<TABLE width=500>+ x) ^ o2 s+ U
<TBODY>
1 t, L1 y J- |7 X! t8 o<TR>
; I3 A! }$ g; }" @<TD><PRE>Method 01
' M2 }: Y+ a' o7 F+ N$ U=========* ~" p0 y% J8 e9 C3 y4 a
- S) g8 Q' n Q2 ^$ d4 f, V
This method of detection of SoftICE (as well as the following one) is1 d# R3 V- W6 o/ @
used by the majority of packers/encryptors found on Internet.
! u! ~7 ]- {+ @! h. a& X3 `5 c2 iIt seeks the signature of BoundsChecker in SoftICE
3 E; n6 u* m+ p3 _: t% i _* H$ [! c" `2 u! _" ~0 e! w9 E- `. o
mov ebp, 04243484Bh ; 'BCHK'
$ B1 q. K1 |9 B1 w. ?) Y5 R mov ax, 04h4 e7 G1 k1 ]6 L4 @- g9 ?
int 3 {7 c9 a. n" |! b) J' Q4 w" N d3 E
cmp al,4
6 h$ e. Y; A* `5 v4 h jnz SoftICE_Detected
/ u6 W( T, ~3 f0 c
- y: r7 b! \. {/ Z* @0 a___________________________________________________________________________# a) q3 |: E, _& z; Q
- ?4 m. U a& S: K' o, m! l! E: h
Method 02
3 d9 k, l5 k" i- z R=========, H, k. y: \- W- r0 c9 k
7 L3 P* W8 ?7 ^
Still a method very much used (perhaps the most frequent one). It is used
7 a- ?8 I& _. i6 ?' t4 S. x( Nto get SoftICE 'Back Door commands' which gives infos on Breakpoints," ]4 b9 R7 K6 e, [- w( Q
or execute SoftICE commands..." `) ?. t5 b# p( n! z3 N8 I
It is also used to crash SoftICE and to force it to execute any commands
( d8 s% v9 }) o(HBOOT...) :-((
9 L7 J9 M# h% L/ j" ]/ N k l9 B `. ?1 l9 G9 W
Here is a quick description:! W- s7 {7 m* z# c* E" w) B$ F
-AX = 0910h (Display string in SIce windows)* o8 M. C5 [! |: H$ l
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)& I) b; P9 e1 H5 g& @# p
-AX = 0912h (Get breakpoint infos)
& x+ V$ h. p- d2 `; e-AX = 0913h (Set Sice breakpoints)
- _3 A7 F4 a5 t( S-AX = 0914h (Remove SIce breakoints)
& r/ W" e! M, K5 q( {
Y5 Z6 K- J6 @4 ]' w5 w2 XEach time you'll meet this trick, you'll see:3 `6 Z9 Q7 D) G1 x) X' `; m ^
-SI = 4647h
% o' X9 }$ _/ }6 o# s/ `1 ?-DI = 4A4Dh3 \- X) J1 I! L& R5 j$ m" d0 E! w
Which are the 'magic values' used by SoftIce.
2 s/ q% ^; a' y/ M& yFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.! {. y! e0 h9 Q7 ~* e" v
: Q4 }" b0 u+ O
Here is one example from the file "Haspinst.exe" which is the dongle HASP! v- \ f2 W# U6 Z
Envelope utility use to protect DOS applications:
; ]- z: e6 J5 q2 S+ }# E# G$ b& m! P% u! r- U8 ?& W) L+ e! \
9 W& \" g$ s9 u9 ~3 k8 q5 d
4C19:0095 MOV AX,0911 ; execute command.
' U; | Q! m( k( b: o! G4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
% K" Z( Q0 a; c4C19:009A MOV SI,4647 ; 1st magic value.
: T; G5 `( _9 u |4 y% R4C19:009D MOV DI,4A4D ; 2nd magic value.
- p9 x# ^% [& m- Q5 b4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*), e, d7 x( H" H9 C3 _* e
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
0 F6 d5 C9 z9 S1 g% S4C19:00A4 INC CX) L& y/ O1 F' q+ h/ G2 @
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
4 X# t7 w7 A0 D) g, k% d) D4C19:00A8 JB 0095 ; 6 different commands.
* e" }+ R7 [; z4C19:00AA JMP 0002 ; Bad_Guy jmp back.
