<TABLE width=500>
& x- g! i! p7 v) @+ d- X<TBODY>
- N1 p! U, v1 L+ y: r<TR>" A# U4 s" ]" n- m. j
<TD><PRE>Method 01
4 K6 n" F+ g( N* V7 o6 i% q* H5 ]) `=========
$ A3 g7 g# h8 P' f( y H4 y4 s7 [
# l2 V% z- D) \, Y7 H6 w$ C2 UThis method of detection of SoftICE (as well as the following one) is
& Y( R+ d" ~7 y( S7 X# tused by the majority of packers/encryptors found on Internet.
* M- q8 m- p* h: U8 TIt seeks the signature of BoundsChecker in SoftICE" H5 A$ m7 {2 C B; L+ `/ h
F+ e! ^8 y S4 U% Z2 N2 P& P
mov ebp, 04243484Bh ; 'BCHK'# h% _9 q2 A% @9 ]
mov ax, 04h
, T) k1 ^ ? y5 W int 3 6 ^! Q+ A$ q; G" G
cmp al,4/ b% T$ T* l0 Q8 Y) \. Z1 m) J
jnz SoftICE_Detected
& G/ B' b- C$ H5 H' P
- s, q& ~2 ]6 |9 D3 J___________________________________________________________________________3 W8 {! C9 ~1 r5 ?, {& ?% U
U* J, E( A3 Z: L5 ]. xMethod 02
: I: }* V% V( D3 l" z) q=========
o9 _' l, c6 \; b1 Y0 e
; F6 Q0 n" |7 |/ lStill a method very much used (perhaps the most frequent one). It is used
$ _0 I# F+ Y* Y" v4 nto get SoftICE 'Back Door commands' which gives infos on Breakpoints,0 o0 o" S# d, ` N& H
or execute SoftICE commands...% V8 B! f5 b8 x& i$ ^
It is also used to crash SoftICE and to force it to execute any commands
1 s. K: Y3 X" ? Q: {(HBOOT...) :-((
% f# q" K, U6 I5 W3 M; P
+ B# G4 b0 y5 V! ]& R9 {Here is a quick description:% r) I; @0 K. L- ~
-AX = 0910h (Display string in SIce windows)* N+ l* y- T* Z* u4 x
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
' |$ b* M6 E7 u-AX = 0912h (Get breakpoint infos)6 z- l1 @; a6 r5 B k. q
-AX = 0913h (Set Sice breakpoints)- V% \& @: _0 q$ l, _+ ]! i
-AX = 0914h (Remove SIce breakoints)' K0 D4 f/ d* {* `& j+ f
7 P( W- P/ Q1 A) Q, a% s$ IEach time you'll meet this trick, you'll see:& l7 K" A/ w/ f" X: X) y
-SI = 4647h
! p( ^, h5 ? _( s3 c6 h" ^& e) v-DI = 4A4Dh
7 z% q5 o& p. a/ d" b2 n# TWhich are the 'magic values' used by SoftIce.1 x# @! k& z) D. n4 w/ {- p
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.. R6 i$ f0 H: X6 L$ k
! }8 A7 U0 M6 t* g; |4 u4 e) qHere is one example from the file "Haspinst.exe" which is the dongle HASP
# W; V5 m6 g D! lEnvelope utility use to protect DOS applications:
1 ^- m% [. g* ~2 z1 q% F
% X' F9 F. e, z# q6 u3 J, C' ^
$ q. y9 J+ Y5 F' p [3 [% m+ J. h4C19:0095 MOV AX,0911 ; execute command.9 d) K2 b8 E9 r. e/ d
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
1 [ K3 y2 W/ m# U4C19:009A MOV SI,4647 ; 1st magic value.; t* @( _$ H R3 R: {
4C19:009D MOV DI,4A4D ; 2nd magic value.) f6 n0 Q) G0 G2 o
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
( e# F1 p/ T; W6 Y) ^; V8 ]4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute, K4 U3 g2 Q( Y1 W, z8 Q
4C19:00A4 INC CX
4 p: d0 h- ~. J4C19:00A5 CMP CX,06 ; Repeat 6 times to execute* o" T: {% V; D9 s3 _& \
4C19:00A8 JB 0095 ; 6 different commands.
