<TABLE width=500>& k: {, Z( k. Z+ G9 V3 A& m( S
<TBODY>
. Z1 ~$ p! B$ v* @6 C<TR>+ H+ R4 r$ N1 b# \* R
<TD><PRE>Method 01
. a+ K; r0 ] n6 ], ?0 \- w& g=========! d* F: g* }. |. A6 F, i; _! j! J2 r
- w* c/ o' m* O' u' J1 H) gThis method of detection of SoftICE (as well as the following one) is4 \. F3 Z. r) q" M! Q, o$ y. |
used by the majority of packers/encryptors found on Internet.
: V: e. g7 x" O0 ~' S w. W+ g3 SIt seeks the signature of BoundsChecker in SoftICE
0 U% g& O3 f/ @0 T5 b4 S, b* s& E8 R4 m
mov ebp, 04243484Bh ; 'BCHK'
* v( I+ ?, p( I mov ax, 04h
$ l, ]- A! J5 ~ v0 z6 z) R' l int 3 $ O0 h( u( W- g8 T5 d
cmp al,4 R! t( j* s0 r6 J9 Y5 L* D! g
jnz SoftICE_Detected/ J" O h7 [4 \: ~1 _
; j8 V. ^6 R y# E
___________________________________________________________________________3 V7 c/ r0 f4 h4 b
$ O# C$ h# Z6 G8 |- r% a
Method 02
9 ?. Q3 B* i1 @& y=========$ K; b! Q) u3 X' R% g8 w
+ K: p5 Y; s1 B$ C
Still a method very much used (perhaps the most frequent one). It is used" q3 S* U l# b7 {
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
3 S9 I# D5 D4 t) G( B8 _or execute SoftICE commands...3 G9 e1 _8 G; I; g2 ~
It is also used to crash SoftICE and to force it to execute any commands
# J5 l5 e& \+ V& F: L(HBOOT...) :-((
6 B$ B- y% h% `% G
) F6 y( x9 j/ c5 Z }Here is a quick description:3 Q, E/ F2 D9 |* E8 p& a( q( g! e
-AX = 0910h (Display string in SIce windows). P t: `$ f& S5 j6 g* z& f: ]" C: P/ C
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
. } s& A+ K' J1 s% L, E& c-AX = 0912h (Get breakpoint infos): n l. }. w ?5 O1 r3 e$ O
-AX = 0913h (Set Sice breakpoints)- F3 i; R; K# |1 S2 @. d
-AX = 0914h (Remove SIce breakoints)
# e9 e: W7 l! K |/ R8 t0 A P* z
9 ^" `; |! J: XEach time you'll meet this trick, you'll see:
- o% z& I# f8 t-SI = 4647h/ t Q! P* _7 O) U- @& Q
-DI = 4A4Dh
" ~: {, d. x4 B3 R. @Which are the 'magic values' used by SoftIce.) E. n" U# k# A) i
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
( f l4 N: G& g, y
; |: L) {2 P% O4 \! CHere is one example from the file "Haspinst.exe" which is the dongle HASP
# }9 o( G) e& U! w d! z6 q pEnvelope utility use to protect DOS applications:
: h' B |; [$ F( o% u4 t: M/ T0 ~; Z, C4 x# S0 V8 ^6 o* F/ b
' t) E9 u' n" {0 D4C19:0095 MOV AX,0911 ; execute command.- V5 m/ I# W- _- U2 ^' }2 F1 J
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).4 f, H% y0 D. R* B5 |
4C19:009A MOV SI,4647 ; 1st magic value.' [$ |& y8 o8 h( @4 |* a
4C19:009D MOV DI,4A4D ; 2nd magic value.5 F& A [1 k2 ]
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
@5 A" L2 ^# ~: C0 I8 P4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute3 l2 n- R* T$ U, N
4C19:00A4 INC CX9 j# {0 N/ `% J3 Y; Z3 }$ v% ]/ V( ~
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute) P# y4 ?; r4 W3 H/ l/ K" y, r
4C19:00A8 JB 0095 ; 6 different commands.
