<TABLE width=500>
8 \( O- ]4 ?. D* b<TBODY>' L- B. d7 g/ N
<TR>7 U2 G9 _6 z7 H9 [) e/ n) Y" n! f5 O
<TD><PRE>Method 01 E+ o% n. _& E( P& X
=========8 Q( O6 S6 I1 G, W. _6 K0 k
0 `: M: [: l$ ]1 J
This method of detection of SoftICE (as well as the following one) is- j# L3 E& ?) A9 i! R; O* l
used by the majority of packers/encryptors found on Internet.
# l$ X2 ?# v( @! Y5 M! g4 BIt seeks the signature of BoundsChecker in SoftICE5 A6 q7 O8 |, ^, p
: S+ p+ g4 f8 k5 w( V# W$ {- a$ X9 P
mov ebp, 04243484Bh ; 'BCHK'% @/ l5 M- Q- N0 n+ O1 S! x
mov ax, 04h) f5 U: n, u% B& x. F
int 3
, l8 O9 D% `1 b7 G. v3 B7 b+ L# z cmp al,4
& k0 s( |3 h, Y8 x6 Y8 b: u. L5 Y jnz SoftICE_Detected
3 g) B5 `4 i: L. O Q
, ^* k% @1 c# [5 M9 t9 O8 r! D9 ~9 j/ l___________________________________________________________________________# u: p$ T2 f( F; ~5 T3 L2 p& X
2 z _" K6 G9 hMethod 02
j M: m- C. l7 u6 r" i) l=========
) z- A/ |, k2 q/ [5 ?5 N5 O( n+ {0 y9 L3 N0 u
Still a method very much used (perhaps the most frequent one). It is used
]( |% J5 G; ~! c, C3 C, r" ato get SoftICE 'Back Door commands' which gives infos on Breakpoints,
6 l1 r8 E2 a6 for execute SoftICE commands...
- `1 b) j/ \9 dIt is also used to crash SoftICE and to force it to execute any commands
, P/ K! |& G- e& O(HBOOT...) :-(( 0 f. X2 L/ F0 B! i8 H' l' q
6 T- Y) c8 {9 S9 Z5 Y
Here is a quick description:: c/ @" U& t, U; w5 g1 L& c$ V& a
-AX = 0910h (Display string in SIce windows)3 K" i; O" D7 d, D
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
0 r1 b& [0 B4 w. j' E( T" E-AX = 0912h (Get breakpoint infos)
7 F8 D# P* c' p-AX = 0913h (Set Sice breakpoints)
- |% t2 ?0 r( ]& T* a- p-AX = 0914h (Remove SIce breakoints)
( k. A( I0 ^+ _$ ?) p
6 K, t1 X' j+ r/ m2 ]! QEach time you'll meet this trick, you'll see:
' J, b; ^6 q3 C2 z5 a! }% h-SI = 4647h
; y2 m& n, S1 ^7 |- U6 H-DI = 4A4Dh! ?* t" [; c+ k$ W
Which are the 'magic values' used by SoftIce.* O& H; c- q2 q6 q7 z5 ]
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.' F5 t# q H) E" b' `; i) }+ }
2 ~! w# Y/ j( Q1 c1 t, M6 H* {& l" }Here is one example from the file "Haspinst.exe" which is the dongle HASP
X3 K$ c$ y( d& e& oEnvelope utility use to protect DOS applications:4 j: g+ I1 i8 a2 P# r3 ^
: e1 X& }" r0 ~( T0 W8 q
- p* Q' z0 r. N( Q4C19:0095 MOV AX,0911 ; execute command., w- u6 I- K$ n; A3 F
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
+ f, s& n' H: a: V9 J/ [4C19:009A MOV SI,4647 ; 1st magic value.3 `/ x. \9 A% Y' L, w
4C19:009D MOV DI,4A4D ; 2nd magic value.
