<TABLE width=500>
" j; v0 \$ j. x3 K* G1 N<TBODY>
1 W7 K+ S# K( O( v<TR>
& f+ t; ?+ J5 p' h, Z<TD><PRE>Method 01 3 ~' G7 a8 C+ c) a" k( M9 }: w
=========" y% Z# ]4 W* u- s
: _, h( e7 S F# @) x! I& B3 iThis method of detection of SoftICE (as well as the following one) is
* ]) W; ?* Z& b9 c1 I# z, [used by the majority of packers/encryptors found on Internet.' x- d3 ^, C/ R F9 e# l# L) {
It seeks the signature of BoundsChecker in SoftICE
8 o) ^9 @7 l: ?. X
8 H" J3 s- A% L/ @ mov ebp, 04243484Bh ; 'BCHK'
/ Q4 Q& i# {; q' e mov ax, 04h P( q9 X- l% @4 H7 j& X
int 3
" n2 o( ^ N& J; w7 E' N cmp al,4
# v/ B# [$ x9 T. j/ V( c. H) C jnz SoftICE_Detected
# |+ O+ P% q5 ^4 N9 V2 _% w8 P i: v# s
___________________________________________________________________________
4 B& P5 S- t; ~+ O: J, p
3 R& |: F& u. JMethod 02
, g9 w, d3 Z! |2 Y=========& A# [6 }* i( ~& h B$ H4 P; W
$ |& E; E c4 b* \! y9 hStill a method very much used (perhaps the most frequent one). It is used
9 [. |7 u- E& B, Gto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
* e: u" y: W0 |+ Ror execute SoftICE commands...; |# n7 @( B2 I# S2 V9 N' e
It is also used to crash SoftICE and to force it to execute any commands; J% }/ I) q6 k: h3 n" O4 x
(HBOOT...) :-((
& t X! z2 Q1 R% B0 K
" b. `, _& E9 Z* W% D( W# BHere is a quick description:0 L1 M2 s8 U( D* @
-AX = 0910h (Display string in SIce windows)
; `# \$ I, L0 @2 B4 r# A+ ]$ r2 e-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)8 B) k" K: `! _6 N, ]3 l
-AX = 0912h (Get breakpoint infos)4 ?( ]8 V/ F2 v6 @5 T( q2 \( d; z
-AX = 0913h (Set Sice breakpoints)4 ^% _8 m2 u: {- I6 a8 C
-AX = 0914h (Remove SIce breakoints)& _" C4 Q1 v* @
, k* R* ? y: {7 PEach time you'll meet this trick, you'll see:! `. K, h6 Y( }) C
-SI = 4647h
; ]1 Q* B/ W' t5 Q; u3 R& d-DI = 4A4Dh
1 }7 |- o* l4 P8 D" p1 ~; ]9 F3 s& dWhich are the 'magic values' used by SoftIce.
2 @6 i3 d. Y: xFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
& Y2 |* Q% ]( W" ^9 C9 I* }8 F% F2 P! [4 q% n
Here is one example from the file "Haspinst.exe" which is the dongle HASP4 K3 h3 ?( n9 r& ~5 m6 j; t; E
Envelope utility use to protect DOS applications:
; K! M9 Q. P$ S! P7 f% X5 g+ a& \+ |4 o
5 `2 f, y2 m8 L$ \ g1 y- U
; q% o8 j, B# X7 D- s' W4C19:0095 MOV AX,0911 ; execute command.
+ g- p8 T v. I5 a( M3 i3 W4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).: y0 Y& E" Y6 ?" }( p' F! p
4C19:009A MOV SI,4647 ; 1st magic value.4 H4 H' H+ q- I7 @. S& Q% ^/ X$ ]
4C19:009D MOV DI,4A4D ; 2nd magic value.
1 W. L6 _( _* q, k9 p4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*): q G. d% C4 t0 M; r+ L" G5 V
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
' r7 Z0 r( r1 l4C19:00A4 INC CX
5 Y# r0 P" ^$ @6 @. w( l4C19:00A5 CMP CX,06 ; Repeat 6 times to execute# c8 l4 v: H: j
4C19:00A8 JB 0095 ; 6 different commands.
