<TABLE width=500>
% l# t5 J( Q# | h<TBODY>
/ d! U$ M8 C4 e7 ?+ i2 O<TR>
- {8 w7 O/ b ~<TD><PRE>Method 01 0 \6 Q8 b& V+ A4 H t: K' i3 x9 s
=========
0 r+ | z; z$ E7 ? N. Z% ?# n5 k0 ?4 ]! _+ Y
This method of detection of SoftICE (as well as the following one) is
! n: Z5 n0 q% }3 aused by the majority of packers/encryptors found on Internet.7 L. Y# u; X' w1 {9 H5 q0 Q
It seeks the signature of BoundsChecker in SoftICE" _. w5 v) }+ }8 A1 V' z
4 O0 B. k3 n6 Y' o4 h% ^
mov ebp, 04243484Bh ; 'BCHK'
' t+ i! ^( j0 _ mov ax, 04h* w! G) W1 z) E, Y U( o* w: K7 g
int 3 4 ?0 U$ o/ M. Z) \$ T8 Q6 ~
cmp al,4
) q: C5 R9 Y: j- [0 s jnz SoftICE_Detected
0 Y# V9 ~9 K- X$ q9 e/ j
, C! A+ l4 n$ N6 _- V___________________________________________________________________________5 t( p& F) d, m: h$ w) |
9 e, I& x G9 g" P- P
Method 02( O `* b/ g* X. l' Y, E, s
=========- g: G- X5 z' ]5 }3 K s) B
. V' M6 `# u: w3 {- i& rStill a method very much used (perhaps the most frequent one). It is used8 q3 T* r: R: N$ _; }* Q4 ~1 [
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
+ f) p" s. ~; E* @( por execute SoftICE commands...
7 u; Q* i# D" A3 D8 zIt is also used to crash SoftICE and to force it to execute any commands0 J' [8 S3 M; N# Q# N5 U/ ^
(HBOOT...) :-((
7 n, g$ Q$ }0 k( V
2 I, F4 ]# K' K* ]Here is a quick description:
1 s- d( }% x3 Q-AX = 0910h (Display string in SIce windows)* _3 t; y3 b( W: B9 F5 S
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
$ A5 B- j' q8 G& R6 t ^-AX = 0912h (Get breakpoint infos)* e B! e4 {& f) d4 d! ~
-AX = 0913h (Set Sice breakpoints)) |9 ^ C# e6 J; p$ A4 K
-AX = 0914h (Remove SIce breakoints)
# K b4 H. ? U. [, {" e5 w) j7 P* u4 Z3 _" {2 ^1 v2 _
Each time you'll meet this trick, you'll see: v8 Q! }% M5 c
-SI = 4647h
2 z( z% }* _2 {-DI = 4A4Dh
8 x" k7 S+ s; Z% \, N& \8 ~# \: b jWhich are the 'magic values' used by SoftIce.$ l. M1 g1 \- X" @: j6 L6 Z
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
5 a+ e; e7 N; c+ Z% y
. N$ K- r: r+ U1 ?; X9 _4 X! h3 LHere is one example from the file "Haspinst.exe" which is the dongle HASP
& ~9 U% Z9 D# d5 n, [7 C2 n. y6 v) ?Envelope utility use to protect DOS applications:4 @$ \% M) E' z' F; Q
& ^9 ~1 U$ ^9 }$ W
& v1 f0 v- M$ n8 S1 ?6 J# i4C19:0095 MOV AX,0911 ; execute command.- p! w+ _! s& r
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).) {9 T! ] j8 r; z8 s) Q8 i4 ~
4C19:009A MOV SI,4647 ; 1st magic value.4 Q# _- ^4 X, V0 Q
4C19:009D MOV DI,4A4D ; 2nd magic value.2 D5 E8 \' \7 l2 [
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)5 L0 l- n/ E R! B- w2 C
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute7 a& ^! v6 S( ]1 `1 N' @
4C19:00A4 INC CX
% b5 e; f' O" M* D4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
' d0 z$ h* f7 a4C19:00A8 JB 0095 ; 6 different commands.