9 C6 ~. y# t, b" u/ } Q4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
3 V; Q: X5 A- m# F: H' }2 Y4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
5 I0 `6 B8 H1 J4C19:00A4 INC CX
; I6 m8 q0 z- e4 f4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
4 E! q8 p! m! t& }9 ^# A9 a, P4C19:00A8 JB 0095 ; 6 different commands.! V, L! M( v7 E7 H" v! T. O
4C19:00AA JMP 0002 ; Bad_Guy jmp back./ G. ~# Z0 S ]$ Z/ l
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
( P: W4 S" k( H, N2 m. ]1 U {( z* a9 O m2 L
The program will execute 6 different SIce commands located at ds:dx, which
8 k+ l; j6 V0 o; d% iare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.7 P8 p3 r5 R# H
) ^4 \5 R( \/ o1 h
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
% p: j, ^7 H5 O2 t% s* X/ u# b___________________________________________________________________________1 s4 `* T) h+ v
) P$ H9 X& q. t$ p' [* x' }
2 Y9 S: O: p+ Z7 Q' A* f9 aMethod 03
1 h! g) ^' J$ r U8 N=========
( f3 ~/ Q& G* i3 i
0 L$ U" @( p8 Y! SLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h8 i* K$ z1 Z3 U. } S# _' T6 n# ^
(API Get entry point)
5 i+ k# g/ ~: ?) \* J8 c
4 x% _8 h% }* u7 p* F
( E# X5 I( H. _/ x7 q& H7 B3 q7 c xor di,di# t* ~/ q, I8 S* o9 j
mov es,di
( I) W/ K' u4 G" A& Y p2 N mov ax, 1684h ( [6 P, ^$ p( z, q8 L2 i4 G
mov bx, 0202h ; VxD ID of winice# h4 u* }9 G+ _9 W
int 2Fh' j. W8 X( m; s
mov ax, es ; ES:DI -> VxD API entry point4 o. f% V8 A) W. k
add ax, di
& R# K3 d1 n7 x. v) [* T% ^7 U& p test ax,ax$ ~& c: [2 t$ J: s9 a0 |
jnz SoftICE_Detected) I& O( d2 u* e! p+ Z: B; E
9 H1 {( i G- o$ y: |+ |2 f1 ?
___________________________________________________________________________
! l1 }( R3 x, V' k3 A5 q
& L% {! i, k9 R( ?6 VMethod 04
1 U2 m A" q. [0 X7 E. J=========
- n; G* w1 S" V/ A- l6 \% ~2 W
+ R* Q! D" L4 ?* @0 d' N# r# jMethod identical to the preceding one except that it seeks the ID of SoftICE( H1 f: n1 U& f
GFX VxD.
5 W! Q, V8 _/ ]3 \" |$ t4 L8 f6 D: c! x n. Z: }; g5 z N/ X5 d
xor di,di9 f) j' W( l. j8 M7 x
mov es,di
. ?# x" s& W, w( w0 g mov ax, 1684h
' M. q1 \2 X8 o7 h mov bx, 7a5Fh ; VxD ID of SIWVID0 F! r" F; I/ f: H9 ~* |# X
int 2fh
, T2 E' r9 K, U8 O mov ax, es ; ES:DI -> VxD API entry point, p, q! O0 H1 n9 {/ z; `) ^4 F8 x
add ax, di, G: g& q2 t- c& c/ ]0 r
test ax,ax
% t* w1 @8 t4 S# c+ C9 N/ z$ o jnz SoftICE_Detected7 p6 {8 R0 R2 Z6 @: u/ h, {
) w* \2 _3 u. X1 D( X0 W
__________________________________________________________________________$ d6 \2 |5 h. O
% V% d1 k4 y! W2 g. W. {
; ^0 v3 y0 B7 f5 H* JMethod 05
; Q# G$ y3 I% p+ U# F+ y=========
$ d" j* A5 w w) H- o5 P( A7 E% ]2 [' T
Method seeking the 'magic number' 0F386h returned (in ax) by all system/ S" a* k* a5 {' v
debugger. It calls the int 41h, function 4Fh.
