<TABLE width=500>( E7 `, C9 i5 A8 M$ r
<TBODY>8 M) Q; Y1 {$ j* Z
<TR>
/ Y6 G' o. q% D<TD><PRE>Method 01
9 ]$ U" C8 H' w9 k9 W t9 F=========9 W) W/ {& q) _* W( r+ x; o
5 A! _2 k6 J0 Y; Z O* VThis method of detection of SoftICE (as well as the following one) is
. @1 z. W7 T5 e* lused by the majority of packers/encryptors found on Internet.
7 L1 M% P3 j H. j+ R5 lIt seeks the signature of BoundsChecker in SoftICE) t# V, `4 o8 r3 d# Z7 y
9 {" S5 O& C8 R; Y) X7 P; J2 } mov ebp, 04243484Bh ; 'BCHK'
4 V g* U0 ?* M/ D+ }6 H4 ^ I. ^7 ` mov ax, 04h
7 w: x' p/ S" `0 E% @+ G int 3 2 s' p4 _4 _2 Y8 k( G
cmp al,4
1 R7 v% t! \. B1 j( `. { W9 M jnz SoftICE_Detected9 x8 p% |' |, D$ ^
- m) r1 Y; n) C2 W
___________________________________________________________________________; ?7 [& ^4 u2 {8 X
6 S& q2 L! |+ x1 ?9 A9 BMethod 02
; W5 T5 B. b6 N6 n=========6 Q5 e5 {7 t4 q. N# ~
& _) s0 C" Q- J8 t
Still a method very much used (perhaps the most frequent one). It is used
1 X/ Q0 Q" z- l1 y9 v# O) fto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
( L# M- P8 @+ xor execute SoftICE commands...$ v/ i0 y0 g/ b( m5 v' p
It is also used to crash SoftICE and to force it to execute any commands) o1 l4 [& a. s
(HBOOT...) :-(( , }$ y* e4 g) Q$ i7 M4 `: D) T+ ?8 i
: P! P. W# j& E# j, A# Z
Here is a quick description:
) J3 O. O0 |. Z+ z0 S-AX = 0910h (Display string in SIce windows)0 j: i. l) F6 P. n
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)& q) U9 h6 S* ^; Z' W- l8 i8 m- g1 X
-AX = 0912h (Get breakpoint infos)% z, U5 _2 o5 A! @8 x0 @* }
-AX = 0913h (Set Sice breakpoints). u4 i! I9 i1 {& ^# O. A5 n
-AX = 0914h (Remove SIce breakoints)
( L2 V; V+ [4 v. z$ ]8 y8 g
& a0 L3 m& _8 H1 x+ i! i2 tEach time you'll meet this trick, you'll see:
) [/ a. q, g2 m! i5 b6 m7 ~) ^: T& C-SI = 4647h
3 R6 i7 R2 V& Y; w2 o-DI = 4A4Dh
5 B$ w4 G) a$ q7 K2 d' @Which are the 'magic values' used by SoftIce.
0 X$ U6 X, X9 i I hFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.- v8 q1 z% Q. b1 h" Y4 G
v! u' @" ^8 HHere is one example from the file "Haspinst.exe" which is the dongle HASP/ I B- D9 {6 e# L, n2 E" M7 Y
Envelope utility use to protect DOS applications:
7 n4 T3 X# Q( a( u" k* [; U( W9 ~$ Y8 [
8 z$ g/ h! [4 [5 H; R5 z* \
4C19:0095 MOV AX,0911 ; execute command.5 Y# I4 b3 Q: Z% \3 n& ?* m4 O
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).* p# ?7 ^! ^, A' s; R
4C19:009A MOV SI,4647 ; 1st magic value.
$ n5 N, L/ @ B( A6 O4C19:009D MOV DI,4A4D ; 2nd magic value.
8 W% D& O+ I* E7 J& `5 ], V: j4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)6 v' K$ S4 L: U0 t
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
7 g4 B- p$ E- V* p5 I8 N4 `4C19:00A4 INC CX
$ Q; }4 H" s# q! P) j ~1 z4C19:00A5 CMP CX,06 ; Repeat 6 times to execute1 K& {# E; L: l. i3 `* x
4C19:00A8 JB 0095 ; 6 different commands.
