<TABLE width=500>* U; z; U/ ~$ z1 Q ?& L# j8 w
<TBODY>9 F$ G4 f2 t; ]& b% I& F
<TR>3 P0 V [2 u1 p
<TD><PRE>Method 01
; |# R7 P( `9 V( L3 H! B# s; K( N7 T=========
3 z% V j% j1 Y! Z6 p9 z5 i- k1 R S! s7 s3 m! w2 E
This method of detection of SoftICE (as well as the following one) is$ y2 S- h% E3 q! D3 Z
used by the majority of packers/encryptors found on Internet.: k" f2 P( j4 ~: A1 {9 q8 g
It seeks the signature of BoundsChecker in SoftICE `* w* ~$ T! U" X' H
6 i- z6 d! F( l% w5 t3 r# m
mov ebp, 04243484Bh ; 'BCHK'
( r8 w3 Z' R3 s& q2 ^" p9 B mov ax, 04h& J9 f& \' i. g! M: ]
int 3 - f; X: h0 ?4 b2 {' d: \
cmp al,4% @8 k; `/ A2 G7 w; ?
jnz SoftICE_Detected( F: Z6 H& s9 L9 U- c% E- {8 F
' f" l" Q9 Z" g& ]* r___________________________________________________________________________
) }9 \+ q9 ? G. X
1 C3 d, X0 [: e; o5 |# GMethod 02 ?9 N% [' H4 K! r& k
=========
M$ ?/ s' e7 w; n5 D
9 O7 k" |+ x! X1 K- ~8 AStill a method very much used (perhaps the most frequent one). It is used
0 B. |+ f6 f, W+ F6 m1 V* A: ^to get SoftICE 'Back Door commands' which gives infos on Breakpoints,/ R$ Y4 X! b3 l, u8 w/ E; A) g
or execute SoftICE commands...
* J) L# @1 |5 D K' Q+ W+ Z$ rIt is also used to crash SoftICE and to force it to execute any commands
, n' k9 M. V/ U J4 O' A(HBOOT...) :-((
/ C! u: J- {, h7 L# B
: J" r, J/ {9 ^! B( m7 }& hHere is a quick description:" B- E6 Y `% o: _) V- j$ C9 b
-AX = 0910h (Display string in SIce windows)! h. f. E3 |: N' A
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)2 v* `" D: ^" W" ? G- V( K
-AX = 0912h (Get breakpoint infos)
9 y/ o* \& @% J9 e3 ^% I( R-AX = 0913h (Set Sice breakpoints)
4 t$ S$ [3 x) a$ j1 a-AX = 0914h (Remove SIce breakoints)$ s' N' f1 m7 t! ]3 J3 ^3 a% d
# }. ]" A5 ~( W- ~! b
Each time you'll meet this trick, you'll see:
* m, Z/ m0 l) S. H-SI = 4647h0 U; p" [, B, ?3 n Q" V
-DI = 4A4Dh
1 ?% Z+ R5 J$ U" C( ~* g! J6 ]/ eWhich are the 'magic values' used by SoftIce.2 |/ i& V8 v4 [" s+ l
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
+ {# [/ n+ k3 k9 N
4 `" M( A. E8 ^$ y mHere is one example from the file "Haspinst.exe" which is the dongle HASP3 ]* }/ r% A: w& ^
Envelope utility use to protect DOS applications:9 ]# F& ~( b6 U0 x) a. G
! Z6 P8 t' W- _; x0 w% B9 I: p9 j' r9 D1 y' t
4C19:0095 MOV AX,0911 ; execute command.
! a& |+ ^* N4 X) H1 {& ~/ ]# J8 Q4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).' T" W6 R% E9 S9 K! l1 ]
4C19:009A MOV SI,4647 ; 1st magic value.
/ Z$ D# {, c. R, U, B! |4C19:009D MOV DI,4A4D ; 2nd magic value.
" B. |8 Z& |% L5 h4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
/ O7 s8 V! C0 _' h4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute/ E" k' n* D$ e6 F
4C19:00A4 INC CX1 p$ O& X. N2 G+ v
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
/ O9 V3 {. p; P* f" V) D4C19:00A8 JB 0095 ; 6 different commands.
