<TABLE width=500>0 Q- G2 E8 X2 X( [( z* @: o/ h5 I, J
<TBODY>
. o) f+ E. T, p% H<TR>1 ?0 b$ i, F! f7 o; F4 _: S& B
<TD><PRE>Method 01 " `8 Y9 q0 M5 E8 J. z
=========
4 G- ?( K4 K" }% j0 l( b& m
1 \/ V! J W* Z3 U$ LThis method of detection of SoftICE (as well as the following one) is, K( {1 x/ b. s4 y3 A k5 q
used by the majority of packers/encryptors found on Internet.% q2 W, d: ]" C) M
It seeks the signature of BoundsChecker in SoftICE
8 k6 k3 P y: g0 O h: k, c5 F0 y4 |9 w C9 P. A# E
mov ebp, 04243484Bh ; 'BCHK'
6 C( k& V% X1 l. D7 o/ M. K( P; L mov ax, 04h
7 m3 a0 ^/ j {) U5 V+ @+ t% S int 3
- Z+ S4 m' y8 M! u) C% ~" r cmp al,4& O% ]7 N3 p* o' x
jnz SoftICE_Detected
* _6 S+ K+ T$ w" G9 ?
; Q* k2 Y+ [- r9 l: G* ]___________________________________________________________________________
$ I' D2 v+ ?$ {# w2 r9 \! T- e9 d! J9 O8 c4 i1 v3 T5 B& i! h* }
Method 021 t! w8 H9 o9 ^% `, ^) J5 k
========= p! Y; u f' h( j% `) @
% K2 X) |" Q; H- k! S3 c
Still a method very much used (perhaps the most frequent one). It is used
5 |9 J; o7 H) ~4 Ato get SoftICE 'Back Door commands' which gives infos on Breakpoints,7 ~" r) x2 d! N6 F) z
or execute SoftICE commands...
7 ]8 T y( E) K, \It is also used to crash SoftICE and to force it to execute any commands
" R7 Y1 O& V) Z' _- u; i9 E(HBOOT...) :-(( ' I, w8 ~" F) J) d& u+ e/ x
B5 h. J1 C6 w; q( H$ T
Here is a quick description:" {* _- w% z$ X1 _5 q% \$ U
-AX = 0910h (Display string in SIce windows)% W3 ?# `1 z' O0 H% U
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
; v# j5 R/ b0 o0 { y-AX = 0912h (Get breakpoint infos)
4 _; n/ {- H* g. O/ q-AX = 0913h (Set Sice breakpoints); ^$ `0 Q, z- {! w
-AX = 0914h (Remove SIce breakoints): L1 X/ w: X4 b
) y5 Z. E8 o$ ]Each time you'll meet this trick, you'll see:
+ j/ g4 }- h2 l; P- P7 i-SI = 4647h% u W& W4 k7 O) s
-DI = 4A4Dh2 U# Y1 r2 [; p0 \8 m
Which are the 'magic values' used by SoftIce./ Y% Y+ K+ ]' T0 v& Y7 X1 |
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.: n: A' A4 ]% }" {1 h1 T
9 [; R! b8 X. x6 n
Here is one example from the file "Haspinst.exe" which is the dongle HASP! T8 |+ z: m" T
Envelope utility use to protect DOS applications:6 Y% c0 U' G2 S3 n8 g- q; C
0 g- W) p+ B4 ~: q
. I/ D4 `! X+ B$ s1 F( }* _
4C19:0095 MOV AX,0911 ; execute command.8 F( o/ W$ P5 A/ `' K4 M+ j% Y
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below)., J1 A% N0 q D. p. y" \7 C# n
4C19:009A MOV SI,4647 ; 1st magic value.1 M c, f. `# T, B, `& j
4C19:009D MOV DI,4A4D ; 2nd magic value.7 ^! \! L4 M1 l' _$ f
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)$ p/ f& I6 ^" x: }7 `
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
& | u$ |1 a7 ?* r+ D7 u4C19:00A4 INC CX
' M3 {# U U7 U4 c( _4C19:00A5 CMP CX,06 ; Repeat 6 times to execute2 H+ X) X, D$ r: k# @1 s
4C19:00A8 JB 0095 ; 6 different commands.$ b% H9 m$ m6 |* D. r* \; _
4C19:00AA JMP 0002 ; Bad_Guy jmp back.