; C) U' V! M8 o2 R4C19:00AA JMP 0002 ; Bad_Guy jmp back.& F/ E! t" B1 H; y$ a) K& i# B c
4C19:00AD MOV BX,SP ; Good_Guy go ahead :), D$ D& k9 b1 d, ^
2 F r+ g0 O5 jThe program will execute 6 different SIce commands located at ds:dx, which4 L# w/ S( o7 d" ^+ t5 O3 u
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.5 {+ M+ H4 y5 h* R8 d5 r
, D8 E0 S4 V$ K' B* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
# n$ B0 |) @0 N- h1 {3 W/ s___________________________________________________________________________
1 Q3 b, x( {1 T0 Y9 P) z6 _% e& T1 d% U4 l: V
! w9 Z$ s$ o U* |0 K* d5 t
Method 03- L9 i6 {, ^( ] D
=========
! b. ]9 \5 j4 F1 @1 a- X# z, f$ O5 S0 V; g! }
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h7 K; S& \5 T. U5 ]
(API Get entry point)
9 y, l$ C! Y( K $ D( a0 @6 t* o1 v% T3 Q
% X* \2 @" E5 z3 h9 V+ n g D xor di,di
6 _6 g! t+ y* ~2 O% ^/ Z4 W mov es,di
) I, N" A! G$ }( i9 K6 a! ? mov ax, 1684h
+ `6 f. M+ v+ P* P mov bx, 0202h ; VxD ID of winice. D/ ?; a/ o+ X/ j, ]0 ?4 t
int 2Fh" w1 _6 N* G1 H; y+ q. X
mov ax, es ; ES:DI -> VxD API entry point$ e- a& z0 _& F
add ax, di _/ a* s9 D; [; c% l) p
test ax,ax$ C' [: T I" W. s, K$ K
jnz SoftICE_Detected
2 p2 x) y- T/ N2 B( {. w) b3 F: f. h" K4 n1 Q+ l6 u
___________________________________________________________________________
# m( `# R7 ?: Y3 ?
* w5 |; V1 W. `# v$ L9 aMethod 04) y) r# _8 S9 @& Y4 o1 w: O
=========
6 ]* X) V! Z# U9 t5 @9 {. [7 \, n
Method identical to the preceding one except that it seeks the ID of SoftICE
z i! d- F5 |. |& g2 n% OGFX VxD.
8 e8 v4 \: ~& o! `6 u5 u( K8 K7 Q% g9 Z
xor di,di
4 `8 j' Q/ G5 A% R/ k mov es,di6 ~8 O, }" D6 i! e5 I
mov ax, 1684h
# j/ N. w. H$ W mov bx, 7a5Fh ; VxD ID of SIWVID- E6 U4 k" R7 {
int 2fh
. S1 F+ a% m, U% ~! n# ^+ r! I7 d mov ax, es ; ES:DI -> VxD API entry point) `$ @. _% |5 x' T& P/ X2 E( i5 L
add ax, di
7 T2 r K. t# d test ax,ax
; A c0 v, }6 W2 {" I! {8 Q2 e8 X jnz SoftICE_Detected
* ]2 m- x" G; {( a* V
3 Y5 e6 J' G$ u* m5 o__________________________________________________________________________
, g, V$ i; j3 V
6 p; V" S# y: e. e$ G. m7 U
! x6 y6 d1 T: ?) j; b3 I+ ?Method 05" m5 R1 V+ S1 k/ V; L4 w2 Y
=========
3 x% x, C1 H& w( v4 N) G5 F5 p {# u' d9 k( d: A
Method seeking the 'magic number' 0F386h returned (in ax) by all system
. l7 P3 O4 I+ kdebugger. It calls the int 41h, function 4Fh.- M2 G+ G! ^ m. h. s6 |% C
There are several alternatives.
