<TABLE width=500>
% t( @. H- l1 c# v( Z/ ]0 _$ R<TBODY>
* F0 Z# q* h: I3 o& g# t<TR>
! ~- J* ~8 `* Y$ @+ b6 G<TD><PRE>Method 01
2 C& R6 Q9 H2 h( m, Z$ m7 u# |9 B=========) n4 h. ?1 }4 h0 V3 R7 u( G, N
9 l! U) S+ j; M' EThis method of detection of SoftICE (as well as the following one) is
( Q* `% D# V9 k* e$ Z& A5 P; vused by the majority of packers/encryptors found on Internet.2 E B9 e9 {* P) l+ D
It seeks the signature of BoundsChecker in SoftICE
! Y4 G( W4 q0 h) k* r( K5 s# W% T( ?6 t2 K% h+ n$ m; Z# c9 o
mov ebp, 04243484Bh ; 'BCHK'' x, c( u, g1 l; w+ p7 P$ }
mov ax, 04h
2 [7 K4 X0 I2 G5 x5 j: K" A int 3
) F# Q" [8 _( h! I* x+ S cmp al,4( G1 j. z$ B1 b% e/ K5 G
jnz SoftICE_Detected+ f1 c ]+ i9 q$ t0 P0 ~! s
' k! J0 E/ [( W4 b( V
___________________________________________________________________________
1 v9 B# y) d5 w7 N1 b7 Q
5 B- P2 n+ r1 M: ~; i4 q/ xMethod 02
: R# D6 K0 E- \, h=========
9 D) s/ A2 ]( ?! V
" h: M) T3 M4 G7 l7 EStill a method very much used (perhaps the most frequent one). It is used
$ x+ Z) m! w4 Z; M q* vto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
0 z$ V9 @5 |7 W6 e7 i9 q( hor execute SoftICE commands...
8 W s ?4 _8 f# `9 _9 r# R- d# x7 hIt is also used to crash SoftICE and to force it to execute any commands
: m* q' y7 Z4 Y! D" U(HBOOT...) :-(( ! _, C) q. X5 e8 H% A7 \, k' h$ |
, ]/ l$ d+ P f0 _# t
Here is a quick description:
6 R* m9 a7 a) x( ~5 }5 V-AX = 0910h (Display string in SIce windows)
" z" X6 D, o1 D1 X: }1 R-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
( @/ O6 \6 c/ o, o/ A-AX = 0912h (Get breakpoint infos)
* m7 O% i# u8 R( G. F0 X; X3 v$ \-AX = 0913h (Set Sice breakpoints)- v1 ?2 w, x4 V$ t4 ~4 Z+ n9 N" E0 C1 A
-AX = 0914h (Remove SIce breakoints)
9 c3 \) _- F$ n) e' s# g" Z! |/ M0 G# [' Z* |
Each time you'll meet this trick, you'll see:& r( q e+ t8 R b, N2 v
-SI = 4647h
+ B3 T/ O V/ L) F0 V-DI = 4A4Dh3 t$ k! u5 r# P1 Z5 w
Which are the 'magic values' used by SoftIce.
$ _% C$ C8 B( W: sFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.# _, u& i) H! p. p* E0 K
+ V) \0 }& g+ L; ~4 H1 f v$ K8 g1 P
Here is one example from the file "Haspinst.exe" which is the dongle HASP. Z3 n; c4 S$ f* r, m% q, s9 g' h
Envelope utility use to protect DOS applications:1 Y; z8 J( x8 }
4 U& e; X3 ^$ T1 [- o$ Z! C9 ~# ^" U' l2 X7 N: I1 J
4C19:0095 MOV AX,0911 ; execute command.
. V/ W2 j. J3 @ Z! u3 b4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
$ f3 X6 C4 I" W! }" [& _/ z/ ^4C19:009A MOV SI,4647 ; 1st magic value.
; L3 E' J/ E% M0 P: c; r; M* l4C19:009D MOV DI,4A4D ; 2nd magic value.
