<TABLE width=500>
& s5 v$ X: ?& S3 S<TBODY>
2 j, ^; r' j- V; Y: C<TR>* w" Q* [. p6 e( n8 W3 u; I
<TD><PRE>Method 01 . D! \2 e- o3 m3 J% ]3 C, e
=========0 \" {/ y& T% B B4 S
; a+ n9 i; x5 O
This method of detection of SoftICE (as well as the following one) is$ v# w0 k" W$ ?/ G1 @: R$ f
used by the majority of packers/encryptors found on Internet.
8 U5 u# O9 e" j) Q0 ~5 ^9 dIt seeks the signature of BoundsChecker in SoftICE
6 Z& k! q% }3 [8 e$ T. L8 R$ K6 Z
2 {3 t ^, a. I4 H- V5 u mov ebp, 04243484Bh ; 'BCHK'- `4 T$ [$ M9 Y! D
mov ax, 04h3 [1 a8 Y7 t! ^( t( S! v) C; j
int 3 ) F3 P! u$ R& v. j: J, t
cmp al,40 `; x& |* i. e* A$ h! Q" X3 [
jnz SoftICE_Detected7 v5 ]6 e9 d8 `( J: p# C$ x
3 f% ^! P: v! I. R, R* ~& B! l/ U9 o, f___________________________________________________________________________
$ F% Q: J9 F% }9 H0 s$ x( ?0 Z* S7 G- |' I' M
Method 02
; C8 A2 F2 ?) `7 c$ i=========
# a) e1 x8 w: V; ^6 c+ l0 A- \% F
8 t4 [* j7 M! ~' Z6 u0 f6 LStill a method very much used (perhaps the most frequent one). It is used
1 N, p& a8 p, D/ t. o6 Tto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
9 {- Z/ p/ @ T: J. Bor execute SoftICE commands...
* d( X( q& @! _' s7 j0 NIt is also used to crash SoftICE and to force it to execute any commands: o0 `0 ?6 b3 {; h& h
(HBOOT...) :-(( ' A! k" _$ b0 I+ u9 O) d( j
/ @. c _3 i9 T
Here is a quick description:
. K4 L9 g* O8 I-AX = 0910h (Display string in SIce windows)8 Z& C; [2 s; R
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
: U5 J* a1 w# b1 W; y-AX = 0912h (Get breakpoint infos)
3 G4 x B; w: z' m7 i( z-AX = 0913h (Set Sice breakpoints)
0 r- F4 \5 U- L) ^-AX = 0914h (Remove SIce breakoints)
% }- q! ~, E1 T6 p# S- ` I) p6 y3 g; i5 |, E& A$ ]! A
Each time you'll meet this trick, you'll see:
, _( X5 `. W: d' p0 g-SI = 4647h
$ w0 V. b) O3 U9 d! u( R-DI = 4A4Dh9 S5 u0 F1 u% W, \$ g( _! w
Which are the 'magic values' used by SoftIce.
4 t+ p- e/ y( A0 `+ ^3 DFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.0 m: ~1 f$ i7 {6 p/ [
1 L p! S; B7 C0 l' A* ?Here is one example from the file "Haspinst.exe" which is the dongle HASP
5 B( `: t# K$ M5 }Envelope utility use to protect DOS applications:
- r* P' r% K- M3 l
& c" N# a! s! _- @& ]7 K8 R1 {
; ^5 a2 [+ x9 [& L% I9 G. o2 f4C19:0095 MOV AX,0911 ; execute command.* u0 y4 b3 _) o
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
+ d6 n4 n5 l, L% n8 N! P+ r8 a$ S4C19:009A MOV SI,4647 ; 1st magic value.
. o5 a. i* E& n8 @( M# ^% @, y" |4C19:009D MOV DI,4A4D ; 2nd magic value.
! S+ |, t8 Z3 g1 o7 @* n' Y6 f4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
- g9 y; i0 x; w4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute" O- `' O- Z+ H2 ~. {. q( _; V
4C19:00A4 INC CX
" g7 K9 s; z7 k- L7 A: B) n' b4C19:00A5 CMP CX,06 ; Repeat 6 times to execute/ l3 q c3 N9 q: |5 ?: ]
4C19:00A8 JB 0095 ; 6 different commands.