: K8 {7 j- ]9 S! b( t! b. K6 v7 G; N+ Y3 _9 q1 C
The following one is the simplest:
. T5 ?- ?5 X& E* \4 ^
6 | \/ H1 P9 n+ U6 @' f% y mov ax,4fh0 M4 G L/ G% m. T8 ?
int 41h
# u& v6 R" N* O* ^ cmp ax, 0F386- a/ S0 z$ B0 k, l1 ]
jz SoftICE_detected. {) p1 u' z) j, S9 s
0 d) k: V. Y! j( f9 m0 V7 U6 E( N" f! J) ~ J
Next method as well as the following one are 2 examples from Stone's 5 X: M+ w0 N. x
"stn-wid.zip" (www.cracking.net):
& q X- i0 M! E2 c
9 o: {2 ?' B Y3 w3 y- a8 t0 H' Q mov bx, cs
( J% C0 v$ k: g" T6 G6 |/ Q lea dx, int41handler2
6 H% @2 a; h; F% `- c xchg dx, es:[41h*4]
4 ~& J& {' ^3 P; y1 e xchg bx, es:[41h*4+2]7 G1 m$ P$ h0 X4 g7 @
mov ax,4fh
% L* a& ~5 W# l- ` int 41h
$ u2 j3 w) S9 k+ v/ I4 r& h6 V xchg dx, es:[41h*4] v6 S5 p" O8 A/ N s- i% d
xchg bx, es:[41h*4+2]2 j1 [# E2 Q* B) N. H9 `
cmp ax, 0f386h
2 P- g9 L/ t4 u: ^ jz SoftICE_detected& T8 ^$ D4 V% i* O) U) z' D9 N: f" Z
$ A+ R' {2 @" A6 V* Z1 T/ Z
int41handler2 PROC% Y$ a( q; Q/ O. U' i
iret
( ~' n1 s* y9 I3 ]/ |" u# j5 w, Wint41handler2 ENDP
+ R( q6 m) c/ b! P/ d" o+ j1 c( B4 c7 v5 _
6 o4 c+ R9 f. ^* S
_________________________________________________________________________' I! {) K- m, h( T, N( {- ]$ V
' ?$ W% ~2 G3 {7 }- S! ~' U9 ~( A
1 Q( p7 S9 O# W* w. k6 k& a, S+ T0 S
Method 06. C" \+ {* f" t E$ J" i! ?
=========+ d9 j$ o- P- r, j7 L4 \
6 Z4 @, Q& e5 D% u2 A6 D
0 u3 M" W# ^% x. |0 N2nd method similar to the preceding one but more difficult to detect:
% N# ]/ ]6 b! m- `$ y% c/ @" K$ S5 j
& U( Y1 D) O$ n. e& C7 V+ {4 O% m' }int41handler PROC
$ j: R* h8 M9 h7 c mov cl,al% P7 |5 h/ Z+ J. _# G' r2 s, O
iret
0 n9 \ f; s& D4 ^int41handler ENDP q1 J( ^6 I4 {5 c
% \0 @9 V9 ?6 d. l3 J$ n! D/ a% J% C& P0 a
xor ax,ax
# Y1 B/ ~& U& x. M0 o5 x* h mov es,ax
0 `0 h( W; u6 Q( T/ z+ b! n& i* k# q mov bx, cs
9 W3 ]# s2 t/ |. q2 j' h" K& C lea dx, int41handler" I6 k) X6 Z9 e& ~
xchg dx, es:[41h*4]2 I. o4 D- [8 W; r6 k
xchg bx, es:[41h*4+2]
& X& D4 j- y9 Q$ G/ u% l in al, 40h
3 ?: V3 M8 ~, k xor cx,cx* Q# X% E+ _9 e
int 41h6 f) ]$ V3 b Z7 b
xchg dx, es:[41h*4]* N, W# I/ } e3 e- k
xchg bx, es:[41h*4+2]
/ K3 C. i/ x. w1 A+ q; L cmp cl,al
c8 ?% T4 U3 f( {: J# J jnz SoftICE_detected
4 v" \9 T* X; M5 g# ^( @0 I3 ]# ^8 V1 |, Y. \/ T
_________________________________________________________________________
7 Z( L# Y9 k) N: W8 W2 `" {2 D
+ X- X/ `; L3 N' b' T) Z k: g& o+ eMethod 07
% n- C- t0 ^: H2 _1 {' e P=========5 c& }1 S2 ?2 G6 `9 p
1 k# |; A% M2 g% Q# D% ?0 O
Method of detection of the WinICE handler in the int68h (V86)# H5 I1 n4 z6 `- d
4 J7 \% l' c/ p! f$ J o5 u
mov ah,43h# B, c+ p8 t7 E7 W
int 68h
" D" [, Q# ^8 H3 B cmp ax,0F386h) _! J& X% Z. V; x) s3 L/ M
jz SoftICE_Detected3 @* D$ g2 x' m2 k7 i