! {+ B. K& j% L) G! Z/ r6 D4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
" c N/ q/ G D2 y3 q$ Q# V# E# E: r& P! f0 b. ~3 x
The program will execute 6 different SIce commands located at ds:dx, which
4 W9 Q4 f; z! f, V. H4 Fare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.5 a% w4 I# S. E( B8 o) V: x: t
; r. e- q% P1 e, v9 I
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
0 U6 `. Q5 w4 t+ i- ?___________________________________________________________________________8 r+ a( n; |2 a1 Z& d1 h
6 O* w) D9 F4 b" B2 A" Z& ?
, m, P9 L' z q G% V/ |' B
Method 03, E: ^" f1 \: }* S+ a8 Q
=========5 p3 |- S4 x; Q
6 t( u+ ?, z8 }; d* W J! R8 @Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
' C: Z3 O1 ]# H, Q3 J! [(API Get entry point)
- @$ S" n0 \/ [% N
# z/ Z7 Z' v/ m- J$ }1 y1 o6 q9 Y! ?- [/ b: X+ r5 n
xor di,di
1 s* t/ T1 n4 g2 g8 ?. T; t3 p! T mov es,di2 ^. W$ L' b' r# _7 Y
mov ax, 1684h
5 i$ U0 e' C% I4 M( u mov bx, 0202h ; VxD ID of winice% v/ t/ i9 k2 Z& j2 t. R5 y; E
int 2Fh
( [1 x5 }! _& a/ M mov ax, es ; ES:DI -> VxD API entry point% b R J$ P; ?6 M, [4 A( d
add ax, di
" h" q8 K. t1 l) A test ax,ax r% W" W G3 x: r+ Z, o+ Q, h
jnz SoftICE_Detected
! ^& S7 l; \' J5 c7 c$ S+ V0 t3 I8 J+ I' R# o( f
___________________________________________________________________________6 ~+ t3 }8 Q8 b, P1 ?* U9 l
0 m% S" q' z: v7 y) D) j' r8 |, k
Method 046 C8 R5 G) d. Q
=========! Z$ I, |0 q5 D& ~- T( C
% v8 ]- p6 n7 h$ A3 mMethod identical to the preceding one except that it seeks the ID of SoftICE* D. ?$ m3 H6 R; \2 D
GFX VxD./ g, G# u9 i6 s7 q6 \( \
) B9 G* U) L( j1 \4 p
xor di,di H9 C& T$ ^3 K3 g: r
mov es,di
2 j3 a4 i Y8 W. \1 O: i. b mov ax, 1684h
- X; F! X' U$ \, m mov bx, 7a5Fh ; VxD ID of SIWVID7 K% S3 G P+ C( ]" S* ?& o- p; u7 b
int 2fh6 m9 C7 M) l3 ~/ B8 Z1 u
mov ax, es ; ES:DI -> VxD API entry point8 b+ J9 w2 A @3 z% E
add ax, di# x3 u h9 G) |, h( L" G
test ax,ax
4 N" L; D, K+ H+ Z jnz SoftICE_Detected7 x7 e9 v; j+ [, _& i
" A! Q. i! w9 B4 y3 L
__________________________________________________________________________# X) d9 B( ~/ x
* x e" ]( L8 z7 w u. o1 w* s2 H* a' c
Method 05
& |: f# j" Q' x5 n3 ?=========
7 `% O! i& o! r9 B# I( `' v& b: ^3 ]* a8 ?8 ^& R3 A( X+ `
Method seeking the 'magic number' 0F386h returned (in ax) by all system, ]: n* J' v2 Q) o* T- V7 K4 x
debugger. It calls the int 41h, function 4Fh.
