<TABLE width=500>) q* `' T" Y) D/ e- e
<TBODY>
0 w0 F. B& a6 }8 a8 o; f/ D4 R<TR>; E% b; E1 O8 t4 U( c, Y0 ?' J
<TD><PRE>Method 01
0 H$ c$ o8 j- s7 n% }& c6 p=========
2 o/ r2 Q/ k+ a0 C2 {: `( D
: O" W' E8 r2 l- h. C4 a oThis method of detection of SoftICE (as well as the following one) is1 Y- h5 U" [% ~5 J& i' J9 I
used by the majority of packers/encryptors found on Internet.% g: ^1 \( I: C7 r, X
It seeks the signature of BoundsChecker in SoftICE0 D' k, w/ u; L2 I5 @
6 ^( `4 _) a6 Q, R+ D7 P
mov ebp, 04243484Bh ; 'BCHK'
+ |0 f& p! ]8 J mov ax, 04h
9 b, ]3 j4 g: Y% l" Y4 Z int 3
0 J% a& v8 k' z+ M; d cmp al,4$ F( T" q# y, \5 z3 n
jnz SoftICE_Detected
7 z) k" e f! U6 q( o% O5 b7 v; g A; \( b! R7 B' L4 p+ u* Y% u
___________________________________________________________________________" z; r, ?; G2 l- S& r6 }
* f4 J( n5 w* Y1 @3 R0 F$ kMethod 02
5 a- \4 y7 U$ V+ H, L=========
0 [- p. o g4 R1 J; }2 a8 B% t! i+ x' u- X) p5 Y# O
Still a method very much used (perhaps the most frequent one). It is used! |* Z3 ^3 e Y
to get SoftICE 'Back Door commands' which gives infos on Breakpoints, w6 f9 h7 S# z" l5 x
or execute SoftICE commands...
! B0 }' |) x1 bIt is also used to crash SoftICE and to force it to execute any commands1 y; o+ g/ C: q% w( Y
(HBOOT...) :-((
% c# `+ H+ u5 T' c- |$ z( e
( I: s+ a, q! AHere is a quick description:* F* U8 ?$ O/ p% K! w, \* x0 f2 o
-AX = 0910h (Display string in SIce windows)
) r7 S$ m1 }/ n: }$ i-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
9 X0 j0 { f* N9 m& l-AX = 0912h (Get breakpoint infos), [, Y3 h: a. m1 P
-AX = 0913h (Set Sice breakpoints)7 c+ ~8 i! p4 F* X9 v# r# c3 I
-AX = 0914h (Remove SIce breakoints)" F7 t3 R. R& z5 [4 G) h2 @: h. L
$ F* n; r0 Y+ lEach time you'll meet this trick, you'll see:
- N3 p) ^( S ]# B: q# y-SI = 4647h! n$ D3 T: p0 f6 s7 k9 h1 j
-DI = 4A4Dh" _2 V% s0 g! k8 n, B
Which are the 'magic values' used by SoftIce.
. @' O' P4 Z$ S$ oFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.5 p; V2 v8 B$ c9 G
2 S2 t1 Z/ B. G( _+ L" @% r; }# @1 ^# r
Here is one example from the file "Haspinst.exe" which is the dongle HASP! J2 b* @, o; h9 \
Envelope utility use to protect DOS applications:
# O# j' d2 |( |" b; @6 `- o8 X1 A3 t- q
z( t5 o7 j6 O
4C19:0095 MOV AX,0911 ; execute command.
3 ^3 t" ]7 ? H E* { u4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).( O& s5 ?: L: q$ t
4C19:009A MOV SI,4647 ; 1st magic value.1 W/ e! n% P% m. W3 x/ ?/ x
4C19:009D MOV DI,4A4D ; 2nd magic value.
& ~, _+ l7 X+ M4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
9 w7 z" k( h6 V. d( r7 { Q4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
: B% J1 g3 j; O4C19:00A4 INC CX$ R8 |, G5 N- t0 c/ g0 {) z( o
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
; L$ k) T! a1 ]: E2 R. e. A4C19:00A8 JB 0095 ; 6 different commands.
