<TABLE width=500>) a Y, ~, P3 k$ s; I: z! S
<TBODY>/ E5 g. `1 t2 ^1 n& O, {: a
<TR>* n& q' [9 Z0 Y0 L
<TD><PRE>Method 01 " h, m9 [8 Q) C# e' t! n
=========) \; K1 Z- `5 W: a# b: P
# E: l4 k4 v% O9 Q
This method of detection of SoftICE (as well as the following one) is
3 r/ c& b6 d) Vused by the majority of packers/encryptors found on Internet.% D& o) Y, S& W, \/ c
It seeks the signature of BoundsChecker in SoftICE
0 R" Q! i W5 G4 E, s; m" W" q( p9 \; w! F4 V
mov ebp, 04243484Bh ; 'BCHK'& f! a( g; a3 z! Q. v. Q
mov ax, 04h
( u3 _6 |0 L- o, J" j+ N int 3 5 N$ r9 x R* i J% A9 q# ~7 q# A
cmp al,4
4 A# Y4 U P1 b# w jnz SoftICE_Detected5 l+ B( U( h* Z# ^
0 H6 A! F) H. q9 q9 }! l" }___________________________________________________________________________2 U: X U6 h) f* V5 e7 J8 T
1 q- L8 u3 X: AMethod 02, |1 E" b2 V( }3 U
=========
- ~# b$ f( Q4 }2 }7 p; t3 ?; H9 M$ L/ H7 B! d
Still a method very much used (perhaps the most frequent one). It is used1 P4 |) j2 U9 u" ^' `
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
! Z' G! l4 \0 I# vor execute SoftICE commands...
5 l2 o3 b$ e$ G+ }It is also used to crash SoftICE and to force it to execute any commands/ @0 |# M, H) F3 J
(HBOOT...) :-((
, W# ]9 _8 ? U$ d% W$ s
9 H) ?" v! ?. s& ]& xHere is a quick description:9 [7 Z0 T& I: |+ d# W8 d% W' R% G: M
-AX = 0910h (Display string in SIce windows)
, x% _* K* s+ ?5 @9 V-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
N4 w \* Z% K: ~$ b-AX = 0912h (Get breakpoint infos)6 k- X* O M5 H. B. f3 ^
-AX = 0913h (Set Sice breakpoints); P2 \7 J- W; t" S0 w- [" k% d7 R
-AX = 0914h (Remove SIce breakoints)
: @# h/ j) F, r
4 z6 d# I8 J X+ G7 @$ I xEach time you'll meet this trick, you'll see:8 r) \* A" v$ P: X; ~
-SI = 4647h
2 w4 t# y1 {) s7 b. H) `& A |- L-DI = 4A4Dh
! |; C5 G3 s4 [6 E1 @0 k X5 |Which are the 'magic values' used by SoftIce.
1 } n6 Q. j$ bFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
+ X, p @+ v! N8 k8 Y- S1 h( L$ O* A1 n- f; K
Here is one example from the file "Haspinst.exe" which is the dongle HASP8 b0 ~6 y$ w# ]5 m n
Envelope utility use to protect DOS applications:" U& v/ q6 ?2 i! q2 C* v
# p& D! U4 s1 H4 G/ K) v. I1 t, A. `+ T; j5 s# @
4C19:0095 MOV AX,0911 ; execute command.: X: w) I2 ?$ G; n+ F4 j- a; o
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below)." q2 \* i, c; H& ^0 W: K
4C19:009A MOV SI,4647 ; 1st magic value.
4 x s" M( c/ o& Z4C19:009D MOV DI,4A4D ; 2nd magic value.* K& W/ t2 L( I& \4 w" a' r/ y
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)" @1 q R0 P+ o: v6 ^
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute, U: X @8 o; p% @* ~7 a
4C19:00A4 INC CX
; K3 H$ }/ x5 D7 J7 \; x& S4C19:00A5 CMP CX,06 ; Repeat 6 times to execute }7 [6 ]6 d" V$ v) \
4C19:00A8 JB 0095 ; 6 different commands.
