<TABLE width=500>
* T0 r5 i$ G5 T' \<TBODY>
4 X+ b3 c9 ?! d+ y6 i5 d+ U0 e<TR>( ?& i8 m. Q, e/ e: N
<TD><PRE>Method 01 y* t) O, I( n
=========
0 v0 W) }% O' K) h& K0 e
4 G. ?! @# H! BThis method of detection of SoftICE (as well as the following one) is
6 s# v7 M8 q8 Z; c) jused by the majority of packers/encryptors found on Internet.
" ~. E* k3 {- [" J/ T% u2 eIt seeks the signature of BoundsChecker in SoftICE
2 @% L6 L' g- Z0 y. g$ w. E* Z0 Z' z! M) N, l
mov ebp, 04243484Bh ; 'BCHK'9 m; \( l4 l5 |3 J6 w
mov ax, 04h
7 t$ T0 Y, p3 _$ c int 3 , j+ K3 a" Z ]' E1 j, ~) j% f5 e- A8 I
cmp al,4
8 ]( q; O4 v) ] jnz SoftICE_Detected
3 J$ s6 w3 w. L
8 R! Z6 X( b3 a. r) v$ E/ J___________________________________________________________________________ u% m, w$ B# n& z
0 f& {/ Y2 Y, ] }8 D
Method 02
q# a3 z( @3 D$ u1 g=========& G) B& @2 W, X" {, i$ m
" \. m; p t9 c' b/ eStill a method very much used (perhaps the most frequent one). It is used1 J0 K s. b9 _
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
" s7 v% p/ @7 \% q4 Z$ g/ {or execute SoftICE commands...! q& _! g! A) ?% L# @/ Q- }
It is also used to crash SoftICE and to force it to execute any commands3 U! r4 b. D3 \5 v- T, k2 L
(HBOOT...) :-((
; [6 v+ E3 F2 C! p o& ~* C2 T, l9 t
3 q8 `+ j' i# F& d& VHere is a quick description:4 U: f: k0 k7 e3 a3 g$ c
-AX = 0910h (Display string in SIce windows)9 h. ` u* G# y4 m7 W, z9 f
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
. i3 A# O* U* b- a5 B! F-AX = 0912h (Get breakpoint infos)% I) b* a+ L$ B9 E
-AX = 0913h (Set Sice breakpoints)* E9 {7 F8 C2 W" N7 j/ g9 T
-AX = 0914h (Remove SIce breakoints)
. g g+ C* s# l$ z J! k/ Y' h2 o8 E: W4 ?* t$ p
Each time you'll meet this trick, you'll see:2 ?6 N+ _/ [$ Y+ x5 J% d& m
-SI = 4647h8 n# Z0 C( ?2 ?1 y( k' c) D$ d D
-DI = 4A4Dh
& J' K' y2 k- _7 mWhich are the 'magic values' used by SoftIce.1 U. K, U; H4 G% e: L
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.! O5 N6 a, ?" t% [' w& q7 Z; X
7 r# S7 e0 `& J! H8 [( zHere is one example from the file "Haspinst.exe" which is the dongle HASP
0 M$ s. S n% {: dEnvelope utility use to protect DOS applications:
& E1 `9 L% o9 @$ y9 [1 M6 l; y# X: w3 O2 r2 N
5 c1 P! n( ]! J- S% {6 G
4C19:0095 MOV AX,0911 ; execute command.7 R' x9 i0 o1 w) `& p8 l( E
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
- J! M; i8 \9 B" ~% v4C19:009A MOV SI,4647 ; 1st magic value.
; e- }& m' k6 p% h4C19:009D MOV DI,4A4D ; 2nd magic value.
