<TABLE width=500>5 ~' [; p7 }1 S/ y' z; P
<TBODY>, u! O0 W0 y" D1 d6 O
<TR>
, }# x/ i* e. K& S<TD><PRE>Method 01 1 x' }& b" X$ z- ~
=========
6 [+ `' w6 j# ]. t
. K1 y) }2 s0 q& u9 R1 \. Z- }This method of detection of SoftICE (as well as the following one) is; b1 O6 h2 A" C/ M% F2 B
used by the majority of packers/encryptors found on Internet.
( F5 a, @! K( W( KIt seeks the signature of BoundsChecker in SoftICE. q- J Y1 U- R7 U" _7 t9 I( k5 _
/ k3 h/ m: r# [% J
mov ebp, 04243484Bh ; 'BCHK'* f/ f* m+ I4 y0 f. t$ q
mov ax, 04h( z( G; J* c }, b8 z
int 3
$ k1 ] d9 N8 I cmp al,4
* ?6 V( g$ Z, S) ]! l, [4 P1 z jnz SoftICE_Detected$ p3 P7 ^9 { h ]0 l
o, o7 t! \% C4 p' `$ p6 @___________________________________________________________________________
+ }) s- l; a7 w. N% l5 M) h" v
! M& \' f" c) |, zMethod 02& N3 U Z0 p% a
=========/ F$ ]' C, L* `5 X- N" c
0 C3 y1 P- @9 D4 W6 n
Still a method very much used (perhaps the most frequent one). It is used
! T5 i& j5 m+ F7 j1 n# M1 u8 sto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
( @' Y* G2 O$ f9 ]or execute SoftICE commands..., f) s9 H! a. G4 b+ \& _0 M
It is also used to crash SoftICE and to force it to execute any commands
: g- `! |' z/ a' c2 q4 R+ B9 Z(HBOOT...) :-((
4 Y% w: I0 u! V4 @
( [! @: m/ k. Q5 h7 Y, {Here is a quick description:
$ x2 b. K3 i3 t; T; A, _. o; j. l-AX = 0910h (Display string in SIce windows)
5 w) k! x6 S( O! Q0 V-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
: o: _+ m& P- U s4 z-AX = 0912h (Get breakpoint infos)
# c- I2 n: Z N; q! C! x-AX = 0913h (Set Sice breakpoints)
: p: m. ~( a8 V-AX = 0914h (Remove SIce breakoints)
0 @0 b3 D1 I1 F
3 e$ Y6 s- e, U) M6 XEach time you'll meet this trick, you'll see:2 M* s5 ~7 t) [5 z
-SI = 4647h
* P. Q$ D$ C% _ y/ [-DI = 4A4Dh7 _8 a9 M# a5 u2 z) T
Which are the 'magic values' used by SoftIce.
# x9 g6 C1 t0 O1 I8 F+ ^9 WFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
! x! s8 y7 A3 d8 X, T4 L& k9 i1 S8 J- K. A
Here is one example from the file "Haspinst.exe" which is the dongle HASP
: ]9 y6 g8 b' ?) G5 b1 U3 _Envelope utility use to protect DOS applications:. m' \1 U4 Y) @" H
+ k; N, D7 _+ q* o" M" j
$ J5 x. t, w8 E% N2 t4C19:0095 MOV AX,0911 ; execute command.2 ^ ?+ e5 G0 h; K( B5 }& |/ u
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
/ _6 k, k' M- D) Q4C19:009A MOV SI,4647 ; 1st magic value.
4 \ E/ U! w. u4C19:009D MOV DI,4A4D ; 2nd magic value.# r, d# i+ ~: N4 Y) O
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)8 E4 {: Q, R! P' R/ D; ?3 o- o
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
' T0 K4 B) s$ I% E, N8 ]+ `4C19:00A4 INC CX
8 ~* g& B$ `$ u, _7 E* w6 w p4C19:00A5 CMP CX,06 ; Repeat 6 times to execute- k) Z: w6 s1 O0 x" |
4C19:00A8 JB 0095 ; 6 different commands.
