<TABLE width=500>
: E, z S4 c/ h5 m<TBODY>
, `+ g2 B, ~4 U0 `1 n L6 A<TR>$ v1 L# I# U2 b( ]& ~: o
<TD><PRE>Method 01 ( V9 {- i: |- D. b9 _2 x
=========
& v& [- h7 g5 o
) q0 r" B0 w. T1 ^This method of detection of SoftICE (as well as the following one) is- r7 U! @& v# Y, {7 F: d- c
used by the majority of packers/encryptors found on Internet.
* S5 W4 y9 j: N4 zIt seeks the signature of BoundsChecker in SoftICE" s% `1 j7 v7 Q- A: @
4 y) r# F3 N5 [; I7 ^9 R; V" D } mov ebp, 04243484Bh ; 'BCHK'2 `5 I* n! S# ^+ j1 X% Q
mov ax, 04h
' c9 A7 X2 A9 _! X! d; H% a int 3
& ^4 M4 Z4 @7 v6 s( y) N& E+ b# q cmp al,4
7 o; i7 R; X4 M6 e& r5 e( V jnz SoftICE_Detected; N6 t5 ?7 o$ |0 `: S2 R
- l8 {! P+ k0 f1 u# G4 g( Z3 u___________________________________________________________________________7 I8 b" ^: }# w2 t! x
; e* ^/ q3 C3 fMethod 02
1 ~9 S2 w, H: Z& ?. z) \4 H9 [=========
% }1 }- }1 O- p- M) K- u3 n) A5 O0 P7 x0 b# k. E* n
Still a method very much used (perhaps the most frequent one). It is used
* z) D0 [0 W* j8 [1 a) Sto get SoftICE 'Back Door commands' which gives infos on Breakpoints,# i3 I4 @2 i7 s" Q3 M, V* l. c( [
or execute SoftICE commands...
0 g! F$ }% h' R# m+ sIt is also used to crash SoftICE and to force it to execute any commands% J) X" u4 z0 ]/ o6 P3 }
(HBOOT...) :-((
8 z% t; W$ f& b3 U) c1 z
( \& O3 x4 `( _+ @Here is a quick description:
% p4 i- J) b7 A9 l& F( Y, L-AX = 0910h (Display string in SIce windows)3 H9 S5 O7 n8 C# g1 K0 ]
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)7 K9 ?' l6 q W' z' _* F
-AX = 0912h (Get breakpoint infos)) W2 ^, F; V, V) U
-AX = 0913h (Set Sice breakpoints)
0 ?* j+ j! V6 K8 ]-AX = 0914h (Remove SIce breakoints)6 Z4 v; e4 x# x. @0 B2 q
" T! X2 T5 q( \! UEach time you'll meet this trick, you'll see:
: |+ q. y" y% v2 Z-SI = 4647h
0 t" H: j; r$ R: [-DI = 4A4Dh
7 b2 v8 c. J; F1 n, P! [) MWhich are the 'magic values' used by SoftIce.
2 e+ I3 `' L, \1 W/ fFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.* B3 ?; m4 ~- n4 c3 S. d
2 e: S8 P) j. C$ lHere is one example from the file "Haspinst.exe" which is the dongle HASP
$ V/ @% b4 }9 N" k* K& bEnvelope utility use to protect DOS applications:
6 Z) K; _9 @, P c, I# A" k- h& M3 e( c5 i" _" C
8 k# d, w; o' L c; q9 o4C19:0095 MOV AX,0911 ; execute command.6 X! n4 ^# g+ A3 C
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).5 ^8 l! m* |9 f4 i
4C19:009A MOV SI,4647 ; 1st magic value.
- I8 M. `% @$ B; O$ k- P# G9 D7 m4C19:009D MOV DI,4A4D ; 2nd magic value.6 {, O$ U8 }( c: ~ ?
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*) s, `4 h# @5 S0 P" Q
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
1 u- `2 o! M" c& e4C19:00A4 INC CX( a# E6 J& K. J6 M1 |
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
( q* i! d7 z; \* D) e4C19:00A8 JB 0095 ; 6 different commands.
