<TABLE width=500>0 @; m. [6 Z. W8 p8 Q
<TBODY>9 h- U+ F; m l
<TR>
9 C$ r3 m! Z! Q0 s<TD><PRE>Method 01
' _0 ?. o5 g0 _3 K4 d' Q/ G4 M% R0 l; O2 O=========$ p1 ~* \9 b8 z- G8 u7 m$ `
3 e& {: k0 l/ ]! B1 _& N7 y+ _: K
This method of detection of SoftICE (as well as the following one) is: A' M% g1 p+ w) D2 i) j
used by the majority of packers/encryptors found on Internet.
/ N2 h J6 z; f! |$ p8 M; @It seeks the signature of BoundsChecker in SoftICE
8 L& R& o7 D+ |/ |- _$ H- V- d' Q' u7 e* S1 m
mov ebp, 04243484Bh ; 'BCHK'1 q U/ v, d& G7 X
mov ax, 04h2 T3 [: t; Z# R: D% ^
int 3 - P& m% i8 O+ {: d
cmp al,42 ^' k3 {% w0 N8 O
jnz SoftICE_Detected9 A' \( N; Z, ~- {5 Q* A9 h7 L: W4 U
9 y& d1 j! p/ R- g3 H3 j$ X; F
___________________________________________________________________________3 K1 Q. R/ e/ o0 r0 R& b0 ~1 e% F0 a
1 `6 I0 r0 n9 w! F( m
Method 028 K3 g5 J: [# Z1 |
=========
, C! \6 r8 {9 u' ?
: u% V H8 F- ?1 G3 U4 c/ pStill a method very much used (perhaps the most frequent one). It is used
1 h3 V1 ]5 p! k) p! e Nto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
6 u: d) l9 _8 l; _ `; Ior execute SoftICE commands...8 S! s" k- g2 p
It is also used to crash SoftICE and to force it to execute any commands
; M$ [4 {2 s5 `& c _$ `' {(HBOOT...) :-(( ! M; P9 p, s7 e) h9 z% P
+ A4 y: h2 g$ K/ n0 V7 uHere is a quick description:
! J7 z _, @: F0 h) t# l, X5 d-AX = 0910h (Display string in SIce windows)
) P7 `4 |5 ^% H4 {( ?9 q: E" q; T-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
, Z2 `: A h7 }-AX = 0912h (Get breakpoint infos)& ?. q" m/ v# W) R. N
-AX = 0913h (Set Sice breakpoints)8 l: w. V9 @4 k; r6 g
-AX = 0914h (Remove SIce breakoints)
" b' Z8 V1 ~% l$ W: Q/ V. s Q( Y* D8 S( y% H5 e
Each time you'll meet this trick, you'll see:3 B! K' D- u& {6 f+ w
-SI = 4647h4 m/ h) `9 e% ^/ y" W4 |, m
-DI = 4A4Dh
* {0 U; ]& C* _Which are the 'magic values' used by SoftIce.
) e X1 r8 x7 ZFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
" w: f+ n+ N4 o/ w; n% ^1 w
% A1 \1 r2 {! l Z8 e8 D# sHere is one example from the file "Haspinst.exe" which is the dongle HASP
/ N2 J$ {! Z! \Envelope utility use to protect DOS applications:
/ s$ J( X b/ r- k
( Y% F: v4 P0 ?, ]7 l, m
5 _4 W0 }, P' N/ {3 L, ?4C19:0095 MOV AX,0911 ; execute command.
- ~9 J. m* u9 M" D+ j4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
7 B+ z5 A/ J, O1 X$ @0 W7 F4C19:009A MOV SI,4647 ; 1st magic value.- Y* c0 v# B1 p d
4C19:009D MOV DI,4A4D ; 2nd magic value.
$ [8 r. m0 z+ a6 E4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
5 q$ Y) E7 K- d& p5 a4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute( Q; I, _/ ^( v# X4 s
4C19:00A4 INC CX4 k0 W* y9 e& H
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute2 g& y& [2 ]" s( F4 W& ^
4C19:00A8 JB 0095 ; 6 different commands.