+ h+ G: U9 }4 r6 O4C19:00AA JMP 0002 ; Bad_Guy jmp back./ I4 D) C+ p% B9 [- t
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)& F% E/ d5 I" Y0 q2 K9 e! S8 I: O
2 p0 C m& j* |! I. u* M) t
The program will execute 6 different SIce commands located at ds:dx, which6 Z8 k+ h! R) n# f
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
( W8 E4 R2 r9 E* Q3 R: d& i
, n! v6 c. Y+ t3 E; d# l8 e* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.9 D- \" b2 T9 H: Q# Q4 g
___________________________________________________________________________1 _. Z* {% Z+ f' m2 i4 Q
# [7 P f/ N5 F& H! ^
# e2 u: U/ J* Q$ X- a8 [9 b: DMethod 03
" |0 I% m7 t# D$ F4 e- @=========
5 P+ A4 l) a1 h& P) D5 f0 k9 p4 f" z, u' P+ n9 ]; O M
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
1 v g% B; K: `2 D$ S(API Get entry point)
+ I5 K3 T% u! n$ I; C7 e# Z ( o9 t/ z" J0 S3 E
# M/ P8 Y6 r# c! c3 m. [0 N5 I xor di,di) d, p! I$ ?1 w7 F+ b- {$ g
mov es,di8 ~) f6 a% Y: y6 C; r5 J; R
mov ax, 1684h
/ M: n$ f! ^* Y" Z/ R9 i) \7 p& ^ mov bx, 0202h ; VxD ID of winice2 ?+ G4 p6 @, M! \9 I8 p* K" q
int 2Fh9 d: `, L0 R+ I( q; Y
mov ax, es ; ES:DI -> VxD API entry point& {5 ~: b* G! O! C. U; Q0 z
add ax, di
; `+ E: N1 s+ _; A$ Z. M/ F! t6 q# ? test ax,ax
9 x& s6 j+ l9 |$ j$ u8 b4 l jnz SoftICE_Detected" B1 f& l) j1 d% B* G
0 F% Q" k& ~5 k; h
___________________________________________________________________________- S/ g. @1 {/ e% f
3 C5 {8 ?* U, LMethod 04$ R- F5 g& }4 H& T- k
=========
: z( Q. @4 p- L
# V) v/ b' V" L1 L( WMethod identical to the preceding one except that it seeks the ID of SoftICE
$ W( M$ \$ I1 Q0 D5 r: k) g6 DGFX VxD.) n6 W$ X" ^4 r4 f0 k; l1 I$ p
/ Z" ^$ A" D3 [( n. l' E) |8 [& O* { xor di,di* C G* ?1 h* j; W
mov es,di
] W1 h" o8 b! R mov ax, 1684h
3 j+ O# g1 e7 W, Y6 Z8 \2 ^ mov bx, 7a5Fh ; VxD ID of SIWVID/ O: B/ e( N1 N! m" }1 i V
int 2fh
; n2 \! W. m; a' ~- M% E9 I2 p mov ax, es ; ES:DI -> VxD API entry point
- D- v8 H9 _% }! k add ax, di2 s: ~% m! |9 ~
test ax,ax
7 \4 S9 j+ y, p jnz SoftICE_Detected* G2 j- m0 L1 c
) x3 _0 x+ s6 E; C) k# p2 n__________________________________________________________________________. F" Q! v: S( L! z5 {5 C
4 R) f$ c, B& Q4 W3 r. C% W4 W
: o6 r% b6 N5 qMethod 05: P- W) m8 m% X/ U) |3 L/ }* ?
=========
) O0 A* K" a- D0 ?* X& l+ ?" L/ N2 O3 c& q2 h
Method seeking the 'magic number' 0F386h returned (in ax) by all system
% w3 ?. ^$ W ~9 D2 Cdebugger. It calls the int 41h, function 4Fh.