9 T; Y' j& P; I: t9 ` x4C19:00AA JMP 0002 ; Bad_Guy jmp back.4 ~5 @( ]! x3 O4 {4 w
4C19:00AD MOV BX,SP ; Good_Guy go ahead :) l0 p C( r9 |' t! x
# T: M2 W# _% r/ o
The program will execute 6 different SIce commands located at ds:dx, which
g; |( ^* {$ m. m( S. Aare: LDT, IDT, GDT, TSS, RS, and ...HBOOT./ D3 _2 v5 P- L( @7 u! z: g
+ z9 Y3 `( q x1 ~7 k$ s2 E8 i* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.1 m5 {0 h: q: n f* P9 }
___________________________________________________________________________
! [/ K3 h6 ~$ u+ B4 C: x1 T4 m5 M+ k& |* P7 p1 q
" S9 u" X! y) Y2 k3 lMethod 03+ `" t8 } Z! w. c X
=========
5 ]: D$ E/ V! {* I7 A+ ]( Q6 D; ]
5 ]2 j' w( X) F1 Q% gLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
9 f1 t2 i. X: G8 x! \(API Get entry point)
3 x* K) @- A+ ^6 k3 o- j$ n ' b7 P" m+ V& `8 q9 ?' r" Q: r
2 M9 K9 W, y; n$ H) N7 y xor di,di9 e# G; e- l4 \3 K: e
mov es,di+ A% J8 w" D6 d7 {- |
mov ax, 1684h
4 u& l: s" T& ~3 y2 B* p+ b' c+ j% G, k mov bx, 0202h ; VxD ID of winice
, k. x: R& L' G! K8 z z/ N" Z int 2Fh
0 r2 u. j1 Q+ q* \+ @% X6 R mov ax, es ; ES:DI -> VxD API entry point3 i, J1 J6 @ Q8 O; M
add ax, di
; u3 {2 C/ g9 l test ax,ax
6 `& W3 E L' p) y7 p jnz SoftICE_Detected5 `9 l5 I: ~! O
6 W! T R$ D' e8 D- ____________________________________________________________________________6 q9 d5 P, t1 s5 A' W+ Z7 ?% r
; {* F n- Q7 T+ `9 ]Method 04
* O, P0 S4 h. T. l' V# ~1 X a=========
- E( \7 N7 k% }9 i/ z4 A4 _. J8 }" f7 l0 n9 `5 Y0 u, q# O
Method identical to the preceding one except that it seeks the ID of SoftICE- i2 i) A. w9 x7 J, P: `, ]( }
GFX VxD.
6 ~: d% t6 q, f! o& Y: d1 v; j- G* r) s1 T) J6 \
xor di,di
8 t+ k: e9 `% w/ l mov es,di
) l5 E% w% I/ C! M mov ax, 1684h |! ?+ |4 F+ J& a5 }1 G
mov bx, 7a5Fh ; VxD ID of SIWVID
, [: Y; C; b* m% l1 l7 N3 T int 2fh
5 _; A3 P/ C" N" \" ?, M; w mov ax, es ; ES:DI -> VxD API entry point
& R. G# }: V7 {4 ~ V" o add ax, di0 w% h* {1 C( w9 ~8 t! w; O4 }) m" O* m; F
test ax,ax6 X, V1 c# R' _9 B( ?. O
jnz SoftICE_Detected
& l" O0 Q5 L! h, C8 T4 R& m) Z h" h- y9 x: r# ] r
__________________________________________________________________________
# X; x w! \( }$ ?. c/ K# y6 }2 z' g: w# B
( n- ^8 u& y, ~& O2 ZMethod 05& {. O9 N% C; u0 ?8 J" Q5 z6 c
=========2 q% s0 O2 U9 n# I# K4 w3 [9 R
" }8 a, W! o- NMethod seeking the 'magic number' 0F386h returned (in ax) by all system! ~6 f2 g: d* R" h- Q1 M
debugger. It calls the int 41h, function 4Fh.6 N- @* J1 S- ~) c# d; I
There are several alternatives.
