<TABLE width=500>; ?3 a5 s. P/ E/ A
<TBODY>% N: t0 N0 z( H9 |, {
<TR>
3 F8 S% @$ T9 ~ z% B7 u<TD><PRE>Method 01
" v. m3 v% ?8 P( h=========7 Y4 i: n4 m9 L0 u: E" ]% Q3 l
7 B2 o" K. T0 {/ {
This method of detection of SoftICE (as well as the following one) is
% J. s7 p5 m' k+ Zused by the majority of packers/encryptors found on Internet. l2 ^9 M. r5 X6 c) c6 I
It seeks the signature of BoundsChecker in SoftICE4 M" |4 R# H+ S' r! n' ? b l7 O9 q
/ ]$ y$ d- \) n. I mov ebp, 04243484Bh ; 'BCHK'
x- W/ Q- a: z2 Z: W! r" u o mov ax, 04h
% G' _5 c7 j$ X3 ~* A int 3
( {& Q% m2 ?7 I$ ? cmp al,4, o3 g0 u) ^* C. ?* Q# C$ w9 g2 j3 H
jnz SoftICE_Detected
8 M) R# y- y8 c# A1 B! \
7 i0 A8 Y8 E! R d/ m% n___________________________________________________________________________
- K( T4 U" S+ _) O* w) o% v& l' |5 ]) N" M4 T5 I' z u7 H' n- ]
Method 024 t( }9 b- R$ |0 d: H7 O% q* d
=========2 ~. ?8 S* ^9 T7 @
3 r/ `- N6 T5 O# LStill a method very much used (perhaps the most frequent one). It is used
k: X3 G: D) w+ F; hto get SoftICE 'Back Door commands' which gives infos on Breakpoints, D' K/ t6 ^+ p, M$ g# N
or execute SoftICE commands...
( x! C# v3 e5 N: g5 c0 h! X YIt is also used to crash SoftICE and to force it to execute any commands
* F% g1 |! i x6 o(HBOOT...) :-(( + V* A+ ~8 G: Y! }1 E9 S
9 |, L: R e- L9 aHere is a quick description:) U% S/ E& R! b" \! t. M
-AX = 0910h (Display string in SIce windows)
# U- c6 ^- f! l$ h9 q \. u* {-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)6 R- }6 C. P1 k h) N2 M1 }
-AX = 0912h (Get breakpoint infos)7 M5 w8 Q) N. Z. u- ^0 }9 u! G9 L2 K
-AX = 0913h (Set Sice breakpoints)
& r" w/ P' I ^1 m; R! v-AX = 0914h (Remove SIce breakoints)
; m, d: ^5 V$ \# ~& [" P2 H' _3 P( D6 k
Each time you'll meet this trick, you'll see:, g* G. C, E' \; _9 w! q) S+ q
-SI = 4647h/ {+ g4 P& m/ x1 i* m, G3 {
-DI = 4A4Dh
! `0 g8 G( O- p! P8 QWhich are the 'magic values' used by SoftIce.
3 Y/ E- \& W$ z2 ~8 NFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
# l7 ?/ v) @. P( J4 w/ R) l# E9 X9 ]- c3 S
Here is one example from the file "Haspinst.exe" which is the dongle HASP
2 b- j$ H7 P$ j3 l+ r# ?+ R. AEnvelope utility use to protect DOS applications:
6 ]) _% m/ x+ K5 q# k
! n: s0 v4 i$ `% w1 [) h4 q A* U# c k
4C19:0095 MOV AX,0911 ; execute command.) w2 p( {0 @ A! {% ^: ?" @
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
" N, b! ^. w7 e( v4 Z4C19:009A MOV SI,4647 ; 1st magic value.
+ j3 _( s w* R3 F( i o4 `4C19:009D MOV DI,4A4D ; 2nd magic value.: w: c; `* S' t4 `" f, } p; I2 w
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)0 h3 A/ H2 z$ b: N( Y* Z8 N) k
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
G3 I' h$ [3 _6 T% ^9 K1 z. Y; J4C19:00A4 INC CX
1 A. G: v9 l- B6 R% k4C19:00A5 CMP CX,06 ; Repeat 6 times to execute% C4 L& a! W: {: v2 {$ k
4C19:00A8 JB 0095 ; 6 different commands.