. {" ]8 S) Y2 S3 FThere are several alternatives. % O# i9 ?8 d1 T( D9 X7 Q( P
( ^# u1 n$ }, A' e
The following one is the simplest:1 o. J2 R$ X5 R" {4 D
) \# _+ ?8 l4 a! w/ }3 I
mov ax,4fh
1 D$ T# o& u5 c2 k' k int 41h) Y* N. ^) y3 I0 @4 m
cmp ax, 0F386% s c/ R/ f: j, w7 I$ o
jz SoftICE_detected4 N T6 S- \+ a/ }
' w% o# ^* b' W1 `4 x
2 \& [9 J6 O$ ^Next method as well as the following one are 2 examples from Stone's
9 D& M% Z9 L1 U T"stn-wid.zip" (www.cracking.net):' d2 T: G' I4 h( z, w H8 ]+ K
1 ` {5 |& E8 U, b8 q+ o- Z
mov bx, cs
N+ O* M% a6 Q+ h lea dx, int41handler2
( t1 J2 d. m* J$ m( T* L xchg dx, es:[41h*4]
* _8 k* K& q- U3 G. ` xchg bx, es:[41h*4+2]# e }$ J* W) o0 O
mov ax,4fh
" q4 `3 O$ o- ]6 ^& N# w* ?, m( ^ int 41h
( L, B' E+ {3 K% } B6 t0 P% r2 M7 g xchg dx, es:[41h*4]
2 K- t6 T: }" J; R! a xchg bx, es:[41h*4+2]
. w% \4 M( A; {' d cmp ax, 0f386h
* O* j& a5 m6 ^& ~ W8 ]- h jz SoftICE_detected% E% J+ K* Z# Y9 e' K
7 {7 j7 z) r/ ~int41handler2 PROC
5 t7 J: x' o! H2 T: r9 j4 Q iret
- @- N$ S2 O8 O' u" J y* B2 ]' Oint41handler2 ENDP
& J9 W) @# \: E: i% Y2 v" r
: p% {# W$ B* O7 Z3 M/ F$ J: c& J- h% {# \6 W9 d& _8 D
_________________________________________________________________________
4 f1 g# G) p: d/ l9 p: R# I9 Q3 X. r
# v$ h2 R; Q4 |5 n. b! ~9 ^& XMethod 06! K( h! Y- h6 j
=========- _! \3 e+ d( k Q+ Y
4 w0 ~$ g3 T# D; v/ d
' l8 h) x8 B1 C& l
2nd method similar to the preceding one but more difficult to detect:- `* t; S: J% v$ {$ n
4 D- u9 `- U8 F/ `9 u7 P/ ^3 {; \! o
J' h8 L+ o0 A' l/ o* y1 ` {int41handler PROC0 k8 J8 C4 u* X! P
mov cl,al
. E# `8 o* @: d5 E iret! b0 z, _6 R: S
int41handler ENDP2 i# q0 X/ ^1 v' x
* d- ^. \1 T, c7 O0 d, s6 |( K+ W7 B) z# H1 ~+ k
xor ax,ax5 U% H0 D7 [. s7 g
mov es,ax3 C9 l+ { m& H8 q0 @( p
mov bx, cs& o/ z% T: Q2 [! t$ K2 h7 ~
lea dx, int41handler# w8 K0 D: C- b
xchg dx, es:[41h*4]
7 i0 v5 v' a/ | T xchg bx, es:[41h*4+2]
% |, l6 ^3 W2 _# N5 p" P: C- D: ` in al, 40h) I' T& f& {8 w" m& A0 V( R
xor cx,cx; `1 E% Q# Z: ]7 [8 ?( v k
int 41h9 G v; j. |/ _% v- G
xchg dx, es:[41h*4]( A$ q6 z" t3 k0 B
xchg bx, es:[41h*4+2]$ {+ } `9 M% v' u- _. J
