<TABLE width=500>: U/ o! L! y5 h6 Q; P
<TBODY>" `# F/ |- b: n/ r
<TR>
3 x4 D2 X6 n( p* z7 n9 _* y<TD><PRE>Method 01
% G! W7 K+ E8 o=========+ b3 Y" f t2 A2 R
8 E* \: B0 `5 h, U: b* T+ [4 y7 P$ u
This method of detection of SoftICE (as well as the following one) is
; k: V, S/ {' e7 q/ gused by the majority of packers/encryptors found on Internet.% O% |& |5 P: L2 i: g: I
It seeks the signature of BoundsChecker in SoftICE. t/ d( `1 u2 K
2 P7 {2 M, H) k. Q9 ^3 ?
mov ebp, 04243484Bh ; 'BCHK'
3 P5 g$ h3 B1 m. a) j6 \% ^9 i mov ax, 04h
$ F2 m# _9 A3 x int 3
3 I$ s3 M8 D3 c( E+ k% P$ i! ^ cmp al,4
. Z* i# S2 [1 P. p7 m9 h# I9 N jnz SoftICE_Detected
( P( Z4 ~% D2 G5 ]$ B( W
7 e3 [3 f& l: X___________________________________________________________________________
5 x( F9 O6 e. t# m& ]) z# F1 j
9 i' p3 o0 \3 _Method 02
j# s) @9 z+ s z$ e/ [. M=========
0 m7 d3 Z' \" y3 h$ o; g' s. ^4 L% }* D* p: w
Still a method very much used (perhaps the most frequent one). It is used
9 X# }" A& h% ]. H0 e% vto get SoftICE 'Back Door commands' which gives infos on Breakpoints,& `4 v& C& a8 i ?
or execute SoftICE commands...
2 Q( c4 z6 e& |, X" [It is also used to crash SoftICE and to force it to execute any commands
- d; X% V: ^! y$ `' j8 S(HBOOT...) :-((
: O7 p% ^" N5 J7 D S' E4 {3 U$ d. i x Y4 C' g
Here is a quick description:
) _6 H# l" |' [) S-AX = 0910h (Display string in SIce windows)3 j& p8 {* j" Y; t# z* h
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
/ F& r K. k' _& p. w8 E-AX = 0912h (Get breakpoint infos)
( Y6 M# w2 O0 ^5 b' e; g-AX = 0913h (Set Sice breakpoints)
3 [, U5 r' r* j3 g: X-AX = 0914h (Remove SIce breakoints)
$ O* D" k. _* g4 q' i3 C; L7 k+ m2 g7 P* Z- z# x0 e
Each time you'll meet this trick, you'll see:
( [ j+ d% D; L) r% M+ L) [! P-SI = 4647h
) O7 b3 D6 o, Y# N-DI = 4A4Dh6 ^% h" R' v p9 Q
Which are the 'magic values' used by SoftIce.
& P4 X. l: o/ m3 dFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.- r* t/ C# J# C" J
; m0 M6 v! [1 r, [- t) t$ b$ nHere is one example from the file "Haspinst.exe" which is the dongle HASP1 H$ R4 K* K) [) K! w( ~) X/ M- |
Envelope utility use to protect DOS applications:
4 G# O# W; q$ l
- ^6 j5 Q6 r5 U3 v: y! a
" Y m1 X9 N- ?/ l! }% L$ s4C19:0095 MOV AX,0911 ; execute command.
. D# c3 n! z# U& G$ B' J x4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).; o& E' C! @1 D* c
4C19:009A MOV SI,4647 ; 1st magic value.
" e, M6 v% _9 |2 \4C19:009D MOV DI,4A4D ; 2nd magic value.
8 d. f4 A4 n" Z2 G9 V7 w; I4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
( G( Z& h! w$ d8 z4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute7 O8 \+ R% `" l4 S% z
4C19:00A4 INC CX2 `( J$ {& |6 K
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute. b: a2 h" A2 P5 R8 O/ n
4C19:00A8 JB 0095 ; 6 different commands./ d z# W/ O [* P% ? ~$ o0 p2 T
4C19:00AA JMP 0002 ; Bad_Guy jmp back.
