<TABLE width=500>4 N' M R q# q! c
<TBODY>
' T9 W2 a: K' F$ |, f8 n<TR>
1 `5 P2 r' p! |5 Q3 t1 g/ z+ ^, T<TD><PRE>Method 01 : a$ x2 p9 H0 O \9 k
=========
" T- y j6 H9 O8 r# W2 b+ G. H1 t
This method of detection of SoftICE (as well as the following one) is
9 l" ~" Y7 Q) ?* gused by the majority of packers/encryptors found on Internet.( G3 @, e% j. Q) p0 ^8 y# r
It seeks the signature of BoundsChecker in SoftICE
8 E; x/ ^4 {6 T$ C6 a6 w
2 g. K9 k$ @ L! `/ x9 k8 k1 ^4 Q mov ebp, 04243484Bh ; 'BCHK'0 R" I. C3 ?3 D; f5 r# g1 r( e
mov ax, 04h2 l! u0 h% d2 O0 Y9 E
int 3
* S7 g1 }& p; p* s7 W9 `1 B' ] cmp al,4
5 ]4 l# Z2 I/ ^. [ jnz SoftICE_Detected7 M( B M' {" d: `9 Q+ M
- ]. ]0 m, S; R1 f
___________________________________________________________________________
* V9 T/ ?; d' O& c! E
, g# k8 j) a% sMethod 02* M2 y7 Z% H9 d, ?5 r. V" x
=========
9 }3 }/ I7 C% e+ G# `. ]1 E5 N" y5 e1 g; Z+ @- G( L
Still a method very much used (perhaps the most frequent one). It is used9 Y$ J7 D: V% }2 e* [7 w4 t
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,7 f" f7 O2 D; _! o) }! r* t
or execute SoftICE commands...
' R6 d- a& P' ]9 J( W* a( ~ DIt is also used to crash SoftICE and to force it to execute any commands
. D7 |1 ], I4 I" h. b3 i(HBOOT...) :-(( ; Z2 c3 R6 I/ U7 L8 Y o( J7 o* q
; ^# u! H! h- Q7 @! e8 C: i
Here is a quick description:. {9 G+ n# D+ b4 n" B" l
-AX = 0910h (Display string in SIce windows)0 M' z4 ]8 C; m$ ]# o$ | \; s* ~) {
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
6 p" n v, u5 S% s! W$ f6 f-AX = 0912h (Get breakpoint infos)2 ?+ ]& D A/ ?0 e8 B. Z j2 r( k
-AX = 0913h (Set Sice breakpoints)
& v3 u7 X& g) x-AX = 0914h (Remove SIce breakoints)
* Q8 k0 Q. Y5 m
" z. i& w- o+ C# o, P4 A' u T2 c- bEach time you'll meet this trick, you'll see:
$ @ o7 q9 U- F-SI = 4647h
# u3 O2 e/ I% V& {-DI = 4A4Dh1 t" B3 E/ U: p+ b
Which are the 'magic values' used by SoftIce.
9 m7 |4 a2 x/ R" P4 l) f& tFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
8 H8 `! ^# L# Z
# X+ J2 h) }* d. xHere is one example from the file "Haspinst.exe" which is the dongle HASP
3 R% ]! f u N( hEnvelope utility use to protect DOS applications:; n9 j# o/ q: P9 T# e
u8 {" H( v0 g
/ Z. V' I( v: z3 T3 k& e8 U
4C19:0095 MOV AX,0911 ; execute command.
3 g% u8 e. l3 ^4 F2 w4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).5 q0 ]' K' g# M- J
4C19:009A MOV SI,4647 ; 1st magic value.3 S1 T6 p. E' ^) m6 S
4C19:009D MOV DI,4A4D ; 2nd magic value.
