<TABLE width=500>1 y+ d# Z* j) n5 S0 O! A! k) d
<TBODY>
" j( N' H6 ?4 t( P+ O<TR>: z' g- P0 L9 H. S4 G3 _
<TD><PRE>Method 01
# ~& ]+ j- \- b=========/ w: T/ Z" t- C1 q6 e" o
# `7 j) u" N$ G- e/ f
This method of detection of SoftICE (as well as the following one) is
' j5 |( H7 M: t% k: d- Jused by the majority of packers/encryptors found on Internet.
! m3 L; ?" |5 o; b L6 q2 ]9 ~# dIt seeks the signature of BoundsChecker in SoftICE
" R- A7 h# X5 Y: W- r; x$ c$ q1 l2 I4 H$ r. _5 x" L1 Q
mov ebp, 04243484Bh ; 'BCHK'
2 q9 p0 v+ j( `1 o I" ~: } mov ax, 04h/ r/ |0 O- d6 `- W
int 3
$ e6 [% v0 m/ c7 z7 q cmp al,4
# E# f6 E$ n) M( T, B; L; ~ jnz SoftICE_Detected
. d k$ `. ]( C. T% W6 O, E3 K; B, j. _5 `* j; x j
___________________________________________________________________________# m6 D2 u' n* C/ L
3 n" L& E i$ Y7 ?Method 02
& @5 t$ c, P! k% U1 h) \=========
' E, l' }: W. u9 ]
; r W9 u* o5 u3 \. {% K# IStill a method very much used (perhaps the most frequent one). It is used+ y _! A; k: j
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,) A1 Z& `9 f' B
or execute SoftICE commands...
M2 z" v9 C, \8 nIt is also used to crash SoftICE and to force it to execute any commands
) C8 D+ n, R8 c' F8 j1 o7 [7 @ I' u(HBOOT...) :-((
8 V" s8 q& |0 y$ K' Q, k$ Q, {$ W
Here is a quick description:( L) Q" S8 ~( P" O6 x( C) H
-AX = 0910h (Display string in SIce windows)
5 X* ~' A7 X7 F' s-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
+ V" B/ \4 ^; n0 U8 [-AX = 0912h (Get breakpoint infos)
, W+ W9 [6 G- T1 ?8 ^2 r4 } f% z-AX = 0913h (Set Sice breakpoints)9 @+ M: |* u) C m2 W0 D7 [
-AX = 0914h (Remove SIce breakoints)7 q4 \: F2 F5 ~4 C' S# f C
0 q# y5 q% R, I7 G% ?' r0 M* P# oEach time you'll meet this trick, you'll see:) e. h# `' V$ h( b
-SI = 4647h
$ G7 i/ G5 x" W( `3 g4 a-DI = 4A4Dh
# g4 D: d6 o9 vWhich are the 'magic values' used by SoftIce.
( z% ]4 G2 N# P, K5 [1 Z, R& ^4 JFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.: L$ W5 C" q" t$ M4 b# ?5 V
+ y8 A4 R. [' K5 D% C/ q/ a+ D0 CHere is one example from the file "Haspinst.exe" which is the dongle HASP
. {4 i p; F3 q" y# Y. b- ZEnvelope utility use to protect DOS applications:$ D" ]! P4 y8 L
8 L% F6 E! q: s4 P" x% N
$ R3 N# V1 A s/ S" M, I: s4C19:0095 MOV AX,0911 ; execute command.
( p- x! a7 G; S! q0 J7 l4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).' j4 ^: b/ ^8 K6 ]( f; W" k+ d
4C19:009A MOV SI,4647 ; 1st magic value.