( c! N# P9 |$ l n/ S4C19:00AA JMP 0002 ; Bad_Guy jmp back.
" |; k$ @5 I- d9 A9 p! Q$ ~* a% `4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
2 K6 X" c. H$ v6 ?; R* F+ U, G5 n( v% p
The program will execute 6 different SIce commands located at ds:dx, which
3 i% o6 v8 j2 ]5 |" f/ Tare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.# z* z. v& [: ^
) h! U2 h& Z T/ W6 G* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
z9 e' f& N0 B+ B; S: Z___________________________________________________________________________
4 @( r% S) N! e v0 p1 ~5 @3 K% t. _3 ]9 N
6 h) b7 Q7 N$ J1 N: d( v% L' O
Method 03" a' V) G/ c8 q( [2 B* F
=========# l' X6 j1 } A' S
& e$ G0 O9 H1 d; DLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h5 |7 o$ ?$ n+ z! q
(API Get entry point)
% B% w1 Q' d ]( v3 a- r7 C & P7 }. \5 ]1 o
7 {7 h; M4 F/ A* F) I
xor di,di; w& z3 f& L8 T! y% R5 l
mov es,di
# q) D. _! X K, ]9 w7 N) e mov ax, 1684h
, h& d' E* N# ?2 g$ U# k mov bx, 0202h ; VxD ID of winice
) @# j: e7 N6 Z6 t int 2Fh1 z+ o" Z. Z- G8 P# e* t7 W) b4 e5 V
mov ax, es ; ES:DI -> VxD API entry point
5 P: u- E2 V/ Y! e8 I7 v) C) x add ax, di# T' l6 M6 I: Z: }% G
test ax,ax
, }3 x; ~. X! s* X; i! ]9 q+ q jnz SoftICE_Detected- ?9 q$ }: I( y! g9 q7 Z$ p
# f. ~. y* }- K$ P
___________________________________________________________________________* A' n) c ]& Z8 U
9 l' z8 d3 t4 \2 i# `
Method 04
% S* ?$ R! {+ H: J=========
# |5 W P8 O, b' b& g$ U' E5 A* K- |0 u! t4 ^
Method identical to the preceding one except that it seeks the ID of SoftICE' i8 b; }: b3 {% r6 x5 p
GFX VxD.. j' }+ y1 A) k6 b: V$ p
/ b' k8 ]3 K, l; r xor di,di+ x, z& @. m. r
mov es,di' G+ q* i" V' w! H
mov ax, 1684h
' n( d& l! d5 M5 e8 V3 C: } mov bx, 7a5Fh ; VxD ID of SIWVID
/ H& \" t8 o! r9 I int 2fh* R: P, L% w4 z* [2 U
mov ax, es ; ES:DI -> VxD API entry point. W- x" Z1 H8 z
add ax, di
. o# J" y/ h& ]9 ]: \+ N test ax,ax7 f$ J6 x, `6 m' m8 [# T7 s' P
jnz SoftICE_Detected
# j+ d: }, n- o8 s. Q2 e# t
+ n, ^& x. f) d/ E5 }__________________________________________________________________________& e9 O- V' o1 d+ q" {
8 ?4 r$ O* X. k% ^) y( U4 T5 L
6 P. E( e6 Q! R3 [5 [9 oMethod 053 U7 q( y4 ^6 F" K4 s4 Q- r+ x
=========
5 K8 g" K8 y6 f/ _# }2 `7 L9 `0 e/ L4 Y9 F1 k
Method seeking the 'magic number' 0F386h returned (in ax) by all system/ Y6 e! h( B3 \0 E, e; R
debugger. It calls the int 41h, function 4Fh.1 Y4 L+ r, F7 l G6 y2 W) J+ I
There are several alternatives. & ]) s; J: Q9 k0 S# Y