+ t+ t T+ o6 M4C19:00AA JMP 0002 ; Bad_Guy jmp back.
1 g5 `7 f% G1 _5 H4C19:00AD MOV BX,SP ; Good_Guy go ahead :)& S/ w3 j* D# f7 {9 k: B* Q4 d/ |3 J( C
! f0 J) W; V- { ~5 RThe program will execute 6 different SIce commands located at ds:dx, which
+ x* w$ m1 \5 {0 b, s5 {, a5 Rare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.! G3 C3 _' a7 B$ I% m" L- S& l+ P
3 R0 |! J w, L1 b7 }' ?* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.' B. B* k) `! M
___________________________________________________________________________6 j+ M# J6 G3 @2 W3 G
6 P, K$ q; H) ?8 ^4 O6 L+ O
8 H' M% @% a/ O
Method 03
: t/ w2 k8 {4 w' W1 ^! ^( ]( f, a=========" r8 E2 y- g+ r/ r+ x' \& s
% u. Q- L7 C% A3 YLess used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
I, @/ W: m+ c8 q, ]) _. d(API Get entry point)
2 ^- r7 s% c) K7 c4 @, Y" c! R 9 ?2 e8 |3 _+ e2 J
, X. I' w/ j! _) C( C6 |! ?# T
xor di,di" V* N- g' }: U7 Q
mov es,di
4 k( H. |5 u* E4 \$ Y mov ax, 1684h
2 k! n" a& R/ A. z+ N2 E mov bx, 0202h ; VxD ID of winice6 a# g9 u9 S" b2 K/ k/ V. ^# V" N
int 2Fh7 L. b2 o1 n7 \7 a6 U4 h
mov ax, es ; ES:DI -> VxD API entry point
8 t% b& l6 R5 k5 g; @/ S! r add ax, di
$ f$ r: b! E! q: [7 \# v test ax,ax
/ C& S' {5 V, g) s9 f jnz SoftICE_Detected }. X8 S" b5 r8 V, G" ~* ^7 v4 L
8 C1 o+ h8 @$ |: K' w___________________________________________________________________________
8 I, i. Q) p" P/ ~4 X2 ?+ c+ h$ v5 D. k3 I& L& L: H- B
Method 040 H8 q9 C, j1 D; p
=========
' ~1 w& Z. C2 u8 h% \8 N6 t8 J) n7 p7 q: t$ R; d
Method identical to the preceding one except that it seeks the ID of SoftICE
0 d/ [/ T- M: b; m/ L( L( p! AGFX VxD.
9 h3 I( I+ r/ S) j c' e) R; X, x: c) }) R6 g- S: i
xor di,di1 ?& _8 s' X$ V( R' L6 J; u
mov es,di
4 D6 P. |8 O; c* ]* X mov ax, 1684h ( P8 X0 l3 K* o/ U( l0 V& X$ n8 _
mov bx, 7a5Fh ; VxD ID of SIWVID
3 x( k( Q* Z! L, y- \ int 2fh
3 w, ^* J S# s1 a( B) q5 D# V5 @ mov ax, es ; ES:DI -> VxD API entry point
% r& m& {0 e, P add ax, di
( Z1 |5 }8 {( k" _: \ test ax,ax5 o$ o, O# s' b) O: f" e: o3 Z
jnz SoftICE_Detected2 Y" {7 o, I5 u6 R& l
. O, T' P+ E+ W5 w+ S
__________________________________________________________________________
, A9 n8 g+ z+ V0 M% S
/ {1 `) d6 E% r8 O) O
- M* c0 D) f* ]3 c) mMethod 056 y. |8 X4 R5 K. I0 e
=========
6 `1 M. g& d( f, e+ u3 a" B6 M7 j' r+ m! a0 \- Q& E
Method seeking the 'magic number' 0F386h returned (in ax) by all system
7 N1 P( I- I U# b! w; M3 {debugger. It calls the int 41h, function 4Fh.) @; }' x: y* Z* O1 d. H; J
There are several alternatives.
