<TABLE width=500>
9 R" I, V9 P; L0 P<TBODY>5 v- o" u0 N. ^! y9 x3 y( ?0 @# j
<TR>, e4 U! ` S: H/ ^, F/ }' O
<TD><PRE>Method 01 V; d9 n* S. B7 l- I
=========1 s6 k/ t) C( m! u! ~
8 K8 [3 z/ R( J; b! f3 f
This method of detection of SoftICE (as well as the following one) is# b/ S f" Z4 o, f8 U( Y9 h/ }
used by the majority of packers/encryptors found on Internet.
+ m9 `9 Y. q/ | [5 U" G' O; qIt seeks the signature of BoundsChecker in SoftICE4 O+ A7 v$ [; G) f
4 D2 ~1 @, s- a) o$ H8 Q7 q
mov ebp, 04243484Bh ; 'BCHK' j) j, ^& D! Z9 O% p' q
mov ax, 04h
# |" \. I' E4 [+ D+ r int 3 # P, q7 J- T# S* M2 C m/ M) ~ @
cmp al,4
9 I8 I, }+ M {# b jnz SoftICE_Detected
* V' r Q- c- a4 P: {( \) |
* ]9 t4 N. F5 u* x% d___________________________________________________________________________
4 \3 R( V5 ~& U
% l7 i2 W9 K# j, ~1 ^Method 02
8 T+ ^3 k6 ^1 O4 L; D! x=========
( I! b! T6 a& S9 Y0 V5 z
9 |+ R, I' y3 L" F: d' Z$ KStill a method very much used (perhaps the most frequent one). It is used
' f9 j, W3 m! _to get SoftICE 'Back Door commands' which gives infos on Breakpoints,: f, }' N4 D' R& K& K
or execute SoftICE commands.... j. g; o9 h2 e6 m# T! P; M
It is also used to crash SoftICE and to force it to execute any commands
% J# Y6 O3 ]. V8 ~ h6 K! Y(HBOOT...) :-(( - w8 A& b( b. w% n, ?
. T. [" ~: }7 BHere is a quick description:
* p" t8 D/ C. L$ [% m: _* v, K2 P-AX = 0910h (Display string in SIce windows)
6 @9 ~7 z9 }% B- E4 c-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)7 U% \! c, ]' w6 D O6 t9 Z0 ^
-AX = 0912h (Get breakpoint infos)
\ m% \7 ?& C8 E-AX = 0913h (Set Sice breakpoints)
6 s5 {/ }# ~7 C2 `- v& a9 @8 W: d-AX = 0914h (Remove SIce breakoints)* ^6 ^6 @( w* r* P% b' M/ q. Y4 W
, p# U- V, N0 n7 ~7 Q: {Each time you'll meet this trick, you'll see:! g) O# g5 z2 ^6 x J# R3 \5 l. {- [
-SI = 4647h' r* D a: c0 F3 v* k; u
-DI = 4A4Dh
" {4 Z! Y; O8 v. B, E( pWhich are the 'magic values' used by SoftIce.6 V, v; K# c! X! ]6 I( b7 ]) n
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
" ?2 @& L9 j: ~- J4 U' a; Q% k) |8 h; h x! z Z
Here is one example from the file "Haspinst.exe" which is the dongle HASP
* [. P4 I- ?# {4 q) G3 _9 }Envelope utility use to protect DOS applications:( S9 h/ [ R& g6 ~$ b
9 t2 D) r9 y; a( C6 h" ~7 F6 Y* A( _
, c! ~0 ~9 {$ Q# S6 z! ^7 l- \
4C19:0095 MOV AX,0911 ; execute command./ M! i3 _3 `* _
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below)./ t0 n8 u4 p, n4 }( [' Y
4C19:009A MOV SI,4647 ; 1st magic value.# {0 @8 ]5 P, {
4C19:009D MOV DI,4A4D ; 2nd magic value.! {4 w5 }1 b* W( ~8 `
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
9 q/ ^$ W; c7 k8 ~: \4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute3 ~- n* a( {* z3 \$ c
4C19:00A4 INC CX
~ C, A M- T3 c/ S( Q" l" `4C19:00A5 CMP CX,06 ; Repeat 6 times to execute k, A0 F3 w) v4 J0 D. c
4C19:00A8 JB 0095 ; 6 different commands.