4 w r3 l' I8 F0 W0 u& ^4C19:00AA JMP 0002 ; Bad_Guy jmp back.+ G/ M* v2 W0 p3 o$ }. ?) _
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)' T& ~( q) Z+ X4 N0 u0 M
, u5 N b) i# _ Y5 O1 h" a7 AThe program will execute 6 different SIce commands located at ds:dx, which, M: y' @6 t) x; d% @1 x6 O5 x: U
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
" v0 x& b& }! y/ o/ E0 B
3 J$ b2 R; l8 F8 B- `* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
$ d5 N) T9 ?8 `: M___________________________________________________________________________# N Y5 P2 q1 y, v4 r5 b |
0 V8 e' }. Q: K6 p1 j
, y7 j5 |* r# u' dMethod 032 g9 b6 {; v! P: v L* E
=========
! d; n. n9 Z, O/ \
3 S8 c# E/ z% c/ bLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
& O2 r) D) Z& M. g1 Q& h4 R6 L(API Get entry point)/ u& Q" \' v# K# U* v: c
( c- b2 W9 g' ?. |7 M7 E1 }0 i% g7 y3 l. Y0 a
xor di,di$ H6 a$ ?1 G) {* |/ f
mov es,di% {: B# q, r$ h \; Q6 U
mov ax, 1684h 5 y' w, N" H+ B% y3 ~, I
mov bx, 0202h ; VxD ID of winice6 x y7 @& Y& |: N) m
int 2Fh7 _1 o' g' ]1 l0 U$ R2 c# e6 y9 G _
mov ax, es ; ES:DI -> VxD API entry point# @$ Z$ X% {& y- v, Y3 W! H
add ax, di
$ ^- {6 b: X9 Y4 @$ t) @ test ax,ax
) _: q. S- k3 v7 L; T) M$ n jnz SoftICE_Detected
2 M" \/ R' p* |! F7 S/ u, s: O
; J1 A4 T$ K6 M8 Q5 L; T% O3 [___________________________________________________________________________$ E: }2 P7 q3 Z. {: q5 @
: A, w* Z# o, U# }6 h' d) y6 H
Method 04
- m8 M. r- {& {=========$ w, `: O& ?8 l) Z1 F
9 w; `! D& C: u: p8 C: g8 G8 mMethod identical to the preceding one except that it seeks the ID of SoftICE
1 m: p$ J; p0 ?/ B7 ^7 M( `3 ZGFX VxD.. S5 V, u, {7 {
/ y8 i. W, A( l$ a1 ~! g/ M
xor di,di
! o. s+ q( Z7 t mov es,di* W3 [- _& ?$ R9 x6 }& o8 X3 w- \
mov ax, 1684h
* d9 K$ y% X8 P mov bx, 7a5Fh ; VxD ID of SIWVID; T! K3 Y% o! C8 u. `5 _& P8 I
int 2fh
( R& `$ g8 m+ }; b6 |, e mov ax, es ; ES:DI -> VxD API entry point1 U) z: N9 N, S
add ax, di* \# F3 P3 J$ D6 w: Y; A/ Z( a; X
test ax,ax
6 u, H: {4 o1 P2 b jnz SoftICE_Detected3 n0 ~5 Z0 L; G
$ `0 O+ z. }7 p1 q s6 V__________________________________________________________________________
9 \2 H# F' u( i& ]2 n5 V) j D: |" |/ i8 }1 Q* z8 {
2 i) p. `# ~: ?" H' TMethod 05
1 l2 B/ ~4 n9 D7 R=========& n2 t1 D0 s5 i- g; O n
! M5 ~1 Z) I/ h! J6 p; w+ aMethod seeking the 'magic number' 0F386h returned (in ax) by all system. |1 |' H) @; @6 P$ c
debugger. It calls the int 41h, function 4Fh.6 J% V- K- J6 R, ]8 |
There are several alternatives.
