<TABLE width=500>
8 a/ J. s5 x: u+ d' ]9 I<TBODY>( F7 ~$ @, ^8 o. z$ R
<TR>0 h _2 b: G. s! t, Y# y' Q. u2 I
<TD><PRE>Method 01
2 P* T- k0 F: z/ ?========= I6 k2 B: }1 l2 Q+ V
$ I( x9 P: C! [# `) g: T
This method of detection of SoftICE (as well as the following one) is
& T3 ?# Q( z! B- k8 ]+ F; `used by the majority of packers/encryptors found on Internet.0 w( S' v) \. o b; ^; z
It seeks the signature of BoundsChecker in SoftICE8 ^( S0 B' B9 Z% c5 u5 L' i
) k1 n. A% {5 s. L; b1 ?
mov ebp, 04243484Bh ; 'BCHK'8 m5 {: n! p, g3 E# J( i5 X& R; y& D
mov ax, 04h9 T, p u# Y3 S2 n' _
int 3 % T7 H4 o/ k. r( C' m+ _
cmp al,4- u, n& p( u& R/ _. {
jnz SoftICE_Detected& ?6 D) F/ e9 c# P( J9 R9 L
9 g* r& E! z8 f& t; e2 N) i. a___________________________________________________________________________
& s1 w: a; W$ B; l2 j8 W. N& Q0 T/ d. H4 H! X3 X6 a$ H/ D
Method 02" t) ~: n& l4 v, N( x( \
=========
1 {) Y* E* f1 E! q* h
# q2 `7 Q7 D" j1 W" BStill a method very much used (perhaps the most frequent one). It is used
0 S7 y. u+ t( ?' H4 U0 L Oto get SoftICE 'Back Door commands' which gives infos on Breakpoints,: c, f+ \% b; f( T7 `( k
or execute SoftICE commands..." s, \$ K1 d& N; m
It is also used to crash SoftICE and to force it to execute any commands
5 W3 [+ |; x) T(HBOOT...) :-((
, u& S- ~& l5 q& o
( B0 e P) W$ e' Y- F9 p' a3 ^1 OHere is a quick description:
J1 N$ N% I9 A& C: O, k0 M" g-AX = 0910h (Display string in SIce windows)5 X i) N/ e! c- u
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)6 q- ~1 n# h7 S
-AX = 0912h (Get breakpoint infos)1 q5 j0 s* e3 A% t" ~
-AX = 0913h (Set Sice breakpoints)
1 i. a+ B4 T+ v/ ?% J/ u: M& z-AX = 0914h (Remove SIce breakoints)
$ e" D0 _. B9 |5 z# R! ?- g( [; V! M5 D( G6 [
Each time you'll meet this trick, you'll see:1 |4 \5 ?- u2 [/ U9 {; l
-SI = 4647h
+ n7 l6 m$ d/ b q5 k' T6 I-DI = 4A4Dh3 Y1 A( w% d- N% l2 r, ~
Which are the 'magic values' used by SoftIce. w+ k9 `/ w x. c7 f9 n
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.1 H2 f# n7 y9 n
9 ~ k. a* X- }* }: k6 _Here is one example from the file "Haspinst.exe" which is the dongle HASP
: s- z& a6 U6 G& eEnvelope utility use to protect DOS applications:
2 q8 n L4 c8 ~7 Q- [0 i
4 f2 M' P2 ~9 `0 P% ?9 A" c( e s I
4C19:0095 MOV AX,0911 ; execute command.
