<TABLE width=500>, l; [; l6 |5 o! A- c/ ?' N
<TBODY>
$ c' e* z1 M/ X" n9 F1 y<TR>
9 q) l, U( }. |0 j0 S) n$ G( N<TD><PRE>Method 01 % g9 I% Q7 W. T h U
=========
K& \' l- t+ Q& s
2 M [7 h' ?6 [7 Z' JThis method of detection of SoftICE (as well as the following one) is. ?( F. c" n" F
used by the majority of packers/encryptors found on Internet.) k) P, ?* M) q4 F2 Y- i, X
It seeks the signature of BoundsChecker in SoftICE
1 K5 y! I" B8 L5 j9 t0 E8 P( @
' y# j/ ~) K8 f W- G6 S$ b4 z2 C mov ebp, 04243484Bh ; 'BCHK'! `2 C' V$ F. C7 C' I
mov ax, 04h
9 E4 d- u& U6 {; f( e4 z1 n J int 3 - n* w2 m7 K6 Q, _$ Q
cmp al,4
1 k. y; M; b5 ^ n1 O jnz SoftICE_Detected
2 u X1 L. H' i4 }) p! E2 m
% _# T4 k' E) I* p$ g1 [___________________________________________________________________________
. }+ [: d+ ]. J/ J5 w0 \3 E+ N
2 J, p/ {3 c' sMethod 02' [1 x2 x6 _. j" k$ g2 c% S1 X, Q
=========
5 W, C2 Z# ]! `; R7 C, a; Q4 E! c- t0 H9 [ g
Still a method very much used (perhaps the most frequent one). It is used
! W' u* x% T q7 pto get SoftICE 'Back Door commands' which gives infos on Breakpoints,% e, ^3 f7 J7 }- W: T
or execute SoftICE commands... i- r$ s& p. E+ R5 F
It is also used to crash SoftICE and to force it to execute any commands
8 O6 ~/ d8 y5 @9 ]0 w5 a(HBOOT...) :-(( " Y+ s, H8 B0 q( o3 z& M
# f/ ^+ M2 ]/ R. O/ N2 N& HHere is a quick description:
7 k( j2 S8 |* P3 B-AX = 0910h (Display string in SIce windows)" j: n# u1 P& u
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
' ], N4 q& Y6 n9 k% D-AX = 0912h (Get breakpoint infos)) l* b' c/ f- ^! M2 |0 k
-AX = 0913h (Set Sice breakpoints)
( n" E( Z# Q$ F-AX = 0914h (Remove SIce breakoints)
R# z1 y2 M/ }6 m7 B& ^. B9 L, Q. L
. i8 T' L+ B4 `% f6 r: I. T0 ~+ HEach time you'll meet this trick, you'll see:: P- l u& f( T2 e7 w0 `# l
-SI = 4647h
( {7 j- J0 E1 O-DI = 4A4Dh
, _' {" `9 q! G0 UWhich are the 'magic values' used by SoftIce.
+ u3 X- A) B. V- A) v4 pFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
' ~/ j5 C3 C- _ F( Q! ]1 N" E( Z$ P
Here is one example from the file "Haspinst.exe" which is the dongle HASP) V% D" G4 E: j& B
Envelope utility use to protect DOS applications:
' v% z* D+ v! ^3 W+ V9 ~6 D: l' J4 v
$ y; m" f0 i' k* p" a$ Q' G9 h% u
4C19:0095 MOV AX,0911 ; execute command.
