<TABLE width=500>
* X7 Y" ^* e( b1 E) X# y0 S<TBODY>
8 |# ~/ f! l6 L" y- ?. N<TR>8 U0 H% v7 n2 g3 ?1 c
<TD><PRE>Method 01 0 y6 v. h4 x! I+ ~ ~# C
=========
7 P1 P$ ?/ [$ {* m
' k8 o& D- l' p/ ^5 N3 JThis method of detection of SoftICE (as well as the following one) is/ J* _5 u3 u! Q7 e% d
used by the majority of packers/encryptors found on Internet.
7 a" a) ^0 W0 g' I5 E: a) R' ?It seeks the signature of BoundsChecker in SoftICE
4 n% s0 V+ y2 K) I2 w, V9 E8 r. r, Y( s' }
mov ebp, 04243484Bh ; 'BCHK'
( Z( V: _; C: Q( h1 x# \ l mov ax, 04h
& B$ f2 T% ]: P' P4 N int 3 " x$ v# `4 k1 s7 z: l/ i( |, q
cmp al,4! K) C6 y' h: ?+ P% J) F1 ^3 ]3 V
jnz SoftICE_Detected
( w* V, Y& ~$ R4 G% [4 [2 |- |- f" K" W( D h" b1 [
___________________________________________________________________________
3 }8 m& L; r* k5 j
# F! N7 l, }4 b9 d" b1 gMethod 02- J' m9 E) w8 l0 |. s8 p" D2 I/ m
=========- Z7 w {/ ~8 |+ f$ y+ _
! @* Q& }6 n. z4 v! a8 N9 y8 _
Still a method very much used (perhaps the most frequent one). It is used8 A$ {# k; _- V2 M" ]- b% y7 a' j l
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,* S* H$ f& E1 u
or execute SoftICE commands...: T0 B, b" \4 O$ q# c2 n$ V* r
It is also used to crash SoftICE and to force it to execute any commands% Q p# `/ [7 v- E" ?" P; z
(HBOOT...) :-((
, c/ k; n6 z( n' Y2 e
7 ^) @0 j: X- zHere is a quick description:
0 J" a) t# c& l+ K7 i3 F-AX = 0910h (Display string in SIce windows)7 i2 T8 V, h+ P4 Q1 c/ s
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
# D- [! K( e! I9 C! M( [/ ]$ T-AX = 0912h (Get breakpoint infos)' X9 X& Y8 M: w' }
-AX = 0913h (Set Sice breakpoints)
( t/ I$ V$ }: ? E-AX = 0914h (Remove SIce breakoints)
1 }7 q. u8 i6 D7 K: G' O: f7 _4 M8 c7 B/ D: u: T
Each time you'll meet this trick, you'll see:
* d* T# P& I& B' h! `-SI = 4647h! X. f- w; M- c0 s0 T" ~: w
-DI = 4A4Dh% n8 g9 m5 U2 G. Y0 @
Which are the 'magic values' used by SoftIce.6 m3 t$ v5 J! M" C
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
1 |4 e/ _9 ?- ?/ n e( [( l& m8 \4 L- V0 ^0 E9 o I! B0 i; u
Here is one example from the file "Haspinst.exe" which is the dongle HASP
5 A1 U2 S4 r3 W& K; {" hEnvelope utility use to protect DOS applications:
3 I4 |9 b' f. G1 x+ B; ]1 x2 d/ t
* r2 U; t5 r& O" Z9 A+ F" s" Q6 W
4C19:0095 MOV AX,0911 ; execute command.
9 e3 c) n" M- a+ R, h0 R! x4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).7 l: D5 q4 _6 \; H9 C; y
4C19:009A MOV SI,4647 ; 1st magic value.' \4 `% j5 `8 a) ^: ~% R5 g
4C19:009D MOV DI,4A4D ; 2nd magic value.1 Q6 q/ ^& C, q7 L+ d
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)1 R; @+ J( l: k) d
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
7 X1 c( a t1 K2 r- n1 R- Z; C% m4C19:00A4 INC CX
% Z& R* i0 Q1 }+ N1 \/ C4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
; I3 q$ h1 W i; d: I" V, U4C19:00A8 JB 0095 ; 6 different commands.