! T$ \# m+ Z3 m, E9 ]8 y( A: [& m0 h1 W
The following one is the simplest:" [3 ]7 \. L- V8 D0 f! a9 f: x
7 L; P* ^+ H; a8 e3 j- ~ mov ax,4fh) u+ a/ e( e4 S& |" L
int 41h
* c! R* G) b/ ?. r7 U3 E* x' d cmp ax, 0F386* ]: v6 ~ g+ C0 Z- [
jz SoftICE_detected1 [8 A+ @* q2 {
' X) {3 F0 `6 a% @2 G
) m, Q$ K. J" J) \+ j
Next method as well as the following one are 2 examples from Stone's
$ a; ^8 c/ r6 k6 S"stn-wid.zip" (www.cracking.net):+ e1 e6 T. V6 m; t' |$ B
' I: G# F1 V" x
mov bx, cs$ p5 {: | s3 |
lea dx, int41handler2- l& w, O% O8 `5 J' b$ [
xchg dx, es:[41h*4]
/ c5 G$ j9 p% c) D- w K xchg bx, es:[41h*4+2]
$ |* O+ _) M; k# E# d8 W1 w mov ax,4fh
f& s H9 H( J( q1 @+ S int 41h h# P, K$ `7 z( o7 ~; a; v" N7 S
xchg dx, es:[41h*4]& Y9 I4 [4 v1 s( P% d! p% B
xchg bx, es:[41h*4+2]
$ x+ x8 m3 I. m! l2 I. } cmp ax, 0f386h8 W0 Y2 j% k& j7 K Q
jz SoftICE_detected
$ O1 R/ p$ M' o! p) A* C
" X' |6 @' l7 u) [4 D3 F0 D+ f5 wint41handler2 PROC
1 ~4 I* s% ?8 A `8 V! | iret* |) u# x7 ]: k
int41handler2 ENDP
/ q% j E4 a# Y! |5 u+ A% }2 N2 _' ]% Z0 s/ |9 {2 d
! X$ Y8 K: J, w
_________________________________________________________________________9 @2 |1 V4 u0 \
' k" v4 v. d0 t5 ^/ f. j
$ u" A/ ?& R+ s* o; h5 Z9 UMethod 06
) C3 F# N( S- ^! K V=========
+ t5 B$ r) J$ u
$ S8 |8 Y& h3 h9 T4 P6 X3 z4 X' q- ~- P! Z+ |
2nd method similar to the preceding one but more difficult to detect:
; B% U% j9 H. ^ x
$ `$ i6 V8 L- _5 L5 ]$ n- j7 S0 d% L2 [! C C
int41handler PROC; r8 h) v+ B6 R/ ?7 h5 F2 F8 j8 f# t
mov cl,al
7 o8 {3 r# d9 }$ I* j( X q( S7 D iret# l# ?2 s/ o% R0 `
int41handler ENDP' V3 p2 M# I/ g* f
8 g0 z/ ~. u+ M2 L0 e" C
0 p4 ]1 s( z; p" Q* b
xor ax,ax' ?7 i. W' T5 L9 u8 |
mov es,ax$ e ]1 U, x5 P1 X
mov bx, cs
5 Y2 o( ~+ t/ b0 ?0 X' J# n% ~ lea dx, int41handler6 U. V2 m2 s( p
xchg dx, es:[41h*4]
, o% f' R" R6 k4 G; W$ F8 \, t xchg bx, es:[41h*4+2]: w8 K, `4 c+ q* |3 M
in al, 40h0 ^" r0 b. @% U4 f# B
xor cx,cx9 F0 [ p# n. ]
int 41h
* i' p9 L& `( ?5 j' N xchg dx, es:[41h*4]: Y5 }. {7 t% X5 v7 w& o, J
xchg bx, es:[41h*4+2]; @4 N: l' F5 ]6 Z
cmp cl,al8 N2 g# W9 e7 ~+ E
