<TABLE width=500>
9 x7 ~) u) u- j<TBODY>
0 r6 `" z8 K! o5 X. F8 s' J<TR>
* ]9 v& Q& j9 {9 R5 }' F<TD><PRE>Method 01
+ ]& d8 {! H+ r- H/ l) j- k=========6 @3 t6 b" Z+ X1 e
" Z- P( I" C- H+ S; D* F lThis method of detection of SoftICE (as well as the following one) is. c3 `: \* {' L; ~' b/ ~, y0 w+ ]
used by the majority of packers/encryptors found on Internet.
8 g4 w. |$ m, h, }It seeks the signature of BoundsChecker in SoftICE
7 ~& `4 x% T. _ Z3 A2 z9 C; o% A2 d$ o4 i
mov ebp, 04243484Bh ; 'BCHK'% Q' e z- a; }# P7 P, H# v& ]
mov ax, 04h
( | Q0 f( c! b7 w+ y; H& h int 3 2 v# a1 e, c3 q, ~- l/ B w
cmp al,46 F) B; W$ X! v
jnz SoftICE_Detected% c. ^6 e# d1 K
3 |8 B6 p5 L1 J& c) S+ l) d* q) p
___________________________________________________________________________
) H8 w' C7 A" M+ ~ Q4 T$ W
) `/ n$ Q3 k! H7 l' v7 g( r2 Z& @Method 02% `4 J/ b! k3 H! D3 O
=========
+ p" M3 z F+ i' f; f
9 z/ C( m2 h8 e; z# M1 p" NStill a method very much used (perhaps the most frequent one). It is used
3 h' L6 R. \2 v9 K7 m; r. gto get SoftICE 'Back Door commands' which gives infos on Breakpoints,0 |/ I6 |7 s" U+ b$ M- p9 O! B
or execute SoftICE commands...
* z" }+ x. X" r' Q0 n4 h; eIt is also used to crash SoftICE and to force it to execute any commands' n! d' O0 ?$ ]
(HBOOT...) :-((
) ?+ f7 a. P# c) X4 n6 M
6 Z( k5 ]- X+ ?Here is a quick description:" s) X. W2 G' m8 W @. B' s% q
-AX = 0910h (Display string in SIce windows)8 _. s- c- Y, \! ]) M
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)6 C$ u3 j8 U2 x( |
-AX = 0912h (Get breakpoint infos)
; s( X8 v9 P0 q' Q; G4 M: Y-AX = 0913h (Set Sice breakpoints)# n% H% V$ X8 Y. O; Z. q
-AX = 0914h (Remove SIce breakoints)
3 i8 u! O1 _+ M$ B! l/ X$ `" U/ i2 L9 F' L S( N# T
Each time you'll meet this trick, you'll see:
8 }8 @* x+ k; p-SI = 4647h
( m; {- e% n! q! B-DI = 4A4Dh" I7 b5 B% _$ h9 @' i3 n6 P
Which are the 'magic values' used by SoftIce.' @2 w& d6 Y3 e
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
* J. X; S$ s# N& j' L! u# Q# m& o
Here is one example from the file "Haspinst.exe" which is the dongle HASP
5 V- z$ ]1 F' o& \, P8 j0 \* `Envelope utility use to protect DOS applications:
& H. J, G/ N' F
, l" m4 f0 y( I+ e5 H" Y$ U/ D k' s
4C19:0095 MOV AX,0911 ; execute command.