( {/ l3 {" r1 l7 D; x3 ?" ^# T7 u
- b- h* o3 R% A; ~5 S5 QThe following one is the simplest:
( V4 J$ z* p, c( f, X, ~! ~8 c+ d- x; R6 o4 @
mov ax,4fh
. m# \# l5 a; Q+ ^6 _$ U int 41h
+ _7 _# T( \$ @5 B0 h: @- s; K# { cmp ax, 0F386/ \: U, }! `& I. n) ?: \' a9 |. Q- Z
jz SoftICE_detected
" M6 ] s* i% [. e2 U! ?9 |2 }: i7 w! X3 h" m. @: u' S$ e: Z% p" f
. A8 X/ t) V# k9 h
Next method as well as the following one are 2 examples from Stone's * m ^- V! M, x9 t# P, B) |( T, g
"stn-wid.zip" (www.cracking.net):: i2 ]% A/ _% z# S
1 e0 }0 X3 p n6 I: }7 B& w
mov bx, cs
* h/ ]& }, b/ T$ S, Q& f lea dx, int41handler2: y: d0 S ]: P. D4 z6 ~
xchg dx, es:[41h*4]: c) L) y- S. Q7 ]! F- Y2 D
xchg bx, es:[41h*4+2]8 t' z6 y7 w8 f% h
mov ax,4fh
' C2 F# i2 V* G0 f# _' x int 41h" a2 L4 `) n! Y; r& u
xchg dx, es:[41h*4]! F5 D+ r1 ~/ Q7 s
xchg bx, es:[41h*4+2]
9 ?) }$ [% \& s' E cmp ax, 0f386h9 K8 m$ T0 v$ O; E" E3 O
jz SoftICE_detected
+ t4 `3 G$ ~) N5 T# u. z6 h% P+ u
int41handler2 PROC
( S9 F' {5 Y3 O5 A& f: o! q9 a iret1 R+ K2 g7 g6 O# D
int41handler2 ENDP
. s t& ]$ M- U; W% D5 D/ ^. [5 f9 O& R2 b3 h0 C' S5 v: c
5 M$ G" Z* B3 m2 W! X/ B( W" |_________________________________________________________________________( D. ]8 L* Z$ x8 x7 G3 @
; U6 U/ C8 B# U6 F' ?8 R/ r
. R- o" Z! D- r1 r6 dMethod 06
- @1 G5 T( x. A$ b5 L/ q$ J=========
( }# `8 x/ ~6 u: m2 W: c, R; ]. m/ _! s+ m& e8 ]
) k2 Z p2 f: d( X& F
2nd method similar to the preceding one but more difficult to detect:
* R0 G. f. D& X8 Z! V6 ^- H4 x- n B" e2 [4 _! y
4 n3 c+ u- `6 ~/ R; uint41handler PROC
. b5 ^# N8 A- Z mov cl,al
; Y5 G1 Q4 D: e/ ~* x iret
5 {( ~0 Y6 ?* V9 I4 @int41handler ENDP6 x+ l9 q' t! N3 [1 m. L) ^8 f
7 T+ K' q" V3 w. ?9 k7 S
! C; }* a S# e7 A
xor ax,ax) D- ]* V. D8 _/ \) d' Q! H
mov es,ax1 P; z! ~! `: a1 ^
mov bx, cs. b& w" }8 P# Q7 m0 o) S: Y
lea dx, int41handler ^$ V$ T3 p3 |- n
xchg dx, es:[41h*4]
# n& ^; @6 d5 Q- F# X/ ~' |7 d xchg bx, es:[41h*4+2]- @6 a* j7 b9 t: D% d, _# r
in al, 40h7 D0 x4 b* l/ Z0 H3 D2 A6 o3 |
xor cx,cx
! a# t, r; K- Q ~' C4 c% }7 U int 41h; M) X1 l+ k0 o! G' B. r X6 s
xchg dx, es:[41h*4]; @% g0 K3 J, }' \' }" k
xchg bx, es:[41h*4+2]