jnz SoftICE_detected+ \4 I6 L' ?8 |, }3 s1 Z$ M* P
0 y0 Q. W/ J5 [- S_________________________________________________________________________9 k! d9 k% P& K9 D; c& s" Q' q% d
# y9 L/ i8 K2 K/ M- o( q
Method 07
& P1 a* ?0 \. i; n' W4 ^$ r=========
; b1 I7 W; m2 k0 ~& w- r0 {2 ]. F& n& V5 l. l
Method of detection of the WinICE handler in the int68h (V86)% E7 n- t7 @; Y0 u3 P
/ Q$ T) A6 N T4 G" Z6 {, y mov ah,43h
* _; X. `9 Z5 b4 t# W5 {- f6 B! ^ int 68h
3 d) R, Q7 Q# q* W4 @, L/ ^ cmp ax,0F386h
5 o% G/ T8 M. _: ? jz SoftICE_Detected
# F+ h2 U2 \5 \( p0 {2 q/ _0 @) i
% Q; V/ s1 w4 U8 _# X4 {$ z
: b4 g* e& o' ~) C! O2 h=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit& I @; x3 E( v
app like this:
/ g/ r: {4 V+ s5 h/ r0 e3 [
* o+ ~8 c- m* u) u5 [. C BPX exec_int if ax==68' i, l& h3 B: @
(function called is located at byte ptr [ebp+1Dh] and client eip is% Z! s7 v4 w8 N$ P
located at [ebp+48h] for 32Bit apps)
2 J2 n5 c9 Y" D, w5 k__________________________________________________________________________8 `$ f- ]* J6 j
3 g \$ Y" B- S1 G: ^/ J7 \; K; g( Y- L; y; V! l
Method 085 T7 s f: n; _ t- u
=========- z3 Q. m' q! L- `9 O
( J; x* a1 f0 m
It is not a method of detection of SoftICE but a possibility to crash the
; y$ ^* p" @, M2 X( p0 vsystem by intercepting int 01h and int 03h and redirecting them to another9 z a8 ]. h# O9 s6 ^; w
routine.
$ k2 y+ }% c: |8 l: ]& sIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points* p9 v w) P" {! o/ q
to the new routine to execute (hangs computer...): p. T2 a5 n3 T0 O. H6 K/ L
+ m# o& t( g/ [. U8 n% x
mov ah, 25h% ] ^: m6 Z. e; g4 O5 U
mov al, Int_Number (01h or 03h)
+ ^' r5 h: t; C mov dx, offset New_Int_Routine& a) \* j8 P9 I' c& l: R; S
int 21h; G7 I+ L1 x; g$ P" H% T
5 r# w0 L3 T. I$ n$ i+ w5 }
__________________________________________________________________________; u! Q- |* r! u/ J: J
' K, Y% K. b4 p) p0 r$ L
Method 09* B* ^5 I& z5 n2 i+ K
=========9 M: Y9 e& \3 N% }
8 m- F0 s @9 N5 @$ xThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
0 v* L4 l% T9 {! Tperformed in ring0 (VxD or a ring3 app using the VxdCall).
