<TABLE width=500>
; L! q ]9 @( H<TBODY>
3 O u/ e8 g" k1 n$ D8 ?& `% ?% Z<TR>" Q8 a' i1 s: D p B6 Q" _
<TD><PRE>Method 01 3 O: Y* R4 h) f2 n8 [$ N6 U* V8 q
=========
5 ]+ a! y5 B5 @6 Z' u$ X$ _
2 K, e A- G* j5 u3 [9 s' OThis method of detection of SoftICE (as well as the following one) is
8 x' M: p' {7 n' |! K( U; S7 pused by the majority of packers/encryptors found on Internet.2 v( f0 ^" W/ B1 ]- i
It seeks the signature of BoundsChecker in SoftICE
, Y3 P: P. q. {0 T7 a+ X2 a% E& f5 l: L! H" T, P2 ?6 Q
mov ebp, 04243484Bh ; 'BCHK'
/ S( [1 J$ g/ X mov ax, 04h! N" z/ \9 C: |& h. f: `
int 3 ! k$ J6 n) {) r
cmp al,49 \. v3 q( G/ ]) L, `0 n+ W S
jnz SoftICE_Detected
9 U5 }. J# d6 E! e) \# }' M5 _6 N" _3 l
___________________________________________________________________________# f" d0 p- m& d/ l' _- Z0 {" f
' ^8 Z6 F, w q% o1 S( nMethod 024 H3 ?, z* `0 `& @. P
=========; M y4 @3 n! A0 w( b
! b" U. d8 Z, |" J8 n
Still a method very much used (perhaps the most frequent one). It is used
/ | u3 R1 T. l+ ^( m3 eto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
" y( G5 j2 X; l7 d6 Y$ ]0 |" hor execute SoftICE commands...
" k+ w; J% t8 V9 h9 n8 YIt is also used to crash SoftICE and to force it to execute any commands5 z- C+ z, W9 h# }
(HBOOT...) :-(( $ }1 \3 C/ P. B1 o5 U
! A/ E9 _. W1 O' {2 z. y
Here is a quick description:
, O7 p! B2 d2 |5 b: b-AX = 0910h (Display string in SIce windows)) X/ F: B0 \& Z3 ]3 \8 f0 ^
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)% X0 r! Z5 m8 H+ p' \
-AX = 0912h (Get breakpoint infos)
% Q' @; C. q, F2 A# L( H! J-AX = 0913h (Set Sice breakpoints)
5 h. V, s) i& J" t, e+ `-AX = 0914h (Remove SIce breakoints)
2 Y2 E7 t3 s4 ~! [6 {; M. h, ^0 y/ s! r
Each time you'll meet this trick, you'll see:
& E7 n5 N5 E0 v5 u2 ~-SI = 4647h; ]# S# p; T- j. ]' k. x+ a& ]9 L
-DI = 4A4Dh
8 N7 S9 ?: r: m0 M" k$ GWhich are the 'magic values' used by SoftIce.# a! _ m+ D4 G4 Z. u, Y
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
( @- Z! t5 `# @6 _* A- |1 V& I4 U2 ]' N) C! S" n# `
Here is one example from the file "Haspinst.exe" which is the dongle HASP
+ g+ X0 v! a. U8 p2 A6 ^Envelope utility use to protect DOS applications:
) A R! r" d! ^& o; O7 Z7 U9 f' T! p
% O! W7 n8 ^3 A+ q2 r* {3 ?
4C19:0095 MOV AX,0911 ; execute command.) L5 Z5 m+ z& _5 L, s
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
' r" ]: D8 ?$ |: y4C19:009A MOV SI,4647 ; 1st magic value.