/ A' m" P* r2 R9 ^" i& u( X4C19:00AA JMP 0002 ; Bad_Guy jmp back. N* o, f6 g- ?! I! L5 k7 g
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)/ X. c2 Z& C" L3 E
' Q) y4 C+ r C9 e' }% qThe program will execute 6 different SIce commands located at ds:dx, which
, q- j d/ N3 u& L3 e% xare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
+ P) s, ~- h3 d! I8 I, R
5 K% [5 {3 p- \* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
, M1 t, i. X$ e( e___________________________________________________________________________
4 q6 g. z0 e: W7 ?# S4 W' @
/ o. M. V8 M l
; h( y i* [1 \& jMethod 038 @; E+ c) I4 ]# p# P- y, E* M
=========* c& a0 f, N: S2 w% @* C7 u5 X: W
# L& I( N$ `1 [0 q; e& M
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
/ B( ?& Y( y9 Z, g Y(API Get entry point)
$ o/ O+ T4 t9 ^$ E; h! X, M) L
+ [1 x! }% }7 P/ J' c( A9 u: v+ `; z8 a
xor di,di
4 Y' q* S3 k" L mov es,di' r7 V" S+ \8 R# A' c" T" |4 y
mov ax, 1684h
/ W" p4 j1 \; ? mov bx, 0202h ; VxD ID of winice$ j$ f6 K0 v( ~( u4 M4 j
int 2Fh
7 ]" h& G$ l- X4 R mov ax, es ; ES:DI -> VxD API entry point
* C" `0 `) K. b4 e5 t add ax, di3 t* l. I* G3 n# l0 P: [
test ax,ax' @% m G7 ^; q5 E/ o
jnz SoftICE_Detected' j6 |3 @; N+ S( E: N8 w
- J3 L9 Z9 Y9 v+ d1 l___________________________________________________________________________; ~% U1 I. o; y6 \
: _$ q& p% i$ H1 H3 f7 ?
Method 04
+ r/ a/ M! n# b& f=========
3 ]0 [& f3 |5 Q$ Y8 |4 V% W& r. Z0 ]+ s, A9 p
Method identical to the preceding one except that it seeks the ID of SoftICE
* i# F; L1 o0 c" R* c+ K' H5 J5 K2 oGFX VxD.
6 }( z; R1 @( L9 B( N* J
- j# v7 t" q0 `5 c; J3 ^% V# i# r xor di,di) m; R% _6 D1 q, M# F2 I: z
mov es,di! S# |" n$ ^/ J O0 ]
mov ax, 1684h 4 \( F9 Z% @3 l3 |) _1 b
mov bx, 7a5Fh ; VxD ID of SIWVID
, l& c4 k6 B- C8 j% A int 2fh% W% g* Z% a2 s& x
mov ax, es ; ES:DI -> VxD API entry point
4 k% _ A+ j [* u5 e add ax, di
7 }1 \0 N5 n8 j* ?' P7 P# _ test ax,ax
% T# d W# o3 P$ q jnz SoftICE_Detected
2 k$ A+ L" | c6 s: r5 ]! {( o4 M
# ^2 [' o! E) K$ S__________________________________________________________________________/ d- s2 n' I1 G" y
/ |9 `/ @0 u I# ~% c; d! ]
1 n9 i( H' \9 J6 [1 p7 T# rMethod 05
4 G, z) ]& W# S- O7 {( w- d6 O=========
8 r& {1 Q" K! A3 h6 w8 e4 |: Q
Method seeking the 'magic number' 0F386h returned (in ax) by all system, l" u1 l- [- w# `5 {. [
debugger. It calls the int 41h, function 4Fh.
