<TABLE width=500>9 V; c0 c6 f3 N0 w
<TBODY>3 B# I1 Q1 z9 ?. k2 f6 H: \% L
<TR>
% T0 L0 }/ U: ]" m7 r+ n" P: o/ U<TD><PRE>Method 01 1 q8 g9 s7 i+ C/ c; r# l& v( C) N
=========! @) M: R* J2 \5 d# ~
4 t. O3 [8 J( cThis method of detection of SoftICE (as well as the following one) is9 j, b7 W5 f1 s: i. `7 B+ p2 X
used by the majority of packers/encryptors found on Internet./ y& v2 M* B$ z- G* C. |: h, L
It seeks the signature of BoundsChecker in SoftICE4 l a+ l; N( [4 X! `# |2 z
- E4 l; r8 v& j
mov ebp, 04243484Bh ; 'BCHK'4 c, q! n/ W( F& B( `
mov ax, 04h6 j; }% I2 ~8 R* z# p/ M
int 3
8 J8 X2 p5 ?2 \ cmp al,40 U' j8 ~, E# x6 l* ~8 J
jnz SoftICE_Detected. g/ \' l3 P- k3 Y1 a9 T$ |
/ g6 [; d# l8 F' ]; t
___________________________________________________________________________ f7 }5 d6 q, U1 G3 S
6 G; N. v1 l% c. S# Y, QMethod 027 M. E( a+ S; ]. P/ ^5 h; w) t
=========
4 i" |# ]/ P' ^
! T1 `( u9 E D8 R6 `) ?. UStill a method very much used (perhaps the most frequent one). It is used
& K. ~3 ^9 r2 L6 ~' G5 R9 gto get SoftICE 'Back Door commands' which gives infos on Breakpoints,3 g7 y9 F5 i- E3 u
or execute SoftICE commands...
+ m8 M# O! H9 I% _& aIt is also used to crash SoftICE and to force it to execute any commands0 v! X* J+ M F! t% @
(HBOOT...) :-(( $ U( |, e, g3 Q9 n: H
! E, ]' l3 S; t
Here is a quick description:) ]1 |5 c' p& A. H( X9 F
-AX = 0910h (Display string in SIce windows)5 w. c- i: }4 D/ P! g* N& p3 ~( m
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)- d9 w. s" |2 |3 R( _. B$ k2 l
-AX = 0912h (Get breakpoint infos)
' |& M* {3 b+ [$ P: H-AX = 0913h (Set Sice breakpoints)
- }5 ^0 X# E% ~: L6 X-AX = 0914h (Remove SIce breakoints)
2 h$ `' G) @7 L
+ H+ {1 _8 G$ T; j8 M+ {Each time you'll meet this trick, you'll see:
% M" k Z5 q: H* K, K-SI = 4647h
D: `: X0 L( L% h-DI = 4A4Dh1 d3 j, ~! M ^5 l9 j1 N
Which are the 'magic values' used by SoftIce.
( V" W1 s4 E Z* ^5 l8 G4 K7 VFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.- A: s! W f0 ~/ r' t
6 D- a" b+ Q8 H$ u2 n5 _1 nHere is one example from the file "Haspinst.exe" which is the dongle HASP0 f8 c& L3 G: s5 R; I" C
Envelope utility use to protect DOS applications:
8 h# q, J; c. J( N6 P- d3 _8 `- w8 a, n" k) W5 ]5 Q5 F ?
$ c H" P* K7 l3 N3 D, Z1 ~( y4C19:0095 MOV AX,0911 ; execute command.
$ Q/ n. w; [+ p" ~. u# |1 f8 u4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
* W ~8 q, h# C' w4C19:009A MOV SI,4647 ; 1st magic value.1 d! P, U2 G! U) Z K( D
4C19:009D MOV DI,4A4D ; 2nd magic value.9 r. B4 S3 `! K
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*); {- n9 T, H1 t# e* E% c
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute; S4 Y" j2 [/ v. H, ^7 ]* _
4C19:00A4 INC CX
) J; T3 S7 L$ C4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
5 p) ^6 M, U3 v: A4C19:00A8 JB 0095 ; 6 different commands.* \5 T# ~( ?6 i" Z# I
4C19:00AA JMP 0002 ; Bad_Guy jmp back.