7 c h& ?9 B8 g* R1 M1 _' x$ V4C19:00AA JMP 0002 ; Bad_Guy jmp back.
& X' W. y+ R: b! |9 S% r8 I4C19:00AD MOV BX,SP ; Good_Guy go ahead :)/ t0 D3 l( W- I0 t
! w- G' C# i; j0 ]9 W2 ~6 Q) O
The program will execute 6 different SIce commands located at ds:dx, which) O& v0 \; }! `# F! R
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.; S7 _/ s7 Z- C* o+ Z0 r+ I# R
8 Y, T8 B8 k% d; S, u* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded." M& W7 S0 O7 Y/ @1 u9 n. `
___________________________________________________________________________4 Q1 @2 w8 V' B( K* C
" G8 z( g7 {& y3 y( o; L
2 b+ @& R L [# F+ @: e" z# q* uMethod 030 K& x7 k& K/ J, j
=========
: m4 X( o: x! }2 ~7 I; P% _0 W
1 u( B) `% I4 \3 YLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h3 l4 U) \5 E( [) U( v
(API Get entry point)- b& g/ s2 t0 c# q
/ ^, I X I* K) \! J: X" K+ B9 t0 p, P! K6 X4 ?$ G- {
xor di,di
, ]- o* I" O) I2 G4 `* v/ p mov es,di
7 c/ j. N; R0 B, {9 C# ? mov ax, 1684h " p! a% P% c/ f9 I; _
mov bx, 0202h ; VxD ID of winice+ W- G0 F V6 q1 H1 a9 g, Z
int 2Fh2 M9 c3 f- }' }- q
mov ax, es ; ES:DI -> VxD API entry point! e% e% T1 g2 W
add ax, di
: ?8 f* Q# o6 d5 M7 n test ax,ax2 k/ c" I" |; y: o# s
jnz SoftICE_Detected
7 ~2 ~+ R& o" |9 ?- _$ w/ K; y
) m# Q% C m, F___________________________________________________________________________
1 t% z: Y0 R8 \
. w7 Q x5 z; { GMethod 04( G* n. I9 u9 |& F) x
=========
# \. d0 M( u: s+ u' f( ]8 A' d0 l( y: I9 E# B; s4 U
Method identical to the preceding one except that it seeks the ID of SoftICE
4 G% R T( i& a$ I" I* o4 I! O rGFX VxD.
+ [/ f5 \3 D% X$ l. I7 z4 `: }4 p# o4 ~" w ?7 u& n
xor di,di, H4 x6 d) i/ a r. L
mov es,di" r7 Y/ p% Y- ^! X1 H
mov ax, 1684h , z. o+ m/ `' B* |% A: P
mov bx, 7a5Fh ; VxD ID of SIWVID# L& _3 ^# k) [7 H' a
int 2fh4 B0 P4 @( M7 `$ ~" S8 e0 ?4 R
mov ax, es ; ES:DI -> VxD API entry point
# e( j# ?3 m* z5 A add ax, di0 ^5 c5 z1 C/ a( Z
test ax,ax
( _0 a/ c5 _( R0 P7 {. b6 \, z6 n jnz SoftICE_Detected
; ]0 l2 q- P5 M0 V5 I
/ g6 z! o; k7 `8 `2 M7 u- S__________________________________________________________________________
* r3 U2 u) ^. i0 M
9 H5 F0 k- v8 |9 p% y7 ~7 O6 L0 v( s" l! W" _4 I$ v ]9 K
Method 05
& B8 Y1 Q9 I* m- [8 n' N9 j2 M" i=========
+ c d+ O; A: h3 O- M# V; c6 Q3 l# M6 L% R% s* C. |) H
Method seeking the 'magic number' 0F386h returned (in ax) by all system
$ S7 W, @. R( gdebugger. It calls the int 41h, function 4Fh.
+ x6 F! P, v6 f9 g& _( hThere are several alternatives. ) D; e( Z- |! _+ _4 U1 J) r# m( Z
' O/ H" ` _" H3 IThe following one is the simplest:# @* \; Q1 H4 }3 Q# r; B# v2 ?