8 H! M* o& W1 c& D( f" ^: q& A4C19:00AA JMP 0002 ; Bad_Guy jmp back.% R% i% X7 I3 A. j( B3 W% a
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
8 s. y3 K% W1 \# L5 H8 n; U/ c8 M8 m2 G8 J w. V$ `4 V1 ]
The program will execute 6 different SIce commands located at ds:dx, which
$ d# Z. e: E# d1 y% a" Z$ W/ Oare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.( O9 V) e/ M- j! L1 t
/ V: h. Y% y& O1 a% F& E! ?& |
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.$ m$ u- d+ m# Z: q
___________________________________________________________________________
* {$ B6 i: i0 x* h; N6 i' g) \! B
; I, z5 o: c8 w" Z
Method 03
; I' o' v; w8 v, b0 S( _0 L=========
# i7 t* @3 i6 g" e- Q9 V1 M- ~3 Y; a l; C- |
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
" p9 W! x$ S8 R, O+ g(API Get entry point)6 w6 r9 y. v: m. u( k+ g' E" A
& i6 a' m; M- h
! C! K% Z3 T. q0 i6 F2 ?4 w xor di,di6 x: e' L0 X0 H* \
mov es,di) l7 ^9 P& T6 Q
mov ax, 1684h ! b7 \) p6 y% B/ J1 A
mov bx, 0202h ; VxD ID of winice* m3 |7 l7 d0 @3 h
int 2Fh( S+ M: S+ P% V9 o. i% f
mov ax, es ; ES:DI -> VxD API entry point
9 E+ J* B+ P4 r7 f2 B add ax, di
- N% V( a7 p6 J$ Z& @0 V test ax,ax+ N S5 I8 [' g( x) X8 Y) `
jnz SoftICE_Detected8 E% J6 H2 _* S
8 T/ d4 d Q! }+ n4 V) J$ ^0 R___________________________________________________________________________ `* m+ ]& y- t9 X6 c1 J
8 f1 ^ f! n1 J" g, k. X
Method 049 s0 G; W0 r7 u* Z9 m* \
=========
0 z2 a3 t$ @! t- a% Q% ~. D) i X; h! w' O6 C' s+ V3 _$ s4 u
Method identical to the preceding one except that it seeks the ID of SoftICE
% \* y2 n. j) ]GFX VxD.
% B: c; W. t. {9 @9 e1 ~ i$ S/ m( X: x2 A T) r3 n- w" i
xor di,di7 T l4 ~0 t0 o. T" s' w G5 C! |. O
mov es,di
: w% J# X3 e4 P; M) Q% w5 k mov ax, 1684h 8 }: `8 m" v0 D' Q- A
mov bx, 7a5Fh ; VxD ID of SIWVID( D: Z5 I& k( L- x5 R9 @/ z8 {3 B
int 2fh( k# J, c: ]! c
mov ax, es ; ES:DI -> VxD API entry point
7 P6 x$ J- \4 q, v8 R# K add ax, di Q0 F6 c: Y" m
test ax,ax
4 B% z: F: d6 m jnz SoftICE_Detected
! H& M! h/ i/ W; f8 ^- J {
9 o5 V6 v6 W" h: B__________________________________________________________________________1 H2 f @ h8 K) t/ z+ _2 b- L
( P0 ?/ V. k, y+ n2 b
w$ t: R& ` b: H0 E
Method 05& Y: u" w/ c8 D/ F
=========
/ A4 n) [. v- X7 ~8 w) e# z: I+ \; B5 ~3 N7 e3 P2 `* |
Method seeking the 'magic number' 0F386h returned (in ax) by all system4 e5 K4 F2 t6 T' G. ?
debugger. It calls the int 41h, function 4Fh.( `; v% t* j' M7 U/ j2 d. [( g
There are several alternatives.