0 B/ q/ h) I& x& ] p# c4C19:00AD MOV BX,SP ; Good_Guy go ahead :)* v. ?4 I$ N& |
( o `4 G/ y5 s' U3 j
The program will execute 6 different SIce commands located at ds:dx, which
% s% }" X) c. d9 r6 Aare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
8 n/ _8 q+ f) l- v% R9 |* p% L1 c( Y# I2 |: q) Q$ j6 \
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
, Q6 s; w9 U9 r___________________________________________________________________________
: ]; t; w" ~0 D F, w+ j2 M; m7 n, @ m; q) X! L2 L* L [' ^' u& ?! X
, Z" L# l: F" N, z2 N1 u. C* E iMethod 03
2 k0 I/ @( K' J) Y, _=========" M0 O- s7 F2 T* p2 Y, q
, W5 `' g2 p1 K% `# r$ {Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h6 f9 M# j. x7 A6 s
(API Get entry point)
8 C8 Z c1 N9 ~- S. g
4 B. ?' c- Z" @7 ]. z' o6 c( d8 z$ }% V+ o' |! W1 I* Q3 F
xor di,di- l$ X) M7 z2 \$ Y
mov es,di2 h9 b2 H2 s- k/ ^2 M0 F" C
mov ax, 1684h 1 c' k5 R( y& |* Z
mov bx, 0202h ; VxD ID of winice
9 K, t" P: g' ^& [# n int 2Fh
7 L2 L" a8 b& w8 W( f3 g" x mov ax, es ; ES:DI -> VxD API entry point9 P& G: ^2 D( N9 w0 i. v' E
add ax, di4 g% j# \! g2 o7 n6 `: u
test ax,ax5 G! ~% v9 V G$ D
jnz SoftICE_Detected
+ @' L% k9 s/ m
+ b* P- i- `0 l* D0 Z% m9 O+ `___________________________________________________________________________
& S6 V' O9 p, Z1 t- z+ _5 @( S/ [ ^/ u# a( i
Method 04
, H% A2 F+ K4 S" Y: v=========
, u: x! M8 h- x; t( H* Y( |. E; o) d, o
Method identical to the preceding one except that it seeks the ID of SoftICE7 t& U6 ~, A9 `% s, {
GFX VxD., K5 y7 n$ Y6 l/ ]3 y. N) A
. @6 S* b: }+ v xor di,di
# e3 ~5 \4 B' Q) A+ G mov es,di* e' y, A& q- A- ~
mov ax, 1684h 6 ?# Q0 { _8 R/ N" ?' _% u& F: @
mov bx, 7a5Fh ; VxD ID of SIWVID
- o" X9 B4 R2 z x7 y* H/ L% k int 2fh
- ^9 P" Q6 ]- A6 q mov ax, es ; ES:DI -> VxD API entry point
, Q S0 {, M7 Y1 q- K add ax, di
7 Y9 k2 r" i2 W& @, I8 h test ax,ax
|1 p( y- Q9 R! `( R jnz SoftICE_Detected
% D @3 u1 R1 e& F2 t
. Q* L* e/ T4 ~+ u1 p__________________________________________________________________________8 t U- }" H: c, l! a
* G/ [- ?3 U p0 _1 r8 r1 R# m6 ?1 k
1 f0 ?& e# E" yMethod 05" K+ ?4 m0 {5 {& @# e
=========; ?. m N# s8 M4 F, S0 t1 e
1 p8 z: l# l$ ~
Method seeking the 'magic number' 0F386h returned (in ax) by all system* b6 t2 Q2 i1 H! O: y2 `
debugger. It calls the int 41h, function 4Fh.
