<TABLE width=500>: w3 S+ w/ c+ v& u+ I. z" ?: [/ p
<TBODY>6 L3 D' |% s" |# {
<TR>2 B% `1 ~* a/ E8 b4 F- F
<TD><PRE>Method 01
( e* h3 ]: y: E' L. |=========3 C0 ~: }) F z
2 z8 \3 @2 P# F) E# \This method of detection of SoftICE (as well as the following one) is
& n+ P4 y; }0 E+ t; B$ _6 Mused by the majority of packers/encryptors found on Internet.0 L8 R2 U6 j+ t" |/ }8 i4 ]
It seeks the signature of BoundsChecker in SoftICE
! u7 \7 V( U( U- P( l% C! S9 ~* [) ^
# X$ D+ M3 X$ }, _ o$ A5 w mov ebp, 04243484Bh ; 'BCHK'
9 @* b; v7 c {* e mov ax, 04h- Y( \; s. ~ N" d7 R, o( S, z
int 3 + }0 |( V8 }8 A, ?0 W) O, Z% i
cmp al,4( _% R, H1 e5 N8 y' P. d% t$ n" T
jnz SoftICE_Detected
# k; z; m0 P: j4 [1 u5 H
) h$ a/ N( `5 h# I5 T___________________________________________________________________________' u$ @, i: ?1 S0 U, v6 n, x: ~
- B( h" E4 G; m
Method 02
D! I; E7 C" o# X w; X+ a* U=========# d0 v- e8 [2 J) b; p' I
2 U4 X. W5 f: k, n: b8 m' @+ K; GStill a method very much used (perhaps the most frequent one). It is used
& y, h' M4 N" y6 p z9 _to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
5 J8 j2 B+ y/ `" g7 X% i a# ror execute SoftICE commands.../ M7 ^, ~9 s( T/ E
It is also used to crash SoftICE and to force it to execute any commands( q7 s( ^0 N- d
(HBOOT...) :-(( " _9 W" o+ A% O
5 B" |! \! Y; J# a' Q
Here is a quick description:2 d* U$ q* d5 G% G0 o
-AX = 0910h (Display string in SIce windows)9 Q& k1 d4 R# K2 O4 V @
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)( r0 w& ~ h3 Y8 w0 J
-AX = 0912h (Get breakpoint infos)( c, b7 R3 R$ k
-AX = 0913h (Set Sice breakpoints)
- l- v' i4 z9 z7 F-AX = 0914h (Remove SIce breakoints)! o. u8 ]: i- S7 t& r8 r
- x8 b$ G1 m% ?- V0 M/ w! {Each time you'll meet this trick, you'll see:
. B1 l+ q6 Z& P! `6 ~( ?. |) x% W) W-SI = 4647h
, h C: H% r9 K: s# V7 ?-DI = 4A4Dh
: m/ u% h* b3 }1 d+ fWhich are the 'magic values' used by SoftIce.
/ m9 T3 C! J* FFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.! E( s5 o; W0 D0 V0 ] [* i
4 q" y# h6 T7 E* Z1 YHere is one example from the file "Haspinst.exe" which is the dongle HASP6 V( I9 N5 \) @* _* v( [6 ~8 u1 O6 p U
Envelope utility use to protect DOS applications:
) }; y3 T* H8 L/ \" Z5 L5 R' j- Y' Z9 K" f. T
& E0 @* g; ^" p$ E6 }5 _* e4C19:0095 MOV AX,0911 ; execute command.
- X4 j' }" k% q' |8 \$ }( D4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).6 h8 L: Z: ^3 E& H4 _8 a$ D
4C19:009A MOV SI,4647 ; 1st magic value.
1 q: N0 h; l) C f4C19:009D MOV DI,4A4D ; 2nd magic value.
- P+ [' |5 `: T/ ]7 j* I4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)! V1 k8 G! U9 ^
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute" z _ i2 R( ]6 E8 l: E
4C19:00A4 INC CX6 _) V( C5 v. d$ l0 V9 W
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute' p2 ?6 I) \! h3 Q4 E
4C19:00A8 JB 0095 ; 6 different commands.