* W, ]5 ^2 T9 C5 L5 V$ }4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)4 P/ ]% F# A" ?/ _2 G* _1 v! @
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
/ r% z- N, O1 n5 _ g2 M4C19:00A4 INC CX9 D, q' | w& o
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute8 Z5 h, Y* n: Z6 i' q
4C19:00A8 JB 0095 ; 6 different commands.
d% v! W- _6 U* Z2 s! ^4C19:00AA JMP 0002 ; Bad_Guy jmp back.( p2 n8 Q( E- X8 ?: _$ r
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)+ y( S+ `% b& {* N9 O+ Y4 Y6 _
/ V* \ {8 E! v: B6 h1 E; v# XThe program will execute 6 different SIce commands located at ds:dx, which) q+ X( t+ J2 K) @; U4 i) L
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.& w" H- }5 L2 c y1 j% w
' }6 N( K. @0 L N* X& @
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
8 h( u/ y7 K# f4 F___________________________________________________________________________
+ x7 r5 [# S( A) [. E- C6 @4 `- `1 d/ F/ l: e# a& ~6 q
) P$ t; S( R& j9 F: O% n
Method 031 G( `/ L3 k; v: Y9 ^$ n
=========
& C9 k) e9 H2 R7 `. p
/ ?% i+ _6 t- |7 D7 b0 I/ f& ]$ ^8 i3 @Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h2 g/ N6 t/ [& n9 e0 P1 C# I
(API Get entry point)% a s5 x9 X8 p, z$ ^$ X9 X
/ z7 {$ M3 Z0 ?) K5 n7 I4 a p
1 H+ `5 Z V( }
xor di,di
6 N8 p/ ~' ?- H( N( u, c$ l mov es,di# y; C& j6 |1 F5 ?+ E5 i" Y
mov ax, 1684h ; ]' x) G( @. Y* u
mov bx, 0202h ; VxD ID of winice) `4 L2 o; x1 L L" a
int 2Fh
8 h: g; j, k; ^" D! U7 @5 f1 ` mov ax, es ; ES:DI -> VxD API entry point9 N- l7 n& P9 w4 B, w. m- V
add ax, di0 e; R' i" @" u' X* z; [
test ax,ax
' @. J0 q+ B) i1 i; G( O, V1 V jnz SoftICE_Detected
3 S8 ]! ^/ j0 |+ H' z C
: c) k6 V1 n7 A# ?___________________________________________________________________________8 i4 l" E, c" i1 q+ B
: I3 B+ B& H+ ~/ l" B
Method 04, d/ c' h" y# R* \5 P! x8 f
=========
9 Z6 Y/ T. i5 c- a- r
. o) i+ }$ r+ FMethod identical to the preceding one except that it seeks the ID of SoftICE5 _9 h4 v1 p' D7 s( [- |8 p+ U
GFX VxD.5 L, g4 Q) d; s1 N3 U
9 W& X; U7 g# h) i* t* a: e
xor di,di
& E& P: D: m0 T8 h mov es,di
# M# n, |9 f# E# t) A o mov ax, 1684h 2 r+ \" d: N. ~/ r& \( }( J
mov bx, 7a5Fh ; VxD ID of SIWVID
3 j: }* ^+ e2 Y0 Z int 2fh3 w5 `8 b0 T1 q
mov ax, es ; ES:DI -> VxD API entry point
* k: x% _* D9 a: V1 W, z" @ add ax, di7 m* C* `! H% ]6 x4 M7 G8 P# {
test ax,ax
. V! {2 N4 q3 Z: J0 s2 `5 R jnz SoftICE_Detected' v$ F% @1 N' J0 K5 U; |6 }
2 }1 n5 K. F! c5 W d8 s4 p6 \4 ]
__________________________________________________________________________
* v% a1 U. L, W m& x- t; O$ ]
/ N j4 A( D# T+ r# A
' Q9 R5 x" x' B0 i' t eMethod 05
( {6 I m; E" V. H1 Z, \=========
' e$ i' @8 d" O0 F% Y, T. ^9 b+ H8 Y$ N1 p& D7 A
Method seeking the 'magic number' 0F386h returned (in ax) by all system" l" \# q6 E; K' O# g/ J
debugger. It calls the int 41h, function 4Fh. r8 ]* ?" o& T. k) A; U! E) H
There are several alternatives.
