<TABLE width=500>$ v% I, x4 a D8 R- E. Y. F
<TBODY>
' ]+ m8 y9 ~! k% \) o" ~* j5 D<TR>
8 R) W* z" [3 L7 i( }) ~$ ^+ T, P. H<TD><PRE>Method 01
* b# W% N; _* ]=========
V* L9 N1 k* i6 ?" m0 d) L2 d" X' B1 ]" {9 h U
This method of detection of SoftICE (as well as the following one) is$ e; P: C/ z5 o y: g
used by the majority of packers/encryptors found on Internet.
- |2 h6 r5 l/ ]( n" CIt seeks the signature of BoundsChecker in SoftICE5 }$ C& o$ Q2 f* r( G% ^
( G7 j4 ?: s/ x6 x8 v
mov ebp, 04243484Bh ; 'BCHK'+ M. m W6 Y. m4 H" V( M
mov ax, 04h5 x* _4 K! C4 x% e3 w& I$ y
int 3
9 o/ m, N, ?8 b3 z- S2 C$ _ cmp al,4
" T7 r% b1 p; t! k- O jnz SoftICE_Detected4 n4 N6 l' ?9 t1 {/ m, k- r
6 O4 ?. q$ S/ k }0 Y___________________________________________________________________________, V' ?9 ?! D& ~
& \! F) H# H* ~5 o4 xMethod 02! _, u" K3 O C4 z+ ^
=========0 {/ S# S3 c% \; S( W" L1 h
1 M7 G' F0 F* `$ B; c! |7 r
Still a method very much used (perhaps the most frequent one). It is used* S- `8 A1 X- t; z
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,& f& K7 K& p0 N
or execute SoftICE commands...
) Y* C6 B( F; E4 cIt is also used to crash SoftICE and to force it to execute any commands/ K$ @7 u3 q+ x% R& [
(HBOOT...) :-(( 8 Y, R9 h6 z+ T2 l7 ^8 A: ^, ]/ k* d
4 t) Q2 M5 }' S/ f3 O3 q0 i$ v
Here is a quick description:, b3 \% \5 Y6 ~9 h& ?
-AX = 0910h (Display string in SIce windows)
) t( M8 {/ U( ^* L7 @-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
1 S' |: U, p9 ?-AX = 0912h (Get breakpoint infos)
) N- o! k( G- ^2 I# V* U2 v( G-AX = 0913h (Set Sice breakpoints)
1 B( F, D0 v3 u* m" Y& m8 ]-AX = 0914h (Remove SIce breakoints)
# A0 \! a! [: }5 c
6 ]# a: R1 x# y" o3 h! CEach time you'll meet this trick, you'll see:5 U; i: w4 L& h8 S9 w( y
-SI = 4647h5 O" k) Y) ^6 X: D. G6 E9 w
-DI = 4A4Dh/ b$ X; y' n9 J1 ~
Which are the 'magic values' used by SoftIce.% H0 j! f" y) U& v/ q5 _- c% F
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
1 v3 |; s7 A# \6 B, ]8 U1 l% k$ I# R, G. @- F
Here is one example from the file "Haspinst.exe" which is the dongle HASP4 D7 i/ I# q, n5 v
Envelope utility use to protect DOS applications:
& V0 c; U$ _$ y8 `7 B& b
7 x5 j$ ^" r* a" x/ y* \
' D4 e ~6 B( L- {3 o: E4C19:0095 MOV AX,0911 ; execute command., n6 q- U, B" J! V' I2 V
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).# @) o6 Q5 u8 |0 i$ K
4C19:009A MOV SI,4647 ; 1st magic value.# i4 @1 m; u7 p
4C19:009D MOV DI,4A4D ; 2nd magic value." Q- {3 i3 L$ W# a" c0 S8 u% _
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
' ^+ f3 m0 p. P( U% b4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
. X; l* {0 N! H9 K! }2 X/ @4C19:00A4 INC CX
4 _, K' b, X: |" E1 T# j4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
0 O' N1 o6 b: Q6 i- A9 ^& W4C19:00A8 JB 0095 ; 6 different commands.
3 t4 ~) J( K/ q) z, e4C19:00AA JMP 0002 ; Bad_Guy jmp back.