' A2 j# X( ]0 U8 `3 I4C19:00AD MOV BX,SP ; Good_Guy go ahead :)0 u. D; w' ~. ~; M* a# x
! l3 O5 ?) c9 F2 L5 I, C% Y0 IThe program will execute 6 different SIce commands located at ds:dx, which/ i @1 V! ~2 U8 J. r& N4 Q
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.3 c% B( @7 F% y9 g0 M R, h
9 X7 o! o: [1 g+ c; y/ ~
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
5 Z3 T/ ~# H! D; F___________________________________________________________________________
/ x, O& i% S2 J" `$ n8 J6 W5 T/ x0 T" N8 Z: B* n+ T( {
8 F, @, @* V/ }9 {
Method 03
1 n# W6 O& `4 ?* d=========2 W1 q8 N( {4 T2 J/ }
. e, |; w5 `9 T% A$ Q
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
! c- S* G2 s; U: B6 d(API Get entry point)# q9 c6 e( E" D
: w+ [) d1 R8 @- N- j7 q2 Q* v0 k: @
, g8 p$ A0 C# J" _
xor di,di
# i% l+ j; a& n! X) l mov es,di
`1 U, z3 [9 _3 s mov ax, 1684h
2 r! r) V7 ^! G5 k& @# E/ N mov bx, 0202h ; VxD ID of winice% ^* `. h/ k: |) o) f+ v
int 2Fh [( |+ [. } A( m1 A
mov ax, es ; ES:DI -> VxD API entry point/ O6 P8 b4 I7 ^
add ax, di
6 w$ z0 m5 t3 z \' q test ax,ax
* h3 t! ^, ]" ^) G/ Q# z jnz SoftICE_Detected
% _! a$ j, q/ Z, C* q s, }* y: y- l4 ]& U" N. V2 z; @
___________________________________________________________________________' D4 H, A' ? a$ ]9 s' ~
, ^7 y9 t' ^ v. T$ O* y X
Method 04: G! Z" I c! n: r
=========
: u1 [- t& N6 g! Z3 w) m) k a8 \) A
Method identical to the preceding one except that it seeks the ID of SoftICE) I2 F- X4 C; t+ M1 J% P
GFX VxD.( z4 A6 _# B3 r B4 W, W& h
T6 l$ X) n1 m8 V3 l' p+ F
xor di,di$ F0 j! H/ P* R. { z! o& s
mov es,di' ]9 u4 w0 ^6 `" l$ ]) h
mov ax, 1684h , b4 |6 r+ r5 N: A m6 @ R
mov bx, 7a5Fh ; VxD ID of SIWVID
5 R7 I+ F! Y3 c2 V6 r8 g/ R int 2fh+ i8 g& `9 z6 q1 o- J8 G( H5 a
mov ax, es ; ES:DI -> VxD API entry point) q3 z% Z* \- M; n8 m' p1 V
add ax, di& J0 ` u" V# X$ R
test ax,ax
, q8 }( G7 F0 w4 | jnz SoftICE_Detected; h. G. a; M) R$ M- M- \) W
7 @7 g- V) }" f8 P) c0 ]; s/ j
__________________________________________________________________________
! a u" }! b* F% D0 h% Q, Z+ B3 N4 O$ d0 j3 R+ H( C6 E5 H
2 P4 Q0 X, l9 G, Q& i( y6 UMethod 052 Z6 C6 }6 E% Y% t) }
=========
9 U' m: g) o2 `/ t$ \ s6 |2 U( _7 M/ i6 j, z1 ^. j- d; m& W$ p
Method seeking the 'magic number' 0F386h returned (in ax) by all system4 F+ W. y- F: X
debugger. It calls the int 41h, function 4Fh., i* L; |! p4 s" B5 e* \
There are several alternatives. ! E# @7 T* a4 @' A, ~
5 E8 p2 K( {+ V8 @
The following one is the simplest:
& L1 [3 P' n1 `. `3 ~# Y( [. J8 _8 a: T) P+ M/ P* p$ z' l
mov ax,4fh
