<TABLE width=500>
& c' Z k4 v& F9 h2 k( a<TBODY>
$ g: I- |3 C, O% K; O6 {' j" B<TR>& g$ M* s9 O. E0 P
<TD><PRE>Method 01
. `' r8 i l; e: `, K=========5 S, i/ I; f) f3 |" ?) S* o( z
, o h3 J, x- J$ W6 }This method of detection of SoftICE (as well as the following one) is
( Y T0 M! [% r y6 u8 Aused by the majority of packers/encryptors found on Internet.: ]. j8 E5 G6 e
It seeks the signature of BoundsChecker in SoftICE
( C6 p2 T# O$ N p9 S4 R; Z! H4 p& K! S
mov ebp, 04243484Bh ; 'BCHK'
3 o3 d# {8 j6 B" R8 z; H mov ax, 04h: v- q* C/ v' ?* Z
int 3 " y0 O* J$ K+ x" Z5 N! H
cmp al,4. w+ f0 ~1 b1 v0 q# K! Z/ u- Q; @
jnz SoftICE_Detected
) o1 \+ v+ `) k/ O# A0 f+ a" V d$ C/ m% W9 n
___________________________________________________________________________( w( f d# r0 `5 n- C
0 M! r n5 G9 B8 rMethod 02
9 C4 E0 r$ f9 l6 u$ K& y v6 F/ ~=========( r- j% }8 c" z7 b) _# b: w, ]
' T1 k$ Z) z1 n6 ~" H# P# @
Still a method very much used (perhaps the most frequent one). It is used5 P+ R8 j( f2 _. ~, Q& F
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,) G% p" v2 B4 m3 R0 p
or execute SoftICE commands...9 P; g. x: `6 c7 q! j+ R% G
It is also used to crash SoftICE and to force it to execute any commands
' l& A, F6 m0 [7 Y; ^) ^# h(HBOOT...) :-((
' s# P3 [1 ^5 {3 G# `0 O$ ^4 ]4 r' V2 s5 |+ }% N7 s
Here is a quick description:9 q7 z/ {/ T( {- q
-AX = 0910h (Display string in SIce windows)5 H* N. g; M k
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
+ s) `7 T1 a6 b# x# C-AX = 0912h (Get breakpoint infos)
0 x7 K$ m+ ]0 W) l; z' y @-AX = 0913h (Set Sice breakpoints)
- s7 D7 z6 O2 B/ [- t2 R6 A1 i5 K-AX = 0914h (Remove SIce breakoints)+ N# q$ f; N$ d" o
4 w3 ]: I0 R) Z0 v
Each time you'll meet this trick, you'll see:
2 M! Q* T) W# q0 S) A: z1 {-SI = 4647h
2 m8 j) ]3 k# d+ u3 \3 |-DI = 4A4Dh
$ P- A+ K) D) Z3 DWhich are the 'magic values' used by SoftIce.
+ O3 s N# w' r4 n7 tFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
7 q8 i7 e0 H6 t, T4 |9 ^# s
& L; e2 ]( ~, E% z/ P- HHere is one example from the file "Haspinst.exe" which is the dongle HASP
6 C7 _" ~# T! N# M" eEnvelope utility use to protect DOS applications:7 \* Q) n# a4 A+ W7 [& o
3 V3 N* k! ^4 }9 b5 H" r/ v6 N: ^$ J5 C) ^, H( S0 f
4C19:0095 MOV AX,0911 ; execute command.
; ` T) c7 O. `+ q1 X" `4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
, x* K8 m* ?5 o) L5 M4C19:009A MOV SI,4647 ; 1st magic value.' [/ w5 O/ Y# W
4C19:009D MOV DI,4A4D ; 2nd magic value.
" w* D5 a7 t+ }' N) w' T9 v4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
# ?6 |! @4 x# e; V8 Y# k# G4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute& M+ j2 G# ~# N/ F& z
4C19:00A4 INC CX
5 v) F2 w& S- N4C19:00A5 CMP CX,06 ; Repeat 6 times to execute- k- k: T4 X( V; Y* X% X
4C19:00A8 JB 0095 ; 6 different commands.
