<TABLE width=500>" w, W2 o$ ^; e1 L2 L- O% @: r# u
<TBODY>
* n$ q6 |7 L! p! t t<TR>6 n: X( d+ c# ~2 G
<TD><PRE>Method 01
: g, G) v" t3 ^ R=========
3 s+ _) F: Y9 r' I7 {6 p+ b8 `( Z, F; o; v, X+ c
This method of detection of SoftICE (as well as the following one) is, u# i, a: N, k2 B4 Q. P0 z, P. h* ^
used by the majority of packers/encryptors found on Internet.: U8 I9 q( _, t
It seeks the signature of BoundsChecker in SoftICE
+ q, l+ K! b1 Q9 O/ _! Q( O
W" r/ u/ z5 D$ R1 {" X mov ebp, 04243484Bh ; 'BCHK'& ]8 w( Z, _2 E# E1 `$ `; J
mov ax, 04h! v1 Z- g1 x4 `/ @
int 3 ! m. b6 {4 Z: Y4 f
cmp al,4
7 Z9 ]7 n8 w$ X/ w7 J jnz SoftICE_Detected
0 w s0 d# t& v, }# O$ Z% c3 a3 Q. l" {7 Y+ ], J1 \! R
___________________________________________________________________________
) T3 O4 a' g9 `8 A; G* y) J3 A/ ^! B2 Q2 u8 Q) p
Method 02( A9 ?/ A( F9 [8 J$ C d" o
=========
2 k3 p3 t% o, m% F" u1 {) W3 @1 ~; J& r8 ~( u) p$ d5 ^8 o* E) F- ^
Still a method very much used (perhaps the most frequent one). It is used! m9 ^5 j0 t6 A# [7 g s
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
* r0 |# E: ~9 ]7 C( Gor execute SoftICE commands.../ w" k# g5 Q8 \& j; s+ b5 G, w
It is also used to crash SoftICE and to force it to execute any commands. b2 U: V$ n2 N5 C$ z
(HBOOT...) :-(( ! l' O4 f1 U$ i7 y: C8 o# B& J
* f q; m R5 T" ]6 O# v5 S3 t
Here is a quick description: d$ P& l( U; S, H( R
-AX = 0910h (Display string in SIce windows)
N$ d) w5 Y O' d-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
4 R9 \5 z2 [, q) t6 P3 A# q-AX = 0912h (Get breakpoint infos) x3 c$ f* o- s" t4 \" D, j6 b
-AX = 0913h (Set Sice breakpoints)
# V2 r( N9 f. u0 N9 k-AX = 0914h (Remove SIce breakoints)
- `, |( Q+ R# {8 V8 F9 D& r% p$ B3 x
Each time you'll meet this trick, you'll see:
" G" m5 D6 ?! ~( [0 i+ ~-SI = 4647h7 H: z) j8 N9 u8 E
-DI = 4A4Dh. b1 b/ v$ X* [- h
Which are the 'magic values' used by SoftIce.# L3 d2 q9 P2 d1 e8 F
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.% D2 I3 d$ q! q8 ^% E0 Z
5 c3 y0 L( v) V9 A2 d
Here is one example from the file "Haspinst.exe" which is the dongle HASP. |% M; Y0 J0 |, }# a" J& L
Envelope utility use to protect DOS applications:6 i3 _$ m+ f7 i. ^7 Q! \
! Z+ J0 n2 C, E
# k" T0 v9 A' |8 `9 _! `- q4C19:0095 MOV AX,0911 ; execute command.6 x$ m7 z) C1 e' M
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
; Q2 C* o8 ]) P4C19:009A MOV SI,4647 ; 1st magic value.) x: j/ S$ Q4 J$ w1 F3 I& A
4C19:009D MOV DI,4A4D ; 2nd magic value.6 g- `# R+ Z) l6 Z3 w9 I
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)+ U+ Q5 I: y& g0 l) v
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute( g+ @# c$ c( J G
4C19:00A4 INC CX
" ^! N6 I: _# o. w8 ?2 P5 {4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
2 @6 f3 |7 J$ m4 H! |0 y3 p4C19:00A8 JB 0095 ; 6 different commands.