- S9 ]* @ ~4 K8 C/ z9 C6 t4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
3 Q, h3 `5 Q. u* a2 }! |4C19:009A MOV SI,4647 ; 1st magic value." Z) V( u: K& G* H5 @
4C19:009D MOV DI,4A4D ; 2nd magic value.2 Z8 m; f6 Q& c
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
9 l2 F) [) Y; A0 I. C4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute( k+ T7 ]& O- d( s
4C19:00A4 INC CX" d. H( R3 X0 o
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
9 J1 w: }' t- i. _! J& E F$ ^4C19:00A8 JB 0095 ; 6 different commands.
/ h2 {6 a6 X7 _4C19:00AA JMP 0002 ; Bad_Guy jmp back.4 ^/ ]- z6 o' n' I
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)- f6 i! H4 k' }% C0 V3 c- ^2 q- }6 P9 f
8 V$ C; L; p+ ]- ? ?+ I8 f
The program will execute 6 different SIce commands located at ds:dx, which
6 F6 T. ]5 p$ L2 nare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.! f5 a. [/ k1 P' ~
6 I. \4 F' \1 f C$ s% t* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
2 }4 x i5 g C7 d' A___________________________________________________________________________$ D2 W4 g- w! P; u$ i, }
9 H1 s( }% R4 r
2 F# a0 I0 d4 GMethod 03* c6 l7 k- a2 @& [% h: V
=========. `+ ^; N$ |, M' A5 A# @
- { G+ P$ l5 I. m' U' iLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
5 J- ^# A+ g2 n0 p- l8 a(API Get entry point)
* O2 B& b( w' N7 [* ~& a$ g
# C/ a! _. ], c3 C( M( f, }! C+ T! c- h+ b8 u" g3 U+ L# h
xor di,di
: Q! x6 P8 Y% l% N& } mov es,di
/ M7 y+ h s! M mov ax, 1684h
/ J1 e- g- }3 {( t2 w mov bx, 0202h ; VxD ID of winice+ W3 i$ U4 c" c5 K
int 2Fh
, g; b0 T: C. T& L5 S4 e9 @ mov ax, es ; ES:DI -> VxD API entry point0 m) {1 i! C8 L7 ~6 y5 ]
add ax, di
( [4 p3 u$ W- ~! s! L: ] test ax,ax* `/ g* k+ [5 e! r3 Z
jnz SoftICE_Detected
; \7 U; U3 n6 v2 t+ @6 _" D
( W2 i. E5 t( o! A9 {+ @+ x___________________________________________________________________________
( b5 q" o U* I, {4 i9 i e# w1 L- w) s: q4 Q9 | ^5 U
Method 04
2 o2 y0 v; O5 ?9 R( M2 P$ e/ ~$ f=========1 w+ p+ h' _$ _
. y4 ~5 g$ ^6 [# f. ^; @
Method identical to the preceding one except that it seeks the ID of SoftICE
8 |1 N2 A3 G' f, lGFX VxD.1 r9 c5 _1 g" J' ^
- o9 F/ m' \1 {: N ~ xor di,di
4 ^) ?1 ~! S, [7 W. r5 ~ mov es,di
* H& C& y0 {9 j! Z1 O4 l mov ax, 1684h
9 p% H! G. G D6 ~9 Q- y! I. H9 b mov bx, 7a5Fh ; VxD ID of SIWVID
% V5 ]* F! g6 a" X; T int 2fh
! t S( M l, t5 [% q5 }* S mov ax, es ; ES:DI -> VxD API entry point) G5 Q# f/ S) s. ]& y1 i; p0 \8 s( B
add ax, di* j9 g: u+ j9 _, F; N% G# Z* q
test ax,ax/ J! t% e* U, i ?# o
jnz SoftICE_Detected, ^: C0 [! u2 K, f I0 a1 e
/ J# @! X+ S$ K" Z b0 w( ^1 N' c__________________________________________________________________________
5 y! [- H5 x9 m5 o
* j' }( Y1 W3 |! G+ `) P- @
8 E; s/ Y: `: k' lMethod 05
& F. |2 @+ M2 A. ]=========4 R* [! h+ O6 R2 `+ S
5 q1 z+ ~6 p4 B6 L/ R: Q+ fMethod seeking the 'magic number' 0F386h returned (in ax) by all system' x* N# l# J. L1 Q' p. m1 D. B
debugger. It calls the int 41h, function 4Fh.
% u1 J+ Q: I8 e: [There are several alternatives.