. G4 F' G' m* P. c% n9 x. q. T5 \; s4C19:00AA JMP 0002 ; Bad_Guy jmp back.8 g/ z# \* L! D1 h! R9 e& q( O' g; P
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)' I* s/ \* A4 x* [) U/ C( f$ P3 Z
% f$ f; x0 e: D2 l# wThe program will execute 6 different SIce commands located at ds:dx, which% _8 X% y: M/ F
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.8 _+ U- T& z) {/ L! g9 j: l V
1 a) b" w8 C* F+ n- ~9 t+ O; ?* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.4 r& Q# S3 I$ R( T) M2 ]' D
___________________________________________________________________________. q. M/ E! d, ^' h
' X5 m1 B+ T) u6 O7 s5 b$ g9 _5 y$ {
Method 03' w7 u* B' E! @0 V; U
=========
, l" p' U$ l3 E5 J) g3 V% X8 P% w, P9 B- k, K* Y- V6 ~7 G; p" _, C
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h; n) `1 W* I; @- d* ^ B! @' e# Y
(API Get entry point): t5 d# h3 Z- [: m+ S1 w/ S! K6 u
D6 J4 r) G( s
' l' {0 z: c. x( n& z! {- L xor di,di1 f' X/ b0 h2 p+ s8 H
mov es,di$ L5 a& z* Y7 A) x; L- V
mov ax, 1684h : r3 m( J0 d( C" l8 K) S$ C
mov bx, 0202h ; VxD ID of winice& r( X' S9 S, N8 {0 T" M( ]: X* \
int 2Fh; S" M6 [) |; Q3 _7 f
mov ax, es ; ES:DI -> VxD API entry point
- r }, ?5 e3 S add ax, di
& C+ p- B7 D7 k, _8 E test ax,ax
+ V8 v3 }, @3 {1 V jnz SoftICE_Detected4 o, q2 L/ {' n$ P% c5 j. a
9 R o* Q" T! |& J- K
___________________________________________________________________________
2 X' ^/ }0 M4 @# {* \, V7 Q8 `5 y9 G6 k
Method 04
& w7 F! V5 I& l, ?- s=========+ R- D) I% i# q
" E8 I8 E' Y1 U8 L- v. G# s7 i [8 p* ^Method identical to the preceding one except that it seeks the ID of SoftICE
$ ]- \" o5 D/ C; ?* X7 ~GFX VxD.
, R1 L7 T( _9 s: E) i( T
& i2 `# X4 C+ d# Z$ v! B xor di,di3 V( v3 z) ^ P9 I3 P/ K
mov es,di# w. i D: e1 K9 R- X) d1 r
mov ax, 1684h * n# I% [5 o$ `. A
mov bx, 7a5Fh ; VxD ID of SIWVID. I( r+ h; L/ U5 k
int 2fh9 u$ c, H3 r0 Q$ J1 y! j, V& c4 P
mov ax, es ; ES:DI -> VxD API entry point
( n$ \% d3 J y5 }9 \& e add ax, di
8 }7 Q% D0 e. ] test ax,ax
$ V ~, r7 l' W% o# x jnz SoftICE_Detected
9 e+ w4 {6 I: H5 ?
& b1 v) d& i7 P0 ]2 e, @; f__________________________________________________________________________4 A; |- b" B- J4 n. t& P b
( l: A1 g' P& f B& t
! } ^" Z F$ t* ^4 xMethod 05
+ M5 W; Y( K$ Z. \6 m=========
5 S* v2 ]$ {9 ]' K" [, a3 S$ G) g4 I7 m" e8 o
Method seeking the 'magic number' 0F386h returned (in ax) by all system1 W) U* p5 U8 c' K% M+ }; ?
debugger. It calls the int 41h, function 4Fh./ ~# G/ m6 Z: a) |
There are several alternatives.
