<TABLE width=500>/ r7 l. z. L$ R, w/ ^% N, N
<TBODY>/ J% m; ]+ f+ g) e2 O
<TR># i4 |$ g* V- {/ z' ^
<TD><PRE>Method 01 % X( X' W0 k! S
=========' x$ ~: x4 o! F2 A% ~5 E6 }
6 ]! w8 _2 W' o" d5 N9 T
This method of detection of SoftICE (as well as the following one) is
3 N9 m& I$ A4 u# Hused by the majority of packers/encryptors found on Internet.
! T* t1 ~" ]$ n& NIt seeks the signature of BoundsChecker in SoftICE* R3 x. j( n: v' p- p3 m# f; v
" i) z6 @) m: N
mov ebp, 04243484Bh ; 'BCHK'
: {( B8 P) @* Z* V: E5 d' }0 ]5 p+ y mov ax, 04h. m) J$ p' N6 z. O
int 3
+ k. E7 k, g+ u cmp al,4
' d. }: I) n2 Y8 k2 ^/ c jnz SoftICE_Detected% c7 u: ?: J- }" k$ z: |( c
$ y: E- U7 I9 p. A$ b! }7 d
___________________________________________________________________________
. L/ u0 a9 h- j1 B* M, S, ~9 ~8 V6 S! ^4 A* ?0 T7 `9 F) C
Method 02
1 y8 c2 C5 O& g* f=========
4 f3 P( P% w, i" d& u% w9 i$ x$ ^5 W5 B7 _. Y
Still a method very much used (perhaps the most frequent one). It is used
" c7 x' }0 F6 \) U" rto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
2 O9 I6 f/ I( l1 S* \! ^2 ror execute SoftICE commands...3 S6 J- ?7 Q- U1 ^0 g+ H
It is also used to crash SoftICE and to force it to execute any commands
" T! N5 @; F( s0 o A+ P(HBOOT...) :-((
8 x# ~3 Y9 f9 N) ?" i: k6 K3 E1 m# `$ p4 \- h+ t
Here is a quick description:/ ^6 _4 R9 L; t5 W
-AX = 0910h (Display string in SIce windows)
. t, l" n$ e9 P$ Q9 [3 ~-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
2 X& O. j- L* o# _-AX = 0912h (Get breakpoint infos)
$ T( Y% A X5 c ^6 |; c0 Z3 c-AX = 0913h (Set Sice breakpoints)
, L5 R2 D$ f4 n2 n+ S7 u-AX = 0914h (Remove SIce breakoints)
+ t, p1 t% P9 @* J- n' n
& J/ B' S- o0 oEach time you'll meet this trick, you'll see:
) n! O% j( V3 x* w) I; V-SI = 4647h8 h+ M/ C! B+ ~. J
-DI = 4A4Dh5 c1 \* V6 U+ ]+ D0 v6 u8 F
Which are the 'magic values' used by SoftIce.
p, ]# W6 u: l, D: nFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.9 ?3 U9 d9 H* c
" P$ V8 b* A" Q/ n7 ? J* l
Here is one example from the file "Haspinst.exe" which is the dongle HASP, c6 N M" y( ]9 I$ h3 `
Envelope utility use to protect DOS applications:5 a. T# q# P- Q! B% U2 Y/ a, c, k
* ]" ]" C; ?9 N8 t
% j: Y- w. o; R$ w# o( V4C19:0095 MOV AX,0911 ; execute command.
4 ]! F8 K# K+ O4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
& b" v) z M4 c- g4C19:009A MOV SI,4647 ; 1st magic value.
q( y# h0 f" u7 |1 s% G4C19:009D MOV DI,4A4D ; 2nd magic value.
! l1 j+ w' B0 H- h, D4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)! U! A w8 w' m4 [
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
6 _& Q* f4 n) _8 g9 L4C19:00A4 INC CX
, E. r' l8 p6 g( G( q" p: L4C19:00A5 CMP CX,06 ; Repeat 6 times to execute/ V; i; C0 r! n+ S
4C19:00A8 JB 0095 ; 6 different commands.
