<TABLE width=500>
" X; X* W% L3 l' j! z/ z+ e1 G<TBODY>
* w5 {6 P0 w3 N" m3 ?<TR>7 F8 G% b* R* T5 ~$ d
<TD><PRE>Method 01 7 k4 C3 }& B2 F: L! D! k' w5 C) C
=========$ |8 b8 R J) A9 ^4 q
8 j- T2 X" z3 Y: Q# Y# U
This method of detection of SoftICE (as well as the following one) is
" B0 o- F* q8 h4 \# Lused by the majority of packers/encryptors found on Internet.7 P& S9 t" Q6 j1 a( c+ P0 ]
It seeks the signature of BoundsChecker in SoftICE3 Y5 A) l( p1 @) l) d
( j' A7 I) b; ~2 K. x7 T
mov ebp, 04243484Bh ; 'BCHK'
* b, n. d3 g7 k$ U mov ax, 04h) O8 b7 A2 D3 _$ Z* J/ h
int 3 : A* }) ]) N; [$ F5 b) v
cmp al,47 r% [$ z# Q9 u3 D9 l" d" g2 |0 a
jnz SoftICE_Detected7 o- E- d" [1 l. s2 R* k& a
0 t) [4 M+ H0 Q) m3 f& ?( ?
___________________________________________________________________________! g! ]- P1 I& v" N5 b q, u
[# `- z0 U( u: [5 X- ]
Method 02
6 S4 L" c: y" O- o: l/ b=========/ K2 j8 A! b. m! p
6 G" F2 t2 F; x/ HStill a method very much used (perhaps the most frequent one). It is used; F- G& }5 D3 ?
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
9 f( v% Q( q! N9 W1 z( e: @, K2 Nor execute SoftICE commands...% y$ O" ?: y) r3 }* k4 U/ l1 O. q6 U8 A
It is also used to crash SoftICE and to force it to execute any commands9 e+ F' p1 C3 l3 ?: _
(HBOOT...) :-((
1 k8 b: u; s" I5 Q( P3 R* O3 g9 T# g7 s1 c# L6 V" W
Here is a quick description:
/ Z* N. ?) k$ I+ m; O# p3 c8 D-AX = 0910h (Display string in SIce windows)
1 J: v0 I1 X$ Q0 Y) W. c0 `: S7 z3 Q-AX = 0911h (Execute SIce commands -command is displayed is ds:dx): u2 D. W, t1 L' y/ c, w4 x
-AX = 0912h (Get breakpoint infos)
3 r) t$ C3 U6 U' B-AX = 0913h (Set Sice breakpoints)# W2 {, e# a6 s" h1 D
-AX = 0914h (Remove SIce breakoints)- b3 W: ]! Y# a3 x0 ], G1 W
1 T& d$ R+ B- h3 P7 L# q5 K: NEach time you'll meet this trick, you'll see:
1 k- U" l D9 B$ O8 l _-SI = 4647h
X8 X% Z$ ]2 R8 E-DI = 4A4Dh$ s3 D' i9 p$ A* \
Which are the 'magic values' used by SoftIce.
: W) t. Z' e9 QFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
$ w/ w+ d, Q7 Q' a0 N6 e6 M6 _. C; Q9 A- C# C
Here is one example from the file "Haspinst.exe" which is the dongle HASP
: X% |' C3 i) M2 [# c- x8 LEnvelope utility use to protect DOS applications:$ z; W2 X' g2 ^3 e
. T V+ y5 }, x* d' j
' s2 b5 N2 N% @* I! a( Z4C19:0095 MOV AX,0911 ; execute command. X1 z7 ~2 ]+ [" l/ d
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).7 ?# e. w E$ ~4 Y. N% u# ~& v! N
4C19:009A MOV SI,4647 ; 1st magic value.