' m3 x g0 ~& [9 e4 B3 n% p5 J& W/ O1 Z
The following one is the simplest:( y2 T. @2 F$ f# T. z
( S+ C/ @, R+ [% F
mov ax,4fh
0 V' O% L0 Z1 T* ` int 41h
5 l3 e" f& k f2 b cmp ax, 0F3860 ]6 D: N( O- @" n- I Y) r
jz SoftICE_detected/ b9 @6 E: @& ]1 a" o6 u- u$ D2 z
; k+ g% u2 M" d O
1 [8 e" p; B/ ?" H) JNext method as well as the following one are 2 examples from Stone's " A1 G9 J( f" j @" ]
"stn-wid.zip" (www.cracking.net):
1 b) J* G) u; r% l; ]6 d- R f! R0 }. W9 u( S9 m) f# `! H& @
mov bx, cs
% v1 b2 F# E j: g z Q4 @ lea dx, int41handler2$ O# n: g3 b* F
xchg dx, es:[41h*4]
! ]# X; H: ~$ r+ F$ Z; ^ xchg bx, es:[41h*4+2]
t! Y; \- n j8 f3 D mov ax,4fh' p1 j {4 g+ @6 P6 ^/ F
int 41h u2 `$ F/ ~$ @) {0 R" s* t. v
xchg dx, es:[41h*4]! }: M' M3 w; @8 K3 k$ P
xchg bx, es:[41h*4+2]
( U/ z) r" ^/ R5 j9 r' n, n cmp ax, 0f386h ^% e& }/ G; `# P
jz SoftICE_detected8 V6 w) D9 g4 Z! T# q
- A' V M+ n* q! k) ^3 X' e
int41handler2 PROC
8 `$ A a; V$ z+ k5 y iret
# R! O8 X5 b7 B7 L5 H! `3 [int41handler2 ENDP
. q. N5 o/ y3 r
' c* \7 e1 \$ M+ i _) `9 P x; k+ w% V0 C: Q5 K
_________________________________________________________________________8 U+ P2 s! P1 q$ ?
2 o7 r! @' q2 i) d- V8 \: Y
1 w3 M9 b. P* ^& ^. ^+ mMethod 06 f8 M4 x0 d9 j/ r7 b7 p9 m% X
=========
3 e' ^7 D) c- f1 [! t( o5 o& @# m/ S4 [' ?, K+ p
; G& v$ z6 ^( t5 }. T2nd method similar to the preceding one but more difficult to detect:- L/ _2 L9 `3 B5 M
: U, c0 [' B7 }, Q; v
! ? M: ~; N8 t. Aint41handler PROC
# t; W6 a: O+ Q( Q mov cl,al' e: R& L1 z5 }- ^
iret3 E7 M( ?$ y8 e6 ~
int41handler ENDP/ y3 @) W2 e- d# `, C1 x1 f9 D
( @! b+ G+ C2 i- D/ x
6 l, f) C9 L: w* x& E# B) Y8 G xor ax,ax% E) f2 @& e* S; R
mov es,ax8 P: z* H% K* n% b
mov bx, cs5 v/ h; N m5 v! w% O
lea dx, int41handler
4 i7 \3 W2 Q3 J/ U5 a% A9 _ xchg dx, es:[41h*4]5 L, a- F, T' U3 W% {) M- C; w- E6 y/ G
xchg bx, es:[41h*4+2]; h$ c; I e) s* D/ _6 J' [( v
in al, 40h
0 o6 _& _ ?* |3 a4 W1 e6 t1 N9 O xor cx,cx
' W! z* s( o2 v( K o& z$ c$ G int 41h
2 X; N% h1 T% G6 x xchg dx, es:[41h*4]+ H8 i: h+ K m! x, @
xchg bx, es:[41h*4+2]
2 t8 z: B7 z: `; C+ ~7 Y0 A6 |1 [ cmp cl,al
% \1 y' _6 w, o/ X5 A& c& a jnz SoftICE_detected
7 [( u" W8 s7 K4 k% T/ }8 H W5 y, d
_________________________________________________________________________
, E+ h: w% o& F. `# m% j- I7 |7 l5 m0 f$ d. U( v7 [
Method 07
7 ?1 s5 _* b2 L/ Q' P* Y=========
1 t9 t% F" l$ `2 q$ B1 I6 W) h. M$ _. w& J5 @; b
Method of detection of the WinICE handler in the int68h (V86)
v. {) S% t3 _, p7 d# N' c
" \/ |6 s/ |% @. Y. S mov ah,43h3 |: ~, W4 @7 j
int 68h
" ^5 Y* ^, D7 L3 B5 ~+ f2 z* C cmp ax,0F386h$ S F4 O$ n: ~1 |7 ~3 z' y7 |7 g% o
jz SoftICE_Detected+ A+ n i2 U" c9 P$ {
+ v4 p% n- V" Y! N0 a
