<TABLE width=500>8 h7 }, t5 j9 d( P* \
<TBODY>4 P8 J6 x8 s, w/ m9 z, {
<TR>
8 a$ @8 L% z' F6 J2 T; w/ H. w<TD><PRE>Method 01 8 Y9 r* ]$ b, V: s
=========
; d6 K3 R: h( v7 T% _' l
4 T* `0 U! c* }$ W& `- mThis method of detection of SoftICE (as well as the following one) is
' W* R% Z8 U. j2 O) eused by the majority of packers/encryptors found on Internet.' q! D5 K5 ~0 N3 ]' D6 T+ X( n
It seeks the signature of BoundsChecker in SoftICE5 w; R, l. K7 M
) \- |: m% a& D mov ebp, 04243484Bh ; 'BCHK'
0 M1 p( X; j b" M) a mov ax, 04h& Z" S) @) [+ Z( Y" Q$ Z; w
int 3
0 y% g5 ]. X, w! R cmp al,4
i6 R: p! O9 R$ v5 S; m; _3 X, d4 f jnz SoftICE_Detected
0 P! X/ g% U' p" W7 g
/ q' j. e r i0 R, L& Y___________________________________________________________________________9 `# e7 `' @* u
8 X2 \1 o$ A }, Z$ v* t
Method 02
) E" ?3 p, {/ `# E4 [: x# \=========8 I& C. U' o, u: d2 E+ |) @
5 Q+ R6 t! y- l* ?9 P' B% ~+ a( `
Still a method very much used (perhaps the most frequent one). It is used
' @+ t J. |3 ~to get SoftICE 'Back Door commands' which gives infos on Breakpoints,4 |1 h; K( h' W
or execute SoftICE commands...
/ S4 K* y) C# y. @ l4 q3 s: OIt is also used to crash SoftICE and to force it to execute any commands$ f$ |0 x1 |1 D- T2 u0 i1 [4 n
(HBOOT...) :-(( : e! c) R0 c n/ h! H1 p) {
6 b/ y7 p( a6 s
Here is a quick description:6 v( H9 H4 V" g- w
-AX = 0910h (Display string in SIce windows)
7 {0 t" ?7 r2 r3 K6 Y-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
$ c* f* N- R6 w+ T) C$ A-AX = 0912h (Get breakpoint infos)
( A$ T# O) r0 I- s/ o/ S-AX = 0913h (Set Sice breakpoints)6 Y& x/ E: q* h- |, l# t8 l8 Z! @
-AX = 0914h (Remove SIce breakoints)
|. w r) c- A0 e- V/ B0 S
- }) U) z+ t @& t: V5 T# @Each time you'll meet this trick, you'll see:
$ ]. ]5 H7 r* G, N4 @. u3 e-SI = 4647h
$ A8 z' S7 ]* s4 r h-DI = 4A4Dh
6 ?8 V5 ?% o$ c* aWhich are the 'magic values' used by SoftIce.
8 L1 w1 R" c+ ]7 jFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
1 z* J* f( Q! h- |4 j! E' O; t8 m* u, E) p& f) J7 p- b
Here is one example from the file "Haspinst.exe" which is the dongle HASP
& ^# K9 Z' C, e7 d. S0 s( VEnvelope utility use to protect DOS applications:: T& k- w% j, r% O: a# n
( R3 `* s, B+ v- H/ v3 l
- p, \9 P" L% I) {, o; A7 A4C19:0095 MOV AX,0911 ; execute command.; M4 K4 t$ o/ d! w
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).5 i1 v4 B/ k4 p3 M1 P* M, S
4C19:009A MOV SI,4647 ; 1st magic value.8 ~# H/ N) a% L, ^ r/ u0 d
4C19:009D MOV DI,4A4D ; 2nd magic value.
; a4 J3 O3 ^. v) d! I/ X/ A4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
; S! V0 Z" ?9 I p) b4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
; Z% m6 w; t1 u' [$ O% P7 V7 W& f4C19:00A4 INC CX
- _. \* T; R! p6 W$ j4C19:00A5 CMP CX,06 ; Repeat 6 times to execute9 T4 q$ H% \3 y
4C19:00A8 JB 0095 ; 6 different commands.