. O9 L9 s0 O `4C19:00AA JMP 0002 ; Bad_Guy jmp back.4 k( N/ r1 B3 U4 e( p* ]
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
, [- N! m3 P _- l; [( d# l5 s9 ]6 t' E( q+ E6 h+ ?# @
The program will execute 6 different SIce commands located at ds:dx, which& X- L5 U' |, ?0 e9 _! u
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.. Z2 Q2 _; u4 ^: S% V1 M
1 |8 _- U, I" b3 f9 f8 v
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.4 W, m5 \; ]& O# q5 A6 E# \* P# i
___________________________________________________________________________
9 K: m7 `3 r- h5 S I7 l
$ {# u' ~' @3 R$ m
5 a+ y, T5 h7 F2 n3 v" q+ ^* T# SMethod 03 B+ h; _2 i% c& _% O4 o8 u
=========: X# ?( c! k% H* [" [9 Z( Y" A L
4 {1 I' d0 b! }, b/ D. F5 L$ E
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
# {2 E. @8 Y7 ~8 f7 ](API Get entry point)! f1 }4 |8 N: T. Q
F* W( f; n O7 s
0 |# ]7 p9 f% S. K" I# T xor di,di* M, m4 i+ Z( H: F& I- s
mov es,di# c" r: q' d/ t4 j% S0 W
mov ax, 1684h
; h7 q; d7 r9 S5 b- V* p mov bx, 0202h ; VxD ID of winice. Z, p5 ?7 i0 x+ j' ?2 G+ @
int 2Fh$ H' e, ^+ p1 g' n1 `0 J6 g
mov ax, es ; ES:DI -> VxD API entry point
2 L' Q% _4 L$ U6 D) k' A add ax, di
9 S) n( R& g+ R+ r. a5 Q6 q% M test ax,ax/ ]# x8 u% d: ~& R) n
jnz SoftICE_Detected
7 W1 O0 j$ C' ~- N2 Z U( s8 x7 F C w
___________________________________________________________________________
# x. C% O( h0 P; j9 P
9 k' _1 C. ^) T/ b; e' o( LMethod 04/ G' w( ]4 P, ]. ^3 r- C! i. x5 k
=========8 b5 I7 m# @* f% {0 ~9 ]' s
7 }6 P5 k' D9 Z5 X9 C3 x) sMethod identical to the preceding one except that it seeks the ID of SoftICE
9 U- C- @# T! A$ [3 `3 c$ J8 aGFX VxD.6 A+ I: q/ J5 \6 Y4 U
( S% {5 M) `+ P* B xor di,di
0 R% t& c: w( }+ J3 ~+ v1 F. _ mov es,di$ u1 J: V4 V; t. S' v
mov ax, 1684h
0 N+ P; V C8 F mov bx, 7a5Fh ; VxD ID of SIWVID
: ^9 V* ?& Y' f: s$ ~! Q int 2fh4 t2 @+ }, J, O
mov ax, es ; ES:DI -> VxD API entry point. k5 z: `: N2 q6 e9 @
add ax, di
7 m! i3 p# [5 @& Q7 Y test ax,ax% ~* n& n2 O5 X) Q7 O; c/ {% U
jnz SoftICE_Detected s) Y9 y( ^9 P3 M
0 s) s7 S7 V7 n2 U__________________________________________________________________________/ a0 K+ s' R# w8 {6 {
0 W& F$ ~6 \8 B f& r* t8 l; p" B: K H
Method 059 G. X/ T; F4 y
=========
1 Z" B+ W0 C( K, u( `4 J3 X$ |' J4 u; X1 U
Method seeking the 'magic number' 0F386h returned (in ax) by all system
5 N% K& T; d( K, f; A+ \2 n) r$ {5 fdebugger. It calls the int 41h, function 4Fh.
' H! m3 ?4 T. e( f0 YThere are several alternatives.