; h% l2 l+ c7 i4 ]( I4C19:00AD MOV BX,SP ; Good_Guy go ahead :)4 `( Q# e: u' r- Z2 d9 e$ h
/ h( k0 L" U {* y1 f- H
The program will execute 6 different SIce commands located at ds:dx, which
( `$ p7 f' N' J& `' y: [are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
" u& z& z$ X) p Y1 t
$ c& E: \* w+ J C# m1 g* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.0 X% h$ M; V5 }; a9 u: U, Q# L
___________________________________________________________________________
5 V3 r% Y5 d1 C$ U$ F% F
$ K% j9 d6 N, t, H6 f1 j7 {3 A4 V# R2 Y
Method 03
9 z4 X4 W. n, r9 U8 {5 W* {=========
) R k6 A) X9 h0 ~% _. \& V
' ^$ e: R7 @- GLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h5 N! F+ B5 ?( q) T+ D
(API Get entry point)
' T0 b: \2 R) j' [9 i6 u
! O5 @ Q: ]8 a* i8 J% D, `. B& L+ s1 f- D
xor di,di& ^: D4 o9 o+ ~4 U7 X, M
mov es,di C' g) V0 k* o2 c2 {
mov ax, 1684h
; U1 r+ q/ J8 Q( V4 E, g) q mov bx, 0202h ; VxD ID of winice
" a5 n' l! I: N: P1 B& e- _: q1 ?8 L: Y int 2Fh+ M/ r$ p; R+ ^ S K1 }% {
mov ax, es ; ES:DI -> VxD API entry point
) k8 Y9 {; L9 m, L7 \" m$ u# i" p! [ add ax, di
" U) c( W$ r6 e( q" N, v- Q test ax,ax; i7 ]; G1 w9 _! U+ d4 p
jnz SoftICE_Detected( g9 p! ]. P1 ]! H. j* X
# F: K/ E4 F/ J, c" s X5 S___________________________________________________________________________
3 I' w: t* {) D' d% M5 Z M0 {2 u
" @ m7 {8 F* j/ D k: }Method 04% S2 ]4 L- a8 m% B. q3 I
=========
3 X1 S$ O1 |2 g
' p# I. |3 n/ a$ S- n) y) F7 VMethod identical to the preceding one except that it seeks the ID of SoftICE" v6 |9 l+ @" ?( q6 ~( i
GFX VxD.4 E# M \2 f" }* k; }
* T1 k8 x: N7 }( |1 ^5 A- k9 `
xor di,di( B+ a1 R$ I+ G, s/ w4 ^" N7 K
mov es,di: m6 O/ n/ Z6 M5 \. R
mov ax, 1684h
+ U9 \6 T, F. S$ y mov bx, 7a5Fh ; VxD ID of SIWVID# j1 o4 J$ ]8 g0 N o
int 2fh
$ Y& a; o4 Y K) I0 K mov ax, es ; ES:DI -> VxD API entry point
5 F; e% O L* F5 r add ax, di- K* \7 {, H+ h) Y/ |7 @
test ax,ax
* b$ ?* K; K9 q! J: | jnz SoftICE_Detected
3 v, V0 B l+ R; }( z) `% D
2 M& z- `/ @6 ]__________________________________________________________________________
; o* l! q+ f# M: i2 C. C: T8 w& k# \) x3 k
1 J( b u/ z$ q! Y+ w$ b
Method 059 M8 X. a- G, ?; M- m
=========
3 h5 }3 W; O/ R2 y9 A9 ]0 h4 B% @" Q6 `4 K# Z) k' t! Y: q
Method seeking the 'magic number' 0F386h returned (in ax) by all system/ D; T# S- A. z& o
debugger. It calls the int 41h, function 4Fh.5 [8 H7 F/ i9 B" _0 a
There are several alternatives. 2 x! Q. z. R) r$ E7 X) H }
9 `2 b. ^+ U" K, K+ W
The following one is the simplest:
$ c6 Z' v5 \% J. b d+ f& b6 P' M+ u6 y1 \5 J b! W0 _# z. f7 n
mov ax,4fh( {% {1 Z! {% W/ @% s+ l! Z3 I
int 41h
