<TABLE width=500> w* D+ L0 c4 H/ F
<TBODY>
5 N6 e+ l+ E) y: N<TR>
6 l5 ^; R$ d+ [0 a; n6 x" `<TD><PRE>Method 01
/ F4 }& j% K& Q2 {=========7 x, I2 O' k. H! _: o8 r& c4 u+ D: m
! F p% d; B' O: R0 xThis method of detection of SoftICE (as well as the following one) is
, q2 }% G& Y( `used by the majority of packers/encryptors found on Internet.
. |$ R: `3 l" X; DIt seeks the signature of BoundsChecker in SoftICE) g2 y8 U$ U" _& [) \! ^
3 D+ d) y4 G3 Z& h
mov ebp, 04243484Bh ; 'BCHK'
* D1 p. m- y) R- A8 f# | mov ax, 04h, ~3 E# F& `6 ]1 Y' T: j
int 3 ( t, _( c7 |, H
cmp al,45 s. [$ K; k1 I0 V( P! N
jnz SoftICE_Detected/ b( V8 X: C/ I- p$ n z# \3 Z5 ?
: ]" `+ v: s h$ q9 I
___________________________________________________________________________ q6 R. F- f' v3 g
" |% }- x, @$ `5 l4 F6 F
Method 02
1 ^! P! p0 |, c4 \% ^=========; i3 x' ?6 P) k8 Z. h+ C
J3 K( T) E" A4 VStill a method very much used (perhaps the most frequent one). It is used3 [* ?3 p) n5 Y" f: P+ o
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
5 f& k8 f. I# [0 j1 hor execute SoftICE commands...
1 I. G! ] x( n# h* @$ d6 q* lIt is also used to crash SoftICE and to force it to execute any commands
; x: [; F+ v6 n(HBOOT...) :-(( $ `' w' G. v7 R( p0 E# Q' _
: l6 ~+ ^3 {2 B9 j9 E$ W
Here is a quick description:
! J5 X# I. t, Y+ \0 [$ z5 w-AX = 0910h (Display string in SIce windows)( R J' P" L, s& P9 Z$ D4 X2 g
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)$ b7 g! x8 k0 N
-AX = 0912h (Get breakpoint infos)
8 |0 }) L9 H* I-AX = 0913h (Set Sice breakpoints)
' w* j, ~! x3 x-AX = 0914h (Remove SIce breakoints)
4 j* g2 }# y7 j
( X) h/ W, f$ }0 q; ]2 CEach time you'll meet this trick, you'll see:1 v5 Y# e! X8 f, d" ^% l4 U- }9 K
-SI = 4647h" B) o0 ~2 o/ f1 a( P8 o
-DI = 4A4Dh
2 S9 b( l+ k$ V$ I/ EWhich are the 'magic values' used by SoftIce.
; Y' Y* a1 ^( c4 @For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
; B$ c6 ^/ g: d& f" y$ j! b0 D H
7 l+ P$ {1 g3 u$ a" ^8 uHere is one example from the file "Haspinst.exe" which is the dongle HASP# |* C5 k7 l( m7 o
Envelope utility use to protect DOS applications:
3 I4 N+ X5 g) g8 G3 [& Y9 T* \) @0 c L( Z
/ f' ^6 z& i+ i, l0 |3 _4C19:0095 MOV AX,0911 ; execute command.
5 T, L; @% t8 ~& L4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
& b+ I9 _0 R1 H4C19:009A MOV SI,4647 ; 1st magic value./ t: U2 V9 H6 c) `+ q/ K4 Q4 H
4C19:009D MOV DI,4A4D ; 2nd magic value.# u% o5 [# _1 g7 z" ]
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
; ~% D0 f2 L6 q. n# x/ l4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
! o! P; F* Y6 Z& p7 _, d" }4C19:00A4 INC CX Q" s! M0 F" B" k8 `
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
6 [8 N- J6 v0 d" {" t! @4C19:00A8 JB 0095 ; 6 different commands.6 x4 q& f6 f$ s- W# v: R6 E
4C19:00AA JMP 0002 ; Bad_Guy jmp back.