" `. s8 b( r# ?$ y* |0 C4C19:00AA JMP 0002 ; Bad_Guy jmp back.7 M8 y0 x5 G' }9 r# m# r4 f
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
! j! l9 q5 H" k d# }: p8 q
5 {. e5 L! ~7 E/ SThe program will execute 6 different SIce commands located at ds:dx, which9 `) h; U' u# K+ _) Y# A0 F1 f" d) T7 m
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT./ u, Z& a3 R; j2 k6 ]. M7 \
, M9 w+ a# h4 g" U* s" ~& J. X# h$ z* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.1 o- i3 O, C! K* t* z' e
___________________________________________________________________________2 R W' U! k; X3 [& Q
. m* q% X' @& o$ p# a8 J* G. _2 x& |+ W0 |8 `
Method 030 y) Y% S+ `) l K+ s) l
=========
% f0 u7 n" J. i8 w T, W* w: [$ @! d: R
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
1 }6 d$ k1 n# i9 k8 E(API Get entry point)
3 j" m* d+ V9 }( w, f
! {- ^( t! M0 J6 p1 D n' e8 P4 ^% f$ {
xor di,di
9 r% A2 r4 q, ]! W0 ]4 R( h mov es,di6 `/ G, Y2 b; ^+ \% Y
mov ax, 1684h
' U4 _+ V- e0 y( Z mov bx, 0202h ; VxD ID of winice, ~9 L, ~, P* A
int 2Fh
( S1 y7 }( A- S- I5 Y( y# _ mov ax, es ; ES:DI -> VxD API entry point
3 g: u7 N) L* Q: ]/ U4 t add ax, di
! u. ]5 @9 G& ~ test ax,ax
! l( z* o9 Q H8 }" O N( o% p jnz SoftICE_Detected4 p( i* H: R O2 b$ k$ r" L
( P l2 D- Z6 \. ?* f: t
___________________________________________________________________________
2 x5 K$ C* A3 q/ _- F
9 {+ N0 Z1 T! M% Q7 _. D% q2 NMethod 04; e* u! r/ w$ M5 C9 `5 B1 M
=========
1 B1 z( c) M1 w0 V! L1 _9 s% C( K) \2 Z, y- x
Method identical to the preceding one except that it seeks the ID of SoftICE' c) e/ S* _0 Y( h4 E9 Y
GFX VxD.( W" O$ Q2 i7 {4 V W- b. W
2 m5 x( t! U* N+ t0 ~
xor di,di
* e6 }5 `0 t4 X2 x7 J8 l9 q mov es,di
" [1 h! Q3 ?- ?0 P mov ax, 1684h
9 p, M2 Z3 C! H3 T4 V5 q mov bx, 7a5Fh ; VxD ID of SIWVID
9 c7 J$ _" x; ~! Q int 2fh
1 l: J7 V5 q( Y1 ~3 Z8 y mov ax, es ; ES:DI -> VxD API entry point( M, @; T+ ]$ S$ K" z0 B
add ax, di
1 k9 D* r& ?. ]7 l: w test ax,ax4 M& Y$ m7 q" |0 J; ?$ j% k' o
jnz SoftICE_Detected& E+ [ |& P P0 i; z" B& e
* w+ n. b& q* H# v: \6 s! o__________________________________________________________________________5 q, a* V1 y. B+ m
8 S. d" ~( S7 n' e3 ~, i" R3 U/ j) a @5 [1 F9 F7 ^! x/ [
Method 05
/ R+ t: p0 ~6 {3 E& h3 V P; a' ~+ y========= J; f# \3 _- N8 y* X" F$ R3 Q
; U5 U0 Y6 f {' B9 |
Method seeking the 'magic number' 0F386h returned (in ax) by all system
) q7 d) g2 P! g" mdebugger. It calls the int 41h, function 4Fh.