. M* l: _) [6 Y, V+ H. L4C19:00AA JMP 0002 ; Bad_Guy jmp back.
9 L: F/ Y1 r/ F# O+ Z4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
7 p# M" ]% ~* U0 h, q) `/ y- h2 ?
5 D5 k7 F4 k; b2 D1 JThe program will execute 6 different SIce commands located at ds:dx, which+ J0 z5 O& M0 s( f) e0 D
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
2 Z" \# M4 E" n2 ^( J7 z0 N* v
$ p: w9 a2 K7 O1 U0 H# \* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
% S0 n( ?2 D1 c! e0 e4 \___________________________________________________________________________( F; ]- Z. t" ~5 U
( R5 j! ], v3 f/ q: \
h) M- E2 J, o; d& fMethod 03
& I& e+ v' ` L# @6 T=========
! ?& T/ }% M( i2 ~8 H. T7 c1 y4 R" h: b' @# x$ O/ D* m0 Q8 A P" Y8 @
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
m# X2 A( b @/ C4 u$ H(API Get entry point)
" t- K; w3 t# p. Q0 [
& j( H' \% A% x, k, a: N
3 @# Z& X) A" S4 a xor di,di
% |+ M" Q+ w! {! S0 [* m, n( I mov es,di, l4 e: l+ d+ G
mov ax, 1684h 0 Z4 X4 u u& X3 H
mov bx, 0202h ; VxD ID of winice' m9 y8 s$ N/ ^7 B1 D
int 2Fh
& u( ?& M; H$ f+ \7 u# E mov ax, es ; ES:DI -> VxD API entry point
$ K. e: f) s9 V! t) Y) g, w add ax, di2 r7 b8 h3 n8 ~! U
test ax,ax: E7 w/ w: i. {# L. O6 _5 n+ M
jnz SoftICE_Detected0 p; g4 y$ q$ T. Q
: o/ A* B' P/ v$ K___________________________________________________________________________0 w+ [* ?: M y& f* X: {
2 k/ A0 L, M# E( M
Method 04
4 o* n& m( ^. U. w: {=========+ ^1 e3 Q3 O s* T5 V+ X& c
8 s& U* `- ]' ~0 u. k2 q+ R/ ZMethod identical to the preceding one except that it seeks the ID of SoftICE5 K! g" {( U* p5 k% f$ w t: O
GFX VxD.. b/ z4 o# ^& x @- x& z. }4 g4 t
% O0 e% y$ a& [+ ]8 y/ H& G
xor di,di
' V/ c: Y; C8 ?# g mov es,di( r, _6 m$ m* [. ~: Y
mov ax, 1684h
9 o) D- `3 y0 ]3 O m8 H+ r mov bx, 7a5Fh ; VxD ID of SIWVID
+ l1 \7 N% C* G/ G int 2fh m( ~7 ]' _% v
mov ax, es ; ES:DI -> VxD API entry point2 a* M5 ?5 H; P9 a$ ?- T/ W/ h
add ax, di/ ]2 r% _* I; |4 ~
test ax,ax
8 Z- w) K, L$ O$ ]' \$ k0 v jnz SoftICE_Detected$ @. U( o" B A
. \2 u G0 M; [- j# E4 O/ }7 Y3 t ^
__________________________________________________________________________
; s( f7 ?- X; Y* l/ y, G+ j- A( l$ e" E& ?( H* M
8 @# S9 W" B! I5 k0 G, gMethod 05