5 x# f3 D! J. G" S& q' Y; c int 41h: M/ u+ i }0 {- w& k9 f! w
cmp ax, 0F386
2 l/ I3 e5 r: O6 W" \& w! y jz SoftICE_detected
8 A+ U' N& ^) O3 n( T0 m+ ? q, f* K, F* h. ]# |2 ~
5 q5 i+ v+ z+ }* w
Next method as well as the following one are 2 examples from Stone's
( z6 n _- X; `, P& Y"stn-wid.zip" (www.cracking.net):+ Z6 w0 \' T7 h' G3 D7 X6 `" d
y( p K: L7 m* ]) @
mov bx, cs
* Z) {6 { }' |+ \ lea dx, int41handler2/ Q- p! f O3 V% L \
xchg dx, es:[41h*4]7 G0 n: [- P8 [! y" O
xchg bx, es:[41h*4+2]" Q0 p- a' h$ u! E! H: e
mov ax,4fh
# M5 @) j& T' m$ W# i3 d int 41h
/ D% ` X5 X/ g% o$ k3 o xchg dx, es:[41h*4]
# `6 E5 _7 \$ L% k y xchg bx, es:[41h*4+2]( S* f i! Y$ O- w% Y
cmp ax, 0f386h5 s. Q: j5 k- K* z) b/ M
jz SoftICE_detected
1 q' M) [: D% ]" I
: S& d5 Q1 ?; |6 Iint41handler2 PROC* [- \5 u- k6 n) Q/ K4 Z
iret
- {7 n8 S% G# F0 ~/ ~4 ~4 M1 ?int41handler2 ENDP
1 Z: n( u# i. K3 y: @& M( Y5 {' S. c: E5 }
+ r; N* \! a, _- f8 q. D_________________________________________________________________________7 A+ H5 N) U3 Y/ m1 V' S
7 ^# _& P4 Z2 ^& L, f% Y3 P
S" ?2 e$ H# jMethod 06
2 B* r" K& Q C$ X6 o Q3 y1 N" R5 H=========
7 O% }" \$ n+ Q7 I! U
9 @5 Q9 H- N& S* `1 i" f- Q% }4 l+ E4 t3 m/ o9 i
2nd method similar to the preceding one but more difficult to detect:$ |' o2 w @! W' i& H
( v* H/ Z: E! Z7 h8 n2 |
$ b( d6 y- e2 F+ jint41handler PROC
8 O% w, u# ~7 r) w5 T mov cl,al: D" h5 Y S4 Q7 s+ A. H; W
iret
: q w7 `" S0 G+ R4 m/ Kint41handler ENDP; F2 [: V1 @! K3 ^7 A9 H& B
7 D* Q7 \" s4 P6 x
4 w. }. F6 i9 u4 W: b9 c L9 ~0 e xor ax,ax
" F- [0 }& V) t. J mov es,ax4 F- r5 ~% B! e9 C; V( Y; H
mov bx, cs
6 r. E) ~: t" [6 P: H lea dx, int41handler) e3 T8 g% D, V7 L% i1 M
xchg dx, es:[41h*4]
& }$ R4 [1 [. v3 }, ?# M4 h xchg bx, es:[41h*4+2]) t5 q, q/ Q" W5 k1 e
in al, 40h
$ W9 R* g" t& d) c# W+ y% n xor cx,cx+ W& P8 z. q# j$ ?, t
int 41h( q4 U- j g" `
xchg dx, es:[41h*4]
# ^& ~8 h; Y: j' c& x xchg bx, es:[41h*4+2]1 |1 H/ i6 ^2 |8 D: |
cmp cl,al6 E: ?/ R: z$ W p6 e, g& f0 Y
jnz SoftICE_detected
/ Z" U! }8 g4 Q: f: | }
+ h8 W( n u1 y+ K_________________________________________________________________________' B6 Y l8 N; T: z2 d- W
7 B8 j, ?6 V# N
Method 07
9 s, L, O- c! n3 }% y9 C=========
: O4 L- k4 J! L( x# i
' v/ Q5 c8 X) N) w- bMethod of detection of the WinICE handler in the int68h (V86)
* V. [; w! B! p4 l; x( I5 c! d0 e" m/ ?# p
mov ah,43h2 J3 d" z5 |+ ]/ L: I! j
int 68h0 x- t( ]$ @3 u; z
cmp ax,0F386h/ X6 {: k q6 F( O8 s$ S
jz SoftICE_Detected% C6 e4 O$ L0 C4 `1 n
: B m* H) m+ [/ C- d9 g
/ f; d7 A9 L& ]7 {; q6 ?% K
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