2 L9 r' E" q% B y5 V. \- {2 l& l: GThere are several alternatives.
7 o! c0 X2 | }' x. M/ o, b0 F8 P& w. w2 _0 g! z& `
The following one is the simplest:
: B; w' T6 n/ ^, l5 @/ j* \: u/ z6 M' [2 v. J3 Y
mov ax,4fh& a4 m9 h3 W P- B! t
int 41h3 g0 ~. i( w2 b
cmp ax, 0F3868 i% ?3 v; ?9 x0 e8 |
jz SoftICE_detected; p, ]# x, T6 [
4 k8 W8 j2 P: `7 `1 S
, x2 q2 l6 J& U, \Next method as well as the following one are 2 examples from Stone's
3 I: w$ D" g: o" B# n* Z) a"stn-wid.zip" (www.cracking.net):
5 p. S7 v& z+ _, n5 ? q5 J- b5 X0 O! l0 M% [( H6 t' H: X
mov bx, cs( W z% Z! c9 Y' M f
lea dx, int41handler2
9 \* \# v' [# l xchg dx, es:[41h*4]. G! p( v; D1 B; k
xchg bx, es:[41h*4+2]
% p8 p8 Z$ p. `8 s% h+ X. |7 S mov ax,4fh8 ^% J) k1 \0 [
int 41h
! y0 Z6 W3 I' ~; f4 y1 U1 N# ~: _) x7 H xchg dx, es:[41h*4]$ ~. m# o( v$ n4 O
xchg bx, es:[41h*4+2]
6 P' L' j& }# f) @: t cmp ax, 0f386h8 L8 N3 C6 s2 k3 ^0 [7 g
jz SoftICE_detected0 Y$ b+ C m. V& O
+ A' Y0 o: [* u8 W
int41handler2 PROC
8 \. ]0 R% v! x9 c iret
, J# U' W+ ?: H: m4 `int41handler2 ENDP
* l- @; k# M+ a" L
* W8 u; B1 f. W
' J2 X4 X7 w9 {1 Z3 C; i_________________________________________________________________________
8 X; z' q; n' j- L n/ b4 p$ f% Y5 y" F- p: [
) i6 N- t: _$ MMethod 065 k' j" v" O" _6 O$ a5 c" d, ^
=========
" q1 a% C! N) q: E7 l0 F. p' a8 T4 ?6 D: q. M8 s
) D. B$ b2 x# N2nd method similar to the preceding one but more difficult to detect:6 r' C& L- Z. k6 L6 [$ E
* L& u# u4 E3 l& r3 m! s& N" h z
: u, [3 I4 g" f2 m. [* k5 y8 ]& K
int41handler PROC
4 D$ w$ }* ^. i; X mov cl,al4 v6 G( k5 A1 W" G2 T! z
iret4 Q! l! e `* p# d* W& D
int41handler ENDP2 k# f% R- I% N: m8 K5 j
& J. j3 j- ^" }: B9 N/ [% _
6 I; ?( m, U' r
xor ax,ax
% g# y1 m9 |0 ~* u mov es,ax
% r" y! d/ A8 M4 N1 d8 E2 a4 m3 N mov bx, cs
1 f$ Q4 @# ^0 J5 G lea dx, int41handler* @% @7 |1 p7 |9 G3 ]0 j
xchg dx, es:[41h*4]
$ X' \9 U( U: i1 y xchg bx, es:[41h*4+2]% T4 D2 ]) F! k ^0 W8 }
in al, 40h
& v( w' k& \$ Y* |+ w" A! q8 P xor cx,cx
, }0 z- U( G8 f0 H2 m int 41h
2 g( o( Q% D. e/ A& n0 D0 Y xchg dx, es:[41h*4]
: G4 t* E) `, X. q: X5 g" O. } xchg bx, es:[41h*4+2]
8 O2 i+ N& L* v( N: S cmp cl,al
7 @- j4 Q4 n( } jnz SoftICE_detected: O& [+ [8 u! T# D
+ t$ }5 m* R! e
_________________________________________________________________________) C3 \. ~ c g" M/ F6 N9 {
2 X) H# {1 d' L; @3 nMethod 07
9 p1 o" \% O; u* K0 k* `=========+ f! p9 c, L" s
- H- T+ M# k# b' ]! QMethod of detection of the WinICE handler in the int68h (V86)4 ^7 a6 v1 T6 l. W# g- h4 I4 k
! N2 {8 D+ d, m! f) X
mov ah,43h5 T( Z% c0 a/ `3 N5 q# Y- H+ X
int 68h: T! E, H T8 ?* H
cmp ax,0F386h
4 I$ Q% Z6 A# o& u, X jz SoftICE_Detected, d6 F* q: l% V$ b
- R# [) C5 [( g. X. N