1 U( D5 @8 d% L x4 M0 DThere are several alternatives.
% a1 B2 P D5 u3 T/ \! p4 U) z. t& `3 `$ F% W3 z3 |
The following one is the simplest:8 T+ U' q% H7 Y+ D$ F5 h4 D8 Y$ E4 |
+ Q0 \* D& ?! }8 U2 }5 T
mov ax,4fh
! y- N+ k( e6 O% m int 41h, B" `- V# c/ ?6 f: e
cmp ax, 0F386
0 A9 C2 N$ m4 i6 J' H2 j, M# Q jz SoftICE_detected
7 B* g3 \; ~5 K& i
+ v* H3 c' Z: H
5 o3 U, D' c2 t- \Next method as well as the following one are 2 examples from Stone's 8 E" l: i+ @: j
"stn-wid.zip" (www.cracking.net):
4 N% z4 @7 E L( _+ O4 P' ^: c* y( n& f2 r
mov bx, cs+ V1 f9 S5 e, l w7 s7 a3 f* S
lea dx, int41handler2
6 f( g/ j& O2 H+ ? xchg dx, es:[41h*4]' S* Z6 {- b# X; W1 M' X# O
xchg bx, es:[41h*4+2]
4 o& j$ \2 R7 }7 L; I+ h2 ]3 D, P. W mov ax,4fh5 z2 T0 j* ], E3 g3 z
int 41h6 \/ j$ l: ~1 U S7 }2 O4 a; U
xchg dx, es:[41h*4]
( H4 M+ B6 q& @ xchg bx, es:[41h*4+2] }/ l* u, W S- }. Y" A+ { z1 |
cmp ax, 0f386h# k; V' N0 K) h+ C2 V C9 @
jz SoftICE_detected
& c1 i" B( Z. `6 F- R0 v5 U" p- o+ x' f" y5 d
int41handler2 PROC
: |; [$ _4 z; |1 ~ iret8 z3 {+ X9 i/ F
int41handler2 ENDP
# S0 v; S9 H# M
! X4 K# G! f$ G: e1 p/ G4 h. h# m$ P d6 M. ~1 K* V
_________________________________________________________________________
$ a* c, `8 Z/ H
% @' X5 f( f6 f: L5 F: l( j8 p: \6 q9 N. H4 C; n9 N" ^& g7 L
Method 06
- F4 I0 C% `5 V+ r=========
+ C# `$ T9 \9 t" ^5 i, q- s* R6 D5 a( Q/ |& u
7 K/ @/ Y2 A7 _ N% N/ T" J3 \2nd method similar to the preceding one but more difficult to detect:8 B4 H8 n7 h: e
r; |, {, ^/ L3 k: Z# I+ z
- Z( P- ~! T* [( t+ K+ Mint41handler PROC% D% ]9 d A4 u' b- t
mov cl,al
: x# P; u1 m: |9 s; w iret
/ g7 B# h1 {- o5 v8 g; Q) Uint41handler ENDP
( `7 t& w6 e. K5 T$ ~; n$ o6 Z( ^/ u9 g5 R5 N
6 B& ]9 s* b% U3 ]7 ?% x( z
xor ax,ax
/ P- |+ d9 k, x0 |, g mov es,ax
4 O" y# v$ g- q mov bx, cs+ t w* {: o! g; j: X) e! g8 s
lea dx, int41handler/ M8 S4 T% w5 c# j
xchg dx, es:[41h*4]
7 X' K8 T# @; X6 Z xchg bx, es:[41h*4+2]1 `* C' T1 J! A5 Z- N$ m
in al, 40h
) }6 T0 e- c h& x. } xor cx,cx+ g/ N7 R+ F# C a' g5 A6 P( ~
int 41h
. j8 x [6 t. R3 P Q$ { xchg dx, es:[41h*4]" [/ M& {$ P# E. R9 @
xchg bx, es:[41h*4+2]1 f" E# N* @5 f6 e
cmp cl,al( c& \. k; |$ L4 c" C0 J
jnz SoftICE_detected! [- H A9 O+ D6 |" U) \+ a% N
1 Q; d+ Y7 B1 I# V7 ^
_________________________________________________________________________" T) Y# N* y |( r$ R! X
$ o& K8 |- u8 U- \/ u
Method 07, g2 b4 h$ w: n
=========
+ b6 w3 r6 b. V) m/ U$ Z% ?$ D( J3 F! I: M
Method of detection of the WinICE handler in the int68h (V86)3 M% K4 f/ S! C8 @ I2 T9 Q
U$ V5 Y9 j6 s- K9 o' s k mov ah,43h+ S2 ~4 @) s4 K8 d% I
int 68h. I Q- U8 ]" M8 s& I0 y: m
cmp ax,0F386h
$ X2 A6 K) n# Z+ l' Q jz SoftICE_Detected. W! y/ y7 Y1 s: N; e
1 Z T- g3 F/ [& b( \# P
2 { T% x. w, S' v% d=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit# |# W( n2 s' p- i8 ?