% v# s7 v& q2 |0 H4C19:00AA JMP 0002 ; Bad_Guy jmp back.% `1 @5 |6 M( K. x9 N A
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
) a4 G7 y0 s. o% P n0 p( m& v6 W+ O- m
The program will execute 6 different SIce commands located at ds:dx, which# _8 X; `. @) [
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
4 |2 D* h$ y# B1 N. x i/ i, I6 l4 z f& j- P# x+ m
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
5 W' k" ~! _" B# x) m/ n# T7 [, ~( n___________________________________________________________________________
& W5 c0 j5 Q, M* `! ^
7 e$ o2 Z3 h$ @9 u( h8 Y0 z0 k2 @% g; P6 y9 ?7 K) ?+ u
Method 03
) x; q/ D6 i% u* W0 @$ K9 s$ b+ k) \=========
" l5 v1 V" A4 j z" d# y' T* G4 S! u! f( P) z+ Q% x1 p7 f
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h: F/ g$ O+ }7 s( V& F- ?) s2 s* a
(API Get entry point)* [6 B0 ~' e. p s2 C( f
, c/ q# e- ~8 G! G: U8 n8 A
- w+ b* _8 f, J) i- a: j xor di,di$ A9 B4 n7 h. B6 f- h
mov es,di) A3 J( }0 m8 o* V* D$ R( U
mov ax, 1684h
7 N4 e4 D: d; M! m1 N- U mov bx, 0202h ; VxD ID of winice: _ v! @# _3 a8 ]
int 2Fh j9 v. J9 S+ C; N
mov ax, es ; ES:DI -> VxD API entry point* @8 |* T' E8 k5 I% E% L! D
add ax, di
& Q2 O" @% k0 i3 @7 [5 \ test ax,ax% ]* W t! ^% A# x: i- E" U
jnz SoftICE_Detected. q% q2 l/ R; z/ \( B8 M% {9 T
/ O. I( h: R- E1 c0 m( m
___________________________________________________________________________0 H0 p! b8 I" ]; t
$ e! `& o# }2 w5 T( ~Method 04
5 D# z+ r3 W% |% t=========
! X2 J C* w2 F" |$ g, i" i$ x
; Q% b7 u; d8 {, G' w7 @! QMethod identical to the preceding one except that it seeks the ID of SoftICE
6 P! S- @8 |8 Y" t8 G9 p8 HGFX VxD.
0 E4 [9 @; Q* p6 F [( R9 M& l0 l+ }8 n9 T. }" Q
xor di,di: Q2 K- Z5 A, @: [5 a, X+ n
mov es,di
& M8 @& F2 n' B5 W k9 Y# a* e2 c mov ax, 1684h 7 k0 V# F# D1 ~
mov bx, 7a5Fh ; VxD ID of SIWVID
; ^2 b. l5 m/ E' f. ~ int 2fh3 R8 I! b. r8 S
mov ax, es ; ES:DI -> VxD API entry point
: u/ h" B# G7 u0 V& c2 x1 a add ax, di$ Z# X$ T/ ^8 h4 {
test ax,ax# z6 }- C' t: Z$ I' x$ Z! _
jnz SoftICE_Detected3 T$ F, F2 _. e: v$ Q) @/ G
+ d8 H8 ~$ W/ `5 K6 R0 ^7 F
__________________________________________________________________________+ `2 W( o- T7 \4 p# f; T
( S( U0 V* q+ _0 K$ e
9 A4 v( A, u) V" F' Q3 _3 wMethod 05
0 v0 ^, N/ ~4 J=========
3 c+ |3 C" C$ h& Q1 S4 c
1 @% `, k( }9 X- j- Y) F9 iMethod seeking the 'magic number' 0F386h returned (in ax) by all system
" P# \+ _3 y8 G2 \' E* w2 `debugger. It calls the int 41h, function 4Fh.
