<TABLE width=500>& B! L+ C0 k3 f" |7 f4 ]
<TBODY>. Z6 F, S! n. O/ q. u7 |7 Z
<TR>
7 Z# ^; k& q0 {2 _) o<TD><PRE>Method 01 ! U2 @% T( E' N% o( ] x! p
=========
$ C: [( A4 K% K/ x6 V
- F- v0 e& j- [7 XThis method of detection of SoftICE (as well as the following one) is0 n1 d9 D; I P& F- ^& a9 u
used by the majority of packers/encryptors found on Internet.4 j( K+ z3 I% [
It seeks the signature of BoundsChecker in SoftICE
4 [% {0 W1 F9 V7 Y6 S
% A3 {% G$ o. L$ c: R mov ebp, 04243484Bh ; 'BCHK'
: v1 z8 U$ x& P+ ? A5 J* D mov ax, 04h& N& n3 c& R' D H
int 3 ' D9 ?, s) o* H) X
cmp al,4
, Q1 ^7 M+ o' l: x) f" S; p# j jnz SoftICE_Detected
* m4 M' t0 j: X3 t1 c
1 H6 k+ y4 X. T7 Z* g___________________________________________________________________________
9 e. j `1 u) ]0 D" | }+ f# e# p: U- b. K
Method 02
* [) A" j! u9 I1 T; a0 @=========
& k8 J/ E7 o6 c7 v* Z: d! h$ U5 G+ f+ W6 B4 [
Still a method very much used (perhaps the most frequent one). It is used; [7 G, N4 {5 g ?- Y" H
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
! H. _. Z o9 kor execute SoftICE commands...
8 A5 H7 ~8 S' V$ Q; w3 |! XIt is also used to crash SoftICE and to force it to execute any commands* i) M$ E8 E0 H
(HBOOT...) :-((
( h6 \/ ]! g+ P: `! A6 o |' g
* B* _4 x: h- c8 PHere is a quick description:
5 @1 v4 Z9 V7 [2 ^5 `7 r( c-AX = 0910h (Display string in SIce windows)7 i- L, q" A0 Z: @% q; w N
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)# p- q) D- O$ B+ Z) M- `
-AX = 0912h (Get breakpoint infos)9 E" \: K z8 t6 i! Z7 f' Y2 B
-AX = 0913h (Set Sice breakpoints)
! L( W5 l/ \8 J2 H& ~ T-AX = 0914h (Remove SIce breakoints)
& Q! g" b: Y% \' Y
_4 `2 k, D) r# ?& ]( }. iEach time you'll meet this trick, you'll see:
* O+ _- S( Q: p, w-SI = 4647h$ U8 W! }) f$ t& T H5 c* p
-DI = 4A4Dh0 ~! h& T* c& r, B& z
Which are the 'magic values' used by SoftIce.3 M5 t9 i. a/ M
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.2 R$ e3 k4 a5 D
; V, |$ H/ S5 d: U; O
Here is one example from the file "Haspinst.exe" which is the dongle HASP2 w% U7 N3 P/ p% l8 _+ h7 y
Envelope utility use to protect DOS applications:
0 S6 ~2 M. @5 g* {# \+ U# S, |, ^8 E; P
: ]$ W; ?0 y6 {7 r" x* y9 B3 E4 s/ w
4C19:0095 MOV AX,0911 ; execute command.0 J J" g5 I5 _% ~& ]
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).* X, n5 M/ i( U5 Q! _5 n
4C19:009A MOV SI,4647 ; 1st magic value." M7 `8 D$ ?* `' n5 c0 F' N, b
4C19:009D MOV DI,4A4D ; 2nd magic value.2 W' Z1 s5 L+ E4 Y: \, S1 D
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)5 T5 E, m# Y6 T0 ^- _: K
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
3 }7 L2 K7 r( i* k4C19:00A4 INC CX# G& {' _0 C, U- \7 g5 _/ i' c
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
* }- J; V- X; U! m8 Y+ X4C19:00A8 JB 0095 ; 6 different commands.$ G, T# M/ i9 T6 j& R b. ?