$ n( _$ K% U* ^* H+ K4C19:00AA JMP 0002 ; Bad_Guy jmp back.
! e( |; G3 v. W. X4C19:00AD MOV BX,SP ; Good_Guy go ahead :)5 ]' W( s# x! ^5 h
. Z) C/ H+ v& ~, l
The program will execute 6 different SIce commands located at ds:dx, which2 k0 D- \8 _ S7 E# `' H
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
E7 F F; W0 A5 z" k& m9 Q2 ^! c" X! {4 w4 Y
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.% j+ V1 |7 f+ E& Z7 l" ]
___________________________________________________________________________8 A, w( e5 q6 B$ q& a8 P* w( I
7 G* |3 g: \5 E
) z) S! Z8 N O+ Y% d% A& zMethod 03% d; S9 |! _5 A2 t4 T; [
=========
% n6 n/ n+ d9 M
1 Y: M& q* x: u. M& mLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h) E( V) f% p( D2 _2 S6 R+ b1 r. ^
(API Get entry point)' V0 w4 N% d- d6 p+ g% ]0 C* C- Z
% r3 X0 I; |# ]' f! W7 n
) G& J5 U# `- N$ W
xor di,di! {5 T- p5 K& _2 X
mov es,di2 |2 P/ y$ K5 x5 P U
mov ax, 1684h ) K4 J% F8 K1 o* `3 s- Q4 |
mov bx, 0202h ; VxD ID of winice
, X- |( I! j8 J3 c int 2Fh
$ Q4 N i/ q4 T9 F: e5 ?$ h mov ax, es ; ES:DI -> VxD API entry point* p' t4 k6 B/ Y- y
add ax, di
, \- U7 ]( L$ e8 I test ax,ax. z7 W. D& m! C* W$ \9 q$ A$ A
jnz SoftICE_Detected
7 y' h# z7 W5 Z8 P3 ~3 U& m7 h
, ]3 `9 A* S+ k' ?% N {___________________________________________________________________________9 c, z) U4 b1 J. |. C
& ~5 y$ E8 g7 R( P2 B4 kMethod 046 H' f2 u& P/ L' ?
=========
! G. V7 M* @# _1 @! V' K6 l! a3 _$ I0 r s. x8 I% s# e
Method identical to the preceding one except that it seeks the ID of SoftICE2 H% r5 r; J5 f# A3 T; Y1 H
GFX VxD.. j9 a9 t d2 G$ C9 n
# S) B1 k: n: a d
xor di,di
) E* p! p* B1 J mov es,di
9 u" G5 @3 g$ g1 `9 s! u! J1 R- C mov ax, 1684h . B" o0 y& _9 v$ c- i
mov bx, 7a5Fh ; VxD ID of SIWVID+ D5 x! K, c, O8 R6 ^2 y" ]
int 2fh9 t# }5 a# M+ M& z( |/ Q$ t
mov ax, es ; ES:DI -> VxD API entry point
5 e* ?9 k9 J$ V' f# t. ~( W: B add ax, di
% U$ v1 M5 y' w& m& n test ax,ax' p7 S' I( P9 a6 w
jnz SoftICE_Detected
# @# C. A7 E: G. H! L9 B
; ]/ x/ u9 K% H9 b( p, F& f__________________________________________________________________________
) S% N9 b) t% a Y" | R6 P& A! y6 e7 Z
K4 E* [6 Q# k/ ^
Method 05
; p, |" {2 M) b8 P7 {=========# g; f8 f6 \8 j$ p
+ b! C7 K/ |* }) J! F* |- p5 @* K
Method seeking the 'magic number' 0F386h returned (in ax) by all system
7 C g+ L1 C. h5 k7 ?3 ^# T1 E( Kdebugger. It calls the int 41h, function 4Fh.( @7 R( I6 t2 t2 m( R2 l$ o% |8 H
There are several alternatives.