+ G' X( d4 t7 E$ p4 L0 Z=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit& }# q- N% j: x/ b
app like this:
, }' _" B/ M/ ^ ?' O
: t7 x' q. c" e BPX exec_int if ax==682 J" W& J# O6 j) P! }# ~) Y
(function called is located at byte ptr [ebp+1Dh] and client eip is
/ _8 Q+ C8 m) \8 e2 S located at [ebp+48h] for 32Bit apps)
$ j8 J- `( ~& T% u2 D8 R; k e__________________________________________________________________________( F; C, p$ P8 }8 ]7 J6 H
7 d! }, V, M) K$ c- M
+ s3 |& m" P" T9 d$ Y
Method 08
' i; ?0 c% J: G=========
( q- h; a$ f- ?$ h1 w
" ]8 q b, R' v ?# TIt is not a method of detection of SoftICE but a possibility to crash the. I8 d2 {8 X! Y/ s
system by intercepting int 01h and int 03h and redirecting them to another
* e0 I# r4 _2 p0 c& i0 Vroutine.
" H5 t1 }2 h- [( Q3 i0 T! v6 NIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points6 U3 _. u) b- H# u( O
to the new routine to execute (hangs computer...)* s1 g. b7 u6 F9 @6 r9 J) X
2 F2 _2 a" g3 \. {0 N
mov ah, 25h
$ x" d+ `6 g8 D& Q3 ~ mov al, Int_Number (01h or 03h)+ c" \- D1 s6 ^7 k* y; I5 ?! v% o& ^
mov dx, offset New_Int_Routine. X! }, q+ |' h `3 F* P$ f( l$ S }
int 21h) e2 k0 I3 V. Z( P) l1 ]
1 C" g" m9 \0 L" w4 a
__________________________________________________________________________2 R0 @2 F ]* M' q8 ~# x3 \
$ r5 M6 U. i& `: T' E, f6 e
Method 09
+ d) m) n; L2 {1 O( E, R=========- c, I% V" E. {% R" y: u
' G( U/ ?( p. \$ b; I9 ]
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
- y, x( C! c; d) P$ Lperformed in ring0 (VxD or a ring3 app using the VxdCall).
/ e" h6 l8 l: q4 D% CThe Get_DDB service is used to determine whether or not a VxD is installed
3 U( W1 l1 v1 F/ v2 Efor the specified device and returns a Device Description Block (in ecx) for
2 k7 t$ ` o0 M* x, gthat device if it is installed.( t: t7 }4 L4 p9 M9 Y
# w9 P: Z: f$ k' ~' f. k D$ S8 T. r( F
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
: L+ a9 Z9 T) b V% w: Z, Z mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
6 H Z+ X/ E! P' C& f VMMCall Get_DDB( B. h ?( F2 z2 L6 {! ?2 S
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed, c4 J3 i( g% _, G8 w* l8 c
/ E$ P/ |3 G; B4 R
Note as well that you can easily detect this method with SoftICE:# e. o8 t7 a; F8 ~
bpx Get_DDB if ax==0202 || ax==7a5fh
3 V0 S8 ?3 x# k0 ?: @8 c+ T) S0 F6 A, S& T& {) c) n* I( x
__________________________________________________________________________. a) {. H1 M% i( U, B9 C7 j, Q
# [- `/ Z% p% d& gMethod 10
6 O- M# R/ D) k5 q6 F=========$ V! l4 L. M/ t- n/ J) {! s) Y& g6 s
7 ~; O$ _% v& D" g
=>Disable or clear breakpoints before using this feature. DO NOT trace with
" m( k$ M$ [& }% S SoftICE while the option is enable!!
