<TABLE width=500>+ r6 ?" |# t [- z# r& ^7 |
<TBODY>
. E8 N* w" a6 z8 |+ T7 {<TR> |# R [8 f9 R& ^1 t
<TD><PRE>Method 01 3 q4 O/ P% h, U! ^
=========
# m" E2 w2 Q; S% a' t6 h6 @3 p" t2 C
This method of detection of SoftICE (as well as the following one) is
2 H) r7 L( [9 z% U4 Z$ p* Aused by the majority of packers/encryptors found on Internet.
1 c4 y4 S/ w" t2 \- rIt seeks the signature of BoundsChecker in SoftICE7 T# [5 R$ ?" ?/ g/ C+ v& n- f
% k9 m; { u q P6 L! m2 N mov ebp, 04243484Bh ; 'BCHK'
' T; ]! A' x2 N mov ax, 04h
8 v8 e2 m8 |) B9 H' b* b8 v5 P# C int 3 , _2 v5 } `) }- l5 k: R3 L
cmp al,4
6 `. [' e# [, @! ^ jnz SoftICE_Detected
3 Q# Z8 Q# n0 P( t
6 E: D. N# B( E9 c) A! e" E5 h, ~___________________________________________________________________________
; I' G% s' l6 g. n8 S
" r0 L6 y/ u4 I% ~* B& WMethod 02
- |6 b+ M& N* n+ `$ p. q& ~=========
, ~; I3 w8 X/ ?
+ ~5 l8 ?: D8 Z% J. r. _Still a method very much used (perhaps the most frequent one). It is used' [' C. b! ?! A/ h
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,4 K4 P) u6 W) X: S: z |, K
or execute SoftICE commands...
: ~ ?# E7 \; W/ s" N' oIt is also used to crash SoftICE and to force it to execute any commands: D; U; X6 M7 h% d" ?. r9 O# q" r% U
(HBOOT...) :-(( 1 z, s/ M3 e; {* F4 v) B3 e) o
# g: a( z& w3 m3 D( D4 j$ _/ Q$ `" cHere is a quick description:
+ E# h! P2 k# z0 w-AX = 0910h (Display string in SIce windows)
; k y# A% M( }6 D4 W-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)( ~0 r Y2 w& U" C: R! J! e
-AX = 0912h (Get breakpoint infos)0 p2 k7 p" Z% F# ?2 S1 r
-AX = 0913h (Set Sice breakpoints)
3 E- t8 ^8 z0 V3 _' c& ?7 e-AX = 0914h (Remove SIce breakoints)2 Z5 F# R5 C/ g- U+ x% F' H
C) K5 z, M# S% p' V& E6 CEach time you'll meet this trick, you'll see:' L/ U8 @) D0 A
-SI = 4647h
6 \ t9 c2 Q( {( m8 P6 L+ e% y. t- J-DI = 4A4Dh/ V m' w) n% @# g
Which are the 'magic values' used by SoftIce.
9 C4 j' F' z3 `3 n/ ~( qFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
" ?* D) ]) r% ]8 f$ a7 k- h0 [: t! A O
Here is one example from the file "Haspinst.exe" which is the dongle HASP/ Z; L6 w+ ?; h3 Y
Envelope utility use to protect DOS applications: D1 V: d' \- e
6 J2 N# d# p1 P. l r
- H& W/ k) m' j4C19:0095 MOV AX,0911 ; execute command., f! Q, e: d1 m9 Q
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
& b% N0 f# {: N% S4C19:009A MOV SI,4647 ; 1st magic value.
