<TABLE width=500>( t5 s+ F" X: k8 o6 U
<TBODY>
# u& f5 M3 X7 B( J+ G' w5 Y<TR>
4 H; O7 Z: E7 ?5 i+ k$ q# a<TD><PRE>Method 01
+ R4 z# r0 v2 S' g& \: Q6 Y1 k; Y=========" X9 |- V# z9 H
( m, K+ P u- c7 ~+ ^) t; c
This method of detection of SoftICE (as well as the following one) is% y' t `7 k& I' J4 q i/ w
used by the majority of packers/encryptors found on Internet.
; j- |: g" t' c$ OIt seeks the signature of BoundsChecker in SoftICE7 j' e: T3 C. }" Z! S6 D& I
; l$ Y5 ?' N2 [ mov ebp, 04243484Bh ; 'BCHK'
7 _" e1 p& `& h- W* B mov ax, 04h" Z' ]4 U/ u6 o+ Q& S6 g
int 3
J; M B; S% \( Y( e+ Y9 y cmp al,46 Z- X9 Y) }* r$ ^# A
jnz SoftICE_Detected* }2 ~! y6 L c- |* j7 X8 p1 ]
4 L& @6 R( A+ t5 @
___________________________________________________________________________
* ~$ S* V. G- d( a- E6 v0 l; B
3 C$ |0 G) O7 z2 {1 _Method 02
\) j$ x7 z, ]' [: o=========: B9 u N; T# r4 r2 e. X2 }
& x z& D9 E4 |% _$ u* ^Still a method very much used (perhaps the most frequent one). It is used
- ] h' Q8 N9 c) G' R4 K/ s4 S eto get SoftICE 'Back Door commands' which gives infos on Breakpoints,$ V- V$ Q, I% a7 p$ D( U
or execute SoftICE commands...+ o9 f1 A" Y3 n
It is also used to crash SoftICE and to force it to execute any commands
2 a! d! i/ T4 v7 ^5 _(HBOOT...) :-((
3 E+ q5 V) }: }: w* ?7 S' q: u+ y0 H- D* z
Here is a quick description:
% e. C7 I5 p3 }% |& ^6 S" C-AX = 0910h (Display string in SIce windows)
: n: S/ h0 C. b" r% g$ T-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
2 j. J. g3 ~( o! H8 a9 x( o-AX = 0912h (Get breakpoint infos)
( f4 F2 w, x7 ]. C2 g" u-AX = 0913h (Set Sice breakpoints)
* y, z& o" d7 \$ I$ }-AX = 0914h (Remove SIce breakoints)
7 B( [/ ~/ D+ f: q' p+ @/ o2 b8 R+ o/ q
Each time you'll meet this trick, you'll see:
3 q% q3 e" b3 N: z1 m* K1 z( l-SI = 4647h9 O% S9 N! F0 g! O. d
-DI = 4A4Dh3 t0 I# n8 n2 H$ \
Which are the 'magic values' used by SoftIce.
% N/ I( \: g q& M, WFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
9 t+ O4 D3 U5 R; R% G, _+ L. [7 d3 G
Here is one example from the file "Haspinst.exe" which is the dongle HASP
- Z# p5 ?5 ]9 a; T1 EEnvelope utility use to protect DOS applications:
+ a1 t; {/ N6 H3 @4 B% L
: ?, {- J3 i# Z% t( O) z) P
8 z; p) k7 Y D$ h: `" T& K" R( k4C19:0095 MOV AX,0911 ; execute command.
5 d& L N$ Z9 l$ _8 l4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
# o2 r a. ?0 J8 C9 G( [; E4C19:009A MOV SI,4647 ; 1st magic value.
R. H; ] r, `% ]' p5 r4C19:009D MOV DI,4A4D ; 2nd magic value.
g! T3 S- q, X. c4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*). Z" E- B" t) @ k9 b- W2 ?+ I
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute) P f ?/ B0 M3 z r; Y
4C19:00A4 INC CX4 J/ k) L* c7 m+ Y1 ^$ M
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute' q: Z B. k# b) S# t" w0 ^2 u
4C19:00A8 JB 0095 ; 6 different commands.
