<TABLE width=500>
- x/ u( c& ~' v4 M. L0 l<TBODY>
% o8 c; ]: V7 z9 {# k<TR>
) {( G, g% B. \& v4 V<TD><PRE>Method 01 6 T0 E# \; F3 j' _
=========
3 Q/ C! v0 A: O1 p/ P& g9 J
( [. H# ~" F t: G8 c' AThis method of detection of SoftICE (as well as the following one) is$ \7 O% P4 r6 a: S, ?+ G7 S+ p
used by the majority of packers/encryptors found on Internet.
5 i( H4 t/ v1 m! H! iIt seeks the signature of BoundsChecker in SoftICE1 T: @! e9 i _
: G G1 @. f7 T% f' j, }2 s mov ebp, 04243484Bh ; 'BCHK'0 p. [" e% j1 W( N: u3 d0 L
mov ax, 04h% L, x+ K) I. H# ^; y
int 3
4 n2 S! K7 g4 _, @2 N9 ?3 [ cmp al,4& ~3 t, X7 o# v$ }2 @
jnz SoftICE_Detected
+ |5 ^# c1 y: g+ F8 c* k( O( E( D! t
___________________________________________________________________________0 V& L8 \& W7 x3 e8 T- g
' X' _" K6 o! n2 k( K: J4 e
Method 02/ d" M' ]: z/ Z4 `9 C% R
=========+ a% g1 F# j- F& O8 Y$ Q
" O0 a* j \% x& H
Still a method very much used (perhaps the most frequent one). It is used
5 P) A* h. o$ `6 C, ]+ m" \, Hto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
. U+ x/ V9 \! J+ F0 I7 @) A6 F7 Z+ vor execute SoftICE commands...
* K) M' `9 G1 ?" T% fIt is also used to crash SoftICE and to force it to execute any commands
- d8 K7 S2 i2 h5 O# q) D(HBOOT...) :-((
0 D7 M; g4 q+ C2 }5 g u0 A: E }, [( I5 j! N) m. C9 s
Here is a quick description:( c1 M& h' ]* {" Q) i9 Y! c% K2 Y' J
-AX = 0910h (Display string in SIce windows)
. c% U1 {+ c+ J) n-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
+ E) c2 O$ a% z3 R4 P8 G-AX = 0912h (Get breakpoint infos)
$ P8 @0 v2 D8 z* {& N-AX = 0913h (Set Sice breakpoints), ]% |2 s# ?% X3 G
-AX = 0914h (Remove SIce breakoints)
5 L: _$ F w1 t7 E3 h6 ]0 |0 K6 q; V- @# y+ S' n( H9 @) I
Each time you'll meet this trick, you'll see:
) U( W; ~* w, B" w-SI = 4647h
1 q' p- V* E7 s% n. h+ p x-DI = 4A4Dh3 q4 j+ M" g1 n* X4 l
Which are the 'magic values' used by SoftIce.
$ x$ y/ Q. F4 \* x9 D9 ~. }For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
: U2 i8 D. _# S0 g t8 N( s, M4 ]+ I6 e1 H' C* Q
Here is one example from the file "Haspinst.exe" which is the dongle HASP
, z4 M2 ?0 {( \' h. r. [: }Envelope utility use to protect DOS applications:3 T1 s9 _# _- f% v
9 ]7 p$ J* W+ e E9 ^" H
5 b, M# H! H- U0 ?( V$ ]/ W* P4C19:0095 MOV AX,0911 ; execute command.
f& v- ^( s; N$ A# D4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
+ H$ T: {% {. y ]0 w @- y. J1 L" @4C19:009A MOV SI,4647 ; 1st magic value.
5 k1 e" }/ A5 G( P, B4C19:009D MOV DI,4A4D ; 2nd magic value.! ]( z$ |- j6 j/ U% T
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
, ?9 x1 m7 l% B4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
7 v' u" N0 }7 s+ J' j% D. x4C19:00A4 INC CX
+ F. s2 C( L0 g- A( [4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
& D9 |; v2 }' k' P4C19:00A8 JB 0095 ; 6 different commands.