4 ^$ @1 o7 i" |. Z2 t, ]=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
6 R/ f. }) J2 u( Q: P0 e* a app like this:
8 S* T9 ^' ^2 m8 T8 G) Y3 {5 X8 G" a t/ K# R( U: `5 t* J# x
BPX exec_int if ax==68
?7 h& }2 k {+ N) e7 ]) T (function called is located at byte ptr [ebp+1Dh] and client eip is
2 ^0 m7 J8 O+ C! D4 @- s7 ? located at [ebp+48h] for 32Bit apps)" s) m* B8 t. h
__________________________________________________________________________
/ q* n+ B+ y" L* F; u
& C1 i2 U& C8 Z3 z
8 h2 l/ T f7 O3 qMethod 088 y' B9 @6 X* p' d8 |
=========, K8 ~" r4 Z* N1 r! p2 X0 I
+ u: y8 j* B2 g# h J1 BIt is not a method of detection of SoftICE but a possibility to crash the2 W3 Q! X4 D+ U% _4 q: y
system by intercepting int 01h and int 03h and redirecting them to another
# q1 n' a$ D' o7 D% ]( yroutine.
: Z0 }% @6 n* x$ V) AIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points! Z' c/ D; q! d9 Z* y
to the new routine to execute (hangs computer...)2 Q5 b' W* Z7 a+ J4 b
5 |& g) m. I* z9 I0 t+ y5 y
mov ah, 25h
v! S+ W/ t0 r$ W8 a3 \ mov al, Int_Number (01h or 03h)
7 z/ u( c: A6 O0 F" T mov dx, offset New_Int_Routine. b& R/ t3 c! K3 P$ }" O" I# n
int 21h
; ^# C0 E4 e6 V) {& e$ h" t v2 _, v: w6 o5 z9 b% ^3 D' [
__________________________________________________________________________
3 \# ^. R P2 ^3 G
3 r7 c) g, P0 R4 T- X& R; v. S$ dMethod 09
, z; S# g; z2 h' h=========$ ^! n( `; P+ ~( X( f; B$ ?
% }# E: b- o2 E% v% ?$ t$ A( S7 n
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
) ]% l; R3 n) c& g! W+ K3 E+ o: O0 Lperformed in ring0 (VxD or a ring3 app using the VxdCall).; z2 b5 z: E* g4 a1 W3 {
The Get_DDB service is used to determine whether or not a VxD is installed& ?+ O; e9 C+ m6 |( W
for the specified device and returns a Device Description Block (in ecx) for
/ N/ L( u) e! Pthat device if it is installed.: _7 F5 i% A1 _* X- d
( c b$ J$ P3 _$ n+ n* Y% {: R mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
' W9 C R. \6 Q' \( n/ H) Q mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
4 B. i+ Z i5 d" d, w0 B VMMCall Get_DDB I2 u3 {" g% b- j
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
. P! ~: l, K2 C1 X8 f- f4 @5 ]# p0 \8 h! Q5 A @8 E8 v8 s4 ]4 b! h
Note as well that you can easily detect this method with SoftICE:
3 B- v1 K9 S2 h: Q bpx Get_DDB if ax==0202 || ax==7a5fh$ q# {! I9 v* e1 U" c8 J3 r; r/ [+ u
" \) [ E2 M' {1 p. g3 a
__________________________________________________________________________* _( K8 ]" ~$ b9 c g
+ r% D [+ Z6 l5 {: c. y9 M
Method 10# K K% J1 `3 A) c* f# K
=========
" k1 I- i( n- ^ B6 a! y, a. h" u" @$ k* B5 c' H" V* c1 T0 J q
=>Disable or clear breakpoints before using this feature. DO NOT trace with& L9 ^7 Q0 p7 C5 E( C, F1 _
SoftICE while the option is enable!!