3 _$ V! x) c2 G6 C1 J, gThere are several alternatives. " Y6 w( j4 j* S6 S$ L7 m
% s% u9 L! J# @. _: p, S6 {The following one is the simplest:
% \4 {6 J" z+ z; a7 d' Y/ J
3 W$ z+ l$ v/ d m0 x mov ax,4fh3 \- r2 L! t" H8 ^* M- R
int 41h) ~0 d: `! m# M% h0 H
cmp ax, 0F386
8 R; Q* ~( O: B! u- Y8 H4 a. _1 W3 q jz SoftICE_detected: a3 e/ b1 c6 _; w
: g2 M3 B4 J% i F4 E/ `7 P" T8 w% B; D3 t$ ]3 C5 b
Next method as well as the following one are 2 examples from Stone's
9 \; |! u! V7 B"stn-wid.zip" (www.cracking.net):4 W+ P w* Q/ _* x+ [0 X8 I
- e; c6 E6 F* g* _$ D* P+ L% l0 D
mov bx, cs' A, N8 V, A1 y9 I3 p, d/ V# }
lea dx, int41handler29 W/ S4 }' n- x& M; t$ B
xchg dx, es:[41h*4]
6 {# m9 E: E6 b4 _7 T7 U Q xchg bx, es:[41h*4+2]
& D& }% W/ m; N A4 Q' o( p mov ax,4fh
5 z) C/ x6 _7 _+ M# w4 `* \# a int 41h N2 E: `; ^3 l- w. Q
xchg dx, es:[41h*4]
% o! v4 p& [' B# E* C xchg bx, es:[41h*4+2]
: c0 N3 z! E, u( ^# Y$ O cmp ax, 0f386h
7 c! c& Y8 `. X8 ^, X' V0 M0 I* P jz SoftICE_detected0 }0 W, _" T c) f$ ]! F1 k
- t. O: e0 D0 l+ s1 y. N: X
int41handler2 PROC
% N0 K# l s6 ~+ O1 O. B6 p iret% u- N. g/ W6 q, [' @) x* o
int41handler2 ENDP
# K0 n4 P! R# s) f* i6 S" @" N6 E6 S3 H- e0 F* v+ F6 x2 ]+ L1 L
* I' q* r7 i- M9 N: L ?
_________________________________________________________________________; Q' T. ^) H" B! n
# o/ Z# l2 C7 Z8 c5 K
/ ?- d' l0 w7 \ e3 H) j* XMethod 06. v) ]$ H, Q% U' s) R6 U
========= R, X) ]% A4 X2 Z0 U& d
! y. N( Q" A* u' U& g: A
& Q, F6 F. L7 c+ b) k
2nd method similar to the preceding one but more difficult to detect:
) J7 h) T: x( z* ?% a0 |) V ~, ]3 _( o. u; a
: f0 h* T3 |4 l$ m* Z3 z: q: fint41handler PROC9 e7 f. P8 F; P! `6 D
mov cl,al9 n* h o8 m$ J5 o4 C3 A3 Z. F
iret
5 F9 z: e" |5 D! X& a2 hint41handler ENDP& Y. k; |: l8 U, m7 P
8 a9 w5 U" E$ R4 C% A1 ?+ z! r
( K; i/ ^% z2 d xor ax,ax
9 Y9 i( x, i6 w8 Q* U- Y) m mov es,ax1 S0 T+ t, N9 O4 j; P9 y7 w. x' r! v& ~
mov bx, cs
, t! p0 W0 Y- B- v lea dx, int41handler' A$ G$ y0 R ?. c7 ?! I1 b! r% a
xchg dx, es:[41h*4]/ g0 P- G' @) J( P! e+ Y- D2 v4 X" D$ t
xchg bx, es:[41h*4+2]
E' N7 X) J1 f! ?, y: W' ~0 a in al, 40h% t2 |/ p0 V/ v8 D+ P* ~
xor cx,cx
0 j8 U% P4 R9 F int 41h6 @' T4 _5 y( }/ g
xchg dx, es:[41h*4]
$ ?1 t( `: y, }0 U2 h xchg bx, es:[41h*4+2]
( {6 M* s$ ]7 m e2 x. d4 d cmp cl,al7 x; R9 a) p$ S0 W6 v# Q2 T% ?
