<TABLE width=500>
- @+ J$ K# K5 s8 X6 v: G* _<TBODY>
/ {8 Y0 S7 q: e<TR>
- h6 t8 ]( w" J* T# R2 @<TD><PRE>Method 01 " `3 P: L- Z, R; k) d. w
=========
( R6 o5 V, K/ m/ G% ~, e+ F2 _* x. h
This method of detection of SoftICE (as well as the following one) is4 f% i: T2 I- {- ]- [/ n' E0 `
used by the majority of packers/encryptors found on Internet.$ Z1 V- N' ~1 ?9 Q
It seeks the signature of BoundsChecker in SoftICE
* R! c2 a" g+ u0 J$ [. ~. K! \4 K7 n6 r3 c
mov ebp, 04243484Bh ; 'BCHK'! z) N7 E! q+ K4 ~9 A
mov ax, 04h
4 b |3 H# _- j int 3 5 v1 U( \: h2 X) Y! ~' @2 }# a
cmp al,4
! t; a0 T: w' }. i jnz SoftICE_Detected. l" k2 W6 e+ a* B
( I b) R# N" U. B, ^- q___________________________________________________________________________5 ?! g2 k7 S/ d5 H
8 Z1 o; e) q, QMethod 02
8 j# f$ n, r. a L" _=========
, M" \9 {5 a: ~+ [. g5 { G) B
9 l' ?& u5 s. T" K. \Still a method very much used (perhaps the most frequent one). It is used
9 h/ V1 Q8 B$ x' Hto get SoftICE 'Back Door commands' which gives infos on Breakpoints,- e% V/ g" R- |% b9 d4 G
or execute SoftICE commands...- a3 Z; }0 x4 Q0 z
It is also used to crash SoftICE and to force it to execute any commands) m/ G" {3 _+ w3 f
(HBOOT...) :-((
: ]) a# U/ S8 X) g; E: E* H! ?1 K: ]9 F% j& y+ R1 S( A
Here is a quick description:; Y9 i+ n9 J- P0 `9 k
-AX = 0910h (Display string in SIce windows)7 [) \5 _) S8 M* F: n, I; A
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)+ N0 [* ]& n# X& x# Y
-AX = 0912h (Get breakpoint infos)( |4 P5 j2 z V0 _2 Y2 o. N
-AX = 0913h (Set Sice breakpoints)
; n- e5 w( R2 L; U- [-AX = 0914h (Remove SIce breakoints)* Q H% m) F7 N
& _0 a0 L7 D: I a" B! ^. kEach time you'll meet this trick, you'll see:" z) x* O9 \8 g8 s6 t& [
-SI = 4647h5 i: i4 N8 h; c, D/ R u1 J
-DI = 4A4Dh! ]3 K N( J B. P$ `% N- M
Which are the 'magic values' used by SoftIce.
A2 Q' f% |8 i9 | J1 ?0 \. uFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.7 Z% q0 q% h. D
' O6 i, t5 G9 @" ?& GHere is one example from the file "Haspinst.exe" which is the dongle HASP
1 M! U3 ` l' R, l6 S$ [" `Envelope utility use to protect DOS applications:( R4 ^; y) m4 B: B/ ^& a
# c/ E J- m! D7 i5 }7 t' T! d
" ?+ \! n" Y. S( y. e9 \. V* f4C19:0095 MOV AX,0911 ; execute command.' N, b2 r. f# l0 u2 L+ x
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).4 S. W4 }4 T8 S4 f- H3 A% l
4C19:009A MOV SI,4647 ; 1st magic value.4 _/ P9 @5 l' {+ {6 f
4C19:009D MOV DI,4A4D ; 2nd magic value.
& M1 A! e% r/ D1 l1 R0 t" @9 z% j+ o4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
7 n) I7 y7 |( C" h4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
) r6 p4 r+ a7 j v* Y4C19:00A4 INC CX
6 h# H* g r5 g/ P4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
* v1 t( Z9 i( E' ?5 D k' u4C19:00A8 JB 0095 ; 6 different commands.