0 h& N% @, ~! ^9 ~4 Z, ^# H) q2 a0 j4 }2 y8 A4 A
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit' e' X5 c; \! i1 w3 W6 m: G
app like this:
) P% G/ e$ |; Z2 q, g, W
# ]. O7 e. d# C4 V BPX exec_int if ax==68
2 b+ u' i) `% c* l+ l: \/ t (function called is located at byte ptr [ebp+1Dh] and client eip is
$ x' t7 L q1 g- k located at [ebp+48h] for 32Bit apps)
) w# K6 ?5 g- |! h- |: T* \% E__________________________________________________________________________
" H4 i9 x; [2 Q$ G$ p3 H; o$ m% X% P! f+ f0 P0 O% f
4 i S/ B" I3 ?. _4 eMethod 08
1 b! p& p4 u2 L* O4 Q=========& q- `+ K, `8 d3 t8 }8 I
! t# ~) z, j( SIt is not a method of detection of SoftICE but a possibility to crash the' ^8 ?2 U) l& E
system by intercepting int 01h and int 03h and redirecting them to another/ d% m9 j$ g6 z) @7 m: O2 }
routine.
1 C0 `( K' S! {It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points) t+ Z- P) A+ J7 d9 N
to the new routine to execute (hangs computer...)
% x) H) T; U) k O# Z, E3 A8 [% b( @( }+ w7 o$ b, N& d2 ~: y8 X
mov ah, 25h& Q! G- E1 |" R {4 `. E/ R) Q
mov al, Int_Number (01h or 03h)
/ x: E8 i; D+ y( ~ ?6 n6 s mov dx, offset New_Int_Routine
9 S& E$ d" A/ ~* k& A9 R+ s int 21h) O' F( W- b4 @* z
1 [& A/ x, ~; h, H# ]1 [__________________________________________________________________________2 k7 _1 X0 I. B& f2 ?
4 p6 w& W% P0 _' g( @/ K' yMethod 09" L% P2 {/ h; U+ }9 I
=========
# A% `( G6 Q. V9 m$ W1 y: p, J/ _; k0 {" x; `% Y
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
( x$ w0 \# h. g$ X( M% _/ Sperformed in ring0 (VxD or a ring3 app using the VxdCall)." T2 a: o. _1 M0 Y& I
The Get_DDB service is used to determine whether or not a VxD is installed
@: F7 V% [1 w7 P" u ?for the specified device and returns a Device Description Block (in ecx) for2 R+ L1 h' h( ?: @- m C, r8 o
that device if it is installed.; N P/ ~8 ?' z! V$ c' w: p% [
( u+ ] U% f/ M7 K1 T1 Q+ ] mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
+ ~& [) o8 p5 _ mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-): Q$ K8 f' X- n- t4 X; ^' D! e
VMMCall Get_DDB
% u) C( {( \; \- I0 C% g mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
7 G+ T: p% a2 \* O' ~' N% w. g" F% a5 D( _' P1 u) h
Note as well that you can easily detect this method with SoftICE:
6 d' R4 E7 \' F$ K bpx Get_DDB if ax==0202 || ax==7a5fh9 f# I+ D1 T/ _' O
7 ^ g- t! a1 b6 c3 `& {7 N
__________________________________________________________________________
0 S. q& M$ M- N& o- X- q8 H
( s @+ C: ]; F; k$ M( hMethod 10* x2 u6 D0 X% G, `) y$ h
=========
/ }5 |% N w# h4 Z! Q2 A, n, A( Y2 D: R" P7 L
=>Disable or clear breakpoints before using this feature. DO NOT trace with/ C5 b2 r9 Z5 l
SoftICE while the option is enable!!