0 {. R1 I: Y, H4 c6 s& \* J4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
# n$ f1 Z i H' @0 t4C19:009A MOV SI,4647 ; 1st magic value.2 j- D: d8 V+ C& i
4C19:009D MOV DI,4A4D ; 2nd magic value./ l; _( n7 k6 u( j1 V( }/ ]7 e
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)) `* ^: N7 v3 V8 Z
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
" o, x0 z3 |; I: G' V- K1 M) U# P4C19:00A4 INC CX7 I& t( t; n( K: q- n0 z7 R
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
& p% h4 C. T9 }7 S! @3 ?# q; c1 x4C19:00A8 JB 0095 ; 6 different commands.+ b) E$ Q" a+ j9 |6 v
4C19:00AA JMP 0002 ; Bad_Guy jmp back.0 a+ U; ^/ s N8 A
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
3 O8 j2 Y! p4 A. P: `" p9 q3 u1 ~, J2 o; S# _/ N) X$ C
The program will execute 6 different SIce commands located at ds:dx, which) s, G7 ?$ u/ e0 p
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
" z+ F, |5 }0 F" V9 \, K# z
3 O/ q/ `+ Q: p& g7 g$ V" U5 o* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
5 e9 \+ b; v2 M' e___________________________________________________________________________- h& D5 o: o6 b8 t% ~! |
3 U# Z0 k/ R. B! i ]
0 l9 X& i) [- t/ |7 ]' s; v) AMethod 03
) r) }7 w, k+ h5 t9 D* {* V=========& U% q J. N* F3 P/ C. `( Z& y
7 |6 T: \+ F! R1 y
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
4 ^6 k+ G# s; P& ?! I(API Get entry point)
( l+ d! m7 U8 J9 [9 T 8 o! i* B) C& b8 g9 {
3 H; p, x3 D, ?. S" {$ g$ b* G
xor di,di G: ~2 Z) E1 M8 n* Y' b
mov es,di
) P$ R1 z0 T, h) F$ {2 L mov ax, 1684h
! k( i! Y; t* R* m mov bx, 0202h ; VxD ID of winice8 g7 r4 _7 o+ }$ F+ M9 W% {, V& t
int 2Fh6 R" G1 N% F6 @. x
mov ax, es ; ES:DI -> VxD API entry point4 ~. I C, N- \5 O* k7 @
add ax, di
( y* k; @ I! A+ t" q, u4 a* ^ test ax,ax
9 d2 w& T# v/ E jnz SoftICE_Detected
* }, K `. F0 A: x" C, i
1 p. o; e; @! g5 [" d+ \___________________________________________________________________________/ @: h! \! {0 _+ Q6 x2 J
- t( p- u% u0 ]* o# M
Method 04 @& T. C! x% f7 d% A5 @4 o4 H
=========# j+ }9 R2 a" B, g
" t) J5 V3 U2 T7 |# j' G+ T# G3 S IMethod identical to the preceding one except that it seeks the ID of SoftICE
- p! f1 K$ ?: J5 l# W& XGFX VxD.
7 i0 u) }$ y" j6 e* A% P
+ I0 }) `/ g% _7 P* [. M2 t xor di,di
# Y% r# e6 S8 ?0 k5 N; a* v mov es,di; u0 E. A3 a* n6 v
mov ax, 1684h
1 G; R* D' ]8 s$ f0 q* _ mov bx, 7a5Fh ; VxD ID of SIWVID
6 S0 s, }6 I# _+ K& J; H int 2fh8 T# Z+ O3 E! J% ^( W9 a% d
mov ax, es ; ES:DI -> VxD API entry point
9 m: u% a- f- g- U; ^ M* R add ax, di
. w7 R* d1 z! Y test ax,ax' E Z2 i1 ^7 [1 V
jnz SoftICE_Detected. E2 d8 r5 |# V2 O/ g+ @1 d
9 X2 ? F2 c, G+ A7 T, }/ k
__________________________________________________________________________
% `/ l% D+ x. o) G
, Z/ S1 `0 \/ s6 j0 E1 k
+ {& M& ~! n4 MMethod 05, o5 T8 E( O5 r2 R
=========4 |) }6 A$ p4 Y0 }- o& K3 q
" r' W, M& p" s4 R |
Method seeking the 'magic number' 0F386h returned (in ax) by all system* j6 c6 j" h% ^1 d
debugger. It calls the int 41h, function 4Fh.
- P8 ?6 U0 c" I8 q2 U' S% M+ \+ JThere are several alternatives.