cmp cl,al+ m4 i- L, Y% Y& o+ R9 \& _- z0 S9 ~ i
jnz SoftICE_detected/ C; W$ y ^ z W
1 p8 J5 W5 h7 B
_________________________________________________________________________$ J R- Z: C* R% t- e
) L: ?7 E2 M$ W! P$ x* wMethod 07
# k& m9 r8 N1 N0 T. m& z/ Q$ y=========
( ~! W d6 z6 i0 N" X! _9 j n! S* C: j& R) Z6 ~
Method of detection of the WinICE handler in the int68h (V86)/ n/ t2 }& i0 c- I& A
2 p) [2 d' ?2 }! u0 n; \7 o: [
mov ah,43h' `$ _7 Y% l: {
int 68h
4 T0 ]0 x' f% A4 L cmp ax,0F386h
) K( i- s" N* ^) b jz SoftICE_Detected
$ e( @- }. l2 E% S* ]& d; b a% Z' Q
) _1 P* z" c7 ~ Q8 C+ a7 H4 j
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit R' U* D3 f# A; n$ K
app like this:
2 W4 X3 Y3 ^9 s. E1 y6 d# O5 E
( `/ L% R" P$ ~ BPX exec_int if ax==68
8 P" |1 r) G" n' k& k9 {9 y T (function called is located at byte ptr [ebp+1Dh] and client eip is! ]5 H7 r4 Q! q
located at [ebp+48h] for 32Bit apps)1 p$ p3 |% N& |9 x
__________________________________________________________________________" A! W! L' _0 Y6 R9 Q m7 @* z
! K4 t- H3 Q j/ M. d0 ]; x
~2 E- j! J8 TMethod 08& c/ E: K& `3 [
=========
4 V- O1 z* L9 N# c# V3 {
9 {' d# X8 s7 u' A' k `& a2 |3 mIt is not a method of detection of SoftICE but a possibility to crash the/ c7 |1 G; B6 Y O
system by intercepting int 01h and int 03h and redirecting them to another& v5 X B. Z$ y" m
routine.
7 Y/ Q0 C4 L" T8 UIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
8 I2 C* h9 C% ^$ e$ s2 F. W Fto the new routine to execute (hangs computer...)$ ^+ h) d; L& l( N0 L: _4 e& f
' I g8 N2 l( F2 u+ K mov ah, 25h
3 O: @3 o/ y4 Q8 a8 ` mov al, Int_Number (01h or 03h). j' b% i4 l/ P. O% x
mov dx, offset New_Int_Routine
2 N; `5 |8 @8 g/ x int 21h+ H* I( Z+ @: g* p! z) F# |
$ O* q2 J. ^- E
__________________________________________________________________________% v4 C' t n4 K7 ? f3 F8 j0 Y
( G3 s2 |1 m, g, r" T. u! pMethod 094 \, Q* k5 S! ]/ X9 L; m0 |- o0 D
=========& U, r) k2 u4 e+ L$ s
6 B/ R5 {& F2 P0 T6 ~" a4 _
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only9 I" w# h; k s2 I4 z
performed in ring0 (VxD or a ring3 app using the VxdCall).
