<TABLE width=500>) \/ X# o$ o/ v
<TBODY>
6 _, i- l; q; {<TR>
, d! J/ c3 Q9 n% `' J2 ?( @$ Q<TD><PRE>Method 01
% |/ `7 J$ Z! l! t( ]0 t0 \=========# }$ u) N6 p/ M) g. v& ^ U% _
% o6 ~8 c4 P0 i( \) [8 l' uThis method of detection of SoftICE (as well as the following one) is
2 [3 K( A7 m% v0 u0 H/ oused by the majority of packers/encryptors found on Internet.
* q# f1 ?8 R$ X! S/ p3 V: Q, _1 YIt seeks the signature of BoundsChecker in SoftICE
9 V: } B7 {9 x' z9 m
+ {/ F% @6 C( I mov ebp, 04243484Bh ; 'BCHK'! A5 U' {* j s' w* t
mov ax, 04h
2 ^+ f0 R$ |' M- L1 N: P% q# q int 3
( @- K# f- s! x0 S2 n cmp al,44 ]/ D) j V5 N+ D& s) `) J
jnz SoftICE_Detected
* u" B+ Y4 V: q3 d- l; [# u0 `
) m" O! I7 S: M) J___________________________________________________________________________# o- i& O2 \* G! L8 B9 Y5 N3 u$ p
" ]1 F u3 d8 DMethod 02
, X. r5 V0 |9 m+ J8 V0 K=========" X7 ~. V9 k k" m, G1 V ]5 y
$ o. ^. f, X+ `6 b3 BStill a method very much used (perhaps the most frequent one). It is used0 H: I% `6 s& G. ~; I/ @4 I
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
8 i) K* w+ A$ e6 a0 b+ oor execute SoftICE commands...: k2 U- d E% c5 V2 D5 L
It is also used to crash SoftICE and to force it to execute any commands/ B( v* k" M9 c2 o, j
(HBOOT...) :-((
7 b Z( c# [# C3 g2 z z) g0 ]6 _1 m, o+ S: a4 s* L: i9 Q
Here is a quick description:% y1 `. l2 l% j2 N
-AX = 0910h (Display string in SIce windows)
$ | h& E7 `' O! ^ H! y4 b2 {-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)3 X% k" [; t: G3 G. v( r* E
-AX = 0912h (Get breakpoint infos)# L% d; r2 z) I2 U
-AX = 0913h (Set Sice breakpoints)
. G# W( o. Y. Z: x-AX = 0914h (Remove SIce breakoints)- E7 z: b4 N# A. V- v
5 j* x2 l7 v9 W4 B
Each time you'll meet this trick, you'll see:
" R* Q3 _7 c- w. C-SI = 4647h, f3 a0 @& H$ B( Q" O0 Z
-DI = 4A4Dh; ~5 B+ d% B4 h& ~6 t+ D
Which are the 'magic values' used by SoftIce.
9 Q. {& f2 \' V, R% `For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
$ }+ v4 U/ {' h' }; J1 ^6 n
7 a8 ]3 h. b7 y$ NHere is one example from the file "Haspinst.exe" which is the dongle HASP
a L6 |/ D! d: N* v7 u E) ZEnvelope utility use to protect DOS applications:
% K, T- V% G, {( `! m9 z5 {% P0 d( @! W( R$ i0 }* P. Q
8 r' {$ |0 @6 x- n0 j4C19:0095 MOV AX,0911 ; execute command.) q/ P% x4 q4 Y1 I4 O" o
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below)." f6 q& ]5 W2 }2 Y- L/ N
4C19:009A MOV SI,4647 ; 1st magic value.% n, J, |8 u7 J, G
4C19:009D MOV DI,4A4D ; 2nd magic value.
+ p0 \7 o: O/ m @% _$ a4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*), d9 I! V/ w( {& R( }
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
2 ~2 C R# a* u/ L. ~4C19:00A4 INC CX- u" e% i" D' ~* d# ?% T
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute$ Z( f# V4 s& P1 h; F. p
4C19:00A8 JB 0095 ; 6 different commands.
