<TABLE width=500>7 ^( V1 l7 ?7 t3 [4 b ?- W
<TBODY>% X3 a/ b( r1 |% B5 f% ^1 x
<TR>. P8 N' {5 {" ` s
<TD><PRE>Method 01
7 Y& i3 x$ {1 s" ] S=========7 m- p* V9 [# n' |
, [$ M$ q' c. r" E
This method of detection of SoftICE (as well as the following one) is
: t6 K4 a- C8 q, Oused by the majority of packers/encryptors found on Internet.; N" Z5 r8 o# @% a/ X, y6 s: O# Q
It seeks the signature of BoundsChecker in SoftICE8 I2 G d9 U# t! E( ]6 \
* j- p5 q1 B% s! Q3 ?7 _5 s
mov ebp, 04243484Bh ; 'BCHK'* v! `$ `* F- A+ u) E" P# a
mov ax, 04h
- v& @( ~* ] W5 G2 J% y4 f9 t int 3
0 [4 X4 x& s+ b& D cmp al,4, S5 H9 `) C2 ^- t k- i
jnz SoftICE_Detected! {# m' i1 h# k1 e' N9 M
# I f5 \7 |) i___________________________________________________________________________
' e1 x& I1 u1 n; Q! l; p2 i$ u u& {2 v1 p% z3 c4 }
Method 02
2 g: t' T8 B- `4 b+ R; i! V=========8 z' V7 n$ e1 q; A: k
. V: u6 J: B) S( q
Still a method very much used (perhaps the most frequent one). It is used
$ V5 L# F; q6 n& L( b% Ito get SoftICE 'Back Door commands' which gives infos on Breakpoints,
2 y! b3 A: H) d' z3 U8 Uor execute SoftICE commands...
+ V/ g, t1 o& ~4 w" G5 E* k- t8 v3 g7 ZIt is also used to crash SoftICE and to force it to execute any commands
$ O) l: \9 P' ~( y(HBOOT...) :-((
5 i/ ^5 g9 W7 J5 m0 O& }. j% M* |0 F7 j1 C5 I" Y
Here is a quick description:! ~5 @# ^4 i- U# v/ _8 a
-AX = 0910h (Display string in SIce windows)
: `9 R$ B$ t' X+ W; [-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
7 p2 \7 M' z% l" W1 D( O-AX = 0912h (Get breakpoint infos)5 w% ]4 h3 z# p/ J, K
-AX = 0913h (Set Sice breakpoints)
1 r2 H1 ?/ x+ J" f1 V4 i-AX = 0914h (Remove SIce breakoints)' X& _. j% m7 ?8 }1 y
! b$ ^! q/ ^) W- x4 \, X" \0 TEach time you'll meet this trick, you'll see:0 T" i0 T0 A9 w S
-SI = 4647h
" O8 m$ ~: W- \. m& k W- N8 Q-DI = 4A4Dh( f" E% s, Z/ D! o. R" b
Which are the 'magic values' used by SoftIce.
$ i' e; B! D* F" B# aFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
2 [, U9 d+ G* n5 ^9 P, Q. V
, P+ k P, n; o& M3 S) y7 m) jHere is one example from the file "Haspinst.exe" which is the dongle HASP+ k8 q% \* s$ ], U! v2 c
Envelope utility use to protect DOS applications:6 w& T/ c% W( d t
# g, B' i l9 `) E0 _* X4 c: i2 ]
9 T4 _1 b6 Z7 N; a- l' O1 Q1 N4C19:0095 MOV AX,0911 ; execute command., `5 G9 b9 G) |: h* |# C
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
& f$ |. s1 n5 g' L# R9 j5 |4C19:009A MOV SI,4647 ; 1st magic value.
; V9 c3 L& _6 p5 g* t9 M' i, [4C19:009D MOV DI,4A4D ; 2nd magic value.