- g! \- ~# x5 k4C19:00AA JMP 0002 ; Bad_Guy jmp back.
7 D' q# }5 ?8 H" T8 ?- A! k4C19:00AD MOV BX,SP ; Good_Guy go ahead :)) d/ c/ s2 n1 m" C( A
# @. q& R& ~0 D" E8 rThe program will execute 6 different SIce commands located at ds:dx, which9 h" U: s; D, H) c y. e
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.( j5 Q2 j8 @ a" {
* h* r$ [; G w* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.& d4 E1 I, d4 @& I$ u/ q
___________________________________________________________________________
0 Z! ~3 O1 W( O3 l: @% B: u8 k
- L" G; S! D5 |: Z. P. n$ rMethod 03" V S. }& c R6 u0 g+ b# t! ]
=========" O+ E7 `: _6 g, K% v
) U* i* Z: w& ?9 [, cLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
# H0 Q! I5 o9 G4 S% f9 v# n(API Get entry point)- @+ E) ]9 a- t+ V7 e
8 W2 i1 V3 ~0 I# N# w S# t
; Y" T( i9 e$ {" V B xor di,di1 m. q3 R) G* c3 Y& Z
mov es,di
+ A3 D* D, F) k4 Y mov ax, 1684h . W' P* T: u+ d; X
mov bx, 0202h ; VxD ID of winice0 J7 h) U$ ?4 r. J0 Q( Z# ?6 B( b! E
int 2Fh! M6 i1 t6 g8 V# y" I: q+ V' L' B e
mov ax, es ; ES:DI -> VxD API entry point
2 M& O# Q( U8 X add ax, di3 O" ]+ I$ S5 J( d0 k4 o/ f3 k
test ax,ax0 ~* w9 F" H7 g) \0 ^
jnz SoftICE_Detected2 M+ W1 P! l/ \
3 M8 q: q0 F7 P3 u+ B
___________________________________________________________________________7 J2 m/ t" U+ Q! [( e! o: V
9 O! H( y% d2 tMethod 04
: d6 B6 I5 i5 _=========0 D& H2 |1 O8 A H- Q
1 v- W& c8 F" i; l/ r
Method identical to the preceding one except that it seeks the ID of SoftICE1 H, Y8 m1 {( F2 O
GFX VxD.0 n7 ]) T0 b9 u, \. y' @
: b, ]) d [4 z) S xor di,di3 G9 l& g2 N, z& L6 D
mov es,di
0 A* \0 H$ L# j; c/ [ mov ax, 1684h 0 D* _0 U% B4 z+ f: d- [2 M
mov bx, 7a5Fh ; VxD ID of SIWVID
2 K Z: C H! b. C- K: u6 P int 2fh
$ m# k/ x7 x6 r4 z# a4 i mov ax, es ; ES:DI -> VxD API entry point
: e" W; R/ N) k add ax, di+ f) h; a# s) S/ F' L
test ax,ax
8 Y9 g( U0 O9 m: y4 ~ jnz SoftICE_Detected
5 r8 a2 N' ~: a* S! ]( c t6 q! B8 q( p7 ^6 x( w
__________________________________________________________________________4 B7 a* H3 d" S$ o5 X, s
, E4 Q6 N1 z6 `/ p; h, t3 ]; B
9 v, V( g: |' A" Z9 K+ Y3 q
Method 05" W6 M$ u' X6 R+ R9 v9 y5 a
=========& M0 h7 }+ L" t! t
7 V$ L0 ~ m( I$ q8 H5 W+ o+ i
Method seeking the 'magic number' 0F386h returned (in ax) by all system; ^; x3 y& v8 y: s% W
debugger. It calls the int 41h, function 4Fh.