* e6 C( X- T5 K. W8 r4 p/ m
4 A5 w' e$ h4 w. M7 ^The following one is the simplest:
7 Q7 [' u* ^& d. F: l& J- y5 |
& T6 J$ W8 h( ^ C4 E( A mov ax,4fh$ ^: ]- X1 h2 _: b
int 41h" V* a1 |. Q F! k9 b" J
cmp ax, 0F386
6 X* ^5 b: [+ { jz SoftICE_detected
* H; N( M: y5 X2 O) d6 r+ V7 X, _2 D t" K, C9 }( p
5 U. ]5 q4 j7 ]" o" y# i, i
Next method as well as the following one are 2 examples from Stone's 9 `: u( Y! j( \5 n) B
"stn-wid.zip" (www.cracking.net):# J ~9 \/ D7 G; g% W5 l
: J# f4 c4 s5 L. Q6 M! T mov bx, cs* n6 Y8 x+ [5 \% J6 r
lea dx, int41handler2
1 @6 R/ S0 R; g* t; e" ]- P xchg dx, es:[41h*4]2 T0 w/ ?7 [$ k" j6 H/ A
xchg bx, es:[41h*4+2]) @# |" U2 ]0 g9 ^. U7 `% k: s
mov ax,4fh
* y6 g0 n+ f& P% |5 w( x int 41h* j: ^* i4 y& [ z7 K3 G. J
xchg dx, es:[41h*4]! S* N4 G6 w2 ~' Q1 M- ^7 h
xchg bx, es:[41h*4+2]
" c9 | A$ Y# C* i! a0 y cmp ax, 0f386h6 ]: T3 Z/ N; P% d
jz SoftICE_detected2 ^' l& d K6 l+ G" E
! |( H) F/ U x/ n+ A
int41handler2 PROC
4 _- [/ `6 @5 I% f iret
4 p: f; L5 s+ Q( U+ N" mint41handler2 ENDP
2 J) e# p) |, `5 Y) }1 {1 `* D( c8 ~% q$ d8 g1 N7 n( |2 D
/ ?) i2 P M) t/ c! m_________________________________________________________________________! ], `( j8 u) W- }- |
- q7 \. H2 I0 G( u' L1 M
- `8 K6 w, J, E0 ?Method 06
8 \6 A/ W$ |% i0 Z=========
+ ?8 d( o9 d7 O' q' |
' d6 ]" ?. d$ b& @; H
% u/ i3 ~* @ H. M5 y9 h, B/ j7 U2nd method similar to the preceding one but more difficult to detect:; P3 a9 H4 i* a$ I4 V% z* r2 |0 J
5 ~! z$ |! Y% f. X
' h. m/ X; Z' n" sint41handler PROC
2 a# ^/ N& \( k mov cl,al
7 k1 H2 p5 r: S iret9 i+ u% t4 r. E- c% w% p3 b2 m
int41handler ENDP
. |+ N9 C* y2 {: g, B- v$ u3 S% ]) L
P7 s+ c( }$ {
% o' s; I8 |# d& d+ L- C xor ax,ax
1 n( [! M! w2 b0 o8 @3 H6 Z mov es,ax4 j' m' ^8 c( X4 R. w
mov bx, cs
( Q# o: ]4 l* z T lea dx, int41handler+ [ C8 u# L. t& ~1 T `2 Z7 ]
xchg dx, es:[41h*4]
# m2 k/ Z* b$ B! ?% x1 i* i xchg bx, es:[41h*4+2]" f3 t8 j( T3 R& Y% J
in al, 40h7 k+ Z6 `" d- B5 [9 W9 C
xor cx,cx8 X5 G# g8 m& I. W" b9 i( t* v+ f" z7 n
int 41h7 s" X' P. L: @) m9 _& m7 m
xchg dx, es:[41h*4]
( `8 q7 m% a2 s: c. u# w1 H4 N; ] xchg bx, es:[41h*4+2]
4 [9 q Y1 o9 F$ A6 G0 u# \5 H cmp cl,al5 W! ~5 s1 J% G/ ?+ I
jnz SoftICE_detected+ ?/ `$ q+ u7 Z3 m( x4 W
$ p- ~( J: `8 L
_________________________________________________________________________6 v, S' y4 R F; g
+ b, O' o1 m4 O' ]! l
Method 077 x u3 `8 \% _5 k
=========
2 Q% p" }8 T" e1 q) R* x7 i/ W' n1 ]+ Z- R4 ^
Method of detection of the WinICE handler in the int68h (V86), i- ]) F# q# S
9 C- x* J t0 d" P3 q
mov ah,43h