( f- R5 P1 a2 P. I4C19:00AA JMP 0002 ; Bad_Guy jmp back.2 N0 j1 b$ T+ L' @! {* R
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
; D) a6 p. @# b! t( s
. L% L# U; @% M, ?* g' ^" z! K1 AThe program will execute 6 different SIce commands located at ds:dx, which _3 I! s; J0 `; q- e
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.1 ~3 Z; B! T! O
- \" C5 m. D3 x* f& H4 H/ N5 {8 T6 p* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
3 Q! I. N. h* b X___________________________________________________________________________
1 t( a! C9 x) V( F# W+ M: l: A4 M" M/ k
! t8 W: P% i6 mMethod 03
2 b% \/ O. e' a) O6 z=========6 k3 ]8 s* r1 a: F# c
3 g# [) ~' G2 G8 Z5 v$ x: a# [
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h( {4 B! A, i* W! j4 Y0 K ]. U Q
(API Get entry point)
) V2 k5 ~: d. A" O1 D
6 ]9 ~1 C* X! _ z$ Y/ p4 `. b6 {# I2 I+ e" r8 W9 y, b. }2 ]$ {' ^
xor di,di1 E4 N2 W, H. m" A9 N8 l$ z* D
mov es,di+ F4 B: [! v8 m( t7 [8 l
mov ax, 1684h
) L& E) f |1 I2 M" j- D) M mov bx, 0202h ; VxD ID of winice* R6 P: T0 j; `3 G+ f
int 2Fh9 j: b* c, F; @/ T
mov ax, es ; ES:DI -> VxD API entry point
( }, n x7 }2 c1 ?% ^$ q2 Z add ax, di
; Q. Z* i# T% G1 O7 D test ax,ax
# T( C l( H$ p/ l* x3 C" o$ j1 g. k& l jnz SoftICE_Detected
& b& t2 B2 }* j2 k8 }2 s# K
, d+ o# A8 W$ [" l% H$ {" I___________________________________________________________________________
3 {9 |( y5 O! z/ `2 c) e5 X% r# H3 M, G$ }
Method 04, R6 N4 V& O6 U& }+ \1 R
========= C+ ~, {9 F' I$ ^) E% a! T; {
: ^% B4 w8 W3 A% Y0 e( V8 Y t
Method identical to the preceding one except that it seeks the ID of SoftICE
. b' @( @# D; j5 fGFX VxD.2 ^# F. l7 a( N. N3 p1 [) i
~ @0 J; X* _9 _$ v9 h6 Y xor di,di
8 z5 N, w7 C) y$ Z* r' U9 f mov es,di
# V4 E8 ?, ?% L8 C7 T4 S/ t! Y mov ax, 1684h 7 X* n4 _& y- h) _' }
mov bx, 7a5Fh ; VxD ID of SIWVID" h. K5 ^2 X0 h3 x
int 2fh' t& m) F$ C- I9 j* q
mov ax, es ; ES:DI -> VxD API entry point# B I+ g- s/ H) w
add ax, di
: P0 W% @' \) E* B9 H( Z test ax,ax$ y4 B! e2 K9 C* t
jnz SoftICE_Detected
) y8 p/ q% Q6 O7 V2 u. @0 }( V3 L+ e0 T( ?( n/ b. w8 S6 J
__________________________________________________________________________
: U& t5 t9 ~- N' `0 [$ e; r1 L2 b) n
E& F* _+ \* {9 Y
Method 055 M# F, S' A! E$ E
=========
: q% [" a. s' ^0 L+ j+ s8 R a2 b I6 C1 V- ~, i! s7 I7 H
Method seeking the 'magic number' 0F386h returned (in ax) by all system
' _# \0 F) r3 o& kdebugger. It calls the int 41h, function 4Fh.. |% r1 y0 Q2 z7 j; a( a/ ^
There are several alternatives.
