<TABLE width=500>
+ E6 K4 d. W `$ D4 c t; H: \<TBODY>
$ E$ m1 q6 g8 p) H$ J<TR>4 Q, w+ |% E. q0 n3 x/ ]
<TD><PRE>Method 01 R6 n' x" e% a6 l0 h: {8 l
=========5 k' A W$ z; A' q
. C4 o% z, a" p' _: i6 \) h4 f S& NThis method of detection of SoftICE (as well as the following one) is
2 m# J' k2 Y7 O' O% Eused by the majority of packers/encryptors found on Internet./ k0 `% h1 q: @% W4 x. ^
It seeks the signature of BoundsChecker in SoftICE
# X }& K% h4 l& g, Z: v* m
- R( G3 g6 X; m3 X" _8 L" S5 L mov ebp, 04243484Bh ; 'BCHK'4 p4 r! z; D6 x- ~/ B3 c
mov ax, 04h
0 ]" n6 n5 z2 a: I4 m7 @9 a int 3
) {: B& z5 o: u w2 a* ~$ Z9 W cmp al,4% O2 @0 A! {; D( M, e
jnz SoftICE_Detected
) g! W6 u: L! t6 Y3 ~1 T) P" g* a2 v |* _! S. Y0 C
___________________________________________________________________________
% }. |) J1 _. j* X. x2 Q' v% c Y J7 g8 P6 _5 ]
Method 02* ?! d# e5 b! b- ~
=========
) |) m5 R2 @/ k+ P% P. S, [' H
7 N5 L" T+ s' q! b6 ]Still a method very much used (perhaps the most frequent one). It is used" I! G# s4 u1 o
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
4 c7 |; f; c3 ?/ o, q4 Dor execute SoftICE commands...
9 t8 Q0 h$ d9 i' G8 oIt is also used to crash SoftICE and to force it to execute any commands2 c1 g! ^! |8 W
(HBOOT...) :-(( 0 S2 J1 m7 h2 n6 v
$ _) Y9 O: O2 Q( Y3 ~
Here is a quick description:9 B9 V+ k7 `2 u# `" h
-AX = 0910h (Display string in SIce windows)" Z7 y7 s7 ?$ h5 H; ^' y4 \9 a
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
3 X+ D8 F# e4 r i-AX = 0912h (Get breakpoint infos)
$ d8 [ r" G5 Y# f' `$ |% W' X-AX = 0913h (Set Sice breakpoints)4 d- ~- v" B$ B3 f
-AX = 0914h (Remove SIce breakoints)9 N e* B8 ]% r: x- b8 ?; e
9 E& X' b! C+ Z. a4 J) }$ N4 s- GEach time you'll meet this trick, you'll see:
1 w6 n7 F+ m: E-SI = 4647h
; z7 l# s: o" ?5 _ G-DI = 4A4Dh
# ]" S2 M6 A9 \; A6 j% w; x$ e1 OWhich are the 'magic values' used by SoftIce.
% o4 ?6 Z6 U7 u3 W& gFor more informations, see "Ralf Brown Interrupt list" chapter int 03h., m) z3 L% m7 P8 [ A
4 A# D: g% ~* q6 w9 z4 x" \' J# [
Here is one example from the file "Haspinst.exe" which is the dongle HASP* o& h7 Y& X: j# b9 G H2 \
Envelope utility use to protect DOS applications:" S# ~2 Y R5 c1 B* K/ o s9 {3 y
7 d/ O" c6 m3 H1 r8 U, D1 M8 g
! c! d7 u. z# H$ I0 V$ |4C19:0095 MOV AX,0911 ; execute command.3 m' |) o0 F# \" c0 [) y
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).: Z$ D2 |& s8 Y) x; e% b( A
4C19:009A MOV SI,4647 ; 1st magic value.& O8 c' Q7 \ E. p/ a4 B
4C19:009D MOV DI,4A4D ; 2nd magic value.7 u( U& b& p- {8 l
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
! l, o( s. M# c9 | g: q, \4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute, x# P: g4 Q0 w9 F6 F. n/ H
4C19:00A4 INC CX
U5 ~/ Z. S; h8 a1 g9 |3 [3 Y/ @4C19:00A5 CMP CX,06 ; Repeat 6 times to execute. M, H1 O- s; }, i
4C19:00A8 JB 0095 ; 6 different commands.