% c: a+ t9 Y) O- M$ i4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
8 ^! D0 H9 s( b2 T T
" |2 L' ]* I( G/ \: }% _3 U2 |. t, AThe program will execute 6 different SIce commands located at ds:dx, which
" z. m1 g. o, B8 ~! e- ^are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
6 Z# }! A3 T) ^1 f2 h* U7 s! i1 {+ {% G# D, u# h+ {& o `0 d
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.) }1 V7 y* g& C( W; L5 i; p
___________________________________________________________________________
: X( e0 D% p& C. S1 p9 G, `9 z, Q. Y4 B) k
+ c# {. h! x$ L- V/ uMethod 03
4 n( w- H; d4 D1 T: j) P=========& w) B1 I! V; [2 r
7 s: S/ ?- [: @4 pLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
1 ?% B+ a$ L. a" m6 M! \(API Get entry point)
5 Q( y2 Y( l2 A' f: i
# d1 V* [7 h7 S4 F3 x0 t' o* I
% D! W: r7 v I; D5 k6 X xor di,di
0 j# W, Q$ G3 M' q, o9 p, b mov es,di* H" s$ M% g6 s+ ~# i8 s
mov ax, 1684h % w- d) z8 j. _/ l7 X8 h
mov bx, 0202h ; VxD ID of winice
( E3 J" D: ^% ] int 2Fh4 q/ q* s- M+ t5 I
mov ax, es ; ES:DI -> VxD API entry point3 t) R: n* y( i& e4 D
add ax, di
: n2 S; }4 Z8 @0 g test ax,ax
9 x* Y- K0 b" i jnz SoftICE_Detected
2 Z4 J/ P4 d; T4 W6 V% m/ i" h
! y' X& l& b$ m$ N___________________________________________________________________________
1 r8 j/ V2 Q( l
) C! T5 H' d3 Y" D3 m: q$ BMethod 04
& T% |3 p9 F/ Q' Y2 G4 ?: \=========
+ A! w$ |- s) W9 ?9 H8 m
6 P" ]- J' I# e5 X9 |; ~& j- UMethod identical to the preceding one except that it seeks the ID of SoftICE
% a; e+ N2 r$ Q4 wGFX VxD.8 O* c9 W* c# }
& V! \; i) e% J
xor di,di
# s) F0 y" V& `* d" ? mov es,di2 y4 w1 {& |2 X3 P# F( f
mov ax, 1684h % m, d" z; n4 h- ^# w
mov bx, 7a5Fh ; VxD ID of SIWVID
9 P1 w; @) R. u: n+ I3 ^ int 2fh9 w- S+ Y& J! a, t& I
mov ax, es ; ES:DI -> VxD API entry point
/ _1 K n* B5 f* } add ax, di) B3 i8 ]: M. R" D( x- B
test ax,ax
9 O8 n, j0 ]5 J8 Q2 d+ X+ i jnz SoftICE_Detected
( n1 Y N$ b H4 l/ \
& T1 |" f) c. V( p8 D__________________________________________________________________________
' [$ ^8 `# Y/ ^" l2 b3 g, o! V8 m8 F" H3 M- m
# q" Z7 t5 b- M) ~Method 05
7 h, b3 A2 r# p( a( h" Z=========# n! s5 {. i$ C, l; f& z
: j1 W9 n" ]7 ~" |% T# ~5 [
Method seeking the 'magic number' 0F386h returned (in ax) by all system
; q# K' ?' G$ [8 Z; `debugger. It calls the int 41h, function 4Fh.% E% G9 q) T; y5 G: z
There are several alternatives.
