<TABLE width=500>
2 _- ?% y6 `5 z<TBODY> ]; G" Q9 N& [ p$ {/ n' d
<TR>
" s) S5 `' @/ `- j7 @' r<TD><PRE>Method 01 , {# o" C) q) x
=========
% v t3 d3 V) r! M: V5 h$ k
) l% K0 o; H3 S) F- \8 yThis method of detection of SoftICE (as well as the following one) is6 ?) A# r9 o# G& f+ ^/ u
used by the majority of packers/encryptors found on Internet.
; O# a4 H5 K6 n. Y& i% L7 u, z, @# E# IIt seeks the signature of BoundsChecker in SoftICE n) S1 E5 e8 d7 K: ~
7 N3 d+ v$ L+ F7 j5 p mov ebp, 04243484Bh ; 'BCHK'
. A* U0 ]) G9 K8 @ mov ax, 04h! V, R7 [* g% o1 t' t! o- U
int 3
8 _& d# R( m w# p1 f. O/ @ cmp al,4
9 {% v- V8 l' `9 n0 V jnz SoftICE_Detected7 Z* z6 `( G" ] |( ]; K6 h0 |
) L G8 ^4 v0 ?# P+ T# N s/ h
___________________________________________________________________________: |; A. `3 e& {) k2 N4 g7 r
* i3 K: a4 C0 l' }) `: {Method 02( [6 s" C/ O0 M
=========
" ^" m# N5 ~# d# v+ b7 ^6 O# Q- u$ g u1 R% @. N* h
Still a method very much used (perhaps the most frequent one). It is used( X6 i. [, n/ g' y5 o( X( z# k9 y
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,3 M# Y7 O1 q" ?/ S# B% ~/ ^
or execute SoftICE commands...
6 \, U6 ~9 E- e: `7 ~+ AIt is also used to crash SoftICE and to force it to execute any commands% E4 |- I# J$ @7 s) Z
(HBOOT...) :-((
% p9 e5 u) x8 i8 P2 {( f; Z4 n( _" ]# T- y
Here is a quick description:$ x/ X, l& M$ F, d* }
-AX = 0910h (Display string in SIce windows)
, h0 }0 W7 Y1 T0 l: ]- x4 r6 C7 \-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)0 H* D. D& f5 {/ q
-AX = 0912h (Get breakpoint infos)
F; D! n, k) D, ~" ^2 g6 J-AX = 0913h (Set Sice breakpoints)
+ ~6 g! u( U# \-AX = 0914h (Remove SIce breakoints)+ r, n- ?1 B0 W' P0 l( g
5 d4 \+ F }% n4 f/ i* D) S! l+ i
Each time you'll meet this trick, you'll see:
% p+ ]! [7 z; }0 `-SI = 4647h* [. g3 q' H; E, n) K# H
-DI = 4A4Dh
3 I& g* Y; V& S# l5 I! t5 L \Which are the 'magic values' used by SoftIce.) i9 ^1 [1 T1 W
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.6 k0 u6 c0 O* D4 {0 x* o7 O8 O4 M
: n7 v2 G9 }7 q k% P: _$ U2 y
Here is one example from the file "Haspinst.exe" which is the dongle HASP, W! i; i2 f9 p( `6 M
Envelope utility use to protect DOS applications:" L1 y$ a9 Y7 h
- x4 }7 H2 K7 J$ F+ v7 P3 Q! k( }; f. Y4 C. J9 ~: I$ V2 r+ j
4C19:0095 MOV AX,0911 ; execute command.
; `# t1 a2 m) P4 d$ `( k1 T4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).8 v- e# U7 A2 X9 ~* k. o$ c4 y6 L
4C19:009A MOV SI,4647 ; 1st magic value.1 b3 u# {8 f6 V; \7 i- S: H* r: D
4C19:009D MOV DI,4A4D ; 2nd magic value.