- z1 s- F) t1 I) H6 Z' u: tThere are several alternatives. & g( q q0 J" K, P
( D* }+ q: a3 E' x J% D& I( I/ J# j+ PThe following one is the simplest:" D) I. E" S- o% t' d$ E
" a& K Q8 }4 {% E0 a
mov ax,4fh
8 p r- x9 u& {5 K3 d! A int 41h% ]$ o4 s$ y& G% E+ g) a! k8 Y9 ^
cmp ax, 0F386
! B. F2 I2 p1 w \2 s jz SoftICE_detected
# b8 Q( N4 A, J# c
' j' S* U, i' r
- y- i- D# D+ t* s" m; j( }4 ANext method as well as the following one are 2 examples from Stone's
4 R( H. ~0 j5 t# W4 \+ E* g( s"stn-wid.zip" (www.cracking.net):. V1 n- |" S. k4 N/ c, w. k
) [. }# D: J$ ?; g9 |2 E
mov bx, cs
4 P& z1 b% h6 k: F( Q lea dx, int41handler2) R. H" a. v J& r& F/ u# B
xchg dx, es:[41h*4]
1 i3 s g9 {& a xchg bx, es:[41h*4+2]" Y4 q3 w! S# ?
mov ax,4fh
; D5 Q9 J7 Y( w4 ^( F7 k" V7 [! j int 41h* |, y$ G0 Z% d+ ?
xchg dx, es:[41h*4]
, \& b( ]; d3 x0 U3 _# K+ J xchg bx, es:[41h*4+2]
3 U$ g0 _) X Y9 B+ {1 g0 ]+ V& A cmp ax, 0f386h) e& s! m: S+ n$ _+ y. q+ S
jz SoftICE_detected
. J2 |1 W6 a4 l( f( q
/ ~7 ~* a$ F8 Bint41handler2 PROC
0 T# a* _2 |% Q* E iret
$ ?. H$ g- g s% V3 @5 m N# yint41handler2 ENDP
b8 G5 A U" d( {% `9 c% k: i) _( h
f) D$ b' x9 e" R% _3 n0 s_________________________________________________________________________$ T$ f6 L/ M) P% b- e
! C1 f% Z' {$ L, t7 H
5 j! Z' j2 }2 D/ {0 N. w
Method 06 J# g g; N K6 {2 a8 O+ ]
=========
+ R: w* q ]6 [) h6 e
- a1 _9 D. _: [1 A( I
9 P& c6 |. o1 j2nd method similar to the preceding one but more difficult to detect:9 x8 [2 k1 r/ @
0 n5 K1 }( C/ S/ P j0 x, a& W
0 W: }- {5 X* O7 T( J8 Q( y R) Lint41handler PROC% A, ?# z8 s& Y6 v B+ r
mov cl,al2 s% t# i( b; f8 M4 q
iret
" B5 ~( p* F8 t% oint41handler ENDP9 | Z+ U1 c5 Z1 J' ~& M
- f6 }) A* ^5 O3 k1 s
+ Y; U& X. A0 S2 b, W9 v/ G' l
xor ax,ax; Z& X5 b6 r/ W
mov es,ax
7 g% J$ A7 W3 C mov bx, cs" m0 ]8 L0 d1 s3 H# p
lea dx, int41handler( K N8 _2 [- F; x. @2 e! K
xchg dx, es:[41h*4]
2 L) [" Q3 W6 W3 _9 W5 L G2 ] xchg bx, es:[41h*4+2]* d2 ` X [1 {% O9 I9 N7 k: T
in al, 40h4 V q& N, B8 u1 U- b
xor cx,cx( M9 s# ~2 T* w5 Q4 _$ w4 r. u4 M: n3 x
int 41h
4 x' e8 b; q2 Q4 |6 |4 x xchg dx, es:[41h*4]
Q, }) T* v+ d( G/ l xchg bx, es:[41h*4+2]' W; T" Q2 P- z `
cmp cl,al4 @8 [/ y1 k4 `/ l
jnz SoftICE_detected
$ |. S' ^! D" ]; ?: E+ z$ m7 I
; y. T' G7 l" ?8 h& I_________________________________________________________________________
& d+ `9 c8 D* G" \, O$ h( e8 O1 ?7 V7 c' G$ w n" L Q& s- c
Method 07
3 u' i/ ~& b) N0 E=========5 N( g7 r" p7 p. t
2 d5 ~" [# W- y+ ^0 [
Method of detection of the WinICE handler in the int68h (V86)( O/ A7 B; b/ B# n8 a
3 b# Y" Z% R# {3 j" X. k, p( G mov ah,43h