6 b. q ~/ r3 s" K6 I4 j2 L4C19:009D MOV DI,4A4D ; 2nd magic value.6 `: }; ~' u) i) N+ y6 l' G3 K
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)+ h% a, |' Q' ~0 ^1 K7 `
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
. V/ x/ Q: {/ u `. |% F8 g6 b h4C19:00A4 INC CX7 x& I4 B3 c E8 S
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
+ q3 _. i) B- G9 | `4C19:00A8 JB 0095 ; 6 different commands.3 m, q( ?( Y. h8 r# J
4C19:00AA JMP 0002 ; Bad_Guy jmp back.% Z Y- t7 M% j5 n6 h; w
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)0 B; X6 h, f E/ E7 J
! L& L/ R# G+ Y! j: U4 {1 J+ J
The program will execute 6 different SIce commands located at ds:dx, which
5 X' V- Q1 ^3 q8 g+ zare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.! V0 I! G) U$ ]0 p
/ P1 T r u0 c0 ]6 R' f! \
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.5 N) [8 C" N3 h8 W# O) G' q
___________________________________________________________________________
3 y/ l" g& u4 C) n8 w
$ D; G" h9 J" _( g, W6 v* ~) S3 _/ N" o4 V2 {
Method 039 k. `6 j4 V: c2 x0 q; E* x
=========
3 u# Q, u# a5 T4 ?3 ]
2 v) ~& m4 S% R( X: F0 f9 y' wLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h" c) r! Z1 D! Z
(API Get entry point)
; s4 ?3 `* y1 M8 E3 i: q# R
0 {. }; `9 ^' O) v
) p- C1 B, t3 Q* |) h xor di,di6 \4 x( D, ?( F( I4 F5 Y C
mov es,di C' N# w7 \# b) T
mov ax, 1684h
2 S2 Z2 o y `6 @" P7 o# _: V mov bx, 0202h ; VxD ID of winice
5 w* \8 b4 m3 f# v- R' B9 k+ d int 2Fh: ]/ h: ?( R- g7 K3 p4 n
mov ax, es ; ES:DI -> VxD API entry point
& |5 Z: z/ x# @9 ~% n add ax, di
- `0 L, j1 r/ {. N. ~! T1 w test ax,ax5 A$ v) n! v; _; g
jnz SoftICE_Detected m* y$ \/ }, H/ p
; d6 x, D9 y3 w9 g1 p+ |___________________________________________________________________________ n1 M9 N0 N7 r) f. k
1 R: K* R% [; y3 t; A2 wMethod 04 t3 B- V6 h( w. ~6 X
=========
: M3 O8 l. V0 e+ A" W9 d1 j1 t0 n. p ^& S
Method identical to the preceding one except that it seeks the ID of SoftICE
8 w/ j8 b" K% t! hGFX VxD.
: D* T% A1 B' K- @0 }, ]. g! W' x. n2 u8 t/ j$ w4 k
xor di,di8 ]; s+ r& T; s1 R. U) ^9 r
mov es,di2 V% N9 j$ c% ^; S" J
mov ax, 1684h + Y: `1 }" p6 t# e4 u; Y
mov bx, 7a5Fh ; VxD ID of SIWVID
- D: Z8 r! m& x$ q; M int 2fh
/ e7 J; T* L1 c9 ^: h, j | mov ax, es ; ES:DI -> VxD API entry point3 A& L6 c" D4 @
add ax, di3 |% P; h9 Z9 C, f5 Z) I' z8 H( i
test ax,ax
- T. x5 `: L1 o+ t jnz SoftICE_Detected
9 e F8 R* ]$ \6 _1 t/ p1 j0 F- P
0 q& W. H7 ^; l- \0 n* M__________________________________________________________________________
! r, }: Q G" C
0 V+ b( @3 T7 L; W! w
8 B( N1 w, K1 U5 f. Z. _* Z8 vMethod 05
, @6 T% l: d' x' E5 [: V3 f& z=========; k5 |* s) r! a* V! y0 \" o3 d
. i+ ~& O- z; C% E! b