{/ ~7 Q( @. O6 o5 }, u4C19:00AA JMP 0002 ; Bad_Guy jmp back.' M" O! i0 D/ ?- Q. g0 C% e9 K# D B
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
% \: g! q0 L9 P/ B. u7 y& t( s$ k0 F( e8 L2 P6 K& s
The program will execute 6 different SIce commands located at ds:dx, which
/ Q. e7 h" B2 ^! y3 [are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
+ c" p! ?) B1 ?( x. }+ w; [5 t; T- Q4 o
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.' \* w* Z1 W* L' {8 b
___________________________________________________________________________, F7 y7 y* O2 ~: O3 k9 [
* W2 l' B4 T' k
, G3 Z5 U3 u1 Q6 G6 c* ]; y2 ?7 FMethod 039 i' m9 |* ~' T6 X: _) ^! ]8 i
=========
) g8 M$ p/ f; H& H" ?) @5 v. E& T- I: x6 m! Z
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h9 @4 Q! T5 u! V( F& T
(API Get entry point)
5 _4 S3 c$ K3 P2 z, i& ^" e1 n E
# Z0 Z: R( o+ O4 F9 S, T: a1 M/ ?8 x; G- Z" D" T
xor di,di
8 n e" v5 z+ L0 o8 r7 n mov es,di6 N/ `* B# r; o
mov ax, 1684h & h8 e& y8 s$ n% C, h
mov bx, 0202h ; VxD ID of winice' V, ~6 V% K! F9 ?! K
int 2Fh% N2 g1 G) @8 Y. {6 ]
mov ax, es ; ES:DI -> VxD API entry point. U3 ]4 |' n9 K0 o1 w2 w
add ax, di7 T! E% @$ ^- c. T& g+ M
test ax,ax% p) B1 P' a6 s6 W$ O
jnz SoftICE_Detected8 G4 u9 Y1 g! k
: k. h, N& Y9 T" L( u4 w& k
___________________________________________________________________________% |' ~, q/ r+ d C* _0 I# P
9 h- R5 r$ Q. ?6 b2 g
Method 04( W/ N, Y) s1 O8 N. [3 o! m# S
=========/ K- J- ~6 a8 m/ J
* o" }/ d% ~" D; S* P; |! _# ]1 ]+ rMethod identical to the preceding one except that it seeks the ID of SoftICE
Q+ G! |& Z- m5 `+ |: G0 w# T3 lGFX VxD.
& G0 L" ]4 M1 P6 [ ]& q- A6 K1 e/ t; U. B% e
xor di,di8 M) i* B$ W' v( G
mov es,di
5 D1 G3 N6 T% P; v7 \ mov ax, 1684h 8 y5 j; i2 ]4 d4 J
mov bx, 7a5Fh ; VxD ID of SIWVID
* p* W& f1 p% p- T$ C int 2fh
7 h( P4 A1 l& L: |" P mov ax, es ; ES:DI -> VxD API entry point
|9 h' N& [5 I, {8 l add ax, di
7 v: m( I7 c9 K8 { test ax,ax
: o3 A; h% }) K3 D+ V jnz SoftICE_Detected
! Y- w- H" @* w5 D8 m6 w0 _
; }4 `$ ^" @0 s2 R: d) u__________________________________________________________________________1 W0 Z0 _( f% N9 P' @8 x( V6 e' `
/ G8 ^! G+ _( ~4 B
- G$ I. q6 r# P4 i
Method 05
& B$ o* d, |. }1 \% _: Z=========
% c9 @8 ?1 _( n b- H B$ d4 X! l9 Y# E# ~) x) _( ^
Method seeking the 'magic number' 0F386h returned (in ax) by all system
9 T8 x2 b4 P. \debugger. It calls the int 41h, function 4Fh.4 k2 |$ C# R( `' B, g4 b' g
There are several alternatives.