* F2 j5 }# V8 b" l$ n4C19:00AA JMP 0002 ; Bad_Guy jmp back.. c3 J0 N2 Z+ w: `! y* _6 y4 F
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)8 _# \* ~6 u( p$ d: T* `4 n8 N
% X3 ?" [3 } [5 X( m8 S% UThe program will execute 6 different SIce commands located at ds:dx, which
$ B3 d" g. p: i' Hare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
/ S, h, d6 ^0 Q9 S5 V
2 J$ b& Y8 @) ^" J* B* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
' ]' T3 o& N8 m) e8 S___________________________________________________________________________+ n' C! m$ \# `4 O* s
& b7 G. L- E; [8 D
2 L* G# P3 ]1 b. B
Method 03
* j: C) V) U; P2 W/ v) I=========
6 s2 Y( `/ T F* c- m$ [1 M
9 U' Z9 \; x4 [6 w) A0 l7 J: @Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
1 {* r Z1 Z# q# m- p- y( o1 M8 |(API Get entry point)$ W/ _0 Y* ] @5 X
& A& H% c) @6 L- m$ n" y
( L1 n5 ^ B) b% y, c& H8 N# T xor di,di
: Y$ R( u d; I% g X5 D mov es,di& Q, m L: ~7 g I( I- V7 I" d
mov ax, 1684h 7 G) s5 H( a8 c/ Z
mov bx, 0202h ; VxD ID of winice
0 G! f5 x `8 c8 h int 2Fh4 x0 d) W2 h4 c$ z& a' j7 L6 I
mov ax, es ; ES:DI -> VxD API entry point% k ^% }/ e$ ?
add ax, di
) d. N, g. `9 B- w' _ test ax,ax" p1 f) U/ H4 m* L
jnz SoftICE_Detected
6 l& c! W7 c/ {, K/ \ _ k9 G: A" l) _; B3 T F$ \& G( M# R. T
___________________________________________________________________________6 H8 y( `1 @. A# \$ t8 x
' p! D; n# A- ^+ T B; Y' a2 Q( J
Method 04: S1 O! S3 Z) S! k1 c+ ~" L& A
=========% ^6 R5 Z! [6 N8 R3 I' c1 S, _
8 V! [% |+ P% u4 {
Method identical to the preceding one except that it seeks the ID of SoftICE9 ?: C) @+ t0 T6 a* O3 M% [
GFX VxD.
& J+ X' ^) n! c4 \3 X
8 f ~1 T! R) l xor di,di
8 f" }9 v4 h% _0 } mov es,di
: o$ h7 X# Y% r" o, Q7 W; x mov ax, 1684h
( Z2 Z# c+ Z( U4 O mov bx, 7a5Fh ; VxD ID of SIWVID' y& K% b% i' K1 a2 Z9 A; K; u
int 2fh
( l0 j9 ~( `+ p mov ax, es ; ES:DI -> VxD API entry point# v9 y( i$ k. `) H5 I
add ax, di& R/ C3 U# n0 \$ `& {8 v/ W) d ?/ q- {
test ax,ax
$ R9 O* t: O* ` jnz SoftICE_Detected7 k6 @$ Z+ y* u! U
% m: L2 d v: i T; P5 H+ N__________________________________________________________________________
& [* I; Q9 F3 D0 ?) h S
. H" p' C3 ^, ^" \6 l; ?) E, V* w
/ G6 H2 w" b0 C! `, IMethod 05) E( ~5 a& |" Q% p2 S" f- C; V e; L
=========
; d- v3 }" b/ S5 r3 d$ q
7 g" j2 m" M* _5 @5 NMethod seeking the 'magic number' 0F386h returned (in ax) by all system: I! c. h- D$ C
debugger. It calls the int 41h, function 4Fh.