4 w1 C' [1 L/ I% C2 Q; `+ J8 F$ _: S" j) L! ]. d% f
The following one is the simplest:
: I4 x8 i6 L% z7 p4 G" p5 T) _* d; D% v8 V
mov ax,4fh( `6 Q+ k! K- f& q0 l j( L
int 41h' G1 i. P r0 z; }# ]& O: U% \2 z0 Q
cmp ax, 0F3865 \8 m2 R: I" u9 H) g
jz SoftICE_detected
; Y( D: A9 H( \8 d7 Z# p, ]$ q; {* Q. o: Z' c* ]; ]
/ i( Z @" ~ |, uNext method as well as the following one are 2 examples from Stone's
/ N2 U x0 Q0 j: p" E5 h"stn-wid.zip" (www.cracking.net):0 i) P4 J& f) c1 k, p9 k
+ a# b1 Q( B/ d( R9 w/ O mov bx, cs
7 v4 v( H, }$ \ lea dx, int41handler2
! |- k ~) O i$ E5 l+ ] xchg dx, es:[41h*4]7 V$ M9 E8 l8 F7 E) Z- f; e
xchg bx, es:[41h*4+2]
/ Y+ ^& A R: Y6 R" U0 R mov ax,4fh! q3 _5 R& c3 ^
int 41h
' c; U2 S/ E! f( A xchg dx, es:[41h*4]7 @9 U% @0 c4 l3 s+ z
xchg bx, es:[41h*4+2]4 P& k) P# h! M' i
cmp ax, 0f386h
: ^4 a+ u" E) z& a5 o jz SoftICE_detected
6 p4 {0 I5 { c/ L, M# k+ i
9 x* L( k# a9 a7 D5 A9 ]7 M/ aint41handler2 PROC) S( B+ G2 M/ T7 W/ n6 k
iret+ t+ L$ g4 |+ q9 J1 e X) M
int41handler2 ENDP
( U3 s# n! ~+ P( X/ e" ~* O: n! @$ [6 j4 W# ~2 Y
4 V' V0 P0 k1 f1 W# [ s+ w( A_________________________________________________________________________
+ P# ]5 m- o5 a7 P
% H- q) D* k3 n
: _$ J& _' e! B: H. N5 v: T" `+ QMethod 06) N4 I* q% T# [6 m( k% Y) v# c
=========
2 m6 i$ x$ X. S0 i2 E$ z- c, q `" z- c/ b$ L$ Z
- u6 K7 q/ z+ P2nd method similar to the preceding one but more difficult to detect:- f5 a4 V" T1 N" L
/ o$ C" K. J; Z
9 E9 d6 N* B' G, l* p/ |int41handler PROC
- Q( y$ a- M) B* A8 w9 S: E' D! | mov cl,al
7 Y0 ?, W, l, p) r$ q2 j) @* W) i5 G iret" L% i" K. d4 V% z1 B3 D% x* P
int41handler ENDP
) ^* X) P. u5 A& C- p- P5 R4 [$ R& p3 U7 b3 v( q9 F
8 v1 @, e8 u5 P xor ax,ax
1 e9 {+ ^! N' ]7 @' I mov es,ax
5 v2 q( D4 N6 S9 y5 ]# G9 ?% U mov bx, cs6 j" K. a9 j! y6 C
lea dx, int41handler
8 ~. h9 ?. h* z. s( M xchg dx, es:[41h*4]
8 @" C+ J" @7 b0 n" a xchg bx, es:[41h*4+2] H' m9 Q9 U4 W3 m1 D6 t
in al, 40h6 S/ p; R7 c4 ~" r. s6 ~& }! p
xor cx,cx
' w i! P' r6 V7 @9 M int 41h1 o/ Q5 m0 e: m( {7 ^. h( D
xchg dx, es:[41h*4]& F5 R' ?. L3 j" P& D; K& |
xchg bx, es:[41h*4+2]
. |# }) k7 h0 g6 K5 S- u% l! c9 I cmp cl,al
3 @. k9 n) e& g8 c jnz SoftICE_detected. l5 U1 i( D. E# j
& P' G4 F1 p4 O' }2 h Z: i; L! V
_________________________________________________________________________
g; B: O! x" p0 ?: Z+ q
) U- M3 ?' Z+ m! z/ M% x" GMethod 078 W; `, X \9 ^4 |* k3 w4 M/ t7 Q
=========4 L D( J2 @ G$ b2 e
! r4 i+ s* Z: w3 A- U, O- a- z, Q
Method of detection of the WinICE handler in the int68h (V86); H: a5 Y/ g' f& X3 N7 M7 ^
, e1 c5 B. b- \" g" T O mov ah,43h
- z/ r8 G, F9 P$ K' Q Y" L6 N int 68h7 i6 X; }* b' e R$ \4 T
cmp ax,0F386h
6 |% J, o8 y3 \8 v! M& ? jz SoftICE_Detected
' l, j# Z3 C* O) {. `3 \! L6 \1 s, X- ]8 U3 e' z/ d