3 C1 n( ]( b5 \$ p- _5 \6 m4C19:00AA JMP 0002 ; Bad_Guy jmp back.
4 _4 K' p2 Q% C4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
( l! a; P; d2 Q4 r) z B! R" t$ c0 i, @( |( f6 y6 g* I
The program will execute 6 different SIce commands located at ds:dx, which
8 R5 u" `1 h1 b! f# ~$ fare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
4 ^: A6 ]# u, l& p
$ C$ `+ Q- m! z0 j( f3 o* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
. E; G* `5 m. @: ]4 b___________________________________________________________________________
+ `, N$ R$ }- f' f) f) d% D( `# K! P. J" `1 h
6 s) v; h+ y( Y/ V) d+ QMethod 03
; B5 m1 {5 |9 X=========7 o5 I' o% c* Y
5 A& Z; X1 ]% B0 o
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h+ G0 h5 Z3 p: d. T! {; M8 p3 s
(API Get entry point): q! K3 D2 l6 o7 q) n! Q3 h
1 i: k; g/ W; M0 D' L3 B# M" E4 _5 I9 Q" I. s6 x
xor di,di
7 C& m q9 s! o, t0 M$ O3 Z/ \ mov es,di& r7 P0 ?* K) h
mov ax, 1684h 5 s1 c! k7 O9 @, w( Y
mov bx, 0202h ; VxD ID of winice
, @% t7 J. Y+ p3 o" X int 2Fh& |3 \( d% Q3 T# Q( n' W2 v
mov ax, es ; ES:DI -> VxD API entry point
3 R" Y B! j8 V1 W. O4 K; U4 o c add ax, di
1 R2 H; R1 Z( B2 W test ax,ax, u8 i/ A% U0 E. o+ ?1 Q1 |
jnz SoftICE_Detected# _8 j. @ g! \ R! s$ n Q6 y s2 {
" g7 `4 B( W. o6 H; T" J( Z___________________________________________________________________________' Z. Z4 [# n, P: k T8 ?6 W5 ^
3 }5 Z5 q, {# ZMethod 04
1 V3 U7 H' N8 e- I9 C: M a" j' f=========
" a3 K; v$ ?( M" r4 t0 [: _( |. k9 J# ^) T: e
Method identical to the preceding one except that it seeks the ID of SoftICE
! `; _1 G& N7 ^1 [4 OGFX VxD.7 m& l- D; x, A0 V9 t* r8 }
% ^2 A- I' a$ _5 E* B
xor di,di+ M% G9 \, W" }2 p: \ L
mov es,di, m' A0 [: e9 Y
mov ax, 1684h . `# y( G( M2 P* j+ U
mov bx, 7a5Fh ; VxD ID of SIWVID, m% i& O2 F9 P
int 2fh" ^: }* K6 p2 n: W
mov ax, es ; ES:DI -> VxD API entry point; b2 N: n( Z& u0 Z5 x
add ax, di/ H8 a' c* C2 }/ V+ q, _" C
test ax,ax
6 }5 o3 G$ Y- [* G! W jnz SoftICE_Detected Z8 `6 B$ n; U8 P6 t! r
; }+ s* d, o2 B! j! z
__________________________________________________________________________
: `) d2 |* H! u& u6 \/ y2 y- Z( T4 L* S9 A7 Y% Q0 B& V
' K' A- e+ T+ x9 fMethod 05# x, `' z4 U2 W; C$ @$ u
=========
3 e" Z* W! _1 s& Q& }1 V0 Y& ~
& [+ ?% [0 [% FMethod seeking the 'magic number' 0F386h returned (in ax) by all system
/ X3 r5 k0 i5 p; \debugger. It calls the int 41h, function 4Fh.* l1 F L8 ^% [% ?( ]
There are several alternatives. 4 ^6 D9 C8 i# I( i7 N8 Z# x, Q
5 G/ K) l9 m8 u$ {+ ^
The following one is the simplest:- S! m2 p: L3 U
2 E) c) O# m# Q! v K% \! a mov ax,4fh9 T2 y! Y; _, ]7 u1 f* X
