<TABLE width=500>0 N$ b5 }+ q3 P1 X! O( F5 [
<TBODY># y8 h% s" h) ]9 S
<TR>
2 {7 }1 A( k% i) ~2 u<TD><PRE>Method 01 $ m8 J. c) M% T$ }0 y% i
=========
! g' q9 I/ A& w; v; d% f$ ~: @( f
- {) O( O; S* u* j( E, U8 v' MThis method of detection of SoftICE (as well as the following one) is1 g+ F, J7 }" \- ]3 d
used by the majority of packers/encryptors found on Internet.+ |2 h! f' E) h9 n0 H3 c3 }" s. u
It seeks the signature of BoundsChecker in SoftICE* P4 l# M3 a: O; h
, p" w; B9 c* X; ~ mov ebp, 04243484Bh ; 'BCHK'" `( c8 G. S: m3 G: b" |. R; ?6 o
mov ax, 04h
" n3 `0 T1 e1 h% L: _, j4 E- M int 3
) j3 j7 v9 a: |$ v7 f) g N+ w cmp al,4 E4 @ N9 A5 q- ~9 L$ L+ f
jnz SoftICE_Detected, M; G9 l6 Q/ l8 D, O" D+ e
- n y {" i5 T% p; O M5 K___________________________________________________________________________
9 G" s. H5 ]* B( j0 Q
5 e1 _8 C5 }" Z0 c* n. `Method 027 i2 T: F6 ~/ m$ s5 C# x# g6 P1 o
=========
) z; ]+ S& k# i/ {, {- W
9 A8 |: N* b Y( w# y" d5 LStill a method very much used (perhaps the most frequent one). It is used
/ C6 ^) F L u1 b$ t& mto get SoftICE 'Back Door commands' which gives infos on Breakpoints,/ d) i, V$ Q( `/ [0 U$ i6 @/ N. X
or execute SoftICE commands...: D, P- r% r3 v5 E% E
It is also used to crash SoftICE and to force it to execute any commands
4 v% ^! R. |* ^0 M5 X1 t(HBOOT...) :-(( / }/ a: D) q g" [
7 l0 V: A5 g% |' IHere is a quick description:, g6 I; N, V3 a/ y' `5 x9 j8 x- d
-AX = 0910h (Display string in SIce windows)8 S1 R8 |+ f) T# ]+ j/ [
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)- b+ ~) g% X+ u6 L4 }- r7 K
-AX = 0912h (Get breakpoint infos)
0 S1 g, r6 `3 [2 K; y-AX = 0913h (Set Sice breakpoints)
) i d" p# @; J6 f-AX = 0914h (Remove SIce breakoints)
$ `: x) A4 Z! J8 D, m1 q/ O5 S( s2 p& g/ M+ S3 e& ]" Z
Each time you'll meet this trick, you'll see:1 c, t! a% ]9 T) Y
-SI = 4647h
* {. U$ I& H$ o6 D0 W-DI = 4A4Dh0 ]1 g! K8 t. H% G1 Y
Which are the 'magic values' used by SoftIce.
( M o) u0 I! `7 x) d& A) g8 [2 HFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.6 e0 S6 O" H% H5 `* o
' ^6 U$ v7 O. [4 I9 CHere is one example from the file "Haspinst.exe" which is the dongle HASP6 Q9 C/ V Y9 Y! V6 j I8 A
Envelope utility use to protect DOS applications:2 G( S- O) L7 C% q3 Z2 n& L% n
7 l$ L$ O, ]: ? X' |5 u% w" d
- I( T3 y8 }) N4 ] P9 e% X4C19:0095 MOV AX,0911 ; execute command.
. }6 e& N7 T0 [5 W* p4 i4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
2 ?* a4 z9 X7 w: Z4C19:009A MOV SI,4647 ; 1st magic value.3 J% J( [. c! g5 R
4C19:009D MOV DI,4A4D ; 2nd magic value.& ?; M2 H( |( r& U }
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
' U$ b7 N: s; z+ m7 R4 f4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute n5 m$ P6 Q; N* b7 h4 N
4C19:00A4 INC CX
2 A0 t* {% r( t* n: S' I: m4C19:00A5 CMP CX,06 ; Repeat 6 times to execute. ]- v( U- B! ~( a: |6 N2 }6 {
4C19:00A8 JB 0095 ; 6 different commands.
