<TABLE width=500>
3 Q# O# |7 w% @<TBODY>
8 W% r3 o% O) h; g! Y* z0 J3 Z8 O<TR>
/ b, y' d' _0 U<TD><PRE>Method 01
- _% Z2 ~2 N4 v, M=========" f7 M9 X0 t$ [, T( e$ D" c3 A0 Z
0 k9 w7 L _; k2 U8 g" L$ }This method of detection of SoftICE (as well as the following one) is# l7 ?7 O* Z: P! r/ q: n
used by the majority of packers/encryptors found on Internet.
' b/ B9 U5 B4 W. R, w" EIt seeks the signature of BoundsChecker in SoftICE
: d" u* N& g: W5 g5 l: i
# C2 X/ G: Z( f2 f" s0 o( K% e3 J. D mov ebp, 04243484Bh ; 'BCHK'
& V6 |' j# D. D% |; Z4 F! D mov ax, 04h* ?1 F ~7 f. } s% b; g; y
int 3
$ E( T3 O6 {2 ] cmp al,4
& {6 l/ z7 f" L4 z( ? jnz SoftICE_Detected
! Q; Z) [$ a9 o, }) u8 c+ R/ ^1 z: ]+ \# z; Q9 h
___________________________________________________________________________
' e% i* ^" u) Y# `
( r* f* m. p. `3 y% I0 u; Q( v* X4 nMethod 02
& ?, D9 F: s: V; p" c=========
- L x d) d+ N$ G
+ h* _% y' k1 L4 G) s, u: rStill a method very much used (perhaps the most frequent one). It is used
. s0 J3 n' k: d' _! @) rto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
5 ?5 U; a% {; @/ _4 G6 Cor execute SoftICE commands...9 ]2 B1 Y, E" ]( j2 ]% u4 G
It is also used to crash SoftICE and to force it to execute any commands
: ?7 T% q0 ?& \( ^5 D1 y- ^(HBOOT...) :-((
; R, }* M# W0 L$ l6 ]! O$ C; I* [ p6 [# i/ a' l3 U- I
Here is a quick description:
& e$ Z2 g1 e, p' C7 A3 s-AX = 0910h (Display string in SIce windows)
, I+ ~, P: r6 t8 D-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
6 C$ ?) P" F$ M-AX = 0912h (Get breakpoint infos)
9 T+ }# H$ T8 N0 z-AX = 0913h (Set Sice breakpoints)
7 P# I% J$ @$ i: R9 z9 Q-AX = 0914h (Remove SIce breakoints)
6 e+ _: |8 t% N% k. N, l
* U$ [) J: L: L5 q) e0 a8 g0 KEach time you'll meet this trick, you'll see:
0 o! h% |. p$ U! N j-SI = 4647h0 ?& q& r6 g; O7 ^4 W
-DI = 4A4Dh) _+ w; W+ y2 y. V6 f4 `' I
Which are the 'magic values' used by SoftIce.
3 U) K# P# B) |1 w: TFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.0 v, ~9 Z a& F, [& b, s+ f
$ @: v) n3 Y8 O7 e
Here is one example from the file "Haspinst.exe" which is the dongle HASP
# F) ~& Y, I- }) T/ jEnvelope utility use to protect DOS applications:2 [. a7 _" D3 w. N# U5 i( @) w$ A0 l
+ n; p+ B& n8 h8 r
9 P/ n! @+ z# x% E4 \4C19:0095 MOV AX,0911 ; execute command.
: E1 j# i, Y% s4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
5 y; U, {! b: P+ [4 F' z4C19:009A MOV SI,4647 ; 1st magic value.
4 E( H1 N9 {% Y4C19:009D MOV DI,4A4D ; 2nd magic value.7 X( E2 k0 f9 M @
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
! k: N6 }7 L1 D7 L4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
2 G5 W- L8 @6 W$ b7 ~4C19:00A4 INC CX
: X! w; Y5 @/ Z |4C19:00A5 CMP CX,06 ; Repeat 6 times to execute* K% z) b" b" n, T0 K9 ?7 ~2 `3 q
4C19:00A8 JB 0095 ; 6 different commands.