M+ p- x0 z! e. Q# h4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)' j( P) l) ~$ S$ Z* W& i
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
' L0 |8 b# W" S' M& H4C19:00A4 INC CX1 O! _, b; N! G5 S( s ~: p
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
0 k# I' _6 q* V2 b, T# i; i4C19:00A8 JB 0095 ; 6 different commands.4 M+ |+ l6 \9 q; U
4C19:00AA JMP 0002 ; Bad_Guy jmp back.3 k! G {& l, T! x
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
6 A+ f8 W; L( e7 m0 `8 U- O x* K, s3 w" Q6 ?/ g6 Y
The program will execute 6 different SIce commands located at ds:dx, which( t; z8 i. `% G2 P% _
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.+ X. B4 c c' t0 ]
% c$ V! U$ l) o( D+ x" F
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
8 a) L' ]2 Q6 E; v# g___________________________________________________________________________, d# |/ i' u( q; Y: W- F" I: O' p( t! h
- Y" l' U) S- s* d: {
{, `4 t! _3 W7 z1 JMethod 03
6 D" E2 J3 O+ W/ u=========
( R* o5 K7 r5 J+ D9 z% ~) {, Z8 s8 m6 b" u) }/ ~* r! i
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h( y0 p$ V. l6 P% v; K2 V1 K
(API Get entry point)
6 h+ L3 Q8 d* ~- Y
' O" h% Z1 O7 |6 D6 y' ]* \- O4 S) C
xor di,di
8 T9 D8 d9 s; o, E$ Y) y mov es,di* N: Y+ f7 u. K7 @
mov ax, 1684h ' k: a6 K& h( ~! D
mov bx, 0202h ; VxD ID of winice( Q7 z* I6 q9 h# K( ]
int 2Fh: t( a/ y ~# N, K; G3 n
mov ax, es ; ES:DI -> VxD API entry point# G0 B; t% d) w. M0 ?- X1 }
add ax, di% ^/ Q" V$ P; Q; U, t8 o
test ax,ax) k& ~! d: |5 ?# n H
jnz SoftICE_Detected
4 q' d: _9 A4 X) _
. f8 G0 V3 B: ~9 f9 U: s+ i; j___________________________________________________________________________9 ~ c# L- s0 U1 i4 h0 ^' L' ]" S
_8 L+ F% j6 A3 H
Method 04
) j. `1 w- b/ Z4 ~: L, V. b2 w=========
- P! v& R0 N" F- E5 S7 j# O9 ?# V! L/ h4 Y# E5 F$ \
Method identical to the preceding one except that it seeks the ID of SoftICE, E0 S7 I: Q( D7 G- F5 |
GFX VxD.- M( @9 g: ]$ S+ Z0 u# I& w- R1 Y7 ~" m
+ z% a5 E2 v1 p8 E3 F6 f9 | xor di,di" ~2 J* Z7 B/ q: w% q5 X/ O
mov es,di
' A; C& |. ^5 Y7 Y7 G8 H mov ax, 1684h
5 V, z2 u- N0 L+ i mov bx, 7a5Fh ; VxD ID of SIWVID
. i/ z" t6 b4 \7 P5 X [ int 2fh
8 B. V" r# e% g mov ax, es ; ES:DI -> VxD API entry point
G( V; E, t" b" n/ p add ax, di
- I/ \/ i* [8 A( i2 U test ax,ax
! `( s' K6 k+ v7 \5 s2 N- o jnz SoftICE_Detected
* x- o( L) j: F8 U
# l# I8 O7 G$ t' z# t__________________________________________________________________________
. K+ b3 o, w9 ]3 ?: w- W8 f1 R/ q4 L, H4 O b
9 @! y; f/ L3 `/ C) s! T8 PMethod 05
& H; S }0 c& a2 l1 D. o5 i7 \$ [=========
6 n% ?' |4 D l& e
- Y6 c3 A$ j6 t& F) EMethod seeking the 'magic number' 0F386h returned (in ax) by all system, D- h9 \8 S1 k( a9 f* E
debugger. It calls the int 41h, function 4Fh.
; R# G$ l+ ]. J2 C) wThere are several alternatives.
