<TABLE width=500>% f# [* w0 Y. u
<TBODY>7 [" F. R0 P- u) `# a2 e
<TR>
5 x C$ f! E% a& t9 |& E! Q! d<TD><PRE>Method 01 . p. C: V! R" g
=========; d Q/ F) _9 `6 n" b8 t
7 l7 F5 N' V; q4 N5 v" CThis method of detection of SoftICE (as well as the following one) is# r1 k' O1 u' t% r4 b {. v
used by the majority of packers/encryptors found on Internet.
$ F. S9 s/ L3 D5 P, r, p; ]It seeks the signature of BoundsChecker in SoftICE
7 v0 W5 N& t+ a- J9 N( H1 Q: U& q4 I: A) F0 @. v' i5 V. t9 j) V" Q
mov ebp, 04243484Bh ; 'BCHK'
3 v/ N9 [* y V$ r+ D0 z, i mov ax, 04h3 c% ~. C& p+ f K
int 3 5 C: a2 }, t( E0 Y* E/ ^& S3 o
cmp al,4
) F3 j, z1 m8 G: Q& s3 x/ M jnz SoftICE_Detected
( j# v% P6 s# J8 c9 o
! |: t5 N) T; g; m___________________________________________________________________________
% x! S$ l# f! T/ b; P' o+ Q0 ~1 R: h9 W
Method 02
: }: e1 g9 q. o3 v# O( E# J=========
0 h5 Z* [/ H0 R7 w- X6 O% o" n7 e& Z8 h+ u6 @0 g) t* l
Still a method very much used (perhaps the most frequent one). It is used% Q7 G4 s9 R$ z$ @6 l6 b4 L
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,- c0 l& D8 M) I1 C4 F) b
or execute SoftICE commands...
4 s8 w: f8 P4 X' ~6 B' wIt is also used to crash SoftICE and to force it to execute any commands0 r7 H" [+ x$ ?5 y5 P: |9 g6 _6 t! h4 I
(HBOOT...) :-(( 2 ~' [: }; `$ O
3 m Y+ J9 W$ J4 z+ I; ^ _/ cHere is a quick description:7 R7 `) j& x1 ~1 S3 ~6 } q3 z* O
-AX = 0910h (Display string in SIce windows)( M; q. d& q* f, G( R: k
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
' V4 P( G! i1 L0 g5 E-AX = 0912h (Get breakpoint infos): _, b/ h( ?- [% N& t% ]! ~9 ^
-AX = 0913h (Set Sice breakpoints)
! s# z' o) u4 P, c4 F4 C5 i-AX = 0914h (Remove SIce breakoints)! O$ P$ e$ L$ B6 Z+ n5 p8 @& e$ C
" A+ d. X7 s0 x0 Q& m( r) {
Each time you'll meet this trick, you'll see:
3 M0 D- A) W0 I+ Y! b-SI = 4647h
% q/ a" m. V2 B-DI = 4A4Dh$ H2 n3 X5 S# T- \. v6 Q& I
Which are the 'magic values' used by SoftIce.% @" |0 ?* ~( W: T
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.$ J9 i/ q' S1 R: E; C# z# @- t
m* ^3 U1 v5 i7 R l- K6 M% UHere is one example from the file "Haspinst.exe" which is the dongle HASP$ a9 v4 z" \+ X
Envelope utility use to protect DOS applications:
4 H, {! ^$ ^( e& M8 G" o$ v1 [5 k5 x9 M% ^: i
8 n/ r& K; Q: |# Q K
4C19:0095 MOV AX,0911 ; execute command.2 [" Y) [4 [ y7 n( `- N
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).8 x& Y% O, I; L& Z* J# s& Y, V
4C19:009A MOV SI,4647 ; 1st magic value.
7 {- v" c0 O8 f4C19:009D MOV DI,4A4D ; 2nd magic value.
7 i0 W6 C( C( S6 Q4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
% K. @" {; X) G/ N5 k' _0 d4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute8 G6 u7 A3 h0 ~1 C9 n4 r* f
4C19:00A4 INC CX
) Q# v9 W( G }. u4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
" G3 G! P7 h: R! z; T8 c4C19:00A8 JB 0095 ; 6 different commands.9 v' V" x+ U6 d* n6 }( Z
4C19:00AA JMP 0002 ; Bad_Guy jmp back.