, h+ y( q3 ^$ e: e8 N( [4C19:00AA JMP 0002 ; Bad_Guy jmp back.' u7 I- S" P/ [* u9 b
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
! y4 b, _! T+ }6 d: X: D! U
6 ^; V5 @; v& C8 K6 h' Z8 X9 R; |The program will execute 6 different SIce commands located at ds:dx, which
/ \3 `# d4 W- C* fare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
) T4 ? B( U0 B, e K! A1 H; x/ b% h* I+ ?. I; y
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
) P& W; b+ v1 C2 |8 K___________________________________________________________________________! Z& s2 p' ^0 r3 m
4 g0 l* \7 g- i- \5 I
* l3 y2 U5 X. o) lMethod 030 y* [ G$ j1 L. f" B6 v1 T) l
=========7 z( A8 m6 g- N! f; s! U; k4 l
, E! ^& e* i9 y8 D& c
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
' k1 d8 x, {7 Y! q. c(API Get entry point)
2 z' l6 R; F; G6 [ 0 W/ h" b4 n- d4 D
2 ~& G7 j- X. \
xor di,di
8 R: f* L" j' g' l4 x7 w/ o mov es,di0 a! `" L; |! q. M
mov ax, 1684h `. Z/ F9 o# z, D
mov bx, 0202h ; VxD ID of winice4 N, F: h' I& ?, G
int 2Fh
1 I9 Y; P% L+ r mov ax, es ; ES:DI -> VxD API entry point
& z2 y$ A. i$ p$ T# q: K% L add ax, di
0 F: l# n) u1 m8 l2 V5 t" T: U' R test ax,ax- y6 X6 z! \# j0 e9 R8 Y) {
jnz SoftICE_Detected
2 b: ^7 }% u/ ~: x" \$ _# D/ L8 j0 n8 o0 x1 Q& F/ J) P
___________________________________________________________________________
! P. e" q0 q) G4 K6 \- Y, R' d# r* `6 ^* c. ]0 S5 w, N* {
Method 04+ H# j( y* W8 l7 k6 L3 \& P& e
=========+ H% q& ^# W* _+ f" v3 e; L/ C) {
- i* y' g/ x" a& rMethod identical to the preceding one except that it seeks the ID of SoftICE. d: H- `, s$ b2 h. y
GFX VxD.
" P) K, E4 ^7 H7 h, I1 q9 R; `7 ~5 F9 k8 q6 \! c- q7 a
xor di,di# X4 m; q3 T4 J& ^
mov es,di R1 U s" I8 V
mov ax, 1684h ' |% K4 _* _2 Z- d
mov bx, 7a5Fh ; VxD ID of SIWVID
6 p4 h% U/ _. l0 ~7 o int 2fh
1 h, A$ ?" O7 q) i$ n( o mov ax, es ; ES:DI -> VxD API entry point' t( l$ q w# @$ I( V- A
add ax, di
, N+ n/ X+ z4 R3 W test ax,ax
( w9 G0 h& W( S% g# P5 z jnz SoftICE_Detected
) A' H- d, x$ ?, c9 h5 E1 A6 J, @, o
__________________________________________________________________________2 _) P* O9 i9 p) P a5 N
7 Q0 A' a# w9 \, `" Z/ F$ U2 V% F! |; [
Method 05
3 ~3 p f/ H9 C% [8 [3 }5 b2 w=========: m1 w U9 M" k9 A; w; V) V7 i
4 @; k. b7 S) Y. F% E5 j
Method seeking the 'magic number' 0F386h returned (in ax) by all system
) {3 A/ r8 B' Mdebugger. It calls the int 41h, function 4Fh.