5 H1 S/ @# x2 W6 {$ \8 G1 _/ S4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)* K: o7 C+ {9 N3 z7 U
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute0 S; M8 n5 ^% a1 G0 O, j, R
4C19:00A4 INC CX
+ F( Q2 R% J1 `: A* N) W9 N1 b$ e4C19:00A5 CMP CX,06 ; Repeat 6 times to execute- n/ h* L0 V! y' Z7 ^5 P6 V
4C19:00A8 JB 0095 ; 6 different commands.4 z6 S% O; j. t9 s* t2 R
4C19:00AA JMP 0002 ; Bad_Guy jmp back.
1 g6 n' \. [* P* Y1 o# S9 _4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
' o1 W/ z+ w9 P) O, y' o
7 `6 ^# L& v7 ~+ i8 yThe program will execute 6 different SIce commands located at ds:dx, which
& h8 ^/ j4 C( m; W, H6 { ?! Tare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.$ f: X1 r+ ` ?: H# n4 R5 I
' w0 [5 _+ N6 ^
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.4 R& m% f9 r& W0 i" K5 \6 O% j
___________________________________________________________________________
. _) H, x0 l; |0 A% P* T5 A
6 Y6 u, C/ C: u+ v4 |
' |" `4 }. w1 iMethod 03/ x0 t0 x& Y. Y4 O$ f' Y5 M5 Q% k
=========
1 S+ k- L: X3 p0 d' Z
3 |8 G' `0 b% @Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
5 p3 K3 x! L. x0 S9 m) f( j(API Get entry point)7 m0 k9 ^ | y
. R& s) x9 q) s6 ~/ j1 o5 m
/ \4 c( q, J5 e* H6 ^1 j# ~ xor di,di [+ G' o8 U# T$ Y; j
mov es,di& r* X# M0 u2 x; F. B( b
mov ax, 1684h , l. W" f1 e% D3 S. I
mov bx, 0202h ; VxD ID of winice/ G: P1 K2 D% W: ~* z
int 2Fh
) f+ s5 T; t( R6 }$ Q8 d mov ax, es ; ES:DI -> VxD API entry point8 l, P! |7 N8 d/ O* a0 e/ {4 u" x5 p8 J
add ax, di
/ `% w# u3 M: _$ k9 f test ax,ax7 O- `# h' |5 x* D* q, O' t
jnz SoftICE_Detected/ E: x+ L1 }* Q: D M/ f* W4 N- r
/ P/ R, q. X3 @2 k$ B; ^
___________________________________________________________________________2 @. ]2 v% y2 m. ?: I0 W
0 l% q% q. p5 c p. Y7 {Method 04
, C9 u. c' d3 ~ v=========* [" M# F6 Q6 H2 o9 Q+ E
; J' R. r; _" GMethod identical to the preceding one except that it seeks the ID of SoftICE! g( @# F. b) a+ l6 C4 X, `
GFX VxD.
/ f% w; [/ b. A* ]
6 j0 x1 J9 u! K* n; {8 a( [' g; V xor di,di' l+ ^; a( P( c5 h0 a
mov es,di z% w5 J) l2 G
mov ax, 1684h
/ p, N" t4 a4 M( h$ Y& g2 g+ ~ mov bx, 7a5Fh ; VxD ID of SIWVID
9 R$ T$ P% _- t int 2fh# e) f3 L' I. r, B; w
mov ax, es ; ES:DI -> VxD API entry point
9 S! y! Q e; r1 h add ax, di4 f0 T4 `8 Z8 u
test ax,ax
0 s( @# ]; j+ C/ o" J' f jnz SoftICE_Detected, s# o' G/ q) ]' `, N
! _0 h2 k# h( g__________________________________________________________________________( p) g# {0 P$ \/ J2 Q/ Y7 J
( o* |& Q; L4 Q- V: Y
y5 P/ }. o$ t3 m
Method 05 o4 c8 _2 l2 S( ]6 ~
=========& A* I6 d$ }! i2 G
- L1 H8 M; `/ h W2 I8 F3 f- |) |Method seeking the 'magic number' 0F386h returned (in ax) by all system- t6 G6 }- b5 ]2 `8 {3 U
debugger. It calls the int 41h, function 4Fh.
8 _2 B( h3 |" e, wThere are several alternatives.