) T0 A, b! T" w0 E7 W# p! r! _" ]4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).$ Y( g% z( t4 J8 k
4C19:009A MOV SI,4647 ; 1st magic value.6 h& }. j$ M( q+ c) r( B0 ?+ V
4C19:009D MOV DI,4A4D ; 2nd magic value.% a; F; A; N* R/ G% a7 N. [
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)+ x& {# `8 K9 T) M, K- n
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
' O, y+ r) w! Q' t$ q; G4C19:00A4 INC CX
- O N/ X/ f) p& ?0 Y4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
u; h" {+ ~; i4C19:00A8 JB 0095 ; 6 different commands., u2 u4 x) V9 ~" K
4C19:00AA JMP 0002 ; Bad_Guy jmp back./ V& { a" o7 [" _$ C2 Q
4C19:00AD MOV BX,SP ; Good_Guy go ahead :), C/ W+ E" d# \: f- ^3 x
% K: k5 k9 }$ C! a) k* N
The program will execute 6 different SIce commands located at ds:dx, which
% p$ R9 r, v; W( h, c0 c# ?are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.) x7 o; x% {; x: G/ M3 F
- x3 J' u/ Z" w5 F4 E
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
7 @* {5 Q2 \# L8 n; G___________________________________________________________________________
! J# Q0 W0 F5 y2 G. N3 k0 @* b3 a9 m1 F4 E/ U% F, t
8 S& [% {5 a& pMethod 038 d \0 j; o! i" S
=========
. ?7 H9 I: k6 l, q: {, }# m# ]( G- Q' J3 N% X& k
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h A F# `$ e I1 i5 n: |
(API Get entry point), M" d+ O _8 P8 E6 r
' z& O+ [1 ?% n; k
# V1 w; W, `: ~& I U
xor di,di+ V" V8 c% u V: b
mov es,di
& G8 o5 p( a( Z7 \! c# k mov ax, 1684h
- k$ `1 R1 X* p mov bx, 0202h ; VxD ID of winice8 }3 U, S0 h. b, `/ V9 j0 s
int 2Fh4 R/ Q4 a( D- S5 ]; H. I% Q( U, ^
mov ax, es ; ES:DI -> VxD API entry point
( t7 o8 V6 U* Q+ F9 F2 N" L8 _ add ax, di; P$ O& f. w$ A' j6 S
test ax,ax6 l8 j. U% { G5 k i( X7 b
jnz SoftICE_Detected* j/ W v T+ S, T
- A. W" I" ~$ a [. _. j" ?/ m___________________________________________________________________________% n0 _/ G) ?6 M6 G* E
* g7 U9 e. Y3 S" w ~' J
Method 04! l! J- L1 x4 s/ H7 J
=========9 z% N! g7 [* g# x) G+ e/ n% u2 d
& o7 S. y0 k# `3 K3 u
Method identical to the preceding one except that it seeks the ID of SoftICE
! |% v9 ?. \' R$ |2 g7 _( Q$ b1 iGFX VxD.
) v9 T$ w3 Q* y7 n$ F& Y& r% I5 [) ^% V; ?5 q4 k
xor di,di
* @* @/ `: c5 V$ ?. \' W) v3 k mov es,di# e/ H# B" r F1 J% G
mov ax, 1684h
8 U- r9 e3 w5 \$ d: g" E mov bx, 7a5Fh ; VxD ID of SIWVID
3 o, Q$ ^! E0 d1 ^( h int 2fh
9 X5 ~$ V2 M9 k9 ? mov ax, es ; ES:DI -> VxD API entry point
: p' _- O2 h1 I+ b7 H% |: L- N8 C add ax, di( z0 k' Z2 `# F9 m5 E
test ax,ax
' |4 [* b9 T7 B8 f) V, B$ m: o) e jnz SoftICE_Detected
% h. S! s7 |$ S: v% c) A; b8 |2 m8 L4 z6 }7 _! U3 ^
__________________________________________________________________________
7 E7 |7 W. R x8 b. M! W- M# E# ~) N1 r4 F
; G ^; Q9 n, OMethod 052 Y3 R5 w$ p* a9 B
=========7 j, d/ U9 g% L) f; o6 U+ w+ [ S
# V2 l0 Q) K! A" A6 Y( n
Method seeking the 'magic number' 0F386h returned (in ax) by all system' n! K3 ]' F7 V' r$ k5 l; a2 H1 c
debugger. It calls the int 41h, function 4Fh.