; E& a4 Y9 u! R8 U4C19:00AA JMP 0002 ; Bad_Guy jmp back.
' J1 n: d! f0 N! O0 e7 a4C19:00AD MOV BX,SP ; Good_Guy go ahead :)6 R1 @% y/ c7 G3 _# c
+ L+ c O& C' y& l4 ]
The program will execute 6 different SIce commands located at ds:dx, which
6 r* K" _7 F8 z" mare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
8 `/ U b" Q% a- J0 X3 C& G6 x: H W4 d
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
- p- d" H, N8 {. I" |. y___________________________________________________________________________
( Y& F5 Q5 T0 b3 S5 B4 Y) q. p
( J3 ^/ M2 R% e" [. O: {
: G5 I$ [* R* d% a" ~3 ^/ gMethod 03+ m! ~7 w4 D/ T% ?0 w$ X" Z, p* U
=========
/ j0 G; h3 v% C/ [7 E( W2 i- G% C/ _$ q" S2 k9 v
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
: v" d. x T$ z# k, C(API Get entry point)7 F' E0 U$ n. l$ v
& H3 I# v* T( O+ G( p+ R) K; t- O( M3 A! t. U- @% k, J+ S/ W' ?3 w, f
xor di,di
% b, I$ M# y! T4 z+ a* `& X mov es,di, P7 {8 H& N; U; g Q
mov ax, 1684h ) w& I9 X, l# I' y. ^
mov bx, 0202h ; VxD ID of winice
- f' v' G. _! w7 E, h int 2Fh
0 `: b' I$ ^ \- ^1 y mov ax, es ; ES:DI -> VxD API entry point
$ u2 w5 U5 ~8 F+ m4 p0 p0 ? V add ax, di/ v# x; h; h- r3 I0 ?( v# ?- F
test ax,ax
7 d. K: g7 f2 k( D: W! g jnz SoftICE_Detected
) K' J$ c- G7 U& r# V, ? e6 N1 _' a) |
___________________________________________________________________________
* x0 f& H' p% i9 h; D ~/ `( c. Q$ W3 D
Method 04/ e/ R" ~: ` E9 U, B$ w7 O4 A
=========2 U1 e0 x5 l7 W' Z6 o, I! }" O* J
9 [5 {9 L% q& n( o, lMethod identical to the preceding one except that it seeks the ID of SoftICE, K# f4 {2 x4 ^( V: X4 T1 L9 R1 u' u
GFX VxD.
% T/ y5 f T" j9 Z; K& }( ~3 V
5 g/ t7 G9 \* L* Y; `. Q' [% K7 U xor di,di4 ?$ I% z0 t; x( P/ j
mov es,di
9 m; @1 n; o( P, n% t mov ax, 1684h , W/ _# q3 ]7 H4 g
mov bx, 7a5Fh ; VxD ID of SIWVID
" I$ b( \) U2 \/ C9 @ int 2fh" w, C0 z; P( K/ Q$ q3 L
mov ax, es ; ES:DI -> VxD API entry point
& p, f0 U* J' n7 V, C% S add ax, di
9 E" f2 \2 I$ _( @& N. W. n test ax,ax! R5 m5 W \1 g* s# l+ y& r
jnz SoftICE_Detected9 G B R% ^3 G2 ~; G, c
2 F9 c) X1 C8 q5 H" ]0 Y
__________________________________________________________________________$ Q, ]: x0 @* D e6 F V
/ z2 u G6 P# u0 k# `2 a
* j5 r7 O/ W7 C
Method 05
. W) l6 s" e0 I e1 F=========: j7 S% C+ _8 W9 A5 |9 }
* Q1 Y* c' p- X& G0 {0 {3 \' C! u2 \
