<TABLE width=500>* ?/ q: {4 x, H( s6 b4 q
<TBODY>" } Y, i. Y8 x) O: o/ G0 j4 d
<TR>
+ V1 B E/ n) d" N& z; l<TD><PRE>Method 01 % k# Q0 h! F) b# V& o$ S
=========
# y! x6 ]) i$ A# a6 x
; l" F$ `7 N6 b# EThis method of detection of SoftICE (as well as the following one) is
) p- d0 K) ~' B% A" _* |% Wused by the majority of packers/encryptors found on Internet.# Z4 k$ Y; P, @$ u: s( z3 r, ?* y
It seeks the signature of BoundsChecker in SoftICE( C0 S' I; A/ O- ?( H; q
$ S/ n3 B2 N6 ^: j- i mov ebp, 04243484Bh ; 'BCHK'+ Y% p" C7 G) T) [0 t( r
mov ax, 04h
; T- W! h5 a/ S4 D int 3 . L/ A/ f& Y& W0 R# \
cmp al,45 a& M" v9 g& i1 o+ F; b9 b- b
jnz SoftICE_Detected
7 m& U1 m9 ?: |$ [+ t* F7 F0 ^5 t% S: J4 U
___________________________________________________________________________
) d+ `% r$ f* P0 S) O* }0 j3 R$ |) m; R( T
+ E0 `: `5 C, b' W, \. a2 EMethod 02% v5 Z9 K' L# m( N! Y# O, N8 n
=========3 b* p4 O5 o" \/ Q9 h; {% ^% c, `
* s5 H6 J, K! W F, f
Still a method very much used (perhaps the most frequent one). It is used
0 Z! N1 P, p# Pto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
) v v, O- S0 f" ?or execute SoftICE commands.... }) o4 B2 E/ Y' m* q: Z. I. c8 [
It is also used to crash SoftICE and to force it to execute any commands# S+ v! c, R) z, k% r1 C- M
(HBOOT...) :-((
% X' Z- s6 X0 d
4 k2 r$ e2 l' yHere is a quick description:
5 @3 \- D& c4 H6 l) y I) A-AX = 0910h (Display string in SIce windows)
( l& k3 e2 b/ E2 `-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)8 S. k- h3 S! k7 I
-AX = 0912h (Get breakpoint infos)
|- n d; M: v+ u-AX = 0913h (Set Sice breakpoints)0 I# M; P0 d, O( _4 e1 Z
-AX = 0914h (Remove SIce breakoints)
* ?8 J! I9 z4 P+ o5 ]: _
1 j8 t+ ]% U5 W, t) h$ ^* iEach time you'll meet this trick, you'll see:
3 \' B8 n# Z% |# K-SI = 4647h
# V' L* V3 E& v; Y' ~-DI = 4A4Dh
, |1 ^" s$ T6 m$ K7 l- r, d3 M0 ?3 \Which are the 'magic values' used by SoftIce.! I* s b* d* G. U) V% O8 E
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
v0 l# N& g# K3 y; A* x# J
# S5 t5 e9 J/ a2 ^4 VHere is one example from the file "Haspinst.exe" which is the dongle HASP
2 @. V0 j1 c- h6 b D' dEnvelope utility use to protect DOS applications:
/ g4 `9 J3 f/ H. T
7 B0 H z9 I4 q, a5 v5 T3 U3 T& ^
5 t4 x, f0 _- E8 ~4C19:0095 MOV AX,0911 ; execute command.
3 B! D! J3 ^+ |% Y5 d6 B/ b4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below). y# M+ {; l) C% g0 l0 c C( I
4C19:009A MOV SI,4647 ; 1st magic value.$ G2 |! C0 p u8 J) K
4C19:009D MOV DI,4A4D ; 2nd magic value.