# V( b2 F3 T/ G( ]& a4C19:00AA JMP 0002 ; Bad_Guy jmp back.) T2 ~, r Z* O& R: T' { |6 ^! p
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
M' d, u. R+ i' c
/ c i! }1 s! Z2 R' kThe program will execute 6 different SIce commands located at ds:dx, which
+ U. T7 f2 _. ]. e' I- rare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
+ U3 c* U3 ]( b( t- c" Z& Q2 @* O; ?& [9 {: B* \7 I
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.1 e' J Y3 Q9 T. K/ A$ N! B
___________________________________________________________________________% J& E3 x5 n5 ]" m3 F1 ?1 I
2 M+ X' G8 u, Y% {
$ S' K' P1 A9 I2 G) v. IMethod 037 N j0 `# S: O9 N& Z& G
=========
8 a, [: T( J1 d" k$ ^' O, R& k
, Q- y9 T4 ?9 D- yLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h0 {! b5 p- Q' C4 U4 U
(API Get entry point)& ?$ J3 U1 D1 h& T
5 V: E( N' ? r$ u# Y: n! v
) \7 @ G6 {2 N4 ^5 }# r xor di,di5 b( K4 K& O, [- w2 \
mov es,di
4 Z6 t& A* P# _% G# j mov ax, 1684h
* I6 ?, `- I2 v; e, y5 N" q) D mov bx, 0202h ; VxD ID of winice
4 f; b) E; S0 Q0 u/ [ int 2Fh
' z/ S O; D% g- X P% T6 w mov ax, es ; ES:DI -> VxD API entry point! E- p$ f3 E4 [, C
add ax, di" c) Z' G- Z' {& ~2 s! ~
test ax,ax
+ z# F9 j2 Y+ I& j: t7 c( t jnz SoftICE_Detected
/ _6 H! q9 U! F" l8 j; l* e- S* @
___________________________________________________________________________$ O! K1 l2 f3 T
! c4 k% j E8 R5 K) w/ jMethod 04# i5 J1 z4 G2 ?
=========
- e4 l4 `, a: s' }- w! I. U: H$ C. e- q, d% A
Method identical to the preceding one except that it seeks the ID of SoftICE+ a8 @" r2 P5 G( U8 G
GFX VxD.
, d+ q" Q, T4 S H2 X+ Y! w4 r7 F' ~
xor di,di
* c4 J, d4 _5 M# F/ \! {( v0 x7 W mov es,di- p9 H' _5 l, v& P# U g7 ?/ S
mov ax, 1684h
; h; {9 P! m2 P2 m( S0 j mov bx, 7a5Fh ; VxD ID of SIWVID
$ @( g, b9 b' {, x7 a: u5 a int 2fh
* O# U* v* |$ _+ V6 |! m mov ax, es ; ES:DI -> VxD API entry point9 c& k4 v0 e6 d( ~; I) Y/ p
add ax, di
; E3 h, A! P' I1 C* K# d9 a test ax,ax
& o% A0 L0 G$ e) C+ a8 U jnz SoftICE_Detected: Y+ x, {# A" n; e
, R* P' M& ~- i6 B6 E6 \ o) R% W
__________________________________________________________________________
8 }& O9 ]( B' ^# M
+ {2 h: k4 O; U" `- e, ^6 g. s. @- D$ h* h+ o- {) X3 ?
Method 05- d3 `$ r6 i6 i6 i' W! L# Y
=========
* [) E4 K6 ~# C; y/ Z* O5 { S9 {3 c7 l9 Q/ Z( q8 j* b
Method seeking the 'magic number' 0F386h returned (in ax) by all system% I1 e! c2 T' G; H, c0 s5 P( H
debugger. It calls the int 41h, function 4Fh. I, l" l" n/ n8 H
There are several alternatives.
