<TABLE width=500>; q/ }/ w( J% E% p
<TBODY>
6 F8 E# Y/ f9 y0 @<TR>
. ?! K" P; b' X+ j) K [4 s<TD><PRE>Method 01
# i( _4 S/ ]" g=========
/ k& w* y: V0 I
1 G! T. r" g! F- O7 s+ v, A) h8 xThis method of detection of SoftICE (as well as the following one) is; ]. p( R) F' g; I# Z. `: F
used by the majority of packers/encryptors found on Internet.. I" s m5 z R4 @/ N: o
It seeks the signature of BoundsChecker in SoftICE
, _4 p& ]8 O" G, t \
( r( s& t4 T. S mov ebp, 04243484Bh ; 'BCHK': N8 {6 D: B Z+ z+ g. T6 {, ]
mov ax, 04h
, r) H/ C6 Z* o8 @. K- i int 3
0 S0 D: X1 ?+ c& X; Y1 e+ h cmp al,4
* r( a2 S0 \2 u1 { jnz SoftICE_Detected
1 C/ _, l: O6 t; F+ w8 z8 E5 B+ Q0 V# k+ f. Y; F% d
___________________________________________________________________________2 D* u* S' v, |5 c
+ ^7 J" {( O; J2 d# R* c9 C
Method 02
# A5 F$ ^$ V5 U5 u9 A9 L2 W% z# e+ n=========
1 Q- G# ?! S W& b
5 h7 ^3 i2 y6 N+ E/ gStill a method very much used (perhaps the most frequent one). It is used
+ c! t( R( s0 R& W: ]: ?to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
1 z3 M; Z, V1 ior execute SoftICE commands...
! m% J: ]( s4 P/ F4 n5 bIt is also used to crash SoftICE and to force it to execute any commands7 m5 h' n+ I4 {! q3 x% N" Q
(HBOOT...) :-((
! o/ e7 ]5 v, _5 h, l
/ }* x% z, g3 F: w( h* WHere is a quick description:7 b/ {8 u4 R( O3 ] w/ y
-AX = 0910h (Display string in SIce windows)
* @. H4 }; p1 L3 b-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)+ J" j/ {& Q2 Z3 k! z+ @
-AX = 0912h (Get breakpoint infos)1 q. `4 F0 J1 y5 Z: M2 g
-AX = 0913h (Set Sice breakpoints)
: n7 X( F1 g: y% C i-AX = 0914h (Remove SIce breakoints)
3 b4 _& E p5 ` a. ]7 J! X6 X# O3 [2 V
Each time you'll meet this trick, you'll see:# w) k% L& Z) H }. S3 r
-SI = 4647h
' x6 `& i( E: L+ T-DI = 4A4Dh
5 }' M6 E, D/ ^6 l- }4 fWhich are the 'magic values' used by SoftIce.
5 V' H8 H' l/ Z- {; }For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
2 C3 ?4 [* `) x
$ o) P' L$ q8 dHere is one example from the file "Haspinst.exe" which is the dongle HASP
. `' f3 p' |! B3 X+ yEnvelope utility use to protect DOS applications:
( P$ k; w2 `7 m9 F. G
- z3 Y# a4 V7 s4 _+ P" v4 c' v& u" |6 a- P7 j
4C19:0095 MOV AX,0911 ; execute command.3 O0 T( w: d Y3 z$ S- H3 k
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
+ P& X# [# b6 y* Z4C19:009A MOV SI,4647 ; 1st magic value.