7 F' h- v8 E' T. r/ {) H cmp cl,al3 `5 E2 ~. ^7 }& [7 D& Z7 \
jnz SoftICE_detected
4 w; Z3 d, n$ A" x3 c. G
# @. e. e- q% i( G% }: p_________________________________________________________________________4 @6 R8 L4 p8 x4 \' S
8 Q, U+ K. k R* X3 M% B7 ~+ R
Method 07
* S* C5 `+ a2 P3 _' K) V=========* i) _5 u1 G3 o. m
$ S' e7 u+ ^' u, s F8 L4 AMethod of detection of the WinICE handler in the int68h (V86)5 A8 s+ F9 \0 V T, e
* M& c: e; g! @& H; f- t+ A
mov ah,43h& P5 W# v% S* O! N( V& B% @) W: W
int 68h& t9 n; N# v+ E) M# z. ^9 ~ R
cmp ax,0F386h" S: H' C1 t1 y
jz SoftICE_Detected! Z1 ^, R- r1 L3 h' V
$ n/ ?+ r+ t) O/ S, y2 F( R, Q# s L! V* p T) Y& D* B" B+ c$ A
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit1 u5 z3 [' J9 H8 q
app like this:
8 E% l5 W4 _$ d( C1 g) ~* S8 x: r7 Z+ P) J; a6 T5 l
BPX exec_int if ax==68) b* L" ~2 L- C7 d4 F# ]
(function called is located at byte ptr [ebp+1Dh] and client eip is
; l9 N8 i9 b+ z; L located at [ebp+48h] for 32Bit apps)- i: Z; }6 x D! K$ T
__________________________________________________________________________
5 x9 o- k) _' J/ K
% Z$ ?" w! k$ ~: [/ U, O* U" d# N, ]# a2 f4 x
Method 08; Z2 z- @1 p. H0 Y6 @8 e, _
=========
: t- w' g' j+ ^0 u& g' Q$ j: r9 g
( o% S6 C$ a9 h# q4 Z$ c# tIt is not a method of detection of SoftICE but a possibility to crash the
% d% l. t8 _" s3 S( {; e5 ?system by intercepting int 01h and int 03h and redirecting them to another7 u& {. c3 R6 Q: g) ]6 g
routine.
. | t) G0 E/ }& Q6 OIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points: x* A4 ]' A$ M
to the new routine to execute (hangs computer...)& r" A. L3 N' ~2 f
& r; d0 O. t/ E% V, Y
mov ah, 25h/ ?( q/ Z7 Q+ V
mov al, Int_Number (01h or 03h)
( B& u7 u5 l$ k5 B mov dx, offset New_Int_Routine
! v4 }& G# _ a$ U4 X0 B$ z" D int 21h. {! f3 a+ t, g% y9 v/ Z
: l* |, _) l& ?8 T
__________________________________________________________________________7 ]% y2 r' y' `# @; O
+ q8 g$ m) `* J# G2 PMethod 09
& \% b- S# {/ `7 D# u: ?0 O$ S=========* T( k7 m& Z* p1 ~& M; Q
' ]& ` r1 n( X( F: ~8 E ]& l5 nThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only5 K9 W& V6 A! T
performed in ring0 (VxD or a ring3 app using the VxdCall).