" V9 Z) X0 J6 V9 S! n! u. c8 \* E" Y4 W: Y
This trick is very efficient:# j; J$ R- A: |+ r) H, Q
by checking the Debug Registers, you can detect if SoftICE is loaded% U! x8 {0 S2 X: i3 {% O3 d- ?# S: l
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if' ~; |) M/ ]& @5 ^/ {9 o! h2 d
there are some memory breakpoints set (dr0 to dr3) simply by reading their
& `% C M9 b/ q( r! bvalue (in ring0 only). Values can be manipulated and or changed as well c4 I& ~, v) i: u7 L8 X& { X
(clearing BPMs for instance)
- X. e/ z+ V1 s+ ?
- Y1 l1 K* |( k; r__________________________________________________________________________; R8 l: c9 [1 F5 ?' {% L
% A6 [0 t( g1 }% R) r ?% ]Method 11& I. O$ u0 f* }6 j& j6 S2 _' k
=========/ X2 B( `. Q! G P' q( c
x& |2 r$ |. Z1 \
This method is most known as 'MeltICE' because it has been freely distributed
. b$ z/ @* b2 j9 \; c- @, tvia www.winfiles.com. However it was first used by NuMega people to allow4 a% S: x, E p9 ?9 i( b7 M
Symbol Loader to check if SoftICE was active or not (the code is located \1 L. Y' x4 C
inside nmtrans.dll).
6 Q! |- |& d7 B* I/ Z& F: j# m2 G8 X" w0 ?- q S V
The way it works is very simple:
8 h. ~% B' [7 j$ [1 }0 |It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
- e, O4 `' V0 O$ T. b9 U3 _WinNT) with the CreateFileA API.! Y, n+ H6 M7 h6 A3 ]9 A; x
8 R V* n6 l. d; c. ?* e- `2 v
Here is a sample (checking for 'SICE'):6 q, B7 D! l3 b/ u5 }6 S8 q$ B* C
# y# A5 k) b4 a" b4 R
BOOL IsSoftIce95Loaded() g( k" S; @ n( F
{
5 g4 ^3 J2 X& W- X3 l; R) m HANDLE hFile; 8 g+ k+ p% W3 D/ a+ a* p
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
: ^8 f( |. n+ z FILE_SHARE_READ | FILE_SHARE_WRITE,
, _! ^$ Y# ~' z$ v7 x D5 B! E0 O NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL); W1 k0 G2 S @$ m
if( hFile != INVALID_HANDLE_VALUE )5 S+ v, | X$ x
{2 j# ^* I$ O; y8 N; K# o Y
CloseHandle(hFile);' _: a7 g( H7 F+ \' u' q
return TRUE;: Q. y% j9 L8 }. J* Y
}
9 F& |( r) j$ Y m6 ^0 L0 {+ n return FALSE;+ W3 W- _' e2 p6 q& O. ?" _1 Q# h
}4 g! ]" b, e3 k3 _2 ]
7 A5 _) I. W( D7 `# BAlthough this trick calls the CreateFileA function, don't even expect to be
4 t' P$ W' f4 sable to intercept it by installing a IFS hook: it will not work, no way!) r2 D. O5 @5 P/ W- f
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
, N* G* g% V% p+ c1 ^! P) ]& zservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)' x3 T: q4 V9 s; [
and then browse the DDB list until it find the VxD and its DDB_Control_Proc a$ V) \4 E. t% Z" ^
field.( B Z5 X P1 |
In fact, its purpose is not to load/unload VxDs but only to send a : {4 b( \/ W1 N1 V9 o
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)/ g( y9 [; F* j% I! y0 `
to the VxD Control_Dispatch proc (how the hell a shareware soft could try/ j2 L0 J$ Z- _, L4 ]" L
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
# P. G' h% j9 F7 s5 x8 N% ]If the VxD is loaded, it will always clear eax and the Carry flag to allow
! f, B5 l* w' W1 Y2 F" f( X$ {4 Kits handle to be opened and then, will be detected.9 M- a6 x; @: h/ t C