( w- h$ N7 R2 K) QThere are several alternatives. 1 a; ]/ z' {' S: b- T
/ G/ h8 h3 p- \+ v3 e+ \/ b
The following one is the simplest:
$ e1 z3 o0 k( Q
y r2 h4 p& Y0 Z mov ax,4fh4 }5 G! r3 B0 K6 o
int 41h
5 j/ V" f! F$ a& {7 b3 ]% ?) f0 \: C cmp ax, 0F3860 r4 H' I: T9 a& W
jz SoftICE_detected
* H! [' K! C+ O3 e* N% q/ ~" d s4 ~1 _/ J; j# g' S# @
, B* j4 X, N) Q/ X; ?3 m5 A5 |4 |! dNext method as well as the following one are 2 examples from Stone's 7 }# j" l7 i9 M) e# K
"stn-wid.zip" (www.cracking.net):
$ V0 k9 V, l2 A! J \; D- i0 N# r
. `; d u5 w: A0 t! @ mov bx, cs
: }0 r1 P# I1 p. ]6 @8 ?3 a lea dx, int41handler2% \4 c7 S4 N7 ~! m
xchg dx, es:[41h*4]
, d5 G" Q, U/ P6 W7 J" [ xchg bx, es:[41h*4+2]
% B: X2 ]8 N% {: x8 X mov ax,4fh
1 ~' C$ Y8 E+ V; L& v( s* k int 41h! W4 j, m. s7 m' s' [1 b# F- t4 g
xchg dx, es:[41h*4]
* X4 T2 n) ]9 j) o& ^- l2 }0 V xchg bx, es:[41h*4+2]0 l% n' z/ j* j0 O! T6 G
cmp ax, 0f386h
) R5 r7 a) M2 W4 ]' } jz SoftICE_detected
P! e2 N7 ~7 e: n7 C* w. r$ ^- v) b, d
int41handler2 PROC$ H. M7 x1 b. X$ I0 w) H7 [
iret
( J$ } A' }* E, |5 C" q! Nint41handler2 ENDP
8 `! h+ {9 F% n) F: x! `( ?/ i2 M* A, ?. g
' M" {# o Z u: ?_________________________________________________________________________
$ R, c: u- f% |1 v( \9 D$ J- h1 Q7 O2 A+ r/ J
+ q6 n" ]9 H2 O' z+ {7 IMethod 06
* u* X( e- d/ D: g4 s; f( o=========, `1 X. ?8 o" l' e
6 ~6 M! N# J* p/ [1 S/ d, O$ E7 I, e& z1 B5 ?; ?, |' G3 D0 f. Z
2nd method similar to the preceding one but more difficult to detect:
* f1 L8 n2 s0 t! `0 \: r4 _6 l! ]
; r' R, [/ y3 y& E: ]& @
8 S* h' Z! a; y+ I& lint41handler PROC
4 k' d4 B* t7 C/ m. I8 e mov cl,al
6 U0 G% I# u, p" C z# _5 [ iret
& v$ [" g2 \/ x/ n0 aint41handler ENDP
I( U) U& J) r0 }, y
7 o3 |$ |0 g% G, O. h" t7 M; x& a5 g5 w
xor ax,ax
A' Z0 c6 A' g( l mov es,ax! t3 |% j( `% }8 \/ E5 E* u* m
mov bx, cs
" f1 z/ T5 K0 i V lea dx, int41handler
" Q8 p. [) K4 a xchg dx, es:[41h*4]: \8 ?& q8 t6 ~9 Q8 B0 j4 J* }
xchg bx, es:[41h*4+2]