4C19:00AA JMP 0002 ; Bad_Guy jmp back.
+ Y$ W, r* o" E4 G$ E0 n4C19:00AD MOV BX,SP ; Good_Guy go ahead :)3 c/ }1 |( a! z. w: U$ _
. m2 e" v) }1 t& r( g7 UThe program will execute 6 different SIce commands located at ds:dx, which
/ G* D- F0 d" o, U9 I; @are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
: _- Q6 U1 L& S2 o9 P. w
& B7 g# b& f, z b/ H" H7 E* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded. a3 B/ K3 ^7 O; y
___________________________________________________________________________
5 I5 M( }$ n5 i) x/ `& W5 u
$ R9 s) }% z' N# `) \1 R7 S* V% V9 C3 w5 h. }- l
Method 03
& v1 q3 l: C. S# G5 m7 Z=========
* S3 Y6 R; L- Z$ E8 @" ?" f0 Y# d: I
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
7 H: {! C6 N# ^* L X(API Get entry point)
; n) `# W* x+ L0 c' r6 m & K, N$ i$ a5 k6 \
5 W$ H7 g! W7 m. s
xor di,di# w) M. `0 A; A9 i" R) ^) A
mov es,di6 }* w% Z( c7 `) q
mov ax, 1684h
/ q6 Z6 Z. P% r0 o7 \6 n/ { mov bx, 0202h ; VxD ID of winice
, r: V, n7 q1 ^; w int 2Fh
; K3 M% W( @6 f5 S mov ax, es ; ES:DI -> VxD API entry point
3 G1 i0 @9 w1 T9 ?. W add ax, di
% r, ?+ y! T. u8 s# V test ax,ax2 Q1 |3 `- C+ V4 a& ]/ n2 X
jnz SoftICE_Detected. d2 ^+ f% b* g8 I3 V4 ?- ]5 I9 }
/ H8 X; A: v/ T' w
___________________________________________________________________________& M% o, e4 e5 @' P8 a" @# k
9 [# o& s+ j2 X% |) ?9 LMethod 04
& }9 u+ n! W, H" h9 I=========: C6 J- x3 L- }2 `$ \8 x
+ A0 X; q! } I% ?: I, X
Method identical to the preceding one except that it seeks the ID of SoftICE
, Z' ]- D! R; K/ t/ d- g) BGFX VxD./ F# r2 a- W3 T E2 R& h/ Z; O+ ]; I
4 k) i1 K+ d0 @% u xor di,di/ t" f; O6 V, H, r
mov es,di
P' Y3 X. _+ W! ]5 C+ A5 X mov ax, 1684h 5 l# ]1 _" A) K* I+ u F
mov bx, 7a5Fh ; VxD ID of SIWVID9 e+ o* `' ]" b
int 2fh4 Z" F' o# V! X2 E0 U
mov ax, es ; ES:DI -> VxD API entry point
' |4 T4 [" [$ W; G* E add ax, di. `; l( F$ g l" `; |& w
test ax,ax5 A+ Q3 c) J; K0 Q. U
jnz SoftICE_Detected3 p5 P0 ?" W& p9 k
/ U1 X+ M. _. @* V- i
__________________________________________________________________________; u# v$ s) V0 p2 d8 @0 Y. |
$ l* M8 ? N8 {( |3 J* z- k
& V. I- e0 b% Y, I1 ^- lMethod 05
9 p+ c8 p3 `* N9 C=========
5 \" r0 G6 \4 j9 f4 c
& o* Z! f4 y. H' qMethod seeking the 'magic number' 0F386h returned (in ax) by all system
6 a7 ?# e/ N. o/ {4 Edebugger. It calls the int 41h, function 4Fh.
, b/ f1 |2 j! `; Q* P7 YThere are several alternatives.