1 o# P: u' E% o4C19:00AA JMP 0002 ; Bad_Guy jmp back.1 C7 B% x) R# x% ^* S5 b6 Y
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
1 z1 N8 T) s( k7 `' U" v! p4 W! K: D9 M1 N. ^+ x/ \$ o- y: }9 _
The program will execute 6 different SIce commands located at ds:dx, which2 S" F& B, u2 F5 S4 @$ F0 j0 D
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
; e; f& Y- r4 y" A
: v# u$ q* B( h2 l1 k3 B( I* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.! s" e* I! v. o+ |& O) S
___________________________________________________________________________% S& H: C9 n5 n/ @! C
0 S& ^& C5 B- b3 D. U
) ?2 d" I5 N. `0 j: y' ` TMethod 03
0 u% x1 F) R* }* |=========
, g* i8 _7 x& ?9 M$ H; _) E. s1 v, _6 q2 i
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h, b- V9 ]) n8 n" \- A. I/ I9 x3 Z
(API Get entry point)
' S9 b s4 ~6 {$ j" _9 B. p 3 Z9 u+ G6 j( x- C' _! y2 l4 g
) F/ @8 }/ n2 \3 T xor di,di
) \- A9 A! P1 y" G& n! ] mov es,di6 a# ~) p. i2 `
mov ax, 1684h
6 p1 R# j) y3 C' m mov bx, 0202h ; VxD ID of winice1 {2 e) b+ R6 |( U
int 2Fh8 Y) ?- q- J8 ~. o( D. v* z
mov ax, es ; ES:DI -> VxD API entry point( H. S& O4 v' H
add ax, di# r/ C1 Z. S6 |, W1 g" \' N; u1 R$ b
test ax,ax2 p9 B0 V% H9 N7 @
jnz SoftICE_Detected
, p# d1 n3 j; P, O8 }
0 F. D6 T0 \* x6 d- p( g___________________________________________________________________________
`# i, k/ _) x, P9 S* V
# r9 K( ? F* m/ @# rMethod 04
R5 e B' ~1 {! T T=========6 U7 L' L/ O4 ~4 E) }9 D! ]: x1 U
+ T& x: C' { ?* U: V4 |3 `
Method identical to the preceding one except that it seeks the ID of SoftICE7 e) l5 }: |, {
GFX VxD./ @2 h) q5 r6 k4 m
# }; a a# P& w1 ]: w xor di,di
" ~7 k h, g7 [9 W: [- R5 \$ J% n n mov es,di
0 |: N8 f" }. T5 x4 F- u mov ax, 1684h & O; Q/ k6 I( b: Z$ r# ^
mov bx, 7a5Fh ; VxD ID of SIWVID
- ~, G5 n! ]7 _ T# b( W int 2fh
; b9 V2 o+ U& y2 a mov ax, es ; ES:DI -> VxD API entry point s, g$ G! L$ n
add ax, di! @; x# v3 `6 D# M7 g
test ax,ax3 M o' `, K1 V
jnz SoftICE_Detected
1 [1 ]/ b% g5 s" n/ U* M
4 i# I1 Z$ l: g6 b& x+ X* n- g__________________________________________________________________________ `/ m- ^/ C T3 y3 |% s
S. @4 W- Q. B
. [- J! `1 Q- C% eMethod 05' U3 b' L* {3 s8 G5 x
=========! p8 G3 V& y' a5 j; j# n