. q' Y% ~' S# Y* Z1 L6 b int 68h
% T7 U: b( l+ x% O* X# I$ |* h: z @ cmp ax,0F386h0 i. O% s! r( z
jz SoftICE_Detected
2 z3 O/ R' y2 f4 R/ r
2 A* {, f- f; _$ y4 Y3 ]8 M3 ^$ `) e* J9 P+ c. v$ p5 L
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
9 z* [0 {* t2 X) `( _ P3 h app like this:
0 M; R, K" z& Y, m1 F6 j
0 N. A. M( E8 w. X BPX exec_int if ax==68% u# P& ?& T8 d- W) C0 f
(function called is located at byte ptr [ebp+1Dh] and client eip is
4 Y1 r D. y5 y( D6 [ located at [ebp+48h] for 32Bit apps)
0 D+ u A o! `. K) F$ T2 Q! K/ t__________________________________________________________________________1 |+ D6 P7 u' P3 d* E& }/ ^
8 t: H' `9 R9 ?* r K
4 h' S- V' G9 ^% Q+ h. m
Method 08: m" a0 b) G: P
=========- K1 ~5 x+ o. @! D3 s" t$ t
0 N# }" E: n3 p/ K2 o1 E6 Q
It is not a method of detection of SoftICE but a possibility to crash the- e; _; C6 e4 [8 b
system by intercepting int 01h and int 03h and redirecting them to another
; y$ c8 ]$ ^) |+ {6 m) broutine.
" T9 H: ^, @' O. T/ uIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points( v- ?% z0 O( B% \# N
to the new routine to execute (hangs computer...)
* K$ A( w8 F, Y P' S. q
3 i2 T, B0 ], X! ~5 u& |) Q mov ah, 25h$ F: i1 _3 ]! s& U% l9 n" p
mov al, Int_Number (01h or 03h)* g2 |# q. R1 U) \* O5 S+ ]& F2 e9 H
mov dx, offset New_Int_Routine6 D* a7 e l5 Q, v* a; k9 s
int 21h
" X4 e ]% k0 K2 ~' g: J& ^, j
1 j \" t. w1 R# B! D__________________________________________________________________________3 Z e5 M7 k9 B& ]' L, O7 c
# J( `4 _+ ^) Y# t/ e) n0 N' O
Method 093 z- A; C3 z. ]9 A9 O3 k
=========
- l$ Z G9 C3 P/ F2 p; _( H% I2 `. u' |( r. _8 L
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only8 i9 O. J1 m) Y j0 l) L9 v
performed in ring0 (VxD or a ring3 app using the VxdCall).1 M" W, D/ ?( C: z6 z, S
The Get_DDB service is used to determine whether or not a VxD is installed
}0 X4 j' D0 u. Lfor the specified device and returns a Device Description Block (in ecx) for
% y6 s! q0 ^2 @* R- w& j) O! Xthat device if it is installed.6 W+ u( A3 q( x, w* e, e# k
& W" D' R1 k1 Z mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
! w' R2 m6 W( f2 u. T' C mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
! ]4 v: i# W) m( g VMMCall Get_DDB& O; \ A3 p/ B: I% y% c5 \9 ~
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
* Y+ I. _0 C3 D- Y8 c0 b! t
9 R! U' O- w& i- ~8 S+ V$ GNote as well that you can easily detect this method with SoftICE:
& k' R. e* a# }9 `/ @) f3 X$ u: j bpx Get_DDB if ax==0202 || ax==7a5fh
& ^! x/ S& _/ i0 N! Z