5 q" ` N7 O2 N4 V; w" ?8 SThere are several alternatives. $ t; h: T' L! k7 }8 X1 L2 \: d/ \
& a5 v% F# Q2 |The following one is the simplest:
. P! E! @7 [" m) G/ T3 q1 {, o% X5 u- {( J( Q4 }
mov ax,4fh6 N# t8 }0 n3 g* S. i
int 41h
, u# p1 w% R3 T) l- y cmp ax, 0F386" F& y( |1 B) \+ i8 H/ u
jz SoftICE_detected5 |2 h* P$ ]& n1 t1 U1 a2 }
' {7 h% {: A3 t) L' y8 d( m. g) z# e& y; j' C+ y5 o
Next method as well as the following one are 2 examples from Stone's
" O& g' s, ^ H) M5 e$ S: e% p"stn-wid.zip" (www.cracking.net):8 S2 W( a4 V- M4 h5 N
& V" s7 Y8 }; p/ g6 o. S j
mov bx, cs
5 Z, V6 R' t7 P$ H3 E4 C lea dx, int41handler2! O4 ]( X1 R4 s( R$ i+ ~
xchg dx, es:[41h*4] i+ n O- [; i& M! `8 E: p
xchg bx, es:[41h*4+2]
+ {; d0 S( ^5 a" Q! {- X* v( h# V mov ax,4fh3 a3 N; L/ y8 W* `- x9 _- D
int 41h5 k7 f+ g8 s- ^# O9 |7 K7 x/ l
xchg dx, es:[41h*4]. q0 T% d) s# z% ?4 {5 B
xchg bx, es:[41h*4+2]
A4 I- D% \6 t# K4 W: u; ? cmp ax, 0f386h
& R3 M. V2 @6 J( W4 n, ? jz SoftICE_detected3 |: q$ Z. U" Q2 B+ E
. S' R( F7 ~* e1 m) ~
int41handler2 PROC
* X5 w* ]$ S# |% K I, K: O iret# b( ~+ k) q5 m- \, d' D4 u
int41handler2 ENDP
7 r h0 E4 o/ S- N: E
1 R# ?; k- o' F% {/ a; e$ z+ u4 d0 Q! u! C( X; W! i
_________________________________________________________________________, e4 G$ C0 c" O3 d
' o' K0 b- x% ^# ]0 f; s" P
% _. @1 @4 [$ M/ Y1 c" B2 p
Method 06
; H7 Y, e! ]; A0 w2 P9 J=========' L6 n' k" k: M3 V" e8 y: \/ p) G- F2 p
: l3 c' s" R( `; b! C7 L- J2 }" N' |) Z8 [$ O& }6 c1 W- n
2nd method similar to the preceding one but more difficult to detect:- i4 ?; @" A0 e1 u& ^" A( \! J
3 j0 Z& ^% c6 l2 v( q
5 m2 ?- D) R$ l: A/ uint41handler PROC# r$ h# x4 Q7 H" r
mov cl,al
! u0 Z* A" D" v9 c iret
6 a5 n- [9 E& I7 J! C; Y3 ?* Dint41handler ENDP
! ?+ O/ c+ s( }$ P8 ~7 C" T6 q. D& \6 W. }
# ~; p+ `3 H ^
xor ax,ax/ a0 X+ Q1 p6 X$ b' O2 G+ ^! D& d* Q) t
mov es,ax
" ~1 z+ y0 q+ N j7 p* W! ^ mov bx, cs
0 F8 Y _. S O6 _' d9 U$ \+ V lea dx, int41handler/ J2 T4 p% A; S: A( I
xchg dx, es:[41h*4]
, }! C- H, L; l9 [$ N; }+ \" B xchg bx, es:[41h*4+2]. G8 |- F! c" j0 F5 L% ?% ^" A
in al, 40h) L( y5 G5 F" ?
