call CreateFileA
5 G1 y! j7 a/ ^7 b 00401071: cmp eax,-001! F! }2 i, o& y9 }+ N9 ~# @ p3 ]
00401074: je 00401091" I6 k3 V4 n ^+ u: v+ @
1 O' X% L2 S, j7 r
* N. {2 j* \" m6 PThere could be hundreds of BPX you could use to detect this trick.% E' D7 K( W' W. S9 M* ?, N
-The most classical one is:
# n; R* E, J* P; m8 A1 F1 l BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||; Q+ p; X' M( e
*(esp->4+4)=='NTIC'" U% C) A K% o
8 y' D+ s7 [. i- A6 W C, e-The most exotic ones (could be very slooooow :-(
S7 ?. H6 ~- g" L7 _ BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') " P# p3 Y# ]+ k4 R# K
;will break 3 times :-(6 p @6 |3 g6 I9 `. X
- ^( I& N4 j# s( d# d-or (a bit) faster:
2 y; I, [" p( |5 W BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
( v+ x4 ~( o' O/ t( X9 L& H- F. B9 Y0 N9 x! b8 ^7 Q( w5 U
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' ( ~, q3 M( Z* B: I1 V7 @' a2 k% o
;will break 3 times :-(7 v r9 }8 E1 h+ p% w
2 ?' Q$ d1 @- ^5 Q+ j# x
-Much faster:, a" G) c6 G3 G0 N+ w
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'" C* J$ b- W6 x, K
3 ~, d+ {/ H8 V9 Q: K2 l
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
5 s; Q9 g- n- l/ ?+ L V( rfunction to do the same job:; _, d" D U; \- u3 S. _8 b
( g1 ~' D! S& B
push 00 ; OF_READ8 U2 r/ ]5 C4 A% T' P3 J
mov eax,[00656634] ; '\\.\SICE',0+ Y1 i8 w. m. m4 D: @! x
push eax# z2 K) p8 `+ A" h# ?5 L+ i
call KERNEL32!_lopen
9 t1 f! A" b2 ~/ X inc eax ^# P4 l5 g. l- W* Z
jnz 00650589 ; detected! W2 e% Y+ I* I. a
push 00 ; OF_READ
; A/ l5 m, J7 B8 d5 ]" U& Q mov eax,[00656638] ; '\\.\SICE'; e2 b6 Y* p1 c9 p* o6 [- r5 o" ~+ r
push eax7 u; O. H( r$ `4 X
call KERNEL32!_lopen
) z$ K( P) Y# e inc eax; k/ R( T8 ]4 }
jz 006505ae ; not detected4 Y( d3 h9 _. ?' s; {6 V: ]
" R0 C- S: ?4 V5 d
@/ ~5 V" R1 [2 t, l: L! {2 g! Q__________________________________________________________________________
8 p* ^. S- W$ U3 x: u# i" F" a0 m( r2 Y1 N# L" ~& K! D
Method 127 x6 T! t2 W3 J
=========. l8 z2 O R! a( m# `& x
; c/ L- N3 s: J' ~This trick is similar to int41h/4fh Debugger installation check (code 05) A! b# c/ t( u
& 06) but very limited because it's only available for Win95/98 (not NT)' w) H# B) ?5 N! K, u
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.9 T+ h9 g$ j2 O
- L ]" a6 w+ _) |7 J/ k$ a push 0000004fh ; function 4fh; _: E' ]" T( u2 {3 [
push 002a002ah ; high word specifies which VxD (VWIN32)
/ _1 t3 D7 b9 H( _. ?$ X: _6 z: [' W ; low word specifies which service
/ m# V/ y( \3 v (VWIN32_Int41Dispatch)
. Q: C; l) @/ T call Kernel32!ORD_001 ; VxdCall
# f3 M0 \" f% X3 h8 [9 h cmp ax, 0f386h ; magic number returned by system debuggers2 ^) m6 l! d3 ]" |" ]1 ~
jz SoftICE_detected
/ t8 f3 c }/ ~- G# ^! \2 c# Q- Z- G" E6 m
Here again, several ways to detect it:
+ W) h2 x p" r# ]- C
$ N& c) p1 O8 w/ c" ^8 l+ Z2 |. M3 I BPINT 41 if ax==4f) [5 L/ i/ G. p5 Y0 Z! C
6 t3 m( ~! b. k# q- ~+ ~# Z0 S BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one3 a$ `! s' a+ |' c- s" A
9 [1 ^$ S# T, ^- h$ J* w( x8 j0 e( x
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A! t0 H! e) M3 V% T! J! W9 c
" I7 N( b: R1 y9 K: ~ BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
! u+ ]" W" G( J
0 h" L. w8 A; b$ w4 }__________________________________________________________________________8 W( N, e$ ?( U* p
5 b0 j W8 u* Q" a/ B6 H0 r8 DMethod 13
8 |( j% J& R. `$ m! ?=========4 [+ t- u8 G L. c* s
/ Y0 X$ l G4 \4 f1 _) x; x+ [7 t* q6 w4 ANot a real method of detection, but a good way to know if SoftICE is/ g; V* _6 G U: z4 C; Q
installed on a computer and to locate its installation directory.
, N$ H$ N( k+ o1 f' R. qIt is used by few softs which access the following registry keys (usually #2) : p8 I& c8 N- |* Y6 B# a
3 w/ B5 ?2 u7 b* o* Q3 B-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion$ E) x' L$ u3 X( B$ E
\Uninstall\SoftICE
" a- V+ \. O; G' A( H" R3 }-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
/ `1 a E" u# N. z, C1 v( m-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion5 v( _$ d ]" B/ w, [
\App Paths\Loader32.Exe
+ V; ]/ D7 V& N! S$ ^) K4 W+ @* M% q c& `# k( h
6 U' S a N( o) }$ s ^Note that some nasty apps could then erase all files from SoftICE directory5 S" N. u$ t: `- p: g, W
(I faced that once :-(5 A3 D3 C) K. U/ n2 \ _
1 l* \% e. a1 N- O
Useful breakpoint to detect it:
+ Z$ ?$ \( R# L% m4 ^% i9 [+ Q8 m/ X+ A9 B/ _" n
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE') H3 u E* j6 K5 c, j# G7 y
. L' f' G$ A) A2 a) D
__________________________________________________________________________! Q2 L( j C* ]) ^: b$ {, F
5 t( n; C T" e* ~; |* ~
7 G- J0 g4 P5 o' P
Method 14 , L9 {( D6 @8 {" F
=========3 c2 K2 {. l% {, r/ S9 N4 ~% t
" F# X9 I8 P P4 W# j
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose6 L) I0 L, J7 o7 S8 m
is to determines whether a debugger is running on your system (ring0 only).
0 E3 U# x$ N& V$ j. U& Q
8 r+ r0 @. ^# j/ d# x" n& y( U! M VMMCall Test_Debug_Installed
6 |* b$ G4 G+ i3 ?+ w: o( l! V1 ~ je not_installed
2 J' f4 o' S# e: m! f2 D' D! q
) {6 [4 b) E7 A |( p' U* sThis service just checks a flag. y) R* A$ D, j* Z! [& {) P" Q. g: c5 ?
</PRE></TD></TR></TBODY></TABLE> |