* C# O- ^! `/ p; r& Q& o0 M9 o__________________________________________________________________________
+ N n+ w9 |2 a/ ~
' T. v2 Z9 x1 f% RMethod 10. ^5 ? c8 Q& U
=========5 t' H/ z, I" p4 f; P9 I
' J$ c# d S9 w6 N* X=>Disable or clear breakpoints before using this feature. DO NOT trace with: L' H% V* z9 y# i# n& I
SoftICE while the option is enable!!4 N; v' M# k' m v4 t" A
8 u( U! _0 _0 _. l
This trick is very efficient:
/ A! Y& a: s# L$ Zby checking the Debug Registers, you can detect if SoftICE is loaded
, ~2 x3 _3 h: s(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
% L8 ?9 F5 v) ^ I! [& K: x7 Dthere are some memory breakpoints set (dr0 to dr3) simply by reading their0 L v: @1 H! l8 A6 j
value (in ring0 only). Values can be manipulated and or changed as well
; C0 r( b; E; S9 F' M' n& L+ m(clearing BPMs for instance)
3 A7 K2 J( q: u( b8 s
+ W2 ?' A2 g) h5 o: y__________________________________________________________________________5 I! E4 z; d) \+ r$ }6 n
! p2 `* j& a5 p0 t1 o4 f0 f
Method 11
# O8 k' [% J8 T=========8 {- p+ _+ c% y7 A5 Q
2 k& Z5 w2 C2 x: K3 t" m- W
This method is most known as 'MeltICE' because it has been freely distributed. |( s" y( b, O, P+ q. q
via www.winfiles.com. However it was first used by NuMega people to allow
/ Z+ M0 I8 h0 i! zSymbol Loader to check if SoftICE was active or not (the code is located4 c1 q6 c% w. t& _) _ E9 V
inside nmtrans.dll).
; J$ Z7 U! x) F- J1 u! g+ P4 O* N4 }6 D5 s+ h& ]# v
The way it works is very simple:. S( [' h& @/ _& z7 l; Z z
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
" h8 T7 Z5 a$ O, z; NWinNT) with the CreateFileA API.! A' b8 I' E. k* }6 W5 B9 Y( n
$ @; B+ b+ Y7 H9 I0 k* u M# ~Here is a sample (checking for 'SICE'):
1 S4 b+ S, I( ?- ~4 l/ C9 |6 ^: l8 h* `, i- _' x$ z
BOOL IsSoftIce95Loaded()1 ]- k+ X9 d5 [! A, n( }$ v
{8 s/ E5 a' U0 q; h, p0 g& u4 J3 s
HANDLE hFile; 4 x! `9 m* K5 q* Y: f( i
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
/ @* p/ U$ } A! X: ^; m FILE_SHARE_READ | FILE_SHARE_WRITE,
/ F% W% L( ~- a" Z NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
* h# E0 l) p5 o if( hFile != INVALID_HANDLE_VALUE )) d. z4 l2 ?( z0 t, q" R+ R* W5 v, Z
{
# K0 u! F( d$ A0 P$ H CloseHandle(hFile);
8 \) q5 U5 H$ h) V" J" l' X# ~ return TRUE;
2 @, t( F. d( Y; W$ R }
4 h6 f" c* ~- b return FALSE;( |% R2 I- s+ }! P
}8 Y7 o1 V6 c( V( [) p) z" i' q
5 [; K9 m8 w- y1 x' ?, e4 AAlthough this trick calls the CreateFileA function, don't even expect to be
$ p( i9 G6 R: W$ c' kable to intercept it by installing a IFS hook: it will not work, no way!