9 p1 Q* _; M3 m7 `' |4C19:009D MOV DI,4A4D ; 2nd magic value.% o4 N3 S0 [1 ]* M+ @( c& y2 S& O+ X
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)$ Y& e! |9 `* r8 v9 @; F
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute7 w! H3 {! P3 u+ U
4C19:00A4 INC CX! F9 P' p* u8 U( e7 g: ?- ]
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
3 G2 ]8 s. r! E \5 o) H3 c9 Z, w6 i/ y+ i4C19:00A8 JB 0095 ; 6 different commands.3 y) Q4 M, s ^$ r* j
4C19:00AA JMP 0002 ; Bad_Guy jmp back.) f% Q1 ~' q& W/ Y, w
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
$ p: `: t; L; i, v: y/ h/ f9 c) e! i/ Z) K! ?9 G9 C) l
The program will execute 6 different SIce commands located at ds:dx, which
6 {4 g8 Z% I& care: LDT, IDT, GDT, TSS, RS, and ...HBOOT.& Y3 ?" H/ O" _0 X& v: Q
! `* F3 H; [" B/ l' N+ {* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
" k& U0 c4 Z" ~ l___________________________________________________________________________
. U' v6 t2 m' N! D( _+ d* s+ L' d) U, I! m
0 B/ U9 D+ C o8 oMethod 030 ~# e. ]' b3 S, _1 v) Q6 ?9 f9 x
=========
7 B- U$ H& k& N( H6 m T
" Z( O8 s! y5 }0 K" c2 C) ILess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
& I8 y% J3 q& l: ](API Get entry point)) F. C' j8 @$ R, h
0 |7 L( H* _( Q5 d' g' v3 p# `( S a
* |+ K' z# W: m& X( g
xor di,di v4 L/ ~, V ]$ ]6 G
mov es,di! H& a8 B5 f# Q9 u/ D" _
mov ax, 1684h 7 _" S }( |" R3 k. c3 f& I, E1 T. R
mov bx, 0202h ; VxD ID of winice
8 N6 B4 e) l9 Z. K0 {3 q; h int 2Fh
, W* j+ P0 X: M% Z: K) F mov ax, es ; ES:DI -> VxD API entry point; R) X! a+ \6 g! A4 i+ F- O" _0 O
add ax, di
0 O g0 T% h% t" Q test ax,ax# s; K3 t' B1 @
jnz SoftICE_Detected7 p3 }+ V7 }& w5 p$ l6 ~
: \- F7 Z6 M. j4 U8 p% m! ^___________________________________________________________________________
6 Q0 T: C" c+ {, L+ M. h9 }+ F
# U: a; I, a, u) Z" ^Method 04
2 K8 U; M& v2 ^1 a5 u# z) u% f=========& K( _% M$ d) w$ X9 }+ f
" I4 c2 h" ?* O2 S+ e
Method identical to the preceding one except that it seeks the ID of SoftICE
: ]- w9 `8 `; d, K% ~# }GFX VxD.
: k2 u$ l" v- T) Y8 N( E1 O- l1 Q
xor di,di! Y- b5 L5 d9 E. N8 B1 V% U7 X: p4 P
mov es,di9 D# j1 K- u3 A% j' o
mov ax, 1684h
/ S9 C# `% d1 N q mov bx, 7a5Fh ; VxD ID of SIWVID- f6 W5 p: ?) Q( ]
int 2fh
1 O9 P* G& p7 k' _ mov ax, es ; ES:DI -> VxD API entry point4 X% _4 b8 O$ G2 ^8 L$ x
add ax, di4 p/ K e# I/ M8 K
test ax,ax% ^- |# p4 E$ }; M+ ]1 ^
jnz SoftICE_Detected5 |8 a$ r% N" L6 E
& m4 e' m/ V# ?' Z__________________________________________________________________________) O& r) V. w- u5 s4 x% A8 V" F