4 H, D' k9 J' X# u
: I& z+ R1 u, x4 e' b+ i/ rThe following one is the simplest:1 H; y+ C6 l m( y
9 k7 k" Q2 z1 w F. d
mov ax,4fh# c, Y5 c5 A7 a7 m# W) {
int 41h9 W- \$ Z$ t: m; x, \
cmp ax, 0F386
, E: w" c% G8 U jz SoftICE_detected
' |- O) h% [9 I- G7 G0 `$ {6 Q* s$ M
8 y' y: |) K) |5 _; G! K# `* g: M9 S* k7 ^7 j) Y
Next method as well as the following one are 2 examples from Stone's
4 P! D1 j+ `5 Y0 R: x"stn-wid.zip" (www.cracking.net):; q& m; z7 |* e. J8 k
1 O5 x7 S9 z# W% o mov bx, cs
0 S: I: K, o# _5 v; G: ?2 \' a lea dx, int41handler2
0 Q, ~- Y- z! ^. V6 g/ ~9 g9 ? xchg dx, es:[41h*4]4 T" k, U" @ x. v/ A% L) l* ~
xchg bx, es:[41h*4+2], D) U* \! g: l2 A
mov ax,4fh: x0 F8 Y+ c' u6 ]; F+ G
int 41h8 r" r* T6 ?: I- }
xchg dx, es:[41h*4]
: v8 u1 D! h. A7 t xchg bx, es:[41h*4+2]
% J0 L. g- U3 g cmp ax, 0f386h
+ b F2 y& L9 U' E jz SoftICE_detected
8 N+ L% x( n! U9 f, L4 K6 F3 x
% H' m8 u* Q) b# p5 {# E( D/ ?int41handler2 PROC
0 j) c1 p- Z" M1 X) a. x iret- D7 C; J) z$ s% U' x% y2 T
int41handler2 ENDP
n' b7 U; v5 T" g# g1 p0 l. w% j- I2 I9 K% g3 i. {
0 }% J9 b- @2 V. j) ?_________________________________________________________________________' r8 e" u* p- P) t% j
. [' Y: q& X5 N- a6 M8 f2 U! \0 u; T# N5 x. T, Y2 P5 @
Method 06
0 Q6 Q$ W* |# n' x: d1 w, _- F=========
% n& i: v% m! \1 _2 K! ?: ?
( s! {% t2 m5 z$ A3 x' ^$ b4 V% P5 \( O% G9 ~" p2 Y
2nd method similar to the preceding one but more difficult to detect:& i* B3 }( f) a1 L2 K
3 O0 `: W3 ~" p8 ]
/ ?; l9 A- [/ W }; I# lint41handler PROC7 v% e; E% J% w! X
mov cl,al# M+ p/ v3 ~% m# O! c
iret2 {+ R+ Z$ f5 \% E& I1 J
int41handler ENDP
7 K" U# o+ T. A! u2 l% h* f6 y7 D; V1 e* x8 O/ n+ X2 Q1 \
% {; ?( ?( ~1 Y& I
xor ax,ax
6 }( u+ d" G- F a% N mov es,ax
) i* g3 L2 Y" g% Y+ L: b mov bx, cs, E& U* z1 R0 {# ]" o) G- ^
lea dx, int41handler
9 F# f' G, a; D' u4 ? V xchg dx, es:[41h*4]- R; o& S, S* R) s
xchg bx, es:[41h*4+2]
5 T; r9 u, S7 F- A0 X in al, 40h
/ b: p$ ?/ ~% U xor cx,cx$ a7 `9 j/ |" T
int 41h
5 p' ^1 Z+ L& [! s2 F1 r xchg dx, es:[41h*4]
( l! G5 _8 L2 c5 `( @ xchg bx, es:[41h*4+2]
% |4 a9 c1 q+ s" v cmp cl,al$ _4 M* b$ T, D8 W8 T
jnz SoftICE_detected; n1 {' S' ]* U) N1 r
8 O! \% C2 r7 h) ^1 y_________________________________________________________________________
1 L6 p. a v1 c- d, X7 y; C/ ~" }/ v5 t
Method 07
3 m, M: c+ F! C. I, S" y$ p+ x1 r=========
% y D Q& ^. N3 {4 B
/ t" e# G" J' ]2 |9 HMethod of detection of the WinICE handler in the int68h (V86)
: e9 C8 M6 f4 a6 F- T0 I8 S, k7 h9 V: D9 M
mov ah,43h
5 \% K0 s" U/ s( G; n) }% K, n! ` int 68h
1 [4 _ p+ h t J( m cmp ax,0F386h$ ?: W: N, c3 ?2 }! y0 j
jz SoftICE_Detected6 a& c: N# q& ?, M2 o
9 t* {* t: k4 F( x6 Y/ _" N- j2 \9 J/ p7 u# ]( m
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
