<TABLE width=500>/ h" [/ ] F( \1 m( O) z' A0 G, p" _
<TBODY>
0 B! S4 f4 o0 G7 S3 f<TR>
8 h; t& L' k/ k- S K5 D/ o+ {+ u4 A; Y3 b<TD><PRE>Method 01 / T7 z2 p: h- ?! f
=========/ e9 V8 i% g8 F" W0 Q% m
% X) n* n6 K2 ]1 Q
This method of detection of SoftICE (as well as the following one) is1 @: E) m# v! y- g
used by the majority of packers/encryptors found on Internet.$ T4 ?$ T) _& j! G" |
It seeks the signature of BoundsChecker in SoftICE
6 k0 [: ]1 x! H$ E% a6 V+ M$ g" R4 m* l$ r, u
mov ebp, 04243484Bh ; 'BCHK'+ l( D; O U. `, i4 e
mov ax, 04h1 Y; Y% n0 |5 n" K! o4 G
int 3
) P+ A3 ^2 D% \5 |7 }0 e$ C% o cmp al,4
, g9 X7 A* i" {: _ jnz SoftICE_Detected/ i' c" M5 R& U& B1 m4 Z+ g$ v
+ U% P* i1 p% B. F0 u
___________________________________________________________________________8 a3 k' F/ c: \' L# Z
+ [+ x! q0 O' T+ ?% p( C# oMethod 02* b4 {9 _3 `4 v3 I7 d
=========
2 `9 R4 j5 k6 P9 A
3 V6 G! s5 i$ ?# m5 B/ T: pStill a method very much used (perhaps the most frequent one). It is used
5 B" }/ o0 T' j$ W, Y' q6 { |( hto get SoftICE 'Back Door commands' which gives infos on Breakpoints,8 m4 o$ X+ V# h7 j1 a( Z W6 h
or execute SoftICE commands...- G, ?; K1 L" Z
It is also used to crash SoftICE and to force it to execute any commands
; l) P: @# d9 `1 ~% _* e(HBOOT...) :-((
5 t4 l6 d m& _& V3 g4 A2 l3 Y; f! H: ?, f
Here is a quick description:2 h0 e5 X4 r0 B( h' D1 M) Z" z
-AX = 0910h (Display string in SIce windows)
: h* S8 t6 }! d5 Y, w* I-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)
( F6 I# G/ t5 Q ]-AX = 0912h (Get breakpoint infos)* J! V0 S2 H: q( W) m
-AX = 0913h (Set Sice breakpoints)* l2 f0 O! l/ F% B- r; r
-AX = 0914h (Remove SIce breakoints)
& a4 G3 Y( y) m" M/ X" @. I$ z6 k' x, N& Q
Each time you'll meet this trick, you'll see:
2 [/ Q4 S: d1 [" t3 i-SI = 4647h
( O7 j. H. a) g" h8 S-DI = 4A4Dh4 ^" T+ }6 O- m
Which are the 'magic values' used by SoftIce.
' U: ~2 X! ~ C% i* @& U7 O4 KFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
! L. r* H$ N) e, M# Z- p
' O% c: E! W6 p" {4 VHere is one example from the file "Haspinst.exe" which is the dongle HASP
) I- K* q) v; h0 C- `Envelope utility use to protect DOS applications:
' p' O2 M: ~9 i2 `9 v" M, t8 C/ z) @# E% J& Z/ q" d
7 S* Z) L6 a" Z' ^# t4 x! Y% T4C19:0095 MOV AX,0911 ; execute command.
}, b2 E" p3 t0 H+ Q4 o4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).
# V$ s: k- s% `! G2 M4C19:009A MOV SI,4647 ; 1st magic value.
# Q" I' v1 U3 m- L/ | q; m, s4C19:009D MOV DI,4A4D ; 2nd magic value.8 U; n. b- U. f# P: x: o$ r. I
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
& ]& W' k% B4 g4 Y* u7 V0 j# W4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute
$ w4 w/ ]9 r' t: t: n# w2 X/ E) d4C19:00A4 INC CX j+ `: K1 j$ o* h& p; m
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
0 V1 x2 |8 N& z$ R: }0 y+ }4C19:00A8 JB 0095 ; 6 different commands.
" o7 E& H C. R( P4C19:00AA JMP 0002 ; Bad_Guy jmp back.
