<TABLE width=500>. V# |# k5 x+ E
<TBODY>5 G& ^6 `, R/ v$ C' E# r4 D: g# ^
<TR>
8 K }+ w. d& [# P. a<TD><PRE>Method 01 $ m6 r, h9 C. A" q7 j% N0 p& i @
=========
$ M- a+ g5 }: v0 m* I! ]: B! z5 j0 C' K1 a: k4 E
This method of detection of SoftICE (as well as the following one) is5 k4 w0 `- i i& B' f2 e4 z; C
used by the majority of packers/encryptors found on Internet., A3 j2 T: p/ D
It seeks the signature of BoundsChecker in SoftICE, s* Y, \+ H' Y2 t7 f7 H' p% w! u
7 J: m& T, W0 X' h% f
mov ebp, 04243484Bh ; 'BCHK'0 s+ r% b: ^$ K. ?' m( W$ q
mov ax, 04h* ^3 ~ u. M. r0 q- k8 _3 M! ] `
int 3 0 A6 P3 n/ g! x' ^6 v( c# m9 E
cmp al,4
5 r! b: M8 [; h+ s jnz SoftICE_Detected
! a5 G: e4 Z6 @5 N! i5 Y# n6 d
. F3 Z4 ^: }; J- ]___________________________________________________________________________
. u W3 M3 A# b1 A8 x5 D% }3 [/ J3 D4 p
Method 02) b0 @% [+ M+ b2 r
=========% a0 k, f! W0 N/ \
% z7 a" C. P# H4 d0 }" @
Still a method very much used (perhaps the most frequent one). It is used
+ a E& ]& F- ]# H) Zto get SoftICE 'Back Door commands' which gives infos on Breakpoints,. I! x) a4 y4 w
or execute SoftICE commands...
6 k: W: E- h Z$ rIt is also used to crash SoftICE and to force it to execute any commands
$ I* I4 K {; ~2 U0 w. x(HBOOT...) :-((
. w- [/ E- F4 D( ]1 }. d
$ c# y c I. k" e5 f' T( s& ?' j( pHere is a quick description:
1 e% H- ]& S' q* p. P: i1 D1 M1 t-AX = 0910h (Display string in SIce windows)
3 C. {* V+ f; V" d-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
! |' l+ { R5 F; t/ H4 w: }-AX = 0912h (Get breakpoint infos)1 c* e* A: n4 I% r1 c) N
-AX = 0913h (Set Sice breakpoints)# i7 B& L: {6 H- E, p' v
-AX = 0914h (Remove SIce breakoints)# C1 D! L$ ?9 c ^% o
" N: i9 X* E- D& c: Y9 KEach time you'll meet this trick, you'll see:4 b6 Y* l4 l7 c9 o8 ?2 `7 {/ h
-SI = 4647h
: h, f( N3 Q* G' B. T$ q-DI = 4A4Dh) O5 R. a& E' F0 ^. j3 y% h) E
Which are the 'magic values' used by SoftIce.
0 s: H3 o7 T0 v, U( T: T3 _+ f+ ]For more informations, see "Ralf Brown Interrupt list" chapter int 03h.5 S6 U' s2 w. y4 A
& c% H3 n6 ]! O/ z! T0 m; W
Here is one example from the file "Haspinst.exe" which is the dongle HASP0 K6 j; {- D/ N
Envelope utility use to protect DOS applications:4 c2 H# a) g8 u2 K) u. M
$ z6 S# ^6 ]6 {6 a
, A, v7 o6 v9 b& ]* Y1 y( T, _5 L$ P4C19:0095 MOV AX,0911 ; execute command.% t& r: g. F' I; h4 [! z4 `: i
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
7 y+ `8 Z# ~3 O& } \" Z: l3 I4C19:009A MOV SI,4647 ; 1st magic value.
6 b. j3 e" ]5 |9 M f' B* G/ l4C19:009D MOV DI,4A4D ; 2nd magic value.0 P! C$ ^, U; m6 t: M. I
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)% o' u- _/ a X) D: L$ W7 s3 _/ W
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
2 i2 j* z7 ?# F% i+ E; f2 ?7 T- Z" {2 [4C19:00A4 INC CX: J4 k' r8 z; A8 m4 @
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
N/ c& J. k X% Z2 X; }- `4C19:00A8 JB 0095 ; 6 different commands.