Method seeking the 'magic number' 0F386h returned (in ax) by all system
7 p" ?5 o7 ~6 k7 }debugger. It calls the int 41h, function 4Fh.9 V/ L# n) M! X* b+ g# P. g4 B5 {
There are several alternatives. # @$ g$ X6 m, m: e
1 H- w: ]$ Q [6 X KThe following one is the simplest:
+ {( e# N/ ?& Y- \* }$ O& U3 g! ]$ _
mov ax,4fh4 v% \0 {/ J; b$ z0 k' \
int 41h
, a. E4 o) ]: p1 e) ] cmp ax, 0F3865 j& {/ c0 H( P0 B4 b
jz SoftICE_detected
$ h( z. ?- k& Y' i9 s. z ]* C
5 D2 u" A/ \/ Y
* G. x% H6 V& S7 M6 @. i [Next method as well as the following one are 2 examples from Stone's , a1 p) ?1 w A$ W5 n
"stn-wid.zip" (www.cracking.net):2 f8 s0 T+ Z. e! @" _' q1 |+ O
7 G8 L* c( }- n* _, x
mov bx, cs% d. C. i. R* J0 a, x2 ]5 J1 j4 s
lea dx, int41handler2
6 @$ J- I0 |# X- N: k8 v; k xchg dx, es:[41h*4]/ n4 v9 \. R6 a/ v. b: O; N( F9 | F
xchg bx, es:[41h*4+2]: Q2 s; S# h/ A, M; x8 d
mov ax,4fh' a$ s7 f0 G: @0 |) u. }
int 41h9 S% q- f: \$ f. k: o9 L% M+ N
xchg dx, es:[41h*4]
/ ~9 D/ x6 |% ^1 v8 Y6 i- x xchg bx, es:[41h*4+2]
9 q: T% ^/ U; E& T, U& ^- A cmp ax, 0f386h
* V& R. f* h7 f5 N jz SoftICE_detected
5 B5 I0 b: e' X" J) J2 ]( S: J: v" j' D$ q7 T; C$ C
int41handler2 PROC
- [9 N/ N/ g* } iret
8 H0 A/ }5 ]5 {. Tint41handler2 ENDP2 [. s* K9 I, H) H5 @9 l
$ J% P3 K) O$ e" X" w/ ? E
' n$ B+ i' P; l; r
_________________________________________________________________________5 ~/ M- X( i! c" |
) P9 e; k3 W1 S/ B8 f8 m
9 v7 a( z1 [, I, _: o aMethod 065 `8 q: g- u v4 Z
=========% o; H6 _& S7 S ?6 D% n- w% U1 q
" ~- A9 I" H- J- L5 |
8 s. j6 b/ n) R
2nd method similar to the preceding one but more difficult to detect:. Q. v( G7 q, g1 t! x% K6 Z) K
7 ?5 x( Y% x3 {- N( J
; j6 y$ z' C7 @( x% t: N+ x) Tint41handler PROC9 E5 ~$ P" t; v1 N
mov cl,al6 R q% D/ Z8 [. Y- Q0 ]5 H
iret& p( Q8 @. P0 }! z( S
int41handler ENDP
V9 n' o$ Q8 M+ M" C/ J) l& L7 g
; n+ i4 @7 |0 v0 j0 D( i3 |+ q/ `- ^+ V7 N5 y
xor ax,ax0 U ~" }) |8 e/ L% I
mov es,ax
* v# B3 X! l0 D( b' h0 X1 ] mov bx, cs T# j. j( P2 h9 [5 B, I
lea dx, int41handler
& U. n7 N3 ]# v2 ? xchg dx, es:[41h*4]
- g7 E- G! O0 l xchg bx, es:[41h*4+2]+ ~- X, p8 A* `4 \6 I
in al, 40h
! m" T$ |8 Q' m' w M' z xor cx,cx
8 W, W, a* M* G0 k: T% J6 e1 {& U int 41h
1 p5 U( o8 q7 c- ^2 I3 ~ xchg dx, es:[41h*4]- V6 F# R$ Y' c' F, |6 d
xchg bx, es:[41h*4+2]
0 w/ W/ v/ | v cmp cl,al% s: X$ ~( q g! ^, k
jnz SoftICE_detected