jnz SoftICE_detected
5 k# @: k$ L3 S3 {8 p/ f; X% V( @6 H9 W9 z' N& G( J
_________________________________________________________________________
* V+ ]* \) ~* p W( F" K
( C3 a* a" E" h" z* j2 t# r1 L% x/ oMethod 07" m3 s! j' q' p' w2 p, q8 l
=========* C' t2 L/ _6 s) v/ f- |
9 H" }& m3 _3 k8 F4 e& Q; \
Method of detection of the WinICE handler in the int68h (V86)
2 ?. s4 c+ Y' L6 j. p+ j/ S7 y7 L3 e( t; \, q7 P
mov ah,43h
2 e, u. {( H7 W; O; ]2 Z7 M$ Z- ] int 68h
8 e6 z& c% L/ K' ] cmp ax,0F386h
* J5 C3 _$ D3 _' v' R) C jz SoftICE_Detected6 b6 u+ O+ o1 V6 @! _$ d& `1 y
4 b; I$ @* I1 W1 X. [1 N* ^
d- i( ~+ T, Q% x& @
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit3 M3 N! `& H6 L b) [
app like this:4 _: d0 X/ t" k% |. y) J, ]. _. f
3 a. e/ ^) S. j' {% z/ j8 K& |$ e9 E BPX exec_int if ax==68
+ m X% L7 O( p, N (function called is located at byte ptr [ebp+1Dh] and client eip is
- ?3 e5 F% d8 l5 Z( n/ u4 b Q located at [ebp+48h] for 32Bit apps)
" ^6 ^9 J& ?2 o( p' g! O/ _: h+ D__________________________________________________________________________
& T8 h% I- c1 d# _& }# l3 Y0 _" d, c6 R2 L
r) P0 T: f% q3 D* a0 mMethod 08
3 Y6 Y, r- v0 ~, t# N=========2 M+ G! @) E) Z
- x1 [" h! |- H0 O" x
It is not a method of detection of SoftICE but a possibility to crash the
7 a% w* k: s) Vsystem by intercepting int 01h and int 03h and redirecting them to another
* z" D' q5 r7 t/ @/ u# rroutine.
# e1 V' H0 ?1 {0 s5 {7 {6 q6 ~ p6 ]It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points/ ~* C8 {, g2 P+ I% \" f
to the new routine to execute (hangs computer...)
/ p! L+ y; n1 y) N) K6 n8 Q% D
( O1 c: N5 |7 X2 k+ U mov ah, 25h
9 T& I) P' n" y! {& W9 e' ?" z mov al, Int_Number (01h or 03h)% H- a# f8 V8 \5 Z; Y
mov dx, offset New_Int_Routine5 ^2 H, h7 A3 Y8 s* c1 }, a& |
int 21h! U! H8 L4 }) E
% {2 s. B' n4 A5 G9 C; `1 \__________________________________________________________________________6 h0 k) I& i2 W( d+ V$ E9 t
$ M w0 L+ I/ O
Method 09
- w+ S% s2 m, W# e& g=========7 M: v! d1 g& I- z) d+ C# R
8 N( U) o; A. k9 B: [This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
5 p+ D4 d8 }3 _8 dperformed in ring0 (VxD or a ring3 app using the VxdCall). _0 m- G$ _! f- w
The Get_DDB service is used to determine whether or not a VxD is installed7 S( e `. C+ {1 J; `+ d$ E& }
for the specified device and returns a Device Description Block (in ecx) for, `* I+ l5 E8 C" {3 v! Q) U
that device if it is installed.& t0 x5 N; D8 Z/ u+ k2 Y
3 x4 i7 a8 K9 X$ \( \' u( M, W8 n mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID: j) w+ {4 X& A _& z
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
! s$ L7 t; I: p1 V# K* v VMMCall Get_DDB4 E3 E8 e! j9 Q4 t7 K
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed" m3 t) D' f u
4 V' H i/ L. Z& y, z% }Note as well that you can easily detect this method with SoftICE:
( |8 U8 k+ Z; t0 |- t. t bpx Get_DDB if ax==0202 || ax==7a5fh0 b9 z# h! s3 h: p9 U
* |! U* R3 z! Y; S
__________________________________________________________________________! g m; H& X- R } h- ^$ k
: M& g7 n; c7 k
Method 10
/ d! A0 ^- S: p# n" e========= h' ?6 U3 [; t* C) U9 w! K