8 J4 Z) }) d# {4C19:009D MOV DI,4A4D ; 2nd magic value.
5 h& g7 b* B& W4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
- k2 ^4 k. o9 X! F4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
7 u1 T( H% {( L3 D v S4C19:00A4 INC CX& F8 H* N/ p4 b( m
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute; }0 P" L) d5 p6 K$ C2 v4 I" n! t
4C19:00A8 JB 0095 ; 6 different commands.0 e Y% K$ m' V4 K5 b, S8 s8 t/ ]
4C19:00AA JMP 0002 ; Bad_Guy jmp back.' E5 ~- {6 ?1 R! O4 l! _& o' T
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
}4 r: ]$ W0 c! Z
: u+ W/ X; w! T+ VThe program will execute 6 different SIce commands located at ds:dx, which/ b" j! O+ A, W# f
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
7 I2 Z) }/ Q2 K' t! P2 n
" D0 b. A6 b: v* C+ d6 k, B* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
" U8 Q" f& g3 ?3 ?___________________________________________________________________________- j9 w4 ?/ Y: D, k _; y$ g2 M
1 R' O$ R1 k: E) @/ v; Z, S1 p8 D" c6 U8 i* W8 B9 _
Method 032 T- U9 C- _4 f9 H% e! G6 d
=========
5 i+ _1 o) g8 T; {' b/ p9 I7 I6 @/ i2 B) E: P- D6 E
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h" Y* O* H+ f: f/ |. d
(API Get entry point)
: n+ ^$ i- u* d2 x- ]5 z' I, S( ~
$ S7 N1 S9 o( Y- {
% T1 a c- C7 }* C xor di,di
5 H0 v& B5 e4 u9 o mov es,di
$ X$ Y2 p4 R; P; S S. H1 K mov ax, 1684h
# g* y3 B! f# l1 X mov bx, 0202h ; VxD ID of winice
9 p4 b9 i; V* [0 V0 i. U& A- O int 2Fh
. P6 X% l+ r! D: M s* o mov ax, es ; ES:DI -> VxD API entry point7 A, k) M$ y7 D" t; X
add ax, di
" F6 J1 O' R" R# y' A# Y- @ test ax,ax. v* L% `# D( r. M; ~" ]* N
jnz SoftICE_Detected1 g; i% s4 D6 D7 h; w: | r5 q; m
8 G( m- d* [! Y1 G; Q/ D E___________________________________________________________________________; n1 T0 J: ^4 @7 ]4 H4 o2 |
/ T. V# m$ H7 L2 iMethod 04# ~& q4 K6 E9 }6 }
=========
$ {! P: }- {$ ^+ `+ E0 M
9 `; A* {( `! oMethod identical to the preceding one except that it seeks the ID of SoftICE
- N/ K6 X) P! k! `/ [GFX VxD.
* v1 ]7 u# h3 j6 n# J
7 E3 q' n! V1 g {4 j xor di,di9 K; D2 p# Q) B5 [5 Y
mov es,di
7 o7 I% O* J0 P. i* n mov ax, 1684h
. | c0 ?5 t" C( T0 w* C5 B* `" O! g" _ mov bx, 7a5Fh ; VxD ID of SIWVID
( V5 ]& ^0 ]4 ]" C; ` int 2fh
1 n3 Y% [) F/ w) V4 B# s# U mov ax, es ; ES:DI -> VxD API entry point3 m# L3 }; Z+ O
add ax, di, t+ M; x1 b0 ]" J
test ax,ax3 |, A' ^- Q( T) f* F, z; m5 ?$ H( u
jnz SoftICE_Detected6 T' C5 c0 @" p% K, r9 L. {& I& Y c
3 W4 z# Q& H9 {# |0 T8 p# v
__________________________________________________________________________* ^) k4 J1 \3 x$ P: ~4 l4 \7 c3 C
1 u" C) w a" c: V z5 x: J' d9 S( N+ M8 q, S3 t" ]
Method 05: n( I( m5 H" H( u% }- I
=========- [( n u9 q6 Z" p2 W( S: t" p3 t- D, D
. Q! p! n" G- m& r2 g9 ?Method seeking the 'magic number' 0F386h returned (in ax) by all system/ w5 I. \6 P* |" V% z0 b2 ?
debugger. It calls the int 41h, function 4Fh.