/ w/ L- f# R1 C! R* W2 lThere are several alternatives. 9 c- S9 _; [$ t6 C- j
% {/ g4 L1 ^9 S. z5 i' J
The following one is the simplest:1 Z# l2 b7 L! N( [9 H
g" f7 ?' i; F2 h! N3 n mov ax,4fh. ^1 H# T6 A0 {; E
int 41h
0 L2 w. r4 J3 [' ]0 s: O cmp ax, 0F386
; I6 Q/ ~4 a5 ]4 r3 L( O( v5 Q jz SoftICE_detected" w/ H3 C3 [; C* Y& D; |
1 H% M5 t, H7 b) [
7 D% f2 q# _9 k# f. Q
Next method as well as the following one are 2 examples from Stone's
5 j4 H$ _9 |" H. F* S4 r"stn-wid.zip" (www.cracking.net):
0 G8 L+ \$ }+ @ }4 m6 Z# `# F
: ?! @8 O* K1 N3 g, o mov bx, cs* @+ ~0 v7 a/ Z2 J. c
lea dx, int41handler2
5 \) n; O5 y" p' n9 K7 j) | xchg dx, es:[41h*4]+ y4 {# R& T, O2 S8 S4 p
xchg bx, es:[41h*4+2]1 U+ i* o3 M9 g2 C% r1 |' b4 a
mov ax,4fh5 h2 X' @: i8 z9 v% B0 ^* ]
int 41h
, a# R" S8 i6 ^* u% n, w xchg dx, es:[41h*4]
3 c" X1 U3 N2 d2 U xchg bx, es:[41h*4+2]% d6 f! ~' q5 L; w
cmp ax, 0f386h
) B- t/ ~0 [0 x& g- X u" o jz SoftICE_detected8 Y/ O+ m. } U3 k5 l
1 n* {. x4 @$ L" Xint41handler2 PROC& Y' X/ ^% G3 r# Z
iret
4 H& F1 S. X, W0 ?/ Dint41handler2 ENDP0 U7 J; `" V. K- e$ n) X
. N! Z$ d% f/ s# \% D- o s! A7 i+ G8 k
_________________________________________________________________________$ ]% `0 @# B& h' W3 S
4 H0 F* N4 F* s7 e5 \# z
7 ~: H0 ?8 N7 i$ P: D2 f
Method 06' b# i0 C' E6 L# ` d# l; Z
=========
/ K1 k4 B' Z7 E/ P$ \& C& c- Y* {1 Y
- `2 X7 V* G2 F) c) K0 p
% \* g$ A' j. A$ D; K* c) @2nd method similar to the preceding one but more difficult to detect:: j: a, U, b; Z) u( M+ W
5 X% P4 B+ L6 X
, m! C% g8 U* J% g0 k$ uint41handler PROC
8 r& O" }% I- j" k l mov cl,al. P6 r4 {" G, d. d- Z
iret! T- c. ]" t% O5 e& p/ H" b
int41handler ENDP
* ]; S+ T0 |8 F" n z" E$ w2 x% e7 r& l7 Z4 t! m
" l. |. o" D/ ] xor ax,ax% L' }9 d4 E D& h' p
mov es,ax g- K; K$ A( k* M
mov bx, cs
6 o& }5 D6 }3 K' l lea dx, int41handler9 r5 m# d% d4 d, G. y
xchg dx, es:[41h*4]+ O/ A3 ]% G9 R2 o7 T1 f4 d+ o
xchg bx, es:[41h*4+2]
9 U" s. |' X) r7 B8 X6 D in al, 40h
`! F4 h' D) h, a- G2 a xor cx,cx
5 n) l4 U1 T9 w0 G: z: q# z3 B# F int 41h; D; h/ x! Z$ o2 `
xchg dx, es:[41h*4]2 g/ Y$ M4 H& D4 X/ s
xchg bx, es:[41h*4+2]
* l! K0 G2 F* V; M K( H/ e& W( O cmp cl,al+ e4 u8 X8 g4 ]/ D$ n
jnz SoftICE_detected
; p7 Z {7 r+ g( q' w6 b
) \# F8 Y: N3 v$ r/ [_________________________________________________________________________, a% j/ L6 L; e+ v
% j# Z% j8 s G3 q3 s% vMethod 07. r1 f! M; M6 Y" A% y, L: a. Y7 s
=========+ T* {& G7 M8 N3 q! l: E& r1 }+ Z7 @
) d6 F' n/ Y5 E0 `, M {Method of detection of the WinICE handler in the int68h (V86)- H, k2 j! |. m- u7 y; o
! A" d7 W* t& N1 M- ?, a9 Z
mov ah,43h
5 _: D: j' e6 y8 q int 68h1 r1 Z0 }; Z/ _
cmp ax,0F386h
& W& K' U8 k( j* ? jz SoftICE_Detected