2 P% p6 M3 p6 R! A2 a& A1 x=========% {& U2 o: u# |7 a( }* C% ~
& U/ Z) B0 @7 T; a& Q% P4 _
Method seeking the 'magic number' 0F386h returned (in ax) by all system; A& i: e' u2 L b% b5 I
debugger. It calls the int 41h, function 4Fh.) p1 A* o; i# z r
There are several alternatives. # f* k6 `/ S) s% e! e
) h) g# O* B. F g0 d
The following one is the simplest:
, M: F( @) s3 O/ j6 w' H
. H9 V; C2 h0 a* e9 ` mov ax,4fh
/ p! U) C9 V5 R# J2 N' S6 o& Z! {. ^ int 41h+ B7 d* V2 d' f# F$ i& W
cmp ax, 0F386
& L/ h, n X& m& B jz SoftICE_detected
) ?9 B# ^+ ^$ X
O4 Q) b( f# W0 }8 [, }
# f9 Q( Z& t) |- bNext method as well as the following one are 2 examples from Stone's
& k7 p/ Q% ?( ]6 Y3 C"stn-wid.zip" (www.cracking.net):
2 A/ |# U1 B% L' h4 o
* @# M9 ]8 h1 K5 ^ mov bx, cs; ?- f3 w1 _/ b' N
lea dx, int41handler2* n( N# w$ F' _, r0 w7 M, b
xchg dx, es:[41h*4]
8 ?9 p9 M: _% F4 o. S! j xchg bx, es:[41h*4+2]
; B* A0 F3 I$ K8 e mov ax,4fh) O/ c! e' ?/ Q8 U9 d0 d/ m3 t
int 41h% r' T6 S9 o9 `1 t
xchg dx, es:[41h*4]0 T2 H) z5 k. U& [" q" E B ]
xchg bx, es:[41h*4+2]- K% E: D( `6 W
cmp ax, 0f386h# X+ r0 W$ y( W5 N: _" k/ c
jz SoftICE_detected+ w% E" t* _9 Z' ^3 i
5 \- D6 q) S" J7 o; ~! D0 r
int41handler2 PROC
$ Y. U5 U! T) H! B3 c4 | iret
& U- A+ z8 I: a+ Eint41handler2 ENDP
" T* Y9 v( T' A3 Z# X& @
, T5 ^0 E7 O0 M6 V. z4 Y" t+ L( X* `' r
_________________________________________________________________________+ A: y: T9 q* A$ m/ n. t9 i
8 Q, F9 v! {7 B; D% {
. {) T. F2 `; P( `! [7 iMethod 06
! T: t* E% w: |8 i=========
' W' |; s& T; m7 B4 j A- n
) X6 f D! b; h$ ^2 X
9 V1 w( R$ @6 W* T5 \2nd method similar to the preceding one but more difficult to detect:
5 S6 `2 m% D, ?* y/ P$ d
. D9 w2 G3 M& H0 |5 ~8 k# w- D& y1 h) \
int41handler PROC6 f5 |' T4 e2 y* i' ?
mov cl,al) q' H0 `; @" i$ N0 g
iret
' c# M x& w- W. rint41handler ENDP a$ A3 } h5 R x C* v, U+ C4 ?* k
8 p+ S+ G6 u/ G" f9 P$ ]3 c- k9 y: V# C a
xor ax,ax3 r! v- M. H/ N& m
mov es,ax
; _3 }8 d/ t, B mov bx, cs
# s/ j: T) g% r, }$ C lea dx, int41handler
$ O! `8 X) N3 T8 G: n xchg dx, es:[41h*4]
' z4 M. T, z& G$ _ xchg bx, es:[41h*4+2]
& U# Z2 d# Y D% K! V* [9 g in al, 40h
. B$ a8 d" `5 z; k5 K xor cx,cx0 K( x" Q# i7 M
int 41h
; a: [8 G! p4 ] xchg dx, es:[41h*4]