" L% S& H) \5 d, a0 aThere are several alternatives. 4 ]: c6 r6 c& r; a# P2 c' r
& X% o: U' P4 X& P& wThe following one is the simplest:
; R' u( ^$ o3 T9 i7 ~" \4 D4 P. j
0 W' s j5 o/ b7 m5 H) I mov ax,4fh1 X6 w3 }4 v( K6 |* `0 J5 d
int 41h5 c9 U) h+ `, M4 {$ s2 {; D: |: p6 r C
cmp ax, 0F3867 h. p" A9 P' ?+ t+ m) f0 I" z5 N
jz SoftICE_detected6 B; Z: F" m3 c2 y1 v. z c* v5 X: \: Q
3 b( }4 _: f( v0 ]) m2 M) o
! [! M8 T" \: }3 KNext method as well as the following one are 2 examples from Stone's
; t! `- T# V: K W"stn-wid.zip" (www.cracking.net):# ` m; V f! P( R' z% k
% k: Z0 D6 v, x3 g mov bx, cs1 J4 `! J6 i1 s- m# h+ P, `8 y
lea dx, int41handler2
# Z) z" s3 L' ^9 `2 M xchg dx, es:[41h*4]7 \! }# M5 ~- h# [9 p
xchg bx, es:[41h*4+2]
2 W7 x& S$ G0 C/ F( `1 v- j mov ax,4fh/ Z" J' X- n3 W" ~3 T. B
int 41h5 X4 A) N" ^# L0 F
xchg dx, es:[41h*4]8 S6 k, e! k4 @' L! C5 L1 Z
xchg bx, es:[41h*4+2]
0 W* W/ [* a& t! I6 B2 M cmp ax, 0f386h4 S+ {9 I2 [/ t# v7 C- u) }
jz SoftICE_detected
- F: f$ o- s' J" w; T/ C3 D9 ?7 R% Z, }; P$ |+ R( p
int41handler2 PROC9 v6 |; `5 ]( A* x( G
iret
2 v& s: b2 x1 Qint41handler2 ENDP
0 q' b, e: H7 ^ d5 u0 `
* s/ a* s$ f" `; ~; z1 ~: s$ [9 D+ @' h* | Q; H
_________________________________________________________________________- q& L# l: a) [' Q0 l
; K; |2 E7 Y' p7 L# ~
! P2 f9 @* ?) k1 `8 J kMethod 06
: e" {% ?/ B8 j5 ~* h=========
* Q; z4 f! r$ z# z6 l
% |# S' S9 U, R$ |6 S9 |/ m( O$ q/ H% v5 }
2nd method similar to the preceding one but more difficult to detect:8 u4 ?/ b6 B" U5 |1 x" L4 q7 M
0 D$ p8 Q" H" g
% U0 ]% \9 F% w7 h# _, d
int41handler PROC
) b9 W, `# l' ~2 } mov cl,al! G7 r8 W% G3 N1 x
iret
+ a( O. A7 U) \9 h, l) [0 Yint41handler ENDP
3 q; _& A4 I7 j/ ]. A. q# m- |) v, \3 V! N( n& ~
$ a2 h; u3 }7 j8 ^) l
xor ax,ax& t! M: d) Z* R
mov es,ax4 B5 [+ Y+ e6 X- _
mov bx, cs7 e3 X6 o3 I2 H' y' o: v8 d2 x
lea dx, int41handler
/ N0 z |3 V; l3 ? xchg dx, es:[41h*4]6 L) q" n7 A' j7 v' u/ |
xchg bx, es:[41h*4+2]% f- \9 Y; Z% o) A9 V: m
in al, 40h$ ~. T' W2 q$ U& E4 p; n
xor cx,cx
, M. M% n+ `& p/ i! ] int 41h I$ S# F! I8 n0 v
xchg dx, es:[41h*4]
1 e: ]- {& |7 P# O/ a: m8 \5 P0 i" {( I- { xchg bx, es:[41h*4+2]
+ l1 @! N) i& {" w- ? cmp cl,al% {" [2 h. c& a4 j7 T6 ?