0 Y5 P- g c2 a1 ~7 `+ R app like this:" D- O9 ~% i* X7 |9 N" \' y/ Y
; I p# x- R4 ~" C2 z% x+ ? BPX exec_int if ax==68
6 P/ A7 R4 L6 ~ (function called is located at byte ptr [ebp+1Dh] and client eip is
) P7 X1 c, _2 |/ Q located at [ebp+48h] for 32Bit apps)
H# W5 d. y0 H__________________________________________________________________________
/ R/ l [6 P5 B" l2 K! a) U$ }; n4 U% C
4 C' l% U a `6 j0 ?
Method 08
6 c" Q1 v! X' E. t" q/ Z=========
. K2 p+ [4 G8 O% K- h- A* f7 y+ `8 R- Z
It is not a method of detection of SoftICE but a possibility to crash the
& a5 X" B! b7 V( A( w; j$ Xsystem by intercepting int 01h and int 03h and redirecting them to another' v' s9 r+ a% f: U* g; c- b
routine.. n W4 |, `& \1 [. e
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
; O2 P2 x. W" ato the new routine to execute (hangs computer...): O2 X4 y" G( T1 V$ v
4 P+ I5 N+ {! [; w7 s5 l
mov ah, 25h$ S; k. ]; t+ y: g/ {- ]) u, s- U
mov al, Int_Number (01h or 03h)( V1 H# k7 [, Y( k' S2 S
mov dx, offset New_Int_Routine2 G- N7 j; E; C1 y
int 21h8 Y& n8 p3 _. m- Y
: ?8 `! s5 x& E4 F: B; R
__________________________________________________________________________
; f3 J/ K4 G6 E) C; [* C9 s: E
9 D, N r( Y" q1 @) \! iMethod 09- q. S( E; `) z9 r! c2 }
=========2 y% `: w ]2 N
+ V9 |. k/ }1 c2 CThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
) S$ `' i! ]- b& g/ h: ?1 |performed in ring0 (VxD or a ring3 app using the VxdCall).: H5 j3 j' v/ Y2 w# C
The Get_DDB service is used to determine whether or not a VxD is installed
" @2 T: f" u! |for the specified device and returns a Device Description Block (in ecx) for
( c p( G. G& l4 w9 X- B) Vthat device if it is installed.% G1 A7 T+ s: u5 J3 ~
) } r( f$ [. r I4 d$ i- M
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID& U* F% j1 `/ J# v3 n8 L
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
# q! b$ h9 N4 Z$ w" e0 y. }4 a VMMCall Get_DDB
1 n9 _3 @1 v, d6 m. K* X2 } mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed- T% k* `9 k! D4 p9 O
% H1 |( H9 d" ONote as well that you can easily detect this method with SoftICE:
0 n* @/ b9 b) N! H- z bpx Get_DDB if ax==0202 || ax==7a5fh
: r7 N2 C0 Y- e) U, E7 A: n' O1 G/ h+ V
__________________________________________________________________________% [% t: J( ~9 b( k5 E$ p0 r
+ U/ ], o, L( ]* w1 `Method 10
. ~6 S- v" Y Z8 ~5 ^3 {. K# T=========
; J9 U; K5 e, M8 k9 E+ z
% q# s- x7 ~/ F1 k6 {8 p=>Disable or clear breakpoints before using this feature. DO NOT trace with! ^! ?) E5 A7 a5 z) w# e
SoftICE while the option is enable!!/ ~+ ]; |. O) f
: N2 g' [7 n! S% M- S0 f
This trick is very efficient:7 k- B: L' u9 @+ [; I9 y
by checking the Debug Registers, you can detect if SoftICE is loaded
, c; B6 t( h5 R(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