xor cx,cx
7 |! S _4 f' @6 U0 T0 u. H0 ^ int 41h
1 b9 ]% I3 ?5 t1 J( v. Z xchg dx, es:[41h*4]2 f7 H# X/ c" Z$ d% c$ ?3 `
xchg bx, es:[41h*4+2]% R: v& |4 p' x+ q; X/ S
cmp cl,al
4 Q2 k) x- a) M7 q8 z& S/ m jnz SoftICE_detected# [2 n' W8 g9 s W: n
3 V6 I3 w/ S! t_________________________________________________________________________
) ]1 I. j4 l1 E, F. W+ B9 n( T* b* Z3 ]. h% v3 V6 H( G$ g' O. [' e
Method 07
7 h; F( E- a( k( I" H5 K3 l=========
2 c/ R! R% ~0 j" Z$ r+ `- j- f4 O" p: N- b
Method of detection of the WinICE handler in the int68h (V86)( A/ ^7 l q5 N% m: E% C
. x- h$ B0 ^+ s
mov ah,43h, g. n7 S$ m# s0 R$ O e3 C
int 68h' e4 m0 O2 k h+ x/ k4 P
cmp ax,0F386h
, t2 I; t. S' t# A jz SoftICE_Detected$ B0 B+ Z( d. ]* Z4 M+ e
& `& F5 {$ N& k3 h! ?
2 S- G- _1 ?. R: K8 C7 B=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit& e' u V; \* [, z
app like this:6 s i+ C- C% ]- P' p0 a8 o2 K
, j8 [' k+ m+ f$ }, a# o BPX exec_int if ax==68% }4 ~& L" S" k
(function called is located at byte ptr [ebp+1Dh] and client eip is- v6 b- ^' X: G
located at [ebp+48h] for 32Bit apps)
. s3 N. u1 d4 P1 P" E__________________________________________________________________________
0 F: N3 R- z5 R |& h3 K' a+ |% P) |$ ?4 S3 E+ z
! m7 A- y2 }* g; \. R
Method 08
" b0 |9 a* ~/ W; K* k=========( `- g* ~0 o. V( a! G/ R7 E
3 t8 J+ G# A$ f J, H3 N$ fIt is not a method of detection of SoftICE but a possibility to crash the
9 _( U' O" i8 Gsystem by intercepting int 01h and int 03h and redirecting them to another
: j- v5 _, P0 y7 A) x/ |$ s9 Droutine.
. }- d4 K5 f: I0 `$ L5 b% wIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
5 l: H) |, v! J3 Eto the new routine to execute (hangs computer...)( K' P8 Y* S3 M5 P' |
$ P9 t4 R, ], X$ s- v& r3 H mov ah, 25h
1 h. i) B6 O/ c# ]2 J mov al, Int_Number (01h or 03h)
" ?7 H- P7 \8 I7 B" [ mov dx, offset New_Int_Routine# o8 X# h) L6 {; b1 J
int 21h, V a- v6 b2 q& _* ?! h' X; j1 P
+ `% a) G$ x4 ~7 J% o9 d) m
__________________________________________________________________________7 E; y! o, \7 g& ^
3 s% e* `7 A+ s' _* a4 }Method 09
) a1 q& U/ w$ K, R. b! y S9 ?=========9 m) m# y0 ~# y) a% y' l
) q- d) O' C- f: ^- D$ z. S: n
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only" A3 p8 R4 ?3 t; k
performed in ring0 (VxD or a ring3 app using the VxdCall).
, ?2 F$ g# \# W: R) M3 c( qThe Get_DDB service is used to determine whether or not a VxD is installed& W5 m7 N# ?% `, L( P
for the specified device and returns a Device Description Block (in ecx) for6 ^! B X( I( Q
that device if it is installed.5 N5 F8 i( H( R" }9 |$ I8 x
7 e$ T; B/ o# @% _9 c
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
5 P/ S: b& x, i, T0 Z, [: { h mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-); s% B( g# ?; _# q4 [0 {5 g3 ~
VMMCall Get_DDB
, b0 \- H6 f0 k' I) X+ ^ mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed; K& V; x+ n% F+ {
4 |8 H, a, q& m5 h
Note as well that you can easily detect this method with SoftICE:; E, n2 i0 s/ e% s
bpx Get_DDB if ax==0202 || ax==7a5fh5 w: a$ a* X5 M
+ P# v. m$ B1 e- f1 e5 ]__________________________________________________________________________
% I. }3 Q5 \- k h) ?6 W" ^4 c# @; [
Method 10. E, ~3 k) G7 \; T! g% L
=========8 S P) F; X5 r* i L
/ o! D6 e% q( P0 G* V9 c=>Disable or clear breakpoints before using this feature. DO NOT trace with