( Z0 v9 c% w3 h6 p2 x8 TThe following one is the simplest:
1 z9 a! d2 I) E8 ]! o) u' X' R) l1 p: r
mov ax,4fh
$ {, r8 L6 |# W% u; R int 41h
! C% h" L- w. w W! s" r' j6 I cmp ax, 0F386+ h! s. ]3 p2 T; Y) t- `3 M
jz SoftICE_detected1 j& \. O4 m y0 v, b5 e/ X( `) `
3 T0 s9 D4 }6 Q1 a: U, e- Z i" t
/ w% A: B# Z7 S9 WNext method as well as the following one are 2 examples from Stone's
) @# ?# z! k2 |"stn-wid.zip" (www.cracking.net):5 ~& X5 h4 c4 f ]+ |
& o3 z `9 ]0 M8 j8 P) c+ g
mov bx, cs( |" c9 i3 }9 d
lea dx, int41handler20 S! g% f7 N8 Q' G4 x& l
xchg dx, es:[41h*4]$ k5 \& N- R# t1 @% t
xchg bx, es:[41h*4+2]. T1 p2 I. _6 x- M3 w1 b' |
mov ax,4fh8 m/ S; L, ?4 B- u' m
int 41h
, |! X; L( I, Y xchg dx, es:[41h*4]% n% g! ^* D, z
xchg bx, es:[41h*4+2]; p% \2 Z& T( a* u1 o
cmp ax, 0f386h/ Y* Q; y( P/ h+ d ?7 @
jz SoftICE_detected$ `; E. z" q! Y5 n. j7 h1 Q
# t$ h& b/ G% p8 h7 u3 uint41handler2 PROC, Y8 m+ V; a/ z- Q4 o) o
iret
/ i# j3 x$ O, X9 ?) @: iint41handler2 ENDP
% }) D' {- m; p4 E+ ?
' `& n0 z4 a/ i0 P: x
% @/ z' g. N3 I0 d' F_________________________________________________________________________; B2 M- B6 Q7 M/ A; ^/ \
( u) b5 m) N7 b0 T
3 ]2 Q8 a: L) W" d# }2 xMethod 06
6 D, t% s, b" Z6 c9 B=========
' k0 y) L3 x' H' {
: j" O2 s* A7 D9 l0 q8 n" Z$ f
6 \# a: r; X- ^9 Q9 k3 s2nd method similar to the preceding one but more difficult to detect:1 `7 v' k" \' }* b5 y$ V; Q& y
7 X& c& o, ~ }) |7 h5 [2 X2 x" Q: u9 X3 D. T+ r, a! f
int41handler PROC4 @7 g; K6 I3 D! I+ v
mov cl,al7 ~# ^+ n4 r0 m" Y
iret
$ J! _0 w- F# N$ Vint41handler ENDP
3 I& i( g! {* p$ }+ B4 h
2 I) ^3 u- c* _3 N! N, M4 [$ R* A) D. g4 O4 ^4 [- s) U7 l. I
xor ax,ax: F. Q$ s7 a1 E; n7 y' i
mov es,ax
* B( ]7 q4 @* _( N K2 h mov bx, cs- o7 t& N/ [, e( R @4 @
lea dx, int41handler
) Q: R. k, z; N+ G+ l# Z, ` xchg dx, es:[41h*4]) `" ~/ t! w2 _% _, W
xchg bx, es:[41h*4+2]
h3 j3 e2 Y& B: v" {! c in al, 40h
0 u# r9 Z! G, K1 n8 D6 N& Y& d xor cx,cx$ Z2 V4 S$ q1 v5 Y( D" o
int 41h& u! X- o6 L2 Z* T7 P( u# q5 W0 p
xchg dx, es:[41h*4]& U4 b/ Y2 E4 n
xchg bx, es:[41h*4+2]; {% |/ ?" `3 E! ~
cmp cl,al1 C' U- q x' i5 r. H4 w8 E
jnz SoftICE_detected- @0 j: i$ I( I0 Q4 S- d: ^
' z; ~6 g4 S% @+ X' q8 N
_________________________________________________________________________
" }5 R2 q, v3 T' h5 A9 d) s
( N' G5 w, y% z& p/ E: h' V4 RMethod 074 E$ m8 ]: C) I1 f4 R4 {, D
=========& {; k+ _' w* Z% w
: X! f& `) ~& v8 B4 \% ^% k9 p( L* A" S
Method of detection of the WinICE handler in the int68h (V86)