& t, b; ~, ^7 A+ }There are several alternatives. + n1 N8 J; { J) Y: S9 }7 {1 W
. c9 q W% h2 [/ a; I- } n
The following one is the simplest:
; K9 V" y' g. D$ G# l( z$ F! q* M* f
+ Q d) O! O9 `/ ~! s: L" ?& } mov ax,4fh$ D, T% ?$ o* O; r
int 41h5 v0 c# m8 ~7 S% C
cmp ax, 0F386
8 {) M7 k+ v: b- t4 s7 m! Y jz SoftICE_detected" b& ]5 t/ o/ R
( _; O& t+ c* I! L
, B5 d0 o' n) i5 F; QNext method as well as the following one are 2 examples from Stone's
8 y$ r- c. q! b! L" G' s"stn-wid.zip" (www.cracking.net):) X- G+ `* X6 `. |0 d9 |
" ?. h; j2 `; Y( u) ]9 n. P mov bx, cs
! X* e2 S4 I- b# L9 Y+ _ lea dx, int41handler21 m1 y+ y: a& e$ O9 G7 ?7 Z
xchg dx, es:[41h*4]; f3 H% Q" i+ G) B* N
xchg bx, es:[41h*4+2] Q, c7 |- {1 N& w
mov ax,4fh, v; y$ }! v5 A2 \7 s M
int 41h
. u3 ^% F: |* v" y z; J& g! } xchg dx, es:[41h*4]
, ]9 y Y1 [ ] xchg bx, es:[41h*4+2] f4 T5 q* |: J5 n
cmp ax, 0f386h5 o) | S4 R9 ?5 }. Y+ j
jz SoftICE_detected3 p0 [5 ^; y j, f
& }0 q+ q, D/ aint41handler2 PROC
* ^. s5 M) b# q* } N* X iret! s1 T6 o+ x$ Q: A* C5 Y; {
int41handler2 ENDP
. [+ R j! W( |0 W
7 N) N+ s% f# O" F; C a
0 Y& V4 r* [( D$ v_________________________________________________________________________
0 J: e# ]; ^+ q8 w
. f( X8 _# U) w0 ]" j0 p: {/ ^2 M- r4 q2 o- m' O
Method 06
& Q! o7 { V0 h0 k9 ~. m3 B7 C=========8 H9 p5 o( ?; J$ d/ | [
9 w1 u5 w3 J) h& k$ ~0 }* b, s! v
2nd method similar to the preceding one but more difficult to detect:+ F8 o/ { ^9 @- N, W
! Q: S9 G1 R. i
9 H$ ~- D M" Zint41handler PROC/ n; |2 V1 o9 ]( ~
mov cl,al
1 W) U2 ~. L* b: p b! T9 }1 e iret
; L3 e$ ?2 b! u, D- [4 l& yint41handler ENDP v0 ~: ~! X: { {; L
' O# ~' j& ?) S/ n3 k7 k
3 z) a, Q. e7 U7 n7 V* a0 Z xor ax,ax# k' T& O- R/ A
mov es,ax
/ r1 B+ x4 M0 u3 q! I( c mov bx, cs: ?) E6 r/ r5 r% V" I
lea dx, int41handler! i6 q# E) _- y; L# }1 O! I
xchg dx, es:[41h*4]
, y- O0 `1 ]% I. M# [ xchg bx, es:[41h*4+2]8 T, u: _; y& a& s4 x* Z
in al, 40h: G" ^/ k* @0 _$ P7 F0 E
xor cx,cx9 T6 a5 S( H3 C7 ~3 k/ @
int 41h7 n: V( p0 F8 s+ L8 k
xchg dx, es:[41h*4]
- W( r- [; U* o: s: L xchg bx, es:[41h*4+2]
- K$ L( ~" B$ p% s4 c7 I, e9 {0 x. ^ cmp cl,al
7 f: }0 t; y5 s3 ~: [4 I jnz SoftICE_detected
) f r9 I+ a! T9 A* k! j6 u& i; R7 z% W7 ?) k3 n# L
_________________________________________________________________________( @$ g! H7 u0 h) {8 }) ?$ h" y8 v4 V
' {- R: x4 g, J; B o, A7 ^Method 07
* k# \0 R# _ `' _6 H9 h8 m=========
2 K5 o$ t7 b3 n9 t X
+ H* s2 @ \4 O6 h6 jMethod of detection of the WinICE handler in the int68h (V86)1 S& Z# u& R4 u! B$ [+ H
- g% N% Y+ r3 D5 F: g$ [
mov ah,43h
( n/ I7 M% r& ^' S- G2 T int 68h9 u5 d) z. x) x0 ^% C
cmp ax,0F386h
& @# @, `/ C& u7 b0 G8 \6 N! V jz SoftICE_Detected
) p4 H, u. P/ A+ f. f
, i) i" P% `/ u* l