, q( m* X7 O T4 kThe Get_DDB service is used to determine whether or not a VxD is installed
1 `) t/ ]7 G) I( g) |% j+ yfor the specified device and returns a Device Description Block (in ecx) for
" h1 S# h9 J8 `6 a! F1 @that device if it is installed.( O% P6 _( P9 M
1 J4 D+ V8 Z- E/ K mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID+ C8 m0 P I) `# m* |6 q) B+ y1 V
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
9 n# U; Z0 ?4 X) Z, f6 @# K VMMCall Get_DDB
) J i1 j' n& p2 u/ V6 v/ ` mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
4 u) K, J& b4 w8 X
* g6 A+ L( m5 q& wNote as well that you can easily detect this method with SoftICE:
, ]" H' D4 b( c bpx Get_DDB if ax==0202 || ax==7a5fh" a) Y6 T" e- U# M/ j* ]
$ `: p. G4 [3 Q
__________________________________________________________________________$ p7 m5 g# j; x0 {* [
& b& v4 [' Q5 Q5 B) l
Method 10" V( ^/ B9 L; d
=========
& B; l% ]( R5 S }& K* R# T1 Q3 ^5 J/ b' ^
=>Disable or clear breakpoints before using this feature. DO NOT trace with: R% a4 B9 ]2 x8 i& u# {& k
SoftICE while the option is enable!! O: D7 \, }- P, D s6 A
* ^) @/ c# x$ G' g# c
This trick is very efficient:
$ [& n$ F Z# M$ n! K1 K' wby checking the Debug Registers, you can detect if SoftICE is loaded
3 [- {; Q8 V# W* p: u; B9 A1 H(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
) s4 e! ]+ Z$ [1 mthere are some memory breakpoints set (dr0 to dr3) simply by reading their3 D' \: K3 G2 ~
value (in ring0 only). Values can be manipulated and or changed as well
9 v& i; f& h; q# S0 l. } L(clearing BPMs for instance)
2 K- N$ v( F* M+ V% @8 N* m/ U( r O. H3 u
__________________________________________________________________________
2 `% l$ q$ j0 s) R+ ?
7 @9 I) N% L& \9 YMethod 11
( n9 e: f* M3 t9 `" j=========& g% _3 C2 y. } E# U, }' j
: E M9 L* q% l0 `! GThis method is most known as 'MeltICE' because it has been freely distributed3 \, M8 c' c! D1 Z& R+ s3 T
via www.winfiles.com. However it was first used by NuMega people to allow
" x( j4 D" b( c! Z* S" |Symbol Loader to check if SoftICE was active or not (the code is located
& s3 h) H! k" W( t: D1 Minside nmtrans.dll).
. q" z: g! `8 I: _# l
( X, `/ R# ^# F& N9 m: |) RThe way it works is very simple:/ ~6 F V, z8 O" I! M% q- |
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
i( b* B$ w1 s8 i$ RWinNT) with the CreateFileA API.8 B4 r* d9 J+ `; P K6 d
" }& o& ?7 a# f. T
Here is a sample (checking for 'SICE'):8 t7 ~" f- w) }0 {
! n. \, \: P$ H& R
BOOL IsSoftIce95Loaded()! C2 p( K- ~/ t W
{& X. q" J- I' ~6 D2 U- G
HANDLE hFile;
7 a) L1 c! S+ z" i& R8 r3 h hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,7 _. T, u+ s; g' ?' A
FILE_SHARE_READ | FILE_SHARE_WRITE,
7 ]3 B: ]- H+ v; J. H. x" a NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
. P, t9 H" j2 g/ \4 B | if( hFile != INVALID_HANDLE_VALUE )8 n! M- e! p! _, w+ s" f
{
0 }8 `4 {# b* q; @6 @, Y5 N/ {* O CloseHandle(hFile);. C+ x4 Z2 ^# |( G+ d
return TRUE;5 o0 g' i' q0 l1 [" z- N$ c
}; B- H7 k) w5 p' Z+ J2 H
return FALSE;' D. F" ~2 o8 w& F
}
4 c# J3 \; r5 p2 [, ~ f
' f% w! ?& ^" ?+ I4 yAlthough this trick calls the CreateFileA function, don't even expect to be
% |1 b* t. Q ^9 { K, x Z5 iable to intercept it by installing a IFS hook: it will not work, no way!5 \5 ^ ]2 x; X- U. U
In fact, after the call to CreateFileA it will get through VWIN32 0x001F9 D& e' \; Y# M; ]+ \1 F3 E
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
* W. E {) T- Y1 Oand then browse the DDB list until it find the VxD and its DDB_Control_Proc
. b* ^/ S& b: p# Z+ ?" A) @# Vfield.