7 |# ^1 O/ G+ Y& z0 [/ d8 Ethere are some memory breakpoints set (dr0 to dr3) simply by reading their
' X! B3 i0 y5 K( f# Xvalue (in ring0 only). Values can be manipulated and or changed as well
' @% C3 x9 g7 h! K/ C7 i3 s9 W(clearing BPMs for instance)/ `3 Q& b& E* ~- \9 \9 A
* B0 H/ L' |# t$ N6 z d/ G6 Y/ W__________________________________________________________________________; q1 D2 u2 R5 |7 |/ c% Z
5 @% H& a) g9 ^: y, K& L0 U
Method 11
; q8 U& J1 \$ [% S2 m& T% e4 B=========
- f8 N5 w' ]: Z; j
4 f& P8 x8 l5 W9 {' yThis method is most known as 'MeltICE' because it has been freely distributed- r$ p! _/ V+ ]9 ^
via www.winfiles.com. However it was first used by NuMega people to allow
0 q( Y5 u, e7 S. aSymbol Loader to check if SoftICE was active or not (the code is located; `- D) D1 X k/ `/ ?% B/ }# q
inside nmtrans.dll).
/ s( Z0 \ w! g1 t9 p1 g/ y3 f, g O; J
8 S- |" o' r" [8 I" U' `The way it works is very simple:
: ?4 b' U, R& P8 y0 aIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for# b# f' d2 j# a& z6 u" i
WinNT) with the CreateFileA API.
1 e9 B8 o$ L; G: W9 I" j
8 i/ y% |, y) b+ O. R1 x- ], o& j- [Here is a sample (checking for 'SICE'):
: w3 o7 B; p$ j' v& Y# X# v
2 a. T. f6 `1 aBOOL IsSoftIce95Loaded()8 x8 j* d, d9 M8 O; A
{5 o! b5 c! O$ ?
HANDLE hFile; - @$ n* E, I% ]0 g- G
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
' b# p& M+ d3 M FILE_SHARE_READ | FILE_SHARE_WRITE,
/ A. h# |/ w. X' B/ C3 Q; a NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);: {7 m; ?' {. k+ n" |( T6 c2 o
if( hFile != INVALID_HANDLE_VALUE )
, b$ B' Q/ i1 e {
5 c4 S* ]+ q# D9 s CloseHandle(hFile);
: V, V1 j$ W7 h5 \/ r return TRUE;
& n6 N4 I( v x, P6 m* j- y }( {( k* t7 ^1 x% U
return FALSE;5 n0 `4 T& }7 X" P! U, r+ i
}
% ^6 S3 _/ C0 y- z+ r8 k- ]( B5 |/ K$ u2 n. b) s
Although this trick calls the CreateFileA function, don't even expect to be' f1 i$ m/ S4 r. B2 F J5 [% |- M
able to intercept it by installing a IFS hook: it will not work, no way!$ Z, R( y N$ z- r; Z
In fact, after the call to CreateFileA it will get through VWIN32 0x001F- |& T8 Q" [+ w! K2 Z
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)" U% J; K" T4 I, B/ D* |
and then browse the DDB list until it find the VxD and its DDB_Control_Proc* r5 O7 Y4 r' U
field.
! R& }3 e. O+ ~In fact, its purpose is not to load/unload VxDs but only to send a
/ D6 m4 ?' a F7 x0 G4 q. JW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
; o& b( U& g# M8 q l, yto the VxD Control_Dispatch proc (how the hell a shareware soft could try; M, `' }( k `7 \& v( K' A/ w
to load/unload a non-dynamically loadable driver such as SoftICE ;-).+ F, b) I: t& T7 r5 q
If the VxD is loaded, it will always clear eax and the Carry flag to allow; S* M0 S I9 J
its handle to be opened and then, will be detected.