9 a0 a% `$ E, B8 Z
& ?0 |# I4 n. }The following one is the simplest:8 ^9 ~6 J6 h, j! \
: p: b/ Z' Q1 y; i mov ax,4fh' J$ n" a+ g7 F% s7 W" Z: b
int 41h1 S* G. j {1 k; p
cmp ax, 0F386' h4 e3 y1 i& ~! d
jz SoftICE_detected, ]- m0 s8 x; h0 X9 G
+ J2 Y1 Q5 s2 P# N W% {2 o
# S$ d6 _! \: }3 C% l' k J7 O
Next method as well as the following one are 2 examples from Stone's
) S6 R3 G6 n2 K"stn-wid.zip" (www.cracking.net):
4 h5 E1 C/ T% g/ } I/ M/ m- i2 }6 h7 r, [, }' m6 b! c9 u
mov bx, cs! o6 `: s' }$ l" n3 u: K! N
lea dx, int41handler2
' k( q. y+ e! |8 V( @ xchg dx, es:[41h*4]% f& G: i6 p5 y) P+ ^
xchg bx, es:[41h*4+2]
% @1 O$ c; ~2 b, ~' U- \5 P( L mov ax,4fh; i$ v" Y* N& H1 W, s4 E0 H
int 41h: X6 e8 H8 Z/ m! F v' n
xchg dx, es:[41h*4] I, E% C$ J6 [" ?
xchg bx, es:[41h*4+2]
8 \: O8 o/ N, X/ c+ r+ y, V& v cmp ax, 0f386h
6 X" i( b! G [, I4 F( J6 K jz SoftICE_detected
( v/ O5 A) ? p1 q9 k' O: e/ s, N7 h) i6 q
int41handler2 PROC' [/ e% y U2 V
iret* z Y2 |- H6 h8 [: [: W
int41handler2 ENDP- \3 l' _( P" O* A# K }( J7 w
7 w* M t7 ?& a! G: r0 f; `8 m
& j# z4 f# o7 D0 y+ C_________________________________________________________________________
1 J0 {/ |. P8 t7 Z
+ p' z, A, y, w' {. N4 q& C* y S5 O* Z0 ^+ q, P: S
Method 06% V! @4 U2 \# R- h; i" u
=========- i" N3 B5 Q6 T* a
9 ]& g) r: \/ A8 g
4 d# i9 P7 o5 O! j3 p9 Z# H2nd method similar to the preceding one but more difficult to detect:6 b) f$ \# L! ]& j6 z
3 a5 N3 y; t3 F) K) W
5 \$ G& U5 j6 V6 d+ Sint41handler PROC1 V0 ]$ l3 Z/ ]- K3 i
mov cl,al8 z9 x9 U# I# b" ]
iret! Y% V& k% Z8 J
int41handler ENDP
& d3 S, Z/ `6 [7 S
; Z4 e8 B$ q- e0 {1 a, o
- @. M/ F/ v+ w6 r' V xor ax,ax. B: r8 M# A3 u0 y! l- g
mov es,ax9 I# s. L) Z* o2 w. ?