+ s$ z+ @; k2 A6 ?- |4C19:00AA JMP 0002 ; Bad_Guy jmp back.' ^2 J8 U( d4 L% K/ `# ?- x! D
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
9 a3 {" o+ P |8 a D+ y! `5 u2 Y
The program will execute 6 different SIce commands located at ds:dx, which
; P& s& n% f. [3 o0 G ?; S0 hare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
4 h6 A* O" X4 {; l* {2 O. w9 J B
) A* K* X: N) ~8 z* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
/ Y' [/ C2 A1 Z* F___________________________________________________________________________
9 h0 p- ?6 t: i% E( t r9 W) F! D% P0 o* h" n2 X" b7 M
) M" u# o" i" {# c D
Method 03
" z; v- J1 t! Y6 _0 s! p1 E9 y=========
c o9 }" b9 A, E: T9 I- R- P2 {7 T/ q
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h- `9 K7 F0 _9 x( C" j( Y& K* Z0 K% X! m
(API Get entry point)
6 y" z6 e; O$ a' \ 1 ~, k$ g: Y- ^5 s; p& D1 b
! f0 e, k, |+ ~: v/ `
xor di,di
4 D' p% b( `$ z* b( r mov es,di5 d' r* w! ]- w0 R4 k8 ?) t
mov ax, 1684h
5 y0 ~% P+ F0 v( c( h5 d4 n* l mov bx, 0202h ; VxD ID of winice
Z" I% x8 x6 B5 b1 V8 h int 2Fh
, h- F2 K- }3 c7 a4 s3 \ mov ax, es ; ES:DI -> VxD API entry point3 d0 Q0 Z% B% f5 h" Q5 b
add ax, di0 P5 |% H' D: y f0 _4 K
test ax,ax
0 J! M" \9 K a6 D; G* [- _. j jnz SoftICE_Detected
$ |- d5 j) x w V6 N8 j
6 v+ u% [; Z( ^) q* m: [___________________________________________________________________________8 ]- r, |) i$ M& r* ^
7 k9 [+ j( K+ j8 v0 T& uMethod 04
! k0 g+ y! F7 S) s! D% E& {=========
1 ^) Y4 w2 [5 D4 N/ W2 I0 [) G, t0 `
Method identical to the preceding one except that it seeks the ID of SoftICE
6 _) B" t! [) c7 j g0 k0 kGFX VxD.
2 F8 L% w$ X3 _9 G' ?
5 Z/ q- w1 c# D/ ~ xor di,di
- X! y$ o. d- l/ e7 N mov es,di' B# w* w/ q$ o4 L5 t8 {* M
mov ax, 1684h 9 X2 M- \5 X2 g8 C2 W
mov bx, 7a5Fh ; VxD ID of SIWVID2 y# t& {/ R" F8 n) S1 `
int 2fh) E7 Q$ ?: c6 d: ?2 |" b4 Y t
mov ax, es ; ES:DI -> VxD API entry point2 o9 v% {$ C: M8 Y' W# Z& y
add ax, di- j6 M* i/ @% T( ]" N( |$ a
test ax,ax
( M+ M; T% v# u2 R jnz SoftICE_Detected, |5 ]& U: }) u& i
& y# l. o$ w: e* v4 D
__________________________________________________________________________9 E3 S& F0 j5 L' d$ d
3 i; g7 k/ B. S, u
( u; V; q. ^2 e: s& FMethod 055 c3 f- v7 z* c5 L8 g! O
=========" C; H" p. H1 P
$ C0 G$ b' J; T3 _Method seeking the 'magic number' 0F386h returned (in ax) by all system; n! T8 G- K7 Q. c% z/ X! @5 `2 G
debugger. It calls the int 41h, function 4Fh.$ N1 @/ T, @6 h( c
There are several alternatives.