; h5 }# A/ N9 K5 f- X5 D! N, a: I# CThere are several alternatives. N L) z4 a8 U0 C2 w
+ b" P3 Z+ g. r! t; i" M- |) ZThe following one is the simplest:
* J+ w% ]' C4 P: v1 |* U0 e5 N1 z& A
0 y/ \& [5 w9 T* F1 { mov ax,4fh
5 h+ L2 j3 B9 r. z( J int 41h D- ^( t+ |6 S
cmp ax, 0F3868 Y7 S! K1 i3 V; x) G R! l) q
jz SoftICE_detected
0 U1 q" o! u5 n$ l8 b
# l# }' G$ V7 b O
r% ^% M8 M% o4 B) s" r2 R+ UNext method as well as the following one are 2 examples from Stone's 8 q0 o4 n1 k( f. }9 ?+ N
"stn-wid.zip" (www.cracking.net):; ? @3 N1 O5 I3 L! [- D
+ e* t2 l6 P% m1 y( s
mov bx, cs
1 O$ m3 w8 k/ V `% O6 Y7 K; e lea dx, int41handler2
7 B; N/ g5 M: u& ^5 S- [7 ` xchg dx, es:[41h*4]
: b, T6 s3 a; n, ]4 |# r$ z# ` xchg bx, es:[41h*4+2]
" D. l( f% U( b2 X# w7 k mov ax,4fh2 N, w. Q( i1 T3 o3 H
int 41h
: r* X7 V* ^+ S& p xchg dx, es:[41h*4]
1 ]* k2 v: E. w$ c xchg bx, es:[41h*4+2]
7 b5 u/ A( G5 E* A6 s; p3 r cmp ax, 0f386h
+ Q% a7 |2 U" w8 k" _# e+ V3 h& K jz SoftICE_detected1 a" a# u8 H8 Y7 ?
7 D3 X5 ?1 a9 C5 E b1 @
int41handler2 PROC
+ z- F' n H: n7 ]1 L iret
8 i# A& B7 `$ g+ Yint41handler2 ENDP
: h% r" F4 [. r2 J# \
3 ]9 m6 N3 R! f# Z1 [- l" K
( ]0 \0 q+ r( W* X_________________________________________________________________________+ R/ O- L2 e* I3 l9 V W
9 Z( h3 P, y& d! [2 F+ G& c4 ?4 `. R( `0 a" @
Method 06- m. c3 p; X7 m" Y8 q
=========
! O5 O! H9 R" w2 _5 i9 ?1 u3 h& n6 Y+ A+ n& I+ D% `
, T" h8 Z" s/ r: L ]( y }0 R& g
2nd method similar to the preceding one but more difficult to detect:7 X9 o- F' z7 ^5 E5 _. d" h
0 P$ X+ ]/ q# q* B
. U5 v$ m) \9 {" @3 g3 eint41handler PROC! t0 X# S0 T9 p+ I# K
mov cl,al
* V! O) X; t: M$ e. v iret) O; W8 j9 r/ N5 b" l
int41handler ENDP- D4 X5 Z/ o0 i: d2 T% Z( w
' Q) ^$ ]- ~; [6 d
* V4 {3 V0 p! f4 r! x- A5 m9 r xor ax,ax* ]. w' R, z- S2 H3 u8 p$ X' q
mov es,ax" @/ U2 a5 A; [# h" q& S$ M2 r
mov bx, cs0 X/ U5 f* O5 \% j* u* x5 m
lea dx, int41handler
4 j y* ?3 S: A xchg dx, es:[41h*4]
& j L% E) K5 Z' `0 U9 J+ J xchg bx, es:[41h*4+2]
, f! q) V! z) q in al, 40h
' A( z5 J, y7 [ u! k" L+ X+ m/ G2 T xor cx,cx
' }2 g5 i# a9 z+ p9 C+ p3 G int 41h* T" I i" r% E% F' F8 `7 k
xchg dx, es:[41h*4]2 G2 X" W0 X8 Y- B0 s2 i/ I
xchg bx, es:[41h*4+2]$ ?, ^/ _# S- l2 [
cmp cl,al
; l; x) T7 c) o i; |. D jnz SoftICE_detected& F8 A$ {' r7 v! O' `7 P