2 m5 S g& I; ?& X' m4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
2 ]/ ?% ?" w* U, ~ W: [; \6 Z! J
; h2 z* M8 V, ~The program will execute 6 different SIce commands located at ds:dx, which; U; e, B" S9 Q3 H' G
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
% {& q+ W" L9 ]8 i9 h3 y' D
+ a; P3 J2 h5 W* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
2 o" O( e7 x& [3 e; w# A. V: s___________________________________________________________________________
* P2 H3 A+ m. a) s3 n
% }2 M) v+ ~. V. K {
/ r1 V0 _: k9 Z- Q s3 o& O0 v% _Method 033 [# S. T+ T9 h% p7 G; u2 Y
=========, A- Q# B5 ]+ x) U3 I1 W+ a7 \
. d7 B- U" m% R+ {( G$ J3 O3 J
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h; Y" }/ t# \4 `8 p' f
(API Get entry point)( }& b9 Z( w w e& B1 [8 F4 v* Z
7 T5 c. x5 u& T7 P
7 x! @) d1 ~4 l9 H+ x0 m! g
xor di,di2 A2 ^4 D' A* n" a# r/ u2 w
mov es,di" f# z5 q* A4 \2 `3 J* c# [
mov ax, 1684h ' |( x; {1 j. f
mov bx, 0202h ; VxD ID of winice
+ ]- `" M& q; e# a' [ int 2Fh
1 O2 n; p% p" B mov ax, es ; ES:DI -> VxD API entry point
( O# U6 N h1 ~ add ax, di; t1 P% E2 q t }7 T! X
test ax,ax! p4 T8 `# @% A* P' `
jnz SoftICE_Detected4 A8 k9 y& B6 g: t
: y! j1 _' S/ @' o; t M
___________________________________________________________________________
1 N( g" K/ R/ T3 o, U* R$ y! r9 l0 W& T8 q7 `: U8 Q9 S; U
Method 04
& N' `4 B* ~* M: F0 Z: t=========
# ]$ ^: P$ Z: q9 |" S' h- I( c2 A# J8 B! p6 F$ d( Y* s
Method identical to the preceding one except that it seeks the ID of SoftICE
. e5 S4 V' u) kGFX VxD.
2 z" \4 W$ ^3 b' t/ |. Q
2 Y" N. ]" J/ g* t xor di,di# q; N1 R5 A! |; W# p' ^" h
mov es,di( h& \* a/ |6 w; k8 ^' h/ u. A
mov ax, 1684h
* G+ Q6 a) ]- }4 F9 H0 K mov bx, 7a5Fh ; VxD ID of SIWVID' U: i. i) z- a; E! u; G4 ]
int 2fh# S; F$ q! |: g3 t: s6 L5 ~$ N
mov ax, es ; ES:DI -> VxD API entry point; X7 a4 ^$ {: G, Q+ j
add ax, di
& ], T' `2 X }% B: Y$ s/ x/ h test ax,ax
8 O' P/ ?. @& h4 z3 X: S( T2 h jnz SoftICE_Detected
4 L, v E% j' X4 v* _" x+ @5 Z9 U+ l$ k+ k
__________________________________________________________________________
* O. B5 t7 U( B5 x! A% i. x/ B
& U) @ q" C2 ]* L( Z: _1 k9 i0 {# R+ U) N- i3 f1 N+ |0 s8 x3 u1 U
Method 05' g' b* U3 s6 L7 @
=========
1 ^# X8 t; U; C
* B8 A1 W: K% C% W2 `Method seeking the 'magic number' 0F386h returned (in ax) by all system
0 ~$ Q6 `* e9 ~/ D. Gdebugger. It calls the int 41h, function 4Fh.