5 Z& I0 I! T$ z, W! a" o4C19:009D MOV DI,4A4D ; 2nd magic value.+ S8 ~; v, n. t' F- c- x) P
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)/ j% w; L) e4 T, U# Q4 `/ }
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
$ o6 s) h5 e6 K" N: g% v7 J4C19:00A4 INC CX
. j$ M9 V- M% O2 G; ?5 Q L3 i4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
; w3 m9 S6 s, O/ d2 z, a+ c4C19:00A8 JB 0095 ; 6 different commands.- d! p% x% B/ Z9 V" j3 B
4C19:00AA JMP 0002 ; Bad_Guy jmp back.
) ^3 k4 ~4 A, k3 V9 s4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
) {2 B- A1 K& Y5 n. v8 p# ]: }; M+ O- y, r$ y9 Z
The program will execute 6 different SIce commands located at ds:dx, which+ F( L: E# F( ?' F) u; P. e7 z
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.6 M! F) ^$ I1 t7 t6 T- k# w) Q
2 b/ Q+ y3 Y! _& h! O8 N7 g& B5 k9 E
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
, \& X' `8 d$ o, T___________________________________________________________________________0 m1 ?5 G# ?4 x& k1 b4 s# [- Y
1 M- p2 U/ {# J" }
3 i0 {# \) M2 N: f' tMethod 03
v. V% Y) i6 Q# D3 @=========+ Q/ ]& e. h& U1 {4 z; r$ X
, B% g$ c% C9 D% p8 g [0 v9 }Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
, s9 ?( f- a; y(API Get entry point)
7 ^1 k! ^5 S& A) w5 n! J 7 t: c7 S! _5 g* ^3 e- z) S
) M) i r* Q+ K/ I4 z
xor di,di; O9 A5 Z% _% C T% y( t
mov es,di
1 X) g+ b" y* E$ S/ { mov ax, 1684h " f$ d, m- E6 b+ g: x1 y
mov bx, 0202h ; VxD ID of winice
" X+ E4 w- X& N2 I int 2Fh1 d: z4 o3 {8 X+ P3 t
mov ax, es ; ES:DI -> VxD API entry point
( R3 D) _% a# j2 p; a5 n5 w add ax, di# A8 A4 q4 E( V
test ax,ax3 S T# q& u3 _7 D) N- w
jnz SoftICE_Detected# S7 l% T/ s1 F0 ]; l, [0 }+ n
% m& ~% D) O9 l0 i( \___________________________________________________________________________
2 G( ]1 z) M' R( j0 p
$ A2 x/ a' G* ~! F% q' ^2 |Method 04- B5 h5 v' b {) m# b/ e
=========% f' A$ }4 ?& i) |
: j: \7 ~6 w8 E8 h+ T4 @
Method identical to the preceding one except that it seeks the ID of SoftICE
3 R' F' S9 g4 w' c9 s; kGFX VxD." ]5 `( Y. P6 o4 S
' X) j) h2 W% L
xor di,di
0 t; G+ H. T1 G$ @& ~ mov es,di; \" _' w1 d4 ?
mov ax, 1684h 7 A9 m/ p. \/ `1 _+ r, I% F; {0 k
mov bx, 7a5Fh ; VxD ID of SIWVID/ b) Y7 I. q7 K0 W
int 2fh
$ K' u+ ^3 p# T. u. j J mov ax, es ; ES:DI -> VxD API entry point/ {! \' z$ ]% m% K: P
add ax, di
( I3 _4 S5 Z3 c# O# ~! J test ax,ax
( X9 e2 \6 H+ U/ j/ C% ], ^8 f jnz SoftICE_Detected
& k- M# F9 ^8 M4 T; Q8 M) R+ p) D' n7 y6 p3 s( f
__________________________________________________________________________0 b& m: P1 \3 P4 B
$ c1 k3 g0 K* W4 F6 ` C6 q8 {7 d1 S1 Q- p% O9 D/ a# K% C
Method 05) y' y! O* u/ A
=========
7 O4 f9 L7 Y% l8 i5 K