- S) R! G, E _$ ]8 R6 b- v
- }3 `. @) @; I9 }) t0 w% ~The following one is the simplest:: M. d0 U5 G$ Z0 r: V
/ D7 A0 i" V0 q6 P4 @" L; n4 D mov ax,4fh0 \6 W( I0 J. U% A% k8 B* y/ Q
int 41h
$ T) q- f T7 B: f8 l S+ e* { cmp ax, 0F386. D& I6 T$ V. C
jz SoftICE_detected L2 C4 s& f) m' M# H: D) w# s
5 B2 k: `5 I" g; U c% R* c- v$ `, t) I0 ]
0 a% b' R+ {( @2 M7 |3 d/ `' B
Next method as well as the following one are 2 examples from Stone's / d$ u3 w$ s- G; B
"stn-wid.zip" (www.cracking.net):
* E- H% ]( g' j6 h6 Q4 ]6 ~) i0 [% _! w5 T( } f
mov bx, cs
! j7 P6 j* l5 u- i, N; N2 _2 c lea dx, int41handler24 \5 t; I0 F& }
xchg dx, es:[41h*4], T T0 N1 a6 I0 H& X
xchg bx, es:[41h*4+2]
9 ~' \ M/ f1 e mov ax,4fh
% x- l4 o2 m7 O* j0 t; } int 41h
# T8 @: s! A& ~5 \ xchg dx, es:[41h*4]( F! Q8 b8 c0 B" \0 A% }
xchg bx, es:[41h*4+2]- R% h1 J, S& z& V7 t$ p
cmp ax, 0f386h
1 w. p2 m2 ~# w Y/ ` jz SoftICE_detected
& |) K7 I: x7 `9 w( r- D0 K' J
" l: J! a! b5 I* B1 X* s8 R, Z) Gint41handler2 PROC( h7 H/ U& h% x' y" D
iret
2 N. q7 ?7 D" m9 b6 x! y* Jint41handler2 ENDP8 C: h _2 M; @2 ?' p6 M5 B+ Q8 r
" P6 T% a/ Q4 C- U E5 {, _7 Y$ U1 l* M/ J x+ O
_________________________________________________________________________
5 L4 ?. N3 ?7 X% H) Q1 I3 ^% M2 O- K- P
+ S3 S* p: z; U. H' ~' L4 M4 |
Method 06* X8 n2 q* N K2 o& c1 @* \6 ^3 ?( D& Y
=========, n: i( Y4 I/ P2 B Y% w; X
3 R5 G3 H7 P" h! P% r( S+ z: ~- N j: E
2nd method similar to the preceding one but more difficult to detect:& Q# Y- h7 n& x
5 x3 f3 `" E1 L8 y5 G
8 ]; A/ U/ E# o( u& t0 Y f5 ~$ \$ aint41handler PROC
' ~8 J! [* {" X mov cl,al
8 w6 n( Y" b, M9 N iret( ~. t4 r* C" |* J6 N
int41handler ENDP
! k4 Q6 k( o" |: S
) j& H5 p. R1 ^" G" l% p# K9 N5 T; \5 Y+ A, b7 O
xor ax,ax
2 X: u3 r9 M8 o7 b& p, \; r3 P( P mov es,ax b8 z( c! d h
mov bx, cs6 c8 [. J' _+ I, K! s& k
lea dx, int41handler
* C N4 r3 w1 J. L7 W u1 \; L xchg dx, es:[41h*4]
& }& @% d" a6 X& b xchg bx, es:[41h*4+2]
4 F/ x, R9 {- C) c( s/ [ in al, 40h
5 v$ I i# E" Q% K4 f xor cx,cx
: [5 \8 R- B% m: M int 41h) [3 ]' W0 m" J
xchg dx, es:[41h*4]
& o8 w3 S3 w6 V1 d n" ? xchg bx, es:[41h*4+2]
7 |3 X; ]5 l+ y- i% s: c3 t# z" ^; | cmp cl,al* z5 n1 x) U) S: y* Q1 L6 N
jnz SoftICE_detected
9 X5 p9 W9 d l$ {/ B b
, o9 \3 r4 F3 d/ ~% a2 __________________________________________________________________________: A7 S3 X: I) A, L
/ \6 y0 ]( R/ ?6 G0 D' ]) ?
