<TABLE width=500>
- M6 s I; \4 O<TBODY>8 c: S; K7 }! N! x: K
<TR>
5 }* D% i5 f( X( x<TD><PRE>Method 01
, v W* e9 f1 j0 {=========
1 g& _9 G* T; ^6 u# T$ J0 `, Y
0 E- N) x5 ? ? F; C& V! m: oThis method of detection of SoftICE (as well as the following one) is8 @$ h, S9 M' [ Y/ \5 Z- g
used by the majority of packers/encryptors found on Internet.) }( |$ A9 a- d G0 Q( i
It seeks the signature of BoundsChecker in SoftICE2 H6 h+ c' W( _$ E! [
5 G! ]! s* `0 J. R
mov ebp, 04243484Bh ; 'BCHK'! d$ N* m1 ^: p9 Z
mov ax, 04h2 c" Z- U5 E. l, i
int 3
% Z' w0 _; f' C cmp al,4
- d! _% f7 {0 Z$ I6 Z! _ jnz SoftICE_Detected
4 _2 B- I* J F6 O) v
+ ?+ ?+ \7 U* @* {___________________________________________________________________________
5 ]9 x2 d8 B& K7 ^7 s
- Z9 Y* B5 k2 ~; q7 ?$ W7 tMethod 02. C+ W% n- ~2 {. m5 K/ S- w
=========
! T O5 ~" Z- A* v1 w4 m4 e1 j
0 s8 T, q2 e1 xStill a method very much used (perhaps the most frequent one). It is used
" P6 a% h% T; q u3 Z7 b9 Jto get SoftICE 'Back Door commands' which gives infos on Breakpoints,/ V* ]2 M8 W; j! Q z
or execute SoftICE commands...6 g+ R' J! C" F+ W
It is also used to crash SoftICE and to force it to execute any commands
- |! M9 p, N V" }$ F+ u(HBOOT...) :-((
* s9 w# D/ ^2 ]2 y$ S
; Y2 u. R3 h# lHere is a quick description:
0 g2 m) D' ] O, K' B$ j1 S/ a% n-AX = 0910h (Display string in SIce windows)
8 F. N6 p2 n+ w. g# D-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
% L% y6 B3 r5 y- \4 [- Y-AX = 0912h (Get breakpoint infos)8 T v9 T# H' `& v$ i9 E) _. |: Z9 I
-AX = 0913h (Set Sice breakpoints)
9 w _8 K$ m' Z- [2 B" Z; s-AX = 0914h (Remove SIce breakoints)
! A% F$ Z; m) [- c( N/ Q* t
* ]+ m! |1 [0 D3 l% w3 rEach time you'll meet this trick, you'll see:
4 o! {5 j0 l2 B z-SI = 4647h
0 [6 p9 x5 J7 Q; Q-DI = 4A4Dh
6 m+ T; f- p/ m+ w' d" A+ x& ^+ @Which are the 'magic values' used by SoftIce.. [2 U7 q$ B2 A* p5 O
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.+ L) L- T( ?$ |% x
n: {9 \- e" K1 `
Here is one example from the file "Haspinst.exe" which is the dongle HASP
+ i; W* T/ o9 O# b; @6 pEnvelope utility use to protect DOS applications:
/ C* @+ ?2 A3 L* [, `
C7 X& d8 `6 q% X' @: L! }
; |/ p) F( p m% i/ {4C19:0095 MOV AX,0911 ; execute command.