# E+ A0 n8 U) Q6 w4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
. Q$ }/ U+ N# I3 h4 t k- h) ^7 v' _" _+ ^9 i
The program will execute 6 different SIce commands located at ds:dx, which
+ ~+ j Q; M" T. u& `' i$ Dare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.6 B% r- Q! X$ o7 s. J' \& g$ P
1 U- ?8 c5 z M2 d, L# Y9 e( D7 Y
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
" }( O1 P+ _* K$ L9 }. M$ Q___________________________________________________________________________/ Q% ?. W8 J; s( _* Q" a
5 L2 B8 D. ~; c: s
) l& n- r9 H% zMethod 03
! c. h. J# y. ]8 t=========: ]( c0 X* L5 U7 t: O+ V# ?
- V, E& i& i. w" @ [8 {
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
( _& A- I6 t+ ^0 s(API Get entry point)
o8 e! d2 P$ Z t : h7 U' u' J5 w
4 S+ W; N r+ V( A# e3 U# U
xor di,di& H* ]9 w h) k- I) i# i
mov es,di. O# P( U9 ?' V1 e$ X
mov ax, 1684h ' \) R6 |$ K: P
mov bx, 0202h ; VxD ID of winice
' R" y' w/ I% F9 f+ ? int 2Fh5 T5 F2 _2 A, ]( V
mov ax, es ; ES:DI -> VxD API entry point
- M# W' V( a' Y! [ A6 f add ax, di
) h( v. K) r4 F7 \ test ax,ax
9 X( F; W @) w, J9 A: ]( k jnz SoftICE_Detected2 C$ W9 W5 D! j& A2 l7 m
1 G& |) _3 {+ w( \
___________________________________________________________________________0 M& `. r8 k0 X
7 i7 |& L; `* T; jMethod 04/ ^3 d6 n9 | n4 a
=========5 D& c3 o( Y6 ^- i3 L/ p1 {! K
# b; O: j- O( T' o
Method identical to the preceding one except that it seeks the ID of SoftICE4 @" R7 h0 Z( Q: s
GFX VxD.5 k `0 @7 { e3 s
$ n+ y9 z* K3 w% ~( j y xor di,di
, ]4 Y: Q2 L/ [! A* T; B mov es,di- Y1 e4 k5 z- t
mov ax, 1684h
5 y& ?* @/ C; C5 _" s- P6 o mov bx, 7a5Fh ; VxD ID of SIWVID0 G) Q, N+ \0 J7 L, a; Z
int 2fh; g0 e% K, y6 Y
mov ax, es ; ES:DI -> VxD API entry point f3 ?- b- I' C& C1 p, G
add ax, di1 }7 m/ c, p9 G1 o" u$ `9 M
test ax,ax
' `" t1 l' }! Z( m. p* ` jnz SoftICE_Detected
4 K$ x4 b8 }1 N% _* g; B& d A
/ o) B- c0 Z8 R% ]! ___________________________________________________________________________
% X/ d2 G9 r7 \8 L6 r5 o& t- O5 x5 o# L. t' B7 I* |
9 H7 `* H& ?" f$ v' K9 i
Method 05* E& Z; H9 v. X# ~
=========; I5 L) g$ Y, z& ^# \7 Z1 u
- f: O& l; G4 k4 ^/ v
Method seeking the 'magic number' 0F386h returned (in ax) by all system- N6 I. G O3 u4 v
debugger. It calls the int 41h, function 4Fh.