( |" u0 V2 B( ]* VThe Get_DDB service is used to determine whether or not a VxD is installed
4 t: ?, n. v7 U7 P) d% D. L( F0 Lfor the specified device and returns a Device Description Block (in ecx) for+ \& h/ Q) E' T4 h+ @# n% a; k
that device if it is installed./ _3 c" \- c1 Y* r* W; A& b
( D5 H: c! f/ R( \& N* O mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
2 G# K' ]8 Q$ E1 \- W8 m* g. P, @ mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
9 o, t" G6 \6 m" I* D) f0 q VMMCall Get_DDB
! m( g7 X: \; x+ y- y# l# J- x! |1 [ mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed8 i8 v; E! J) G8 D7 o1 \: A
. w3 k9 |" b5 L P6 j
Note as well that you can easily detect this method with SoftICE:4 }9 X2 f D: z( ^+ t% t
bpx Get_DDB if ax==0202 || ax==7a5fh: X* l+ E) h7 ?& @7 R
o' b& c9 q" [3 l
__________________________________________________________________________, G* \! \7 h( D; f" R8 }9 u0 C
k$ Q, Y+ D: d% O' s' JMethod 10
& _5 u6 J8 Z; u; T7 Q. k$ d=========
$ ~% G, k0 ]7 Q+ J/ s5 H+ t3 C/ E7 d: C3 c, X5 j* ^ z/ E j
=>Disable or clear breakpoints before using this feature. DO NOT trace with( b* @9 O0 f# \* t j
SoftICE while the option is enable!!/ Q. v% J$ r/ R6 g' N4 E
" T- l5 P& ]0 OThis trick is very efficient:
3 ?) N: ]# j( t% X: Bby checking the Debug Registers, you can detect if SoftICE is loaded$ Z4 I. a/ J$ ?* S* F" [1 e4 L+ l+ y
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
; D- u' C7 U4 U) D' L$ \there are some memory breakpoints set (dr0 to dr3) simply by reading their" E/ P: T W" s
value (in ring0 only). Values can be manipulated and or changed as well8 d+ H. n& M, C/ k! Y! A8 N% ?
(clearing BPMs for instance)
; J- j; B" ?* Y* d- U; l% [5 s$ z6 e. V. |, D
__________________________________________________________________________ ~8 _/ ~* Q' ~: l# ^( M
! y: K1 W2 B& g: I9 N
Method 11% F* \6 b, d) P6 S2 M0 ?
=========
# C5 C- a2 K0 B
# N" Q" m& r2 @7 H) sThis method is most known as 'MeltICE' because it has been freely distributed- ?* m2 r- t3 z& t3 T1 r, A9 M O1 }
via www.winfiles.com. However it was first used by NuMega people to allow
6 A% s Q- {+ {$ S0 x+ `; T' R7 hSymbol Loader to check if SoftICE was active or not (the code is located' v5 R1 |3 T& Y0 ~: k
inside nmtrans.dll).; @, _7 X; C* h7 S
|8 S- r6 C4 ]% }% y8 U, l+ p& G) d5 fThe way it works is very simple:5 x- T$ a& A+ ^/ a. i: q: J
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
6 C; P) S) O9 IWinNT) with the CreateFileA API.
& T3 i6 c1 j; D7 V% h$ j' f1 y3 x/ [( i1 M1 R
Here is a sample (checking for 'SICE'):
% W& G- {& M0 J' q( v4 _
/ k6 d5 S: ?! a5 \1 nBOOL IsSoftIce95Loaded()
* o' y R* U$ g. P) Z2 m( v* F( W; q{) a. Q1 k' ^# P% T) R5 ]( V( o+ N
HANDLE hFile; . A* }, Y5 p" K! P) N
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
! x8 b* }/ _( f FILE_SHARE_READ | FILE_SHARE_WRITE,# L* B% R" B+ y. M
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);' N0 a4 r' m: D5 |3 C
if( hFile != INVALID_HANDLE_VALUE )6 |/ z. x9 q |% V
{
( ^' o0 I& K: }: e; D7 w& k6 S CloseHandle(hFile);
4 X7 ?% [2 ]& E5 F) H% X1 m# \# b return TRUE;4 A" V+ l! e& c0 I
}
. `% K3 {% \& c: |+ F; V, E return FALSE;
6 O( |# |3 ~+ N) H+ z. ]+ F4 x}# J+ E$ q7 @, }# w4 Z
6 B. `8 [" c0 s# f
Although this trick calls the CreateFileA function, don't even expect to be( R F/ U2 u% C! w& G' ?& W8 \1 n$ i
able to intercept it by installing a IFS hook: it will not work, no way!( C9 Q/ [4 q+ S& E6 B- j- g
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
$ C8 Z$ ^; L7 h5 V: Gservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
% f ]0 Y9 i1 S* A: L, H7 aand then browse the DDB list until it find the VxD and its DDB_Control_Proc! V- n2 k6 v$ R5 N* c4 i' F
field.+ ]5 N* V* i' y* _$ {6 A
In fact, its purpose is not to load/unload VxDs but only to send a
! _/ I1 v. n% V( ~& BW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)/ Y6 Z$ O0 b( [; k5 k4 U, y2 j1 e* n
to the VxD Control_Dispatch proc (how the hell a shareware soft could try [/ V5 ^* H' P( Z ], L" p5 u' ~
to load/unload a non-dynamically loadable driver such as SoftICE ;-).- v6 @2 g# R+ U
If the VxD is loaded, it will always clear eax and the Carry flag to allow- \3 i" n) a+ V: C
its handle to be opened and then, will be detected.
