<TABLE width=500>
% \& s* `# s6 i( [" J2 u( }9 N<TBODY>
7 k8 [7 p# @# v" n( W. L<TR>
1 d# f$ s, R. [7 ~8 L& y: o<TD><PRE>Method 01 ( F4 I, l- @ t' @) H, W$ q
=========5 o0 b: a) O) D C1 U3 V
! M; q% H! f/ _8 oThis method of detection of SoftICE (as well as the following one) is
& E; r% I5 D, X# u- qused by the majority of packers/encryptors found on Internet.
u7 g" _6 q4 `- P, n5 p" A" sIt seeks the signature of BoundsChecker in SoftICE: Y; @: M* @2 @# g$ g1 J) f: j
2 @2 x7 l" H7 N% F3 K mov ebp, 04243484Bh ; 'BCHK'6 U2 |( J. D" z. T
mov ax, 04h
: [0 I7 V1 @7 ] int 3 " D, b# @5 @5 @- D! [: c" {
cmp al,4+ n0 {0 ]# ~( o. a6 l
jnz SoftICE_Detected: A2 x6 b0 c9 Q
* |4 `& M0 B0 g
___________________________________________________________________________
4 Y* g4 b5 r4 a. X/ l2 I) _/ ~
7 d3 F U. _6 N K# A6 H+ J! jMethod 02( q7 \1 t8 _% M* g. l2 p
=========
! b: v& H( y( H2 w6 ^3 G' |6 A& l. W4 {0 n! c
Still a method very much used (perhaps the most frequent one). It is used: c# s9 X2 x! s9 K% X
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
6 u. H9 d* v4 m: o- ]* b* Sor execute SoftICE commands...
% z3 V2 n/ U( j+ sIt is also used to crash SoftICE and to force it to execute any commands
/ ~* j P' j( d(HBOOT...) :-(( & k( A, |: L! T$ i6 [3 o
- H# s G3 Q2 G/ b( ^! Q; _
Here is a quick description:
3 j. U' z1 ~$ \: p( z5 [-AX = 0910h (Display string in SIce windows)+ a& w2 x. n* x; i5 p
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
- G* e4 N3 J6 V* C3 A' T2 @5 H-AX = 0912h (Get breakpoint infos): e0 q0 m: o. ^! w' k$ h' G9 i
-AX = 0913h (Set Sice breakpoints)
6 K5 ]1 l4 g9 M1 Q-AX = 0914h (Remove SIce breakoints)$ X% n3 R: G1 C C
0 a: [5 v0 s3 [$ s( E4 c" @Each time you'll meet this trick, you'll see:
0 A: A9 ?7 _/ q& F z/ I+ O n( q2 W-SI = 4647h
+ S0 Y$ f8 I* s4 Q# I: n-DI = 4A4Dh
' l' x! \6 |( v6 B- j, H/ @8 \Which are the 'magic values' used by SoftIce.
, Q) V, a2 ^- h- r/ eFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
' S- H* f( F( S- X! ]6 b5 y/ ] c, j) O5 u" M3 x. i# J _( z
Here is one example from the file "Haspinst.exe" which is the dongle HASP" t, g4 z/ A4 Z, j4 N- m
Envelope utility use to protect DOS applications:
0 J2 P7 T! T: {4 Q! s
" D# C% W0 o/ v, S3 ~! B
9 O. _" {: U" b$ a) L6 ^5 c0 k4C19:0095 MOV AX,0911 ; execute command.) H' L7 P' U: i( \0 n8 M
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).: E& j* [. _) r2 _( A
4C19:009A MOV SI,4647 ; 1st magic value.1 Q/ Q4 V2 Z) x( ?# ^9 ?
4C19:009D MOV DI,4A4D ; 2nd magic value.
