<TABLE width=500>
8 i) x; E v& ?7 Z/ }6 w<TBODY>2 f+ `+ K. R. Z1 B
<TR>! C6 j' y5 Q. K6 V' U
<TD><PRE>Method 01
: s) Z; p1 s9 o; P=========1 l3 `, A) t" T7 m8 |
# c) P4 M+ j4 c# S- {5 a7 u) M8 I4 f* U
This method of detection of SoftICE (as well as the following one) is
, j! }8 g& Q4 c6 u4 n6 Nused by the majority of packers/encryptors found on Internet.2 r- d% O9 Z7 k. l: \/ D. ~$ [
It seeks the signature of BoundsChecker in SoftICE
4 l$ J6 S/ z2 W2 n( }3 N% {% m: X Z9 V; ^* h1 [5 p# t4 X
mov ebp, 04243484Bh ; 'BCHK'
~4 z+ }) ^# @; X mov ax, 04h9 h4 g: N# }' r* _4 F) E% u
int 3
" _0 l# z! X7 i4 V cmp al,4
+ N) f1 _, Z o) ]& ]2 `" k jnz SoftICE_Detected: C) x6 \* d& N
% l$ }3 p) L9 x- T4 A___________________________________________________________________________" X8 A$ k/ u0 u$ [# Y) \9 O
$ D5 k3 v3 ~$ H2 ^
Method 02! _7 A% T6 a/ ^: H/ b7 g3 @
=========! t" q7 ]5 o; R
- H0 v2 |2 w2 Y& N' c% Z x) i8 n
Still a method very much used (perhaps the most frequent one). It is used
. Z! K0 v: Z$ g3 Z8 _' T0 Mto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
5 h! a) O# v* |& n: |- qor execute SoftICE commands...
5 ~4 z. D7 d: P ]! x& b% Z3 Z4 TIt is also used to crash SoftICE and to force it to execute any commands* c% a O* W3 w, g
(HBOOT...) :-((
' C; O* n4 s1 }
: c% l$ N9 r# {) `3 QHere is a quick description:6 B- Q/ a$ V: p) S3 e) ^. g
-AX = 0910h (Display string in SIce windows)) @8 _5 ^$ u& X! D+ P
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)! ~5 P1 a$ K' \4 ^/ P4 V
-AX = 0912h (Get breakpoint infos); A5 l4 N4 V; u1 F
-AX = 0913h (Set Sice breakpoints)' `# ]/ M8 D1 `6 V
-AX = 0914h (Remove SIce breakoints)/ g+ `* }) {6 U4 R: j2 z' k* P4 D
; ]" O' C1 @: w8 \
Each time you'll meet this trick, you'll see:# F/ L- u& |# _/ ^0 b
-SI = 4647h- J! l( u- y1 _( p1 ]4 ?
-DI = 4A4Dh
6 E- S; }. H% t& NWhich are the 'magic values' used by SoftIce./ E5 v+ ]2 P3 t4 t
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
; D1 V( H- M# x: O3 c3 l$ ~4 C' B9 }9 [# ^3 v% n5 [
Here is one example from the file "Haspinst.exe" which is the dongle HASP- p# Z( a+ ?. A E7 n/ x
Envelope utility use to protect DOS applications:
3 l2 ] b5 K6 r9 T& \- |1 C$ q1 B
$ J6 [' d9 x$ O& F( R4C19:0095 MOV AX,0911 ; execute command.
8 \& Z8 v$ r6 a, r0 y. d4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).0 i3 E1 m, r$ U, O6 f
4C19:009A MOV SI,4647 ; 1st magic value./ {, }8 Z! l% c8 K
4C19:009D MOV DI,4A4D ; 2nd magic value.: ^& H" V+ g# y! O6 g! ]
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
- N; R/ U' c7 q4 L* L4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute5 m1 g$ m, f4 w! y- q+ c& f( Z8 n
4C19:00A4 INC CX
$ L; J) a! @& m9 Y6 j& [% E- W4C19:00A5 CMP CX,06 ; Repeat 6 times to execute4 h) H7 w: E0 }" L( d' n5 j1 R
4C19:00A8 JB 0095 ; 6 different commands.5 v ?: o: K9 ?1 s/ {4 q0 j
4C19:00AA JMP 0002 ; Bad_Guy jmp back.