) A/ C" e! T" P6 Y4 q, z. z% t
% ]) z8 o. d7 O* R6 O! m% c$ QThe following one is the simplest:
1 | f6 ~5 \" h' o4 w: }6 A! r0 [ k3 E9 |
mov ax,4fh
$ Y$ Q+ i3 q v! G7 \0 ? int 41h$ N9 W0 d3 c/ X+ { p X( z
cmp ax, 0F386
1 T1 ~# L" d& |+ {2 C0 p jz SoftICE_detected
5 S5 x6 z' [( \$ T5 a3 A
, p* S8 \. R3 E4 E1 s
( _' G% d% Q3 i( a3 W8 TNext method as well as the following one are 2 examples from Stone's
! r( Y! X4 y: H"stn-wid.zip" (www.cracking.net):8 l; f, T. D' p
- X; E: U4 V' w5 a8 Z8 G% { mov bx, cs
* a. Y2 ~! R% O [% R lea dx, int41handler20 y+ u* o) U; h7 e# Y
xchg dx, es:[41h*4]6 L) l( K; y. U) n: C
xchg bx, es:[41h*4+2]
; z5 `0 R$ T" K3 k( [+ a mov ax,4fh# U6 F. q8 h# l" o: a5 [
int 41h
; y B/ x9 _% g* Z9 A9 d/ o xchg dx, es:[41h*4]
9 s9 a/ U' F2 s8 W ?- D xchg bx, es:[41h*4+2]
3 c: x I' p R0 p" K- M! l cmp ax, 0f386h
. ] G: y7 h+ \! s% M3 a jz SoftICE_detected
- w! t3 J2 G- [7 P% o
$ L P, O& O4 _int41handler2 PROC
# a6 P! N3 n( l4 F0 S iret, a9 Z8 l% Z: F
int41handler2 ENDP# }- U4 k/ B4 b" G! F2 N0 c/ ]
* k5 a! p' \6 N* t6 m) q
* U5 z( `5 ~4 L$ @% g: L. w
_________________________________________________________________________- b) o1 D0 [) r3 x
( ~* Q' `! A! T" J
* [5 c5 L2 l8 I. s$ B$ s# u
Method 061 b* ~- A* _# N) o) X. o
=========5 d5 G3 z( X( G/ W
" p8 n; J- _7 v8 B
% D( A y$ x+ a/ H# A1 X$ f
2nd method similar to the preceding one but more difficult to detect:
5 r: N1 v) n h0 ^
9 ^2 @8 M. S! H
0 s+ ^6 s/ o& Bint41handler PROC8 T+ |: Y5 M7 D' s
mov cl,al
' u5 ~4 |) \1 E) L2 Z, K4 k; g iret
( X: z% z( }$ ]9 }, k* Q0 ]int41handler ENDP
( {) v1 }0 m! G
# o6 O6 `% }5 ^' \' P( S3 u
5 a( D+ f1 N* z7 T xor ax,ax
" g4 g, F2 h# Q( u! _8 [: q mov es,ax
* T9 [& X3 K6 ^; a! t mov bx, cs
+ \, Z1 N5 U* p4 g lea dx, int41handler/ E2 e7 A. `& T
xchg dx, es:[41h*4]
1 d- M4 k }1 `+ N- { xchg bx, es:[41h*4+2]4 o) C& s6 x& B L& A. G) ~8 V
in al, 40h
& P+ d% q# E+ C6 s& G6 O4 @ xor cx,cx# ?+ W: X3 i+ y+ D0 N/ O7 o
int 41h
) L* I" J& j, O( C- k7 G xchg dx, es:[41h*4]
+ n! Z \3 o$ ~$ c. H xchg bx, es:[41h*4+2]
3 ^# z+ Y5 g4 v* L2 G& z$ {( [ cmp cl,al
: I- R8 ?) H. {; p# ] jnz SoftICE_detected6 y. ?$ N% c$ h! C" q$ G4 L* P
" E7 m0 G1 \; X& Q/ A, E% Y+ G) f
_________________________________________________________________________$ [9 Z, d9 u; `# E
1 P: x" m3 w- U+ J7 C; R4 G
Method 07
! o# G0 K7 s* P=========
) k; b, i% B. A- k4 f7 I7 u0 y/ m( ^7 @. H
Method of detection of the WinICE handler in the int68h (V86), J/ B% i0 F) b% R# j
9 z# ~6 q# t2 Q* k mov ah,43h
( r5 C9 U1 M3 L: {" W int 68h0 O' ]/ @3 M8 q. f: _# z+ V. u# ?
