<TABLE width=500>' h" I) C3 D: m& F
<TBODY>
" y/ y6 n. e9 s7 J9 s0 x, r% z. E<TR>
* U! H& t% K" B) i$ |6 R- O<TD><PRE>Method 01
# W$ H& a* K/ e' w1 }# I& Q3 e=========
. e. e* |" q) G* |1 b
8 I8 ^1 D& p1 Y& n3 OThis method of detection of SoftICE (as well as the following one) is
, M/ V1 }5 O6 I$ P5 K1 eused by the majority of packers/encryptors found on Internet.! a3 ~9 `; U% B0 z6 G
It seeks the signature of BoundsChecker in SoftICE+ E1 A1 `6 K% {- ^4 j. H
0 k3 P* Z0 Z" S# w3 Y; [9 {
mov ebp, 04243484Bh ; 'BCHK'; Q7 g' E7 j" B" ?% r
mov ax, 04h
' v2 `# n |+ n8 g9 ?2 \: { int 3 5 D7 \/ w% _' A, ]+ |: `! L* \0 c a; c
cmp al,4( ^+ v7 u; ^) A. _0 d q
jnz SoftICE_Detected/ J' N3 C, ~$ C) q* u
2 a; ~2 V. E' E
___________________________________________________________________________ R- H* {4 L3 @- [
" J" t- x3 o& S4 T* ^ mMethod 02
( J5 d7 U" E0 K* I# }=========5 j3 Q4 \/ {; N2 }$ S
/ ~) w) H. v- u v" Z
Still a method very much used (perhaps the most frequent one). It is used
0 o1 w6 d2 f" `1 s8 Vto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
) r$ K9 ]% |) n/ S# z% x# p8 Qor execute SoftICE commands...
: x p9 @; T' _$ P8 ]3 v& ?6 x* l# vIt is also used to crash SoftICE and to force it to execute any commands
4 W& w5 E, A& j- G(HBOOT...) :-(( # I a( c3 b+ O
2 c3 N9 i* Q$ u( }Here is a quick description:
+ b' Z# h |8 u$ X; N-AX = 0910h (Display string in SIce windows)
6 p3 H4 {( q# H: S. n-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
) Z% M# u. v# g2 p8 t/ ]7 i-AX = 0912h (Get breakpoint infos)
" K% Z* N L# f7 C, o2 O' C-AX = 0913h (Set Sice breakpoints)# D& L: \) @, n2 G( Q3 H
-AX = 0914h (Remove SIce breakoints)& T7 ?( [* A# e* U9 x
- U0 T7 k' V2 F# R) U4 H# `
Each time you'll meet this trick, you'll see:
8 O5 F7 c* G# x% ?$ F-SI = 4647h
6 Y6 ~. A! S( y9 S4 {-DI = 4A4Dh8 N2 o v; {& p
Which are the 'magic values' used by SoftIce.
7 t* D1 X( X3 V) ]3 l2 F+ nFor more informations, see "Ralf Brown Interrupt list" chapter int 03h. H3 t. y& x: c: `/ t
1 v' n$ o9 J% _( u- J: OHere is one example from the file "Haspinst.exe" which is the dongle HASP- Q5 V: h$ K0 D% k
Envelope utility use to protect DOS applications:$ N1 C$ u% M% R% X9 x4 v
. d9 I4 R h4 D2 a
* U4 F+ p) Z/ @, g4 ~4C19:0095 MOV AX,0911 ; execute command., A1 H, B3 }( p& j# Y/ c
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).) b! V8 r: C! ?; I( G* S' U+ z
4C19:009A MOV SI,4647 ; 1st magic value.