! A2 e% o( K) f2 H& L) ^2 {0 N3 g# l" L# P2 @5 O2 `
_________________________________________________________________________
" Q0 |, y5 x" W; `; D2 O' b W9 h# u
Method 07
( j" h- r3 Z7 \- ^1 { j=========! }) z- M( w4 L/ {' c5 {
2 Z. V" ?/ s6 J( zMethod of detection of the WinICE handler in the int68h (V86)
9 Y1 H) w, w! W# M* j: p9 C# l) d8 `7 x }* k
mov ah,43h% B) P% {% W/ e# q2 v$ b; j
int 68h) o6 K. H2 P9 u7 Z7 J
cmp ax,0F386h
2 x3 P$ y S! D' n# H jz SoftICE_Detected4 j, g+ J' W3 V- \
! h8 a" A( T' t! R! r
# _' C% s5 x6 {
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit* e0 w, B: \! W# m, n4 [! B( f! n
app like this:8 j; Z0 d0 H% L8 \; `0 \6 J
+ A: k2 I1 z a: }& o) i) G BPX exec_int if ax==689 b$ x [% Z& I- i, F
(function called is located at byte ptr [ebp+1Dh] and client eip is: D( X9 g& y5 T$ w4 k
located at [ebp+48h] for 32Bit apps)
. W7 M" V5 H5 O6 }! m& h3 k) t. y__________________________________________________________________________
0 O# h0 |* p8 k j+ ]/ k5 s# V% |1 u
4 j4 m- j O+ j% u+ P; p
Method 08
- {, g8 @% s2 E. l: V2 B=========
* f+ m' X! Z8 G0 D% p+ ^$ z) s1 j% t" F& h0 ~
It is not a method of detection of SoftICE but a possibility to crash the
2 I0 E; x6 @) m% h A4 Q% t! fsystem by intercepting int 01h and int 03h and redirecting them to another+ i' G9 ^% L& c
routine.
* ]/ C4 \% g8 z. WIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points- F4 p' U8 a% q% J4 F4 P( @7 E
to the new routine to execute (hangs computer...)
0 S+ @2 r7 ]' i2 s, ~' @7 m! q n" u, s# d
mov ah, 25h
2 N3 _4 {1 l2 l4 M. X mov al, Int_Number (01h or 03h)4 c$ g h5 y- U, @
mov dx, offset New_Int_Routine
$ Y0 s6 Z: y( K6 g+ h3 Y3 L int 21h& g( T; s, Y' x' E% O9 k: Q3 O
- D% W; y% V/ h5 _+ E& V5 f
__________________________________________________________________________
# ?, g b& e4 C+ x7 Z+ a4 S
) P) ^# G; a/ Y$ U! z8 G" g9 tMethod 09
: H: k( J7 |: K5 W6 u7 n=========
7 E( ?/ g/ |7 _7 Y# U1 b
. k* d0 d) [* y& \# e. G$ _' IThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only2 K, b- T) M" t; L
performed in ring0 (VxD or a ring3 app using the VxdCall).
- v8 B' P/ _! z: c E; K1 v3 m6 i, DThe Get_DDB service is used to determine whether or not a VxD is installed
. H! b2 l2 [0 ?( g( W$ m5 n, D% ~for the specified device and returns a Device Description Block (in ecx) for
+ i3 H3 b. q$ O; ]9 [that device if it is installed.