* g, |# q1 U* u% z2 U/ p2 e mov ax,4fh( _! m# [5 r r' `; k
int 41h3 ~' }. O1 h2 ?
cmp ax, 0F3862 m- R f+ V) ?. \4 e
jz SoftICE_detected" s1 C7 X# Z" m% c
% G9 Q& s1 T) t; @0 O
2 w+ M: O8 S- i2 m: p' f, n
Next method as well as the following one are 2 examples from Stone's 6 x$ {: } M8 `$ W" c
"stn-wid.zip" (www.cracking.net):6 M! T* x* M4 Y
' O- ?1 }( F& i9 ^ mov bx, cs3 I, g7 K9 b. `# H P' H0 Z9 y3 v# o- U
lea dx, int41handler2$ S! O1 T% i+ ]
xchg dx, es:[41h*4]2 i5 s2 H, g$ r u
xchg bx, es:[41h*4+2]
( |* j9 D( @# I! e7 k$ s ` mov ax,4fh7 r2 E8 [* G: B7 l8 @2 B
int 41h' r& d: y* D0 c/ ^6 o
xchg dx, es:[41h*4]' t7 \! p' p% ^1 K
xchg bx, es:[41h*4+2]) c2 s5 t) w- V0 u/ k6 d2 n( K' s
cmp ax, 0f386h
5 s4 z2 Q% C* @# k9 B jz SoftICE_detected
! R% X3 g5 m+ B
* W5 ` k0 n, B- `: Kint41handler2 PROC4 m1 ?5 L" X3 G$ g: J) _3 f5 ^
iret& p* r3 t# G" Y+ A: u
int41handler2 ENDP, ~' ]/ T5 m$ `( `" D$ G
7 k, a& G( x3 m( ?& }( K" Q! x
% o n! B _# C a8 |_________________________________________________________________________
' `" s7 U5 o7 I: I4 Y3 l% \1 Q/ Z
# B( s9 _1 |; z- p8 l' B O4 b: ^
' ?" u( ~# Z0 E- _, F0 g2 PMethod 06" R3 I1 ` K2 H1 m6 z% O6 j b
=========
0 t$ b$ f3 b0 r' {4 q: |9 C8 j) \
/ D1 }9 p F% e! F4 A) p$ @& K
2nd method similar to the preceding one but more difficult to detect:
! h( \" Y1 A$ w4 k2 \$ {! i
$ [+ O9 y. }% z; B" V, q
$ P: o4 e4 O2 P: @8 E+ ^- tint41handler PROC2 r" K& H6 H" G* G* E
mov cl,al
! S5 X+ w% v! l) z! d# { iret- [% o& C4 |/ ] j3 |6 ]5 E
int41handler ENDP
1 I. q: K3 N; x% r& X- I/ h2 U
- a$ S% [$ A4 c- i
% X2 o# C) J- v% B: ` xor ax,ax2 |& P5 K$ V( y5 M' ?# C4 I
mov es,ax
$ O( \; W& [6 A* O mov bx, cs4 L6 k* D V* R: P9 b, g6 {
lea dx, int41handler
: g& F+ A6 l) ^/ p& ] xchg dx, es:[41h*4]) w" B+ j$ K2 v; J: B( ~. ^
xchg bx, es:[41h*4+2]" r: z7 i+ [' I
in al, 40h
- \& H% X% v, k) N! _ xor cx,cx
2 A* t' ]. H( ~( ] int 41h
6 A0 |: b* g2 [+ a xchg dx, es:[41h*4]: e# m# }6 A# |5 S( p
xchg bx, es:[41h*4+2]
. e. t8 t9 i* i) H4 e4 s2 V cmp cl,al
' @+ K5 ~* \, w0 p' e6 Q/ Y5 r5 U0 a jnz SoftICE_detected
$ ?! h i0 r0 J' B% [
0 f0 W2 k6 g% {2 M% q0 ]! |# d_________________________________________________________________________/ |, B7 G I' R( F* ]
) \1 w# k8 M7 K, i5 \* @. O1 Y$ w
Method 07/ s) M9 @$ T" s7 N r* }4 e
=========
6 h$ E, T( |9 k3 N9 l2 z! m W O# ~7 V" u' l
Method of detection of the WinICE handler in the int68h (V86)
% O1 ~6 s" _; v; b/ O/ f2 q N5 a/ e) _5 P/ u+ k
mov ah,43h
, Z9 e1 C: H, R. \. }. \' V \+ R int 68h1 k4 d) Q( t1 \2 `0 g4 @4 H* L0 F
cmp ax,0F386h/ |: D4 v; S) t! f
jz SoftICE_Detected
9 {( {4 H1 L ^7 r8 W, I. x4 {
( l( h8 }! q! l. q) e. g
# }8 \ c3 k; p [=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit g0 V i- \- E0 l
app like this:
! {) r% R k0 E* Q& k, k5 f5 y% T& V3 H, _