mov bx, cs- M8 }: d0 \9 V8 b
lea dx, int41handler) A3 }3 B/ o8 P4 N
xchg dx, es:[41h*4]- N2 f- \' _0 H/ ?5 h
xchg bx, es:[41h*4+2]
7 d3 p& U$ {2 d7 } in al, 40h
* O9 K6 l e* D+ j$ r" R xor cx,cx, J# i9 K5 j4 u) N3 O. M3 {
int 41h: x$ n1 r0 d3 W! B9 s
xchg dx, es:[41h*4]
2 D; |" e% h$ ? xchg bx, es:[41h*4+2]1 d6 G ^: f9 j
cmp cl,al
0 l/ W4 v" o$ Y- s) K, U jnz SoftICE_detected" K! B2 L3 _+ i$ R
$ J9 j* N) m7 Y' R. m$ V
_________________________________________________________________________
7 B: O5 V. ?6 h1 U! Z
2 u' J" W& f' \) _. Z o4 C0 n) ~* }; oMethod 07" g: i+ ^) z3 a$ n c
=========
/ G$ M! U) A( I8 b) M6 o4 \) I( s3 L" A8 M
Method of detection of the WinICE handler in the int68h (V86)
+ c5 R7 C6 g1 o8 b
" V( p- }) o8 f mov ah,43h
) Y3 p" z; F6 L6 j& ]$ q int 68h2 b2 ?4 h: {( ^. [
cmp ax,0F386h
( b" m I) C3 f jz SoftICE_Detected) J! n3 G1 j+ G8 b8 Y# T! |
6 Y- Y8 @- I( b- m2 r7 u1 a* _! p% O7 ^8 H3 ^! z. j. m9 Z# a* {, W
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
- P e' s8 u2 W app like this:0 Z1 D# ^9 b" X
7 `' v- h4 K' C3 P' q2 ~% [- t
BPX exec_int if ax==68
4 i' h5 n- J) t; G: ]+ X! _ (function called is located at byte ptr [ebp+1Dh] and client eip is) i# [- b- P/ p# {2 ^8 U1 l: i* G
located at [ebp+48h] for 32Bit apps)
4 w* G# F; T! J& F0 I__________________________________________________________________________
1 S; c" `. m- H2 z! Q* B7 U( A$ w f1 P, l n/ ~
2 e1 I* L5 ^' }
Method 08( U0 c# |* F/ ]/ j* j
=========
, g8 _8 g/ u0 R$ G4 @: Q7 R' S
% q, T" f# g9 I2 U6 N, M# e6 bIt is not a method of detection of SoftICE but a possibility to crash the0 h5 H9 ~/ M* K$ p3 B
system by intercepting int 01h and int 03h and redirecting them to another6 M1 `* ~: `/ M, {+ A
routine.3 ^* S$ ]& \" G8 \! O6 R' }: t
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
8 D% `) H! h" U% ^5 {6 B; b& Gto the new routine to execute (hangs computer...)- W5 P% v% W0 _. g/ r
# V1 U% A& `; |: |" p" a/ p mov ah, 25h
; Z* ?5 f( N8 @1 ^& x( A6 O! c mov al, Int_Number (01h or 03h)6 S$ ]5 ^' T( m% Q
mov dx, offset New_Int_Routine4 u& P5 ~- @1 v% m
int 21h
" |# j1 }2 |1 @7 V% d9 O
1 X* _' |" c( O8 f__________________________________________________________________________9 U, f0 r( L2 N2 G# O3 A# v
/ ~; N; C; l- e6 l2 T) ?7 h; `
Method 09& R/ K8 h" \7 C' I, B Q
=========
* m4 N- d1 }0 A. @9 w4 g+ D G0 o: |5 P2 Q0 S
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only6 S6 Q0 P `7 Q W
performed in ring0 (VxD or a ring3 app using the VxdCall).
# ^. s; s+ Q* c( Y9 B( FThe Get_DDB service is used to determine whether or not a VxD is installed" l7 N0 G2 d- | S3 l
for the specified device and returns a Device Description Block (in ecx) for2 @( d8 @( ~) z* f k3 j* b
that device if it is installed.