9 i' q' f4 m' L7 L
/ ]9 J7 r& A; ^8 B mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
+ U" j0 s( i% \ mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)+ K4 a2 K( E% M1 \
VMMCall Get_DDB
9 `* T7 A6 N* m8 s, r mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed7 P0 `9 |& h+ M3 D. E; R, u ]
4 a' N* f6 c; w& T ]6 |( ?) d/ W. A! a
Note as well that you can easily detect this method with SoftICE:
8 _8 U1 f5 }9 O. S/ p( J bpx Get_DDB if ax==0202 || ax==7a5fh/ k. y" j+ \0 N/ Y
+ }0 o; d* U9 b__________________________________________________________________________( V1 r9 ~0 F" h
t, X e$ U- I9 U& r
Method 100 _& Z" e5 h; v$ B9 n
=========
( E4 [+ {3 A% k: Q9 c/ z( B4 m
7 C. e$ _: [) L o; F# d S=>Disable or clear breakpoints before using this feature. DO NOT trace with
! I& e4 P7 J. h( J SoftICE while the option is enable!!& @8 s$ l2 f4 _# X* D* B; d9 t+ J
- o5 ^9 `. [' j2 G7 l5 a1 t
This trick is very efficient:
2 G* I1 u* K$ fby checking the Debug Registers, you can detect if SoftICE is loaded
' F; s6 z2 N. P9 H" {4 i0 e(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if& o7 J8 o1 M, `+ L3 P
there are some memory breakpoints set (dr0 to dr3) simply by reading their* S! ~, o- U" o- ^
value (in ring0 only). Values can be manipulated and or changed as well
: V: K6 l0 O+ \ C6 O: d7 g% F. l1 @(clearing BPMs for instance)
0 g- S, V* o; d9 m% S* y! N3 u1 u* m- l
__________________________________________________________________________
* j' e$ J% q, Q4 h7 Z4 n% k3 S! r; _2 f% k/ |6 R6 h
Method 11, P. l$ [: s' E, g: E& Y$ T
========= |) d/ y8 J8 g5 [3 ~
y+ I7 \9 |# uThis method is most known as 'MeltICE' because it has been freely distributed
. W* m8 y; D& i/ Y& W& s: uvia www.winfiles.com. However it was first used by NuMega people to allow, q0 ]- I0 y2 S+ A% E
Symbol Loader to check if SoftICE was active or not (the code is located
. S5 O) Q7 |1 L7 ~inside nmtrans.dll).$ A7 q7 i! _+ u2 Z4 l4 H! S# K
0 X3 |$ {6 a7 Y& N4 {The way it works is very simple: r8 L" I( r+ x0 r9 M7 c1 ~# @
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for. Y/ z4 V; h. A4 V. V
WinNT) with the CreateFileA API.
: U8 C. w1 m( T) U' A5 h8 v5 T, T5 F# S' {) k: y
Here is a sample (checking for 'SICE'):
, v; T; y n7 i2 N+ h, D1 ]0 l. ]' y* p) x8 E
BOOL IsSoftIce95Loaded()
5 Q3 b5 V5 r: b4 }% C{
! E! G( G: L# W6 t. b h HANDLE hFile;
) F6 V$ x( t, k1 |7 o hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,' S4 |* a6 P: W4 T* x9 O& v
FILE_SHARE_READ | FILE_SHARE_WRITE,. m, z4 S& g7 P+ h) i' K
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);( w: B* I- n% D) O# A; }
if( hFile != INVALID_HANDLE_VALUE ). G8 i. C7 N6 o3 o9 W8 @$ i/ v
{4 l: D5 V8 z1 C% s2 ~% O+ c6 S: k q
CloseHandle(hFile);, {% o- I6 R5 b, B, Q7 t
return TRUE;* U) M6 Q, J/ B$ w8 r7 \) T
}
/ F9 S: M) f: M& | return FALSE;
0 X& j9 v0 i- q% _3 k9 K* B7 Y/ X}
4 E+ G9 Q4 c+ p, `& b7 w: j B1 ~8 u
# T- M$ D* ?& _ lAlthough this trick calls the CreateFileA function, don't even expect to be8 h5 Y( @+ J! u$ r
able to intercept it by installing a IFS hook: it will not work, no way!
- P# k; c( C9 s( r7 S3 |In fact, after the call to CreateFileA it will get through VWIN32 0x001F
3 h0 @: f( m7 D$ |service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
& a$ |4 g& K$ i# \and then browse the DDB list until it find the VxD and its DDB_Control_Proc7 E- k- l( L2 Z# y) Z. R' K
field.1 Z8 K2 ~0 R/ J( P2 W! M
In fact, its purpose is not to load/unload VxDs but only to send a - G, o' @/ l2 I/ P
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
+ B7 E# i9 g7 K" `to the VxD Control_Dispatch proc (how the hell a shareware soft could try7 N8 W3 l0 w: W6 _( `/ F
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
4 u3 m# k7 ~1 g/ yIf the VxD is loaded, it will always clear eax and the Carry flag to allow
; o, k0 X, s/ w5 E r- h9 u( Vits handle to be opened and then, will be detected.