$ b) h0 k. G- b. z( Z5 s! n
# T7 p G) B8 z+ k% x+ T% i7 qThe following one is the simplest:/ u7 j) }2 \+ w
: i8 U4 p: H1 q$ Q9 s5 g. a3 F mov ax,4fh
( ] j' X* y. X; @( t% O int 41h
. f* r$ k7 W. ]) o cmp ax, 0F386
! Z9 y- |* p: x0 L jz SoftICE_detected7 e. a) C% e+ U; W/ e0 d' L
( }1 _2 P0 p7 h% g7 E7 p$ r' a8 H; ]' b, F; E
Next method as well as the following one are 2 examples from Stone's - Y" o5 [, l& p
"stn-wid.zip" (www.cracking.net):
' e+ V( C8 a: z" J( V8 L$ ~; o- G2 G6 ~8 R0 J/ E
mov bx, cs' p) e1 H' L) l5 T* p+ F. d
lea dx, int41handler2
' f y8 {6 j9 N4 d8 @$ A: k xchg dx, es:[41h*4]' ], `0 H* K7 C. Z
xchg bx, es:[41h*4+2]9 X1 h8 L% @( {1 X% F! Q& i
mov ax,4fh6 a \/ R7 l! s4 r$ i8 U
int 41h
/ @- i8 w0 @- L6 X" ~ xchg dx, es:[41h*4]
' |" O. `+ z y! M5 F/ t9 b3 ^ xchg bx, es:[41h*4+2]
. w# I1 D# c9 Y E) I$ g cmp ax, 0f386h4 U6 u" C9 \8 D; ^* G, l9 b
jz SoftICE_detected
; q" [3 ]) h6 D1 C" C8 P0 C# v) C& S0 r4 W
int41handler2 PROC
, g+ s# }; @6 E: b% Y iret+ N* L0 x$ P1 _# J! G
int41handler2 ENDP3 P+ C+ n3 ?5 P# |
" C7 c% j' a, R6 i S. \
& e" L. m7 t! N4 ^
_________________________________________________________________________9 J4 V [, j" m' F x1 | h5 m
. _+ D/ n: G. b* _3 `, h& k, O; I7 _3 ?0 g/ E
Method 06
2 x7 C4 [9 M+ s8 x# ~=========) \/ `' y: T" ~: t
3 T( |1 P) [# D1 v! j* F( |
6 ^: B% L7 ?) c9 R7 i& b( }' I
2nd method similar to the preceding one but more difficult to detect:
3 d1 x& n3 s/ }. I. p/ E" ~2 d. b0 ]1 F1 P
9 ]6 _' i; k4 A" b% G2 ?
int41handler PROC
% g# ` L- Z% u- N mov cl,al$ W& X0 W% ?$ D ~1 b
iret
) H8 O1 m% p; B# |6 V: c) W* }int41handler ENDP2 l% T/ e# w- T4 ]0 [9 j# ?
8 V: L. O8 F8 ^- h
# X4 z7 d: t: a4 F7 ]0 k/ X9 a: r xor ax,ax
* W, x) E c2 F( L- k mov es,ax- ~9 F# Q: C' q! g1 T9 E
mov bx, cs- g6 }8 g; M( ^' g+ V% j3 M
lea dx, int41handler
) `9 ?/ q% ?/ `2 a' }' x xchg dx, es:[41h*4]
4 d5 ]" k( n" f xchg bx, es:[41h*4+2]
1 y/ X6 h: s% j! i; n% C in al, 40h
5 M% h4 t' O* I) Y xor cx,cx
4 m5 L5 b2 h$ T+ m8 ^# H9 W int 41h5 j6 n) r7 c& s/ k
xchg dx, es:[41h*4]
$ ~& z8 l. K$ `7 s4 l$ S xchg bx, es:[41h*4+2]
* ~! U9 a0 ~) |- S cmp cl,al
6 b; G/ Z) s! a, g jnz SoftICE_detected e) N9 X c0 o1 L
; m) E6 s8 m* e6 L6 |0 O
_________________________________________________________________________
+ w( V5 U' B/ }