! J4 g) s+ c( W a5 r' ^: ~# E) z4 e. \% x& u! V0 J
This trick is very efficient:
' {: A0 t1 c% P Mby checking the Debug Registers, you can detect if SoftICE is loaded* K( p# |% N1 |- c! i" S
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if9 E3 p$ I! T: c( i
there are some memory breakpoints set (dr0 to dr3) simply by reading their
1 d3 _( a) W Uvalue (in ring0 only). Values can be manipulated and or changed as well
/ q2 q, \/ a% C c(clearing BPMs for instance)
+ w0 M- ^4 @" F0 v2 h, K7 ^
! N6 k; V: w, p5 e4 X9 _7 X; u__________________________________________________________________________6 Q ^1 g$ k7 ]$ |( S
6 I7 h3 T" T3 X; }7 O T
Method 11
" M% B; `5 i; \# |% q& u=========% g7 T9 C3 I- o- g3 K2 y
/ l7 S& h) f$ t0 OThis method is most known as 'MeltICE' because it has been freely distributed- e- t0 R6 S* Y, _
via www.winfiles.com. However it was first used by NuMega people to allow
( S+ ~; E. P7 R; ~- tSymbol Loader to check if SoftICE was active or not (the code is located
- f8 k$ V- Y) [inside nmtrans.dll).1 F Q0 s- @ O$ A9 V7 E' Y% ]
, l, _- |* L9 N+ o
The way it works is very simple:
2 a1 W3 @. ?* ~& W/ [0 AIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
4 [: P! l- ?5 gWinNT) with the CreateFileA API.
5 l/ w! O, m$ |1 E5 f1 \2 G5 ^& [' v" F" k% q0 }% Q4 T
Here is a sample (checking for 'SICE'):
. f' F/ k& ]/ s5 z2 I& [- u# K" l) n: t( L0 f/ q
BOOL IsSoftIce95Loaded()
' c# S+ M0 ?, _1 R{
4 R3 j3 {- T- d, ~* Y HANDLE hFile;
, Z& R9 q$ t& ]% t9 L2 s hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,7 f8 Y: l" Q* A7 T
FILE_SHARE_READ | FILE_SHARE_WRITE,
* @0 l8 B" s. k) J8 n+ Q2 u- C) C: _ NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
; ? K$ y, }7 h% u/ ?% A if( hFile != INVALID_HANDLE_VALUE )
6 J: Y. f' Q3 d, d, h {
3 ^' ?. n r% l8 Z% R: B CloseHandle(hFile);
6 r: W, s# S9 x/ q return TRUE;0 T# y% p0 O# O- x$ B* d
}! B E2 h0 F% X; g$ B9 x) G4 c
return FALSE;% Q+ p$ @ U" ]4 b. A$ e' \* f/ R
}9 M* d. t x) F7 x/ S
5 g3 t' [; L( UAlthough this trick calls the CreateFileA function, don't even expect to be; P. j. s% b. A' {8 I2 P1 d
able to intercept it by installing a IFS hook: it will not work, no way!$ |* {& q2 B7 P" p/ Z
In fact, after the call to CreateFileA it will get through VWIN32 0x001F. E: {- p1 | M) R0 n% ~! o
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
6 i" X. u6 C' ?( Nand then browse the DDB list until it find the VxD and its DDB_Control_Proc/ y9 ^4 M0 b( l) y; ~& a
field.