& D' Y" Y1 l8 D5 _4 p! ^" S: [, x' z2 @
The following one is the simplest: B( a" G0 a4 U) a+ ^
' i+ J/ N# z! E0 D
mov ax,4fh% [1 q* H$ q7 {6 I2 \( `4 Y
int 41h
( m, s: }: H9 R4 c) G* \0 G, i cmp ax, 0F3862 o5 b x* L: L' H8 [) g5 F
jz SoftICE_detected
9 L: r5 s& R1 A1 [4 |3 T* i
a+ |( L# n$ v; [- J* Z" r, D \1 q4 O$ S8 [/ X
Next method as well as the following one are 2 examples from Stone's
9 l4 ~( ~7 e9 m' F- f( m"stn-wid.zip" (www.cracking.net):
- h- q. i% D* b4 E; L3 Q$ x8 P2 g" w: T3 r! \8 p
mov bx, cs: C$ `# J B2 A% ^& C% h
lea dx, int41handler2' w- Q0 b" _4 G! s+ j7 b/ a3 W
xchg dx, es:[41h*4]
5 O! e) G7 A, A/ C- j xchg bx, es:[41h*4+2]
( }& u8 q) H, Y- Z6 m4 z+ T' u mov ax,4fh2 U/ s8 U: d3 r
int 41h
* |% b) t3 p6 o G xchg dx, es:[41h*4]4 F& A+ X, f3 E2 [# M
xchg bx, es:[41h*4+2]3 p) d) b! _5 K& L- G% o
cmp ax, 0f386h
9 t8 Q: x2 J& b1 A0 k* r: |4 K jz SoftICE_detected ]8 h! K! E8 c, O. q; L
7 W6 p3 k$ g6 B0 M1 h: |3 |8 C7 _ C+ Oint41handler2 PROC |% G/ O; Z& p5 X1 N: d3 q' n; p) E
iret, p# q1 ?: l3 A- t" A' ]# k, Q0 q
int41handler2 ENDP
% _. \! i$ p* a4 W- t, P4 `& Y
! f. U7 o) `( `, R
! v& y4 Z5 \% F( B_________________________________________________________________________, \8 |2 p( ]: e. s
/ `' b- a! W0 \3 b
w, I( T3 }, ^. o1 _1 N/ F1 PMethod 069 | Y- h) S3 g" N
=========
5 S, @3 E) R0 E
& q9 h9 [& R+ A7 [
G L+ Z- t) x4 a6 v l$ d2nd method similar to the preceding one but more difficult to detect:
9 y/ g1 s7 y3 U& m
+ N: e; \# v x; \
7 Q, T4 J. s% n! X( rint41handler PROC
1 I2 }# b. N- y; M mov cl,al, e8 o, _& [; P7 V9 r$ l* p
iret
4 c1 @! Q# i" [: ]/ O, Q2 i( Z( H F7 eint41handler ENDP
4 p' e4 o3 x7 v6 T# L4 `2 U8 l3 K% r4 g/ @* \
3 f2 O- n' u/ N5 z4 ~ xor ax,ax
# v0 E1 ?# h/ u; ^3 O6 C0 y mov es,ax* p0 |3 G& M7 K U7 u7 A p
mov bx, cs
$ p7 }: _/ k7 j6 | lea dx, int41handler
u4 ^: z$ E. l" F7 n& M' s xchg dx, es:[41h*4]
/ N/ p) T" }5 e' _% ]5 X xchg bx, es:[41h*4+2]
0 m1 N: Z1 e" {: O9 ^; O in al, 40h
$ b2 R; ^5 K. M2 Y Z) b0 w% N* B xor cx,cx. i7 G6 y( k5 \. D
int 41h$ i$ c' U& o+ v5 i
xchg dx, es:[41h*4]
* {( A" G; G& W" W/ F3 S xchg bx, es:[41h*4+2]
- x& D# _) B: A, q cmp cl,al1 v; J- K% I, Q2 C
jnz SoftICE_detected% u6 u0 o; B; v
# [9 m D" F6 ]6 d8 V_________________________________________________________________________
: ?6 u) N% V" v, O5 X0 X' j8 o5 c$ p
7 r8 C4 z' u2 VMethod 07; C" h7 w! o: }1 K
=========5 |3 j# l9 T. F& e% a6 I$ q
$ O* n, Y" |' L2 z- ?0 {Method of detection of the WinICE handler in the int68h (V86)
1 n# b4 q8 z% v: j& ?