3 \% f, s# s0 j6 VThere are several alternatives. + H, ` w- A; F8 d" f5 @- I
( {# F6 O- {8 Y5 u
The following one is the simplest:" S1 y) O4 G; F5 I
$ S/ ]: M8 `1 u4 K# ` mov ax,4fh2 y, P* f" z9 d2 k
int 41h
$ ]7 c4 Q! P# I7 M$ ^2 a+ ~ cmp ax, 0F386
% U v0 h, b- x, h$ e jz SoftICE_detected& r* m# t5 m4 z8 V% c9 f0 a$ t
8 |, N2 A5 L: D; F- N8 J {+ R2 N$ ?% F4 k b! G7 N
Next method as well as the following one are 2 examples from Stone's
9 H% a5 m9 T5 W! l8 h+ p" S" r3 w"stn-wid.zip" (www.cracking.net):1 Y' g9 l$ n" Z3 c5 Y9 i# {' m6 a
) M- t3 y1 f3 ` O8 H mov bx, cs
- _" s% F! z) l lea dx, int41handler2; n! A% o+ D( R. y9 }* e. t) D5 ?
xchg dx, es:[41h*4]" w+ D: J# N: H8 ?9 ^* L7 N
xchg bx, es:[41h*4+2]
! ]& k2 d, v: i9 q mov ax,4fh
5 T: A4 k! y ?6 k$ a int 41h
8 ]3 M" E* T- V; ^( G xchg dx, es:[41h*4]
( f+ h; l) r" N0 i2 P xchg bx, es:[41h*4+2]
& R% J. P( S4 A3 _ cmp ax, 0f386h
. Z$ }- i7 x" ]- `4 V' B jz SoftICE_detected. l: z- ~/ l* `! I8 l. z
* e% A" J: k0 n8 L7 `- {7 F* |
int41handler2 PROC* Z- r' @4 `" {4 ]* [. n; D
iret
/ o# J1 n4 l6 @int41handler2 ENDP: p, J: _) M' L1 y+ M! g' x
) w6 w1 r" v, h) j4 \/ H; n2 k: ]) T" _' _
_________________________________________________________________________
1 }1 `7 ]& v9 g- e0 O5 J( j7 z; @ w- h$ k: `
) o8 I- S8 D% m: c4 I" k- b& XMethod 063 O- a5 [: K! u. y3 @
=========( x, S0 T. }6 a# S
0 m, }. X, y. c$ O
$ Y. e0 e9 T9 a. x: B' A" f
2nd method similar to the preceding one but more difficult to detect:
# _2 Z! G* P2 Q
1 h! s: F! ]! w) j+ I& |7 Q* [- l1 z2 e- u$ \* p ?7 Y
int41handler PROC
0 Z# T9 Z) [) y6 k$ d mov cl,al
# Y: l5 Z$ O% O) O; m5 d4 v iret* H1 m0 x, y/ ^/ Y, r, T5 B1 W
int41handler ENDP
% Q8 g* ~: ~7 }( j- i/ o2 c
& V, b0 M. L9 m' l4 V9 e" k* ~: O, |" [2 o9 u# q
xor ax,ax3 p4 A; U" y: X- p& {
mov es,ax+ K6 L" w! e5 y4 h6 {
mov bx, cs% Q) {1 ^( n2 B$ ~( H
lea dx, int41handler
: B( p0 }9 w+ E, q xchg dx, es:[41h*4]
% f( z1 V" a5 C xchg bx, es:[41h*4+2]: ]* G! r1 M- H% R* G
in al, 40h6 ~7 a$ n& T( Y, ?3 ?% ^ {% ~
xor cx,cx% G3 U# B v6 v, J( U% W8 ^
int 41h5 Q& V6 |9 u$ j4 ~4 J" e
xchg dx, es:[41h*4]3 ]4 [ j/ G1 x" M% T1 x
xchg bx, es:[41h*4+2]
) ?' V3 x2 E4 `9 J cmp cl,al
6 h: ~3 O. ]8 n5 r1 K jnz SoftICE_detected& ~: V. u/ z- p3 t
" T, ^* H4 b7 O( P/ y6 i
_________________________________________________________________________
$ k3 u. B0 H- a9 }/ \: ]3 h: t) t/ f# C) A
Method 07 ?% b/ G- a0 P( O; O
=========
9 g. ^: e ~5 ^; @
7 k* ?5 k; `1 y! `! f8 CMethod of detection of the WinICE handler in the int68h (V86)