int 41h9 c) l a* g2 ?8 u
cmp ax, 0F386! _3 [# V5 g$ p8 E
jz SoftICE_detected% ]$ i2 Q( u, {! Q9 P M; @
) N- ~2 t/ c. x4 R
C* j7 Q# j" r. O
Next method as well as the following one are 2 examples from Stone's 8 m" q" n5 |7 P$ c! B: x
"stn-wid.zip" (www.cracking.net):
8 t# U( q0 j" X5 H; a5 w1 n* }, k( A; s
mov bx, cs
; B8 z4 B2 R% A5 k/ f0 ] lea dx, int41handler29 [. B* i7 T c$ z6 K
xchg dx, es:[41h*4]" q# l1 e+ M; |" @( ]3 Q; c' |7 N; R
xchg bx, es:[41h*4+2]
& |3 _6 A% U( q& D2 n2 m9 }% A mov ax,4fh
1 s: v5 S: L9 H9 f/ n" T int 41h: F5 T+ K& `1 r& E3 ]( l: S# ?
xchg dx, es:[41h*4]
/ F% I4 C3 G2 b4 t2 N0 N xchg bx, es:[41h*4+2]2 H$ J( t3 c: l
cmp ax, 0f386h
; k6 D d' b4 \% ] \, b jz SoftICE_detected
/ D P: A* Z0 C: x `7 p
# O9 t, q: n. h5 iint41handler2 PROC
) J+ c9 B9 e+ T) A8 q1 X$ C iret
' u/ Q0 R% _7 oint41handler2 ENDP
, I# w4 `7 X G' h
. \$ } q7 ?& Z8 S8 Z
3 e3 H( ]% I. a5 T6 o; t_________________________________________________________________________
, X! m, g b# p2 m' m# ?6 x
8 T6 K2 V8 m- v& ` A! J
7 a6 r( ^& z- h, Z" ? }Method 069 u% `7 O- b2 {) F# `
=========
. P4 i: M- n/ ^2 v
8 [3 O1 V6 x- X+ }# E+ G" W5 [
' H% f* ?( x% d8 ] q H2 ~: z2nd method similar to the preceding one but more difficult to detect:
" \+ x1 D/ e/ z0 y
4 J3 I9 K! G; x. |# J
, L7 n9 c+ D, Y9 g" m) Yint41handler PROC8 H( r) `0 h) O( z- c9 N# _4 g
mov cl,al
/ ?6 {6 W2 [/ S8 W iret$ A; ~6 S& T1 [
int41handler ENDP7 R9 R$ n' I5 m5 z4 L
: |, A3 V9 Z( k
+ J) K7 d! o! y1 m: H" k
xor ax,ax
9 c; R( [1 ? q# Y# X _- B5 ^ mov es,ax
# r; U/ Z3 q0 u- S% C8 a7 k' h0 G2 s mov bx, cs3 c/ Y# Q" b. {; I8 c! ?4 u
lea dx, int41handler% @, ?+ h! e1 y* s
xchg dx, es:[41h*4]
, T @1 X% K3 C xchg bx, es:[41h*4+2]
$ u9 _6 u" D0 p6 k) p# k in al, 40h( A/ X, ]8 F2 c9 D k* U; j- w
xor cx,cx2 U4 q4 v& z" W) t, c* z2 Z
int 41h4 v; ]; m. q3 ]5 H, x1 h
xchg dx, es:[41h*4]
6 w) m: B: [( n' ]1 p xchg bx, es:[41h*4+2]0 v) J4 S9 C6 U+ M
cmp cl,al
$ ]6 y4 k- P0 S% Z/ X- }3 P: { jnz SoftICE_detected7 E! E+ m! x- e3 q1 [; n1 j
' g. f0 e" I+ M+ v& E" q1 g0 C0 ~$ V9 P
_________________________________________________________________________% K8 i5 j3 p8 V' f* U" X
+ P) S- C( ]5 O! x, MMethod 07
" s+ L$ Y, k/ ~' O# @$ ^=========+ a! _+ @, t( a) Y. k2 ~
' a# _3 U: V6 t( T7 Y; A7 i3 JMethod of detection of the WinICE handler in the int68h (V86)
' @1 [, G( C3 q# ]+ j% v4 s) o
1 P2 G" l+ |7 @0 h) n) Z/ I mov ah,43h
. r3 K4 `) D+ E int 68h, B X0 Z0 Q" v6 o6 \
cmp ax,0F386h
# r0 N* X7 b/ @: N* l jz SoftICE_Detected V. _. m2 b8 u( k' A& F' b
3 n# o3 \5 q$ z) g$ w) i& v) K3 N" P4 n2 W2 c
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