/ `$ ?2 a( |2 l# X1 J9 g, U
* k) \( C5 v0 }% ?This trick is very efficient:
+ s/ C! `1 y7 {1 kby checking the Debug Registers, you can detect if SoftICE is loaded
2 P. M& L6 f, z7 n3 @(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if. `# ~; M- C; v
there are some memory breakpoints set (dr0 to dr3) simply by reading their' K$ @; q7 u& Q( s4 ]
value (in ring0 only). Values can be manipulated and or changed as well& x5 ]9 H6 g: q' o/ N+ j: I* \4 S
(clearing BPMs for instance), S: k+ G. ~+ x ?) R \! r, p
) e2 A" R; Z% X7 N2 X) H' _
__________________________________________________________________________
& k i4 r$ \8 W8 ~( e! w4 ^( R9 T$ U* r# N# E
Method 11
1 Z Z2 E) }# j8 y7 L+ R=========4 C3 C% T6 ~: f
6 w" ?9 j1 e) X6 ^* y& eThis method is most known as 'MeltICE' because it has been freely distributed1 h4 s5 g$ f5 e! w* |" B
via www.winfiles.com. However it was first used by NuMega people to allow4 L, k7 |' T2 `6 L' W
Symbol Loader to check if SoftICE was active or not (the code is located
2 t/ z' T0 S; ?, g( Z* M) G& Finside nmtrans.dll).
5 H0 x' @0 [% h$ P7 m/ [% U7 u* e) X4 u5 ^/ I
The way it works is very simple:
+ H, L4 m! H+ _( l8 MIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
4 b0 D' g9 I# u2 k4 R P5 uWinNT) with the CreateFileA API.
/ ?+ L( m8 B7 V/ M
/ Z$ \' M1 o4 j7 } |Here is a sample (checking for 'SICE'):; g: L7 h) g* F8 y1 D% l. H
( ]) q) ?* d! f3 h% _$ l( I. r
BOOL IsSoftIce95Loaded()2 V8 ~/ E0 d6 ?+ ?( }# m& L: `
{
; r& w% I; G& d% ?( C HANDLE hFile; 8 u! M# b9 J! h2 t. }
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
2 e0 `, K V1 b% ?$ B0 v' |& i FILE_SHARE_READ | FILE_SHARE_WRITE, o& d5 L( k" S
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
# l! n) b+ w+ p& l$ M if( hFile != INVALID_HANDLE_VALUE )+ R- b' A h2 j0 g* R) g5 M; E
{
, C3 e# l: ]. j( G: ` } CloseHandle(hFile);2 G( s: O1 p( u( O
return TRUE;: s* d4 E4 D; ~- L& v$ b% G+ b: v7 g! V
}! l/ l5 X# w% D9 \
return FALSE;( A" C- ]4 U5 \- `
}# X+ g2 F1 f8 l8 E; @8 T
' R* e0 B0 j. }
Although this trick calls the CreateFileA function, don't even expect to be
1 |2 L4 u8 k2 C8 ]: {able to intercept it by installing a IFS hook: it will not work, no way!# ^$ t! V Z9 T t2 P. D9 n
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
' S/ P( }+ ] j5 v% j& Jservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
2 {4 M* m% h, r5 W3 h3 j pand then browse the DDB list until it find the VxD and its DDB_Control_Proc
?4 _3 j7 Q$ P, P2 f/ f tfield.$ ^ L3 u3 s( T1 ~
In fact, its purpose is not to load/unload VxDs but only to send a
! A. J' ^' U( ]5 w- h! fW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)( b% A3 T8 z; u
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
4 } b3 M: W8 m9 D/ Q! z( m. q! h, M4 |to load/unload a non-dynamically loadable driver such as SoftICE ;-).: ], G* ~! `; O: Z0 _" a+ E" _
If the VxD is loaded, it will always clear eax and the Carry flag to allow
, x9 p7 u' l4 e R) Q* j" J0 |its handle to be opened and then, will be detected.