/ L8 C" y |3 d% s/ U! a7 `( l xchg bx, es:[41h*4+2]2 Q- ]1 Y: I5 e( w/ T4 N2 l
cmp cl,al* ? e2 M1 I7 e @' G8 Y
jnz SoftICE_detected
+ G# U& h4 v0 y- W2 @) \, V, o1 u8 J7 y* s
_________________________________________________________________________
3 [: U6 C* A7 i+ X O& x5 w7 S ]2 a, h
Method 07
& B, o" r$ g- J6 [$ a _+ d=========
) ^# K6 ]0 Q2 {0 w$ B6 e& h
1 U6 P `% @! Q6 d5 E* l0 P! |Method of detection of the WinICE handler in the int68h (V86)! d, K( b: x6 s0 d. j
) B5 O, u- J( h! r+ I( E1 ]) k5 m. \
mov ah,43h9 Y& { D& v) ]
int 68h
4 Q( t$ f- t, `/ h& Z ^# y2 e cmp ax,0F386h; y$ y! ]5 G4 z0 {
jz SoftICE_Detected4 s: W( @, h$ E% g4 B0 r/ _- ~0 Q
+ o( Q" ?9 Y1 R1 S( N3 X7 _6 P9 v' i% f& \% C7 L
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit$ v. m9 X! @2 y
app like this:0 }2 j' ^# v6 k1 Y( A5 R
2 W. j+ O( `2 ?4 _
BPX exec_int if ax==68& A: C3 z2 E5 V
(function called is located at byte ptr [ebp+1Dh] and client eip is2 ~1 p: r2 a: u3 g7 s
located at [ebp+48h] for 32Bit apps)
8 W% `* W1 p9 p# c) d__________________________________________________________________________: r7 ^' F% d4 m+ A2 }% w' v6 u' m
, r0 f" k7 k& f. W
" F6 P1 H! j4 r, q/ k1 l) VMethod 08
/ T! j7 G( F. Z" v( H" W=========
% E9 N3 u/ [" P: @ I! W s
' @/ }# K' P& d- rIt is not a method of detection of SoftICE but a possibility to crash the: x% ?" _& X: b1 o* p: c" z
system by intercepting int 01h and int 03h and redirecting them to another
0 i0 l4 a( Q' E( Yroutine./ h$ I4 n! D' G
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points3 {' X! h& Y Q, V+ y
to the new routine to execute (hangs computer...)5 j% Z0 J$ b5 a4 [6 O$ S, q
/ ^7 K1 s& b/ h: K$ j
mov ah, 25h3 k: L3 o1 S9 O. \
mov al, Int_Number (01h or 03h)5 C& ^9 S! c, {( k( L O7 [8 V
mov dx, offset New_Int_Routine
6 z4 r4 w. s) B( @8 w9 v int 21h5 X0 `. s) P2 D ~
; ^6 l! [0 V$ I* ]/ ~__________________________________________________________________________1 B8 D3 v$ n- }* b
8 W+ @, D% h. P |' b6 O
Method 09
" d+ u/ n, p! P& _" W; U t' ]=========
( _% j$ T% V+ j. m% Y* i
. M5 Q0 E1 [: I: d2 OThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only$ \; T. G8 ?7 \# C4 P3 e
performed in ring0 (VxD or a ring3 app using the VxdCall).