' l+ c; V3 A9 z" q
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
* L) t& i/ k: S' U% a5 c8 j app like this:/ v+ w( g( t; u" R
9 K; l0 Q! P8 [0 l0 M! X1 |# x
BPX exec_int if ax==68
4 j/ ^8 Q' c8 a (function called is located at byte ptr [ebp+1Dh] and client eip is0 m) I, O' e- x- W" {
located at [ebp+48h] for 32Bit apps)) e. _$ N: X- c
__________________________________________________________________________
$ j- w# s4 R# W" w* a& K
8 V' m* N( @2 j9 u6 C B6 f: ^* r6 O/ T% Y$ E2 H
Method 08
0 N, X3 ?, N! ]* ~5 Y; J=========7 R5 `( ^9 @& Z$ e
# s4 G% M) N+ B' Z0 a' g; Q
It is not a method of detection of SoftICE but a possibility to crash the
2 Q+ R; b- ?+ c- T0 E" d* Y' u- Fsystem by intercepting int 01h and int 03h and redirecting them to another
m7 }3 I5 P4 G9 x3 `% ~( m. ]routine.8 A( @- j/ n. S( k" k
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points7 K; I( q1 g; d" B( t, K
to the new routine to execute (hangs computer...)
+ o% g7 i, X# n% B! k% V
4 `& @; B5 v6 w0 E2 C$ p6 L1 I mov ah, 25h$ l0 }7 D+ v* A) ^' @0 `+ u
mov al, Int_Number (01h or 03h)
' p, {$ J- }0 u! {" Z+ \* E mov dx, offset New_Int_Routine+ m. H0 `- ]) S* \' A
int 21h3 n/ y+ F5 ~1 @ }0 b7 U% `$ {
9 y9 K' K* M$ S8 o; W" `& o__________________________________________________________________________" y7 T& v, s% @1 I9 K8 O
2 s) ]) b" ?7 Y2 q/ P+ g# _' Q/ y' uMethod 09
9 T2 @$ o1 s8 Q, s( ` h2 f1 z1 b$ t=========- M+ {% T: ^) o- m' v! p
f! y* U0 w# N% O" x0 QThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only. b. j- ~+ p% Z. K& e+ f5 j$ n
performed in ring0 (VxD or a ring3 app using the VxdCall).# B9 S% M* O, _& Y: N- M4 N
The Get_DDB service is used to determine whether or not a VxD is installed0 h3 {' @; W% z9 a6 T! f& A
for the specified device and returns a Device Description Block (in ecx) for2 t5 f( j& M- H1 ~. i; q2 j
that device if it is installed.
' j. @9 e% m }: M! y" N: e! w+ U; N" I8 G% n5 O; P3 q' \
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID2 d- c2 N" q. h& M+ A* O
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
. ]) T7 k! A( ]& M1 h VMMCall Get_DDB& l) t+ B5 i# C
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed( w7 O& Y- ^' z+ I0 l
) E: U# M. P# ^) H$ H& ]4 Z/ WNote as well that you can easily detect this method with SoftICE:
+ w" N: [. j! L/ L+ E8 U bpx Get_DDB if ax==0202 || ax==7a5fh
. ]! I2 b" {- e- Q& }. v! C( s0 H: d" @ `) D1 h4 q
__________________________________________________________________________
9 W$ F5 _$ t9 L- g& F0 E
7 }4 M2 D0 K0 PMethod 10) @9 h. g$ m! G! @( @5 _! m
=========
4 E' w8 B8 [- F, X& J3 w( W" f# m5 t& V% R7 ~/ _5 y3 K# S1 c
=>Disable or clear breakpoints before using this feature. DO NOT trace with/ ]+ x* B+ K- p7 S8 G e5 m) ?