( P& [, K' L, }) s1 b% L: \4 l% Z6 ~* Z; E- M
The following one is the simplest:& f6 W. v$ l8 d7 R. L+ v' a( c) C+ W4 [/ K
* r7 o& [9 X6 ^5 J- ^ mov ax,4fh* b" q! b% v) l4 j; K- v
int 41h
. S1 O" o- i1 K/ ^" H9 H cmp ax, 0F386 b8 d# _! Q8 D" H1 u3 s% @ \
jz SoftICE_detected
; h! M. f( n; p
$ `% y7 `; k$ s/ m2 E# c6 H+ ~9 q6 e3 a# R8 I" c
Next method as well as the following one are 2 examples from Stone's 6 G* \4 z; b0 S
"stn-wid.zip" (www.cracking.net):
3 W K5 a% r8 u/ t: `: o7 ~" M. [1 P8 p$ G3 k
mov bx, cs3 f, X# J. c Y+ V3 |
lea dx, int41handler2
. g' _+ ^5 D2 I+ Y xchg dx, es:[41h*4]
0 W- g. \1 c3 `) Q. y. o2 V xchg bx, es:[41h*4+2]
5 T, }' i- ]3 p5 [" |/ C3 F mov ax,4fh
% r3 Q7 t8 F9 _2 w# q* }8 a, x int 41h
! s$ E1 U$ H$ j6 ~% L xchg dx, es:[41h*4]
& J' E$ U+ ]* X- V; k1 O xchg bx, es:[41h*4+2]; ~2 n3 Y/ N# I! ~
cmp ax, 0f386h
% o' | M$ G4 B5 b3 K5 ?, s jz SoftICE_detected& R! b2 W5 n+ u, ]# N* ] d7 B5 q: L
. T& G! x4 o4 Q, P% a8 f* p
int41handler2 PROC1 i& @, x" N' |: q
iret
9 B7 _4 n# y1 R7 rint41handler2 ENDP
& j0 Q( c0 G. Q1 _$ U6 Q! w: y2 n9 f
8 m6 C, ]- j) z1 m% P: \1 T0 V, b_________________________________________________________________________8 A0 \/ C L/ Q% A' a# S6 \& }
8 A/ | [8 |1 W2 Y. R$ `
" R) v9 A" ?2 e9 P- [Method 06; L4 L: g* B" n/ A, f
=========% ]% [* @; @$ m1 G' R) G
& R4 v( Z+ X0 w. Z
- P3 A; A( ?( S7 ^2nd method similar to the preceding one but more difficult to detect:
- \. p$ D! Q3 L' d0 J4 B' L8 U' U; W7 Y0 W! ]4 e7 ?
- Q e% i# Z6 T8 k: V+ A: X
int41handler PROC
' b) c% \* ]: S& ^; r2 E$ W# S, h mov cl,al9 L$ [& }8 d# ~/ j& A4 k
iret
3 P3 y4 Z) [' R( `6 ^, mint41handler ENDP
0 v( X# [4 L: o# e- R( x; }. p
% F% N/ G1 ^7 W5 |# [# ]# R! V" H; }: n! w" X) z( \7 K
xor ax,ax2 {- [7 H" t" c0 o6 R
mov es,ax9 L: X/ ]# }! N( C/ B y9 W+ W4 y
mov bx, cs
& R. d8 Z4 r' r lea dx, int41handler
2 Z. R4 r% c u7 ]8 p xchg dx, es:[41h*4]
+ D9 I0 f) X" p$ r0 m2 G5 O+ B. B xchg bx, es:[41h*4+2]
: Z& c1 D( b1 I L& N in al, 40h
5 w. b. F9 X3 D xor cx,cx$ ]1 ?" c) O$ Y* E) z) o
int 41h$ M8 c Q. E* r
xchg dx, es:[41h*4]
7 F, m: X+ y! C, [6 w1 S! D& F xchg bx, es:[41h*4+2] V4 A8 G( R4 n1 J
