<TABLE width=500>
; {* v# G' w V F. X3 x% B% R' q3 W<TBODY>6 E2 `9 M6 @/ P! a' i5 y
<TR>
; u) P+ Q& y$ _* b4 R& L) _0 @& n<TD><PRE>Method 01
9 l+ @1 g) y8 x) q3 z* E=========! L0 g$ V9 G# o2 p
( x! m7 S# F. R# c
This method of detection of SoftICE (as well as the following one) is# E" E& a. }$ o& x0 O( d C, S4 K$ t
used by the majority of packers/encryptors found on Internet.
2 |, T: S t- n) {' L2 jIt seeks the signature of BoundsChecker in SoftICE
m, x- L1 o( o* Z+ A" T+ a! ^. R# F' i' X6 a0 w$ ` i
mov ebp, 04243484Bh ; 'BCHK'
+ v, F3 Z6 B( h4 ? N mov ax, 04h7 D% Z ^+ b d$ y/ F
int 3
9 W- h& z( B; L2 j2 h) _ cmp al,4
P. `/ F1 h/ X3 }* m* s jnz SoftICE_Detected+ j- p/ z% z2 a' |1 m; e
; G- i/ V0 T7 d F% Q* M$ N8 ^, A___________________________________________________________________________
f7 L: S. H# N( p1 A
y$ L3 z$ [' HMethod 02
) i) V' s8 H: Q" Y=========2 u7 I. f3 J( O9 z2 B) l; l
4 M! C" F. H: l* W# |- d( mStill a method very much used (perhaps the most frequent one). It is used
- W. F( h5 N8 B4 y# [to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
2 Z% F; s$ @3 A# ~- ?! oor execute SoftICE commands...1 k4 K Y4 N; k: l
It is also used to crash SoftICE and to force it to execute any commands
% K% R1 ?: Y) [5 b(HBOOT...) :-(( $ \ Z* X; ^, Q6 z6 X8 e
+ n$ A( _+ N; P- p/ bHere is a quick description:
7 a$ y1 _$ w& v% g$ f-AX = 0910h (Display string in SIce windows)
. ~3 u# ^6 f" x) h- ] e5 J-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)* \% s! J) h: o& K8 N4 Y" J
-AX = 0912h (Get breakpoint infos): T$ p4 L" u/ v
-AX = 0913h (Set Sice breakpoints)
7 v6 R# ?$ b1 N; }9 p/ s' I-AX = 0914h (Remove SIce breakoints)
5 t; z# ?6 Y, I k' f: [
4 C- I6 ?& u: f) qEach time you'll meet this trick, you'll see:' s0 C" U- ~1 U4 t8 V9 y: D# F# @
-SI = 4647h- v: @! ]* y* N$ x. Q$ |" e
-DI = 4A4Dh! G5 y" G' c5 ?. K9 O9 l: h
Which are the 'magic values' used by SoftIce.
: p5 w( z9 x- g4 QFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.% ]8 @7 }7 E! W; H: Z
% x' q" a; x; Y+ |$ N/ n
Here is one example from the file "Haspinst.exe" which is the dongle HASP
+ q' z# {, K# OEnvelope utility use to protect DOS applications:2 e) {$ c; G( e0 Z1 `6 {
) t4 H8 J) Z( c( H* C" K7 `/ e" ^% \- M7 H# m
4C19:0095 MOV AX,0911 ; execute command.0 Q3 D: S1 Z6 B9 D
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
" T N" h% Z. S, ] W4C19:009A MOV SI,4647 ; 1st magic value.9 P' z8 F; U5 w Q$ y( S4 y. j/ k
4C19:009D MOV DI,4A4D ; 2nd magic value.* d6 `( J0 M) d5 i2 b: g
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)% ]2 z8 O$ e: L6 U9 y# ^
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
9 M" H6 Y9 z; }. z9 i" k4C19:00A4 INC CX4 L( S2 x' f# B6 [# Z
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute B( M4 g4 e# A8 `
4C19:00A8 JB 0095 ; 6 different commands.