! Z6 \! ?( t1 P6 ^/ ~! `* a4C19:009D MOV DI,4A4D ; 2nd magic value.5 R l2 B+ f0 ~/ t0 \4 ]1 i
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
$ }) Y, s7 M7 t" X4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute0 y3 Q5 y6 {8 |. o
4C19:00A4 INC CX9 X& i2 w0 u# x4 w; \* W# E
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute+ q) y8 o; \( W3 H2 k! L
4C19:00A8 JB 0095 ; 6 different commands.9 [3 l) j' n/ k% r9 m" o
4C19:00AA JMP 0002 ; Bad_Guy jmp back.2 z4 B& }8 i5 }- ~
4C19:00AD MOV BX,SP ; Good_Guy go ahead :); u; W. W H' X$ f. R* @4 O: G/ |
0 ]1 y. R7 \& w0 o+ V- n: @$ u1 ?The program will execute 6 different SIce commands located at ds:dx, which
3 n7 `6 n+ H; j+ n6 d: fare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
3 a1 Y' m9 z/ F) H1 p7 r5 b }- e5 [: I; y; [/ x& |4 }' H" H
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
, }+ o0 D0 [7 E# ^" p% q___________________________________________________________________________
/ f' v) p! ?5 H% j3 |- c, Q* a; L* t- M ~- V- Z3 A
- c6 Q% I- W3 g4 N7 j" W K; c2 E
Method 03/ R( j4 w' t4 U0 l/ M7 a7 b8 F% U
=========
" A" R! T/ z3 w9 U) e% b" F( a# E4 A3 w, H u5 T' q4 ]# I
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
4 s6 X* n# R, t, A- x* V8 R9 T(API Get entry point)
3 P% A0 V2 S$ {1 y; L7 j _; J: k5 f ) w% C" V; J% \! N( n
0 A6 r5 H1 w0 p8 M
xor di,di1 M' `6 Z6 f# g" j0 v
mov es,di: I1 ^8 z, v/ R1 L7 M) p
mov ax, 1684h
8 ]7 ]- G/ y4 \+ \- V7 L mov bx, 0202h ; VxD ID of winice5 Y# \. i: h' X! P8 K
int 2Fh
( U F$ x: Z% a' p( W0 d% j1 |$ _; b mov ax, es ; ES:DI -> VxD API entry point
0 R' b. w0 I6 x8 d add ax, di
7 `7 |# c: A4 i$ e test ax,ax5 d. M& H u6 b% y: [1 N
jnz SoftICE_Detected
4 T {8 v# U5 E3 Z i, c* y- b6 b* C# g
___________________________________________________________________________
# S! X9 g T* l) u
- p$ ]" q) T5 s/ b5 uMethod 04
7 v7 a' V3 V2 y6 F, g) j6 n=========$ }4 u1 O( g' j+ y
& q: B0 g! b4 A: SMethod identical to the preceding one except that it seeks the ID of SoftICE
7 o2 f0 |9 o; HGFX VxD.9 \" `) Q3 o, Y$ S2 ]1 R) ]
; M) O/ ~) h2 _: j5 t xor di,di7 _2 d5 A+ M, H
mov es,di
( l4 v( t! b" I" Y g3 [ mov ax, 1684h " i7 S# c @; L7 @( @
mov bx, 7a5Fh ; VxD ID of SIWVID% ? W2 ^" G/ {, Z, v. l
int 2fh- |. c9 C$ w5 O% _
mov ax, es ; ES:DI -> VxD API entry point
. S4 Y& S) t( c6 \ add ax, di
9 H6 ]) @ l _ test ax,ax
) n5 w" R- N' [( n! B2 k jnz SoftICE_Detected
' I, r* w; v8 j. J2 u
) _! |) F9 G+ u__________________________________________________________________________
# t4 ]9 c4 y- M2 b- R
% W3 ?: Y- w; c" a! D" ]7 ^
3 {; C2 j7 j0 {2 d8 Y, o' k: aMethod 05, T Z7 q) ~; T. W1 S4 c& O$ {
=========
$ U8 U1 a$ G' B+ [5 Q* l# ?' C5 A$ ` [/ l' i4 R
