<TABLE width=500>
7 r. v8 p% \8 C, T<TBODY>2 P# |- ^. v4 u
<TR>7 V( p& ], N' b7 p; m, A
<TD><PRE>Method 01 : I! v. C. A2 {5 @/ w
=========" c1 h4 U+ M1 Y: p2 N8 }6 P
3 u! j, ~( a% h) M; o
This method of detection of SoftICE (as well as the following one) is
0 F+ c3 q0 j+ e' r" [3 [used by the majority of packers/encryptors found on Internet.
5 r0 c! }5 R( ~3 LIt seeks the signature of BoundsChecker in SoftICE/ E, ^# n& f" X% U6 [: d" X
8 E6 I( x. a- P. k+ E5 \/ W4 U mov ebp, 04243484Bh ; 'BCHK'
; r: V2 ^( @$ D' f, z/ m* q mov ax, 04h
9 J2 q: e# Q( I+ N6 X- u: v int 3 % }" L1 k: H, n/ m2 V3 w- ]
cmp al,4
; D9 D \" c$ [. T. A: M! [( | jnz SoftICE_Detected
$ B0 m1 `! V6 l8 u+ E( k9 Y# r+ G: `! i8 s4 y" n
___________________________________________________________________________& y) G' Z. D! X I
0 L( V0 H7 {! J! GMethod 02) Q5 A& p7 U1 v- d# f
=========
4 x5 ~; U/ U' g, t3 x: D
3 I8 o) s/ h& k7 n: @0 bStill a method very much used (perhaps the most frequent one). It is used6 q* K) A3 w$ q6 }% e
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,! t. _+ l/ p: F; X: g S
or execute SoftICE commands...
& W4 D5 i* A- M, X, TIt is also used to crash SoftICE and to force it to execute any commands' O" `4 u4 n' ~
(HBOOT...) :-((
6 R4 ^( d- n: x0 Y; W; ^9 y
2 [" Q+ N( b" N- U2 AHere is a quick description:
7 u4 }9 g- t# H1 x# g& I% \-AX = 0910h (Display string in SIce windows)
X/ Y/ w2 ^; o' O1 z-AX = 0911h (Execute SIce commands -command is displayed is ds:dx) i( g: J4 B! X) f1 k" H
-AX = 0912h (Get breakpoint infos)2 n9 ^6 N6 P* V2 @
-AX = 0913h (Set Sice breakpoints)
/ A& t5 P7 u7 i2 t" k) c-AX = 0914h (Remove SIce breakoints)- v% V, X/ Q1 c+ I# C0 w
% v4 u4 L8 u! v. X D2 y
Each time you'll meet this trick, you'll see:
) Q5 I/ d' |# N-SI = 4647h/ K. J0 A& |# N' [* A! h) j
-DI = 4A4Dh
+ V/ t' _- @/ z/ a$ {" Y) D+ sWhich are the 'magic values' used by SoftIce.
( T' ~+ Q4 d* ~0 z$ rFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.5 m2 L1 o' f2 |7 L- P
, w- X4 i2 I% g" O8 N3 s- v0 z) FHere is one example from the file "Haspinst.exe" which is the dongle HASP
9 d' V2 @% H% Y: d4 w h% uEnvelope utility use to protect DOS applications:
8 g1 f+ `! M5 M6 ^2 ~: \3 C3 P3 a
( A+ Z6 p/ N0 O: T7 w8 Q4C19:0095 MOV AX,0911 ; execute command.4 ]7 [. _( B( g1 x3 p
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
1 _. o. J* X$ C0 [* F8 i4C19:009A MOV SI,4647 ; 1st magic value.8 G: T# k, `9 h: @5 i2 H# P
4C19:009D MOV DI,4A4D ; 2nd magic value.