+ E: |, ?% A5 d4 DYou can check that simply by hooking Winice.exe control proc entry point1 O/ C# U$ B9 @9 `
while running MeltICE. h: S: m: e$ @9 u7 N5 H2 I2 F# H$ ~1 L
( v5 t( ~% [2 e
3 K3 {* M0 U) k- }: i 00401067: push 00402025 ; \\.\SICE$ G& a; F* U: X) f5 G2 ~- c$ Y4 z
0040106C: call CreateFileA
/ Y3 Z& c, z3 ?' ^ 00401071: cmp eax,-001
% w( E( K/ _7 w5 E- H7 h3 G 00401074: je 00401091% K3 g( P) N& g4 U, e
. |9 |' } \/ }/ ?( x* e
- e& d2 g S P. D% c4 p6 f+ I
There could be hundreds of BPX you could use to detect this trick.( ?( K9 [6 Z, n2 o) l. U
-The most classical one is:
& F" T' P/ f( R# Q BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
) a; k' W: i# n6 l: Q! t *(esp->4+4)=='NTIC'; _. L" B- x: e4 p
! N3 z) k! ^% ~* @4 j% v-The most exotic ones (could be very slooooow :-(
- Z Y9 p/ K: H. c! d: L' d: u BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
3 n- a; }& i" ]2 _" T1 s ;will break 3 times :-(
; @5 r+ W" O" s8 Q. _9 X" i |8 ~1 }' Y
-or (a bit) faster: % ?3 A2 Y1 |+ r; V4 R
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')0 M; C6 M3 N* L! V \3 R
: w9 g7 @" x C BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' , h/ I% x% u, P9 q2 K- L n
;will break 3 times :-(1 u9 z8 P. s! p5 z6 E, i! x
& b6 C: f0 _9 I5 O+ U3 Y+ l
-Much faster:8 n$ B' `8 y! f, k. S& B6 z
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
I& P4 B7 v) r# p( W/ U) N* O( X1 W. \) X% R* H- ~
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
8 L. _, ]7 ?2 Zfunction to do the same job:
$ p/ F0 p2 y! k# l3 ~& N
# N% t5 M8 S& Y m push 00 ; OF_READ
2 M0 E% S% }9 ?6 k8 u2 W4 ~6 X1 P mov eax,[00656634] ; '\\.\SICE',0
6 r3 R5 W' Z! Z1 Z& t9 B" P push eax
6 l* e+ j0 M' m- _. t0 k/ K call KERNEL32!_lopen# T4 C& n6 d& z; o7 o
inc eax
( }/ I9 Z% N7 p- n jnz 00650589 ; detected
* J* h/ p z' v9 R- ?9 a l push 00 ; OF_READ( o2 A) b0 U- Q& g" J2 x1 s
mov eax,[00656638] ; '\\.\SICE'* ]: M& F1 g% s `& [( C( j1 {3 D8 l
push eax( {4 X4 B- d6 N
call KERNEL32!_lopen
- f. z( s7 i0 ]( }. y& b+ q inc eax; X+ {! y0 ?' j; H( g6 R
jz 006505ae ; not detected; n7 }$ _2 \2 z* M& w, r7 J
/ J* Q$ i1 I# e; j# S
. q2 m5 P! `0 g' L3 w__________________________________________________________________________
2 J$ O# n* {) L0 ^/ \: j4 `0 D1 A* ]" m/ _9 z" r
Method 12 _4 ~; {8 y& \$ |4 Y
=========2 M9 _% d+ {7 V" @" \; f
; i0 I3 [' M; @2 n# GThis trick is similar to int41h/4fh Debugger installation check (code 05* ~3 j7 _# I4 O6 J7 @. A
& 06) but very limited because it's only available for Win95/98 (not NT)
9 R" k; w! K, B0 k; w# S; y9 Gas it uses the VxDCall backdoor. This detection was found in Bleem Demo.. k0 H1 S/ C5 E( |, M
: J# r$ J' B9 L. }6 Y
push 0000004fh ; function 4fh) D+ a- y0 y! ]$ T7 U+ Z* q