jnz SoftICE_detected8 x& m$ [4 z. X. y2 ~
% s0 m5 n7 _% e) y( e* j
_________________________________________________________________________: t0 n ]6 C6 v# q- \! r& Z3 @
q9 \" h" {! K$ v
Method 07
: P) r5 h# C' G v=========0 @4 ~% S0 m( ]1 {
9 W( V1 D2 d. }0 q8 ?7 G
Method of detection of the WinICE handler in the int68h (V86)
+ z$ P z, R, k0 J& m% s
4 [* [8 c4 o5 s1 j; |4 D2 Q3 ^! } mov ah,43h
1 V+ ?9 y3 n6 |3 U int 68h
! y) S+ i1 H, U* S L, ]0 q/ D cmp ax,0F386h+ H) G& i, {. L8 P
jz SoftICE_Detected* x6 n; B3 p( n5 v# ]
0 g9 I+ h2 o! F4 n" v$ t
& C* @7 w* N+ R- Z& V; L=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit5 c; K7 u9 Y9 `$ o% }% F8 H
app like this:3 m8 Z5 f0 t$ l6 o6 Y" X o
* \% f, v6 }8 L5 z3 D* y BPX exec_int if ax==68
8 A6 ?+ b# y! b( R# ^9 t5 u2 X (function called is located at byte ptr [ebp+1Dh] and client eip is
7 s, q: R& s" b+ u; m! y located at [ebp+48h] for 32Bit apps)2 ]) T" e* o: C& \% P" R4 v e
__________________________________________________________________________' h( D; \6 c) h1 I1 [( j) Q
2 P$ L0 Y$ D6 y" h7 [6 k
! F0 r0 s$ k$ r, p; W0 IMethod 08
; \* D' g3 ~( j0 q! m5 \: v8 r=========
m3 y! l1 h7 q! R; w j& F ^
It is not a method of detection of SoftICE but a possibility to crash the- ?1 N' b7 g) b; X: [0 W
system by intercepting int 01h and int 03h and redirecting them to another) Z& Z- x& g" C1 y ^6 b; g' o
routine.2 @& s$ |: K: X3 N: A
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
. y3 Q# f, j. Dto the new routine to execute (hangs computer...)9 A; e8 i5 v T4 O7 K' W+ z, R
8 W! i3 V4 n, j% z3 G mov ah, 25h
+ Y! k6 [2 R5 J( i mov al, Int_Number (01h or 03h)
/ h2 b- {. H/ A1 e8 i0 a mov dx, offset New_Int_Routine9 z- J( s$ O7 n U# ]* y
int 21h
0 w' T$ _, G# N2 ^ w" i& `0 j$ r& B( E* z
__________________________________________________________________________" D& v2 _$ T. @( G* o% \* W2 `, R, o! B4 p
& `0 U: P) P9 J3 |9 K0 gMethod 09
+ L E' `. X- v=========
% b4 [ r3 Z% [ g( r" ?( X. O
# ~/ a" Z" E+ n k4 IThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only( d- R& O# A" r i
performed in ring0 (VxD or a ring3 app using the VxdCall).* N0 q$ U, ]) O
The Get_DDB service is used to determine whether or not a VxD is installed
' v; P5 m* a: D9 R% r. U* Z8 P) dfor the specified device and returns a Device Description Block (in ecx) for W, A1 k+ x) [* o m
that device if it is installed.