$ b7 x' v; M- C3 T) D0 f+ R$ i$ G# |
The following one is the simplest:# F) q$ f( w' g6 m9 P) f
/ I# w( ~# T: E5 r8 Z4 f' `' F( d
mov ax,4fh# k: D8 J! ]2 q0 d5 u
int 41h1 M$ _0 t) B( a! q6 T- z' g
cmp ax, 0F386: o8 W6 w/ l5 \ x& k+ l4 q
jz SoftICE_detected: h! I+ B# E+ H7 k$ G( a% L
; l" T! z. ^. N. d
& s- {) |2 g# }5 dNext method as well as the following one are 2 examples from Stone's , R" e) L% Q" X
"stn-wid.zip" (www.cracking.net):/ j( O! M: T( G0 [" @7 ?# R6 e
/ F; D; W3 ^ j% O7 l" r8 ]
mov bx, cs7 K( }0 E. r2 Z. o) v
lea dx, int41handler22 e, v* i; m8 X& x, U- A
xchg dx, es:[41h*4]
* ]; i7 R0 F: B! I xchg bx, es:[41h*4+2]
9 M ^9 V: ]+ f, H% l# k& P. s; ^& P mov ax,4fh* h. v2 C6 L. C, z
int 41h
0 L3 q5 m, A# j/ q xchg dx, es:[41h*4]$ H. } J K/ n. q
xchg bx, es:[41h*4+2]
7 {& m) y$ R" D4 G2 J# g cmp ax, 0f386h
& R5 B e. p# e" n1 m jz SoftICE_detected
' g$ T% \- ~9 D) R& [) ] h* ^8 L* Y" s( N
int41handler2 PROC
% ?, r/ b; Q! J3 o$ d: w iret
8 y+ O8 }6 y6 n, c- i5 @int41handler2 ENDP
; ?1 n3 a* W. q; V6 h
6 I1 _# N! k* Y* d l9 ~1 i( U8 R7 x7 ] ^
_________________________________________________________________________
- D9 g! n; u2 v
5 `7 A# w6 D0 g- ^; B* p3 @" b
! a$ o7 H4 X. v! I* m9 g3 kMethod 06( n }% J+ ]" z3 P; y( v- n
=========
# G# _! p! n9 r: O* _) c" M7 b( z k( r8 j' q3 b
$ K+ }& I% r/ l1 I* H" k o {5 ?
2nd method similar to the preceding one but more difficult to detect:) Y \6 X% m4 Q( N7 b! V0 G
. I8 a2 |) t0 V+ P& g/ m6 p
$ q1 Y6 s; G4 I. o1 o) l+ }9 |4 A
int41handler PROC
. ?) d# ?5 e# ]4 S mov cl,al {% w8 w" {8 o; ]- T) m0 C
iret! S0 @( o2 t4 h/ x8 Q. R3 j
int41handler ENDP1 I" V8 s8 }9 D
/ m6 ~/ d2 c, a2 j. U0 Z# g( s
8 T# i* m$ b# s2 `0 G. D xor ax,ax
# f3 X- h! a4 V. {9 f. r. O3 ^( X7 Y mov es,ax
# d/ @: P& N" l, U- \; `+ X mov bx, cs1 _) G- B' H" w M; |8 I3 B
lea dx, int41handler
2 y6 a+ _7 Q. L) c. H7 g6 f xchg dx, es:[41h*4]. X$ b1 J/ G1 w; v6 z6 ^ @
xchg bx, es:[41h*4+2]2 }0 F( }/ ^1 O) C4 M
in al, 40h
& @4 H1 P. a7 L/ _: q7 B5 l. ]) I xor cx,cx1 Q9 }* {+ L/ D. I0 J& Q) w1 q
int 41h
3 f$ X7 D" ]8 c9 K- y/ [- c xchg dx, es:[41h*4]2 a. w! ^9 l" v3 D5 R3 W0 c4 O
xchg bx, es:[41h*4+2]
. `- Y# v$ k& O2 ]* c cmp cl,al
8 O: j3 G; } T/ {+ \* d( B0 a0 h jnz SoftICE_detected9 U& p+ S. H4 ]
4 M8 P. C( j1 u& v0 _& Q_________________________________________________________________________
- w1 g% H4 ] V" `+ Z( _( H' Q; s$ ~& Y2 f2 p
Method 07
& B! m! F( F3 l$ E, [=========
4 p h& v/ Q) i O/ m; o) ?/ [& H' U$ l# s5 ?9 N
Method of detection of the WinICE handler in the int68h (V86)6 H% u! d/ Y0 s5 W" h
/ f3 K3 _. Z' u+ p
mov ah,43h
. ` M; H: N/ W int 68h
9 n0 n) T7 E7 W' M9 V cmp ax,0F386h
1 q! S Y# G" y8 x! F jz SoftICE_Detected/ M1 Z! t0 _% L$ T; J
+ p* z9 t5 P! e. l! a