- G4 e* F9 G( A mov ah,43h
1 N8 M7 o% g P" | int 68h
- V, e6 ?! Z, U( @! a cmp ax,0F386h: `) _$ \8 l7 P! F; ^
jz SoftICE_Detected2 O/ O X2 C# o, p `! [
1 W8 w6 [, G! w
/ ]% [. S) w& F6 b! r) Y8 y( W
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit8 l% b! c8 ~ T# c# A% ^
app like this:- j! Y$ b3 J( H2 k/ F( u) Z9 r1 i, \8 `
3 Y" l% q; c( U! h0 O; V BPX exec_int if ax==68; [7 O% C( o1 f9 Q# N9 A
(function called is located at byte ptr [ebp+1Dh] and client eip is1 ]* | V/ n' L Y+ x
located at [ebp+48h] for 32Bit apps)$ F, t! ]8 S# Y+ V
__________________________________________________________________________" ^! D2 j$ E& X. P& ?
- }/ H- O3 {7 Z+ j, ^; u/ `2 f
3 M/ g5 E/ F S
Method 087 y- n: V+ k4 j& ~; V$ ^ k' \( J
=========. U+ I0 i9 W# L
/ z8 ]* o5 U2 j5 P* [& s6 _It is not a method of detection of SoftICE but a possibility to crash the
( ?6 |) k8 J9 Z, wsystem by intercepting int 01h and int 03h and redirecting them to another
% l+ p8 Q) b& ^6 d6 k0 ~routine.
% f; C$ s* F' N! r3 m7 VIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
8 ^7 p' t5 o: y4 N% X4 ^$ x) yto the new routine to execute (hangs computer...)
0 y' i8 p# h8 Y- U/ O$ P
# p& ]/ H; }+ \" B mov ah, 25h* p0 C! P/ o% c7 o
mov al, Int_Number (01h or 03h)
9 r' y& K) y/ m3 W mov dx, offset New_Int_Routine8 w4 f/ ^* s: N. T3 c$ [7 b
int 21h0 P+ C, V; @, `6 L( P# F0 Z; w
. Y9 B2 N' C& N! U2 h) t, B* L: ]- G__________________________________________________________________________
6 l7 Y- Y% s! Z3 j. ~( U+ e+ w* {, G, V) H6 U: `
Method 099 ]) }5 @% w1 s5 }- s
=========( Y( e% h" |1 b$ r) n' x2 r
; ^( N9 L( A1 J( E9 I b: YThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only, M# |% D& ?! Q2 k
performed in ring0 (VxD or a ring3 app using the VxdCall).5 F$ p1 L' @1 L" p0 |/ s- ~: U
The Get_DDB service is used to determine whether or not a VxD is installed) v9 ?: C5 L* k# F
for the specified device and returns a Device Description Block (in ecx) for( n% d, @2 O& w- m2 t
that device if it is installed.' q0 ?/ ^+ d; ?) `4 r+ m
* I; T2 |+ v# l, @4 B2 m! }
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
% t) z/ y1 \2 ?0 y mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
: P: A4 {: k0 N; h( K# h VMMCall Get_DDB
4 f8 W. J+ K' { mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed( i1 s: s- r) M/ u/ ~
: F' i, X4 k3 N0 _
Note as well that you can easily detect this method with SoftICE:0 y9 s' E9 S% C0 F; s' J
bpx Get_DDB if ax==0202 || ax==7a5fh9 g, [9 J) c0 {
4 E6 `0 ^1 `1 `' ~* h8 o G
__________________________________________________________________________
" |5 W+ `9 z% F7 W6 f! ~% U2 X* P+ w- Q
Method 10
+ ~, e9 ?+ s% H1 z=========
* M* B' F" h$ V8 }$ K+ u# f* X. a6 q. _9 S8 c4 |
=>Disable or clear breakpoints before using this feature. DO NOT trace with
2 ` [+ W$ }/ p SoftICE while the option is enable!!