8 A1 X E0 p0 V- s* {2 i! f4C19:00AD MOV BX,SP ; Good_Guy go ahead :)1 y* G1 j$ k: R. _. l* o
1 ?- E; n; T; `2 q
The program will execute 6 different SIce commands located at ds:dx, which1 P& D' D. k4 G
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
$ M8 m" _/ }6 T( {4 r' m& b1 Q3 R$ ~' ~5 }$ v1 X9 }9 A0 D9 l
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
( o( k+ y4 Q: B' B; H; X' \4 g___________________________________________________________________________) S) C; p# M/ y, P
8 S0 Y; L: H9 l- P( U- z- \ h2 A$ m
Method 03
9 c6 c, r: u+ b) ]& T. J* [* r$ a! C+ }=========" C* k! w5 G @* _7 q, q4 u
: w8 P; O9 ^" ]/ M/ N/ m
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h1 T z- r3 J; ?1 n3 I; B
(API Get entry point)
* ^+ k( n+ U! l$ P( N$ t4 m, Y V0 ]! Z. I. z, g
3 F6 ^3 D3 S0 r8 V- e' H: P
xor di,di. N2 ?3 L: Y0 y5 c9 H! j* _
mov es,di; M) \5 J& G1 L9 `+ p8 j
mov ax, 1684h
2 u8 _# f3 H& c' ?, M mov bx, 0202h ; VxD ID of winice" T1 t/ B. [# Q3 z2 t$ V" J
int 2Fh
# p% f, B5 v% ~ l* ~( M; l8 r mov ax, es ; ES:DI -> VxD API entry point/ u# n& X( }5 L
add ax, di
. r5 i' R6 N5 I+ v test ax,ax
4 }6 [& n. Q3 x9 ^9 W jnz SoftICE_Detected
/ y) ^7 E5 T1 x; d) p! F' ]- z7 O5 ^' G. C
___________________________________________________________________________
8 A5 r% v5 q. l7 H0 ?) X, m; s) } A5 J/ r
Method 04
0 ^, ?1 s; R+ R/ p; a7 f9 a! K=========7 M0 m/ X; z, X2 J6 M6 F
6 E. _$ G# g4 {; ~; F4 N
Method identical to the preceding one except that it seeks the ID of SoftICE' X! J9 S, ?$ h9 j( Y
GFX VxD., n/ K! x' `# W% V& @
7 \# X" D2 a5 _ xor di,di+ a8 g9 P' t- n3 K4 [9 N8 l
mov es,di* g( }* F& v+ l" C h
mov ax, 1684h * X$ i6 I9 U( \: i% T& }
mov bx, 7a5Fh ; VxD ID of SIWVID
1 O; S6 P' ~2 a/ L+ \" G6 ?1 P int 2fh0 w! |) P3 t2 f# w% v2 I
mov ax, es ; ES:DI -> VxD API entry point9 R2 `2 q( b S# v9 A1 `2 i
add ax, di- u5 B/ h0 j0 ^) a
test ax,ax3 C( c& i3 c2 o( z, K# Y5 J$ O
jnz SoftICE_Detected7 R7 s4 s$ Q) l7 J. m; m
( W" Z" I3 U; o6 g( x__________________________________________________________________________
* M/ |# @! i' q
6 g, z1 y/ ^) [* u5 I) v: P7 `7 Z7 ]1 }3 l+ s
Method 05/ f5 m; B" a& H: L5 P5 v1 c% S+ \
=========2 Z5 x5 L1 E$ Z" r: Y' V
/ b S4 |3 D! G9 G; K7 I T8 IMethod seeking the 'magic number' 0F386h returned (in ax) by all system
4 B! Q- a# [! _0 G3 kdebugger. It calls the int 41h, function 4Fh.2 _( p1 S, C0 m, }
There are several alternatives.