: Z' q3 Z# Z! {( l' C; n, AThere are several alternatives. 2 X6 f- G3 n; _6 Q. B' T
5 K% ~, T5 I4 U( D- O: ~) Q: _
The following one is the simplest:
, {8 u2 C2 a* u% p' W- \0 o9 Y8 o; \0 ]6 g: C8 S/ w: [
mov ax,4fh
. i! u& s% i# K' Z int 41h
' W0 | ` {5 S; {% g3 y cmp ax, 0F386( \7 Y6 d' T/ |6 ]) P. P8 T
jz SoftICE_detected
! C4 x; x3 h, }' V+ L) m. q
( a9 E/ S% r6 I4 S% F+ @% b
|+ r# ~& K7 X4 v! KNext method as well as the following one are 2 examples from Stone's
* q6 g c' ^4 x/ Q: [3 R, h"stn-wid.zip" (www.cracking.net):$ I' ] Y7 H3 e7 G+ p& l
4 [1 {$ {4 K0 s: O4 a/ p- |
mov bx, cs
' \. j! c4 P9 X% o+ _7 P lea dx, int41handler2
9 o# j+ f8 j0 W; W" X xchg dx, es:[41h*4]+ e/ A M* E6 E; a7 V
xchg bx, es:[41h*4+2]
! o. N4 M0 R$ K5 U mov ax,4fh
2 S8 i2 s# h# d- l) |; K int 41h
5 r7 F% D3 C V/ P% {, o* @: H xchg dx, es:[41h*4]
. N; f7 S& h& ? Z; t+ C( R# j+ e xchg bx, es:[41h*4+2]: e6 g; k) k# m4 c7 V
cmp ax, 0f386h
, ?; t6 `# n4 y3 s% _ jz SoftICE_detected
" B% a- {, b* P5 P, j" `
9 Y5 c" G2 }+ R. U" e Z9 n( Y# Uint41handler2 PROC
. R4 d. P6 A0 P# g9 }$ n3 \ iret {) b5 S# l& p
int41handler2 ENDP
, U, X! d) n! ^! J; e" H1 d) `! T% F7 l1 h. M3 O) I% }6 ^( m' ~4 F: V: ?
) v6 J* Z/ n" l: D/ A: Q_________________________________________________________________________- w8 q3 U; j% O) [* `4 S) P
. ]% W, q2 c! U% Y- C$ F& k$ s1 q2 \
8 _& Z" T# F) t+ @- ?5 ~Method 06
" t& f7 p0 v. Q% V! W& Q+ f=========. x" O4 S- X# N
; H( X- b( |- `1 ]
3 l" J' E# P6 |$ [# L7 ]
2nd method similar to the preceding one but more difficult to detect:
. @$ y9 y- F% s R2 f$ H+ r+ z
5 S- B; L( t% G. m" M" S6 s+ ^1 M/ }. M+ ]7 o
int41handler PROC9 q3 z( o9 J& A# K& V- y
mov cl,al
, d; _: E+ v4 R iret" C5 g* G* Y g( h6 P8 f! U2 B' R
int41handler ENDP8 W7 P5 ] |5 n0 U$ z, S7 e
1 z8 K0 K: `0 M% C
4 \0 z Q8 o# V+ L( ]
xor ax,ax3 ^+ k k& b" ]
mov es,ax
* J- P) \0 P& X2 j5 n mov bx, cs
9 N, p. |1 Z4 p9 N$ y/ D! K- s- ] lea dx, int41handler
Z1 ?# i" D! ]& h6 o- V xchg dx, es:[41h*4]) v% \* ~; ^5 p$ D* D, q
xchg bx, es:[41h*4+2]2 |1 W) e! V7 j& t. l$ i
in al, 40h$ @) g/ N+ }2 ], o3 F( B7 X
xor cx,cx' N7 R8 U' J% A( \0 `: a5 P! }
int 41h! X- W0 U3 P" `9 D% a! `
xchg dx, es:[41h*4]
0 p: C+ \; F2 e4 r" n xchg bx, es:[41h*4+2]
/ @! l$ q. z# d- r cmp cl,al9 A% i2 [; w7 w; R! n1 _1 J2 o) I
jnz SoftICE_detected
/ b. \$ ~- O- j4 L
& a) `4 M' H2 V# p_________________________________________________________________________
2 \6 p0 ]; E& J: F5 a& r
2 D$ e* j( v: M4 E; u) @7 l& E* PMethod 07# X9 N8 k0 j& W8 [
=========1 c! x; k: b( i* l9 r. A% Z+ [# s0 w
/ k$ i4 }/ [. ]' o9 ]Method of detection of the WinICE handler in the int68h (V86)
3 h/ H& S# ~0 ]) m/ k
* M- J1 d3 m% c5 U& U/ g mov ah,43h
* B7 l" x7 x0 w9 Y. |9 P0 d int 68h
' H; |, N; E) y0 y, B+ J) I% O' g U cmp ax,0F386h
( @# U/ } `5 D- J* ^. M3 Z( O jz SoftICE_Detected