7 f5 K2 E6 k9 U: \- o. l4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
% O' L% [$ }. [2 Z0 [7 F1 O& d4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute/ c) e* ~5 t' w3 r& J
4C19:00A4 INC CX
( m8 L" [& f" B4 E( l% H4C19:00A5 CMP CX,06 ; Repeat 6 times to execute2 i' ?% H3 o; b
4C19:00A8 JB 0095 ; 6 different commands.
o0 f! ?( R" U4 H1 [4C19:00AA JMP 0002 ; Bad_Guy jmp back.
1 z" x( s/ f: A/ F7 r4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
! O, o) h$ X1 _9 {- \+ [* X# u' l$ g" B$ i8 T6 Y6 n& D+ }4 Z
The program will execute 6 different SIce commands located at ds:dx, which+ H6 u% c$ A0 ?" `# n
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
6 |! F3 H) e$ r) a% X- Y9 f& p5 n% H, k7 p- H- H/ H
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
: y' O7 _: o/ E$ K- T___________________________________________________________________________
V2 L2 f; l$ ?9 e
2 }* b& O1 x y( e& @& Q2 I: L! _- |0 C5 i; F
Method 03
( ^9 u, Y$ S' D$ ~. H- k: k! o& h4 b=========
7 V8 F [; ^( w$ T; u9 R/ O4 k% L5 ^: }! Z" R0 i
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
/ z1 A! _5 {. }0 O4 ?(API Get entry point); V" N6 v! k6 M2 \- A
$ [6 h: z* H7 d
- X7 `' b4 |. p% {1 R7 ~0 s
xor di,di
$ C/ E$ v, q" @8 z+ ?! d; j/ ] mov es,di5 q* h' D; ?5 q8 [
mov ax, 1684h
# e) W: {, L. u2 N! S mov bx, 0202h ; VxD ID of winice
3 ]( t8 f# [! L0 x& w int 2Fh" c2 \' u; [, e9 F# {
mov ax, es ; ES:DI -> VxD API entry point& q- w$ o* ]+ Q- P) o
add ax, di
7 ]1 _; r ~; h% g, S' t8 T" S' n! w9 g test ax,ax% b2 q2 S( h1 J+ I- s
jnz SoftICE_Detected" I" T; R" k( u4 x. U
3 m1 {5 x9 o/ S7 S* M
___________________________________________________________________________
8 {6 u/ S6 S& N f
( b1 A% c1 ^2 [& f8 _ aMethod 043 C% G) ] A" s: ~/ ]1 E
=========
2 J8 v$ ?: g1 @
0 K. r$ b$ s( ZMethod identical to the preceding one except that it seeks the ID of SoftICE
# y, q' z, Y6 }GFX VxD.
7 r4 e# Q/ N. w9 d b1 K& Z3 {+ T% U1 L! I2 D
xor di,di4 m4 e3 _/ W2 @" ~; j( ?3 y( Q
mov es,di+ w* {* R# C5 f" |' r' Y- P
mov ax, 1684h + f3 W- \: o; K4 J( A# \ |
mov bx, 7a5Fh ; VxD ID of SIWVID" a2 {+ b0 q! V
int 2fh
- h" `' V+ P( p8 b mov ax, es ; ES:DI -> VxD API entry point
- ?1 U: x5 e' Q add ax, di& e$ C6 T0 k U# `; x
test ax,ax* U. u1 E& s$ d( A( b, v
jnz SoftICE_Detected# k4 x- b& D g, S
$ |7 M$ G$ o3 ]# H: U% K# {% k__________________________________________________________________________' I& u& X: B! z. F' U5 w( ]) b
9 ?# z t4 n0 `! n
/ g# N! M, X( i! O
Method 05
4 B$ f, r' j$ Q. z6 S; F6 `9 {=========+ K5 {" _! y' q0 { v* l- `! i
2 D9 l) K: @! ~Method seeking the 'magic number' 0F386h returned (in ax) by all system$ a/ w. s5 D# i: L% B& t
debugger. It calls the int 41h, function 4Fh.
0 \$ }* z6 |: P9 c5 CThere are several alternatives.