& `6 k% {* P, T7 }8 M0 V6 f: n, {( _% T. [! w* a7 v
The following one is the simplest:
* _! Q2 s) h, e# s7 ^5 U9 h4 w6 U) @$ t7 j0 g% o' m- X* n8 F! E, e, p
mov ax,4fh
9 t6 `8 S- b* a( v1 M int 41h
: T9 d: n- y$ h. `- s1 s cmp ax, 0F3861 h" @0 V# v5 U8 n m% |
jz SoftICE_detected
" C+ W4 o& ~: T( K) ], A N" `5 _# @( d, L+ c
7 _3 E; {0 G2 _' e. P9 r1 f7 tNext method as well as the following one are 2 examples from Stone's : l* D- ?. V+ W2 H
"stn-wid.zip" (www.cracking.net):
: U# S. F& j2 F) F9 [0 P, B1 N& |, s
mov bx, cs1 `+ l: g1 \3 N, p; X! ?* t
lea dx, int41handler2
: r+ a- A" y2 p* L+ @1 a xchg dx, es:[41h*4]$ r! L i' M( U
xchg bx, es:[41h*4+2]
8 H' l: A- V0 K) c mov ax,4fh
& K9 K9 U2 [9 C8 h, O( E int 41h4 D; J& Q% e# @5 {0 r# w/ {( g6 e& l
xchg dx, es:[41h*4]8 [: U1 M2 r. j! D% g9 u
xchg bx, es:[41h*4+2]$ S% ?4 A Q# l# W7 u$ u& n
cmp ax, 0f386h
1 G% {4 P8 T, p& ]& r jz SoftICE_detected& [5 u# j2 ~, ?* E; u1 g
2 G$ X7 p( Y% f# Gint41handler2 PROC3 _1 m+ M3 }! x: S, R
iret2 g2 z% m3 D9 I6 p1 I: ?2 S: x
int41handler2 ENDP
' _" h$ ]- G2 W! H' c7 a- M* v9 i& `! \) R. ^1 f: O1 l- T/ ~
3 D9 V4 d0 i8 [ X4 s2 ?_________________________________________________________________________7 V# X5 a$ d/ ^4 O
# U' f# H. p* u( O$ ?$ H0 v1 E9 K
& o1 [8 d2 V) m& Y! }8 SMethod 06: l+ ]6 j5 H0 _1 y9 [# [# M Q8 K$ J
=========' a2 P& V4 ?* x3 y- V
6 Z; \- ]) r# H" X8 @5 p
$ z4 @! r) s' g8 g/ A$ {. A' Q
2nd method similar to the preceding one but more difficult to detect:# [# a$ k, e7 q9 b1 h
/ M G! H$ M; o/ o7 T
, X6 ?* M6 U, T6 L' T7 c; i8 r
int41handler PROC3 f% |1 p6 R. @/ `" f5 X3 v
mov cl,al7 Z7 r+ E# p; z1 G7 m! {
iret
/ q+ K8 J9 S" H' Iint41handler ENDP
8 r3 l* n2 T/ s& C; K3 A! z' V4 [: W4 }( b. X# j# N
+ f9 G' m6 R6 w9 y# J' e* D xor ax,ax
# |& ]' g6 j* w- b mov es,ax4 y" b$ J8 H' H
mov bx, cs
' f0 M% w/ |7 ]% f lea dx, int41handler8 P! k W5 K3 f; X; U! m
xchg dx, es:[41h*4]% s1 a7 a0 ~) c2 v3 W8 x
xchg bx, es:[41h*4+2]/ t6 C* s0 q8 j
in al, 40h
9 E+ o% \9 c. J. v% s, F- `; z! H xor cx,cx* ~& X) }6 f* {* m0 o# E$ I
int 41h" m! F8 @$ W- a5 M* O. G2 l
xchg dx, es:[41h*4]
, X& y; t$ H4 n/ m+ {/ g xchg bx, es:[41h*4+2]& Z+ v. z3 M6 V7 Q! x
cmp cl,al% l( }& l' s" N$ F) ?9 P
jnz SoftICE_detected
3 ?* d' A, K4 M' d! E8 \
- H# C: H+ [" B8 d% w8 }_________________________________________________________________________" L* e) J* K: b0 s/ O$ i0 {6 V: T: F
; w! g/ r& H* X- D& d4 J/ x
Method 07) Y1 _. Y0 @- Q( R5 @/ i
=========
: ^- [4 N' K2 ?: \& U/ \5 U1 W
Method of detection of the WinICE handler in the int68h (V86)/ J; w. `: b, s( Y4 L
% v* p6 K+ c6 X2 W' h1 |; l7 @ mov ah,43h- I3 [" X/ F( p
int 68h( a) P# t. c" y R
cmp ax,0F386h8 v8 B; n: O5 n. U8 j; J
jz SoftICE_Detected5 V$ Y) L7 d, Y
