<TABLE width=500>7 Y# h& U2 }3 e5 N
<TBODY>
/ ?# z, F! _; ?! U<TR>. ~8 c2 h2 ^( D9 J" Y# n
<TD><PRE>Method 01
, O3 L8 F9 T2 }8 w=========
# [/ u, B7 `6 Y! t# j7 Q, o. C- G0 {3 }* E2 E2 m s
This method of detection of SoftICE (as well as the following one) is! f: H4 [: n# B9 q( g' h
used by the majority of packers/encryptors found on Internet.% f" N' r# G; Y5 h+ o
It seeks the signature of BoundsChecker in SoftICE
5 T2 p6 R+ K; H
/ X8 y: O$ }2 i mov ebp, 04243484Bh ; 'BCHK'
+ e; r8 A. g. i3 ^ mov ax, 04h+ F" y; t2 s1 P2 O$ S* m+ z; s9 f
int 3
- x; }. B+ Y! u! X! B4 m- g cmp al,4& g$ [1 W. T' F5 ^& N. O
jnz SoftICE_Detected
4 A ?* K' M; V' U
. f6 J; _; G; q___________________________________________________________________________- \1 o, G5 o8 X" C! c% `* `0 e
6 p, Y/ w' M O6 V" f2 M) X6 jMethod 023 M# G6 K+ }% D' s8 f% l( ~
=========& K) ~% x4 j/ y0 V! G
* \1 S, \7 J; I' M8 Y: H' KStill a method very much used (perhaps the most frequent one). It is used
8 }; d+ {1 B# g- [9 B1 z& ~to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
# p1 N' C# K \* E0 u4 @" jor execute SoftICE commands...
0 [% `) {& Z4 I9 ?/ C. b+ rIt is also used to crash SoftICE and to force it to execute any commands
1 y. R4 m/ |2 c; @1 _5 x, q! t3 |(HBOOT...) :-((
H) ^' W0 c2 B3 Q% U
1 K" H0 V; [, w' BHere is a quick description:1 K a$ C5 B0 T2 o+ g! h
-AX = 0910h (Display string in SIce windows)
% d& T$ C& k6 |: H2 b-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)' _0 s- H- `$ m9 _. ?! K5 }
-AX = 0912h (Get breakpoint infos); O9 a- h1 e& O5 _. F' s6 H3 }
-AX = 0913h (Set Sice breakpoints)$ p" R9 S( B$ n& P0 T+ ^* u
-AX = 0914h (Remove SIce breakoints)$ C% \; {$ c' A/ P
9 f, b8 `0 a: Z: S. z% }
Each time you'll meet this trick, you'll see:9 b( x0 z$ E" v. ~. [2 `
-SI = 4647h
9 r' B/ d9 `0 K-DI = 4A4Dh6 f/ X' o- H3 {
Which are the 'magic values' used by SoftIce.4 |$ [9 O8 W. T" t# |& @% e
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.7 s/ n0 i9 j+ n6 x! P9 W
% p+ v$ S3 \" ^- x
Here is one example from the file "Haspinst.exe" which is the dongle HASP
3 U3 A8 f5 C1 n7 o4 O9 o$ eEnvelope utility use to protect DOS applications:, X- v: h- _+ S/ Q' F
5 p' E; m M* {! v- [ M; _6 S. t8 O7 m4 ^
4C19:0095 MOV AX,0911 ; execute command.
S+ }$ N' R- {4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).. ?% n1 y6 C! R' N" K$ ]
4C19:009A MOV SI,4647 ; 1st magic value.1 j5 Y0 F9 k5 s" A* _- j
4C19:009D MOV DI,4A4D ; 2nd magic value.
& ^$ D% T! Y3 o7 C2 Z; }4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)" K0 [8 f; Q4 ^" V; q" r7 X
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
) Q/ E/ ]5 h9 g2 S+ k# y4C19:00A4 INC CX) {/ @! q4 [% \- c
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute9 t) m5 }7 s( x9 h* Q
4C19:00A8 JB 0095 ; 6 different commands.; ]& u2 H) b( q: [- Y f: D4 S- o& r! A
4C19:00AA JMP 0002 ; Bad_Guy jmp back.