BPX exec_int if ax==68
$ ~5 Z- ^" ]+ K% @9 z7 [( y (function called is located at byte ptr [ebp+1Dh] and client eip is
* i9 _" W, U/ i E located at [ebp+48h] for 32Bit apps)7 ]3 p" b6 A4 u) K9 e& Y- A
__________________________________________________________________________
6 C/ M* M! `5 t* V) F
2 ^9 u. [+ N7 H1 o9 ?6 R' y" h' g
Method 08$ b U1 N b9 p$ U/ b/ X2 ]4 t
=========
4 O. A; `+ d3 h8 c6 V+ M: E( m( i/ Q+ R" T* h
It is not a method of detection of SoftICE but a possibility to crash the6 m7 ]! B. K+ l
system by intercepting int 01h and int 03h and redirecting them to another
* ^5 F) `, b; R* qroutine.
; I- k6 w. L2 R+ I" {% aIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points5 d# D5 J% Z& z7 J5 p
to the new routine to execute (hangs computer...)
( d0 E: [6 b& Z V7 }4 t* J1 e
8 h- c" x: s4 V2 P1 x8 z mov ah, 25h9 x0 k& u' Y( Y& f k
mov al, Int_Number (01h or 03h); {# z9 x8 R H2 w: l5 p
mov dx, offset New_Int_Routine
1 N, L' R2 }! q int 21h
0 E4 F, V8 h) x; `% {2 _
& z0 L3 {, D, V3 u$ \+ r__________________________________________________________________________
% F3 l: Z% p2 D: L$ {+ R6 w" R9 i- x+ }$ e$ k
Method 09% A, c/ E' \ u$ z& h* \( j
=========
: x' o) F% W8 b5 `. l' C# [3 N2 l5 Q, a( \# W0 E
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
' z& q! C) E" L0 R$ j% k0 M8 Pperformed in ring0 (VxD or a ring3 app using the VxdCall).2 d/ E& d: k) T3 s6 B1 w5 F
The Get_DDB service is used to determine whether or not a VxD is installed4 [1 `/ j% b3 j1 ^# I. y, y
for the specified device and returns a Device Description Block (in ecx) for
, T5 n0 G8 U- kthat device if it is installed.% @3 p' h# w& T- ]# A( O4 G
4 s3 j' O, z! m) w/ ^# l. Q) E mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID& t& E2 u/ x" k; q9 b: i6 M/ \: W
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
$ X+ } c& v) p VMMCall Get_DDB. M( \' R* j7 B! X
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
# |+ l! e* D* x
; G3 ~0 ?% @+ A. f' R+ z% JNote as well that you can easily detect this method with SoftICE:" d3 X6 S$ R- |/ G& q9 k
bpx Get_DDB if ax==0202 || ax==7a5fh
/ |6 G4 U: D7 K! a( N$ N2 ^6 c9 B9 Z g
__________________________________________________________________________4 Q7 j+ ?8 L! {# Q( V
- {. j" i {- _: R5 r. ~
Method 101 _) Y% _: J7 T; x
=========& H5 {/ m$ a, X: l- G8 X' s
5 I! M4 m' J3 A=>Disable or clear breakpoints before using this feature. DO NOT trace with( k, g$ [5 S3 A( U
SoftICE while the option is enable!!/ [# {( _& S; K/ D4 a* l! ]
% @2 n: v, e; b7 i- r W$ y4 O
This trick is very efficient:
1 F8 x) C3 b4 C9 c6 s9 @by checking the Debug Registers, you can detect if SoftICE is loaded
! I O5 k+ Z. w/ t3 S- O(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if& K) ?1 E! w+ n" M; \7 ?