4 A* ^+ D) _0 c* K7 z- v8 v+ q2 d6 m6 T" l- Z7 M9 p* [0 f" o/ P" o
The following one is the simplest:
4 R" f& ]8 Z( a7 U. V8 D' E6 }0 c D; Z8 k5 M
mov ax,4fh4 q7 ]+ N) J% Y0 W0 j
int 41h, b; k1 T) z9 e2 a: q
cmp ax, 0F386
[/ h0 ]2 m1 x2 g+ F4 w5 A jz SoftICE_detected0 T0 w7 x$ w$ e$ s# [ a. M
- P0 V6 L0 m, y; q: U" S5 O# Z$ b2 i$ X
Next method as well as the following one are 2 examples from Stone's 8 | k G1 i+ |% C; Y7 f
"stn-wid.zip" (www.cracking.net):
3 o! l. e0 K, V, h" A& R
5 P9 [6 t& f) E0 O9 w. V j mov bx, cs$ P8 j2 H8 U+ s$ I8 p6 }7 u; V
lea dx, int41handler2, e0 X5 b! \+ Z
xchg dx, es:[41h*4]0 x( F8 |* u4 M" ~7 ~/ o$ Z1 g
xchg bx, es:[41h*4+2]# P$ V1 A% m( j+ G' M2 P! x
mov ax,4fh l$ m" F2 h% c; _; i
int 41h
: j9 X8 B4 F: L, x) { xchg dx, es:[41h*4]
% f! J1 z0 E1 s xchg bx, es:[41h*4+2]
6 G# \- }; D G, Z9 h& L7 A$ g cmp ax, 0f386h
+ ]$ N5 b5 p3 Q7 } jz SoftICE_detected8 a' e" N$ y7 k ?5 F# P
! F# L1 f, J7 x6 `0 F4 Kint41handler2 PROC w2 ]; I- {2 V
iret
. u6 Z! m7 e) G" fint41handler2 ENDP$ R+ D1 E+ ?7 `
/ Y; b0 F! \/ y9 G
8 y) U& G; d& E) v5 l_________________________________________________________________________1 a: p2 ~; V; I( g/ D$ Z
% _. n' A6 {" u* h
^1 d" p6 [: z# f2 z
Method 064 D" C$ h2 Z- c( {6 ~9 o
=========/ o; D5 ?9 `+ k
. k) w, g5 C5 g
9 |! c3 b# R3 p9 c2nd method similar to the preceding one but more difficult to detect:
# m+ g- a- E8 g8 G9 X3 U
1 t7 x5 W1 j& p0 S% K l% t3 E" N% q3 @3 x2 z
int41handler PROC
5 u6 T- i9 z7 k6 w8 q2 Q8 J mov cl,al* i5 c0 o+ u: B1 a V9 t
iret* ^" V! F; ?( F7 @* R; u
int41handler ENDP
5 ~" n6 Z$ M% v
$ \# K+ L; R+ X% _/ K$ V( J' R4 C$ A1 t( ?5 m
xor ax,ax9 X( } c) q, z
mov es,ax
3 d' @& b# H+ W9 L4 y7 E mov bx, cs% m i7 i( k2 s( D
lea dx, int41handler8 x5 `+ E' S# N; Y5 s" G$ A. e
xchg dx, es:[41h*4]
8 M7 ~1 x) V; }3 |7 g xchg bx, es:[41h*4+2]- t" b% t: M+ a. Q9 _
in al, 40h! u0 ?, _, K7 k! F7 W
xor cx,cx
. k- I( ]' E& `: L- \ int 41h
9 d& y$ L9 l; `5 a xchg dx, es:[41h*4]
4 g' y7 ? q2 O7 i/ X, } xchg bx, es:[41h*4+2]
& a! r( S: [9 H: o! N1 a1 |* t cmp cl,al& u; S9 U/ [ d2 h& x
jnz SoftICE_detected
0 {7 k X8 W' Z! X$ k2 R6 U8 j8 d% |" C3 ?! b
_________________________________________________________________________
8 J+ ?# x, z; |, d7 t9 E
0 Y6 R6 T# B, G' W. J0 fMethod 07* R9 U/ z, `* f( E
=========
: Y, l! `1 Z) z
6 @+ Z3 f7 G A6 a5 |2 V7 S7 ~Method of detection of the WinICE handler in the int68h (V86)$ e8 x2 |, W0 V. e6 W/ v' S; ^
6 o9 q- r* V; O8 ?9 ~: M+ d. G mov ah,43h
2 |7 ]. r6 M* l/ ^' s5 a) X1 ^ int 68h