( f+ |- a/ ?1 ^# \% m: `$ `6 ^2 I1 e9 v* e# }( r
mov ah,43h4 N# o) J$ l+ e7 M" @7 N
int 68h
4 Z `7 r z5 x: e S3 [9 i cmp ax,0F386h
! P3 B2 g: s! P% | jz SoftICE_Detected8 O- t4 ~( N# p
7 H" Q4 p: ?; A+ G4 s
7 Z6 ~* t! U4 \( ^=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit: x h$ G/ w) v* y! |+ _/ ?( q
app like this:
1 b6 h1 I& l# v' y/ [7 K
; |: J6 J; y0 M/ O8 z, F: t BPX exec_int if ax==68' @; N9 X1 r4 k# X! f
(function called is located at byte ptr [ebp+1Dh] and client eip is$ M) m0 u( \$ y/ D2 d) R* D' Z2 G
located at [ebp+48h] for 32Bit apps)/ T$ k$ Q$ T0 v) A
__________________________________________________________________________, q7 U) R3 @6 p! [
, B- U: J2 T% e0 F4 S
) |5 S& Q3 u6 ~
Method 08
" T, n& j+ c! V0 |=========- Z3 n9 A$ g2 l! G
. {1 X. o2 L7 w, U9 w6 m ?
It is not a method of detection of SoftICE but a possibility to crash the
2 E1 x3 [1 c- z! O zsystem by intercepting int 01h and int 03h and redirecting them to another' D X) X0 K9 M; C( F' E
routine.
: P) R+ X( D. Y0 U( C P) IIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
6 O& S5 p% V: W0 xto the new routine to execute (hangs computer...)
+ r. ?: k2 y6 x+ j" S. q. B' T
$ D: c- Q2 Q' k0 t! r( h1 X mov ah, 25h
% e6 E4 `- j) g3 [0 w ` mov al, Int_Number (01h or 03h) ^$ c! v2 i- n7 B' y3 @! ], K6 ?
mov dx, offset New_Int_Routine
: Z! x7 k7 k5 _( ` int 21h' ?# ~! g9 |5 I) d' O8 ^7 Y2 i
^5 P5 A, _# G+ L' A0 p6 }__________________________________________________________________________
! k" V' @* U! _# w2 J
: C7 O' r# S2 o5 h6 g' T7 B4 _3 hMethod 09
4 y% {2 W F( F' E) U=========0 P! G! Z( y3 S! {( k* s: Q
* C2 e' J3 z/ M- } n/ c7 nThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only& q+ b* H# W# M6 m4 s+ \
performed in ring0 (VxD or a ring3 app using the VxdCall).$ ^ c; {( E+ y, M
The Get_DDB service is used to determine whether or not a VxD is installed
% l3 \) b6 i- R" Gfor the specified device and returns a Device Description Block (in ecx) for
Z# m. q. \% w6 bthat device if it is installed.
" P! U/ I1 t$ \
' W3 q+ Q% D, v* N X mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
$ E. h* G; M- k9 n6 i mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)2 ~3 v# b1 }" k- | t9 H4 O
VMMCall Get_DDB
. [# I7 _6 S( A* c" L mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed7 G2 i! C: M: v3 ?
9 Y* X1 C4 L6 \
Note as well that you can easily detect this method with SoftICE:
4 [) F# y6 y& [5 P1 t1 [$ ?3 v bpx Get_DDB if ax==0202 || ax==7a5fh0 \, w( l! U, V0 N6 U' c. i. R" ?