7 H$ L: D0 A( v$ E- k
6 K9 v! b2 X$ W; `+ IThis trick is very efficient:
: f& ?! t7 ^4 H: v- eby checking the Debug Registers, you can detect if SoftICE is loaded
9 U& @ G4 P- t: n, S, K' d3 `8 a7 p(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if$ q2 e, I5 R/ |6 b* ^$ u
there are some memory breakpoints set (dr0 to dr3) simply by reading their
; g# k+ T1 k8 avalue (in ring0 only). Values can be manipulated and or changed as well/ |+ D1 N( b) @' |. f
(clearing BPMs for instance)4 ^; j* z0 D; R7 g
/ H# k9 f/ I/ }' }' L9 z1 W5 l
__________________________________________________________________________/ F4 m" Y2 Q2 M9 M. Y2 W3 X5 E; I( z
$ S6 x4 t) L8 ?% B+ n
Method 11
( H [7 B; @' |4 M+ M( T' ^! k" ?2 m=========
1 O9 ?: k! k: E) _( Q s! g
8 N- h: y' c: E2 m( ]' E2 YThis method is most known as 'MeltICE' because it has been freely distributed
! k q7 V: E- B' K3 x( Svia www.winfiles.com. However it was first used by NuMega people to allow4 k1 Y8 f0 A4 \
Symbol Loader to check if SoftICE was active or not (the code is located) y) }! w2 q) i4 L
inside nmtrans.dll).
& e8 K# k- I. h7 @9 e- d
( d$ R: R5 t- t3 h) u2 K2 g6 EThe way it works is very simple:! @- T0 u" X9 D# h! R9 L+ T
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
[$ f7 c) B; {' y5 u2 E+ B# |WinNT) with the CreateFileA API.
" p3 m1 f; e1 ^. z" ? A1 j
, k o6 S0 I2 ^Here is a sample (checking for 'SICE'):2 U1 a$ t: y; O2 B/ Q
5 f0 i- y* w! ?' K" i3 Q6 uBOOL IsSoftIce95Loaded()
4 o* e) Q* u" E% g/ r1 ?" N{7 w% o, T: W2 d: A) j1 Q
HANDLE hFile; ' g( y7 j- X2 S% a* g3 ^& d. d
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,1 Z+ r* z \! Z
FILE_SHARE_READ | FILE_SHARE_WRITE,
& Q: `# I5 l6 [% L0 ? NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL); L) u7 G. o C3 T! c
if( hFile != INVALID_HANDLE_VALUE )
0 l1 Y( i! _/ l3 _/ P- H {1 o. k2 g2 k& E/ k2 M5 X6 N
CloseHandle(hFile);
1 t P4 M$ n* P+ K& {# R return TRUE;
$ U* ~; e7 }( B2 ] }
+ l9 f; X" n! |' L/ a return FALSE;- V2 g* J8 U; i; Y9 V9 t
}& `2 N- S9 B/ t
8 q' I( H' Z/ ZAlthough this trick calls the CreateFileA function, don't even expect to be
9 b6 T9 F* E" \$ @$ xable to intercept it by installing a IFS hook: it will not work, no way!
& k& E1 D+ [4 }; o+ ?# c# H* |In fact, after the call to CreateFileA it will get through VWIN32 0x001F
# @. w/ i+ @ A( i5 o7 r1 K, g! E; {, zservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
( {! u* ~6 w% A3 _" Kand then browse the DDB list until it find the VxD and its DDB_Control_Proc) j# J4 T9 a# Q5 t8 @ i
field.
* ]0 L! e/ p& H/ O, W( A/ e$ dIn fact, its purpose is not to load/unload VxDs but only to send a
* {- `* X1 x8 C3 UW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
: j% N7 R- g" r! j7 {& ?/ T( Nto the VxD Control_Dispatch proc (how the hell a shareware soft could try9 K* {6 k1 p9 Q# X* U4 b) O
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
9 U) k, l; {& F( UIf the VxD is loaded, it will always clear eax and the Carry flag to allow8 `$ W8 d. g- F& l" }6 r$ c c
its handle to be opened and then, will be detected.