( D& u' c5 l% T7 i% {4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
) o' M+ b& q2 J/ T- z/ F( f, P( G9 \2 _' U
The program will execute 6 different SIce commands located at ds:dx, which
% a1 o" N- ]! }1 Zare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
5 }' j9 C7 y8 r2 y0 X% t+ P f" T+ H) i% |, K% U0 a. t4 l
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
5 }5 F& K2 ^- Z' o: a; }# ^2 u___________________________________________________________________________4 t' C- {& |4 ]
; K# P. [) U1 b5 @- e- W& j5 g" U$ ]( S
Method 03
K% c5 I# k9 s) f* V5 J=========
( d; `3 t+ ?: {( ?8 B. |) @: O$ H0 D# S9 [( d
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
' d6 L! g! n" q, ]$ @(API Get entry point)" I# j' F7 z z) @
8 I' `2 \! r9 L
2 l n: o% y- C" J xor di,di
' j. A y! T% x8 H, Q- n% ]2 E mov es,di; Y" O; S9 n( i" w% s) x; \
mov ax, 1684h
/ t4 q2 M6 d# L6 Q* z mov bx, 0202h ; VxD ID of winice
# [ a% L7 o# r. a int 2Fh
1 H9 z' G- Y: v, P" h3 q mov ax, es ; ES:DI -> VxD API entry point
3 r" A1 H0 [6 i9 z% k9 v& R; N add ax, di
* c+ Y/ [3 [' ~% J! o: ^ test ax,ax
# e' Z9 C6 |, R! t) P! R2 \- J jnz SoftICE_Detected2 A2 f, [* `5 q; a9 k
* g+ }" ]4 H; Z1 J: f( F" L& T
___________________________________________________________________________# x8 O0 H( g9 F- O* T
|: y) j4 Q+ Z, Z6 {* q# C
Method 04
: q% x6 X# Z9 U3 ?- l7 x4 K=========2 P# P' C, ~1 x
2 D/ M3 m. G0 B; b2 P! h4 L( DMethod identical to the preceding one except that it seeks the ID of SoftICE
) V, B& L* f$ a( ?9 ?. KGFX VxD.
4 r7 H+ F) P' Z2 V1 s5 S1 _
( P R8 v; Q( X xor di,di
3 c4 _& g# C c0 ]7 S" q mov es,di; j& j! F- {8 ~6 O8 ?1 Z
mov ax, 1684h
7 Z: q- W) P) I7 G mov bx, 7a5Fh ; VxD ID of SIWVID
) U1 O$ X# |: L- s M int 2fh# ~* @3 d. J: u# ]; w5 k0 w
mov ax, es ; ES:DI -> VxD API entry point
% F# l; V! w6 r5 E7 r8 E* r add ax, di3 Q6 r1 X( V) V
test ax,ax
; H7 H' Y, ?7 E( F jnz SoftICE_Detected
, }* ~. L. s, }5 K/ q6 K6 @" v; y5 C8 B* x4 R7 t( e7 C/ j
__________________________________________________________________________
+ E5 \3 g) M0 z* M* g
2 `; V4 C8 l/ u- f5 y/ G% Q" x/ G( q- m" \
Method 05/ @# [5 U& I4 v7 @ c
=========
/ K9 r7 `) h8 v6 f' m$ a6 p
4 b2 J$ o1 I' D5 ]; g" x" E' G: t( fMethod seeking the 'magic number' 0F386h returned (in ax) by all system& O- r0 T; y n
debugger. It calls the int 41h, function 4Fh.( S4 V' b& y, T: M0 ~- X
There are several alternatives.
* W) Z# V4 n' w( ~1 r! e' R5 B0 ^7 u6 s* ?