$ ~! N7 T% C9 I7 L( T: u' w/ A: S b/ U
Method 05
3 J! ? `# l! F# H=========5 m" W& I, p6 ^$ q Y/ P0 l
3 F* W9 y0 _, o
Method seeking the 'magic number' 0F386h returned (in ax) by all system
% _2 f5 B- i7 _0 b4 Y8 ?9 s jdebugger. It calls the int 41h, function 4Fh./ c7 f. r g- \
There are several alternatives. 3 J5 O d1 R# [1 l! C& ?5 ~
( z8 h( k% ?' UThe following one is the simplest:
' O" F. D2 E4 G' C
' t4 v; D M) \1 k& ^ mov ax,4fh
* C% y. N9 `) y) a+ z; K int 41h8 N* P8 U& u( j
cmp ax, 0F386
: R1 X2 O& A* A* W u/ i jz SoftICE_detected
9 f, x0 t3 r) A( r$ o8 }. c4 M' {" N3 @ V" l T
8 [. ?8 L5 L: B% Q9 S6 H' `8 ZNext method as well as the following one are 2 examples from Stone's
% Y3 H& ^8 }/ ?% D"stn-wid.zip" (www.cracking.net):7 v% b3 k0 z) `
+ I) M! V/ a! B7 ^, q; z6 g mov bx, cs
8 G, }# Z" B8 m* c- m' A, {) R lea dx, int41handler28 K3 p$ T& e# w$ [8 n
xchg dx, es:[41h*4]
- b1 I2 @) I5 c- N xchg bx, es:[41h*4+2]
% `. \9 y" D3 I: P3 l( w9 ? mov ax,4fh7 R8 v3 X4 w1 r/ s* \
int 41h1 s7 q5 \' e2 M1 w
xchg dx, es:[41h*4]6 v9 X! L# Q/ k
xchg bx, es:[41h*4+2]) Q" U. _0 Y* T3 ?& |3 R, X8 Z
cmp ax, 0f386h7 d3 X+ {+ V: I% E$ t C1 J
jz SoftICE_detected
* K( h3 F* V" U/ @9 v: W% x& s( f1 t8 B# h t+ N* H
int41handler2 PROC
. i h9 ?3 B$ y( b iret
" _) U" m* k$ x1 s; Aint41handler2 ENDP6 f& G5 S" v9 X, b, X/ t% H
+ [" k5 ` m: u l0 [( Z$ l
7 j) h) m! d1 N3 \( M_________________________________________________________________________ T, S; z# D( o- {% t/ v& E( b
9 K! |: ]; J6 y6 G1 W/ E$ w
# b0 u0 U# \- h# r N8 p9 ?Method 06% S% _- X8 `) `% V5 N' f
=========: a! \2 u3 r# D% ]
, I+ Z; T6 \8 p a6 m. h) [$ ^. s
2nd method similar to the preceding one but more difficult to detect:& v3 s! E& ~) L1 K
. x! a+ ^/ y- T' l; j9 z; |/ R
4 R5 ]& ]7 o' v( a) aint41handler PROC$ u3 {1 e; E! o, I( s- V
mov cl,al4 x5 g3 \5 i+ L, P) ]! K
iret
y( k* B0 T: }4 qint41handler ENDP
9 h4 b0 A" L" E; m+ S2 i+ I- L' m% q
9 ]9 p( j! i; h xor ax,ax
3 \$ |! s( x1 {6 r mov es,ax2 y' {' Z7 \8 Z) [
mov bx, cs# \! V: }) F/ F6 N; }
lea dx, int41handler
5 t$ t( M7 O% b( y xchg dx, es:[41h*4]& K# H6 T3 B; _/ e" G) w
xchg bx, es:[41h*4+2]
" @' ~9 t1 e g& n7 l6 n, J) _' U' U in al, 40h
7 x" q2 i5 }7 E! U8 K( } xor cx,cx& V6 i1 K! Q2 M- w0 ^! U( M
int 41h
+ i7 A$ t" ?: J$ \: t: k. s8 N. {5 ]" \* N xchg dx, es:[41h*4]: O% M+ H5 M* ?, b) d6 o+ n
xchg bx, es:[41h*4+2]
! B7 e# W2 E! i" m9 X) C cmp cl,al. R% i1 N: p6 E& U
jnz SoftICE_detected
; `5 U0 Y9 S& [7 v4 _4 m
# m3 W( z: i6 L6 t" o_________________________________________________________________________
" z% f1 ?2 D0 N' ^' y. o' g( G5 w- F3 V; A! h* R6 O