' ~( n# ~8 r! m/ E- D4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*); u2 ?; a7 E; D& r) g
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
4 n% k. i# {, d4C19:00A4 INC CX' p7 U7 _) O& {) y, z
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute+ K+ z" J, i4 S% r4 `( o5 m
4C19:00A8 JB 0095 ; 6 different commands.! `) G- `. \' Y
4C19:00AA JMP 0002 ; Bad_Guy jmp back.8 E7 V" [- ~7 `: T- k8 L
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
1 H# \) i6 D" m7 y2 w
' u: \' f2 ~% G) b* m6 oThe program will execute 6 different SIce commands located at ds:dx, which
- `4 h6 P* h: c* j' Gare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.0 G9 J& ]: @1 x3 @6 f, T
: ~8 P# T7 @1 A) I2 a4 X, u
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
. ^; a+ m B+ f" q1 T* i4 _+ E* q___________________________________________________________________________' E5 @* e: h, K c0 J( \
8 V% T \7 P; q8 I" l$ Y' g3 \! {& P* ]6 e
Method 03
' K: u& D2 P: G6 M2 `' }& K9 W=========
2 H& x5 Q( R, J2 [5 M7 I! q9 N( M" v9 c: F% H! `
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
7 }: U) _$ h) \; W* N) x. m* Q) M# h(API Get entry point)
9 \: u! X( I, ?& X: L) O. e & i# F# h& _& V; Z
' K/ b" D$ R) l0 x" I1 w
xor di,di
& k/ y& M/ [# v; w8 ~ mov es,di
/ L* }4 o7 C; ~ G mov ax, 1684h
2 n( p3 d' {& d$ U2 U5 C1 ]6 ~! k) Y mov bx, 0202h ; VxD ID of winice
8 C/ R/ W* ]0 D7 v8 T& ^/ |9 s int 2Fh, C9 P7 x. d4 G
mov ax, es ; ES:DI -> VxD API entry point' d2 B q( W' r. a. r$ w8 D
add ax, di- \8 ], d9 P7 H7 N8 T
test ax,ax* Q i5 Y9 m6 o% [
jnz SoftICE_Detected/ i+ x8 m$ G" m* H6 N
" t; K8 e* ~3 P/ v___________________________________________________________________________
2 L2 R4 d% G- H2 {4 L" \
0 I7 {% u S% U/ y6 F# GMethod 04' T: j5 n% k/ V- k
=========. o3 c: \1 B5 z: B# J
6 D4 z0 z a6 m- F$ Q( p& GMethod identical to the preceding one except that it seeks the ID of SoftICE% E( c& S. e- K* \0 b* d7 [+ B
GFX VxD.
0 k- R9 E4 L t) @6 i7 a7 \9 u7 m
! I; h! P, M7 y( K& \1 P& b3 k xor di,di- K; P1 j9 D% B; l3 l
mov es,di8 A* l: M, G3 A0 o0 Y4 i8 x
mov ax, 1684h
+ v2 C3 X% ~$ t- @8 ?, T) Y mov bx, 7a5Fh ; VxD ID of SIWVID2 Y; w" V& S' `" L4 b! e
int 2fh8 S' b4 }4 k6 w: K% p0 G
mov ax, es ; ES:DI -> VxD API entry point& Z' f& q- E7 v; `: Z+ M
add ax, di4 M* {8 L. ^4 x+ g5 ]* N
test ax,ax
# L. e+ f% h$ |; K jnz SoftICE_Detected* M$ R' t5 X2 o8 U/ ?7 A& j
; ^3 U5 X$ M8 H; r* P% T
__________________________________________________________________________; L3 N+ ?, Q0 s+ {$ I
* s$ ]1 K3 p, K# I* I
& }: |& A- I p d: \Method 052 p. _7 ?% ~, @7 E4 ^1 u- \* r% r
=========' C! l s8 P0 q. U
6 T+ f, J5 N! F$ ] X D k( SMethod seeking the 'magic number' 0F386h returned (in ax) by all system/ U' g* f% m/ @/ W
debugger. It calls the int 41h, function 4Fh.* ` L2 h9 u2 F/ p' U) T
There are several alternatives.