The following one is the simplest:
1 |! l0 x6 B! i! I0 }, q
b2 b4 h0 B% S, ?( P( @ mov ax,4fh! B& e4 u2 v3 Z$ F) h& {
int 41h4 n5 Y& [$ P) Y4 y6 y# [9 v6 l
cmp ax, 0F386
; v. Z+ r; I! _. N3 K' D2 t; p jz SoftICE_detected( E9 U8 k) E" P/ D
, [* `0 l2 ?8 R- q& c4 k
, u) q/ m- M9 r
Next method as well as the following one are 2 examples from Stone's
5 {4 _8 r! r; l8 s+ z- q. _3 D"stn-wid.zip" (www.cracking.net):
, U/ G2 [" M: \% L8 V
. ]) }; c8 K( q! C& u: s mov bx, cs/ ]( B* K# C" R/ P( K0 R
lea dx, int41handler2
, G- D! q: C- o; \/ h# V5 ^ xchg dx, es:[41h*4]
/ ^0 s, U& |9 p) r! c6 F xchg bx, es:[41h*4+2]8 C7 L: }* w: V6 g, Y
mov ax,4fh' [ t0 X" c$ ^; b2 h
int 41h8 g* E% J" l4 ]
xchg dx, es:[41h*4]4 A$ T# l& Q4 m: N7 S
xchg bx, es:[41h*4+2]* ?1 x+ s. I2 q( Q
cmp ax, 0f386h
' }( F0 k+ \$ C& l. X; B jz SoftICE_detected( _2 w1 W: ?- G- a
7 V; {& d$ y8 l# {9 `" j5 Z# O/ a# `
int41handler2 PROC o" K8 G' h' N$ J q
iret
. }9 F1 |4 }1 u2 H" b2 yint41handler2 ENDP3 I4 U/ o+ ~- I, S' C7 e
" l; a* v# G" n+ k; ^, F. j: i) Q
9 ?* s, }6 O L. w! N! @% Q5 T_________________________________________________________________________
5 S% g5 _: j X' ?% `# Z6 s6 ]: V/ q- v
; m4 B) D9 x3 X+ l4 o9 Q0 C* UMethod 06% J% B z& A9 ]- h$ v4 K4 V! x5 s
=========
, }0 [' I Y/ k3 o5 o: q& s# z5 M
0 a' ], P" e" G7 f( I! `/ X
5 L0 b% U' `5 U2 R( h2 o2nd method similar to the preceding one but more difficult to detect:
0 [, l0 n7 F2 \+ j! w3 s. v$ [' C2 x) `8 \# R+ t# D
) Z: M" w+ q% j. _+ r2 ~ uint41handler PROC0 g( K2 m4 p; k
mov cl,al7 V$ M2 d- r- ^( h" a! {
iret
6 q |7 v/ T; _, ?9 wint41handler ENDP g K% ~/ ?+ P' [
: m( r5 F7 n8 V9 @& V; |. z- @# X
K' O% C4 t1 g3 x xor ax,ax
) J3 D7 u3 O, L mov es,ax2 x9 E( [5 w0 M5 j# @' R( ?