5 L0 C3 J+ ]& Z7 x% D }7 E7 `# G4 P' b0 S1 [- k
The following one is the simplest:
: C, K( ^! c4 Z$ N7 e: _7 m, c' H( ^3 O: ^, z7 F" ?
mov ax,4fh
7 I3 ]4 q% O, r8 D9 P% i int 41h
\$ X5 M7 t2 [7 y cmp ax, 0F386
: O* j5 Q& [: H3 e4 b( d jz SoftICE_detected
( Q' ?3 c/ Y) l1 K0 G% @
/ U* C/ Y N' U0 w. |0 ^$ O; H
* I/ r& J% k7 V( v B: `6 G9 bNext method as well as the following one are 2 examples from Stone's
' M5 L) k- K( S& G, Z7 B& G1 a( |( A \"stn-wid.zip" (www.cracking.net):
7 j1 ]2 z: Q) H# ~* _* @- J q- v `0 M5 T; w3 [
mov bx, cs) ?5 s2 t |# y; K( g" ^
lea dx, int41handler2# v) w# v9 G ^2 L
xchg dx, es:[41h*4]8 H) Q; C8 d8 R
xchg bx, es:[41h*4+2]7 F1 ^6 O2 ^. S. i3 S7 J
mov ax,4fh
, K7 f8 r, e* f4 i8 ~ int 41h
. M2 l# G$ Q0 V5 {* S6 G% v xchg dx, es:[41h*4]
7 T; }; a; F( f, F& D xchg bx, es:[41h*4+2]1 ?7 H8 C6 R. C( M2 U
cmp ax, 0f386h/ t8 Y0 n; j {/ Y0 S6 V% B
jz SoftICE_detected
1 w& b4 o8 w: T. w: i" g: i% G0 ]& ~8 q; b
int41handler2 PROC* z D( ^7 Z) \8 z' `0 {5 a
iret
/ | E' h3 [0 w2 Z# Wint41handler2 ENDP$ X: f' T4 `( A2 t
7 ]$ h+ e. }2 I) t2 h Z8 T
; o/ ?% Z. {) H1 D, G8 [" K_________________________________________________________________________7 a% [( W$ N( R/ q1 @1 W
$ x' a6 n% ^. f0 `. |7 S9 i$ E% Z
% F6 D1 P& F: P; y9 g
Method 06# n& d2 f! {( e. e5 t: [
=========
0 m* K: F& l" X
* V9 o/ v' F f. ^
$ g& E% T0 p% l% W: _6 ]- `: Y2nd method similar to the preceding one but more difficult to detect:
1 Y) w' @% E. L
# v5 ~& C6 P6 {+ [6 M
( k$ T3 g8 h1 O/ A& p- R uint41handler PROC: `1 \3 h) l# n' g( {% ?4 g
mov cl,al
0 G) O6 f, G( r- c. l+ c iret+ |& E. c3 G; m) r. o0 M8 u/ \
int41handler ENDP
" l) O& W: q, N: J
; u' h8 S5 t: y ~6 C F
2 v4 m2 Y( @) z v! z; m xor ax,ax9 w* A4 I9 n* o6 O/ [: S" y
mov es,ax0 I' M1 J8 i, g/ U: E
mov bx, cs
" d2 Z& L! w+ x3 T1 m lea dx, int41handler
' F- O+ b0 X/ t2 T6 n/ r xchg dx, es:[41h*4]" \% O7 v- V) y7 H* f ^" E
xchg bx, es:[41h*4+2]8 |3 f1 f! r! k+ f# ~- R
in al, 40h6 h( o! L S8 z6 X# Q4 K) W* X
xor cx,cx, F% Z1 w* g) X8 |2 |# e
int 41h
7 l4 v$ c! c+ s# X xchg dx, es:[41h*4]
$ {9 z( r9 _$ m4 I4 p. Y$ l& f xchg bx, es:[41h*4+2]
8 H. p9 w% }: D3 q% p cmp cl,al
, S- a; `; d# N8 W# [% w( d+ O jnz SoftICE_detected
0 P7 Q% S# f# V* N1 y& ^- r( b7 A9 ]6 R, d) p6 C