3 v6 m6 w! M& p o- c$ Q* z8 o4 s9 V app like this:
" j2 g) Q! M R% ? J) n3 t( M9 w: ?+ `" N$ G h( B c
BPX exec_int if ax==68
3 w( Z2 F- p" m' k) o9 f (function called is located at byte ptr [ebp+1Dh] and client eip is
( ^9 i3 }8 O5 r i3 P4 z located at [ebp+48h] for 32Bit apps)
: h6 j4 p0 p: y' k; `__________________________________________________________________________+ V2 F' g4 |( q* q7 ]& j7 N
+ j7 X- \* c& O% I: n
8 I/ }9 X9 e/ N, q/ Z! w! z* C xMethod 08
6 N* p: W% s# i$ f* R: T=========
$ e( ^ y! ~3 w: N! K1 L' o) v2 ]1 W1 m" x {
It is not a method of detection of SoftICE but a possibility to crash the
/ j2 M" E$ _! ~$ M* ~7 P7 G- D tsystem by intercepting int 01h and int 03h and redirecting them to another
2 K6 v5 r r; v% y" p: broutine.
6 `$ l `3 M6 f9 A _8 _It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points3 r7 ?- {0 Q2 e8 l6 b
to the new routine to execute (hangs computer...)
) c( t* v8 `" V: r* f. p9 K2 t6 I+ K& f# k
mov ah, 25h
* _+ ?& [. Q7 \ mov al, Int_Number (01h or 03h)
* L2 w1 v% z2 D4 J+ K t6 v* p mov dx, offset New_Int_Routine
+ l2 F# q0 ]8 B$ Q3 o int 21h! b$ c1 W1 @4 _5 `, b- d
, J% g) t# ^/ A/ J- u( j9 c& t__________________________________________________________________________
9 \' y i8 _# i, m' E: |$ P1 y, | k2 G- r/ N# c
Method 09
$ u+ v/ N) a. {' \=========
7 e0 p& o- t; z
7 \& }" }1 W" T# \$ h# U' OThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
4 T- I; x% ?9 a. Lperformed in ring0 (VxD or a ring3 app using the VxdCall).) q5 I. f4 J. T
The Get_DDB service is used to determine whether or not a VxD is installed
1 b* f6 \0 b5 l- J1 V8 M; {for the specified device and returns a Device Description Block (in ecx) for
% k6 k% W. I5 o+ hthat device if it is installed.
5 M: Q5 l3 Y+ G) s' c0 D! E
0 r2 [( j5 k# C: S mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID& T$ @4 n- @7 M' Q
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
" Q. o! S. Y& h" z5 B VMMCall Get_DDB& |! k" D4 U, r3 ^2 `3 t
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
. l. w0 R' r6 D+ U8 }4 i( U/ s2 Z) B- w
Note as well that you can easily detect this method with SoftICE:
+ E1 k' q7 W& n9 n bpx Get_DDB if ax==0202 || ax==7a5fh
2 t7 b c/ L9 }" M* t5 l( ~
* t7 T$ Z% u4 W% \) m, u% K__________________________________________________________________________# j- C9 c% i& n n! `
1 T7 Z5 o; J4 d9 g7 X* i* q( aMethod 10
) s1 ~: S% I2 S+ Q8 I2 O. |/ s- `6 u=========5 ?! O5 p5 o! y& D# m
9 o& `: ~" Z1 r; y& j; z3 |
=>Disable or clear breakpoints before using this feature. DO NOT trace with4 g8 n6 W H8 h5 x
SoftICE while the option is enable!!