Method 07, X) p* J- v. q8 t+ U, @
=========
4 ~3 _- W/ A6 i7 M
9 P( Z! c' n) tMethod of detection of the WinICE handler in the int68h (V86)
' q. R3 M* o5 |% N' m
# v1 e8 v5 u" ] @ n3 A mov ah,43h: m/ T" ?8 E5 ^ ], J4 F: F- v8 c
int 68h
) X9 _4 j% }& u- W$ p+ [# { cmp ax,0F386h
, o6 F. K7 q+ A& T jz SoftICE_Detected" }+ d6 Q5 t& M8 Q
1 i, G; n* m0 j3 e7 u& [) }
# p5 H% k" [5 _
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
+ h2 O; ]- M; Y/ C$ E app like this:* [. D9 R& [4 V
* k+ c# F7 R: \0 n, t7 E; ~; |
BPX exec_int if ax==68
9 e; ?$ u1 E6 e' K9 l (function called is located at byte ptr [ebp+1Dh] and client eip is- g! n1 }3 G# I. I
located at [ebp+48h] for 32Bit apps)
- p5 D( G& [: u6 r) v2 X- K__________________________________________________________________________
: t# C r Q+ o8 m0 ]2 q
6 B( d2 S3 k2 v
" h1 D8 S/ i$ S, Y* N! ~Method 08) w+ e( T( H4 z3 Z+ E) R" v
=========
4 g v/ b- `5 ?0 q& a7 T6 E1 `' G
0 L# n- W$ T+ ]' P3 b2 g. Q8 P) c/ lIt is not a method of detection of SoftICE but a possibility to crash the
G# y+ ?: e- v+ R7 Ssystem by intercepting int 01h and int 03h and redirecting them to another
: H( m9 w- k1 _2 xroutine.
6 j0 V. M8 ]9 AIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
6 w& s0 e9 ?9 F$ \to the new routine to execute (hangs computer...)$ j8 @( M. f7 a
. g+ C: Y+ X2 L, ^! W& z mov ah, 25h$ R" r* f+ h+ p7 `5 T& v
mov al, Int_Number (01h or 03h)
- u7 ~& n# N4 O E( B- b' N mov dx, offset New_Int_Routine2 s$ P( v. ^4 f; }9 O2 c2 Q- M! n" p
int 21h
" R# m, ?& @& j9 j! G, I, g8 s- ^" ?. m, u
__________________________________________________________________________9 v8 M( ~ n. u0 y- A
; ]3 ]0 I, ~) v& S( ]7 e
Method 09
' d1 D: S a* j5 ?% K=========
3 S, z) i" ^/ B$ V. `, x1 y$ N& S
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
6 n/ j2 Z* t5 E6 z k9 P1 c- qperformed in ring0 (VxD or a ring3 app using the VxdCall).# Y( n( m1 K$ @0 |0 ^$ O4 `1 B
The Get_DDB service is used to determine whether or not a VxD is installed
; B' S2 T% T7 e4 N$ z1 U9 r4 Sfor the specified device and returns a Device Description Block (in ecx) for2 r$ ^+ j G9 @3 q) P1 O$ R
that device if it is installed.
7 B1 q3 w" i( ~3 s. Y8 _/ Y" G |, ~, e4 M
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
) S( H# S% b8 T% j mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)/ [) Y* l; n" N* T9 B* E
VMMCall Get_DDB
! w! x" L: [1 F" Y2 X1 A mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
" `# u/ j' V+ h) ^7 n, I0 x F6 }" o, v: f3 q, v& t, m. V/ ^4 }+ ?