& j4 M5 d/ n( H: l! n0 vThere are several alternatives. , t6 ?" `) w' t! d/ G3 v
3 f% v" s; V/ z+ m" y, p
The following one is the simplest:
5 g* |9 g+ o/ [, P5 `! m
# N* a+ ^9 I9 ^; c) y mov ax,4fh1 b( s8 A. @' g' U4 c
int 41h
# H$ w) Z9 D( [, o2 G- p cmp ax, 0F3862 |$ A7 D ?3 x, P
jz SoftICE_detected
z' F0 C1 U# W `6 h* ^
$ v4 y7 u3 \, B4 R O% u
2 l3 d7 {% J* VNext method as well as the following one are 2 examples from Stone's ) }5 n6 e* T' D, G
"stn-wid.zip" (www.cracking.net):
: ? v1 \+ i8 v7 G' B' s6 _* J* T$ a9 i) M& Z3 }
mov bx, cs Q0 [& P/ Z/ B) ^" E
lea dx, int41handler2+ ]8 A2 P5 |% V% X& U
xchg dx, es:[41h*4]' K3 m" P; m3 W( [
xchg bx, es:[41h*4+2]
) |2 y+ k) w$ y. X' | mov ax,4fh+ p6 }3 {/ E1 @7 Z* K
int 41h
: n+ @/ J0 u. U) u$ w4 M# f xchg dx, es:[41h*4]
D0 S* X7 Z, s+ T) a1 | xchg bx, es:[41h*4+2]
& e# U$ X) {0 @( p( N* O cmp ax, 0f386h
+ i6 k" J; T+ S) t+ N- c jz SoftICE_detected
2 ]( U! c0 K+ B, w/ U
+ s: O% b# h( ^, g$ o( D1 Jint41handler2 PROC
" V7 M7 |! e2 Q u( y iret
+ g% G, M# T/ ?' y8 hint41handler2 ENDP
8 [$ O1 a! _" _7 Q
* ~* F, T; ^& A% K$ n+ \
9 s6 o/ B( g" k_________________________________________________________________________7 ?( W) A) U6 |, u/ Q) i
/ T% o, }# z7 P- F) B6 q) i
) A9 ~; \# a+ q& |
Method 06
# R$ [1 d- J) Y* g) y/ m( r=========
4 Q; X6 c& ?, @! Y9 y+ e! v) d0 @2 J, t. ^& E
% i e, w/ G' k2 [, W
2nd method similar to the preceding one but more difficult to detect:: J2 A; n3 l5 A( U* K5 Z
/ h) H- {+ k: t
7 U7 K2 y1 H& h2 U& c$ P& n
int41handler PROC, F& ~+ [" S, w1 H) L
mov cl,al% |' |* H) W% {! S+ s2 ^ x
iret! W# Q7 U; d( I0 I4 R; i$ o# c
int41handler ENDP
, ]9 q) `; ]; T; m# d
) u( t- m' C" G( g# J9 P) b( R3 }6 B; \) w1 F
xor ax,ax
7 F$ x! o; s# I mov es,ax5 e) U4 h& V) V/ z" Q# F
mov bx, cs
+ G' i3 }( l+ ~7 A2 L/ Z# T, b0 y lea dx, int41handler* s# E8 Y- D' m# G" b( O5 I5 }
xchg dx, es:[41h*4]2 }9 d( l: h. S* x2 i5 {+ b( l
xchg bx, es:[41h*4+2]
; U' _2 S$ `9 `7 B6 ]" o in al, 40h9 G' O* K5 z- E* H5 e! T% I
xor cx,cx
, }$ g0 d- j' Q% C int 41h
7 @- u" \# G9 t3 w' Z' }6 L4 J xchg dx, es:[41h*4]
5 A3 a8 S+ g0 x xchg bx, es:[41h*4+2]8 Q7 I" R& x. g5 n. Y. U
cmp cl,al
, F8 I5 j8 F2 _/ |; W1 w jnz SoftICE_detected
% A* v( c# t, S! l0 {' [5 ]9 f
* T% t4 q0 Z. M& [( O c_________________________________________________________________________
8 r" @: X* P8 o* S1 Q6 i8 d4 j: n) S1 W2 g# L
Method 07" L) _. z4 D" L2 s% `* c
=========
* {0 K8 L( A. P: f+ X/ @
& N5 s2 \& N& t4 h' g- A5 |6 d# YMethod of detection of the WinICE handler in the int68h (V86), y1 l2 Y' w0 \' L8 N
1 A9 ]/ Q2 [1 d! Y" s mov ah,43h
( Q) Q4 F0 m' A' g4 k0 F/ X int 68h
$ y$ \4 g+ }' y$ ~# j( M cmp ax,0F386h0 j2 ` @: n: ?6 b7 Z/ K& R" d% K
jz SoftICE_Detected" D0 }5 w" b8 D) d1 s/ N4 Z
' l% \0 Y) b/ x0 Y) H. T2 {) P- B. b
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit8 y o% b# J/ ?; }" j, p
app like this:
$ E: T( L& E3 u8 I7 H l, Z# [
BPX exec_int if ax==68- m% G; K$ {- Z
(function called is located at byte ptr [ebp+1Dh] and client eip is) q# O& Q& q9 d9 ]2 n) ?