( k' D$ P2 s& p! i( QYou can check that simply by hooking Winice.exe control proc entry point* ~2 W& [ }; o$ M6 Y v) F, p
while running MeltICE.
! i' a. J- g/ _" H9 U
y, u3 U' p8 H$ b. ^! n. k
0 V; s2 F7 M: Q; v7 V 00401067: push 00402025 ; \\.\SICE$ @" C1 A: w- Q0 n$ O7 U) [* Q6 ~
0040106C: call CreateFileA( {, O+ _5 p: c/ G
00401071: cmp eax,-001
: s/ f3 @; J& R' s( d 00401074: je 004010919 y* {$ v! U7 n- o' D( t) }
# C$ ~+ m$ ]5 V! ^* C8 `2 w$ D6 R/ G# o: v# f
There could be hundreds of BPX you could use to detect this trick.
- n) ~0 h Z6 p2 I( k% z-The most classical one is:
, o8 S8 D( `& f) `& p* \* o1 U BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
1 h9 g7 F: O* h( F$ I v# u. h2 l *(esp->4+4)=='NTIC'
+ P4 P/ s: F9 R2 ]/ E2 n3 ~" q p: Y( l5 X& z! q* V. z; }/ w
-The most exotic ones (could be very slooooow :-(2 K. q* U( z- Y4 u2 M
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
# i. i! M) r' l6 @; I; ^ ;will break 3 times :-(
, u5 S n' S" v/ g5 x4 }! l" c' Z9 d8 m9 l) D, ?5 j5 q$ ?
-or (a bit) faster: 9 V6 }5 y: f- K5 `7 f; L5 S
BPINT 30 if (*edi=='SICE' || *edi=='SIWV'), Z; s' ^" @+ N
, e1 N' {2 a' R/ M2 n BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' 9 W* v) O6 a/ S1 f- n
;will break 3 times :-(0 x" G2 L7 {5 ?
* G$ s: u9 Y, I) G# S3 K
-Much faster:$ P6 o; E1 T9 u
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
2 J, K8 l7 M/ Q/ S+ Z; e2 m8 P3 Y8 N$ K- H/ N' H \) B" ]1 Y7 h
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen8 b E! ]$ f$ t# d) c
function to do the same job:
/ d' \0 Y+ o# l" L7 J6 e; E
" A% N) J3 A- O; a$ ?! I push 00 ; OF_READ
$ H4 W* n2 x7 h9 v& j. C mov eax,[00656634] ; '\\.\SICE',0! E6 }$ u! D/ E- A
push eax
2 }, v0 c5 C3 s$ J# {5 j) _ call KERNEL32!_lopen0 Z! z/ I. L: z5 D$ [
inc eax. f3 V' h1 y3 y$ a! m
jnz 00650589 ; detected, x4 K0 }9 Z* u4 F0 y
push 00 ; OF_READ2 b" c4 F4 ? F8 s6 `
mov eax,[00656638] ; '\\.\SICE'! c4 Z- X/ z: U* R# g
push eax
8 t- R/ d, C& U2 i call KERNEL32!_lopen% I a; X, Y9 u+ _1 c# k' f
inc eax9 |/ r1 U5 R" p+ i
jz 006505ae ; not detected4 I$ C" V: C5 y
+ r d+ T2 K. E _7 @7 ^
8 `: W+ ?' k- B6 V* I4 ^5 {__________________________________________________________________________% o! Q. ^8 u' }5 c/ p
1 g4 r7 Y% O, hMethod 12 h9 ?5 A F S* E, ]
=========+ ]5 y( y/ c! G
, O6 n1 [. H! O. R" }! V
This trick is similar to int41h/4fh Debugger installation check (code 05
$ x( T' Q6 a; b: P. b h; D5 Y& 06) but very limited because it's only available for Win95/98 (not NT). }) e6 Y( G/ P, @4 K
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
5 Z6 E8 {* G7 o3 J7 C* r t
" x5 J& {2 P' B1 }+ t" l push 0000004fh ; function 4fh
% `" \. F6 j/ E$ L$ I* o push 002a002ah ; high word specifies which VxD (VWIN32)