+ N8 J9 u- y' D* h( B& Z2 ?" Z4C19:00AA JMP 0002 ; Bad_Guy jmp back.4 S9 N9 }5 \5 d3 R, b
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
' z3 k# ?2 Y* ?3 y. u0 I
, U1 ~; e3 {7 }$ n; DThe program will execute 6 different SIce commands located at ds:dx, which
: y' ~' t* w3 v0 \( P3 J( x, ^are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.# ^$ d: r! ]' L" ?) v6 r8 w
5 d4 V) F, s6 K7 B* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.' d0 }1 b, ^2 n Q, O- b* \# n; [ q
___________________________________________________________________________
9 R. o+ J+ H) }- d) w" I5 ]8 L3 Y$ P2 O6 O
. l( w2 _8 ?3 D7 KMethod 03
" ?4 B$ z! Y; Z" D2 W" x5 W=========
- I; _. t" [$ V
" T( z" e* i/ Q% Z" @7 eLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
3 V v* y5 x% B(API Get entry point)
3 r% a- B$ _( j' r8 I
$ A3 J# u6 m, |2 x/ {8 j
: _9 D6 M$ W8 ?. G9 G: e xor di,di- @4 _6 e) U4 _$ I
mov es,di
) ?0 _1 _" {- W! G6 |: g4 s N mov ax, 1684h . L) e8 S2 n. p& }! J1 k2 N/ _
mov bx, 0202h ; VxD ID of winice
1 m" [' O) t7 ]; q8 j$ k, ^) B int 2Fh1 h" q7 g9 C( V5 H$ ?# r* @2 s# E+ X
mov ax, es ; ES:DI -> VxD API entry point
% [2 I( X5 m' c1 ? add ax, di
$ q8 D+ k& n) X( u. }& ?& B test ax,ax5 s0 x, T z! W; {8 ?; Q- Y
jnz SoftICE_Detected2 H' k# B$ |) ]' L4 S6 `1 E2 _& _; q
, ]; q4 ]( w& C& \
___________________________________________________________________________' |3 m @9 I, w0 L& \
F$ Z/ J; l2 Y7 B4 D$ S4 M+ Y
Method 048 f, S: A8 G1 ^7 `9 ?
=========- d4 i2 A% w" G2 d- X: k8 R: ], C
% K' x" F; X7 BMethod identical to the preceding one except that it seeks the ID of SoftICE
1 A6 @$ i, z4 x. m% E/ _GFX VxD.- w* |* s, J0 }. P7 K$ r1 t& a
8 X. V/ e, J' a+ S xor di,di' C- U" T$ J' t5 A4 l0 s5 l9 @
mov es,di( K# g$ `1 K/ M0 E0 m& M H
mov ax, 1684h 5 }3 [- A$ t# w" [0 K
mov bx, 7a5Fh ; VxD ID of SIWVID
$ p7 S+ j& B4 Q, A- o. Q int 2fh
% b0 S, [4 _8 y9 F, @ mov ax, es ; ES:DI -> VxD API entry point& S. `2 z% F% S
add ax, di
1 {. Y) D7 ^" s test ax,ax$ [) q( \9 L9 Q
jnz SoftICE_Detected
5 z' P) J3 b% Y. y% j2 Q
' M; `3 m2 V( j* T+ J( R__________________________________________________________________________
& R& ^% o/ }6 E* [8 I. l
2 y9 ^: d' D; u# O. U% n" c! ^6 e: k5 {) Q, K+ H
Method 05
- \ o9 f, o0 S4 [# K=========/ R+ R2 r4 V, R+ U- H
0 r. U$ h. `/ X# j5 ^- {Method seeking the 'magic number' 0F386h returned (in ax) by all system' S% T, ?8 C3 Q4 n, ~$ O5 ]
debugger. It calls the int 41h, function 4Fh.; x3 v! P* h4 F& P. `0 P
There are several alternatives.