located at [ebp+48h] for 32Bit apps)5 U) l/ r4 G7 w8 a9 S6 l
__________________________________________________________________________
3 }5 H% T! c \) f' v, ~
) z% G8 K" O$ b, {3 y" M K
; P* n$ r6 v+ x6 y& h! H: t( aMethod 08
3 _8 f8 E# M$ ]( n6 y: X& s=========# @ L6 \. S3 E4 E
) L+ M& H6 M0 s* ]3 {
It is not a method of detection of SoftICE but a possibility to crash the
% _: u+ k4 P/ G I7 `9 fsystem by intercepting int 01h and int 03h and redirecting them to another- N/ I& I1 `1 s: k1 _
routine.
3 e3 j3 g% b6 a5 y5 T8 ]It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points/ a$ E/ N$ V2 ]7 e* `9 e4 L# X: _+ R
to the new routine to execute (hangs computer...)3 ]- C6 o, z& ?/ l+ z
! u M# N' C1 j2 P0 Z) @
mov ah, 25h
8 U O/ Y1 t4 Y; Z8 J b) J3 v3 u mov al, Int_Number (01h or 03h)
3 D. U' U9 ~& `, T mov dx, offset New_Int_Routine* g% ~0 Z( }4 V& S6 r6 y" G
int 21h
* B, K) W6 h! u5 ^. Z$ D
* }0 l% U( K, e7 R! j( G6 o4 H__________________________________________________________________________
: J6 m; Q) n5 C" @
T. Q9 M. S! ?8 Q/ s* [6 eMethod 09/ R" A( a) a: P: b, k0 N- ~
=========! W+ E3 i- f& l6 ?: V
, g. [( Q5 j6 Y+ ~# eThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only1 | u ~) N( s8 `
performed in ring0 (VxD or a ring3 app using the VxdCall).
; I& a: F, P+ p: `; K* k# {4 zThe Get_DDB service is used to determine whether or not a VxD is installed
' S! Y2 y, E( e6 O. B: yfor the specified device and returns a Device Description Block (in ecx) for
' i! [' Y0 a8 m( J9 [that device if it is installed.
) }; ^. d K3 e" ` \
3 l3 n) M& N! `$ b mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
0 p& i! S! G$ v" R2 b mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)$ n. m1 Q5 o# Y6 s+ F
VMMCall Get_DDB
# j: n- A, I4 z mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed$ F. {- p; {4 O7 h! z4 P% W0 L- ^
: e# Q6 f- k8 W, |7 @, J
Note as well that you can easily detect this method with SoftICE:6 v2 h: Q* h' s9 m$ V, o/ M
bpx Get_DDB if ax==0202 || ax==7a5fh
: D* S- C5 \( H) |. I1 M8 f) Z& W( _2 c# g: F# I
__________________________________________________________________________
2 j, k* f9 N7 K, ` U# p# Q- P1 L/ c( h9 L$ n' C) o/ e1 @ _
Method 10* s) N8 o) q' _$ i( ~. @' W7 a! X
=========1 u# r, `5 _7 Q& L3 G
7 l- w7 s d% h' G$ ?