" }9 f: x8 v# @0 ?( ]* F4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)4 F, t3 V) X* m9 P$ R
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
$ J) l5 P9 W* u% M4C19:00A4 INC CX9 r4 c' U0 y1 z; m* w
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
9 p2 F* k$ ~( e6 M4C19:00A8 JB 0095 ; 6 different commands.4 ^% [- [- l3 @
4C19:00AA JMP 0002 ; Bad_Guy jmp back.- w% C9 Y4 ]7 q
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
6 ^- L% {% l8 f; k$ q$ d" t
/ \- G8 @' X6 Y) D$ a/ P6 E- U. d- ~The program will execute 6 different SIce commands located at ds:dx, which) G7 p: x e$ v& L
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
& v7 ]+ ]: x+ @$ K! z/ w$ Z+ E
! O# J5 i6 L5 D" k; q' ]; @1 u* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded. I/ W, J6 Z. {2 a& V% D
___________________________________________________________________________9 q. L: n) }* ^7 Q7 h
& S7 J L$ n; f& `; M
8 `8 I6 f8 N* M+ R/ EMethod 03
, Z: i h: t% E" g4 j! @=========
* Z( S7 u X0 X. l0 \" j+ Y; ?$ ^
9 o; u' q/ H+ M7 E0 B0 K9 dLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
. J6 v8 @1 d3 ?# t& \! e(API Get entry point)0 h2 j# h0 h9 C' M2 R- ]7 X& M
, Y ^+ d: k1 }
8 j( l" Y$ D* E; a2 C6 ^ xor di,di+ J% V" k: `% N' p
mov es,di: u6 H7 s9 l% R" j7 l3 s7 |
mov ax, 1684h
/ P. ^. U% }* L1 B% @" s mov bx, 0202h ; VxD ID of winice( r& V1 l' g0 N+ n6 j5 y
int 2Fh
' M" k- y# Q* l: L, E' ^8 e6 q4 O mov ax, es ; ES:DI -> VxD API entry point
; Y' T6 ^- T$ }" R4 B" N& D add ax, di! T" t. P3 s9 S
test ax,ax
% C; H1 N* S+ n8 q jnz SoftICE_Detected
+ f) ], ~( @4 t; ]" }! D; J1 M: R8 c) ]8 c6 u m Q' e
___________________________________________________________________________
# g7 C7 \$ a: `: h$ }
# y! Z$ X; s' r; {$ [8 ?4 |" TMethod 04
$ t2 d% O" v5 @/ j1 F9 i=========
# n8 B7 K) w$ P) J4 o7 u3 e0 ]8 E4 a3 s' ]2 G$ N
Method identical to the preceding one except that it seeks the ID of SoftICE9 @/ w; q$ ]$ A7 _- ~" u7 ?
GFX VxD.+ d5 i# w, D5 A
4 S" f2 v8 F0 b" T; D+ s9 t3 |
xor di,di
8 j* P; Z" Q; A mov es,di$ L9 w9 O. J7 b1 v" m
mov ax, 1684h + ~1 }7 d/ v+ m% w4 ]5 M7 X
mov bx, 7a5Fh ; VxD ID of SIWVID7 [1 b- z7 C( M U
int 2fh
! T$ @0 ^% Y1 U$ ~1 i mov ax, es ; ES:DI -> VxD API entry point: t- ~5 _; u) |
add ax, di/ ?9 F9 i3 t7 m8 Z; y2 }. _/ f9 \6 f
test ax,ax
4 H- I: \) R6 x0 Z+ x jnz SoftICE_Detected
) s: J+ \9 h, |( T! m. G. e: R
) B& Y" ?4 r8 R9 }& {% f__________________________________________________________________________
' s# K( i1 M& \1 M
l$ Y& T* c! B' O0 {' e
/ F4 l7 w+ W( x+ K* AMethod 05
# U0 h' A/ G/ `=========- D& W/ {! ^' ]
. u6 x' t4 A5 Q3 o5 N
Method seeking the 'magic number' 0F386h returned (in ax) by all system
( M' M; `' m( S( t1 T1 ]debugger. It calls the int 41h, function 4Fh.