push 002a002ah ; high word specifies which VxD (VWIN32)1 D* j8 L* s. x8 G/ u
; low word specifies which service
/ Y0 C* N) y* U. V$ P ^7 J2 M' u (VWIN32_Int41Dispatch)) y& K q7 x S7 z! d: e* E5 k
call Kernel32!ORD_001 ; VxdCall9 W/ f- |: S) T& j' _: i
cmp ax, 0f386h ; magic number returned by system debuggers3 c- _) C/ d* g$ A" |) t( N$ D# x
jz SoftICE_detected
2 N9 ^* v! ~. m: l1 @9 b
) x* C* E0 _, [, T7 sHere again, several ways to detect it:! e1 J) F# v$ j
' S! z: B( U/ p BPINT 41 if ax==4f4 L" ~$ i7 }5 G% j0 r
: w& Q% \ D8 J2 g3 x8 @ BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one; ~8 h8 x( e7 I/ n! `; i& B8 w# Z. ^ ?
; J" f4 F) J) u! \6 {( k BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A1 O e" R' u+ ?3 h5 c
3 d3 |' h$ ?4 c/ w# y; Y( k, H: T' z BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
, i6 N$ [5 f6 g$ `$ \* k0 @
# u" F" L# A* G x# w) ~__________________________________________________________________________7 p6 ]% ^8 O/ H5 m1 F; _7 ~9 }
3 l6 h7 Q9 n1 J+ N0 R& {. `Method 135 E1 U# F+ V/ K# r; {# U8 o0 d0 k
=========
7 ^7 D o2 T9 V* b5 {: r0 C/ x9 z5 `3 _5 k- o; a4 Q0 A
Not a real method of detection, but a good way to know if SoftICE is
! L! ]3 c# X T, Pinstalled on a computer and to locate its installation directory.$ y1 X3 r! e* h
It is used by few softs which access the following registry keys (usually #2) :
$ E) I; ^& m' k3 }; w k0 o+ s- L9 {! g1 |& X. Q# T4 r
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
) j4 s, `+ D$ Y. Y\Uninstall\SoftICE3 u- A6 _8 I2 a1 a
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
, i! g( y2 T; n/ T* ], Z-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
' P8 A2 H, `6 r) t: _9 H4 |\App Paths\Loader32.Exe) X4 @7 Z- V$ L
7 ]! `& o8 D. f5 E
; A, f) \ l6 p: w. \Note that some nasty apps could then erase all files from SoftICE directory% U* Y/ w3 c# }4 D8 G# w9 F6 \
(I faced that once :-(
0 r. e# K' j0 h' K, S6 o3 e6 ~# A: w" N
Useful breakpoint to detect it:
5 ?, L% A* \% }% l# R' Z8 Q* T8 g0 n
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
$ a w5 k) m' d( _) Z% c
$ t. y, z- G' @7 Q& b) @8 b, J5 u- p) q__________________________________________________________________________
* x! P/ P6 G+ q! @( p) N; H, x2 a) J/ {/ c, I# e i. k O
+ x2 \ S: x2 w! z! V
Method 14 - [5 X" O$ X+ f
=========8 s" u6 n. V# S3 e6 p
6 G" ]4 }& b' ?' b8 k7 v, K- l
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
5 k6 p1 z$ A: s7 v$ P$ T4 N3 e3 uis to determines whether a debugger is running on your system (ring0 only).9 k& [- K' W4 B- ^- R& P9 H/ r9 z
+ |. R; ?# z6 m6 {. B! S VMMCall Test_Debug_Installed+ e. L( K! L- _! b
je not_installed
) {5 O' H" x" n# t2 K& S1 N/ U0 X' S
This service just checks a flag.) X5 X" k% ^3 {1 C/ J' F7 T
</PRE></TD></TR></TBODY></TABLE> |