4 Q& U) H1 g. M7 ?9 v2 x& C4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
+ y; f# E$ {( E! B9 h7 z( \" q
- q# j2 D' v0 D! CThe program will execute 6 different SIce commands located at ds:dx, which
0 a, K/ w% p* ^ z1 bare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
" l, ^6 `& r4 D9 H ?# K$ j% r: S6 R5 I& }; I& T' r
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
5 ^9 a0 T$ W% z* }3 E% y4 i___________________________________________________________________________6 y4 p8 O8 v! t- j) t s6 v
" E ?, x+ A/ U( i2 e( M
3 P6 {* l0 ]. |
Method 035 w f s$ Q( b' D# o7 R8 J
=========) \; j; T3 E" D+ e" ?! L
/ N( [1 v+ R* ?: I, r& CLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
- M5 b% k$ O4 V; E7 e(API Get entry point)
# u' q& W" T4 z& y! B6 k* C : e$ o$ v) ~0 R6 A0 \$ V
# o! E L3 t, B" W& m9 Q
xor di,di* U6 }" d1 G! o2 a4 N3 [4 i; o: q9 K
mov es,di
. d8 U/ H f- E! X `* @* y mov ax, 1684h . n9 C2 l9 X* c% u8 w
mov bx, 0202h ; VxD ID of winice3 q, X" s' J' }
int 2Fh$ w# w$ b0 a2 d8 |& z
mov ax, es ; ES:DI -> VxD API entry point2 L9 h2 z4 p8 ?3 m$ Y0 a% i
add ax, di5 G- Q, \1 z$ `' H4 I
test ax,ax3 W% ^$ q. h8 p# S4 I0 Y# z
jnz SoftICE_Detected
' E5 `0 w2 J" z1 ~% o; P0 h; n ^3 @ q" O. k0 t0 a% W
___________________________________________________________________________
0 c v0 I+ R, O/ E0 h
( X4 f" }9 ^ } O7 dMethod 04
# S% J: W- Y* j# e; ^=========
- w) V3 O; z, G, e
6 ` M! n' Y' Z& h' b ^7 VMethod identical to the preceding one except that it seeks the ID of SoftICE0 P% j- W% U( V! L
GFX VxD.
, O! b" X8 e' p8 A0 U7 B X
6 V$ S8 l% v; p' B xor di,di) S. s9 {4 y) {4 ?
mov es,di/ P' c, i$ {. q& w2 I4 W* C- K
mov ax, 1684h + Y2 r9 P. N( M' M7 f4 l
mov bx, 7a5Fh ; VxD ID of SIWVID4 x' N8 J' r) w) t4 \/ a$ X
int 2fh
1 { s& q" C( q mov ax, es ; ES:DI -> VxD API entry point; g: z1 p" |% L( E9 a5 D
add ax, di
7 \% F# g7 F2 D- r$ w test ax,ax
/ n v- l/ m- w- }8 p8 x3 ^1 x jnz SoftICE_Detected
4 |* V6 x% T. E# ^0 G, q r- Z0 L7 p: m# L: _4 q6 v, }
__________________________________________________________________________
8 i. i3 S, V! }7 t7 h! T' ~3 r) _2 A7 o, o1 M% o5 \7 a3 t
9 p; W, _) c" {4 n& H; ?: u" c& ^Method 05
, D8 \" q; |8 m7 Q. w6 q=========
! a7 T4 ~9 G8 X8 W( N; }) g8 U) ?( C7 o& L! P/ C# h
Method seeking the 'magic number' 0F386h returned (in ax) by all system
$ b) Z( n" m' D8 u2 {0 C2 xdebugger. It calls the int 41h, function 4Fh.0 O- H' W1 _7 ?- `3 S
There are several alternatives.