. V% V/ m5 c; m3 q4 f
5 l9 P7 D8 _% P! `7 ?& L) m( I& aThe following one is the simplest:9 s1 ~8 s3 h* q, Z& L: N: |7 C
9 u& |) ^ F, M2 X) K! p4 H5 H mov ax,4fh
@% W$ i3 H$ m2 V" K, Z$ O& C int 41h
: l+ l5 z$ s! ? cmp ax, 0F386# V: P3 B7 |% r1 j1 N) v* x
jz SoftICE_detected7 o$ ?! k% p9 G4 ]
4 e% F' |2 r4 p3 @ p' \) W3 L( {1 W1 L% z7 X
Next method as well as the following one are 2 examples from Stone's # K* c' }6 o$ A a A
"stn-wid.zip" (www.cracking.net):: {* n% o4 R" S q* J/ B4 j8 Z, M5 b* L
5 r% e D4 i4 D& j. X9 v( T/ s
mov bx, cs
3 X: b, J4 Y+ l; E/ x8 X0 R1 I lea dx, int41handler2+ V! t8 i& G5 v
xchg dx, es:[41h*4]
- Z2 O* ^, K9 U# ^9 D xchg bx, es:[41h*4+2]
, u& ^% g8 h1 R' y+ d9 e2 C mov ax,4fh
2 v* E, G- M# I; P int 41h. }/ e3 J! P' ]/ I" K5 K
xchg dx, es:[41h*4]
* Y+ O' j* s4 f$ K' {3 s xchg bx, es:[41h*4+2]! e9 ~* L( K8 p. X# S- A
cmp ax, 0f386h! }% g" K: G* z0 `. M' a7 U
jz SoftICE_detected( G! i9 e7 K" ^6 J$ ]' ~
+ u) O" k2 E8 p( \6 u
int41handler2 PROC
7 C3 V. ? M( l8 ?% l iret" b0 I. g7 @# u$ K K; }
int41handler2 ENDP
; @$ x2 b" x1 F' j7 F0 O0 b3 l
* {7 Z6 g! T; V( O6 Y" s" s- N; K' y7 A7 u9 L
_________________________________________________________________________8 {! \/ c# Q" C* k$ z* r
' G. p# n% y3 t( j2 q2 Z
# w/ ~" ^6 Q9 A# H o+ X% cMethod 06' s9 b; I, M8 D2 M
=========
; s2 [2 q+ A1 Z) i9 W; K) r" J! z2 ], D6 n+ B& F. M- o
# V4 I$ c% B. N+ y2nd method similar to the preceding one but more difficult to detect:
! m7 T! k1 D3 C9 n5 Z7 w* |3 I# |7 h8 B" u& ?7 o$ b/ |# A G
7 d4 ]- u, z8 ], l7 y# J
int41handler PROC
. g' J; h3 B1 Z& S0 D mov cl,al
, } c7 n. G: {( m# o0 K iret9 z; m6 O( {* ?2 c3 i4 ^
int41handler ENDP. i( O% f5 Q$ U1 [; N
& v) o4 N, T% {$ Y5 n% ?% R
8 A6 P4 r) R% x6 \3 N xor ax,ax. z* ^/ [9 t8 O D1 `) h3 P, f# L
mov es,ax' o& Z8 Y: V9 N4 `" b% ^6 j
mov bx, cs/ ?" n8 ]5 `/ @- H$ t q( i9 c
lea dx, int41handler% N3 X5 M; e7 `9 f* P: |
xchg dx, es:[41h*4]" ]* f) } _4 n; z, Y! ]) s; x, J
xchg bx, es:[41h*4+2]: [' g+ Z- {9 _4 @" s
in al, 40h
! R) Z3 R- D* V5 b* ?4 O8 Q xor cx,cx# [4 `' ^- a7 f, H9 _, @" M
int 41h0 P; I1 [* W0 ?. W6 E( R# q
xchg dx, es:[41h*4]1 ?9 ~; z7 i9 z3 Q
xchg bx, es:[41h*4+2]1 w+ s8 a7 e. g* t! a$ r0 C' B
cmp cl,al* x8 f7 f) d: z
jnz SoftICE_detected
* V1 ~, u# _; x( y; O) p5 l5 u" Z5 K. p$ F9 d; Q" y
_________________________________________________________________________' R* ^8 ~, L% k2 k- M" k
+ L7 _1 p9 o- n2 p6 A9 F
Method 07
! R0 D) ` |! q8 v: L, L8 w; C=========$ k% ^# t8 s! S9 B7 j: |4 ?# l
5 ~; n( U$ ~: [' I" D, c" j
Method of detection of the WinICE handler in the int68h (V86)
5 x) h* O( i$ R" ]5 r
. o* |$ I% u+ P4 G% [5 t mov ah,43h! n6 \! N. }' ~6 T* M" t0 j
int 68h. k i* P+ T H+ j8 V6 ^
cmp ax,0F386h
/ \5 {1 b! {6 m4 l2 C: N jz SoftICE_Detected