# p- t! U/ s1 r/ Z4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
8 Z6 I [1 h' u* b; K/ E4C19:009A MOV SI,4647 ; 1st magic value., T1 q( h- k' \! S, Q8 I
4C19:009D MOV DI,4A4D ; 2nd magic value.$ i" C3 B5 a0 `8 E- x
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)# G, L( i% a, P) ?) { Z4 D
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
6 L4 O$ h( A8 h' V5 N1 ]4 g& p4C19:00A4 INC CX
. j( z: L9 p! h; n+ @. `4C19:00A5 CMP CX,06 ; Repeat 6 times to execute- j0 P& |3 |8 w' k
4C19:00A8 JB 0095 ; 6 different commands.# ^# U5 }; o7 G% H/ f5 n
4C19:00AA JMP 0002 ; Bad_Guy jmp back./ e8 x9 C& y* k& \
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
2 I# ?. {; ]$ Z* E9 [3 a8 S
4 ]& |6 J! M2 n+ VThe program will execute 6 different SIce commands located at ds:dx, which
, `0 _; N# @" A" Ware: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
6 [4 V+ u6 N% D9 X$ L
% u, w5 ^8 T+ ^. S6 W5 X, g* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.: I4 ?0 b& w+ |$ b2 R( T% l
___________________________________________________________________________$ s. Q0 P7 ^8 l0 q
. p3 X- f7 ~& U& a" x5 u" j6 w. z* w5 \ I' K
Method 03$ ?5 N( D- H2 W2 B
=========! B* z, }; F5 d) t; l; t
0 v D% ?! y; T. _Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
6 a0 D/ Z9 D" F9 |(API Get entry point)
/ u8 }7 \2 B2 t* r
4 c% A. q. p" ^* B4 H$ s4 q$ f# A m. u2 Y, ]
xor di,di3 i d& @7 _4 T$ s4 o- z# _
mov es,di4 P7 f e _( z$ t% U
mov ax, 1684h & y* e4 S( f' N
mov bx, 0202h ; VxD ID of winice3 ?- q/ D7 S# k
int 2Fh
5 Z* ^- p% v: U# f$ {! G, r mov ax, es ; ES:DI -> VxD API entry point
. f; U1 O" c8 d4 {% _ add ax, di9 j7 b3 j! y: P, D6 l
test ax,ax
$ U" x* E8 ?" X& H7 @7 n0 b jnz SoftICE_Detected Q# \: T7 Y0 p0 m* P5 l4 ?+ z
7 B- d( d! G3 s
___________________________________________________________________________
7 N; q) A9 h D8 t1 i2 R M: d; H& H/ p. b/ z, Y, b
Method 043 H- O* q0 F! O6 }( d' n3 v
=========
( y$ }1 G# k- V0 Z7 Z8 m" b) ]4 m' k8 j: Q- ~! n
Method identical to the preceding one except that it seeks the ID of SoftICE
+ o$ ~1 _2 n6 u9 sGFX VxD.
; p8 X3 |9 j. w& ?, G" d
* o( ^ p+ g7 ~% T xor di,di/ Y( V0 f* Y) d0 I) e% @
mov es,di
X. f2 @ F1 ? mov ax, 1684h ' C" D4 M/ E4 A. X
mov bx, 7a5Fh ; VxD ID of SIWVID
2 d1 z. {* j/ ~ int 2fh- h) V. C' {, R, z/ T3 m
mov ax, es ; ES:DI -> VxD API entry point1 z+ c9 x! ?( H% i' y6 x1 P
add ax, di
1 k! ^( \# e: J) F& _- P test ax,ax
9 N$ B8 [0 |) | f. D2 K% K jnz SoftICE_Detected
. @7 g8 |, A+ u) S% }/ p$ }0 C2 \. B( M
__________________________________________________________________________2 T9 |+ Y8 m+ i5 r
9 _$ e+ j" n2 W7 ]$ O# k ~+ H+ Q& Y+ c7 Q6 i! v