& u" c" {; u; O$ N int 68h9 Y- J1 ~1 H$ v! c) \
cmp ax,0F386h3 K1 T* w( O9 I/ k4 W* p1 H
jz SoftICE_Detected% @- J: P! `" d$ a( h% ~# }
6 E3 |0 B- n) P; e1 F$ P' S( p- ^. F* c8 B5 B' b
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit. [& k' S8 t q+ r5 r
app like this:
4 K6 b7 s* k# j! j* f8 R9 L" v3 |0 F5 q* t
BPX exec_int if ax==688 S. J0 P1 {6 k$ f5 F
(function called is located at byte ptr [ebp+1Dh] and client eip is* ?1 M7 p8 n y) B: O- d) D( F
located at [ebp+48h] for 32Bit apps)
' x; U# P, r. e; w! e__________________________________________________________________________
. w P' A" Y! O- A6 }2 G: |
! K. Q/ z- E3 p+ s' o Z
0 F* K2 z) E7 x, NMethod 084 e9 T* I0 Y! H4 {
=========8 l' x- n# b* K) \; F
- N$ T8 j: j6 g9 a& |" r
It is not a method of detection of SoftICE but a possibility to crash the
# s+ P7 ]; J9 Gsystem by intercepting int 01h and int 03h and redirecting them to another
" y( s1 m. j% Iroutine. ~3 A3 k/ Y; [9 k
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points% D4 T6 {5 i( _! ?
to the new routine to execute (hangs computer...)
% i0 g) z. a. v2 ?# A! J: ^6 ~1 S' k, A
mov ah, 25h2 @+ q! g8 k4 y) F, v5 `6 q/ d7 \
mov al, Int_Number (01h or 03h)( m% L( e8 `% X( ~6 o0 ^
mov dx, offset New_Int_Routine
% t& n: P4 t- j. e; o1 L( E' T" F int 21h
1 c1 E: M h! x, b1 w4 \5 N7 B8 o0 K+ x: q1 V: x3 s- b( X
__________________________________________________________________________
|3 j& g9 r0 |9 }4 Y; ~4 p: g, m4 R2 q
2 [8 A. C. {+ P! H. r) zMethod 09
% M; y0 J1 {, U* b( W1 p" W=========
8 B. |7 |0 \( F: J5 v9 e0 Y' j/ O3 r# M& i# c9 [) J. R4 D, V/ c
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
0 F% {, Z [6 P1 b; zperformed in ring0 (VxD or a ring3 app using the VxdCall).6 F4 e7 L: `' `8 ?
The Get_DDB service is used to determine whether or not a VxD is installed: v9 b" g$ \1 Z& Q& `! ^
for the specified device and returns a Device Description Block (in ecx) for; |9 M2 `( {+ z$ J$ l+ A
that device if it is installed.
# l7 g% K$ j9 [1 H+ {; p0 P* C5 s0 N" [, V3 \' Y( ]/ t' w8 O1 h
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID `; R, a; d4 H: J
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)0 W# w& Y/ D9 W* \) r- c; p
VMMCall Get_DDB
! ^1 F, S3 M/ N mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
% \4 e( \2 l( W7 i9 c- e* c z, v+ ^5 B$ Y6 V
Note as well that you can easily detect this method with SoftICE:( j1 _! v, B0 X4 f) \
bpx Get_DDB if ax==0202 || ax==7a5fh
6 ]* p; S: k1 K: F( \
, ~* _: ^0 A. q/ Q__________________________________________________________________________& e' ~% W) Z: x8 L7 e% ?