5 q8 T [5 P' N( _8 wThere are several alternatives. 3 U `1 b, Q7 s2 t
" ]/ p9 z, Q" J. K7 r* ^The following one is the simplest:, @: a% F! @( A# q s
" s) [1 H6 a; i4 C. O4 G mov ax,4fh
# U* b8 ?5 O" e& s; k$ n1 { int 41h, K4 ]( G/ X5 g4 o
cmp ax, 0F386 _9 b4 f+ O& ^; M: j5 U' R
jz SoftICE_detected1 q( G, h3 [% @# E$ X [
4 [4 T$ `0 Q; p
5 m5 |2 R5 x) z# @" E) nNext method as well as the following one are 2 examples from Stone's . t& ?$ O/ C2 ^: g, W9 b* b
"stn-wid.zip" (www.cracking.net):
; x7 @, i `% O
8 e- S3 ^% z$ d+ `* S mov bx, cs
$ G+ u0 C6 q0 A3 X) s; O/ p lea dx, int41handler2% G" b$ U7 ^0 [+ G" y1 [
xchg dx, es:[41h*4]
! r' J. Q! H% `' @6 u& {7 K xchg bx, es:[41h*4+2]
% f$ J* @4 ~$ n. d3 q5 [ mov ax,4fh. n* |$ R. T5 {5 ^
int 41h
; u; g8 S& o& L# e# D. A xchg dx, es:[41h*4]7 N2 h& ]+ x& w6 V& E
xchg bx, es:[41h*4+2]+ ~" T2 j5 y- C2 ^
cmp ax, 0f386h
6 |% {) y# k9 ?4 E0 I. f jz SoftICE_detected
* h, b$ O) j) W! C) S9 h5 H) U# o+ y) }+ l, ~3 c, A. g+ h) q" G
int41handler2 PROC) R- Q% s5 q. ]8 _
iret; K# M/ v; ]+ t4 e) H7 f5 b
int41handler2 ENDP
6 d& R, k/ E8 {4 M7 d: {6 n( W" C
! ^: K+ o" f x2 K5 \0 c3 A4 A. T6 H5 V% Z
2 z# q/ |9 P. {: \_________________________________________________________________________
) B; _+ }" p# N* {2 ?# @* I; C7 [9 v$ T" u5 o) T
# c2 J" a9 a$ S$ b z2 p* RMethod 06
7 _7 Z0 F/ T3 F- r" _& g7 q% H=========( |7 w B& {2 r6 ?
+ E6 R1 }, r! C. `" T# R9 L$ P P. m* t2 F8 g" P
2nd method similar to the preceding one but more difficult to detect:
5 S- E# D1 T# B' N9 j9 v3 g6 \) v+ h; q- I k
9 C1 T5 d8 K5 [+ J& K, N4 p
int41handler PROC, G) A6 R9 p2 n0 Y9 U8 `
mov cl,al! W3 ]3 a3 f3 t' Z7 i
iret1 Y* b0 b$ o( u
int41handler ENDP, @# Z6 A7 J; J2 | e5 Y& q
2 ~' {. E W1 R: H9 L
6 f! T+ \& Q7 S4 ^2 V/ i" W xor ax,ax7 U% t2 j( E* r* c" p
mov es,ax
! Q% O# M. M, m9 ~ mov bx, cs1 J$ C( @+ D$ k2 @# T
lea dx, int41handler
! V0 K/ R7 _5 O8 _ xchg dx, es:[41h*4]
* ?' F: b ?( G7 c6 @ xchg bx, es:[41h*4+2]
9 ^7 J8 ?% l: h in al, 40h
$ {' a8 N2 C" [5 L) f+ `) B6 x xor cx,cx
9 l- n H3 i, L, e. T9 o9 l int 41h, ?7 c$ X6 n( B0 F9 [
xchg dx, es:[41h*4]
1 H/ n: _; K5 N+ j8 R8 C+ r xchg bx, es:[41h*4+2]
6 {4 R4 W9 M1 D cmp cl,al! ~3 {) e M* Z
jnz SoftICE_detected/ \( Y7 G; f# I' o
; S, x8 {, J8 h_________________________________________________________________________
0 [$ a* o: S1 M/ U1 U
& Y; l, m% f2 y* ^# Z/ uMethod 07
* {2 x# T5 _; y6 I2 }=========
' U) l, \% Q+ G( k5 z# O5 a1 T" ?1 N; ?( g: B
Method of detection of the WinICE handler in the int68h (V86) u2 ~- Z% q/ _: n8 w9 Y s7 d
& _) w: j; D. M+ z" Z! c
mov ah,43h1 p2 b& X* }& W( n3 W+ W
int 68h+ B+ p) X. C2 T
cmp ax,0F386h
/ }, g9 F: n, ] jz SoftICE_Detected& G T' B0 b2 ]9 O, E* o& V