cmp ax,0F386h4 n5 H, M4 S& z; c: o
jz SoftICE_Detected. l+ M# z1 p1 z I
3 ?* ~+ X, Q9 _
9 G: K+ T! j% g8 Q" n) Y' t# s0 g
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit$ ^- }: F* ~- e! E5 d- |
app like this:" ~& h8 Y3 K. O! X( H1 Y6 t
; ?+ D8 C( ~( L6 q# Y
BPX exec_int if ax==68
) y* N5 N+ z' x$ s/ } (function called is located at byte ptr [ebp+1Dh] and client eip is
) i9 y- f! G$ [ located at [ebp+48h] for 32Bit apps)
* N- w! f( I( f) z__________________________________________________________________________( ?7 Z; m0 Q; I8 P# Q
4 ]& u5 {4 D8 k/ Y2 T+ l
" ?3 F( e. W& SMethod 08
( y" v- T F6 T. d$ b7 E' o% A9 E) m=========9 ~8 _4 e% Q$ H$ S/ x$ l
# D9 z2 I' O2 r" qIt is not a method of detection of SoftICE but a possibility to crash the
2 T$ P `" u K, S5 Wsystem by intercepting int 01h and int 03h and redirecting them to another
/ `& k5 e1 S7 t: q7 s0 D2 J; broutine." M+ i; h D' o& u2 C% I5 H3 E
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
8 x" T* Q& Z( o% G2 ^1 U+ R( [to the new routine to execute (hangs computer...)- O, A' M8 j2 q* F4 |" \
% ?* q7 a# {( V) | e mov ah, 25h
" D& i* x2 Z) s& R. A" b; f mov al, Int_Number (01h or 03h)' M7 M3 K1 j# N" f: d- s, G( v+ M
mov dx, offset New_Int_Routine' z8 d% m# l. y4 k" Z: Z- C
int 21h2 F- w+ @( l% w. }$ q/ ]8 s, }
4 V) n. T7 }9 Y, I
__________________________________________________________________________' u0 u3 p$ ?( D
2 N1 y* V& b: YMethod 09
! c+ g/ Q3 J$ L( }=========
+ C3 k; d" I0 _1 d8 j3 i6 B
* X$ q% G( O5 B+ y8 b- }6 r4 I0 mThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only$ {% i) k7 _. a& N" Y9 j2 x, M @7 @. v
performed in ring0 (VxD or a ring3 app using the VxdCall).
0 N" L) r, x( e! k5 R, V. y" U2 a: KThe Get_DDB service is used to determine whether or not a VxD is installed0 O. i7 f: f9 Z4 o0 u' e1 G# N4 s
for the specified device and returns a Device Description Block (in ecx) for
% V" [7 {3 I" Cthat device if it is installed.: j3 i6 S, @ f) K
: Z2 \1 \. P' @ G- X& @( T mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID* o+ C- s! h" M( ?
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)! u6 x0 N4 K, u t" W
VMMCall Get_DDB
8 [$ L) a; S. N, t T G mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed, a G2 a7 v1 G; F1 R
: G& }5 v4 z) C! e- w. hNote as well that you can easily detect this method with SoftICE:: ?3 t5 }( |, x9 Y8 s; D2 d
bpx Get_DDB if ax==0202 || ax==7a5fh: M3 h% l# I) g& s# N$ }
9 F; Z4 Q7 S7 D" i6 j3 X8 [8 B9 n
__________________________________________________________________________
! G# w7 c: Q( G* k+ P" E7 L$ ^' A
( v/ |$ ^* ^6 X; F. _* q5 Y3 aMethod 10
l2 Q- m) L/ z6 |8 v, J' o) q1 b=========
J& N6 I) z% C$ f+ C( j5 [0 A' Z! f9 y! P; |2 h! r
=>Disable or clear breakpoints before using this feature. DO NOT trace with0 M9 X& [1 Q) X- ]# E0 R
SoftICE while the option is enable!!