( |8 p- \: L' a6 }$ x: m; I4C19:009D MOV DI,4A4D ; 2nd magic value.& N- Z% C) d w" ?0 Q7 c
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
* R) t2 z# t% i$ m4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute: M& ~# Q. W9 Z2 M/ b
4C19:00A4 INC CX, U; i8 i" v$ m) p, ~2 G( \. y
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute* G7 U* f% g+ P6 B! Z* X
4C19:00A8 JB 0095 ; 6 different commands.& E, a8 y9 x. [4 h
4C19:00AA JMP 0002 ; Bad_Guy jmp back.* R( H9 R, a e+ V+ o4 B$ e
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
) k& n" m! d, \ ]" h/ e4 r( M% I; O( m* [9 M
The program will execute 6 different SIce commands located at ds:dx, which/ i I; J4 F) M0 b% A2 Z7 z
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
8 K8 z- t- s' i# g+ v
5 F- ~2 F: |5 I/ k' x2 b* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
/ W( d, T$ G9 i) G0 Y___________________________________________________________________________
2 Q2 \0 d. X2 ]
) y0 l- n! R: c/ f+ `# ?8 `& B7 @3 {4 |* u/ t
Method 03
, h- a8 L3 L$ |. C$ |5 q: F6 `=========0 ~" B' {- s9 n7 o- s
3 ]/ x1 {+ q I0 oLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h( j. c3 l+ {5 Q8 C E6 I6 }+ v
(API Get entry point)$ t8 o1 k) F9 i
+ S4 v9 i, p* G5 w0 x/ l% v+ N( ]6 @* X
xor di,di
& l {1 ]+ B6 q8 ^6 b) P mov es,di. z2 g! I( K; g8 y0 ]! d8 }9 ^
mov ax, 1684h
3 o8 G8 `! ?1 k6 G mov bx, 0202h ; VxD ID of winice- F4 q5 [0 d+ f1 f+ R; c
int 2Fh
, _" p( \# r- ~: k mov ax, es ; ES:DI -> VxD API entry point
' l# G- J9 [4 `0 [0 F3 T7 j( W6 C9 a add ax, di. y# F, e" N# l3 T/ \6 k
test ax,ax
% C% I: B1 s' L6 e4 v jnz SoftICE_Detected# Z( d: _1 Q: R6 k+ a! E
( N0 y# p9 `: w% B- Y. I7 h
___________________________________________________________________________
" a o" D7 M1 N( E5 W/ R8 q* V2 l( U
; i9 G$ \; N2 X7 G7 F9 IMethod 04' n0 N* @1 J3 {/ M1 r( N2 B
=========
, @) f* Z, _7 S4 p- E* {; ], X8 H3 O
Method identical to the preceding one except that it seeks the ID of SoftICE
6 L3 s- H; M8 \6 RGFX VxD.: U/ U) T& | J1 m
7 v& q4 {, ~" k8 C+ T xor di,di
3 g p) }" d/ ^* K- [ mov es,di
& k/ H3 s9 l) Z1 b8 N+ S( Y. { mov ax, 1684h
j+ w* {- D% _+ Q$ n mov bx, 7a5Fh ; VxD ID of SIWVID
- R) ^4 ~- n5 Q: n8 k1 a, B int 2fh
, [: Q! R) \0 V8 M mov ax, es ; ES:DI -> VxD API entry point
/ i* J, s/ X. s add ax, di% C. B! `( D6 Q8 ?% J
test ax,ax
1 I& j# G* B" ^+ \9 W jnz SoftICE_Detected$ v& I+ N& H3 j$ @( f
/ s3 O3 n! R7 E! R- _3 i& b__________________________________________________________________________/ p Z9 C0 J9 q
' T, E, h1 @1 e* F
/ R6 |' q% S" H1 C3 d8 _Method 05
2 w6 W1 ^& Z, ~; A6 b=========
5 T8 @- H' {1 B. @. O# h* `& o, G+ y% M" I- S: ]4 H
Method seeking the 'magic number' 0F386h returned (in ax) by all system
2 o- I- X3 ^& w3 k( ]6 }debugger. It calls the int 41h, function 4Fh.
: s+ c7 Q1 L: _% X$ I8 jThere are several alternatives.