" ~8 x7 u, j7 x* W cmp ax,0F386h
/ k0 X& H7 S z jz SoftICE_Detected* s9 M' P8 F# \" Z' ]6 r
4 }. D; p/ V8 Y* x2 y, F
" P" P" f- ?5 H( n1 y7 i7 D=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
# A$ c2 x: q0 I. Q app like this:
) _5 W6 ~; P+ P4 k) y. U& _) G; {3 k2 Q' X1 ?5 n, t9 V" i
BPX exec_int if ax==68
/ y, t8 z- W# h5 X! u (function called is located at byte ptr [ebp+1Dh] and client eip is
" F0 q! R" ~/ H located at [ebp+48h] for 32Bit apps)
, q7 S# Z$ c+ Z3 R: X3 p7 W# w__________________________________________________________________________% }' f" e/ i5 e2 E/ ]( h5 @: Q. R
% q0 b9 B6 r# O
6 \% a/ d& B6 ~+ h" oMethod 083 ^* V, Z) n; l! Z( r! a
=========, u$ b* O7 A0 q( N, B* k" }6 E- N+ {
9 R' }: ?1 C( c, pIt is not a method of detection of SoftICE but a possibility to crash the7 n" ^3 x8 N8 z
system by intercepting int 01h and int 03h and redirecting them to another
6 q3 o# z- U: O# qroutine.
( l4 H. y4 s9 q9 E; B% Y" tIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
! {/ `! G8 p" \9 Qto the new routine to execute (hangs computer...)0 |2 n' M' e" ]& l+ E N. [
# J. W5 x* t. F3 [4 Q7 k
mov ah, 25h- l: ?9 E9 \# ^+ W6 r+ \; W7 ~; a
mov al, Int_Number (01h or 03h)# I0 [; J) i) o, F9 i2 F1 g7 v9 x' k
mov dx, offset New_Int_Routine: V F% G) t0 g" F
int 21h3 T, {" J/ f2 Y( q% W
& v; P9 b4 ?( \3 \ a+ n5 [
__________________________________________________________________________
" L/ m9 l0 Y- T, B
1 B- Y! b8 y& S8 @5 Z) PMethod 09' C1 t8 o0 n3 D z1 S' Y2 D
=========
; J0 p: o' r1 g( n# N* h- A$ I% t/ l/ e
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
+ [) X' x3 w4 j4 Wperformed in ring0 (VxD or a ring3 app using the VxdCall).. ~* \# _1 @9 D
The Get_DDB service is used to determine whether or not a VxD is installed8 V# x: z3 R: }
for the specified device and returns a Device Description Block (in ecx) for, U O7 ]" A/ B" ?3 V7 b
that device if it is installed. |- H% J4 @7 P) m
2 w! d; O) T5 y) [( N& X mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
. S9 s" }% z) |8 @+ e& z mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
% K' h& F* T! i3 P+ X VMMCall Get_DDB# ~: ?1 o* V- n! P+ U# O8 }% z
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed* Q4 h( K6 _+ m' R% ` I
( c" j) Q, ^# ]4 J% t- g4 b6 B0 H
Note as well that you can easily detect this method with SoftICE: f7 ?# `' A3 P! _5 o1 ~2 h
bpx Get_DDB if ax==0202 || ax==7a5fh
# F1 q+ J& F& _ u# F' M$ y, r) |
* \9 N7 v- c; k% A9 B3 G__________________________________________________________________________