- z+ t( E1 h6 q. h, s ~4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)0 I* Q' z/ w( j0 @
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
( C* _) E9 n% C, y+ P4C19:00A4 INC CX# K) O: A: q! K" f7 x* q9 v
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute4 D! ?/ ~' O. T
4C19:00A8 JB 0095 ; 6 different commands.
" o2 G3 N" y* |! ?& K' u4C19:00AA JMP 0002 ; Bad_Guy jmp back.. z X5 T5 N$ i' x/ e2 m' ^
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)2 {! T; k2 p& B
0 B' G& e; R5 v- d3 B* ^The program will execute 6 different SIce commands located at ds:dx, which( }. R$ B3 w3 X, g" ~1 H
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
5 ?& E) L# K: u* m5 k9 S5 R
/ o6 K6 x( ]- e7 Y$ z* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
! f, f9 V" D$ [8 d* n___________________________________________________________________________
; P. \$ @9 B7 ]. }4 \4 Z
; t4 W1 y; Q& t I; J4 e0 k0 {. L: q- `' C8 Q: ]
Method 03/ w2 t, [( Y4 w9 i6 K! a
=========
/ f/ N4 K; _7 _2 j, ~9 f% |6 d1 J" h6 {' ~; F1 [( @
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h8 X! F" E& m1 ]6 t8 w: G0 m
(API Get entry point)0 F; c$ e+ l' P% {) M
$ l' \. {. V$ q6 t7 v# q9 k1 T
8 S# q X& |; Z }( e5 W5 u xor di,di# l5 n' M" D0 A; e4 E6 f7 U- ^5 D
mov es,di
6 P" a% T4 G% R& b$ O0 `+ A1 A mov ax, 1684h + T0 b; y. r* W2 d% u' A
mov bx, 0202h ; VxD ID of winice9 Z/ o6 Y' T) Y5 n1 |& l0 A
int 2Fh. Y5 l+ M0 X# T# R* j% b" I# U% B
mov ax, es ; ES:DI -> VxD API entry point
0 {; V7 _# C3 ?& e- A add ax, di
' |9 s' b" ]7 x0 O* {+ U test ax,ax3 u- b' h0 X0 F$ W* V) g
jnz SoftICE_Detected
# W- K5 Y9 B8 b r4 ]$ j4 L7 ?. Y
3 s0 ]" ^/ y( r' A1 [: R7 V3 V8 @9 A___________________________________________________________________________9 T9 A' j& x6 L* z5 H, V3 }
7 x( m! a; c3 M& |5 i i
Method 045 s0 ?; K/ b1 _, m: ~
=========! u/ E2 p Z8 u9 U% e q
1 j* \ V$ T& U) e- |4 Y
Method identical to the preceding one except that it seeks the ID of SoftICE, h# @7 @+ x9 h- i, e
GFX VxD.9 e; ^7 j0 o! A G! y
0 n1 F8 A8 S. a* X/ p xor di,di
& l' _4 O" ~4 M* e) O1 l2 z0 i9 F mov es,di' g' J" d1 r. `( Z6 z
mov ax, 1684h
$ {/ ]" P7 L0 h* @" y6 g2 h/ u mov bx, 7a5Fh ; VxD ID of SIWVID/ @# L; i: F8 S- {& @
int 2fh: f6 L2 k' ?3 V! }& c
mov ax, es ; ES:DI -> VxD API entry point
' L( R+ v) E1 m- i) j9 ?, R3 U1 ` y add ax, di
# y1 y! `' I; D test ax,ax) y$ I/ u" q0 k% B; \! o+ }& @
jnz SoftICE_Detected& Y' G6 S! r. \( |, v/ m5 R# {
( j0 U$ S, x4 l0 ^__________________________________________________________________________
( Z: m7 z+ K- C. B. F3 ~# o
7 f2 |1 {1 N4 u$ m" v- [" L7 |/ v, x- G1 h
Method 05
2 B0 l T. W) [/ d=========
5 l; C3 E% ?2 w, [
" ~6 y5 ^* N3 w' D( ]9 k+ O; wMethod seeking the 'magic number' 0F386h returned (in ax) by all system5 t; t5 l& p0 U4 r" y- |3 Z5 w
debugger. It calls the int 41h, function 4Fh.5 R) o2 m9 x9 \, `+ t# i! d
There are several alternatives.