& H# I C4 B: n9 c4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
, r- G5 n! }2 I' j. E4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute' _( G1 d, y3 C9 M% o
4C19:00A4 INC CX
6 V% \' f$ S y$ m6 J2 y* o2 W4 Z4C19:00A5 CMP CX,06 ; Repeat 6 times to execute" _+ f2 I' k2 S7 B% X! M- j2 g! L
4C19:00A8 JB 0095 ; 6 different commands.. U( Q. c, k- m) D
4C19:00AA JMP 0002 ; Bad_Guy jmp back.: _/ x( t% P W, o6 D. n
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)$ ~' K( W M9 v1 J7 s4 w! @
# d6 L" a" j4 {1 P/ I, k |1 T: H' @
The program will execute 6 different SIce commands located at ds:dx, which1 L: ~# L7 ?1 |; |6 Y1 e) f/ c
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
2 J3 U9 l3 X. U4 ~/ M/ g, ]
* Y1 \* H. C. Z5 B/ h& w6 o0 w* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
$ Q* S; ^2 q Z/ u4 d8 |( q6 |) p___________________________________________________________________________
; t$ o& |# j6 |8 d! `8 \+ j. E5 v6 t
/ V: M6 ?: B" H. v+ @, Z+ J8 I$ ?( r
Method 03
B6 |/ W8 k3 {. s' K=========
' Y9 R% ?3 c8 j$ [' p" r% X' _ r
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h" U( d' f' t( \1 ^
(API Get entry point)
; {% k' s0 M! ^+ ?
$ K* X$ E8 y- E
4 u% p* A' s* f3 _+ K) l xor di,di
: _. \* ^/ [! ?+ b# x1 V mov es,di! D1 C; Z; I& }9 ^' W1 l
mov ax, 1684h - e7 y6 y1 J- z4 \$ L1 `7 Z9 j" x" }
mov bx, 0202h ; VxD ID of winice- l. v2 B3 U9 V T0 E
int 2Fh
& I( t7 J! ~% m5 Q( O* _& V8 s5 Z mov ax, es ; ES:DI -> VxD API entry point7 ^7 p# s4 e/ T- ]3 ?
add ax, di
; h$ s/ u% l, q7 F' _" D test ax,ax
4 \; Y9 D8 t( L1 ]2 Z$ Y7 [- a jnz SoftICE_Detected
* R% v B: z! I7 O/ [) V% c" O& G$ g6 r. o7 X9 x2 @8 @' Y- J
___________________________________________________________________________
8 Y) | I" V& W% `! C
$ @5 w! [, v/ O) I% Y* Y4 a% U8 `( IMethod 04. K- v# S1 W- @; ^. z' |: B& r8 B
=========
# u: R5 v( b! y1 g
4 m k9 K7 h) fMethod identical to the preceding one except that it seeks the ID of SoftICE
. r% [9 l' O- Q; ^5 s5 lGFX VxD.+ z1 L6 n ~' I: l% N4 y8 u( [
( T6 l- z. ^8 N- _
xor di,di( T5 A2 M9 o, N& P
mov es,di* u, o' O; ]3 r; M/ n
mov ax, 1684h : Y; H( w5 |1 h4 X' r9 t) Q
mov bx, 7a5Fh ; VxD ID of SIWVID
, A2 g/ `# {. [* a5 C- v: U int 2fh
- x' q, m2 x _0 k( { mov ax, es ; ES:DI -> VxD API entry point
; D- E w) d. Z) W. X add ax, di
4 i3 _( |, @# v& {5 }, |- U test ax,ax" a" t( f7 d n5 q3 X P4 L
jnz SoftICE_Detected
6 j% o6 J/ q; D2 B! p, F# G' l# [7 J8 `: X
__________________________________________________________________________
, I! `7 M* p! z1 s- v' _: ?' W, [- ]- {) ~* }/ x
$ ?% o) w5 l2 o" B) o3 b2 g5 c: {- VMethod 059 ~* A* @ Y9 X d
=========/ u+ O! F4 M' L! |5 E* z
0 h7 @' f# W0 X% \7 E; g
Method seeking the 'magic number' 0F386h returned (in ax) by all system
/ K, C& K: N2 X1 ldebugger. It calls the int 41h, function 4Fh.