% o5 c6 W5 ~9 e1 i% M3 u+ j( uMethod seeking the 'magic number' 0F386h returned (in ax) by all system8 a# ?! Q; F7 N+ i& E& P/ p
debugger. It calls the int 41h, function 4Fh.7 Q( W* X: Y! x$ g* O
There are several alternatives. ) Z. ]4 G9 v# ~' @6 ^% l# v
& G7 S) e( f+ K$ JThe following one is the simplest:
5 ]4 [3 E( l4 R2 r5 b! V0 ~6 v( w) g1 L/ l" G; l( |
mov ax,4fh' P7 D7 y$ p% z) s0 D' I
int 41h
b- r2 @$ j& T- N5 E% I7 j cmp ax, 0F386
; M$ O4 o# V2 ~) e; Q jz SoftICE_detected
! r* u' s x) l- b& R0 g! l9 N& g4 R* |0 D* C d1 @
! s# E$ l+ v; s0 Y( j5 }' d, c; eNext method as well as the following one are 2 examples from Stone's
/ X m7 Q/ a: }& E8 E5 \"stn-wid.zip" (www.cracking.net):
2 U% b2 J' ]2 v6 j3 }7 ^/ t
3 o6 V1 d3 \7 Y8 H, w/ Y! c mov bx, cs# ]2 C5 {$ S) N. z
lea dx, int41handler2
+ z+ _4 D& q; h/ a4 \ xchg dx, es:[41h*4]8 ^6 r' Q/ ^) w; K' D- L
xchg bx, es:[41h*4+2]
S$ n/ ~5 _% x5 n' j4 L mov ax,4fh$ @; X2 N% s# V
int 41h
B8 j) a. F$ R0 S) s' N0 W xchg dx, es:[41h*4]# M: [# E( }- [
xchg bx, es:[41h*4+2]
1 k! ?% ^6 W) Z) b+ b" x, T cmp ax, 0f386h
! r; p! o/ [0 d6 ^: P# c& s4 [ jz SoftICE_detected6 B, V* Q$ t* K* A# a
9 c5 ?4 O G$ E c) e5 f
int41handler2 PROC
+ s5 Y. ~. O6 a# G9 W! l& e! n7 U iret/ s8 G; ?8 E0 R3 t5 u
int41handler2 ENDP
+ g- u2 T! ]) i$ i9 F
: V( m% H: O* I( d; _2 L4 J5 e4 H4 M" S2 p! m/ z
_________________________________________________________________________3 ?- c+ y8 T7 W- W# @/ C
. i$ R6 F: @3 C5 `1 X9 B
/ u6 x/ U0 O- q5 H; CMethod 06
; {7 T r2 c% Q5 Z2 @=========
2 o. P0 X5 w; ~4 A3 F
2 r6 k4 B& q% r9 ] r7 t5 _: S& ^
2nd method similar to the preceding one but more difficult to detect:
+ a D0 ^ @+ `. l6 g* D, G* {- p- h' G7 l+ v( s+ Q7 F
: q+ c3 R x- l) Yint41handler PROC
# d5 K! N0 H- l' u) } mov cl,al
/ h8 @- K J% ]+ R9 c iret1 @% y. C4 M6 A8 f& q
int41handler ENDP
: W: q8 I7 s, x8 p: R" Z+ y- S, s2 B8 A2 M: c( F
5 `# V* M1 W! R( J( X5 m, ^( A xor ax,ax
4 E( H* ?2 F* ?! R$ n mov es,ax
6 y% c3 o# {2 d7 d2 p2 o mov bx, cs0 q0 v# [1 f% b6 {5 m
lea dx, int41handler
$ t0 N% N% M, Y' D" e3 ~ xchg dx, es:[41h*4]
4 i# k* k* m( r0 v( j+ d xchg bx, es:[41h*4+2]6 o' i7 M, x: r6 z) p
in al, 40h
! W& E/ W% g6 @6 `) h" K* ^ xor cx,cx
7 b$ U1 d) N d, j1 k) ]2 O' Y- {* N int 41h
( g1 \) L1 A' K4 k xchg dx, es:[41h*4]
& y! [0 o1 x; }7 w, l( f7 p% l xchg bx, es:[41h*4+2]7 C! E" M: [( j
cmp cl,al
- M+ K& W- J/ p. u' r jnz SoftICE_detected# z- i8 t7 y) n! b
& d2 ~# f* H0 ^; b& a_________________________________________________________________________
2 K& \; g% o* z/ |. {% J6 c |. |3 S4 K0 m4 H" y+ c
Method 07
7 w. L3 C. D) j, n. Y3 [=========
( l. T5 T( s2 Z
- r6 d& b: y# ~Method of detection of the WinICE handler in the int68h (V86)& S3 N5 `7 {0 u! V' i