Method seeking the 'magic number' 0F386h returned (in ax) by all system& p3 q3 L& z$ a
debugger. It calls the int 41h, function 4Fh.$ S$ q2 R. T* r% G
There are several alternatives. ; J/ J7 E, L! U3 i& L$ H' d
! t" j& H1 t/ t9 {
The following one is the simplest:3 j! v. u( v9 G5 u6 b3 K
% Z/ j1 q, H' T4 B- y mov ax,4fh, n/ f$ u$ N! q5 C5 v. y% R
int 41h; C1 G* X. H6 P# a
cmp ax, 0F3864 b8 w6 T" F. u. x/ y( X
jz SoftICE_detected
6 q9 q: J. h1 u' k2 ], y8 m
# }$ c! T: j3 g) f `. _$ i G# c, |
Next method as well as the following one are 2 examples from Stone's
6 p0 v: d9 m! a- S"stn-wid.zip" (www.cracking.net):
, W* S9 S5 @" o) _. i
1 {& ?2 F9 L! n mov bx, cs. b" q5 S" z) s: J0 n0 F
lea dx, int41handler2% B7 m8 R1 i. p' e% q
xchg dx, es:[41h*4]
- v. }4 l, T Y2 l xchg bx, es:[41h*4+2]
) P3 Z) }: ~, _' V mov ax,4fh
, f4 N- j$ J G- z- h4 F int 41h
' ?7 ~1 l- @% I" F' |$ v9 w, w& a( ] xchg dx, es:[41h*4]
- \. K: N% \7 X, l" b5 P xchg bx, es:[41h*4+2]1 S& Z, n6 P+ W2 r
cmp ax, 0f386h3 r/ G& k5 x M5 D3 @5 J
jz SoftICE_detected0 \' r# P) u& N
/ J7 I) O3 o6 eint41handler2 PROC
& V1 q. j; k) _5 f1 O O) f iret
0 a$ H& U0 f* M$ ~& l, i- Aint41handler2 ENDP
6 a* H% V: \6 X& S" ]% F9 N0 A( d- e; m& ?0 i
^8 S% h% Z' E/ F9 L_________________________________________________________________________
. s: n# A) L+ U; a8 s. Y: s J) }
3 |: }: N* i' h. R$ L
5 @2 K4 j7 j( p/ W* g$ i6 p2 q- m+ aMethod 06/ N4 }. F& Q5 L
=========
: i7 N8 X5 w9 X8 @0 m
z2 E5 e! g2 ]; [+ {3 ]4 X5 E9 ^) L P1 j) q' u4 Y5 h
2nd method similar to the preceding one but more difficult to detect:
9 n3 {$ i7 u% u! n" o& j9 f. O( T0 j1 e
+ L/ m8 }% B. Q# s$ p5 |int41handler PROC
' c9 m; M8 F' |- m) Z mov cl,al
0 T+ ], s6 m* V( D iret8 z$ n8 u, o' X! w& M
int41handler ENDP
7 O8 R, k* m, C6 p6 G# J) }2 [0 M! c7 f+ w+ r3 T; E- N
; d- [0 A1 `# O8 s0 @- s& p
xor ax,ax! V& p6 r _) x2 r/ e! z8 @" d7 B% T
mov es,ax
! |' x& \+ L" `5 y/ s, M; H- t mov bx, cs h4 W. a2 w+ \5 ], P
lea dx, int41handler
) ]+ C0 z5 [1 E0 A+ _; n4 ~7 r xchg dx, es:[41h*4]+ | z) W: h6 ~- d$ f
xchg bx, es:[41h*4+2]
4 T6 ^$ x7 y |6 h in al, 40h
1 h- I3 H1 ]) @) f r3 v, g xor cx,cx) y+ ]! T0 _3 [1 Y4 k, y
int 41h0 Q# e y! Z9 V( Z% k$ F4 D
xchg dx, es:[41h*4]5 \1 L+ B4 _$ }2 ^: N% W
xchg bx, es:[41h*4+2]
0 | x# t+ T$ _7 A, A% S& n cmp cl,al
1 O' O6 @; F8 a% c& m' D6 V; q1 m0 \ jnz SoftICE_detected) T! k& w# ]% ~: K; Y6 s! _
; q! D7 J' z1 A' v
_________________________________________________________________________
( H" u$ r4 s+ M9 V& }4 X0 o
4 D8 ^0 i& P5 y2 WMethod 07
4 j# ]1 E0 T" J. C6 x2 Y0 `=========
) ~0 a1 p* c' ^: G; t; o0 D5 U5 l; ?9 X
Method of detection of the WinICE handler in the int68h (V86)
K! R7 ]8 \" ?9 R$ F7 j$ ~7 y9 J
mov ah,43h# A- Y: K8 S L; }+ O
int 68h, Y3 U4 ~6 {: n, ?