_________________________________________________________________________6 i/ _6 [4 M) }# }$ Q
' s! v" L) Y* Y1 ]+ I+ t1 }8 l( W
Method 07
) |) K4 `- `+ j/ f9 ]( O/ w=========7 X! ]& r, c3 x. }, h: q$ b
2 s$ x, M$ Q! H9 W, m6 T0 C
Method of detection of the WinICE handler in the int68h (V86)% m7 X8 G0 n9 H6 X: g3 j
# C0 x9 @5 }1 T, Q mov ah,43h) v. k% n4 ]' O: F6 [1 D I6 Q) Q
int 68h! @. ]$ j' u, Q$ Q
cmp ax,0F386h
: s3 l9 u# A, ]1 B7 [ jz SoftICE_Detected
, h1 g" T7 C; c4 N& V9 \; k+ R
O- {0 L, g% y: Y
* m2 E9 r# ^6 @ i=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit( q. \4 ^3 g( g& y/ U* [3 }
app like this:
. o$ D& J0 N/ M$ Q% i
7 p4 Y# x' d @* N" c" _ BPX exec_int if ax==686 ^# E& k* d7 y
(function called is located at byte ptr [ebp+1Dh] and client eip is
9 l: ~2 [. C" X located at [ebp+48h] for 32Bit apps)
5 x6 q7 j: e3 }' F- m# Y X( I4 V__________________________________________________________________________
# J$ z+ L1 H# n6 Q, D: U6 ?; P1 D" R. z! f1 C7 F% j+ `
) {. T5 B, A9 U$ e3 n
Method 08
0 L/ W2 q; I1 A- M) h5 C- M" s=========# b; e3 w6 c& T5 t8 I9 e% W& @+ o
* F4 x8 F7 y: V
It is not a method of detection of SoftICE but a possibility to crash the
+ N! y" ]1 y/ W3 m" ^5 [system by intercepting int 01h and int 03h and redirecting them to another# |6 o' \1 @0 s# ]4 t4 x* \
routine.
6 `+ G+ w, _8 ~0 R5 s7 GIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
" m* s+ r: l( a0 ito the new routine to execute (hangs computer...)
* f( K% N) N0 z F, |8 N* `, e& l; t) J0 S; Z
mov ah, 25h& M! A6 X4 i6 F8 Z* h( u
mov al, Int_Number (01h or 03h)
# f1 B$ n/ I! q( l t( w6 o mov dx, offset New_Int_Routine$ P& O7 O H+ D M: }# D- I
int 21h1 b3 w, O! E4 ]( W Q" X
d+ T& @2 N# p$ Q, ]" l
__________________________________________________________________________& C" q$ B# w4 x0 i, |7 g
" r# R8 m$ A7 G) i7 u9 ?
Method 09
, ~! Q0 h) N$ j }* W=========+ u+ s& R7 ^; H% |7 g' I
2 X; |+ f6 ^2 b* j( F: y0 dThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only9 N J/ n/ _* q' O& u* L/ Y
performed in ring0 (VxD or a ring3 app using the VxdCall).
2 U. C8 u- {% l) i# L+ jThe Get_DDB service is used to determine whether or not a VxD is installed
7 F9 V: R) Y+ j* kfor the specified device and returns a Device Description Block (in ecx) for9 V% J+ [/ X- A) c& K! G
that device if it is installed.