3 I5 H/ T1 _1 t( S f1 _7 g/ e" Y( ^
The following one is the simplest:
4 h# n' @ @ o& h! f
a$ f, ]5 @; A) y! U l mov ax,4fh7 K0 q* A! J' G
int 41h
$ \5 N; b: k6 e- V; `7 n- i cmp ax, 0F386
; S5 h: k4 l5 }& t; q# | jz SoftICE_detected# Z% K6 U( A% {& i6 Y% u+ J& ~
. y! r. X u% E( E) y( q/ }$ s
" @8 G0 Q# Z4 X* P9 o
Next method as well as the following one are 2 examples from Stone's ; b# G; P7 |" N1 f9 X; @) S
"stn-wid.zip" (www.cracking.net):% C# Q1 a$ L* Y$ D/ c5 `+ O
) f" z! w3 k, k' ^
mov bx, cs+ Q# W- i9 O5 i1 w
lea dx, int41handler2* R9 p; g/ t2 V: \1 _4 D
xchg dx, es:[41h*4]
4 a& v2 A1 v3 v% ?" \2 Z7 H8 P1 P xchg bx, es:[41h*4+2]
+ L. v. I7 U% `4 i5 S mov ax,4fh
0 \8 W6 p' m& h/ g" z) d int 41h
% A; k/ o# k7 g0 b; n2 a xchg dx, es:[41h*4]) e( T& i+ V! i) M
xchg bx, es:[41h*4+2]' ?* m* }& m5 L$ H% i/ z. f7 t
cmp ax, 0f386h7 ~ w8 v( i( v
jz SoftICE_detected
6 O0 p* L. X! K$ P, u9 T# l7 Z' }2 l4 U1 ^' { h" A6 Y
int41handler2 PROC9 G" w* H. m1 t$ D
iret
7 c1 G( }( o' R" B6 C7 v g' vint41handler2 ENDP& ~* e! Z+ y+ E0 n9 L/ `* O" ~$ O& h% C
7 A1 t4 J5 C& @6 {$ `% c( S6 {; t: w1 ?" V
_________________________________________________________________________
5 ]3 I( E$ `7 E$ I6 N1 N4 z
0 M3 v% W! F0 y( `1 @! A1 E2 m5 ^# T
@, I$ X/ G$ {- e, _8 v- s3 L# ?1 vMethod 06
- A/ M3 W- @+ U* o9 H=========
: n6 \$ M* J1 b$ d' D3 F/ ~# C8 I0 N- P& V
. {) x4 Z1 Q( m* y. e9 N7 q) V' w2nd method similar to the preceding one but more difficult to detect:
+ f9 A! N) G' ^. E3 ^/ s4 P, @3 N9 K2 |/ F; B; n! w
' m( q) D0 b+ i
int41handler PROC, F$ V9 [: ?/ J) O
mov cl,al
- e% P" m$ y" _0 K1 J/ l1 | iret
# V- M5 y0 z1 mint41handler ENDP
. N0 @; R4 b. F( V! D5 |
; p6 ^" e. J1 _' S; l/ |+ F" M& R ~$ x
0 x# L1 a X" G6 r xor ax,ax: [. \" P: {. `3 M% ]7 B3 r3 m+ G
mov es,ax, E; I" E4 W4 D% m/ [7 j
mov bx, cs
/ D( `3 h: r% I lea dx, int41handler# Z9 x0 y7 {3 I0 U6 S& ^% ]; ~
xchg dx, es:[41h*4]" O+ g% Q7 t \! ?6 y( K
xchg bx, es:[41h*4+2]
9 t/ W4 |. e1 t: P in al, 40h" U9 i" z Z8 U4 q
xor cx,cx
* _* W2 Y' G. L; F u- k int 41h
* y( r2 H4 u# O/ {' S4 }, T2 q xchg dx, es:[41h*4]
* ^4 A( @) q7 F/ ^+ P- y xchg bx, es:[41h*4+2]
1 g5 d3 }5 n7 Q4 K* V$ l cmp cl,al
e5 ~% t( Q# r ~) A$ v) G jnz SoftICE_detected
. j- t" [9 _$ G* {. ?- j
; z7 t' Q: \' A_________________________________________________________________________9 O8 l( p/ {. A& Q# b5 z5 J
# A l7 A. `( q3 M8 h7 ?" E; R+ E
Method 07
: D) C* C6 r- E# I4 B0 u \=========
" t) I; L0 h; n) N* }; _4 {) B" A4 r/ d- w; I
Method of detection of the WinICE handler in the int68h (V86)