' t y R* ~9 L% n/ D' R$ y) ^You can check that simply by hooking Winice.exe control proc entry point
$ X! ]. G C* J6 S! s' \while running MeltICE.. Z" T& r8 t6 g
4 [8 I. t& L& \1 c! G" `
# p# i. P0 z1 d% o* w5 M7 n( p
00401067: push 00402025 ; \\.\SICE$ i" `( ~6 A" C' ^8 O+ D
0040106C: call CreateFileA
" r/ S& E q, E 00401071: cmp eax,-001" Y& a' d9 [9 o$ T
00401074: je 00401091) b9 m6 W# C# y! y' u8 o
3 V G0 H9 d1 ~- _
5 p4 P2 V ` ^) m7 ~; T$ C( iThere could be hundreds of BPX you could use to detect this trick.1 _% c, r6 N0 S% c( ?" m. J
-The most classical one is:
* @/ V+ I- g3 [' ~9 P" z" l BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
# b* G8 N; V' R% t0 ` *(esp->4+4)=='NTIC'
) p9 F7 Z5 v- c
2 _9 u1 W4 T# O O- u2 i* Q$ `& U0 {-The most exotic ones (could be very slooooow :-(
" E, a7 U. q1 w' Y BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') & X9 A1 F) m3 C" {! r
;will break 3 times :-(
& r9 E$ v4 h" q. \" M5 w
" J, W: z0 Y5 Y3 D. N* x0 _" V% {-or (a bit) faster:
, q; w4 R; j! B6 r+ X BPINT 30 if (*edi=='SICE' || *edi=='SIWV')$ n) K$ Z! k. y- L; P; L. u# C6 V
2 Z1 a! I6 x7 i9 K) n7 R3 S! v BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
% j: z2 G. ]# t! F3 E p. c ;will break 3 times :-(
5 Z: ^5 j4 k4 g0 |/ d/ j5 b9 c% _
7 k9 H; C2 G! o; b7 ^; d-Much faster:. F" G, t# q; j
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'6 i- H( L* t& L5 x6 B, J
- D8 F# v+ Z/ a. H! ?5 ~1 ^: m
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen# i1 i/ m* E1 ^; T
function to do the same job:! W- ]; S4 [% X. H9 ]* B
# I# p9 p- N- l
push 00 ; OF_READ
: k; g( z! F, q. p c mov eax,[00656634] ; '\\.\SICE',0
7 \( s" r5 M, n& N* G4 ?# D push eax: E6 h5 C& o( N. H
call KERNEL32!_lopen% N; G8 N5 N- K
inc eax
: c2 A6 J& B+ @8 n: _2 e4 O jnz 00650589 ; detected, v2 h* }& y/ l: a! A% L' Q i
push 00 ; OF_READ, j5 R- a# f6 |+ J" C
mov eax,[00656638] ; '\\.\SICE'
' f1 v' k+ Y) Q) i+ z push eax
, V; {5 @; ~7 {% p. \3 r call KERNEL32!_lopen
" S8 u0 H% w8 b- y! d+ d inc eax
% T: W7 H4 V4 w/ ]/ D jz 006505ae ; not detected
( d/ v3 _7 p8 |6 D+ _& o. `% f' T' I2 _8 C( K* B/ m8 q, x+ w
, T; N: q* {7 T
__________________________________________________________________________0 B+ ?) e" `7 U# l% R& h8 c$ h ~
/ p, V6 t _. Q2 W+ U6 Q4 T
Method 12
6 b! r! z( U d M=========! D3 y2 |% }9 V3 d! m* A
1 F6 a& B6 W# Y4 H" R9 _/ B! q: pThis trick is similar to int41h/4fh Debugger installation check (code 05% S& C1 _7 y/ T* p8 G, O; Q
& 06) but very limited because it's only available for Win95/98 (not NT)/ G4 _0 n l9 z3 s; W2 z
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
8 ^# o9 b, W7 w9 ] x. Q, w! B" _, F. ~7 q9 u
push 0000004fh ; function 4fh3 T$ ]0 K2 E3 e! e- g, r
push 002a002ah ; high word specifies which VxD (VWIN32)