9 K4 g: |% d8 L2 ?3 X+ @) KIn fact, its purpose is not to load/unload VxDs but only to send a 2 X' n8 R; n$ `
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)* d/ b& {: K, A2 y/ E1 i6 e& X
to the VxD Control_Dispatch proc (how the hell a shareware soft could try7 k8 R& v% B7 U0 l: I n
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
' i2 R, W+ E: x9 F% @, `If the VxD is loaded, it will always clear eax and the Carry flag to allow
! |8 P) U# E& Hits handle to be opened and then, will be detected.* l4 h- L: w, o
You can check that simply by hooking Winice.exe control proc entry point
5 A, \7 ]* ?3 a8 ~3 j- W, X4 y8 nwhile running MeltICE.8 \, h1 |' U( h# X% C/ P+ ~2 C
/ m; B! l& L0 Z4 k% M5 @
: Y6 x+ d ^: ~
00401067: push 00402025 ; \\.\SICE3 B, [& m/ C! R5 z3 F! j
0040106C: call CreateFileA
( z2 @* y" r: r$ Y# ] 00401071: cmp eax,-001; C9 ?" j( F+ E, D$ E6 B. `7 C
00401074: je 00401091
( [4 ]: j, O& E
: J" `" d2 ^; G+ k/ B3 }7 m7 P7 y5 l: X5 {+ L5 \9 u
There could be hundreds of BPX you could use to detect this trick.7 L# J$ z( M B7 w
-The most classical one is:
3 T3 m* g; y; m, Q. |% h BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' || @( Z1 t0 g2 x: [9 t
*(esp->4+4)=='NTIC'* D/ M) ^+ k/ V4 C
. j; d5 u3 a4 i) K; u4 c9 C2 L
-The most exotic ones (could be very slooooow :-(+ L$ a8 f7 k2 k! O! _. L
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
3 @8 D8 Z" X& j" w* G ;will break 3 times :-(5 d: c6 `: M5 w3 q3 x
+ S& t- Y/ {) J- R: Q/ h
-or (a bit) faster: ) Z, P3 m; N% o& g% \7 j' z* \
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
; O; y+ [& g( P; i4 N! I
4 I6 _, w1 P1 u5 ^' A/ c BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
5 e3 A" d% R8 @8 Y/ s4 ]: S( h ;will break 3 times :-(
/ U, X" w7 o4 B3 F3 h0 j( W2 b( q/ u0 V- K# r3 f
-Much faster:
; h6 P& o, h, @( q: \ r BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
+ p. A# O5 r% W' R: L8 \
- Q7 n) C: @4 O0 b8 s6 e# y! }" NNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
* S7 z% I) k+ dfunction to do the same job:2 m# O2 J* D7 p! X* i* m
, o/ u: F6 x1 k4 a7 k) l push 00 ; OF_READ
! Y$ ` S! B* y mov eax,[00656634] ; '\\.\SICE',02 ?4 x1 p @7 x* n) a
push eax
& M, b- b: h3 j- s# z. V- J call KERNEL32!_lopen3 A6 t) b/ N6 t' K1 h# {* [
inc eax
/ n. q l4 \$ j3 `7 i jnz 00650589 ; detected# u7 B3 z* T1 G4 O! u
push 00 ; OF_READ
+ i' O, [+ s& q. q: w/ h0 x4 G/ M) C mov eax,[00656638] ; '\\.\SICE'% B' l( ~" o4 m, B, p
push eax4 @2 ^" w' U, {$ V9 `
call KERNEL32!_lopen4 X* |9 o5 p5 u! \ o9 F2 V6 B
inc eax P9 z1 h/ x5 N7 Q+ G
jz 006505ae ; not detected+ E; }" b/ G' ~2 a. [( _
" Z6 N# _4 z# w: p
% p7 o3 {. ^) W" a3 y/ j, u
__________________________________________________________________________3 r3 O. h' p0 g
5 _: u, j$ q9 _; o% H0 t
Method 12
7 e+ R) H5 ?# M9 u& c=========
& m3 }# U: i3 z5 f
q* L: E: p4 L8 E/ U& ]This trick is similar to int41h/4fh Debugger installation check (code 052 P- J+ U1 P) H