/ h; H) T) ?6 A1 [' | cmp ax, 0F386. y$ T- U6 w: m# \1 J" r
jz SoftICE_detected" d, i" J0 D. ?& v s
8 Z5 T ]0 `% D4 B/ A
) r! k- X" ?1 F- u- MNext method as well as the following one are 2 examples from Stone's ; g! S* f/ Z$ s5 M8 K0 w' c: S3 h
"stn-wid.zip" (www.cracking.net):0 ?4 I+ C6 M/ f7 m& `
6 i$ v2 _* y+ B4 |2 p* d4 s mov bx, cs' _# s. `2 z! d
lea dx, int41handler22 `, [& D2 }2 |0 {* @9 u5 m" ^
xchg dx, es:[41h*4]
8 G) ~( V/ D& b; E( G xchg bx, es:[41h*4+2]
1 Z/ s0 s7 q z z! | mov ax,4fh% L- N. Z& _8 Y0 d
int 41h x, Y, y! ?$ u5 s/ D+ j. c, {5 \+ E
xchg dx, es:[41h*4]8 |1 V) `; P4 M" ]6 O
xchg bx, es:[41h*4+2]0 M. k' w! g% d a' I/ ]
cmp ax, 0f386h! g+ W8 p! v$ f$ [
jz SoftICE_detected
0 F" D0 a5 C' D6 X0 M0 |, [4 G
. a A) s5 [+ O3 y) sint41handler2 PROC
# F" k- ]7 r+ r2 ~ iret3 L- ]( Y2 H& z5 |3 y n
int41handler2 ENDP9 H; N" N1 F$ A, S' G _
: [% ~ T% Y) Q: W' u8 `- u! B5 H. z V' }: F, q! ]# p# N
_________________________________________________________________________! j& }3 z3 v r; q4 n$ |( D! y/ ]
6 a- `: G1 { j% d ^
' _% ]# G. C2 g& SMethod 069 c2 H; Y$ R. N0 Q7 @' D
=========$ G( r; N4 J% Y3 w& n/ o Q
' u0 F) }- P# Z6 h5 P% V
3 A k& s% P1 b* B+ g y) z2nd method similar to the preceding one but more difficult to detect:" a; C$ z5 [: Q- n2 i! f
5 h" } C `9 G! d' o3 x; F7 ~
; o# `0 H* _* i9 v( vint41handler PROC
; ^8 f; y+ g/ C3 Z mov cl,al
' B8 d% j( f9 g: k3 w iret
4 ]! x$ u" ]3 D+ Yint41handler ENDP. v- g- _2 V# v+ x/ Q4 q% W* \
2 X/ [% [4 R/ W+ e
, \/ k3 U9 Y$ C6 B
xor ax,ax
8 ~; l9 i9 {' d0 z* F! O. w- r5 e mov es,ax
T0 v1 b) a% K4 F! C7 R mov bx, cs, M e0 M! ~4 G0 b' X: P8 l
lea dx, int41handler
, A3 x, X, Z* e. p xchg dx, es:[41h*4]
: S! C+ [4 U7 f& ` xchg bx, es:[41h*4+2]
5 H9 O. m9 a. m! H7 |2 l in al, 40h2 O4 ?' t( F) W8 E7 {9 P( }
xor cx,cx
4 K1 S% A+ P( Q$ a, J/ d' g2 e0 D" [0 I int 41h' ?+ _1 K: a( V x
xchg dx, es:[41h*4]
6 l2 V: O; k& @! `, T xchg bx, es:[41h*4+2]
8 u9 Z* o: }( |) M. _2 @5 \0 k ] cmp cl,al1 n% n2 j+ |: N1 Z' L
jnz SoftICE_detected
, X. w2 J8 i6 }2 i! M, [% S. O/ C, L" c0 B; s% d; C; z0 T4 H
_________________________________________________________________________+ K% G1 i2 `7 F& v
; ^6 T B" Y6 s5 u3 v1 cMethod 07
; ]3 E' o' u0 f3 _( j7 n9 x=========% }" N }) X0 p) n, ]
$ b. \$ `1 I% J8 m( G* K( p
Method of detection of the WinICE handler in the int68h (V86)
( e; d3 |, N* Y" g N
- Z/ q0 o0 d, s2 q# |; T mov ah,43h
# T/ ~/ m6 B0 l4 `+ A y' K int 68h7 m" w$ `6 l6 G/ w' u
cmp ax,0F386h! m5 L# V- ?( s
jz SoftICE_Detected# N+ v( n$ ? d9 g
& W5 r( H0 Y) K5 \ E1 l% L Z
) w8 `# G7 f$ ^( ^! m=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit- a$ k+ ^7 r1 M4 ]