6 U, M W& C! i5 d: l, U8 q
/ S; N- V7 c/ ]' r% M3 _8 Y: p# F* A! d
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
# j9 C, `8 h0 A) v) z) e app like this:
: t8 e8 k" {- K2 L( n/ L6 S9 F0 U
- Q: |6 y# Z. C7 Z6 F/ p7 O; p1 m& [ BPX exec_int if ax==68
T7 A7 k! l% r1 ?/ i" N; R (function called is located at byte ptr [ebp+1Dh] and client eip is
- u7 r- u0 D$ w- K, W located at [ebp+48h] for 32Bit apps)
8 [$ I& I& c [4 f {% p! F o T__________________________________________________________________________' D) q+ r8 M, G5 L9 l
! f( T0 X) B% A+ O9 p
# r- i/ _! ^ x7 n4 `. UMethod 08
& _0 m& y8 t7 V1 s: k2 g" o; x=========
: _$ M& l# l8 u- i8 R+ B% S \& K0 s! u
It is not a method of detection of SoftICE but a possibility to crash the" E+ `7 b( t' i; v
system by intercepting int 01h and int 03h and redirecting them to another* d6 B3 V* a T
routine.
* y$ s$ M& b! s- gIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points9 {2 `5 J( S. s- n2 T7 N1 @
to the new routine to execute (hangs computer...)2 j* L, r1 {& W" u* o r3 v! d
. B9 _7 H# P, C. e; R. L+ K# }' {
mov ah, 25h" F: l/ U; X7 |+ v
mov al, Int_Number (01h or 03h)* D0 k# I) W& h4 B; Z
mov dx, offset New_Int_Routine6 ~3 l7 \0 M. b& r5 h Y( P5 ]
int 21h& u* E# X9 f) [9 k- g2 e
5 j5 J$ \% ]& u
__________________________________________________________________________4 @- ^: G, a6 _. S. @& Y' P) A
$ x) l- `5 d& G" Y. r
Method 092 V- ^; Z( F' M
=========
0 B. j! M! E- `) K% m' S2 L; P/ s, Q
9 ]6 ]* Y: Y J& x9 i6 `This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only, ~; y7 K. z) e$ e4 i* c
performed in ring0 (VxD or a ring3 app using the VxdCall).: [, z2 _1 i9 U* a: X
The Get_DDB service is used to determine whether or not a VxD is installed2 m/ u/ f5 ~1 ?7 }. }
for the specified device and returns a Device Description Block (in ecx) for
! p, B8 q3 m. I; L+ L& v5 Q' ?that device if it is installed.1 N1 d/ V" N6 N- U2 m
! f. ~6 D+ J4 n s
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID/ S$ |6 [- e; Z4 j
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
" E! `; i2 u+ t' i; o VMMCall Get_DDB
% F7 e" t+ T2 |. M5 H6 F/ X; R7 q mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed) M: g/ p# {5 ?0 T9 x
e# q' M- f w- l
Note as well that you can easily detect this method with SoftICE:
: m$ U b2 o) Y7 S& G y" ^ bpx Get_DDB if ax==0202 || ax==7a5fh0 E* ~0 C+ [/ s0 G y5 ]
' q) H( [' k4 C__________________________________________________________________________* s$ e; V' B- f! l- J
9 ]5 x6 v( C% H) i! m. l
Method 10) f% P! B' s5 W3 [
=========
- B, c+ q2 {( H; }1 A5 l8 U ]% W
=>Disable or clear breakpoints before using this feature. DO NOT trace with# \8 s0 Q$ }# ?7 D
SoftICE while the option is enable!!! u7 F: y0 P9 Q' b& \
9 j6 `" w6 R: ?, A: V* L* p oThis trick is very efficient:/ K/ q1 a% [# B