; F# m1 X* c# ?8 T! h% w& r7 Q4C19:00AA JMP 0002 ; Bad_Guy jmp back.
0 ]; K( ~+ ~8 D5 S4C19:00AD MOV BX,SP ; Good_Guy go ahead :)% u9 L2 I( R; J( [
$ y8 K% F3 S0 i9 s: a! r; VThe program will execute 6 different SIce commands located at ds:dx, which* t+ h( h8 _& G6 M3 D$ ^
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT." g) H2 n! h6 D) ]* t# U9 w
/ R& d! X' I: |7 B1 W2 r
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.( @! t/ k9 \/ n- H1 [0 o8 j
___________________________________________________________________________% ? d- A. z) B: d p
8 Z9 Y2 d/ N( I5 p* d% x
1 Y3 h6 P& U" ^1 ?7 bMethod 03
4 m7 ]9 j1 \/ Z% i4 g' G=========
* a2 A. K3 G) g2 M! u
& R* U2 ^7 t/ MLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h0 \1 \+ F+ s, J* R5 h
(API Get entry point)5 V2 N4 _# [+ z# H S9 s9 @. b5 n
; W" d1 D3 l- a' m4 r2 x
% }: `6 I2 R2 n6 M3 i! P xor di,di5 B, S- n; \: m' `4 x" z
mov es,di
+ V3 H" _% W1 ?8 a mov ax, 1684h / C7 [0 ?& J+ Y* g6 j: Q$ b1 k8 s
mov bx, 0202h ; VxD ID of winice
* ~) z9 ~1 D; y# g9 t int 2Fh" j1 i1 h/ ~$ d/ M
mov ax, es ; ES:DI -> VxD API entry point
# }, v' S+ O! j% R add ax, di
Q) z/ x' z" ~% s4 p test ax,ax8 i' N1 K- f" l7 ]
jnz SoftICE_Detected$ Z% ]2 K+ x, c( l# s9 W
- a9 O5 c7 z- T6 @
___________________________________________________________________________
, [# E; R9 i5 ^; G5 l; G" C& }7 m. o9 _, y! A. ?
Method 04
* s. Q; X, \) Z d: L& p& Y6 p1 |=========
1 Y! @& S- a2 Z+ G$ s7 j
3 K# k/ |$ D0 Z0 W3 Z" c JMethod identical to the preceding one except that it seeks the ID of SoftICE
0 p7 v: K3 j( I: G' [( @8 WGFX VxD.
9 p5 O4 T l0 |
# U% U/ X5 z/ [) C* R* j xor di,di% P* b: C% ~& [$ k! u* ]9 w5 D$ z
mov es,di$ @$ x9 K. ?, l9 N) ]. H) m
mov ax, 1684h - D9 `) X) t- t3 I& ~
mov bx, 7a5Fh ; VxD ID of SIWVID- s/ m9 j& B; m* S9 w
int 2fh
! K" V U# X* d3 k _- C mov ax, es ; ES:DI -> VxD API entry point# f/ v6 W4 B3 K( u
add ax, di
; F" B' o% G; A4 f# m# s test ax,ax$ h/ w3 Y+ Y( A4 z; q/ l$ ~
jnz SoftICE_Detected2 e) y" X+ ^; Q. W7 p- M. w
3 G7 P" n' P- ^5 q7 d0 z# e9 N; g__________________________________________________________________________9 v. Z d) {3 O# b2 e, c
* \8 U" g z& u \3 S( D. n. L7 o3 E+ P2 S; g! [8 B1 p
Method 05/ S" I: p$ m+ Z. b6 |+ q
=========# J; }3 @0 x8 q' Q
, A$ A- `$ K6 H2 M4 V) WMethod seeking the 'magic number' 0F386h returned (in ax) by all system