mov bx, cs& b3 S1 G& ? n y
lea dx, int41handler
( J6 S1 ~9 o* W1 H( H5 m; a xchg dx, es:[41h*4]. C! k( w: G' V
xchg bx, es:[41h*4+2]
; j O' H! b A2 Q5 H in al, 40h
$ [. T+ n3 u$ R2 ]3 Q xor cx,cx+ C' l3 M4 N" n! V2 ~; t' \3 n
int 41h/ v) t! `/ D: o" T; U
xchg dx, es:[41h*4]1 h, N* d; Z; L8 a, \% h
xchg bx, es:[41h*4+2]
' I; S& K3 B4 U# _ cmp cl,al
5 v$ O X4 U4 Q: S* ?; O jnz SoftICE_detected
8 I- a2 x9 \4 R' [! N
! e, K1 q- c. D/ Y& x_________________________________________________________________________5 X8 y3 P$ E4 t
/ B0 V9 n; V3 x B0 j+ NMethod 07" q& f3 u# ~3 ~" S6 |
=========
; d) K+ j# I7 X& g* u5 t7 L6 b, W7 W) J0 Q* w
Method of detection of the WinICE handler in the int68h (V86)
6 X/ g( G2 u0 e" z9 X: ?/ g" Q% t2 L% Q( y# X# @! w, b
mov ah,43h; u' z5 F; a% H2 c0 k& A
int 68h. q1 C/ s4 q- h3 b+ A
cmp ax,0F386h
# v* Z4 d& d' X& C, Y jz SoftICE_Detected8 N4 E8 ]3 n' w( j6 q5 K
$ f' q! f$ G: `0 |
, ~: ?4 `5 ?/ @- B=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
: o8 J5 {3 {/ }# H' t app like this:( ~- r9 b1 V) k5 g; p+ B9 Y; i) S
0 o7 H7 O. ^1 q" U BPX exec_int if ax==68# ]% o% j: p2 V, I: V
(function called is located at byte ptr [ebp+1Dh] and client eip is. U3 X! ?' d2 `2 |3 q5 p' ^
located at [ebp+48h] for 32Bit apps)/ O0 r3 Q/ H3 s: l. ^
__________________________________________________________________________7 e7 E, H4 Q5 z
( M' S7 v! C# O7 ~4 Y, C
+ \% }9 X) O A$ ZMethod 08
4 X0 Z g5 Z: v r6 p* C=========/ x& a& A, T0 ^+ [% d2 B4 E! W
' t& u# `- l3 G3 w( C* t$ J
It is not a method of detection of SoftICE but a possibility to crash the. A0 B* T& z% e& o
system by intercepting int 01h and int 03h and redirecting them to another
: X' c- Y' k& P: |5 t3 R9 ~2 rroutine.
- F, U. V* I- XIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
- c8 Y7 T# b. \/ z" w1 m3 e4 F. lto the new routine to execute (hangs computer...)
2 q; E8 a8 q0 b: G
7 J' Q& p, k6 a1 r6 X: L) Q mov ah, 25h9 ?( d& H0 u; A. D' s5 z$ P
mov al, Int_Number (01h or 03h)
$ W3 L7 b8 G# W o! J- Z8 S mov dx, offset New_Int_Routine
1 E( o. J* r7 L/ J! i+ G int 21h
8 b5 [- v' v) j) a( E6 l1 W3 a2 w$ u7 ]* G* c
__________________________________________________________________________
2 I8 P7 I: a i* b+ o: w5 `! i1 g( \/ h! z4 A
Method 090 ?- \! w+ p: T+ \- y# u' @
=========8 }- z+ E5 O! O; z& n2 f" K. A
: D' n7 F! X8 d/ O( T/ h
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
! Z; A: k2 o; \9 @performed in ring0 (VxD or a ring3 app using the VxdCall).8 Q" p8 k/ Z$ D" ]3 ?
The Get_DDB service is used to determine whether or not a VxD is installed. z/ {+ t! O9 \2 J& b2 k
for the specified device and returns a Device Description Block (in ecx) for
/ ~+ u7 z; \8 T: q: _. T" Wthat device if it is installed.1 G- b& O+ ^/ a `
/ a9 n, Q4 P% k
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID$ _. Q( ?2 Z- v+ I
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)& J- D& F) |+ x; ?# D* n( a
VMMCall Get_DDB9 q ?; g1 G" U/ b- @% c
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
# L5 v. l# P/ R$ l4 q; s/ m5 b5 [- B0 i, N* n; }
Note as well that you can easily detect this method with SoftICE:% q3 V- O- A5 G- g2 v8 L1 O$ v
bpx Get_DDB if ax==0202 || ax==7a5fh, X/ L8 y; `& E: }
/ P. n/ V7 }4 O
__________________________________________________________________________: C G g) z1 N: d! [ B( ~, O
R" L. u; Z9 K5 oMethod 10. b' H$ B; V8 r