- t9 j+ ]9 }/ F! S5 i9 j2 ^1 i9 V$ C1 u1 V
The following one is the simplest:
. q/ Q4 j$ G% T" N# J4 q
7 \, W- L1 U5 }8 z. Q6 t# x$ f mov ax,4fh6 k; V2 J* w6 B6 ]! U; N
int 41h
4 J, f* N# [5 b% s cmp ax, 0F3869 l. y ~4 p! P$ e5 x
jz SoftICE_detected
. v; \$ H% n0 L! z1 n: X$ G. y) C- k
$ s1 v* f# H' C( M$ g; z, d" ~Next method as well as the following one are 2 examples from Stone's
2 |- J) q: G/ b7 p"stn-wid.zip" (www.cracking.net):0 ^6 ~5 O+ \9 y' \- Z5 m* l- Y* K
" E( f6 D# g: ^6 i3 r2 C
mov bx, cs
$ V" F) V# } i( U$ a% t L lea dx, int41handler2
6 m H0 P& T; \2 Y8 p) `; a3 \! P xchg dx, es:[41h*4] a* c" `4 k8 E+ w: p* e2 j: [3 _
xchg bx, es:[41h*4+2]
+ e1 w, `1 [# g9 {# ^5 Y mov ax,4fh8 D/ |4 R+ a6 E; Q- |
int 41h
. J6 |# N' Z; \4 Y, d+ ` xchg dx, es:[41h*4]7 K: X. {, ]3 U1 z
xchg bx, es:[41h*4+2]
$ B2 ^% q' U* N! ] Y) b. f cmp ax, 0f386h! P2 D' }& c1 S# y5 U# E
jz SoftICE_detected4 X) b& t, ?1 W7 F1 m" K
. v% C3 f$ W1 Q% u) |# f
int41handler2 PROC N% _3 s) y5 }" a& h
iret0 n# a9 H5 K3 K( i5 Z: J
int41handler2 ENDP
. J3 p8 [7 K! r, q
: k( }: r7 g/ b; p- }3 L
h1 l5 f' y4 w; v7 l_________________________________________________________________________+ {4 l/ t' X5 p* U- W% N: X3 C
( d- K! R9 P' P$ q. w: k; F' J
0 _$ \2 Y7 c4 t) M6 q2 b- ~Method 06
. u' H6 i/ b" {* z=========: |2 V9 H+ }4 ? }0 Y8 `" C
1 u! C& U/ l/ G& D2 r0 y; v
V) Y/ U! c6 C- a# A8 ~2nd method similar to the preceding one but more difficult to detect:9 Z! W5 N% M, d; N8 z& U- `
K; d' m8 Y0 x1 X1 F1 h, X3 D
& w, U% h: x' n* R* q4 Gint41handler PROC$ U) i0 E3 j- o5 [: h: D
mov cl,al6 K( m6 K8 Q( Y
iret
+ \+ n V6 I6 wint41handler ENDP
. D) {# H; V0 _9 [
. f- y7 S2 b7 q- f
5 z2 j, M( t3 V5 h. z) }# N xor ax,ax; U& R( J( h; X! i( U; r. S1 \. Y' x
mov es,ax2 S* ]2 D( Y1 w6 q0 {2 E( @
mov bx, cs
, t, y! P+ Y+ u% z! [; I; v lea dx, int41handler" j. t# I# N1 ?. Z
xchg dx, es:[41h*4]
$ j+ A- a7 [& ]1 r0 P2 t2 P xchg bx, es:[41h*4+2]
- D. P: m- ^: H in al, 40h; X# Z- {4 a! L2 ^
xor cx,cx
/ _* l* k4 c+ W$ T int 41h! _# z# ]1 N& m' @9 K. }
xchg dx, es:[41h*4]
; _- Z4 p0 r9 X/ j xchg bx, es:[41h*4+2]
' ?" ]6 C4 R! f cmp cl,al
, h, w, X7 b5 a5 N! g" g. y2 { jnz SoftICE_detected2 s, p6 X" r7 { O
- l6 i, \9 d, J& j" d& x- x3 i7 n_________________________________________________________________________2 e1 @4 G+ \! T9 w