* T/ y4 w+ F& n5 h! z/ S4 G8 y# o
* m7 W+ |" ~/ Z mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID& W+ _9 x n1 H4 q2 H/ ]. Y
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)* g7 i/ ?; a5 }4 S
VMMCall Get_DDB" l5 W# B! K! Q& ~ @% K# g2 ~, ~6 M1 j
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
5 Y* A( E, k$ b( X2 M9 k6 r% |# Z F5 U; I+ w
Note as well that you can easily detect this method with SoftICE:
/ R, H2 y- D; {( P8 r# E+ } bpx Get_DDB if ax==0202 || ax==7a5fh
6 S; u: A: n2 a! h* _# F A3 t7 f
0 h8 V( X$ z8 R0 K! @ e7 I__________________________________________________________________________
3 G9 a1 ?6 S* a- {
. ^/ I ?6 \6 m; LMethod 10; R5 z9 }! k5 m/ v2 w3 M
=========
6 K V5 N6 j l4 D! F; W% [3 T: r1 M$ {7 C) k% O. c; M4 ~# u( I
=>Disable or clear breakpoints before using this feature. DO NOT trace with
+ b( Y3 L3 g& V2 _, X SoftICE while the option is enable!!/ y5 x- Y8 x% ]1 G6 M, H6 t
6 ^& ~- a; F: i, G: }: eThis trick is very efficient:
3 E/ L8 ]! _' \by checking the Debug Registers, you can detect if SoftICE is loaded, j, |6 ]$ ], d4 t
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
% b1 _- O2 t- g8 Jthere are some memory breakpoints set (dr0 to dr3) simply by reading their' [& y# A: _4 r+ y5 s/ _5 Z7 X" Y
value (in ring0 only). Values can be manipulated and or changed as well: C0 |* t) _- t; {' |
(clearing BPMs for instance)& s" b5 g) f2 @8 w8 _
: z; R8 U9 D; H4 O. H6 i5 a8 T# w5 E__________________________________________________________________________
/ z# D, ^$ G+ T# s8 t
/ p% Z" g! C# m4 j2 lMethod 11
# Q; M* g% i6 O' E$ z6 K; q) ?=========# K, R9 D2 X. T9 u3 ^9 N
6 |7 h% @7 [6 }- b0 TThis method is most known as 'MeltICE' because it has been freely distributed. r) x2 @9 h! I
via www.winfiles.com. However it was first used by NuMega people to allow" K0 U) Z; c, C6 ]8 Z
Symbol Loader to check if SoftICE was active or not (the code is located& \" H# S2 K" k( T3 N: v7 R$ T
inside nmtrans.dll)." p* H+ M5 T" |1 F" h6 v+ }5 [4 P
7 ], A1 ?0 [- ]* E( [# ^3 p
The way it works is very simple:0 W7 E1 ~. C( W2 K* {
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for J' c$ }) R. l5 l
WinNT) with the CreateFileA API.$ |- ~; `4 Z* ^1 Y
/ o" u3 e, o4 U7 k3 t2 HHere is a sample (checking for 'SICE'):
1 D. Y, w2 }1 u, S
4 I2 z }3 S0 e2 Z8 \, aBOOL IsSoftIce95Loaded()
, h+ H2 V9 R& O9 P{
3 } F4 l4 t& y0 Y; b HANDLE hFile;
) w+ }9 C' v" I, K4 ^+ b hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,5 J9 r9 w. _: x" n _* B
FILE_SHARE_READ | FILE_SHARE_WRITE,. w0 E6 M6 a* \/ Y
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
4 i; c! I0 [2 n4 `) T5 z+ }# Z if( hFile != INVALID_HANDLE_VALUE )1 h4 n2 W* d+ {+ r
{
; U4 {4 I, b& e. |! }# e" } CloseHandle(hFile);+ m* Z& A, Y, { w1 I. p9 s! e
return TRUE;
6 ?; p8 V/ I9 q6 ` }( ^+ \8 j% m' @( S- |2 x
return FALSE;+ t% b9 ^( s7 v B m" l7 P+ x/ v9 z
}
7 k2 I2 H& |, p" s' J% Q& e5 A, A C" j6 ~
Although this trick calls the CreateFileA function, don't even expect to be2 m4 |1 i0 h' W) q9 L. u& V
able to intercept it by installing a IFS hook: it will not work, no way!
1 o* A+ O# ~8 Y" p$ l, } b) Y+ z4 L( ^In fact, after the call to CreateFileA it will get through VWIN32 0x001F
7 v @% l" A: {4 }7 D$ H7 Mservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)1 g5 @$ \, ~% W/ t3 h2 Q+ D! G
and then browse the DDB list until it find the VxD and its DDB_Control_Proc2 Q1 g, q W* a2 V6 d- `
field.
/ V; R. u4 Q& EIn fact, its purpose is not to load/unload VxDs but only to send a 1 z6 @. K( c' ~* E1 I. I
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
1 T7 I, |% l3 n xto the VxD Control_Dispatch proc (how the hell a shareware soft could try! W- }. W4 a( K3 B3 i1 n
to load/unload a non-dynamically loadable driver such as SoftICE ;-).- r. e6 a6 U; |) [9 {2 }
If the VxD is loaded, it will always clear eax and the Carry flag to allow
, F6 }9 j/ K5 `its handle to be opened and then, will be detected.