=========; s; h$ i3 d% |& H8 Z1 K/ q
/ K+ P1 p0 L! Q- g L# X* `. _=>Disable or clear breakpoints before using this feature. DO NOT trace with$ a+ f+ W f2 `& y1 R1 Z# u
SoftICE while the option is enable!!* l" P) u i, c8 A9 x+ X
! ?) @ j& A5 `) f: e$ mThis trick is very efficient:& w; n- z( R" ^
by checking the Debug Registers, you can detect if SoftICE is loaded
" A. k# {; v. c( `2 {4 p' k' S(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if& P# T6 r- y+ e0 f4 @/ ^8 z
there are some memory breakpoints set (dr0 to dr3) simply by reading their: F- O: _0 U$ q$ r8 M
value (in ring0 only). Values can be manipulated and or changed as well
3 s- B/ F: k4 N0 i(clearing BPMs for instance)
8 K$ X# f, B9 B: u4 p; }, w
2 s2 ^, h5 u/ Z6 }8 f5 L3 R__________________________________________________________________________
6 f' Q. u. N* i4 h3 s9 c* ?4 _0 v
Method 11
% x" [, R: m; w6 X=========$ \) z% C# E. Q8 l
. L: F- u7 w. E' w. BThis method is most known as 'MeltICE' because it has been freely distributed. E# w" |6 p( p: l. p
via www.winfiles.com. However it was first used by NuMega people to allow
+ S* Q4 |8 M& w3 n/ X& D/ |Symbol Loader to check if SoftICE was active or not (the code is located# j' ]- g9 u- t5 v5 F" Q6 k# s
inside nmtrans.dll).
1 f( O! @+ g. F) @
. C2 e+ T* U4 T5 Y/ d* ^( yThe way it works is very simple:9 h; ?3 h5 ]4 Q! _6 `
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for2 F Y8 f6 I6 S2 U; Q: R
WinNT) with the CreateFileA API.
5 t' Y7 W8 h. B- ?* D$ f
4 h% ~2 h2 k$ f* {5 ~: P5 _9 }! `Here is a sample (checking for 'SICE'):: p- R7 n2 R$ k; z) f0 n/ U* A
0 Q: b1 r7 c3 {! p$ C YBOOL IsSoftIce95Loaded()% W) ?5 l! k% N1 l& x3 E8 K
{
8 d% T' }9 b, j' u3 x; D HANDLE hFile;
" c! a' m( y7 y: f- v8 R+ d hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,, m$ J0 o# f/ x. q+ V
FILE_SHARE_READ | FILE_SHARE_WRITE,
5 M2 D; s# n) c. C! V+ k5 ^ NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);) [9 [7 z6 w, q0 L
if( hFile != INVALID_HANDLE_VALUE )
$ b/ E% D, |1 U& }) `% `" r {
0 Z! \: I) [9 T/ {& n CloseHandle(hFile);! r4 z! H5 c5 H \% b2 f
return TRUE;
# T. u1 G: d4 I* ]- e! S$ y0 `- ]; G }1 e9 T% {+ N7 f
return FALSE;
/ \1 D E: R7 r% _5 v}
$ F# i( J3 \9 a8 n
5 r3 [( d2 i5 \; p3 qAlthough this trick calls the CreateFileA function, don't even expect to be
1 O8 u! `, C' P% J: Q. ?: }$ d) A# @" ~able to intercept it by installing a IFS hook: it will not work, no way!
& C8 j7 G2 ~& Q+ y3 W% ]$ k5 bIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
; d: A' j3 \+ D& M oservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
8 D6 d/ v- z* f/ ^# gand then browse the DDB list until it find the VxD and its DDB_Control_Proc+ N5 M' t& ^& G0 p. ]# b
field.
* s C: i. g \# B6 n7 L2 ~! hIn fact, its purpose is not to load/unload VxDs but only to send a 9 L% U) h0 a( E3 a
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE). ]" L# q$ m& J( x
to the VxD Control_Dispatch proc (how the hell a shareware soft could try# @4 k7 ]8 w( }: _- D" n: \1 I; {
to load/unload a non-dynamically loadable driver such as SoftICE ;-).0 A$ t6 S- c* e. `8 E0 ~
If the VxD is loaded, it will always clear eax and the Carry flag to allow8 }) ~0 H h; f: `- {
its handle to be opened and then, will be detected.7 V) g+ O( c$ K, s+ u
You can check that simply by hooking Winice.exe control proc entry point/ r3 @# {6 ], i' W0 Z5 A
while running MeltICE.