Method seeking the 'magic number' 0F386h returned (in ax) by all system( s9 f# [2 t' I& Q9 \8 T! n! u
debugger. It calls the int 41h, function 4Fh.1 R$ G. n! y6 V6 u
There are several alternatives. ; H. o# A; b& v8 v# `
; c* U# y; o9 Y- a& y. S
The following one is the simplest:
0 Z Y8 D q" D- |$ x% V( s/ N& c
O, p* L3 Y# S) b5 ]7 W mov ax,4fh; I1 D8 W6 Z, D% |) C O
int 41h
1 q% n) B, b* Z/ z cmp ax, 0F3860 Z3 z, M: b- F. _
jz SoftICE_detected6 K! F6 j2 D# S: y- U% C
$ W5 d9 g9 Z7 I
( a. _+ p+ x- s4 @Next method as well as the following one are 2 examples from Stone's
n a0 }' v( p, O4 K"stn-wid.zip" (www.cracking.net):( ?7 A8 X( F. y% R2 Y: A. E; D
# W- h$ h' [6 _' D" u mov bx, cs* }; Q6 z% j4 O L' n
lea dx, int41handler2
9 I# q" |/ j% O8 P9 V; N8 O' Z4 f xchg dx, es:[41h*4]
6 w9 u$ X$ r# Q6 A7 m3 K xchg bx, es:[41h*4+2]3 X7 p3 b, J! V, A4 }
mov ax,4fh% C9 W, P& ~3 q. h* O
int 41h
r) t( E/ _/ Z1 x: x9 \ xchg dx, es:[41h*4]
" E* g$ x4 p/ @$ V xchg bx, es:[41h*4+2]8 Z: S" f1 K1 L! ?. C# J
cmp ax, 0f386h
) j1 G4 k W& z$ X" h jz SoftICE_detected1 I# n* U: F) s# V8 n3 X4 i; Y
/ b% b- r4 m5 v! T7 i4 h
int41handler2 PROC
" q5 |1 @( e0 s* j iret
# x) \/ o/ w. s" D& E( M6 w- j' Nint41handler2 ENDP
5 a& }6 u1 V4 M5 w4 h* ]" X$ V X5 u/ c" `+ D- G0 s$ u8 x
3 Z) x0 W5 V5 w) g/ ]
_________________________________________________________________________
. _- |# b9 s! V5 r/ ~3 Z6 u; F& `5 w1 I4 G8 P# H+ J) H" a* z
) G0 m% b5 ^' S5 Y3 `Method 06
# M4 P+ o- e0 `3 S X3 r=========: ?6 _# p2 ]' n) ^* n
& T; ?9 K! y" v, M
/ h5 K+ o' {3 K7 B5 Q/ n3 }: d2nd method similar to the preceding one but more difficult to detect:) u) {5 v5 L9 w+ B3 k# B, X
9 o8 n s+ z& R4 l- j
0 V6 D2 z V- sint41handler PROC! \! s0 i; Q" R/ W1 ~
mov cl,al9 v3 A% P" a$ N
iret
& x" K( g, t* N/ R0 n3 q; ~! W6 `int41handler ENDP
. P6 L0 b3 w/ S, Y; [8 {% A9 E: a+ a% Q/ f, q
2 h9 Q1 _' ?4 k! ^" r xor ax,ax
0 L2 s0 v) a- L mov es,ax
1 A1 v5 L. U0 G1 p. W mov bx, cs' m8 L& W+ x! k+ W+ P- N
lea dx, int41handler
7 A' I( A+ J; h! A' m4 ^ C/ Z5 [ xchg dx, es:[41h*4]+ F- [ N! ~8 l# \
xchg bx, es:[41h*4+2]0 R: c& D3 R( K1 Q' t
in al, 40h4 {( {( W T6 S. G
xor cx,cx1 }8 @ r, L4 Q, k3 u
int 41h
. A4 s, n% ~- J) ] xchg dx, es:[41h*4]/ F8 Y5 j' \4 ^) h2 o
xchg bx, es:[41h*4+2]) ]+ y9 _9 V* [) z3 R7 R" }
cmp cl,al
$ l r' U# d$ v u9 | jnz SoftICE_detected
* C0 } E- \" B! l5 J7 x
% D* l( ~3 R4 F& E6 `) T' o_________________________________________________________________________: S! z# D5 [7 [- l7 x% H% N+ H# h
/ R3 ^! y' \# F7 J" w; E6 M% l% oMethod 07+ Q# v# T# a4 a5 H$ d6 X
=========# m$ {+ [9 \# N+ s O) P
3 `. Y$ `! n+ Y9 w9 ~Method of detection of the WinICE handler in the int68h (V86)6 R8 d" F7 J' @2 E
" }6 D5 Q P1 q! ^$ K