) c7 |, {/ x4 v3 L$ f: QThe Get_DDB service is used to determine whether or not a VxD is installed# u6 z' P; U: J- c
for the specified device and returns a Device Description Block (in ecx) for% J6 m* D/ U G% [( B5 p
that device if it is installed.1 ^2 K6 Y: U8 I" p
0 C) T8 r& ^! h6 H; {2 ` F& n
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID" \/ N7 o1 R4 K3 y
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
, m' Z, Z" m1 s, I) c VMMCall Get_DDB
Z D4 ~0 @' f* p mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed! {+ ?$ w" y9 M* U9 z
1 Q0 r8 ^! c- o1 e: k0 |9 ]3 @/ d
Note as well that you can easily detect this method with SoftICE:
8 _) N/ E7 ?0 t" x bpx Get_DDB if ax==0202 || ax==7a5fh5 N. N4 c0 `- @0 z" O( X, O
0 k, l/ f: b. G8 K( l
__________________________________________________________________________1 ^/ R6 Q2 `0 }( R6 W+ Z
$ Z0 N# b1 R( a# m0 K [
Method 100 e2 s, L0 [8 J) ~6 B3 p9 c2 z
=========
" D. R' l4 f+ r5 \( y' Y5 ]" Y' B {$ ]
=>Disable or clear breakpoints before using this feature. DO NOT trace with( }) m4 d& c9 B% L5 ]. V' d: O
SoftICE while the option is enable!!& R1 \+ }$ ^* H: @4 J, w
1 Y, g, S2 @7 XThis trick is very efficient:% W6 p2 ]$ B' m" b3 k1 V
by checking the Debug Registers, you can detect if SoftICE is loaded1 V5 e- o- u! y u% U% ~3 [
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if: z6 y( Q4 e& ^9 l( F% Q3 K9 w
there are some memory breakpoints set (dr0 to dr3) simply by reading their) |! ~% E6 y1 I5 u" N
value (in ring0 only). Values can be manipulated and or changed as well
1 I1 S; c5 q. j9 `0 ]! Y' }(clearing BPMs for instance)# o! e3 y; f, l2 L; z
6 _! T- @5 H& a__________________________________________________________________________0 X( j% N5 Q8 n5 A) `, `
; q4 L% t. \+ y5 r
Method 11/ ]; D. s) W) u+ I# C! G" \
=========6 ^* [8 e" f& T$ t% E* f' x
7 }7 _4 M0 R0 |7 `' F. i- H# T
This method is most known as 'MeltICE' because it has been freely distributed
" b2 S, A5 J' s( nvia www.winfiles.com. However it was first used by NuMega people to allow
' z6 P: W9 o, u, s. VSymbol Loader to check if SoftICE was active or not (the code is located
: x, V4 f9 }& Y9 `inside nmtrans.dll).6 G# t' n( ]" l) I) j7 }' C
9 c; Q; i z. d9 u# h8 w" V% RThe way it works is very simple:( K* Y2 G' W, q* b c# [; ~0 W
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for6 b* u% z7 e6 y0 b1 x; F& I
WinNT) with the CreateFileA API.) @' r L/ U. s( P. v6 Y+ O
9 O9 n) u3 U, H$ F! SHere is a sample (checking for 'SICE'):
! ]/ i& s @, X7 q) a( s2 K9 B6 I. ^6 n0 H; p: T- E* d
BOOL IsSoftIce95Loaded()
& \# Q+ A: j9 S% P( J{6 `+ H' R5 Q3 w+ ]/ L( _ U
HANDLE hFile; W/ B) V7 Y6 E7 P9 z: W: [
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
9 y+ M. w) ^' \ j$ i FILE_SHARE_READ | FILE_SHARE_WRITE,8 z5 R7 G! p( r2 v$ }7 K
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);% E2 A/ M9 I, O9 O3 O# Z' \3 t
if( hFile != INVALID_HANDLE_VALUE ) I: w, o: j( l9 [( ^! n* g
{
6 o, {2 }% I; w, W, O6 M/ [ CloseHandle(hFile);, c% W6 [* W; z5 r) _7 J4 o( t& u4 H) N9 b