" A, h. G2 B. h& u( L. K. x6 _. V- a" ]' L7 I/ n) `
, O/ b4 O3 b! k; y4 M/ c=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
) o; m D7 s' ~1 n9 e. A* p' C app like this:/ D" ]. q* N0 n" l
# x3 O5 I8 p, X( j
BPX exec_int if ax==68
* d" }" C% a! ` (function called is located at byte ptr [ebp+1Dh] and client eip is
% ^. F. N0 E( L0 e K( n located at [ebp+48h] for 32Bit apps)
) d' s, c& ]2 D. r0 f( [4 k; u__________________________________________________________________________2 c8 t2 p: d$ c* `2 ?2 G: I
& S3 g) z' L/ r: x: @4 D3 v' i, }
Method 08
) L$ ^- @% h( s=========
* Z: h$ T( @$ M& @, G8 g' G/ v. }# K& c
It is not a method of detection of SoftICE but a possibility to crash the
7 X( D4 Y% Q# Y$ a; B5 y) s* Z& vsystem by intercepting int 01h and int 03h and redirecting them to another
' T1 p7 u0 g& mroutine.% R4 ^. s2 T- }4 s8 R' l
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
" c/ _# Q- X# _; kto the new routine to execute (hangs computer...)
& ]6 G3 ]. F# f
u, J) Y8 y! `3 k" a# s3 d mov ah, 25h' M/ c% b& r& Q7 K
mov al, Int_Number (01h or 03h)
& u. G7 T2 k9 R2 w" o6 j mov dx, offset New_Int_Routine) M$ p ?. E5 b( T1 j V
int 21h
5 |/ {6 [: b/ R; }# x% B# m9 \# D& u( V8 W6 O9 a& u6 q' X' Y
__________________________________________________________________________
. y+ Z# ?4 U* h* V2 a% ~9 R+ }3 d
6 H8 f3 @/ H& O C3 \( I0 {Method 09
. c; R0 ?4 U( P1 N; ^, g=========
0 N& j3 e) P, T( L0 E
# {+ w5 Y6 g X% qThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only4 U# c. J2 _9 n' c. I/ W
performed in ring0 (VxD or a ring3 app using the VxdCall).
% {3 R9 ^4 }0 ^' b/ \) GThe Get_DDB service is used to determine whether or not a VxD is installed
: h4 t" k$ }$ f Z6 Afor the specified device and returns a Device Description Block (in ecx) for) E' Z- _) l0 J* F
that device if it is installed.
: X! X m+ x0 W6 |' L2 h/ V' _8 s0 \1 d, v8 A
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
2 z% Q k/ K. E8 Z, R$ H% C mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
/ h8 U H" u/ t( e- Y+ }. a, e VMMCall Get_DDB; ?# ?( M' D: E- \- b6 ]2 u
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed' h- y$ `/ r H2 ^" a4 W
# V' v" f1 s5 N4 g; e9 m( j$ M) T
Note as well that you can easily detect this method with SoftICE:( K7 a" p7 s; Z3 j! k1 h) f
bpx Get_DDB if ax==0202 || ax==7a5fh. |# X/ U3 o' @6 Q3 j7 Q, X
6 T; s% p% Y: A' N__________________________________________________________________________
Y" K2 r. r0 E# U# E- f6 U# ^4 G
, Y# @, l) @$ D1 ]) o: \: ]! g- ]Method 10
! Z7 J9 u8 w9 n @! `* I=========
9 k+ B- X+ }4 V/ B9 i" o6 B6 u# t5 ]3 p) M
=>Disable or clear breakpoints before using this feature. DO NOT trace with
4 m7 L6 O# L1 F7 y ?/ q SoftICE while the option is enable!!