) C" [! ]. V& k% m3 M$ @! Z# c5 S
0 Z6 @9 I0 d6 s. z- b/ yThe following one is the simplest:5 Z: ]; A' V; ?* k7 ]2 q
X9 R# o' p( i; }1 @ mov ax,4fh
. @/ j2 O, D! e$ D6 J6 M int 41h
+ e7 M, {( q% V. t9 X! u4 S3 y cmp ax, 0F386$ D+ W7 i# a( V( d
jz SoftICE_detected) ? R# }0 `$ j+ }5 Y
. L. ?1 a1 W/ E- J" r1 A; x7 N! H9 j, u+ M5 @ [ D( `' x/ S
Next method as well as the following one are 2 examples from Stone's % q- l+ q! l0 a
"stn-wid.zip" (www.cracking.net):
% m, a' z, `, o" ^' p- P X! x2 E
mov bx, cs. y4 z- A$ O6 v" W6 e% Z8 s: [
lea dx, int41handler21 P4 w! X9 {! V
xchg dx, es:[41h*4]- g( }% i8 V. f5 w6 `
xchg bx, es:[41h*4+2]) g; R. Q) ?) n2 s6 X2 D, ^3 M
mov ax,4fh
$ U. l5 B% c" i/ a/ N int 41h
$ h5 `4 s/ G5 \ xchg dx, es:[41h*4]
, a5 a9 p v3 D0 Q: O xchg bx, es:[41h*4+2]1 V# E9 }% c) E x- F# W4 r
cmp ax, 0f386h# b ^; y0 a8 c5 f# _) h
jz SoftICE_detected
$ X* ~0 H( [3 }2 K, J
! Q/ o# n- [2 hint41handler2 PROC$ Y8 |" V: O8 D: f L3 _3 D* O
iret" u' m, l1 i/ _! O/ G1 B
int41handler2 ENDP
8 }. N4 w' c( I9 E0 f* K
2 w- {) C( `5 W% d' l6 Q
3 I- i( ?4 [/ q_________________________________________________________________________ Z1 b$ z& x) E: g1 d: P( s8 P
. t9 g# r& ]/ t
( t1 W2 C% [8 @1 [5 qMethod 06
& P& j% x x1 d/ @, M, ^9 J( I=========
! o+ E& ~7 q A5 K7 s& X7 a7 _
+ r: e: {+ q' h' w5 f5 ]+ V
e! A6 g" z- k6 o# l2nd method similar to the preceding one but more difficult to detect:
7 D5 r. Y+ d* b( @+ n2 R8 c+ l, ^" L7 R7 `
: B2 }6 X5 D' d# Hint41handler PROC/ _! B1 Z4 y7 J5 j; \8 y" T
mov cl,al
* ~% E, v; I1 s7 Q iret
7 y$ m, t% q2 S; g+ S& jint41handler ENDP
: X a) a" B4 O1 y
) j# L0 f, Y. M- P
/ P; t; S; t& m2 U# X5 | xor ax,ax* `3 C( p. u. i+ Z
mov es,ax8 J- r7 a0 G$ R% C+ W4 S
mov bx, cs
2 J) h1 ^4 C+ w- t lea dx, int41handler" }* n0 k% B1 }1 N3 v# ~
xchg dx, es:[41h*4]
: _; G& g" d; v( J) | xchg bx, es:[41h*4+2]
0 a8 K5 q, i, k( D* O- Q! H) Q in al, 40h
. E& n) ]! V; ^: `9 M: s xor cx,cx
2 s& h% k7 x: t( l0 b9 d7 f int 41h
3 I0 k0 w1 U1 v$ `! e, ?2 u xchg dx, es:[41h*4]
6 f, n) R3 r0 R! V& e+ Q r xchg bx, es:[41h*4+2]+ ]5 s; ~. E& _( q
cmp cl,al
5 R4 V$ u2 h5 y) W4 ` jnz SoftICE_detected
6 a3 Y% E# X+ v! f9 I& [/ K
$ j7 q1 B3 U1 l9 `& @9 p_________________________________________________________________________
) ^: ~1 S5 _9 U: g" D2 \9 O4 X! M$ b3 y( j, K# F5 o- }
Method 07& o$ ^: A, J: o
=========: |* o% L2 N+ T
' G3 J8 y7 x+ j: H& h+ n5 y
Method of detection of the WinICE handler in the int68h (V86)
7 ~/ q4 D, A1 s' G
& Z- C, j# {* y- C) W; R mov ah,43h6 A- l, n U- n+ \# j6 y
int 68h
. N1 `( ]# ~6 `* J- h5 j cmp ax,0F386h
/ ?. g6 j+ a- N1 n L jz SoftICE_Detected
/ f5 d! J5 B9 z1 H/ b. M! ]" b1 ?$ m8 C
& B) Y n3 y) A4 E