Method 05. p+ i- m) L1 ^
=========
, G W I+ ?$ V) a- U! H
% J2 V/ y6 E8 h6 T* \+ mMethod seeking the 'magic number' 0F386h returned (in ax) by all system
/ X- \' u/ R( D/ g3 ^& tdebugger. It calls the int 41h, function 4Fh.$ x3 h. f. N/ o6 c! \( f4 S Y! d
There are several alternatives. + `2 U, {1 i/ L* c0 n
. \& x' o0 C3 f6 L! s, n# \
The following one is the simplest:
" v8 i& z6 g2 A# d, c4 U
6 Y2 T: Y0 e& K' M/ a, N2 ^9 y mov ax,4fh _" }) b0 ~8 J( `, E. R% a
int 41h/ W. F- Y/ X4 e" C& n' U
cmp ax, 0F386
/ J; G6 w" T; Q, q% X) K jz SoftICE_detected
. M% O9 I1 k9 H! E* l6 _" a$ ~; d/ c& t% U& u5 A y# I4 L% |
) ]. }- M' Z4 S9 ]Next method as well as the following one are 2 examples from Stone's
7 s5 H8 S' M+ r" _- {0 o"stn-wid.zip" (www.cracking.net):
3 ^- h" O9 j s l
: U( |- Y0 s7 h# B mov bx, cs8 h4 f3 |, a5 o2 @ ^; |, z$ H
lea dx, int41handler2
, |3 d# P; c& s' q- B% ~( H2 X xchg dx, es:[41h*4]
+ P/ \2 f" j2 b% K4 h xchg bx, es:[41h*4+2]1 O# `) ]4 X2 W
mov ax,4fh8 u7 v! |( S7 n+ t1 s
int 41h
- E: p7 a$ c+ y- d" ~) x8 k5 @7 B xchg dx, es:[41h*4]
' T5 ^- A/ C4 w, V4 {" k' M7 [; x) r xchg bx, es:[41h*4+2]) S' v+ L) n+ m( \2 R9 m5 d t4 |+ w
cmp ax, 0f386h
5 M; Y9 d4 M T jz SoftICE_detected- m4 M2 S# |! X- R) h- g4 X
% m, P8 X* n4 w6 X! `" H- Hint41handler2 PROC8 v3 B0 u: J( _( l$ N
iret
W; a3 Q$ D3 O% Y; fint41handler2 ENDP; g8 k+ X. J0 P5 b( ?
+ b$ W9 s$ z& U0 k+ ~+ a. ?8 }/ `
6 y5 l# F4 m9 _( l/ ^. L B5 C_________________________________________________________________________
6 S9 o: K# d) y" i
! d. I L( S) W& R6 P6 Q4 W5 } X$ [' m5 L8 H
Method 06( N- w$ j: z6 f4 C6 J! A, t' |
=========
$ Z) K) P) L) s6 V& A+ U; s2 G' M T) X3 M
* W9 w) O6 p, v6 ~
2nd method similar to the preceding one but more difficult to detect:6 ^7 Z v7 u: q- ?% f
. R8 d- j+ } n9 c: G; N. b. u0 z! v& f2 P/ Y, g
int41handler PROC- ?) g- m6 E% } T5 y& T6 t8 ^6 |
mov cl,al8 ]7 L1 X* X, z1 a
iret
7 W# y! b+ O& Oint41handler ENDP
! S3 P7 V2 A7 ]0 M W& P7 Q Z
1 I& ^+ O+ T7 E3 Z. X% j* e
6 e" d4 y: R4 R/ x xor ax,ax* b8 l @ r6 [- K. t
mov es,ax' p" B8 S- _2 Q' g9 U* j
mov bx, cs
* U) T# a' l8 ^1 L5 U lea dx, int41handler) J/ J0 s2 ~: ^
xchg dx, es:[41h*4]) r! R3 N7 M2 ]
xchg bx, es:[41h*4+2]
* _7 ]* l. h6 H/ D. n in al, 40h& A2 D+ v5 ~# V; N7 T
xor cx,cx* `1 T# M. p3 j. U, I
int 41h9 w4 `: T1 y8 F# L6 _! G! o7 {
xchg dx, es:[41h*4]
) X* |0 N( }5 {2 ^ xchg bx, es:[41h*4+2]
9 e" ?. `# s$ s& M( v cmp cl,al* k! C( Y: X" i- }9 V) K3 U, v) R
jnz SoftICE_detected. O' A$ B9 q* v& s ~ J
& a/ ]* q2 w2 `& l* h* t_________________________________________________________________________+ r, p+ ?3 ]" k- ?: p8 X# ?