/ R+ r D, [% p' r `, u mov ah,43h. U" Z( x4 [/ h5 t+ J6 x
int 68h
# j8 e& d. }/ Q5 Y cmp ax,0F386h
% x$ G- d3 {0 E$ \4 I Q" C jz SoftICE_Detected
# [; j. O+ H. d. G7 N8 S5 y8 e6 l3 G/ c5 t' W. Y! R8 [& [
( `2 Y$ u. R, u7 Y9 J3 `=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
5 x6 Z! v p' { app like this:
7 E% x% w L& k- @
# O3 ?! U; R% P/ Q7 \6 W. B BPX exec_int if ax==68# u& v( B' T5 J. M: _/ {8 D% ]; q
(function called is located at byte ptr [ebp+1Dh] and client eip is& j& l% ], e6 Z& D! \0 @
located at [ebp+48h] for 32Bit apps)
% `4 ^ P. @1 a8 v! M- L8 B# y__________________________________________________________________________5 a+ c" S) e8 z7 m* e8 R
' J. S- w0 q0 l! S
& m1 z$ S( \- E5 c6 I
Method 08
5 k& B9 E! \- I+ _=========8 s- ]. r6 d; L, M0 H
) ?7 A { G# m" IIt is not a method of detection of SoftICE but a possibility to crash the
2 i% O$ }1 w& R% \& isystem by intercepting int 01h and int 03h and redirecting them to another
& f; T* @1 \2 K% U1 \5 D7 ~# y/ [routine.8 a: a# x" {! E5 F- ~. t' p
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points, H8 s$ S4 G B( K# ]0 n: p1 a9 q
to the new routine to execute (hangs computer...)
8 j) ^* X- P' a6 Z# f/ Y/ @ P- `# a, X. ]' J6 O/ x1 { g4 U" x
mov ah, 25h
" V# |' F0 V3 c! K; [& G mov al, Int_Number (01h or 03h)9 e3 A9 _) u0 [5 ?
mov dx, offset New_Int_Routine- L5 i x8 u/ V, v) i
int 21h
# p" ?( Y: H& F, @! t9 W1 @$ s) m# |2 d6 }( q5 P: c' V4 }4 d
__________________________________________________________________________
0 O# n$ M9 \. q9 C3 Z9 P! r$ }
+ k: `6 @% o! q3 D+ _3 {/ k7 W* KMethod 09
% H5 k: o2 e4 h: A- w8 J- O% f2 L=========4 ]1 ~7 }% B9 A
9 O0 K8 _0 C+ ~& ]( p+ l2 N) H* s; VThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only! y {8 `1 b1 M' s1 t4 ~5 H( c
performed in ring0 (VxD or a ring3 app using the VxdCall).4 `3 O' E/ P6 K! b
The Get_DDB service is used to determine whether or not a VxD is installed8 T- c/ h9 y. Q# S3 V+ @3 V( X
for the specified device and returns a Device Description Block (in ecx) for
3 ]8 t/ x5 k+ othat device if it is installed.( ?; x" h# H! U9 h, Q+ N0 S; q
* L+ U( x# N# V% O/ N+ Q mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID$ F8 K0 g$ |, w
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
: A7 m5 d, l& x8 u1 o) F/ V VMMCall Get_DDB
5 Z) T; e: Z4 D4 o3 P mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
; E( }& p; Y. }# [/ P# M% Q
6 C9 w" R% ?; j( K. ^Note as well that you can easily detect this method with SoftICE:
4 P( S0 {" z {, K- j) f bpx Get_DDB if ax==0202 || ax==7a5fh3 l$ Z. Z1 }: P9 S0 G/ A: _
9 t7 W5 G1 h& ^% s/ ]& \__________________________________________________________________________ T1 T; C# Z. L0 u! P& J3 ?