2 M+ t% d4 r; M) e& a3 X+ e) w- O6 q2 h& B" P: c: Y- ]! K* o
0 L4 ~: I, v- J$ H2 ~; K 00401067: push 00402025 ; \\.\SICE
- V- |2 X2 ?- |/ R; b' E% L3 f- l 0040106C: call CreateFileA
+ O% N) y8 C- q: g( s* X- N. {- \9 B 00401071: cmp eax,-001
# X3 h# P) E8 N" c5 Q, Y 00401074: je 00401091: \/ G: ?' @" l8 i% S" C- B
3 C- M# s% e, l& w( W9 k
6 [% F0 ?( F7 w1 RThere could be hundreds of BPX you could use to detect this trick.% n5 M4 y7 Y5 G. {- a& F
-The most classical one is:
- ?& H' X: J! j, i; U+ N. i2 P BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||1 m: `2 o+ N, I! Q- @. W
*(esp->4+4)=='NTIC'
' g4 \( Y8 [! A* ?0 N" _0 b" q' N) r& P
-The most exotic ones (could be very slooooow :-(
: S( x, W1 M5 r6 ?# a( z BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
4 d) c$ t. D8 k ;will break 3 times :-(
+ S# w" J9 k) i8 p
. O5 O/ M0 w% i6 M-or (a bit) faster:
6 Y! ^5 \; ?4 ^# N' S! \/ X BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
2 v+ i4 M8 i+ v, S- j" { B
# V' J7 Y& I, p; Y9 e6 @9 L9 g BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
: V7 M7 o# z( g ;will break 3 times :-(
/ F2 U1 {5 N+ U6 ]* u- y: _
! ^9 K- i7 X7 W: b, ~-Much faster:% Q, X0 q* `0 c2 G
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'' S" E" N4 |' ]
. m' J7 g% c8 t" `/ p }( gNote also that some programs (like AZPR3.00) use de old 16-bit _lopen, K- ?0 p O4 V- ^
function to do the same job:
( k! f, r) X0 l: Y/ z4 U8 p, F. L& p6 r$ F
push 00 ; OF_READ
6 a- D) I1 g7 g8 M% k$ U mov eax,[00656634] ; '\\.\SICE',0. D: B8 T( @$ ^: Q0 u5 b/ c
push eax
: @/ R" Z' B% l0 d9 O, X call KERNEL32!_lopen
; D/ I' X9 F/ t inc eax$ d+ n1 J' ^ L2 i' H- U1 u3 Z
jnz 00650589 ; detected$ j6 x3 ^2 H9 [
push 00 ; OF_READ
, Q$ B3 ^9 c8 V' B m! I o mov eax,[00656638] ; '\\.\SICE'7 M3 T" m4 @5 i! ^ p" j# [
push eax5 q, p4 @* v$ t, q Y g$ j+ l
call KERNEL32!_lopen3 I3 z. P* \$ ]: l$ b
inc eax
3 o/ [) Y- q G, Z$ F jz 006505ae ; not detected2 U9 @$ w2 `" a' G
$ z. @% L, ~0 p, {2 D
* x' `% O9 ?* u+ r" @- D, G__________________________________________________________________________) J$ O3 x) M2 u6 M1 }9 ~/ m
; R" m: ]/ i! [" v- M, OMethod 12
# q$ j3 B- [$ o% `=========
1 F. S7 S: l/ ^& ^0 D" {& u4 Q3 L0 d; u# ~; l0 P" A$ _
This trick is similar to int41h/4fh Debugger installation check (code 05
! R: P* A; z; m X5 A# q& 06) but very limited because it's only available for Win95/98 (not NT)
, g+ f" T C0 L: Eas it uses the VxDCall backdoor. This detection was found in Bleem Demo.