# e( _6 F! \1 \1 I2 I9 MThere are several alternatives.
6 q2 |' r4 g; S2 a6 ^6 a# X3 ^1 X4 M. g3 `2 ~) y, K
The following one is the simplest:/ O* l2 y# b* I* G: C
4 D3 u! W: l+ d- O- ]1 h7 j
mov ax,4fh
: f4 |) x& | ~ int 41h
# T+ l" m& t8 A cmp ax, 0F386& ]# i7 ~8 R1 q0 ] r! n, [
jz SoftICE_detected1 T4 c* K: D4 c; ~& H
8 W7 F" R' [9 i2 I; `
" d; d( [; q5 t3 }; N. ~
Next method as well as the following one are 2 examples from Stone's
$ C% Q! k8 O# Q! C9 ~- x2 Y"stn-wid.zip" (www.cracking.net):2 f) \" O @0 T$ e4 Q0 P
6 y0 c) n2 l& u9 N, r5 D) e6 i mov bx, cs8 @' U- e& b2 I: I; h
lea dx, int41handler2
( _$ I: @* d% W5 {% m7 g, i xchg dx, es:[41h*4]
% F9 ~3 L; d+ e: m xchg bx, es:[41h*4+2]
3 G% g/ p1 c) X. q mov ax,4fh
# |' O' k! i2 T G int 41h5 n! l" H, m Q7 K/ G/ ]. a0 F2 N. Y
xchg dx, es:[41h*4]
+ i/ U$ {6 |/ A" C xchg bx, es:[41h*4+2]2 N8 u6 w* }# i1 J8 o8 w
cmp ax, 0f386h" |% N" e4 H3 N
jz SoftICE_detected
6 v' S+ o" ^6 k+ b/ L
% n; j0 H9 Z- Q" ]. u) L" I% z1 Zint41handler2 PROC
$ X& k7 O! w' l# Z, l( K! }+ w1 C iret
8 Z" ]1 y7 k& sint41handler2 ENDP
2 v: G) F3 D3 h; X% G( G |$ i
- d4 j. J: D7 v, ?- E1 O7 r w( }$ z# k+ U, O
_________________________________________________________________________
7 L1 Z h9 B' {& J# F
+ {$ e, _; B" v" e, H$ g" |
8 ]+ z" b+ `$ f. YMethod 06
7 f& u+ z4 `0 N n2 y=========; L# Y! H0 G& p: B* z6 E
3 c: f' s% i8 N
6 v' Q7 x7 w: ^: `* u2nd method similar to the preceding one but more difficult to detect:4 O4 I1 G$ O- p- w7 x
1 y- p0 @/ h- [
& i4 h# s& j3 U" j# o5 cint41handler PROC4 v* I" K9 h, H3 M. b
mov cl,al
- N+ W) }9 ]9 v# L6 m) D: I iret6 E& J7 ~5 @5 Q
int41handler ENDP; v4 H$ W* l; t G- P1 H
6 W7 `+ a& @( x7 v1 C y* ]8 h% v
( O/ Q( z8 n; X' S( L1 G
xor ax,ax
0 d" D2 f: y& K% U, X: M mov es,ax
4 f" X b; z2 z; i U) \8 R, {% @ mov bx, cs
8 N. R% b+ _0 x9 c% B lea dx, int41handler
. R6 a9 U$ F6 Y/ R xchg dx, es:[41h*4]( R$ n- a$ a: G% C
xchg bx, es:[41h*4+2]3 q7 B' X$ r6 x) Q
in al, 40h" V' L0 x+ c0 S' C9 ?7 E; z
xor cx,cx
8 h2 o. r! h/ U# d int 41h
8 g( U: h: ^- ^+ Z xchg dx, es:[41h*4]
: [, D/ p8 [# w; z% P xchg bx, es:[41h*4+2]* E+ m0 J- r" k* a
cmp cl,al
0 y% }5 a0 ?" Y: [' b jnz SoftICE_detected9 s& `4 ]1 k7 F0 d f- @) ~
$ R% `$ v/ I- Y* }- n5 B
_________________________________________________________________________% j8 o; ~! z! V2 J* O
, u: F8 @* p$ T/ e
Method 07" l5 j, F1 Z! \& r/ \
=========
5 R5 L; ~/ u: D
- e% m0 T7 s9 fMethod of detection of the WinICE handler in the int68h (V86) W9 |3 O- i' g3 O
) [! [% E. K0 w0 [5 N) n2 f
mov ah,43h
, o0 Z, c/ {4 g- S3 V5 v w7 J int 68h& ~& ]0 Q: I% r3 }) \
cmp ax,0F386h! a( d' a4 o* F5 c0 C5 @7 ^ E7 {# C o
jz SoftICE_Detected
& H; z! D% S7 a1 O
9 r1 y u4 i* v& t# ]2 L2 B* c: e+ K: w
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
4 f5 q. v3 Y* }, c app like this:7 U* I9 o7 l% O