) m0 z$ @3 e4 v; c4 oIn fact, its purpose is not to load/unload VxDs but only to send a ' ~ y% S! C {2 Q' R" y
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)* t; s2 n8 [* }8 v1 `
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
6 P% h. M. {! c8 U% j% pto load/unload a non-dynamically loadable driver such as SoftICE ;-).. A$ C% o8 g2 @9 o7 c( Q1 ~
If the VxD is loaded, it will always clear eax and the Carry flag to allow; w I( p8 }# E* F; E' [7 @, B) r
its handle to be opened and then, will be detected.
2 }( A3 f$ B! ?% x. hYou can check that simply by hooking Winice.exe control proc entry point
8 q6 l) P+ E* A+ f6 P4 F, J( F( Xwhile running MeltICE.- n5 W& ?, W \$ m) e! b
) P+ S/ P" A* Q2 F
+ P' r% p6 ~( k' H6 u 00401067: push 00402025 ; \\.\SICE
( K' o% W1 y, X( Z7 ~ 0040106C: call CreateFileA
. u/ N0 u. [- A" l' D 00401071: cmp eax,-001
- X# k1 j+ X9 q 00401074: je 00401091/ `$ o+ @% w' }8 C- [
, o5 @' T9 ~4 P. v. }
/ P: S3 Z' v! |9 u; k" f% ]1 |! [- e
There could be hundreds of BPX you could use to detect this trick.; m" l7 J; O: y0 r& d y
-The most classical one is:
$ ^& L K2 i" |. B' b BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||3 }$ s& N3 j% B: z' W: U
*(esp->4+4)=='NTIC'; G% o* V! `+ E- \3 n- d3 ^
! z1 V" Y" r- a0 f9 W! J-The most exotic ones (could be very slooooow :-(
1 f1 B- x9 \. p BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
& g) C" b& a6 f ;will break 3 times :-(
5 w* s- \4 E, @
N. u" S6 |: \# ^4 g1 b2 z-or (a bit) faster: , ^1 H3 ~* e- M- S& X
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
" o, b1 }8 `. S( i6 F. ~! Z. |8 v# J0 r5 A9 |9 Q
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' 6 J0 e3 c! U- r& q T/ F6 G
;will break 3 times :-(3 h# Y: Z& n6 [
9 Q( L9 k' C* u ?-Much faster:# X8 J# x+ K) E# H
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
: g$ l& L+ _ F) J: G+ ~% R B4 B$ P8 M
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
$ H( j; S" F: z* e: f4 Nfunction to do the same job:! G! b& V+ k: i: R
5 `9 l& V' q; l4 D. l4 _ push 00 ; OF_READ9 L# D$ J1 l: G. u% p
mov eax,[00656634] ; '\\.\SICE',0: b/ S1 e& [2 o9 W4 |: U Q
push eax0 V1 Z9 d/ B/ m" E* B
call KERNEL32!_lopen* g! }( x) y; V% m- R! O9 T1 J4 {
inc eax% r; K$ S& M$ c# U
jnz 00650589 ; detected
$ g% G# g$ L7 {" s0 l push 00 ; OF_READ
) \) K- w% ]( Z- K k mov eax,[00656638] ; '\\.\SICE' a- M8 }3 Q# t/ e& V9 W' a4 t1 ^" |
push eax0 h. ?9 A2 d7 H/ B
call KERNEL32!_lopen- }% @( O) d9 {
inc eax
5 `0 ?2 @! `! I+ M8 ? jz 006505ae ; not detected; B* Y, u4 b9 o' k! H: T, q3 G' w- @
$ a4 D9 K8 y( X$ G0 [* F# V) s/ q# Z8 r0 S7 q. Q
__________________________________________________________________________ Z# s4 C5 Z7 v
) G3 A: C: e1 |, J0 Y" FMethod 128 X8 `" l7 H) x% P& d
=========
9 S! k- ?. T9 W! y0 X' d% ]1 _3 ^' i1 v0 J! ]" `% @
This trick is similar to int41h/4fh Debugger installation check (code 051 T) Y+ ?+ Y+ W& K- ^4 m