' _* b3 }# L: q; _9 r4 S% h; Y7 G' c+ K2 V! L; W( C+ j
The following one is the simplest:
- d3 \! O6 J1 j0 b, A( C! ~! W5 n0 C: `
mov ax,4fh0 D# Y) i* E5 Z/ c1 p( ?( @
int 41h8 \0 k, F4 j) i, O2 r
cmp ax, 0F386& v( m+ K4 I5 F" X2 `/ s j6 L A
jz SoftICE_detected6 ]$ F# L) C% P* T) g
+ [& f' T9 z8 C6 M' s% M, f
: y: u/ [# K. _# INext method as well as the following one are 2 examples from Stone's
5 H1 Y: q3 g, @& M6 S9 h"stn-wid.zip" (www.cracking.net):
e" Z# j& U! o: @: K1 T) b4 a D a+ e: T
mov bx, cs% T0 D( u% m2 \7 I! S
lea dx, int41handler2
8 D# M# v5 G1 h& ~% t/ p( L# N xchg dx, es:[41h*4]( m+ o- q1 \" L, B! h3 u' `
xchg bx, es:[41h*4+2]
2 E9 C1 s5 @, @$ N0 f mov ax,4fh
4 K6 }. S" T$ O* p int 41h% w. I' d/ m" R% R7 A. G
xchg dx, es:[41h*4]- r9 t, j8 q. W# U3 c! i/ Z( w; P
xchg bx, es:[41h*4+2]( s8 {3 j: z8 [0 ~ K/ Z
cmp ax, 0f386h
5 }1 i8 t3 z1 Q8 Q1 m6 S jz SoftICE_detected( _/ o7 h( G3 c' W) r
! E% k9 R: o( y1 W5 b# [. wint41handler2 PROC
7 y) F6 T; O2 k2 |, h q& n4 y iret( x1 y5 h, n" U/ J
int41handler2 ENDP n/ ~" E( Q, Q3 K0 v
9 l# t' F" S. H- o' u9 d4 o
6 I- }# x- u& A- H_________________________________________________________________________1 G! C# k9 k! Y( _* I
/ j7 I% N* i7 k) X- F* s4 V( O+ @
; f! h1 J9 [/ v9 BMethod 060 ^) I, [0 y6 L/ W5 j9 j. j1 z
=========% S( b( r E* p) d
! \4 r# X5 [$ b( n# h! ?$ o6 W# @: C
2 g& E$ v6 t8 y: n$ f) s4 x* [
2nd method similar to the preceding one but more difficult to detect:
1 A. \2 v" I. T+ j
# g( P8 a# r, I1 M8 u! v" z' K
" q q8 A8 W9 {: x1 K1 g3 g! [int41handler PROC
5 E1 q, X/ R/ O* L mov cl,al
' d( w2 c8 J9 `. F% W8 i z* a iret
3 x* Q2 E4 M* E- e& K# E, z6 M8 `int41handler ENDP
3 h2 T: f9 y0 Z7 @$ s) V
4 d9 H% m$ u+ i$ d0 C" [/ f
M' b/ X* m( s# @. T6 x1 B( G e xor ax,ax# _! S1 C3 e# h6 A8 G
mov es,ax
9 x* U5 w5 a* s+ F3 H5 H: T mov bx, cs: Q8 U! ?" n/ k; d- h7 y
lea dx, int41handler, i, K2 O- w. M# c
xchg dx, es:[41h*4]
. y( r2 y8 n% }+ x, b: b xchg bx, es:[41h*4+2]3 c% i" {/ U$ j7 }5 M: T% O
in al, 40h- j: v1 [7 U9 Y N0 |6 X. J
xor cx,cx# d( d. c( p8 z. d. M4 T
int 41h* p$ L' S" i" Z/ c! q
xchg dx, es:[41h*4]
! ]! T* R3 N0 b! w: W7 x xchg bx, es:[41h*4+2]: ^- [( ]* w+ f8 [5 T7 }) p4 d
cmp cl,al
, k7 H4 Z2 O6 r% J: | jnz SoftICE_detected* k0 Y( E2 A" Q( t+ R
7 f5 }9 |2 p2 c% B, F0 `
_________________________________________________________________________
1 o# I: I) f; u6 q2 h' G& l4 M8 u- f2 k V4 B% f' @2 g5 ^7 Z
Method 07* P4 v% G! E8 N: I
=========6 R0 @6 L( Y4 R
$ K# ?1 \8 R4 X. ~! Q; S" Z
Method of detection of the WinICE handler in the int68h (V86)