1 s/ |3 b8 Q1 u, @$ y: t h0 e* |
Method 076 U! Y6 l. `8 }: L5 c; J0 i' k, F
=========7 \: l4 F% B7 t2 a9 X3 d% T
# B. X4 a. ] ] s I- ]Method of detection of the WinICE handler in the int68h (V86)7 b) g1 P% j, o$ C* b3 x, ?
/ X5 l& {5 W8 k8 D; O
mov ah,43h3 t: J- _* n h, X
int 68h" M5 }4 T F& `" W
cmp ax,0F386h
* Z! ]2 A! U( o& q& `0 w jz SoftICE_Detected
6 a( V0 k! u0 N. a0 q: U. g
- M7 B$ C0 R4 G9 O) `% a" ~6 l
+ j* a& }* s2 c n) N3 i4 [=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit' c( {: u6 B" p4 r8 O: v* l& G
app like this:2 l! v- W$ P0 j! M/ C& w- P
0 P! D% U2 z p2 G1 |' I4 ^
BPX exec_int if ax==68" @' M1 T0 l$ p$ W2 I/ ^
(function called is located at byte ptr [ebp+1Dh] and client eip is
: \+ Q, E! I J: Q8 M' k1 j located at [ebp+48h] for 32Bit apps)7 a) A: x: M C6 j+ p7 K+ j
__________________________________________________________________________+ o4 k7 i7 b# H9 U8 V$ k; A" Y% Y
5 C6 s! V7 K U! J1 u1 p
$ H8 k }# A: O, c+ iMethod 08
9 ^; R4 y& L" j0 z: R" p& \1 Y=========
/ R; v) E$ {$ Y+ } E0 ]3 T
: U5 V! k6 ~/ w5 |' T7 Z/ o1 f5 H& t; OIt is not a method of detection of SoftICE but a possibility to crash the5 a9 v- J$ e, m
system by intercepting int 01h and int 03h and redirecting them to another m7 S$ |+ T& J# m5 x: Q
routine.
4 c" `/ ]* |' c2 y$ k) bIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points* X8 ], `1 }% Z$ i
to the new routine to execute (hangs computer...)9 x9 R- ]; T) q" X+ h* v
: r0 ] s; i. |6 B( F/ X mov ah, 25h
2 w' ]" N% W/ } mov al, Int_Number (01h or 03h)% l) [$ P' [, x, F. l; j8 ]+ W6 F5 f
mov dx, offset New_Int_Routine
7 C; d" a! J( h- Y- c int 21h) R; D) ~" L1 S8 C, [
8 r1 z2 Z3 ^: l+ G. g* l1 H
__________________________________________________________________________, v% S" ~+ P& v) o
# T5 m$ v6 y% W6 ?8 O5 G& d+ n
Method 09& P. W4 s, F% I; U
=========
# M0 l. X0 e5 b0 Y- d7 s5 X
( ]1 z8 T5 r$ {2 X, UThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
) l( d9 y. q- q2 i* [ uperformed in ring0 (VxD or a ring3 app using the VxdCall).2 o8 i) {5 R" @0 B: V
The Get_DDB service is used to determine whether or not a VxD is installed
+ Y# Q }1 I2 Q, \0 rfor the specified device and returns a Device Description Block (in ecx) for
2 A) B" Z, ~$ Athat device if it is installed.
3 ]2 w1 n. `& B% B$ e2 X
. a4 |. g1 Y- g, N5 b; i mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
+ A2 [. A# l) Z) k mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
8 V6 v3 h1 ]/ A' B. ? VMMCall Get_DDB( p% g; }$ d. @- d# d! T7 H
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed3 g+ t; I" }0 t# ?