& C( X$ q9 C6 _: e4 @4C19:00AA JMP 0002 ; Bad_Guy jmp back.
* a/ q3 T- F+ @: N4C19:00AD MOV BX,SP ; Good_Guy go ahead :) f# Y; R1 v/ ~1 k% `) o$ D4 |
' J" `; g, z! i( i% j) U) b
The program will execute 6 different SIce commands located at ds:dx, which
0 Y, E- S% y. nare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.* ]: p9 r4 i. y: r4 Z' q3 v O, R& V
' ?$ J( K V( N2 |4 I8 P# y+ ?) W2 f* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
4 o+ t1 s$ O. U, I% _+ X___________________________________________________________________________
6 l4 A0 P; K, B! U: j1 M* S7 }; V" R6 r& c/ X/ f
! {+ R# l9 L+ j' @( I9 C* s
Method 03
: M" L$ x9 S) W! v=========
- l8 T7 t( \ ^2 x3 {2 l6 o
, Z8 e" Z9 D: Q% cLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h! e0 Y7 w& W7 M' U
(API Get entry point)
) o& B, a' \8 s2 A
% w- \5 ^4 w! r4 y
+ w+ t1 p; I; g# b, Q9 a9 ?$ {. C4 i xor di,di
- t2 E6 n0 E! k3 l mov es,di# K8 y: L& f8 C0 {" N
mov ax, 1684h 1 ~+ o2 }5 w" B9 }
mov bx, 0202h ; VxD ID of winice6 Q7 j' O# u5 L9 O1 G# b& Y* |
int 2Fh
7 {6 V$ r% t5 F. m* g mov ax, es ; ES:DI -> VxD API entry point
9 k+ A* T; j- q+ J add ax, di% z7 p* j/ x9 Y& a" O" N& F7 ^
test ax,ax
$ N% V$ i$ ]1 c& P jnz SoftICE_Detected
$ l- \- t3 E$ E. Q. ]$ F0 p. H( V4 N: I2 r- S5 T" n
___________________________________________________________________________
8 H( x6 Q8 h k; g6 t
9 J. i4 q# b! t8 K9 [Method 04! a* v* E: u2 i5 L0 c! E, F3 i ^* V
=========' x% J1 }) ]' {0 v) ~3 Y/ E* D
/ g( ]1 B- f1 j5 oMethod identical to the preceding one except that it seeks the ID of SoftICE
9 J9 }$ Z S. @. k( NGFX VxD.
# i" B6 S* C1 T( D/ W5 u) h# _( F* X( E
xor di,di0 A2 q0 C( w s0 G9 N
mov es,di
% G6 v- ^ ^+ d" L, x mov ax, 1684h 6 d4 e+ }1 q6 z6 Y6 V) Z
mov bx, 7a5Fh ; VxD ID of SIWVID. v+ R: J! l3 E" E# b
int 2fh2 @& [1 w/ L m
mov ax, es ; ES:DI -> VxD API entry point
5 |3 r$ m2 B+ I" e) T3 T2 y& b; `6 D add ax, di3 C. t+ O8 Y2 v) B- ]. [) T
test ax,ax
2 e" _) O2 Y( Y jnz SoftICE_Detected" {, d v7 H- P+ p0 h- N2 X
: }# p* w3 z4 N1 L# `
__________________________________________________________________________
7 s* F) x3 o4 K* N+ ~
: ?5 r6 D0 d' _; m: M) Y2 u5 d
: }: b+ k1 o0 x6 G) FMethod 05
& A/ S9 N% e/ n4 }7 c% |3 Y5 m=========. w( p$ p6 n/ C7 o4 N
* p( V( B, p! S1 |" o0 RMethod seeking the 'magic number' 0F386h returned (in ax) by all system
8 c T$ m3 d2 E1 pdebugger. It calls the int 41h, function 4Fh.
- E- h6 m+ L* D, U1 vThere are several alternatives.