app like this:/ o6 e* W4 w. _* L& [ s
2 B# y6 j6 V+ n) q6 M* ^8 o BPX exec_int if ax==68
! |3 r* T. K. Z2 M3 b/ v (function called is located at byte ptr [ebp+1Dh] and client eip is
; E7 r/ d- g- o: [; I5 ~ located at [ebp+48h] for 32Bit apps)
% V, k6 p, g1 y7 u/ _* C__________________________________________________________________________
# @' m" A' T9 Y% c! m h1 v! A1 H4 ]0 I! N9 c) I: D
2 ^; H0 R4 W* u2 vMethod 08; Z5 _& J1 p: A% l
=========
' K* R0 F9 }; H# y2 ~3 S/ p. F, ^
5 j# ]: O9 Y- i! T- ?It is not a method of detection of SoftICE but a possibility to crash the
0 a8 f+ X- k( T6 X7 Z! j: F! V2 gsystem by intercepting int 01h and int 03h and redirecting them to another
1 x6 {4 B5 a2 `7 F: z8 j! @routine.
1 Z9 ^4 M1 B. T$ e7 D$ V O! ?5 oIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
. H3 y& x' u2 v6 i* {" Pto the new routine to execute (hangs computer...)0 m" A, h# N. a9 c q2 c+ k
" U, I( l! z' y3 p5 T mov ah, 25h
) p7 T( v0 L! { b mov al, Int_Number (01h or 03h)7 i) O: L. ^2 l4 Z3 N) ^' `7 w
mov dx, offset New_Int_Routine7 h9 h7 P+ ?4 q% T4 S) n4 Y K: {1 {
int 21h4 r. y R5 x. ~! x6 ]$ r7 e
8 q. {; ^' C" f( c+ `8 V__________________________________________________________________________
. N/ f. S1 E( l* X; k6 X; {) W! B% _) l9 q, ^4 b4 d$ n9 x
Method 092 I: a; V6 Y9 D- U3 G9 ]! o
=========
! s* Q* m7 O8 R! \% K& V. V3 d1 A2 ~$ \1 {" A
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
2 }* |& P0 d4 S' |performed in ring0 (VxD or a ring3 app using the VxdCall).' X# R7 X% E E. `) h5 n3 H
The Get_DDB service is used to determine whether or not a VxD is installed1 J8 T% \8 I/ S! X g5 t* b: v8 \
for the specified device and returns a Device Description Block (in ecx) for
9 ^& _$ j0 U+ t; \6 q. zthat device if it is installed.
1 v* _5 l7 \# x% i+ [# A3 a' I7 f" E4 k
7 k2 ~6 z" o: u, Q" v a7 g _/ b4 e mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID- a! e3 m/ @8 M o, d* p! k. D9 [* v' {
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
) j, m8 T3 f) o9 c8 n0 W' m VMMCall Get_DDB
3 Z$ N u0 }; O; ^2 w mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
: Z& i* b1 D. s) S8 G8 e: h5 _
' R; h1 o. N# W/ j0 f$ ~Note as well that you can easily detect this method with SoftICE:
9 _; d: d! X% b0 H bpx Get_DDB if ax==0202 || ax==7a5fh
1 B3 u0 B7 M2 x; J( i) S
1 s V' I3 g8 p. M, l R__________________________________________________________________________" o& L6 q* ?# j
" w/ ]0 f3 |, X
Method 10% ^# w. K$ n( T3 ^% S6 a$ \
=========/ M+ J9 M) ?% m0 P
1 m% K) C4 ]9 Y$ S T( d=>Disable or clear breakpoints before using this feature. DO NOT trace with. \$ \& s' x& {1 l1 s" U8 u2 F4 U
SoftICE while the option is enable!!6 o( k3 l, S1 N, v4 ]
$ i) r! B* C; M5 U1 cThis trick is very efficient:; @1 T! p5 X7 y1 a) p% z
by checking the Debug Registers, you can detect if SoftICE is loaded
( |% y6 l# g/ l3 ?' k& U- h(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if: t% D; Y9 G: p# _
there are some memory breakpoints set (dr0 to dr3) simply by reading their/ d3 k8 n5 N }& I! \5 n" t
value (in ring0 only). Values can be manipulated and or changed as well; v: J( X8 h- {1 F; ?