$ } |( N6 [+ ^, w' H' KMethod 10
9 @0 x% g- ^7 M' w0 E=========
) n$ p0 v' c% t' T' n2 |$ p8 D8 N
=>Disable or clear breakpoints before using this feature. DO NOT trace with
2 a& L2 m% E3 v9 N# i7 F& W ]; E+ g SoftICE while the option is enable!!
, y( @6 L/ J: e n" [0 i F0 Y; \/ ^ E' E3 P
This trick is very efficient:
1 D0 }0 [' \: ~' t: T4 S% sby checking the Debug Registers, you can detect if SoftICE is loaded8 U- d! D% @# b* q( [5 c) w5 t1 X; x
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if2 `: D% x7 d; M
there are some memory breakpoints set (dr0 to dr3) simply by reading their
, `' z) ^6 E* O. B# _value (in ring0 only). Values can be manipulated and or changed as well T S1 Q% x9 G. ~2 N* s
(clearing BPMs for instance)
( e/ a. u6 s; P+ I7 s( R/ E
2 G+ [+ }: ^ n7 S) b. T5 O__________________________________________________________________________
" h5 o2 G& z$ m% N
n; i4 c) {2 b$ D* n2 P6 vMethod 11
: D1 O& J7 L! V=========# f6 x P- k* p7 x
! h0 ?# Y$ {4 k" M z" OThis method is most known as 'MeltICE' because it has been freely distributed
* v3 ]" H& f6 t, \, Y0 Y" evia www.winfiles.com. However it was first used by NuMega people to allow
3 s- R% g' u+ }2 BSymbol Loader to check if SoftICE was active or not (the code is located. u4 B' N }' Z- g
inside nmtrans.dll).. t/ a. ]: b1 h8 S
- x. x. b# f4 V1 zThe way it works is very simple:, K! ^ O3 A8 f! _. E3 n! A; T' G8 I, f
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for3 y! s8 W; }1 S' ?8 }) u
WinNT) with the CreateFileA API.
T; [$ g% P: d% J( f
1 t0 e; r$ K+ O" G" p4 M9 fHere is a sample (checking for 'SICE'):
0 `' M" d% o. r( V4 o$ m1 Q% \7 X5 i5 B* {- V0 U7 F6 i
BOOL IsSoftIce95Loaded()0 ~5 v1 }3 B) z+ t8 J7 @6 ^ C
{( n/ y! n& n: D
HANDLE hFile; ; e* L. \1 y/ |- I, b( U" @! P
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
: l: W$ X5 h" l% }* T FILE_SHARE_READ | FILE_SHARE_WRITE,
# p# B& N& B7 w4 \0 J NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);3 O7 h/ Y$ e, U( ]# q3 |
if( hFile != INVALID_HANDLE_VALUE ), C. Y3 a$ q. E, ?( `
{
, r P7 c) k* | CloseHandle(hFile);
( t1 ?8 Q K& t& ~/ h return TRUE;' i: g/ o9 M5 ^0 @. _
}
1 X) c5 i n* l1 a return FALSE;
7 e h$ p( N6 J4 {% ]# T2 S}$ C# ~/ w& \+ I* \
- l, ~5 x) e" u( m8 t0 g
Although this trick calls the CreateFileA function, don't even expect to be
! ~. I H# @3 |, T$ _' {- Rable to intercept it by installing a IFS hook: it will not work, no way!
4 `6 S( s+ l7 p" F+ hIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
1 ?: h v2 K, lservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)7 _- x+ ^1 r& I" m
and then browse the DDB list until it find the VxD and its DDB_Control_Proc3 z( d* i4 M; Z: ~2 I' K
field.