9 G4 H" v. ]$ o4 @
/ O6 ]- G0 i( u7 _1 _0 zThe following one is the simplest:
6 l5 P% @! ]) n9 ?. ^: z3 w* x# f& p9 v
mov ax,4fh. w# H8 C" p0 `" \* p0 L
int 41h
' p `2 R. g6 L3 d, S& [. y: ^ cmp ax, 0F386" e: Z( d2 X; O: W
jz SoftICE_detected
5 T/ B% q# Q! H+ f2 L( e1 h4 x" T9 e8 G- y' C S" d
/ w' R$ O5 C" j* ?3 o
Next method as well as the following one are 2 examples from Stone's 2 M8 d! V; F% F p# c7 O: v
"stn-wid.zip" (www.cracking.net):
. m2 d1 F; x$ M# F
/ d1 Y+ ? M, G- W mov bx, cs8 D1 [* V. d+ ]
lea dx, int41handler2- w' i" C' Q9 Z: O9 X# k4 O" i1 d- T
xchg dx, es:[41h*4]8 @% |) A0 r4 x6 @/ T1 y7 m
xchg bx, es:[41h*4+2]# L' b, Z6 C2 ?2 ], l) o, X
mov ax,4fh$ Y; p; s. y* G k
int 41h6 g/ {! X7 r3 X$ t1 |0 h
xchg dx, es:[41h*4]# P; v' s* m% i3 H& P H
xchg bx, es:[41h*4+2]" i2 y# `0 U& }
cmp ax, 0f386h
1 C9 L1 _9 n3 R/ K( ` jz SoftICE_detected4 I Z3 v) C6 x
# I* s& P6 ~4 H+ o6 F# T
int41handler2 PROC
. d: _" d W" a# X iret3 I4 Z1 k& w; E+ |/ P
int41handler2 ENDP
+ q8 ^7 L5 E1 d: G. t
' d# r( U4 Y! y' B8 j6 E. | o
_________________________________________________________________________- t* `; n _9 @) C; f4 g
* Q& P8 z7 |( K5 v% ^2 @( i3 z7 {7 B- O2 O
Method 06. G! ^, b. A4 a
=========
( F2 q; U8 j k7 D9 l. W1 @( g) d+ O+ U- N. E) ^! |
" N0 ^5 B K1 l# c2nd method similar to the preceding one but more difficult to detect:
3 e8 w9 [7 c. u6 N( G2 S) _% z3 m- y0 p8 L% b. D
9 Y# j7 x+ r; Q& y. m8 a& Y8 ^1 h4 A
int41handler PROC
% v7 e- h8 R2 j, } mov cl,al1 ?, k' R6 Y4 `1 o2 k1 B% T
iret5 a0 x3 ]( e( A L) ^
int41handler ENDP
7 ]5 l4 |0 ~2 E% l% ]8 R; W+ c( I. T. O( W
: t5 E6 ?6 v' P8 l7 t4 R0 `
xor ax,ax! |$ u2 e4 E" m
mov es,ax& p9 r9 b2 g2 X2 E
mov bx, cs
; @- y' J$ a) ~/ X1 x/ Y/ z lea dx, int41handler! |0 i( h* a4 e# l, U& e, d2 T
xchg dx, es:[41h*4]
- P" u+ l. c% Y+ \# J# z& o$ [ xchg bx, es:[41h*4+2]
, }! a$ N% R8 q g6 { in al, 40h) j- Y( A" {' p9 ?& m) p" g4 [) k
xor cx,cx
) }$ _; d7 G# y& j int 41h& k% K; @ j F- }# f/ n0 h
xchg dx, es:[41h*4]* x, v* U/ V- [2 |1 Y+ O' n# y3 [9 |
xchg bx, es:[41h*4+2]. M3 C( G" l$ H& h
cmp cl,al
0 A' p+ D/ P& P1 m jnz SoftICE_detected
w: e: Z/ b; u7 ^6 r. R5 f2 O
4 V. F- H& n0 i( q; ~( O; ~: Y3 L" w_________________________________________________________________________4 O. X( Y, ^: E C
_* p! M) z6 n+ I
Method 07( z) u2 [4 l+ D, W7 v
=========
! n3 ]# q, q8 Z' J$ X# b' K+ v; { F" q: z8 h; E5 s) q% j
Method of detection of the WinICE handler in the int68h (V86)6 Z. j1 @$ O H2 [" m' p. M
( Q; v' j% W9 { `( Z/ h
mov ah,43h! J, l( d3 m; B/ y
int 68h
/ a( s& e& l" |$ J4 X8 Y cmp ax,0F386h
' @# F N) P5 F6 S6 A- Q jz SoftICE_Detected
t0 v9 s$ ^0 h2 A, n5 _
+ T; ^/ o; p4 {6 C7 A2 C V- F& S# U
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit4 s) z) K( s- W+ s7 ~% f$ z% g
app like this:
/ }) W4 z' C" s, i! R* G
) E. t- D0 Q3 \& q7 o1 w BPX exec_int if ax==68: N p* n, S' P" M" H7 s