: o( u% y' _, e BPX exec_int if ax==68
m0 k4 T0 U) g (function called is located at byte ptr [ebp+1Dh] and client eip is' ~1 ?; C0 R0 ` e' y
located at [ebp+48h] for 32Bit apps)9 B! L3 u: u r ~
__________________________________________________________________________
. E- g" y3 P' X! K0 V3 N9 P) q; k2 M# X& [/ s& b
8 h! `3 E; E2 }4 E! O* SMethod 08
' T) i) R: e( f6 j& T1 ^ o$ m=========
6 |$ t9 t: W2 b1 a6 l) q. k) ~
* r3 ], `* r3 u5 E. m1 d& iIt is not a method of detection of SoftICE but a possibility to crash the
+ M5 s6 B5 K+ _5 y# Rsystem by intercepting int 01h and int 03h and redirecting them to another. G/ r% V! Y# j1 [0 U
routine.
) z* b+ l8 X( A) }/ s8 HIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
5 ]- ^2 g" g9 W* Z6 n- \3 w3 `: ?* Gto the new routine to execute (hangs computer...)
0 X- q8 K% |" q' m1 x7 w3 F& t7 P, a3 q7 i( W- S5 ~# ]
mov ah, 25h# k; [; j- K, P/ c
mov al, Int_Number (01h or 03h)
- V3 G& x W6 W' e) I mov dx, offset New_Int_Routine% Z" p( p# I+ n3 L1 Z7 C
int 21h
# j, i# h( g# w4 N' L3 q8 ^, T0 b2 S! @3 l- A+ H9 z
__________________________________________________________________________+ F, o* e# n5 E- u, @
5 D; h' N, l% X* N7 aMethod 09
! {, E0 ~# Y: b& a6 W=========: O; a7 I( @. E4 }$ L
# n$ @6 E6 ~' n6 }6 t/ QThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
+ \; i5 Z q/ P* ?performed in ring0 (VxD or a ring3 app using the VxdCall).
6 N5 N% f. f( W/ FThe Get_DDB service is used to determine whether or not a VxD is installed
" v; v2 G0 h6 C9 T$ h# G, Z/ L4 z+ rfor the specified device and returns a Device Description Block (in ecx) for! h+ _3 H/ g& r. c0 H1 m/ l7 d
that device if it is installed./ K1 m9 @2 e& K' p2 B
- o3 q: P$ u5 l/ I2 v
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID1 ~" m. p# C1 T, D
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
" b. M1 w* C6 O" h; @# Y VMMCall Get_DDB0 V0 m& x& [, e6 E$ f5 R$ ]% Q% F& \
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
7 F. T' B) S6 @# @2 T6 R) V3 ~* {% q& T
Note as well that you can easily detect this method with SoftICE:; F4 c K h1 U8 g) T8 }6 n: U
bpx Get_DDB if ax==0202 || ax==7a5fh" M0 u; b+ y( P" g
8 C8 P, Q3 ^$ @7 ]0 K__________________________________________________________________________
: u3 `( ]$ T# {3 P; T% ]4 y) P# {6 H. Q& b( S" W1 r- L
Method 10
V& s3 d( R( ~( n$ R0 p. \=========1 s; j, b; h m& O
) ?+ H/ h7 G6 }0 v- c6 ^=>Disable or clear breakpoints before using this feature. DO NOT trace with
, }7 p# q6 \" _5 m SoftICE while the option is enable!!5 z- s: z$ m' L( l$ @9 e3 z1 u, I
. O0 m2 L# O) ~& @This trick is very efficient:
) l' Y7 G" z V1 h# ^- B4 sby checking the Debug Registers, you can detect if SoftICE is loaded
' l9 T$ n( a) w& P(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if5 Z1 c5 \- L$ m( Z) S( Q7 c; @/ o1 T* m