SoftICE while the option is enable!!# O4 l5 {6 g+ P- O/ }& ?9 s
# b4 l6 v& V9 n9 rThis trick is very efficient:
- |0 E. ^. N/ R2 Eby checking the Debug Registers, you can detect if SoftICE is loaded8 P& l9 Z$ I( ]7 Z+ ^
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if: F5 {9 y, {9 ~4 h0 @+ L
there are some memory breakpoints set (dr0 to dr3) simply by reading their
1 K- a3 K; j b1 S0 c1 D! S2 rvalue (in ring0 only). Values can be manipulated and or changed as well
% k- h. r' I$ _6 j' v7 P(clearing BPMs for instance)' F" P2 d$ d& `/ B3 Z, P
' ?+ r$ X* J- s0 E2 Y
__________________________________________________________________________" y) E W6 m" O* Z8 g
, h9 [4 \1 G* N. }
Method 11
/ @3 `1 k9 ] \; x8 A=========
1 {5 k5 ?( m* _* ~: }9 S1 `
+ k* O- Y/ o$ H% l8 F3 g$ a* `This method is most known as 'MeltICE' because it has been freely distributed) r0 _( i: K7 H. k% @
via www.winfiles.com. However it was first used by NuMega people to allow2 r2 D6 k8 j1 j; W8 M5 V7 g
Symbol Loader to check if SoftICE was active or not (the code is located) \8 Q' _0 @( z _3 p1 e
inside nmtrans.dll).4 R, M$ ?# v0 x! L7 F
" V, I) X5 `8 D& s; ]The way it works is very simple:
2 K1 ?7 c$ H- LIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
( t9 j5 ?0 c# o' h" JWinNT) with the CreateFileA API.. _ `0 Z- k9 @9 ^9 J, g; u
! {, p- N4 o: _# V) r9 _) J0 n) xHere is a sample (checking for 'SICE'):
( {8 f2 k2 _! N. r% o4 N* w8 g4 z$ Q2 Y! r
BOOL IsSoftIce95Loaded()3 [2 p* y5 G- _+ [2 x
{
6 J8 `, g! m6 C! o6 a HANDLE hFile;
" ]- H( j6 d% X hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
" O- O" Q g, @+ E5 w5 W- h FILE_SHARE_READ | FILE_SHARE_WRITE,
- E- x/ ?2 n: y NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);2 D# | t* e8 P3 N% P
if( hFile != INVALID_HANDLE_VALUE ); o* [# [: C7 |! y
{. U) I) ^, m7 M2 w$ h
CloseHandle(hFile);) j. C' Q. ^4 V2 x' c6 O6 [2 o
return TRUE;
) h! G! w# R- k% U; F) _/ V }/ b) v6 x! a' g* F6 Q A2 G
return FALSE;1 v" j0 d' Q- X: P
}
& V: M4 A) m: |; r1 u: G" }* g5 Y% |6 p$ y% E9 `: A6 ^
Although this trick calls the CreateFileA function, don't even expect to be8 D/ x, O* } k' J( Q p
able to intercept it by installing a IFS hook: it will not work, no way!2 k4 B$ l$ ~7 t' O& s# V
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
1 O" B% N6 v' E( O: w" C# r$ p3 Nservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function) r! P# _$ U1 a& s- f
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
1 B! S3 G) B$ _8 ?field.- S. T# l5 A. L+ p; q, x* i, s8 ?
In fact, its purpose is not to load/unload VxDs but only to send a
! k. t# i9 X' x) e! P# gW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
: u8 v U- m6 [( Jto the VxD Control_Dispatch proc (how the hell a shareware soft could try4 `9 ?0 h' J- N, V8 x
to load/unload a non-dynamically loadable driver such as SoftICE ;-)." ]: r+ f9 q+ c% v) `6 n, W# J
If the VxD is loaded, it will always clear eax and the Carry flag to allow
$ Q, `+ p$ t1 t) ~, B" e @+ eits handle to be opened and then, will be detected.3 T, O: j' |" f3 t; { Y
You can check that simply by hooking Winice.exe control proc entry point
, i3 U- |, P: X3 W" G; u$ Xwhile running MeltICE.