7 T4 C0 o) C; Y. h4 N% P/ r9 _' J! Q: l) s6 ~$ T# U, u
mov ah,43h
; g3 s( w$ j. z, [ int 68h
! H; N7 e3 t5 n' J5 H9 |! [ cmp ax,0F386h
, a# Q1 D6 S# P jz SoftICE_Detected
/ @4 Z0 D' c/ H9 ]% N Y
9 R0 X$ B; F2 l) v. ]5 z/ T+ s! \7 t) B( ?
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
8 N: z& Q, \% G1 v7 e E/ ] app like this:' i8 ]' G: m2 A9 n! G0 T6 T
Q. [% Z: z! ~$ b& S
BPX exec_int if ax==68
! e/ z* ~3 k% ^/ k (function called is located at byte ptr [ebp+1Dh] and client eip is
8 e0 p. \0 ]7 C* w located at [ebp+48h] for 32Bit apps)
& R& f0 c) M2 p5 c+ u2 {( ^__________________________________________________________________________
8 t `$ g4 @* I. B
4 K0 c6 X2 p! k4 i; H/ U! x$ T" b1 P% i2 g* v) L9 V2 o
Method 08, J0 _5 k% o- [6 a
=========
) t8 [3 u9 D- ]6 y, m
, e# B+ G: C2 ]7 g. TIt is not a method of detection of SoftICE but a possibility to crash the
- M @/ `0 i3 J" s' L3 K1 Msystem by intercepting int 01h and int 03h and redirecting them to another8 S z1 \ ?6 _$ T
routine.+ y* H7 j5 y+ C7 ?& l
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
6 j7 D. f3 @) J9 w# Rto the new routine to execute (hangs computer...)
3 S g3 r8 p7 G5 Y+ W8 j: ]8 C2 e; h( _' s3 Q' p# `- |/ h
mov ah, 25h
/ u6 x+ _6 M3 {- `# e, \ mov al, Int_Number (01h or 03h)" a, n# r, Q( e" s4 P
mov dx, offset New_Int_Routine
. x! n" `4 [* A/ h: M+ I; D2 _ int 21h4 a" l. c- {8 B3 I$ T
$ |4 W2 x! I9 m8 \5 K- }
__________________________________________________________________________
) Q: `1 i' p( y' h+ k
% n/ V- H9 U) pMethod 09
& ?! _5 Z: ^$ y* u+ X$ _! o=========
m" S" b! M/ i4 F
. j- E: F% c: M* f4 N( k rThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only6 n5 s; v8 X: A3 E# @# h
performed in ring0 (VxD or a ring3 app using the VxdCall).2 E' r4 i6 G' g0 ^4 r8 G, C
The Get_DDB service is used to determine whether or not a VxD is installed
2 S: ^) M* F7 q# k; p( V5 Gfor the specified device and returns a Device Description Block (in ecx) for0 B& b8 G2 C/ k0 W3 b8 ~5 _! k" }
that device if it is installed.
4 n+ t- w8 k. U2 z( ~- |% p0 y7 ]; {( D* E& y9 w
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID; J* P6 s9 Y. w3 r0 y) v
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
6 Z4 {1 C$ x. s, b: [ VMMCall Get_DDB
. |0 E# _5 a6 W- i7 j mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed+ W: R6 r/ n3 A& }
9 E* S! H5 T7 o: W( O* V
Note as well that you can easily detect this method with SoftICE:
$ F. q1 P$ J9 k bpx Get_DDB if ax==0202 || ax==7a5fh
( f/ w/ @- l% c2 y# u" G0 J+ X$ o# w/ P
__________________________________________________________________________
: u& k& R9 h8 B" f
# j( i q+ ~/ G6 S! y. k: M/ c# [Method 10: F# {! i0 u0 V2 O9 X% R, y
=========; r$ x1 C4 c1 g! [. j
, p5 W9 A- x% U2 Q( d! _ T=>Disable or clear breakpoints before using this feature. DO NOT trace with
! U4 C5 ]& v- k% ]: W" Y% o SoftICE while the option is enable!!