You can check that simply by hooking Winice.exe control proc entry point
1 Q1 u3 e1 x6 ], Jwhile running MeltICE.
/ f2 U! X+ `( D1 _* c! D- N( }
0 l% N2 f" [( b% v! t( i" l% m- a- S* A6 D: j' v2 L
00401067: push 00402025 ; \\.\SICE9 R: M- x1 w P6 j, g
0040106C: call CreateFileA5 m! a' c9 N* a; S8 u: x9 P& d
00401071: cmp eax,-001: {4 k \ Y" z8 `5 r% W
00401074: je 004010910 @8 A- Q6 a1 K4 f7 ~' Z
& c: Y: L9 y7 s5 {7 P
2 R( J1 }8 } U/ S$ b% P1 o
There could be hundreds of BPX you could use to detect this trick.7 q/ ?( T& G q, h/ _
-The most classical one is:, Y& m3 K' q2 q) c, d4 Y2 Q( h) D6 O
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||" v* A/ M$ ?! M$ f( A
*(esp->4+4)=='NTIC'1 T; K w& s; q% K; L
* n5 X4 ?& \0 S8 N7 w* w-The most exotic ones (could be very slooooow :-(
3 V. L8 [0 A+ p) x: r) y7 T BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') 7 l- T8 ]0 e& T( ^" @
;will break 3 times :-(
Y- \5 ^$ j( _$ i7 a0 j9 j* x; m; B0 n9 u* W! j
-or (a bit) faster:
+ Q+ [0 v$ k! W! U2 M; N BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
" {5 W" S5 V' O4 ]: B+ U$ U: C# M# }& ?6 e1 ^: O; ~$ M8 r9 w
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' 6 Q6 l7 w4 t2 c/ _ A j
;will break 3 times :-(+ X) h, z S Y; {( u% q
5 k' W- ~3 b7 |* ?-Much faster:/ H* i1 C$ x6 T; ^: r
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'% h' f9 Z! y+ I# l5 Z
7 k* r$ \3 E |* vNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
4 G; i$ d6 k" B8 g5 ]! pfunction to do the same job:6 z4 e8 k) c7 S8 E& V8 O3 k4 V
. e8 C/ A1 R* ^% B0 u push 00 ; OF_READ& v) O! d9 L" l3 l
mov eax,[00656634] ; '\\.\SICE',0
* ^; S, Z* A% o& T& |" D push eax/ t+ o6 L8 I( Y0 Q9 `, f3 [
call KERNEL32!_lopen
7 n! F* T. J3 G5 S inc eax
# w& }3 R# v4 K jnz 00650589 ; detected( g$ Y7 m/ }% X" u2 f
push 00 ; OF_READ$ d) Y" r+ _- N8 f0 p2 B" ~ ^
mov eax,[00656638] ; '\\.\SICE'- R% ]$ c% ]* @4 Q* ^
push eax7 U& P. l+ ~& o7 P: G0 g7 N/ A2 S
call KERNEL32!_lopen1 N! ^2 g( h$ o. \& z8 f4 k0 @
inc eax
1 N1 ]' R" c& z. ]+ ] jz 006505ae ; not detected" V B# P6 [) q- F- i; z
& z+ d, m, k+ c- w) i
& ^! o+ O$ t$ P$ |# j__________________________________________________________________________+ `, Y+ ~- x# I7 J8 D0 F5 @
( t# c. r' H; A% {# B0 M& K
Method 12
; l( g+ L/ ]* w, M=========
4 p3 ]% H1 k- [
4 l; P; p$ k) P! D7 NThis trick is similar to int41h/4fh Debugger installation check (code 05 S3 n2 X- D1 a9 [- U5 O7 D( g
& 06) but very limited because it's only available for Win95/98 (not NT)
- Z* N8 J3 t4 Gas it uses the VxDCall backdoor. This detection was found in Bleem Demo.( R$ d+ o! e8 H3 |8 `
) F4 `4 W6 F( J( Z push 0000004fh ; function 4fh% I: M1 j2 o% _% E* |% s" H9 v