6 o, C" k7 Y3 p' i
2 u7 ^, d% P0 v% T/ E+ h, DThe following one is the simplest:, H8 J$ o" E; v0 ~9 \% \ N5 X
) k7 k$ p9 e! a2 Y9 G
mov ax,4fh. N5 U- [% `- h* E: F* t
int 41h
9 \8 g$ W- D- O2 p9 J/ z0 i cmp ax, 0F386% b0 m$ j% z+ B
jz SoftICE_detected# `% r9 g8 e e! Y
N" [' n- I1 b5 g. @
7 Q- ?- \4 |: E9 B5 {! l9 ^ LNext method as well as the following one are 2 examples from Stone's % N( b# t! o' s& H/ Y. M8 ]
"stn-wid.zip" (www.cracking.net):4 B7 J2 r, u& Q5 Y# |" V# n* @- `
$ _& G7 c3 n! i N4 \
mov bx, cs# T% `- R/ ^1 b0 t& I& ]. C& d
lea dx, int41handler2
1 g/ l% r3 Y6 ~1 p1 d1 @$ p; o* ^ xchg dx, es:[41h*4]+ r9 c! R' S& d2 ?4 Z$ B4 Q% f$ h
xchg bx, es:[41h*4+2]
; B" h/ W! l ` mov ax,4fh' \0 A! g, D3 a# I7 Q
int 41h
) k/ I- |% F2 F% x' q Q- \ xchg dx, es:[41h*4]
6 }, I! d6 M/ n s E& [5 H8 b8 V xchg bx, es:[41h*4+2]7 j3 f3 b- g1 a" G! A
cmp ax, 0f386h
( ~9 r C1 l0 [: D jz SoftICE_detected! f7 q3 {. U& b$ v. q, E
7 t4 x8 u) Z/ ]int41handler2 PROC
/ K3 H7 B+ _0 ^( D; v& Q' [ iret1 y& h' @. @# H: Z! Y+ `) F8 ]
int41handler2 ENDP
( f9 ~3 ]( I" ~% e: n
& J* Q* `! v; A. [8 D
/ x3 M* t+ S1 o) v# ]3 d_________________________________________________________________________$ g: q; x5 v7 C5 Y, d
+ |- B) }( U$ `1 ~( a# ^3 `
8 |; F& w1 |' F
Method 06
4 a3 `8 o1 f8 c! s; `; \# h# I" j=========
3 ?+ P1 H; V. t0 E$ c. ?
C! c( `- F' ]( I. A( |/ o
+ Y8 }( X) E4 c9 v3 Z3 S2nd method similar to the preceding one but more difficult to detect:
4 _; R6 ?8 y; q5 N) a8 L
/ f% R I. W/ M( V- Q: L
+ t* V# h9 g* Rint41handler PROC
2 ~# a' M8 h3 h! K! N- n6 q mov cl,al
- d ^* H5 |8 D( U8 o iret$ G, ]" l0 i Q* e, X, \
int41handler ENDP5 p8 ]0 `8 J/ Q6 G: M0 K) b- F/ E2 h
% M. F) y6 N K2 e3 c1 h' f/ ^& z
* m+ H: ~4 M3 N xor ax,ax
; O6 k. A* W I' a. ]. D, _9 S mov es,ax; ~$ g" h* Y8 P6 [3 ^9 b
mov bx, cs0 t$ K- |) ~7 g4 w* w7 {) ^
lea dx, int41handler
$ O5 F) `: Z/ f' f xchg dx, es:[41h*4]
2 h5 L8 ~) n6 d! l# q4 q/ f xchg bx, es:[41h*4+2]
7 _4 s) v& R: Z& v: b in al, 40h
9 h; b6 c: ^- a" o1 M# R, x: ~ xor cx,cx/ O% o: N5 ~0 d$ J% @
int 41h
6 m5 e1 B) k. U8 U0 r5 e5 I+ @: f8 D9 L xchg dx, es:[41h*4]
8 l( Z6 D% x! d8 \' G xchg bx, es:[41h*4+2]
6 b q6 N) R5 _* l. g+ p cmp cl,al1 w2 s* g/ a% W, [3 J9 X
jnz SoftICE_detected. d8 _5 D9 r' R, ]! e# n
4 E9 _# D1 p, n) S4 @