/ `7 |3 M3 X# v
$ ]3 _4 d' s) e9 e3 `3 K( X1 i2 ^2 Z
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit; X& ?* {$ |/ C Z
app like this:- @ O0 f% \6 Q: _7 `+ [
4 G7 S8 z6 N3 @$ s3 n1 y* y8 R BPX exec_int if ax==68
1 K+ t6 h" @; }# a: Y" L& f2 T (function called is located at byte ptr [ebp+1Dh] and client eip is- y' @# o, m G
located at [ebp+48h] for 32Bit apps)
# M9 C0 Z5 s0 d& |* m9 ~2 D" T6 U; b__________________________________________________________________________
6 s7 _$ ^0 d9 K, u7 I
, {7 }2 R v1 Z Q8 V8 K* u7 ~
- V' A; I1 D8 c$ U) q: vMethod 08
' t$ _( J) j! O) U=========
# X2 g Y8 i" J+ v; }2 l0 ^) K
& M% p: J9 n. e2 Z# aIt is not a method of detection of SoftICE but a possibility to crash the
7 Y) u+ K" p& f& R* z1 [: i( c* _system by intercepting int 01h and int 03h and redirecting them to another
, g# s+ x- K N/ J. ?) X# yroutine.2 _! ^( J+ L1 ]; f' j/ ^- N1 L
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
% l; V) M9 T$ H; n+ T* |( a; Dto the new routine to execute (hangs computer...)" c' b& J) U; [! Q, o( ^+ ]
* t& b1 T3 t" V% m; B( w! Z
mov ah, 25h8 |. M8 L) a( ^# p, f
mov al, Int_Number (01h or 03h). N! s8 k' Q g; r
mov dx, offset New_Int_Routine6 o' j7 |& [' U" C, h' J
int 21h
: T+ Z- H a! ?: d3 |) g: m$ f, C& A- O" {/ D; W
__________________________________________________________________________
( a! a' Z! Z$ N# ^8 H+ k5 [" H' R: n* u
Method 092 g7 K1 z4 I4 P1 ^, ~
=========
2 ?; z4 H/ G, B1 b" \4 \. o
4 L9 Q; ?( B* f1 fThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only6 d; S/ c$ C) i
performed in ring0 (VxD or a ring3 app using the VxdCall).
8 e+ ]: s' ~5 u! r, uThe Get_DDB service is used to determine whether or not a VxD is installed3 Q- {/ C5 G$ H. g; x3 \9 W
for the specified device and returns a Device Description Block (in ecx) for" Z& E& z6 b# a l8 f7 L* a
that device if it is installed., G$ V: n0 U% S6 E, Y$ c
/ {4 D/ F& B) u; ~7 b mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
4 `. _7 i- D9 @# l& G$ ^) t4 ? mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
]% w9 h, `- E, Q( W* n0 o VMMCall Get_DDB
( x; i9 L y% W, S8 [ mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed+ h" U! m0 o9 z: v# T' l3 ~
& T6 q- A7 W+ x2 u3 N: F/ N( X
Note as well that you can easily detect this method with SoftICE:8 n2 u3 T- W8 m
bpx Get_DDB if ax==0202 || ax==7a5fh! q) J& s, b# N* O
7 S2 y; D: [" u7 a* [0 c) D
__________________________________________________________________________' F5 x9 r4 V( R
( H8 h8 t6 c p! v8 _Method 10* ~. O( U3 y9 M
=========
8 A% ~3 r8 q+ V: K$ ~
$ X3 P1 T3 j& E3 q=>Disable or clear breakpoints before using this feature. DO NOT trace with
) W" A/ l# j9 C! e# s. s3 U- W SoftICE while the option is enable!!