(function called is located at byte ptr [ebp+1Dh] and client eip is$ _$ i& G6 Z1 j ~( l1 X: p; E
located at [ebp+48h] for 32Bit apps)
2 |! H# |- e- y3 p__________________________________________________________________________8 H+ U; y$ H" O/ r- q. V5 D
% k7 h7 p$ W8 j& E5 }: [# w' X/ E7 d' n+ A, r V, V# d
Method 08
& k# m M7 j9 B$ d5 b! s6 Z; P=========. H9 X- ~, @, }" ^$ G
) \" {0 S% G+ Z1 h- g- g- ZIt is not a method of detection of SoftICE but a possibility to crash the
1 Z7 i) C% H2 @- ]7 p; tsystem by intercepting int 01h and int 03h and redirecting them to another$ {8 w% |. {0 Z4 y, _0 [+ u& I2 D
routine.
' j# m M; @. @& U+ I+ h) p: b8 hIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
. ?- }5 s% e( @1 B5 Q! Jto the new routine to execute (hangs computer...)/ ]7 I5 J: I7 s9 B) Y
3 n9 j$ p5 c: E( E% E
mov ah, 25h
# Y O' q: d/ i mov al, Int_Number (01h or 03h)! w5 P( ` P" [# P3 S: j2 b
mov dx, offset New_Int_Routine: M/ B2 y& r7 \+ h4 O
int 21h
- j5 X- J. v' E6 Z( ~' H) p& K
Z" P" _: D5 e, o n R" P__________________________________________________________________________
( w- I0 s0 D: y5 V' Q3 z6 r" R$ i) g& B/ |8 M/ n
Method 090 F' @3 g5 n1 r, Y* H0 M6 R% ^3 r
=========: a8 x" s: m* b
4 m4 A* l3 O8 W% XThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only1 j9 N0 C, Q% h$ O8 S$ p
performed in ring0 (VxD or a ring3 app using the VxdCall).' S# w+ x4 Z* O$ [: v! ~# {
The Get_DDB service is used to determine whether or not a VxD is installed
) N* d! i# ^+ y$ zfor the specified device and returns a Device Description Block (in ecx) for
3 V6 V) Z' W# z) Gthat device if it is installed.3 X" d4 w! n% M4 F( {6 X
/ u- `% ~: J! p; i
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID. w4 Q' Q9 A+ O4 g. {
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)" E/ K, k; S, S
VMMCall Get_DDB
4 s; R9 p# R7 t4 X' h mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
2 D/ {' @, ?; e- P5 w9 Q$ ~' J
- \& w% o6 j' s- k @ v7 @, ANote as well that you can easily detect this method with SoftICE:; ]/ v Q$ w! s- x
bpx Get_DDB if ax==0202 || ax==7a5fh) \/ s, ?- J$ G0 p) Z1 s" C
' S; Q. c) u) K+ Q
__________________________________________________________________________+ }: U% [% Y6 q" {! k+ c
3 G; b& Z) H) H' k* _0 rMethod 10
5 b* A) y- Z( ^=========' D4 |6 a. y$ [
. z) i9 i& m1 O5 T=>Disable or clear breakpoints before using this feature. DO NOT trace with5 x8 f4 c" G5 O
SoftICE while the option is enable!!; G0 _, p( ^1 C( ?! U, S
4 f. t& o% z: h1 i6 _This trick is very efficient:
' G& H8 T6 J6 p; Zby checking the Debug Registers, you can detect if SoftICE is loaded
/ x! Z' p. ^7 h& M1 q! U(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if9 x9 c8 M# C3 e( V# h
there are some memory breakpoints set (dr0 to dr3) simply by reading their2 E+ K& R( h7 m! M8 p- J* X1 O