. |$ i8 ^7 Z( ^4 C& j app like this:& r$ ^: u& t$ S& T J5 y
$ @( }9 f6 }1 F5 R
BPX exec_int if ax==68% O9 A# Q+ ?# ]0 ]/ g0 j4 y8 Q5 Z/ V
(function called is located at byte ptr [ebp+1Dh] and client eip is
M+ x# T$ x( b7 A- E located at [ebp+48h] for 32Bit apps)' B* q, p( h v; y
__________________________________________________________________________4 r( p: Q, ?) ?& A* i# Q
" K f) j3 R" e) f3 m [; ?( f# W3 l, d- c
Method 08
! k) }3 Q4 }. p# h) D( r=========
2 e1 F% A) o" j, v o
5 a: }; V9 t; u% Y, o. dIt is not a method of detection of SoftICE but a possibility to crash the
( y; o5 u! `! o% S$ P; Fsystem by intercepting int 01h and int 03h and redirecting them to another5 |# |0 L" A1 o! I" o5 M B: C1 c4 X' B
routine.
1 `: M- P. [) ]3 Z& R0 ^' \It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points, E9 J4 z% p4 i
to the new routine to execute (hangs computer...)0 s% |9 \2 E# }- j( A7 M! _) F8 [
' e" f4 a$ n0 x, P, u) g1 y mov ah, 25h
$ M2 Y8 `' z" P2 n5 \! {& c mov al, Int_Number (01h or 03h)
* a( j/ E8 x" r: l B mov dx, offset New_Int_Routine
/ k* H( o+ B- N7 L" ` int 21h
1 T# T3 I8 V! p
5 Q# M1 e8 w% k! W0 P7 W2 v8 ^__________________________________________________________________________
3 M4 ^# B- W: ]4 {/ F
% C( H. q9 w/ e8 ZMethod 09/ @7 C( q/ y! s, W
=========; ?( C+ a9 M0 n; Z2 p
0 n& h$ ^+ m. \! P9 M* s: \This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only5 U* _) b6 D: t2 g/ R$ l
performed in ring0 (VxD or a ring3 app using the VxdCall).9 D7 P( A$ d: E4 ^9 ]
The Get_DDB service is used to determine whether or not a VxD is installed
6 ~' o/ ^: ]$ a- yfor the specified device and returns a Device Description Block (in ecx) for( \" k2 v8 n' {
that device if it is installed.
; ^9 v+ G# P+ w( z
3 _" U# h4 a6 ?5 Z$ Q mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID& E. f: h, Z0 p$ O
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-); q* I" U2 k1 d) }* }
VMMCall Get_DDB9 k! G' \! Y/ F0 ^# G5 K0 \* k# c
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed0 ^+ E# B& { f2 {
2 F2 C7 T. S$ H, @' X: @7 _Note as well that you can easily detect this method with SoftICE:
7 V4 B1 t) _8 ^* M: E% n/ N; g; E bpx Get_DDB if ax==0202 || ax==7a5fh
# i3 z, S0 w) Y! c/ A2 h" m, e" g4 E6 O8 y4 [6 y& p& O( A
__________________________________________________________________________& ^. n) u9 h# m2 k: B) B* p, |( ~( p
8 B5 G( T1 p5 y( l0 C7 Z4 e+ r# pMethod 10
. M h" c9 P/ w=========
; y0 a9 D r: D6 x; R0 k; x
! z5 K5 h0 n2 Q. V! K=>Disable or clear breakpoints before using this feature. DO NOT trace with