+ u0 o% {: T: d3 u7 C# T- r) e% b! N" t" A4 T+ d
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
, m9 c2 W, M% F$ h& h1 s, b. y1 i app like this:
o. t) m% B0 g- C: b- x3 C* G$ n5 G( a4 r7 u
BPX exec_int if ax==680 Z! _) l3 \0 ?8 X" W
(function called is located at byte ptr [ebp+1Dh] and client eip is! e& \$ _, Q, y$ a+ V% U
located at [ebp+48h] for 32Bit apps)5 h) [! f! X( X# z2 A7 L
__________________________________________________________________________4 }1 b. a0 D+ L: M9 [" \
4 ^# u: [7 D I6 x S2 ` o3 a' l; a) k
Method 087 H% n! X- j2 Q9 U' [
=========
) k% I# U; f7 f, A) w% }( m
& D& Z' o2 P) p- Q% LIt is not a method of detection of SoftICE but a possibility to crash the% ^. X( s J4 X- u% s) b
system by intercepting int 01h and int 03h and redirecting them to another9 v R! L5 e4 _* R3 ]" W( t, b% x
routine.4 R* h3 n$ f3 _8 {% t) W$ c
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
$ W6 ~/ M3 h: j6 V) Xto the new routine to execute (hangs computer...)# P3 c0 u1 [8 p# W5 G9 G
* b% v: i" Q1 |2 `/ r7 i0 h, ? mov ah, 25h
/ I. A/ G' C: T, u' R, f2 D mov al, Int_Number (01h or 03h)
7 [5 f8 M' z- E7 Y! O+ h* r1 ] mov dx, offset New_Int_Routine* d( Z# C- x9 Y3 w
int 21h
1 H( ~" z' R: ?& @- y" J+ k% u: c; U& l0 R8 ]
__________________________________________________________________________
" S7 ]$ ]; q: R" K7 @: q3 w0 t k1 |$ d
Method 094 L% X3 Z- G. G8 J+ X5 F$ ?
=========
; v6 t$ b N+ h6 X( H
8 L5 G% N* n! o! |4 \! U6 J5 rThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only" u, i% N) Q0 \0 I9 T7 w( x3 T
performed in ring0 (VxD or a ring3 app using the VxdCall).1 }9 i, v; p0 ~7 t4 I! m- i |
The Get_DDB service is used to determine whether or not a VxD is installed- _6 H6 l2 [' V, c G+ ?
for the specified device and returns a Device Description Block (in ecx) for* V7 v+ g z! y: v
that device if it is installed.
[7 T2 _+ B% \- ~) a4 A1 @$ g) a+ q4 E5 a9 U$ Y F
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
) J2 s( B! e' ^ mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-). c6 N, M- ?6 ]+ K$ J
VMMCall Get_DDB5 ~& [) }5 n( r9 C# r
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed
" W: C* A, x2 c e+ h3 M+ ^& y4 ^: i+ q2 G4 \
Note as well that you can easily detect this method with SoftICE:; J" k4 L! z* d' E8 A2 `
bpx Get_DDB if ax==0202 || ax==7a5fh, G6 N _2 H4 D& F5 g$ |% l
- C0 Y5 C& q% W8 s__________________________________________________________________________
4 e: K. n l, q$ g. o* c- C5 ]
/ C* G6 X% ]) \+ K0 |, q% eMethod 10
/ o5 A. {0 ^: C% W=========
5 ?, _3 A. { h& p, t' f6 U# v) H, W6 \8 g
=>Disable or clear breakpoints before using this feature. DO NOT trace with' Q" k! C6 C" s% x# ]
SoftICE while the option is enable!!