8 ~" i1 H* c2 \4 b$ \9 z' B, O8 N+ e& Z" {4 `( \: f& a0 b3 p
This trick is very efficient:
7 e; S0 `1 P; B1 oby checking the Debug Registers, you can detect if SoftICE is loaded9 Z) t3 E! m; [+ C1 R
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if; `6 p1 E- e$ x
there are some memory breakpoints set (dr0 to dr3) simply by reading their
: X& T- g, l& `0 a8 Pvalue (in ring0 only). Values can be manipulated and or changed as well' u" K" M ^# l' o
(clearing BPMs for instance)
8 ~$ G+ X3 q; T; h) n" k& j% O& b D, e
__________________________________________________________________________
' J/ s1 r8 ^+ y ~6 l2 c. u& E% f+ {- Q$ i9 `
Method 11
7 m" W7 L' |8 _) u) Q=========5 x2 F' w% r' i) G, I9 h
r0 \6 u# c' o. O* KThis method is most known as 'MeltICE' because it has been freely distributed
- y; m2 { e- ~. X# [via www.winfiles.com. However it was first used by NuMega people to allow
6 I; ` V) p( v3 |$ z' R: MSymbol Loader to check if SoftICE was active or not (the code is located
, w E- a/ X4 N- n- Minside nmtrans.dll).6 g) q+ E e/ M5 L8 t" Y! K
3 G2 c+ W2 s6 p
The way it works is very simple:% G* E! O" B& x2 _# S
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for/ }# C5 ~* A8 e+ \' X
WinNT) with the CreateFileA API.
3 Q' x* V$ }5 Q. a/ B1 G& \6 ?: @* r4 Y& b c
Here is a sample (checking for 'SICE'):
4 _1 \6 R7 J) s) a2 X
9 S: ?# T K* X; g& g& VBOOL IsSoftIce95Loaded()
6 c3 H" W7 x) K4 v+ n& B4 E2 d: r{5 `% m) U' R. l+ v8 p
HANDLE hFile;
! d' g9 c- Z% R* p2 E hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,$ P: f2 j6 z9 |; _% ]& h3 ]! F8 V/ q
FILE_SHARE_READ | FILE_SHARE_WRITE,
3 [* E7 W; Q" A) ?- [# I# a NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
+ D7 d1 B3 }' { if( hFile != INVALID_HANDLE_VALUE )
: ]5 k- v) _7 f) e: |" _ {
+ U) j% V/ ~! j CloseHandle(hFile);
; C+ U, F; o* F( W3 D return TRUE;) _: b* k" q- f# g) {
}
% T1 i* s. f) ]( y& ~ return FALSE;
- e7 w1 i( ]" Q}" Y8 l2 p# I' q& ~! }: z$ x
" y t) j/ E- q5 E1 g4 M: d% w
Although this trick calls the CreateFileA function, don't even expect to be! Z2 e$ Q7 R6 T0 e* R M3 n" b
able to intercept it by installing a IFS hook: it will not work, no way!
2 X6 r; P2 K) E0 R9 {% R7 qIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
. P) |0 f" B9 q. Tservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)% L2 O* ^# f& E5 R
and then browse the DDB list until it find the VxD and its DDB_Control_Proc, W2 g8 c3 a2 x% V$ m) B9 M9 A) ^5 T! e
field.1 T: z2 {/ H6 {
In fact, its purpose is not to load/unload VxDs but only to send a
/ ?. ?! p7 c/ x9 W; {W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)! x# U6 M+ }# b8 y5 i8 R; I
to the VxD Control_Dispatch proc (how the hell a shareware soft could try( G& A1 z2 _5 G2 ]9 W1 M
to load/unload a non-dynamically loadable driver such as SoftICE ;-).+ n: O# e* O D3 M- O1 \% v* I F* p
If the VxD is loaded, it will always clear eax and the Carry flag to allow+ A. x: _6 }+ x) y/ x: _: ?2 Q
its handle to be opened and then, will be detected.