; s0 n- b' M# C" ddebugger. It calls the int 41h, function 4Fh.7 k8 J t: e3 w5 `: ^2 b% R/ L
There are several alternatives. 8 h( U0 w5 q" K, [, J
5 o8 ^) F' g+ VThe following one is the simplest:
. e- \" P- G' [2 W) K- k
6 p0 }. R; w2 W mov ax,4fh1 k, f ?4 W* c& R% ~
int 41h
/ o2 t' G; Y/ W K: q$ r7 V cmp ax, 0F386$ w4 |! S4 v/ H9 U3 r- _" [
jz SoftICE_detected4 R* X# \9 H! x( \- u' t5 g7 q
+ ~6 N! `; b' `2 k. ?0 Q& G: G1 u7 N3 V! {% k4 Q9 L3 m
Next method as well as the following one are 2 examples from Stone's 7 \) f( |5 J/ ~; f9 \# k z
"stn-wid.zip" (www.cracking.net):
5 w, x `7 J& ^1 C4 @0 T1 |$ ]5 x; R0 C: S+ F# P+ J$ p
mov bx, cs
: Q, d4 K+ @# r) O! h" _ ]4 \ lea dx, int41handler2* r& |7 h: s' \1 o6 h& L$ G- ~
xchg dx, es:[41h*4]
! m4 @5 J# ]8 K, j& B xchg bx, es:[41h*4+2]; F- u$ f9 g0 y/ K
mov ax,4fh) h$ W Q7 u' Z2 L
int 41h
" e. R9 [3 l0 M/ X# X" k" d8 b' }* A xchg dx, es:[41h*4]; i: Q. j8 v# f3 n1 b, b
xchg bx, es:[41h*4+2]$ b! F3 U- [( p- w
cmp ax, 0f386h
9 E2 C# L- J" y/ p3 g' U jz SoftICE_detected
- g+ e& _% n% O/ Y4 o0 \- M
3 S \ @1 }) y9 y" Gint41handler2 PROC4 ?. s# @0 U& J7 r
iret
6 o( R) N6 b: }# X/ W+ rint41handler2 ENDP& S6 v; h1 G* t) o4 d& v0 @
2 n( v( o& b" A ~' L
! Q2 x1 s* ]5 |: G_________________________________________________________________________) D: W3 y: f( w7 D* d( F! S
( K: F# `9 |3 _1 v) J" o$ }& M7 u: M/ B" W: }3 r3 a1 y& r9 v) A8 p5 g# i: J
Method 06/ v I! z4 }) Z
=========6 P3 x0 X" u n* }! H
. i! x7 b2 ]! O. ?
0 A4 A7 a" M; S" h8 ]
2nd method similar to the preceding one but more difficult to detect:- B9 {9 v2 M% _2 H. h
4 C( O- H! N& z5 H! h- t
5 V `% [0 p& }- r: \
int41handler PROC$ {! U z% _. @+ o* Q3 M
mov cl,al
$ ^1 U) y3 g0 V# T' v/ ?) V iret
) m j7 R6 f8 _6 W4 bint41handler ENDP
. {, H% |; A+ C, O; _! i$ @+ j1 `3 L9 q6 ^8 u
0 ~! R) e3 X" [2 P7 V- S* c2 u
xor ax,ax
' l# N8 C7 X" ^5 m3 Z mov es,ax
6 K& z; d+ h; m mov bx, cs
$ n. @ b% ]: M# ?8 o# X+ V lea dx, int41handler" r4 ~! H6 k8 d2 v4 P
xchg dx, es:[41h*4]
! X# [2 t/ ]7 [1 {" y- L xchg bx, es:[41h*4+2]/ ~; m* D/ m& X/ {0 X
in al, 40h$ c* C! Z* k# u3 }5 U* }' ?
xor cx,cx
+ l' c' k6 m `8 Q int 41h1 Q8 K# v; f: k0 H y+ d
xchg dx, es:[41h*4]
% {, @+ G y+ ^( b8 r* W+ J2 } xchg bx, es:[41h*4+2]
( ~' N& i1 f) v cmp cl,al, L6 F( H( A, p7 G$ ?