+ I. v" G* U. S+ `7 J
" s) M! y8 o6 F: ~8 xThe following one is the simplest:
: p' U$ P7 M3 D" A1 {
; Z( L/ z' o% C' G" Z mov ax,4fh
" \9 F- E, D5 p5 O1 Y( e int 41h6 @9 f7 r0 j2 ?2 }3 V. A$ o8 c8 L
cmp ax, 0F386( {* [8 T Z3 [2 n, u
jz SoftICE_detected
1 \! | p9 Q0 z# m
2 I% a1 v# B0 Z. v/ j' ]9 u6 v) \% I: |5 |! @
Next method as well as the following one are 2 examples from Stone's
: q% P `- g0 n; ~% h7 ["stn-wid.zip" (www.cracking.net):: w4 D: [7 J/ ]1 s
N; i; m( ]4 |1 E8 X
mov bx, cs5 V2 R5 ~1 o7 O
lea dx, int41handler2# J' ] t, M5 t/ u; J+ K9 B
xchg dx, es:[41h*4]' l: s: m* Y: ^. g: T6 K9 Q
xchg bx, es:[41h*4+2]# R \+ e9 a8 T
mov ax,4fh
3 f4 Y' p9 p. `2 U0 r2 u# o int 41h1 ?! z! b& `2 L
xchg dx, es:[41h*4]$ u0 U+ O, M6 Q0 }( X1 O" ~
xchg bx, es:[41h*4+2]! O4 {$ D1 X3 x1 z7 ~) Z! r
cmp ax, 0f386h
; p- t. w% Y; B. \: `1 ^( d4 m. o jz SoftICE_detected
. o; s: ~. Y; C5 g8 w/ W! U" |0 e8 Q0 ~
int41handler2 PROC$ d$ F% B. w q* {$ U& d. M
iret3 ~/ J' K" ]% h# |. j: }
int41handler2 ENDP( _; o* e6 i3 F
7 V! l ?9 Q( v% v) U5 _* B- x
( G4 n7 Q* w0 T
_________________________________________________________________________) j+ p' |# y( ?6 P$ K5 D4 y: y
7 z: f: S' w) a( P) M2 M+ G
1 \ q, `8 O' l
Method 06
" j( ?" p: w! j, z% X=========5 T, P+ X/ _. Q0 m d% i
: T& q% U" e% a% o% @; u ?
% a, Y( }. @5 X% }; r$ n3 z
2nd method similar to the preceding one but more difficult to detect:
9 s9 y) D: ]6 B U# @, [9 h
; Q7 j6 t7 h/ W, C7 j" y* m( g/ H5 s! t( @$ h
int41handler PROC) S" T. u4 f% P! K6 d) e+ Z
mov cl,al
6 V. S0 ^+ ?: {' {/ J iret; x h0 e1 a$ w2 t, }
int41handler ENDP( c# o$ L2 m8 S4 Y4 r4 A. q% f
+ Q9 j* W* J: j7 P9 ~
( e+ `, R9 f& g& [! X2 a
xor ax,ax
2 u. o( A9 g: B mov es,ax
: |. j" g+ I2 A! K& S+ l mov bx, cs
1 X3 X( ?- Z( v1 w! M0 ~ lea dx, int41handler* E. J: N( M/ o
xchg dx, es:[41h*4]
/ I- L# {, X# ]: c xchg bx, es:[41h*4+2]. N- M' m& i' _9 ^* H0 ], ^' z
in al, 40h
+ o+ p0 v! b8 A+ g2 y/ e( Z xor cx,cx0 N" m- t% ]1 l7 _$ V& a! U- g
int 41h
7 i! a. K/ X& L. I& G7 G1 g$ r1 A xchg dx, es:[41h*4]! Z1 W& H* x+ k# P2 ]) \- G
xchg bx, es:[41h*4+2], d# o w G% B9 g: ]9 j. B: R5 D
cmp cl,al, R% t+ b6 Q, V8 m6 t8 x6 m' W
jnz SoftICE_detected
3 V+ W: v: w$ u0 x# k8 i3 v I
/ F* G& C7 y8 V' m" @3 W5 y_________________________________________________________________________; j0 c( N5 I; H/ J
6 c8 d, I- {/ M4 q9 O
Method 07
* K! q- |, I' h8 m5 r- v0 `3 j9 K; k=========
$ c5 T! ^3 D, ?5 ]" @8 A" j. r% e& W! A# T; b* y
Method of detection of the WinICE handler in the int68h (V86)
! E% [: d; n( Y5 |6 m Z& b8 w( X6 u+ f- x2 \" d& b
mov ah,43h( K8 K" R3 Q& v w+ m
int 68h
& g8 l: J* ^; j: ~2 x1 b! N" _ cmp ax,0F386h
7 d2 j, V, |7 k$ p2 L$ e( G jz SoftICE_Detected2 z' D: V+ [" k% j- s8 |0 q