" E$ K! w0 u, p7 f2 t1 I, K7 k2 [) k W/ {# D+ Z& p S" c
4 |3 o/ C1 F, k$ C, o9 c6 k% B
00401067: push 00402025 ; \\.\SICE" ?# l. Q# Z6 w7 d+ Q
0040106C: call CreateFileA! D; x8 b# a; |/ \% ]5 ]9 J
00401071: cmp eax,-001! B% M, c+ T, ]* b1 V1 f9 F8 c3 B
00401074: je 00401091 J& _; s: u" \/ L
! k# {8 a8 {$ L& `) n0 j! u/ p
8 }1 A0 ?2 s9 X* _There could be hundreds of BPX you could use to detect this trick.$ ]: }# v" v6 j8 _' {
-The most classical one is:
) |3 Y+ m, r9 ] BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
. N! K, E9 V0 P7 T2 Y, O- A- B *(esp->4+4)=='NTIC'
% ~" Y" @5 Y" J, d' @, D
O" }& }' l7 m5 P$ g1 g2 u-The most exotic ones (could be very slooooow :-(" g- o+ K3 F$ ?. C: P/ \8 d8 B7 ]
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
6 E0 I6 I. ]8 g0 V+ B3 {, c H ;will break 3 times :-(
2 z6 X2 s8 L) S
$ H' k2 z+ m+ \& v6 N-or (a bit) faster:
, J" u( }# Y) m# } BPINT 30 if (*edi=='SICE' || *edi=='SIWV')! z, v& t% v, ]- [) T
) J/ c: \8 C8 K j+ c( D
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' ( p& B$ N3 L% X8 P
;will break 3 times :-(
* G9 q& p& I9 k( `, M! d3 y; a4 z2 e- ]: \
-Much faster:, ~: `2 M1 Z" |3 r$ m0 `4 p% u6 }: Z
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'! z2 q1 S$ B. W! B% S3 c5 P
% e. @7 n2 A; Y) M- g2 m
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen9 t% s* W% A8 |. z
function to do the same job:
0 y; a/ N6 S3 [0 M0 W
, l. d& L8 y7 m } push 00 ; OF_READ% w' Q, V7 ^: B, L! X# E8 Q. h$ T
mov eax,[00656634] ; '\\.\SICE',0
% u/ R" F7 S p3 s- H push eax! P/ g+ @; z/ K/ f
call KERNEL32!_lopen$ M: }3 l- D; M$ `! l
inc eax
/ F2 _9 p* [$ r/ Z. n; N6 P jnz 00650589 ; detected
8 Z. M; A7 U$ O) { push 00 ; OF_READ
; a$ \9 G t) d mov eax,[00656638] ; '\\.\SICE'+ `, a$ a9 y% R% U
push eax
/ i0 T8 G9 K; q# B9 ?8 n6 N call KERNEL32!_lopen" L# v% ]. i1 Q; y: Z, g
inc eax
Y& Q: p8 b5 `9 _. K- k/ A jz 006505ae ; not detected
, S3 {, @9 x0 i/ y7 ?- _2 I( G
1 F/ B7 Q: p- S6 Q0 {0 l( e# S+ W* S+ v
__________________________________________________________________________
8 q$ c# a, b N3 i
. S0 u$ @$ e7 E0 p1 ?9 FMethod 12
- h7 }' x0 y; W* Q8 v8 ^! s=========
% ?4 f; k7 @ ^. r) E! T; R) E& A( B" D# H X" [' w4 j3 q, V4 G
This trick is similar to int41h/4fh Debugger installation check (code 05
' _1 ~" c) X `& 06) but very limited because it's only available for Win95/98 (not NT)
) n8 T0 [- Y% n0 O7 vas it uses the VxDCall backdoor. This detection was found in Bleem Demo.