# p4 b b% C0 d& DMethod seeking the 'magic number' 0F386h returned (in ax) by all system
5 b- z3 l+ R, o* F/ g) pdebugger. It calls the int 41h, function 4Fh. u) M/ y& V9 g( E
There are several alternatives. 0 s# Y! t9 a6 m# F1 o' Q
c) f% X7 O7 lThe following one is the simplest:
# I( [, D' |8 q3 c: v! g% d
* A5 Z& l3 U" n0 i' n mov ax,4fh3 P! A8 z$ W x& B( Y( Q9 L6 s( t
int 41h. w7 N; Q% i* N8 {
cmp ax, 0F386
8 F) _$ ^" \% H" o* [) l jz SoftICE_detected2 S6 M& ]# X5 e# P% X
* J: W6 N1 C# z( e( g: H
& w( Z3 B1 l0 s/ r; Q+ @$ c0 zNext method as well as the following one are 2 examples from Stone's ! Q" }7 Z/ G( a5 @4 a
"stn-wid.zip" (www.cracking.net):; C" F" P4 }9 J& E& v9 g5 B
) p; R5 g) M% h5 m# O0 h: S. V
mov bx, cs9 x* o. d4 @6 h, r
lea dx, int41handler2" B) v4 ~( z! \. T5 q$ F
xchg dx, es:[41h*4]( J2 n; H* S3 P8 X* f
xchg bx, es:[41h*4+2]
; p, R8 q v+ m m1 t- I" D mov ax,4fh$ [6 ]% v5 U6 b1 J) x7 Y% C
int 41h' |. h! f) b, I9 S
xchg dx, es:[41h*4]
2 @- J! u$ Q9 c. _% k xchg bx, es:[41h*4+2]$ q, L* V7 Z5 K& h8 z3 U7 ]
cmp ax, 0f386h
4 f3 V& }$ c! Y: W* Q5 B jz SoftICE_detected$ U o u. s, U: `7 [7 f
* X9 m' ^1 i! D# `$ A/ v
int41handler2 PROC6 f3 d( i! I( S8 m' b/ l! @! w
iret
# v# h, H7 A4 l% d. oint41handler2 ENDP/ }8 F9 S! O# q: V2 Z4 F2 d1 K/ h
, @ O' {/ m& J* o) N7 m B
4 Q- s* k% X2 R! m9 e+ b; h4 `
_________________________________________________________________________1 R8 U1 l2 F, X! O; d
" K! Q: T G5 F5 A" p* Y0 H
# T8 O1 w1 t" ~+ e3 D7 W( BMethod 06
8 T4 n6 x5 Q0 u1 ^( E; M) m6 u=========
! s7 p# a( m5 W8 T) r9 @- K5 G5 U" {6 _# o
$ P) V6 `+ Y7 l+ F# h6 U7 l& w# j8 k9 p7 g
2nd method similar to the preceding one but more difficult to detect:
6 I5 q, Z- Q& \& j- C6 F
8 [4 ?0 l7 c9 \) J
) i( y0 k9 A% N; U/ Cint41handler PROC) w9 Q& ?/ \: [% A; m1 q
mov cl,al
, X4 n# }8 U( Y& {9 N) M3 O" h: Y1 z! P iret
% j. r1 d" ]4 F; \5 Sint41handler ENDP
" E& A5 L+ c5 |( ?5 r- e$ n; w7 x" f% O' i: n# d
6 I4 U8 @3 r# H) X: Y1 j1 d xor ax,ax
& [3 p9 F4 Y1 w mov es,ax
# M( e; |: T! ]+ P3 l. B mov bx, cs# ~7 [- g6 H6 S) k
lea dx, int41handler6 P* i9 R! e$ x: ^
xchg dx, es:[41h*4]$ y" U8 \; d& r4 z6 F
xchg bx, es:[41h*4+2]; M4 S6 E+ k6 C+ V: H7 ^
in al, 40h s" T) ?4 L/ f
xor cx,cx- P7 o3 q' j$ v4 J3 V: d9 x' U