cmp cl,al! b/ l- K. y: D9 v
jnz SoftICE_detected- n! \ ~4 j: i9 `7 k$ K
; Y; f9 j- O" B1 ^ C8 B s_________________________________________________________________________
# e1 v9 l# y# b ^4 c; s
R E9 N: O- [) }: J5 k1 DMethod 07
8 p. }8 o* G. v& p% [ m=========
7 F5 n* B h' L0 @3 a" E
- z$ a; z0 Y- L+ D1 W) f4 [, OMethod of detection of the WinICE handler in the int68h (V86)
7 o- g" |& {' R
6 H ?6 r, f. X mov ah,43h
5 [# ~, H0 c) I+ C; C4 `% c int 68h
5 s: C" d. t& Y% N# { cmp ax,0F386h$ q7 w) f% W. V. v7 I8 q" E2 @
jz SoftICE_Detected# t6 h; O7 k" R8 S; U" ] c
- c" |. c0 Z* w0 T
2 ?' b7 h; N/ D* s: [=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
: N/ v# e( K' ^, u- x app like this:
* o5 y/ t2 S) e' J* \- a8 u/ @- Q( ]1 `; ^, F
BPX exec_int if ax==68
1 L; {7 J% A2 u) b3 `( X/ S (function called is located at byte ptr [ebp+1Dh] and client eip is
) s. v! y. U4 X- {, [! O7 @* ~+ Z* T located at [ebp+48h] for 32Bit apps)
" p4 g! R3 i0 }; X" S$ G5 D__________________________________________________________________________
& x' l( Z% d4 g/ I5 b4 l! P/ C' t6 c
/ _1 f0 s: G7 Q. F9 s" \Method 08' A1 w k" q; C) |# m; ~
=========1 k6 Y) v$ Y% G# L
2 |) Y) r% f y
It is not a method of detection of SoftICE but a possibility to crash the9 }1 k4 _6 i# w" W2 w; Y: R
system by intercepting int 01h and int 03h and redirecting them to another
/ ?: r* \7 ]; b [' aroutine.
7 F) e6 i* h2 T, a+ ~7 rIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points# e* b/ b3 }8 i7 k% d8 a+ y1 ?
to the new routine to execute (hangs computer...)( ^, D; N3 F* n
3 D& C) x1 @2 Y8 C mov ah, 25h" `; H L m3 n
mov al, Int_Number (01h or 03h)
( y5 p. s4 p9 U9 M mov dx, offset New_Int_Routine
; p! b3 v9 ]; E4 i9 P int 21h
* c3 H' r+ U# o. c' M: f2 O- T& v& a/ J. V6 I3 w6 b2 t* k4 ]
__________________________________________________________________________
7 b6 c" w. b6 l% Z w2 r4 h. t% _" u Z' B- d
Method 09
# V! U0 a3 ~4 U$ g% U3 v) ~' q=========9 x/ ^' ^5 p+ J5 D# `
1 J4 y: }2 l# J) B) xThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only' e6 [: w+ }' A* Q) S# a
performed in ring0 (VxD or a ring3 app using the VxdCall).