3 B, [% W/ I( y1 B( Y
& z, o( [6 d" e/ Z& I8 `& i zThis trick is very efficient:: W8 C8 v5 ^! l2 h2 S
by checking the Debug Registers, you can detect if SoftICE is loaded4 i0 G, }/ t7 ^( z, X8 r
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
) |) r( K1 q7 ?2 v0 I6 Ithere are some memory breakpoints set (dr0 to dr3) simply by reading their, U" K) x- u5 z! b& n4 I% X
value (in ring0 only). Values can be manipulated and or changed as well! K+ O8 i( B: C8 \- q9 T8 _) a" A/ M$ S
(clearing BPMs for instance)
& h1 e. m" X$ X2 ?' k
" j9 `; s; g( s0 R__________________________________________________________________________
6 ~8 a3 `, S2 }8 ^+ }) x1 I! @8 @3 ^! j' }& Q+ V4 q {
Method 11
9 Y6 b9 W0 x) m' v$ L=========
6 a. D, a! l# ?6 D0 J# a4 ]) p$ ~* K9 G
This method is most known as 'MeltICE' because it has been freely distributed! ^- j% w% j+ N5 y) T
via www.winfiles.com. However it was first used by NuMega people to allow
, k( o/ W7 P( U0 ^Symbol Loader to check if SoftICE was active or not (the code is located
9 `$ p" ^3 x) u* {8 f' Oinside nmtrans.dll). B; _& m4 i) ]9 z
' l. t' d' k& uThe way it works is very simple:
0 f) F& k( L6 Q( ]( DIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
% i. J l) D$ a5 ]WinNT) with the CreateFileA API.
6 y$ j; X5 w2 o0 {
' ~ l: d' v+ g# f) Q4 YHere is a sample (checking for 'SICE'):9 `( U) ]8 |5 R1 S, V
& E- K& V' [8 D3 _5 `0 b2 J$ ^
BOOL IsSoftIce95Loaded()2 S! {9 o4 v# ~
{. }2 L7 Z' {/ f" j- K
HANDLE hFile; : X" t& A+ F) r2 w5 W' x+ f
hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,9 o1 M+ ~, F7 H/ y
FILE_SHARE_READ | FILE_SHARE_WRITE,
1 U' e/ ^7 T+ N0 D9 Z% g2 {1 J c O NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);9 }+ s/ o/ t: E& q! \6 L
if( hFile != INVALID_HANDLE_VALUE ); V- c" B; _- e
{
& s4 \5 v+ V. ~% @3 z% Q CloseHandle(hFile);
2 s+ C7 M. N# W" F+ v return TRUE;; s" P0 ^& ~$ \/ i, @
}
4 H! \8 H9 s9 u, p& R( X return FALSE;9 D+ z l: Y8 M5 D9 J9 |
}
/ d& M3 x3 d7 t- C, z5 v1 r! l8 L" s' i) i
Although this trick calls the CreateFileA function, don't even expect to be& o; Y' m2 ^ a/ X4 k5 Y$ A9 G
able to intercept it by installing a IFS hook: it will not work, no way!# e/ S& X; Z; v. ^) m0 u
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
' b/ N4 a- G- a: H8 m& L9 J# dservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)7 |$ k0 J) R% G2 ?, ^
and then browse the DDB list until it find the VxD and its DDB_Control_Proc! S: q8 t! ]5 P) L. @
field.' n* L9 F- a, U; E O
In fact, its purpose is not to load/unload VxDs but only to send a 5 ?% G. H e+ l; _" p
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)" `* C& \2 P* S, V/ S$ Q- V6 P/ D
to the VxD Control_Dispatch proc (how the hell a shareware soft could try) v3 y) q( [% X2 i' d/ ]
to load/unload a non-dynamically loadable driver such as SoftICE ;-).2 [' ^% ~5 \2 u7 P: n
If the VxD is loaded, it will always clear eax and the Carry flag to allow
/ m7 s* e2 a. d# Eits handle to be opened and then, will be detected.