( S5 r4 e5 Z% V; a1 ^You can check that simply by hooking Winice.exe control proc entry point
! [5 z0 {/ {0 a7 H+ c Owhile running MeltICE.
. s7 y' i: K& g8 w! D# h3 o- I7 Y7 r4 X" ]. ^3 G/ U$ L' |
8 A6 `7 p' i' H P7 a# c: W
00401067: push 00402025 ; \\.\SICE0 m4 V B4 p3 ?) y, g1 ^% {5 V
0040106C: call CreateFileA
, _% c/ @- {$ w2 A: K: X7 M 00401071: cmp eax,-0011 o8 g3 @: F) c N! F' h
00401074: je 00401091
4 L- R7 j% V0 r' E+ g& C+ p' Y' s, I- L
" \" Q: w' t- a. c: l8 D) gThere could be hundreds of BPX you could use to detect this trick.: v9 P9 G/ I1 g: b) d5 C6 \: f
-The most classical one is:( A f5 t; `& R* @5 l( j1 ?5 |
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
& F, z9 ?# l1 N5 Z' z *(esp->4+4)=='NTIC'' M2 j4 X! r9 j% E) n
9 r6 m6 _0 p% {6 l! N* w-The most exotic ones (could be very slooooow :-(
8 q# h: S H, [0 X9 r- k BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') 8 G, G) ^4 ^ p5 o; }9 ?
;will break 3 times :-(
0 J; P2 u* u, J7 Q5 Z" [- c" F `4 T0 U1 w% g
-or (a bit) faster: , L+ h- t Q- T1 n$ V
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
: M! `$ _+ l% W( w3 c4 E
! y* i) K3 z6 s# ?% W; Q: j BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' ( G# f/ H1 u/ A1 z$ i- u' n9 ]& e4 ]9 o
;will break 3 times :-(
2 }/ y0 P2 e6 E' X+ g) ]
$ _5 H3 p" O' ], c-Much faster:
% u/ [; ]+ k' W n BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
' [" P2 n4 p& p; a. k# G+ a6 \$ ]3 i8 x
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
2 v2 b) v+ P3 i1 t$ }function to do the same job:
' W' r* Z6 ~( s8 n& `$ K
; t Z: _+ M5 s& {- a push 00 ; OF_READ
6 N2 H* e& i' u& n mov eax,[00656634] ; '\\.\SICE',06 g6 o# X4 J* g$ i; a# U
push eax j6 e. g' V3 b1 H
call KERNEL32!_lopen! D: J5 r$ y6 s9 r- s) t
inc eax
. U4 d! ^% z, v3 \. z, f jnz 00650589 ; detected
. [- o' @8 Y$ `6 g' N/ q K push 00 ; OF_READ
2 o+ e9 Y1 ^, R* L1 o; O. J3 e mov eax,[00656638] ; '\\.\SICE'