* g" S6 G8 \" X5 g, q6 Q& |
T2 e2 C0 p. X) VThe following one is the simplest:
6 W* e: v4 {# E/ H& T
* F* s, O2 E% u4 Y1 X' @1 ? mov ax,4fh
: ~, B. [5 ^* I8 T( z ^ int 41h: R) L4 v" k# N* i8 P
cmp ax, 0F3863 L7 w, L6 p+ ^0 w
jz SoftICE_detected
$ h9 L3 X; x+ G3 {( s* q$ G7 `" N8 x' I& z2 z
0 ?) D8 t0 ~3 y1 |# y+ mNext method as well as the following one are 2 examples from Stone's " W) g7 `9 Y4 w& W( n+ m; @
"stn-wid.zip" (www.cracking.net):' r% a8 |8 \' x; ]' o
6 s) k9 l/ w3 W p8 K mov bx, cs2 @: E& m# T( _1 t
lea dx, int41handler2
- h, ^0 E3 i8 l* [, p) m xchg dx, es:[41h*4]
0 c4 q# ]9 B- A+ ~+ Q% k xchg bx, es:[41h*4+2]
3 I' D' x' W: f+ T- C mov ax,4fh% a0 g: S% e) a7 Q8 ~8 M* L
int 41h
6 k$ m' q' O/ f5 g xchg dx, es:[41h*4], d6 T( F1 n! J$ a; }: q5 H
xchg bx, es:[41h*4+2]0 |2 h* f5 J% b8 I( I% z) i
cmp ax, 0f386h; O1 D$ ?) k5 n I C" O
jz SoftICE_detected
% s" K4 Y7 u O
$ w! ?: }' ?6 Y: U3 x( a/ ?int41handler2 PROC& E+ n9 \, D: b# ~$ Y* ~: Z; B
iret `6 G% _6 N. V
int41handler2 ENDP
8 c' ^+ L; {9 P" [, i' z9 g/ z. G, [- e! K8 Z# _
?3 l6 ~* _6 A_________________________________________________________________________
! Z* |7 S( `& |! p" i- m' I/ ?/ w5 u8 j4 n# F+ h( |2 R1 J
" ^6 a7 ?" d$ m; i( s2 ?8 SMethod 06) f, D: b' b0 u
=========
" }* s9 j4 s" _2 A, Y9 }. p3 Q$ p- B# |9 s9 t) j! P3 Q
* s, X, s" d# Y5 z9 M
2nd method similar to the preceding one but more difficult to detect:
$ s8 f* W* X9 X' L# H1 {8 b) t3 ?
7 H- m# }. q& G1 w" u( Q$ M0 r8 t9 ]5 u- @+ J# p
int41handler PROC
E% {* P0 p1 J8 w% G- C2 M mov cl,al
/ ?- G: c* b K' ~4 A1 x iret7 M. [5 B* q1 K1 E6 a- P
int41handler ENDP% n- R2 C3 _! Q% a
6 V) g' p5 ^" b
' Y4 e8 H, D: _- f4 p4 N0 @ xor ax,ax
" j4 Q0 h F; F9 C' ~# I mov es,ax
0 l; `9 Y8 _' [+ ?0 P mov bx, cs
) l$ z3 i, S; r) i S% N1 [' q) _ lea dx, int41handler0 V* p. b* v6 ^4 H9 ]" z2 h
xchg dx, es:[41h*4]
. W; B- v/ k7 T+ m: k xchg bx, es:[41h*4+2]
! G9 R* N/ y I. J0 e in al, 40h
G3 z* r9 |/ L xor cx,cx
/ i3 g1 m" b0 k! H int 41h
7 d' _, D( w5 b& N xchg dx, es:[41h*4]
" @, l0 z, O6 W xchg bx, es:[41h*4+2]
! W- h# O% w1 [7 r5 N ~ cmp cl,al
3 M4 y; b @. w* E jnz SoftICE_detected
0 p8 Y$ N2 q8 P/ B4 W5 h
9 e$ ?3 t: P8 B o* f# t' o1 C_________________________________________________________________________6 V/ G% n, a& w: }" o
" M. {3 a1 C6 R6 x- l5 Y2 n; O/ EMethod 07
0 f" }: h3 E* E6 d# u=========
& h6 P: V3 H# C% \
c8 j- D( g$ ?6 u) _9 x0 hMethod of detection of the WinICE handler in the int68h (V86)
+ [' \+ U1 \! ] u* e, P0 ]) P/ x2 L) A+ n) n& g
mov ah,43h
6 Y7 ]/ k- f5 @) d1 G int 68h7 E- O- p% E/ D; z# J' g1 z$ W2 J
cmp ax,0F386h# v: O8 b) t" d
jz SoftICE_Detected: a$ C( V4 s: B+ `' D- m. ]6 \( l
% J' Z' Z8 c6 w# x4 U