return TRUE;4 F' V8 B3 V% i1 m% `
}
# o' Q0 M3 z0 s$ s4 F% ^% ?: n return FALSE;: w# l0 a, p8 p' h
} O6 ~, N0 u) z6 \
? X Y3 {. M4 u7 @8 y4 _% D+ {Although this trick calls the CreateFileA function, don't even expect to be1 n( j4 e. p, a
able to intercept it by installing a IFS hook: it will not work, no way!! `: y2 m7 Z! B
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
" G6 T) N+ u& E6 V& Eservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)) N7 a# ?$ D x$ P- T" N
and then browse the DDB list until it find the VxD and its DDB_Control_Proc6 e. A5 J0 v5 F
field./ Z7 C$ j6 V. d2 G
In fact, its purpose is not to load/unload VxDs but only to send a
" J: h7 G0 b" YW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
7 W, P' N$ H- U# }( p3 rto the VxD Control_Dispatch proc (how the hell a shareware soft could try1 G% D1 l- j' H! b7 Z3 E
to load/unload a non-dynamically loadable driver such as SoftICE ;-).- R% f0 q# X k% n
If the VxD is loaded, it will always clear eax and the Carry flag to allow
/ g1 F* C( Z- G0 Dits handle to be opened and then, will be detected.7 U4 v0 j3 [' J. O; y
You can check that simply by hooking Winice.exe control proc entry point$ v. N7 t E- C: R6 K
while running MeltICE.% B% @' [1 j6 M& K0 g4 [
, N5 Q0 p1 n! W
* }* a2 f6 I; u: g1 \# |
00401067: push 00402025 ; \\.\SICE
2 D k+ Y: m5 h# X 0040106C: call CreateFileA1 _0 g- P7 p! u. T! l
00401071: cmp eax,-001
$ @8 ~* a+ E9 U, ~5 g* X 00401074: je 00401091
2 S5 ]- B9 @: F2 V( n5 {6 }1 k1 O% O6 \' q2 s
! D# t) t' ]: q$ @& W( [
There could be hundreds of BPX you could use to detect this trick.: V/ ~3 n+ f: U& _% f( q4 Y. U
-The most classical one is:6 ]2 Z. j0 h0 D
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
6 c2 s4 x: `: ]& t *(esp->4+4)=='NTIC'
2 W( b: n! Q( |7 X! b3 d, u* P _+ [3 e. l3 u* l7 U& h" F
-The most exotic ones (could be very slooooow :-(
: c% }, j9 V$ e, M2 A BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') 3 E1 z/ }% H; E& G$ B& u
;will break 3 times :-(
) g E, _! S8 D* C; E) M, [3 C2 ?9 q+ Q# G3 J2 `1 n- g: J4 _
-or (a bit) faster:
/ M+ I m0 ~# }: W5 Y BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
( W0 B* j( ?$ k
* O9 D. M! X9 W' x) t7 l BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' ; B) j4 e. C% W. l7 j
;will break 3 times :-(
% a- S6 p, r0 C+ f9 z5 u$ {( H# B& ^' W- ?* e1 R# r; {; l3 A2 t
-Much faster:/ J; l, b# U r* _' T0 i
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
( K. ^0 U% U1 d# h' f+ J1 F, s, e* \( T9 V7 B, f# L! \: G
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
4 Z# h( @: p( G c. I* g3 p9 h' D* {function to do the same job:+ ]$ s$ p, K+ {' B* f& q
2 d) ]5 e& t: l4 G
push 00 ; OF_READ
7 H! x" w" ~# d7 M& Y( C( B mov eax,[00656634] ; '\\.\SICE',0
+ _1 T. {5 ~6 Q5 `! g push eax$ s( ?3 c6 O) G
call KERNEL32!_lopen
, \2 q, g, k4 [5 g inc eax% l- S5 b* T1 Y8 {! h6 P; M% ?
jnz 00650589 ; detected
. P& v3 A, C! `1 {/ B5 S, s push 00 ; OF_READ) l% j d' W, W6 b0 P8 a8 `* }" D6 L+ @5 ?