: l. c/ F2 U; @( j& H* q$ [1 h6 j( |+ ^: k
, G( P+ ]3 }; S=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
" D4 k; z( }3 _6 M/ s app like this:5 I" Y; |+ j) ]$ g" K3 g
4 d c$ G3 e1 e" C2 c0 y BPX exec_int if ax==68* \; ]- ]' a: V# b
(function called is located at byte ptr [ebp+1Dh] and client eip is
- v# Z8 n; _/ f8 q# U located at [ebp+48h] for 32Bit apps)
+ n1 ?8 [. S5 X- ^__________________________________________________________________________
$ q2 _' w+ x S. s# S+ K
7 h8 _) Q& n, c4 J4 K) C3 A+ N- u! c( c/ H! n1 R; q
Method 08
7 N1 Q4 t0 t0 L2 T2 r=========
* g) v: @0 P: w6 b# o
! }; ~. |4 ?# S( l2 F3 i3 A2 xIt is not a method of detection of SoftICE but a possibility to crash the6 }: M$ W, ]8 [, v3 l6 Y1 K; g
system by intercepting int 01h and int 03h and redirecting them to another: ]5 N D* q2 ^
routine.
] v: R8 [! X- v" `0 h3 y# eIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points) ^0 }6 s6 Q, c. a
to the new routine to execute (hangs computer...)* j. V z P9 I3 a1 j0 \
" y: G) _' g& |7 v% P; q G
mov ah, 25h
' t6 O; g+ D2 `) t) g) y mov al, Int_Number (01h or 03h)
- H1 _( f9 k- E9 l; c7 Q mov dx, offset New_Int_Routine
% a- x7 z7 `1 K1 E% ] int 21h
$ y' n! P0 m3 P2 A4 o9 |% w+ f" M, L1 q# r; M( c$ Q/ [$ N" p& V
__________________________________________________________________________* c' H8 K' e& X& q$ s
; G9 t+ D+ E9 n' J6 `7 }/ L
Method 099 s$ P& j# n* k/ R
=========6 [. ?9 m. V- ^6 h
F. E' X; ^, \3 U" \1 M- uThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
' ^$ s& M7 e V/ y+ qperformed in ring0 (VxD or a ring3 app using the VxdCall).$ G. d# P& y$ v- c: G
The Get_DDB service is used to determine whether or not a VxD is installed
* w' A% M, t# ~' u- q8 Cfor the specified device and returns a Device Description Block (in ecx) for. r# a; t0 J- f
that device if it is installed.
/ o7 f2 |. R" Y" x, T- o, Z2 c1 c& c2 X# A) U4 [
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
2 {& ^+ u$ p4 B; R" Z) H( ]6 a mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
4 ]) _- J) {7 s; _% c VMMCall Get_DDB
& p% o0 f' r9 U+ R/ H mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
! f# t: ^( N s* u# k5 A
" a5 ^) q- e3 C+ f0 rNote as well that you can easily detect this method with SoftICE:
0 _8 `0 G9 S! ]( b: B0 a) X5 O bpx Get_DDB if ax==0202 || ax==7a5fh7 f* O3 W$ ~5 D4 R+ q( D
7 ^, O( w$ _: i+ @4 r% X__________________________________________________________________________
8 C) |/ L8 `0 w
c; d1 }- P' F& f# @Method 10* a3 c" V$ u2 D" g0 i
=========3 p! C: B, U8 w3 X
' E' u0 Z1 J% g( Q/ G=>Disable or clear breakpoints before using this feature. DO NOT trace with: H: y+ m) `" Z: B% l, m
SoftICE while the option is enable!!