6 c( D0 X- H6 I
# v! @8 _6 R# |This trick is very efficient:2 L2 d) {8 V. p1 m& f/ g/ H
by checking the Debug Registers, you can detect if SoftICE is loaded
+ c! V* Q4 P; y(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if$ T- S1 W5 o/ r4 @ u% [4 L
there are some memory breakpoints set (dr0 to dr3) simply by reading their) U/ M! Y5 `6 T) o
value (in ring0 only). Values can be manipulated and or changed as well$ e9 U8 d' Z. n4 G* q
(clearing BPMs for instance). L1 `7 P, p! u7 Z
- S% r. n7 z5 m e__________________________________________________________________________
, k" O' G0 h9 M h1 k
" g$ E; g y4 G# c* }$ wMethod 11( X$ F+ V" ~ T: }% k% c) r: t J
=========
% I# H# ?- d6 f7 r6 i3 }% w$ ]% W) v( r: _, X7 W5 `; I
This method is most known as 'MeltICE' because it has been freely distributed
2 V4 i" V0 @+ V: pvia www.winfiles.com. However it was first used by NuMega people to allow
% V6 \3 p) M- u) Q' n( fSymbol Loader to check if SoftICE was active or not (the code is located
; T- `5 g' \% H3 Oinside nmtrans.dll).6 g/ r; e1 U. ~- D6 R
; e+ K% o( x4 N" ~
The way it works is very simple:( i& f6 J5 H: Y0 F- x0 t
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
& l0 z2 [# m! P5 \! ?WinNT) with the CreateFileA API.- e4 C$ }/ u0 N7 R0 u, n
, l* P0 Z" u7 p( }# }Here is a sample (checking for 'SICE'):
2 r) M- ^$ M; u) T
) c' `2 G* [+ b aBOOL IsSoftIce95Loaded()6 X. Q/ a4 x( q. m: T6 g; u9 k
{5 `. E3 c1 |$ F$ g g+ @6 Z0 H
HANDLE hFile; Q8 v. W2 W% Z
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
$ g3 y# l0 v# S. g' D9 t FILE_SHARE_READ | FILE_SHARE_WRITE,) \0 u |4 \' N& B0 U
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);5 j6 U6 ]+ R9 T
if( hFile != INVALID_HANDLE_VALUE ) I) d0 S' P6 {3 U) m, z
{
& b$ {/ N& d5 y/ ] CloseHandle(hFile);
0 z, Q# H5 M* @# K: ?* j return TRUE;
9 V n! V( m# @) `* a, S0 o$ z }
) Y, G4 x; b, E1 w* | return FALSE;
5 [( F: y }( p- V}
( ]% |; ?$ Y6 w. U2 D: h: g, R! [! T3 m( V& r: ~
Although this trick calls the CreateFileA function, don't even expect to be
" {8 X/ p. K1 p5 D+ Bable to intercept it by installing a IFS hook: it will not work, no way!