cmp ax,0F386h
2 {3 v' J- I9 ?4 T- G jz SoftICE_Detected9 l& |" M9 ~7 w* O- j" B0 n% k
% d2 _/ @( m# N6 g
- _% S: I8 R! _3 A) p) @9 C0 G
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit- u4 t0 Q. T6 e$ V! a
app like this:
$ |# f8 h) d+ p* q2 Z; c* n9 E3 K: |
4 G4 J' u9 N6 P( R8 P Y9 l BPX exec_int if ax==681 E u/ Y5 H1 f! n
(function called is located at byte ptr [ebp+1Dh] and client eip is
7 V+ u4 h4 d' R7 M1 {( [$ e5 u located at [ebp+48h] for 32Bit apps)
! B8 K) \1 b& j) L__________________________________________________________________________1 [0 O8 C& x X7 r- C2 k- z$ j( L
# o4 b, b) ^! W$ @2 r4 l9 L
" i' Y1 c b0 c( ?/ rMethod 08% a Q3 j9 S' {* f+ O- M
=========) R: _+ g$ J- M( {2 l7 p% | j4 w
: j4 f" h* G. r2 M/ x0 l. j6 fIt is not a method of detection of SoftICE but a possibility to crash the
: x B. w* t1 ~4 \7 Dsystem by intercepting int 01h and int 03h and redirecting them to another
; h+ ?. S6 [4 rroutine.
0 x% o0 o9 g/ U; o* T+ K0 Z, r( GIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points# @% M% e( q3 e/ r" h
to the new routine to execute (hangs computer...)
& V% ?3 h* u7 u$ Z+ C# Y( C- }! P* l/ E; k) I3 D) \
mov ah, 25h7 @5 G% S; M. M
mov al, Int_Number (01h or 03h)
6 c, E( b4 T* D) Y mov dx, offset New_Int_Routine
`5 \/ }, N; @% `( g int 21h$ a6 v- |- v7 U3 H
* U9 [+ z; O# e8 M7 x6 W0 f* O__________________________________________________________________________
g, b7 w9 X2 A) I! k) \4 g6 ~ Z" [# B$ x5 P
Method 09# K4 E, [0 O3 c9 L0 S* C
=========$ ~ ]1 k6 R8 x" c; x; Q( I
; x Q$ R- p) t7 P* {) z
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only4 i2 X; T1 b8 i9 M
performed in ring0 (VxD or a ring3 app using the VxdCall).& [+ _. }( F/ W
The Get_DDB service is used to determine whether or not a VxD is installed
d J: E' L$ l( z, ~( Dfor the specified device and returns a Device Description Block (in ecx) for
5 d# ?: |! X" uthat device if it is installed.0 A, j. ^, W/ j9 j4 J
/ W. f/ P5 X4 T
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID; o, X$ Z. f& r1 S9 H
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
$ H1 q; x9 m& Y2 a- @' J VMMCall Get_DDB5 P7 H( Y7 X* t; C# B; Y
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
1 C: z5 T/ {; @
% a) h* W, Q. aNote as well that you can easily detect this method with SoftICE:
" i& u( E s$ ], p8 ]' q bpx Get_DDB if ax==0202 || ax==7a5fh _) a8 N, t) k1 K
. S! k R Z! F+ ]__________________________________________________________________________3 y& V5 f9 b- g/ y
+ n5 q8 Y6 f7 t# G0 x/ Y) |Method 10$ i( v0 E+ d9 O& X% u. ]
=========' b; L+ \$ @3 l/ e
0 M. g( |" T# x4 z=>Disable or clear breakpoints before using this feature. DO NOT trace with; o, l, V i* |( w9 F& l
SoftICE while the option is enable!!