8 B2 t. [' B2 V- k4 Z- d4 ZMethod 07! y2 M$ Z: r' @; k+ a; m
=========
1 E9 A% D% {3 N/ A, j5 ^) Z7 M5 `+ b3 |/ o9 r/ u2 b
Method of detection of the WinICE handler in the int68h (V86). o0 I: l4 [# j( g7 ~: G' ?# u+ Y
# ?9 P* w" c* r1 R+ {% @" S
mov ah,43h
' A8 q& w/ D/ m+ O$ T% h int 68h8 ^$ w2 a/ J+ j9 t& h9 C) ^: x
cmp ax,0F386h% z$ G8 A0 n7 n1 I$ @
jz SoftICE_Detected: s7 u0 ^+ ]1 F7 L6 E
1 a( P3 Z N9 z9 a, @9 c5 y, S; W) L* K1 t, m- K
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit9 a8 g- H, t# W9 j8 g% Z& W
app like this:9 p# b2 r8 @' U1 a! ]) Z" t
- Z1 v) D" M2 Z9 s. O. ]" |% R j
BPX exec_int if ax==68
3 s6 e9 L: G ]# ] (function called is located at byte ptr [ebp+1Dh] and client eip is
: q( P5 C0 m: Q' k, ] located at [ebp+48h] for 32Bit apps)3 T! p' n. T3 I$ J& H: m
__________________________________________________________________________
& G; D, A( W h9 Q6 d7 S! ~! `; Z# |8 Y9 ? v7 @9 j* X' h# C
7 t+ D1 d! C K# k" m/ E- B2 F3 Y( b
Method 08
) [; i; o% n3 }% o=========% r0 i( w/ O% [( B' |8 m* n
# Q: o& i D8 L5 ]% ]3 r( Z6 EIt is not a method of detection of SoftICE but a possibility to crash the2 t. l0 T7 K- c/ `8 | I) h
system by intercepting int 01h and int 03h and redirecting them to another6 d5 p) @- S3 T# ?# _1 [5 B
routine.- F9 g8 k% p: H# B) B9 u. T" M
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points+ v0 I3 T1 j% ~- ?' p0 P. ^
to the new routine to execute (hangs computer...)
8 P! `. j; c4 S
' [ f' u: J" {& a, d mov ah, 25h
% \! X9 y6 a8 ?" n mov al, Int_Number (01h or 03h)+ l S7 z3 L! m4 M7 k
mov dx, offset New_Int_Routine% U( Q/ o5 k, J% s+ z% c
int 21h
6 x0 W" r; ]2 p8 f) s0 [+ O3 t) P# _9 X/ `) a) ]/ V
__________________________________________________________________________
/ \% f% \3 {, V2 e `
. Z3 P8 @; R9 r# v$ e7 g" u1 \) @6 XMethod 09
. G2 R/ r2 q5 |. y! v=========: O: d6 l7 b2 H I- L) y+ V
- b3 ?2 `7 m! T* HThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
, ~) }5 W! M" B/ ]4 u5 k; b, ~performed in ring0 (VxD or a ring3 app using the VxdCall).
$ `$ @3 O- z$ F+ pThe Get_DDB service is used to determine whether or not a VxD is installed
, k! q, W5 \1 n: }6 Z6 Kfor the specified device and returns a Device Description Block (in ecx) for2 u" E4 _. x4 O. o0 W. }8 u
that device if it is installed.