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit" R# ]7 f. w! D1 ~5 g4 e+ h: G" f8 i
app like this:- _& Y+ K& W- b" @
- v2 x) I2 E# P: }9 v BPX exec_int if ax==68
' K3 q( U4 Y) n4 s6 T8 m# Q (function called is located at byte ptr [ebp+1Dh] and client eip is
7 b2 E! }6 A" @! h- b f located at [ebp+48h] for 32Bit apps)8 R/ r/ i/ u( S; M3 ~+ a% u3 v
__________________________________________________________________________
% y+ b" _' }8 Q) b I- N. k* H M" P
+ m( F3 M+ t4 f5 Q7 N
Method 08
% r9 T$ X8 Q* Z" M: B" Q=========
' U" T8 E! s0 D+ F
- }) x7 B3 r* ~! m; `: X0 rIt is not a method of detection of SoftICE but a possibility to crash the+ r4 p: y7 o2 b5 J" [2 x1 [
system by intercepting int 01h and int 03h and redirecting them to another
% g0 L1 s, S/ Xroutine.9 ?% K' D: ^: B7 n- i" M2 K' e3 m
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
4 W8 @. T! h4 u' p( r# m# sto the new routine to execute (hangs computer...)' I- s2 ?6 F0 u4 O7 F& s
) N1 i, f, r% {0 r2 `# H( [- d' b7 n6 P mov ah, 25h
' Q6 v& _$ I! V mov al, Int_Number (01h or 03h)
: n1 R9 T& N# g: D% f# `. L% l, o. i mov dx, offset New_Int_Routine. \* x2 R% T6 y4 p; _' X; I5 l
int 21h
$ ^- [( |+ {- s7 E/ F* {; Z
8 B; R# W" g' |$ k; e, z__________________________________________________________________________
8 Q, h/ T' {# i. |& L7 W. ^7 @& a' r
! j8 ^: k5 K$ [' z$ E: fMethod 09
' ]% ?1 I$ @, P5 M! _7 O6 c+ B0 k=========
2 U1 V3 T$ p9 Y* ]
' }2 g; C" Q/ _( g) K3 V8 q. `This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
0 w. @; _5 J5 O0 Lperformed in ring0 (VxD or a ring3 app using the VxdCall).
4 a' j7 z, a' G9 C1 r" Q. RThe Get_DDB service is used to determine whether or not a VxD is installed
- A5 O) x4 x4 L% E2 n4 M1 e8 x, S& _- {for the specified device and returns a Device Description Block (in ecx) for
+ d, S/ j- Q9 m% vthat device if it is installed.
0 \, P' l, h3 ^" G
7 A) H( T" U! I9 p4 g2 j. H1 Y mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
9 K% _+ Q* R I1 l( y; J mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)' ^9 v* U5 M* A7 X
VMMCall Get_DDB& C2 O0 |: Y& d( i
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed8 s, y$ z {* u6 Z$ s: h$ v1 ?8 p" m
( p8 N3 E/ v5 U7 @* g3 Q6 m# _4 FNote as well that you can easily detect this method with SoftICE:, k* f) Q2 R- ~ z' S: u
bpx Get_DDB if ax==0202 || ax==7a5fh
\! a* k+ g3 B' l p2 R2 B9 S+ ]8 a7 e! a6 C9 [. _
__________________________________________________________________________
6 K& `+ F g9 a5 J$ g# u) \: {: ^/ F0 x( ]% R
Method 10( v6 u: S5 D! r% y% @
=========
3 |& r2 S6 u* h6 S8 `+ H
3 ?. L. \- S; G' L( [$ B% J=>Disable or clear breakpoints before using this feature. DO NOT trace with u8 B5 t* [. L1 n) j8 o
SoftICE while the option is enable!!