7 x0 [4 A) m$ w& K- e ^! y
. u/ n( }6 z4 k# `2 t0 NThis trick is very efficient:
; Z1 k$ ~/ K5 }7 o$ b& Q! Gby checking the Debug Registers, you can detect if SoftICE is loaded
9 M5 k6 \0 A. W- c7 {(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if) N: t! C0 q O7 O) `) y, V7 s
there are some memory breakpoints set (dr0 to dr3) simply by reading their
9 `; z$ i4 P0 b6 [2 |0 r9 @value (in ring0 only). Values can be manipulated and or changed as well" w- x% @2 {" `2 Z
(clearing BPMs for instance)
, k E/ G0 N& M! h! P) W
1 S% j; d( J0 {+ k__________________________________________________________________________
: Z& B. y: D/ G; L
6 F1 d; [% B1 e; n5 P9 a4 KMethod 11& g3 W7 F f8 z6 _7 t9 H" E
=========
$ v7 t: o1 V4 x2 ^8 j2 x
" p' l8 Z8 |+ VThis method is most known as 'MeltICE' because it has been freely distributed. W+ y3 J9 s5 y5 k: R) i: B
via www.winfiles.com. However it was first used by NuMega people to allow( Q; X0 t5 |' p/ X, `! k0 ?% I
Symbol Loader to check if SoftICE was active or not (the code is located
$ d6 y o4 ^% `3 q2 |inside nmtrans.dll)./ ^1 K+ J6 y) z& e, r/ \# V
+ M7 Y3 n9 g3 k* k7 x/ N3 ?The way it works is very simple:! ~) g7 Y; r* y3 V2 J0 H
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for2 i, C/ {9 L- d0 L
WinNT) with the CreateFileA API.
* W3 r; `% U; f9 Q. }. T- X6 p3 o( G2 `' n3 u. Y3 \
Here is a sample (checking for 'SICE'):
1 Y, m4 i# {& C' d; ^
" } r9 P" G* H3 G- K9 N/ vBOOL IsSoftIce95Loaded()
" w) I- U$ ~; ] y{4 D% m7 {, D' r# a. m
HANDLE hFile; + w- |3 j, w4 m! _' }
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,# }9 z; |: X. m) _- m9 t# s
FILE_SHARE_READ | FILE_SHARE_WRITE,
/ h4 v* ~% D4 x NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
1 d4 {' Z) U' ~5 _ if( hFile != INVALID_HANDLE_VALUE )5 Z- {: E( `& w! w7 L) a! c
{
& ?9 ~" c$ b* ~ y8 { CloseHandle(hFile);
% X) d, z1 R# {& O$ }0 [* f7 d' ~3 b6 i7 O return TRUE;
7 r! K0 e2 }- R. M6 x }3 f! [- k/ o, S. m
return FALSE;
/ h5 y7 j O4 s. |}/ S+ A: j7 y. Z
" z; E( `5 n$ y* i1 P
Although this trick calls the CreateFileA function, don't even expect to be
s" U, `% E& E7 z+ gable to intercept it by installing a IFS hook: it will not work, no way!