! ?, J# \+ M. l5 L1 G4C19:00AA JMP 0002 ; Bad_Guy jmp back.
: b9 f% g5 B. i/ C1 k4C19:00AD MOV BX,SP ; Good_Guy go ahead :). T: I+ ^) z2 Y0 [' E& B* p
3 i8 r3 a& U& MThe program will execute 6 different SIce commands located at ds:dx, which8 \$ u7 W R: | t
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.) s: ?5 V+ _1 J# V: I* S" k
5 F- J4 n/ M+ i0 H; k
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.3 x7 ]2 @& ]$ q# I) Z9 c
___________________________________________________________________________, k: s; p p% e0 c- d) D
6 x8 u: R" B1 T0 v; U
9 a5 j( A, q& fMethod 03
6 `( v* A5 \1 u3 _=========
, b9 a" M4 J+ ` J, C6 E+ u
$ I& J+ w. s" E6 WLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h4 R) i4 ]4 @+ I9 o/ F
(API Get entry point)
+ i7 F0 U. [ w4 i7 y% Z k" w+ u
r. a( L7 i/ D; I L
1 e% o6 y r# j9 q+ u0 K- S. ? xor di,di
( f% h# d) _2 v$ P3 n7 E& L mov es,di1 G' Q7 u+ D& W$ a1 M3 v. f$ }+ m% J
mov ax, 1684h
' w" @2 H G+ B5 R# l mov bx, 0202h ; VxD ID of winice
& T" E; l; q4 {7 m9 j int 2Fh: p5 `! n5 a! m
mov ax, es ; ES:DI -> VxD API entry point% a% `, x- L1 }1 D4 t2 G
add ax, di
+ V2 A' T# Q/ V* v, j) Z test ax,ax
5 O& ?* c l; o9 P) V jnz SoftICE_Detected, q& s" _: Q* D
! }; G* _# J( B! G) u& S___________________________________________________________________________
1 E- o; ?: j A4 T! p# m
( |( W0 |$ a0 ^) v5 E2 ?& IMethod 04* q. u: j P+ F J% y
=========; i r0 }: a) d. z
! j( k$ P! {: Z: ~" V# p* i$ {# J
Method identical to the preceding one except that it seeks the ID of SoftICE% T& Q9 t4 ?- E1 m) Q2 b; _" p
GFX VxD.
1 e3 d( p* }0 ]! G. r* h, I8 O, X% V
5 d8 r# a O* d/ `, C6 j9 u xor di,di
/ }* J* Z$ V: g: W5 c. w mov es,di
/ Z6 Q% ]* z6 P0 O2 a2 \1 a6 V mov ax, 1684h
4 H# C* O' y1 T5 T' J) c mov bx, 7a5Fh ; VxD ID of SIWVID+ B/ S+ b2 r8 K( l/ ]: J1 U# h/ B c
int 2fh
& `" D8 j2 k% H* e0 m3 B* H( V mov ax, es ; ES:DI -> VxD API entry point
! X5 [! c- k' K2 A; F9 x add ax, di
# L3 b7 p! j# m/ b1 ^' E test ax,ax
" W8 ]$ _. ^, p c9 q jnz SoftICE_Detected) \# P/ M) D$ i I6 i
+ G, s% N0 E# D6 O
__________________________________________________________________________
4 |4 x$ P; {) w7 o# H) Q4 l: b" n {' `% \) P3 a( l' ?
: d6 M, E3 j; b8 U: O/ [* j5 v# p9 T QMethod 05
1 L. d' m: q' Q% \) k. O! o7 i=========
! \4 n1 r, j% i$ ]& A) ]( K% x* P! s" P" d0 ?
Method seeking the 'magic number' 0F386h returned (in ax) by all system
* O" @2 V- ~/ a$ t8 R1 \debugger. It calls the int 41h, function 4Fh.