=>Disable or clear breakpoints before using this feature. DO NOT trace with
2 o4 ]. C% X" J4 z; o3 ?8 Z SoftICE while the option is enable!!
% r0 M1 |4 A0 H" Y9 L3 _# A$ {
* J1 e* W ~1 c- ]. K* yThis trick is very efficient:
9 o. {8 C2 ]# U" m% |+ j" Nby checking the Debug Registers, you can detect if SoftICE is loaded
* G, ^0 Y8 P: I(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if* ]# I) `, Y$ Q5 R, O
there are some memory breakpoints set (dr0 to dr3) simply by reading their
: x4 u8 \4 d* Q8 tvalue (in ring0 only). Values can be manipulated and or changed as well
1 Q- k" f2 _7 J(clearing BPMs for instance)
2 D& i! C" f; K
$ Z( ]1 z* {4 m$ `0 j9 u: b+ O__________________________________________________________________________, ]) ]3 b# Q' w- Y
! ?1 N* y' U5 L- Z
Method 11
( C. g. y+ r8 j- I8 H=========7 J6 l' u1 v. j) z
/ o/ d1 m; K" B
This method is most known as 'MeltICE' because it has been freely distributed- ~% t+ u( L* U! t- g
via www.winfiles.com. However it was first used by NuMega people to allow7 o0 Q$ b, ]. a j) b+ a: m
Symbol Loader to check if SoftICE was active or not (the code is located# R( A1 z% x3 w0 H( q4 J
inside nmtrans.dll)./ }, P9 A6 [. r, q
" z- x# J3 A* L! {
The way it works is very simple:
6 ~7 a8 U* l$ I7 I& QIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
) t$ g' w6 z. g- v' z9 sWinNT) with the CreateFileA API.
0 Z* C( g* m+ {, y# k, y* M, l5 U+ W r$ H" k- d
Here is a sample (checking for 'SICE'):7 j- z/ S9 \& d$ C
$ n) F+ ^0 H+ q4 g
BOOL IsSoftIce95Loaded()* r# `* R0 B% K
{
/ ^6 F; |" S0 C HANDLE hFile; / T% P0 i7 K( A: z$ D5 V
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
# Y& q2 x% R$ c! ~ FILE_SHARE_READ | FILE_SHARE_WRITE,# x: D- A- b& w7 F
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL); p7 o0 g+ ~2 h4 @2 H
if( hFile != INVALID_HANDLE_VALUE )" c8 _5 h0 W D" c4 s
{; s" J* q: ^) F" Y0 s/ h5 y& V1 ?
CloseHandle(hFile);
" ?% C+ q; M5 m return TRUE;
5 t6 b6 ]1 A/ }; a: T: N } t" t) M+ i* @& O2 R8 h
return FALSE;
: d9 {6 y( P( ]/ T) T7 Z. W}
7 S( b' u( X0 |* Z5 x# A5 R
- Y A- H+ x/ z+ C7 s8 D+ M2 Y( kAlthough this trick calls the CreateFileA function, don't even expect to be
( }6 z2 J- {9 p E2 ^! Jable to intercept it by installing a IFS hook: it will not work, no way!" B( O) _( {; P! D. I3 c9 s: e
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
, E+ x; P" C, C3 {service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)+ @) U) N# K( ]9 [3 q0 s" ~
and then browse the DDB list until it find the VxD and its DDB_Control_Proc6 t [! c8 g" d: _. N
field.
6 l' Y1 _ U; f+ ^' Q4 u1 X7 ZIn fact, its purpose is not to load/unload VxDs but only to send a y0 e+ {6 m% I; w5 z) y
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE), b2 w9 n* m- r# h
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
5 i6 R) T/ |* v& i7 z6 {to load/unload a non-dynamically loadable driver such as SoftICE ;-)., _* `" q& ?6 U7 Y8 ?