( {. l, H) L& yIn fact, after the call to CreateFileA it will get through VWIN32 0x001F, j. g& s, |- y( U3 r
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)# i" u$ s* y1 @; E" t9 ? q: Y4 N: D
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
1 W6 }$ x4 s) d- q. }0 `field.0 N6 W' ~9 D9 V' e) {4 k$ o& B8 s
In fact, its purpose is not to load/unload VxDs but only to send a
C) k# g: Z/ OW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)" q/ O4 l: P! O* f9 O. B
to the VxD Control_Dispatch proc (how the hell a shareware soft could try0 d9 @, y! {8 A9 p/ ~3 `! V/ f3 V
to load/unload a non-dynamically loadable driver such as SoftICE ;-).6 f1 j3 z1 A! R, Q6 ~9 r, ^
If the VxD is loaded, it will always clear eax and the Carry flag to allow
2 L7 g$ k' w# [4 ?its handle to be opened and then, will be detected.% Z: e. N: S" G) A' }8 e6 r
You can check that simply by hooking Winice.exe control proc entry point( K( o+ G" \2 W! @9 O
while running MeltICE.6 W/ J2 }1 [5 N7 H! I. H
7 x0 y$ E6 D; v t
, T: r5 c. B: n$ p4 V 00401067: push 00402025 ; \\.\SICE) H, a) E' {& |8 n9 h1 _* R: a
0040106C: call CreateFileA$ P6 }+ k- ?/ ^1 p* @3 M
00401071: cmp eax,-001, U% k O7 m5 ^" ]9 Z
00401074: je 004010918 g$ O8 m* x+ }8 n" x! R l
1 E- }/ U8 ]9 y( n
0 G& P Z$ E" t' {6 A5 F$ I5 a7 j+ RThere could be hundreds of BPX you could use to detect this trick.
0 Z' C) z7 X! O) w-The most classical one is:2 C8 T* U6 V$ G- \8 b- q3 H
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||' a% ~0 f* v4 k( L6 o5 k+ p( }
*(esp->4+4)=='NTIC'
) \5 k+ x: C4 s- ^: E5 a$ i5 q
-The most exotic ones (could be very slooooow :-(7 W) b$ n/ o, c: m/ s" d: v9 M* {: K
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') 8 L/ e. o( v- l6 a3 W
;will break 3 times :-(
& g7 \/ Q6 a/ R5 W, b) k
Y& h% l6 C- o, c4 O' _ Q' H' S-or (a bit) faster:
4 ~! V1 }5 V6 p& @% d BPINT 30 if (*edi=='SICE' || *edi=='SIWV')+ P) U5 G) B, M' q& l' |5 l
, s' ^! i4 L! k* I3 v ]4 J
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
7 m T7 K' E# q1 q ;will break 3 times :-(
& h; n* P% c: I7 h
3 l" A( [3 b2 v-Much faster:
% {$ x8 B2 n( R( k! J BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
5 ^# i( m7 i7 F7 @" r. m
# ?; |8 R% O5 mNote also that some programs (like AZPR3.00) use de old 16-bit _lopen; [7 y& v" f i l& P& V
function to do the same job:8 q, |' I4 Z+ }3 e& ]
" n ~/ k) l# A7 y" f push 00 ; OF_READ" V8 P1 y* i1 @( |' B: f7 G3 Q+ M
mov eax,[00656634] ; '\\.\SICE',0
. }/ d$ P- ?( E2 l push eax# {; b; r; l: F* ]4 G7 e
call KERNEL32!_lopen9 M/ J! B/ R3 l) \2 r# U( v5 C' S
inc eax
$ z2 t, K, Q7 b! R: H( s( S jnz 00650589 ; detected0 b+ D4 h; B6 o6 v7 b f
push 00 ; OF_READ
+ K& L G6 x: c. n8 ` mov eax,[00656638] ; '\\.\SICE'
6 X, L. L9 `5 U$ [8 P push eax
& n8 A5 [7 Z* d9 d call KERNEL32!_lopen
* G6 } u3 d( |8 I& Z inc eax
E! Y% c, r8 l+ l- B jz 006505ae ; not detected
- A& _ ?2 k: F9 T6 W0 t' H0 ]& Y& U: N. d; L% D5 c8 t
/ y7 Z5 Q* X5 @: U$ E__________________________________________________________________________
4 H% a* b' U# D9 q% n0 ^/ U5 I% c7 q. K9 u
Method 12% c: @( j3 C2 R: I6 ~6 {* u/ M y