7 X7 ^9 V' B- H7 Y2 s3 f; N: e! s5 d8 i8 T' a
mov ah,43h
& t0 p% o3 ]8 S+ Y$ f& f int 68h
) [7 m# c* r8 O cmp ax,0F386h9 g9 V- }/ L2 e0 Y
jz SoftICE_Detected
( K+ x* a5 ^' m7 E* l/ N5 g% _7 B/ c8 I% u
j8 s( A5 g2 g: f& Z=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
+ ]# r+ P6 q& m8 o8 O app like this:
4 `7 |* s- x" g9 U+ Q- |) o. {: Q3 `/ e, W
BPX exec_int if ax==68
7 G7 `0 w. ^7 l o (function called is located at byte ptr [ebp+1Dh] and client eip is0 b9 ? E' R- c( o" C8 m
located at [ebp+48h] for 32Bit apps)
& O/ l7 J" o* d) N2 s( J0 n8 E e. h__________________________________________________________________________
- y/ M2 Y! k, W
( {2 N: w/ V- [/ v8 u! f
6 n* O: Y* n( D4 D0 YMethod 08 v6 \. e* f! ^2 t* i
=========4 H! I9 w+ e2 I- s9 E
- X- j) \) S; J- w7 _* H% hIt is not a method of detection of SoftICE but a possibility to crash the. w- z- ~' \8 n2 V$ \
system by intercepting int 01h and int 03h and redirecting them to another
& d% ^' g5 h$ x+ L; vroutine.
M5 B5 [( f; SIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
6 }# Z; G* [& N2 Dto the new routine to execute (hangs computer...)
# J) ^4 R3 h4 l6 o" M h' W/ O# @) Q) V5 s( m) z" ]# S, B
mov ah, 25h: e& E$ s+ R6 N/ ~9 ~/ Y- f0 X
mov al, Int_Number (01h or 03h)
7 R6 U% u+ ?+ W; U, B& f2 l% }* B mov dx, offset New_Int_Routine* y* K9 ^- o i7 r$ I( f. f: g* K
int 21h
- ]! F( ^, m/ J; S0 g; p! b* N
4 l2 h4 E6 Z/ x' T2 }__________________________________________________________________________
2 N0 t& m; \" K- Z
0 E# k+ Y v h; r7 P JMethod 09
( O n% L, Y' C* M4 ?. y3 P=========7 |6 f; y% G7 D7 F2 t- i
5 E2 a/ \8 x. p: H* y) G0 n
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only5 E& _+ Y) ?, y k/ t1 H: h
performed in ring0 (VxD or a ring3 app using the VxdCall).8 K) U0 i6 g6 ~: {3 _
The Get_DDB service is used to determine whether or not a VxD is installed
6 A q6 c' X: a$ ?8 {$ y' d2 ufor the specified device and returns a Device Description Block (in ecx) for
( `& g* F2 ]' D" m# b0 Gthat device if it is installed.
# [' S3 w4 _9 w* P P+ T$ \6 ^* O
& w; A- k! j) B mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
/ s- Q c. d% d O2 w/ f- k$ Y mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-): A- j( u" Q5 n! m3 {$ {
VMMCall Get_DDB5 [ t C' O, ]: ^8 Q: D5 v
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
7 w2 M& _& A8 z4 \. C
- _- \' i& Q0 w) ]7 gNote as well that you can easily detect this method with SoftICE:
0 h& z7 a2 T8 e bpx Get_DDB if ax==0202 || ax==7a5fh& Q; D9 W$ ^/ j8 t$ ^' h) }
5 m2 S {8 l% C% A# q# ?