+ R* X) V( ] ^/ r( a0 } in al, 40h/ h5 L& v, b6 L. q; W+ j
xor cx,cx
1 D" P4 p/ X$ f2 i int 41h2 v: t5 ]2 L; F" \% e$ B& ?
xchg dx, es:[41h*4]- a# b" D, Y4 v6 |/ h. a2 D- }
xchg bx, es:[41h*4+2]
4 o! |( L. s' U( s8 W" ? cmp cl,al
. [3 d) S6 f& k8 g0 g8 y jnz SoftICE_detected: S( V' _# m8 y) R2 R& Z
4 m( i! W- W0 V6 z1 X" p% \
_________________________________________________________________________
! F" V' l4 m7 B" m9 N4 N4 M6 x
0 D4 g8 P& V% N* TMethod 07
9 y1 v* w$ n7 U: ]8 t& M=========! e2 V8 ]; R- D: z( D2 X* M( |" o
$ b+ {0 B/ G) ]8 _$ t O" C
Method of detection of the WinICE handler in the int68h (V86)
7 C# u4 D0 l; d) l
0 d* o8 A! z3 ~3 ~ mov ah,43h
$ F% ?' v: ]' z7 O3 s, z7 {/ Y3 C1 V# H, Z int 68h5 @' L; v; b4 i, ~ E& v; l& Y1 g
cmp ax,0F386h/ x/ Z7 ~* S) k% Q" u, Q' V [ U
jz SoftICE_Detected2 H6 U9 d K3 W# b. k+ ~$ [% E2 F
, }1 z% u8 \8 |9 P$ M) J$ @
$ E' T" \0 C U& N+ y=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit1 k5 E9 ?) j( p i; a& m: @
app like this:
% k& f2 k5 \4 O; v. |$ F
- i. ]3 T. Q; q3 X" w8 T6 F/ [, D BPX exec_int if ax==68
/ u# ^7 }; f6 ?: I (function called is located at byte ptr [ebp+1Dh] and client eip is
' e8 x9 r# j5 E) R" x9 W. ~ located at [ebp+48h] for 32Bit apps)
4 U- e6 ~9 V: G/ T% @4 g__________________________________________________________________________4 ]4 e% I- x, Q5 a. @2 D: R) H
/ a+ \1 ]4 B, z; i& f( ]* ?5 X. g
3 E, m% q7 N2 f3 Z1 C' e- H$ q% X" ]Method 08
) t' ]& T, b. n! p9 V6 O H! n3 k/ }=========/ W4 F2 v0 q' Q; K% R- S7 w: j
& ~/ g, o5 ]4 T
It is not a method of detection of SoftICE but a possibility to crash the3 ]' w( F: E9 F! a6 K. H7 S; \
system by intercepting int 01h and int 03h and redirecting them to another
8 Q/ Z, J1 R) x; Z" i7 Aroutine.
1 G: j4 }( z) Q( n- K+ uIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points$ B \/ \, ^6 _# d* u; f1 d
to the new routine to execute (hangs computer...)
9 g7 W$ w( S( Q$ Y$ N" g# Z+ s: L1 L6 \8 S& n& A7 y: J7 k
mov ah, 25h
5 h0 W+ S- o+ Y. w, f) t) X mov al, Int_Number (01h or 03h)- {& m& I/ S H( }' t$ Q7 }
mov dx, offset New_Int_Routine& W! C5 Y3 P2 a6 h5 K) g, i9 [
int 21h l2 K# ?) y! K
4 _3 D5 q2 w# ^) v1 B+ v& Y( y
__________________________________________________________________________% B1 L- w$ s0 R
4 X3 T* |% ?. AMethod 09% L) m S5 P! ` [
=========1 B) Q9 d* P: K/ Z" m+ @% p- H
: B- s5 F9 \% B' V& R7 k$ wThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
K0 ?3 y! D zperformed in ring0 (VxD or a ring3 app using the VxdCall).
5 R7 j( g# e% G5 g' JThe Get_DDB service is used to determine whether or not a VxD is installed
0 g. @2 I3 C$ ^" zfor the specified device and returns a Device Description Block (in ecx) for
+ A/ P8 J3 w: O+ N( [ Athat device if it is installed.! h: @6 X" K, j& k
- V) i% u* O3 f& m$ }
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
1 [0 d; Q2 N, s2 C/ h& v mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-). G0 A, ~* B2 X% X1 S9 N/ X$ w
VMMCall Get_DDB" ]& `4 d5 H) g/ j% N( r0 | O, p
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed7 d8 V3 s0 f- s9 `* }
2 U+ W7 i, \6 `+ |0 Y+ s
Note as well that you can easily detect this method with SoftICE:
3 i5 G0 |5 E9 c! y9 F9 W7 }* D bpx Get_DDB if ax==0202 || ax==7a5fh
4 e6 E9 D( b5 C. K7 U# A% ^1 ~+ f0 i, b1 y- C* w$ T0 P
__________________________________________________________________________8 q* @- @* `5 a. F) d' X% Y( K; G- J+ M
3 j7 ?# s. s/ f8 \0 H/ P$ f