there are some memory breakpoints set (dr0 to dr3) simply by reading their( e- n* @1 R& R! P, ]
value (in ring0 only). Values can be manipulated and or changed as well) C) d- U# N3 |6 ^
(clearing BPMs for instance)$ _% x" p) U# p+ }6 Q
: w/ E$ P# ^8 L0 g% |+ K: n
__________________________________________________________________________0 D: _& i/ @+ [7 u( \4 E$ d
) i5 s$ f3 B% [9 M+ L1 V
Method 11
2 k2 a$ A: m' |7 `8 o4 q=========
( S8 R4 j3 L) `3 J! `' K/ K' K5 \) C9 [" O$ \5 E& H6 L7 g
This method is most known as 'MeltICE' because it has been freely distributed" M, l/ ]2 F6 Q' g$ y
via www.winfiles.com. However it was first used by NuMega people to allow
4 O+ W; S7 _: ?Symbol Loader to check if SoftICE was active or not (the code is located+ T5 T3 k* K, U, S5 _% Q7 m
inside nmtrans.dll).8 S" N' r$ N) p% s3 |
8 z9 n( H& u% o" z+ D* }2 qThe way it works is very simple:+ E% B8 F6 U! j1 c
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for& `0 }: V+ ]: `" c
WinNT) with the CreateFileA API.! p6 I7 ]: ^/ y0 g3 o! ^/ c5 k
3 i- R c6 S! v" r
Here is a sample (checking for 'SICE'):
/ ~/ ^: y8 d2 O% E2 C
+ k; u& C' B' ]% eBOOL IsSoftIce95Loaded()
% s. z7 o2 z( a3 u! F{7 J' \- P( j' \0 q# b) U7 \1 ]8 K# U: K
HANDLE hFile; ) I, V$ h U+ \+ [. o6 H
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,. m+ u1 Y/ l* @
FILE_SHARE_READ | FILE_SHARE_WRITE,
- z- s0 b8 Z1 I$ @/ Q/ s* s% j NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
% F+ l* @7 `5 Z3 D0 M4 Y6 n* a& o if( hFile != INVALID_HANDLE_VALUE )
! }# g9 x: T: T; Q9 b& u1 m: u {2 L, f } E: x. s6 l
CloseHandle(hFile);
) |" K% `% C/ g# j return TRUE;
) C. K: n2 e* \, X1 a. c- ` }
' t: P8 x! v: G8 c( g; B return FALSE;1 U2 y+ |9 a& b4 ?! ]: Z9 R8 ]! {4 _
}+ d! z( _- S9 e
) D: N; h0 O" a& LAlthough this trick calls the CreateFileA function, don't even expect to be+ j" Q3 Z1 V6 X" k6 ?+ n( l
able to intercept it by installing a IFS hook: it will not work, no way!' o* E, o, D3 ], L4 F
In fact, after the call to CreateFileA it will get through VWIN32 0x001F- q; x j5 {5 E; F( Z
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
. u1 _* `4 u. }- p, y% ^and then browse the DDB list until it find the VxD and its DDB_Control_Proc
2 G3 h7 i" L$ vfield./ X9 M8 g+ t8 I) b# D
In fact, its purpose is not to load/unload VxDs but only to send a $ M D+ R7 o4 Q% a5 F! ]. v" Y
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
9 T% ?3 k/ m& C& n) P: ^to the VxD Control_Dispatch proc (how the hell a shareware soft could try
/ g( J6 f' y6 O5 F9 }" Dto load/unload a non-dynamically loadable driver such as SoftICE ;-).