7 K: F, }; M% Y3 f! z, ^; YYou can check that simply by hooking Winice.exe control proc entry point v$ N9 x: Q! a3 z/ R. P
while running MeltICE.3 @/ L' k3 D* k
! S: j$ c8 I, ]' E; w2 T* R) s# s8 ]" b& ?7 E. Y
00401067: push 00402025 ; \\.\SICE, l- W9 m' ^; t# O& D) X( o1 l
0040106C: call CreateFileA0 X I7 J) z; I; s* U0 t" P( \ o
00401071: cmp eax,-0012 H- E6 q4 K+ v0 e
00401074: je 00401091
) e% r/ c4 j) C% I. {$ w" j$ @5 z: M0 i. p' U
2 A1 P$ I4 S) t$ q; z
There could be hundreds of BPX you could use to detect this trick.
+ v) z; P& |# n- D. U-The most classical one is:
! \1 `3 W$ W/ j, K2 A BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
% c( h9 R: N Q; J z- I- O9 m *(esp->4+4)=='NTIC'1 T1 A2 b( u7 v: ]& l. q
2 q8 \; `0 p8 [" T+ A9 s
-The most exotic ones (could be very slooooow :-($ \- ~. ?! M( C
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') $ T0 D, `: i0 D$ @0 B
;will break 3 times :-(
2 G# S3 _5 d1 D q8 {9 l5 a0 X S& t8 j8 }9 `/ o5 n: W
-or (a bit) faster:
' ?- S: p5 G u. N: I BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
' c" k9 e( Q; g P& E( ^5 w9 B1 M8 Z. W7 L7 \/ w' z. h% p
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
1 z& x$ p* p! P7 G P ;will break 3 times :-(
* k0 z! N6 l- a) Y P
' {5 x m6 {+ i8 w! G7 z( t( S-Much faster:
$ Q# }9 u* j2 k' o0 U BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
4 }$ K% o5 U$ I+ B" E/ Q5 N
$ P# n; u$ v2 F1 N ?Note also that some programs (like AZPR3.00) use de old 16-bit _lopen7 l- N2 G+ ]) c2 v& q
function to do the same job:* R( w: v3 l$ X& P% \& t0 n- L
4 Z+ C! e& F" M+ h" b' j8 r2 o push 00 ; OF_READ
4 t+ i0 w5 Z0 a1 u mov eax,[00656634] ; '\\.\SICE',02 O F+ L+ L6 D. T$ w
push eax
, _# \+ o* l, w" Y; \/ M call KERNEL32!_lopen
- C5 g! K' J* l3 ?, R& x- A# ^ inc eax
: @# ?5 F7 c6 w3 b2 U @- T jnz 00650589 ; detected/ ^. s( d5 g2 ~2 _8 @1 X
push 00 ; OF_READ5 f2 t! O0 a7 X
mov eax,[00656638] ; '\\.\SICE'
- N P* i6 m% `; h: _ push eax* S4 V. y/ L: O% }: F2 ?& R
call KERNEL32!_lopen' O! _' q0 ]1 p* k' L' v! ?9 I
inc eax% d' c: X6 t; M4 T* @. Y
jz 006505ae ; not detected; e: F4 N& ]- V H; {) E- ]
$ R2 B2 z- ^- e
5 @% N9 U8 |2 v% r. n6 r__________________________________________________________________________
* f. }" g: b: o h4 H3 s8 R9 H9 O7 n5 G/ V+ y& \6 i5 d9 i
Method 12& h% ]" v$ L& M: v9 W
=========
- E8 N% v7 G# B- F1 Q% T
# l9 Q" o2 r k: @- ?# {: AThis trick is similar to int41h/4fh Debugger installation check (code 056 k& [ p$ H: [8 C* t: P9 b; Y
& 06) but very limited because it's only available for Win95/98 (not NT)
/ m2 y' G& `8 h! c, b8 N- X* }3 vas it uses the VxDCall backdoor. This detection was found in Bleem Demo.