& 06) but very limited because it's only available for Win95/98 (not NT)* |" i' R, i8 Y+ {. E t+ |9 K
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
# V1 S- l$ e M2 l8 ~" g: J. A% T* G, w/ d
push 0000004fh ; function 4fh0 q+ G. _( X# m; K+ L
push 002a002ah ; high word specifies which VxD (VWIN32)1 U7 v# R6 N+ C9 x9 d" _; r
; low word specifies which service, e0 Y6 ^3 ]% i! d& W+ A
(VWIN32_Int41Dispatch)
2 R" u0 S$ c* x call Kernel32!ORD_001 ; VxdCall5 z' G* q! {+ l0 `; g
cmp ax, 0f386h ; magic number returned by system debuggers' e; K% K/ F/ H* c
jz SoftICE_detected$ q7 u/ o! x* p* C6 j
" ?/ X$ E9 I P
Here again, several ways to detect it:$ w( I! B. u7 Q& K
: P* w9 I1 @1 f
BPINT 41 if ax==4f# |$ j7 V3 H ^2 p: u
4 W- P+ \# ]- ?! {# h+ T- S
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one3 Z5 z; j8 X0 {7 x
0 Y, y1 b5 t' M BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
7 @# C+ H2 r* {* ~' N
: G, C" e+ O0 y. @" P C! V BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
& T, s8 p6 Y, h3 k0 o% n- U) {0 w! ]$ a; O: g; i
__________________________________________________________________________
# B3 G* s, O$ U- H; q2 `0 m
2 _1 k: o% y8 N4 O3 j. Q, k5 _Method 13, W, U9 t4 |+ H! F; X1 R# w
=========! s0 b: K& Z* d) M. L
, M: }7 F @( i B xNot a real method of detection, but a good way to know if SoftICE is
) s; t" Y/ f0 p8 _+ m( V/ ninstalled on a computer and to locate its installation directory.3 j, Z4 D3 p: C( ?' T% s" @3 h9 r
It is used by few softs which access the following registry keys (usually #2) :2 D9 N V0 D7 g5 ?
5 C/ P2 @6 E% k& i7 {-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
# `% k% m+ ^, D5 N\Uninstall\SoftICE/ i9 Q5 V2 a- Y# R e
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE8 D: ~; Q/ n9 ~6 a
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion h7 W4 M" r" n/ Q r1 h+ g
\App Paths\Loader32.Exe* f$ ?# D1 N" W3 `5 R8 `
+ W3 H7 ?6 v8 O$ ~* u
* l* m; q8 p) ?5 J0 N: I* gNote that some nasty apps could then erase all files from SoftICE directory# M6 |2 y1 @/ I# e& m
(I faced that once :-(3 b1 F( w5 H+ G# ?7 L
2 {$ w6 D/ G8 K" d8 [
Useful breakpoint to detect it:" o9 W) N' N! h' h' d
2 l8 q/ ]1 ?" s! P BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
' p% Q1 A0 `) H0 u+ T; M
8 o8 u x5 B/ @# V__________________________________________________________________________
, i8 m' y; t" b6 W f) I0 ~$ p- w+ \: c1 }, R+ d4 r' [
3 u' v7 V e8 J/ S1 M
Method 14
+ ?% ]1 z# {6 k1 u$ z: Z=========
6 v3 }' T! z: V
A9 o9 S8 d5 x5 QA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose" v/ n! P% A9 e2 n+ W: v4 ]8 F
is to determines whether a debugger is running on your system (ring0 only).
: s4 S8 p/ M. W% t8 P( A2 `" R7 z( j& x* k- m
VMMCall Test_Debug_Installed5 u+ R( \& s7 F9 v( d
je not_installed( B8 V' A" F( l" g1 t& l. `5 r
1 D& ^" I5 x( A. c: c
This service just checks a flag.' C8 ~% F. |7 P: p; ~
</PRE></TD></TR></TBODY></TABLE> |