$ i7 S+ t- V& q4 K4 `$ i/ ^0 N4 j; N& \. k( G+ }% Z$ O; K6 I
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
, ?" r+ V s9 m4 l, f) ^( J9 j mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
- s' X; U* ]2 _% k' e, {3 U VMMCall Get_DDB
1 }. R6 v+ j& z2 J mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed' ?) J) Q! `' ` L
0 x9 D/ j8 a; z+ PNote as well that you can easily detect this method with SoftICE:
0 u% b2 ~8 S$ ?! ^* J bpx Get_DDB if ax==0202 || ax==7a5fh: ^/ `# m/ W+ K/ ?$ G
. a4 ~4 F) ~( W" G+ d
__________________________________________________________________________% E9 b8 `5 a% ~* b+ B1 `- z
( s% _7 v. T7 M( f1 QMethod 10* E; r( R, E% W$ f: O
=========1 W7 i1 D' y3 o3 u$ ? f# F
( U8 S7 S/ S- s7 H+ W. c=>Disable or clear breakpoints before using this feature. DO NOT trace with
/ R" C4 ]# O5 z. V8 a9 \ SoftICE while the option is enable!!" }, o& O0 @- l9 l9 F, Y0 e4 r
% ~: z4 L0 U; g/ F) p sThis trick is very efficient:
9 a( y8 X, U4 j# u% D3 j/ hby checking the Debug Registers, you can detect if SoftICE is loaded' @& G2 z) F: @2 Z) v0 d) {
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if0 a. e2 z: u! f; w9 s8 d5 H8 }
there are some memory breakpoints set (dr0 to dr3) simply by reading their, F/ A3 \. I3 b5 o) B
value (in ring0 only). Values can be manipulated and or changed as well6 z: P% B2 P) n% d- l
(clearing BPMs for instance)
- p) P, k0 z; P. @" k! U; f4 ~ @1 j# x+ R. e
__________________________________________________________________________2 h' {/ I0 D3 A: d2 i0 t
4 z, Z- V1 t- A1 ]; c* e
Method 11# Q2 Y4 L! r( O0 w. n& \7 u
=========4 I3 l& A( w9 f4 j
/ m9 w# c0 N a: d M
This method is most known as 'MeltICE' because it has been freely distributed4 D" N. k/ p% g/ l+ e4 e e( v
via www.winfiles.com. However it was first used by NuMega people to allow
. V2 @- G' w. a3 a' L0 oSymbol Loader to check if SoftICE was active or not (the code is located6 M+ E# F+ y6 C! [
inside nmtrans.dll).1 h7 P6 ], K( z$ Z L; L" l
8 z k* P* |1 J$ @6 g2 KThe way it works is very simple:2 t1 @( F/ u; P( Z6 o: z
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
5 W& s/ H1 P% U HWinNT) with the CreateFileA API.
; r. i7 z& L0 ~7 w* |- E
' L) O( o" \2 a7 KHere is a sample (checking for 'SICE'):- p O$ Y$ P) w9 Q2 |3 P
/ W6 ?; V$ i+ k+ `! J" fBOOL IsSoftIce95Loaded()
0 ^+ }' B- V# ` N{
# e2 k& k, C6 {, _6 [* ^ HANDLE hFile; " [! |& u1 v& I3 q3 |, |; @
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
" c! n1 z/ Z1 a* J) o) u# V FILE_SHARE_READ | FILE_SHARE_WRITE,
6 H% @% u" ^# d* e$ n4 z0 M8 E NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);; x8 ?+ c# b$ `4 v: `3 ~/ o
if( hFile != INVALID_HANDLE_VALUE )" g* _% K' o* }4 i! t
{' V# L& I- Q) N M3 `& L; m
CloseHandle(hFile);: l, h) r8 J; e6 r3 p! y- x ]
return TRUE;
/ p1 @" s; G8 @# T" z }" ^3 t/ I4 m5 d2 Z+ l
return FALSE;
8 ~0 R& B0 x, i; X}
& q6 u7 N3 k) e# c6 m2 `; r
k' y+ J1 L5 w- M" Q+ K( HAlthough this trick calls the CreateFileA function, don't even expect to be" [- s0 k- C* n4 _7 ~
able to intercept it by installing a IFS hook: it will not work, no way!
1 T+ Y- y+ T2 j4 ^3 c, zIn fact, after the call to CreateFileA it will get through VWIN32 0x001F$ f6 s ]2 U) x* o2 C: W3 B1 ~
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
9 o6 `' h8 y; |/ }and then browse the DDB list until it find the VxD and its DDB_Control_Proc j$ H" a E3 ^! p+ o% I
field.
! ?2 a, ?, x5 hIn fact, its purpose is not to load/unload VxDs but only to send a ' d9 ?; z; w3 v# f- [ ]% f2 ]
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
1 _! `4 _1 v( d& H1 D1 g: Z) W/ Ito the VxD Control_Dispatch proc (how the hell a shareware soft could try
8 o1 h* K3 C: G# u* ^* @to load/unload a non-dynamically loadable driver such as SoftICE ;-).