; r) X" C! L7 A) Y# D4 L
V: D# a8 @# B/ J' {0 y' c: h mov ah,43h
& s/ w* L z3 i4 D; w int 68h
2 \& f$ D( R* x. T5 ^1 h cmp ax,0F386h
6 U$ }: I* t% W& M# p$ J jz SoftICE_Detected
# P% v6 L4 G3 p
8 O( g/ O5 {$ G9 a# e# H
. Q/ C1 L1 ?4 E0 |+ P8 I=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit" M" U2 F ^3 R* S! Q* i7 V
app like this:
" U& L$ V3 C! B1 a G
( t. Z! }8 {0 N: A) m) ~& q2 ^ BPX exec_int if ax==68, v* i6 w: D0 ?/ c0 K/ v
(function called is located at byte ptr [ebp+1Dh] and client eip is
5 A+ ]* m1 O# i- A" K5 }5 B7 c0 S$ _ located at [ebp+48h] for 32Bit apps)' ], Z5 x( Y' m t& F2 w' Q
__________________________________________________________________________
: b1 o* R( L. C# I! Z9 C1 S! i& V6 F' s' a; p. ?5 D8 B
1 I$ Y L1 |& Z& p$ T- nMethod 08# |5 n Z' @% H+ v5 ^$ v6 B
=========* g2 k9 O/ i3 {9 C: U1 x
: x) C$ O2 ?$ Q7 oIt is not a method of detection of SoftICE but a possibility to crash the
! I5 @5 H, H+ i+ b3 j& X- |& n# k2 Bsystem by intercepting int 01h and int 03h and redirecting them to another+ ], L% E/ h+ l. K+ I
routine.- `9 T+ z0 |* t5 v* p
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
3 e+ d/ T2 O- |5 J4 x$ Ato the new routine to execute (hangs computer...)( n* \1 ]% [1 A; i
+ E6 O p1 u! X5 H! e& E
mov ah, 25h8 D7 k0 T4 k8 A* M: z# k$ v
mov al, Int_Number (01h or 03h)
% S v5 X3 v0 k7 f mov dx, offset New_Int_Routine
9 O3 G/ Y0 `. d: M/ Z& Z+ U int 21h
& ?* K1 \, {8 i3 U) x) L" {6 C) S1 ]; D& A/ c
__________________________________________________________________________
0 `: ]# b; A" b3 c, y) v1 @
5 N& z7 u% C$ g, n- g8 U Z+ lMethod 09! F {$ [) x3 k$ }' J9 L
=========
; T7 g/ q6 A8 y& x
' E0 h. r; ^* Z) V! BThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
6 N3 J8 k, m% y4 G' B* }$ ^9 d% wperformed in ring0 (VxD or a ring3 app using the VxdCall).
9 D0 X$ _* ^/ T; h/ p: F& [The Get_DDB service is used to determine whether or not a VxD is installed$ ]# v+ z* r5 L* p
for the specified device and returns a Device Description Block (in ecx) for0 \. }1 |( w$ b5 z6 b& r
that device if it is installed.& O: F U8 y A. ^4 x2 @3 |4 v
- m& Z8 O9 W l* t3 r; z. m4 d mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
- b" B" d$ C [3 L mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-) s8 K' [! S6 Q) r! |" Q. A4 _
VMMCall Get_DDB
# l0 N" P4 r: R7 {- r# ?% k0 I mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed9 x& k# D2 g- d& F( k
6 R) K1 D) o3 \) C9 m5 Q+ Q k! T
Note as well that you can easily detect this method with SoftICE:
" V1 v E5 ^- G8 |, b: k bpx Get_DDB if ax==0202 || ax==7a5fh
( e& x# ]+ D. n/ B: G; _ g& |; }: o4 K8 |" k
__________________________________________________________________________
$ A$ A1 o9 H7 I t, p3 \' D9 g. E
Method 10
/ I1 p2 k, X; B( f% z+ |1 }2 e=========5 i, ]( X7 N9 @* h
2 a5 o$ f D4 V
=>Disable or clear breakpoints before using this feature. DO NOT trace with
2 N8 Y9 p# D# @ d) e+ e+ i, N SoftICE while the option is enable!!
! D3 F9 w& \& N& k6 G8 |. p! I' c: D
This trick is very efficient:
! P5 q0 R: R! j& T; mby checking the Debug Registers, you can detect if SoftICE is loaded
1 S2 Q8 q/ v7 P5 w6 M* O8 C(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
+ c+ r+ K5 u6 b P2 x; I& r& l1 uthere are some memory breakpoints set (dr0 to dr3) simply by reading their
; G3 Y! V) n* Z. f* dvalue (in ring0 only). Values can be manipulated and or changed as well
$ a V/ Z- b9 h7 \% m" L(clearing BPMs for instance)1 T* b3 ]# f y6 C9 @
& f$ L2 S# o3 F( N' I& K
__________________________________________________________________________
0 n8 I$ f. I+ E9 P/ J" E1 H6 f5 a- p& t4 K' B" F5 D P9 T
Method 113 G& a# X2 p/ X) z2 n/ [. B& A# y
=========
% M1 a0 i( W: F7 \; N1 Q& O: L& b7 ]
This method is most known as 'MeltICE' because it has been freely distributed
' b7 c2 f) A* A3 U4 z2 Rvia www.winfiles.com. However it was first used by NuMega people to allow
5 s4 d0 y2 B# N& wSymbol Loader to check if SoftICE was active or not (the code is located& `! O4 V v K# C7 ~2 v0 ?" x
inside nmtrans.dll)., E) i5 F5 ]) p4 S1 u5 H' |
Z3 `* m5 _% b4 M! JThe way it works is very simple:
- X1 h+ a: S# S0 P7 }& A! ZIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
1 y/ i2 N6 t& V$ pWinNT) with the CreateFileA API.
$ |: D$ @ g+ S% L# |/ P# W# D0 `$ r; @2 M/ V. D; J& }
Here is a sample (checking for 'SICE'):/ _" ]1 R9 X' {+ h8 R* ]; q9 b
* I1 K% f5 |( i2 M, l" K
BOOL IsSoftIce95Loaded()8 `) B. O2 B3 f" H9 _; ?. {- t! ?
{+ o* a3 G1 u5 y5 u" K
HANDLE hFile; 9 B4 w2 `" K9 J1 u4 b* Y
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
' N2 k( l# m5 @$ I9 U' i$ F( {2 c& R FILE_SHARE_READ | FILE_SHARE_WRITE, ?9 G8 v) c7 T: A u4 Q6 s
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
: Z: L6 v. f1 a/ H1 p! [& B if( hFile != INVALID_HANDLE_VALUE )$ a" V" N& q' e( t
{
# G8 Y, `" l& \ CloseHandle(hFile);4 X( M' l& L' [1 i) m E& s
return TRUE;! c+ g2 O, F4 ?, h- C
}0 A0 ?& Z8 ~. G. u7 e8 v8 u1 b
return FALSE;
, `! @# d$ c$ g/ o4 Y}
' v3 U2 ~7 L3 Y- z0 `7 A. t9 ]7 P, M9 i) W
Although this trick calls the CreateFileA function, don't even expect to be
9 J* C; a+ k3 Lable to intercept it by installing a IFS hook: it will not work, no way!
/ o7 j- j! X- L2 iIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
% k1 w8 }( u. k2 _% Cservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
" |+ A3 n1 D+ H6 r: |and then browse the DDB list until it find the VxD and its DDB_Control_Proc
; K! d) P- i5 qfield.