. U! c0 T: i+ E2 ~$ w" {3 p$ Q! ^3 G=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit6 p4 ?% o/ p4 z$ W( h$ c, h) T# m
app like this:7 ]% y' {( O/ a# b9 @ B
- T3 C0 n% u0 u, K3 i7 s* w( Y* S
BPX exec_int if ax==68& s$ Q" c3 B8 V: B
(function called is located at byte ptr [ebp+1Dh] and client eip is) k P3 p. w7 Q* @: w3 N6 T$ ` @; I% P* k
located at [ebp+48h] for 32Bit apps)# x- I' q1 s; j' X, `
__________________________________________________________________________1 k! e7 V1 |% J; Y
& J9 P) Y( T# E; k% [" n
, O& J9 R- Q& T! l$ ?" NMethod 08, g) A8 E" z% F. d ^
=========
4 j4 h, X2 ^: f& r8 \6 H
) B4 @7 Z. C; iIt is not a method of detection of SoftICE but a possibility to crash the/ x% O* w# G' i# x g/ h: @
system by intercepting int 01h and int 03h and redirecting them to another& o5 r7 p1 m1 q
routine.
6 D" O( K" I& G8 J* n1 ^$ ^0 j( }7 AIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points! z) S. C1 d! T9 L) M; ?0 p7 ~! }% W
to the new routine to execute (hangs computer...)
6 z9 K1 O8 K6 [ j4 R! D* Z {2 B8 U' V
mov ah, 25h
0 J4 \4 L) B H3 F6 [. j6 |& b mov al, Int_Number (01h or 03h)
: _0 z$ ^' Q4 A+ X6 @7 _! a0 k mov dx, offset New_Int_Routine+ B+ d* ]1 i, D+ ?0 i
int 21h
% |- [: H6 N! ?+ u6 M$ C- w' ~* Y$ ^, j6 Z }$ k, W- V$ ^; U2 E
__________________________________________________________________________
3 v! ?1 a, | g9 U1 j! `
9 n7 E% t* ^+ v( x+ B+ Y/ BMethod 09
" Y2 J% Z0 c" A) `, W=========$ |! l9 d) X1 R4 k. z' ^/ W
' U( `, t5 T* z! s, d: D/ k% j
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only! ~2 H! ]; }; }5 L; L! S/ f
performed in ring0 (VxD or a ring3 app using the VxdCall).
- S* N4 U/ ?- C: S" ~/ j9 r8 s5 lThe Get_DDB service is used to determine whether or not a VxD is installed
# |% `& W( S \2 T5 Q gfor the specified device and returns a Device Description Block (in ecx) for* s: ~, I4 X0 ]6 @
that device if it is installed.3 N( V. b+ J9 p2 f3 W. ?* I# C
0 P, J+ {: B+ m( u* n9 f2 m! M' [ mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
# H" }$ _4 g5 v. ] mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
% p4 n! X: P- r* O VMMCall Get_DDB- ?/ S' C% K5 q3 M; ], }
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed9 B- q* a9 s9 }4 ?2 ^4 |
# |2 X) G9 T3 F2 a ^# `- _) D% w
Note as well that you can easily detect this method with SoftICE:- i! V7 v A; K+ `" N5 \: v% K& {2 q
bpx Get_DDB if ax==0202 || ax==7a5fh
# `. C r8 \) ]* b! O! @6 r9 M K6 D5 \4 H2 s$ {- `9 R$ \
__________________________________________________________________________
/ g# Q+ y4 u5 d& \
9 s5 X8 Z+ r+ [" F$ m7 HMethod 10- O( c. x" Y- ?* x$ Z6 C
=========
5 a, r* T V8 R) ~) v) |# b; J
=>Disable or clear breakpoints before using this feature. DO NOT trace with4 j( P5 s M, \' d- B3 e7 b7 u2 Y5 \
SoftICE while the option is enable!!