# S0 m( ~4 g" c3 \( f+ L" j R" y% EMethod 07: t- ?2 {5 D6 A5 J% v
=========
, v1 r( q! {2 T2 N& M) @' h8 z; }) j6 }# f& D3 u
Method of detection of the WinICE handler in the int68h (V86)
8 T7 x: `$ Q" b M
6 {0 ~) ?- D; _7 I mov ah,43h# C0 K" d( ^9 t8 W
int 68h
2 q+ A" u0 S! u# l9 n( Y2 `4 _* x# \) t cmp ax,0F386h
7 q2 |) Q" r7 r: B, i! Q$ J# r jz SoftICE_Detected3 k% M' a( b3 O4 C) B8 L
5 x# v) H. e6 y5 o7 }! I$ o
0 r( E2 `* i0 Q d- f5 M8 ^/ X
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit4 ?4 i* m* M( Z2 Y7 W1 U
app like this:
* O( ]; j* `9 S$ s$ D6 _, V2 [5 _ A( L9 c# M6 p& c
BPX exec_int if ax==68
1 ^8 c2 ~0 f& O2 ? (function called is located at byte ptr [ebp+1Dh] and client eip is
2 ~( A6 P) v$ g, Q q1 N* X( C located at [ebp+48h] for 32Bit apps)
6 Y! ~3 c% [" Q; K. t( ___________________________________________________________________________
1 F2 e1 h4 ?* f) |9 o
/ j4 |) @$ {. I1 O# N' ^0 x- k' B: r1 h; e8 G [. Q$ L$ S
Method 08
/ w9 P* @8 R5 Y9 v9 H) m- ?2 b" L=========4 w# p; m5 b" W \, s& X
+ X2 T$ ~1 w& c1 f" MIt is not a method of detection of SoftICE but a possibility to crash the) E: d$ b' t0 l3 z% q3 d) I8 V7 u
system by intercepting int 01h and int 03h and redirecting them to another
' u, Z& J$ R/ b/ Troutine.
6 |0 |5 @* k. W* q& H8 m X/ @It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
: \! g$ b- h# uto the new routine to execute (hangs computer...)
! D; k9 [8 H* L# ~. _
4 x3 v& q0 W- q/ K( s mov ah, 25h
; U# p, I( M8 A mov al, Int_Number (01h or 03h)4 s9 }% P) w* w: A- t
mov dx, offset New_Int_Routine
: G8 t$ U4 q [0 w int 21h$ Y! y9 h/ b3 G9 }# C8 D: F
) T( ]2 B: n6 _1 n
__________________________________________________________________________
: k, ]& c0 M' ~% s3 N7 w' K
3 D" a: x2 U' e6 [Method 09
+ L& p' |; Q* r, N=========
/ h6 h6 C: x- a! Z H' b) y/ n, U5 @ R; L$ v: j E6 A# X/ p( Z
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
3 H0 x5 _; t' [% L! U$ Nperformed in ring0 (VxD or a ring3 app using the VxdCall).
_3 [8 x! l) ^& yThe Get_DDB service is used to determine whether or not a VxD is installed
& I q2 z0 k8 Z2 tfor the specified device and returns a Device Description Block (in ecx) for
! V9 S: v9 z/ x- _that device if it is installed.