! p* B3 D5 H9 i$ l9 f( j4 U! d7 T0 ^! A2 L. q w3 g" B
This trick is very efficient:
8 [, ^1 u( R d& c5 j! Rby checking the Debug Registers, you can detect if SoftICE is loaded
% Y2 Z+ s5 D' ?: T) P(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if4 u! ]% H$ V9 }3 G- a
there are some memory breakpoints set (dr0 to dr3) simply by reading their
I. `6 q7 V% d9 ^' N. n4 Gvalue (in ring0 only). Values can be manipulated and or changed as well
2 e- ^* D; h6 h- l(clearing BPMs for instance)
) ?* x/ T5 j: g& y2 I' ]
% y6 ?! \$ E$ W! |* [9 C__________________________________________________________________________
* [3 i9 s# M( U5 I9 B
; E g' R" t: T3 I8 `& _Method 11
/ N+ R+ I2 r* n* U=========. u; m6 ?, c# O6 E4 R
/ n5 P& W2 `% I+ D2 P
This method is most known as 'MeltICE' because it has been freely distributed- x9 L# c8 v: j* E
via www.winfiles.com. However it was first used by NuMega people to allow6 ] P& J+ M- m6 Z2 @
Symbol Loader to check if SoftICE was active or not (the code is located% \+ b. E: g9 Y- W
inside nmtrans.dll).
3 i3 }2 }" {" D5 r" \ l" ?7 {9 O- ^$ z/ Y
The way it works is very simple:+ ]7 o) N0 o" f. p
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
5 v1 _2 S2 R5 W8 c: U* v( b1 {WinNT) with the CreateFileA API.
$ v3 w/ Y, U* i- T
) o& d. T- D- ~" S qHere is a sample (checking for 'SICE'):
0 n7 c. I* P9 v5 u4 o) C' H$ g' a8 h' z' i! U7 T/ \+ s$ Q: {
BOOL IsSoftIce95Loaded()
4 g' i9 Z: m( _1 z7 |{
; k, m6 n9 V( P: r9 ^ HANDLE hFile; f) T* {+ A5 _" f1 `( `5 M
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,7 U" t" n; F. m1 b! P6 _7 V% K" Q) m5 _
FILE_SHARE_READ | FILE_SHARE_WRITE,* H+ {! |' l: K4 j, T( d! i
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
# @2 i! ~7 P! O* k% k if( hFile != INVALID_HANDLE_VALUE )7 M! Q9 o& R6 q9 g4 T, O
{; L% e) C G& m7 ~/ y& t/ W5 l
CloseHandle(hFile);
& ^' g0 b1 v9 z; f' w" ~/ f' x+ }2 U return TRUE;
# v2 k# R# r0 @ }8 W2 ^8 C" B }3 f; {7 R& G1 p
return FALSE;+ `8 I" L W! O9 o8 F; n, `& C6 P% o
}
' n* Y) ~8 U6 h( e6 j# ^7 O
# v" [: { J1 iAlthough this trick calls the CreateFileA function, don't even expect to be: K# C# i8 A+ C* ^4 r0 o' ^- V
able to intercept it by installing a IFS hook: it will not work, no way!7 z5 o7 \9 b& U- W% K# _
In fact, after the call to CreateFileA it will get through VWIN32 0x001F# p% x, w- P& E' e" M- ]
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)* Y L# b5 N7 g; d2 c! S9 y
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
6 e4 |3 S" z7 i: Q$ f5 Mfield.