% g) S! f: a; P; a; {4 GYou can check that simply by hooking Winice.exe control proc entry point
: F0 F2 {! ~$ C! zwhile running MeltICE.& [% v b h- \9 a4 x0 Z* Y
$ N6 G+ f- q6 C& [" E
0 J* G F. O- s
00401067: push 00402025 ; \\.\SICE
6 W0 Q. K) y9 @. M 0040106C: call CreateFileA
- u4 n/ @$ q! z 00401071: cmp eax,-001
; p: F; i3 T1 G7 ~ 00401074: je 00401091
, E; I" R d- C5 r2 F
" o4 K9 H5 @4 k! }0 V1 l& x- O( g/ S7 C a* a* X! U
There could be hundreds of BPX you could use to detect this trick.
+ j6 Z' l3 q& K9 `-The most classical one is:: j& b* t" Z# Y& V, [- N
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
* E" L& ~3 |, I0 z *(esp->4+4)=='NTIC'; \# v- Y# U" o2 z& z
' \9 C" |1 }3 W' W. p; Z' j
-The most exotic ones (could be very slooooow :-(
* _# V( d( d9 P BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
6 ]! ?3 A/ F7 A- j; r3 U ;will break 3 times :-(# g* V4 ]" s9 s/ y5 q6 q! Z- }
P8 |+ J2 m8 Q: g-or (a bit) faster: " q" M6 n8 K: w& @" g4 O4 a. Y
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')* K( N6 A( ?8 ^# Y( A
2 c- g* p4 H! t+ e BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
{: o" n/ g: ~8 k ;will break 3 times :-(
* o$ C/ [. D, I G0 ]2 c
, Q% n2 u! M! l1 r; e2 [7 ^-Much faster:
( [& u8 ^3 \ e7 T& ~- T7 | BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV'
# \4 d1 g' M8 ^0 G5 _) D; H) V% r, _) t7 C9 H$ n2 @ ^
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
3 j, W* _2 m! {. F4 f. E& \% Gfunction to do the same job:
* J: O1 V& Q+ D) g
' j) i2 F* X! v0 e) I push 00 ; OF_READ
! O4 R8 [9 b/ G mov eax,[00656634] ; '\\.\SICE',0
0 P C* X9 t, }) Q+ p7 s* c/ N' x! K push eax
5 w3 Z# y9 j# ^- V( p* D/ [ call KERNEL32!_lopen ~: C3 v7 |+ [$ j: U5 \, I7 u
inc eax
+ T& l( i. [, ~( d8 B jnz 00650589 ; detected
4 H o9 \. T! z3 \8 e push 00 ; OF_READ
) B7 b5 G, m8 Q, O mov eax,[00656638] ; '\\.\SICE'- W6 B. O: ]& c; U
push eax$ @6 R* V7 m+ Z' ~* h) X
call KERNEL32!_lopen% a5 B" g; V9 m( x+ f+ V' I3 m
inc eax
( x0 s \. Q( l% ? A jz 006505ae ; not detected2 T# U! Y* \( K8 E8 \4 b
" t4 S8 _# g) Z+ H9 Q. J
6 }2 i1 {9 U1 ]) s
__________________________________________________________________________2 W8 e r9 k6 R- g8 u
6 ]1 {3 j- a. v6 n' s/ m; p
Method 12
$ Z- Y# G. |' q8 r0 x=========- g* n& U4 d. R& }5 R9 ~9 f
6 ]$ @' i4 w5 [4 h! A( |! z0 s
This trick is similar to int41h/4fh Debugger installation check (code 05
0 r8 S& |: @3 Q, q' v! e$ W# U& 06) but very limited because it's only available for Win95/98 (not NT)
$ X$ l( K1 v$ k. ]: [, [as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
( H( T$ T5 m8 t; g
! q W6 P" E1 ~, A$ w push 0000004fh ; function 4fh: w# X; j: Q; a! l, I& a
push 002a002ah ; high word specifies which VxD (VWIN32)( M$ |6 Y/ b2 A0 {( b' v' k" T, }, P
; low word specifies which service
9 H8 K0 f4 U, w! X* J (VWIN32_Int41Dispatch)/ S$ H: H# g# c* p7 [& P/ x
call Kernel32!ORD_001 ; VxdCall
4 a2 s2 ?: ^& \' N/ \2 A/ _7 g cmp ax, 0f386h ; magic number returned by system debuggers5 T$ N7 ~5 w$ p5 S: R9 r" P3 S
jz SoftICE_detected- J8 l0 F/ S) \
8 t# i: ?6 ~6 W/ \" L( {$ fHere again, several ways to detect it:+ G" r) a6 S4 m& r5 c" P& `
( D3 T% m8 h" c- S" ^5 f6 n
BPINT 41 if ax==4f
5 _0 O% L( R" K) _9 X. A. y* r. S$ r$ p! D9 ?
BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one+ k$ [/ H8 s/ Z) H! x; P, H
/ R+ k2 E! z3 Z
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A* w; I* V0 U" K. s8 y" d* v% v
, l0 v! e8 M, @: g
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
v1 ^$ s6 k. ]
" \) ]+ y: e$ y__________________________________________________________________________
( Q1 t( Q$ N* F3 {
! S. U# e `, x, u$ g$ XMethod 134 \6 g5 o6 A# z6 G% F" N+ a% n& o2 z
=========
* f' m8 w3 w! [8 D; g2 k7 I% @
% P( x+ F8 b! x9 Z( [; o1 x$ gNot a real method of detection, but a good way to know if SoftICE is ]/ n2 u' a9 G3 `4 S* T) v
installed on a computer and to locate its installation directory.. ]% s+ c3 h6 a1 U$ l
It is used by few softs which access the following registry keys (usually #2) :% S1 z! X$ }% g; }7 T `
1 h% I9 L9 w* B5 p" a' W-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
% j9 |) P! V, D$ Q- U\Uninstall\SoftICE e& p. u5 w) R# l4 n
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE6 J) m R, t8 w7 N5 z
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
8 u2 ~, M7 k6 ^: i/ N3 l\App Paths\Loader32.Exe
1 T7 D; X- [6 G* p$ w4 i9 Y* C9 i
# Q* `/ Q+ C' P9 R0 U9 G# X; M3 P. J' v2 v N: y
Note that some nasty apps could then erase all files from SoftICE directory
( ^% s1 `8 @- F2 O+ h4 ?' F(I faced that once :-(2 r, E$ U/ e* R# \
# _, y% d4 Q: a4 m, n
Useful breakpoint to detect it:
- y- l m' j/ b4 r9 I+ R8 v1 S4 R! a
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
6 o) Q' \$ ~0 I2 d9 q
2 k4 t5 {, q. Z" E- I__________________________________________________________________________' x& W7 y |4 E; K5 w4 y9 o* ?
: E& E: @+ [3 Y4 ]8 A& E
: d) w( a8 \; n% o4 ?Method 14
/ G' a& s0 O. q) x& o7 _" J=========
* J( {) A- n! T" V8 a2 K9 Z0 K$ m8 ~# @! a, q1 s1 V5 J
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
4 [8 C; d1 i5 x x6 Eis to determines whether a debugger is running on your system (ring0 only).
7 ^2 R7 y0 Y8 h9 S" m3 S; N* w8 u+ A! @ {
VMMCall Test_Debug_Installed! W0 Q1 j. X1 p* z$ `, z( d
je not_installed- E' j$ @/ f+ {. W- D
, }/ ]. J! }& B \* k4 Q- f
This service just checks a flag.: c/ @7 g9 o- ^/ A1 T, Z! q
</PRE></TD></TR></TBODY></TABLE> |