: @6 I8 ~4 l! L5 ]3 hThe Get_DDB service is used to determine whether or not a VxD is installed j+ `$ O9 `) \
for the specified device and returns a Device Description Block (in ecx) for+ T' g+ M' f9 i3 B* w' k, X3 G
that device if it is installed.$ E; V8 V- @2 e( }
) \4 K- P2 E: X9 V& p5 Y8 R
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID0 h. }- |7 V& v6 l% O: @5 E
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)# X! C) d2 W. N7 a2 a
VMMCall Get_DDB# Y. J0 g0 X) e! m( a8 H r( V
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
3 @/ H" z& D) ~: Z
# S6 J4 a% a3 |& r( CNote as well that you can easily detect this method with SoftICE:( r8 y1 d- Z" g+ X4 p
bpx Get_DDB if ax==0202 || ax==7a5fh
$ N" f. S$ p# m8 J& H6 m+ R* w9 g- x) G2 P2 _4 N1 a
__________________________________________________________________________5 u. F: c$ G) ], Q
, j2 d! {$ ~0 _2 U4 e7 e
Method 10! \3 ?0 M3 ~+ U! A9 {" J( _
=========
: S1 U c: n4 F3 S( O. l+ K9 c3 D6 m# S% A1 I9 ?7 _
=>Disable or clear breakpoints before using this feature. DO NOT trace with
9 h7 P: |2 l0 ~2 I2 T' B% p SoftICE while the option is enable!!) U# c3 R0 ^0 Y* U& J) E
6 D/ o/ T: m4 ?9 X: W0 @0 z! R; ~; v
This trick is very efficient:' N7 X$ g5 F q7 I2 g% N
by checking the Debug Registers, you can detect if SoftICE is loaded
9 o# J7 L$ p' c$ L(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if6 ]- b7 b: f$ P {
there are some memory breakpoints set (dr0 to dr3) simply by reading their
, l; l d) ~- V8 \value (in ring0 only). Values can be manipulated and or changed as well
3 w6 i3 J! U- D* Y+ m+ _ z7 `. m# c(clearing BPMs for instance)
8 H1 @% j o" @/ X2 u d/ v! a7 d/ I2 V1 f" Q
__________________________________________________________________________; K+ D+ r$ G- s e
) m, ^7 C, j* O1 hMethod 11
* f- w6 P$ K$ }! s/ K6 n Y e8 M=========
$ S( y+ F" p9 s2 o4 N
& g, b3 u9 L9 A4 l+ P: @This method is most known as 'MeltICE' because it has been freely distributed* @. u1 y3 p* q9 u* b& s3 ~. A
via www.winfiles.com. However it was first used by NuMega people to allow
- K: G0 G7 N- |; [8 J6 z1 g: ?. WSymbol Loader to check if SoftICE was active or not (the code is located
' `6 n7 E2 |" S1 m. {9 x! J* _8 ainside nmtrans.dll).
/ {' N3 G" s% ~, I
$ m0 G u* }! _9 `# L4 P5 s$ BThe way it works is very simple:/ ^9 u2 v. b3 @5 `
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
) Y j! \0 ^) f% n, zWinNT) with the CreateFileA API.; a6 }5 {; D, |0 |7 M% u
6 L+ Q. l2 K2 J n/ R4 ?: g& rHere is a sample (checking for 'SICE'):) `( d; Q: q6 m. Q( x$ o
6 }1 V; `9 X1 I7 m; e3 y* N5 rBOOL IsSoftIce95Loaded()
1 J( L5 y6 P- o* e$ n. w2 R{% p' C, ^& g3 T* Q
HANDLE hFile;
6 O) t8 ~ i' T9 ?& f, B! m hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
! U5 w6 z# O. Z7 P FILE_SHARE_READ | FILE_SHARE_WRITE,3 e' [7 R+ |9 a6 ?, [
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
2 [0 ^9 t& P9 g. F, C/ ]5 A if( hFile != INVALID_HANDLE_VALUE )
0 t! o* c: K* Q7 O8 t) P( q1 l7 l {$ [ L: h; K: I/ F& D1 C4 v( u
CloseHandle(hFile);( l* V, S; {/ `4 o+ B5 Q
return TRUE;
& n1 v8 f% m* J2 T( l* L. q1 ] }0 h+ n7 Z" m# F4 k3 H- w
return FALSE;5 S$ z/ P& A. `/ g
}
$ V* G( X! K& O, g, S" S
" V# k" F+ s# G! ^( FAlthough this trick calls the CreateFileA function, don't even expect to be" H( Y" i( j9 {* K$ J" s8 U
able to intercept it by installing a IFS hook: it will not work, no way!# D9 T! W3 o& f: _' f, f
In fact, after the call to CreateFileA it will get through VWIN32 0x001F0 o1 ~+ u1 k5 U, |
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
' l( o7 _: V! jand then browse the DDB list until it find the VxD and its DDB_Control_Proc8 ?* N% }1 R" K% c; @' P
field.