/ t }6 l3 ^+ }4 p& _=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
5 e' \. @+ }$ K$ Q3 t! h app like this:
, ~, o, ^- w6 L6 |# I
1 H. I) }' `1 J. [0 c- s9 b5 L9 s BPX exec_int if ax==68( E: n5 a& U5 [9 ?. K$ X8 [- X
(function called is located at byte ptr [ebp+1Dh] and client eip is
2 }1 h- o( w* {0 G" p located at [ebp+48h] for 32Bit apps)
/ n6 n: V- k2 H' `, e# l% I__________________________________________________________________________
, W/ K$ w; K# f3 G1 i3 a1 p/ M' C& q% z8 |4 _5 _8 E9 o
9 R; k2 r1 Y# Q4 o/ r# y) i
Method 08, k7 y. J+ m8 v$ [
=========
3 @: s" H4 Z/ y( o* Y, X7 }0 W1 H f
It is not a method of detection of SoftICE but a possibility to crash the1 j9 z; e- B% I( R8 d
system by intercepting int 01h and int 03h and redirecting them to another
2 |. ^% n. Y* D; {7 \routine.4 @7 }; Y4 @9 m3 B* T
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points, V( N+ P3 c" j% g( k/ p
to the new routine to execute (hangs computer...)
" @# v/ D0 R* A& k+ o7 D/ h
& }# k7 ? Y/ n4 H p mov ah, 25h
! T) X- b# N: F/ p9 r f mov al, Int_Number (01h or 03h)
. |% _; |% J& i0 Q/ q+ F mov dx, offset New_Int_Routine, G3 W; S" Q8 ?
int 21h
4 J8 ^( F* s" z$ X% U5 @. ]7 W6 m4 z( C J) a- r; b
__________________________________________________________________________
' F. C8 k8 v( r6 v# L$ G5 C2 g( q# { u& n4 q; ~# T
Method 09; a8 C% \; F5 K
=========& w0 H* Y( k6 c/ y
; s8 Z- z$ @& {7 ]9 l
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
& g1 M: n/ Q, z5 q! }. ~1 _# j2 tperformed in ring0 (VxD or a ring3 app using the VxdCall).1 Y0 S) y) ?# G: R2 }2 |
The Get_DDB service is used to determine whether or not a VxD is installed
( C3 S0 d1 ]# {9 x! Efor the specified device and returns a Device Description Block (in ecx) for F$ z' Q- s$ T
that device if it is installed.
: n, s% g5 E& p' m# O8 A5 s6 f9 L# m* I% x
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
9 C% m! C2 Q; T) y" @. I mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
2 J2 T: k& y D5 i* i! d6 S VMMCall Get_DDB$ _) c: K5 ?) O% F3 A5 N4 q5 ?
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
9 O. W8 V: T; s$ o5 U2 Y, x
3 n) v9 M* J! w8 o) SNote as well that you can easily detect this method with SoftICE:
% m4 _6 Q/ y3 u6 H bpx Get_DDB if ax==0202 || ax==7a5fh3 m( ~; u7 q' S
8 z' O4 ~) }! e1 e2 X) j
__________________________________________________________________________- |: Q# V/ e5 d6 h2 P& }2 s: W
& M, z: L: a) T/ F; J6 I% vMethod 10 B, P4 q! [% g3 r
=========
. C2 ?* |! h- }1 H! A
6 p$ |$ V& p& h" y2 w; l=>Disable or clear breakpoints before using this feature. DO NOT trace with/ u& u* _; X; v6 g6 A l
SoftICE while the option is enable!!