If the VxD is loaded, it will always clear eax and the Carry flag to allow' r" z/ @8 I; S L% f4 `) H9 P
its handle to be opened and then, will be detected.3 S7 r* `! _9 |- a' Y) k3 e
You can check that simply by hooking Winice.exe control proc entry point
* s% B- c7 A+ v6 `: H7 awhile running MeltICE.8 t8 ]! V" h7 i+ W' \3 [6 B6 p$ t
. e: M# q' ^' J: d* S+ Y! p! w( Y( r% P
00401067: push 00402025 ; \\.\SICE1 u3 h) D( s. y- ^' E- u1 c6 u2 y0 }
0040106C: call CreateFileA7 O/ |' W/ k/ U4 ^8 H9 [
00401071: cmp eax,-001
9 p/ ?3 z" m, o8 ? 00401074: je 00401091
4 G# Q2 g( d8 K! N8 [! Y1 O
. P- m9 {2 z k6 C% i3 { h' U. Z; h7 o! g/ e$ j8 W1 x6 B8 b
There could be hundreds of BPX you could use to detect this trick.3 P: A, p# }- r6 J S
-The most classical one is:: \4 k& ^% Y) u- k. d
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||" X4 a) s9 P' x6 m; \, i
*(esp->4+4)=='NTIC'
' b( G( J6 e1 I# ^" ~8 D5 F
' p$ \! o! U6 _-The most exotic ones (could be very slooooow :-(* w# [! E7 F% i k7 K( I" u0 m4 I
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') * |8 H" u6 V% Y$ S$ d
;will break 3 times :-(
0 t$ s' C7 r8 h) i' d6 g, I$ {
; _4 M; M0 O( u2 j' c1 l-or (a bit) faster: 8 V$ f2 H8 W' c
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
. [- u! d( J# ]
* u( Q: z4 f( o, a W BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
7 r t* b7 S5 |7 N ;will break 3 times :-(4 P2 B5 J9 [+ c3 \1 g: ~' z
) S- h0 _8 J* N2 o/ [-Much faster:
; Q* b2 H- u5 A' A# d1 P BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'; I3 G( Z+ d- _
# h/ F4 H7 x1 }7 j
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
& E7 t9 p& j/ q" f6 nfunction to do the same job: f# L0 Q1 s) z
2 U% ^' K: Q' {
push 00 ; OF_READ: o, I6 K* `3 p k8 ?
mov eax,[00656634] ; '\\.\SICE',0. j) n5 e% q2 N q2 R
push eax K3 p9 K% k) `* T8 v0 w% y
call KERNEL32!_lopen+ y5 y& f# P% C& c: {; s
inc eax
: p4 G# _6 Y% y jnz 00650589 ; detected* ^, B+ D |" ]* N1 k3 I$ }7 _
push 00 ; OF_READ
0 g/ E7 s; H4 u0 v2 K2 c7 C/ h9 Q mov eax,[00656638] ; '\\.\SICE'
4 w* C# K/ q; t9 r push eax9 O9 b2 g! E3 c) j' f
call KERNEL32!_lopen
1 s8 K$ {8 F* |& c inc eax
7 E2 I9 O) e( ~: B1 U jz 006505ae ; not detected* }) x$ U% U+ w
2 m/ Y. M( c# |2 W
+ n' X. f9 i+ I" o* S! }9 `% N
__________________________________________________________________________- g6 E7 U* N6 {: @' r1 A2 o
7 G1 ~* K( I& h4 `
Method 12
9 N( q6 w' r" [=========+ b6 A6 A. E4 f2 w, ^4 ^. N
! n5 x$ J1 c" F# a7 G, EThis trick is similar to int41h/4fh Debugger installation check (code 059 {' l5 x" ^5 [5 {# r: h+ j
& 06) but very limited because it's only available for Win95/98 (not NT) Q& y! ?9 t: F8 N
as it uses the VxDCall backdoor. This detection was found in Bleem Demo., F. z3 S3 ~* J4 a8 f
1 V4 w. ^1 X" J
push 0000004fh ; function 4fh