' v1 \2 e0 @% b: W4 ^) G+ K! v. k_________________________________________________________________________% [0 ?' E. D. P& R% I
6 [& a5 q# A" C3 S
Method 079 @& V0 f" T x3 O
========= ]1 f! f( C5 z3 w7 F# |
9 z' V' ^ P, \/ KMethod of detection of the WinICE handler in the int68h (V86)2 R7 G1 _; O/ [* J
5 g" `9 F1 s0 N9 W% z" v4 b mov ah,43h
' \- _# E6 F& n. T' Z" u int 68h
2 }) {5 a- z, _3 _! \" O. t cmp ax,0F386h
z9 q+ t, n; V' a* X4 @& w0 ] jz SoftICE_Detected- M" T+ f7 L9 g* R% n8 P5 U4 c7 D
( g# m9 [, X+ p; C5 y( [- |
" B' c3 f1 {4 p3 \
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit8 r+ G. N( S5 ^
app like this:
' g! N* t) d7 `) J0 V6 D# Z A- m9 F4 H/ ~% L2 {- j& z9 Y. i
BPX exec_int if ax==681 C5 _- f n0 Z& O
(function called is located at byte ptr [ebp+1Dh] and client eip is( ~8 C) S3 \- |" F7 r9 ~, n& b
located at [ebp+48h] for 32Bit apps) ~/ l2 \. b! I1 d) M _: K3 c
__________________________________________________________________________
1 p, V8 A' r- v: c9 j# X
7 H# c3 d0 R0 z. K2 @. Z
2 i! Q$ U2 ~9 R2 o1 L: }Method 08& d5 D5 N" A2 }7 o* y: n
=========! K5 c+ e, Y$ W: Q) ^# |
! j+ @- [9 z3 ?; T: SIt is not a method of detection of SoftICE but a possibility to crash the
0 i) G) I* k: o6 ~1 b, |system by intercepting int 01h and int 03h and redirecting them to another& z8 p# @4 `: T+ a u% p
routine.
4 V/ a( q4 l' g$ T! a! KIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points8 |* a8 J; j; p, E- b. B
to the new routine to execute (hangs computer...); N/ K3 q0 D: Z( L$ R) r$ G
! K" h! H1 J8 o- e mov ah, 25h' o$ U) V# h" w2 k+ }3 X% I( N# K
mov al, Int_Number (01h or 03h)
R4 }8 l2 I) J9 d/ E, V. H) {8 N6 v2 q mov dx, offset New_Int_Routine
3 [# x' S; w- m7 r/ t; y$ c3 B2 f int 21h
7 Q! {$ o2 j8 J3 D' J0 {, n" x) Z" f! D
__________________________________________________________________________
8 s$ Z! x n+ o: d
8 D o# O- ~2 {Method 09
0 g+ r! f1 \4 @0 J7 r=========- i6 e" x2 b" R, S% v* l0 j
8 k/ r& ? u H& GThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only1 r [5 ^. [ K' k! F3 [
performed in ring0 (VxD or a ring3 app using the VxdCall).
' Q; N$ Z% I; t" j. }8 FThe Get_DDB service is used to determine whether or not a VxD is installed
. ^- g y' Q6 L3 v5 i0 ]. @for the specified device and returns a Device Description Block (in ecx) for
6 g I6 k2 x( V" B% m1 Othat device if it is installed.