1 A8 m0 Z Z8 ]+ [+ r3 x5 k/ g4 NIn fact, after the call to CreateFileA it will get through VWIN32 0x001F9 r: {! |6 m5 j1 z
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function): L _) E1 n* { T T+ g; @2 z
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
4 l- r% ^: \& r4 Q3 T1 `field.1 i% O0 q% K, U) E
In fact, its purpose is not to load/unload VxDs but only to send a 5 z6 @; H& {4 X" \' `" b/ u1 N
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
( S5 y/ i R2 G! c* Tto the VxD Control_Dispatch proc (how the hell a shareware soft could try! w' m5 B0 t0 i+ J& q
to load/unload a non-dynamically loadable driver such as SoftICE ;-)." T; s& M2 i9 Z0 r9 j# D
If the VxD is loaded, it will always clear eax and the Carry flag to allow) {# i1 b. x, ^; q1 K
its handle to be opened and then, will be detected.( i% ?: C. W( k% X; y8 [' t$ U0 j
You can check that simply by hooking Winice.exe control proc entry point
2 w. W. Q& a; P* I2 g" D1 {9 d/ wwhile running MeltICE.6 @+ }# S9 W/ b: Z4 p7 ~0 O
; N- ]" a3 ?7 W( E' [) {& I
. F) \$ J5 r! l! A1 P3 B 00401067: push 00402025 ; \\.\SICE! q6 z, ]/ a4 L4 e( I
0040106C: call CreateFileA8 U9 F1 J/ }% @' ?4 t% H) @* C
00401071: cmp eax,-001, U+ V# |7 O K
00401074: je 00401091+ n# g+ O) P1 I% b7 j: A1 @
; b9 W( @ w3 ~8 g
. s) r6 O+ f+ d: Q$ W7 ?2 hThere could be hundreds of BPX you could use to detect this trick.
$ L3 s' K$ s1 o/ c& u-The most classical one is:$ ]* x: w' ^" X3 w* R6 i6 H
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||/ O( ^% s9 z8 r1 O6 Z+ X7 k
*(esp->4+4)=='NTIC'+ v2 ~8 S& y2 c$ f" g- I6 q) w
$ H. L0 {& j7 e3 c {+ w. a
-The most exotic ones (could be very slooooow :-(
3 }. s8 P1 L7 H' R: J. L0 x BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') : P7 z1 \& s, t- e- C# t+ }5 b
;will break 3 times :-(8 Q. z/ o/ c$ _8 f0 @) \1 ^9 A. g
}' e2 d8 m! u* ?3 ^ u
-or (a bit) faster:
# }/ j( r8 |4 d6 v* H1 } BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
' F0 g) z5 _3 W: H& d! y" @+ p; G0 V- f- h6 h: t2 V! X
BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' % \6 {% `7 D8 u J6 R. l
;will break 3 times :-() t6 l* I& g9 b# f0 K; O2 E! T- x9 o
3 [( X( E+ i& C% m! Y( o. Z-Much faster:
7 c5 y v5 i C! H9 Z BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
# }+ Q& X$ \- h$ e+ P+ @6 w
$ w1 R7 z$ a: @2 k* j% \" lNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
2 D5 R3 v) e9 J# w/ \ Mfunction to do the same job:6 g3 \' a0 K) [. D4 y$ J' I1 o
. O' i4 j& g* i! F8 \
push 00 ; OF_READ
8 b" w: {/ i6 g6 w9 f mov eax,[00656634] ; '\\.\SICE',0+ ~! p6 O9 \. y& M
push eax! }: p% j6 U( _: N( x) g1 |
call KERNEL32!_lopen
6 \8 M; R5 `- u) P) o, U$ J% L inc eax% Z3 Z- n. Z6 v9 V
jnz 00650589 ; detected
- z. p( `. z# k+ Y" [7 D push 00 ; OF_READ
* P8 P7 s6 k+ q5 n mov eax,[00656638] ; '\\.\SICE') y9 V& J; q( ]2 d' |. s
push eax7 w' F3 y' h! L2 c6 K. g( I6 O
call KERNEL32!_lopen e& }( j( Q& k/ P' m4 J6 T8 U. ]
inc eax
/ { V8 k* a% t0 Y4 l9 H jz 006505ae ; not detected
; K: _" I7 n( w5 z
: @' F& n) c+ K* I
1 D; }( O2 I' m4 m4 L& c__________________________________________________________________________
# p9 q) s7 f/ X% K, R3 g0 l9 ~
$ b2 K# i$ b, {$ @% M; PMethod 120 t) }$ w) G" D