4 _4 Q% r: W1 _4 VIn fact, its purpose is not to load/unload VxDs but only to send a 4 v4 ?. p' _2 G
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
: ]0 j4 Z3 I0 B' |: c+ W1 u8 Gto the VxD Control_Dispatch proc (how the hell a shareware soft could try
* z9 a* \, _! ], hto load/unload a non-dynamically loadable driver such as SoftICE ;-).: T1 N) u, j8 o1 j# D; L6 e
If the VxD is loaded, it will always clear eax and the Carry flag to allow9 G/ E. I1 p1 y( H
its handle to be opened and then, will be detected.
$ d! [ M# h! ]* AYou can check that simply by hooking Winice.exe control proc entry point
. q8 x2 n. f7 B/ H% s8 m! I$ bwhile running MeltICE.
' @) N( y @9 l1 O9 u5 ?
' L0 X) s) V# e) B; X3 }2 ]. ~* _+ }
00401067: push 00402025 ; \\.\SICE9 U: j. _1 o5 ~1 E9 b2 @
0040106C: call CreateFileA
( x* G2 n2 x! _ r7 R' Y 00401071: cmp eax,-001
* q- @4 \3 T) f' n( n, b% R! x& j1 Q 00401074: je 00401091
' u: ?0 q8 o, A/ l- i# }) v
7 G8 }' Y0 X- L+ N# K
7 J& p8 q& P5 U" y P) O; _) a( rThere could be hundreds of BPX you could use to detect this trick.
- o- K! n, g5 P/ r- }! r: K* A& x-The most classical one is:
+ k' o& u, t5 A R9 t2 C BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
$ E: d/ f4 Y7 n9 y% g *(esp->4+4)=='NTIC'3 r! q/ w& N6 a4 `' }# @) ~1 k
8 `0 T( _ m+ R4 I6 Z \
-The most exotic ones (could be very slooooow :-(
' |" P. l5 {& F" c# \; l BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') , j( [2 p: Y; ?3 f" p) E' O
;will break 3 times :-(! J* i9 T1 V8 A# k$ M) y" P
, l% p! E1 A1 K$ h: Y5 W
-or (a bit) faster: 1 w( K r& @, K3 n& {
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')) d0 ^* `! i: |7 E4 o
7 Q6 K) \+ c+ R9 _5 | g7 X! T' n5 s9 C
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' ) d m; q2 e! X7 Y4 ~
;will break 3 times :-(" a. L. V! ]9 Y0 d; [& Q
1 m9 M9 L! K! k) \0 v! N o7 F-Much faster:
. j" A8 p) v4 |. z0 T BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'" p4 h! {+ J. s0 t
! m: |) N) D, Z8 I
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
5 ?: h5 Q' t: f$ Bfunction to do the same job:0 a: ^# ?7 _- c5 v" m* }8 B
+ j/ g. R. t* j$ C# g
push 00 ; OF_READ4 m' N/ F" L" y1 k( S
mov eax,[00656634] ; '\\.\SICE',0, p5 A8 R3 u$ j4 D! H
push eax
3 ^% I) R. V' m% X! A0 A call KERNEL32!_lopen9 i9 I3 Z2 R a5 G8 Y9 g
inc eax
/ R$ x6 X" i7 g! s7 X$ ` jnz 00650589 ; detected
& e( [- T# Y) b* M1 J5 } push 00 ; OF_READ
2 v I- V( A1 T. {% | mov eax,[00656638] ; '\\.\SICE'! R& s, a. c# g( l9 I- S
push eax
% B9 p* k A% I call KERNEL32!_lopen, s% d2 ^% t* N2 m5 X" p5 o- {" ^
inc eax3 n9 b/ n2 o; f: j2 \4 _# {% i; X1 E
jz 006505ae ; not detected
_, O; _# @8 Q* T' {+ i% @% s% j0 q: s
% U! \7 X/ i" x" f7 P" g" N& ]* i
__________________________________________________________________________5 `! X$ \) P% i8 [# k
, Y9 |. j) a( \4 Q: ]4 ]* y; _
Method 12
3 p, S$ A# K- g3 a( G. o=========
0 G9 |2 E+ p! i& O6 a! p) w7 P0 ~- O3 e
This trick is similar to int41h/4fh Debugger installation check (code 05