Method 109 k7 z3 N6 U: W. U+ x7 v/ U( N; \
=========6 l S, q+ O7 [% G" M) V2 E" S
# g: g. v6 r# Y+ S/ `=>Disable or clear breakpoints before using this feature. DO NOT trace with" p N6 q( Y( p( r6 c" W2 m. B
SoftICE while the option is enable!!8 t( t+ ]& b. Z( H/ Q
3 S% G' g2 _" J5 b2 o3 x( aThis trick is very efficient:
; N' ]7 ~6 ]% Z1 bby checking the Debug Registers, you can detect if SoftICE is loaded
4 h0 f) N: m/ c* q+ K( A$ q% L(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if) @% r- Y0 G% V! p( o
there are some memory breakpoints set (dr0 to dr3) simply by reading their- v% N7 B% `4 q* |; r
value (in ring0 only). Values can be manipulated and or changed as well
/ z5 j8 n' G' N: y(clearing BPMs for instance)
x0 I! L2 Y8 w& M2 v0 e/ c9 |7 G* [( t7 f, v; ]/ }/ ]
__________________________________________________________________________
% s7 J" P1 g4 J; m$ d0 L9 _& M
/ [3 t# f. M1 t$ _/ XMethod 11, z: O7 Y3 z8 ^5 ~6 u
=========
6 w' k# \* a$ k1 i" ?+ E% a/ M) z# Y7 j* N0 t" m' r6 A$ @
This method is most known as 'MeltICE' because it has been freely distributed/ K5 w, {/ k! E) y% V
via www.winfiles.com. However it was first used by NuMega people to allow- a n( ` S2 Q) S' Q- |! |
Symbol Loader to check if SoftICE was active or not (the code is located
0 n: ~; B2 Q% |* n% o6 [inside nmtrans.dll).9 p8 G. m& l: [
3 [( b8 M# a9 E6 {5 E
The way it works is very simple:; M, j d* A/ b/ `7 E5 U
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
# }! o5 X+ G7 Y6 M( [' C, S( aWinNT) with the CreateFileA API.
' F' O" L9 z/ X5 h) z- v3 f+ I
0 Q- E$ s( T; [3 {Here is a sample (checking for 'SICE'):
: [' x+ j9 t% Y+ |( Y. ^1 R$ c! y" s
BOOL IsSoftIce95Loaded()2 G# V% T" X6 l) {! Q8 e
{
8 y+ I v# U1 X( P; _& L) J/ c9 L- w) g HANDLE hFile;
% @: [7 \7 V# b hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,5 ]4 F- ? P) W& ]& x
FILE_SHARE_READ | FILE_SHARE_WRITE,0 M! B: F* j4 N0 E$ m, T. W
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);# ]& Q7 A! S7 R! v
if( hFile != INVALID_HANDLE_VALUE )
+ O4 O$ u2 F4 ` {
/ q+ @3 }. K+ b% M/ p/ O% ? CloseHandle(hFile);
9 e# F, U2 H3 m3 ~* `" F: S6 ` return TRUE;( ]6 Q$ m) V. c9 ?) z; y/ V
}0 p" z$ G/ O4 n6 Y* ?; E
return FALSE;0 i( j$ U) |# [1 F" z2 u
}
' H, }' m$ c4 K4 m4 E/ r) }! e, k$ o. U$ H
Although this trick calls the CreateFileA function, don't even expect to be
! |0 F# q9 V3 L0 [9 z- p" w& ~able to intercept it by installing a IFS hook: it will not work, no way!
/ y6 y5 r& T; e& h( M( u$ SIn fact, after the call to CreateFileA it will get through VWIN32 0x001F1 B: i l e: |7 \# a, x5 I
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)& I1 m- k0 l" w7 S6 i4 a b
and then browse the DDB list until it find the VxD and its DDB_Control_Proc! \- F. k( r' r3 ?1 J" Y' {# E: X8 B8 D
field.
5 H( W% c$ Q4 A: QIn fact, its purpose is not to load/unload VxDs but only to send a
C1 q0 e( m" w* c+ ^, sW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
# s4 d' w% {, r( O9 x6 b Bto the VxD Control_Dispatch proc (how the hell a shareware soft could try
1 r" P8 p4 \4 K B+ e+ Zto load/unload a non-dynamically loadable driver such as SoftICE ;-).2 o2 V% q" V2 {% I- J
If the VxD is loaded, it will always clear eax and the Carry flag to allow$ P+ Y( s, n. |7 M. j ?# \9 O
its handle to be opened and then, will be detected.