; c- [5 ^8 q+ S4 X& F: ^
Note as well that you can easily detect this method with SoftICE:
/ d2 k" g- f3 R bpx Get_DDB if ax==0202 || ax==7a5fh
4 n# j( k! u% v
0 _1 J0 T( x7 q3 A# c__________________________________________________________________________3 P. ~: C, V& F8 i/ B
, u7 y% W4 w! G% ]' f1 z( V2 Y! k0 {
Method 10
9 B& i) y4 _! I; d' J% {) b=========
: ~1 [& j8 ~4 M& E/ @3 Z8 T2 F4 U& R+ P* o5 i; c
=>Disable or clear breakpoints before using this feature. DO NOT trace with! Z1 O; m, R) m2 l2 Y. h- ^: ?
SoftICE while the option is enable!!0 U5 ^* C% _3 V, F6 R' n
4 A# J% B; I8 v. ~2 I" w& u
This trick is very efficient:
0 W, c/ A1 @" P" kby checking the Debug Registers, you can detect if SoftICE is loaded
0 V4 L$ e9 n5 p: ]. k(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
5 c% X) b# z; N' `! e4 d! R- othere are some memory breakpoints set (dr0 to dr3) simply by reading their" w$ E$ G: }" ~2 N4 g
value (in ring0 only). Values can be manipulated and or changed as well
2 K7 d* K1 I4 R$ _& A6 W+ \6 O(clearing BPMs for instance), o6 j+ w4 u. ~* z
$ U f- s3 T! g! S# @# S
__________________________________________________________________________4 d$ p: G# S2 ~' W" P* T
4 v C! ~" d" w! c6 {% p
Method 11
7 O1 V; c3 N! t0 q=========
' l" _* s# l) j. o9 B9 Y
8 k% C# `& a, V. y/ N- |This method is most known as 'MeltICE' because it has been freely distributed
9 Z6 `$ h2 B' I H5 v9 `0 G/ uvia www.winfiles.com. However it was first used by NuMega people to allow
* ^4 Z9 R* U% E, d7 iSymbol Loader to check if SoftICE was active or not (the code is located
' w) u5 V; z& Q/ j. kinside nmtrans.dll).
5 M5 Y/ |7 Y+ i; a% g) v3 d5 d
; X- z& F1 V+ D/ qThe way it works is very simple:
0 E9 v6 v" P* ]& XIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for: G+ S, C0 ?3 h! g/ Q$ ?+ o. I8 Y
WinNT) with the CreateFileA API.' L/ _: ?2 C2 K8 m. n/ A4 @1 a
: Z& |3 T; `; Z
Here is a sample (checking for 'SICE'):
0 Q1 W. h6 `$ ]. R
w+ Z( u ?# U ?4 p, Z5 TBOOL IsSoftIce95Loaded()2 n; W$ ?1 q6 J" Z1 ]) ~) J
{
& D" i! g x3 B( p" L% d. m HANDLE hFile; 3 A9 {4 P) |; L/ ?) |- d
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,4 R3 I+ P8 H- g# {% {7 D
FILE_SHARE_READ | FILE_SHARE_WRITE,- j: Y, x+ y( s3 f6 P
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
0 {3 v3 ?2 \4 I# k0 ?, v if( hFile != INVALID_HANDLE_VALUE )
7 t! o) k4 s; H/ O ]0 b# D; ? {, f: b3 ?5 k# A! g
CloseHandle(hFile);
" x. n2 T2 }. Q6 J return TRUE;
% ~3 D6 n6 I9 T# K% C+ y; l- @ }( x" T7 `7 ` k
return FALSE;4 E/ S0 K8 a5 D- C% q2 Y
}" [$ I- X) `) E& X6 B
8 w, C: T/ R1 N' g4 g7 w: JAlthough this trick calls the CreateFileA function, don't even expect to be# G* q9 @+ ~3 Z
able to intercept it by installing a IFS hook: it will not work, no way!
% _3 E2 F% d8 N2 m* r) j4 eIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
8 ~# J6 V7 N m5 k! rservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)5 c8 q9 J( z+ d7 r: d, m
and then browse the DDB list until it find the VxD and its DDB_Control_Proc- K2 F" k9 e& P4 I2 m! {9 b) ?2 G' h! ]. G
field.