7 Y, X" ]7 R8 r5 ]0 `/ o SoftICE while the option is enable!!
1 ~* E8 |# h7 P4 N
3 o) D$ Q7 r* D( xThis trick is very efficient:8 [9 }' c' e" x/ z7 \
by checking the Debug Registers, you can detect if SoftICE is loaded
, w C! e- v1 R: R+ i(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if2 o9 p! {; a" g0 k5 o& ~6 T
there are some memory breakpoints set (dr0 to dr3) simply by reading their
% ]$ \' O9 g1 |value (in ring0 only). Values can be manipulated and or changed as well2 ? m% Y/ Q1 }: E
(clearing BPMs for instance)
5 m/ d& I2 j) g, Z2 ~7 y$ c/ @# \* Z9 `# l
__________________________________________________________________________
/ U7 {- e% z0 z' m# o2 M, e- E
- z. S6 \* ]* Y/ r: w( v' z/ XMethod 11
6 N9 ]. d2 r! L: B; m1 t0 j9 u+ o=========! g# g0 R& }. T5 ^
; r6 c# a. g4 P/ V9 t
This method is most known as 'MeltICE' because it has been freely distributed
& r( ?8 K X5 w# [( ?! ivia www.winfiles.com. However it was first used by NuMega people to allow5 q L$ N- b- Y- W- X" c0 [- n
Symbol Loader to check if SoftICE was active or not (the code is located! s. B; r3 I% c0 Y$ _
inside nmtrans.dll).
( E1 v" X5 `/ q1 P7 W" o4 k1 G' E& o0 C
The way it works is very simple:+ V3 c [3 m+ |" `7 T( A* e
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for! z3 O, g9 F/ \: r4 C! b3 T' K$ c. v
WinNT) with the CreateFileA API.
1 |0 ?: z" }1 x' g+ F; d
% ~" }( u" v# xHere is a sample (checking for 'SICE'):* q% L& ~1 m W; N. M* ]( P
0 j: S- Z+ L) d+ A
BOOL IsSoftIce95Loaded()1 `4 S; e. @2 B7 _# K% X. e- Z
{' l# Z- B5 z$ D6 z+ L) a
HANDLE hFile;
: T8 b8 i" L' a( n1 f6 D3 n6 M hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
1 n4 f, x1 V! j1 I3 c FILE_SHARE_READ | FILE_SHARE_WRITE,
; M# s& e$ S! s h% K4 ] NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);6 J) T+ k5 D u. C$ Y
if( hFile != INVALID_HANDLE_VALUE )" @9 c# A6 U5 q7 L% X4 _! _
{
- J) r8 D! j O9 P9 I8 a( m% A CloseHandle(hFile);* C# W* q6 |4 i. a9 n$ i0 [
return TRUE;
/ |4 _- }: @( b/ d9 b4 l+ [/ \ }( e& V* s4 ~; X1 u) A ]
return FALSE;
& _! x6 A( U' y2 m$ R' |* i1 F* q}7 T5 D" H3 j/ L0 x s( s
8 }5 r* }2 M% p0 J1 sAlthough this trick calls the CreateFileA function, don't even expect to be1 Y) o$ m+ i- J
able to intercept it by installing a IFS hook: it will not work, no way!0 c7 R! m& e( a7 W
In fact, after the call to CreateFileA it will get through VWIN32 0x001F2 Q# U) M7 o+ T6 p5 z
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
0 k% Y7 `! Q% o' n. H" w, Jand then browse the DDB list until it find the VxD and its DDB_Control_Proc% Y+ v$ J9 r' q6 S2 A; l. E- h
field.