) p% v" {& L/ F* t3 C, [ y( y! a8 q- O3 t
Method 10
! M* x+ E: _/ W9 J% P* B: Y E3 L=========* M' z) q9 T7 z9 x$ |& U
+ A/ h* t+ a1 R, X) }; r=>Disable or clear breakpoints before using this feature. DO NOT trace with& B! _; `! U; V% L4 r+ l% k( X
SoftICE while the option is enable!!6 P: A \) G; e, j+ _5 e/ i' @0 m5 t' G. N6 o
A9 j" M2 x7 n/ l! qThis trick is very efficient:: o Z$ g* u8 O
by checking the Debug Registers, you can detect if SoftICE is loaded$ p M! f. w. Z7 h7 z$ L$ ^
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
- r; O3 w0 D4 \; V }there are some memory breakpoints set (dr0 to dr3) simply by reading their3 E' p. E2 i/ \$ A+ D
value (in ring0 only). Values can be manipulated and or changed as well E5 p/ P2 A* @& D
(clearing BPMs for instance)
: J4 q8 \& G9 o4 n! c& e$ S; D- J+ v5 w" e$ D8 a
__________________________________________________________________________' J, i5 W7 s* a. N }. p& J
, @0 ?3 p& c1 e$ N$ I7 M; yMethod 11
/ I) Z9 \* c9 n* B, v=========
3 y: t) C7 w4 I7 h: z6 y5 O0 ~ x1 V
This method is most known as 'MeltICE' because it has been freely distributed: q' }0 R, p! ]% V5 ^& n
via www.winfiles.com. However it was first used by NuMega people to allow% K( Q; ?( u" w* O) ~+ a. p5 Q7 c1 u
Symbol Loader to check if SoftICE was active or not (the code is located
g/ ?0 ]5 }! qinside nmtrans.dll).
; G) B2 z' p1 P; w& O( T1 y
! z3 i9 M7 s ?1 w0 U9 @* UThe way it works is very simple:
1 ?. w& H+ E/ p0 f s6 KIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
# I D: i; B7 N+ o5 w BWinNT) with the CreateFileA API." n' F* e3 `* g8 O" N
8 Y7 X5 r: s9 i, H+ }Here is a sample (checking for 'SICE'):8 k2 c( m0 k- b/ P( W
E, I! a2 j( w( S2 UBOOL IsSoftIce95Loaded()0 m5 ^0 ^& Q$ F1 X$ H! q
{
+ E) |. T: x* X! _) K0 { HANDLE hFile;
9 `9 n$ n# A! [% y3 [ hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
# o2 e: v- J H2 x3 z FILE_SHARE_READ | FILE_SHARE_WRITE,/ P/ u3 p1 v; C" G1 J' z
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
- d" r m8 Y7 T/ _. ^, y if( hFile != INVALID_HANDLE_VALUE )
; t" I) A; }9 y. b. l9 s. w5 b {
& u( E$ g2 t% @1 k& l' E CloseHandle(hFile);1 N" C3 \2 K- ?
return TRUE;7 W& T) p! c% u# m5 \
}& e2 V3 B; U+ t* ]2 ] ]
return FALSE;& L f# h. Q. m" S6 c3 y
}. K; o) \# c0 `- `3 ~& O; L
$ k+ z2 R( j* U
Although this trick calls the CreateFileA function, don't even expect to be
2 {: B; V4 N& y, Vable to intercept it by installing a IFS hook: it will not work, no way!