8 W# A5 l& {9 K e c
# M! {) [) W! P6 u: t mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID; K3 k! H" C5 T7 Y
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
( m9 P2 Q3 b1 j+ W" m z VMMCall Get_DDB
: u$ h6 r, Z) K mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
' ]. Z" y& ~7 P) l
# W1 M, t, K p. N/ mNote as well that you can easily detect this method with SoftICE:, t4 \0 Q4 X+ J2 O' n, O" V6 l0 D
bpx Get_DDB if ax==0202 || ax==7a5fh
# I' x3 }; H- o# h+ ?. J1 M! X% B0 c7 t ?1 j$ F5 l8 I
__________________________________________________________________________
) x b0 o4 z' p: @0 r6 z6 i4 e# N2 o7 k6 l$ B) g6 k/ z
Method 10$ I& K8 V/ G2 a! L( H
=========) a" x2 ~) r2 n# d
* C T+ K- Z* ^ B/ w3 [5 r( g
=>Disable or clear breakpoints before using this feature. DO NOT trace with9 S4 Z! l1 V: @8 L
SoftICE while the option is enable!!6 [% r! h. \4 a4 G4 b; I9 [ p
5 }: N% K/ }6 R/ s' UThis trick is very efficient:1 {, K2 R: Q. u* z5 ?2 p2 h
by checking the Debug Registers, you can detect if SoftICE is loaded
0 `6 o! I: }# d! A(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
. I/ y/ E* }) x9 J3 Bthere are some memory breakpoints set (dr0 to dr3) simply by reading their7 `9 |" W9 Z& V
value (in ring0 only). Values can be manipulated and or changed as well1 `8 d) q# ?4 T, X+ ]
(clearing BPMs for instance)
% T/ F) o0 n+ E( D7 X+ w0 f0 x: G7 v I4 K' |
__________________________________________________________________________
; F5 ^7 t8 \& D; `+ B" u5 a7 `' R( y9 q' D' o! F
Method 11
6 Y# _5 C, S/ |0 |7 Q/ F=========! y- I) j* v7 Z2 y0 [# _
; q/ B0 }. f/ B' D
This method is most known as 'MeltICE' because it has been freely distributed0 l' u' |" ~4 \9 B& m
via www.winfiles.com. However it was first used by NuMega people to allow0 x1 O" u9 _5 J" q" E7 Z
Symbol Loader to check if SoftICE was active or not (the code is located
. y# P# L) H, ?inside nmtrans.dll).
; m& c6 }/ O' R3 Z- W* g9 Q6 o6 U; |# h1 e. u
The way it works is very simple:0 r. b3 y7 T0 Y |5 E( _+ w7 r9 S
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for e s7 j7 m* ]( t( @& V
WinNT) with the CreateFileA API.
( d( _7 y v4 {' M, c9 S& F- F
6 {! v- J) P/ z/ s+ P% g) MHere is a sample (checking for 'SICE'):4 I( B7 [( [' y7 f
- H Y7 Y+ S- v
BOOL IsSoftIce95Loaded()
1 N9 ^8 i% V8 G* W# {4 Y{. z: H. d4 H% c; h
HANDLE hFile; ( s( E; v- ?0 u
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,! |, R( N6 Z( \2 Z% r
FILE_SHARE_READ | FILE_SHARE_WRITE,0 [# p. t7 J7 ]. p* Q0 _& b
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
2 [: s& w' P2 \* |. |- w$ _1 Y$ k: ` if( hFile != INVALID_HANDLE_VALUE )9 `/ ^# e+ K1 `
{' z6 x/ s1 {! r2 x: Z6 Z+ z
CloseHandle(hFile);. @) }* y/ p- g. s/ g5 h
return TRUE;
% ^) E1 {7 X1 [8 c5 y2 z }3 |3 A, n$ g4 B0 h7 W+ G
return FALSE;& c O5 l: i$ a) F2 ?/ b+ {, L
}0 F4 c% i! a- t. r. k& x
1 T' o4 w1 J/ UAlthough this trick calls the CreateFileA function, don't even expect to be
" a' i8 ?; [7 ^) i5 F# r [1 |able to intercept it by installing a IFS hook: it will not work, no way!7 ]8 F; [5 a8 G
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
& x+ W% D5 n) U" x; eservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)- [% s" c, x9 C1 a- q9 ?9 |) m& _
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
. h( \/ E% X- v0 A0 o$ B3 }field.