8 y8 b3 l: K+ ^1 z& q% R$ aIn fact, its purpose is not to load/unload VxDs but only to send a 6 Z" n1 G; K" E* @/ { U p. V
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)* t8 z, D! {3 T5 k
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
4 F/ O; P. I; e$ i9 uto load/unload a non-dynamically loadable driver such as SoftICE ;-).2 Q5 z. K/ P3 \" P) p" S
If the VxD is loaded, it will always clear eax and the Carry flag to allow
/ s+ z: M E0 S( x+ Cits handle to be opened and then, will be detected.: y6 X" {! T/ n L
You can check that simply by hooking Winice.exe control proc entry point& |# ]& l, t( t. I4 s
while running MeltICE.5 o! F8 c; k/ b" U
8 N* U% _5 I9 p- G4 t6 v: H0 Y/ R$ S' E* B0 Q
00401067: push 00402025 ; \\.\SICE
) J9 V- I: \( z; S( F" Z- u 0040106C: call CreateFileA
( U, E$ ?' g$ |3 Q; ~: ?& D* l1 y 00401071: cmp eax,-001
& }& p, q e2 S) E 00401074: je 004010913 b# d- B$ @5 t" W
# ~9 C) R! M+ _2 i
3 F) A) B/ g. q% U E
There could be hundreds of BPX you could use to detect this trick.1 y" d% ^0 d; N5 T2 g! V
-The most classical one is:
3 o9 @4 M: O7 U0 r2 t8 Y' o2 _# o- n BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
9 D, |! S/ x: V+ o2 x' Q% n# j$ { *(esp->4+4)=='NTIC'# |) Q" N' o: O" M6 ~
6 D# z# C' [3 {! B, N( [
-The most exotic ones (could be very slooooow :-(
6 E; O9 Q: o8 n% O: T7 K BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') " V% q& a1 ~9 @' ]9 `* r& Z
;will break 3 times :-(
3 T( V9 K5 D" Z, ?$ Y `
) U1 `/ G) Z6 g; N6 e" ~- M( b, w-or (a bit) faster:
( m! b' B% D0 j( S BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
4 S4 L8 a4 q4 v+ u+ J, O+ {, q4 ~: p
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
9 Y, Q& z2 u! D, s2 {' Q: H& N- O ;will break 3 times :-(
' n+ D% e8 h' X4 k; X$ _- R
5 V' Z' m/ E8 W) s1 b-Much faster:' H8 x8 n4 m4 c) h" z. h B
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV': |+ u; M2 e( d% ~. _' p
& `6 W# o3 ^) P1 o9 i% {" L- e
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
3 \ e) I! o. T5 R- P2 x; `function to do the same job:4 S+ z' B0 Z) q( k
0 V. T1 r: l L4 w push 00 ; OF_READ
% l9 u2 Y1 c A mov eax,[00656634] ; '\\.\SICE',0; x3 j8 V4 |( R: h: u5 x6 Z) B$ }
push eax$ V3 `* @4 @3 r+ B. E' p$ D. g
call KERNEL32!_lopen
! Q; Y$ m! i, D( p$ x/ {+ |# c inc eax
! X9 y0 a" i) e1 F# }2 o( n0 X$ B jnz 00650589 ; detected, x8 J- v! U! V* _
push 00 ; OF_READ
3 S, l. E# X- m" q- [1 X/ N& U" `: I mov eax,[00656638] ; '\\.\SICE'
% j! j: T W( m8 i1 C0 S5 D8 F push eax
5 z0 }! i- w* n' C call KERNEL32!_lopen
! C' @5 Y0 Z/ j3 j0 x* \+ _5 I inc eax
9 f. a# e3 V, u2 `2 F! U8 T: m jz 006505ae ; not detected0 i3 d9 e. S1 E/ ?3 L
- F+ w- S# m7 V0 p
1 y% Z% {) C) O0 I x6 X! |) B3 C__________________________________________________________________________
O# S$ \" G z, u0 [7 v2 N: t9 R6 U; p3 n; U$ ?* ?; s- S
Method 12# F( I2 ~; |/ F# l5 k$ P
=========
' I# z+ s1 Y. q6 C$ @6 Q& ^% f8 `) x. r
This trick is similar to int41h/4fh Debugger installation check (code 05
$ n; n: X4 a6 M% Y# N2 e; A# @. i& 06) but very limited because it's only available for Win95/98 (not NT)