__________________________________________________________________________
" S$ T7 L; q2 }: X9 ^! A( m( B' S" b. r! i* s6 r" P2 K4 t; B
Method 10
1 a( R+ n+ `8 _=========
" Q7 A+ Q1 B5 ?. j5 _2 v! J0 e/ |8 Z5 _! y' P* I
=>Disable or clear breakpoints before using this feature. DO NOT trace with8 b( T, i L$ K; B2 W" x
SoftICE while the option is enable!!. J5 N, x7 S. {( e4 v
' O8 x: @2 X* n6 J$ g( P! r# W5 Y; S
This trick is very efficient:
1 S# P6 v! q- Z/ V7 ^by checking the Debug Registers, you can detect if SoftICE is loaded
0 M: }5 y% K* T5 [' A( w(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if n" I- x2 `7 W2 n0 s
there are some memory breakpoints set (dr0 to dr3) simply by reading their J7 I* @2 f/ l8 s! u* m; h& c; t& Z8 @1 n
value (in ring0 only). Values can be manipulated and or changed as well
b4 c2 o/ r/ y$ G# V2 ^* H. q(clearing BPMs for instance)
* z' Y1 q4 D% n2 P" q% C) u! w
% _. t8 _* I2 {! Z* U- p__________________________________________________________________________* j' s9 o2 g9 ]
$ d( ^& w1 G: K; I IMethod 117 c. M6 @/ |2 H* S( h1 a' H# _
=========/ d8 `* o9 q0 Y1 L/ f1 g. L! K' }, \
, [$ r+ w* P/ A" J- F+ R4 qThis method is most known as 'MeltICE' because it has been freely distributed
3 b( W9 c3 d. p" M- Q5 j; ovia www.winfiles.com. However it was first used by NuMega people to allow
p. S( e* O* H" rSymbol Loader to check if SoftICE was active or not (the code is located
# d! ^- l/ t) b1 N+ y: n+ n/ f3 hinside nmtrans.dll).
( I7 J8 u6 d3 B4 O. s$ p' V1 v+ [( ?) a4 `% R u$ O8 W
The way it works is very simple:/ |. b3 }, c6 q9 r% m |
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for0 m" A% I: Y1 T. r% {* G; C
WinNT) with the CreateFileA API.
; j7 \* Y4 p9 q8 ]! ]* Y
/ M( G4 i3 W" iHere is a sample (checking for 'SICE'):
6 Y: `0 t# R( H7 ^) e3 I" Y5 J- L2 E% x5 l( t! n
BOOL IsSoftIce95Loaded()
; J. p* j4 M+ {% k4 ^9 B0 X1 C: D{
3 N5 `' C- J( t HANDLE hFile; F, o4 g& ?$ M" o* X( _
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,1 x+ b; K0 J/ J9 w! u/ W
FILE_SHARE_READ | FILE_SHARE_WRITE,0 ?, @* j- r1 A
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
- x: ?, b5 a+ Y- a* @: j% S if( hFile != INVALID_HANDLE_VALUE )' l" \# {/ O& `! L4 C% L6 [ i, {
{# B2 U2 p- J' y3 B( [
CloseHandle(hFile);
# `; l/ O* M' C7 d) H return TRUE;2 e3 K4 D( r! @: b2 i
}; _$ K/ b# A1 h
return FALSE;+ j6 P, q3 R$ h7 Q+ q
}
1 G: }+ u# i2 f% }% O& n- Y8 D
; E n5 b& Y& ~1 h. g0 F) W! k: U4 SAlthough this trick calls the CreateFileA function, don't even expect to be" x9 Q& E6 u- }9 z! H" _& Z
able to intercept it by installing a IFS hook: it will not work, no way!) a9 h$ A; ]7 X/ l9 @6 r
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
# { y/ b" t/ X" ^. A, [. d# sservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function), c+ ?2 K# Z6 b7 p3 f, k3 e3 T
and then browse the DDB list until it find the VxD and its DDB_Control_Proc& }: {6 }# L! s. ?8 }7 W8 q
field.