jnz SoftICE_detected* I/ G$ _! Y1 q- f
0 M; G9 b( \) H9 ~- u- X3 Z9 t* g_________________________________________________________________________& L3 k+ p. r+ H7 V
3 w# w: r9 K! o$ z$ f8 bMethod 07
, J* x2 h4 g4 q/ C0 s& D1 O: q7 b=========
# n$ j+ Y3 S$ i4 C' r/ x/ f" l* {3 U
$ p; Y) k( ]/ V. G; N/ O; dMethod of detection of the WinICE handler in the int68h (V86)7 t% P& [ G: Z
* n2 z$ i. T1 ]
mov ah,43h
" q1 J v2 w5 @ int 68h
, E! E! x i2 W: ^" a0 N cmp ax,0F386h3 b9 G* e) }. r3 ?$ P
jz SoftICE_Detected; w* b* i% S' m/ _+ |( ~& M
3 j+ [8 Z1 H* k; e. j$ g6 u2 [7 e
, d; k6 ~" j8 D$ i$ ?) c7 x3 h* n. R=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
+ @+ J4 I* m& [3 h* F& g2 B app like this:2 J6 J9 D3 Q. w! G9 Q: n
2 w% M+ n( A; ] r0 m T, |
BPX exec_int if ax==68
1 b1 l) o- w/ i# X (function called is located at byte ptr [ebp+1Dh] and client eip is
- T& A4 X" |5 ?& w3 Y: ~ located at [ebp+48h] for 32Bit apps)
$ F- @4 J, w0 W# G; p/ d__________________________________________________________________________) X" `; v+ e H1 }% L" e
3 P1 D% ^' @3 h; e8 W: k
: G' V5 |6 t' NMethod 08
9 p. [! O$ k- H=========4 x2 l) ~' b* i) l$ b
# F$ }3 Q7 v# j) qIt is not a method of detection of SoftICE but a possibility to crash the" o9 g/ d0 f* a
system by intercepting int 01h and int 03h and redirecting them to another
1 D( V2 C" I7 ~* b! X) rroutine.' ]; q8 I# J9 b( P
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
0 V8 c8 }( b3 }, r X3 q' P. _to the new routine to execute (hangs computer...)% U& F& [( B2 b
; E+ D& \2 x* a$ A8 v" o mov ah, 25h" O8 y0 d% U' ^4 S' q, D8 S
mov al, Int_Number (01h or 03h)
6 a0 u0 ~3 A5 m- [5 p/ L# b9 H" x; X mov dx, offset New_Int_Routine
- i5 G) {' s& i int 21h+ Q7 h# ^, _1 H K, F! V
) j8 }$ {6 \/ ?9 K& n
__________________________________________________________________________
- A. Z4 ^' [& T/ c# D1 ^
- Z: j; n" R6 G0 jMethod 09: k) n* x; n8 c$ ~0 `" |
========= X1 E+ _. _# s& Y* O; T* ~
5 k5 d! C* V/ Z& ?3 s/ d
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
" T! H F# W& Iperformed in ring0 (VxD or a ring3 app using the VxdCall)./ B9 S" o. p) |6 K
The Get_DDB service is used to determine whether or not a VxD is installed2 ~$ `2 I* _: T; G7 i' H4 H) u' T
for the specified device and returns a Device Description Block (in ecx) for
5 J6 h$ c ?- |1 T6 e: sthat device if it is installed.6 z0 t$ C' f" l, F
5 T* y- n' L3 I* I W
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
" ^/ {+ Q- ]2 T m& M O mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
1 T4 l; k. {8 j* K2 ^9 M3 u5 ^ VMMCall Get_DDB
' V, {" R7 T- V* m mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed" t9 E9 A3 g5 w) l
g5 |" j5 R5 Z$ I
Note as well that you can easily detect this method with SoftICE:
. }8 N* K' }/ e' z U- e bpx Get_DDB if ax==0202 || ax==7a5fh9 N! j# q3 Y( M& T }+ ?