# P0 w: n, z3 k. ^ SoftICE while the option is enable!!
, F/ c% A# l' c3 \' y5 _+ t1 [) J
This trick is very efficient:
2 c% A, m9 I) f7 {" e$ jby checking the Debug Registers, you can detect if SoftICE is loaded
' X8 A l' g7 C(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if5 H3 y+ I6 g" F( f# f
there are some memory breakpoints set (dr0 to dr3) simply by reading their
. Y% I2 U: W" uvalue (in ring0 only). Values can be manipulated and or changed as well
. s5 x% { }% P( d4 U) J, k: H- h(clearing BPMs for instance)
$ M; m# C7 ^7 T9 Z% }% q) @# B; \; r: S! a7 T' f+ z' A# O
__________________________________________________________________________
8 S2 e. j3 ?8 w3 d
3 Z; _& l2 h3 }: J9 mMethod 118 f4 _' |6 G1 j
=========$ t; N j7 q* U& q
4 ~5 U* w; j9 ^: I2 i
This method is most known as 'MeltICE' because it has been freely distributed4 S. D5 q' N: y: a/ X, t
via www.winfiles.com. However it was first used by NuMega people to allow
, ^) x3 P# F, D# u/ d# GSymbol Loader to check if SoftICE was active or not (the code is located
$ U- O& b$ s, Winside nmtrans.dll).
c4 y' f; E$ E+ `5 ]/ p. p. Y& Y; K% k7 P
The way it works is very simple:9 a& C P T$ F# ^7 R, ?4 P2 X; @
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
( _ z/ J `- q: yWinNT) with the CreateFileA API.2 b+ L o' a! w
# K4 l8 D' M/ N. t h9 D" Q. P$ A
Here is a sample (checking for 'SICE'):
Y0 G4 d# Y7 s* l Q
/ B% m5 M7 h! mBOOL IsSoftIce95Loaded()
0 `( e; @7 K b% Z2 D Q% k{
" k* i/ P+ u! W6 H: R' | HANDLE hFile; ' _8 |2 O% Z0 ~: l) H
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
' p1 X h, m1 M: {2 G+ u FILE_SHARE_READ | FILE_SHARE_WRITE,
9 X" u$ i- Q9 ^4 y$ S) x/ @ NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);7 g" g: b& q* }
if( hFile != INVALID_HANDLE_VALUE )3 N5 t& r8 l7 n6 c4 x0 Q% X
{& T) }* F! x* y, u. _7 g7 U
CloseHandle(hFile);- e. s2 c7 n: q$ x6 w
return TRUE;! q3 m5 W% }% p/ m) ?( [
}
' n; W% I ?9 h8 T return FALSE;
& A' U( K2 O& S! B3 U4 `}8 U; o, R: ?! @* ^. w
% t9 v3 T# R; z8 S5 l9 g( h2 jAlthough this trick calls the CreateFileA function, don't even expect to be
4 a v, C4 y9 rable to intercept it by installing a IFS hook: it will not work, no way!
0 a9 B/ E7 e! o, e, u8 `) qIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
( o: F: W7 P& R( X6 ^3 O U9 V: @service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
& `% ^8 n" h$ n6 q( J, ~2 r0 l1 Pand then browse the DDB list until it find the VxD and its DDB_Control_Proc
$ s1 V6 G" E7 b4 F1 v7 v" {field.