. v4 a+ E2 G( j" S
) I4 d+ |: C. T8 A' B* Q mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID" Y- R7 g" b8 r3 c. u. r
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
v# ]/ @7 [4 n1 V& R& A* D VMMCall Get_DDB
- o2 V- T* Y$ o1 ?8 F- q& e mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed! g3 |; T6 g' b) {/ z
5 H6 b6 H; P" m) e5 E5 C
Note as well that you can easily detect this method with SoftICE:
2 |- b( i& h6 g* b. X! o bpx Get_DDB if ax==0202 || ax==7a5fh
9 m. q, A& A. N( P1 B7 _' y/ z! k5 H5 O$ y; T
__________________________________________________________________________
* k8 q. [ e) B# h, a% V4 C
# Q! A' }1 z% X3 H4 p2 PMethod 10- V; q" o: b+ M' U4 x
=========( Z7 y& F: j8 O3 D; w
6 a t7 A) B& ]6 ?=>Disable or clear breakpoints before using this feature. DO NOT trace with7 w, L% s( Z2 H8 b
SoftICE while the option is enable!!7 F+ X2 v- |2 o3 j8 H% B
2 l. @' q$ w8 _+ A" j+ w0 J4 o: z
This trick is very efficient:
* ^. Z$ [, ~0 bby checking the Debug Registers, you can detect if SoftICE is loaded
# i+ m% E8 M# S, L(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if7 ?, f3 ^! `5 a0 A z: F/ U) u) V
there are some memory breakpoints set (dr0 to dr3) simply by reading their" ^( t% v( W' k* f7 t9 v
value (in ring0 only). Values can be manipulated and or changed as well
0 o8 k2 X5 i6 B) N! }/ ^- w(clearing BPMs for instance)
: p5 A! w1 X3 J) }8 \
: z* ~$ m% d4 R( N0 A; K/ J__________________________________________________________________________
5 O% a5 y! G+ O# K- `
0 C& ^% o( Y# b( \' QMethod 11, q2 q" S2 i+ t+ m3 I
=========
: f$ U+ m) B1 H) [
! g2 F1 T7 e7 M' mThis method is most known as 'MeltICE' because it has been freely distributed9 h- Z% C' H4 F4 V
via www.winfiles.com. However it was first used by NuMega people to allow
, T W3 X [3 ~% e8 uSymbol Loader to check if SoftICE was active or not (the code is located' |8 M; @+ h; P5 ]
inside nmtrans.dll).
~* |2 P5 x: O0 R
" T$ u$ }, m8 _0 [ gThe way it works is very simple:# R2 x$ k. ]9 Q2 a
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
5 D6 J. X# Q& f% H0 b v! |2 kWinNT) with the CreateFileA API.6 T" Q6 S2 ^9 R1 j! L6 I; _
! a+ W4 @ X+ g3 `0 g D: t& QHere is a sample (checking for 'SICE'):) q% H5 W. p- R4 n! K" y
( J: ]! i$ j4 s) S9 m
BOOL IsSoftIce95Loaded()2 F) u3 @& ~# o3 U8 i
{7 ?+ r3 l8 H+ v1 d
HANDLE hFile;
6 w; L0 F' c1 l. ~ hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
: ?& P& V- a4 d! i# S3 J+ W- U8 O FILE_SHARE_READ | FILE_SHARE_WRITE,
; x2 T6 D3 F2 x; }4 F* ^: | NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
9 ?# t# X# e* K, j9 M" g if( hFile != INVALID_HANDLE_VALUE )+ i1 X+ ]* g& G# d/ o6 s6 y
{$ n7 N; G4 J1 O3 t
CloseHandle(hFile);
, \, h( l% q" Y. l& p return TRUE;* d* V3 G! s, p( e f; [
}
/ F6 Z1 n7 P( W* R1 m6 Y return FALSE;9 G$ u2 E8 m; a2 {
}5 V5 j/ u- X) C% m6 {1 y
! p! v Y) [) \9 `" ]2 ]+ W
Although this trick calls the CreateFileA function, don't even expect to be
' A8 B9 ]. G3 M5 G: ^$ vable to intercept it by installing a IFS hook: it will not work, no way!
; G! M% A$ y7 X, \1 oIn fact, after the call to CreateFileA it will get through VWIN32 0x001F' C1 z% {/ |9 b& `
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
9 ? M' S; E: g! [3 C$ i0 {% Eand then browse the DDB list until it find the VxD and its DDB_Control_Proc
# L$ I6 d7 V4 @6 D+ {9 P- vfield.
: q r3 B8 S3 b, Y7 ?In fact, its purpose is not to load/unload VxDs but only to send a
5 d: k) g' ]- x3 v; d, X3 \3 jW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)9 h. J' t A! d ]* ^" }* x
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
5 M) O8 x2 a& D6 m7 V, e3 M1 g- ito load/unload a non-dynamically loadable driver such as SoftICE ;-).4 w# ^( N6 j& J r
If the VxD is loaded, it will always clear eax and the Carry flag to allow. v$ O! b9 j% c; j% O& j1 I8 a. r
its handle to be opened and then, will be detected.