6 K- M# t; B }
__________________________________________________________________________
9 _4 i% b- C6 U; Y3 m1 C5 Y
0 H* ~9 d/ r- s) ]4 JMethod 10, V) \" f* r# ^: v2 R: V
=========& D0 @+ K+ K7 C2 _& u1 I
. _1 `# r# V2 @=>Disable or clear breakpoints before using this feature. DO NOT trace with: Q; `) }5 x; E! D3 b Q
SoftICE while the option is enable!!2 O e: L5 l; S: Y' J
3 d. b- d" f- U% U' z( o4 j' _) B$ rThis trick is very efficient:& }6 v; U" h5 q9 K4 [# L* g0 U9 \
by checking the Debug Registers, you can detect if SoftICE is loaded
, s+ H6 X# J0 l. F! c(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if9 ~, d' K& n; Z; t9 F* }
there are some memory breakpoints set (dr0 to dr3) simply by reading their
) Z9 r% x" }8 z" {value (in ring0 only). Values can be manipulated and or changed as well
2 o" V2 ^1 \: ?- j(clearing BPMs for instance)1 E* ]1 {4 K- f4 x1 J* E$ [, j
! }6 T8 i& m9 T3 v4 P
__________________________________________________________________________
9 W8 L+ s+ `5 o3 t3 Y, V
1 k! h' u8 n: i, D& VMethod 118 E) ~+ A+ h0 J. w9 t5 x
=========$ n/ o3 Z8 N7 p! Z4 X+ x% f
6 y! f {+ D6 i0 ?
This method is most known as 'MeltICE' because it has been freely distributed# p9 p4 [; t& e% i+ {
via www.winfiles.com. However it was first used by NuMega people to allow
; R% S$ Q- u' [Symbol Loader to check if SoftICE was active or not (the code is located
% O) }% s4 P4 z6 I7 t2 Ainside nmtrans.dll)." }% [1 R( T3 z0 n) @ I q
% u2 G& `8 ^- \- w* L2 |/ B
The way it works is very simple:
1 { p9 m& `' WIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for: L7 ?0 |$ m; R- ?* C8 P
WinNT) with the CreateFileA API.
0 [7 s1 z4 h2 x. w! w: F7 B$ q/ [0 i. j. \
Here is a sample (checking for 'SICE'):
+ w1 o' o3 C6 q; Q0 i6 [5 M$ h" s4 ~$ c) O
BOOL IsSoftIce95Loaded()
6 y0 W* n) |+ O0 f) M' [{
7 A2 Q' s* d0 t- x- l HANDLE hFile; ' b5 S7 C) n7 {
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
" b1 [) b2 ^! Z% D+ i FILE_SHARE_READ | FILE_SHARE_WRITE,
2 X7 R9 }( U9 z' H/ ]1 T NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
a$ m C$ {8 ? if( hFile != INVALID_HANDLE_VALUE )! a( I1 F' M' w: r* F# e
{
3 M5 k5 J7 G; U2 r6 q+ F CloseHandle(hFile);
2 i- @0 h' H6 |& c1 i7 ? return TRUE;0 d {! v% M# G( d: M3 K) M- a
}
& }: }# T# g! j4 t return FALSE;
, A0 t% O1 W6 }" t' [" j}7 y: G. V, c& z; f; |
0 W: F2 |7 {9 o4 m$ SAlthough this trick calls the CreateFileA function, don't even expect to be
t7 O1 E1 Q$ h8 C- c2 kable to intercept it by installing a IFS hook: it will not work, no way!) R# s( o( e( H6 h5 V6 o3 v6 J- {
In fact, after the call to CreateFileA it will get through VWIN32 0x001F2 R9 h* Y; t0 {& V: j/ J( j
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
3 w* V+ J2 q5 w% T+ uand then browse the DDB list until it find the VxD and its DDB_Control_Proc8 s Q4 m7 b8 P; Y2 z7 b* ?
field./ h) `8 m' _- c$ T
In fact, its purpose is not to load/unload VxDs but only to send a
; g% l2 h; z3 X. h" RW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE). _1 e$ H4 G3 x- \9 q
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
/ w% r5 C8 S% {6 Cto load/unload a non-dynamically loadable driver such as SoftICE ;-).