3 [ f0 Q p' x! [% a" k2 z: K
' A5 C; R2 `! c3 C0 NThis trick is very efficient: Z* z$ x7 a/ K/ v
by checking the Debug Registers, you can detect if SoftICE is loaded
# D) P1 i* A e(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if/ G; K) i' o" u5 S
there are some memory breakpoints set (dr0 to dr3) simply by reading their
; q) |, z# ?! O- Uvalue (in ring0 only). Values can be manipulated and or changed as well
2 z$ n4 Q1 _# g. k* u' M) R(clearing BPMs for instance)
0 c* D0 P6 X* X; H+ |9 A1 ]. i1 `7 W1 g
* S4 a3 B. g* p9 V8 o- m! U( h__________________________________________________________________________) J9 x: f* H1 d1 X/ Z. f
# w. E A% Q* [6 p* t" U: Y6 z' HMethod 11
( H0 i$ }- O h9 s p; A0 X=========
) S% D1 E. L: p! \ ]2 e# ]
( I1 v" V1 m* G fThis method is most known as 'MeltICE' because it has been freely distributed [% f3 q- r* e7 T0 R, Y
via www.winfiles.com. However it was first used by NuMega people to allow9 C, k$ O4 {8 h
Symbol Loader to check if SoftICE was active or not (the code is located
# i8 u4 L2 L- N6 ~3 @' Xinside nmtrans.dll).. Q5 B, S2 x) {4 I& k
! G( u; W3 j1 k& `! x, l
The way it works is very simple:' l3 b- ]+ q* @
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for1 A( ?( s" C/ y( G* m4 C
WinNT) with the CreateFileA API.
$ N9 g& y1 }' t: q0 r8 M2 K0 t
Here is a sample (checking for 'SICE'):
' _$ t m( v$ e/ F/ q8 ?& V
4 a- q+ P2 `/ X: s8 \2 lBOOL IsSoftIce95Loaded()4 |! }' z2 p3 X; m% r
{4 E" t7 i7 x' o3 W3 w$ s* n
HANDLE hFile; , x2 G3 _9 e0 F* e: A3 G1 f
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
* n, ]+ C/ c2 J% D6 J! M FILE_SHARE_READ | FILE_SHARE_WRITE,
' g- |3 P, x9 S9 M- f5 a$ J# A$ V NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
" A* M' Z4 ]0 v if( hFile != INVALID_HANDLE_VALUE )5 M, {$ U. i7 C- j5 {" X
{+ ~( d9 k* H. ^$ E2 W( G
CloseHandle(hFile);- q9 ~0 \: l2 M; R& Z+ `" ?
return TRUE;
0 T- ~6 ]! M) _ }
- j3 |- R' }8 m6 W return FALSE;* d9 G) V P- e. r( r% T& n+ z# g# t
}
* N+ l; Q# i8 e) b: @5 j8 }
& i, k) B/ f4 H2 C4 D* TAlthough this trick calls the CreateFileA function, don't even expect to be
6 V! d3 G; H8 \0 F* k" M. }! zable to intercept it by installing a IFS hook: it will not work, no way!
) N' _& j8 S9 p- `" |$ IIn fact, after the call to CreateFileA it will get through VWIN32 0x001F% d1 [- }$ v+ {! e
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)& q# C) ?4 v# z( m$ E
and then browse the DDB list until it find the VxD and its DDB_Control_Proc8 O4 g: R7 X$ w" w) n1 [
field.
C5 {. K W' d" ]$ q3 @* L$ CIn fact, its purpose is not to load/unload VxDs but only to send a
2 g/ b: z% r; c: R6 O0 MW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
: @/ ?4 ?/ ^) D1 nto the VxD Control_Dispatch proc (how the hell a shareware soft could try
. J) ]1 V. U) h7 A* {, X, Rto load/unload a non-dynamically loadable driver such as SoftICE ;-).. F# }8 s+ @& ?5 X/ q
If the VxD is loaded, it will always clear eax and the Carry flag to allow
$ ^: J' Y: a% D; G! nits handle to be opened and then, will be detected.