- a4 o( r. _" e! sIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
, D2 ?$ A- O; Mservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)# n. f: `6 M. s5 P7 K- Y# _3 c8 H I
and then browse the DDB list until it find the VxD and its DDB_Control_Proc3 t8 M/ R! M: h. K) {
field.4 F* ?7 E! a/ _ K
In fact, its purpose is not to load/unload VxDs but only to send a
: Q3 [7 _5 U5 E2 d3 y# R) }! eW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
) l, e! _$ u8 }$ _! i, Tto the VxD Control_Dispatch proc (how the hell a shareware soft could try
& M9 m3 ^3 F* Ito load/unload a non-dynamically loadable driver such as SoftICE ;-).+ j* R& ]* {8 G' k. U; T3 j
If the VxD is loaded, it will always clear eax and the Carry flag to allow6 R) |& |. c s% U+ t4 u2 D
its handle to be opened and then, will be detected.0 `2 R; I8 j7 U
You can check that simply by hooking Winice.exe control proc entry point9 O* e* P z# H* Z2 l4 Z1 O9 Q& P0 K2 v
while running MeltICE.
/ V7 _8 A" }+ n; f& l' \- {' b# n$ |7 V3 W# X
. |, X5 X, k" _ l 00401067: push 00402025 ; \\.\SICE
. _/ t" |# r2 D' y 0040106C: call CreateFileA3 a( X6 o( b5 s. e' i. ~
00401071: cmp eax,-001) x# @6 @; P3 I+ j
00401074: je 00401091 B- Q& Q7 W! u. E8 }% Z# g8 y
; \' g0 t5 T. `; x, ~7 @
0 F9 }" V0 {# H: @% h8 @There could be hundreds of BPX you could use to detect this trick.
. J4 D$ u* Q, o- U, e6 W-The most classical one is:
2 n3 q& U, z1 U BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||6 E8 j6 O! _( M1 z+ M: w
*(esp->4+4)=='NTIC'
* t0 H* \# \4 g2 f8 V( S! b: J0 a) f. N9 R& ~9 n3 A6 t2 {
-The most exotic ones (could be very slooooow :-(
7 r$ ]2 I# `6 r1 I# Y' C BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') 8 b8 z. @; O w4 N! ]. \1 N
;will break 3 times :-(2 B; @. X/ X& f$ F0 }3 P
7 w7 O* y4 y* @0 g/ S4 h-or (a bit) faster: ; q. O: v% W, W5 Y* h* o
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')# T& }0 ~2 q% Z9 w
, z5 r* Y! t. S5 \8 E
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' & g$ f' \ ?9 `$ e, W7 v: G4 K g: Q8 l. a
;will break 3 times :-(
5 q' X R7 C* K5 w! U9 n) V4 z* |% d& _3 u4 ], _* d
-Much faster:( y; j& y9 x( H
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'6 m' b( \3 f0 V e0 t2 n1 X+ I
8 z. V* q* Z% u2 Z/ i1 V4 H7 v& dNote also that some programs (like AZPR3.00) use de old 16-bit _lopen# l+ F, b; j9 \# i! l6 K/ `0 J
function to do the same job:% c* y8 r W! J2 d% s
% ]$ N* _" T6 T0 M push 00 ; OF_READ' _" H! e& r( M' m8 F
mov eax,[00656634] ; '\\.\SICE',0: F. j" N; l2 c2 [
push eax; I5 y; f: F1 S# ]
call KERNEL32!_lopen% Y; J# e% d. Y# j2 D
inc eax7 M0 B: y1 K7 G
jnz 00650589 ; detected7 p% f# P5 g6 F& r
push 00 ; OF_READ
+ a* d2 Q3 S& S9 n1 U* s mov eax,[00656638] ; '\\.\SICE'$ F* E# Y# ], n h) _
push eax
5 c" r2 d* ]4 k0 ^ call KERNEL32!_lopen
# f8 d5 A4 W0 N/ r$ ?- H4 j8 v! m inc eax
+ R& b' e0 x" V1 L7 x jz 006505ae ; not detected
+ [9 K3 A$ W7 L" d1 F; F- G( | ?$ r* t& m
1 ~6 y, k3 Y( y1 Q$ [1 v) K
__________________________________________________________________________/ k% D* t+ P: i/ \
/ {# {. K% x+ r. e& WMethod 12; l& P+ N+ u l5 r! J& z
=========! Z- I4 V. p2 n) N8 X" X, N' y
) P" y- L% F' d) y& A( O3 r# ]9 AThis trick is similar to int41h/4fh Debugger installation check (code 05% R8 e6 m" K" }
& 06) but very limited because it's only available for Win95/98 (not NT); J. _' E+ [0 D3 ? v$ y
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
3 @+ L% M5 `( L. w; t
$ e' r3 t+ P! Y, t push 0000004fh ; function 4fh
$ O8 r, \( U1 B: ~7 r- c2 Y push 002a002ah ; high word specifies which VxD (VWIN32)4 o/ T S A3 h3 S5 b2 f
; low word specifies which service1 M' m4 v, b# f; S/ M5 ^
(VWIN32_Int41Dispatch), K# s8 o' F! W( J" B8 K& I
call Kernel32!ORD_001 ; VxdCall
. L) M8 C# [- C cmp ax, 0f386h ; magic number returned by system debuggers
- z8 a) X( q5 M) r! R8 v jz SoftICE_detected# ]" T- w; n( O8 ^& I3 t
2 z- B0 j9 [. N' T% `
Here again, several ways to detect it:
0 V/ a1 m9 M8 R' H' ^2 d, k8 W+ E- X2 r2 ]
BPINT 41 if ax==4f5 _ j. p% T" b) f
& i. c, [- G0 ?