- u$ ]$ |1 }% }# o- C) g3 f7 ]: k* [- P, p+ B ~! J" ?* U! @9 f
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
! u( o' X8 p0 U1 H mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)4 \ _4 M1 t* O. l
VMMCall Get_DDB/ T3 S. \ J6 g; u; o
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
+ u! d8 H1 B; y0 ^( X& H) i% P# l" a* E4 y' n
Note as well that you can easily detect this method with SoftICE:+ t2 Y2 l! y5 L+ S3 q
bpx Get_DDB if ax==0202 || ax==7a5fh5 Z- \, T L# Z( f$ M! ]
! H+ C$ R! L4 ?. `__________________________________________________________________________! S0 N# h+ [$ a( r# j
" S) g# P! B1 g! ?& X; s: IMethod 10; t5 G' J4 z3 p- D* E
=========) N. o; y" u! \% r3 S0 A) f
( ]/ }$ q8 X- ~=>Disable or clear breakpoints before using this feature. DO NOT trace with( L5 P! h. m/ c, S
SoftICE while the option is enable!!) _) r! V, U" J3 I# z; z. G
/ m. e( x' s$ N$ lThis trick is very efficient:
4 e& [4 D3 U& D) nby checking the Debug Registers, you can detect if SoftICE is loaded: z0 S9 S: f9 t' f3 v, _: b5 ~7 @
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if- D+ g" A6 S* Y
there are some memory breakpoints set (dr0 to dr3) simply by reading their5 P) R( z; j$ i. z
value (in ring0 only). Values can be manipulated and or changed as well% v8 Y$ v3 l. A3 B2 A2 v
(clearing BPMs for instance)9 \5 S! O2 \" [' Q# s
8 S3 ^" _7 A! q3 p& x9 Y+ e$ `__________________________________________________________________________1 C# S+ f; j' N1 q( Q+ e
! W! p9 S C% {0 V# eMethod 11% w/ O+ g7 b% l9 s1 o! Q2 [% r
=========
* H. C+ a, f" X4 i' H" B$ R0 R* F* b1 }( F& f- [* h
This method is most known as 'MeltICE' because it has been freely distributed
+ `1 e% A# S1 L4 J0 U) R0 Cvia www.winfiles.com. However it was first used by NuMega people to allow
0 y; }; H! O$ R/ t" JSymbol Loader to check if SoftICE was active or not (the code is located
3 Y& ^2 J6 T" `5 Oinside nmtrans.dll).; v" g4 @! Y$ n$ l; a. h4 s* E1 F
^) s2 A3 Q! b4 m. w( r
The way it works is very simple:
. ]( P. s& D. KIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
5 B2 r- u* e3 X0 hWinNT) with the CreateFileA API.( {! s1 B' j( S5 V% O B. o
x8 Z0 s ~0 S% ?Here is a sample (checking for 'SICE'):* G A$ x$ G+ i( g
) O* p( v& i2 F0 D+ X9 z, G4 F
BOOL IsSoftIce95Loaded()/ s+ M! C$ h$ D+ e8 r- J
{
# P. D% A s$ {" ] HANDLE hFile;
2 u5 E' a5 x" G( t% Q" [& N. d9 Y, P hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,1 ?: a# c4 C9 u7 V/ j- X8 |: S
FILE_SHARE_READ | FILE_SHARE_WRITE,) }( j' E# g9 L3 Q1 {
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
2 `% A A: O7 |/ {7 r/ L0 j0 N/ s if( hFile != INVALID_HANDLE_VALUE )4 i/ V" o/ `8 B1 O
{9 g6 m0 k9 B- v; I
CloseHandle(hFile);
- j1 @7 L' }$ L6 c6 F3 p& T A return TRUE;* }' e. z" [, Q4 A. f5 E* Q$ ~
}
) p d% J; d+ `6 d, l return FALSE;
}# n( ^2 J: R2 r7 N6 q* H% ^}
5 X9 O: U( W- T# X9 n% Q6 O) Y" B" ^ C
Although this trick calls the CreateFileA function, don't even expect to be
+ N3 J# D; f4 T) }" table to intercept it by installing a IFS hook: it will not work, no way!+ V6 ^1 l( v8 X) i; U8 k* Y
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
+ j7 l1 q, E) B! {: W, d4 vservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
0 Y' k. s3 l' @# h- P* ]and then browse the DDB list until it find the VxD and its DDB_Control_Proc
5 C! S# |: d8 v1 a. R; ffield.' l. N; W, `) [) x1 _* ?
In fact, its purpose is not to load/unload VxDs but only to send a / r Q" m& Y- H: m5 M
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)' j, s4 ]( ~8 |& H
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
8 U. ]# D. m" y8 L7 Q& bto load/unload a non-dynamically loadable driver such as SoftICE ;-).# X) Y1 D7 k) i; N( f
If the VxD is loaded, it will always clear eax and the Carry flag to allow
7 {3 k. \9 a$ f7 W7 T$ fits handle to be opened and then, will be detected.