( ]9 ~' R3 D, V: f8 g7 ?5 XIf the VxD is loaded, it will always clear eax and the Carry flag to allow1 t7 E& b3 ~4 y( f
its handle to be opened and then, will be detected.
8 d4 O4 u$ D% z V; {You can check that simply by hooking Winice.exe control proc entry point
Z" ^% p; e4 F+ B3 Uwhile running MeltICE.
8 z3 W0 _% G5 o, L& R
* V! w) S5 h4 f
7 {6 Y; R& ], W( k* Y" O# K 00401067: push 00402025 ; \\.\SICE
0 x0 ]5 j6 ^* ^* i, y' ~! f$ ` 0040106C: call CreateFileA
4 f- V, q+ Q' X' N' e 00401071: cmp eax,-001: V1 p8 I% g/ R" G! p0 x* w
00401074: je 004010911 O, t- t3 ~7 U' R. a
. |3 a `8 u6 m7 o" L* H
2 p" I, D8 Z/ l! Z+ U" OThere could be hundreds of BPX you could use to detect this trick.1 j2 w$ N) x2 j7 M: [: _" U
-The most classical one is:
- \8 q$ j' Q" B& c BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
% `8 Z. _/ y8 z% h2 B *(esp->4+4)=='NTIC'$ q: I2 B& h( q) f: l
/ t4 }# W4 V+ S: D+ w9 Z; n) \* ?( N
-The most exotic ones (could be very slooooow :-(
4 B9 z+ n, w0 _/ _5 } BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') 8 M3 t4 P( N+ J' z0 K9 L" P
;will break 3 times :-(
$ X1 {/ I( k2 [7 g; o' k6 U- `
% N' r( y" O4 Q1 l- j0 P5 P( a-or (a bit) faster:
- \- h# a x# g6 |$ i/ N* g, Q5 Y h7 I- U BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
. n7 W& Y) y { v9 E+ |( r% t" Y5 T
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
) A: e( A1 f' ?7 r6 F8 k ;will break 3 times :-(* o8 F) G8 R) T4 G! ]- v. b4 i
) ~% V* X6 o3 B+ }: A% K; h-Much faster:
5 l8 u9 D/ p* O- |7 q+ b+ K6 Z/ G BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'2 }' [- |% w+ [; `& a" q6 S
5 ^- z& U' D- y( b" ?Note also that some programs (like AZPR3.00) use de old 16-bit _lopen5 k7 t9 x0 g; T9 |3 Q: m
function to do the same job: O: m$ S5 O0 S) [" \1 g) v
/ A8 d8 N9 }. x
push 00 ; OF_READ+ N9 O( P5 o1 x
mov eax,[00656634] ; '\\.\SICE',0
8 F$ z$ @) d6 ~# [) {% T push eax
1 p+ ]# G4 O/ S: T N7 r call KERNEL32!_lopen! l. W: B h2 v* V; s9 h1 o3 H
inc eax& R8 H" R1 ]2 D' f9 n8 E: W
jnz 00650589 ; detected
; S2 u$ P w5 n! }4 W! e& s push 00 ; OF_READ
7 p) x% I+ E9 \: t+ N5 D mov eax,[00656638] ; '\\.\SICE'
! S- N8 @3 A' Y. q6 _# J9 a push eax
/ R, ^1 o, j# I6 @, h$ n call KERNEL32!_lopen- r2 e+ _* x$ _; G, q
inc eax
8 {2 H$ w: ]! L! F, N jz 006505ae ; not detected
/ a0 l1 g/ P( O8 o5 ^. }+ c3 z b3 N& L7 T1 z0 T z
2 s1 ]0 I1 |6 \3 h0 p4 `__________________________________________________________________________9 W+ O" i, b* ?& j. `2 F
9 u& c0 i x6 }4 ]& r hMethod 126 Q/ @- e- |: T5 t, x1 ^
=========
% }; H) A- R/ i+ I1 H, J# O- x8 D3 ?