+ ^7 z n5 M* X3 Z' m" F ; low word specifies which service' A, p1 m; B0 Q5 {( T9 |. @
(VWIN32_Int41Dispatch)
6 K; n% h+ @1 ]) _; y call Kernel32!ORD_001 ; VxdCall
1 Z0 B3 v! @+ } cmp ax, 0f386h ; magic number returned by system debuggers
2 h. q" @: l( z5 U* \ jz SoftICE_detected! O8 \2 e" G& k! N0 U, P1 L: J% k
+ F3 N- L6 p" p2 ?; R# O. qHere again, several ways to detect it:) x6 N+ D# G4 V+ j$ T
, n' C. d# ^" Z
BPINT 41 if ax==4f
4 q+ A1 V4 {# y* y/ Q2 x
5 p+ X! |- k. l( U0 y# Y BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
X/ ^! y) s+ S, u; x1 M/ ]- E5 y% W* V
" ]8 G8 X% T% B* V BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
1 M# h! P" G. z
6 m$ U5 T# ]8 Y* M/ ?# q BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!; d& l6 ?) m7 L! Y& m# ^- f0 m1 R
* T' t8 C+ z1 v7 F: L" D5 `__________________________________________________________________________
1 |* S; R. V& W0 I, t1 v K, _0 p/ J
Method 13
1 L1 S# @7 o; j=========4 [. G; M- u+ I
. h, r' x9 I) t8 e Y1 |# ?2 pNot a real method of detection, but a good way to know if SoftICE is8 V; X9 n0 ?0 \, }: t9 o( \
installed on a computer and to locate its installation directory.
% x0 D+ O0 s0 ^, SIt is used by few softs which access the following registry keys (usually #2) :
" t8 z: w5 N, @& u
# i3 V) ^/ U0 z& j: z-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion R9 X2 c3 s8 G( g5 G& N" ?
\Uninstall\SoftICE. y9 M2 ^5 R- z
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE2 ]& u* Q3 z, I/ L
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion n1 [: P9 [1 _; ?% M
\App Paths\Loader32.Exe
7 e2 v4 j% m0 j, f1 \9 W
, f4 k4 {9 _% K1 L2 N) L. \5 K
4 w. p' W- X# w: e( U- V, ~0 |4 ~' XNote that some nasty apps could then erase all files from SoftICE directory
, y1 b) U% O* m: w, H0 m; d(I faced that once :-(. `/ c7 {: Y; F9 G* H
9 y6 d& \7 C9 M: X1 Z k( ]5 C) J
Useful breakpoint to detect it:
0 _; J$ K! T" S. ?, I3 u8 D& H1 U/ W; c: F- B/ u6 p1 x
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
1 j8 H3 M7 h5 C& l" F: ~4 U) [9 J2 E4 h$ y
__________________________________________________________________________) T) J0 t* [, S2 J6 K
5 Z$ t1 h' G2 O1 Y1 x( a' H
5 i/ X3 |5 Y& Z5 TMethod 14 % M& L, L6 x$ k9 _' C$ k6 o
=========
8 u, H. f$ L: G: G) R! e
) o: c8 M6 ?8 Z7 H5 \; s, {A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
5 m5 F6 w% k6 B. u2 Qis to determines whether a debugger is running on your system (ring0 only).
% s v4 x1 f+ E" ~, p8 g& n* L8 a9 N* N$ K0 `+ [
VMMCall Test_Debug_Installed
# F' |& w3 Q0 z, ~8 m5 M je not_installed
( P2 \: y. S- l8 c& \8 n+ ?; @9 X1 R7 R/ G/ Y6 Z* z' \: J# B
This service just checks a flag./ Z k5 P6 N5 D0 X/ V4 N! Q: M1 U
</PRE></TD></TR></TBODY></TABLE> |