4 l+ N: {. i! v/ |# E" rYou can check that simply by hooking Winice.exe control proc entry point
" o9 v; }4 O( l% pwhile running MeltICE.
8 X( R0 h* c# l1 {/ t* [
8 A: Q# K! e. f5 y; f! ^0 |2 p9 |+ H( w1 c) e
00401067: push 00402025 ; \\.\SICE0 ^8 _0 Y6 |- F9 _0 t: k
0040106C: call CreateFileA
! ^9 D4 W. Y! Y" z6 [1 g) z3 `: a 00401071: cmp eax,-001! o# X9 O# C) s0 d
00401074: je 004010915 g* f! c; l& ?* l( [
( T3 F6 b1 R x6 m
7 W7 E9 @! u4 K% R. \) QThere could be hundreds of BPX you could use to detect this trick.4 _4 S5 o, @7 e3 ^; o9 s2 s& C
-The most classical one is:- ^$ Q9 g" `. \
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||. m) K8 e _6 H5 v0 X! u
*(esp->4+4)=='NTIC'
* x0 a# J+ ^2 k3 R7 g A, V& Z
4 ]+ k2 b! r1 @; r( g2 Y-The most exotic ones (could be very slooooow :-(! e5 k5 q8 k" }' Q7 G
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
$ M7 I* L7 ~0 s; W# `. V( k8 \ ;will break 3 times :-(! z: P1 f& F& q z/ H; N$ Q
) A; ?; }2 P! V' _
-or (a bit) faster:
1 r& l& Q% ^( N3 U BPINT 30 if (*edi=='SICE' || *edi=='SIWV')% w- V5 s' B" z% _" N! n
% Z# C! Q0 ]$ e$ l. U+ j: O
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
5 L) g! Q7 F, ^! q ;will break 3 times :-(2 K' C; |8 B3 V" L2 f6 K
2 |5 [4 w! J( \) w+ [
-Much faster:
: ]* v. E' N$ j. @2 Z: T BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
/ N+ L0 P6 `+ @- e$ V/ f) E$ a3 ~/ r1 f* T
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen2 e* S9 {5 X B$ i% W1 c9 \
function to do the same job:& E$ h0 l2 h3 Z3 q$ N1 a
5 s4 W9 n) E3 T: U% @9 r, L" T6 G8 w
push 00 ; OF_READ3 ~8 _+ O; q' \' J
mov eax,[00656634] ; '\\.\SICE',0
$ i. _- N; n- X: v3 n0 g; W; Y2 G push eax; r8 T: p z/ N; F
call KERNEL32!_lopen
# l. y8 ~' S" c: r inc eax
o* l' i/ a+ L jnz 00650589 ; detected6 j1 ?2 p# n9 ?9 K! y( V2 x
push 00 ; OF_READ
# Y% \7 A' }7 s/ r3 S0 V% Z& p mov eax,[00656638] ; '\\.\SICE'
8 a* x( A! T) x3 \, M; K4 Q push eax8 [" i5 i, ?& L3 M2 a
call KERNEL32!_lopen
' W" y; h3 r' U8 A inc eax& q6 K1 ~: L$ T$ |7 s
jz 006505ae ; not detected3 A2 Q' ^ r8 q5 Q" O. P& J
' i3 o- {$ j0 z* s2 ^4 j, Q
& h: |# T0 \6 r, Z6 F
__________________________________________________________________________
- N8 {) R7 [6 T9 E+ T0 k; e( k0 d6 f% c* w
Method 12
+ ~/ ^! k. R/ x2 z5 [ ]5 j=========% {; d7 I$ @5 P
/ j! B, g% P& Q, c7 j& n. \
This trick is similar to int41h/4fh Debugger installation check (code 050 r- l9 ~( W' s, z
& 06) but very limited because it's only available for Win95/98 (not NT)6 ?. N' p9 V1 @8 R2 B& R
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
; |. q7 R/ U. g. r6 y; @7 `. k) w. y; y( |( K. w
push 0000004fh ; function 4fh+ E) W2 A- o; _$ c4 N/ ]7 L7 |
push 002a002ah ; high word specifies which VxD (VWIN32)