(clearing BPMs for instance)1 w2 h4 E$ p- b9 h& F. u" @( a2 Q& ?
1 i o$ W6 }1 _" B
__________________________________________________________________________/ z& Q9 p, G& R3 ~9 h
* D0 @8 [8 K4 |* A. s9 P' h) ]
Method 11" v5 }; P U, x
=========/ ]' r9 T Q v; n& o
4 h/ I" d4 e: |. F. \" Q9 s
This method is most known as 'MeltICE' because it has been freely distributed/ B0 C p6 p, h( M [3 n2 D
via www.winfiles.com. However it was first used by NuMega people to allow
& ?1 u# f [% i% _' `Symbol Loader to check if SoftICE was active or not (the code is located8 c& X% F6 i- r; J# e2 p; C$ H; c
inside nmtrans.dll).
1 `" t* ? G( T$ w% g, l4 t2 h9 `! s* P
The way it works is very simple:( O, Y0 Y" `$ L. N/ ~
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
8 y9 [4 M5 n9 KWinNT) with the CreateFileA API.9 z9 G" s5 L/ |% I) F
4 q0 q5 ?$ Y# `& l+ B! c5 Q
Here is a sample (checking for 'SICE'):3 m9 |( x- `* q2 n" i; a+ Z& \
; c- o0 P+ O7 Q# x6 ]( h
BOOL IsSoftIce95Loaded()1 o' r# R( b0 L- J8 l0 A
{
4 T! A$ U+ J3 `: c% m HANDLE hFile;
. T6 Z6 G' s% a; g; j hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
# ~* ], F+ }0 u# ~$ A9 v2 `) _ FILE_SHARE_READ | FILE_SHARE_WRITE,2 y/ R! `7 {% Y2 a! v3 a2 r
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);6 ~2 Y4 H9 @: y) V
if( hFile != INVALID_HANDLE_VALUE )0 U' W: j5 f0 E, }
{
+ U# A: |7 ~) n% }3 E+ u CloseHandle(hFile);, Q# c$ A% F) Q+ L0 h; x/ R7 j
return TRUE;
; ~9 l) a4 W. m3 R }
& D4 ?5 R, ~: y0 Z9 @+ T return FALSE;
% j8 m: m8 U9 L" ~4 ?3 p}, E$ ^7 r0 D; A/ Z+ k1 }' J
4 a+ t ?/ C) f: T; Y' M" w
Although this trick calls the CreateFileA function, don't even expect to be! W9 A& z! Z+ K3 ]$ W: ~
able to intercept it by installing a IFS hook: it will not work, no way!
0 D2 k, }7 U9 E# c4 LIn fact, after the call to CreateFileA it will get through VWIN32 0x001F6 w$ M' p/ F, F- }/ g, m$ X( @
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
. A! c L) |8 z8 M# `. wand then browse the DDB list until it find the VxD and its DDB_Control_Proc8 y- m0 D0 p3 W! A! V5 J& N
field.