mov eax,[00656638] ; '\\.\SICE'. t, l7 _( w6 N4 a7 B5 ?2 s
push eax) {$ n( h9 y9 I2 M
call KERNEL32!_lopen7 x2 \2 A# R; g* F+ i- ^, H
inc eax
2 Z) m- B$ U0 B q6 W/ k0 ^* H jz 006505ae ; not detected6 t7 A, | v3 U' ?2 g6 B0 L
* ?5 Z* G9 B7 e# F+ @
* k, R& N; H) [8 }2 d
__________________________________________________________________________
# ^: k% ]4 [/ {$ h6 g
$ U+ I3 Q+ I( o' aMethod 12
( ~" A, \6 ~2 x9 F, j=========5 O: u( R' p; E! `- D1 S$ f4 w$ B
; {: s6 |! d6 e$ \2 wThis trick is similar to int41h/4fh Debugger installation check (code 05% A, j9 g* V4 {+ @8 ~; P
& 06) but very limited because it's only available for Win95/98 (not NT)$ C$ D4 D2 S" s
as it uses the VxDCall backdoor. This detection was found in Bleem Demo." y4 G( I# a* E. C Z& y
2 c5 C! |: {4 y: ~5 `0 V G% _
push 0000004fh ; function 4fh
/ ]9 r2 Y3 _, |+ |# y; ` push 002a002ah ; high word specifies which VxD (VWIN32)
+ Q. Q' J: h& M; ^% t. n3 ]5 |* A ; low word specifies which service
+ r) E- d' E6 a* }0 e$ J2 u2 I7 y (VWIN32_Int41Dispatch)
2 B6 [7 `- L& S9 ] call Kernel32!ORD_001 ; VxdCall( p3 ]4 U* T3 G9 e. `
cmp ax, 0f386h ; magic number returned by system debuggers% g, Z: I; I* z: a8 D o! x/ C
jz SoftICE_detected
& \' g. L$ l7 @3 @
9 i/ d0 b. k( K- `. uHere again, several ways to detect it:! g! d' y' V/ D I, e0 T
" L, t# P7 q |; Y0 g BPINT 41 if ax==4f
+ w% w/ _& ^1 R! P- C& s3 [: \0 K1 t! r; [7 Q: p3 ]: e
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
- u/ n2 I! \/ W) P- H3 k; j/ E0 }6 P( C
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A
( d- _+ V2 U% E- B6 J4 p, e
- l3 R4 K4 p' n2 e( T BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
& U8 B! E0 b# j4 ^& B$ Y
) D- [+ I8 x3 d& j0 b# b__________________________________________________________________________
7 C% X! S+ B' v* D9 \! ]5 ]( o5 m
Method 13
9 s5 P3 p- c& p7 e1 e3 m& l=========
6 K n7 k+ Q; D+ A" u5 `/ B8 E" P/ e% _1 z
Not a real method of detection, but a good way to know if SoftICE is
# q* i( m. q( Z# x+ ?+ Kinstalled on a computer and to locate its installation directory.8 {- _( e& d! P- \: A
It is used by few softs which access the following registry keys (usually #2) :
6 J' w& r, |, w- D1 N) H- |, A! | ]" d) U5 B
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion; g5 ~* K1 m" j! m# k
\Uninstall\SoftICE
" f" [! g' @7 d9 l-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE! R5 u, `5 l: I O/ Q0 k& c
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion6 B! k3 I# N3 d; x
\App Paths\Loader32.Exe
, Q. n' I" b0 D
( G% g+ J$ W' e* W8 r. E" I: U$ `4 `# e0 d9 M8 l! k' B; @4 i0 e
Note that some nasty apps could then erase all files from SoftICE directory; t. P: \( o, ~9 n, f
(I faced that once :-(5 ^6 L, ~, a: \$ { k, @
: P( c7 Z; h9 m6 Q' IUseful breakpoint to detect it:
: D' r* N5 B8 ~, g7 ?- e# D- C' l! H2 t5 Q s4 F+ Q3 r$ @: \
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
& R% C& t3 p, q/ L; l* r& u9 Q( i3 j+ D @( v6 F
__________________________________________________________________________% F0 f3 R4 g7 j" X q
& Q- r1 [! l- g0 R5 R$ `( U, a6 F5 F- `3 u7 v& o
Method 14
' p; T1 N: E, `4 E$ a2 P( x=========
* j1 i' d ~! o' ]0 x% Y& b3 J \$ Y: k
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
: ]9 x; _1 g$ `. j3 y; j6 m/ Mis to determines whether a debugger is running on your system (ring0 only).
1 f. j4 [& }; b, }. |& E( l. ` B# z$ ]; O8 S v
VMMCall Test_Debug_Installed
1 n$ Q; z2 Z; h: ?& j( A je not_installed# c' ?1 u% t3 a3 C: r6 F
2 b6 V' M! n8 e& Y
This service just checks a flag.' f. d' p# e% }: C8 s5 l+ g
</PRE></TD></TR></TBODY></TABLE> |