: R# S0 I4 i: {' c5 g, `/ lMethod 10) ^4 P P6 w3 t/ o
=========
0 X% E% k5 Y/ c/ u8 t. A
& R* ] s0 J* H=>Disable or clear breakpoints before using this feature. DO NOT trace with0 R9 H1 |, C3 A* m4 a, k
SoftICE while the option is enable!!! \- y% m w1 |( p1 V
( b$ u- }, f$ k1 r4 f* \, Y$ D
This trick is very efficient:) r3 p% m5 w& U* I$ k+ F- r) k) a
by checking the Debug Registers, you can detect if SoftICE is loaded
9 y3 m& y/ l+ q0 h4 Z8 M6 s(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
: U7 ^* e3 D& a& U! @' Jthere are some memory breakpoints set (dr0 to dr3) simply by reading their. z ~( M5 `1 l7 D+ G. R7 X: ^
value (in ring0 only). Values can be manipulated and or changed as well
" Q* \3 z6 W6 A9 ?6 k, @# [(clearing BPMs for instance); e+ l0 w W* T m* I, W6 s
, g$ g4 h6 e2 T1 t ]+ G/ B
__________________________________________________________________________
9 h2 s0 g: n( x
+ I, x' ?5 m, wMethod 119 C, P9 \7 I& a, S! G& n- B: T
=========+ u, s9 @3 r5 i
' e* m& }! r8 `" ]8 |& k$ g
This method is most known as 'MeltICE' because it has been freely distributed
7 y e4 o9 `" lvia www.winfiles.com. However it was first used by NuMega people to allow* ^: z% Z' C. ~5 b8 n: a( |
Symbol Loader to check if SoftICE was active or not (the code is located
6 R# t$ F6 w# X( Q% ^& ^inside nmtrans.dll).
5 N b/ Z, ~7 ^" W2 @8 |
6 u2 {% v- y) A, ?The way it works is very simple:
' s& D5 Z) q6 F+ y7 zIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for9 b* l* T. Q+ {
WinNT) with the CreateFileA API.
! A! ^% s, m. X5 [; D: b2 F; R) E9 q' D& m2 a
Here is a sample (checking for 'SICE'):. t2 ~: c+ b+ {+ A9 u4 \9 v
% w& Y4 a2 t( Q3 o# U
BOOL IsSoftIce95Loaded()- k2 @1 }" _! e9 h' f9 R; q
{ ?3 j0 J) z: \8 {- u6 J2 X+ ^
HANDLE hFile; 0 P8 ?+ ~" y% N) O. B1 t0 X2 Y; q
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,+ u( k0 D4 |4 \2 z6 ]: @# ~
FILE_SHARE_READ | FILE_SHARE_WRITE,
2 R2 b+ r- }" X5 ]' _1 v0 ^ NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);) e) P8 j+ D! Y6 G, g* _/ m
if( hFile != INVALID_HANDLE_VALUE ): D9 v0 z* O, f% V& P; f
{
( V1 b$ _3 ~2 Y% r9 I+ t1 W0 z1 }0 t CloseHandle(hFile);' W3 M0 J! u: S, _' h
return TRUE;
( p8 ?/ n# s' R5 }3 ~ }
+ u5 i% P3 M* Y+ X2 C+ M$ o; C return FALSE;2 }! W$ v: l* v' O/ T# F
}0 i2 O1 V, _) [$ Q
- J6 \' V% I; S- C# W* RAlthough this trick calls the CreateFileA function, don't even expect to be
" g- w8 u% `& e( K3 N0 S2 O% table to intercept it by installing a IFS hook: it will not work, no way!
2 f( I/ G/ @2 A" oIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
* l) q5 r* `% ?- V" {/ o/ qservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
8 A; L9 o4 d/ T% j4 ]' pand then browse the DDB list until it find the VxD and its DDB_Control_Proc- ^! ^4 ?# u: N; K" I6 o9 z- b
field.; P4 q* d# \: a4 u6 f8 ~! k) ?