8 @* L/ s6 q: d! f( e5 C; C! oYou can check that simply by hooking Winice.exe control proc entry point
- G( I. H# n* D( f" e9 Fwhile running MeltICE.
. u/ [4 O4 r% h/ \/ x
) Y6 ~# l* m: h' {2 u( F
# h, E0 U+ E5 ^, A# ^ 00401067: push 00402025 ; \\.\SICE
' f9 h* A7 m9 R3 m4 [& V# A 0040106C: call CreateFileA* `* Q1 {+ }: a+ i$ Z: j; z
00401071: cmp eax,-001
2 @2 J8 `+ I3 r5 u% Y" t 00401074: je 00401091; m! N/ F# h5 r2 G: b8 l
& F* ^. c* N7 o5 u) H
- _# l) I1 R9 q0 u# K* \$ b
There could be hundreds of BPX you could use to detect this trick.
& u; t3 T! G8 y! W-The most classical one is:
! y% b5 e; q/ _) R" P BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||! q9 D& ^: A/ y/ G# b- H
*(esp->4+4)=='NTIC'
& r0 F6 H1 P* [$ N! |3 B$ u
7 A( C" _6 O" z- g- h) L' @7 J; W5 \4 Q-The most exotic ones (could be very slooooow :-(9 z# }- X( C$ ]
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') * {; E4 W/ z. a( t1 b) n( S1 p
;will break 3 times :-(
" R) o) V, B; Y" p# [. Q4 R2 V+ `2 R" x% W
-or (a bit) faster: # R- Z0 m+ y$ G" k, p& q
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')) O' v: [8 x/ H3 _9 Z9 B. n
6 H8 D6 p5 z! D! T5 `' G
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
' A+ `) d5 W3 ]" A" w' R. P F ;will break 3 times :-(
. V' I& Q5 E- a5 w/ q3 Y: Q3 w/ L% ?/ e8 A$ f
-Much faster:9 r( I+ ]6 a. c* @
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'- S1 U3 e7 `/ q T2 \3 R
& `9 y6 N: V7 v) J) R' lNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
F+ Y9 F' U( C( `4 Z# D5 ?function to do the same job:: h2 B. Y" M# a2 s3 V3 r- H
" C% N# }- I$ r ]; ?2 F. ]
push 00 ; OF_READ
& s0 f. y* k$ k- D: L$ q+ @ mov eax,[00656634] ; '\\.\SICE',0
+ e' ` d! P0 H/ {4 g push eax+ e; v: ?- g: @5 q0 B4 Q
call KERNEL32!_lopen0 f6 q# p1 e# Y% }: I! B& g
inc eax% _0 n F1 O- H6 J# l5 K( {
jnz 00650589 ; detected% ?) A3 Q5 E( F e* [' a9 u
push 00 ; OF_READ
1 x2 u- I; o7 V$ A& @/ _ mov eax,[00656638] ; '\\.\SICE'* u2 ~ \0 {/ H7 q) V( {
push eax
& a% H8 J3 ~5 V) m# u call KERNEL32!_lopen
8 b- E K. }3 ~4 W3 F2 S inc eax( X6 D7 n |: v' _2 F1 Y8 n
jz 006505ae ; not detected
4 c$ M& Y5 g) N4 O$ W. J- x3 s: R
4 D$ A. g. {& l) o1 J- `+ ]$ }' |
__________________________________________________________________________6 Y8 T e [* D
2 K& h( k5 r( @. a2 t5 ^4 zMethod 12
5 J4 I! \9 \, y4 ?, T3 H. G8 m=========3 R$ I4 V& ^3 u' l# V B8 o
* c$ C, Q0 F- BThis trick is similar to int41h/4fh Debugger installation check (code 05
! Z! c; L; p5 M, R- ~/ s& 06) but very limited because it's only available for Win95/98 (not NT)
( @* F6 m% l# jas it uses the VxDCall backdoor. This detection was found in Bleem Demo./ F `9 E7 y4 U, f* Q
M# q" z- v. G9 D push 0000004fh ; function 4fh
2 x2 B% Z7 {. \6 m9 K+ {( f9 w push 002a002ah ; high word specifies which VxD (VWIN32) w: V+ c% P. B4 ]" ?* D( Y