: W. S* p# Z0 W, ^# \" k: v=>Disable or clear breakpoints before using this feature. DO NOT trace with
2 b, V) B3 h# c$ \8 h SoftICE while the option is enable!!% s/ U2 R. W1 A/ R. F& F! s j
5 c, L8 i( {* Z0 b! a
This trick is very efficient:1 h9 L: M8 M' P' l. Z; e
by checking the Debug Registers, you can detect if SoftICE is loaded# s; z a; t0 {1 p2 {: G1 R
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
4 {' ~& Y+ [9 w, y$ L/ i* Gthere are some memory breakpoints set (dr0 to dr3) simply by reading their
* O! F! F$ Q( m& h9 f6 ^+ Rvalue (in ring0 only). Values can be manipulated and or changed as well ?' y' \3 H- t; M9 V- A. }
(clearing BPMs for instance)
+ Y/ m2 z5 q7 N* E/ g% [- k. X3 \5 _ k! y& e: O* W. p; F! Z! i8 i
__________________________________________________________________________" W6 J# I" E! v6 K s
" ~. Y/ _: z! \. G1 x
Method 11
, A' p9 k! u9 m, W0 m( n7 d=========8 G. t8 g& {$ r- E
5 a0 }& Z8 ~( l8 @# x0 YThis method is most known as 'MeltICE' because it has been freely distributed
8 f# X4 N `) ?8 avia www.winfiles.com. However it was first used by NuMega people to allow2 `( k9 J2 V7 p% Q$ Q8 v! `7 H K7 J1 I
Symbol Loader to check if SoftICE was active or not (the code is located
$ C( J- T% M/ i, ~inside nmtrans.dll).9 s y+ {4 t# K- Z
+ U2 O/ [$ u& pThe way it works is very simple:+ b8 Q4 a) r! U# t9 Z( ^
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for) M5 u6 z4 J% q$ x
WinNT) with the CreateFileA API.0 [2 C7 k6 j6 \( E
% ?$ A" s4 r9 @# h! I; R( Z& ?) X8 RHere is a sample (checking for 'SICE'):
2 L# d/ ]# q. a
- j% r9 r+ }( C2 DBOOL IsSoftIce95Loaded()' e# U* U8 s$ x5 i0 Y$ {
{
# h$ F$ z6 i: a: n9 S- M' F HANDLE hFile;
, s5 m( |! T* N$ \* s' K% Z hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
M$ S" R1 s3 A FILE_SHARE_READ | FILE_SHARE_WRITE,+ w7 Z, L* S$ ?& U: e$ m# D
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);4 u) P0 S& `9 G: R+ a4 v
if( hFile != INVALID_HANDLE_VALUE )
- f7 u- V9 s/ T; o. Z2 ~! l {
9 ^5 T/ P5 B9 z+ K CloseHandle(hFile);
" w+ B* q8 I0 D# Q2 p9 K return TRUE;
\( [) J, E7 \. }7 L }( O1 K- c. @) }" t3 T" [
return FALSE;: x; Y" q5 `! y/ Z5 c/ C5 N
}9 m4 r8 P; K% b
1 N8 ?1 e5 ^6 g( C: AAlthough this trick calls the CreateFileA function, don't even expect to be; f: \' a# e% _4 O3 c6 Y. U2 G. C# K
able to intercept it by installing a IFS hook: it will not work, no way!" Y& K% M& ]% O# B+ k/ C
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
4 a) ^+ k2 ]) f2 N8 {+ }# sservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)0 m+ P+ U! \" y% X2 v5 Q
and then browse the DDB list until it find the VxD and its DDB_Control_Proc, P! @; |8 |# l, t
field.. N o- o) L) O! [% } U
In fact, its purpose is not to load/unload VxDs but only to send a 5 x3 S- H# e& J
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE); E5 n! O% u+ r5 \2 F F9 W! X
to the VxD Control_Dispatch proc (how the hell a shareware soft could try8 \# @) h6 N+ ~6 {6 s$ W2 F
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
& e" J! N$ g3 A8 A. z; Q1 r) qIf the VxD is loaded, it will always clear eax and the Carry flag to allow9 N8 j: V ~$ p' H4 a# T, J, S
its handle to be opened and then, will be detected.