In fact, its purpose is not to load/unload VxDs but only to send a , T; [7 f- e* m: [1 @ f8 H/ `) X
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)% G3 h% t) b T% f {
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
I9 D% ]' e8 {) y- V+ R. ito load/unload a non-dynamically loadable driver such as SoftICE ;-).' E( X! \6 j9 D6 |: n0 q
If the VxD is loaded, it will always clear eax and the Carry flag to allow: c" W& l* @3 G; [* [
its handle to be opened and then, will be detected.
* f) Q$ U1 j% e6 PYou can check that simply by hooking Winice.exe control proc entry point9 e% P5 X0 x# o- Q) K/ S1 c
while running MeltICE.
! X/ [; B& F% q' e7 E2 W% |6 I1 U# p/ ?/ D0 s4 V
# o8 I; M7 I# f2 | 00401067: push 00402025 ; \\.\SICE5 P2 q& U6 B8 F; W2 ?
0040106C: call CreateFileA
, l! o7 V' F' p/ a( h1 f1 n 00401071: cmp eax,-001
: i3 G$ w5 I0 o 00401074: je 00401091
* r1 x6 ?5 `7 Z
0 d+ ]3 e+ l8 E5 C
( t- {' |5 |3 |7 I# a: [$ P2 h6 NThere could be hundreds of BPX you could use to detect this trick.. w6 p/ d; K0 l8 ~5 w
-The most classical one is:
: p$ S# D; I( d; x+ \1 K BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||* g: h8 `9 ]; P, f* M% ~
*(esp->4+4)=='NTIC'0 [2 q9 o, b+ h7 b; i# ^* l' R \) G
8 J& H) A6 C, _& Z
-The most exotic ones (could be very slooooow :-(
% I1 D r) r, o) d' `! x BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
# @3 B6 R- `6 x! [) N$ w% t* p ;will break 3 times :-(
1 Y: {! e* q$ w. d% N% O! X" E( y$ b( |0 u) o& k) X/ u
-or (a bit) faster:
* v3 F+ D2 k0 T9 r. [ BPINT 30 if (*edi=='SICE' || *edi=='SIWV')2 K9 H7 w2 J$ u# a, \
, [8 V U b- f& | BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' . K( C) f3 ^. v7 ]$ f; Q
;will break 3 times :-(
- \8 H) Q) p; C' Q! J: x9 U9 ]
6 l, C$ Z6 Z ^2 a-Much faster:
8 n; }9 ~4 s! T. _% Y5 C# b BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
! m) `4 ?- p4 q/ [* B \2 y4 {2 _* H; d: y( A; _
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
+ L% ^9 k3 X9 P$ u8 r- d+ {0 Bfunction to do the same job:/ W/ W+ `" I, U0 h- j n% N P
- d+ _: a- W) X( b! l! t
push 00 ; OF_READ7 _; e- W& N' g! T
mov eax,[00656634] ; '\\.\SICE',0
9 R9 D( x$ t' J( N& ~# c0 O push eax
$ z; e U' { ~6 v9 S call KERNEL32!_lopen* m- V4 b! [2 S, K, M+ e
inc eax! g5 P& D! C) c) H8 p
jnz 00650589 ; detected: { k& i/ G1 M
push 00 ; OF_READ
, y1 v. R, k! S) a" U' B- Q4 o1 t mov eax,[00656638] ; '\\.\SICE') V' y1 W# H% P* T
push eax9 a' K+ x% A! M7 k* J1 p' T
call KERNEL32!_lopen- U* d9 R9 _) P% X) Y( y
inc eax
4 P ^# H" Y: c3 } jz 006505ae ; not detected& k2 I8 u) G# S1 Y& o* S0 a: y
# w- i, N# V1 j! q
7 q" R7 [% |( C# r3 h" q8 ]__________________________________________________________________________: w6 t" h$ X) }
. }" R: E" s6 D u; {4 n
Method 12
7 `4 e8 H) Z8 A; ?0 |; c=========
# T Q# A) t+ o& ?8 g9 @! ~* a/ v+ I9 Q' f4 x0 l) ~
This trick is similar to int41h/4fh Debugger installation check (code 05
1 F8 Q$ i: n2 K& 06) but very limited because it's only available for Win95/98 (not NT)
B7 v4 q2 r* ^. mas it uses the VxDCall backdoor. This detection was found in Bleem Demo., P4 ~7 g. k l( R+ C) x# W
* r) d1 c4 a6 |; R: ?; N) ^/ _ push 0000004fh ; function 4fh/ A4 n" Q) B5 C V# H6 j4 \9 [' {
push 002a002ah ; high word specifies which VxD (VWIN32). Y% M/ L2 J/ e: V* W* Z; a9 d
; low word specifies which service, V5 e6 D' ^) R' }
(VWIN32_Int41Dispatch)
4 \- [! }) Q* R' [( U6 r2 | call Kernel32!ORD_001 ; VxdCall0 w. Y' F5 o& l6 `2 l
cmp ax, 0f386h ; magic number returned by system debuggers
( g: S. y3 x4 a T3 ?! } jz SoftICE_detected0 |1 i4 H9 F. w5 A) G
& X; P2 R* c7 L
Here again, several ways to detect it:
- l N7 O! K2 N& {. E: {! F
# | M. U4 k% I BPINT 41 if ax==4f; Y) X7 \: j& V {" `
- `# q$ r! S- D$ p- m9 ?