# I: G3 H/ S: u; U0 {* A1 i9 ]: k6 c
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
+ N3 i, ? Z0 r app like this:! `7 l4 f. S1 ]% D- K+ l
/ _" J6 N2 Q" ]6 M
BPX exec_int if ax==68) s/ z& S( ^8 T( b7 a( I
(function called is located at byte ptr [ebp+1Dh] and client eip is
1 B( Y4 r- z' b) J located at [ebp+48h] for 32Bit apps)3 Q. ^/ z- g! m
__________________________________________________________________________/ G& r; x9 ^, p. t( Z9 P" x& S8 ?4 |
/ s3 v9 ^& O( n' w6 S# t% Z% x5 \$ n* r: P9 E7 ]3 _
Method 08
# n* V, {6 ^* N9 G+ g9 M2 E/ U=========9 O5 I. v- {6 g B
+ Q* g8 g/ Y$ k, X( V7 \It is not a method of detection of SoftICE but a possibility to crash the2 @; `) K0 N2 u, J
system by intercepting int 01h and int 03h and redirecting them to another
" Z. Z: z, S% {" Sroutine.0 s, u7 ^" I. g; u
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points' O. a. s" p. P/ i0 d
to the new routine to execute (hangs computer...)5 ^$ ?. y+ Z; }( B. t
% |0 \3 K" y* W x J8 T3 I5 X1 } mov ah, 25h
0 O' s! Q1 r# K0 F- b, Z mov al, Int_Number (01h or 03h)( v& j- @- S, X( L0 C
mov dx, offset New_Int_Routine
5 q) `' S8 v4 K1 A, k/ z# I. \* c* X4 D int 21h- n6 a8 y' z4 I1 i7 ]' h4 T
6 c2 y' L7 t$ m: Y5 r# ?__________________________________________________________________________: _$ h! z5 |* Z; V/ W3 o; |
8 p$ d" y7 S5 C r9 |- [" y+ RMethod 09& W4 L; m5 f: Y& ?
=========
1 X9 x' m2 x& X6 V5 D; H7 u! b7 ^/ ]3 f& b- S) O4 y& y3 r
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
9 A$ l; l! C) h% l3 S- P2 u# mperformed in ring0 (VxD or a ring3 app using the VxdCall).
, B7 a/ ~( P8 n! w0 o0 k, XThe Get_DDB service is used to determine whether or not a VxD is installed4 o6 w/ J/ z" o( t
for the specified device and returns a Device Description Block (in ecx) for
7 H1 \( u% C' L6 V! Pthat device if it is installed.
- R) t" H |3 z4 i5 a- e9 d7 U4 q [. C+ h4 o5 V
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID' T9 d; r* h H0 q5 A9 X
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)& J, V3 |/ S1 E1 D& {. q1 F9 o
VMMCall Get_DDB( L- ]. {+ z" Y7 I1 {
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed" s! r3 k& r% `' v& S) L0 p' z
1 C) E' H6 G# B5 N* `/ e; n
Note as well that you can easily detect this method with SoftICE:; u6 f$ D) b$ r
bpx Get_DDB if ax==0202 || ax==7a5fh
3 G1 o- T* I1 S0 b8 L' n( V2 f* U
__________________________________________________________________________! M; H( Y( L" O! k/ Y) ]
1 b' W4 k0 q$ V; A) {0 H
Method 10+ k9 \* l! I% @9 O, {5 J* [
=========, c1 B) x Q9 a7 S; ?) u+ c& J
- E H1 L7 W/ ?9 E8 S
=>Disable or clear breakpoints before using this feature. DO NOT trace with2 O9 g6 _% x( k! M/ p! S8 \% u
SoftICE while the option is enable!!