+ g% M) l+ M- G) Y) x) o6 i% L* g8 E6 E6 X
This trick is very efficient:
1 s" ^# V! g6 V4 S: iby checking the Debug Registers, you can detect if SoftICE is loaded
+ A# X0 D. q- n# ^$ t c( A(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
5 A6 N4 n h5 W+ dthere are some memory breakpoints set (dr0 to dr3) simply by reading their
# Q/ U' Q, s9 m+ ?: Dvalue (in ring0 only). Values can be manipulated and or changed as well
) K$ Y3 w- ]8 x9 w4 i1 T6 v' o' G6 W(clearing BPMs for instance)3 A c3 v+ M$ V) R2 W) x( I
" ]5 S. m# O1 {/ Z. U) ]
__________________________________________________________________________
h h8 w5 V3 X* q3 f$ T( y: z8 K- @) W
Method 113 n( _& l* d2 L: |
=========
8 ~0 i! K- \ A8 \3 @
# A8 Y) C7 |. f6 ^6 VThis method is most known as 'MeltICE' because it has been freely distributed% t; G0 a; k6 H: j
via www.winfiles.com. However it was first used by NuMega people to allow
# n% i' r! W2 l% i; WSymbol Loader to check if SoftICE was active or not (the code is located
- Z. \8 r* d6 p/ [, ginside nmtrans.dll). Q+ J+ f2 p: N) G( c& Y! B
# g5 h8 U, U7 z
The way it works is very simple:
2 Y, v ]3 x# E# KIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
1 D+ c+ s7 X/ @* _2 WWinNT) with the CreateFileA API.& i$ d7 n* F; o9 V. `. Y0 a
+ b5 ?1 n% Y: B% Y( ]. N6 g
Here is a sample (checking for 'SICE'):
. m! Z7 y8 ^9 l1 x [
, T5 d( ]; H; K5 ?BOOL IsSoftIce95Loaded()
+ v$ P6 @: v3 _ I5 O' r# P{
* h* s& d/ C2 ^/ a! e HANDLE hFile; 8 l% K- ^' h# u) D/ A+ e! j) B+ b
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE," S, \* l% B4 _
FILE_SHARE_READ | FILE_SHARE_WRITE,
8 J; ]4 c2 p" |! @! U% ` NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
9 a, p/ Q3 a9 ~. s if( hFile != INVALID_HANDLE_VALUE )
$ J" M; U5 F# s7 H- h' o+ B {
7 N9 Q% W- J; h2 W ? CloseHandle(hFile);# s0 `0 h2 w4 A! S+ N
return TRUE;) {4 I5 W6 d, K5 J
}0 U# j( m- v' E
return FALSE;
5 g! P/ U. f; Q}! T7 C3 r" [4 u0 i8 n% X; @$ P
8 o: U( s) @4 k. G) u8 p9 z/ R# tAlthough this trick calls the CreateFileA function, don't even expect to be
0 _' K( l2 {7 |7 t* K: P) y0 {% iable to intercept it by installing a IFS hook: it will not work, no way!