int 41h
7 ]7 i. Z- {! b1 J" H! \- h5 A* }$ L xchg dx, es:[41h*4]
% `9 U& R" F; w xchg bx, es:[41h*4+2]
5 e" f' a- C+ | F! ]8 } cmp cl,al
8 H, f2 L7 r% q6 X4 n0 G% y jnz SoftICE_detected
3 S9 L2 _/ J3 i$ X6 b- w* }( f- X7 U6 v
_________________________________________________________________________: \( g( B& }7 [, l( p$ Q! G
! W& P8 R4 `; D8 @Method 07
. }9 Z) J3 }: u9 w, g. f# J, t=========# y* B2 e2 t+ @" ~' z
& {! D3 g: e* I" m& @* {! n8 b
Method of detection of the WinICE handler in the int68h (V86)( E. g/ C' P0 Z7 o8 d
8 T" s' K5 c$ H' u& D% T mov ah,43h
) h2 {: r' A% q4 W; J% H int 68h
9 d+ h& l/ r: @0 h. r cmp ax,0F386h
- ^" O U) R+ H' r; w- f: C jz SoftICE_Detected( t/ @9 c. v& Q' P
! ^! {3 @( g" E2 `8 P/ ^ j+ [
' V. H+ _: @- m; t: M5 [ R
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
& z7 t- S- j9 X) ~; }6 S7 P app like this:0 a" d' Z) f7 G3 U: n2 c
8 M1 O( e5 k, A. a! d
BPX exec_int if ax==68+ i7 J+ r/ G/ j( S q
(function called is located at byte ptr [ebp+1Dh] and client eip is* L- Q7 w' n% ?4 F
located at [ebp+48h] for 32Bit apps)& m1 c. K( ^: a, O4 \9 f% X7 }
__________________________________________________________________________+ j \: o; X' H4 s
- V2 {4 ~+ {2 ?: X4 o- Q6 _3 W% ^4 ]( b! X1 A$ S" n) s
Method 08( v- j. E% `5 l0 l
=========
2 k+ O( B9 ~# N0 }0 f8 u" i( H2 R& B% m' C! N* h! I
It is not a method of detection of SoftICE but a possibility to crash the
/ W S/ A/ G4 jsystem by intercepting int 01h and int 03h and redirecting them to another5 \& X& v2 k) R, ~% E" i! p
routine.# ~8 N# {* A9 b
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points% {; [4 ^$ P+ O- _
to the new routine to execute (hangs computer...) E1 a$ l4 c3 ^! q% w% O0 I
- F, o; G g7 s- V! D
mov ah, 25h
( z. F' J) A0 i& P$ S7 M mov al, Int_Number (01h or 03h)
) @# G6 Y/ ] W mov dx, offset New_Int_Routine# S! f1 L! v ?' u: B4 I
int 21h/ h) C' u+ q( A7 s, Z) |' d
4 w1 ^1 k+ v' j- C* X__________________________________________________________________________) d* \% Y+ {9 X( @: k4 O: f ^' j
. F. V I. u- q& N" w) v, f$ m( {
Method 09. q) k4 B/ n4 H. ]8 X/ ?% K
=========9 Q1 V, \9 X( M0 S2 \, k* I. g
8 a) C; O1 N% h% T: P4 a# s }This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