S' {' q ^2 {* s2 j8 R9 W# F+ {% P5 m" ^
This trick is very efficient:
/ `4 I" d8 U2 i; w7 dby checking the Debug Registers, you can detect if SoftICE is loaded1 R7 |# {% `1 E+ P/ U
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if% v' G, ]5 z9 u/ R" D# j
there are some memory breakpoints set (dr0 to dr3) simply by reading their
) C4 [, R [! U' p# g# X4 ovalue (in ring0 only). Values can be manipulated and or changed as well9 e A; ~, B! j; b
(clearing BPMs for instance)
. G% X6 h3 T3 ~- o( _8 Z
6 _6 Q3 h7 B0 |* B2 B; H* m% b__________________________________________________________________________
5 q9 |9 [7 y6 {, T3 [+ ?8 [: D0 `5 R2 \9 |' n6 a
Method 11
1 ?! \4 N4 _& J0 ]9 q- d5 F7 r=========" b7 E6 i8 b1 X4 j2 L9 u- p
9 A$ C, [- _4 {. B
This method is most known as 'MeltICE' because it has been freely distributed
" g/ e! v2 k: r* X& }via www.winfiles.com. However it was first used by NuMega people to allow
$ }3 V; M# s1 QSymbol Loader to check if SoftICE was active or not (the code is located. c2 [2 B" c! x4 W' S
inside nmtrans.dll).
8 i1 G9 a! h1 E7 E$ o) C
" @( C! ^ M( u, `( _; ^The way it works is very simple:1 A' P# Q0 @( o$ O# N
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
# j. m$ l1 e- `+ d' eWinNT) with the CreateFileA API.$ r; T, v& S; o$ w7 r( N0 C1 ^
. i7 o( O: h7 THere is a sample (checking for 'SICE'):
O s& J, C3 T, G# W% j+ W4 V- R: m! N3 {" O
BOOL IsSoftIce95Loaded()
" _7 l1 P- D- ?5 \2 @- ]6 ?& F7 v/ }* E{
0 S: Q* w4 z: F$ ^9 _ HANDLE hFile; y0 C I/ f4 @
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
. M% b' \* b$ C FILE_SHARE_READ | FILE_SHARE_WRITE,
0 f9 X& I8 O# `' P: `. Y- K NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);( G1 G7 P. i, D7 |; I
if( hFile != INVALID_HANDLE_VALUE )
7 h. Z4 ^$ Z, e& L {
% C* V. b; t2 X% j3 R: U# @ CloseHandle(hFile);! d% q' \: c. h$ x3 x
return TRUE;2 n u! K/ @' E7 L8 P6 r
}
# \5 f% _8 W! m$ i+ x0 V" [# T return FALSE;
$ q/ Z# x: T7 i1 d}9 d# @$ o* i4 E
+ d7 B: z! L# M- e
Although this trick calls the CreateFileA function, don't even expect to be
; F1 l6 f) k0 p3 eable to intercept it by installing a IFS hook: it will not work, no way!4 E O6 v- B2 a! F7 U
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
0 H) J3 s5 p" A9 A) t6 Hservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)% j3 `8 D4 A$ X7 x/ F% F
and then browse the DDB list until it find the VxD and its DDB_Control_Proc& w3 v( G/ g, _/ x( M
field.4 {2 X! j( a4 \ P. a4 x
In fact, its purpose is not to load/unload VxDs but only to send a
7 \2 k( H" _: L- l5 g' M# |8 nW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
6 k, e* z1 c: `5 ?, f3 ^4 gto the VxD Control_Dispatch proc (how the hell a shareware soft could try9 q. F+ O7 r: c7 P5 u9 d- q
to load/unload a non-dynamically loadable driver such as SoftICE ;-).# M! c5 \7 E; i8 ~/ j( h
If the VxD is loaded, it will always clear eax and the Carry flag to allow# P. \+ \5 }% e/ w8 l
its handle to be opened and then, will be detected.+ t; b5 j' ?) V# Y2 \' v
You can check that simply by hooking Winice.exe control proc entry point* L- O. q+ A9 w/ ^: L
while running MeltICE.