mov ah,43h* }9 m' D6 k) T% K8 \. C9 t
int 68h5 F x* S4 e5 K' w. n6 @6 p7 t
cmp ax,0F386h, j8 v, ^2 ]' \
jz SoftICE_Detected5 j# z- U. z; H3 ~
0 z, Q( t* M' ?8 p1 A/ B
) V: c& {" L7 m5 D=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit9 {5 J! N: d7 f3 q" [2 W
app like this:
" p( s9 G- C( q2 m7 U# Q) h! L& x* q& }7 @' |+ {
BPX exec_int if ax==68
, s( ~9 z5 N6 Y) O# \2 {4 P (function called is located at byte ptr [ebp+1Dh] and client eip is
J: \) t9 v3 Y' [ located at [ebp+48h] for 32Bit apps)
7 y6 t/ V) O7 O$ h6 D; x2 R7 c__________________________________________________________________________5 N l( d- d% I1 i
; S% v5 N# D; u; I2 F* R
* ~' ]. t- S" R( ?2 ]Method 08 |4 f; z( ?2 p
=========9 d( B4 y8 M) }2 X! r# b: X
: {+ _, s" z* H
It is not a method of detection of SoftICE but a possibility to crash the
) |' b) Y2 v4 isystem by intercepting int 01h and int 03h and redirecting them to another+ e+ ?8 ^8 ?* x2 ~5 `
routine.9 o9 R* e/ }& i+ [7 L; t- @. P
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
1 _% m7 n) m, N6 n4 W4 Cto the new routine to execute (hangs computer...)) }. r8 y% G/ R/ ~/ G
, S$ i, g9 i9 ]0 ]
mov ah, 25h
* E P: p1 @6 y$ S. s+ D( Q5 | f mov al, Int_Number (01h or 03h)
) U! [. d2 N; l7 R. O mov dx, offset New_Int_Routine/ N( ~$ d/ [2 e
int 21h1 p R- Q$ b. Y& Z) T4 y) f
7 r- Y- y- g# Y
__________________________________________________________________________
6 ?9 }; v: e' G& F' {$ d+ [. e p5 [/ u+ X) r y. @ J
Method 099 M, t' f6 ]5 _# N- p; w
=========
) e8 Z# c6 `. X _% T0 P3 J8 h
/ W, @8 E8 _* M: K+ ]) c4 d( L; TThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only* ]) @/ \7 ]3 S( V$ l w
performed in ring0 (VxD or a ring3 app using the VxdCall).9 I! H1 t3 B/ W. n6 r
The Get_DDB service is used to determine whether or not a VxD is installed1 u! ?% e% j5 L3 Y
for the specified device and returns a Device Description Block (in ecx) for
5 T/ `& R. c+ F1 {/ L) R$ y! lthat device if it is installed.- k% O+ Q" J# f9 m; V- Z# U) \
# T4 Z/ \/ @: M: A# X6 @. ]1 ` mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
: J4 Z& k$ @0 T# Z. `1 p( G8 O! J mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-). g+ |) U9 P0 [: l8 O! X2 p' n& M
VMMCall Get_DDB
% y/ C& O3 \- v3 a* |, y; H mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed* L* a' U* a6 U1 q! Z9 Q+ p
1 d3 A4 P! h5 _# a {8 ^Note as well that you can easily detect this method with SoftICE:
$ w$ J0 v$ D% w; d) Z& @ bpx Get_DDB if ax==0202 || ax==7a5fh" v* b: H) v f) [# ^$ p# S
1 d- p: q1 {- i9 U
__________________________________________________________________________
1 S- a& c9 m. Z7 f/ B) D/ e; q
7 w8 M" n& L4 _/ S* lMethod 10$ N' B* [$ `9 F
=========