8 I. [% ?, I; }$ U: SYou can check that simply by hooking Winice.exe control proc entry point$ A( W# X! o& |) f, N$ y( H' a
while running MeltICE.
* i9 [" ~9 i: e, X7 K/ v& \. P/ y9 B1 P& T' e9 Y: ~
& F1 E4 a* C# e* l0 B 00401067: push 00402025 ; \\.\SICE
- B: E. ]$ c! { s/ W9 R 0040106C: call CreateFileA
+ g" B* K: Z8 B ~( v 00401071: cmp eax,-0014 }5 u2 F! w3 d2 q
00401074: je 00401091; [# @8 Y/ \+ V, i
2 |' X$ [6 |+ l1 X2 {; M) C0 U7 p- x' h8 e4 y3 `2 f1 {0 |
There could be hundreds of BPX you could use to detect this trick.
. P0 G4 ?/ m- p6 D- ~1 E, I8 h-The most classical one is:
7 B( I. }$ ?/ Q8 { BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
8 X9 X! y* R5 c8 Q *(esp->4+4)=='NTIC'& |. a6 m( I2 ?2 S3 J6 ^# w
$ p$ c6 z% D" U$ s; G Z3 i3 o-The most exotic ones (could be very slooooow :-(
$ _% ?' h+ m ]& `$ F BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
. j7 y7 n, k, h5 f ;will break 3 times :-(- _( z( r; L) q
# E* [8 G, c' \5 b8 A& B; j8 {2 }1 f
-or (a bit) faster: * X! O; h# [5 Z( |
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')4 I) t! |7 T! p8 D
3 R& A% x) L+ j/ `
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
! k* ]6 Y0 C; n2 \( Y( q6 C ;will break 3 times :-(
a, m" V5 X, ?+ ^6 I" i- G( T/ S% u* o0 [& T) X7 y4 ]3 ~- C
-Much faster:
1 I N" G3 p+ k, {! r) }4 i0 d, f BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
( n- @' T4 l; B& F
: U) r# K9 Z- P% ^4 _' mNote also that some programs (like AZPR3.00) use de old 16-bit _lopen( Q* G( z! h& F' I* Z
function to do the same job:
2 ~0 B( L H7 E. O
1 \0 C% J3 ^5 z; T0 j8 ~9 e Z) g push 00 ; OF_READ9 K- J' b, n& [% ^, z: I+ |3 L
mov eax,[00656634] ; '\\.\SICE',00 |6 ^. V0 s: q% G
push eax2 s6 Y8 G: a1 _ }
call KERNEL32!_lopen
& B& i/ Q0 ~, Y. u: J1 e3 C( z inc eax
7 {9 s9 }# z& v2 E9 b/ d( I jnz 00650589 ; detected
% l* }, h% h# e8 H push 00 ; OF_READ. [9 W) ]2 N, K$ h5 L+ q r( m# G
mov eax,[00656638] ; '\\.\SICE'
7 D x3 e& p# N& m push eax) s- _! ?9 l- M5 e4 R
call KERNEL32!_lopen
8 ]1 Y O7 i T& d: Z: t inc eax
8 L+ h9 `# z) g. F# H7 O jz 006505ae ; not detected a* Z8 M, O! I0 ~
, p4 \. A+ o8 }) H$ L" ?/ U% ]8 c
__________________________________________________________________________
! X- ]7 L/ N3 D; G
0 }! E8 F% M: O; U% A1 S2 g7 `Method 12 L$ b/ P4 j5 J2 Q7 v: |* A
=========2 A& G! u. N6 U5 ` t1 w( m9 {
9 I3 _! t) a* R5 CThis trick is similar to int41h/4fh Debugger installation check (code 05
2 A5 K) s" H1 H% A* q( l: }0 L& 06) but very limited because it's only available for Win95/98 (not NT)4 x( x( ?5 v1 H+ i2 F; h8 ?8 f
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
& W! C* V2 p# v/ T7 R5 C. h, W
push 0000004fh ; function 4fh