Note as well that you can easily detect this method with SoftICE:9 Q# X% j. W; T/ L9 Z
bpx Get_DDB if ax==0202 || ax==7a5fh
, n& L" p3 u: I7 h) y& ~) n$ x( V5 E; l+ m5 F) A4 |$ j& j
__________________________________________________________________________2 s9 B2 ^/ y* s/ o/ I' b& @8 |& p
/ a! ]& J/ h$ ]4 _# q: h! VMethod 10
* ]% w3 o* ^& A/ `7 t9 P=========
7 X. s5 V0 u+ U# C; w) I+ n
+ C' M$ B6 d( ~0 k8 r=>Disable or clear breakpoints before using this feature. DO NOT trace with( g" d+ n& Z7 I) W; w
SoftICE while the option is enable!!3 A2 U7 r1 l2 t2 Z+ [; W' {1 \/ C8 Z
5 i; d* H N& D7 B1 F) e
This trick is very efficient:8 e7 B9 M# Z5 N0 \3 o1 l
by checking the Debug Registers, you can detect if SoftICE is loaded
5 }7 D, V9 }$ U(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
% d; g- k5 {5 m- _1 sthere are some memory breakpoints set (dr0 to dr3) simply by reading their
% h1 O# E9 J* E5 z" J; Bvalue (in ring0 only). Values can be manipulated and or changed as well
! y F% l% t4 g(clearing BPMs for instance)# O) X: `& C7 Y& ]% B
: w- R' @7 E0 F
__________________________________________________________________________
' o1 L Z# l5 T" l: A @3 w5 ]1 Z
Method 110 U4 u+ W5 {7 ?
========= f$ s: J& R# J5 G9 ^# ?
% L9 v, }* G9 M0 x6 T. p1 k( s ~This method is most known as 'MeltICE' because it has been freely distributed
; F* V) H) w( r" u5 Kvia www.winfiles.com. However it was first used by NuMega people to allow
0 Q% ?: U0 p2 K8 |Symbol Loader to check if SoftICE was active or not (the code is located: p4 H1 Y3 ]5 k6 t2 E. l' B
inside nmtrans.dll).
" t! p% X' a& n5 y" f$ A0 T0 n1 @
! E- h' d h4 | S" c. \7 k1 k) Q8 ]$ m: G: vThe way it works is very simple:
5 r7 _+ y4 A" S# [; q; h& y# r+ r8 eIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
& q: Z) p1 l- WWinNT) with the CreateFileA API.% C( b! l8 [. @/ h* A& o
; E, I* l4 N/ {& DHere is a sample (checking for 'SICE'):) w4 q) C0 d+ t$ @) [( K: S0 T4 o
' R$ f n, L2 b% m! f, Z! T
BOOL IsSoftIce95Loaded()- b- V- \1 i' }, B) L6 `+ D, l- O
{
+ f. M0 Y: M2 @. [ HANDLE hFile; 0 u( f; |. u" ~& B" _1 b
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
, E( w0 x' X; T" x# q2 T/ F FILE_SHARE_READ | FILE_SHARE_WRITE,
' T3 [% q9 U9 c$ d NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
* p& A i) l) k1 Q! { if( hFile != INVALID_HANDLE_VALUE )
3 q+ U- E4 I# J {
$ i# @8 v3 Q/ I# ?) L5 Y$ t" {% Z- h* B CloseHandle(hFile);
( [: s x( a* ?& c# b8 n6 I return TRUE;
2 c1 _& l% [6 P }
: z1 c5 d2 X4 P% J, e% o2 b: E% z return FALSE;
+ L6 m3 n( T/ z# L$ t4 k}5 y/ e' k! [* J& O
" F0 }4 l- u- x9 [* {
Although this trick calls the CreateFileA function, don't even expect to be+ i: j; a5 @$ g: ?0 a3 l$ A
able to intercept it by installing a IFS hook: it will not work, no way!
' A3 M4 X! T7 N4 _3 dIn fact, after the call to CreateFileA it will get through VWIN32 0x001F8 ~$ _1 R$ T3 c/ u
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
# _ J3 U1 f0 d1 @# Fand then browse the DDB list until it find the VxD and its DDB_Control_Proc
$ w! W x) W B. }! H9 k- hfield.* B1 Q e7 L6 q
In fact, its purpose is not to load/unload VxDs but only to send a ; U6 K! l" o# ^; A4 A
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
6 F7 n: z6 g/ s1 Yto the VxD Control_Dispatch proc (how the hell a shareware soft could try
7 n6 e1 S/ C0 ^/ t& Q3 Cto load/unload a non-dynamically loadable driver such as SoftICE ;-).