8 L. T" F- L- ^) h7 w+ k5 kperformed in ring0 (VxD or a ring3 app using the VxdCall).
5 r- k0 I/ [- R9 T7 N, Y$ JThe Get_DDB service is used to determine whether or not a VxD is installed$ n! B( M7 W( Q+ }8 v
for the specified device and returns a Device Description Block (in ecx) for. [$ | ]1 b1 j
that device if it is installed.( A0 F) x, M+ l
- u, O( f4 M& i+ s8 A) B mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
+ _) }) D$ V9 E mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)3 | I& G3 g6 l6 ]4 N4 x
VMMCall Get_DDB. S1 ~( n+ Q* G- H* @/ q$ V
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
, L( b' |6 d0 c- K; s
4 g2 d. ]" N; r7 V0 { [( ANote as well that you can easily detect this method with SoftICE:: u7 \) A* Q2 _2 J5 Z# {
bpx Get_DDB if ax==0202 || ax==7a5fh
9 g, ]$ v0 k2 T
* f+ X% a# e5 i$ u+ Z: x" K__________________________________________________________________________8 \. Y9 q: D3 x% {
% D% x8 e$ B" S) d" z
Method 10
: V( a; s( {5 g% D, k# Y2 U=========; t/ }6 j9 D+ t/ S+ w% E
8 l& ]+ o9 R! S; _, e& {7 t
=>Disable or clear breakpoints before using this feature. DO NOT trace with, F% q3 \+ `7 [
SoftICE while the option is enable!!6 l/ C+ C! Z8 O6 F) i4 N
5 O7 P4 D, J5 T" Y8 r* q/ U$ @- nThis trick is very efficient:
: f9 |. g4 {8 ? O# h! X) |, Rby checking the Debug Registers, you can detect if SoftICE is loaded
$ g, e* ?1 g' J S0 ]( t5 f(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
4 {" a) j3 z# Y- nthere are some memory breakpoints set (dr0 to dr3) simply by reading their3 V6 h# w+ B- @5 n9 D) f- W
value (in ring0 only). Values can be manipulated and or changed as well
/ J) x* |! ^5 u$ F(clearing BPMs for instance)
$ X6 S) J3 ?+ G: L b3 u8 ^& X; T% Z8 j' z9 o
__________________________________________________________________________% e! n% Z" ?) P( \# e
, O' K( n% H9 G
Method 11* I* x) ~5 F- G; d& H9 o
=========
; Z) ]' k- |7 u- V2 r2 ], [
: N4 W; H0 m9 K1 R& h! RThis method is most known as 'MeltICE' because it has been freely distributed
0 Y0 p: v# W0 ?: H. ^ hvia www.winfiles.com. However it was first used by NuMega people to allow
) |$ n) c' W/ U+ d& J+ SSymbol Loader to check if SoftICE was active or not (the code is located
1 O) m9 ^/ B7 y0 O0 b4 uinside nmtrans.dll).
6 v/ @/ {) S4 i3 W# H# a) K5 N, {; z w
7 y) J2 I/ A1 j- F# w M/ OThe way it works is very simple:4 P. l9 C" W% P# \& F
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
5 d1 @: u! o1 ]+ [$ sWinNT) with the CreateFileA API.5 u) d2 w9 o1 @
- r7 K8 G2 S' m/ oHere is a sample (checking for 'SICE'):
3 B+ \: I" @) _5 W4 s' S U/ J9 B1 l* ?1 l/ [
BOOL IsSoftIce95Loaded()
8 {! t5 K. L& g{
# w( C7 k O5 M. T HANDLE hFile; 2 q% `9 W" r- D! t' ^
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,. _! C9 ?6 ]: f9 J$ Q: v' y
FILE_SHARE_READ | FILE_SHARE_WRITE,
5 c1 B! \0 t" j ] NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
; D) a# x5 z9 C& Y& u if( hFile != INVALID_HANDLE_VALUE )5 P0 W5 O' z% C- N: q
{, `+ q6 a6 W. T2 d! n7 A
CloseHandle(hFile);; Y& ?* E/ z/ j+ }! V( c
return TRUE;
, d/ t9 L3 ~, o& F7 X) O3 e }
9 r0 u+ T t3 _6 x. Y return FALSE;8 q' K. J" J: m; A6 p8 b
}7 F/ p6 B+ e' D1 h- e* j/ A# ?
6 f w: w+ y ^0 {0 Z0 X
Although this trick calls the CreateFileA function, don't even expect to be5 I* e7 ~' t+ m& ]( h
able to intercept it by installing a IFS hook: it will not work, no way!
! h' f( a& p2 E) Z' G* cIn fact, after the call to CreateFileA it will get through VWIN32 0x001F- P( L- k& \5 g3 ~2 w
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)* A+ t8 _0 Q5 j
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
( i& N8 ~ ]7 v. ], a; qfield.
! j9 Y9 H) V% y0 r) A" RIn fact, its purpose is not to load/unload VxDs but only to send a 3 V0 X [& I) ^- L. c1 N
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
- ^* z% F! R" W' v( }2 _9 o' |to the VxD Control_Dispatch proc (how the hell a shareware soft could try
2 }' f/ U" H( S' I. S7 l) A! H( |to load/unload a non-dynamically loadable driver such as SoftICE ;-).