0 W6 q% m! e6 B# E# s8 k) z& w=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit' Y0 K1 C# r! r- h" c! W
app like this:
0 K4 z- w9 d% i9 z5 }
9 r- U$ ~3 e( h& Z" ^" ^9 w; B BPX exec_int if ax==68
- M2 R- r5 g( {- f9 X2 Z' m$ R& j (function called is located at byte ptr [ebp+1Dh] and client eip is
" R! \$ m$ h# n located at [ebp+48h] for 32Bit apps)
% j( f8 t1 {6 v$ @/ U( _' k9 V- x__________________________________________________________________________
6 i/ ] Z/ |6 z4 `2 S5 u
) H8 }8 \( p" R: O/ _
2 i' y- N9 a/ \# |% i# U3 E( {6 ]0 I" DMethod 08
& w5 t! h0 j3 u& |8 o4 ^ G0 B=========
& o3 x4 i& O, L& Z" A% l
0 Y7 P: H1 U4 C. U* N3 _It is not a method of detection of SoftICE but a possibility to crash the, d, H* x! a7 ^. h$ M- }2 I) k
system by intercepting int 01h and int 03h and redirecting them to another
! v: A+ e- W# r* H/ Kroutine.
1 O, x$ H1 `: o4 E' _2 n2 hIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
: }8 y! Y: g- G1 X- h3 qto the new routine to execute (hangs computer...)
8 a6 U' z' H( @8 n ^* K5 N$ \% i( [) O/ v0 Y6 h
mov ah, 25h( p3 O. ^# g/ D+ B
mov al, Int_Number (01h or 03h)
, i) c9 Q; Q U% ~6 h- z mov dx, offset New_Int_Routine9 G# B; T0 ?2 V, O
int 21h
7 X! s, k% A6 ^& m/ p: E
. W3 T* b% m5 F$ N" ?__________________________________________________________________________
% F6 e' u- n4 {9 U& @* p9 s8 }! v9 F( f$ a8 e" R
Method 09, {7 t% w% D' g9 [! y! a2 t
=========8 h% A; ~4 h, O" J
1 S& D% A( _, f5 l$ u7 z" F g! L0 RThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only( y. E% C' B- f
performed in ring0 (VxD or a ring3 app using the VxdCall).
7 _8 x! ]; m# M- O9 J) c% X. R2 CThe Get_DDB service is used to determine whether or not a VxD is installed" P& p5 k# P3 t4 @2 S+ ?1 u
for the specified device and returns a Device Description Block (in ecx) for/ X8 @2 I. O+ [& t& }1 e6 I* Z
that device if it is installed.- c2 V& r3 C- B- K5 l% v
7 g/ K7 g4 w3 h4 {) I4 l; U mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
- z1 _( q! b. ^4 P& C d mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
. W# Z, v1 P( Y% P VMMCall Get_DDB9 M9 w0 ?" \3 d
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed1 G9 s7 ?# x3 t9 c6 v$ X
1 u5 s. G y1 c& I, U9 YNote as well that you can easily detect this method with SoftICE:. t2 g4 [' W5 Q0 F
bpx Get_DDB if ax==0202 || ax==7a5fh
5 q* u* E/ f0 ]& X7 c: I0 a( u3 R& o
__________________________________________________________________________ Q7 T/ r' t6 G8 T/ D0 `$ o( x
& B9 A+ L( k2 t: {% k' |$ \' i6 W/ RMethod 10
6 `" a' L1 {9 V% Q" U9 m=========8 _# w, k- @+ c. ?$ o' z- j& \
5 y0 H* T1 K4 F/ d=>Disable or clear breakpoints before using this feature. DO NOT trace with$ j7 g, l. ^' m- N+ A
SoftICE while the option is enable!!