value (in ring0 only). Values can be manipulated and or changed as well7 q! d) }: \' i& T: m& h+ B% k
(clearing BPMs for instance)# a, h4 e4 R7 M c' n# O
* |$ q' D# u; W
__________________________________________________________________________
8 S# j: O, V }
# y( D2 L9 Y: x7 rMethod 11
* ]4 B2 o [5 C8 p$ S+ t" t=========2 ^) g) B3 {, `: ?1 G- i. [4 I7 c
4 U( s9 I/ ?9 C& a6 Y$ e$ gThis method is most known as 'MeltICE' because it has been freely distributed
4 c. Q( v l: H" |via www.winfiles.com. However it was first used by NuMega people to allow
; J& q3 U) a. U; sSymbol Loader to check if SoftICE was active or not (the code is located$ p) N$ }% k9 o! `/ a2 A( ]3 n! W0 F
inside nmtrans.dll). l; ?. }& n8 O! s, m9 {& @- b
, A- \" {) o2 A6 U! bThe way it works is very simple:; F6 z2 k: Q6 R8 b, D0 X! {( ~
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for: F1 ^) d" `- t% A( u- y' M1 i! d1 h
WinNT) with the CreateFileA API.! f* U+ F5 U' s
; a& s3 _2 v% j5 P" v* dHere is a sample (checking for 'SICE'):
2 w$ E5 _; O( a& h1 C: ^2 ^- U# X5 K" l
BOOL IsSoftIce95Loaded()% T: Z( K3 l Q
{% B( ]& V& `8 j+ U, T; U
HANDLE hFile;
6 | ~& p& k& R" x: d3 @' z hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,% z" J" t' O5 n. y% T& H7 X Y+ ~9 g
FILE_SHARE_READ | FILE_SHARE_WRITE,
' M1 T! a, }$ e% _- [ NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);& c. R) `" f' y' @* y8 c
if( hFile != INVALID_HANDLE_VALUE )* ?0 b& e# R; e( [8 @5 w
{
4 y0 {; R" J. m6 N; X5 s* A CloseHandle(hFile);3 V, _' ?0 |$ M8 U
return TRUE;5 k5 \: T$ A) C$ C4 H% @
}
- I& ^8 D p9 Y" ?& F4 v1 n return FALSE;
+ n2 R u/ w1 ~. G! u/ j$ C% F) i% x- P}
' p- C$ K; z6 _ z, p
# i3 y/ x- _$ EAlthough this trick calls the CreateFileA function, don't even expect to be1 [5 Y, M1 t' S y L$ p: `
able to intercept it by installing a IFS hook: it will not work, no way!, @: \( F) y9 V) M. P% ?: D
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
1 l% k8 U) V; ^# ^2 R7 pservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)4 M: D2 _; X6 {$ g; _, j1 p$ }" Y
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
! E; O- |) ~3 hfield.! ?3 U9 e) S0 i0 X m* v% m
In fact, its purpose is not to load/unload VxDs but only to send a - R( T3 ^/ H! N9 L# j1 x- h
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
" \6 [2 H6 X! Z1 U- b. uto the VxD Control_Dispatch proc (how the hell a shareware soft could try1 Z: E% C2 H9 d& r; E7 `- w
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
" p3 e5 c+ t$ m- C. f6 ]+ N- TIf the VxD is loaded, it will always clear eax and the Carry flag to allow' k2 d6 l- f& z. Z; G) `7 ?/ u
its handle to be opened and then, will be detected.8 ^" A+ {8 z; ]* \+ Q# n
You can check that simply by hooking Winice.exe control proc entry point: |3 l6 h1 F6 q( A4 c; {
while running MeltICE.