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
/ @8 l0 p- ]4 c1 w( c, w" t+ G9 f( j3 }
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A7 b+ \) c) h8 `' M
0 e9 j4 ^4 L9 j2 G0 Q1 i
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
5 E* q* `; f: S {2 h, S. Z- i+ b& }3 O$ L9 Y4 K
__________________________________________________________________________$ ]1 w1 O9 [' B+ G; t% _% |/ R
2 C! a) }" k) _6 h* L6 bMethod 13
. R' y9 @5 a: R* B' @# q=========
a. k/ B" K3 T$ b
, j0 {! r/ U. J5 yNot a real method of detection, but a good way to know if SoftICE is# e# t& D% R2 ~, C) p" g
installed on a computer and to locate its installation directory./ V: L9 F v9 N: G0 k9 Q
It is used by few softs which access the following registry keys (usually #2) :, O- `2 ^& |+ N7 l) v( i
2 m& U, ? E. j. p( {8 _ T
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion' i0 R/ }% d7 L$ h; Z
\Uninstall\SoftICE2 @' S: L4 Z2 A5 f0 A# Q
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE) X5 e/ p4 g( r; O3 U% n( J9 d" h' E
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
8 v+ j% G4 {3 t5 Z/ j; i\App Paths\Loader32.Exe7 {/ S8 n; H' k2 Y( k) A7 W
E7 L5 H# Y7 s- v
5 G. B% u; o5 v; A' p1 gNote that some nasty apps could then erase all files from SoftICE directory0 y; ~. [3 H( n" Q+ e5 j. l" t( c
(I faced that once :-(. o; W# m+ b C& A$ A1 E
0 i; d! E: f& p' q* V \
Useful breakpoint to detect it:3 ?* _4 D7 e G' y
0 q; v- o3 A* L( z( ]$ P BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'- b3 r* K' X' P' _! ^: |1 q' r$ ?
$ _6 P" ~8 ~7 |! w__________________________________________________________________________
: Q2 k2 V- n! f! }, t) l
0 E/ H) z% r6 b* @2 O* G+ p. X4 G$ p$ P1 o
Method 14
% Q2 P, @2 \, C$ r8 B" v0 g( q, [=========4 u2 V, x# M( d
5 Y- ^/ n) X2 ~ \, U7 UA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose. ]9 i. M$ u: a( u, S+ S6 J
is to determines whether a debugger is running on your system (ring0 only).2 r3 M2 l( T7 x. Z( O: g
$ F0 I+ d6 j! [! d VMMCall Test_Debug_Installed
9 H+ p( F! c' { n. K, Q+ S) W je not_installed
8 x- @$ ^2 O/ ^9 h5 k' ?9 \7 h, E8 X! a- `4 B! D
This service just checks a flag.: R f% @5 R( |2 K! M* h
</PRE></TD></TR></TBODY></TABLE> |