_________________________________________________________________________
) ~7 g# Q' p8 d, z- u& _# C4 S2 J5 R% k! U% B
Method 07& d. q9 q& i: r; i2 S9 q
=========
1 k" H8 q/ y% p9 g; J" V" g
$ h9 ~. S/ X8 @0 O! c' D/ HMethod of detection of the WinICE handler in the int68h (V86)
" M* l# k2 i- c' A9 }8 u1 K% K) J+ \# k' L7 s+ U
mov ah,43h
, {. T2 e5 i/ K. x. q: W- d int 68h
9 Q0 Y9 a! \3 ^8 k. l+ ~ cmp ax,0F386h* P4 @; _% H; Q) n0 K
jz SoftICE_Detected
' `2 I" z" n s9 X6 {
) g" w, J5 m8 i3 Q* V, `" @$ C2 t; d. p& }) x* n
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit% B0 Z7 p0 i7 e+ I
app like this: a E. e8 [; A4 K5 F2 c1 y
' q3 [0 _# @* U ]9 l6 S7 s BPX exec_int if ax==68
1 b; o$ c$ r- Z4 N! [* e (function called is located at byte ptr [ebp+1Dh] and client eip is
4 v; D* l V5 ]3 o& t! b/ F: a& o0 Z located at [ebp+48h] for 32Bit apps)1 n/ Z* D8 U6 P' G; L! C; O: ~/ j& g
__________________________________________________________________________9 z4 ]% p" O/ _ V( _
+ _' \6 g) ^' k1 n c
F- l& g. y' a
Method 08# C- j, a+ K* i, D( f9 F$ \+ F
=========
/ m. Y; B% L% I9 F+ E' p, b0 S9 \, H( @: k& M& K
It is not a method of detection of SoftICE but a possibility to crash the- v6 c4 s9 H/ [, c0 m
system by intercepting int 01h and int 03h and redirecting them to another0 N- c8 R. [7 i" l
routine.
2 p( q$ b0 K( T. s0 Q$ YIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
6 j( i8 G: V" o" z# B; _# w; Bto the new routine to execute (hangs computer...)
: ^" h- V4 ]( Z" G5 a
! ?% [0 D% o) t3 V; X mov ah, 25h
0 o+ O+ r: t/ n mov al, Int_Number (01h or 03h)
# M/ L5 i! ~$ _5 G mov dx, offset New_Int_Routine
; I* N9 i! j; W* F0 ~7 C9 Y int 21h
; U- o% S; [; P: v& X! n+ f' U( t
7 V- Z& _: z% @5 s# ~__________________________________________________________________________2 r6 \' f: a+ l# H' u* v
* w) d8 l, a4 t2 ~
Method 09
5 U( i( O$ K) `2 D) [$ w @=========
2 K6 X6 Z+ `% o
, v O' w$ _9 LThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only& L; L4 ^- S0 W3 w3 U
performed in ring0 (VxD or a ring3 app using the VxdCall).2 a& D4 a8 g& S: `4 \* X+ V0 c
The Get_DDB service is used to determine whether or not a VxD is installed8 W' R& \2 x2 P$ g' l( F% G( R% g. O
for the specified device and returns a Device Description Block (in ecx) for
8 H' m. u9 V% Rthat device if it is installed.
' O l& c2 F; L& F) b1 R7 ~- X2 |3 p, i& Z4 @; }# V. f+ ?