6 Z! f W- c5 t% Z/ e' WThere are several alternatives.
+ d4 z2 C! n5 P
! w! `* L$ X V1 M' a/ w' Q6 v: \& UThe following one is the simplest:
$ j; N9 R5 d8 ^: W7 J
7 z8 n, b' L2 _2 o' ?5 x* [ mov ax,4fh
! a5 \7 E# S9 G! U, ? int 41h
7 O' }- o+ }7 h* @ cmp ax, 0F386) M* I3 \* I0 V6 R. @6 x* m1 M
jz SoftICE_detected. a; {6 w: s# K- l5 t3 X
% Y( C1 ?8 g+ Q0 P4 |: o5 \! W" W& ]- o& Z& ^) n
Next method as well as the following one are 2 examples from Stone's $ D" h( v$ L }" F
"stn-wid.zip" (www.cracking.net):
$ m# w( x9 ~# h) v( b
) g% d& K* y, H3 P mov bx, cs
5 w: a# I/ q. L) v8 i2 L( d lea dx, int41handler2: V o" T2 O; e O6 c: `( r
xchg dx, es:[41h*4]
. s/ P+ e, u; h" L# n xchg bx, es:[41h*4+2]4 Z8 y! l7 J; r4 T
mov ax,4fh( H2 Y( I4 h1 e0 y
int 41h
M" ~4 n% M# W' M8 [. e5 z% u3 g4 | xchg dx, es:[41h*4]
: Z( p4 |! o @+ f2 ]& P xchg bx, es:[41h*4+2]
' [3 I$ H6 [$ w8 O$ Q4 ?- A cmp ax, 0f386h- n( M+ ?, N: D1 U q$ `* H5 Z, u) }
jz SoftICE_detected
1 }! v- _. V5 U2 A6 y
# Q5 n; g/ G5 c! Z0 dint41handler2 PROC
( M3 f% ]+ l5 \2 F iret
2 c0 v2 Q+ h' L" p6 v1 @int41handler2 ENDP
& k& `9 D& r5 s" K2 i% _& j/ c
: K; @' x' D9 V2 Z- V, ]3 x# O2 w8 d
_________________________________________________________________________
- C+ y2 P$ z1 p- f
$ `7 _; w2 Z) e: X
- G) W6 `* O7 {! m+ z$ T& o4 YMethod 068 @: h% l% w7 E. G* X
=========
4 X4 q3 i/ W0 U2 x
) ^' l( w, j5 z; C4 `4 U9 Y" e% V" v: Y2 F8 S6 a, e+ S8 ?3 C
2nd method similar to the preceding one but more difficult to detect:
# r8 P |* H/ j" I8 d/ d) @" L5 O) t0 N' |
: f% e' F$ g$ m
int41handler PROC+ R7 h5 ~5 s2 D4 a
mov cl,al
& z; ?$ I% L# `- A/ ?+ \6 L iret
6 M* K- n$ p. P6 F) vint41handler ENDP+ Z/ `8 [2 Y$ n9 D. l
3 h3 D( u* R0 D* f. X- k1 F8 D
& A% N( C' n9 t% c' K% l xor ax,ax; x: Q S" W1 e! o
mov es,ax
3 D+ i* j- H' k) V" H. p/ H mov bx, cs
( q$ R1 X! w4 h9 i5 D( ? lea dx, int41handler7 i; \( C$ v8 s' I0 ~# [- w/ b
xchg dx, es:[41h*4]5 Q+ X6 p1 C8 l: ?2 `5 a
xchg bx, es:[41h*4+2]
* z9 e/ J: c) y in al, 40h7 d7 y1 f2 r9 m2 Q/ }
xor cx,cx5 _8 ]' U) a$ l) S/ f
int 41h' |% H* X$ R1 k" t
xchg dx, es:[41h*4]% v5 u7 _1 w; v. |' d) G
xchg bx, es:[41h*4+2]
7 b" f8 n0 N l, K* X4 x. M8 h+ ` cmp cl,al1 o- H& n* |' c, l
jnz SoftICE_detected9 C3 c' c# f: p/ o: n( a
/ Q5 J0 H% [. S* N, t' q
_________________________________________________________________________, s8 {8 V' t: J: y
" `5 e1 K) `7 x3 k) h3 rMethod 07' L/ ]8 A) H1 a/ d! c k0 c1 s8 }3 M7 f
=========
2 q9 q% V& V+ f8 n! \
3 v j; l8 f5 U- J F3 jMethod of detection of the WinICE handler in the int68h (V86)/ o, R; v& y) ^. F+ \6 S R3 l3 R! [
$ C9 q, t6 O0 _. N/ V, d
mov ah,43h
6 o) w% Z6 l# i) O4 h int 68h