! R( S/ J" X6 @8 F) s' v% U3 H' ]$ L7 l( k( L( {4 n% O. p
=>Disable or clear breakpoints before using this feature. DO NOT trace with* ]+ M+ k* v" W
SoftICE while the option is enable!! C- [0 A6 Q4 G$ q; k3 D/ X+ a. a
; |( W% q& }; H1 o6 l4 {
This trick is very efficient:" R( [! @7 a$ ]* ^
by checking the Debug Registers, you can detect if SoftICE is loaded2 H, m# L% s" e w1 v6 }# P4 K
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if& R/ }; z P* d! t% K. J4 P$ v
there are some memory breakpoints set (dr0 to dr3) simply by reading their
, L0 S. J! Q% d" Dvalue (in ring0 only). Values can be manipulated and or changed as well6 D2 w! U' E% Y& Y( n% T7 n. ^
(clearing BPMs for instance)
* E: `) G# A% K0 |
; V* |6 t' S Y; x2 ~/ W! p; P! c, E+ X__________________________________________________________________________
; D- t; X/ _9 r- u0 q2 e6 P8 {" c& G" L
Method 11
' Z" n8 Z4 l1 j# y=========. W; p9 T& ?7 t' `5 o I* ^
; F+ S& B# g6 A& VThis method is most known as 'MeltICE' because it has been freely distributed
$ k7 m2 Q1 _; R& W8 Dvia www.winfiles.com. However it was first used by NuMega people to allow
* p+ w, ]! _+ e: q( ASymbol Loader to check if SoftICE was active or not (the code is located
: a. C, T" K/ C7 X. X9 Z, Q ^inside nmtrans.dll).
\0 q/ X8 M( `- K3 o* @0 T8 l$ S* J" \8 a/ R
The way it works is very simple:
3 v( J# F) ] ?" m% g, w9 G0 ^It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for/ j+ M# P; X# B* q
WinNT) with the CreateFileA API.
. G4 Y! L0 w( `: H8 d; t& a0 D0 `
Here is a sample (checking for 'SICE'):6 x2 g) @) j1 ? `& F
5 Z# o; V% v0 e* U. c
BOOL IsSoftIce95Loaded()7 Y, D) {/ b$ k9 A' U
{1 z0 P; ]+ B5 }% y& z
HANDLE hFile; . E9 }7 i& @- z( l o: w
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,& ?" @7 Z. {8 i1 `2 b. x
FILE_SHARE_READ | FILE_SHARE_WRITE,
: v( K `- z2 E3 f- T! y4 { NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);* g$ b) S5 `( N- l/ |! x
if( hFile != INVALID_HANDLE_VALUE )
! I! t4 e: p) p {/ m0 S; i4 T# y- b, O% P9 B
CloseHandle(hFile);
! f4 L( o' q; ?& S) Z return TRUE;3 o/ F- J: w3 U6 y& |/ `5 O
}
' N" J( ^8 L t. q3 E- R+ m2 n8 ^ return FALSE;
4 I7 i5 ?0 `; B( w/ T' @}6 `1 @" }! t. M) t0 l* G
: N0 U( S2 l* i
Although this trick calls the CreateFileA function, don't even expect to be
/ n5 S, p1 q: A: J; m6 h$ Iable to intercept it by installing a IFS hook: it will not work, no way!
0 ^7 `+ r6 B: t, ]In fact, after the call to CreateFileA it will get through VWIN32 0x001F. X- c2 o( ^. K0 Y# |
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function): a! g8 j; P& P' b ^3 y( y
and then browse the DDB list until it find the VxD and its DDB_Control_Proc) {8 |- H4 I: f t1 T
field.