/ x! H2 ]( n* S9 s# cIn fact, its purpose is not to load/unload VxDs but only to send a . t: H$ m4 `+ w i
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)0 R: }! P' y6 d3 G( D
to the VxD Control_Dispatch proc (how the hell a shareware soft could try1 o' h! j/ { @) n) Z/ \" f
to load/unload a non-dynamically loadable driver such as SoftICE ;-).$ l$ w5 \% A* v
If the VxD is loaded, it will always clear eax and the Carry flag to allow
; k( W; {, m- w6 D3 nits handle to be opened and then, will be detected.
! R: g/ O) n. Q% ]You can check that simply by hooking Winice.exe control proc entry point2 j7 O/ H: U1 [5 q( g
while running MeltICE.. Q0 D0 X h; t& g5 _; K
* B/ O6 t( e3 Q; e x: o" d% r
( t4 h" h$ i. r1 x$ o. _, I3 H& q
00401067: push 00402025 ; \\.\SICE. c/ D+ F+ }% O: S* a. }
0040106C: call CreateFileA+ E3 I; [2 S( q+ g0 R
00401071: cmp eax,-0011 I; p8 @% y+ ?# }4 y
00401074: je 00401091, E3 i) c+ [5 @% E8 e$ r" _
. p. W8 _1 X! C; P( o5 c5 ]5 i* L% z, }2 a# U
There could be hundreds of BPX you could use to detect this trick.
i% j4 q8 I3 K* k-The most classical one is:
- ^) o* m4 s5 r BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||. P' k' i3 K- m' K4 t7 {3 d
*(esp->4+4)=='NTIC'
0 m* F6 S" b' y4 A
, m* Q+ z0 V! ]7 m-The most exotic ones (could be very slooooow :-(. B4 o/ }! y' F' ^$ v* u; N) J& m
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') * V: J) e# L7 a' @
;will break 3 times :-($ G# s# v9 F3 n$ e( j% ]. V. ^
& Z% C) k, A9 H. f6 z7 B. i-or (a bit) faster: ) v7 C& y+ j3 `" ?! e
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')1 t% l( {6 I3 ~* t0 A
/ M9 a! U. ~+ m
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' ! h; H! q) ^$ z- U1 {. a, E
;will break 3 times :-(5 G, t7 D+ r" T3 x7 D. ]
! T8 y: H& U7 h/ W8 A2 Y, m* g( U-Much faster:& j& L6 J% s e3 {1 T
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'+ C9 l2 B' ~! L; r
3 T& f% ?" a- r! |4 V
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
' \& E9 {" q8 D# W1 Y1 mfunction to do the same job:8 j5 m( [: `1 I4 M
9 U- }2 E8 A9 b6 b" Z/ j
push 00 ; OF_READ
4 t( H. G6 O9 w7 t0 `- P" F. k mov eax,[00656634] ; '\\.\SICE',0
4 e7 L2 ~& I$ [2 j push eax3 V Q& p' [' p! N! F. G" K0 l* E
call KERNEL32!_lopen: ~! _* A9 j4 d8 ]; V7 {, w
inc eax0 k# u+ H, p% P' y5 ?% }4 C6 {' U6 }
jnz 00650589 ; detected
# v$ P5 q1 }4 O+ M' c# x push 00 ; OF_READ
2 J/ k& J; P" y4 f; Y' } mov eax,[00656638] ; '\\.\SICE'! |# H, P! m: }1 e: g: i) L
push eax
: T) G/ m% k; `2 r& ` call KERNEL32!_lopen9 o; S: z: w9 W o9 g9 `
inc eax
; q% E) _; Q6 n, ~6 R/ S) Q" A jz 006505ae ; not detected
* e: m) x1 C0 S: X
, M. [6 P- |* q! u
) i4 v- l0 [# ]- W6 V__________________________________________________________________________
+ b5 n2 I, s+ k
- M) t2 n) F$ O; G' c; ~( o2 HMethod 12
9 c1 C _# U e- F=========. y" g3 [4 A. N( X" n8 T
9 r2 H' R+ W+ G1 `5 k
This trick is similar to int41h/4fh Debugger installation check (code 05