; low word specifies which service, x9 ]' L( s6 c, j
(VWIN32_Int41Dispatch)
+ E/ d7 z) ` y% l9 o9 M call Kernel32!ORD_001 ; VxdCall
+ Z, j+ G$ B C5 K' B( e cmp ax, 0f386h ; magic number returned by system debuggers: w" Y' j# I; z, N; G
jz SoftICE_detected
0 ^, b4 p* j$ D, T* p/ ^+ X. ?8 h' `: b! S3 b' p' F
Here again, several ways to detect it:
, I9 R6 p0 t; `5 }' I6 P: F) R/ f: x4 H6 O
BPINT 41 if ax==4f
- c: i& }. f/ G* \% n! D* a3 Q- R& H( t# a# b
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one. i% W9 Q) I& L# f( ~* A/ \6 Q: I9 `
3 k. P( a2 J1 ~1 r8 n
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
9 V+ e$ l$ A( v" N6 D+ }1 s5 W& a$ U* R1 s$ n! v
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!4 z, o% e& o* l7 U8 O3 G- N2 C. t
" {/ c- `2 T! {" z* o1 I( F4 c" t+ x
__________________________________________________________________________7 r/ g8 `/ J8 f+ g# N# ^* R
! ?3 F% f4 H* j9 c/ M+ J5 X0 e0 k
Method 130 P, M4 H7 N+ m* n' ]4 j0 \ N/ H6 [
=========0 k1 v' A8 f, ~0 P$ k
$ e! L4 {. h6 o/ |; M
Not a real method of detection, but a good way to know if SoftICE is- U) g' A7 q/ H# {8 z u
installed on a computer and to locate its installation directory.3 f3 x( O1 ~5 N+ r8 {2 _1 Z" y
It is used by few softs which access the following registry keys (usually #2) :) m/ N' N0 s' l1 i
" ^; u: \0 r* z, j+ x-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
- h' T0 D8 b. ~. C0 i: |\Uninstall\SoftICE8 [' Z$ B6 b m; j2 r
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE5 z1 Z- X: [3 i9 w
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion% Z# E; U6 Z( O0 W8 w/ `6 G! [
\App Paths\Loader32.Exe
; D, i& S- Y. q% ^+ J& G. ^' \
/ b0 y( L, {* c6 B7 |7 r7 N& g$ o1 t0 s! U" v2 j* G
Note that some nasty apps could then erase all files from SoftICE directory
" y) p: x% U+ |6 B4 W$ D(I faced that once :-(4 N0 p c8 l* Q8 X
& [, V" }% k/ O! q. K% l
Useful breakpoint to detect it:
" _' Z- ?# {* x" |4 C3 w n& V% `& R( Y- m( u6 l* r3 m
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'1 y9 X$ x* T5 A* R# L. W, Y7 g
3 t, I$ K6 V; l! T9 z" e5 ^; |__________________________________________________________________________
& k3 V& E! Z$ ?6 L3 x, E: g& ~5 Z, h
' T8 r1 @- y, R
# l1 g. @; ?! B5 I+ _Method 14 1 [8 T1 n: c5 }
=========
8 M- O- z: V0 Z. T$ t# @7 ?9 ?$ d8 g9 Z% ]" x& Y' g9 ~
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose( J; \$ p& y, a. L
is to determines whether a debugger is running on your system (ring0 only).
$ k6 e# b; ^7 Y/ P$ t; A( F, R6 z' _/ |$ u% h3 B. r/ ~
VMMCall Test_Debug_Installed
% T( b+ o( l' C& K# r je not_installed
) q$ D1 H) p" R3 a: D4 l$ f( q9 O" e4 v" [* }. \2 ]& ?# H
This service just checks a flag.
4 Z6 W+ S& x! u6 n</PRE></TD></TR></TBODY></TABLE> |