there are some memory breakpoints set (dr0 to dr3) simply by reading their9 f) K6 [2 `1 s( T! T
value (in ring0 only). Values can be manipulated and or changed as well
! a3 I3 l; ?+ ~ q(clearing BPMs for instance)
% R) t3 ~3 |+ f. Y! t$ J( R, A, x* K
% U; ^# q* a: m7 K; }- k__________________________________________________________________________
; B9 w/ X5 G/ f7 N) o' ?9 Y. I) X- h" Z1 j3 Y* K
Method 11
6 q2 X7 {8 @* D+ B9 `. o=========$ _7 Q, o- \# \8 ~/ s' ] K
6 P% ?* [- p9 [+ q' W% dThis method is most known as 'MeltICE' because it has been freely distributed+ [+ M3 B/ }/ ]; ^
via www.winfiles.com. However it was first used by NuMega people to allow. l; j5 |/ q6 @# y4 ]
Symbol Loader to check if SoftICE was active or not (the code is located
" Y J3 _8 q$ Q8 ^inside nmtrans.dll).
- L& J2 N! V" W1 i& C3 s9 }% E+ k" F% P2 s& a/ N! Q
The way it works is very simple:
+ t, V# f: B' Y f n. I6 F) \It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
' [" [. l( _4 Q& s9 sWinNT) with the CreateFileA API.( n2 e0 `, ^" h2 J, L2 |$ @
; v" Q0 u" H9 G& {! ^. f
Here is a sample (checking for 'SICE'):
3 _- z1 j) z$ c) x9 q# Y, _1 j5 F4 \! s1 B1 b
BOOL IsSoftIce95Loaded()
$ u: S& D% W j0 N X6 S( j! k{
% G; E4 @& ^% ~+ A9 ` HANDLE hFile; * H. J9 O# b- R* U, r
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
, M7 W' r6 v6 \0 r6 b FILE_SHARE_READ | FILE_SHARE_WRITE,0 S; U. Q d5 ~, e' f
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
4 x% P; V' B7 o if( hFile != INVALID_HANDLE_VALUE )1 I* N: }5 D0 }0 s9 q( e
{
9 q* V! J! V5 i CloseHandle(hFile);. N, e3 S( M9 s. w( L( {
return TRUE;
I9 D( d& y1 W: R5 Y' e }* M* a4 j# h# F8 T& u6 L1 _
return FALSE;5 F9 F' | i& L; T; w7 p9 f
}$ |. {9 s. x) w; t- K3 c
- d! [; L; V1 A( Y; m5 W7 d) w4 S3 D
Although this trick calls the CreateFileA function, don't even expect to be/ T& Y5 F$ }$ n1 }8 f
able to intercept it by installing a IFS hook: it will not work, no way!- C8 \" [' ~- j- K: h& B7 @& N
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
; |" j6 V- v# D, K4 c, w( |service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)4 O. ^. X; T9 W5 W7 Y6 U7 N! q
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
y5 Y1 t7 m9 z# M6 {# G: ^field.0 Z6 q7 S" B, t) g& I% u8 c2 t
In fact, its purpose is not to load/unload VxDs but only to send a
0 u, y5 g; l4 t/ PW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)( Q; ^: P& q; k5 f* N Q; X2 w
to the VxD Control_Dispatch proc (how the hell a shareware soft could try( E# I' G9 _6 w% l& v6 K, I0 l$ f
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
7 ]: n, |- z& O: @$ d0 MIf the VxD is loaded, it will always clear eax and the Carry flag to allow; ~3 H! T9 d1 O8 |2 [+ n
its handle to be opened and then, will be detected.