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID. \5 j* @ `+ B Z' D
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
/ l: b/ [6 n8 N4 o VMMCall Get_DDB
5 [2 Z b& f$ [$ V$ Z mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed' x6 [9 B i) C! z" E8 E
! c! b$ _# X' }4 _- T) aNote as well that you can easily detect this method with SoftICE:
: n% H) a6 I f# ~3 \- ]" \ ~ bpx Get_DDB if ax==0202 || ax==7a5fh
% j" i) I$ `: b( j# d
2 N3 \: P- J8 K__________________________________________________________________________
: W1 G! c* N* y9 t: q% f
: Z' M, d* u& \) Y LMethod 10
* v7 U2 {" v2 n8 |=========
+ m) z& O1 E1 X3 b- Q
* t# }7 S9 E! f% r- Y4 g- e; b6 l* v=>Disable or clear breakpoints before using this feature. DO NOT trace with
1 V. W, l) V! b: l& t* w SoftICE while the option is enable!!& c/ X$ R5 N* c3 V, h r# A
$ p' q: V, Y8 T5 t" e( Y0 E' r6 e
This trick is very efficient:. q4 [- v" v$ C3 |3 E2 ^2 J
by checking the Debug Registers, you can detect if SoftICE is loaded+ p1 F* g9 D( `5 l" X4 [2 O
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
: w# \: t( D) b& K1 a6 hthere are some memory breakpoints set (dr0 to dr3) simply by reading their
; p! a y+ V* d7 `6 z% u2 _! xvalue (in ring0 only). Values can be manipulated and or changed as well
5 q0 Y& n# L' n7 f; p(clearing BPMs for instance)" X* e/ |) |( @9 Q* U
0 C2 n- ?8 h6 W: T: M! t z
__________________________________________________________________________+ J% D4 Z& h+ U5 g2 \8 L D3 |
: L9 f4 y. D9 d( K) nMethod 11
x% q9 N: R+ |: o4 P1 _=========
7 i- a5 I+ U! { T9 p+ J! x2 x, g+ _; k$ B9 l; G( u/ m% ^
This method is most known as 'MeltICE' because it has been freely distributed
& \8 q# d4 V( ?0 n W3 {6 Hvia www.winfiles.com. However it was first used by NuMega people to allow0 d4 k6 b6 C* L6 t% t
Symbol Loader to check if SoftICE was active or not (the code is located
/ H7 t/ U1 B6 ?- q! ?0 Oinside nmtrans.dll).
D* W9 O; E! }( P7 d5 `! I; s( H6 n
The way it works is very simple:
/ d% W' U- @5 r9 r, x/ ^1 bIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
/ U( V$ w2 T* W' JWinNT) with the CreateFileA API.0 e9 l) e; u) ]6 J/ ?. g8 S5 j
q7 O* V' X& Q e. jHere is a sample (checking for 'SICE'):
1 G n$ o/ P/ z7 j a! R6 ?9 s- Z0 b
BOOL IsSoftIce95Loaded()
" ]) ~8 }% T+ {: R0 g{- D* z J4 D) Z$ q; ^4 |, {
HANDLE hFile; 5 O. T! ^) \1 a* t4 `, E
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
: s& I- p# m/ e FILE_SHARE_READ | FILE_SHARE_WRITE,
: }. |+ R! I. | NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);8 \9 W+ z% P# m2 E* S
if( hFile != INVALID_HANDLE_VALUE )
& F V1 z* P0 ]' y {
. G4 \6 ^' Z ^3 U, u v4 y. ` CloseHandle(hFile);
+ a- L1 n H+ r return TRUE;* w L$ q* y0 e" Q/ q# f
}
5 u$ Y/ d: \+ |1 b/ U. a return FALSE;
# t2 `- V/ ?* j% [/ J+ C& C}0 f5 i9 ? S/ q
4 Y+ i6 A+ X- D1 t0 i3 UAlthough this trick calls the CreateFileA function, don't even expect to be
& A, k' m9 E7 G* @- kable to intercept it by installing a IFS hook: it will not work, no way!8 E% ^/ f0 u* A8 B1 S2 v
In fact, after the call to CreateFileA it will get through VWIN32 0x001F. ^' b, e, K) }: u. p4 @, `
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
0 x, s: C8 B, z7 Nand then browse the DDB list until it find the VxD and its DDB_Control_Proc
. l. y6 r: ]; Q. Dfield.
3 e* g/ D" m# Q5 R; L8 eIn fact, its purpose is not to load/unload VxDs but only to send a 8 v \( F' W2 l/ s6 W4 j
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
. e$ C2 _; D$ [5 mto the VxD Control_Dispatch proc (how the hell a shareware soft could try
% }5 V; v& X) M) j, S- z. x+ v( w5 yto load/unload a non-dynamically loadable driver such as SoftICE ;-).