8 b# Q v7 o; a. f- a# x; ]% T5 _8 W) |( W; R8 ]6 `4 u) ~9 Z9 c( u" o/ y
push 0000004fh ; function 4fh/ M! r& r! B4 n4 \2 o; X( Y7 O
push 002a002ah ; high word specifies which VxD (VWIN32)8 k8 _/ n! R/ r' q
; low word specifies which service3 z: T d. w8 ^: D
(VWIN32_Int41Dispatch)$ e3 X0 \' }! U R S) ?4 w% ~
call Kernel32!ORD_001 ; VxdCall
. ?; m9 H9 N+ k- \; E' H8 J B cmp ax, 0f386h ; magic number returned by system debuggers
4 X* f2 t, A) R' O) [ jz SoftICE_detected1 L4 e! O+ D c1 @
3 I+ @7 ~, p/ r; cHere again, several ways to detect it:
, G- c7 j) ?4 V5 k/ ^+ g) R
( s$ z, v- ?3 u, m BPINT 41 if ax==4f$ R* k( R N/ F; D2 b$ [. M
I( z: N0 r& V( ~& v4 n8 ?8 B \ BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one6 S7 F1 h0 m! t# e. M
O# m( F: ]5 n
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A8 `+ T( k- ?$ ?
+ S4 q5 p2 u, `6 W; a& F" q BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
* e$ V1 ^& r, g. L" T1 T) K2 S5 L+ {7 I# d9 T
__________________________________________________________________________/ t, s9 Z" }. y* f! z% N
r: x: p+ L% x5 o2 lMethod 13$ f- r1 }& e2 z5 z7 p5 [2 Y; R
=========
2 J& l, m3 s0 K6 P; u: ~" w% g
Not a real method of detection, but a good way to know if SoftICE is
: H) `2 v9 Y/ Sinstalled on a computer and to locate its installation directory.
! F% z7 Y4 @8 ?It is used by few softs which access the following registry keys (usually #2) :
+ B7 w- k; x$ g6 t' P7 @ x6 @( B* U+ y
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion% n+ L# F p9 W
\Uninstall\SoftICE8 D, Z W% y( P3 A
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE" L1 h/ w' [% l. r: x6 C* _& ]
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
6 D; `' h" d. J$ k' q# C I\App Paths\Loader32.Exe
5 y. f+ L; F; e: v
! [9 {7 ^! D, |4 q( b; v! W
5 W6 N$ ] H- Q5 n" wNote that some nasty apps could then erase all files from SoftICE directory
8 v- F* e/ r! g2 N(I faced that once :-(
3 N2 I. o# J& R9 J% d
& u5 S7 H( Q; x2 a# S5 S6 \Useful breakpoint to detect it:
, J4 t- n; s/ i- ^; d
: r9 k: N3 f6 L& `7 J BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
5 b9 W4 `9 E2 Q* `. e7 l' R" ^5 F* N# w: o' Z* V, n0 p
__________________________________________________________________________" m# p1 ?6 M$ n1 s! H( A
: a H8 I; g, D+ j) i; g* g
0 m& ]$ }. p) }$ M% i: }Method 14 # v4 {/ K' A/ ~" S ~
=========
9 L6 c% z6 M! y3 T
& J5 H: \# K1 L% s" dA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose0 h8 T& G8 Q2 I
is to determines whether a debugger is running on your system (ring0 only).0 D$ ~ f) t) N
' ]7 ]9 s2 V( V6 i- Q VMMCall Test_Debug_Installed3 a" }* C6 v5 Z0 b; z* [
je not_installed
3 R$ L% K0 l5 u9 v2 e2 Y7 N7 W n4 T0 {
This service just checks a flag.
7 f3 ?, I6 \4 }( S8 M</PRE></TD></TR></TBODY></TABLE> |