% f* S' L1 C# f3 a! q
: y3 G! {/ a* h% z hThis trick is very efficient:
8 P C! L& t& L/ L Cby checking the Debug Registers, you can detect if SoftICE is loaded1 H. H- ]. @/ `
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
5 ] J; i) u7 G3 O7 _' }& G2 O' m3 kthere are some memory breakpoints set (dr0 to dr3) simply by reading their2 y1 l) S7 {! e( G; d) w7 N
value (in ring0 only). Values can be manipulated and or changed as well
3 X# c3 Z# y; T) F# w1 V(clearing BPMs for instance)/ j% I. p! [$ Z0 e7 Q/ s- b" O
3 `- w; d0 f0 W2 e* Z F, t__________________________________________________________________________2 B6 c; ^/ X6 [
5 O$ O n5 ]* l% [- a/ [% [& W' TMethod 113 s' g& b- L7 t7 f
=========1 f" I1 b9 B7 S2 A
, E! _& j2 `& V5 @
This method is most known as 'MeltICE' because it has been freely distributed
) P" Q1 J) {. P. z) {6 n5 ]via www.winfiles.com. However it was first used by NuMega people to allow( d8 I$ k( H% c- C
Symbol Loader to check if SoftICE was active or not (the code is located8 V# z) U) e5 O
inside nmtrans.dll).! I1 @) l, C; u
5 [; ]& C) O2 H7 `* I
The way it works is very simple:
/ v, P" y4 R- BIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
- D, c2 a# b5 a$ E' e6 F" {, c0 mWinNT) with the CreateFileA API." N7 r) `" I5 j7 Z$ V+ T0 f7 s6 H
6 u! R" O( u/ ^2 oHere is a sample (checking for 'SICE'):# G" Y5 j1 P/ @- g/ e: s
9 c+ s. J8 O( l9 Z; q
BOOL IsSoftIce95Loaded()
) n1 q2 I8 Y" k9 l" G# L! Z8 L{
! E! _/ m0 d* K2 e HANDLE hFile;
- o( p, ]* I# W- n B hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,) D7 `* _: u$ t. W; V) V: N
FILE_SHARE_READ | FILE_SHARE_WRITE,
6 L* w2 [% E- |; M- r2 z( H NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
4 [5 K: a2 a2 Y3 J: h+ N! E if( hFile != INVALID_HANDLE_VALUE )
m1 F1 o& B |2 I5 I {
8 u- Z3 X6 h# ? CloseHandle(hFile);- Y. g4 f5 `/ ~
return TRUE;. q. u; R$ z% e H5 }9 v* I4 m# y9 O
}
9 ]$ n% {3 k+ C6 e, Y return FALSE;+ @& y2 Z1 B# [6 f f
}' v e& S) ~* S3 N( D- k4 _4 z
9 O/ a5 B" W% h% E; P! N* gAlthough this trick calls the CreateFileA function, don't even expect to be) _) b3 L1 F) G
able to intercept it by installing a IFS hook: it will not work, no way!" r; F% ]- z6 L* v: n; x2 v
In fact, after the call to CreateFileA it will get through VWIN32 0x001F6 O6 r1 T. B+ z) Q/ }! q
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
4 a8 v6 T8 b, aand then browse the DDB list until it find the VxD and its DDB_Control_Proc. K) a0 X0 v# v" u; T1 U+ P
field.. j3 ? z# x) K2 `
In fact, its purpose is not to load/unload VxDs but only to send a 2 ]* ], i) j1 U/ ?* M$ c- A
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
$ f0 |, m( ~. I: [to the VxD Control_Dispatch proc (how the hell a shareware soft could try
% M. `) x- q1 ~; {+ M8 ^% V& ^( Wto load/unload a non-dynamically loadable driver such as SoftICE ;-).$ G& n M1 K6 m( \2 b( ~