( i5 G6 B% L5 u2 tYou can check that simply by hooking Winice.exe control proc entry point
d Q/ ^3 |+ Q; S6 Dwhile running MeltICE.3 n5 B4 V$ o+ H( L
% e: j3 K4 t( v% _
9 j3 K& I# J& L 00401067: push 00402025 ; \\.\SICE4 Z | k3 [. w
0040106C: call CreateFileA" D- }( V {4 s% i7 @+ l- _, y
00401071: cmp eax,-001
' ?5 K6 W% _' f; \; ]1 e t 00401074: je 00401091
$ T! ?" H1 x% e. v( t% m6 U" b% R2 x
6 L9 |- i) Y p+ U3 k
There could be hundreds of BPX you could use to detect this trick.
) `+ M- ~" x% C2 g-The most classical one is:# A) s! W5 e5 _! ]1 j( G* L
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
3 t* L) x8 n# p( y0 S *(esp->4+4)=='NTIC'
% D+ j7 I/ `9 m9 m; J' Y5 l. w
8 i# |: M9 K1 K4 x5 |9 d-The most exotic ones (could be very slooooow :-() |6 T; A& b! f
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
7 O. J6 F5 s. Q k4 ` ;will break 3 times :-(. e9 J+ E8 ^% {/ Q
" a0 t. t5 \, `: O4 r0 X-or (a bit) faster:
! s) r0 ?1 K$ @$ X( M" H BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
; H2 [+ e6 T! j; e% A
& j+ A4 c; B, } BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' $ o2 j: ?0 x0 s, t6 h- X
;will break 3 times :-(
/ n3 Y; J" O7 G$ Y1 J3 n: a. \
+ s- _ N, ^) Q( Y. M( _: V' \' n* V-Much faster:- i _5 C) `7 \/ h3 i ?
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'. k% @2 B% n) w+ R5 Q( [4 K7 o% H* m
k& i N6 c. M1 j4 E0 B6 z8 M
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen5 E5 ], q1 P. y7 `1 A
function to do the same job:
/ b. _7 G# m7 ^5 t3 A. Q9 t9 W
I' ^/ b6 a) Q1 X" { push 00 ; OF_READ: s0 V6 ]! q& y/ u
mov eax,[00656634] ; '\\.\SICE',03 A! \) k- e$ B/ ?, T) D+ y
push eax
2 j5 V4 ]8 D: h/ C call KERNEL32!_lopen
8 a: o! K7 W: d9 V) y) q inc eax
& Y K4 M( p$ |+ {' A" _0 p) ~: w8 C0 u jnz 00650589 ; detected" }) S# P2 Y, R+ ?* r
push 00 ; OF_READ. k" v1 e# s8 X" B4 z7 b
mov eax,[00656638] ; '\\.\SICE'5 t$ {4 Y# O; Z" U; ~ D* y5 \ H
push eax6 t3 J: Q- S8 |3 P- ?. P
call KERNEL32!_lopen
7 I; h! X4 j; g+ F' X inc eax
$ t: U6 N( _: @; X ? jz 006505ae ; not detected" P2 z2 K. x" K4 J# t& z6 A1 \
; b; n4 m- c# I0 U: E/ m3 t% e6 W- A% B4 M" k! J# V+ ~! { x) O
__________________________________________________________________________$ x3 G$ A: j' _2 F: g
. _3 ~ ?8 ^9 I. I4 _% ~Method 12% L4 C, S8 \" S2 H5 l! s% \3 ]
=========2 N- g( g0 `! X" `& d$ _! \* Y
9 _: m5 `: O) X2 Q6 _/ ?3 _
This trick is similar to int41h/4fh Debugger installation check (code 057 C+ Y+ e$ T; S- D$ u' i& Q
& 06) but very limited because it's only available for Win95/98 (not NT)
: ^; \% w7 u) i, a: d: ]3 e) J( Gas it uses the VxDCall backdoor. This detection was found in Bleem Demo.