app like this:
: r6 Y7 I/ o' `9 x9 _& K# L
. a2 y) T( z3 _9 p+ k BPX exec_int if ax==685 R7 V C& U$ [
(function called is located at byte ptr [ebp+1Dh] and client eip is
* Y. |" w3 o1 B: ^% A+ |/ O located at [ebp+48h] for 32Bit apps)( p5 W7 N0 e: } N5 J2 x: s, x7 ]/ s
__________________________________________________________________________( E& _% R8 D& m: D- U$ J
2 R" G) E r& w& Z. C
* v, D% C4 M( j+ D0 S% UMethod 08' m; m5 b8 m4 D* w. e
=========
2 g& W, z& ~: C/ v$ `; L- }
I2 c' W$ m( RIt is not a method of detection of SoftICE but a possibility to crash the
" d: a9 N' f- H0 Y8 c; Psystem by intercepting int 01h and int 03h and redirecting them to another% w- q" L2 H0 _
routine.# b& e% m3 P/ r: U6 _/ P
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
% e+ e' @6 C2 `: C3 Yto the new routine to execute (hangs computer...)3 V" A& C8 w7 f/ m% S
) |" |/ ~; X% V8 l+ E/ h& ?) p5 i0 E mov ah, 25h
( I7 X( ^% N6 Y6 B# e1 f8 m mov al, Int_Number (01h or 03h)/ S5 j: I2 V6 g/ I+ N0 s+ I
mov dx, offset New_Int_Routine/ n- H; d5 d4 X" L8 A# c9 {
int 21h
& F. ~# p9 D! `7 X+ S4 {7 R( L% v$ n& F" Q% Q# r( S* C
__________________________________________________________________________2 r! T1 I, f$ \% A. m
5 |7 y& l- P8 @
Method 09
1 s; m' ?5 x+ M8 P$ l3 y: g$ L" C/ {* O=========
h8 W) C: @ n1 {/ q8 d& ?! D. l# F9 j' F1 |$ W6 g
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
4 `! [: W; c$ ?5 G1 M8 O/ Q) _performed in ring0 (VxD or a ring3 app using the VxdCall).4 U1 s! N7 Q& g* D! z1 I
The Get_DDB service is used to determine whether or not a VxD is installed: q2 U- s5 q% k( `% z' g- ~% L
for the specified device and returns a Device Description Block (in ecx) for. W$ g- H$ S( t! e$ G
that device if it is installed.& e- D0 F6 m, C. S3 I" I, D6 K' \
5 G+ j' X8 I, [2 u( Z" I
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
$ M: T/ U/ l5 s1 e! Y mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
- E3 v/ r$ u( I) i% y- d$ Z& J( C# k VMMCall Get_DDB
" a) f' W/ \- Y mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
1 v, ^* o5 g; F, W0 a& T1 F0 l* A [1 b
Note as well that you can easily detect this method with SoftICE:/ F+ b: a, P. i( i; e; X
bpx Get_DDB if ax==0202 || ax==7a5fh8 ]' F3 `0 X) K" [( Q4 j2 J
+ a9 E8 ?6 M w; H2 B- R/ V__________________________________________________________________________/ ?" G4 @, B5 B+ q9 j, U
4 R! D. m% t( PMethod 10) T/ {- ?$ _; c+ v
=========
, F0 ?7 c# a/ J
6 s; L. a5 z7 c=>Disable or clear breakpoints before using this feature. DO NOT trace with' S/ }5 V d1 E' Z+ L9 B" a
SoftICE while the option is enable!!