7 f9 z6 z9 B( L cmp ax,0F386h
; j* S/ K8 V; n* f& M/ L' T# U7 ^ jz SoftICE_Detected
. r" F1 ~' c$ I- S
+ y' R. o4 e( I3 f* C8 @, \6 o/ V Z6 x8 T3 n
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
! u7 A1 _1 a# l* b7 Y% B0 Y app like this:
3 I( E( G# ?# r0 r7 E( M4 i
' }5 H! \2 ^; h9 A BPX exec_int if ax==68
% `/ u4 [- |& { [( j: l (function called is located at byte ptr [ebp+1Dh] and client eip is0 W& n1 [. v6 v5 A1 _
located at [ebp+48h] for 32Bit apps)- h6 h1 l# k2 }8 a8 P/ ~
__________________________________________________________________________: Q/ H* i: r4 r1 n; h, D6 v
: \. o6 m `4 {* _
& U; [$ |) P( s0 S0 X9 U8 wMethod 08
* _# Q: r% a9 r r/ B/ t1 X=========9 x5 B3 m% ]' [1 K
- c- ~, j; S0 f( L) sIt is not a method of detection of SoftICE but a possibility to crash the
. V4 ^! W0 q" @7 x3 Q$ x" Msystem by intercepting int 01h and int 03h and redirecting them to another
8 H2 Y1 E* x2 ~1 P- N( {4 proutine.
' B0 a3 Z7 e7 B: {( AIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
& l! z8 G" u% s3 }3 cto the new routine to execute (hangs computer...)
9 o, ]* R% D4 c* g. h/ J' p' D! u2 j4 e. m- P
mov ah, 25h6 n% N0 D+ D6 I. `/ X2 S. K% x
mov al, Int_Number (01h or 03h)
* ~0 B5 x/ S- c% Y mov dx, offset New_Int_Routine
, P, u. _( X! \ M5 Q; f) G% _1 h int 21h8 \; J) P2 @2 q6 k2 Z
8 y/ v- I) [# B& J$ J: n
__________________________________________________________________________8 n. Z3 v' ~- V2 V
2 \' V' l( i. oMethod 097 A. `( J3 R8 E
=========
1 G7 V+ l6 Q; t8 y" q& B, Q3 h
+ D! w7 ]# X% ~6 pThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only5 u# @9 l& E# a; I @( H+ v
performed in ring0 (VxD or a ring3 app using the VxdCall).
: V& j/ M& a3 V) jThe Get_DDB service is used to determine whether or not a VxD is installed
, m+ J9 D. `2 ?7 a. u+ Hfor the specified device and returns a Device Description Block (in ecx) for1 J8 z3 J+ }, o" S) {9 U' y
that device if it is installed.
# A( W* m, W( D1 M% J6 G' v) h4 H# r4 s7 c
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
) H3 e; Q% F$ I mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
% i/ y u/ N% Z3 p" X6 ? VMMCall Get_DDB6 g2 M2 l/ w, L+ |6 w! [: j p
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed" f/ D8 I) w7 S4 x& D5 q
- W& d d& Z" n F5 R) ]2 T4 CNote as well that you can easily detect this method with SoftICE:
. x# D, F/ Q7 ]& Z4 k/ d0 y4 E bpx Get_DDB if ax==0202 || ax==7a5fh
& B" u. a# b7 x- u1 C0 I6 d+ ?! H- P5 h7 n1 c+ I8 T- c: J" G0 f
__________________________________________________________________________* D( P; {$ F( i
" [6 `4 f% ]4 i
Method 10
+ X) I# Z, k' x }, Z& S5 u h=========9 {7 t* G: Y$ A P( ?