$ t7 @! _. v& A2 x; [- NIf the VxD is loaded, it will always clear eax and the Carry flag to allow% t/ [* p2 ^+ N8 E7 e
its handle to be opened and then, will be detected.
/ f4 L, _1 r* f6 P4 A' pYou can check that simply by hooking Winice.exe control proc entry point" _* E0 |6 P q6 X2 \( p5 ~+ P
while running MeltICE.
7 t$ c3 ?; p' u9 [! j$ a
: g6 L: J: P, M [% m3 `2 X% U5 _
$ D! D/ B' v( n% i, X) k+ O" E6 W6 I 00401067: push 00402025 ; \\.\SICE
' _2 g$ i6 D8 h 0040106C: call CreateFileA/ P( X4 o* b, o4 {% Z% o
00401071: cmp eax,-001: l' _5 z) p. w% ?
00401074: je 00401091$ l4 C" y) v4 f6 O
3 W, G9 z+ a4 R. ^) K" x3 Y b4 `
' t0 Q2 W6 F6 n' s6 MThere could be hundreds of BPX you could use to detect this trick.
6 @. _4 ~9 w0 s2 h( f: z+ A-The most classical one is:: p, e0 [3 S+ L, q* M
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' || h& I! P& \7 R' D5 m( D
*(esp->4+4)=='NTIC'
1 L1 C0 x, m7 x$ }) ^9 A5 v& n- t8 U
-The most exotic ones (could be very slooooow :-(
6 w8 i' d& m' c, ?1 i- S BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') - T, f: w7 O* x6 ?
;will break 3 times :-(
+ e* x' b% p: Y6 p' a( p
# F, W3 t" x+ t6 c" c1 |1 T9 a3 r-or (a bit) faster: 5 f4 b, H5 k6 v2 L3 J7 m
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
1 F( ^/ z9 V1 M0 v- I/ c% \
* }6 K3 Z) z8 G( {/ C BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
$ v" E b" Y3 h ;will break 3 times :-(# U- b1 ] k, F+ X j
' i5 p) b* b: Y-Much faster:+ ]) Y# Y4 u$ C
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
0 [" p+ Q# z# q) u7 E# H
, Y# f) ^( k; y' rNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
+ J2 f b# o2 i5 U1 yfunction to do the same job:, k3 ?9 @$ |4 o- e7 l" E& J
# Z0 P% o* Y9 {1 O( e7 X$ |+ T
push 00 ; OF_READ8 p. H. H" J" z* p
mov eax,[00656634] ; '\\.\SICE',03 J, t% f; V) \$ \
push eax* h5 B3 W t9 v/ F' Y, ?/ i
call KERNEL32!_lopen
) q0 f- U. K' C9 C* y inc eax- m, h( u$ X5 R9 K0 \
jnz 00650589 ; detected
$ f+ w( D1 Y& [6 F) q4 [ push 00 ; OF_READ
' L8 |+ d4 M# v% E4 S9 I mov eax,[00656638] ; '\\.\SICE'
/ g0 q) M! V) `6 ~8 U% n! C) o push eax
# _ K7 w7 P7 {; C" }2 u: x9 G call KERNEL32!_lopen' X4 y4 {3 j1 f- ]' k4 @
inc eax7 i" \: F$ P; ~1 g: h
jz 006505ae ; not detected" I1 o$ b& Z) S9 C/ F' {- M' i
/ l7 H3 E7 C. F l6 L9 k1 m4 \+ L0 D S0 X1 o, Y/ |$ f
__________________________________________________________________________% O9 `8 F: p- `, {% Z
$ n3 }* q |8 Z2 x3 f. @' mMethod 12
* q& c8 s! O! _/ q/ d=========
5 Y4 j+ x3 N. o3 l7 [0 h0 @; M3 Y- E6 g+ l- x8 N
This trick is similar to int41h/4fh Debugger installation check (code 05
1 a7 g+ P4 j- l$ q" r G& 06) but very limited because it's only available for Win95/98 (not NT). x ^* C% m3 b4 A& J" A" y
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