5 Z" ~' ~& Q+ y( W nIf the VxD is loaded, it will always clear eax and the Carry flag to allow2 P9 K0 `% p+ u* L0 `: m# g% h: B ^
its handle to be opened and then, will be detected.: B1 i7 y: P8 A
You can check that simply by hooking Winice.exe control proc entry point* H$ h, P! k( b3 E; r
while running MeltICE.
+ ^" G W# ^5 g, W) ]$ P9 [; X3 U) T& m- r1 V
: J3 R& E& |" G' }+ A+ b 00401067: push 00402025 ; \\.\SICE
! z% z; i l0 a r4 n 0040106C: call CreateFileA9 @+ j/ g9 X) r* b0 n+ V; h5 T1 P
00401071: cmp eax,-001
) k1 k, J& P6 L) L8 Q7 p% \ 00401074: je 00401091, d+ p/ z% I% ~" m5 x
7 I4 D8 ]( h5 o
% K9 q0 J) B9 O# lThere could be hundreds of BPX you could use to detect this trick.$ [6 s( R3 Q. e( u7 R7 q8 X
-The most classical one is:
4 p( ^( Y% `& X( @9 t0 M BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
& t- S* O$ d m( D3 \9 S* J1 a *(esp->4+4)=='NTIC'
: W! M( c6 y+ Q, ^3 \: f, `5 [
3 x% [/ R. }, x p% P5 O-The most exotic ones (could be very slooooow :-(
3 m$ s7 }0 U- J8 U) A4 m0 g BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
& I7 \% k2 r. r0 D ;will break 3 times :-(% p. [' n6 Q/ q; Q# Z
: H Q( Z% u( h2 x {* l
-or (a bit) faster:
# z0 ^+ m7 E5 L" B" ^. b BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
( h; B: j: q% g. n/ U- r. b: F: X( f5 g W% d2 I
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
- e' X, W r( d& b% m1 M) u3 ~ ;will break 3 times :-() C C- }5 m2 U6 D4 Z
h: U, |: C8 y7 n-Much faster:4 E6 \) c: \' p$ B, G, c
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
7 ^8 z: n$ P! w2 z. c, U7 E+ h( ^
7 N# @( s! ^" ?: GNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
4 N1 N3 m6 |0 t+ g. Z7 d# K Rfunction to do the same job:
8 ^) ~5 L+ T) z9 F4 \$ G* b3 n+ k& h0 {- @2 ]! ]5 h. w
push 00 ; OF_READ
6 h* B9 L l P' y4 V mov eax,[00656634] ; '\\.\SICE',0
- N- ?" Q& A2 N2 v' P, C) V. ` push eax
' n4 X) a$ \! Q A call KERNEL32!_lopen
, m8 e: S$ ~5 O8 f. L9 a inc eax4 G/ W6 r) |; Q$ x
jnz 00650589 ; detected" W# J3 M8 R: m
push 00 ; OF_READ
) S5 @1 H" d# F9 j! j& B mov eax,[00656638] ; '\\.\SICE' T( u- P; z8 ^" Q: t' |
push eax3 J" s: N" ?$ M. ^& m
call KERNEL32!_lopen
. i$ T& d% }3 H1 d8 ?/ x: R# y/ b inc eax
t; t+ m5 r+ T. }, o! [. y& o+ H jz 006505ae ; not detected
2 U. L' X& x+ _: |2 t9 Y6 L0 j% s) X8 q$ i! [
- u1 F$ |& U7 r8 Y__________________________________________________________________________
2 Z5 L5 y& g& x9 C9 R6 B8 ^7 J6 g% |7 L
Method 12
6 ?3 K, l" }, Q- [9 q=========' F# \/ E, s- z6 T, b: e
: p6 @2 X% h# Y
This trick is similar to int41h/4fh Debugger installation check (code 051 _; p/ [' h! s
& 06) but very limited because it's only available for Win95/98 (not NT)8 a) p. E4 Q$ w2 E$ \, W6 T, W" A
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.$ U+ L$ r2 K# Y* k7 }) J
: M1 d# t" t7 j1 z( B! t% x4 H push 0000004fh ; function 4fh
( d+ J) Z( r& X1 y1 x6 L push 002a002ah ; high word specifies which VxD (VWIN32)5 O/ B8 `5 U# L8 D8 D; B% F# d2 Y- F7 Z: ?