% j7 l c: Y7 q1 DIn fact, its purpose is not to load/unload VxDs but only to send a # N6 O& E# E+ o' K& P
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
& c; l* K2 `9 ^/ n! g6 `to the VxD Control_Dispatch proc (how the hell a shareware soft could try: B& P1 |8 R+ N1 a/ m6 f
to load/unload a non-dynamically loadable driver such as SoftICE ;-)., }, z) r# A! s
If the VxD is loaded, it will always clear eax and the Carry flag to allow
+ x: V; Q% S& ]. @; N. {its handle to be opened and then, will be detected.
, U0 \4 B/ {* {( X4 m& bYou can check that simply by hooking Winice.exe control proc entry point
6 @# r9 x8 |' y& |while running MeltICE.
2 V$ S- T- f9 `) r t) c" r. Y7 F5 K) r! ^+ k1 V# G
3 f( r' ? K0 A1 M$ c* X, t
00401067: push 00402025 ; \\.\SICE5 f8 N" j5 H* D/ H
0040106C: call CreateFileA
- [" t4 l# s5 D) A/ ~9 | 00401071: cmp eax,-001! g \+ s4 O- [
00401074: je 00401091# R4 c t, N7 }: v
`3 Y1 b# j( v- s
( L* \4 h8 r: t$ G# _: g& y; QThere could be hundreds of BPX you could use to detect this trick.
' _ U: V8 m" ?1 g V6 l" l/ B-The most classical one is:- o/ w6 R& D6 g. {& f) M# `
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
' A* t a$ |2 Z8 E& d) ~' I' A *(esp->4+4)=='NTIC'
/ S, M' `. ?) }: ]5 U/ V1 z: r) X9 ?- B+ I' G2 m9 ^
-The most exotic ones (could be very slooooow :-(
+ a3 j- Z6 {" u& X' G) J8 D BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') + ? C! f" ~, @$ z
;will break 3 times :-(* N: J' z4 o/ e; @
% T3 b5 A+ `! C-or (a bit) faster: @' e, n& t8 X; V( _: c+ a
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
( u; Z$ i9 C. Q* ^6 H
: X+ y! ^) F; l$ u. k4 S BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
2 Z, n, ?7 r8 \; B9 I* o ;will break 3 times :-(" O- V4 A2 j7 z9 z
3 O: X3 B3 f5 B& E! B2 ^
-Much faster:: d4 Q4 r; f6 A0 T- N! I7 l) l8 e% ]
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'2 l6 Z1 C$ q$ u( i0 d9 i% W
* K3 i* r* |) c5 X
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
* ?5 E/ |+ l% o7 ]( Vfunction to do the same job:# G* {2 n$ C- G" ]. o7 g, q8 _% ]. M6 S5 V
( b# }6 ]' u# K% k# l0 J
push 00 ; OF_READ4 N& j' ^1 m0 t9 l; Z% c
mov eax,[00656634] ; '\\.\SICE',0
# p$ R1 o% J g' {( y push eax7 Q; M3 Y: o5 |' S$ K: e
call KERNEL32!_lopen' w: R& _( k. K0 T# p
inc eax5 z$ q \% a6 R! h; @) \7 A
jnz 00650589 ; detected
; r8 N% Y5 `) O0 @: _6 _ push 00 ; OF_READ
g* k; v" I& {( e1 m( \ mov eax,[00656638] ; '\\.\SICE'
" p# _7 N& R" B4 k9 v push eax3 q* l1 j6 L4 X1 r' |
call KERNEL32!_lopen
8 D3 A1 m6 u6 A5 ]( U2 c inc eax
+ T2 F1 @3 N D jz 006505ae ; not detected: v- q( X6 e- w/ G
2 i+ p4 c& E* e6 {) L3 ?) `3 h3 J5 G$ r9 L7 P4 l0 p
__________________________________________________________________________$ q& \# F- N" u+ @( V6 F( ]& q3 V
! h+ ~$ k0 I) e5 F5 t
Method 12
+ y& J! o+ w8 g' c$ ~- `=========
8 ]; M: J7 s; q
" `4 v: N5 ]/ _' ?/ S) XThis trick is similar to int41h/4fh Debugger installation check (code 05& p- }+ n% d4 W1 J) q, G( k
& 06) but very limited because it's only available for Win95/98 (not NT)