7 n' s7 s, V9 B2 \! ]5 ^
+ N) E+ \" E" c: Z1 F' J; m# C/ N3 X3 Y/ F( q' }8 m
00401067: push 00402025 ; \\.\SICE
/ H3 Z2 g# a& Z, D1 _( K7 W 0040106C: call CreateFileA
% c# C6 I: a) t, _* D: _0 M0 F 00401071: cmp eax,-001
3 z' |" J5 g2 I6 f! T8 R- s 00401074: je 004010914 h; _6 L' A, d
. [, P) s# i5 _
4 ]( t: `, J9 E( w" `There could be hundreds of BPX you could use to detect this trick.
1 X5 x* n, ^# a+ G: T-The most classical one is:7 _( U% A8 u$ N* b6 c! S
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||. d3 _9 I* G% E+ w1 I/ P* }8 ^
*(esp->4+4)=='NTIC'
% F& w! T& |3 O5 z7 v; W; ~; A
-The most exotic ones (could be very slooooow :-(
) T5 B& n0 h" y7 y4 X/ v U; S! _& | BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') ) ~+ E, R" c7 T$ g: l8 O
;will break 3 times :-(, @# H6 }" y' _
! F7 \1 t: o# v; O-or (a bit) faster:
7 M5 K9 [$ t' \* V) w; q BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
% p, R A! }6 W& M& u% \, j4 J5 a" B0 _3 u; F& R' ]; s0 E3 |2 B. M$ X( A
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' - s1 } l7 G# `: B
;will break 3 times :-(3 b* u, |# h+ `( {4 g" R/ K* M
/ U. G6 l' X% y: r
-Much faster:
1 o: n) d( c4 R) l BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
3 T+ A+ j, q, i5 p, |$ j/ n3 K: T
% o0 }. K. H! H8 d+ w# {Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
L4 U# s7 f' q& \function to do the same job:
" r8 F4 H, O3 R* o) g# p/ N# l. k! F0 Q' L" p( ]2 ]8 j: W" N9 o
push 00 ; OF_READ
# o1 Y% i2 @1 a mov eax,[00656634] ; '\\.\SICE',0
7 F' @. k% l9 L' f% L push eax
0 g& k' L; w, U0 H0 p call KERNEL32!_lopen" |! D7 u; ?, L/ N% ^6 y! k9 m
inc eax1 x" j `0 Z6 W h! X7 r. \" k% R
jnz 00650589 ; detected
n5 @- J" N! S! B, {! k) _ push 00 ; OF_READ5 l4 G; L; d; W
mov eax,[00656638] ; '\\.\SICE') q+ c9 t3 v- ^/ ` d- ]3 ?8 _
push eax
7 ?8 _1 |# b+ n2 z* V7 F call KERNEL32!_lopen! }$ t% {; W9 b3 S
inc eax
6 a @5 r$ r( F: A7 b, ]( _ jz 006505ae ; not detected
7 U; R5 g5 ]3 j) ~( D3 t8 f+ u: R( J5 t
7 j7 e7 v% D+ b5 J( f__________________________________________________________________________' E; V8 c8 M# ^% _7 w9 {# a1 M
5 f3 P2 u( m" x1 c7 kMethod 12
9 J- k+ {2 f' \( f5 J1 C=========
/ T: L2 |: w& F* S5 l) {% U7 i2 c4 T% c/ ]# M
This trick is similar to int41h/4fh Debugger installation check (code 05
( T8 [4 K# O5 k ~0 o& 06) but very limited because it's only available for Win95/98 (not NT)
: D9 @7 r. d6 n# h% j! ~as it uses the VxDCall backdoor. This detection was found in Bleem Demo.: A. s8 X3 i& k8 A _ y5 Y) S
2 w$ {' q. r4 K# D+ h/ W) r; r
push 0000004fh ; function 4fh, `$ y8 i: D2 z- y7 g+ y
push 002a002ah ; high word specifies which VxD (VWIN32)+ Y" b9 U% @) Z# d6 S }