5 a: Z0 ^ z) q$ \% ~& t: ?" q7 ZIf the VxD is loaded, it will always clear eax and the Carry flag to allow% l0 {* I, {2 c8 l3 [* y' n3 I
its handle to be opened and then, will be detected.) ^0 ]" I" a# a
You can check that simply by hooking Winice.exe control proc entry point% F; m3 I+ k( a8 X$ g% g4 U
while running MeltICE.
% M& t [* S6 a3 m6 T7 n5 z! b7 P/ g3 W+ f# w
# G* R8 K$ R4 p% M; y
00401067: push 00402025 ; \\.\SICE
7 u: [( N5 B- _' x* m7 M 0040106C: call CreateFileA! [# T; x9 G5 ~ q8 x8 ?
00401071: cmp eax,-001
4 s1 O5 w1 W* Y8 | 00401074: je 00401091
# R3 d) K- O& y. A J% e% u! g# Y @2 X, R
7 w/ M+ b& }! D- v. I- E2 l
There could be hundreds of BPX you could use to detect this trick.
0 }( R0 k8 b4 I-The most classical one is:( [7 [/ ]$ E8 @$ s
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||; m" t0 K8 L2 P- ]9 E" V5 K
*(esp->4+4)=='NTIC'
/ H0 ^- n5 r/ O5 _/ K: V
$ ?) ]* A& q$ X$ G-The most exotic ones (could be very slooooow :-(, e5 q+ W u. V' P
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') " V* P) u2 t1 Q; G
;will break 3 times :-(
9 j1 P% h7 g" q8 Y* O- |
8 K; p6 }( C- t T-or (a bit) faster: # V2 K0 o! D' r4 T
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
1 _4 l, H+ u8 l: K% p# U
9 [* I- @5 o. T3 B# q: I% ~$ u BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
0 U( `3 ?0 t$ T P7 i" c ;will break 3 times :-(
% T' L- ^' M5 r1 r8 e# {/ {0 k- c
* F3 b+ n3 ]7 d-Much faster:. v/ O: p6 q4 N4 {* P# A
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
4 [6 `1 E2 J" n' u e+ F$ G4 c& }- ?, y- Q2 S3 @% F+ e g s9 V
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
* R0 Y* }$ l6 M+ `function to do the same job:
0 C2 N b& D, L$ p) [0 o
0 X9 X# ^/ l2 L push 00 ; OF_READ
5 D3 [% H7 Y/ P mov eax,[00656634] ; '\\.\SICE',0
( I5 ~; P$ \9 b! S8 O push eax
. s0 [- ]6 i& b" l call KERNEL32!_lopen
& S& r* ~( a7 ?. [ inc eax5 @& ~9 h8 H% i# _
jnz 00650589 ; detected, b) W. S. F3 {4 {' b
push 00 ; OF_READ7 x" G' f7 F Z1 Y
mov eax,[00656638] ; '\\.\SICE'6 B- `+ b+ L; V; d" f( J6 a/ W
push eax/ }. B) x6 M s& S( T
call KERNEL32!_lopen- G# o) S- ?2 v+ E0 D% N
inc eax$ v' G, \1 z6 m; G0 k. S8 w
jz 006505ae ; not detected) @. Q `1 E) |( l7 P0 v% ~$ e$ Z
0 D5 R5 t5 X. I/ P$ q0 i2 k; P; F* k* l& i8 p4 g
__________________________________________________________________________" E- t9 D+ }+ k9 J7 Q" ` @4 d
/ {8 X7 t; A& D1 {6 d
Method 12
' s* i1 ], s0 p+ x$ J+ L9 j========= y. ?; A) X+ r* e
& h5 J/ P' G' M
This trick is similar to int41h/4fh Debugger installation check (code 05
. F% _3 u5 @ P. q( G7 M9 N& 06) but very limited because it's only available for Win95/98 (not NT)
8 o( l# s9 K3 G% has it uses the VxDCall backdoor. This detection was found in Bleem Demo.' T, F# W$ v; B; n- q6 C
9 f- l8 a! q! w6 g
push 0000004fh ; function 4fh