1 a7 [: l; I( v; |& f4 V8 ~2 Y+ _2 P+ D, Y) m3 F7 x0 J
push 0000004fh ; function 4fh& A) Q y/ I3 A: k; p/ Z
push 002a002ah ; high word specifies which VxD (VWIN32)
1 I+ ?# b# ?0 k% f ; low word specifies which service
+ G& L7 Y1 S4 N# _# D (VWIN32_Int41Dispatch)
8 c: t2 E6 p/ n9 _ call Kernel32!ORD_001 ; VxdCall
3 ~8 }* n7 j2 X" e: `% d' D cmp ax, 0f386h ; magic number returned by system debuggers% _1 g- t7 a* _7 t+ V
jz SoftICE_detected
0 I& w* o. k1 O! E$ ^- D: }$ |' t: @4 D7 |5 n3 e/ a5 z4 l
Here again, several ways to detect it:: ^6 M4 h9 Q1 g$ `" m8 U
! Z2 b. v4 u6 d
BPINT 41 if ax==4f
" H$ o# N$ S" K
O0 v5 a, q$ Y/ K. H BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one; S+ R- o( O0 T& O
! z) K/ X Y- b* Y2 M! L) Z A
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A7 D. Y7 s" v, I: ~4 S4 |
5 w+ |8 P6 F1 @" A
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
8 s' B7 Z2 w1 B0 a
+ Q* r. {7 |9 N" I* s. P+ j__________________________________________________________________________- `+ A9 a8 K/ o
! O7 T/ t9 @) |4 j3 `& uMethod 13) J1 E% }: ^5 j" @) k
=========! R, r% Y$ D" G: |$ [# o
7 L% r6 x6 n$ J, W* W2 I
Not a real method of detection, but a good way to know if SoftICE is
0 _! B, B4 N- }* z) Binstalled on a computer and to locate its installation directory.- N" L0 h! V) X2 K) c1 Q5 ]) C
It is used by few softs which access the following registry keys (usually #2) :
s) @, |0 C* I" @5 u6 f+ o2 R) `5 ~# O- K1 x2 h
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
, Y. p) A4 N& y; Q8 }& [! Z8 }' P\Uninstall\SoftICE& k, y" { o9 D. |2 l
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
2 h7 ?$ R7 R+ S$ `( w$ a5 h6 R-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion/ E" f2 ~9 U+ c# s$ P
\App Paths\Loader32.Exe. B5 O& X/ x8 p- n" H* A
' ~7 w1 O6 t0 `2 V6 y# ]4 W) x" Y3 D
2 Q5 v8 A/ I2 Q4 ?6 z8 G* A% ?8 ONote that some nasty apps could then erase all files from SoftICE directory
7 q* E/ C0 c1 f# _- W; t& G(I faced that once :-(( Z3 c: F6 O; A x9 J/ G
) W, y) W6 u$ wUseful breakpoint to detect it:6 M$ j9 H1 G. ~" O- |9 Z
9 @6 R1 z3 {$ a! I v
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
1 l$ ?# c! t4 M9 b" m P4 A8 n7 u+ d: x8 u1 g. Z; G7 X7 e1 p
__________________________________________________________________________7 o6 I; J q* a. E' P6 z
3 b! V x8 N% l2 L2 M! k% N- l, S7 H
|% z2 ? Q" s B7 C2 ~; VMethod 14 # L2 c4 q# \+ o( v J e
=========1 Q, w& u/ d0 n# Y
- M- M! [. B* _" `; A# A
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose- \ O' j$ N4 u! l$ ^
is to determines whether a debugger is running on your system (ring0 only).7 o( U8 N( p! T8 `& x5 S; O
0 `4 N2 O5 S, m: [5 m, d* l7 P* V VMMCall Test_Debug_Installed
8 b5 G5 M8 J" s' D4 B. U& U je not_installed9 O6 q) d) D/ ^8 ~5 I6 S2 u. c
/ m- d# D' @ z* W$ U& i3 hThis service just checks a flag.& p, C8 R, I) C2 M$ i7 P
</PRE></TD></TR></TBODY></TABLE> |