=========
' A1 F, b7 U1 U
7 s8 i* d& H0 @, S& MThis trick is similar to int41h/4fh Debugger installation check (code 05' ^$ x; T5 N1 L0 F( x& W
& 06) but very limited because it's only available for Win95/98 (not NT)6 F& V3 c6 A% m* y$ a( p, ?0 q
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
9 Z. U% Q+ Y7 ~! w0 @, k2 S# B
5 n3 c9 R6 q5 }4 g2 G4 s push 0000004fh ; function 4fh6 J" O% b& f M! t2 O% ]1 ~( _/ Z( d, M! d
push 002a002ah ; high word specifies which VxD (VWIN32)
0 O( g1 S" T6 T) J- f |+ m# q8 Q ; low word specifies which service I- N$ ]' C1 ?& q* S$ |. G% n" j
(VWIN32_Int41Dispatch)0 ~" h" _6 o4 s% T( x' f: h
call Kernel32!ORD_001 ; VxdCall7 S5 T* _2 G* A! k4 o. o
cmp ax, 0f386h ; magic number returned by system debuggers3 c& b) v$ X( F# m, R/ [: Q
jz SoftICE_detected( W4 c7 W1 f9 B7 w f0 j, K
/ `7 O* T& ~2 w3 M, ?8 G GHere again, several ways to detect it:2 U9 f# v2 {+ u
3 {4 w' i8 l4 D S
BPINT 41 if ax==4f
+ R' I( r2 g: ?$ W' u, f$ w l0 z9 m
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one( V7 U; V3 x( N# R) \& a
, c/ L6 X" S& e- P8 L+ R: j
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A% r, G# F" h& ~0 {/ j
# {, d. m9 p$ Z
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
6 R# t2 ]; Q# t" y/ \" R; t, P
6 |' @9 q) g# Y__________________________________________________________________________
* p m+ K& [ V& B: y
& x: h% A! N/ I/ ]4 P4 L+ CMethod 13
& E0 x3 Z* ]6 y=========4 R8 X$ O- Z% N0 z! V
/ A5 Z* V4 T% j8 [5 [8 a
Not a real method of detection, but a good way to know if SoftICE is
- x9 G$ W# o+ P5 y1 A3 Jinstalled on a computer and to locate its installation directory.
4 M! x0 Q! S Z9 xIt is used by few softs which access the following registry keys (usually #2) :
' g' o, r9 j; m6 U& ^/ b D
) K( o( `- _1 U0 s: H7 r-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
/ G% r, f. ?2 z$ A2 V( r+ X1 W\Uninstall\SoftICE
- R' {% m) E9 J. P. i9 h2 ^-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
* B/ q- G5 A4 v+ k/ B* u, q-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion' t( f C. _: M5 Z' g; i. o
\App Paths\Loader32.Exe3 g& F$ F$ V, a5 i
( b+ }" L' p1 P6 D. g
& I& w2 n8 t) v6 y( r2 |
Note that some nasty apps could then erase all files from SoftICE directory
. P/ [# U1 L( H(I faced that once :-(
9 j- m9 `/ W3 S# S9 @
1 _2 S8 f+ G: n: N+ y5 PUseful breakpoint to detect it:
: w8 T% ^* Q2 q9 ~" c9 G3 v) J, L+ Y7 `$ I: ~
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'1 E" j1 I* }0 J
3 I. B% Q p4 |' m6 R
__________________________________________________________________________
, i2 x: M% w. [) _" ^) Z5 e: i) x, B
5 P& \8 x5 g9 H5 L
Method 14 $ x9 G5 a8 h% B6 q
=========
, e) g9 I; `& p1 {4 q9 a
5 d8 B- }- k7 e! F9 Q7 Z. B( r% zA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
; u! `/ A! n# Jis to determines whether a debugger is running on your system (ring0 only).
1 _& Z( b6 o; j: s9 x$ v. @0 o1 C k m9 E. G
VMMCall Test_Debug_Installed# ^' c H, U/ {& w( P. f, J
je not_installed$ e3 E4 K, _6 X& d
2 B) Y8 s3 q' ^: F H+ b G4 bThis service just checks a flag.
0 _ \$ ~- x- i1 L2 `& _) [9 k& Z</PRE></TD></TR></TBODY></TABLE> |