[% M6 a5 Y, h* ]4 g: b
8 x1 C5 Q- p1 F8 jThis trick is very efficient:# h* V# q* o5 I5 O
by checking the Debug Registers, you can detect if SoftICE is loaded
9 k/ f$ u% b3 z( Z, R/ P; V(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
6 |# p* ]0 I7 f$ z! vthere are some memory breakpoints set (dr0 to dr3) simply by reading their+ U* ~5 W5 V. y; k2 k
value (in ring0 only). Values can be manipulated and or changed as well% W j& R0 O$ a- L- e% r
(clearing BPMs for instance)
9 a" ~ w" t9 m! r, _4 [9 L6 L5 _$ H9 R, ^
__________________________________________________________________________
8 |+ _) q. t5 }) {9 g5 m% ~1 P: R- _& T5 Z J! I' k0 r; p
Method 11" M* T' q4 ~7 w3 e9 F% R% _
=========/ L2 a8 o# R, N# H; i9 @
0 k9 x+ R- r5 f+ Q. i; GThis method is most known as 'MeltICE' because it has been freely distributed
4 e& I% ^. T" d: c* L H- vvia www.winfiles.com. However it was first used by NuMega people to allow/ N1 z4 |5 T! J' C, G' |- e& y
Symbol Loader to check if SoftICE was active or not (the code is located
# T/ @& Z! t( u. s( d5 ^9 x& Winside nmtrans.dll)." @5 b' \ c! E" @, U
; P r8 i% X' |6 k$ G: W% m- iThe way it works is very simple:' m! y( _6 l% G% O3 T
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
& k4 w! q" x$ P( \4 RWinNT) with the CreateFileA API.
; W6 {1 g$ x/ v9 X. O& _# z1 M/ J3 s* P- t( x$ k
Here is a sample (checking for 'SICE'):
1 L5 G! Y- p; R) h5 R& W
- c- H Q4 m# c- a) DBOOL IsSoftIce95Loaded(). K; I# w6 B9 [+ J& B. \
{) R* c$ v4 Y% |
HANDLE hFile; " E" M) b, W) j# d! N3 c2 s0 F; I
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
' }( n0 O( f5 a2 _* h/ g FILE_SHARE_READ | FILE_SHARE_WRITE,. i- E$ \2 J h0 u
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);: T4 z0 t5 t4 T) M3 X
if( hFile != INVALID_HANDLE_VALUE )
4 |; t! x3 Q. v" ?1 W {" x& f8 o |4 ~5 \
CloseHandle(hFile);
% {* p: q" s% k* r% P8 p( I return TRUE;
2 E8 I0 _- F5 A2 c" b }
2 {3 q9 E: h f; @: z return FALSE;4 j9 l2 ~3 Y/ Q p5 g
}
4 {: ]5 N* Z8 A2 k6 C a+ x5 n/ s! M
9 Y% m; V- f7 Y1 }Although this trick calls the CreateFileA function, don't even expect to be; C: f' n/ k; z" R
able to intercept it by installing a IFS hook: it will not work, no way!# T* j2 T' B; C- O$ f L
In fact, after the call to CreateFileA it will get through VWIN32 0x001F" q) f: e+ `3 P2 V; Z& |& Z5 P
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
. L6 d$ E6 D! a& W) O) T3 Eand then browse the DDB list until it find the VxD and its DDB_Control_Proc1 \( R7 F$ \% }' k: T/ B2 f; Z- b
field.