" H1 {) n* s0 Z* ` ; low word specifies which service
: `4 T% X% }* w( b' o/ O! A5 l1 r (VWIN32_Int41Dispatch)
% S! N3 |6 c) O" V call Kernel32!ORD_001 ; VxdCall
& k% u: V( H$ V; Y cmp ax, 0f386h ; magic number returned by system debuggers" U! B a% N4 S4 v* k0 b
jz SoftICE_detected
3 n& A- J: ?" j' \9 z. n/ a% Y$ |4 t% d7 X5 T4 M& X: H( m
Here again, several ways to detect it:
5 p# L: _3 p5 x7 t
) j* t" N8 Y( A ^* h1 `/ R4 g BPINT 41 if ax==4f
0 Q( s, O y7 `
' c2 o9 ]7 V7 e- V9 y BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one2 q8 c4 U, ~8 Q( x
, ?$ u3 F2 }8 B' L$ J/ Z _) }
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A. l$ G+ ^/ X% ~8 v" F- E2 ~
/ K- C% R8 n9 ~& Y9 f p$ W
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!7 I; ~8 m' p: `# _8 _+ }5 ]% i% G
/ y2 X. F6 Y5 W1 [' a) D__________________________________________________________________________. Q4 T5 U6 y9 z( i5 L; o# R
: N7 L, C* B2 u, iMethod 13! @2 B2 A2 \% w! a# C9 I2 Y5 j
=========0 V" [9 A; j) `2 L, E( b& E
8 Q: u! q- u% w% C# l# D
Not a real method of detection, but a good way to know if SoftICE is* D% _3 u0 b8 ?5 k. }) c
installed on a computer and to locate its installation directory.0 K, I; K! o, H; }
It is used by few softs which access the following registry keys (usually #2) :
# f# ^- i0 \ w4 z9 s% J0 J6 w; N3 U. ~- U! m1 \
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion6 h" x: ?; E6 C+ p* r
\Uninstall\SoftICE
8 s1 l0 a- k3 {+ a0 g-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
; ?0 C1 }$ k3 |0 q) s8 Y4 X: j-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion: }% z7 l. o3 ~
\App Paths\Loader32.Exe
u" B; H% ?+ r& m/ d. y9 M# p# J( Q& @+ \# ?0 M7 e7 {
: S) Y5 u8 Z6 J% T. \: F, Z+ y' FNote that some nasty apps could then erase all files from SoftICE directory
3 M/ u7 Y9 N8 a$ z/ v2 O' g- @(I faced that once :-(
' X7 A* r- b8 k9 F( ?( ?2 Z7 P# y& N& a6 h; N$ g) d
Useful breakpoint to detect it:
/ z2 ^" f1 V/ c5 T. O, L# \0 D: S; R+ `
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
6 @4 E; a7 C6 ` m4 u+ \% K+ r
' g+ N& j7 ~$ T4 @2 z' e__________________________________________________________________________
6 q, s2 V* F) Q7 ~& a1 N
, }6 d& A: ?2 D r5 y5 {7 e- @/ w. H- m" Z0 G
Method 14
$ ^( E& R- q7 z6 I=========
* \$ l- V& z* h, E' M- m# C3 ~
# {( }0 {0 ` D+ @& w, zA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose4 ^* G8 e Z+ f1 h4 m- i* }
is to determines whether a debugger is running on your system (ring0 only).
" l2 `" I4 I1 h% C) i3 {/ j& [# O' {( N& W
VMMCall Test_Debug_Installed7 ]) ^$ d Z: q: M- }8 W0 o
je not_installed
w4 ]$ S4 t* z) [
1 S' p) ^9 M) M2 \: @This service just checks a flag.
6 w4 |1 a9 z# G, a3 Z1 O</PRE></TD></TR></TBODY></TABLE> |