/ C0 Q( j- A Q3 c2 f' D, e3 l4 k9 s. u& t" K4 {: h; R$ H
This trick is very efficient:$ r9 ~) L0 q0 ^ K: E
by checking the Debug Registers, you can detect if SoftICE is loaded
5 C: [5 W' A/ C3 E" V8 K- D4 X(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if9 m! R+ W5 |" i" S
there are some memory breakpoints set (dr0 to dr3) simply by reading their
0 n, t6 {4 x8 k; M$ p! Wvalue (in ring0 only). Values can be manipulated and or changed as well5 _# w6 _, s# D1 i
(clearing BPMs for instance)
: s5 g& S+ ]6 ~9 W5 j; |* W/ R; g, ]2 C& J& u& t' a6 v' f/ Z
__________________________________________________________________________
* \2 c" q0 r% O" M/ z2 V# N7 z9 v: a0 N4 v
Method 11
' H% b/ m Y8 D) K# W=========: F$ k' T8 a" v0 z( t) h) z
" R7 T( r2 @. t6 k& a5 LThis method is most known as 'MeltICE' because it has been freely distributed9 q! Q# B$ \7 O7 I/ n& z) E' P
via www.winfiles.com. However it was first used by NuMega people to allow
- F1 X2 |$ F- b0 T$ B) J% O5 JSymbol Loader to check if SoftICE was active or not (the code is located
5 A. g6 E2 Q9 B. _1 pinside nmtrans.dll).
, Q0 n* a# d9 {; G& o+ d6 N! t9 m( Y( {( \5 w9 w: N9 u
The way it works is very simple:+ T& D7 P1 T2 W% d. c
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
8 m1 U" j' T( \9 D4 kWinNT) with the CreateFileA API.. g5 N; c4 Z" I. y$ t- {. f. x
# k: \3 n2 t. v/ b1 P1 z
Here is a sample (checking for 'SICE'):
. U0 M! _1 B# m; f) a
. \6 F" y+ m. ^( m. EBOOL IsSoftIce95Loaded()" S j i. E" m# Y* q8 I
{: i, i* T7 H7 r/ v$ j: i6 o
HANDLE hFile; " s, [% u$ Z! L; x! C R
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,$ a; ^0 k7 T' C
FILE_SHARE_READ | FILE_SHARE_WRITE,
% t, e2 M5 |9 f+ R4 g! c' r6 X NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
% U* ^) z1 ^+ t( @# R. ]/ @1 t \ if( hFile != INVALID_HANDLE_VALUE )1 Q' X* B0 n' d6 a* P9 r3 r
{
. O; u4 J4 x4 s! S! F2 d3 z0 c CloseHandle(hFile);2 U% L2 L$ s: o- J- x* o
return TRUE;
# B5 j9 ^" O4 c& H2 s: D* A }
/ t' B" r5 ~: \$ Y, } return FALSE;
- k' b5 W' v! n' ~( |}
! `0 L6 J/ w9 H! a* b7 n/ @9 o/ X( r( G4 o9 j0 J2 x3 l
Although this trick calls the CreateFileA function, don't even expect to be
# j" L- l$ Y1 aable to intercept it by installing a IFS hook: it will not work, no way!
" X' _* b5 F9 w3 R% KIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
6 U3 T, h0 z( G* tservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)7 r: D# W5 H6 q
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
8 a" }8 M% q$ d8 Sfield.# P4 E+ A4 n# Z! j9 x
In fact, its purpose is not to load/unload VxDs but only to send a : U& ~) K ~8 P
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)8 A, i0 [* b; [5 X) F. j& A6 |
to the VxD Control_Dispatch proc (how the hell a shareware soft could try: L' S8 d0 r# a6 l$ a
to load/unload a non-dynamically loadable driver such as SoftICE ;-)., F0 l$ o4 a8 {% o& T4 `
If the VxD is loaded, it will always clear eax and the Carry flag to allow1 x5 i( K5 ^5 d* u3 Q
its handle to be opened and then, will be detected./ w5 t! v) [. e0 S+ Q
You can check that simply by hooking Winice.exe control proc entry point
k- |4 o, q4 w1 {5 P' Fwhile running MeltICE.