1 v* b* v9 I1 k" j2 @# j" {- P
+ _; v9 J; Y" |$ A6 |6 W; V# gThis trick is very efficient:
# d9 o4 w% g; w7 zby checking the Debug Registers, you can detect if SoftICE is loaded; p7 x2 b, _' s- p2 D
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
5 A; V1 D. x2 p) S. T# D g; rthere are some memory breakpoints set (dr0 to dr3) simply by reading their
?8 Z8 X, \! }value (in ring0 only). Values can be manipulated and or changed as well
+ @" O2 X2 i+ M$ i$ d(clearing BPMs for instance)
: F0 [" h* Z! _/ _
0 ?3 A! j( Y( b" A( c# L__________________________________________________________________________/ }" L/ _' \! |% O6 ?
' v1 D, b* O; V+ z4 l1 r @) pMethod 11% D: q; p" y( Y1 e5 u) P1 A0 _; r
=========
3 X- ?- U% T& I! z* F' h& ]% D O% X$ B) @
This method is most known as 'MeltICE' because it has been freely distributed% [) j5 M L9 [
via www.winfiles.com. However it was first used by NuMega people to allow7 D7 t! C& b+ X* m! I# J8 k5 D
Symbol Loader to check if SoftICE was active or not (the code is located0 z3 l b$ Q( v: b
inside nmtrans.dll).3 R# U; j, k0 P8 u, u
# v" a5 [* k; ?3 V* e% k, x/ V0 m
The way it works is very simple:
2 v$ P8 j' ?1 K# K0 O& xIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for$ i8 n' I. j }0 w8 V* f
WinNT) with the CreateFileA API.
% N% h: j3 r$ B+ q3 v6 o5 b9 m- s" L; r* t
Here is a sample (checking for 'SICE'):* A- G% n# b- F
# _' Y6 Q7 w/ k, K, bBOOL IsSoftIce95Loaded()) D, P7 ]: o4 d4 ?! `" h
{
" K4 m9 A9 O0 y9 G4 Q* }4 m* x8 A HANDLE hFile; - Z! j- t* m' \' \
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
5 g( {+ l3 n* H# o! q6 J) D FILE_SHARE_READ | FILE_SHARE_WRITE,
5 \9 G1 W: B d% Q3 F0 \0 n NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);3 y! E5 c, r* F
if( hFile != INVALID_HANDLE_VALUE )
9 R6 q" z7 E' @; i1 C) h {
W! n5 m* [; ~9 K0 S( Z CloseHandle(hFile);
8 W% E6 p. H# a- A. a0 a! g return TRUE;
- ]3 K1 T5 |1 x" j. p* f' h }
4 B7 b/ B- j9 ?) T1 [" Z+ Z3 C return FALSE;0 w, q! U+ j% g0 Z
}; B# R& Q, d- P6 |* w
& H7 B/ F, \' m( g8 ?" ?! A& V0 pAlthough this trick calls the CreateFileA function, don't even expect to be
5 a: e( c4 e7 c. B! L$ A( G( w yable to intercept it by installing a IFS hook: it will not work, no way!
, F" N4 I: U3 [) e, vIn fact, after the call to CreateFileA it will get through VWIN32 0x001F: v; B8 e: N" f" Z
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
# T2 x3 C0 Y0 `and then browse the DDB list until it find the VxD and its DDB_Control_Proc
" f, s/ q; R. H; W/ Mfield.