@9 ] N7 X! w; f4 X- ^# ?7 y: lIn fact, its purpose is not to load/unload VxDs but only to send a
$ m- x! W% D, }, ]6 \W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)7 i* C$ ^. i. N8 H
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
& r" [" L/ @3 ^to load/unload a non-dynamically loadable driver such as SoftICE ;-).
2 }2 b( J0 F. J' e. c7 O! PIf the VxD is loaded, it will always clear eax and the Carry flag to allow
3 x0 G) F7 p+ F* t9 O2 k, Xits handle to be opened and then, will be detected., J6 Z5 w. g% M) f5 H& C- t- j
You can check that simply by hooking Winice.exe control proc entry point2 W0 e/ X/ k2 [" c: N
while running MeltICE.- P2 P$ a4 t1 ?4 }
3 u! m8 l5 Y# |6 w1 S+ e9 [/ J8 L2 k6 f2 {) _" I* C. W. m% {
00401067: push 00402025 ; \\.\SICE/ Y2 P8 t. T: c
0040106C: call CreateFileA
2 y7 _0 k" d' P 00401071: cmp eax,-001
9 o/ e4 N) @4 M5 n0 |+ J 00401074: je 00401091
- u# H& m7 _8 L0 I" y( {% `6 W, C; J/ K
3 L/ o" m- O" k) H9 ZThere could be hundreds of BPX you could use to detect this trick.! i* {8 b/ j+ f- s/ t( B! v. d
-The most classical one is:+ ^9 ?1 h$ n7 E
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
! B- \: {$ l+ C- b, { *(esp->4+4)=='NTIC'+ E& F: j& {5 s# y
3 P# v. X2 G2 k! g; k+ W% h-The most exotic ones (could be very slooooow :-(
4 M% B- k7 l m# D- c, d1 L( F BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') 3 \: w' V1 D" J8 Q: }) p2 h
;will break 3 times :-(" g8 \5 F! {* y1 a/ l
h4 g( N) ]7 V- b$ z-or (a bit) faster: ! `0 I: C2 {) j# o( I! h$ M* o
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
, i) \) `3 B, k+ y Y
5 _ |! N1 @0 @7 r& f BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' # C' e1 F. @9 D- E3 k% \
;will break 3 times :-(7 D# u8 F5 x/ r2 Y5 j& E
& S9 d* |6 P0 L7 K6 ?8 W-Much faster:
+ z) N) C: J+ j) X6 L BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
: f/ D% i% d3 d- W& [: }- A" Y: U& C/ e# ]6 ^' j
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
* G( |) _# r a: u1 N5 C; `function to do the same job:1 p* y' ]; S9 A' h8 B( p/ ~* m
0 _% n& q3 S3 `4 k) s push 00 ; OF_READ
- y! B, Z, F; b* ? mov eax,[00656634] ; '\\.\SICE',07 R- N6 E1 P; r% |( a
push eax' v9 n* m+ k& j, C
call KERNEL32!_lopen
/ z7 U% u0 e: z; h/ y inc eax
T2 e! E& \1 d- Y* E jnz 00650589 ; detected. `4 W5 Z4 t, V& o
push 00 ; OF_READ6 I0 U/ l6 M3 Y K' O. e2 d# X
mov eax,[00656638] ; '\\.\SICE'
' F% ^: q E, r+ D- B, j push eax
- E- \* E r. ?) { call KERNEL32!_lopen: b* e6 R+ d: {4 a
inc eax
( }" }0 u4 |" V9 ]( B9 l4 e jz 006505ae ; not detected
8 h* f+ ?5 f; X+ A: S6 q" Y3 v) U: D2 Y) Z7 V# F! s
- W- d: P5 [% O# x
__________________________________________________________________________
3 N2 N( ?+ @6 p7 O& ]0 H( _2 D2 W1 Y
Method 12
c- b9 c" x G4 Q) e. d( {7 c=========
" m. x& ~, ^9 w ^/ X/ G$ G+ G- Z9 u' z( D5 O( v
This trick is similar to int41h/4fh Debugger installation check (code 05* G% ]# t! h* w" U) c2 U5 U0 G
& 06) but very limited because it's only available for Win95/98 (not NT)
5 ~( W9 ~+ H% o" L: was it uses the VxDCall backdoor. This detection was found in Bleem Demo.