( C8 q1 F. k' m5 {* y0 b& W
% }, L6 k/ h- T$ P6 p! [5 w
; P! J1 \2 i6 K2 i+ ] 00401067: push 00402025 ; \\.\SICE Y! ?- g! g$ M% ~+ G
0040106C: call CreateFileA8 d% F5 E3 w8 A0 L
00401071: cmp eax,-0013 {% j+ t. y8 Y2 ]
00401074: je 00401091
. M1 X( t4 n3 Z0 |6 k, {3 ?: \6 Q# i3 [" i2 C; N
8 ~1 C/ w/ |" r7 }There could be hundreds of BPX you could use to detect this trick.( }! Q8 N5 s' S' U1 \4 ~6 h
-The most classical one is:$ c* q( j' z+ T. {
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||) ]* d5 P0 G3 h w/ x9 `& D
*(esp->4+4)=='NTIC'
/ x& C v1 }% U: @# ^. v; u$ @
4 |$ j+ p0 n6 K4 G-The most exotic ones (could be very slooooow :-(' z6 D' ^* y7 M9 g* H `+ Q3 c T
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') - a- l3 T+ v0 Q7 L% e( F* e2 W5 q; M
;will break 3 times :-(& m" F' m3 Y' a
- j9 A6 G* i9 H) `-or (a bit) faster:
. r- t% i0 c& ]( h. l# `7 o! l1 E BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
& x; w9 \0 W( R. {: i7 m& f7 T, |/ q$ V
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' 6 {( Q& n9 ]2 p S0 J" J
;will break 3 times :-(# m4 y& E6 K) g( |6 @/ l
1 w: X" ]9 W; A- {/ v! @3 ?+ m0 \-Much faster:2 V3 ?6 Y$ q# I. s6 ]: A) _
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'7 ?6 m/ x1 J( J% M
0 c8 q% [! r; F5 ]! P8 `Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
& t+ p& z$ |& X: ^7 k, `' L6 Z0 mfunction to do the same job:, K w3 L4 x r# m' h
: t+ u3 C. q/ r- j push 00 ; OF_READ
. L, X4 u" f7 G! }5 S& }( n mov eax,[00656634] ; '\\.\SICE',0+ _5 D( ]! i1 a/ h
push eax
4 p3 m$ }. l6 A T' ] call KERNEL32!_lopen
! D7 ~/ x$ j4 [, z3 V inc eax
6 Z9 v% \$ c, b; K0 Q* H1 R, j jnz 00650589 ; detected1 g6 T d& o; {5 Z0 C! ]# l% j
push 00 ; OF_READ$ N6 X' l! c& x7 O: b
mov eax,[00656638] ; '\\.\SICE'
9 l6 y' U2 r# V z x. i: S* D push eax
$ \3 W( @$ Y& y' a1 {) ` call KERNEL32!_lopen
8 \6 E3 e* y" V* G* s# H0 k inc eax, T" f/ _* g- {: I6 x5 E% s) C! T$ ?