/ w6 f5 a |/ X, ^ E, C0 GIn fact, its purpose is not to load/unload VxDs but only to send a
7 @& ^4 g3 H/ E# u$ M- E# fW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
' M; z0 E- k1 M. Y/ ito the VxD Control_Dispatch proc (how the hell a shareware soft could try; [. p+ x0 i0 N: M5 r. e* z7 [7 |
to load/unload a non-dynamically loadable driver such as SoftICE ;-).) f; K5 x; I. i2 e
If the VxD is loaded, it will always clear eax and the Carry flag to allow
( |$ [% o+ k: ]7 s+ F4 k% M" Y+ Uits handle to be opened and then, will be detected.0 H/ Z' m, _- ~4 O7 J6 p- O
You can check that simply by hooking Winice.exe control proc entry point
. ^, ^7 v) b( L0 L& @, o* g. i2 `while running MeltICE.- l9 _3 s& b( b( k8 H8 }3 h
5 L1 R0 {" V1 e$ P) }, m
1 ^1 L0 }0 A+ L {1 P7 F+ j 00401067: push 00402025 ; \\.\SICE6 @7 [9 E& u) I5 ^% L# n4 i
0040106C: call CreateFileA7 o% x+ {% v5 v' J3 _8 {
00401071: cmp eax,-001! u7 `, K; @0 m4 w5 r* K
00401074: je 00401091$ q- K' M+ G! f& w# T3 z4 a
# K( V' m3 U1 [* H2 t% N1 y- n
* U) f- F* Z+ T2 yThere could be hundreds of BPX you could use to detect this trick.
! [: D$ B+ n! O/ X* G' X( I$ l' k-The most classical one is:% B* L: Q4 X# i' [6 {
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
: U2 }% l" j5 r *(esp->4+4)=='NTIC'
- _ [9 `/ j0 C% d- N& _7 w- |* T7 `. _
-The most exotic ones (could be very slooooow :-(
- O! n( B+ | }1 H& E0 B1 k BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
: V! C- T$ P- V- b6 i, \3 N u0 ^ ;will break 3 times :-(9 @0 {0 X: C& V. y/ z a. K U
+ n6 z6 q. a0 i! u3 y- p: q: g+ o
-or (a bit) faster: $ @/ ^6 J- S* }6 n* `' _4 X0 Y
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')& w# p: q4 K- r, k7 s
: R: l6 K! F. O1 @. }7 {
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
v Q2 D9 Q0 T' E5 u0 u: T. [ ;will break 3 times :-($ p% d. I* l: e% x
+ w, H3 ?5 j2 M-Much faster:
, U1 ?( F. ? r9 r, y' i BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'1 B9 g, a( Q2 J. O9 r
4 T& u* Q2 w' d+ C" Q6 t; g
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
6 f8 `. j0 c, f+ Efunction to do the same job:. m G2 |& F. U) x# Y
& a. B9 Q0 D% J; h R* r. \ push 00 ; OF_READ
! c% A8 X5 n8 a5 F0 | j mov eax,[00656634] ; '\\.\SICE',0
$ }% |+ T7 b+ E( K8 c/ q2 b push eax
; A* Z2 X" A4 I1 X3 c call KERNEL32!_lopen, H5 ` S& E; g' T' X
inc eax" R+ F/ S( ]. H3 f, E7 I
jnz 00650589 ; detected
1 i6 i2 ~" X" v3 H [ push 00 ; OF_READ1 k/ |3 K6 a* K, I' e2 J
mov eax,[00656638] ; '\\.\SICE'
% f8 x# x! u. r% x# m- F X* l push eax( `8 Y% s4 I) J* D/ u# l6 [
call KERNEL32!_lopen2 @. J$ [( m- H
inc eax
+ |- Z7 a O; w' k2 u; u6 B jz 006505ae ; not detected3 d7 u6 C: e9 |2 h3 C0 ]
" F4 ^3 H* Q5 b* D+ R4 P3 j3 P5 u! G- p! R$ |0 Z% W" l& Q2 W
__________________________________________________________________________
1 C0 d1 j- z" e; L4 K7 I
) H8 D' x# b$ I- X) ~Method 121 h4 S) J# i* o' ^% d% ]
=========% G0 |6 M M) D0 k0 |
' ]3 @; N" e- c; KThis trick is similar to int41h/4fh Debugger installation check (code 05