This trick is similar to int41h/4fh Debugger installation check (code 05
8 c5 k; n+ U& r. R2 j& 06) but very limited because it's only available for Win95/98 (not NT)
4 G/ y) j0 H6 A) }6 h3 Kas it uses the VxDCall backdoor. This detection was found in Bleem Demo.' e. V2 u9 K$ l7 N
( n- e8 Y7 @; H2 i7 f" x* R6 b push 0000004fh ; function 4fh
8 T+ ]+ p$ r: m2 S" P& k push 002a002ah ; high word specifies which VxD (VWIN32) w' c: t$ d6 B& B3 p
; low word specifies which service5 |1 h- h* c. s
(VWIN32_Int41Dispatch). `0 \% g/ o6 ]9 V
call Kernel32!ORD_001 ; VxdCall, a- R8 j& Y( [$ [: I* Q
cmp ax, 0f386h ; magic number returned by system debuggers; {0 u5 V/ ?: [: n
jz SoftICE_detected
" M2 b" P$ `* S
( A/ ^, Z9 h. l' ^8 M; ~4 PHere again, several ways to detect it:
8 I8 V+ `1 E+ a( u( q4 Y8 }# E0 ]( }# z9 f& U% [% Z# f5 C4 }; r
BPINT 41 if ax==4f
6 e s# A" [/ s; C7 ]3 I% D4 B4 P( [% V% q
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one. s& [0 \7 [% S. Z" Y" n
. X/ e& T1 T" v, N$ c
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A0 J( u( K: ]5 {7 y% N. K
: m# F* s# l; n" v BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!$ t+ Z4 q7 A: E7 h2 `( v9 q* S
4 Z) {2 ^3 H" U8 l! O" m/ Y__________________________________________________________________________4 C8 i6 ?6 }: F' C& o
% n/ \, C$ X0 S# [
Method 134 Q3 b# Q& ~, V3 E: ~+ s
=========
8 c$ V, M& L4 g3 i/ w% i3 {, l% _! A2 @1 ^
Not a real method of detection, but a good way to know if SoftICE is+ @( K J/ K x* |
installed on a computer and to locate its installation directory.) b2 O1 a( ^3 h, I. t
It is used by few softs which access the following registry keys (usually #2) :$ ?6 k" A0 m' B( g/ v
5 i: R; L) B1 b( I6 B' J% O-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
" x! k* e K) X, L! g2 X7 k\Uninstall\SoftICE
y2 Z+ m( T' e7 g-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE* [& n2 `6 [! u% @, k& n
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
7 @! L( I: b# a7 S m" ]\App Paths\Loader32.Exe
7 u: C: H# g8 o% _: O2 E/ r
8 L- i- v" \: t
8 J. u+ x Y4 w6 g4 L. p# }Note that some nasty apps could then erase all files from SoftICE directory
. }; n% @% P; l7 y# w(I faced that once :-(
+ ?# ^6 u8 K' G o) t2 L/ w
0 T5 g6 }! s0 T5 j8 P3 r8 O; D& B, @) UUseful breakpoint to detect it:8 L7 o& _, a! n3 ]
; \' A& y4 \' t7 ~: F8 k
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
- F0 H, m, x% W5 I- K0 B" i5 Y8 t9 |; {$ u2 G8 m1 E [ E' l1 H
__________________________________________________________________________
& H+ h5 h8 U* z5 Q- k. ?
! F9 ^ V @) F* X! v7 c2 }# B0 R9 G
Method 14
% _ X/ {; u' T! m2 }=========# x8 F/ I( o: Q* g! `7 O* z
; L+ t; R* h5 Q7 e0 F" M, h
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
* B7 C( x% F+ N+ Tis to determines whether a debugger is running on your system (ring0 only).
# m2 T% g! r! S* g4 G+ m; V; D* l0 h I. P+ Y
VMMCall Test_Debug_Installed) q+ O7 L, b# s2 M3 m5 Z3 t
je not_installed, K2 h9 ]. N4 f4 o0 u! l
/ ~# ?, C( l1 m! m8 }1 ~1 X
This service just checks a flag.1 w$ h* i! p- R: r6 F/ I% g6 W
</PRE></TD></TR></TBODY></TABLE> |