- q1 j1 j- f, n& 06) but very limited because it's only available for Win95/98 (not NT)$ D8 S5 A4 Q' z- r5 x$ |, y; c
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.3 h7 G' g7 L4 h! }# D
3 B T2 U6 i* N" D) l
push 0000004fh ; function 4fh" D! b8 \3 S8 Q
push 002a002ah ; high word specifies which VxD (VWIN32)
# }1 f2 j! U/ o }5 U, Q ; low word specifies which service7 Q$ t# w- j p4 \- W9 W. c9 @9 x
(VWIN32_Int41Dispatch); w' l& s; Y. h& U, d
call Kernel32!ORD_001 ; VxdCall
, Y3 l& e5 e7 f# q cmp ax, 0f386h ; magic number returned by system debuggers! E t8 v+ ?8 Z
jz SoftICE_detected
) o9 \+ B" c: ^6 D$ a9 ^4 y, z) A* E! K5 k2 X$ ^7 ^
Here again, several ways to detect it:1 |- t' N X* [8 p
6 f/ F4 L+ t n. @. V; y, l
BPINT 41 if ax==4f
6 P+ ^) ]1 }: L7 @8 Y
5 A! H3 @6 W8 y$ @2 m* I6 C BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
& c# _/ I9 [3 F" g% q- Y& P# ~
9 F: @7 f( G4 U, a, R BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
8 r8 ~9 p D3 ^( ]: q3 s
1 n5 k. w/ i& b6 S+ Q. O q9 U+ ] BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!1 }$ F x" F" b5 R( F+ u0 z
1 @' [1 A& k: J
__________________________________________________________________________
8 K' u6 {' C1 V- [+ Z, s) [; e' n
Method 13
1 Y& \; e+ V2 q: v8 Z3 H=========2 C* [$ [" T+ m! m
' I1 Z/ R2 I& e0 c6 J* YNot a real method of detection, but a good way to know if SoftICE is6 x# Z% Y2 T) S Z6 [9 ]
installed on a computer and to locate its installation directory.# ?( l" H/ z. H
It is used by few softs which access the following registry keys (usually #2) :2 o+ d' \3 r7 T% O
8 B& H7 \. z9 n) \: @
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
1 o9 C+ e9 X; J4 Z\Uninstall\SoftICE( z! t7 B9 w# b5 u6 P& \3 h
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE* |, p% }9 ~# H" j$ D
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion6 d$ w. y& G# w ^& |6 n7 P0 Q7 G
\App Paths\Loader32.Exe, s( I/ e7 \5 ^" P
) {% P7 X% ^0 q8 T" O9 ^- s4 [" T* y2 {0 x# r; e6 d, t7 ~
Note that some nasty apps could then erase all files from SoftICE directory
7 v, O& R! j- j% i: U(I faced that once :-(1 p! U! Z$ w7 H: Z
5 V. L8 K( o: L2 m3 ]8 F$ U8 P
Useful breakpoint to detect it:; L8 j$ C9 g7 N4 I/ _/ q( \* y, I
* \- H. V- d7 l. T1 ~" z( l4 ?. F
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
1 I+ e0 W. L( E. k1 G4 e p; N9 }2 C4 [- V% ^
__________________________________________________________________________
* a3 p. G* m2 }5 M
6 L5 T2 |! c0 r7 {; c, c! n0 f% [; x. S: j% I, X+ O
Method 14
7 B8 L, k% k5 \% |=========
2 H* A7 B- T J1 [0 K+ E9 L2 G
) L1 S y( K, g7 D T. I7 [A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
+ Y) y' P- W6 J- |& }& P8 @is to determines whether a debugger is running on your system (ring0 only).
# ]( c8 X1 x) d& x- \$ {
2 O- y$ Q+ C1 r% A" y" b VMMCall Test_Debug_Installed4 e: a: O) E- Y) h% \4 E, }* Y
je not_installed
@7 H: R( @% B% j1 J8 {' S) x
8 D3 w' c& v9 x6 m$ RThis service just checks a flag.4 s: |* b) E3 k2 s1 H
</PRE></TD></TR></TBODY></TABLE> |