G& F) l: [# A9 }+ aIf the VxD is loaded, it will always clear eax and the Carry flag to allow" z6 Y& k# D6 Y& Q. n
its handle to be opened and then, will be detected.
" u" {2 E' t( N# z+ IYou can check that simply by hooking Winice.exe control proc entry point K; j% @. w& `
while running MeltICE.6 d% T" f8 J$ Z) y8 E% y
: d' d+ l, e7 m" q4 ~
# w$ w' @- g$ K& j' O 00401067: push 00402025 ; \\.\SICE
6 S, u. D& L7 f% s5 { 0040106C: call CreateFileA
/ Y) q4 F/ j* r! W 00401071: cmp eax,-001) T' t4 N2 x; {8 w4 z$ M# R
00401074: je 00401091$ D, t: W5 G5 T5 H
3 @4 o: P6 o$ m# ^( V0 X% A% F
" \3 M" c) ?/ c7 C+ S: I
There could be hundreds of BPX you could use to detect this trick.
1 ~4 K T( o0 H+ m- t. b' W% Y-The most classical one is:* ~6 o! V4 r( ^* R
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
: z. A9 A" d' E* c0 ` *(esp->4+4)=='NTIC'% T' i, I7 z3 _* }. w! @
5 r; R, V# W& |2 n5 N: D0 y-The most exotic ones (could be very slooooow :-(: r' P0 _9 C/ d" ?: v9 f2 ]
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') 4 l% I! I* b' u! \" w: f# I
;will break 3 times :-(9 K/ u" h4 b6 V6 x7 v- B
, E) F. C, y7 E* Q. h
-or (a bit) faster:
4 q/ X) J q7 \8 i BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
" O; e0 [4 }- l z0 X& u) Z( n+ q) e: `- u# J
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' / r) r* V" C9 V
;will break 3 times :-() v5 P6 W4 b, s2 L. C+ R/ Q
' l5 G, l/ a: [8 q2 Y V-Much faster:" H5 r' Q% A* [3 Y8 x
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'/ k2 _- d7 l9 q
: ?5 Q5 ?7 r+ y1 x5 o/ x5 Z) \
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen& j; d. k# r L5 \7 S/ _) ^* |
function to do the same job:
# r0 J% D1 \5 x/ X5 G) b4 C. j# u6 l
push 00 ; OF_READ9 n0 b; m, c5 R
mov eax,[00656634] ; '\\.\SICE',0
8 T+ f+ W* a: c9 Y; K* L( a push eax5 b6 o, t9 x/ _ A
call KERNEL32!_lopen
$ Y# _2 g+ `2 [8 r( T1 Q, J inc eax4 ~/ }9 C& l( j/ v
jnz 00650589 ; detected
0 G: N+ t6 a% ~0 m push 00 ; OF_READ
( X, ^7 \$ J3 {% N4 l- j; z mov eax,[00656638] ; '\\.\SICE'
. R0 a2 |1 [5 R3 f' { push eax5 H8 b, D8 _* [$ B3 ?