/ Y1 X! V$ F0 ^8 Eas it uses the VxDCall backdoor. This detection was found in Bleem Demo.1 j9 y! E: k( ? c2 \4 I d
) c, ]* q3 y- H push 0000004fh ; function 4fh
+ i3 a+ Y$ j6 w9 V R push 002a002ah ; high word specifies which VxD (VWIN32)7 k0 j' r$ v8 M- [- q4 C( n' f( K
; low word specifies which service8 R$ H- R4 J$ z4 c+ e6 @) z
(VWIN32_Int41Dispatch): `& f+ [6 n0 ?( |" I& s
call Kernel32!ORD_001 ; VxdCall# [3 e8 s' a b- i2 E4 G
cmp ax, 0f386h ; magic number returned by system debuggers
; L7 J2 P6 x% t6 s3 y- Z jz SoftICE_detected% t. E6 B( R7 e- Y+ F
# S* s. K! O1 m+ \5 ~0 E( Z0 [* Q
Here again, several ways to detect it:3 [. h& o" t7 j4 Y3 x' d
, y9 t6 s( u8 ?' X& C BPINT 41 if ax==4f
# c- Z% R5 X; M+ E ~. g9 E3 s! q- i2 G
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one* ^3 ^+ y8 D, n9 s- R- g
) E- e H4 C' W1 _7 U# y BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
5 |- }% a0 K* L! J. I( Q8 A! u. L7 G$ V6 @. U: w: A0 T; T
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
# z2 r4 s I& Q8 c+ ?8 h+ X9 h' s" d7 t* K( r
__________________________________________________________________________9 R1 k# {( F" `
" t, u. m W" R! E- fMethod 13
2 t7 q) n) L- e$ d=========
" I' P9 N9 M$ u# L5 A1 X
7 m+ [, D9 B1 c: C$ n6 T& W* dNot a real method of detection, but a good way to know if SoftICE is
$ @3 F, B# @0 _4 A- sinstalled on a computer and to locate its installation directory. |- t( F; k& p% E5 _! ?3 \: S
It is used by few softs which access the following registry keys (usually #2) :
4 a1 }9 z. }( K; A, g" ?' {$ Z. C+ q) H4 C( N
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
* D9 `2 B# `! |' \ Q\Uninstall\SoftICE
+ F, m& ~) l& s8 e2 Z4 a-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE) |0 h9 D+ h$ d$ k8 X% J2 x5 {
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion" g" b# x9 ?+ M, X2 b8 u
\App Paths\Loader32.Exe
5 `& c+ F+ j1 h7 b/ [1 ^+ e# J7 b& H/ s
# S6 p% P7 x) M1 t
Note that some nasty apps could then erase all files from SoftICE directory
( J3 c. `# n! ]: J! n) k+ ^3 h(I faced that once :-(6 w7 R6 {' T1 ?9 _5 Z- c3 [# R
. _1 n2 D1 A( J7 }- `
Useful breakpoint to detect it:0 {9 T; V3 S5 S( ?& ?' h6 F6 l- L
: K0 _- @0 o; q' c6 T# Y BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
: c& B; p0 \2 X+ _) b+ k" L
4 n) o( F% ~/ J: C$ i__________________________________________________________________________
M* F9 ]$ S) E2 m. P3 e$ m8 S, J7 b/ \. n
) v, P3 F- q% kMethod 14 , w; k5 s0 T5 I" v; h
=========& h$ n( @# e+ z9 d& s, p
5 l8 O. _, K3 e9 q, ?4 ^# gA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
/ U% o( n9 D" p9 }6 P2 O5 Cis to determines whether a debugger is running on your system (ring0 only). i; S. R0 }" T- f% Y. p
0 B$ }5 I4 ]7 L+ s5 { VMMCall Test_Debug_Installed* s& D2 L2 k& E7 ?8 F. A+ v ~& F
je not_installed
' T# D" s& A% U1 h* X. y3 U! ~& e: C. h3 l% ]' B0 C2 Y6 P$ q
This service just checks a flag.. d5 j n/ F8 d" R
</PRE></TD></TR></TBODY></TABLE> |