) \) |4 N" N: h' f- A) T, DYou can check that simply by hooking Winice.exe control proc entry point
' x0 k/ |& C* @- S! p. M) [while running MeltICE.
9 C k9 G0 U+ z( d; Y/ m9 L& ?7 P% }
4 X$ I) X ~5 `3 Y7 E3 T 00401067: push 00402025 ; \\.\SICE# H* D* Z3 w) J, d6 I/ r/ d- |4 g
0040106C: call CreateFileA" c" h6 F) D3 u2 t
00401071: cmp eax,-001
: U. w- k; K7 }( U 00401074: je 00401091
* \$ ^ \ m: h2 l
5 S2 U: B6 X% b- I/ z+ T6 Z
- c: C/ x9 a& ], ^There could be hundreds of BPX you could use to detect this trick.
' d/ v9 m8 ^ [3 P0 n-The most classical one is:
+ }4 f$ w1 z; O4 ?, A% h( m BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
4 _% u4 A' M) i4 W& p2 z *(esp->4+4)=='NTIC') b9 u" q$ }* P5 ^1 r
+ C0 x7 b+ t* f( e! `8 L0 C4 a-The most exotic ones (could be very slooooow :-(
s3 J! y) t9 E% y: |! |6 G! U BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
" n" ?" U1 ^; Q& ?: M5 D+ g ;will break 3 times :-(
% D" {0 x- k) h) j
- r, b; b- e) N. M# \' y1 L* S# |1 b) s-or (a bit) faster: 8 s+ N4 y+ z3 @
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')) a: E' r. k3 W! Z
4 j1 D+ _2 W% V BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' " w, W; _7 Z1 Y
;will break 3 times :-(
% v* n& v* e" h, X ?2 d
# \; Z/ \6 R/ H" ^! c-Much faster:& L6 L4 l+ B3 z. f% j
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'- I/ M0 y) ?# }) `. C( Z
. @4 U) c5 W) C/ j# i
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen- ]7 p' R- [4 H' v w- F) j4 f3 L
function to do the same job:
0 A1 s) m1 d, _$ I! d4 X. x
3 q5 r. q: v1 N( { push 00 ; OF_READ0 U& o V. A$ f. S/ C. F
mov eax,[00656634] ; '\\.\SICE',0
1 t1 d8 M- Y4 j( y- } push eax
) J: ]9 {) b/ R% D9 m; S call KERNEL32!_lopen
/ z2 ]0 [3 {3 z$ `2 A2 [# C inc eax
* q' y; T' e' V2 a5 a1 \ jnz 00650589 ; detected& N! C! c @2 Y- b6 s2 t
push 00 ; OF_READ
$ E- H+ ~$ e! j- b0 W" s mov eax,[00656638] ; '\\.\SICE'
" M6 Q q3 |6 u; T Y push eax4 j) s9 \& O9 \& T% n; a
call KERNEL32!_lopen' v9 t U& F$ R8 u: r
inc eax
: Q& _" s6 x* d/ ~* n- M jz 006505ae ; not detected' m1 d9 r" c% B/ |; t- h) ?