8 Q3 d! \5 W w I2 D) r push 002a002ah ; high word specifies which VxD (VWIN32)
5 R( @! \. s% S' [5 e* h! x0 `" e ; low word specifies which service# i2 p! `! ^6 m2 `
(VWIN32_Int41Dispatch)$ n9 \- N! |% H; t+ Z* }* X
call Kernel32!ORD_001 ; VxdCall
* H+ _: N, s/ L! M, I% @+ a cmp ax, 0f386h ; magic number returned by system debuggers } x" P. q0 ^ A: K a U
jz SoftICE_detected4 u- S* w4 }) i- Q4 G- B3 X
+ u" l: B) B; z6 uHere again, several ways to detect it:8 {" {- z# n. y2 r: U0 [5 a' W+ j
/ s3 n/ |& n7 G6 I
BPINT 41 if ax==4f6 W- J3 s& r7 v5 y: y
5 ?7 b% i1 V) P
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one; \ |# M- i) P& X
' y; }5 y$ L/ y; c6 R BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
# B3 U1 J2 @! z, h7 R: m& {: U6 I# O6 Y2 }; A. Y
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!$ B/ r* `8 ^7 B" \! S
6 {/ t% x: @; q/ r
__________________________________________________________________________3 v, T, _8 @/ f( K
?0 X; R5 c3 R0 PMethod 13
6 E* w) f" i$ c/ V1 ]=========
% G7 k( O6 t) ^ i9 R' N3 _+ I8 R- j+ p
Not a real method of detection, but a good way to know if SoftICE is! P% ^2 f* m" `6 X4 z# q4 Z' x6 m
installed on a computer and to locate its installation directory.
6 E$ o* s& `( UIt is used by few softs which access the following registry keys (usually #2) :
' z# I7 j5 \! @& ~2 r6 A1 y; q% X. P
0 W$ B/ n& q O& Q% q. _$ k-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
7 X( z5 [% t* J( e\Uninstall\SoftICE
8 @4 [( Z$ t: ]" Q5 N-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE. s+ P) G, i, Q$ L' B7 L
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion5 R( Q. h1 X6 p" n4 r/ e
\App Paths\Loader32.Exe4 [2 z' _! T! z- V
7 `- z) q3 \3 w2 P$ g
; W- n% d$ B- j5 Y$ R; c7 D t2 MNote that some nasty apps could then erase all files from SoftICE directory
: G! N: o8 _7 C6 L( Y4 j(I faced that once :-(
( F8 U. ^9 J% X8 g& q3 D) e1 d" x4 c0 y) K
Useful breakpoint to detect it:
# s/ c& _" R) N9 `
5 l3 r$ B/ R3 S! _ BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
( m. r+ p! q$ ^/ u1 j2 d8 D
! L3 K T8 @' j O% B- H7 ^7 R/ T__________________________________________________________________________4 |5 ?/ Q6 Y9 B% O0 ]
6 n0 |2 n' r6 v9 x1 _/ r, Z9 q7 ^
1 h2 z8 d4 c5 X' y3 EMethod 14 0 {) v4 ^ J/ m* P" O8 s/ k4 P
=========2 }. B2 n# H$ a1 N. r
$ A' i# M2 w& n) c6 B! t
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
6 R; w" B* Q" i# W( {/ fis to determines whether a debugger is running on your system (ring0 only).
$ C% u) a8 |5 D/ k& \# N
% G# a; H8 o( C3 q# ~! d$ t M0 Q VMMCall Test_Debug_Installed
4 [8 Z% Q% j3 \9 o6 m je not_installed; D6 Y3 s/ y) t. q
% I V4 ~$ a+ _( s" D" Q
This service just checks a flag.
( h$ q1 c" Q- Z) W/ B" R' ]</PRE></TD></TR></TBODY></TABLE> |