jz 006505ae ; not detected
" ^7 O6 ^4 ]; d8 S* }0 M" I& L+ ?$ G4 A1 H% C7 Z
/ f. p1 ?9 W* }- d3 Z2 n__________________________________________________________________________3 @' Z: X3 K" S5 v7 j7 h
8 ^+ W0 ^" L. e/ J( e. o
Method 12
) h- U' v9 L0 D* F' v: Q* y, ?& Y=========# y* h0 ^% l$ O# ?' x: }. d
2 d, F5 D# B/ Y/ r) uThis trick is similar to int41h/4fh Debugger installation check (code 05
8 J" p( L9 {, k( n& 06) but very limited because it's only available for Win95/98 (not NT)7 v7 n% w b E; J: D0 J; F
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
! x6 U; [% c# v9 [* Y I, [
8 ?% b+ q+ [3 G1 N% x$ L push 0000004fh ; function 4fh/ m& O4 a' N2 S$ L6 y7 c4 C9 j
push 002a002ah ; high word specifies which VxD (VWIN32)
% W3 v& l* i0 x1 s9 A9 d ; low word specifies which service0 @% g9 G3 p, x+ H- v: Z: T: l
(VWIN32_Int41Dispatch)& W' a5 w) a/ H9 O5 J4 |$ F
call Kernel32!ORD_001 ; VxdCall7 K7 b/ @, _) N; n
cmp ax, 0f386h ; magic number returned by system debuggers
' d! A# O3 e7 C R# F jz SoftICE_detected- P! W3 m- k4 @/ ]) ~* Z; \
5 H) ^: m) n5 K$ ?5 C2 W$ ]9 IHere again, several ways to detect it:
( f2 m, u+ m8 q ?7 O. k' Z/ J6 m, k5 E& L
BPINT 41 if ax==4f
. z5 I) e# Y6 E2 U8 h( Q* S
1 ?$ z, V& l, R' V6 w$ i+ X+ x' n BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one: _# J/ h$ M+ g, T+ x2 u- L
8 s* N+ }/ q! u- m
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
8 i, l# B R" I# t. ^! d
! x$ l9 Z) D. m+ d- O3 A BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!5 p6 ?9 s. _/ D7 Z$ u
; y1 H# D; m/ F6 V* T$ T__________________________________________________________________________* |% k. R7 R; X; \$ H
# E# n9 o8 p/ j" G: q0 uMethod 13
; N$ O% L" B Q0 N4 c=========
0 ]6 z- S5 v% h! U1 Z& x$ P# U7 v R1 A! g$ E3 z
Not a real method of detection, but a good way to know if SoftICE is+ K. \7 `$ R" x( }1 n7 Q& l* f
installed on a computer and to locate its installation directory.6 }/ N+ }) i& K. P2 z0 D' q ^
It is used by few softs which access the following registry keys (usually #2) :
) Q( b" A- I4 R; j! b$ p
/ q M/ ]: v3 ~1 Q, A" R! D-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion6 V' h) b) Z. v1 W( {5 p5 c
\Uninstall\SoftICE& _: r* y: C" B+ w) q; `
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
* a: m( l2 K5 n1 t7 b, ?+ t+ h* [-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
: l/ M5 t3 G' B _- N\App Paths\Loader32.Exe0 g" S3 S% x" q F2 J
9 i# T1 |/ ]( r4 y5 A% Z. D- Z* |8 J) n
Note that some nasty apps could then erase all files from SoftICE directory
7 r7 B5 b3 W5 B( Z$ M) h/ p(I faced that once :-(
4 \- s! f( R; V1 c1 N9 F
8 @( ~: ?6 L' o/ K* [Useful breakpoint to detect it:" g2 r% r9 N3 C
# p% M/ D( z! j6 { BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
1 v# q" q$ G2 a' H/ E3 N4 |: O. K1 }, C5 ^/ e7 u0 v/ u; |
__________________________________________________________________________
5 g7 d* g- H V" L4 J0 a2 y- q* Z9 h7 E/ [& _
% }9 r, {/ ~9 I# O9 n
Method 14
8 S5 \% F, l; t# m7 ]=========2 b- C3 |/ J2 y0 |( {
* a- u9 B7 I9 A6 o) H
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
5 |( U o7 B0 B+ J E bis to determines whether a debugger is running on your system (ring0 only).6 {# H+ B8 M6 J8 E) c9 A
3 v1 D# ~7 ]6 O0 @7 [
VMMCall Test_Debug_Installed
) e F: N. N% \$ r0 t je not_installed
( F; r5 s+ L' N0 ^) l9 D* W4 q0 X Q- z8 L
This service just checks a flag.
& L5 t9 L5 ~; V. Q" e& M! P7 a</PRE></TD></TR></TBODY></TABLE> |