6 w1 i9 e( j8 k2 X" I/ JIn fact, its purpose is not to load/unload VxDs but only to send a
. ]2 n+ M2 N. r b6 f: N0 [! l9 M. `+ s! _W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)% s. x! H" N0 N9 x; Z
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
# `# z% }( P* j7 Pto load/unload a non-dynamically loadable driver such as SoftICE ;-).
- L- }8 k& V9 q. p4 T$ v& N! u. AIf the VxD is loaded, it will always clear eax and the Carry flag to allow1 d8 w/ J; ~: H
its handle to be opened and then, will be detected.! m& Z' Z( P- z( D* b6 |
You can check that simply by hooking Winice.exe control proc entry point
+ }' |% O9 q- `/ n& Z! w4 swhile running MeltICE.( U: e9 g$ D) ]: R* ~/ |- Q/ X
) i j) J6 b* d) U6 p9 Z; ^
- J; K# Y- B; K8 M6 ` 00401067: push 00402025 ; \\.\SICE
1 R; D! Y- y! {3 N9 q& s0 n9 Z 0040106C: call CreateFileA
$ B% y' \8 J! W0 z 00401071: cmp eax,-0015 q% [9 ~3 D2 Q
00401074: je 00401091
# F; c: q. M% S; b+ I% l) j
% G/ W0 ?) B# p- S( s2 E2 i! b/ W1 y' C8 `& K
There could be hundreds of BPX you could use to detect this trick.4 M+ `; e, R" k6 l6 Z
-The most classical one is:8 \4 \, ~" g' }& ]: u# q Z
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
0 Z& B1 {. I6 ]: S *(esp->4+4)=='NTIC'" _! ]2 N9 ?) C8 c3 _4 m
- q. b, f2 |# T- R& ~( @, a. x$ U! _* c$ R-The most exotic ones (could be very slooooow :-(
# i; n$ Z$ D3 E4 j, l" f% U BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') ) h( T3 }) u( y& I& i) B; E
;will break 3 times :-(
t0 p, O9 @. ]5 v
! I& S6 k! x- t% W3 l8 P) Y-or (a bit) faster: 3 e: K; U7 ]" w1 z$ `4 s
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')# h; |2 @: ?- {: X& W4 U9 i
' u6 L7 }- P, E( _9 h( @5 n
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' , t; O6 W! b8 G G
;will break 3 times :-(8 F* A% Q- h* h b J
& l% f# W* C. P. Y-Much faster:; k0 _( E/ p( |
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'" K* p9 A+ A+ Y1 J# T/ S+ }, a
$ {$ q2 X0 Y( [1 {Note also that some programs (like AZPR3.00) use de old 16-bit _lopen& b$ t" b3 i; b
function to do the same job:
2 g* T# @) d, e8 ~; f) ~& V" _5 n: N$ v- d4 B' Q$ O5 ]
push 00 ; OF_READ
3 s8 m' l% T( c mov eax,[00656634] ; '\\.\SICE',0
; n. R5 B2 j! z2 I! y1 [4 D- x push eax
* m1 ~; y$ |: [, C* B3 b/ V call KERNEL32!_lopen
) c, y: S1 ?+ G' z* \ inc eax
$ P5 X8 u, f0 O5 D! f! V: k jnz 00650589 ; detected( @4 { a! z- |; Z+ e F
push 00 ; OF_READ
1 L2 H5 W( {: R/ z; R$ ] mov eax,[00656638] ; '\\.\SICE'
& L$ n* t9 U& P0 E push eax
! C, t# g. q1 c, J# b5 z call KERNEL32!_lopen0 h) o/ V6 N$ m `; q' k' p
inc eax. K/ n4 C. k6 h0 ^7 K
jz 006505ae ; not detected
$ y& B6 V! R. U1 z- r* k1 C1 I
8 b2 o5 z/ x! {) W
1 [; S, L2 G9 O, @2 w* i, p__________________________________________________________________________
9 ]! D3 L+ \4 }2 G! P% v8 {) Y! V# G2 \
Method 12
( L) i: f$ v. ]4 e' J1 }=========
' ~/ J/ e5 T* R
( p' P! ~# `/ P- R2 x- ]& N9 D0 \This trick is similar to int41h/4fh Debugger installation check (code 05