! T% k" X3 B; ]0 E; ]You can check that simply by hooking Winice.exe control proc entry point0 f" w. ^6 W0 y; f9 Z' G. q/ y
while running MeltICE.
9 u! U$ U8 t- b+ B) A) I6 `. f* O+ d6 ]+ z" d
) L- b; i5 c; U1 F; [ 00401067: push 00402025 ; \\.\SICE. @- E6 f$ c, {' G- d2 |3 _& U: F
0040106C: call CreateFileA
. F4 P6 ^7 v- A3 _3 `" T1 A/ B& N 00401071: cmp eax,-0012 U, S0 Z( K5 J9 _
00401074: je 004010911 E; N K) f2 y2 u, v5 S1 y
& d. m) I& G. @% u6 A4 ~$ S: s0 m. T( g
There could be hundreds of BPX you could use to detect this trick.
, x8 O0 v+ r& J-The most classical one is:4 W( s/ l! N' |- w6 J+ r
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
% l$ w& A0 ~& X# {* W7 S N( e *(esp->4+4)=='NTIC'
0 Y3 _( P: `+ L% O1 ]
0 J+ r3 t' |) o8 J" E4 Y-The most exotic ones (could be very slooooow :-(5 P2 B) ~4 x+ a/ z9 K* V2 ?
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') ; z. W2 ?( V {
;will break 3 times :-(8 |% s2 {' J: ~' `# G6 o- B8 ~
9 n( s. }* d! d1 c P
-or (a bit) faster: ! ?% ]! l9 r! V' b5 J, A: w
BPINT 30 if (*edi=='SICE' || *edi=='SIWV'), z" Z1 X( p4 c" Y4 t# f5 ]# S
' w; J7 G' s2 V5 g- \' \$ |0 T; X/ b BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
. Y! s! y6 y1 c4 C ;will break 3 times :-(/ }* C( ~" a" Z5 \4 l: N7 X0 I( p e
/ }1 Y2 y7 N5 C-Much faster:
o) F- a8 q% \/ I5 o BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'+ s9 K! w( k2 k4 n
4 |! u* q5 I# O( }
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
0 P4 w- N8 I0 |0 K1 Z1 z* |7 Q2 Xfunction to do the same job:
7 Y9 C& _ T7 m& Q, h9 a
) t5 g' E4 c+ x; v: m/ _ push 00 ; OF_READ, H' s* ]" R% u
mov eax,[00656634] ; '\\.\SICE',0
0 u% |& G. G _7 g push eax
8 q0 J6 S0 L5 S# _ call KERNEL32!_lopen
u) ^! y/ D) Y2 m' j inc eax
`5 n2 g0 J$ t: E& L4 | jnz 00650589 ; detected
, @4 E' y7 y9 |: `: t+ m3 L push 00 ; OF_READ
( o% G7 t) v& [. x8 Z) |6 H- w mov eax,[00656638] ; '\\.\SICE'. `) A' _7 n, ^
push eax
& ]7 |0 w' t7 f% f3 A8 e call KERNEL32!_lopen
, J- @4 a* p' H1 O* o inc eax, ~- ^! R0 q+ h# B, |
jz 006505ae ; not detected
6 L% b- \: V9 ]6 L" N! W
6 w5 X2 r( D9 b, J" c
+ B( m5 X; ?/ q6 f7 n' l__________________________________________________________________________
+ x5 T2 I9 C7 u$ _2 n6 O# J( C! \( l* D4 O6 o! l
Method 12
/ I( N* s @' y5 Q" R=========# _% Y2 C( N5 x/ \9 e
% G& K7 K* R2 [% {' `3 eThis trick is similar to int41h/4fh Debugger installation check (code 052 \ @2 U& |& ^( i
& 06) but very limited because it's only available for Win95/98 (not NT)" G, }+ {) i Q
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.; h" |' D) D& o5 ^1 _0 x
% |1 j3 q. H8 h& U) f
push 0000004fh ; function 4fh
e9 D7 h2 H- a push 002a002ah ; high word specifies which VxD (VWIN32)