2 ~& Q) F4 r6 A. G: e0 G6 G' nIf the VxD is loaded, it will always clear eax and the Carry flag to allow" `% z7 ~* {# q, Q5 r
its handle to be opened and then, will be detected.
1 w6 y) G# H" _4 a* VYou can check that simply by hooking Winice.exe control proc entry point$ p: z# E, E$ `1 ^( y
while running MeltICE., Q& c' Y F. `4 ]
# H8 ^- a; M# r0 d5 V; ~* w. q3 f+ v
00401067: push 00402025 ; \\.\SICE
1 s' T' d( w% { C% V; H8 p 0040106C: call CreateFileA
2 h" u; m& P Z& @& v 00401071: cmp eax,-001/ P2 Z# E6 ~% }# S/ a! O2 h4 a; i
00401074: je 00401091
, X6 F3 G2 A8 Z4 ?3 s* W
- ]( I9 ?# y }5 A5 J5 k) ? v# _' v( q! U
There could be hundreds of BPX you could use to detect this trick.. E* E5 O. L8 L# _
-The most classical one is:
6 P, j: j5 M) o9 k W# n( g BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
/ f) ]0 v- f H0 U- y/ S3 G *(esp->4+4)=='NTIC'9 O; R4 d) r& w! v) [
" W4 Z" J4 ^1 X9 M# H* R
-The most exotic ones (could be very slooooow :-(
0 m4 P2 `: L4 x BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') 1 g8 b( D' P% X
;will break 3 times :-(
8 R7 B& a0 w5 Q- t( ~; q! {
" J3 ]/ ~6 e7 e }/ P-or (a bit) faster:
5 A$ U$ Z2 j; _* l" ~1 Q8 G! G BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
3 u7 x& ^( u+ _9 p: D: M' q! }2 Y- v& }& u+ e5 L
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
" \- {0 B- g" n; J" | ;will break 3 times :-(4 {! l, r( f6 t, }+ k5 ^( a' q8 {
: }$ N: ~8 N4 T-Much faster:& ]4 J5 g$ X6 g. ?/ B1 a
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'3 T9 U6 t. _" n6 [# ~5 ?5 H7 T0 w
" o1 c8 I0 {2 C6 `/ j; F& u( HNote also that some programs (like AZPR3.00) use de old 16-bit _lopen7 F. |3 L4 L& f+ k
function to do the same job:7 V; |5 H. O; R% @2 j U
1 j) X9 z. k, q, Y! S
push 00 ; OF_READ1 n, k/ F0 w: n3 q* t/ u
mov eax,[00656634] ; '\\.\SICE',0
. u% J. @! C w1 o7 x! W* W: b& w push eax7 V- k' B9 B! P( a' |( o. Q
call KERNEL32!_lopen# Y3 h. L& T3 r6 B) j/ `
inc eax
% v) c2 `+ D& Y jnz 00650589 ; detected
# P8 |6 [; [5 B. U+ o push 00 ; OF_READ0 \' i- u. h7 P3 F4 `: z: P6 m; {" B
mov eax,[00656638] ; '\\.\SICE'/ \5 h* ^+ D6 _& W% J- W- ~) \# J
push eax; K. X" K' ^4 g) t8 Q# I( [: J
call KERNEL32!_lopen
- \7 j0 M* J0 F" U inc eax; a' f% V# W( `" j3 y
jz 006505ae ; not detected. n; S- s7 p4 }
5 Q# W5 t, J" N4 D% v$ |
9 l" m5 I$ j6 @& `6 @__________________________________________________________________________
3 R5 @2 _4 S% x9 L6 B! T3 u& Y/ k7 B# `) p4 I, B
Method 12
& e+ l+ G2 H8 Z9 k& J& k9 K' z=========
, R; ~; v* S) K+ x3 V$ M" S$ [: c# @- R; R. ~+ L
This trick is similar to int41h/4fh Debugger installation check (code 056 u% q9 c+ N* m7 R
& 06) but very limited because it's only available for Win95/98 (not NT)# A' W P. B: Z* y9 u; m* h
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
7 [- }5 a+ E& \0 y; b( R# S- ]( t( x1 l