. U Z, G# u9 [
8 f: ?7 |: X& [ mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID+ S; r* Y* O( |1 T
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
, p$ F, L W/ r0 V* T" t- Z- d VMMCall Get_DDB" `/ J, H, m' t2 m2 I: p `2 d, d
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed K8 o5 C: i7 x. n9 `) V. o" {
~8 j) [$ k, qNote as well that you can easily detect this method with SoftICE:
* J. P3 \; X- }# ^$ P+ E bpx Get_DDB if ax==0202 || ax==7a5fh6 n$ [6 C8 s( N: w) U
% F! ]$ O6 Y" |3 F) F8 W0 b__________________________________________________________________________( ^8 C r8 N' D( T, [
4 m7 j+ y+ R, h& k
Method 10
1 B \% \! h( G=========
& O1 {/ e8 u) A* e( b, J" I% o# e
2 P9 `6 j% n, ~ ~* l( X B=>Disable or clear breakpoints before using this feature. DO NOT trace with) R; C7 r* F9 P& ^% H" d$ c g/ ~$ x
SoftICE while the option is enable!!" g$ V3 v: J7 f: s/ Z3 B+ h+ @
) N7 U6 y) m0 s t% E, E7 t
This trick is very efficient:0 }% y' }; X0 M
by checking the Debug Registers, you can detect if SoftICE is loaded
3 D8 p6 s7 k; t/ x(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
7 r \# U1 H7 j% y$ P/ D0 tthere are some memory breakpoints set (dr0 to dr3) simply by reading their0 g+ z5 {; ]' x% w9 |0 q( Z3 C+ l
value (in ring0 only). Values can be manipulated and or changed as well" K- ?, ]1 M) j
(clearing BPMs for instance)
, ]: A; N/ H( Z2 _9 j
3 V# B4 W5 L2 r7 g' y# Y- e4 F__________________________________________________________________________
) v* x& r5 V% ]: ^- X" z
/ c* d: _; O# tMethod 11. i l) J" z( c0 U
=========
; n- _2 n. s+ k. n7 o B5 W& S
' }! h8 ^: ~3 o( C0 VThis method is most known as 'MeltICE' because it has been freely distributed* ] F9 I; O6 \' F( N2 E2 A+ {
via www.winfiles.com. However it was first used by NuMega people to allow
; }- m" n. q, H- z, FSymbol Loader to check if SoftICE was active or not (the code is located1 I" d* U. {" q- B# p
inside nmtrans.dll).
" R8 n' s) c# l4 ~$ s
+ L5 | j3 w( J- r* wThe way it works is very simple:0 f2 {/ L1 M3 y
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for/ n7 }- {5 b( q6 d/ Z' S
WinNT) with the CreateFileA API.
8 w- T5 T$ L8 d& f; ?
0 V$ Q5 K1 k2 Z' kHere is a sample (checking for 'SICE'):
9 C2 N: V: p8 A. p! M% E A `4 }7 q8 L4 H0 L7 n( z/ r* W
BOOL IsSoftIce95Loaded()
. W) Z/ f0 A& }: b2 J! ~5 a' M2 f{
6 o8 r7 i8 m9 d( l4 D" ] HANDLE hFile; ' q7 E. o# D F; Z0 `8 [- m3 g
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,* `$ C) g* R. G' n( ^. y
FILE_SHARE_READ | FILE_SHARE_WRITE,$ J+ d/ @* L9 b
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);; g. X& G @5 ^; R
if( hFile != INVALID_HANDLE_VALUE )
) B3 O0 b) y D) c8 C5 H* } {
" B: Z0 y1 @; S( B4 }6 I. x CloseHandle(hFile);$ ~- i# x, e, W7 i
return TRUE;2 y: [7 @( w5 I
}
4 v: v5 J, L, M. T) t. q return FALSE;
# I; ] r: i% g, s! B% B& m}! T5 z& s7 K$ @! `$ ]& V
, s7 e5 Q/ I W" P) F& a6 i6 U
Although this trick calls the CreateFileA function, don't even expect to be
* y8 q/ P! Q! M) o4 t" y2 U* F5 Uable to intercept it by installing a IFS hook: it will not work, no way!