% t# i5 }, C% X r5 @In fact, after the call to CreateFileA it will get through VWIN32 0x001F1 G& I/ C1 `, m0 q5 j0 w
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
) ]* p9 d& B2 n9 t3 }and then browse the DDB list until it find the VxD and its DDB_Control_Proc3 D" Y; N1 e* _" X" F! C
field.# b$ T5 S K* `. c
In fact, its purpose is not to load/unload VxDs but only to send a
6 P- M' X, o4 b4 ]W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
4 Q; G! F5 Z9 Lto the VxD Control_Dispatch proc (how the hell a shareware soft could try9 Q! @2 \$ M# Z7 \" [+ _( k5 o
to load/unload a non-dynamically loadable driver such as SoftICE ;-).* b5 f' x& ]& O# ]
If the VxD is loaded, it will always clear eax and the Carry flag to allow
4 M% ~" s' [6 A! x. C( q6 dits handle to be opened and then, will be detected.3 V; `4 ?5 ~) t1 O
You can check that simply by hooking Winice.exe control proc entry point: a% ]$ R; a& z* \, C
while running MeltICE.( `) L6 {3 U8 X8 e& e' `/ i7 ? u
) a5 j- G1 y8 m$ C5 {' v8 V
- i& c, E+ S8 O2 h 00401067: push 00402025 ; \\.\SICE4 h# y( ~& a2 ^
0040106C: call CreateFileA2 h: S; Q2 ]: y/ u% S" Y, c, q- k/ k" n
00401071: cmp eax,-001
+ `# V7 z9 ^. H$ i3 E 00401074: je 004010911 {& ?) c6 d9 j9 X. ?4 [/ Q
) J5 k; m- K x# u% ?% U8 p
! G& P/ H& e) r- R# tThere could be hundreds of BPX you could use to detect this trick. U& V1 h' {0 r/ H8 O
-The most classical one is:
6 X! Q+ g0 C/ ^% C BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||( [4 \) h$ V' M6 E. {8 O* }% t
*(esp->4+4)=='NTIC'
+ H# ^& \! m$ r1 j1 W' _% A/ p$ X# E# o, T
-The most exotic ones (could be very slooooow :-(
- @: m2 O4 \5 Y! X6 j BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
! t6 c3 Q+ v7 V1 K ;will break 3 times :-(" W! K" P8 j, t4 r' T
3 {0 C1 D6 Z8 E& z) \-or (a bit) faster: / w4 Y; b9 M* [+ Y3 Q. l5 n8 Y/ [
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
1 v. V6 a* P# i1 c0 x; ^
8 t* B) n1 a. ?; h, { BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' 4 E" Q- T$ x% {3 k: ~9 U8 ^
;will break 3 times :-(# z- I ~5 G5 x6 ]
& B! V3 X% e4 \/ n# ^-Much faster:# _0 |! @, E9 c$ ^ w
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
1 r3 l4 V( e* y2 b# Z, |7 G: i5 H, X2 ?
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen/ J O" v% L( G5 I5 u
function to do the same job:
8 ]1 b3 O C8 ^% @( e# C! l$ P+ I& y7 x# M
push 00 ; OF_READ& V. G6 N o( m. C4 L
mov eax,[00656634] ; '\\.\SICE',0
: i& G2 t9 \3 N: S3 _5 U push eax
2 p- E' C' t8 L2 y S* d call KERNEL32!_lopen) M3 O5 f9 }* r @. P7 B
inc eax6 v3 }- R8 u; i* t
jnz 00650589 ; detected6 d- z3 \! l( g8 t2 ]
push 00 ; OF_READ, u, w" Y. k" l1 a4 b$ g j
mov eax,[00656638] ; '\\.\SICE'
/ ?+ b( y: [% \$ D- ?4 W& S push eax
5 M$ S0 u8 ?, r6 P% R8 u# g0 J call KERNEL32!_lopen
* @/ k" U. U( \& F: S inc eax
% f# r6 F9 ~% g! g- m jz 006505ae ; not detected
; A# c! C9 g- Z. O9 @) [" Y8 @/ V9 L$ g' `$ f8 @6 t$ {
+ k- S @/ c* r8 L__________________________________________________________________________0 s$ t: k$ d6 T6 @ R! t9 d
V2 `: W0 [8 H" F
Method 12
5 g) v7 p; R6 T& ?* o6 f0 y) I=========