( i& b, |7 ?9 Z. B$ R/ m
__________________________________________________________________________
% U1 @9 e1 m7 Z; @# n
, m: ], A4 N5 S: ?Method 10: f* @' D0 l$ t
=========
; q& z. ?# k+ Z2 S' E
7 ]& K8 g A. Z6 T- o- j0 @=>Disable or clear breakpoints before using this feature. DO NOT trace with
; g1 }4 J Q& C) x: g7 f SoftICE while the option is enable!!1 d. T. X# F/ V7 h
) V7 D3 J* N; K* q
This trick is very efficient:! [1 U' w, M X4 a3 m' T% b+ R
by checking the Debug Registers, you can detect if SoftICE is loaded3 o. N, l" p+ o) v
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
# T0 I, x) P0 p1 D3 \ v% qthere are some memory breakpoints set (dr0 to dr3) simply by reading their
& P8 D1 K) a9 Y2 w8 u: `value (in ring0 only). Values can be manipulated and or changed as well
7 _7 Z2 d5 S, \3 t: |) v9 E+ ?2 i(clearing BPMs for instance)0 K% N& E1 P: }" ]
; B2 \" T3 q+ |$ N( I/ \
__________________________________________________________________________; I" {( Q0 |! S/ _
4 B$ ~1 M: }* [, l
Method 113 Y9 A+ \. t+ i$ j; N
=========- Z# q! P( i* q9 i" X8 m( d
% G# d1 s% }/ y; c" G1 JThis method is most known as 'MeltICE' because it has been freely distributed
5 {( E+ ~7 y& D$ h6 kvia www.winfiles.com. However it was first used by NuMega people to allow
5 L1 s/ T, U9 [Symbol Loader to check if SoftICE was active or not (the code is located
/ A4 c& B" Y; N% Q" Hinside nmtrans.dll).( O( K( F& T! g8 x3 i* r9 v
4 A8 R' s' w0 A6 y6 t% A* mThe way it works is very simple:
, t. k6 Y5 l# ^0 w M, y7 O8 sIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for: V; j$ U5 e+ ^, \! h
WinNT) with the CreateFileA API.1 j3 A+ N2 _1 k* ^7 u( g- e2 u
0 i& `6 T. O* ^& l2 ^
Here is a sample (checking for 'SICE'):" y; D4 ]: w i/ J, ~% g
' K; n! J0 l/ n; E) }/ s" {/ `BOOL IsSoftIce95Loaded()7 d% _; M4 q9 u% [0 h
{
2 ^+ m# A- z6 t" y2 @! V2 F' j- R HANDLE hFile;
9 G- O8 b) B# z, R) Q# N G/ Q* C hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
6 U; u1 h1 G8 _ FILE_SHARE_READ | FILE_SHARE_WRITE,
6 t9 {/ E+ [; E; o( I1 N8 T+ q1 c NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);; o+ ^9 F' H$ a( l
if( hFile != INVALID_HANDLE_VALUE )
& X8 t; f q( c' P {
8 Q; `7 x! F5 q$ A! J1 N& \ CloseHandle(hFile);8 k/ j$ ?8 y; ]9 |5 }# c
return TRUE;
1 D" N, l( y4 t) q: ` }
5 _/ z' H9 ^2 E7 _% A3 `9 F% } return FALSE;6 Q& a, \8 S& j! {. Q8 ^
}% z+ U* W& l, _6 ]7 S
0 B- ]+ S k) y" I; D$ pAlthough this trick calls the CreateFileA function, don't even expect to be" c" P, d- e/ A
able to intercept it by installing a IFS hook: it will not work, no way!- x6 H s, d8 T! u! D
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
$ R! j: L7 I* c, m' T2 X. }service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function) S. x" _: t* }" D# e
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
! Y& E- A: V5 ~" O% Pfield. U: A* C$ g8 H3 V/ e* x
In fact, its purpose is not to load/unload VxDs but only to send a 0 X# F% H2 ^ k, {
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
; N( D, T8 W8 S; E) _* Lto the VxD Control_Dispatch proc (how the hell a shareware soft could try
! ?$ _- w+ w1 ~5 u$ N9 o0 F) U2 Lto load/unload a non-dynamically loadable driver such as SoftICE ;-).