8 [+ Z* Z$ s: ^) C: q; F
=>Disable or clear breakpoints before using this feature. DO NOT trace with
. M1 q V3 W! N# Y, y$ v" \, M SoftICE while the option is enable!!
3 G8 J' I! D: }& M: e: x$ l; k, Z$ J3 L
This trick is very efficient:2 g5 t& c- p. g! V1 o2 {! e& e/ h$ L
by checking the Debug Registers, you can detect if SoftICE is loaded y8 j- U4 s' m5 V% s
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
* \* T0 B J! y N r kthere are some memory breakpoints set (dr0 to dr3) simply by reading their; Y) e1 G+ N1 H! `2 D1 {+ P
value (in ring0 only). Values can be manipulated and or changed as well9 J! {5 Z, T& i& m+ w( Z( I: U) ]: l
(clearing BPMs for instance)
' D. D* s) d. ]
! g$ Y2 Z2 a; `__________________________________________________________________________
5 x6 n1 C p0 Q1 M4 d. v# ^9 L; d8 B/ A
Method 110 [+ U# b. R9 s1 }1 w/ N
=========) e0 _8 i6 {9 a% k: d2 `
) Q( h, ~+ j& k7 `1 QThis method is most known as 'MeltICE' because it has been freely distributed6 o9 N! x! @, {; E3 w: C3 C" i
via www.winfiles.com. However it was first used by NuMega people to allow
n4 f' @8 ]) I' U! t9 k3 dSymbol Loader to check if SoftICE was active or not (the code is located
0 B: r4 m1 ^6 I. oinside nmtrans.dll).% a" ?6 j1 Y$ {3 x1 h1 Y
& e, h; f% |" X/ B* z; X/ E
The way it works is very simple:
) f; U7 M3 d ? r" Y/ wIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
) n. r0 W& t5 c0 Q+ `5 U- LWinNT) with the CreateFileA API.
& k3 }2 s6 `+ ?1 a! \ y9 P7 G' m5 v! Q: |4 a* P" Z3 }
Here is a sample (checking for 'SICE'):4 [7 @- R# e, c- Q* E
6 b" M9 R- ^) u9 l5 o1 }' ZBOOL IsSoftIce95Loaded()+ A; I1 U6 d; S/ p6 ]
{
3 N7 r3 @9 ?' l. w3 |5 { HANDLE hFile; , I9 l- t2 h9 }8 \: z9 x+ ^
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
# V% Y9 ` F" z1 H$ D& c3 @ FILE_SHARE_READ | FILE_SHARE_WRITE,
( a! b* E: s$ u4 e NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);. ^4 S, T+ N+ u3 I$ R& k8 M8 K$ w
if( hFile != INVALID_HANDLE_VALUE )0 ^$ ^, a3 f9 B3 M3 T' }
{
) ?' b$ i. {- g CloseHandle(hFile);" z2 }: N; D6 t, n4 v0 h
return TRUE;5 ~+ r1 ?- y0 f( f; K
}, W5 @/ }; Q: z- j
return FALSE;
; @) S8 x+ y' e- z2 N}
/ R/ s' R* ?, A. d; l* V; H6 t
: a+ ~2 r5 L6 l5 R4 zAlthough this trick calls the CreateFileA function, don't even expect to be
?1 } Y4 \/ ?# h& Kable to intercept it by installing a IFS hook: it will not work, no way!5 w* J; }3 ^, ^4 |8 t0 Y/ Y7 o
In fact, after the call to CreateFileA it will get through VWIN32 0x001F0 A/ V% O; T3 r
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)+ h% S1 w- `; I* y! c( c! M
and then browse the DDB list until it find the VxD and its DDB_Control_Proc, C) _+ U$ G4 w2 q" Z
field. l9 p6 a( f; t0 w
In fact, its purpose is not to load/unload VxDs but only to send a & M" Y8 i- f; k8 C" \
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
6 u% y7 Z2 |1 b' `to the VxD Control_Dispatch proc (how the hell a shareware soft could try
7 G; e/ B2 I" ~to load/unload a non-dynamically loadable driver such as SoftICE ;-).5 q L# O% |3 ~8 e
If the VxD is loaded, it will always clear eax and the Carry flag to allow% j: W( h/ z1 I3 V' k* n% j
its handle to be opened and then, will be detected.