call KERNEL32!_lopen% p1 H) f0 A7 g# h
inc eax" j0 R) y3 G' {( ?, o4 |& Q; O' z
jz 006505ae ; not detected
; c2 U. E5 p E2 U5 V6 H
# J( e, `% T' n; R
' l6 u8 I5 }- p& S# l__________________________________________________________________________9 R0 t" m0 B, @8 Q3 r3 b& u% k
" E, I4 \& ? c" j. M3 Z" B! eMethod 12" m2 H& O% ^4 y% B8 d; o
=========$ S: s& l6 g+ y
8 E% L$ g9 e: w k3 d- k# ]4 [; p& J
This trick is similar to int41h/4fh Debugger installation check (code 05
9 z, o% m. t( _. R; E4 K& 06) but very limited because it's only available for Win95/98 (not NT)
, z8 _' |" @# q* r* xas it uses the VxDCall backdoor. This detection was found in Bleem Demo." R% e. r9 Y. ]3 V
. L) t C5 Z! E, v- b/ q" ] push 0000004fh ; function 4fh, @% H1 A* Z) O
push 002a002ah ; high word specifies which VxD (VWIN32)
: y6 S C! l# d: q$ X x1 @, S% @) Q ; low word specifies which service0 K/ a. z7 T" ^& O# E
(VWIN32_Int41Dispatch)
; U$ J# Y* U- ?9 a" v' l0 a% E call Kernel32!ORD_001 ; VxdCall6 w1 a; v: M7 r- q
cmp ax, 0f386h ; magic number returned by system debuggers8 t6 r/ K" j4 E5 _4 \/ Q
jz SoftICE_detected
0 g8 [/ Y, w% o
; h! t3 I8 W$ a' a. B: SHere again, several ways to detect it:
+ _5 f. G$ `, T+ O0 [$ ?) s+ Q) }. T! [- c8 B
BPINT 41 if ax==4f
( x: t- I2 L% s8 V0 y: N3 ?" F* k! _: u* m+ m/ i8 C
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one( N! L% q9 G1 Y% K# r2 ~6 k3 Q
/ R) M; o7 t% m, l8 _" U7 }; J
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A Q5 \ O$ \) z% _) ]7 t) G
) C" t+ x4 m# Y) V, }2 |1 p% G
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
7 v* j5 A( B+ i2 P. g8 y. l! O( e! `9 E6 b
__________________________________________________________________________& [1 k3 o; j1 D a
5 U" k* w _, F$ c( W6 z3 iMethod 131 H6 t @% J$ \ n- k
=========
( ?' ^: \, T, Y1 c. X" m, Z) S# E
5 z# a7 k! |+ h% T% c; q- BNot a real method of detection, but a good way to know if SoftICE is
9 c, ^. Q" j$ Einstalled on a computer and to locate its installation directory.3 ]$ F7 J2 c2 @/ @+ X& o
It is used by few softs which access the following registry keys (usually #2) :
; q0 U$ g- x. V. Y$ R4 ~4 I4 t! {' r0 B
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion, m$ Y7 e' k, W8 l( M
\Uninstall\SoftICE
4 C# X/ S) B+ k- ] [4 t/ ]4 {- j, Z-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
1 j5 p: b/ ^8 [* B# P5 N* s' o-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion( _7 p2 m( @" D. x! A; E, F
\App Paths\Loader32.Exe8 G- m6 l: u! M9 P/ A( X, m1 t/ `" i: W
5 i8 U5 ?/ U2 X% O& w& a2 s( r8 R
& d$ R h- R3 Y- ~8 ONote that some nasty apps could then erase all files from SoftICE directory
7 o7 O2 } f6 N3 U( m+ y) ?" ~- c4 I(I faced that once :-(; Q. w+ P4 x- y5 A4 n
6 X! ^/ `+ [6 H; pUseful breakpoint to detect it:* S' [9 `" B. L3 s& R
3 f% `0 c1 X0 `
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
1 K, {0 O* O& Y5 t2 e8 N" G4 n" N2 @: `! N' Y/ H$ L: N8 n3 k" A% B
__________________________________________________________________________
8 p' Z3 v+ Y" R8 z# H& @: E
1 P* k/ y4 K0 ~+ s% b+ E5 e( W3 b6 b& x4 [$ W, \. F9 z1 X, g
Method 14
3 i$ x6 a0 V9 I( Q8 ?=========
8 V6 {5 @& z: q/ s1 b5 z. t# O; O7 y8 |6 Y9 m
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose5 V/ a5 B0 m% H+ g9 _& N) `
is to determines whether a debugger is running on your system (ring0 only).
- P' O+ ]* `# k% F- v, D9 W
( @) o0 i6 N( \3 ? VMMCall Test_Debug_Installed
1 ~0 t2 s/ p$ _5 Q8 R, d6 A; z je not_installed
7 W) ]8 h! r+ |, m) k# [0 r
4 ^' i4 ?! r X9 J& Q4 DThis service just checks a flag.
' l% y& f3 R2 E. `2 A: u" F& F</PRE></TD></TR></TBODY></TABLE> |