& 06) but very limited because it's only available for Win95/98 (not NT)) O- ^0 p& W+ N. \0 u1 L' e0 N' W
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
5 S$ C+ X5 `9 u3 G$ ^+ t P N+ ?. s0 F" ~
push 0000004fh ; function 4fh
7 o, ~$ v" }$ C push 002a002ah ; high word specifies which VxD (VWIN32)
& M+ _9 o& B1 B9 _7 w8 @/ a( G& X ; low word specifies which service
# u4 e: ^. |: o2 g; v9 F- T$ S1 o" u (VWIN32_Int41Dispatch)
+ P$ t% P: F: g( Y call Kernel32!ORD_001 ; VxdCall
9 R, g6 g# l9 \5 F( Z. d3 Y cmp ax, 0f386h ; magic number returned by system debuggers7 `7 _4 A9 Z$ l1 O% B
jz SoftICE_detected
8 `4 a# h& _( r/ W* w" }0 Z& u2 K$ f0 }4 k
Here again, several ways to detect it:
. N7 u b8 S- G; h; i
- n4 k' i; e$ `) q( ?- _. ~% I$ G BPINT 41 if ax==4f
3 ?" W+ ^" u) J7 E
& u9 s4 i$ Q/ w6 ? BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one9 u8 ~8 `0 H0 v7 Z+ |' `
7 R5 [# B+ [5 o BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A3 ^$ q* m) |. L: U' ~( a
& n* e0 i* u- e- \
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
9 `/ `' _2 }. ^: }; n2 F% @# c0 w0 N Z- N0 I$ A
__________________________________________________________________________
# @' M& {3 P. _7 {& p8 Q: z
" E9 V( `: I+ z0 ^* H& GMethod 13
' U7 g2 D" x1 s' @, R=========
* O/ X2 g( Z3 h, U1 N+ y% j8 F# b; A3 \+ Q1 N: ]
Not a real method of detection, but a good way to know if SoftICE is
$ Y( n" ]; r' P- `! _) Z) d$ S, binstalled on a computer and to locate its installation directory.
7 a( a$ E9 k2 ~; J" QIt is used by few softs which access the following registry keys (usually #2) :
r. c9 h5 x' ]/ i1 U% ~" E3 j( V
$ n9 G, |7 ^: u-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
, ]+ }4 h7 K5 c( ?6 e\Uninstall\SoftICE
. z; x7 z) l/ i8 F-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE# m8 A* A, H/ n$ p
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion8 q) s+ _" ` K& i
\App Paths\Loader32.Exe
1 b C" U7 x* [6 K @. K: Q- i h7 C: S8 o0 O
: n' h* M6 {& ~% nNote that some nasty apps could then erase all files from SoftICE directory
3 M# ^3 T8 {6 X$ Z3 o, Y(I faced that once :-(
/ t6 u3 r( H' ?2 N
" F: H* @8 R2 ]! }Useful breakpoint to detect it:; G* u) W" L2 A% \5 w" m- x. Z1 ~
4 X* C ]# w% n# a3 m3 M( O
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
& A: d: T% M1 c
; ]9 L( j& V [) c" ___________________________________________________________________________
3 G# K2 _: H2 d9 F1 \
& e6 d7 C6 v G s% r# G* L6 K
+ K. p1 O* z6 V cMethod 14 + H+ t: |$ t7 N5 W
=========
G+ ~/ d3 c |3 L1 D& f8 B/ [& D
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose; W4 i, i s6 B; n: B! y' z- h
is to determines whether a debugger is running on your system (ring0 only).2 O( z! F1 S+ _0 s; z
# O- R( ]( k' `8 `- p8 G4 d
VMMCall Test_Debug_Installed
7 a2 ~+ j* j$ T$ y/ ]8 R je not_installed
& L' p2 P: K, {. m5 d( N6 L
% W2 W+ C1 t7 l' @This service just checks a flag.
3 e* d+ [' X* }! D</PRE></TD></TR></TBODY></TABLE> |