# `; t: T+ V0 bIn fact, its purpose is not to load/unload VxDs but only to send a 1 K# \" v& \! f! b/ I+ w o
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
+ c' u. p- X9 _( w/ qto the VxD Control_Dispatch proc (how the hell a shareware soft could try
2 e7 S1 Y' ]; [; B s/ E5 u# N/ C6 yto load/unload a non-dynamically loadable driver such as SoftICE ;-).% v8 L) V5 N/ v0 \: B
If the VxD is loaded, it will always clear eax and the Carry flag to allow) ^1 C; l4 M5 q2 O+ p6 Z4 a
its handle to be opened and then, will be detected.+ b, b" {7 _" J8 r* }7 l0 T6 j2 K
You can check that simply by hooking Winice.exe control proc entry point
; Z; }/ Q7 E0 V6 b/ wwhile running MeltICE.
8 O8 q8 G5 ~6 Q$ k9 N2 @% U/ Q# U2 j+ b# B+ p
* W4 t w0 g% I+ s6 I. A
00401067: push 00402025 ; \\.\SICE
0 Y5 ?0 M' I. |* X' d B- ~& l 0040106C: call CreateFileA4 L, X* \9 K, e+ _ U0 u3 Q
00401071: cmp eax,-001
( m4 t0 x- }( }# ^ 00401074: je 00401091# i& Z/ U2 k1 s2 P4 M; b
" }$ k+ C* p: P( s4 y
% h, i2 D& q2 g5 g8 AThere could be hundreds of BPX you could use to detect this trick.5 i! {, Y l7 c- o3 g# j- N: T
-The most classical one is:0 |3 [. D% ~- g9 ?& [; | q( n' Y
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
+ [1 A7 |% Z7 ]9 |) w, r& x *(esp->4+4)=='NTIC'! u9 d2 E* m7 E2 \' U) Z
$ x, c2 h+ ^" j* t/ O# b-The most exotic ones (could be very slooooow :-(
7 B7 T4 N& j7 F: d( f6 e BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') - N, m, e( w2 R% R# e- W
;will break 3 times :-($ S8 @2 Y6 Z8 z, Q* D
$ g6 e T' Z9 o$ `
-or (a bit) faster:
! x; r7 L- z6 v4 l6 H BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
8 X I+ P! ~4 v3 F' v
) f6 E& ?& k# d5 H- x& N BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' g4 {; R$ X) r, p4 g
;will break 3 times :-(
2 _! {9 a9 N8 J+ P, v7 z& d. q1 X+ }2 O3 l) @
-Much faster:/ t2 p, z0 X6 E- e* i2 C; x7 p/ n
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
% |/ p2 ]8 O, Z* S) q2 B; W
3 Y( H+ z* k3 G2 H) [Note also that some programs (like AZPR3.00) use de old 16-bit _lopen+ s' B: u2 [" M) f7 n Q% b% i- b3 G
function to do the same job:
# w' i k1 P8 O4 E. A0 n
1 L" Q/ _& {: P0 h n% B push 00 ; OF_READ* T. S' K- s; x7 K$ s& |
mov eax,[00656634] ; '\\.\SICE',0, i T, m) @* F' {1 q0 x
push eax
8 V: J: H! t$ w call KERNEL32!_lopen
1 }3 E- E2 Q6 s; ?) Z1 b inc eax
% Z9 S* r7 ~2 D9 y) t% A6 e jnz 00650589 ; detected* ?0 x& x' l: _9 B- \6 N0 f
push 00 ; OF_READ! ~# ?2 X" a/ Y" b! L
mov eax,[00656638] ; '\\.\SICE'3 p, W4 V% n( k) l7 i
push eax+ ^1 A$ w q" }( N; K' r1 H
call KERNEL32!_lopen
/ e; C) T) f0 B* j. |8 s inc eax
( A4 K/ ^. X( [ jz 006505ae ; not detected& X8 }$ k# W8 }1 v. n/ q! x# `
2 A6 h3 _9 g" C4 J+ Z7 c, k5 F+ G
__________________________________________________________________________
( E1 ~% I& m. G- j) U; @$ J
* i Z$ ]: t9 j! A! | h$ F' dMethod 12
. o7 W, ]% {7 Q+ E2 A- C) Q5 c=========8 `8 d+ O0 I. Q* Q
, X5 a$ g( {" [% \: OThis trick is similar to int41h/4fh Debugger installation check (code 05
9 G8 A4 F/ p: e0 n* v0 w& 06) but very limited because it's only available for Win95/98 (not NT)
4 z1 ^' P5 a' T4 Y7 r3 Fas it uses the VxDCall backdoor. This detection was found in Bleem Demo.