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one4 O8 V Q# `! ?& }4 G" g; k
: o" X: m0 f3 t# t- D, | BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
. h# r: f4 j5 j& }1 W9 K D4 D) C
: R0 R0 R4 d8 h& g( j/ ?, k BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
9 @9 }% c( a5 d8 }6 b$ I( i: N5 d4 `- k
__________________________________________________________________________
* d# J8 O+ M ]/ r4 I# [- ]' G9 A7 R/ T# ]; V( F
Method 13
3 C& k5 W$ w' a0 b=========
0 U, w+ j; I8 ~6 U1 c4 \
& W. }% o }8 y' U& h2 G1 d0 Y$ CNot a real method of detection, but a good way to know if SoftICE is
) T- O4 R' I/ ^! f, G" g/ t2 Vinstalled on a computer and to locate its installation directory.
! F9 n+ }( s. @: {2 d1 _; j2 MIt is used by few softs which access the following registry keys (usually #2) :' b9 ~ z4 Z) o; e( d4 ^) i
, b; s3 X( ^' D7 }-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
2 l0 c9 C, j: q4 @\Uninstall\SoftICE
! U E1 _1 L6 J3 \9 ?. I-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
) D, _5 s7 I6 R. \-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion0 ]7 d0 Q7 ?8 W1 O
\App Paths\Loader32.Exe
2 X, [ z1 \: S* O1 v
( @0 X1 @: d s# w# k
2 V A& [3 z5 d& c+ f3 ?: c5 UNote that some nasty apps could then erase all files from SoftICE directory% e, u: A' a( K4 o0 ~
(I faced that once :-(
: b$ o, H; N: p9 t: A' [ e2 V' s, r6 P( ^% Z/ s
Useful breakpoint to detect it:% Q% w3 w% O2 L1 p4 P
' ~2 g9 }" u B5 y: _6 d, ]6 j
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'6 H8 K( C* i+ N+ S5 A
% I) e* W- Z( W
__________________________________________________________________________3 N' I) {# a! O, b- r8 W* C" l3 z
$ v. ]4 z8 d8 _: M. I* v
2 j+ P2 G' F. W) [Method 14 8 n) F/ Y3 e. ]0 h! T8 ~
=========
* N9 L+ v7 w: [6 q, x
2 w. O1 x7 i$ ?A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose( z% d! c7 z* c% L% n# J
is to determines whether a debugger is running on your system (ring0 only).: h4 n- N% n: r( U i
, H$ O P3 Y& ?$ [0 a7 Z3 ^: h VMMCall Test_Debug_Installed D* n6 j: c& x# t4 Z- Y" \
je not_installed
7 X4 h, {$ ?+ w+ P/ l" Q9 Y0 V0 ^3 J$ `
This service just checks a flag.) p. R3 U- ?$ E% ?( `, v6 S
</PRE></TD></TR></TBODY></TABLE> |