9 m- [+ X# a( T# ^6 A1 f! ]4 C# O. jIf the VxD is loaded, it will always clear eax and the Carry flag to allow/ I0 w# G& h' M% c* d8 x
its handle to be opened and then, will be detected.7 P! \+ h, T' A% {3 T
You can check that simply by hooking Winice.exe control proc entry point
- B; f$ w7 I) i7 Gwhile running MeltICE.6 e* W1 y' q9 [% |& a) u
0 z' e- L; Q- q4 ~% L
6 t7 f+ ^$ Z7 b. I! {5 r: ~' P 00401067: push 00402025 ; \\.\SICE% s* i( D8 x6 [7 ~/ A5 U- g& r8 L
0040106C: call CreateFileA N8 S4 n a# O: S$ t
00401071: cmp eax,-001
8 m! ~- h+ [) R 00401074: je 00401091
3 ]2 r0 f8 U2 |
7 O3 m5 f9 Q8 b9 t2 y; Y) Q$ T
7 Z; t# `2 k4 S# u5 SThere could be hundreds of BPX you could use to detect this trick.
$ ]/ B( H8 {% x. M- ]-The most classical one is:4 L$ H- s9 w' }3 |( y0 _: s
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||* I& X5 @2 N. W! {
*(esp->4+4)=='NTIC'. M+ J& y0 Q% q2 \- Z, [# \) h
3 W. X3 Y" A3 g, K9 n
-The most exotic ones (could be very slooooow :-(
( Z* G; D" T$ N1 o) r8 _8 N BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
* Y' I: T' N7 K" V, _8 g* ^' S* { ;will break 3 times :-(
- o0 M. Y1 y% e* }# J4 i: o- r" R4 e+ A5 r j: E7 F1 d2 U' s
-or (a bit) faster: ; T! w/ J* N" ?* A
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
( G: O. H) z" ^2 i9 L, ?: }& m; _' x( ]9 [9 F8 o' I; \
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' 3 l. l) F, k+ R5 G- j- g
;will break 3 times :-(& C9 K) d6 D+ b6 Z- r, G' ?" X! C* Y
; a0 E8 s0 @) K' e% O V-Much faster:
[) a& o- ] s: u1 u( h3 s3 J BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
4 ^; x4 i) S2 i1 E
2 z( ]4 F3 b. l6 {8 eNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
8 ^, j9 O2 e1 F0 p+ t( k4 Mfunction to do the same job:' u" B# ^5 G4 u/ }( }
4 l4 j" s- ?& c1 l+ _. V+ a
push 00 ; OF_READ5 B4 B3 E6 s3 C# F
mov eax,[00656634] ; '\\.\SICE',00 r& D: [ ~& u+ Q1 l9 h6 s
push eax, E, Q3 ~( T2 B1 m6 l' [2 d2 s
call KERNEL32!_lopen
. W }" a. J7 @* S" T inc eax7 q) j9 n" G4 x* u
jnz 00650589 ; detected
9 j9 T4 e- } g push 00 ; OF_READ
$ F7 w' N. e" e6 U; W2 H( q$ y mov eax,[00656638] ; '\\.\SICE' D, y- {0 @- [+ K0 ]
push eax
7 }( O, {0 X; G$ X, L' d call KERNEL32!_lopen
. ]9 \. W) ]' T, r# E inc eax
/ R. o6 E: c6 P; B+ H, o jz 006505ae ; not detected T2 V9 Y: k# l- ]+ ^
2 u. s7 U; Q# D# ?7 \$ q* I/ l( q( V
__________________________________________________________________________: e9 _- `; ~& D3 ~2 Z2 P
: n/ q, Z; ?0 Y
Method 12
1 F: k9 b8 M0 y) B0 C8 R=========* i: s& [- W" u* t. F5 T
; m/ A2 N; g2 o/ [) n& a
This trick is similar to int41h/4fh Debugger installation check (code 05- G! e7 m+ T+ A0 k
& 06) but very limited because it's only available for Win95/98 (not NT)
0 m( `; |. {3 d# ~/ `9 K @9 `as it uses the VxDCall backdoor. This detection was found in Bleem Demo.7 `1 c% J W( U) W
: {7 B! ?9 o( y* z" m