& R' w$ f6 g9 s/ F4 \as it uses the VxDCall backdoor. This detection was found in Bleem Demo.+ l' ^' b6 V5 P: }
+ R' j v& B2 H8 n) X push 0000004fh ; function 4fh
/ G0 i5 h; d- P( E+ ~ push 002a002ah ; high word specifies which VxD (VWIN32)2 c$ P: Y$ r. |$ x4 z
; low word specifies which service" }1 c+ E4 W& j3 j$ B8 H$ r
(VWIN32_Int41Dispatch)
1 F2 {7 C4 \- a$ Q5 z: e2 y+ t# u) I call Kernel32!ORD_001 ; VxdCall
3 E6 \. E! \- J } cmp ax, 0f386h ; magic number returned by system debuggers) p) |" l/ E! j5 N8 T. f" W9 N- q
jz SoftICE_detected' Z! a0 p" | P% \( J" t
2 E$ f9 e) b0 Y8 k& p0 j4 o# E, M8 W( GHere again, several ways to detect it:
9 a0 m; o/ R- G) p* F C% T" V* _
/ H' V2 a' @! t) E; A1 j" v& L BPINT 41 if ax==4f8 r" O8 X* I7 T' J* h, v
+ e& s8 |9 J; J5 t) A
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
+ b6 C/ n0 e& s/ H# H% U5 V- ~* R: l" @, a% ?$ i; {, g9 I8 V
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
) b6 m/ Q7 s& [5 Q& o4 a7 P% C g' p* q- d2 {2 }
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
% Z* F0 b- ]& A* ^, B1 {* |6 t* ?) e. Y( M- l* Y
__________________________________________________________________________8 T: [: O6 V. I4 n+ j4 ?
- d! u& u% e% @' QMethod 134 z9 [1 ~, r" I* [# s9 V/ E ]; z
=========
+ ~7 |* i. v! P: r2 p) N5 a. H- }
5 m% d, o7 j1 B$ ^) i4 TNot a real method of detection, but a good way to know if SoftICE is3 E# o* O8 n! [+ q1 p( i
installed on a computer and to locate its installation directory.% @1 l" ] j% h! N) s! E1 @
It is used by few softs which access the following registry keys (usually #2) :0 o/ V- s% n9 p: W- S5 I4 @
7 P% ?# G, o1 g9 D! G
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
( o& V: U: _1 S" t- e3 u" A; k\Uninstall\SoftICE
1 `" k; U: |1 o3 w1 r$ I* B, [-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE3 y* |, s/ h* Z/ `2 _8 a
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion( j8 T2 Y- c4 c6 ~+ N
\App Paths\Loader32.Exe/ _/ |) E9 o3 l% k4 d* V* T: q
2 u# w) i0 a, I, J
% g. r3 z# f! C/ {" ?7 K1 a) c
Note that some nasty apps could then erase all files from SoftICE directory
: I% Y# G$ l! J4 _9 L( M/ p1 I(I faced that once :-(' B! \# T3 |" B5 B* ~
3 ^6 }' ~7 K" I2 F
Useful breakpoint to detect it:5 P! x5 d( y7 ?0 e
' W! M9 ]0 E' L: H. s: }5 T: ^ BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
3 K% A2 Z. ^& }. k
4 J# U) N" E0 L5 w5 l' y2 E* s; ?__________________________________________________________________________5 `6 z5 d3 F* C7 N8 l8 ^3 W
9 E3 W. k( n3 u- k
- h. E! u# {1 hMethod 14 9 z/ A+ J1 C! B2 h% S
=========
: ?- v) J9 y5 I: E! z4 j; s w/ ~) I# p: P+ D, d9 n: g+ G
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
0 d6 K7 f! o; y* A" u& H. Jis to determines whether a debugger is running on your system (ring0 only)., E" G, v7 T8 y9 ~) i/ _/ P
$ w6 t, f# k+ k/ P
VMMCall Test_Debug_Installed
* c2 J* J' ~( g% i/ ?6 @8 W0 { je not_installed
/ `$ _- U( u! e8 K( {
4 J8 d0 D/ Q1 }! dThis service just checks a flag.6 f9 U# {; L, A9 g6 Z4 I
</PRE></TD></TR></TBODY></TABLE> |