! ~5 j' R% o w# k! e) P
# i4 A( [3 M$ ]1 F# r4 b push 0000004fh ; function 4fh: n; x6 S+ v& v; z1 y# s' q2 m
push 002a002ah ; high word specifies which VxD (VWIN32)7 i2 p; W) Q* W( \# ?. I
; low word specifies which service& ^4 h7 y/ j( {1 _0 }- ^
(VWIN32_Int41Dispatch)* W7 T+ u3 d1 s9 l3 ~4 K- X+ F
call Kernel32!ORD_001 ; VxdCall, Y; e: j# x3 e. ^
cmp ax, 0f386h ; magic number returned by system debuggers
+ {0 G3 X! e; }, [2 i/ h2 A" J jz SoftICE_detected
/ w" U. d* } [2 k
: l7 S1 J5 P5 u7 u+ ?2 W6 Z( @. @Here again, several ways to detect it:
" e* L6 }/ W2 [# I4 I* T
6 b) e: P( _+ D( A BPINT 41 if ax==4f
q1 l+ x" ~: [( B3 e* c+ I6 G; n1 ?0 H7 Q
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
( A& f' B) |( U7 e9 C$ O5 y( ^- F' Q6 R0 i5 F* r, [9 ]
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A2 M- v9 p* j- L8 G2 s; F" L
3 x% I6 S0 s: U6 x0 ], Z
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!& ^ Z* e5 b; w' e
" h; ?: i" H7 P) n- g. f
__________________________________________________________________________
4 K% I" W; M; T0 N K# i% L- u& s; w* ?
Method 13" x4 ], |" ^. e3 h
=========
& ~" y5 Y/ b: c$ [0 q2 N- x
7 R2 t9 ^/ c; [2 X7 U/ F7 MNot a real method of detection, but a good way to know if SoftICE is
5 w( h4 X% W% h+ T ^installed on a computer and to locate its installation directory.
) [( F0 `' w# E7 a1 A1 @It is used by few softs which access the following registry keys (usually #2) :( C5 H/ s T% d# h. ^# @
" e5 I0 u8 M) S. {-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion h% U6 O2 s" z. m
\Uninstall\SoftICE# `+ m! |; x2 [- R8 g4 k( [! O
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE. ]! N4 H8 E. `
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion3 _& \" |2 y, J0 E' l
\App Paths\Loader32.Exe; P8 R5 Y3 ?8 e8 m) X. K3 J
; p- D5 f1 Q( U. z, l+ ?; ] {6 r( E3 d
Note that some nasty apps could then erase all files from SoftICE directory5 f1 B' R: k+ W( r2 E
(I faced that once :-(
# u2 H4 v8 v1 G1 ^8 Y: ]1 E. i
- D) W/ w+ l! t7 [ H) \; vUseful breakpoint to detect it:
4 S- T- C' j9 N, i1 h, Q# a6 P7 u: @ j0 B" Z. r+ G
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
~; D; Z: a1 Q* W2 M2 j
2 t5 q2 o% m/ g- ^3 Z" o) Q__________________________________________________________________________; [3 H0 L2 H/ Y" I2 w" d* X+ A
! I& v: f# ]" T! V; I1 T* H5 Y
& _7 e6 x+ x, n3 H: ~, Z H2 XMethod 14
" }; X Q6 ]5 T) l: ^9 Y=========0 V0 Z& {( W3 t, K& j: u
4 ?" m4 a" x o; s( E
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
$ w a/ {7 R& Bis to determines whether a debugger is running on your system (ring0 only).
/ M' n. `% ~$ E' q/ g4 D
7 K" P8 B. @1 c$ S7 r8 a) I VMMCall Test_Debug_Installed% {$ M/ L7 S) _
je not_installed% R$ G0 c4 A8 n' Y4 H- m" k
) b: g1 K5 A/ @; Z# M
This service just checks a flag.8 C @ n* K/ A, V( m# A% V% J
</PRE></TD></TR></TBODY></TABLE> |