; low word specifies which service
0 a4 @6 a+ U& _& I4 n$ ?* E% b (VWIN32_Int41Dispatch); _) `/ i# w5 b! u4 Z( v4 i$ g: Q
call Kernel32!ORD_001 ; VxdCall
! U* o0 p1 C( f/ _ cmp ax, 0f386h ; magic number returned by system debuggers7 M6 Z' Z+ d6 |" a
jz SoftICE_detected8 B/ d% v, [: `9 u
5 M: t+ h3 j$ i6 O: x, p, |Here again, several ways to detect it:
3 J) t/ M* Z" B0 h) k) f8 }# I% z& d2 |
, U4 Y% g8 f+ f5 `9 \; y6 N BPINT 41 if ax==4f
' M8 c# r$ c8 B: z: _* r
" ~; R- _1 O- h' a/ s5 n( M' z/ G BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one" q' L8 \$ } o, G: A1 N
& \/ I5 }) B/ W8 D" b BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A7 a. E- I$ y" ~
3 ?- p$ O% {. _2 \: {1 G* A
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
4 e3 d: B0 E. l# n- z' ^" _' G( y/ C+ b
__________________________________________________________________________
$ _+ P6 t, F2 @$ Y% A6 f2 d& J n9 z9 Z0 O' \; N5 p
Method 13" D* _3 t, W2 Z7 H a- u
=========
- G- T4 V, H, M, H- ], w. O2 X) e8 L# C0 i* q
Not a real method of detection, but a good way to know if SoftICE is! f0 R. J4 M4 S& |1 l9 c. H2 |
installed on a computer and to locate its installation directory.. q3 p6 D' Q9 [
It is used by few softs which access the following registry keys (usually #2) :
# x# |- m, p% x: q7 m: @: A8 }
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
# [2 b" \1 @! l8 L M7 M\Uninstall\SoftICE! `/ b3 y6 X' Z! J
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
5 d2 h5 e; r& ?2 C-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion3 n d4 D2 P4 l1 ~/ l5 _' [( D
\App Paths\Loader32.Exe
' d. n* l4 o3 p! z
( d' K( y5 ]6 Z! K% U& t5 n6 A" F; g, k" u
Note that some nasty apps could then erase all files from SoftICE directory
4 H5 k6 I/ x# l8 @6 F6 N(I faced that once :-(
; q, u+ O- p3 |& L5 _: A: H0 n
$ Y( p2 P) y6 O* r* fUseful breakpoint to detect it:2 T+ P( z& w" m1 X# G3 m6 S
/ N( P" x" p# z3 u4 w& C BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
/ z( m+ L1 O/ q8 X* J! e' Y* r8 T/ W9 e+ q8 l: O0 ?4 M
__________________________________________________________________________
# C. u" m( D v2 K- w3 d# c0 o, o, f1 `/ H- @
- A0 [; T' z) @$ S# DMethod 14 8 E2 T, S; D6 H5 B6 s+ W- X
=========( s) s% f& X* ^9 u
( K3 f- ^6 ^0 K& X5 o' ZA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
) v5 i. d: C5 @9 j9 \% {+ o2 Gis to determines whether a debugger is running on your system (ring0 only).0 n5 U' X7 _- E/ m5 \9 E' I
: q* G5 \, C m4 F1 I VMMCall Test_Debug_Installed
! I% }3 o. \- M/ Y, ^ je not_installed
, x6 j+ I8 R( [$ J1 e" j) Y; ~. z9 d% A9 ^ O
This service just checks a flag.
& f& k4 z& U$ S1 ]- u! S8 _</PRE></TD></TR></TBODY></TABLE> |