3 T2 f I' U9 |, U ^# }In fact, after the call to CreateFileA it will get through VWIN32 0x001F
+ O7 H/ U; ^* f2 I0 Z6 D3 V* r; aservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)4 U0 ?$ X5 Y1 {
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
. m: `2 y$ \, P& Z8 ofield.% I5 M' N; ?4 K: J0 l
In fact, its purpose is not to load/unload VxDs but only to send a $ A! R9 z: D6 |
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)" o( z' A% O$ f& A+ Q
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
# h" K5 w# X K3 W8 pto load/unload a non-dynamically loadable driver such as SoftICE ;-).& N; M# A5 q: i+ C+ a' s3 K
If the VxD is loaded, it will always clear eax and the Carry flag to allow/ B2 z* {; U4 O7 R9 `
its handle to be opened and then, will be detected.
3 x' B |. D9 w6 J+ k2 i" pYou can check that simply by hooking Winice.exe control proc entry point8 p. G6 r; @' W7 P h
while running MeltICE.6 x% b. p6 \4 R! l
- _: \% d+ E% b/ ?) }. Q+ ^' Y
+ q& y$ x. H: R: N3 ]6 n7 S: r 00401067: push 00402025 ; \\.\SICE
6 k. @& O% } u0 D% }3 u 0040106C: call CreateFileA
9 V+ T# a5 P! b% e 00401071: cmp eax,-001
" r9 |! B2 r( [. i' o! Y# h 00401074: je 00401091( x2 e* X# f1 |0 B: I4 t
* r+ [3 G, ^4 g0 m; C
9 `9 N9 X8 z- H) k: z) {There could be hundreds of BPX you could use to detect this trick.% _- Z7 R# b0 E4 W8 T/ O
-The most classical one is:5 ^& W4 k l- x: `7 V1 W1 n
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
5 h6 x% G4 v( e$ Y" ^ *(esp->4+4)=='NTIC'* O. J/ c8 E9 E% c
1 \7 k# i+ g. ?; G-The most exotic ones (could be very slooooow :-(6 o" T% _5 _* C" Z
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') ' y7 g5 L1 c; u
;will break 3 times :-(
: }/ Y, q, E5 M/ r; }8 _# F6 A+ Q3 r% S, p; L, u3 ^
-or (a bit) faster: ! ?* f6 T. H7 h, h- I5 U$ K
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
4 [, ?$ }) L/ ^+ S6 |0 z K+ ^; N% K
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' ; y( K2 T* ?$ ]( P! `; c9 B
;will break 3 times :-(
$ p6 f7 Y# n) C. }. h4 a- i0 E/ B$ |# k2 H
-Much faster:
9 y% N; \4 Q8 J8 A6 |4 [) \& b BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
- o6 I4 e2 A8 u$ }0 {* E& O) [% Y% A; P; [2 _% \2 e
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen: C+ }, i7 ~8 c( \
function to do the same job:
' I/ t# a9 Y* T+ i1 {9 A; Z3 `# R# w( ~. B+ _
push 00 ; OF_READ
- W) @$ e1 D1 ~3 y% t mov eax,[00656634] ; '\\.\SICE',0
. G9 u$ c3 ] z1 X push eax
) D4 c6 g: W$ | call KERNEL32!_lopen
' }5 Z* \& x! a% r3 j! u: t3 B; F0 @ inc eax
" a& E. A7 D' j' ^- k3 D/ C jnz 00650589 ; detected
' v9 s2 b ~: ? r1 I$ e, h push 00 ; OF_READ2 {( ~' J. `( s. e/ W" C
mov eax,[00656638] ; '\\.\SICE'
$ Y( }- i* \7 T. F3 ]; b* U push eax
4 f7 N% G: _0 C# Z1 {) i call KERNEL32!_lopen' \1 S. P$ ]: b, s0 s
inc eax
* O& s( V& V* j3 z jz 006505ae ; not detected
9 g- @2 F% b% g X+ C: G9 J6 [
* ~+ o5 K. |5 ?4 ~/ k0 m! k7 Y
% l( b1 s! u- T- Q__________________________________________________________________________
2 M- x# \8 x: E5 \+ }3 N2 s. u2 m. `& n, f, j4 ]8 I! N
Method 12; J& s- Y6 u C" N3 q3 `
=========4 B6 t0 j2 S2 ?: I' E