# m) {8 _# X6 g% _" u# lYou can check that simply by hooking Winice.exe control proc entry point8 X2 c# p" n, k" I; I
while running MeltICE., l2 Q9 k9 X- T/ r& p! X! K
8 `* U3 K7 P, {1 `5 P# \. t; k" z9 Q" d% Z
00401067: push 00402025 ; \\.\SICE; W+ d: p8 K+ o t7 I
0040106C: call CreateFileA
4 V% }1 b, b+ }) b 00401071: cmp eax,-001
1 p }) j4 @! P& S: {' P5 F 00401074: je 00401091& b) A7 J# g$ Q! {
) D$ l8 a% t5 l! b
3 ^. B" u4 A" M- T$ @# ~There could be hundreds of BPX you could use to detect this trick." h' E8 e; B2 t7 i
-The most classical one is:5 Q) S) _* M3 t+ C
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||- G3 X" R) ]* z! _7 h' B: u; s$ b
*(esp->4+4)=='NTIC'; N, N4 @" _" z+ F8 V/ E
" B0 j; q. o; m4 v& E-The most exotic ones (could be very slooooow :-(
0 v3 K$ |* k) v9 N BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
! R/ N9 W: w7 x* v" u6 H% Y ;will break 3 times :-(' l* s* c. j0 b% [' t' |$ `
$ C& ]( M! E; p" {8 ^$ m-or (a bit) faster:
1 v: K! z2 _% B& O BPINT 30 if (*edi=='SICE' || *edi=='SIWV')- }, ~3 \8 v1 n1 F
. y) [1 a( [) G% i. g8 {( o BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
8 J! ?: Q8 |, ?' ], {2 Q; t; ~ ;will break 3 times :-(
9 [, V# V- k; F' u
) R% _2 A) |. {, Y7 e& V-Much faster:# N) k1 z4 t0 v' r; f$ X4 I
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'' S9 `$ e6 Z8 {& `8 Q3 s0 R q
. X& |* @9 a6 ENote also that some programs (like AZPR3.00) use de old 16-bit _lopen
" f a( u: i0 |function to do the same job:8 Z- M" K" o: G
/ v0 A; l6 d: i) V" \ push 00 ; OF_READ
# y. s: A& W; O) w8 x/ |. O7 \1 e' k( ~ mov eax,[00656634] ; '\\.\SICE',03 D Z7 B6 n1 g: Z# B; M; t1 O
push eax
( y) o# f1 U2 o call KERNEL32!_lopen
1 a3 N* O4 ?6 v7 T, }9 o inc eax& X0 F# y# N7 I8 k" `
jnz 00650589 ; detected
^" ~4 [5 @, L9 {1 P7 B$ G- K: n push 00 ; OF_READ1 I2 A' i# l- g: J% m1 N
mov eax,[00656638] ; '\\.\SICE' _( {+ s( W' p* J0 [
push eax/ D/ k8 L P9 s: E5 V( S( Q
call KERNEL32!_lopen% M0 l# [# a5 W _4 N) w- `
inc eax
# u- ]! c |6 X/ u- P9 h jz 006505ae ; not detected/ h% f# s2 y2 b/ ^; q. O5 v
3 d9 L+ G ?$ c' ^: N
; k5 o( Y( ^- T* H- R__________________________________________________________________________
3 Q/ Y, S. j8 H% x1 e( N! F2 m8 D9 S
Method 128 L* s! L! F: a8 N$ e
=========/ ?, K9 n6 j7 F* N7 J7 v- Q
$ G, h7 G% F. N$ R/ R4 w3 g
This trick is similar to int41h/4fh Debugger installation check (code 052 t7 w' q8 Y1 L% x' K* Y9 O7 k3 w
& 06) but very limited because it's only available for Win95/98 (not NT) S2 S, E3 o% q/ N7 {" K4 o
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.: Q- x6 b' m/ K: k4 T$ }* q( U
8 X; D; o: m# f& @& |3 Y push 0000004fh ; function 4fh
: N7 b$ V$ e' |- |% a( C push 002a002ah ; high word specifies which VxD (VWIN32)3 Z& V! i9 X: h" M( U8 i3 I
; low word specifies which service0 s" E* s. `# t
(VWIN32_Int41Dispatch)
: F, ^' @ |* n$ F& E call Kernel32!ORD_001 ; VxdCall3 E T9 ?$ L# A) [
cmp ax, 0f386h ; magic number returned by system debuggers/ M: Q$ _3 W. K' p. {9 ^# H