push 0000004fh ; function 4fh! i/ |9 l3 \3 E9 k9 i0 b2 R% N& N
push 002a002ah ; high word specifies which VxD (VWIN32)9 `* O$ q( U: R5 v8 n6 ]% X
; low word specifies which service$ C2 I; Y ]: i# f2 O9 H
(VWIN32_Int41Dispatch)
, d0 O, M$ u3 F7 k call Kernel32!ORD_001 ; VxdCall
+ N+ [: I9 T+ [0 b( S/ l4 C& [ cmp ax, 0f386h ; magic number returned by system debuggers8 s3 Q6 m4 y. p- {. a9 R
jz SoftICE_detected5 a) T- x* U' s9 j: T" V1 n
6 P5 x% c' S; S. m+ g1 {6 J4 U% jHere again, several ways to detect it:
5 m) \# {- ?- W0 u) `$ K1 O0 M y) b" y4 |) f9 Z f4 Y8 d
BPINT 41 if ax==4f
8 u- ~: I' {% C1 x0 w( Y; A( C3 v: z' k7 o6 r3 Z9 M9 \6 s- T
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one1 B: n8 |7 e! ~1 M# i( D
) |) c# X- v7 ?& k! s" _4 H
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
' |$ M8 D! u4 h6 |- X7 h, u
$ f1 o3 Q8 i8 D! g$ I BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
7 v5 _/ g0 S; P6 C% Z
3 B }# C, b8 P__________________________________________________________________________5 P6 G2 M, ^7 L U u& w; S+ ?
( g% z# ~! {; M# Y9 F$ c8 f% RMethod 13
3 v4 i! O {# s=========
; _# D, [8 z. T& T
9 t; J% ?: I# \: i# v4 u DNot a real method of detection, but a good way to know if SoftICE is5 q6 J4 i1 U8 _7 G* @! F
installed on a computer and to locate its installation directory., Z% ?7 Z, Y% Q/ F1 \" v$ Y2 z
It is used by few softs which access the following registry keys (usually #2) :8 M% R5 ]" H) K* v
; p! N# t5 U5 Y: E# J
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
( ~3 f+ ]# k+ D E+ K/ O\Uninstall\SoftICE& B$ x7 z0 E! G, s8 ^0 d4 H
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE" T c* E( b/ r+ S
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
* w, j+ m9 S' J8 h\App Paths\Loader32.Exe* a2 G6 U7 g% }2 H
: l& g) I8 O' X: {9 W) a: ~4 Z9 V: P
5 }- V+ X2 r0 Z9 FNote that some nasty apps could then erase all files from SoftICE directory: z) T% ^$ {8 t. [
(I faced that once :-(5 X3 T+ ~& ?' X" x2 z( h0 S
8 M0 G$ v2 E# |/ i/ D4 w- y l
Useful breakpoint to detect it:+ i9 b1 l7 a9 |" D
7 G5 ?' z- p u; Z& j+ @$ v& J
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE' i9 N4 ~: U* S3 _ {
7 R+ A$ Z$ O/ _, \) m__________________________________________________________________________
+ \( F6 ^5 ^- M" C8 y' w( M4 z: T6 f- h) O5 J! O; ]+ c( y) _
- f/ p$ k5 S& I3 f2 s0 A c, ^
Method 14 4 V* y2 p/ ?) {, _
=========3 D, K. w# \, @+ e0 \' x. B* H0 c: V
- n' \$ n% h9 @* z& f
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose' W9 o5 X! R" D3 H& y
is to determines whether a debugger is running on your system (ring0 only).2 _0 c t0 Y& {+ ^ F7 o4 ^
8 V( B. x) h: W- ^: _* F VMMCall Test_Debug_Installed$ w9 x* W, C3 `7 j
je not_installed# F4 t) M0 g% l/ U( A( h
/ i& S! R4 j, Y2 U
This service just checks a flag.
t6 K+ l$ e+ N3 Q" H</PRE></TD></TR></TBODY></TABLE> |