4 A) k, N2 Z: M; [7 [$ h
This trick is similar to int41h/4fh Debugger installation check (code 05, m: z3 K* f2 H% L+ \
& 06) but very limited because it's only available for Win95/98 (not NT)
" D7 B S* T. m* }as it uses the VxDCall backdoor. This detection was found in Bleem Demo.8 W1 s+ @8 E" D5 _# m! j: a7 r
/ u: w- Y3 _, e! `
push 0000004fh ; function 4fh$ j* G& E1 L) h9 X# `" |
push 002a002ah ; high word specifies which VxD (VWIN32)
1 B4 V8 u4 ^, B7 z ; low word specifies which service' X+ D+ |/ g+ @
(VWIN32_Int41Dispatch)
, |$ n* ^. p% E' J" I i; A call Kernel32!ORD_001 ; VxdCall
+ ^0 F5 D# O9 ?" t! ~! I: V cmp ax, 0f386h ; magic number returned by system debuggers
8 v D/ i* Q- Q8 O, o4 | jz SoftICE_detected7 I1 I/ P# U. |: N" G- R
+ y! B, W, Y3 y( Z" S4 v
Here again, several ways to detect it:
9 |% |4 b6 J5 M
( q/ f5 c8 V- i* \ BPINT 41 if ax==4f4 P1 B4 Y* Z) [6 N: I. d
$ M% B2 `' [+ r% b0 k) e& i) a# A
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
W- M) P3 s) _5 }$ @
) a$ [3 K: V* N: j) p BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
0 I' U/ c* t( v8 M' v: `4 Z7 |; Y2 S
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
% X* P+ L9 m8 R6 s: o/ k7 A. H( u. W Y; x
__________________________________________________________________________' C; i% @+ K) n! R; o. n- s
* }2 R$ n6 B4 SMethod 13% s" N! V" h+ g2 t4 r' u& k) ?
=========
, A$ T4 I- c* ? _3 ?3 [+ X
8 [; ?2 S& `* q$ I0 u/ c# _Not a real method of detection, but a good way to know if SoftICE is, N3 }7 d5 l. b& y6 c; G
installed on a computer and to locate its installation directory.5 c8 x6 A' \/ N( ~3 h5 L0 X
It is used by few softs which access the following registry keys (usually #2) :+ U' c$ y" r3 {$ d) t) u S
% C1 l$ G# o9 v4 V- v
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion B& m: P5 m4 P, _3 d
\Uninstall\SoftICE9 y% ~. u1 r- h l* r
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
2 t( R$ q3 ~2 m8 q; |! N-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion f! |: [ H& k3 ~2 G9 f3 l
\App Paths\Loader32.Exe
4 q0 x9 H, N Y4 \8 T# B$ {2 h; }- m; g
2 R! {- l5 N2 Q$ J- K6 NNote that some nasty apps could then erase all files from SoftICE directory6 c: V* J3 v! g) W8 Y5 I, H
(I faced that once :-(
8 \' F4 _4 T3 e; Z3 S
4 D& t( q3 N e5 EUseful breakpoint to detect it:% o5 g7 [& \* s0 T0 |. R }5 w
" w. W' W) r3 j' k4 i& F5 {, T- o
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
6 Q9 w `6 U% ^3 d9 Z. P3 v1 n- J" }$ f- @
__________________________________________________________________________+ A$ l/ Y Y3 D7 n/ v4 P
) b) p/ ?6 H0 d6 ~1 X: i9 g
& X' Y1 T! C! B3 A+ K
Method 14 1 ~+ x. J* r$ X6 F
=========
4 q2 X" A: T g4 b1 j4 H9 s2 b! N$ | d1 R
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose( [/ I7 _3 b, d; V, ]* O
is to determines whether a debugger is running on your system (ring0 only).4 j7 }3 G. w, n
, ^1 L6 B: v! k# @5 D
VMMCall Test_Debug_Installed
. ?# o2 C/ }4 p9 Q. M/ o6 h( L# I0 X je not_installed
9 c( c, G! ]5 n" ?/ o$ a* q% }4 v4 | }2 k8 H u1 K" o: l
This service just checks a flag.# e% C% n- i6 V8 Z
</PRE></TD></TR></TBODY></TABLE> |