Method 073 d0 ?/ g/ a4 \% N9 J8 Z
=========
9 Q, t; C6 w& C8 G. i
* ^# y& o) L& KMethod of detection of the WinICE handler in the int68h (V86)
, v/ Q7 h4 Z) c1 i2 J R. g O, k4 c2 b$ R
mov ah,43h! j) e6 ]& {) F! M
int 68h' q0 p& V' c6 z4 j, X) N' {7 m5 `8 y
cmp ax,0F386h. M$ Q; x) _! z# J; ^4 l6 `6 J
jz SoftICE_Detected' e" J* ]- ^0 ~8 U. V1 n
- t5 u) q! L1 a1 ^+ s- v& P
+ `0 v, B" G, c3 b$ W q=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit2 \! _) z. U2 R" e9 R
app like this:4 j" a2 m+ T- W9 R
) D' z$ L. l: X& v# g3 t4 w( |0 ? BPX exec_int if ax==68
) z2 O$ d) V; e6 v0 c5 c$ U1 e2 X7 p (function called is located at byte ptr [ebp+1Dh] and client eip is
" b8 o7 f; ]1 F" V5 i located at [ebp+48h] for 32Bit apps), U) U- @4 h7 x
__________________________________________________________________________
; a0 Z0 p) R4 X* I
2 V! l) _/ q1 \+ I! H- u5 b' U1 p+ }1 O( V6 Y& s% r1 P4 _5 m; I: G& P* z5 D1 _1 [
Method 08
7 O( L! F3 }4 o3 s0 r=========
8 l9 q$ z) i% O- @; z% d9 r
5 i+ [. P6 v- }+ HIt is not a method of detection of SoftICE but a possibility to crash the3 I7 g' u( p/ Q' e& l( l/ m; b: r
system by intercepting int 01h and int 03h and redirecting them to another/ P7 L6 @, A" Q
routine.
* G. i0 _! f! u1 y5 v. \& zIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points c6 ?! I0 y& D4 Q' t8 Q
to the new routine to execute (hangs computer...)
- o/ R$ Z- d o8 @8 W6 k5 D: z" T: a
mov ah, 25h7 j5 O% R- i# u+ N3 S4 S
mov al, Int_Number (01h or 03h)
* i' j# ^' c: D5 a7 S8 ]% e+ R mov dx, offset New_Int_Routine
: t5 m+ }& @1 R2 p! J# f e: u int 21h" E2 I: y2 O6 e- ~. D/ v
( f% J* ]8 a: |8 v__________________________________________________________________________
. r$ a: k) I2 J' c8 Z) U; i, C# z- T! f1 H# } H4 g( N$ N7 B
Method 09- m, e7 N7 ]6 [' P# `1 F
=========0 o. W7 }& `) \$ C! P
0 q$ v! R* X3 G) | |
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
6 j l- G2 ?3 |performed in ring0 (VxD or a ring3 app using the VxdCall).
8 o- p4 b8 ~& f( eThe Get_DDB service is used to determine whether or not a VxD is installed
# I% f: } x6 ^7 tfor the specified device and returns a Device Description Block (in ecx) for' k5 O. j1 z2 r( \5 E
that device if it is installed.& J# c9 T4 ~/ _* v
) u) S6 P! C9 j% s+ m# I mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID: M5 j2 Y9 K9 j9 `; i
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-). Q& W* X$ D; ^8 J+ L% `
VMMCall Get_DDB$ k6 ?( Y, x6 j% c- @# P/ ^/ Y
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
; B) T& F8 Z& W* u4 ~( H8 ^- Q- e6 c R
+ @) W( ?# W( |9 p+ ^Note as well that you can easily detect this method with SoftICE:
' Y% M* y" {9 ]5 }! _ bpx Get_DDB if ax==0202 || ax==7a5fh
# ^: C$ S" X5 o. h8 ^
& T7 j/ H% i# N- J# c__________________________________________________________________________
. \* @4 M A% s. h
8 S, v, E W; w6 n& t6 k' AMethod 10) E, _5 k3 T) X+ [* m' _
=========
& F0 D/ N" M: D8 i2 l: C
. E% U" H/ H+ i) P- c& P: S; b=>Disable or clear breakpoints before using this feature. DO NOT trace with
+ l8 P! w) \% p; r1 Q; A SoftICE while the option is enable!!