9 [+ P% o1 \8 ?- w9 \4 x/ [You can check that simply by hooking Winice.exe control proc entry point
4 [+ e; \* O) A5 }: ^( Nwhile running MeltICE.
8 U; u, e0 v! o7 E- L: ^% `2 b1 r9 D4 y# y& K6 z
- O! T, b7 }( d: P4 C3 A* @ 00401067: push 00402025 ; \\.\SICE$ \2 r/ z& {! J7 C$ d# O
0040106C: call CreateFileA
! k( Q3 ]8 i0 P* A/ t% d' ? 00401071: cmp eax,-001" B1 J) _: N/ }9 S% {# p2 `
00401074: je 00401091
% x0 ^0 q F6 R) w; u1 t- w& g- y/ x! a' D9 }1 k
( ~ X* P6 l$ | a5 sThere could be hundreds of BPX you could use to detect this trick.
4 S, C8 y2 M* B; @: G! J6 ]+ \/ P$ v-The most classical one is:
- {6 l* n+ D! z7 R( Q BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
5 k# }: ~. O; T1 A *(esp->4+4)=='NTIC'
8 P( b5 @: I) T- F7 H
) r- z1 g+ l( _+ j% b" v5 T-The most exotic ones (could be very slooooow :-(
5 P& d7 J& v4 z1 u, A BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
: r9 v2 |2 g9 k, y ;will break 3 times :-(/ \6 g& a4 h% d% R l% w d* Q ^. O/ N
% o; d8 D/ _: J1 G
-or (a bit) faster:
0 `- r, n. S$ I# z, I1 x# I BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
& x6 w! U& w- }. B4 c# k/ r, r8 h. f. Q, U/ y
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
% u! i+ N( Q# M; f7 n. f* Z ;will break 3 times :-(
; j8 I" ~3 u4 h1 P' V
5 W# c# U( _2 u; O* N, N-Much faster:
7 ]1 @2 K0 |; b2 r( b( J BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
' b, N+ w |3 b6 r1 F8 \* g' f
! l7 @6 A+ |/ s8 }& ?Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
9 a; u6 s- ]) t: Afunction to do the same job:
- F; g7 t4 ]: W7 K8 ]9 r# W
( I# T, M! U) `& g6 Y. G- G' O5 H push 00 ; OF_READ
, X1 Y) V# T& {5 u: b mov eax,[00656634] ; '\\.\SICE',0
' G! x; J. l; H$ O push eax
+ N% q, r. O% R# ]3 w: t call KERNEL32!_lopen% s* B* Z1 s' P0 K$ t9 v
inc eax3 I" U' N1 C! e; K' \2 F
jnz 00650589 ; detected3 k, q! m# e% j/ {- |. k
push 00 ; OF_READ B8 O+ H3 `4 v% d6 S9 t9 [3 f- Y" Y
mov eax,[00656638] ; '\\.\SICE'2 A- n: Y* u* ?, p& {% }
push eax
5 R+ L% j4 Y2 d t0 ` call KERNEL32!_lopen
I# V5 R8 `2 `! N inc eax y; P! r- ?7 Z9 h. ^- y
jz 006505ae ; not detected
# c! ]$ I7 W0 l4 ?% n- p R6 d; p
) d( W( G+ l7 n: t; F" [3 {; F' o i/ q9 @. O
__________________________________________________________________________2 R3 E' O! L& c. s
8 Z2 V1 y9 L4 S, ZMethod 12" g" J6 N5 Z% w/ i1 Q5 Q6 l
=========
, b0 Q- G8 Z" n9 V, t- Z5 F1 D) V( i5 h; o# |/ c
This trick is similar to int41h/4fh Debugger installation check (code 05
, d0 p9 S9 T8 `$ u# a f" ~& 06) but very limited because it's only available for Win95/98 (not NT)