, f# d% ~2 p9 d7 ?' y) P1 K( s/ T push eax
& X- m; z- N2 S- C% t+ ~ call KERNEL32!_lopen
% W- c* `" B P v: l3 A7 X4 f inc eax
, t( c1 y# z* r9 ~4 _" t jz 006505ae ; not detected
n6 P9 Y s1 [, a: ]" I' S1 U4 W. y: m( i i/ X# m8 Y/ s, g* K
/ h- _6 c6 G( |6 J& n
__________________________________________________________________________3 G0 R4 K2 P, @# G: ^9 ?
) X4 V' J. w }* `5 ]7 e" X
Method 12- G1 Q! F. _" o7 Q
=========) S, |9 G8 C* F" f' A) ?1 \
0 d+ D/ |6 k0 X$ g; m6 l
This trick is similar to int41h/4fh Debugger installation check (code 05
0 q5 e }, B) b* t. w) j/ M0 A7 h2 ^4 c S& 06) but very limited because it's only available for Win95/98 (not NT)
1 b* G: |7 V- e% O7 X0 ^7 q$ kas it uses the VxDCall backdoor. This detection was found in Bleem Demo.+ ]; K( @+ @! v _1 l. j
% _- s! R V+ _1 x2 e
push 0000004fh ; function 4fh
: q" Y4 {2 Z4 M+ L$ p7 W! K7 ^ push 002a002ah ; high word specifies which VxD (VWIN32)
( F9 l1 |8 Z" Q# M# c ; low word specifies which service6 U! t0 U7 V! R1 e
(VWIN32_Int41Dispatch)4 R4 B7 A$ {+ s6 m1 H+ w
call Kernel32!ORD_001 ; VxdCall
9 {% U& s6 t d" y) v4 s cmp ax, 0f386h ; magic number returned by system debuggers
, a& q4 P7 W& V: R0 u+ O jz SoftICE_detected3 c8 M/ u! d/ l) m4 p
7 P/ R8 `7 I7 jHere again, several ways to detect it:8 ^: u ~& L! }. r! S. q
4 h1 ^' e+ z3 h: _7 E
BPINT 41 if ax==4f- h- g. Q! f. z+ d2 T- P
3 g2 f. i0 t1 D: j& n
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one; ~. k, s& [- {2 ?9 M) @
2 }5 Y& B) a) }6 v
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A+ c. v! O+ o, }$ d
* [+ F! v8 W# g z9 F- R& r3 R BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!/ b6 k. a: K% D3 l8 d
+ y7 O# }- y/ T5 d__________________________________________________________________________2 g0 \! Z N' ~/ `* M1 O
) Y, D5 y+ C/ S
Method 138 D* ]$ s3 O7 K, h
=========: j+ l% Y3 c3 w/ \* {, E1 d$ F0 n7 D) t1 C+ R
7 A. E4 ?! U# O' w7 g( c2 SNot a real method of detection, but a good way to know if SoftICE is! w3 x$ {- G# C: Z* I. a
installed on a computer and to locate its installation directory.
C6 z* n# x' W3 D; H' b7 nIt is used by few softs which access the following registry keys (usually #2) :
+ ]! {5 \; \) r5 n( r. P7 Y- H
$ V6 L- I2 A9 s5 ~% J" h, r, R; x-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion+ i) P1 P! A, m
\Uninstall\SoftICE" y; Z; m9 o: y! u5 s7 N1 S& @# w
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
* G1 v6 N7 X; y6 W9 n# h4 S-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
1 k1 _; d+ N( T% D0 x/ ]\App Paths\Loader32.Exe& M$ D+ [. c" e+ J" Z. C
# @% H% d" F6 L: }: ?+ M+ _' T3 J) j1 G) S: U2 B/ }+ k, U1 I
Note that some nasty apps could then erase all files from SoftICE directory1 p6 p9 X B5 J6 n, a, d
(I faced that once :-(
" w/ ]0 c; U k$ ]! L* A$ A. Q
]& ]2 X! b- x, F- ^4 GUseful breakpoint to detect it:& Z9 g, o0 D4 R& r
8 n! q4 a' n* A* h1 w
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE', g5 c& v8 B- p D
5 g' \# z6 s; V# Z9 } i5 k__________________________________________________________________________
; g5 ~, z( F [/ ^4 m3 p5 G1 N9 N7 C& [; t& l \7 u
& C' d! p1 Y1 V( h* B" s( U8 S. V& v
Method 14 , R( Y9 M3 X' a, I% U3 B0 s
=========5 G+ R1 k+ i' s* E9 T2 ?7 r" T
5 A' N P+ c2 Y* z
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
`: A$ T1 a+ B' u' Ois to determines whether a debugger is running on your system (ring0 only).
* n) b/ `) I; P, G# L- V; F4 @+ c+ ~8 `! g% n% W+ f0 u Z
VMMCall Test_Debug_Installed A+ W6 s: {" W ~( e
je not_installed
6 d8 S$ d% m/ S5 c
- \4 Z7 w+ p7 P, ~2 JThis service just checks a flag.' D; S b9 K! C$ q. s: J
</PRE></TD></TR></TBODY></TABLE> |