push 002a002ah ; high word specifies which VxD (VWIN32)
3 `5 [" |5 m3 w7 ^ ; low word specifies which service
9 u0 k: ~2 a+ x8 h (VWIN32_Int41Dispatch)9 b1 T0 q2 o4 U, G# U. u' j$ W6 X8 X
call Kernel32!ORD_001 ; VxdCall( |. A; [( ^9 F0 h
cmp ax, 0f386h ; magic number returned by system debuggers
5 R: l5 e, [3 M* U& o jz SoftICE_detected Q8 [& o0 z& a) _
8 F; v% R8 p& \* nHere again, several ways to detect it:
: R% }; x4 c6 \$ [; J
: U$ M* w, d Z BPINT 41 if ax==4f' e8 S) m7 ~% C# _
4 b! A! }5 |4 X. v! [
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
) t9 V8 ]9 M0 r+ C5 l$ I( f7 i# B+ l% ~$ {
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A4 w( {& k5 b, j3 D$ Z
) ]7 {# z7 c9 `/ _ BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!0 X$ h5 T! o# I* \
" I6 j G0 ]/ o! m0 K6 n
__________________________________________________________________________
; y# ^# O$ H; l ]7 C W9 S8 F4 v+ g' c4 V: t. b: X; L, G$ n
Method 13$ R% _. B4 z" W
=========; N8 U0 G" |, v4 P
]' P" D/ b1 v7 P e! RNot a real method of detection, but a good way to know if SoftICE is
, O& t* g1 F/ P4 U& |, zinstalled on a computer and to locate its installation directory.% a' h3 ]) V8 q8 V, e0 m
It is used by few softs which access the following registry keys (usually #2) :8 M4 ^9 e' ]. l; g k' r1 a! g
5 c1 `! j k' [3 N, Z-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
& Z% }2 m3 E+ ]! R4 G W\Uninstall\SoftICE
: a6 `- t* V; T* I0 A2 h4 f-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE5 I2 p! _; ]" O$ b: z8 R
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion; I) T% B& U3 p7 F8 P
\App Paths\Loader32.Exe9 J* r" z( j$ N" ^* \
% \( H4 f6 l! ~
/ N) P3 z/ z/ j$ MNote that some nasty apps could then erase all files from SoftICE directory3 G! ^% l& I d* j$ u
(I faced that once :-(. Q1 `; W' S h6 h4 n. m7 D. L
! ~# L& P& e; Q k% d( kUseful breakpoint to detect it:1 q1 i- I+ `6 c2 l* o
2 A$ L9 A { x$ C' B BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
! [( X% c' m( U n. Q( F$ H; ^5 M$ h% ^% o+ a* g3 N1 ~" D e# G
__________________________________________________________________________" g; _; @$ H& |8 d8 W( _0 ?3 \
( i' x' e0 U$ p
5 U u! N( U7 V& I! M4 [' M8 H- S3 zMethod 14 ) Q& o! y5 [1 J+ m# S( m2 c
=========
5 L) Q# Z+ h( p- C; p* z4 Z. Z. T# V9 C* w8 d
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
9 z* Q3 i+ |# ~0 gis to determines whether a debugger is running on your system (ring0 only).
5 }1 o) z9 `6 g* W% I
% I! V2 R' k n- y+ b4 N6 R; C: | VMMCall Test_Debug_Installed; y! ]$ O# n6 \0 x8 n7 [5 I, ]
je not_installed1 R* `. N* g' h# |& s
5 b w8 o+ U3 {2 x6 T/ r
This service just checks a flag.0 g- X* _" Q' K, ~& n! L* n: u1 I* u
</PRE></TD></TR></TBODY></TABLE> |