% Y/ f2 x6 N" m. {In fact, its purpose is not to load/unload VxDs but only to send a
! Z) y% h" o' S6 }W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
$ z( Y0 E0 \# |" O j0 z qto the VxD Control_Dispatch proc (how the hell a shareware soft could try
- U' H" c) B [) t1 |; |to load/unload a non-dynamically loadable driver such as SoftICE ;-).. s! }% C1 Y+ P: T# S' ?6 H
If the VxD is loaded, it will always clear eax and the Carry flag to allow4 [, @. v7 G- V# `) ^' i
its handle to be opened and then, will be detected.1 q; t- e% |/ C
You can check that simply by hooking Winice.exe control proc entry point
, v3 ]; O* K& M: rwhile running MeltICE.9 p4 W, r1 }8 F7 H/ ^2 W
; N! r9 o& ~( W0 q5 W- c
8 j+ @8 g' o {- y 00401067: push 00402025 ; \\.\SICE# C) i1 `+ L% ^' l% L
0040106C: call CreateFileA
1 c$ p! y8 D" ?6 z" ] 00401071: cmp eax,-001# t2 \) y; P$ C) m9 N7 u e
00401074: je 00401091
7 ^+ o6 ^! I& c/ m }+ Y2 [# _& U2 O/ c& K9 C* y; ^3 ]- b
+ Y7 w' w+ v+ @, z9 \: iThere could be hundreds of BPX you could use to detect this trick.
( ^6 }4 W/ k, | n8 h-The most classical one is:2 @9 S, o. s# j
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||3 Y) x n" D j0 I; I- N. [3 B- \
*(esp->4+4)=='NTIC'
8 s. N4 c! y9 o
- t' w X! ]8 T2 t+ e-The most exotic ones (could be very slooooow :-(( }( `0 o" m# x: o
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') ( E, n* o+ a! G" z
;will break 3 times :-(4 |! x: B8 U1 @: W' [
. L3 U& b: z" ?( b' L2 |
-or (a bit) faster:
& G0 e. x% ?8 p9 F. W6 G2 r- Z BPINT 30 if (*edi=='SICE' || *edi=='SIWV')6 e* L9 l: W2 p) S" U: q, a! ?# K
! S+ Y% x0 E6 Q7 f, x3 H: g/ D BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' 0 |9 I' S+ l5 S O5 c3 j3 h5 D- N
;will break 3 times :-(! k: R4 w- _9 j" ~3 v6 G+ d$ Y$ x
, C& B5 K+ q3 A9 H6 ^$ O-Much faster:" y8 ^' B$ u2 g
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
! i# M ]% c& p9 S0 z
$ O8 A8 _0 b; L9 z- x* _Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
6 i! Z p& m, ?) H, K; `function to do the same job:
* v7 E$ x* Z6 l2 [5 h+ K, s0 p$ ?% t4 B) J2 n1 _ C6 G. q% M
push 00 ; OF_READ9 Y9 t# E7 `1 w! K: K$ q1 B
mov eax,[00656634] ; '\\.\SICE',0
b4 i8 S& {6 Q1 M push eax
: K+ s, c% q) N U# G call KERNEL32!_lopen
) U% o0 m2 a, [5 s inc eax" Y; D# N* y6 E9 D3 w X [( g) E
jnz 00650589 ; detected" j6 Z" `) h' O
push 00 ; OF_READ/ b5 J* s. m. ]; w$ r! S
mov eax,[00656638] ; '\\.\SICE'9 [% q- D. y7 o
push eax/ U# v& |4 {$ J% k; O1 g- \
call KERNEL32!_lopen
) s% T' T- U( d+ Z; [5 i inc eax5 {# y" N; L/ C1 s. L
jz 006505ae ; not detected$ C4 }9 m1 ~4 P9 F
/ D, m$ n3 U( }4 g$ ]3 @% m. K: P9 _2 e( i- U0 v6 l
__________________________________________________________________________
; C0 l3 J R1 \& r1 I
. A1 u( Y0 ^ c& B& k( U( e" b+ }Method 12
9 L6 g" A. S3 Y% s# |" X' Q4 I0 X=========5 r+ Q( G" H* w" X8 d3 l
4 s- m* h; n- {6 e( p# qThis trick is similar to int41h/4fh Debugger installation check (code 05