by checking the Debug Registers, you can detect if SoftICE is loaded$ `/ |/ ~) W2 n6 T
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if% V1 L. A4 q: I" ~+ K8 u+ I
there are some memory breakpoints set (dr0 to dr3) simply by reading their+ R! m1 |7 H, x7 b
value (in ring0 only). Values can be manipulated and or changed as well
7 f$ d/ }. C$ t. Y" C(clearing BPMs for instance)
' Q5 w% k! D4 _. w2 b5 m4 r" | Q7 s8 k" U
__________________________________________________________________________
+ z" q' ^3 Q; X, P# B3 {
& s t* k; h5 J% F) VMethod 11- r( F! V' ?6 l3 U( \
=========
3 B2 |! o2 u, T1 h' b R4 D' }) R1 g" Q3 E& l, ?7 B$ r; s% V
This method is most known as 'MeltICE' because it has been freely distributed6 }* J7 d. W9 x. [
via www.winfiles.com. However it was first used by NuMega people to allow
2 L9 m3 r6 Q# J" b0 }Symbol Loader to check if SoftICE was active or not (the code is located
( O: Z8 R1 L& t% x+ _inside nmtrans.dll).
4 ]4 L9 Z P" M) y9 x6 Q- \7 D$ p' o5 E4 Q5 V$ M7 U( N
The way it works is very simple:
2 c- I: [1 T: ?It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
* w$ G0 {0 S1 I, HWinNT) with the CreateFileA API.7 f8 d1 y8 _2 ~2 ?; ?$ h" m
2 Z$ x7 E. \8 Y9 v! r% [3 q+ `
Here is a sample (checking for 'SICE'):: o2 L* |( h9 ?# j6 U7 x
$ a1 V) r. d4 b4 u+ N" {BOOL IsSoftIce95Loaded()! l" E0 a$ j% ^2 a2 _6 M
{( Q/ C3 c, x: v9 Y3 t0 @6 F
HANDLE hFile;
9 b* t# F9 m3 q hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,9 ]' H% a4 h; z
FILE_SHARE_READ | FILE_SHARE_WRITE,
4 o. Q0 [% k8 B; g NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);! X( u4 l) z# `+ s; e }' a& F, i
if( hFile != INVALID_HANDLE_VALUE )
- l7 E9 R+ s Y" Z8 d* r { L5 o* d( W; t5 ~" z: t6 ]) q/ O7 U
CloseHandle(hFile);/ o, S7 Z7 p3 P( N1 P# S: f! I
return TRUE;
3 g: i% ` ~& ]6 n0 T } `+ C5 G* l5 x4 g {
return FALSE;7 ?! g2 d/ P( h1 Q9 W" `
}
6 Y9 ^6 f* k/ m
0 _; B! _+ q! |Although this trick calls the CreateFileA function, don't even expect to be
! y/ C$ C% T; f( H# U( Pable to intercept it by installing a IFS hook: it will not work, no way!
% {+ k" K* _6 Y# E0 L- p cIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
P( g& a2 Q# N% t% i# Aservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)- q2 ~! r! R: G
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
( [9 [) j1 ^+ Ffield.- Q8 p g8 i0 a, c7 R
In fact, its purpose is not to load/unload VxDs but only to send a
6 s- c6 N! u" H# c- y+ P% l: }; tW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
( ?1 g8 q" W# H j% ]1 Jto the VxD Control_Dispatch proc (how the hell a shareware soft could try
4 C" T/ S# N3 b. R% bto load/unload a non-dynamically loadable driver such as SoftICE ;-).
7 F# [+ X( L- E; RIf the VxD is loaded, it will always clear eax and the Carry flag to allow
/ O; v8 K1 L' d' mits handle to be opened and then, will be detected.