& u8 t. M1 e/ E! }In fact, its purpose is not to load/unload VxDs but only to send a , }! v# Z* C3 _
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
+ [' @% o$ Y: zto the VxD Control_Dispatch proc (how the hell a shareware soft could try# h. n Y; P* d- `1 \
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
+ o6 h, g5 N6 JIf the VxD is loaded, it will always clear eax and the Carry flag to allow! a. k4 D, P& l" ]2 | E8 S( f
its handle to be opened and then, will be detected.5 m6 j' s4 Y/ l
You can check that simply by hooking Winice.exe control proc entry point
% ]0 D- a: F: P( Qwhile running MeltICE.6 l8 O9 f* o; k; e4 `7 m z+ v
' N& |; J: T+ n, P" ], H2 G0 [0 ^# l
00401067: push 00402025 ; \\.\SICE6 T; m% D* i6 s3 x- s' v
0040106C: call CreateFileA
' K9 T8 p/ w7 c( O2 W 00401071: cmp eax,-001
& K4 a' n& m0 G 00401074: je 004010917 ~& c- ]" i4 | I' q! z7 u6 {& ?* F
+ L7 E0 `, \1 I' L5 g4 z6 i
: X( h; S, i: p/ ]
There could be hundreds of BPX you could use to detect this trick.
0 L' ^5 Y+ L! q! [9 @-The most classical one is:. y0 U6 ]9 k% _, Y, h( L
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||( R! ]8 |- \/ l: `" K
*(esp->4+4)=='NTIC'
$ b( Y/ \6 J# F( u- z/ Z; I* U9 q9 z2 E
-The most exotic ones (could be very slooooow :-(" z4 B& r7 G6 ?4 g: W
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
j" }) S1 t! G0 |4 D ;will break 3 times :-(
- e: Y+ m0 u' d2 R* S8 n, _
% V# K6 B' D( X/ H- H, b9 N6 a-or (a bit) faster: ; ~, x1 P% ?& j" e' w W, C( `) F
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
4 C H. W+ Z. c4 n: a. @8 ?, u
; Z C, Y8 f; _6 d: g8 T BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' / f6 N7 Z, ?9 _! b
;will break 3 times :-(7 v" d3 [, q7 D9 {3 ^. g& L
6 y$ r. e+ I* D. N2 h( _, M( H-Much faster:
- ^9 ~$ t0 i" J BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
0 K+ v. Q; q0 m5 D* w: M
, m0 B8 U( O, I7 T$ H9 \Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
4 J5 K) U9 ^* k' ?- ffunction to do the same job:
4 ]* A/ ]! j8 t
+ x/ e8 k' h" X push 00 ; OF_READ) |' G/ q3 n" J. E, _' `
mov eax,[00656634] ; '\\.\SICE',0
# |; O1 \8 j/ s) v/ s& c0 x, ? push eax
' H4 D- N3 Q$ M( A4 ]9 W call KERNEL32!_lopen' t" e# I8 d. s, f
inc eax
2 z) h. J3 Y0 f; x1 r jnz 00650589 ; detected
) A; B. y, o- @0 }' @8 |0 _# d push 00 ; OF_READ. O l/ P B) x5 y8 j7 T
mov eax,[00656638] ; '\\.\SICE'( J) x) _6 S. s8 A& b: f+ _
push eax$ U, S/ |- b2 M5 U% I. r" v) Q/ o
call KERNEL32!_lopen& I! Y% @6 q, ^; k: K" u$ H: z
inc eax
) A2 ?" }5 C& g jz 006505ae ; not detected! f S9 H5 Y9 M: l' A7 }; ]4 ^1 B
. p+ [! e$ R, p* Y0 ~+ ]0 r
: `, ?9 w5 h1 P7 e__________________________________________________________________________
0 ~1 t: t, G( A/ M# a, h5 d
. l# F% I& M8 E0 g! e6 WMethod 12# R' l' A9 |4 T! K. }
=========/ [1 c3 ]! r- _" H7 }/ r ?* t
5 a0 k* u6 i0 P ^- q* Z# e" Z
This trick is similar to int41h/4fh Debugger installation check (code 057 |0 N1 T/ S- v9 b