0 |/ Q8 f- l C1 J* q) k
6 H9 P+ D9 o* P7 Z: U- N/ cThe following one is the simplest:
9 O0 ?6 A# H8 x7 w
# e$ z# o7 W' m4 s mov ax,4fh
& H* _1 Q% R' W. Z int 41h: g4 L3 ?: o& s f- y: w5 ~( A
cmp ax, 0F386
$ f, J" o2 F: d. Y6 K jz SoftICE_detected8 S8 u8 M8 q) s5 t5 o1 ~
" a" ?" _/ h' F7 i/ Q( u" w: S8 z4 t
" r& X* h l1 a, ^1 ?$ K6 YNext method as well as the following one are 2 examples from Stone's A5 ~% J0 | t8 V$ F/ K/ ~
"stn-wid.zip" (www.cracking.net):
4 j* x1 e- b% w' d, J
, m6 z" O3 W% m6 J, { mov bx, cs# G) a4 d* u( M
lea dx, int41handler2
8 f7 U) _5 z9 B: A. W2 I9 M. I xchg dx, es:[41h*4]
2 [" C- c3 X" f2 \1 n% U! Z. ?. n" j; j xchg bx, es:[41h*4+2]
! A& s: I# t5 n4 @ f6 | mov ax,4fh9 n) R* E3 _! l
int 41h% j1 p+ Q* k$ a$ ]5 L' `
xchg dx, es:[41h*4]" z0 }5 p8 { f
xchg bx, es:[41h*4+2]
* k, \4 M' u! m3 X cmp ax, 0f386h# z0 a& Q" ~. Q& v/ Z) x
jz SoftICE_detected2 }4 g# U' Z: _- u- D& C
4 a/ z- w; t3 @0 {& X* k2 oint41handler2 PROC7 P! Z* r# Q6 e/ D! d
iret
9 K; x9 W6 s1 H- I2 aint41handler2 ENDP
, C: C+ S- _ W4 p+ k! W w: N# o# @6 Q) c
: s4 z6 Q$ h Z2 |: \2 v( q_________________________________________________________________________
7 q/ _! ]6 K( e7 ]% A. P) v9 P" g# E) F% L D
1 |# u, L/ f K
Method 06; p" r" E. K6 Z8 {$ n
=========8 F: h# D/ h0 T; ]0 H! U
* r$ n" Q& z4 p# w& J- V" G B n- l+ e" n& M
2nd method similar to the preceding one but more difficult to detect:! F4 J. {! V0 q4 I
6 t0 U8 b# N5 \9 H; ]8 W8 v, n& f+ E
& E$ T( x* z/ P- s# _
int41handler PROC5 n' @( i. N( W/ F
mov cl,al( u* v4 D+ q3 m' J
iret: p+ t+ p0 B) E& w
int41handler ENDP9 A4 C+ P3 V: R# B
3 N6 ?7 }: r) N6 {1 M3 {
, ]' Z! b+ o& U; u _ ]/ ~9 ]' L
xor ax,ax
* K# e, k3 ~ K( z; g* ]8 l6 U+ B# y mov es,ax* @- y$ B' R: u- B
mov bx, cs( b$ f) g- p" w+ B2 B2 s0 n b/ |& a
lea dx, int41handler
$ S5 V4 T( ^' W; F1 h9 H xchg dx, es:[41h*4]- }1 F2 H. n; \4 `7 K
xchg bx, es:[41h*4+2]* j& s* U; G' N1 t' t
in al, 40h
: o+ h4 x+ Q* A3 j( C xor cx,cx& {! D; x6 C# L$ S
int 41h" k/ L6 m/ g0 j8 ]7 ?, j4 S
xchg dx, es:[41h*4]
; _; G) F% \. [3 a9 h0 F" b" G0 S( @0 B9 d xchg bx, es:[41h*4+2]3 H5 a! S* G3 R* r, Y
cmp cl,al
& ]! G; j" c7 w3 \# R: K jnz SoftICE_detected U! v x) d5 W* d
; H* \1 M( E- L0 @_________________________________________________________________________+ W0 \8 G$ N- Q9 ]& I8 c
1 h3 _" G. l( ^& v3 c: G
Method 074 Q9 W$ F% f8 |. R. _; u. q
=========
7 C6 D% ?$ D# c q, T: d* ]3 ~6 B% b+ R; k9 W) V