, e4 f$ [3 K& [$ d! Q: @) ^ ; low word specifies which service' {/ ]3 J% t" X T
(VWIN32_Int41Dispatch)# Q& Z0 c* v E: S9 l' w# d
call Kernel32!ORD_001 ; VxdCall- A+ ^8 [9 c8 y9 {, I1 q) \
cmp ax, 0f386h ; magic number returned by system debuggers
6 j1 x. h; [; k jz SoftICE_detected) {0 l0 M7 e' G, `
8 f8 ^. j4 p4 Q2 X
Here again, several ways to detect it:
+ h( F- `: r2 I) p. u9 T
& T* O" v$ h; B6 [, T) A1 k BPINT 41 if ax==4f7 d( _5 u5 S7 h6 _3 X( ]
0 S8 C2 @; B9 C6 v
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one! B/ C0 b3 X- H8 v
- y6 c2 n* L6 K0 m. b
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
% N9 ]0 D0 q# p* Y0 I
: P9 G" B' K$ N0 \0 \3 r BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!2 Y1 A# y& X! h
& l4 V h8 S) ]; ]$ M, I# ]' }__________________________________________________________________________+ C3 W" G" R6 ~, H
1 W" \# R, F% S8 e' O' B
Method 13
# q2 G6 N* i1 n+ p$ o1 b=========# s& r! _) j" R$ a8 `8 J4 ]
2 n; y0 @# {0 U) {3 z
Not a real method of detection, but a good way to know if SoftICE is8 T2 Z3 Q* Z" L) b6 R
installed on a computer and to locate its installation directory.
4 y5 p5 @5 o$ w. U3 f9 @4 VIt is used by few softs which access the following registry keys (usually #2) :
- a, t3 S2 y5 Z9 g/ n' C
/ \- b. B( p6 L7 B+ ]7 q-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
* Y/ L; \0 w) {: q$ f\Uninstall\SoftICE
! P- K! M1 m: |. |" u4 w( [-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
! Y% x0 y+ M& _-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion( g: B4 F! {- g, `# r9 g# N" X' Y1 t
\App Paths\Loader32.Exe- Z7 s& a+ G) L7 H' ~ T5 c
H$ G( ^( z; p; X) t4 O- U1 @
/ ^6 \ Q X+ s1 Z& Z6 r. G4 ]
Note that some nasty apps could then erase all files from SoftICE directory+ y: l9 g9 B" e) U
(I faced that once :-(; q, e/ x8 x/ U: ]4 p
. S2 x5 M: \( o' `# M. `4 M
Useful breakpoint to detect it:
( f% w) W9 v5 I& @0 {
8 s0 x& h) Q; L+ \. c5 p d& w BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
: `! t0 W- A& ]2 [7 ?4 d6 e F2 V% o
__________________________________________________________________________
4 _& }- ^. M- r: Y+ q# c7 v" N3 j* ^& E3 T3 `( @7 b/ W5 x
! A7 E5 ]1 |" Z% q- C( o
Method 14 / u7 v8 ~6 p" [1 F
=========) c3 ?. ]4 D. ~5 i |: c! \
( p( H! K# ]8 p S* T$ q9 RA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
" u' { l7 j% {9 e6 \( tis to determines whether a debugger is running on your system (ring0 only).9 `# K% r" I B: R: N4 w2 z
" ~( w7 L( c1 A$ [' @2 @6 D' s
VMMCall Test_Debug_Installed3 f1 c' ?) g7 k. l
je not_installed2 \7 V* ~+ [) T) w' o% z& F
A6 `, E! T7 rThis service just checks a flag.4 C7 i/ g) y- y1 i+ d
</PRE></TD></TR></TBODY></TABLE> |