0 W k/ a: X" @% v# ?. {+ n
; `( ^1 A, P9 E0 d( ` a# D! P( G7 w) |
00401067: push 00402025 ; \\.\SICE) ]5 f% e. F3 A; W
0040106C: call CreateFileA: a' r6 c( G4 }+ _4 m
00401071: cmp eax,-001- s: I6 I) E. v
00401074: je 00401091
* U) S7 A( Y7 }
5 D% k9 B5 F. N8 P2 W% M: g X) i0 _% A0 M
There could be hundreds of BPX you could use to detect this trick.+ w4 n# l$ }6 O: m4 K( F+ ^ u8 t' S$ ~
-The most classical one is:
6 n& u0 q1 _5 X+ U% } BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
; F( P5 Q6 g* j- s4 u *(esp->4+4)=='NTIC'( `/ F" k# i3 C* R' Y
9 O% F2 g, z, X( S: N7 y3 S2 X-The most exotic ones (could be very slooooow :-(
8 `' b9 s( K6 o, g; d BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') / H0 _9 w1 c; A0 f# J
;will break 3 times :-(
' U. F2 A: {7 q( l4 U c; i
1 g* y6 y. z, X q) T-or (a bit) faster:
( G% Z4 C% T3 R, z: U: S& d3 K BPINT 30 if (*edi=='SICE' || *edi=='SIWV')( Y& n- J5 @' A$ j! \
8 p% ~8 E( c F BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
* d s7 |2 ]+ f5 ^4 F5 O) l; l ;will break 3 times :-(* D: R6 _/ j& R/ H f: T# j
$ S' e6 `' q% `: V( u- w-Much faster:
% B; l. G( e6 Z |7 j BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'9 C" Q0 \* S8 ]- f1 s2 t
7 t: J- Y$ {1 b6 A, G7 _: ]Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
* p% z( P: P- v7 b" H, Hfunction to do the same job:0 F# m/ ] j8 O2 N( E2 b5 k
2 L+ K( Q* r b! o7 F- B8 k7 _" E' [ push 00 ; OF_READ
2 M, ^3 @3 d/ ?/ L- K# v mov eax,[00656634] ; '\\.\SICE',00 o. [' n! U) R8 ?$ h
push eax+ Z" J: }+ S- {8 H+ \
call KERNEL32!_lopen
) L6 Y0 u) w# X inc eax
U2 v4 Y4 C! R% n, w jnz 00650589 ; detected
# V% P6 `5 _+ f2 |$ l4 e+ b push 00 ; OF_READ3 Y( ?# T, u+ |
mov eax,[00656638] ; '\\.\SICE'
4 a' a3 m* D7 G8 w1 L push eax9 h X- |( e8 g. |& [: q' C
call KERNEL32!_lopen3 j/ Z* R' Q4 K* ]
inc eax
$ N2 F* j h9 D$ ` jz 006505ae ; not detected
D: U/ D7 _% @+ ~5 B! r7 T: Q7 V% l
( e9 w( p; f- g
__________________________________________________________________________* ~) N2 K2 v5 O- `1 W8 X3 _
! E7 X: \% J2 x ?$ _9 h7 cMethod 123 z& k0 ^% W* \: l3 M9 k
=========
4 H/ P' `& g, `7 N6 X" G5 d* J4 Y" @& g. z. L( _% P+ A
This trick is similar to int41h/4fh Debugger installation check (code 05
0 j+ {1 ?8 n3 `& 06) but very limited because it's only available for Win95/98 (not NT)6 ?% W! m! R* O) y
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
0 ^( |% A* V' z$ y! W, `
! @) k$ ^% e( ^, J+ R$ y7 Y push 0000004fh ; function 4fh
! J* v+ j# I; Y5 Z push 002a002ah ; high word specifies which VxD (VWIN32)
8 Y5 u1 h# V$ D- S+ N+ h; _5 z ; low word specifies which service5 k' l8 h [' E- O5 u& H