. \1 p2 U1 A- g0 G$ |; F! y/ cYou can check that simply by hooking Winice.exe control proc entry point5 Y# S' e* j) c5 L9 L* Q, M
while running MeltICE.
) t0 ^4 f$ V$ V, C. l2 p& w/ a9 e8 y6 T" }$ A7 R+ C
" T' u/ b' l5 T" N 00401067: push 00402025 ; \\.\SICE1 A' |: \ I# F9 t7 J5 j
0040106C: call CreateFileA
, B4 _. ~1 {5 o3 n" E- A A( ? 00401071: cmp eax,-001
. ^0 D, C# ~- m, J+ y! y 00401074: je 00401091
, I U- ]* b( _+ _1 }& y
; \/ r* }2 q k3 `2 W' w- R2 b3 M7 I C2 `9 _+ y
There could be hundreds of BPX you could use to detect this trick.- T. x ~. G- n& i" o6 `
-The most classical one is:$ ?2 I6 c; S6 F
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||' N( z. G; F* O9 P# Z9 ?8 L+ M
*(esp->4+4)=='NTIC'8 F; z8 ?$ z- ~. j- I
7 p1 r+ R, K3 g6 x5 i1 l" a c
-The most exotic ones (could be very slooooow :-($ k7 y& V) W" e
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') ' t, R& }% K% |- H6 W# W1 W# \3 q) X
;will break 3 times :-(
C: O3 G1 m8 S! ]/ C8 \& L @( Q3 ?0 A/ c* V7 z% `
-or (a bit) faster: - ~1 n8 G$ Y/ _4 g
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')9 e5 Y' C+ P6 E) d& [2 O+ L! w2 g
9 p* p2 Z- J( N$ X. L& {
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
) o. D5 Y- x' w$ A ;will break 3 times :-(
1 D+ \2 e( |; C9 b1 k0 O: G6 V& ~" W# c v) t& K1 \' w9 Y
-Much faster:
. T! E1 Q; e( g" s" `: k BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
. {/ X9 X' n. M) `- g) `% U4 z+ i' |) z) G* ^7 |
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
) ]% q# Q" i; [% m8 X) f1 h9 cfunction to do the same job:
4 Z( ], J+ \6 C7 \! P$ j! z2 e
5 G0 B4 e7 ]! R push 00 ; OF_READ) r6 [ U/ Q, L. g: f; X
mov eax,[00656634] ; '\\.\SICE',05 D7 _6 c0 i1 S m7 e, \
push eax
7 }. x' F/ n: c8 s call KERNEL32!_lopen
* x8 ?4 n8 b) Z6 H: T3 Q" p4 A inc eax1 A. p8 z" N( r9 z9 z
jnz 00650589 ; detected- W8 O) o5 i1 T0 d, c5 E6 N0 \
push 00 ; OF_READ
6 b4 n- X% S( L" u x/ z! E1 P mov eax,[00656638] ; '\\.\SICE'* q% B# N1 R, Z9 _* O; T
push eax
3 g6 Y, _5 z! W% h$ v4 u8 [ call KERNEL32!_lopen
7 P' s1 V- H0 s) M7 H6 b" _2 X inc eax
L: v- {+ y3 E% j z jz 006505ae ; not detected
4 N `' Z6 K; k
: }' W4 d. y; ?, g. O/ D$ K3 M C k; v* l
__________________________________________________________________________5 P, I8 S/ U D1 Y" k+ c9 G
9 x6 P. N, ~- E9 u( I; L
Method 12
8 z0 ]7 [4 c# J5 ~+ R8 K/ n========= a- K7 ?/ {3 U( E2 T6 a# M
* N" u5 y+ M2 ]3 K! DThis trick is similar to int41h/4fh Debugger installation check (code 05
) c) C- V7 u# ^) X3 [& 06) but very limited because it's only available for Win95/98 (not NT)% G' m$ r& k" ^2 T6 V
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.2 F% H& q4 E4 A8 B; y
) K, @2 ~9 ^) X3 Z# O
push 0000004fh ; function 4fh& i( O8 T" q% E6 K3 _% z+ _