If the VxD is loaded, it will always clear eax and the Carry flag to allow2 u' _" P4 z$ _; ]4 n
its handle to be opened and then, will be detected.# v4 ?7 C$ K' @4 B2 m" l" Q
You can check that simply by hooking Winice.exe control proc entry point
3 Y& x: D" h8 \& |( Q1 Z5 Rwhile running MeltICE.( D2 \- N+ s. d; n2 S+ P5 E3 M
2 u8 v! k) e1 v4 k+ e
) \3 e! `! o% J2 Z8 i 00401067: push 00402025 ; \\.\SICE9 l9 ~, l+ L2 W0 G) Y
0040106C: call CreateFileA
+ f5 Z$ {9 q) O K3 }8 ? 00401071: cmp eax,-001% j: a5 p- X, U* o% h
00401074: je 00401091
8 D+ j# t/ l1 {. l1 N8 U) R/ U7 Z, S2 g
0 a# R8 Z2 k: E5 U- \There could be hundreds of BPX you could use to detect this trick.2 N: n! l6 I% d
-The most classical one is:( W* J1 ]1 D. y1 a- O
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||. Y. Y+ z3 Q' x! o% b
*(esp->4+4)=='NTIC'+ k1 J$ f) L$ v+ t7 x* N4 X
6 C: w+ r6 I0 y6 @-The most exotic ones (could be very slooooow :-() O9 f9 `$ s8 h; F! w; C% i* C
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') " i) K6 `: o6 o* h
;will break 3 times :-(
" \5 x: z3 k [ g$ ]
6 z6 J8 `+ Z, b; w" T. ~4 w-or (a bit) faster:
6 s& L& t$ ]5 z! W BPINT 30 if (*edi=='SICE' || *edi=='SIWV')- B6 y( R9 V, T* T- ^
7 M2 c$ o; k% v' d/ j4 R9 w: f3 A BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' 8 Q4 ]; x# A: r: k
;will break 3 times :-(0 b- J- \; j8 e' W4 |, e- b
2 j1 u3 _$ o: H+ p+ p, J
-Much faster:4 D8 [, D1 v8 g |! r+ c
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'8 g8 ]% s5 r7 a. p
3 G9 m& O' E/ j6 |- u) ^% _; k: }Note also that some programs (like AZPR3.00) use de old 16-bit _lopen9 J5 Y# K L4 `6 s; ?. E
function to do the same job:( K* R* i0 X! Q7 M
0 P7 Q- ]6 w' m8 l push 00 ; OF_READ% U; H4 |1 j; h# i4 w: n% ~% @; H6 n
mov eax,[00656634] ; '\\.\SICE',0
9 n& ?, {; t3 ~ push eax; E5 x( B% {, V
call KERNEL32!_lopen9 M5 p- U% B. s
inc eax) b: [0 l- C5 ~2 c3 V
jnz 00650589 ; detected
/ j2 G$ u) [* F) A7 c B push 00 ; OF_READ# _" ]$ c% p* [3 Q
mov eax,[00656638] ; '\\.\SICE' Y \5 I# k) B& S5 A1 ]3 R
push eax& C- | V2 g6 w: ]6 u' @
call KERNEL32!_lopen6 `. F E3 `$ l- U# g9 @% H
inc eax
9 K, a; M! x: M& L( T jz 006505ae ; not detected
3 B8 J6 ^& x- M7 G, b3 K( \) f4 w8 u1 a; ^7 `
. ? w5 y+ V" r: |6 c3 P$ ?1 a
__________________________________________________________________________
b2 v/ Z! [# A2 I
* A( g" ^+ n7 o7 Z' oMethod 12
6 }) V, s" n8 ]# Y) S& V x' @+ B( r=========
6 A& g* _. Y# W5 J$ g4 v$ {$ S: Q' m: U# q. H
This trick is similar to int41h/4fh Debugger installation check (code 05
* S- x2 s3 I# g# U. d& 06) but very limited because it's only available for Win95/98 (not NT)1 a9 }& u7 _3 j- h% p
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
1 |7 C; t4 Y/ f3 `1 E; d# T* r
3 e. y0 _/ r c8 ~ push 0000004fh ; function 4fh