0 x X( d' `3 Q2 t% i( i
4 S0 @7 D8 T! A9 \/ \This trick is very efficient:4 K4 F4 X$ s$ E# l# O# A- ^
by checking the Debug Registers, you can detect if SoftICE is loaded6 G) p3 v0 I) j+ X% |7 w
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
! m) Q* i) T. h1 [there are some memory breakpoints set (dr0 to dr3) simply by reading their
2 o0 y8 b) k. jvalue (in ring0 only). Values can be manipulated and or changed as well; i$ O' o$ J3 e. j' s& \. I1 ? {: ?
(clearing BPMs for instance)
u9 h4 W: s' U6 N4 h8 d' E* S: t% H/ g2 ?7 |: k0 l6 b
__________________________________________________________________________2 ~3 i; k( U2 u+ V
' L% `3 R& N4 d. H9 UMethod 11$ K. a x% T$ d- f: r/ v9 M
=========
* E* o7 J7 l3 F7 e; w$ Q" @! w/ Z, N) n: |7 x2 N
This method is most known as 'MeltICE' because it has been freely distributed
0 d+ M A x. b7 j3 E/ mvia www.winfiles.com. However it was first used by NuMega people to allow$ W. h+ b8 K9 ?' Y" H/ J
Symbol Loader to check if SoftICE was active or not (the code is located
4 [8 S: o$ ~1 t4 u: rinside nmtrans.dll).
$ b9 y5 i9 u; F* M) i) F! q
9 |; w1 e% C$ ~The way it works is very simple:
# j: _, W2 h* a) n8 p* _It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
, x9 B4 V% C! z s3 LWinNT) with the CreateFileA API." {& u7 C! o* X/ q
K1 p8 c T& m+ M. D, Z1 P7 i
Here is a sample (checking for 'SICE'):) m; z0 D& o- M* h
! T% k3 x5 D# s5 q
BOOL IsSoftIce95Loaded()
L; P% d( t& S{
, t* d! o3 \6 a0 _ HANDLE hFile;
! W) }- h1 v% r: Y0 P5 y1 R- \ hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
5 r( v5 T2 k( I9 o6 K FILE_SHARE_READ | FILE_SHARE_WRITE,
# P. T( D% g8 k NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);# Z2 K& t; {5 n. e4 I# g& i/ V# U. _
if( hFile != INVALID_HANDLE_VALUE ) F; Q9 z. L+ k4 f, T5 l/ A9 r- |- S
{
: H/ s1 [* T7 n7 a CloseHandle(hFile);
/ Q4 G' v* ?+ v return TRUE;
' t/ @; \$ j4 ^5 p, |9 d }
' s5 C. U, h. B4 \( R return FALSE;1 t; p2 l& Q+ Y. @, p
}
; Y9 f& b2 N' \8 R G+ V+ g0 Z2 B
% e4 R( [% {4 X s# d( @Although this trick calls the CreateFileA function, don't even expect to be
& H+ l6 B3 ]# }# M5 L% ?; Hable to intercept it by installing a IFS hook: it will not work, no way!
# b& X, j2 F) l, LIn fact, after the call to CreateFileA it will get through VWIN32 0x001F" c$ t1 r; J$ j# @! j, S
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
9 l, U9 W: Z/ ?; O5 w) |$ Yand then browse the DDB list until it find the VxD and its DDB_Control_Proc
3 C* o; C6 p# \field.
3 ^1 u, f( g7 A; Z: y% k% v& XIn fact, its purpose is not to load/unload VxDs but only to send a 3 X G' X& o- G. D/ s! f U
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)2 ~3 \$ Z) j9 O P
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
- X$ s& l1 _9 T( n: f% Jto load/unload a non-dynamically loadable driver such as SoftICE ;-).