5 m6 v, @5 p7 `In fact, its purpose is not to load/unload VxDs but only to send a 9 {/ o4 \$ `: ~' M, N/ s
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)( W$ `/ f: R/ v: C/ M( x5 x
to the VxD Control_Dispatch proc (how the hell a shareware soft could try' I) r; H: f. B6 Z
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
. @3 u e: z# P5 u. x, `If the VxD is loaded, it will always clear eax and the Carry flag to allow
0 k8 Q) k) e; v! xits handle to be opened and then, will be detected., ~5 _. E; K, c+ V0 V! \
You can check that simply by hooking Winice.exe control proc entry point3 }2 j% E) P( e3 h; [3 Z
while running MeltICE. ~1 i6 o7 f* L1 L7 E f5 k0 a6 a) B, f
+ ^# U6 E! Y( n$ [& \# n; i
' m+ R% `' A8 g* N" m 00401067: push 00402025 ; \\.\SICE
( ]+ t: T `. @; m. Q8 P% u8 G 0040106C: call CreateFileA
2 ^0 a" w3 p3 y! k! @" r& @! a( e0 ~ 00401071: cmp eax,-001 d% V) V7 Y! O0 T4 Q
00401074: je 00401091! }, ^+ M5 _0 {
/ c* u3 U3 w+ z0 z" t/ S$ K+ j, Z1 K$ W+ K6 Q" D
There could be hundreds of BPX you could use to detect this trick.
7 l: X# Y% n; [ g2 E, u4 w! C-The most classical one is:
0 N. |( t' [% L* c6 ^% f( f& l( { BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||& V" E! Y& f7 u( _7 N) y
*(esp->4+4)=='NTIC'
: c1 a+ M: l! U `" }; J& `! B/ {) P2 y b B. B9 T3 i; m$ Q o
-The most exotic ones (could be very slooooow :-(
0 K/ _& F+ j1 W3 j! Q: K& V7 R BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') % e- k0 l. O# z) E# Z4 v
;will break 3 times :-(- W" P& ?: r' x% t' ^* J# R
1 T" L6 X F- g9 W7 z2 Q9 r* C-or (a bit) faster:
: v) J! M: B+ ?4 B; Q BPINT 30 if (*edi=='SICE' || *edi=='SIWV')( c* ?$ Z6 _% A! s1 ]
5 S% m' O1 A5 n7 {0 }2 |9 K! I
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
9 K. [% A4 ~1 _& ]3 D4 j ;will break 3 times :-(
+ h9 q" A/ F2 l2 [& }4 h" I; \
5 N$ V' C" t0 |8 ^7 b' h-Much faster:
7 a% K& r7 _; O# n! m! B BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'# Z2 U) R+ p' E6 `! w; j. K5 U
3 O: x: ]( E4 b! H4 l( X: INote also that some programs (like AZPR3.00) use de old 16-bit _lopen
) i9 k, l5 S5 @) Q* cfunction to do the same job:
8 R- a; E2 ~: e8 o$ v, I0 Y" s# j
" {. w+ s* W M5 }0 H2 ` ` push 00 ; OF_READ
8 Z; |4 P) \3 T! J mov eax,[00656634] ; '\\.\SICE',0% L6 h. s, Z( c9 r2 k' N
push eax5 E& E- ?" I/ L3 m
call KERNEL32!_lopen4 j T7 Z. m8 [ L6 R
inc eax
- @& Z2 s, ]- r. Y, a jnz 00650589 ; detected
& S9 K% E* Y9 i& O* Q! y- c5 ^ push 00 ; OF_READ* F3 X3 _- y8 E' o
mov eax,[00656638] ; '\\.\SICE'! b1 {0 Q5 g5 R" W( j' x6 J) p
push eax
) y' a: K1 c$ {; e call KERNEL32!_lopen
6 B6 G7 O/ @ ]/ K5 b1 C$ I* o inc eax# O1 f- O, d) }
jz 006505ae ; not detected& `' D: i N( D% B# K" v
m6 r+ [. g& ]5 [' A6 B) R6 C/ p. q5 ]( z# h8 x
__________________________________________________________________________
# v& f: x' A1 m# N# G9 B. D* \ g) [
Method 12
& O; C! S1 M$ W( I=========
# O: P4 l& X4 _; L* s$ m
: a" C. n2 Y. RThis trick is similar to int41h/4fh Debugger installation check (code 05