( y- l( V7 F6 K9 j z3 e
; e2 k: I' _7 a! P" c push 0000004fh ; function 4fh& B0 u7 I. P/ m4 K7 K! R
push 002a002ah ; high word specifies which VxD (VWIN32)7 w' x) e% C1 f) l
; low word specifies which service: J- x/ h# C6 K+ }5 ]
(VWIN32_Int41Dispatch)* \+ x' r) v6 b" {6 d9 K- a; O) W& X
call Kernel32!ORD_001 ; VxdCall% i F2 V! y; [+ y7 J5 c5 L5 h; Q2 y
cmp ax, 0f386h ; magic number returned by system debuggers% d8 |. D% Y7 M( J2 I1 N/ b
jz SoftICE_detected
$ i7 b& K0 X" c
2 |/ }6 @8 u" {2 p5 t7 K, JHere again, several ways to detect it:
! L3 W) t/ m; {1 Z$ e
0 H. j, a% q9 n, [ f! E BPINT 41 if ax==4f
' V4 w+ Z! S, N' ~1 _" G" k9 j! k/ N
9 z! F' Z3 G! v% b' b7 _/ A1 m BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one T) j& ]- X/ b1 t: ~# \2 E
; X2 H; Z* ^" y# W% `* O6 _* G5 t BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
5 j' G G$ a! u5 F; \4 N. v$ ]# |! z2 D8 ^9 F; J6 c" e
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!/ Q& Z- F! M3 f1 P( c
3 x3 W# q: { c. L0 L2 O__________________________________________________________________________( B; D& ~2 Y8 l7 T
0 V$ B! B- c0 v+ q3 q$ ]
Method 13
- f% x: i* s2 D& t- a& T6 G=========! }, P2 t) v* P: h3 S* m# o; }
. y. [; e) Z$ Z a9 Z% xNot a real method of detection, but a good way to know if SoftICE is/ \/ X/ n: ?2 l, S
installed on a computer and to locate its installation directory., ?* w/ F& {9 R# t) m( w
It is used by few softs which access the following registry keys (usually #2) :
7 g1 x8 h8 D- P. {# q5 d1 v! E. e$ C6 X, [. A, l n( G
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
* v% B% z) ^/ d0 F: S! P. x( Z\Uninstall\SoftICE
/ \9 W9 h1 o, B$ y. m-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
. v& W3 u1 V1 q7 E& f-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
4 f0 u# g5 g' q* o( `, @\App Paths\Loader32.Exe
- F1 e0 _$ y+ h" b
4 G5 \2 T$ q7 c
) R3 z1 u8 u. ^9 u! {9 jNote that some nasty apps could then erase all files from SoftICE directory9 W% P' e# M! x/ ]# M
(I faced that once :-(
; n, A1 s- u! O& k) u5 i
) R# B$ J, ?7 J y$ |Useful breakpoint to detect it:
3 p& j$ d V& v5 Z7 b: ~6 ?% Z
5 y" i8 h7 ^$ X2 @ BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
, F) l4 {; f! b; s5 H4 D+ F
@( X @' b$ s% Z+ Q__________________________________________________________________________
1 m+ E( }3 ~) `7 l- H6 C+ w5 M: \0 j! g$ m4 S. Y+ v& V; g
' E1 }4 z% p' z# S
Method 14
# x% {' x5 A3 L @5 R! N o=========
' ]8 [8 T5 ?# f( E; m
5 u" m- c1 t, ~6 {+ v6 uA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose. r3 R0 a D6 G" |
is to determines whether a debugger is running on your system (ring0 only).2 t* X2 _; Y4 H: ~
3 G# T5 h- {) r9 ?" N VMMCall Test_Debug_Installed
- ?3 J; A; w: z4 l& O je not_installed
$ N) c3 h, i3 z/ n1 ~0 i3 H5 }: L, H" M3 O) g
This service just checks a flag.
, c+ b, S; D' ?. V</PRE></TD></TR></TBODY></TABLE> |