% j& R1 f2 b S+ H& n( e% N( ?# d' c3 j8 E) m3 l' p& N+ p- l
push 0000004fh ; function 4fh
& P7 q1 x4 Y" g$ O% R O push 002a002ah ; high word specifies which VxD (VWIN32); C9 B' e- _0 l! k2 e
; low word specifies which service
, T4 Y( n, L# r% ~ (VWIN32_Int41Dispatch)# J3 V1 r- O( n/ o
call Kernel32!ORD_001 ; VxdCall7 K8 J+ \& ~3 u7 a) z
cmp ax, 0f386h ; magic number returned by system debuggers
5 E( Y% H/ f# p+ }6 C jz SoftICE_detected7 Z+ a4 Z8 Y1 E7 P( G+ t4 w- Q
3 |' L$ Y6 }% ^; v# e% LHere again, several ways to detect it:
9 k# @8 U: J3 f7 G/ e9 f3 e0 g! a3 Q. _
1 x2 w! ]7 Z# H2 o% T4 w. T BPINT 41 if ax==4f/ m. l B, f/ h- j- E" J- Z7 P
" z4 [ d7 k( m9 ]9 Y; S
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
5 Q8 `8 c. T3 L* E5 N1 w. `
) G- D0 W+ p! h N BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A k- p/ j7 ~6 [. T
# d$ v r) A( x6 w! t, u BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!% t; D; ]; B5 I- a0 K
+ |6 p6 G/ Y/ @/ V- N__________________________________________________________________________. r0 r9 V5 r. U
T4 u0 w$ e. W( I, b' M: LMethod 13+ r' Q. V+ ~7 v/ F& z8 D
=========0 J+ n+ \" u7 a
) b, ?2 ?/ ]5 A8 `' ONot a real method of detection, but a good way to know if SoftICE is
' Z4 r% O$ L6 _+ ^ xinstalled on a computer and to locate its installation directory.) ^9 }8 }, K2 f& V, t% z' A
It is used by few softs which access the following registry keys (usually #2) :
+ c( G3 |, ]8 E3 r# ~6 D5 J( u" n- O* ]0 S
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion# w# J; J9 s* j
\Uninstall\SoftICE
& e( c& Q8 X" }-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE. P. c. @! F; g1 {. C8 K! O
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion @" q5 X' T0 O
\App Paths\Loader32.Exe
8 ] r# n$ B1 x5 u7 p: I9 S+ s3 J' }1 F$ n
y/ v0 [8 ] {, Z4 K0 G& u+ JNote that some nasty apps could then erase all files from SoftICE directory
: p% Q! {( T" e' F2 T; x$ Q(I faced that once :-(9 k) c- o% T$ {5 [+ W4 Z
- C" i9 i T5 ]4 u `- H, ]% \
Useful breakpoint to detect it:3 j) i* R& l& S* ~( v; `
" `( ~- q' X1 f5 ], J) V BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'& n% S! j8 R3 }) q# n
: U. ]8 X4 k, T! Z4 Q__________________________________________________________________________ l7 `9 O% g9 ~$ q. P- G3 g
, ~2 e' Z$ n" T N7 I* g& h) c3 y* B; t7 T3 Q6 R8 B7 x
Method 14
) { ~! M" f) O! S# D9 {=========1 J" }5 t/ ?: }7 M. R4 i
% u5 _' Y: J) p' R
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose$ m) p* X% q7 K) B+ T
is to determines whether a debugger is running on your system (ring0 only).+ N9 Q5 D; j. P" B. R
8 \2 l x) `" I+ y
VMMCall Test_Debug_Installed+ ]: i+ M; y0 G9 j( s
je not_installed7 B a R A! v2 y- {5 ^
% h- p) k4 @: I
This service just checks a flag.$ L& U% p \6 B, m! `& _
</PRE></TD></TR></TBODY></TABLE> |