(VWIN32_Int41Dispatch)6 Y# s' {& T% U
call Kernel32!ORD_001 ; VxdCall8 ?( z% d$ }4 |1 G8 ~
cmp ax, 0f386h ; magic number returned by system debuggers
# `( A1 @; j( L0 w+ ~/ h5 P- x9 o jz SoftICE_detected
' j) E3 _4 N0 N( O7 g2 R3 T: }2 E# U% G# |+ C+ k7 B1 T
Here again, several ways to detect it:
# c# U$ L& i+ H; o# j2 g* b8 N! r# }6 s$ G
BPINT 41 if ax==4f
0 Y% N& m( L G. i) k/ G; {1 D& w3 _" ~' U9 g
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
: p' f2 d5 l* m0 O
+ Y0 C }; x) q8 c) v: b" O3 @ BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A. F+ j! R4 e% N; \0 I) h+ m4 R
0 U8 G# x2 S3 `+ Q
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!- o# V- I/ \# d O# x f: p
4 A( f+ d$ q" i- k( }3 \9 w3 k
__________________________________________________________________________
+ [, W: h L7 u" q J$ U: s; S: `( ?: M- a+ E) N o
Method 13
9 G, ^6 V$ X+ o$ \1 M1 L. X=========( w8 g; g K& n7 K
0 I. d+ {4 y4 {9 r
Not a real method of detection, but a good way to know if SoftICE is0 G8 ]: Q s- U( `) ^9 ~3 r8 I
installed on a computer and to locate its installation directory.
$ A9 l% ?4 g( Q" c8 N0 _2 _It is used by few softs which access the following registry keys (usually #2) :
' _! U; o% l# e' S( p- M5 U
+ i7 f+ X. _- z9 m$ q6 K1 V-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion8 r* L5 t! }1 w4 d- B9 t% M% Y
\Uninstall\SoftICE% N6 J; `# P2 P3 |
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE1 m0 ?4 H0 p! i6 b8 ]1 k3 _
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
# S: v7 Y, s: m% X- y\App Paths\Loader32.Exe9 C! {( ~4 G |& ]) J
/ y- N1 K& V, Q& n
- R% H% r- b% ]' aNote that some nasty apps could then erase all files from SoftICE directory
6 [2 G( d6 g- k7 S3 ^(I faced that once :-(
! w2 y* L- W6 q' F q) n9 \) W0 a$ [$ s% S! {- I. h
Useful breakpoint to detect it:" C6 v$ F% O: _1 b- f
% M2 P2 x+ Z9 `8 k- ` BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'/ T4 N& u5 b5 D0 ~
7 Q( I; @0 M) A) L# }__________________________________________________________________________! c$ D) [6 M& }4 o9 W
! z6 @3 `6 b) k8 k2 R& B {4 u# p- k, ~' U$ ~
Method 14 9 b$ j3 h$ `& ~ ~9 Y3 u( e
=========
8 i( I6 l1 B' d# M X: k' a9 |8 B5 T- b; J$ ^8 q( O _
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose! |2 U0 }& z( ?0 K; h4 ~2 z" M6 \. z. o7 O
is to determines whether a debugger is running on your system (ring0 only).! ~ [8 @& Q' l/ \
, |- g1 W3 F" W& O/ y1 T$ J/ j
VMMCall Test_Debug_Installed' s4 |& X6 b' H% _' b9 W3 R" t: O! A
je not_installed `; w$ I9 b' d( O/ f. K
- D& h# v" z3 l0 V
This service just checks a flag.
1 v, K. e! J4 ?: l</PRE></TD></TR></TBODY></TABLE> |