! G8 u; t3 R; l6 Y, I push 002a002ah ; high word specifies which VxD (VWIN32)6 e) h& h4 U' ~, f7 W
; low word specifies which service
/ P! z9 F# }) m6 g& s% g* ?+ Y (VWIN32_Int41Dispatch)
T4 K7 I/ O9 M- z1 V: { call Kernel32!ORD_001 ; VxdCall# p7 N8 a `: r* y8 x3 l
cmp ax, 0f386h ; magic number returned by system debuggers
6 ^) c6 @1 X/ r" q) I8 _# Z jz SoftICE_detected9 l1 g' C& W6 Y$ i% {
( `5 e4 E. S& dHere again, several ways to detect it:
4 o1 w3 |2 M1 \" o. i. Y: f& I8 W5 ^ e$ P. @8 D
BPINT 41 if ax==4f
+ k9 ], Z; b6 \
0 [4 c1 ~& S+ f# B; d( l BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one4 ^0 _2 V, i, X" I
e- f& ^5 n$ D; ~. B& R& E
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A0 \! I6 \5 ^5 x3 O
Z$ u( T0 |6 D% H- ^/ s
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!" v# q4 e, s$ s; l: h! {( ~
8 o+ y# }" I1 W5 Y4 Q
__________________________________________________________________________0 L7 o: K9 U0 g% Z7 j3 _: m- t
: m! l7 p! F: I# B+ G* kMethod 132 [, l4 f a7 e0 H: a( Z
=========/ f- J5 [$ s* k
" d+ j" d. r# X$ [Not a real method of detection, but a good way to know if SoftICE is
6 \3 L a! }+ U; m+ x3 _4 q6 @installed on a computer and to locate its installation directory.+ b/ K; u& }, s' G: o- o$ \
It is used by few softs which access the following registry keys (usually #2) :
8 E1 T8 v; t* s! w+ |- {
9 ]" A2 v- d. f- O" B0 `-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
# \$ L/ B8 a8 A( @! f\Uninstall\SoftICE0 @1 _6 u3 l6 ^/ d$ K9 y( n" a
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
/ E9 [0 P: R- O: b) K-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
5 m9 ?0 R! \" w, y\App Paths\Loader32.Exe1 {+ a- O' k5 |$ ]; R
& s4 u( U. w% J I* f/ W' l5 X% A
+ ?6 c- ?) }1 B4 HNote that some nasty apps could then erase all files from SoftICE directory
4 \3 I, `' ~* A6 }0 f(I faced that once :-(- k( R2 f0 m" `3 F
5 M: b P. h* A! ]
Useful breakpoint to detect it:
) t- R( F5 f( p
; a+ D* _# b7 @. N8 f- ^ BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
3 T* \1 z, w, F# }$ @: f( C, X
6 E- @3 Z4 V) H# d__________________________________________________________________________
7 q+ S% e3 \1 B8 u. h) C2 U9 _6 Y/ X" O
3 d; _) O) p' X ~
Method 14
' @7 y' |0 r9 q( ~8 E J/ e=========
, U2 L7 p/ Q& ^+ G$ e* D3 E/ t) {0 `+ b/ j: X2 B' U
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose3 L3 ~# K# H8 ?+ `8 m
is to determines whether a debugger is running on your system (ring0 only).
6 `8 J; | J/ E& N. K% z1 @
. d' p7 ]+ v3 |9 B% ?( `5 [7 q' @+ ` VMMCall Test_Debug_Installed( ~, F6 }- x- I, A3 f: r
je not_installed
* ? F+ q( Z, I0 a+ w3 D; `
1 L- a5 n" n1 N6 z I mThis service just checks a flag.
4 k0 ]" M+ N+ I4 d</PRE></TD></TR></TBODY></TABLE> |