# z# y% O+ ^; u8 V& 06) but very limited because it's only available for Win95/98 (not NT)
0 v8 t6 i4 ?0 V7 D! H7 Z* q( xas it uses the VxDCall backdoor. This detection was found in Bleem Demo.8 m. {, j! }: ^8 n% y
/ s; L: T+ L1 s0 I# ]0 y- ~. I: v1 q push 0000004fh ; function 4fh
5 E6 K2 H. v( P push 002a002ah ; high word specifies which VxD (VWIN32)
3 \6 Y8 w, d m, ^) Y7 i( x ; low word specifies which service
u5 v2 e: O7 u3 ^" G (VWIN32_Int41Dispatch)- v; x& Y* Y8 ?& Y+ Q
call Kernel32!ORD_001 ; VxdCall
) Q; [* T7 g0 V- D0 \; h1 G u cmp ax, 0f386h ; magic number returned by system debuggers2 Q" v4 \& o1 E2 A
jz SoftICE_detected
0 D; T) x! j- w, b8 U8 g2 S
4 N1 s# Z3 J% ?# A/ `& |/ q# EHere again, several ways to detect it:
0 \5 }. y) t. d) e+ |
0 H0 f G, U# n% A8 z( Z BPINT 41 if ax==4f* Z6 K. V. X. ~+ o
f# k+ F# _% e. {% q BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one/ n C$ b% S9 Q) D
L; {" d1 M8 ?5 f# k# J* z3 r
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
" q( s8 j4 j6 D9 T \0 O4 r3 w \
2 f; _% m2 A6 k& P BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!! V) _3 R! p7 N/ e7 t
% o. P! M( ~( {__________________________________________________________________________
6 X& Q, ?8 Q$ z
1 Z( K7 @ Y5 N$ J5 k' e$ R8 jMethod 13- Z# s# E8 \; [' b
=========! ~# z4 \5 ^- C* q
! i4 Y1 P) j) I
Not a real method of detection, but a good way to know if SoftICE is8 V p' W, E7 V. N! X! U8 H
installed on a computer and to locate its installation directory.( I3 [7 I+ [& l" j5 h5 P- a
It is used by few softs which access the following registry keys (usually #2) :# _4 f6 d" S- Q6 j) }6 `
6 C. E- n/ z# o* @-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion# L, o9 I- T' W" E# I) P
\Uninstall\SoftICE
. P. _' p8 U0 ^" w' T. S-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
4 l9 l2 V1 M2 o4 J-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
! b' e5 p; y; j6 @/ U\App Paths\Loader32.Exe
9 D. o% ?6 M; u* {5 l# R0 `9 I5 Y- _! r( m8 W
9 C% T) a! I ]5 \0 MNote that some nasty apps could then erase all files from SoftICE directory
- M8 P8 {. n) C) s" }+ E(I faced that once :-(
% D% B% z& y! _6 n# f
! w; M! `! F/ u3 _5 \/ A0 NUseful breakpoint to detect it:$ Z3 Y1 P: T* p1 ^1 X6 Z
5 c4 O' Y: Z% @4 z* D7 ?! I$ |1 U
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
7 M t Q; _3 S+ z1 V
9 P, x9 F+ P. z6 z: ]__________________________________________________________________________
8 M0 Q% s( \( f6 r+ k+ }( m5 q2 L9 F7 M" W) O4 [5 N3 P7 g$ w
7 m3 o, W! f. q
Method 14
9 g# k# T0 p1 C& u+ |=========
& ^9 N. P# q( J2 D e2 I* `
* ~6 D! i C& x) T aA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
: I8 A) Q0 i" K {is to determines whether a debugger is running on your system (ring0 only).+ v8 {$ f' O+ Y G; _. i
; G6 r: f* ^# _
VMMCall Test_Debug_Installed
) z) ~3 W0 M5 w# z8 x: E2 s je not_installed
' i! \4 f6 o3 P& ^4 u. d2 P4 {! b
+ L3 @) v/ D0 }# K& P5 ~This service just checks a flag.( o: j; ^8 y/ Q
</PRE></TD></TR></TBODY></TABLE> |