* s$ R- r1 X0 ^# S3 C; {" [$ J, T4 |- z- {8 F! l; d
This trick is very efficient:/ p6 a! r8 x' G6 F" t+ F0 w7 Y
by checking the Debug Registers, you can detect if SoftICE is loaded
- n) r! O; e8 T(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
6 |/ G- [, v8 f2 [" {8 j1 ?there are some memory breakpoints set (dr0 to dr3) simply by reading their' V# A9 J: C7 |- m8 r( F
value (in ring0 only). Values can be manipulated and or changed as well
5 c2 u0 w, [8 d" f; D; r(clearing BPMs for instance)
9 Q4 ~* @, T/ F& W4 [3 h
* J* \" t" Y8 I; z__________________________________________________________________________3 ]/ b3 Y0 l- {* \8 j4 r
7 d8 Z7 @2 g* U0 h! C0 f" k9 s
Method 11: s8 E, v2 X* d( l
=========* @# _' Z5 u- v2 u
7 I# ~) w% K4 F8 g z s+ F
This method is most known as 'MeltICE' because it has been freely distributed$ `' p( F8 D( ^# @' Q
via www.winfiles.com. However it was first used by NuMega people to allow1 J! E5 w# t+ X: Q
Symbol Loader to check if SoftICE was active or not (the code is located
, u5 y3 m: f6 | H% k4 v6 E- {inside nmtrans.dll).' d8 k) l* |9 x3 L* {
. k- i; _: q; o6 G: FThe way it works is very simple: ^5 p/ L& t) R" ]# l [6 L% E
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for" R# Z9 j/ j" P9 m/ ~, v$ U
WinNT) with the CreateFileA API.3 H) x6 G" f/ Y0 ^; \& ~
2 s, Y6 p' ]$ u9 Z+ }7 AHere is a sample (checking for 'SICE'):
+ O3 ~2 a: C! N; e" t, _
5 \- n# O0 q, h) q) |& @BOOL IsSoftIce95Loaded()
& l) A% {. {4 C' S{
3 m$ q8 o9 A4 p! a! e. k& N% @ HANDLE hFile; + H( p+ B! }, y$ S* i. h' g5 Q
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,& R' D3 h& I' G7 I8 R% u: S. l" C
FILE_SHARE_READ | FILE_SHARE_WRITE,
0 x1 W0 D. {8 l2 q NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);# e% A& D5 }9 W; o& q; ]
if( hFile != INVALID_HANDLE_VALUE )
* h9 k2 d1 e8 }2 Q' ^ {
- ?% v& d# ~* j# c& ?" E CloseHandle(hFile);
1 X* y6 J z3 v! c return TRUE;7 G# o, q w! H, W8 S
}
. _: {, @, ?# ]8 j9 Z5 g return FALSE; C# p* f1 f5 l; g R
}; z% [/ \" d0 k7 T
# v+ x; j3 e$ N! o4 f
Although this trick calls the CreateFileA function, don't even expect to be+ ~' r1 ~8 A" _" L% k: J) m
able to intercept it by installing a IFS hook: it will not work, no way!- T6 U7 b i; P) A$ _
In fact, after the call to CreateFileA it will get through VWIN32 0x001F& y- V9 r6 v5 p N( t2 r' L# V/ \
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
0 E2 D# p( s' V2 }6 Gand then browse the DDB list until it find the VxD and its DDB_Control_Proc
# j8 |6 ~* R2 Tfield.
/ Q# s* o7 I0 J, W& w( S9 sIn fact, its purpose is not to load/unload VxDs but only to send a
2 a) l4 t4 e) W% r& @+ Y2 AW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)4 l* B# ~3 T. _6 z
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
9 |5 k3 [3 W. F8 F3 M2 Jto load/unload a non-dynamically loadable driver such as SoftICE ;-).. q- T" m7 Q7 d. @
If the VxD is loaded, it will always clear eax and the Carry flag to allow, }+ m* h+ q9 O9 r. x& k! L
its handle to be opened and then, will be detected.