Method of detection of the WinICE handler in the int68h (V86)* _7 A* y% }; y8 V( u
8 c" `* f# a( F- k2 x, f mov ah,43h
& y+ a4 Z) x1 _+ l* k. g int 68h
' ~0 j! M+ M) K8 \6 F+ p cmp ax,0F386h
$ y4 D' a. v; a* ]' z) x3 h jz SoftICE_Detected
# E# o4 e9 a# }# R D
& `) e9 c5 S' E1 G" `. v
$ e! M6 P% H8 e' R3 O7 F3 S=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
4 [5 @$ z' n' U3 ] app like this:
2 ~- `. m* E- o# d' l$ L0 x! i% j v# d
BPX exec_int if ax==68
* H. K0 E1 ~7 K# M. K$ ~ (function called is located at byte ptr [ebp+1Dh] and client eip is
Z* I4 n6 N7 X+ ` located at [ebp+48h] for 32Bit apps)2 U h" M8 P: ]2 \# ^
__________________________________________________________________________0 X# s* H" ?1 L; _5 G; K; T
( c$ v9 O v4 i
, }/ r. r' S9 s9 g
Method 08
" L" J% ^( L! `3 D' c( Q( K( @=========' C0 i8 a6 I, S8 P0 i. i
9 Y2 o" N" i; W: |
It is not a method of detection of SoftICE but a possibility to crash the" g6 ?5 q/ V' d& h7 x# V4 N4 }
system by intercepting int 01h and int 03h and redirecting them to another$ R1 y4 j' }9 w0 s6 q
routine.
) x9 |4 @$ V7 L7 FIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points: V% A, i4 S: M( a8 w) f
to the new routine to execute (hangs computer...)
8 ]( Y2 g6 _' h7 g) F
4 y8 F8 w) |, a! U* M. [* N8 C mov ah, 25h! N: B }" @4 i9 D R
mov al, Int_Number (01h or 03h)3 R9 W: l( p) y0 m5 t
mov dx, offset New_Int_Routine
; w" L" p) M; K3 C" m( r$ P int 21h( [ a5 D1 p+ F* b4 v- u6 j
# J! s5 S# d- k( A1 f! k
__________________________________________________________________________9 u+ c& \7 S1 q5 N+ A- g# o
& A" v2 e6 `, OMethod 09
% Z) j8 f# G1 w$ t$ R=========5 @4 S' O1 p2 M* ?9 f- d
, R/ B) N# ^9 ~6 oThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
/ I: o/ G0 _$ x9 l9 ]6 tperformed in ring0 (VxD or a ring3 app using the VxdCall).& r8 a9 w7 j6 I+ d
The Get_DDB service is used to determine whether or not a VxD is installed; r) r3 k6 c% v8 C
for the specified device and returns a Device Description Block (in ecx) for, t6 k. {5 d* X: o2 P5 {
that device if it is installed.
1 r% C) m# d: ?3 W. B" x1 v! J- n5 j( `, P+ l7 p
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID" y6 G. s3 D4 d! L4 x3 B$ K
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
2 U/ [& G) k* U; H N( I VMMCall Get_DDB7 v) [- Z9 d* L2 L& M. `9 L% C W
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
! V" V. W m& Z4 h) W- t a5 ~) x) {! n; m0 o/ ^7 F% Y
Note as well that you can easily detect this method with SoftICE:
1 D! s5 }- X" m) { bpx Get_DDB if ax==0202 || ax==7a5fh
* y0 ^! ^$ }# a5 M+ H' o) F; W& m0 K* x1 ~ Y7 d0 O" @" w. Q5 L
__________________________________________________________________________+ S2 v3 B8 K0 ]' b+ G% N
2 m8 V7 z. R9 W; GMethod 10
, E2 t7 C* Y$ T) z$ _: f& H=========
" D+ ^, n; t7 {! q- _/ Z: V: D
1 B+ g n* V% d=>Disable or clear breakpoints before using this feature. DO NOT trace with
8 A( p5 k! ~9 `& W- z SoftICE while the option is enable!!
H8 b* s* k! ?3 s; O" h; A# s4 p/ Q0 p# m9 v4 F
This trick is very efficient:, {# f' d7 c0 i: o. X) R. j+ D
by checking the Debug Registers, you can detect if SoftICE is loaded9 [. c n k$ G( ~" f2 d! o
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
% n/ q0 L) b* J3 xthere are some memory breakpoints set (dr0 to dr3) simply by reading their
7 ? I; O9 R! I L% w: Vvalue (in ring0 only). Values can be manipulated and or changed as well
6 V1 L4 C* g4 `(clearing BPMs for instance)
# ^( C5 v8 Z% p. a7 F6 |6 c
! O9 Q- W9 i% P" B__________________________________________________________________________8 k" {4 A0 H6 D" l# m1 R: v) w
7 [) y. O+ x. ~' ^7 {Method 11' ?* U) ?8 {5 {4 l! ?
=========
! V3 f+ f6 U, t. Q9 d& X% R; @6 n- C, j5 K) R
This method is most known as 'MeltICE' because it has been freely distributed2 l: y, z: H% Z
via www.winfiles.com. However it was first used by NuMega people to allow
2 X; Z" d. [6 Z$ ~Symbol Loader to check if SoftICE was active or not (the code is located
, R. F4 h7 `- ]) j! |, \inside nmtrans.dll).# P0 W; p$ p! Z# y
# e+ @6 @! P l4 \; B# U3 p1 AThe way it works is very simple:8 ^2 H9 }3 b' ^1 u% y" K; ]: o5 T: \
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
+ }3 M4 e6 d# ^. H! cWinNT) with the CreateFileA API.
6 T* p; B e& p& X: u! ]: l
/ W5 m8 x5 S( m8 p6 GHere is a sample (checking for 'SICE'):+ Y* T3 B' F8 w. v
$ x& x) e, ~+ c( e" v
BOOL IsSoftIce95Loaded()7 R$ p |: Z2 v
{" S( s$ j! _7 _, ~" z
HANDLE hFile; & q, H* b6 E( n3 D0 u
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,. A$ r6 q; L" \6 o1 ]1 G
FILE_SHARE_READ | FILE_SHARE_WRITE,
! \2 |0 m7 M8 P/ u$ T2 ` NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
* x' p: T0 I3 @+ {5 y8 e if( hFile != INVALID_HANDLE_VALUE )' \5 z% v8 Z+ [* i; g: l5 g
{4 I! c$ ?6 q* o: u) W4 g; `, \5 U; q
CloseHandle(hFile);
0 I5 u9 v9 N+ ]5 x+ K7 q return TRUE;2 P' [6 v% J) E1 |
}
- @ d: j" y$ P; Q& u2 s u( k return FALSE;
" r+ k" z+ _4 _}
( Q" }; o h7 ~6 w) g& P% c8 w# u
% J& _: b( s+ [; h. n# W5 t3 T* wAlthough this trick calls the CreateFileA function, don't even expect to be
# t h9 \, i( n. ]) a% f$ \able to intercept it by installing a IFS hook: it will not work, no way!
* |) V- J) t! t# k! RIn fact, after the call to CreateFileA it will get through VWIN32 0x001F2 @! c! ~, T9 z4 h) M
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)$ a: a# _( k: D0 G2 w$ c4 k3 Y
and then browse the DDB list until it find the VxD and its DDB_Control_Proc6 q9 `+ I, z/ f8 o( I- S: _+ J
field.
% w, X" C7 M; h5 |In fact, its purpose is not to load/unload VxDs but only to send a
. ~/ \& j& h4 M- Y8 i# \W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
0 R5 i/ C' c* b% d1 w* l% y% n9 _to the VxD Control_Dispatch proc (how the hell a shareware soft could try9 W2 G8 y& j! m) `$ e- N) }
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
- S, g. Q! N8 D' RIf the VxD is loaded, it will always clear eax and the Carry flag to allow
$ @, A" b9 B: l1 ?its handle to be opened and then, will be detected.