* H, z0 Q0 O9 U- v- e# k& 06) but very limited because it's only available for Win95/98 (not NT)+ o! }$ U6 {- `) Y# h
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.: E8 _! [# g( ]: K
* r- s" l* i- h, y$ v
push 0000004fh ; function 4fh" [. f4 B, M! b3 U
push 002a002ah ; high word specifies which VxD (VWIN32)
" o$ |1 v% N+ ]. _7 G ; low word specifies which service: a. y+ Q9 {& K* l2 X' O
(VWIN32_Int41Dispatch): q3 N0 ^" P+ q1 H% S
call Kernel32!ORD_001 ; VxdCall
9 w. h) b0 |5 v' L' [( B* Q6 W0 C cmp ax, 0f386h ; magic number returned by system debuggers
6 P) y! | U+ J4 I' K: {1 O+ S jz SoftICE_detected6 X% o x6 U) c# `
2 B7 T ?5 |: K/ n
Here again, several ways to detect it:: \3 Y3 U( K# }% P& W
* p8 G X: z$ W" Q( F BPINT 41 if ax==4f5 |1 D+ L( g6 |+ t: d
4 j# v, u6 E6 A
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
- O. a$ Q6 f- f+ Q( N
) }+ Y. j; m$ k, ]. i% q BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
+ t$ G8 C: P% R2 C. g5 }# o! {4 \( x o3 d
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
! x: |5 Q9 I9 a8 x8 O
3 ], R7 G: F2 s, H" Y__________________________________________________________________________
4 u* b- X( R) I
" ^/ P) d1 j& o. o1 n# PMethod 13- K# } b: ?" @8 X+ Q
=========
7 c5 e* ?- E- y3 G- j! N: S& J. r
Not a real method of detection, but a good way to know if SoftICE is
4 [' t7 a. e* C# V2 j% Minstalled on a computer and to locate its installation directory.
. R3 |% O) H0 @. ~ q# N* z7 O# lIt is used by few softs which access the following registry keys (usually #2) :
, ?0 z, s" k2 X' A3 v
/ c& I0 K' P2 x3 V' f$ ]. t-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion# w1 f |1 B! ~1 q( ^
\Uninstall\SoftICE
! n, ?! I3 `4 w- T# k-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE; i: I2 b7 ^! q0 S8 ~& j
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
4 a7 W( d' p) b3 \! r+ c1 G\App Paths\Loader32.Exe
0 a+ ^ K. Z. X/ A; C, z0 r
* W1 E8 o( o6 P" C( j" q* F m2 ]5 F
Note that some nasty apps could then erase all files from SoftICE directory: A& k; z. O9 p. }. y4 J
(I faced that once :-(
+ C# y) A: S, ^* v" N3 d D1 t% U- W
Useful breakpoint to detect it:
+ O* g s3 ]8 j$ Y' S) r
! D4 K/ E2 v$ B2 Y# ~ BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
" n! Q1 u/ l( m6 m/ z
8 k# d5 Z9 i+ C! D: x__________________________________________________________________________- Y" ^( w6 U' x6 m
6 \, x6 z! q/ A: N; r! T# x0 }8 v$ I& K e! V( U6 p+ Z. S+ p
Method 14 + K x7 R" p9 a G" o! w4 e
=========& ?; h1 `. g+ R5 f8 X+ T9 X
5 j2 F0 n' h& M4 X' q
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose' L7 P' `* ]6 X9 c& C# u( |
is to determines whether a debugger is running on your system (ring0 only).
2 @7 [% R- v# y
* q" I; s% b1 R& A+ h6 i VMMCall Test_Debug_Installed- d& T5 q6 {; B3 x8 r+ U
je not_installed/ i- [+ o8 y9 j' {
: [6 `/ G, q# ^- a* R" dThis service just checks a flag.5 `; w1 a# H$ E* o
</PRE></TD></TR></TBODY></TABLE> |