% Q1 n5 l3 J! K( g. EThe Get_DDB service is used to determine whether or not a VxD is installed
2 [( @+ g, x4 A, q: w2 e ]for the specified device and returns a Device Description Block (in ecx) for7 ^8 C% T5 S& ^' z" w
that device if it is installed.; c4 z* _$ C6 x7 N6 y# |
: G& ^$ y5 n, X; A
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
% A& E' o" e& M) U7 d, f mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
* u/ U6 ?1 V7 L3 M Z) L VMMCall Get_DDB+ j/ @2 Y) ~% R# V
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed2 \3 W: P. o; y8 ^, n6 I* b! g3 F {
! Z$ m7 \7 T4 U2 w( vNote as well that you can easily detect this method with SoftICE:
: C; Y8 v2 J) i! K/ g" W, y bpx Get_DDB if ax==0202 || ax==7a5fh
5 K. `4 q2 d: A( m" W/ |, D- p$ k6 Y4 B, _4 m: K% E$ K
__________________________________________________________________________
# _5 D W' E8 f$ B( m' w3 w" B/ B6 m
Method 10
9 p6 \4 B' p4 o4 K========= r) N; Y; |9 O/ n9 @' ~
. O3 j% T' x" r. L* ^; F9 |
=>Disable or clear breakpoints before using this feature. DO NOT trace with' o) W4 j2 A& o; T- ^
SoftICE while the option is enable!!( D6 ^' h/ E8 t2 O; C2 f
* ?) T" A! z' ^8 a1 |# }8 m
This trick is very efficient:
. r! y2 a. v0 Y8 K5 t1 @3 s* X/ Pby checking the Debug Registers, you can detect if SoftICE is loaded. b% H7 s" G% _8 B* P$ k, s& R+ \
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
5 m0 A* q+ O- `- y/ J6 l: Wthere are some memory breakpoints set (dr0 to dr3) simply by reading their
- Q, v: K! i$ S) @) b" }, ^value (in ring0 only). Values can be manipulated and or changed as well( v1 ?/ I+ ? H d' ~8 t* `
(clearing BPMs for instance) S, R3 u/ i5 V& f
+ b% C9 [0 C0 R# r) \1 Y__________________________________________________________________________3 X1 T; _ @' w3 I( X4 O% {- P7 c: ]
8 v5 B( z4 G- t& V6 O* qMethod 11
s8 G4 @" B2 J6 U5 m=========- x- d& [ n& ~; M. ]1 W& A# \
2 r+ W/ h F+ g/ S( p) mThis method is most known as 'MeltICE' because it has been freely distributed% N% n/ K, ?" K- J7 x/ W/ j* i7 m+ {
via www.winfiles.com. However it was first used by NuMega people to allow0 E, E2 W2 E) P, O( u
Symbol Loader to check if SoftICE was active or not (the code is located
. c: W& B7 |9 I. y' E( @inside nmtrans.dll).) ?8 ]# S% E0 b5 H- ]* \! d2 Y" j
) t5 F) J! J% A+ {( ZThe way it works is very simple:
7 x! P8 K% P4 W# `It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for7 _0 {( e" [/ e2 m& v. o. v
WinNT) with the CreateFileA API.' |7 W! c% F% F) z8 E9 ?7 A
7 O8 o) q" y% o: r: \, `+ L8 n% x
Here is a sample (checking for 'SICE'):# O' t5 ]" g5 x7 O& T
8 u2 @/ s! b" g
BOOL IsSoftIce95Loaded()
1 ^$ n' f. V( W7 z& `{% O- ]& ], U% \5 T8 ?
HANDLE hFile;
( G1 @1 ^# e+ Z% L( O# j+ c" K hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,4 P2 ]0 [7 D8 T( J) x& p" }% o
FILE_SHARE_READ | FILE_SHARE_WRITE,6 v" O4 G% H. m
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
9 T6 \! T- L3 A3 R- l" D- {. n! p if( hFile != INVALID_HANDLE_VALUE )- }) w) d& ~$ u# C
{
$ z+ t1 c3 n6 Z; c CloseHandle(hFile);
1 R; {( r# g J8 q return TRUE;
O0 D" p+ B e }
% Q5 W1 Z4 L! P; r1 f# y return FALSE;1 |. x: Y K* ]( N3 o* q6 E0 M
}
) @8 t9 E9 j7 x! j9 {& W6 {. M. O% \' X* m4 S* Z
Although this trick calls the CreateFileA function, don't even expect to be
8 J8 V# j3 s5 R& wable to intercept it by installing a IFS hook: it will not work, no way!1 _( `% J% V- Y
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
5 m6 z }3 f8 p2 |3 D7 i2 o+ ^2 \service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)6 h* ] ?' m8 @1 v
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
/ I- `2 x9 J/ J# ]) X1 W/ B/ Wfield.) W4 G1 p x ?
In fact, its purpose is not to load/unload VxDs but only to send a
! ^, O" a) d1 n. ?7 {W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
5 _& L7 r6 d( t4 }to the VxD Control_Dispatch proc (how the hell a shareware soft could try
1 p" Y5 C5 F! P/ N3 b8 k! ?to load/unload a non-dynamically loadable driver such as SoftICE ;-).