4 l- n2 X( a9 R- n G push 002a002ah ; high word specifies which VxD (VWIN32) ]8 X- Q/ x# F
; low word specifies which service) N& d1 R6 h6 E1 L' Z8 P, V, Y
(VWIN32_Int41Dispatch)' f9 K) @9 I4 }. Y ?, a
call Kernel32!ORD_001 ; VxdCall: f: H8 `/ A' h* e0 n, b' G
cmp ax, 0f386h ; magic number returned by system debuggers* D9 Z9 i& P4 l' N1 l( ]
jz SoftICE_detected* j* Z- u5 W* c p& @3 b9 X
* G4 @0 Q* _) G) f: o; E" J
Here again, several ways to detect it:
3 I; n D, e! k8 P/ o6 o& [
( {; G! k; ^, N; o! ~3 B( j5 x BPINT 41 if ax==4f
3 o8 J: B: ]8 r0 j. _/ [
- Y4 N% z( g7 c: p BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
. e% t7 I9 ^& @. w7 h3 w& ^
' Z! ?) d y0 m8 J3 C( r BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
; q0 {' i4 [" Y( n6 N
/ ~4 a% S& ?- s/ P4 ] BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!1 p. G3 [1 ~ }! ]! ~2 f7 Y
- y; q# f* ]# l& L, ~' X__________________________________________________________________________
: S( \/ o/ f B6 k' k1 W8 S
- I0 `. E& Q) ~! ^3 z% fMethod 13
/ E& U F) w ^& T9 Q=========# b1 u# |+ @9 w9 W' G
% O$ p' N5 {8 Q) @
Not a real method of detection, but a good way to know if SoftICE is3 n1 ]4 f% [+ R' `4 a8 P1 z4 s
installed on a computer and to locate its installation directory.7 ~& _8 i) n' Y5 ^8 O. d$ t7 i8 [
It is used by few softs which access the following registry keys (usually #2) :
5 {( {0 v& [/ K& m7 ~. B$ u _' N5 m# e r
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion* X" V% x( _$ f4 q: {! G9 A, ?
\Uninstall\SoftICE
8 J7 V1 D9 T& P: _9 w/ w% e% `- a* [- Q-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
% P1 p5 I5 w2 X& Q6 S# T; ?-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion# l1 f$ j( ~. O% G" C* }
\App Paths\Loader32.Exe
" q+ f! w# I2 g( n, o& L
4 m$ w5 k; O/ n2 p7 U5 g/ H" f# [; U
Note that some nasty apps could then erase all files from SoftICE directory) _) T: b) n! ^6 G) M+ R8 r
(I faced that once :-(
; s Z) l2 F' e F5 f) A8 [4 v
Useful breakpoint to detect it:
3 I A- N3 R* M/ `! O0 B. x6 |4 a, m1 u8 B" S) t
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'2 J( x1 [! o* M7 A: F9 P$ r
! q5 o# y0 v- V+ d2 [% x/ w* F__________________________________________________________________________
1 z5 p, Q3 N! {. K0 S# o6 O, D
+ y2 ^4 D) |( @: Z2 a; P6 G; nMethod 14 : V1 x7 `1 Z8 R" s* k
=========) `/ _ d' V7 I9 U
+ R( I# @) F1 L* [' \% lA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
. O' u) L) f% w, eis to determines whether a debugger is running on your system (ring0 only).
3 [% t3 F1 _' I4 h3 h/ D
! H' ]; X0 o" K. h/ K: G- s VMMCall Test_Debug_Installed y5 T5 ]: b) O8 t, T. D- I
je not_installed
7 z7 r; r; V2 j7 M- R3 v: I' B2 w) p
& C- R; I/ q5 y6 n1 X5 q% ZThis service just checks a flag." |; @0 u+ P9 j6 B* [) Z- ]
</PRE></TD></TR></TBODY></TABLE> |