5 D$ J$ `% N+ c; m1 @In fact, its purpose is not to load/unload VxDs but only to send a
- f7 G" ~5 Y( \4 {. [6 Q$ TW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)0 T! M1 H* R1 _4 C: O
to the VxD Control_Dispatch proc (how the hell a shareware soft could try5 W% X$ t2 _ j4 N
to load/unload a non-dynamically loadable driver such as SoftICE ;-).4 m' K3 u: r# p1 ^ D
If the VxD is loaded, it will always clear eax and the Carry flag to allow
2 Z M; P7 D8 E0 I* J& aits handle to be opened and then, will be detected.
; v& d' R3 B( {5 p+ o) `: c" @You can check that simply by hooking Winice.exe control proc entry point
7 ^& b7 `: d1 h8 |7 C* U; P" mwhile running MeltICE." E5 I% J/ J% q: U$ w$ ]2 A
- |/ c. a: ]% C8 v3 w5 Q" b
) K, c& ?* o! F1 F" {( J 00401067: push 00402025 ; \\.\SICE
9 V8 j: [$ D" D 0040106C: call CreateFileA: N7 G G7 O6 {
00401071: cmp eax,-001
% n# V$ A# e. U- ~ 00401074: je 00401091
, Z# N$ E4 {4 E% I$ t' q. b1 [" \0 \$ M A7 G; ^3 w6 L5 o
6 J+ V0 I( A/ Q
There could be hundreds of BPX you could use to detect this trick.
$ W; W" p$ U) G-The most classical one is:
+ V0 W0 R/ Q! G/ b- M. Y. l BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
4 f% J0 H, y& k3 N5 J1 D6 c) W. o. t *(esp->4+4)=='NTIC'
& F( W; U. R9 [. n& l6 ^! v" f5 L: O
-The most exotic ones (could be very slooooow :-(
5 {- V6 x( ?' W4 G% F1 Z BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') 4 `+ u. R& g7 p- T, H
;will break 3 times :-($ |7 @9 Y; k4 K' k$ E
; K; o" ]6 k" \$ v ?
-or (a bit) faster:
4 z0 D* C: {/ `, \$ H3 h0 ^, D BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
! C6 o+ ]) [' [) A: g$ H4 C
6 F3 R" } u6 B/ o BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' . F+ u( U* x# E* M% d$ B; k
;will break 3 times :-(
) q) |5 z6 J& ^, W5 ^9 r) O
Y) g) p- w1 \* K-Much faster:
l7 C7 `' d% K4 n; h8 |& _9 | BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
2 T( c' U2 {+ R* |; L q& u- {& n9 K: H7 W, J& y' K
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
2 R% r0 } o1 [6 C1 E# [: sfunction to do the same job:
, p- V* d& P6 U% G
! a/ W+ e3 T, ^' Q push 00 ; OF_READ8 y1 a4 g7 s9 _+ e& m! I4 N
mov eax,[00656634] ; '\\.\SICE',0& J- F ^8 M, |7 m0 i' u8 n
push eax/ U) X, O5 d* J. n* G4 n
call KERNEL32!_lopen3 Y7 y: a5 U+ j7 F4 ^9 `' ~7 }
inc eax; I k% ?) n# o7 d- ^
jnz 00650589 ; detected
4 b. ~6 W: u! e+ h/ O( n9 ^4 H push 00 ; OF_READ
2 p+ f7 A8 m! n mov eax,[00656638] ; '\\.\SICE'
$ ~, d9 B' ^: U2 y3 `2 I push eax4 y- s7 P9 A, n. r. ~5 ~, i# i/ ]; G
call KERNEL32!_lopen" ?8 C8 V% U; f, d
inc eax4 A8 q$ [: U7 k9 a- K
jz 006505ae ; not detected3 K; C6 \5 i3 ^: r
" D- g+ Y& f, ~" f
l7 O/ G& X# b__________________________________________________________________________
( \, I# M! ?9 |4 T$ E0 b2 T
4 v' t% }8 P% Q- R, h( ZMethod 12
/ Y2 d' C4 W8 m/ W. {=========! n/ R4 E9 [8 X0 m! t& @# ^
7 s8 X( M c5 o! N1 ~; ], m
This trick is similar to int41h/4fh Debugger installation check (code 05
) A# O# B3 J! \" S& 06) but very limited because it's only available for Win95/98 (not NT)