9 u4 Z( b1 x+ i! U: g! oIf the VxD is loaded, it will always clear eax and the Carry flag to allow/ d9 Y, ?' I- N
its handle to be opened and then, will be detected.) T! |$ i' T) K5 v2 I( O
You can check that simply by hooking Winice.exe control proc entry point) L$ M, Q2 Y2 I+ y/ i& l
while running MeltICE.
' k7 P. t d1 O; {4 a+ d6 c2 \$ A! s; W4 ^7 Q
5 D9 n9 [- X* e( H; e. @4 N v 00401067: push 00402025 ; \\.\SICE
* @6 b# Z$ _- A. |9 ^ 0040106C: call CreateFileA/ _9 [ f( Y: X; k% o2 U
00401071: cmp eax,-001 O m. _5 l/ b+ f7 l: M% n
00401074: je 00401091
6 h/ l' @. ?; R! {$ u1 i/ T7 A8 {/ T- d H) V, U
+ p) t1 v. U' l6 R! Q2 [! ]There could be hundreds of BPX you could use to detect this trick.
/ w1 ^4 ?* C( q7 e, `3 X6 Q-The most classical one is:: b* K/ u$ E4 l, d1 p
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
( v, [% b9 b' [$ G- C *(esp->4+4)=='NTIC'& _, V1 I. {& K) p
g' Z' h0 _( v1 k8 f8 o: n! V-The most exotic ones (could be very slooooow :-(
0 y4 X9 H5 _( f% o$ K: ?+ N BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
: q1 s6 n, X# K# t) r" w& }2 Q- U( W$ Q ;will break 3 times :-(# y' p' b, f! y- e2 M C
- |. j- c e: X f-or (a bit) faster: ) F$ n+ H t3 t, @
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')7 D8 [/ L/ t, R( \& w4 }
, H1 R& _# \. R3 V
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' ' O1 C b6 r) T: K
;will break 3 times :-(. y7 b$ ~ o( b/ |" b
0 f; m4 o' F' G, C- s-Much faster:
/ d+ w4 I9 t* M- M) S' Z BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'# E1 |, _2 e- E. V
G) \; ?7 ~4 l! t
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen, ? `. p: V8 S
function to do the same job:
' \9 ]: Y' s( z% x; Y d& L+ t7 v, \0 h( h: {) e
push 00 ; OF_READ
$ ?8 w3 V$ C$ }! P7 m% _# O mov eax,[00656634] ; '\\.\SICE',0
/ b9 d! x" t! L1 C* [ push eax
$ D) p+ k/ ^, c) ^' C9 z call KERNEL32!_lopen
, K& h. E |* |: P inc eax
h6 \4 E- E* Y: P3 [6 ] e jnz 00650589 ; detected$ H; G- T" g6 G2 K+ I
push 00 ; OF_READ
; ~$ e' s6 O# ?/ ? mov eax,[00656638] ; '\\.\SICE'
3 y4 q) x9 `" L$ ^+ L. s9 D push eax1 F1 L' T, c4 a& H" y* j6 u
call KERNEL32!_lopen
) ?. a, B- k) e6 z ^5 [# ^ inc eax
1 `- X1 ~2 [" O/ }" {: K jz 006505ae ; not detected4 |1 d5 J; B% M w& m1 e. ]" n
! c' I" b8 p5 u
3 a0 m- ]# N" u& o) c3 f__________________________________________________________________________, Z4 [( f: g5 l# _5 z, S7 w
) M' i+ k1 v. C2 w+ q+ D% d1 |
Method 12% G4 W4 J2 ^% {( P! M6 C: }3 I6 A
=========
" O* ?* @: B) B9 R/ C2 K$ O( x: V: R# W# d* h" P
This trick is similar to int41h/4fh Debugger installation check (code 05
- `& X8 |' C! Q" A& 06) but very limited because it's only available for Win95/98 (not NT)/ H/ {9 j( \- _8 G0 o% j: z
as it uses the VxDCall backdoor. This detection was found in Bleem Demo." i; J2 ~; j9 b* g
0 I1 \7 Z) m' |5 B$ L$ u9 @9 d push 0000004fh ; function 4fh
/ G/ A3 D- c1 m0 K. X push 002a002ah ; high word specifies which VxD (VWIN32), A* m x% u) Q: t
; low word specifies which service
' s' b8 w/ M' B4 p, n- q (VWIN32_Int41Dispatch)
7 G! O. i9 \; N# F call Kernel32!ORD_001 ; VxdCall# M6 p- Q- G2 J& E' Y; e+ v% g. C5 W
cmp ax, 0f386h ; magic number returned by system debuggers
$ r4 m' b& j% h1 e jz SoftICE_detected
# J3 }% \% O. U$ }* n
( W) m0 ?3 _* q; M' v9 t0 EHere again, several ways to detect it:
! ~! H" |; r; z' Z, R3 U; x ]8 X5 \& T1 x# U- v3 ?