jz SoftICE_detected3 k8 g' P7 J7 |8 x# ~) ^8 Z
1 `6 Q; A. N7 v; E- p! |* p0 R
Here again, several ways to detect it:9 ~4 f- |; G# |0 R4 f* \
2 X9 M# H7 ^2 d- p& G0 w0 ?
BPINT 41 if ax==4f* `5 r8 s, x9 b
7 D7 @; G* h5 e; Y+ i1 f BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
7 d. ]& k8 ?- l& H
- l5 v5 r* P- G. t/ t: Y- @ BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A2 t6 s' E+ D& N
9 p* ?1 c: ]/ y } b
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!, }+ a3 k* W8 z5 @* b2 s8 R4 j
, Z( M, a" b) e1 Q. `__________________________________________________________________________: b# X W0 B% N: _, V- c! I
0 g" L$ f/ o7 x" U7 N
Method 13+ A- \6 ^4 {1 h' y
=========3 v7 G" c% J, @" q
0 S0 W1 @% w" ` m. b7 E$ aNot a real method of detection, but a good way to know if SoftICE is
& k. e/ O; D. Ninstalled on a computer and to locate its installation directory.5 j9 `+ _1 A4 j; Z0 s
It is used by few softs which access the following registry keys (usually #2) :
, [" C$ E, }3 x0 _( p, T2 N7 J9 Q
2 e' T& u( _: f3 W5 Z3 r-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion- D( C8 E/ J7 \3 Q" K! b8 g
\Uninstall\SoftICE, F0 T# q5 o. J B+ @4 Q% {
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE1 `% ^8 _. J0 }8 d6 y2 c& }
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion# i+ V! ?4 p/ r! D
\App Paths\Loader32.Exe P5 k" E/ N4 m, G' d
& U) e7 K3 M% k5 q" J8 t7 X+ w2 b. E/ @9 M3 y7 s7 a
Note that some nasty apps could then erase all files from SoftICE directory( J- o3 g y5 G6 O+ |$ g! E/ \
(I faced that once :-(" T2 s! M) s% ^$ j. {: O) ?
+ I' |: v# L4 JUseful breakpoint to detect it:' {! h5 x% u0 _) w( Z
( K+ A. k8 `+ G BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'( z- m" G, r3 x; h
4 o9 M! O( O. q) v" i
__________________________________________________________________________5 [5 U+ [0 b3 E: I* G; [5 }/ X5 J9 ?1 q
9 r, \1 p2 ~7 B1 P h, H0 K
$ l8 e, ]2 ~! d1 g# ]5 h
Method 14 ; p4 v6 F2 c, C" M3 z, C: M% Z
=========( b9 o" y4 G9 F! J' t
- L! S. G: g* C# ]0 R4 b
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
( `/ v' ~( b/ E w1 Kis to determines whether a debugger is running on your system (ring0 only).
7 e ~; {$ z p7 o; H. ]2 I3 z8 R& F" m! p1 D' I$ d1 B* M5 `" o
VMMCall Test_Debug_Installed: ^8 S& p) v3 M( t* @/ J
je not_installed9 q9 o2 X+ C5 b5 U l/ m1 c3 |
2 t0 _: j4 K) B* MThis service just checks a flag.5 x% x! e( _# f b3 L- Y/ i+ L$ W; A
</PRE></TD></TR></TBODY></TABLE> |