% X) _/ o1 q6 ^% t8 z `& 06) but very limited because it's only available for Win95/98 (not NT)+ W/ U/ _# @# o, W7 E/ s
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.' b1 a$ n* L1 g/ f2 _2 p/ V, `
) \" p$ Q1 k2 ]0 E* m o+ @. f
push 0000004fh ; function 4fh2 W8 T; X* ~* m( {4 \6 X% \
push 002a002ah ; high word specifies which VxD (VWIN32)+ Q K' `* B3 B7 X3 h" F
; low word specifies which service
$ M9 j3 W( _* `' {) t (VWIN32_Int41Dispatch)- N& |, z+ L" {5 g: E) Q
call Kernel32!ORD_001 ; VxdCall
b/ i& c4 A4 p z0 w cmp ax, 0f386h ; magic number returned by system debuggers, r+ Z3 ~8 y9 z; f- ~2 R; M1 y
jz SoftICE_detected. m* k3 }8 E: {9 G
+ l, p# r; {+ P5 w
Here again, several ways to detect it:2 T" S+ F9 E% Z& Q; o
5 G1 g- V+ G( u- b8 p2 o- |
BPINT 41 if ax==4f
# j3 S8 H# i4 Q9 Q! ]# |# O; C' z6 a, a# i) N6 i
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
( Z4 J$ }" o5 Q# F3 E
; S x' o0 i. Z9 U2 p' i BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A8 R' C6 O! q( |. a: Y: G$ o8 @3 W
/ H7 T8 f4 m* y9 p6 Q* [( V+ X8 [
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!9 d" ?! q) Z. L6 Q2 a
9 e5 B& |8 z( Q, A0 P2 Z__________________________________________________________________________* f7 E' S& U" Q; H) n- w) ?
2 A! }, ~3 O+ x+ R7 H* QMethod 13
( E1 q/ L; |( H( M! Y7 X=========
" p1 f& |/ `( W5 i
) g3 F- R; ^: @( w, @Not a real method of detection, but a good way to know if SoftICE is
: w4 ?% u+ e* {( k1 W8 _. Iinstalled on a computer and to locate its installation directory.
' g* h& Y# D3 Z/ R. g6 bIt is used by few softs which access the following registry keys (usually #2) :. [3 p; i6 [2 E `
. O# ?7 x; v. z) H) H-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
( C2 F5 i3 C7 N. S/ H\Uninstall\SoftICE
4 n: P0 W0 c) w6 ~0 j-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE" ~: ^: x; b$ E
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion6 Z! j* q; `8 N, i8 a
\App Paths\Loader32.Exe
/ j3 _1 v# Y' w/ J; K" z G3 h) s
9 `5 E( g2 J# s8 ~5 e- B& E8 K$ z) |3 H- R$ I0 V7 f
Note that some nasty apps could then erase all files from SoftICE directory
! m2 L; L6 {. l y! L4 \& b) k(I faced that once :-(
# {0 ^, N4 S3 h6 w
% \$ \" W! [7 u0 y6 J9 \Useful breakpoint to detect it:
Z' `% U% J: u' _4 D) R
8 O% G% T1 y0 p5 ~. Z BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'8 A5 _4 z( Z4 g# S
9 B: w$ Y* [2 ~ ?+ [) K0 h5 O__________________________________________________________________________( R/ ]) f- H' b! |$ ]: ?
* D g: d) J) Z+ N" v$ C( z& Z/ Z, o( ]
Method 14 * |8 z4 s9 k/ T
=========% Y2 a& p4 u' M* c
/ A/ V% W8 k. H S1 l* _A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose7 b4 f. I% y" N
is to determines whether a debugger is running on your system (ring0 only).
* A' u4 p, s& ~- X% D6 z- D6 O/ R( k) w" i, h
VMMCall Test_Debug_Installed+ K# ]) f% o5 \$ ^3 y
je not_installed
$ Q; B8 I& a5 H+ |* p; Y
% Q4 z( p6 N2 h8 XThis service just checks a flag.- @( c; d2 d2 `0 q
</PRE></TD></TR></TBODY></TABLE> |