$ v8 \& T- v* N# N' H8 J+ [
9 F. A& K6 B6 q' i: aThis trick is very efficient:1 g" J2 ~( J) g% P8 q: f
by checking the Debug Registers, you can detect if SoftICE is loaded
: U/ B4 l; k9 u+ i) o(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if7 P3 u" r+ R* R& c G4 F9 ]
there are some memory breakpoints set (dr0 to dr3) simply by reading their
* m! s( b% }7 D/ Tvalue (in ring0 only). Values can be manipulated and or changed as well7 `" E1 G2 i4 u2 i; e* M
(clearing BPMs for instance)2 n0 t. v: @- i; [" z
/ N- u% T5 I8 ]' `8 V
__________________________________________________________________________; a& G. d2 t1 @$ S# n" I
; N6 S" e! ]1 I3 c
Method 112 @' m( ^7 w/ q* d, m _+ x. Z
=========6 c o5 p9 Q0 j# N
+ o+ z: |- H( \( v3 v8 [4 \This method is most known as 'MeltICE' because it has been freely distributed9 c0 q% N& j& ~' T$ u
via www.winfiles.com. However it was first used by NuMega people to allow- \$ J4 p+ R5 u# Y) R& i
Symbol Loader to check if SoftICE was active or not (the code is located$ p+ u3 B) E0 ?
inside nmtrans.dll).9 s, i1 q' Q; }
: f/ | X5 O3 V3 d, _& o
The way it works is very simple:$ T3 v) E* R8 Q9 A
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for w k# d! c6 G; Z* P2 ]1 V
WinNT) with the CreateFileA API.
0 d$ I% O, }: R. G( L) \, t# b1 }8 e! M* B' e6 M4 b
Here is a sample (checking for 'SICE'):
: }# ?" |$ n5 m) I k
' G! r' f1 R- c! s4 oBOOL IsSoftIce95Loaded()/ c3 R, ~$ U' \5 ^5 k
{6 `& a, ~% Q: R" Q g+ z! i% C
HANDLE hFile;
: Q0 q) g. h$ o- g+ b hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,1 I z/ Q, k4 D z. B% [$ H
FILE_SHARE_READ | FILE_SHARE_WRITE,
& P9 W- I( D: a v. Q$ @" Z# a+ ]$ ] NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);" [: @- u! f7 D3 M. U! ]+ |& N
if( hFile != INVALID_HANDLE_VALUE )
' l4 w$ b. K9 y6 W" { {
l" b' u4 J5 y: p3 O+ z CloseHandle(hFile);# h& _/ W* K, d) j
return TRUE;
0 M6 b7 M7 n1 K* s }* y7 j9 m/ L' `% B& z. ]: P+ i- p
return FALSE;, E2 ~8 b$ V' e5 ^9 B/ }
}/ Q& H- w8 f) d( Q6 h
7 @" h7 o" L& BAlthough this trick calls the CreateFileA function, don't even expect to be
( D+ e7 X" Z7 s2 }! b. hable to intercept it by installing a IFS hook: it will not work, no way!
% B- D6 E+ \3 k4 W6 n2 p: A) LIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
8 w+ A, J: r1 ^. L6 t( O: Qservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
; ~% q8 n3 A0 t6 O4 U2 ~and then browse the DDB list until it find the VxD and its DDB_Control_Proc
9 o1 m$ n7 c" X+ Sfield.! I, s' \3 d, i, J& U3 s1 e8 I( v
In fact, its purpose is not to load/unload VxDs but only to send a
" l( U' B; E* n5 {. tW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
/ B2 p B, J" [% Z, R3 Ito the VxD Control_Dispatch proc (how the hell a shareware soft could try* y8 U. K! J" A5 U7 a |' ]
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
5 o d5 d1 V! n3 AIf the VxD is loaded, it will always clear eax and the Carry flag to allow+ x7 r: Z4 ~3 ]9 o
its handle to be opened and then, will be detected.) X/ q/ S& V: I2 X4 _7 Z$ {( x
You can check that simply by hooking Winice.exe control proc entry point
9 p' }3 Z1 @, X0 W+ w+ o' m/ Fwhile running MeltICE.