" ^! h5 q5 G. z Qas it uses the VxDCall backdoor. This detection was found in Bleem Demo.5 `; `( D9 K1 b" f" |
. B" K; H( z. W3 ~
push 0000004fh ; function 4fh X# @- w+ n" |) p- D% y
push 002a002ah ; high word specifies which VxD (VWIN32)5 }, \, P5 i& A
; low word specifies which service
0 g3 A7 X& ] H4 \3 ?6 Y, D (VWIN32_Int41Dispatch)
; A. o1 N! D' ~) M v call Kernel32!ORD_001 ; VxdCall
J1 R: V1 P/ i/ D cmp ax, 0f386h ; magic number returned by system debuggers
( g( o- p. d' r: r) x2 Y9 S jz SoftICE_detected9 a! t7 ]( C K% @$ g5 m: |
6 u% q( B) O. a$ g2 Y- t( BHere again, several ways to detect it:
! k: N$ h% i1 f$ U3 b, A; Z- w @0 U$ c5 [: b
BPINT 41 if ax==4f; d" R* z, {& C- V# t9 X9 |
- z/ T; V; o( y% G$ C( Z BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
( J( K/ r7 c( q; p) X
5 @ `: x# k+ z+ Q _ BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
0 l& x ], `1 a8 l( X* R+ _) {
1 \1 Y5 `, z0 K9 ^, o$ h BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!: d+ \8 n, S& s/ G- U% Y4 }' q
8 ^; E6 O* T2 O& ^5 P( T
__________________________________________________________________________
$ h7 P. _9 l& Y* L3 s" z7 s# J1 b
0 i0 L; f* u4 s5 IMethod 13
; t& e$ ^+ y4 F8 ]: d; X1 ?=========
8 \' y8 @, S% ?# U& t0 ?
( p+ [* W6 m. ]: m8 D+ G8 L8 b9 p. iNot a real method of detection, but a good way to know if SoftICE is
7 }! d K) H+ j, ?2 H! Pinstalled on a computer and to locate its installation directory.) ~" h. J; B5 ~1 y
It is used by few softs which access the following registry keys (usually #2) :; I: f( ?# {4 L: j: @2 G4 r0 G; ]( N% [
" c: |5 y2 J* R5 l9 m( [) f
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
# s( Y- ]9 P. _\Uninstall\SoftICE; T3 x0 |' I, O, c; A4 E
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE0 M, }) o; q/ S7 X
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion. |2 m$ w, K9 }5 A0 @- u& q
\App Paths\Loader32.Exe
% y; u, u2 _* i
& L# @: T: Q; I+ {' ~' D* K1 ?' W( D% x* U/ a$ s
Note that some nasty apps could then erase all files from SoftICE directory
3 x0 f# w* i- ?: r4 F: y5 R(I faced that once :-(! I$ Y- X! t5 J# h+ ^3 A' P9 r$ G
# n+ H* D& ^ }& oUseful breakpoint to detect it:
* o/ b8 U. w4 B/ H4 l' y
2 z2 |1 {6 R; V8 S4 f1 u, v BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'* f7 d8 H4 I4 f8 t4 A8 A" D2 w
6 g* p0 P# E& j2 _0 m. v
__________________________________________________________________________
0 P: U, X' W6 U8 t9 s
, {8 D7 ?6 U. Z, U6 @9 } A) X7 z3 o
Method 14
/ P! }7 J! X/ D5 c4 q' U& m- Y1 u=========
& D" J l$ i3 _" @
" U6 O+ {! D( z. ?" Q5 Z2 l# XA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose1 d! f" l3 M; a/ F
is to determines whether a debugger is running on your system (ring0 only).; q) z2 U% q/ ]0 V+ v, N
9 K' F$ Q C. D: J; v( F+ _% c VMMCall Test_Debug_Installed5 n+ y& M9 {! |9 P0 y7 Y* A
je not_installed' ` b6 ^) [) f; D6 Q
/ t/ e8 s, _4 T& s- r: a3 h
This service just checks a flag.6 i H. o$ \$ c. |; e
</PRE></TD></TR></TBODY></TABLE> |