/ y' Q$ t5 E& e3 f1 L' L ; low word specifies which service( p1 C7 R# y% Y# ~
(VWIN32_Int41Dispatch): b$ M9 O& x7 _" l
call Kernel32!ORD_001 ; VxdCall. U$ v s2 a4 s; T" N
cmp ax, 0f386h ; magic number returned by system debuggers1 h, ?) @! \; O& N' f G% A
jz SoftICE_detected
0 q; u6 ~" }5 w3 A% o# Z; H S8 ^
) q0 f6 W! B2 U& B4 e# o5 G5 YHere again, several ways to detect it:
3 c- l- V/ H; k: W: I
4 D. ?* g% c+ n% }2 v BPINT 41 if ax==4f# D1 G8 M; C. m7 [" k# L
9 I3 h4 D" a& i& ]; |! }9 U
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one/ n3 Q' b9 t' ^" G- A& a
* q: t1 b$ w: f2 n( s* o P BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
- D- k* q5 G, N- p. l( b
( e" d% w, b% A$ S9 O. P BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
0 f5 @& Y; o6 M0 F$ y6 s
- ?& s4 l& B8 d__________________________________________________________________________
, S2 G7 D: e7 D: b, I$ N7 O
& E0 V/ b0 |+ [. }6 {/ BMethod 13
* H& i- m7 N3 V4 n/ p8 c# m=========. j7 j1 w9 P& a
) D, [, v6 S8 }* n- M" r8 m0 O; p4 MNot a real method of detection, but a good way to know if SoftICE is- D- L' n; C' L' X+ d& C
installed on a computer and to locate its installation directory.* C2 R- Z I/ B- _
It is used by few softs which access the following registry keys (usually #2) :$ Q+ v7 [8 x# w: c& F: M3 h5 A
2 H, ]$ z3 O8 W$ ]0 v$ z
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion& M ~' E8 u: p
\Uninstall\SoftICE
6 T R" @! v* y) J5 n) Y# ~3 O! d0 y-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE6 Y' k6 N/ J9 E/ A# z5 p
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
2 M2 `" p8 p7 J! E9 v\App Paths\Loader32.Exe3 H3 p" e6 W& ^+ k; x- h
, r, K- P. ~+ a, {; M
/ w2 t. f# Z3 G7 aNote that some nasty apps could then erase all files from SoftICE directory% y9 G: o, J5 {! t- V* I* w5 K+ U
(I faced that once :-(
, L5 z9 t: }2 I$ M8 ^! j8 F9 S6 {0 J3 S J
Useful breakpoint to detect it:
# [6 N W" ?1 m+ E n5 x5 n, _- E; D
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'- f& D* r( L& a1 a; [" V7 J) p3 e
8 j7 H, {- [' M T( v__________________________________________________________________________% X5 E# F9 M1 g; R i' J# z' I
- ~+ S3 s1 ~1 r" v2 u% G1 U- q9 B- l3 F7 W. A/ D, Q
Method 14 ; x. Q7 _2 z7 y1 j3 Q( _
=========
7 m4 }$ x3 C) O. C% T. ?- m( v
/ k- ~9 J5 l/ q/ H; E0 p, e& D1 n% E, LA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
# a2 {) q3 X0 k0 W& i) _/ h- dis to determines whether a debugger is running on your system (ring0 only).
w0 k6 r, u4 _2 h( L
, `) ^" s+ _2 t4 a5 L/ c4 O& @ VMMCall Test_Debug_Installed$ M5 N/ ^ d7 K$ N- I
je not_installed
$ m3 _+ [+ B) N1 z9 d! e7 F5 t/ D/ F: J' P& F, k$ }
This service just checks a flag.
9 X: \2 d1 W/ ^3 r4 T. j2 a</PRE></TD></TR></TBODY></TABLE> |