9 P- [: ]' ]4 k& c; C6 Q' u- K+ R, B: z" u3 c/ c
push 0000004fh ; function 4fh
; v5 P0 W6 g& m push 002a002ah ; high word specifies which VxD (VWIN32)$ g* U0 z' O) g! I
; low word specifies which service* ]7 y. a2 o, t, y8 S, R4 b
(VWIN32_Int41Dispatch)
/ e4 r* R: d0 Q% N/ s9 G call Kernel32!ORD_001 ; VxdCall. ~. J, o+ e2 @& u
cmp ax, 0f386h ; magic number returned by system debuggers
' Z' k7 C( H$ }0 Z jz SoftICE_detected
. g# _6 X" O; P9 n1 P7 c
( C+ o) @4 j/ S" Y# P7 mHere again, several ways to detect it:: y0 `) Q/ r: p+ f0 s- f
) t& y3 c( X! z/ X4 R# M. X
BPINT 41 if ax==4f" L0 V" @7 j) x7 W7 M# c* I9 M9 b
1 R: J( H# q3 z5 ~+ ~
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
5 [& w# x* H6 _/ p/ q7 B6 F* y% h. R' }& Z. c
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A/ r# w- f+ ~! |- Q
/ W+ Z# F( Y! `1 z1 K4 k( a
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
$ W0 P' n7 m; Y: }4 [ G4 a% a7 i& a4 f# [% _; ?: c
__________________________________________________________________________
6 T2 P$ t0 T7 c
3 G5 `1 Z( v$ z0 ?/ |, O, hMethod 13
+ @1 s t4 D# T$ l2 {1 r( H=========
6 F' W) g' T1 @2 l8 Q+ t: ] q$ {- f
Not a real method of detection, but a good way to know if SoftICE is
6 m* w4 g# }' O, ~3 a, q+ o' Yinstalled on a computer and to locate its installation directory.4 n# u+ z1 S( e1 O" v
It is used by few softs which access the following registry keys (usually #2) :
3 D) H" } q3 f5 A1 n1 U* ~; n
3 W' V9 R& K* a. K-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion% ]0 ?! A5 g: Z, s- s
\Uninstall\SoftICE+ e9 U- A9 q, x: |6 F& G) [
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE$ G- Z. I! ~+ q6 H, z' Q* T
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion% v: K, Q8 q7 P3 o# s$ p9 W
\App Paths\Loader32.Exe5 q5 X, [+ h0 M5 Z
3 j8 k% ~: \- o" K" e
" v# g: E! a' s$ R9 UNote that some nasty apps could then erase all files from SoftICE directory: l8 G/ g4 A7 Q
(I faced that once :-(
- }- z+ F$ v# R5 |
3 t0 v" {& [3 d. q2 ]5 IUseful breakpoint to detect it:
. x' N* }5 d7 c: T
# e4 i5 X3 K+ @/ B+ a: G BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'0 h4 b: g/ w" v6 B' g: V
0 x7 a9 H3 B" Y' x& E! P
__________________________________________________________________________+ F1 ^6 ], v# p3 X
{( |8 u; F. X* g1 u7 t3 C& `8 T0 g$ H5 d2 R6 D" _
Method 14 . q; }% V q9 A* {
=========
. g8 [1 H" \7 f1 `. \% }6 F+ w- d' u4 _
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
' S) ]+ E. j$ p2 G% q5 B1 X0 o! Y( Vis to determines whether a debugger is running on your system (ring0 only).
( [. t& z% m# @5 D. u! t2 Q9 B6 g8 Z6 V j9 ^, g# M W, C
VMMCall Test_Debug_Installed4 l9 {/ z, Y6 \# I. f3 J. K
je not_installed* H& P$ r x j" M5 S
J0 ~' o5 m. T& s
This service just checks a flag.+ y: g* w& s8 S4 U) o
</PRE></TD></TR></TBODY></TABLE> |