push 0000004fh ; function 4fh
( _* ^: i* [8 \- O push 002a002ah ; high word specifies which VxD (VWIN32)
9 d2 I& |) o- i ; low word specifies which service! E3 P4 a/ b+ M' f& {
(VWIN32_Int41Dispatch)2 M( E& M& H8 e' m" H) c- B
call Kernel32!ORD_001 ; VxdCall8 H" s* S; d$ F3 I/ S
cmp ax, 0f386h ; magic number returned by system debuggers5 g6 y. f+ K( w a$ k2 L7 s
jz SoftICE_detected5 J' o9 \0 q; ]! {1 j! @
2 B4 c) Q" x5 r1 S9 rHere again, several ways to detect it:
7 {- C( U/ _4 n# d) F% x! e/ x& g5 P h* O+ _
BPINT 41 if ax==4f) f& Y8 S) l) C2 {9 U9 Y
2 }! q( u1 F2 l4 H5 W9 o, D0 r* V BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one: t3 E5 N) W* d+ ~8 b7 W$ U/ m
7 i' a. Y- o5 @5 m BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A, p3 S' b. h2 z5 J; K$ r8 h, ]
& S1 S5 ?( w; y+ u BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
3 A" }0 l. n$ m9 m% F
% V5 _. Z; p/ l4 @8 D% K( J7 c) M4 S5 m a__________________________________________________________________________
0 |1 G4 D: {/ j4 I- Y x2 H/ H( z, d6 ?- e* y
Method 13
0 I) c- ~& }' {$ b5 T) J" _9 r=========; a3 D) I$ d( R5 q+ ]" H9 G
R! b4 I a& z9 m7 e- {Not a real method of detection, but a good way to know if SoftICE is: E! L/ B! u K/ t' V
installed on a computer and to locate its installation directory.% m* O H5 E4 `0 J" P* m
It is used by few softs which access the following registry keys (usually #2) :
) S* T- ?. A' r* {5 n8 w! ^( J0 y; z# S
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
* O. |8 Q+ Q: e0 m z' Z\Uninstall\SoftICE
* V+ ]/ \4 z6 S R4 `% x-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE0 D B! X8 G2 J' t" ~
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion" t/ G5 V! ]7 I" Q
\App Paths\Loader32.Exe: l( r" G. A9 m; e0 W) C! J
2 k+ U! c) d6 b0 w) m
4 x' v8 Y# |' Y3 N
Note that some nasty apps could then erase all files from SoftICE directory2 I7 ^# [/ b$ |9 x8 S3 _- U
(I faced that once :-(
7 e! B, |2 _0 c7 u/ l0 M9 y. l4 F r1 H. ~& O) P/ a
Useful breakpoint to detect it:
( n* ?; y2 @5 h" Y( M: n
P- q0 z, d$ _9 K" b C0 O8 x BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'/ B# k' L6 G. K5 ~" m1 J& a, z0 H
9 D4 s! Q3 w. O% P4 x6 f' M) l
__________________________________________________________________________7 J' v& e: M5 z' q, O
6 D, U4 ]# i& |" T* R
~' T1 F- n+ L- KMethod 14 1 P/ m8 {7 B4 D/ x/ e, m
=========$ o3 q& g! E7 u9 ]. Q+ n+ I- l
5 K1 j5 y4 Z: J) aA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
- P, u* U4 Z3 H! N% \; Dis to determines whether a debugger is running on your system (ring0 only).0 O a( Z) d1 u+ e% M) ]
* \) Y- V: V9 J2 K VMMCall Test_Debug_Installed: D/ {( z! @3 I+ P. S5 p
je not_installed/ c- ~0 Y) K! {+ V! v. o! ]
7 G- A& U& q' t4 i( R8 ]9 {+ e, l) K
This service just checks a flag.1 u" X4 c4 o H
</PRE></TD></TR></TBODY></TABLE> |