=========1 g+ Q: f! u% P8 p! _
p* c: T, T: X/ L( }This trick is similar to int41h/4fh Debugger installation check (code 05 Q$ B$ {9 d% r, \$ T2 {$ ^
& 06) but very limited because it's only available for Win95/98 (not NT)
& J A) ?/ x4 j8 S! \+ _as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
& n$ G( H, j6 e4 v; q/ F( h3 H& ]0 K Y) b+ e9 m% r) ^' A6 S
push 0000004fh ; function 4fh
* ^+ P# |. J! f0 Q5 v push 002a002ah ; high word specifies which VxD (VWIN32)( a$ B5 x& ~, b8 {+ ?0 v
; low word specifies which service
/ v3 r! @9 U0 j! v (VWIN32_Int41Dispatch): {+ v* k+ f) M6 Z
call Kernel32!ORD_001 ; VxdCall
2 y* ` T4 ~$ V, B cmp ax, 0f386h ; magic number returned by system debuggers
; [/ ~' X& d5 r# G" f: W5 _ jz SoftICE_detected
7 \5 O* d2 {, n( w. m. t1 J5 W3 F: l5 `
Here again, several ways to detect it:
/ ~+ e" `6 o/ F8 w6 I, M) i M4 w# U4 L" a& a2 W
BPINT 41 if ax==4f0 p/ u& y4 S+ A! |# T+ I1 H
- R9 `: n ]- w. j BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
6 M# u. ]+ B+ b! g4 A( f& p* C+ ]+ l7 y- V, V6 F7 g. E
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A/ K. A+ d6 I4 K2 `8 V ~2 i
% ?/ B/ h) ^, m( K BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
6 ~- o" V1 B% K* Q: K) g- s: U9 M4 }
__________________________________________________________________________
" L" D: F5 H8 `8 T0 x E0 P- s; C) f0 r- V# m
Method 139 Z4 ^: ^& }- w- O5 j3 Z. z* h
=========+ P9 J o6 [2 f9 y
8 m7 {4 Y+ P9 Z5 m0 y7 j# e
Not a real method of detection, but a good way to know if SoftICE is8 _) i( ?8 ^5 [2 _7 f
installed on a computer and to locate its installation directory.) q& o7 n! V$ c; |+ `; ^" j* K. f: i, f
It is used by few softs which access the following registry keys (usually #2) :5 K8 n! C7 f: r- C/ Q9 u2 I8 n
/ ^ v. h. Q8 z
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion' r& e7 Z# [. U0 I. }
\Uninstall\SoftICE
9 c; n) e* z" c5 z0 v-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE2 Y: Y# [8 |- \% ~+ ]5 ]+ P
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
0 M5 o, M9 \' {* G% g* Y\App Paths\Loader32.Exe
6 ?4 z/ l, L4 _. W! T/ P1 J. ^
- ^: u8 @: Q6 i
8 u7 @* I" W; ZNote that some nasty apps could then erase all files from SoftICE directory* g. o8 J- s/ j, R! ?
(I faced that once :-(! ?9 m0 j% a( k; o
7 O3 F5 b* f" oUseful breakpoint to detect it:9 N( A9 W2 m/ s2 v# Z6 B
/ i9 M$ `. {8 Y( z) C BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
9 }3 r0 g* S* i; ^3 E- O
" A/ |1 j+ `8 }9 ~+ m__________________________________________________________________________' s/ E1 G0 K0 M e# Q
! F- Z& _+ K# e+ z: R, m
8 P* Z3 \$ I% U* a
Method 14
% p6 P* G; M% j=========
0 V( U1 N: c6 u! v# q8 {0 d% a# A n
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose9 t# X$ R2 k% }0 Z) E
is to determines whether a debugger is running on your system (ring0 only).9 U6 V& s0 h) g# \: B6 V
( n3 F: T9 Q, w# W) T/ p- e VMMCall Test_Debug_Installed6 z1 J/ r. H0 h j2 ?$ R+ @7 U
je not_installed2 d& [7 v, \) d- f0 C
0 a3 I6 h7 {. ~
This service just checks a flag.- x" i6 y4 g, u
</PRE></TD></TR></TBODY></TABLE> |