4 W$ r: o4 r, C( c' M* u& I0 `' B: {" C% i' b# v- e
push 0000004fh ; function 4fh
% \: f- |1 s$ `! { push 002a002ah ; high word specifies which VxD (VWIN32)" @7 _1 V8 p; d t. b
; low word specifies which service# n/ Z# d0 Z, s' h: k* X5 {
(VWIN32_Int41Dispatch)
7 s0 q8 \4 E3 u call Kernel32!ORD_001 ; VxdCall- E) M, e0 D- j3 G
cmp ax, 0f386h ; magic number returned by system debuggers
/ w/ _/ {4 h8 _$ } jz SoftICE_detected
, ?7 r- R0 o; b7 c6 K( {! w. h- e/ |$ B( J/ L: Q) Z
Here again, several ways to detect it:, m" r2 \! z; Y2 _9 i4 J8 ~
! W* B9 _- [/ [% {6 r
BPINT 41 if ax==4f2 U* _. N1 {; u6 d
# Y, j5 B5 r) @7 \ BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one' i, j. P1 h+ f9 @: q
9 x6 ^4 I) O( q8 v! q+ {" i
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
% I7 R/ q" U) d1 o0 G6 v! D
4 S7 w5 @9 c5 C P/ `2 o+ P/ T( @" O8 g BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!; R7 n. g$ F4 }; H
( G7 K' q* o( k) E: V( b
__________________________________________________________________________5 O( V5 X7 l% W! }5 ^" E4 O, r2 ]
! s# ^; Z& L3 o$ l
Method 13
) i6 }& ~- B% H+ [ _. B=========
. a6 x' |+ k! w; I$ b
& P* T' r2 e' L5 u# R9 @: bNot a real method of detection, but a good way to know if SoftICE is
: C" _3 f+ C) Pinstalled on a computer and to locate its installation directory.
1 v; ^& N) p/ t& GIt is used by few softs which access the following registry keys (usually #2) :- F1 v/ E5 {8 M* f
g" j4 {4 r( p-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion5 G1 J) Y) K) s8 k: V& Z' }
\Uninstall\SoftICE |6 @0 {. `8 y; L1 l' q
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE8 s @9 |" ?" J' {; O
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion) y* i8 A. G# S, O+ _) P
\App Paths\Loader32.Exe
]4 I+ w, e. w3 n- `/ a: G( ]/ M- _: @' y8 B; w5 G6 B
+ t$ Q* d6 t( p2 h# {
Note that some nasty apps could then erase all files from SoftICE directory
$ g: u7 A2 n, A i( N8 h% X(I faced that once :-(
, O4 h1 F1 ]1 O5 P. a- @( W$ y
/ M, B( u' i% @, Z& c: S' lUseful breakpoint to detect it:7 J9 m% o9 Y! P+ N
) B( _7 K: p$ R+ R% ^4 F
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
m( y$ N8 `: w; q
9 W/ N1 N1 U" n* M' C6 v' l+ r; y__________________________________________________________________________
) K3 v' C) h9 ]7 j& W
7 l3 k( U$ B8 K8 s* ?2 O$ K! Q3 p) f7 O. y1 j: r) [
Method 14
2 B" }- U' i" J4 B=========' e* j2 O* M& [# j9 |8 H
: A+ @+ z3 \( lA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
1 j; }9 ~7 X2 q9 l- p2 ais to determines whether a debugger is running on your system (ring0 only).
& Q8 [, U/ @% Z2 @$ W8 N0 W/ Y0 q W' Z3 {- v! B9 s. e, Q3 R; a
VMMCall Test_Debug_Installed
! Y2 Q3 H& J# } je not_installed
' m5 Q" i2 n1 L6 }/ n; I
& ?! k3 ^& O' f1 PThis service just checks a flag.6 Z0 p8 J( _ P
</PRE></TD></TR></TBODY></TABLE> |