; low word specifies which service5 x+ o( b8 a) A% ^; v9 a8 Q5 a
(VWIN32_Int41Dispatch)
2 j$ m- {' W6 h# f3 }% ^" S! d( l call Kernel32!ORD_001 ; VxdCall
1 \, }2 h! e( `1 O9 T3 T cmp ax, 0f386h ; magic number returned by system debuggers
3 }5 d5 \% l* w+ S6 l jz SoftICE_detected
3 b" d6 P+ c% k
' \! P! X9 d; DHere again, several ways to detect it:
) q. {7 n! x4 W5 t( K' L: G
( V7 D. Y. L6 _# G BPINT 41 if ax==4f
8 W. i& t; U0 R7 E. e
' ^ t( w* G% ? BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
) C+ r! M P5 y# M8 z- S1 i: z% J1 b/ S6 N$ r; z; R5 x, l$ n
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A2 P! p" {+ A! V7 e. S8 z r
% A) j6 m2 n" N. C! M# N, ?2 w3 u
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!: r% u+ _, E, e9 S' ~9 u' Y5 e
/ h! |6 L* ?) t6 H3 Y" s
__________________________________________________________________________9 S9 W1 l3 E( ^( R& q
& [' s; [8 a9 Z3 ]5 `Method 134 L7 X) E, v5 z, }) x
=========% c& E: l6 {4 v2 K. x2 n" t5 R
$ y5 g9 [- z/ W: ~2 O G
Not a real method of detection, but a good way to know if SoftICE is% A' L6 f1 e, x a0 A {
installed on a computer and to locate its installation directory.
9 ^ l. a2 m5 N6 z/ y, CIt is used by few softs which access the following registry keys (usually #2) :; K% q& ?9 q& i# F
! [3 V4 ]; r9 B) l; q-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion ], k2 Y6 K8 ~, w6 K- I) [7 w
\Uninstall\SoftICE
$ N" J2 V$ V( d-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
+ o6 L# i% x' C! f9 N-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion7 r0 b0 g, R s/ H4 S9 W
\App Paths\Loader32.Exe
2 {9 i' r0 h/ b# e; w- P0 z: e$ z& w3 }0 f
; f" b2 Z4 w" wNote that some nasty apps could then erase all files from SoftICE directory; F. @1 T4 N' U
(I faced that once :-(
6 J- L) e$ ]1 ?, {9 T$ w, s# z4 W8 ]
Useful breakpoint to detect it:0 U+ [( j- D1 S
7 _) V! @# y1 w( b3 K6 Z( E
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
l1 ]6 K" K5 G7 q/ W. {* _/ b
; @5 B k) M6 i6 Q: D# ?9 _: [__________________________________________________________________________
1 A7 [9 ~3 w/ o2 N0 t1 N; i
6 z v5 q ]8 [- M
, z1 i& z/ ?3 t8 \; _" V, u1 BMethod 14 ! D' i& J H8 Z) @6 q k
=========
) q% K1 k/ R4 T1 C6 ~! A; d: H1 p4 i) y/ u5 f: [) o- M" y
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose3 r: v6 @; k6 J8 v7 j" r
is to determines whether a debugger is running on your system (ring0 only).
. J7 r: f' l0 W: n. C9 E
) Z8 Q8 j' W% D VMMCall Test_Debug_Installed8 @7 }6 c$ R f: y& i) q
je not_installed
) E+ w/ [* v; V. J) l! B& L* G: i2 y6 H7 `3 [+ L0 ?/ A
This service just checks a flag.) u" p: G( }/ I# X/ G7 R
</PRE></TD></TR></TBODY></TABLE> |