& 06) but very limited because it's only available for Win95/98 (not NT)1 P+ }0 z# B& m, J& J1 q0 y/ r, w
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.1 l1 k4 V+ a9 [
8 y4 T/ r. r, w0 i4 [ z4 I
push 0000004fh ; function 4fh# H0 R& V8 k: x* z& X
push 002a002ah ; high word specifies which VxD (VWIN32)/ O; o Q4 _( c) D% [! n
; low word specifies which service% `# g) Q. V) d
(VWIN32_Int41Dispatch)8 V2 z Z/ i+ u
call Kernel32!ORD_001 ; VxdCall
# ~) L8 j1 L1 W/ |( ~ cmp ax, 0f386h ; magic number returned by system debuggers! _0 h9 |# g' K. B8 e
jz SoftICE_detected+ Z1 |9 R: N" p3 f3 p/ W, I4 \
6 P5 j1 w' T9 g9 c: t7 T
Here again, several ways to detect it:# u8 S3 H9 u S" Q! S
& v# o- j5 n; v0 k BPINT 41 if ax==4f/ m: f5 s: q7 r& K4 z
# [+ r/ v4 \" P! L8 ^3 @ BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one# Q; s$ w% Q$ [
# W- P" ?2 q' `+ T
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A) X0 U; c" S3 x4 K
/ y9 j- r" y# r. i$ D3 P
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!% G7 ]! n. M: X% @- N
- P( N; c+ i; e1 Y x! m! _7 @
__________________________________________________________________________& N) ~$ I: V% S/ |3 y
q. d8 U2 r& G" T3 Z D2 Y9 ^7 f o
Method 13- x' N p' Z4 H6 }
=========
/ z- r! v0 u8 J0 F; x$ }) j/ B: V
! n2 a# L) ]% l* ?2 x, Z6 ~Not a real method of detection, but a good way to know if SoftICE is
1 P9 [0 u6 l L' `; xinstalled on a computer and to locate its installation directory.6 C( M8 q/ f% R- z+ W/ m' t6 r
It is used by few softs which access the following registry keys (usually #2) :
) y: f: Y# V! o3 x0 \* E- t+ T/ l0 Q* C% `5 W0 b- Q! |! B
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion1 x! f$ z: O: @* {- D: ~! R
\Uninstall\SoftICE, z6 B+ s! G" y2 O1 a& U7 a
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE8 G7 A5 R. F0 B7 m/ N6 l6 x1 R. |
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion# p* ]1 l5 _* T) U9 _" }$ i8 I
\App Paths\Loader32.Exe0 m, a+ F+ V0 x# h5 t% R
) q2 C$ i5 { D7 g1 w
. C9 ^5 R( q3 @3 q e& y! C
Note that some nasty apps could then erase all files from SoftICE directory
2 |3 g3 R7 D( b2 V1 L(I faced that once :-(: A" N3 Q4 F T/ S1 E7 P
6 U% L/ D: v- m1 x+ k+ {5 S
Useful breakpoint to detect it:
& d: Q& E: Q' K$ L. j- U" J/ k" S; y
! W. [' K/ a6 H4 k; [+ l BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
4 N% r, Z! L3 B# O* f' K0 z6 E2 w9 Y ? M6 c% }: y
__________________________________________________________________________
4 `) l9 Q# C+ X% d( l+ n- Q; ?8 p1 v# r
3 E( O# z8 ?0 H! W7 xMethod 14
( Z I8 O+ W7 W! n. f* K=========
+ R S* D! w8 F+ `+ s7 [
& S# B. K5 a; c2 {, GA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose7 I, v; S2 K' B h! O5 S/ A
is to determines whether a debugger is running on your system (ring0 only).! L1 Y9 R0 Y' @
. w3 W! a F& M# l! C! b, z% d! E
VMMCall Test_Debug_Installed7 H% p, F/ ?5 V: G3 B& _
je not_installed4 _) |0 r3 A' p, @ l
4 W( _# r4 `0 t1 P j9 KThis service just checks a flag.
7 X4 J! {& @3 s6 P* U. j</PRE></TD></TR></TBODY></TABLE> |