/ }$ U5 ?9 @/ B! zYou can check that simply by hooking Winice.exe control proc entry point
8 b/ m7 O9 ^. u. Q) l# v% Q7 ?% Jwhile running MeltICE.
. p) T5 A% R8 U4 @0 w# V8 r
2 Z2 O, D2 e4 h2 h2 E2 N
( X+ x! e2 D1 \4 x, ?( A9 O+ e 00401067: push 00402025 ; \\.\SICE
0 G4 m2 F, ^3 Q- j7 E/ y. C 0040106C: call CreateFileA
& b+ _) A" v4 Z. Q }7 O 00401071: cmp eax,-001) I8 I9 h, p! x9 @$ u
00401074: je 004010913 k3 {* Z+ ]; B L
5 I' Q5 T+ T7 J3 k) G6 I* U) l- e
" Q, V; |, v! M k; i$ i3 T# NThere could be hundreds of BPX you could use to detect this trick.$ P% o' C. Q' t, ?6 o3 N. ~) w+ t
-The most classical one is:
7 a5 @3 m# x0 W0 a BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
' v; v# ?( o- `$ ^7 f, k# g" d *(esp->4+4)=='NTIC'' Q0 g, Z( i4 U
; x; |$ M v, O-The most exotic ones (could be very slooooow :-(: M' ?- a2 r5 {- [
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') 5 k' K+ f+ _) u4 ^
;will break 3 times :-(
2 B. e. A4 e! C6 t1 Q9 j- E+ D
7 }; t0 Z4 }; k-or (a bit) faster: 8 K2 S) q: y: o& j3 M6 e6 ~$ Q
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')8 v% X1 p3 l' M) z3 ~
p+ P3 a& j! p9 Q
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' ) [$ l, J0 L$ e, u1 {
;will break 3 times :-(
8 u8 v- z; ~$ R
9 {% ~- R- M- s' n$ ?9 E-Much faster:$ Q7 n$ N/ F" l. ^7 P
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
x, d. b" G2 Y8 ]( s" }+ w( e3 n6 v) C( i! {
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen& ~" Z3 E( f7 l H$ d
function to do the same job:
+ { N' ?* k! W. y7 n: n. G. o9 L; w; T0 C9 D- r/ x1 L
push 00 ; OF_READ
, j1 g z3 V- x+ d mov eax,[00656634] ; '\\.\SICE',0
5 y. A9 }+ G1 {* p6 f push eax
4 M- O$ q4 n/ N2 k4 r7 N* ~+ ^ call KERNEL32!_lopen
$ W1 C- q; Y7 C7 V& N* V5 x inc eax
& E1 a$ P% D: m8 V' D jnz 00650589 ; detected
! i& R: E0 [) w push 00 ; OF_READ0 O4 D* I' Z2 ~2 }# _0 A2 m
mov eax,[00656638] ; '\\.\SICE'8 O3 \ r, t9 C$ y& B6 `1 z8 z
push eax4 g3 i5 ?$ n5 _; A5 U
call KERNEL32!_lopen% Z' R9 Q$ E" B7 Y! A
inc eax2 H- k$ K; I$ Y" r
jz 006505ae ; not detected1 D0 p. u" d. e# m2 O- r3 i: N
- c' u- S- E# l, Q# M
1 @' m5 H, P8 N__________________________________________________________________________
$ _) K& f. U! o: n- R3 a3 H/ G
: V9 T3 X7 [) s' [Method 12: N/ f# R) e+ a( M2 K/ s
=========0 E; F& l% ^- b2 Q5 K9 l
, A( O* L) G) U7 o
This trick is similar to int41h/4fh Debugger installation check (code 05; W" ]' _, v6 _2 Y- n! ]& K3 {- }
& 06) but very limited because it's only available for Win95/98 (not NT); {( a z6 s* K
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.0 I7 n, N7 Q Z6 A9 g% q
/ |8 Q! O- _/ P1 F6 Q; P, X push 0000004fh ; function 4fh
; P" J+ L$ i* i2 ?$ R1 ~% x push 002a002ah ; high word specifies which VxD (VWIN32). v5 \1 o+ t+ p1 P% m* k& Q, P3 Y6 @