0 Y H3 }0 F1 J! g8 `) j7 mYou can check that simply by hooking Winice.exe control proc entry point8 N* W& v/ G" {6 G+ \6 a$ X
while running MeltICE.) s! f5 }/ i$ t7 c: M
! C: O3 y) {6 q7 C1 Y6 C/ @1 j$ t
0 h4 m. W9 f9 n
00401067: push 00402025 ; \\.\SICE8 a& `. I2 p% \& r- ]2 `
0040106C: call CreateFileA! V8 V7 d5 {- b$ w; V6 _5 ?0 h
00401071: cmp eax,-001
8 W& R, `* n1 U* B' H8 { 00401074: je 004010917 F+ L2 P& F* I! S' U) [' _
' o7 j& n6 q5 V5 K7 `
8 C/ g# a+ w: Z- i& @ v& _6 T: b
There could be hundreds of BPX you could use to detect this trick./ i, b# ^# X& |
-The most classical one is:
% N- i+ s1 S+ M' V/ N/ m4 [6 T BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
\& Y* t5 {, H S# [5 P *(esp->4+4)=='NTIC'% g F4 u2 j! x7 Z6 \
$ e" g2 ^) N* Z/ u k: U( \
-The most exotic ones (could be very slooooow :-( V% T% G; C. t% J7 z
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') 2 }8 o' W0 j7 q( O
;will break 3 times :-(# E% W6 V' t. `. E9 t. J* Z
8 S+ F+ [- E2 {1 M
-or (a bit) faster:
7 o! G$ n2 u. P" _: B BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
* @3 C2 }/ i1 `) g& R8 B5 k, T# ]+ C( c6 w1 S" W1 T P, r& U
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' $ z+ ^5 N1 G" c J; r7 E1 z' _
;will break 3 times :-(! Z: f6 ?# |3 ]# C+ [ u
* S$ @7 P% Z+ h( B-Much faster:9 Z( c$ r+ _5 x( ]0 C# @
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
, \; x5 p) N2 I6 r7 N+ i: @; m
5 S# s8 v/ D, j- g/ F3 ~& ANote also that some programs (like AZPR3.00) use de old 16-bit _lopen
8 J5 }: {% W$ o. L4 K6 K: v- Gfunction to do the same job:
4 [& b' I N' z& q& _3 u
! v7 ^8 f8 s; I- w push 00 ; OF_READ
1 g! h/ r- n l; P9 R mov eax,[00656634] ; '\\.\SICE',0: h: z9 {0 a! B ?0 i0 k
push eax" @% T9 ]6 N* g$ k$ ^# u1 f0 @ J
call KERNEL32!_lopen- x8 L1 F5 ]% A5 ~
inc eax
, h% e8 h$ k8 x( b4 l jnz 00650589 ; detected
" A2 a2 x; a2 c8 M+ F push 00 ; OF_READ" |4 I5 ~' c/ T& |
mov eax,[00656638] ; '\\.\SICE' f: A9 H$ F8 J; l( d9 g
push eax8 A- A9 N, _ _1 f& V M6 A' H
call KERNEL32!_lopen6 [' u s! |! ^9 k0 p
inc eax T( b6 C: C5 p: M! g$ {
jz 006505ae ; not detected$ b+ w9 Y" A T2 \' d
" T: N+ e% a- C& \* `( S
+ K2 P& _1 L6 l5 g( g__________________________________________________________________________/ b( \; a" P- ]* y/ G0 V) o- b8 @; |
' u8 |- j) _8 L% cMethod 12
n+ b5 v/ u+ A+ v" j=========
# o z! j# M1 V& g% K: z: f- x) {! L- v) d9 O. ~/ q* N
This trick is similar to int41h/4fh Debugger installation check (code 05
$ ?+ `# u0 h, x9 G# |- O; r6 Z& 06) but very limited because it's only available for Win95/98 (not NT)/ W* _% \. K9 G7 G
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.8 @3 G' l( |" D7 i* g! {
- E7 G9 ^& L7 J. T2 ]$ a push 0000004fh ; function 4fh4 ?: [- P) I7 a4 d2 D. s