4 A2 \- F$ A+ ]% P! e) ~You can check that simply by hooking Winice.exe control proc entry point( |* h4 ~0 ?$ R; y$ m5 B( S
while running MeltICE.8 a, \1 R. B# m% O( f! v6 ~
w R& c3 ]$ Y S+ {, c) B( ~, c: I) Q9 K% b P
00401067: push 00402025 ; \\.\SICE5 v8 `' \6 |; B8 j7 K
0040106C: call CreateFileA
: s7 v V4 S/ ]! i" B 00401071: cmp eax,-001
9 V4 g# l( x1 N- i 00401074: je 004010916 k0 V! \* N" n" Z. Z7 N/ F
: ?7 k6 _( @5 l4 H6 K/ u- W$ w: U+ k ^5 k" @/ l
There could be hundreds of BPX you could use to detect this trick.
) [- H8 t+ G; o6 \, F! O5 p* h' h-The most classical one is:5 I+ L' \$ n; y, A3 R$ c
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
/ D& q2 ?# t$ A *(esp->4+4)=='NTIC'! j; e& ~' f' V5 x3 x
& R) C% r+ k7 u$ n9 ? ~-The most exotic ones (could be very slooooow :-(( Y% {! o5 O! X) i' i* T9 B- b
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') 3 x3 k9 P% S, s. d
;will break 3 times :-(
+ L, }, M A7 T; r3 D
; z( u e0 @! [3 c4 }, I T-or (a bit) faster: 3 Y& |1 @2 [' h& m. T
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
" ~' D# ~8 @* K4 z* s: |4 c3 L1 b4 E' z9 V' x
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' 6 F0 ]7 I6 P3 V$ \
;will break 3 times :-(: V" d ^) u) L6 n. ?9 A0 K
7 z, h$ M% c7 P. b
-Much faster:' r- O) m2 X2 H" d" |, a
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
. E: q }; ~9 z% X. o( }3 S
. N* F9 s+ P6 x& ^3 k- S$ KNote also that some programs (like AZPR3.00) use de old 16-bit _lopen" D7 V" s0 F; M( w6 b0 o/ N
function to do the same job:
( ?6 q7 D$ U6 w& K& D: m1 I& g3 z. ~$ y$ ]7 \1 \; v. a
push 00 ; OF_READ. V0 M2 J- W P K. Y, v1 T
mov eax,[00656634] ; '\\.\SICE',0: @* X0 u% Y5 G( i
push eax
W8 b1 J% ] t call KERNEL32!_lopen4 j. l$ y) }3 W1 v! F+ U" m' i
inc eax ?# Z7 \- ~ \7 { ]
jnz 00650589 ; detected4 Y, n5 x/ ` H+ d
push 00 ; OF_READ
8 Y; E- K4 O, V9 F3 { mov eax,[00656638] ; '\\.\SICE'
4 A/ N' |$ a- R7 | push eax4 |" c L1 O$ l# M' x/ e9 R
call KERNEL32!_lopen
0 o9 }4 `3 O0 r) Z' Z% N inc eax# k5 I3 P! h, J4 j+ N
jz 006505ae ; not detected
- U: }1 C( d+ b' }- G6 ]1 G4 y) }( `+ \' M& f
% \, p0 h' }3 h) @+ o2 }/ B
__________________________________________________________________________
/ ~) C9 ]# A& W- q( y
# e! y' f" E7 mMethod 129 ? P' m) D, {. I( Z' z
=========$ e0 t; l ^, u% s' X. C
$ u w. E5 b% iThis trick is similar to int41h/4fh Debugger installation check (code 05
, N- Y- [4 h( R/ Q) j; ~# Z2 K0 ]) I& 06) but very limited because it's only available for Win95/98 (not NT)
/ b; K; w q! d$ R/ \5 Qas it uses the VxDCall backdoor. This detection was found in Bleem Demo.