) k2 m! f+ S* o( n& 06) but very limited because it's only available for Win95/98 (not NT)0 ^2 B9 S2 x, [2 @3 e( b) p
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.2 {7 E+ @- x( d1 G5 c# q Y
, F- r" Y: F8 ^& A push 0000004fh ; function 4fh
/ a0 ]8 i8 U3 L; e# a6 ]+ ^+ o+ H* f push 002a002ah ; high word specifies which VxD (VWIN32)
8 L1 H- a* U" i& N$ e ; low word specifies which service/ w" W' @" Y& m' L9 [; Y
(VWIN32_Int41Dispatch)
1 S" b1 b; {+ h$ @2 Y' `& ^8 _ call Kernel32!ORD_001 ; VxdCall
, T3 f5 h) f% d8 q cmp ax, 0f386h ; magic number returned by system debuggers) D" N( |9 E/ Q$ M; ^' a
jz SoftICE_detected
( I' H) \' ?" C& e2 g9 e H
% I( m* |/ |8 r! @! LHere again, several ways to detect it:
/ Q( S" R/ G: Z, u& |/ A
" I+ B, s/ ]& r+ t8 i BPINT 41 if ax==4f
: S6 y- |3 }+ Z! a+ M: F- l( w3 e2 y# l7 A3 t* b8 G d9 i8 Y
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
4 K% g. T6 r& ]+ B! ?6 T3 T
' J7 @5 m' v/ e BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
3 ^" w* `7 I9 ]2 i8 o; p6 |4 f1 [. K# J/ t
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
6 s+ ~" U9 \( _5 Z5 o/ T, u4 p, e4 {
__________________________________________________________________________
) u) H# b2 S# D/ A0 ^2 V# J( I9 X5 E# p+ s6 u5 B1 M
Method 13( x% Y, }1 g/ I. n; h( _
=========& n& a& Z) q4 Z: t0 l6 [0 |: l
0 T; d3 u5 b8 r) a5 R; i- E) p! VNot a real method of detection, but a good way to know if SoftICE is/ \: O6 q" o7 w& N1 m8 t
installed on a computer and to locate its installation directory.
5 H8 L# k* N7 b. f. p0 @3 j) `It is used by few softs which access the following registry keys (usually #2) : s% G( G2 V/ W
) ], y$ {/ m- |3 y! y7 L4 \-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion# \7 I3 p; Y$ k( O( C1 T
\Uninstall\SoftICE
9 Z( O- q- y Y& F-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE$ h! J/ R" a4 D9 a$ P7 Z" p
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
5 F8 o9 ]. |& I( g" ?\App Paths\Loader32.Exe
8 T. n# }9 {! A
& l6 } a% i Q: `: D6 b& c3 F7 `6 c6 D u* q% K. W
Note that some nasty apps could then erase all files from SoftICE directory1 `. _- g. ?" V0 ?
(I faced that once :-($ J4 o" ^& D6 O. _7 [6 o1 v: L' [
: k. {& u& B, X3 F9 E/ U# B wUseful breakpoint to detect it:
" H3 y! {5 v- h& A2 ^" W
$ F+ I2 \7 k+ n. t BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'0 W1 D8 @" c+ r) V
2 t6 g6 ~4 i& f7 z1 L__________________________________________________________________________8 z( ?) U1 w X6 u7 l' `
+ ~9 T/ T& ~6 \2 H" U* s
" ]! O2 m9 b8 X0 |3 q
Method 14 4 D. X4 t% Q; W' m- n
=========$ Z3 q1 F7 S2 i" _
1 t8 H/ r( _$ v+ P2 r
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose8 L( j8 B$ ^! ]8 o8 D9 H9 y
is to determines whether a debugger is running on your system (ring0 only).
& ^+ w2 W6 |- Q4 s& w' Q! P/ h6 _3 a/ A; U( Y2 e
VMMCall Test_Debug_Installed7 c7 \6 N) @) U) F+ P
je not_installed
2 j/ ~ T5 a8 f
- Q0 ^. }6 t1 p2 \; G* F" {This service just checks a flag.
' E9 P6 k& L ^' E( n E0 j</PRE></TD></TR></TBODY></TABLE> |