9 J& r! q9 s# n0 K4 G4 t2 uas it uses the VxDCall backdoor. This detection was found in Bleem Demo.
; B7 e, u. E' Z& }* p m8 b4 U0 c& E: w( R
push 0000004fh ; function 4fh
3 t2 V# K- h8 [: e# ?/ E2 N push 002a002ah ; high word specifies which VxD (VWIN32)
5 [$ ?4 J2 a4 K, W4 Q* l2 h" J% A: m+ a ; low word specifies which service
% y& f" ~% U# r) M: Y- I! h7 N, s (VWIN32_Int41Dispatch)
8 u# h. [* ]' U$ N5 e. H call Kernel32!ORD_001 ; VxdCall
, F- E3 W e* ]7 n( v0 {( F cmp ax, 0f386h ; magic number returned by system debuggers
L7 ]# X; k' H+ l jz SoftICE_detected
" a! _: c" I$ U% H7 [$ z7 [# F% Q8 d$ G$ @% ^: _! @& ^) s3 Z" p
Here again, several ways to detect it:
! u4 _! U4 N/ n1 n( ~/ a
2 \4 s) O" h# x% k BPINT 41 if ax==4f
+ h3 J( o) ^- D* C9 L
& `* p: D/ J/ [% S% |' y BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
/ @0 T& m" ^$ s1 c/ C5 G) }+ v O$ ]" V
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A0 H2 g, m& T: Y5 k6 P r
$ f* @0 u# D3 ?, q) e
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
; L! y) T1 n4 M' F& w# b3 R2 f+ m1 }
__________________________________________________________________________
2 p; k* R! n2 V2 g }1 F3 f, P$ l n) |; E9 D" j
Method 13. Z7 W; _3 v; _0 W! i
=========/ g: c [+ Y& `( D: x) l. L) K! p+ `
$ e1 V6 m/ d( D( ~8 y$ d) MNot a real method of detection, but a good way to know if SoftICE is
" o- d& Z& q+ `1 Iinstalled on a computer and to locate its installation directory.
0 P, O* L* K7 U6 G8 BIt is used by few softs which access the following registry keys (usually #2) :# D& P& m, i& v) _! V! M! s% a& i: C
0 D$ D- O* v+ {, s7 O, J$ q-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
) e7 b# t; v# a( M$ J\Uninstall\SoftICE% f+ `9 h6 d& h2 I o
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
4 S- T! _) v' Y" t-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion9 H5 `5 M# z9 M% A' A
\App Paths\Loader32.Exe s$ j! T1 R6 l8 P" r
0 \0 S9 K. O$ d) c( G( R" G% ^0 u
' |) |* M E" Q/ yNote that some nasty apps could then erase all files from SoftICE directory
6 K% e7 I( c+ U' Z1 u$ S(I faced that once :-(4 x9 s1 C! ^- l
" E0 s- x3 |1 D0 [- CUseful breakpoint to detect it:7 `, k3 }, m2 H" L! J
' l7 \/ k5 m& Y; @ BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
+ O/ e& x) r. b$ T: S' U
& O7 A) d4 x! B( n" U; Q3 E__________________________________________________________________________
6 y- ]* H3 Y G) l( a
# {# M$ t- Z0 J0 u* x1 O6 k- t5 |3 \ C, x
Method 14
& C! M, j: G0 C9 H6 k8 G& ^# a=========
8 R% v. x! g! ^3 p" D
3 c3 u6 f2 e3 P. R) xA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
$ A3 l, b* F9 a5 M% e2 g2 f) ^is to determines whether a debugger is running on your system (ring0 only).
5 F ?8 L0 \4 o9 t. h" h1 f: T0 m2 ~6 L5 |
VMMCall Test_Debug_Installed8 `, [; H: |0 F$ ]2 f& v
je not_installed- O; ^( _8 [1 s4 I4 { @
( e8 L# T& C0 ?) C; W* T; ]This service just checks a flag.+ d8 k+ Q' V- B4 q# D
</PRE></TD></TR></TBODY></TABLE> |