4 a/ |1 G. _9 x' x5 p6 [If the VxD is loaded, it will always clear eax and the Carry flag to allow
7 O* n& q l. u' P! _$ iits handle to be opened and then, will be detected.0 n8 G& H; n5 a6 }6 X1 S: E
You can check that simply by hooking Winice.exe control proc entry point; z6 C7 X0 D$ |( F& o+ u1 h$ k
while running MeltICE.
6 n/ x2 L( N5 @: h6 B( J( U! b- F8 b& ]& Q5 W3 d! {( X0 L
+ e1 o) {, |/ R! y& ?9 ] 00401067: push 00402025 ; \\.\SICE% D5 L. ]* I! U& B
0040106C: call CreateFileA& b) Z- P, V% C; E& V
00401071: cmp eax,-001
% ]6 Z, D) J% U; h3 L, ], _3 l+ z% n 00401074: je 00401091
3 a/ d* B* A) a% W2 D7 a/ R
9 Z+ q _1 S! d
9 g7 O: Q3 T& `4 U2 _( sThere could be hundreds of BPX you could use to detect this trick.
3 m1 y4 Q3 M; d$ D6 }-The most classical one is:
' J2 ^# ~' p( o0 }$ L8 q) e' ^ U BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
! ^2 m- ^7 h+ a) `! K *(esp->4+4)=='NTIC'
& G4 @ P. e% l; e4 B0 I( R, E" n* L% N9 q% d, }% s9 N2 F
-The most exotic ones (could be very slooooow :-(
+ E8 ^% y, z! W5 G BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') ( [* V2 E7 N( p
;will break 3 times :-(, E$ t( ^& F6 x/ r
3 m& \$ H! J4 s; Q-or (a bit) faster:
, K* z9 @! L2 u& m" d( K$ @ BPINT 30 if (*edi=='SICE' || *edi=='SIWV')8 ^3 \5 _5 O) z5 H- ]
, H' p; S5 r; t) H
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
5 ?# S4 P" ~4 ?7 f6 c( Y ;will break 3 times :-(
8 F+ V9 x% k+ E3 z( Q, k$ [* v @1 x, I0 o
-Much faster:$ f# Q4 w! C$ Y% A! [( p/ }
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
0 a/ |+ l4 Z* |7 `
* X* \# I" s* C3 B0 f+ eNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
+ _9 E; Q# @/ I1 h# a# q/ p# afunction to do the same job:
2 W2 f4 |/ |0 }, u! X% n! l$ g @. x
push 00 ; OF_READ3 }, ]1 v! G6 t7 i8 F* J: i
mov eax,[00656634] ; '\\.\SICE',0; a3 P3 I, c- A" g6 z
push eax' u/ D( j, q6 L' @' ?+ R! G
call KERNEL32!_lopen" Y0 i3 m- n2 c& p' I3 h
inc eax$ p7 ]# z( M1 r: d
jnz 00650589 ; detected
4 q! P3 \8 ~9 H a d push 00 ; OF_READ
6 ]! \8 J) S" C2 `$ j5 A mov eax,[00656638] ; '\\.\SICE'
) S. p. F- Q, L( e& a) ]" {) _ push eax
+ y$ k1 e- W5 B. a u call KERNEL32!_lopen
8 [4 ]$ a+ w; G* V inc eax# l% r: O$ H' t8 a* Q
jz 006505ae ; not detected, a" A: a C; {% I* \7 z( c5 s) R
1 u6 Z& _+ L6 \/ J+ }) ]
! k1 O( h5 n' I4 V- z' z" Z__________________________________________________________________________
6 V# R/ s! }7 W6 S6 P5 o) F! b! }% Z/ l" v
Method 12
) R6 F2 X5 J9 b=========3 B5 b. g# E% s* c) c! u' u. ~
0 P7 o7 u! t6 D; R1 qThis trick is similar to int41h/4fh Debugger installation check (code 05
3 K' U: U r4 @: j& 06) but very limited because it's only available for Win95/98 (not NT)# C. x v& I3 f+ y9 f3 P9 s6 ~
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
8 `( A* T! r o# C# y2 d( v0 j" e; Z+ k# B6 U