# U3 _( i8 t6 I# l) C% YIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
+ `' v0 V( @9 xservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
) ^( h+ P1 N& W0 }0 `/ h8 Aand then browse the DDB list until it find the VxD and its DDB_Control_Proc0 e7 C7 x4 B. C" Z% r" a) Z
field.6 a9 W$ ~* d& v* [; M
In fact, its purpose is not to load/unload VxDs but only to send a 1 F) |4 Y& ?: N1 t; R
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)/ O( |) Q' N, {8 C( H( O$ U0 B
to the VxD Control_Dispatch proc (how the hell a shareware soft could try5 u7 d' |$ h( n# J! x$ {
to load/unload a non-dynamically loadable driver such as SoftICE ;-).$ V; S4 O' J9 A& m Q
If the VxD is loaded, it will always clear eax and the Carry flag to allow
5 T! `$ D1 l$ R. ?% l% @ F: F+ aits handle to be opened and then, will be detected.
) F. s$ b# K5 e! C5 OYou can check that simply by hooking Winice.exe control proc entry point
# u0 x& e1 T& B* }* r2 Fwhile running MeltICE.
J* g' ~" h! ? v" W9 C1 d& M6 X+ T7 n5 P3 T
: l7 s' I1 D5 @- t5 t- I7 S e 00401067: push 00402025 ; \\.\SICE
- o4 v$ e' D1 K* y 0040106C: call CreateFileA
" ]* E( Z- }. i/ A* H 00401071: cmp eax,-001
1 ~# w6 n2 i9 U( V, ~- X 00401074: je 00401091& n% O2 F, X! N
; x/ ^5 y% w) c$ l7 e9 L
& c" l) {% H- _' u4 T3 N% T: L: C. uThere could be hundreds of BPX you could use to detect this trick.
9 C4 ^9 D- @1 a, B1 M3 |( i-The most classical one is:
; f! f2 J6 b' o' J; B/ p$ B% p BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||8 n" t+ z# ^# l8 V
*(esp->4+4)=='NTIC'
* k$ D- s3 I5 T, A, N B l/ g8 U8 a
-The most exotic ones (could be very slooooow :-(8 q, B2 {! \9 X: U, n: {. n' K. O
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') ; U$ G5 O$ f: A5 C G
;will break 3 times :-(
3 U8 r; |5 F; c: O5 m
, t" H. b8 |$ x$ g-or (a bit) faster: 4 e" E3 J2 a8 K5 H5 v
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')+ A0 Z2 h4 U/ |- K N5 K
- f2 s) D7 }9 M( f* Y: _- x BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' ' ^" I$ U( K5 ?; ~) S3 P
;will break 3 times :-(
9 p% f) f2 g- a2 m- f5 w$ |$ T- }" D0 F
-Much faster:. N- y+ a! K) r( {$ M4 |6 }
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'4 U: W, s$ {. ], f
/ ?: u/ b+ ?' F- v. i( SNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
4 M& G3 I% T9 q& m5 F9 ~3 pfunction to do the same job:
9 T, a4 \( g: s% W1 e0 W' g) r6 r' C' }9 I
push 00 ; OF_READ
( t( k8 a, t* z4 M mov eax,[00656634] ; '\\.\SICE',0
' c8 w5 p0 U y5 ? push eax
0 i, f4 v) s6 B+ y5 h call KERNEL32!_lopen1 z% E- p* X3 z/ P3 N
inc eax
1 c, [+ P" [4 F9 b& M jnz 00650589 ; detected+ }) I9 m# X6 y6 U) E4 u: V2 o
push 00 ; OF_READ
, W0 c/ N$ L' e" D& Z& v mov eax,[00656638] ; '\\.\SICE'' m: @8 W5 K9 m9 R/ B( N X" J9 ^
push eax
" o( I) b1 f! f call KERNEL32!_lopen
+ L6 D9 R1 v" o3 g$ T, S/ d inc eax: a0 p- k6 w1 O
jz 006505ae ; not detected
7 j& N: h# T) @: u" i* N1 o! I, J& `! \+ ]. F* s7 k
, s' Z) B. h* F' X8 ]5 j) B- `__________________________________________________________________________
b1 A3 T Q" o; `( f0 P+ m& ~9 f4 r; _& o9 Z
Method 12
! n; ^! R! c7 [0 ?, V=========
@8 ~" l" C2 n G5 S" a$ I, l, D( [0 N/ ~