push 002a002ah ; high word specifies which VxD (VWIN32)
. B* r8 N s' s: L5 k$ } ; low word specifies which service
8 V/ H1 E& k4 v7 ?% X, o0 ]- {! | (VWIN32_Int41Dispatch)
9 [+ z7 k& T v) H; p; f1 E call Kernel32!ORD_001 ; VxdCall! ~ g9 ~" w% N: e5 |! C
cmp ax, 0f386h ; magic number returned by system debuggers
F6 H `* o7 d! K2 d- ~$ c& h" Q jz SoftICE_detected/ ~/ {7 i+ v$ h/ T; K
0 i! F2 M+ ]# F) \+ ~$ `2 a3 |Here again, several ways to detect it:
4 T( ^2 ^' w" _
9 T# L4 C ~$ b" ~+ c% m: a BPINT 41 if ax==4f
* R, {- B0 F/ \; H/ F- r" c: f+ e2 A" t
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
2 K! q: X, L- ~2 S% J; T
6 U/ e6 r5 i# R0 `+ U BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
9 M- y" H0 K8 O1 {
. l6 J+ ~. N- }& b* N; z$ w7 j BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!6 ~% }: ~. E% `; S4 k6 G
0 n& l3 \1 ~: P* h: }6 M
__________________________________________________________________________
, |, u- Y' ]. l, m3 K: G+ u) m- V+ D/ c
Method 13
! l( c, B( d6 b. w5 h! R2 d# e=========7 I* r n4 `+ l' L* j' [
8 l0 U4 c5 ^8 o8 G: O" w. vNot a real method of detection, but a good way to know if SoftICE is
4 R2 o. _' q" [installed on a computer and to locate its installation directory.! M' O' G: ?. f
It is used by few softs which access the following registry keys (usually #2) :
" C3 Y" H6 n0 _/ p, o/ ~+ |& V; Z% i( }" R& ~1 `9 h1 t
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
7 V7 p: P( n8 V5 F2 q4 Z\Uninstall\SoftICE
2 d7 f; X) m- C( T1 G-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
% u& u, i) q* G7 B-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion5 f; B+ ^+ f9 H; c" R7 A
\App Paths\Loader32.Exe) Q6 c. P @2 M( A! m; k9 p7 w3 k
- r0 B" ^5 u) p4 f
9 c! m' F6 z& Y' |
Note that some nasty apps could then erase all files from SoftICE directory8 D( \! O" j% X W' t4 T
(I faced that once :-(
+ o+ ^1 J" S, G+ b1 X v ?2 w% Q/ F4 E) X4 _: ]7 Y9 Q
Useful breakpoint to detect it:( W; V: g2 u2 k0 b1 D1 \& Y
7 l6 U) A; Q2 k/ h4 D% b* D( Q BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
7 |3 X% O. G; f: v5 L2 P1 \4 [8 j% H/ t2 x1 z$ |) h C( T8 o
__________________________________________________________________________4 g2 Y8 K2 x& I3 l
4 T' V# u4 E ?. }4 m0 o( Q% d0 _# a" m
$ o! _: k; ]2 t BMethod 14 * k5 T6 _& ?+ m- e; n
=========2 o# r+ O7 Z" w9 J: ~: e
; M) y4 ^) M) q5 hA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose9 \( V! {5 V: J! i
is to determines whether a debugger is running on your system (ring0 only).
+ l3 e5 r! I% A7 w) m. u% @4 ?4 J) L5 P# m2 B1 @1 Z
VMMCall Test_Debug_Installed
& Y \7 f1 r+ O je not_installed
3 X5 o F: p( T- l1 S r
: w/ e7 v7 J [- n d* @8 G* M: DThis service just checks a flag.
7 K( N# h5 _$ [7 i! v" p& q& s2 M</PRE></TD></TR></TBODY></TABLE> |