; low word specifies which service9 v- G4 w8 Z$ Y; I, _2 n) e3 v7 @
(VWIN32_Int41Dispatch)
; j+ f4 H! t$ U5 k. U* ^9 Z2 A call Kernel32!ORD_001 ; VxdCall
5 J4 y/ u d1 K: l# e& E cmp ax, 0f386h ; magic number returned by system debuggers- Z, l G. i2 R) Q' {5 d ?) `
jz SoftICE_detected
& \4 Y! e5 F [
. {2 B8 f) T+ ~! ?+ dHere again, several ways to detect it:
n9 U3 b3 _" w c$ r5 D
+ E+ F$ a; m8 ~ BPINT 41 if ax==4f
6 U) R+ K: ~: h3 ]9 j8 ]" B
5 V' t5 _7 o4 U. T. S) P BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one6 H2 P- O0 L" {" `4 Y0 T
/ _4 I; D- a ?+ E; Z! x" N
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
! ~; w. Q' a, I+ b6 \ B9 x2 w" T* E( {, J! R: B
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!; b* D/ M" E& U% y9 H/ W$ b
4 k" C5 d0 k+ N' R, m9 b1 \4 a
__________________________________________________________________________
7 O1 U! k" Y( {, _
. l% V3 k8 C, v( B/ o$ M- cMethod 13
+ E; `4 W: v8 Y% A, F4 w0 r1 c=========
2 X) j! `. L8 m1 r; U9 f1 U3 P% ?4 E$ a1 [5 ]9 |
Not a real method of detection, but a good way to know if SoftICE is
2 T+ N+ C& u6 s0 E9 w# tinstalled on a computer and to locate its installation directory.. v, M% a4 D8 O7 E# O3 b
It is used by few softs which access the following registry keys (usually #2) :7 _) `: E0 m- w' ?% k
* b! i& i6 f4 f-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
8 j9 I" e+ j9 W0 n; I( v6 E5 ~' l\Uninstall\SoftICE
. _ }9 U, Q( n! N-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE, P; P1 A! E4 A, H
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
: }9 m8 I- h0 e% w\App Paths\Loader32.Exe9 U: K& u' R+ s/ e$ U
0 u. {7 g2 z; h1 [
/ |* v+ S5 U( T2 k' P8 o( Y" J6 tNote that some nasty apps could then erase all files from SoftICE directory) k' F( A! z g6 m, V0 n
(I faced that once :-(
) j5 F" D6 \, X) T/ ~% _+ q5 I( q2 r7 _9 u
Useful breakpoint to detect it:
% _3 o( Q k4 f1 Y7 ?
[1 \3 }/ U/ e5 X! j BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'" ]/ q I& ?6 G7 T, J4 Y
7 V2 a! A; d4 g6 m$ U9 O" ]
__________________________________________________________________________
( Z- Q- N, w- [# J
$ X0 Z- U3 X0 `2 _, o0 h
* x7 L+ A4 h+ }0 ]6 PMethod 14 . t0 g9 w+ a4 u& r: P
=========( f) ^ K0 N% \1 h3 I6 _ ?% Q
" b z9 g& C' r, N; Y
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose* p" r' g) w4 P# a/ {$ c2 A
is to determines whether a debugger is running on your system (ring0 only).
* n# S+ O9 j1 ?" w9 x" a1 ^$ D0 J6 E& c
VMMCall Test_Debug_Installed5 _) t E9 Q/ h' N. w |
je not_installed
% b" P3 x, f) x q' h4 }$ B# }% j2 A6 @ V ^
This service just checks a flag.
# v% x9 t) Q, n9 t* s* v</PRE></TD></TR></TBODY></TABLE> |