This trick is similar to int41h/4fh Debugger installation check (code 05
. p0 q. y; F/ T! f4 R& 06) but very limited because it's only available for Win95/98 (not NT)7 C4 W& P0 B* f& M! t N% h$ b3 C
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.. b$ Z3 r9 z0 L0 T
0 X5 N; i7 F7 k- s* y push 0000004fh ; function 4fh8 T1 ?1 d7 X; R( F0 Q3 W& F
push 002a002ah ; high word specifies which VxD (VWIN32)) N( K s, E$ e# g
; low word specifies which service
, s3 U8 K( O: L3 E# n8 A. F7 Q: G H (VWIN32_Int41Dispatch)
f7 x" V2 L+ W3 H/ d6 I" F6 k( d call Kernel32!ORD_001 ; VxdCall# ?$ N5 z8 _+ E( @
cmp ax, 0f386h ; magic number returned by system debuggers j2 W. T( |% C5 f
jz SoftICE_detected- l" N; n K6 E& @
6 J7 U- }9 J. V$ X. Y" ^Here again, several ways to detect it:. G0 m4 P' ^" F. C2 n
& H7 e& t4 K7 s, W' [6 `
BPINT 41 if ax==4f | A# M0 S8 H' Q# _
' r! h# D5 n) U6 c/ k% K7 H0 O! b BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one, M1 J) }% _6 e! w3 W& ~4 A% R
/ D8 ~3 `; i4 b) I6 }. k BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
6 k4 i, j0 v; |; u8 n0 v3 U2 H3 p
, d; c0 B7 l( C8 R6 c BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!) [. k7 k" L7 B# V; l" R* \
6 D, u- {- l% I
__________________________________________________________________________
& }" Z! N) G- d, V+ G* K9 H k* C- b% |. g' P; j4 z1 ]( o; f" R! n
Method 13
% R( Q; B: n' C/ }9 j$ v=========4 m' ]& e% U! I9 C
9 A, |+ @9 | W: ?# V. A& R: K
Not a real method of detection, but a good way to know if SoftICE is
9 N( s- d9 l; linstalled on a computer and to locate its installation directory.
4 r# t0 v* K3 e( V& J+ C' C5 jIt is used by few softs which access the following registry keys (usually #2) :7 n- I P9 n( ?" e: |/ k9 ]
1 M, V$ V9 | F; K/ F
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion3 q1 E6 E3 ]% g1 L0 V
\Uninstall\SoftICE
* u$ x; g+ [1 t# f-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE% @9 S* C# s4 U; f3 W
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
$ X3 b4 X; Y; x8 W$ b\App Paths\Loader32.Exe/ t: }( O& g( ^+ J6 ?
. I: n: W' p+ m A, d h0 g- y2 Z3 r/ D/ b
Note that some nasty apps could then erase all files from SoftICE directory
. z' g Z6 c6 e: P8 `3 K(I faced that once :-(; d' l1 r* R/ f" Q5 {
) W" a/ D7 z" A5 O: B; o! hUseful breakpoint to detect it:
) H2 R3 P( {" v, Q8 Z1 `( s" m" g) o: V5 u3 X( F5 s- y
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'$ V# y* r, a. D2 l, J. |' v7 g
) V* I9 Y! [6 @" ?) `& u0 k' V$ s
__________________________________________________________________________
- s9 u6 X( s& i8 N7 ? W1 i3 a0 C @) `
1 I! d I. X* m- g1 o/ T8 p% k/ ~! F
Method 14 : |+ |- g3 [) _' p
=========
* u) l( ~1 r8 @% c- R/ ~; {: r
. G- {) O5 c0 RA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose3 q* {2 N& ]) Y8 j( P
is to determines whether a debugger is running on your system (ring0 only).
) p1 T# ^( k2 j- Y* p2 \0 K3 ]1 Q+ n; ]
VMMCall Test_Debug_Installed1 r( u+ z, V9 T' k2 I
je not_installed
# |# ~' B$ X7 G$ ]& b8 ^( L- R% J8 f- V5 k" Y; o- ?9 G
This service just checks a flag.
/ p6 c& m5 [% S% M3 e- ]</PRE></TD></TR></TBODY></TABLE> |