. Q9 G, W9 I: v; T: p7 h3 k/ ^7 q& g% b3 ^
, J) e( X S5 u" h& H. n 00401067: push 00402025 ; \\.\SICE
1 ?$ @* K3 M% X& ^- ~* w( Y/ l& }9 O 0040106C: call CreateFileA' K" T' Z7 h; I9 H7 w
00401071: cmp eax,-001
+ J" y$ v" {9 D8 i 00401074: je 00401091
2 u% k- m" L7 B7 C' b) y2 E# V4 ^) n5 U: v6 V1 K! ^0 c
- c9 Z# e1 k7 K% g5 h. s, ]; j
There could be hundreds of BPX you could use to detect this trick.
# N6 f% E2 i( ~' [. F) w( a-The most classical one is:8 n5 p# O: v7 _1 _* p
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||2 i2 U+ c; \( M9 \6 ]
*(esp->4+4)=='NTIC'. [" N) K u8 [7 D1 h$ ]1 ?
6 ~$ j- Y$ C- k7 d8 R
-The most exotic ones (could be very slooooow :-(
) x) r- B! [1 u/ a* `1 [9 b0 u9 i BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
N+ a' ?: |1 `1 I2 i- i ;will break 3 times :-(5 g3 m, h! D1 m. x# O, _4 e$ w
# P2 _6 Z" M+ F1 [/ ~+ H( y3 T-or (a bit) faster: % ]! L+ {3 z3 m% |- @7 P( ]
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')9 C& U' h; ~) ` A, r# k
$ f9 H* E) }$ |( A9 [3 G4 W BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
: N6 h4 V8 `; b2 _* t5 y9 _* p ;will break 3 times :-(
7 ^! B# e. R9 @7 P" w0 K; u' V5 \+ r. t* I$ s2 j2 K1 H
-Much faster:; j, @1 _& A4 D3 A; Q' M% w& W
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'2 C7 S3 x! ^* F, Q
. M+ X- m' h$ w' kNote also that some programs (like AZPR3.00) use de old 16-bit _lopen7 A p! i/ z! t$ `: k( _
function to do the same job:
: g; C) o/ R" X3 N: s3 }
/ S( S4 y2 y1 }, J2 }* J push 00 ; OF_READ( u& _- I# b. U5 M! S0 f
mov eax,[00656634] ; '\\.\SICE',0: T9 w. S9 b6 y1 u! e' a
push eax
2 F* a* V# m! J' ^8 _3 k call KERNEL32!_lopen; z) n7 T& D- n; j, G& n
inc eax
1 {, r1 B# h9 R% {1 f jnz 00650589 ; detected0 r9 r/ G0 Y" c1 P
push 00 ; OF_READ. f. m% h/ r# v, K8 k+ P
mov eax,[00656638] ; '\\.\SICE'
) ~" f5 M: [ t3 {$ n: T7 V; \# b push eax! i7 c' X' i* z9 ~
call KERNEL32!_lopen
; k8 B: y0 j3 |6 |, [: X7 p: A2 A inc eax
* B4 i: o+ t0 V8 s, j) B. B6 X! Y jz 006505ae ; not detected
# W* n; J+ R1 ^8 p
+ v7 W) h+ l& c: f
9 P( E! m: Y2 Y$ o__________________________________________________________________________
u" z( ?8 E: P. k3 `, |7 j
% d2 p, ^2 {5 P- `- q( k( s+ oMethod 12
2 o) h8 O C$ m8 ^) Q=========
; K; G7 `3 H/ x/ L' X
# ]( F& s5 }3 [* `( bThis trick is similar to int41h/4fh Debugger installation check (code 05, \" J' x; S% H' X. p1 U- X
& 06) but very limited because it's only available for Win95/98 (not NT)1 ~! @2 _, S) o
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
3 D' N( ]- r& V9 `! q2 L- Y. \/ y1 c7 J; {5 y
push 0000004fh ; function 4fh) D* Q; d5 L) ] t6 o
push 002a002ah ; high word specifies which VxD (VWIN32)