9 u5 F% R, Y3 W. m: t9 m& U& 06) but very limited because it's only available for Win95/98 (not NT)# }+ _, \0 e4 U: e0 m
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
) w# I- f9 R8 @1 y s$ n# U6 K) C k! m3 Y
push 0000004fh ; function 4fh7 t% [- T0 y; Z: A ^
push 002a002ah ; high word specifies which VxD (VWIN32)
4 c/ j1 p( ~/ `! I ; low word specifies which service
/ e- @7 M2 P+ ]5 n- F (VWIN32_Int41Dispatch)
4 f g$ N7 j% [; g/ k& @# Y call Kernel32!ORD_001 ; VxdCall
* z- z, _& R# G; [- `; E1 W, a1 O cmp ax, 0f386h ; magic number returned by system debuggers
/ G2 i5 `" V3 S z. X jz SoftICE_detected( N4 q" d8 J$ ~. b& c; }; u3 w l
9 T7 ]. G) A/ q; s3 W2 BHere again, several ways to detect it:' P4 f; L* J' _0 \# j
# k2 A* m$ |" x. M+ O; P BPINT 41 if ax==4f- X- F8 S' V+ ]) L- d5 r. T
% Y1 T) Z/ S6 ~5 L( k BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one+ F+ @/ y1 }" x2 s+ b y
. ^/ {. }1 Z) ? _, D5 o BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A. @3 O& Q5 @: ~( C3 p
9 _9 t. o! j: s. E8 k7 V BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!7 m: A6 V5 K2 h
8 X+ z' U, D% l- _# B# U5 k
__________________________________________________________________________7 r% V) h& T: E( Z/ ~6 W; D
/ |5 Y) l1 d! O+ T' @( Z( F1 R
Method 13& _( I4 O5 K* z! p5 R! M
=========& H( V& w# \0 _& W/ n0 p
0 m' ^. E$ G' D# ?7 W& Q% iNot a real method of detection, but a good way to know if SoftICE is
- \, M0 r0 R! G: V! M; g# _installed on a computer and to locate its installation directory.6 A& a2 @5 C5 W- B
It is used by few softs which access the following registry keys (usually #2) :
% {5 P5 \" F9 d6 @. r
8 d5 r" s1 ~/ m: Y3 k- u-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion( c! X" N3 O V$ q& }3 k
\Uninstall\SoftICE! O; O+ t& J* E' y/ C, z a5 h' I
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE" J0 Q0 K- o$ v# r- R- l
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion4 j$ C9 B+ W- ~3 A3 D# J
\App Paths\Loader32.Exe7 }8 i! {1 x( W6 c
) r( D! M$ v. Q }4 [; o# ^/ W& W2 N: L8 W. R3 M
Note that some nasty apps could then erase all files from SoftICE directory
6 y( J' Y. P: T(I faced that once :-(! r4 r$ ]% V! l3 C z
$ o# j) q }6 z! B! ^& c# U
Useful breakpoint to detect it:0 x) m6 P' S0 W6 b0 n! A
) [% T/ Y( x' A2 m1 S7 U BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
5 [/ A& ?) ]; p% E' \; H
/ u9 A! Y, X: j5 q- F) d) I) z. S__________________________________________________________________________9 B* {/ ^2 @' ? |) o
) i3 ~: u8 ]* }/ a1 Z
. I0 Y) o3 e' d% UMethod 14
7 _# q) }- i# }=========
8 i. I; `2 U1 u* K' L5 R7 E% a5 s; u2 ?
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
& y# z5 m* [' d% {0 ?: lis to determines whether a debugger is running on your system (ring0 only).8 U: @# P1 Q. @: J
2 D- k" w$ ~6 @0 W4 J% A5 _ VMMCall Test_Debug_Installed& l3 N& l) I! g5 a4 `" Y/ \+ W8 _8 c7 R
je not_installed5 O* L1 c; m) t
5 R6 z2 ]. T. OThis service just checks a flag.- @/ G5 ]! ]* A6 }
</PRE></TD></TR></TBODY></TABLE> |