1 t; w; J; n) k& j push 002a002ah ; high word specifies which VxD (VWIN32)* E+ U7 a' u) H- R, Q2 d
; low word specifies which service
0 ~- F" C6 } [; w (VWIN32_Int41Dispatch)
5 `+ f @. k" `( U7 U* l! g) e call Kernel32!ORD_001 ; VxdCall3 Z } W8 i0 @. @7 s6 v
cmp ax, 0f386h ; magic number returned by system debuggers' L. A& S$ a9 T9 ]! m8 {0 G6 g0 z
jz SoftICE_detected& ~% P( |! ?' I$ C; Y- e# P
5 D1 T* }# ~. P. x0 B$ oHere again, several ways to detect it:
4 c- r, n$ j- G ?1 ]
: P, K( o- [' A) @/ [ BPINT 41 if ax==4f; k: n9 `/ w. N
5 d& W0 w) F( l8 W% z; f/ `* Y BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
# A+ o7 K+ L ]0 \
, X( |( F: ~( y6 D( K BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
8 c$ c! `* c- R4 h. y- S. u
9 W' v4 U5 e% B. D& ? BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
' \- r+ H/ L7 Z; k7 o& d
- D. m: O5 k+ |" Y' ~7 j! n+ ~__________________________________________________________________________- Z, g0 Q" j$ i- W
+ N1 T) r6 P% {0 d7 e: S
Method 13
9 B$ e2 W- Q i=========
1 D0 L' u7 x; M( k+ l0 l, V2 B" m0 w7 M) S. l$ S1 _4 e) t- e( x! w
Not a real method of detection, but a good way to know if SoftICE is2 b% E, [ i# p# e$ q* E
installed on a computer and to locate its installation directory.: e( z- g4 Y* m7 Q# v7 g
It is used by few softs which access the following registry keys (usually #2) :* S! }6 H$ X8 G9 @( [5 s
4 K2 d& `0 q0 n-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion5 ]: g% Y; L) A6 r( W
\Uninstall\SoftICE
& e8 n0 }2 F' B! `1 e/ A-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE6 b( B& U! z: o, D; T
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion( M1 D: M) ]3 ~% ]" t9 n d
\App Paths\Loader32.Exe ?; d- ^4 ~+ N( |# {: R
% G2 u( n' j# `+ w* k2 f
6 ?' k( e- V; I! T0 PNote that some nasty apps could then erase all files from SoftICE directory( ~& e& _. G/ O! X+ f1 ?& g
(I faced that once :-(
& g! j; M0 k) R0 Q2 K& B' s
8 S! c2 A j. k. h0 z. l/ UUseful breakpoint to detect it:
) v7 K: g! N& J9 L; u& K( \! S& \% e) c" t( D; l, x
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
+ ^7 ^' {& q5 i% Q3 h% U6 Q8 K7 Z6 ~ l/ j
__________________________________________________________________________2 E, e& D' _1 @6 W4 u
! @( b" s5 L3 F3 w
9 I: `6 C" w! [8 uMethod 14 / _4 b5 v' s& T; W( @
========= [2 |* l, C3 U8 ?9 W) i( ^" t
- N7 j9 ]! W( q9 `+ r! HA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose3 w9 x; c9 E* Q( d; K+ R4 l
is to determines whether a debugger is running on your system (ring0 only).0 d# r: I7 }8 L8 q0 q" I5 a
- E# t$ I4 Y/ f7 M/ o
VMMCall Test_Debug_Installed
F' D% L+ b- J1 z6 R2 o6 Q je not_installed+ r( f' t( L$ j; {& b! h
$ S8 B% U' y0 E
This service just checks a flag.$ F: Z/ l5 @/ D0 v$ g/ t/ w9 Q
</PRE></TD></TR></TBODY></TABLE> |