. ~& c) ^& K2 I% S4 T$ F" S- aIn fact, its purpose is not to load/unload VxDs but only to send a 4 ~* N t1 b) Q
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
! g+ Q- V" h, r; }+ h$ ^0 fto the VxD Control_Dispatch proc (how the hell a shareware soft could try: l9 q. |/ d* k [
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
( n4 Q) o- O. A) [1 i& uIf the VxD is loaded, it will always clear eax and the Carry flag to allow9 h9 a# Q/ I6 Z! M. `+ M
its handle to be opened and then, will be detected.
* Q: E( D, h& l" b, u! wYou can check that simply by hooking Winice.exe control proc entry point
" {, a/ z% R, Dwhile running MeltICE.. T$ p* V! b; \* ~3 `: F2 k# ]9 g
/ q# h/ u( P5 J0 }9 w1 m0 B4 v& V. k- N
00401067: push 00402025 ; \\.\SICE
+ g2 C1 @1 \$ y H5 x* ?. m: l9 R 0040106C: call CreateFileA% t6 ]1 ~7 t# x& T$ e2 p2 r& _
00401071: cmp eax,-001
0 T" r, t% K: i0 E, q4 g* F 00401074: je 00401091
. n# H* v2 v. S* r6 z4 H
* f2 U* _5 v% D4 m6 V/ L8 P# q3 N
- q2 M* v$ v' r5 u3 Z7 XThere could be hundreds of BPX you could use to detect this trick. K9 E! }( [% @
-The most classical one is:; V( g; r! t; ~
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||' C0 ]. G2 E% V$ l; d+ _
*(esp->4+4)=='NTIC') T7 G, _5 I9 s
; N8 q4 O6 n1 y4 t
-The most exotic ones (could be very slooooow :-(
+ U) H2 _6 |& i BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
6 B& ]8 r `! k/ S# S ;will break 3 times :-(' t; M: v F% d1 w6 B+ K" z
' ?' m( ~9 Q: P* J
-or (a bit) faster: 8 y6 q: V7 o4 C3 r, _- h1 E. P" d
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
2 b0 i" I! d" ?9 h) p: N# I. h- H! K# {/ }2 g4 q1 a
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
4 |* O) t; m! q$ f' c* o" y ;will break 3 times :-(
4 ? @% j w. Q( t0 {* d* {
0 ~( H" Y' j) W8 ]0 |4 @-Much faster:+ i* {' c+ ^! A6 X2 C; e
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'- m# V1 I/ F, f0 @1 c2 N' h/ Q! j2 P
# _+ |9 t! ]1 Y: e" BNote also that some programs (like AZPR3.00) use de old 16-bit _lopen% i$ q* c% o. ^& t+ J: m
function to do the same job:: X4 J# s! B) M* r6 P
6 Z8 r- e6 l+ s. G push 00 ; OF_READ* \7 J: m( u1 u# M. S( J
mov eax,[00656634] ; '\\.\SICE',0) b* C5 ^; w) j0 H" R
push eax& A" b3 }3 |2 {- {( K7 x
call KERNEL32!_lopen5 \. C! u1 x! k! [4 @. D
inc eax. v# J; J% \3 q7 `' @# _
jnz 00650589 ; detected
- N! O, {9 W% C$ d" f+ D6 } push 00 ; OF_READ
! m, N: ^: G6 r1 f mov eax,[00656638] ; '\\.\SICE'6 j& y' Y" n) w9 N/ `# z( p
push eax
2 s( F; ^ L* Q, }& d- l call KERNEL32!_lopen
5 x- b# w' `4 M inc eax
* X* e c9 v# x- P jz 006505ae ; not detected
2 g2 o' `, h9 S2 t5 @
1 K( ^+ J5 [7 c# P3 }& d" x& g0 N+ J2 Z: W
__________________________________________________________________________: h& U6 b& o& Z6 r8 R
1 X; p: Z6 T( k/ V2 d4 V& d0 q
Method 12
# {6 M+ _) K* a$ \. n6 X- \7 K=========# A$ y, J/ k3 R
2 ?6 k- n- N* [4 R- L
This trick is similar to int41h/4fh Debugger installation check (code 059 d& o$ t, n3 h7 c# n