BPINT 41 if ax==4f
$ H- l2 V: c2 h$ X
" I8 x5 v8 d8 P2 _" T" b3 M% A BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one O0 z5 U4 \' d7 M% W+ V5 g
, y1 {7 Z, Z* f! X BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A) R( a1 f' P, V1 G$ P
9 M: f R3 U( r- t2 o" o! x8 }1 }! z
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
$ b' a8 v0 @: Q* D/ |/ r" H" W! h* p2 {0 u
__________________________________________________________________________
3 I. y' w5 J8 L4 L0 ]; E8 E) z) n1 F$ }3 I
Method 13
, E5 X4 c$ m( ]4 |% q2 q. e=========
+ |) ~2 E; ~3 D- e2 J+ z! v* e$ _- v7 D, s. I4 {
Not a real method of detection, but a good way to know if SoftICE is
, W4 o+ A! ^6 T+ a' n9 Q! `installed on a computer and to locate its installation directory.
' x4 T0 Y# _; X! V5 Y$ K JIt is used by few softs which access the following registry keys (usually #2) :, T% Y @3 K2 B0 O' K6 d6 ?
" S+ L& E) x6 @& t+ Q-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion' ^5 m# E$ X- _
\Uninstall\SoftICE
0 p1 q \9 `4 V4 G* u8 K1 D-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE7 V3 ]/ G/ o* w; p: s4 X X
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
3 B1 n* i. y7 ?2 v8 d\App Paths\Loader32.Exe2 K2 @( s5 k' j$ F; e `
8 c6 N- L5 X. B3 B; f
8 ~! @& M% K, {, }! ^" p: F, ?1 FNote that some nasty apps could then erase all files from SoftICE directory
; ^* m' E8 b- x6 E4 Y(I faced that once :-(
( A, K, Q) Y1 u: H K9 o4 d+ Y$ Y& E9 |- J
Useful breakpoint to detect it:
' S" m. W/ R& q* q G& P
& D' U# _8 e r: O) T7 W: A BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
8 n" Q' }% t; Z9 A7 [ O7 Q1 g1 D5 n9 q/ L* w' Q2 {* e
__________________________________________________________________________
3 c# p, s! u: x, p' V- M5 s" e$ c; i% o. b
3 }9 q5 ?/ T5 P1 ~Method 14 0 {3 L$ z! N/ e' v2 v
=========
$ g* w) d- r* d: B
( ~7 W3 t( B% f' ], d1 X$ \A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
# d( F6 }' [! d) wis to determines whether a debugger is running on your system (ring0 only).4 J" s4 ~; r5 G6 r" E! s$ k
, v7 v8 C, U2 H T( Z1 @) s
VMMCall Test_Debug_Installed
) ?; P; G! l! S: R2 L8 u je not_installed" y2 Y" B- ?+ L$ o
! f$ B- ]+ n9 S- [4 n1 c& LThis service just checks a flag.6 [+ A0 o3 q: b3 a0 n5 c! W
</PRE></TD></TR></TBODY></TABLE> |