1 b) L: P2 o7 `# z) R7 N R ; low word specifies which service7 r# ]' a' g0 {/ V' G7 i
(VWIN32_Int41Dispatch)7 a. ^2 }+ N2 L$ d2 n3 i% q
call Kernel32!ORD_001 ; VxdCall
3 v7 O; m2 X5 W, x6 q) H5 }' P) g cmp ax, 0f386h ; magic number returned by system debuggers3 ]1 I) X) S, t% V8 d
jz SoftICE_detected) D* W' _+ ~% ~1 L7 a* ^ V( }
3 Z! A: F6 r6 R; s& g$ N/ \Here again, several ways to detect it:) G6 k% t6 A c
4 _3 s& S% o6 s( {: \. j0 G( C1 x BPINT 41 if ax==4f% B6 m. ^3 _1 M8 Q3 M6 X5 D3 \
7 o# I+ k3 W# T, {
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
: n W/ u0 ?* y# n
, n, H7 p3 e6 g Z BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A. O9 o. [$ x; h- V
* d& c7 G- s @& q2 h6 s$ K BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!9 k3 t0 l0 z2 f1 H
1 U9 D! `4 T( J. N__________________________________________________________________________+ N/ L7 o3 l. Q, M g
# r! R. l3 K& W9 b8 O
Method 13
% }" Y( a/ ?" z' P=========
+ ?/ S. |2 ~5 j4 m3 J% U7 ]) E
' o, h, }- }4 PNot a real method of detection, but a good way to know if SoftICE is
$ ^1 l6 ]$ k9 vinstalled on a computer and to locate its installation directory.
2 [# X$ M/ K xIt is used by few softs which access the following registry keys (usually #2) :
4 Q- `3 N0 h1 B% k; ^7 I ^& Q# f" C( ?* o
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
7 d/ D T) @& x\Uninstall\SoftICE( b+ T$ X9 i3 A1 p5 |
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
7 `7 t% {4 i6 d$ @! A* u2 q-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion8 H1 e5 f. [) }- F6 W
\App Paths\Loader32.Exe2 e6 ?# S( p9 [ Z0 C
0 J) E# u+ }* n! D- F
" \0 N [9 ^8 z8 z9 S: INote that some nasty apps could then erase all files from SoftICE directory" M- ]' H$ w/ K/ x! O7 `, w8 o
(I faced that once :-(
2 s4 ]" |8 [+ _4 [- `" ?8 T0 p: f& L6 Q
Useful breakpoint to detect it:, _, R0 ^4 b2 p5 a" a7 Q
2 u6 W2 f% |# S BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
! ?) e9 \/ e+ |2 x" I7 W- O
% T2 m: b8 r; M* m__________________________________________________________________________
d1 y) V( t0 s7 M" v
1 K4 @% a( `$ J7 G% y4 F* ~( K1 h k% s
Method 14
. Q; W2 o5 W7 q/ W3 v- |=========
8 s T; o2 a; S& f2 D$ i# u4 E, h: T# A- E; G8 ]) @- B7 \ E- }6 Z
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
% t2 A* c3 L) U4 h x8 Tis to determines whether a debugger is running on your system (ring0 only).! b0 A* f! E6 i* N6 Q
4 D+ r3 t( X$ u6 Y
VMMCall Test_Debug_Installed6 j5 u: f) z$ ]8 z0 @$ Y9 m
je not_installed
* A9 l& T$ K9 z1 M
R9 d$ r3 x) s/ _This service just checks a flag.# @9 y* L8 P; L2 n/ ?3 q% O' _
</PRE></TD></TR></TBODY></TABLE> |