& 06) but very limited because it's only available for Win95/98 (not NT) @: j7 R* Q2 u+ p$ z' Q
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
: \3 ^8 ]2 z b S; g# K) p( _1 T0 n: v% e
push 0000004fh ; function 4fh
% p% g u4 Z9 |# E" z# C( T e push 002a002ah ; high word specifies which VxD (VWIN32)
) v3 c! t% N7 Z ; low word specifies which service& x, l4 L) x- S5 T' z# u
(VWIN32_Int41Dispatch)8 U: y) n$ \$ n' L, c0 I
call Kernel32!ORD_001 ; VxdCall/ k5 Q `4 g3 ]
cmp ax, 0f386h ; magic number returned by system debuggers* u J! E& Q$ q0 A' x' \( U# S! P
jz SoftICE_detected) [# X0 a) w* R
8 I8 [: g; U8 k+ x% ]9 M
Here again, several ways to detect it:
) L$ Z8 P) j+ E' L) N7 D8 f/ K+ D2 B& i8 X3 I
BPINT 41 if ax==4f3 j' i" |3 h w% S
1 D: ]( O( ]) c# l
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one& Z/ ]" i% D8 i9 b) G; _ @
# ?/ }9 H/ S3 w; W' e' H
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A2 R7 V, K9 V) j9 o* o& D
, z% D8 N+ M! j2 W' i
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
% e, Y) `# V: L" W- W
' U. x( p, E, }$ c5 A6 U__________________________________________________________________________6 ~3 H. ~( q& H6 i" Y
. X6 Z |8 v/ G# V0 {5 AMethod 13% \6 e0 F; I8 L1 t; s
=========
' C2 m9 U: K7 L+ ^9 Z
; W! V, W$ ^4 DNot a real method of detection, but a good way to know if SoftICE is. r& F% l. R$ J$ H) x% d
installed on a computer and to locate its installation directory.7 s% V# k0 K7 M- W
It is used by few softs which access the following registry keys (usually #2) :" y7 w/ g3 @' V# s' h
9 P } J" B/ ]( ?# k" j/ B
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion& U1 q& x1 k6 i. n, A' \$ t
\Uninstall\SoftICE1 G1 m# ^% H$ ], j4 r* R
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
' N% C i$ K1 D1 @6 I+ G. I: ~+ x-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion: e% e4 R0 X+ O
\App Paths\Loader32.Exe
/ k% o2 d3 I1 |/ F( z0 T) d
5 T" r N) [( ~" V4 V; _% Z: C$ @- K7 ~( l- v
Note that some nasty apps could then erase all files from SoftICE directory
& |# Z0 T+ P T4 H$ b; G(I faced that once :-(
6 B2 c8 U* m- r/ p$ B2 H
+ e) V* e7 x& H/ A( [, X: DUseful breakpoint to detect it:- z3 w, m3 F/ s: d. h9 f
% u: K0 g+ E' [4 j2 L- v# d# H
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE': N( @7 T5 g5 m5 S* Z. A h
! S. Q* |5 w3 o F0 ~9 C
__________________________________________________________________________
9 B9 S7 l& m* A7 b5 u }0 }( w6 U! K4 V% v$ \) n
3 Y- z: E! [5 Y* EMethod 14 1 {, ?: q: E# l' y
=========9 {$ n: R9 k5 t* s% e! P) C
( y3 f m) b4 u+ I9 r
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
# R3 s- k9 }7 ^is to determines whether a debugger is running on your system (ring0 only).
) S& |& g7 L: c. Y" C. d( `! F4 j8 j
VMMCall Test_Debug_Installed1 l3 n# ]2 ^% e6 m
je not_installed9 c, V9 t& F: E3 G
4 W: b/ f7 e# j7 B, ]% t
This service just checks a flag.
/ l3 j! h+ J( i; q0 a& k; l</PRE></TD></TR></TBODY></TABLE> |