push 0000004fh ; function 4fh
0 ?6 N( X- ?& Z push 002a002ah ; high word specifies which VxD (VWIN32)
, p. d6 G0 K, b& X' O ; low word specifies which service
0 @3 Q2 Z/ e e (VWIN32_Int41Dispatch)
( S' O6 R2 u6 ^( I+ }/ F* d call Kernel32!ORD_001 ; VxdCall/ N% C# M2 F! b3 n+ U' @7 U& P0 z# c
cmp ax, 0f386h ; magic number returned by system debuggers
2 x# \" ~2 Y) p& r8 ~6 o9 P! ] jz SoftICE_detected B4 W8 E; Q* W5 I% r3 `5 s
, T# W9 |9 x* zHere again, several ways to detect it:
% s1 x, C4 I; G- M
' c# ~. ~& P& `0 B" I9 @. M9 [ BPINT 41 if ax==4f
3 ~* _% `% ]: U9 U @
5 Z2 T' ]1 W F# f4 x BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
8 x4 C' j7 ?8 b1 T' U8 }" w" E0 O: s7 L! z) G
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A6 I k3 d3 n+ `$ c" O' D! p
4 W9 G; G5 U3 z7 o; D1 x6 g" T BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
; ~/ y4 f9 ~' A3 P# L5 b. E4 z7 \ q2 Y9 o+ Q5 R3 S. T" x7 Y& V: c
__________________________________________________________________________
, f! R# T7 a5 V
5 H- Z5 l( y IMethod 13$ i) B+ i H( S4 c
=========" I% e5 a9 I& g5 r5 m
! P- a7 K0 X( b8 ?. _
Not a real method of detection, but a good way to know if SoftICE is
# b; p& o. X9 v t3 ^1 \installed on a computer and to locate its installation directory. ?7 r# B7 `& S
It is used by few softs which access the following registry keys (usually #2) :
* D9 Y: b* U3 z( P7 V! ]
* T0 V+ `5 y5 p! l- U x! w4 b-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion* g8 ~, E4 K4 r+ \
\Uninstall\SoftICE
$ X6 Z( m' d6 }-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
$ Y, I/ z8 H6 ]% D-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
( m" t9 E, i7 A# Y e\App Paths\Loader32.Exe
* v( S9 _& d% v U7 C, j B- H" b) @ P4 c/ m7 [ `
0 h ~' X( i' M" S: h1 W- ZNote that some nasty apps could then erase all files from SoftICE directory; B& s; L' a" E5 c6 l$ J
(I faced that once :-(
9 t( Z+ N7 b! R5 C8 ~. d
, ^. o/ b' J# Z* B. XUseful breakpoint to detect it:
& }4 E. ~1 d& \7 C' S) E) v. n+ m( |) U
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
" H! M$ |' K, d, K1 R4 d/ _) _0 X8 S& t
__________________________________________________________________________/ m# ~% ~ s3 X* ~4 { v, f
0 {8 O# P3 v# S! i7 f; Z- a9 F9 c# ?. O1 s, i T5 K
Method 14 + z2 `' u; j% D! r: W) q+ v6 g: w
=========: f3 p$ a/ j9 L' u
' g& g% v) O, J) w. b4 D+ F# h) jA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
1 X. p4 {8 j+ p" ?is to determines whether a debugger is running on your system (ring0 only).
" Q. T7 n8 [" W8 B; v7 w
' Y* ~& s( `* K" P% _, _& n$ D; H VMMCall Test_Debug_Installed1 i% g" ~# O0 Y7 y, ~. U, U' F
je not_installed
& x9 s8 |0 S4 q ?9 z( Q/ b' y+ A8 z9 i9 Z
This service just checks a flag.+ Q; B9 s3 M. [- ]. W1 \: J' W
</PRE></TD></TR></TBODY></TABLE> |