1 h7 u. f0 }2 K2 F3 s" F
5 l1 l" U8 e' C( S0 M; }+ R push 0000004fh ; function 4fh
8 n$ ]) p6 x% u9 B" _4 T5 o. d push 002a002ah ; high word specifies which VxD (VWIN32)' ^# Z% x8 y/ l: X0 w" M. E
; low word specifies which service; v. L+ N, t: [- V
(VWIN32_Int41Dispatch)
7 ?+ [" \& i' u% O; ?* w/ y+ {$ F call Kernel32!ORD_001 ; VxdCall
7 o# b$ q- {% J( a# [- b z" T8 S cmp ax, 0f386h ; magic number returned by system debuggers
+ \4 S- j6 Q5 N, v8 f1 U( s jz SoftICE_detected9 A. {6 K: W: M7 v5 @! n% l* ?# D; M
: Z4 |: x! H3 f; x/ k5 X9 F( j k
Here again, several ways to detect it:
7 n9 k$ a- [! f8 z) ^) M. o0 @; M+ t4 L4 C; S9 k+ R& t* B2 a- B- m5 ?
BPINT 41 if ax==4f, t/ P& m+ C; l2 z
& C& R2 e1 T6 i6 q; D" Y. V
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
% b8 L6 M+ }% S( ^: h7 n+ V3 }9 I- T/ k/ A5 `! W( ~8 F
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A/ o. v( D ^" A2 G! V/ _- {
8 D; a2 l; J) D0 Z2 C& {- t% S
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!1 C+ X6 p, ^5 B% v
% \1 |4 K5 t7 R# k7 A7 R4 v
__________________________________________________________________________- v# r% ^" w6 ^+ W
; B4 n: s& }$ U# mMethod 133 k3 S( d% X- I7 P5 U5 }/ S
=========6 M( U1 W/ y5 `/ j2 Q
$ S$ ?; z$ n1 tNot a real method of detection, but a good way to know if SoftICE is n8 w8 f* P+ A" x) C/ D A
installed on a computer and to locate its installation directory.
5 b2 r1 E5 i3 S/ c& M+ E$ QIt is used by few softs which access the following registry keys (usually #2) :
- o1 a( p- R' F8 h/ Z9 ~
, P r8 g# `9 S( Z+ r# P-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion. L8 {, k. B+ i: X
\Uninstall\SoftICE: s$ Z! g# e& w" h$ c
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
7 C. u7 h( ~9 s3 y% @8 K: ?/ G-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
4 u5 B3 w4 Q4 _$ B& j6 Y( g\App Paths\Loader32.Exe
4 v8 f& A6 k0 |; [5 ?4 w0 o5 Y0 S4 W7 z6 `, F
$ P+ d& F: \5 C2 b) wNote that some nasty apps could then erase all files from SoftICE directory- M$ F$ [& O, o* J
(I faced that once :-(% z4 I/ t+ z# ^$ Y4 a6 x
: P `: |7 X% P3 J: rUseful breakpoint to detect it:
6 x2 a0 e( K5 u: X$ \7 X6 C& Q- B( A. `! |' _0 B
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'3 B6 O8 n: t3 i5 @/ @" A" M$ B2 d
' M- \2 Y+ `" i7 |8 O* b__________________________________________________________________________
W0 W2 [1 p$ w2 j: U6 i E: W3 g6 r) v& O( J# B
2 _8 n) C. z: cMethod 14
: E, h7 } S1 l$ H9 S |# Z=========
4 B% v( L, r% ?. F& `1 ]* W/ N* C6 x( e# _' G5 }
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose3 f) } n' t% m2 F1 d2 a3 [
is to determines whether a debugger is running on your system (ring0 only).! O4 N5 ]* X2 A
' O5 ?. j7 q7 G1 v7 U+ v. b VMMCall Test_Debug_Installed
4 U8 `3 _4 \- p% h* ]- R je not_installed
* g$ ^! K5 c5 d% E/ I
) x. l: Y0 R. b; P9 \2 E( U/ F' _This service just checks a flag.. u3 W8 J/ a8 R3 r$ e9 l
</PRE></TD></TR></TBODY></TABLE> |