! ]" d' }6 t5 g. i7 [, l: P1 l
0 Z% p/ ]3 K& C: uThis trick is similar to int41h/4fh Debugger installation check (code 05
- l4 c+ c( N! v1 ^& 06) but very limited because it's only available for Win95/98 (not NT)
) z1 a; L E3 j3 W/ ^as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
% P7 W* {$ B; D" w, E* `: _$ V
push 0000004fh ; function 4fh
- G# c" H5 c' B$ ], { }7 \ push 002a002ah ; high word specifies which VxD (VWIN32)
" W: ^5 \0 C3 u1 \: g ; low word specifies which service
+ @: _ `' K- _9 _% q (VWIN32_Int41Dispatch)
- R. o$ q& h. O2 s1 L: Y call Kernel32!ORD_001 ; VxdCall
, l) w" A U: h/ t cmp ax, 0f386h ; magic number returned by system debuggers
; m- U) s4 }+ s jz SoftICE_detected! L7 F O# | c2 E
2 f2 c- P0 L4 p+ P* A' D1 _2 [
Here again, several ways to detect it:
" f2 u7 Z* g) I' h( n) ^, i
+ J0 w; o. M$ f! x. Q5 c BPINT 41 if ax==4f
! p: a3 D- y1 }. K1 N' c/ m3 S1 P! n( s" t# G w
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
5 b# o* g1 }& p
5 J9 S4 J K8 q9 d' T BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
* j. P+ D5 D9 s, b; D+ i3 \; \* }* R/ [ B- p8 E
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
9 U9 t k) W+ \4 C8 P+ c1 z+ Q2 e# I3 h) w( I- r4 n
__________________________________________________________________________; Q' Q7 Q( ]2 i
7 Z6 L5 D7 a) N7 d& {
Method 13% \% p: g1 X- y
=========7 G+ Y. v3 }6 C: d* \/ r% s
: |- R N5 r4 TNot a real method of detection, but a good way to know if SoftICE is+ [% F' v( R6 {5 U7 O
installed on a computer and to locate its installation directory.
6 {/ R, u( l5 Z; l4 \It is used by few softs which access the following registry keys (usually #2) :
/ z: |5 w8 b7 o
% f" h3 I4 i4 {3 Z- A-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
1 e- C1 w0 C! L7 F\Uninstall\SoftICE: V7 x2 J0 J5 N1 E8 Y8 i9 G6 A
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
: `# M. p4 M: h# h/ K1 Z( k-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion; L Y" `/ I( L. I5 b. q# Z2 B2 n
\App Paths\Loader32.Exe. }0 S X6 j& y
; f; h3 W+ ]: T. B! T {# h" x8 `+ w# q- W9 ?0 p1 I/ ^/ K6 V2 z
Note that some nasty apps could then erase all files from SoftICE directory. n O5 S2 B. d, Z" r, U+ K& ^
(I faced that once :-(
) a" _: p% `. j; [) \
* Z, \1 Y& Y: I# {, s, P# jUseful breakpoint to detect it:
' T1 a+ D* C3 c8 ^+ S
1 c9 E6 u8 }: A# ^# S BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'( I* U6 X% }% X/ P3 D8 a
9 x7 t1 r Q9 j7 r+ M8 k1 @+ @8 s m5 A
__________________________________________________________________________
5 W% _! w) r/ ?( R# b8 s, S$ R( K( l( K4 G" W
. z% d& E, }3 l; n# \) a
Method 14
0 j7 p) E1 r P, z+ p; F) ]' p7 d% e=========& q" b( g0 F$ J: r- G
0 u& G, g& L/ Q" D
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
. b) E2 A! z$ A1 ?0 N& Kis to determines whether a debugger is running on your system (ring0 only).3 `% \$ V: }( [5 u$ `5 T
$ r/ z; Y" t; u5 v. g' q
VMMCall Test_Debug_Installed
1 X+ n7 R6 y$ f2 W: _ je not_installed( R0 {- t$ b* X* D8 N- J( p
1 [3 Z6 b( j/ q# W; y8 TThis service just checks a flag.0 M) {7 Z- I" W0 V/ X1 I/ f
</PRE></TD></TR></TBODY></TABLE> |