1 d3 O: |. a* f8 B/ U
: c; d l3 L& T0 t# `
__________________________________________________________________________
, b7 j- o- K! f2 T4 e% B1 W
, N0 ?( @& G( A2 D5 l2 _1 [- \/ I4 D4 IMethod 128 S4 _6 N% F& A( h4 W; ^9 {7 s
=========1 k8 S; I! F/ P9 a S. b, ^, s2 j
5 @2 b! _' ~# f, PThis trick is similar to int41h/4fh Debugger installation check (code 05* ~" o& ~7 J' p0 D
& 06) but very limited because it's only available for Win95/98 (not NT)
" a# O# B" }3 Y, Ias it uses the VxDCall backdoor. This detection was found in Bleem Demo./ y6 P+ P! O9 H' g& N
$ h0 U5 K! H) K
push 0000004fh ; function 4fh
|& j- y- K+ Q5 _( T- m6 I push 002a002ah ; high word specifies which VxD (VWIN32)
6 s4 d" V) L) f8 d9 S. O E$ U ; low word specifies which service
( L# k& A% Q( c! f ^/ \ (VWIN32_Int41Dispatch)4 u4 ^ U" W! I
call Kernel32!ORD_001 ; VxdCall
; Y$ p# H9 W: Q8 b9 t6 j; P cmp ax, 0f386h ; magic number returned by system debuggers
, G1 \* M* k# o$ t jz SoftICE_detected T! N0 G* [! K; q; B3 B1 \
' ^& a/ x5 H. N1 D3 c( c2 y; UHere again, several ways to detect it:
9 M! ~: G8 _& M# `' i- @1 w
5 U8 l+ K) R; ]2 r* ~, e BPINT 41 if ax==4f
3 v8 A7 E( P& v- W$ c* Y) K& x3 }8 t9 V7 Y
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
/ t- d( K2 `" X- G
$ J6 A' G- S: h BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A* ~# D6 I4 q+ r
6 H8 _# u! d& r' N+ o5 m/ } BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
* \. U# \4 W; v$ B
- A Y ?4 n0 n0 X# {__________________________________________________________________________
+ b. Q% i6 l% i) a' g8 a# q0 f% }4 b4 O0 e }0 F4 ^7 b
Method 13
; \; n3 J; Q" L, K, y: d=========2 z& V) ?7 s) y* A2 M
0 j) b/ E' |; p/ L8 O. Q; J$ n# zNot a real method of detection, but a good way to know if SoftICE is
N- T5 P- [0 J2 Z9 sinstalled on a computer and to locate its installation directory./ o: O1 L* c; @1 Y
It is used by few softs which access the following registry keys (usually #2) :7 ]- X+ i7 ]8 D# w" c
% d; H( L k W" @) C& R-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion1 h% t: t& _& D, y8 c* E; k+ D
\Uninstall\SoftICE
# b5 Z+ Z( u$ E" f5 v, a- v-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE' y; K2 ~) a D. \( O9 N& M* b* t
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion/ i/ V I3 ^5 G& p$ x
\App Paths\Loader32.Exe* x# T# G+ i3 _/ q9 q
4 y% [. l: G& f6 {8 ?' ^$ n
- X6 {' [# I0 @Note that some nasty apps could then erase all files from SoftICE directory
T* _6 d( ~ q$ p2 f! o7 ?(I faced that once :-(
! v$ @3 Z8 o$ @+ o1 A+ |% ^
4 U" p. p6 q. P- ~( A8 ^+ |Useful breakpoint to detect it:
- _1 y" _& f6 G9 `, F3 [
% q8 y3 i I/ n/ t8 k3 |8 L0 e! H7 n BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'6 _, c; q6 S8 b5 p6 d
, f! \, R# z/ P' p' r% q
__________________________________________________________________________! [) V- I3 M! z# h4 |6 t" J7 Y
' h# L2 G+ R4 B2 h
5 h* o2 w+ P; g- H
Method 14
7 ]4 m/ ?2 S2 t0 J6 a; X$ F$ B=========
* c3 n x: O6 I2 D1 u& j, P' c8 k3 y7 {
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose& G) o" d0 s" @0 i
is to determines whether a debugger is running on your system (ring0 only).
: \( ]# c" \3 q, i( K7 _0 n
: P- Y2 ~: K* H/ y" H% f! U+ t' X h3 e VMMCall Test_Debug_Installed
" H+ W# \& f' n je not_installed
& P8 b8 ]9 k2 S8 d, b! F6 m
3 Z* w$ \. q, w5 tThis service just checks a flag.5 |: \7 V S! }+ l( c# S
</PRE></TD></TR></TBODY></TABLE> |