push 002a002ah ; high word specifies which VxD (VWIN32)2 Z! e0 y$ b/ E8 w6 {
; low word specifies which service
' W+ B% O: `4 q x (VWIN32_Int41Dispatch)
6 k+ O. G }4 O- N3 d call Kernel32!ORD_001 ; VxdCall" I6 y6 h; @# @2 B& B$ b7 |* [
cmp ax, 0f386h ; magic number returned by system debuggers
. P/ h7 L6 {( t! L/ i. i jz SoftICE_detected6 p. B% j8 d( o7 o4 O
2 h- n! {1 m# Y
Here again, several ways to detect it:
& D) C0 g; y% E+ A
) p$ z5 _2 _* v2 B2 Y/ M BPINT 41 if ax==4f* s8 I$ ^4 x' G6 n. `0 o
& {& d6 p) @' Z/ b1 } BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one8 ~& e8 O5 p# `0 L# w
8 b( D8 Q8 N+ i# K3 u9 B& G BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
2 B1 y9 I8 I- r
! A% {/ }. C" e2 j9 H' G BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!: H2 E* @/ y1 i8 r* y5 Z! c* P
& e9 @" N" F, I4 _5 T( n__________________________________________________________________________: A& c9 e9 T8 [9 u0 F
: y& C" N# r1 R! d2 I9 b
Method 138 `' n# @# z* i9 P4 B( s
=========
6 I! c0 `; j9 j5 ]+ }, m! l+ ]! U, C6 r( [
Not a real method of detection, but a good way to know if SoftICE is
" y: T$ o" t8 @9 h5 ainstalled on a computer and to locate its installation directory.* y2 u- N1 n. S" p' x
It is used by few softs which access the following registry keys (usually #2) :+ x2 v( C( O8 |: r# }% k r4 F
1 b9 i B( [+ C* Q. U# n" y9 X" Q
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
2 q8 ~6 p( c2 I! j, P, ]- m( u\Uninstall\SoftICE( R) z: R6 E# b% h! h' x
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE1 R! g% y4 P6 v3 R
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion7 }& L) R3 ]" I+ V) c+ I
\App Paths\Loader32.Exe3 e+ q% s9 \# @2 L" O. C$ y# I5 n
3 T2 `4 P2 r$ ^4 b+ ]: f6 ]& t+ f# }+ s: H7 P8 _
Note that some nasty apps could then erase all files from SoftICE directory
$ M% c; A5 S7 T7 K% k+ F(I faced that once :-(- n0 \4 r* [/ n1 F
: t! i* u: f) ?: z" M: ~Useful breakpoint to detect it:
+ E9 q1 ^. f9 s4 z' ]2 }( z
, {0 k( K' f5 j! \0 a BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
( |' A' C& |# g2 v: @9 |$ J+ R% a6 M( [4 M
__________________________________________________________________________! i. K$ P/ _+ L" ]8 W8 H, s! N
4 O& O" b3 M" b, b0 F# ^9 n( m
: G8 C. X4 `2 S1 j; n3 r, D9 kMethod 14
+ J9 L, h$ k. Y3 G=========, k+ n" K8 d, W0 K, x( S7 T
# } q0 | p( ^$ I" o, {A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose* B0 Z7 y% W' g
is to determines whether a debugger is running on your system (ring0 only).
+ Z+ A. l* E& ^! M4 B
4 o4 e+ e4 |4 H+ Q$ g3 i! {% o VMMCall Test_Debug_Installed
% ?8 m# S) J: n! T" x7 Z4 ^ je not_installed
- c A# f( \( H' `
/ x/ C; E: E: Q; J- j$ E0 I: ~This service just checks a flag.
4 \6 @8 z4 ?& M1 N</PRE></TD></TR></TBODY></TABLE> |