<TABLE width=500>9 x8 O4 o, |$ r M; o
<TBODY>
( Q$ R8 Y1 G. o0 ~$ D<TR>
4 l1 Q' b: c6 M<TD><PRE>Method 01 ) A$ J8 r' R" {
=========! u' r3 c3 U! O w( A$ g7 I
7 p, j$ D G: ^2 a2 G* z; j
This method of detection of SoftICE (as well as the following one) is
0 z0 R) H: n0 k: x8 bused by the majority of packers/encryptors found on Internet.3 ~6 b$ g1 e1 ^
It seeks the signature of BoundsChecker in SoftICE
/ N# J1 n6 E+ R( O0 [; G4 l- W* D3 \, _$ j0 R1 \8 r. i
mov ebp, 04243484Bh ; 'BCHK'0 j0 p7 C8 P( P: d' U% K X
mov ax, 04h" p2 @' Z0 @4 @# m% p$ u# c9 T
int 3 : V* ]! M6 ~, ^% B: x4 M) ?
cmp al,4
5 `7 c& T6 `8 n jnz SoftICE_Detected* Z1 E4 F3 M0 P8 o& y
$ h+ I' K( T4 h6 r- q___________________________________________________________________________# z$ ~. M) F8 X% a& Y
# u6 o+ K, h0 G: U) GMethod 02
% a) t5 ]/ u( ?5 b=========
N' ~8 u! s1 h7 `" c& h* e1 U# q! N* O' x1 f9 z
Still a method very much used (perhaps the most frequent one). It is used5 o4 x% L8 h A1 @& ?% S6 ]/ ~1 m6 V
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,; C& Q N" F8 f: O2 A; U% u; M6 R
or execute SoftICE commands...
/ ^ U8 G4 v* p# j% d. T( vIt is also used to crash SoftICE and to force it to execute any commands
: P* [* Z0 u; {* \! h(HBOOT...) :-((
' N0 n" ^- c0 V. T1 i$ A4 F/ E" A8 z# u1 L
Here is a quick description:' M. A; _! F( f
-AX = 0910h (Display string in SIce windows)9 ? |' D0 e, E4 v4 \# c8 D
-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)( u+ p4 n; p" g( {6 L& Z- o7 ?
-AX = 0912h (Get breakpoint infos)$ E- b# |- P* h; P& z" M2 e
-AX = 0913h (Set Sice breakpoints)3 q) a: e+ ?$ N& H. \6 ]
-AX = 0914h (Remove SIce breakoints)/ t, u) E5 f9 {! L+ O9 z# v
- |% { p z" e- `1 l
Each time you'll meet this trick, you'll see:
" }* @9 I" T2 n6 q: X( T-SI = 4647h
: k% I6 I7 M; f+ E5 J4 [-DI = 4A4Dh, c% Y2 [6 T( L
Which are the 'magic values' used by SoftIce.
2 q: u- V' f: D: i6 j) {& MFor more informations, see "Ralf Brown Interrupt list" chapter int 03h./ ^ Y$ o: t d; F# R" `/ S4 I
, @: u/ v% z! c0 |. o8 H6 y
Here is one example from the file "Haspinst.exe" which is the dongle HASP9 \1 p9 C8 V& _& }: O7 C
Envelope utility use to protect DOS applications:! V; C: S9 K" J! Z, s! Q
( N$ Z2 J/ A$ t* X; K% X" w! }8 e: `4 {8 m6 ~: f1 {& K0 p
4C19:0095 MOV AX,0911 ; execute command.
, ?0 g, z5 j+ O. o' x0 c T) q6 ]4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below).$ I8 r, c7 c% m7 Q: C/ M" G& A: `- H5 t
4C19:009A MOV SI,4647 ; 1st magic value.
c% X) ?6 Q, `' t4C19:009D MOV DI,4A4D ; 2nd magic value.' s. Q! V% [! t$ U" ^2 ?& G. {
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)0 j6 ?- W# N- L' a4 p5 W2 \
4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute; ?8 x( {) D& `9 j+ b
4C19:00A4 INC CX0 T$ Z1 h) f9 T+ c) {! p. z
4C19:00A5 CMP CX,06 ; Repeat 6 times to execute1 a* b) Q. L/ e1 p* n
4C19:00A8 JB 0095 ; 6 different commands.: r- g" F3 g& ]3 x, f8 Z- t- p
4C19:00AA JMP 0002 ; Bad_Guy jmp back.
* F1 z& f& C0 C8 A4C19:00AD MOV BX,SP ; Good_Guy go ahead :)0 K7 ?' R4 g$ @" l# Q5 L2 G
* r2 c+ o, {. X8 |5 r
The program will execute 6 different SIce commands located at ds:dx, which
* Z& S& T- D/ z1 @+ C3 Oare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
. v% d7 v" E" k+ x: O3 L
& N& q% g4 ]2 Z0 A1 ?* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.' B% ^/ f3 h4 N3 M* A
___________________________________________________________________________
# q; Z1 S, h7 z
8 {4 B2 i8 m& v
/ W, s* @$ ^1 G0 L, }Method 03
; X' g: h1 N8 S=========
. _0 x2 x" J1 _; u+ v/ g g, K. w& P5 B
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h
6 }# K3 P( V9 b5 @) O(API Get entry point)
/ `1 N" g) _' t q6 ^3 n ( z _ e" A4 N1 e8 h0 ] E* i
% w4 W5 ^. q W" [
xor di,di8 ^# w% c0 g. n+ p( Q) D! x) d4 ~: I
mov es,di
0 X0 |/ [/ a( {9 M/ F' {0 l- Y) D mov ax, 1684h C. f* k) ^: `, j
mov bx, 0202h ; VxD ID of winice) G9 O# B, P, Q. D; |
int 2Fh
0 P+ \1 x5 e! }$ s9 t! u mov ax, es ; ES:DI -> VxD API entry point, ^" q8 z5 n. x7 ?' e. `
add ax, di
/ j0 N! H/ P$ y1 X0 M7 i test ax,ax
7 W. d- G: o& D r4 | jnz SoftICE_Detected
- c) M" Z; z/ Z d, W
0 y4 o' b7 k, l+ \5 n___________________________________________________________________________
+ Q! t. {! p9 V$ C( c1 Y0 m% b% @$ ?
Method 04
5 y% _' i! L! O4 \" m/ r=========5 Y; K l' l2 f7 u
, l X' S/ }* A4 h8 a! ~( lMethod identical to the preceding one except that it seeks the ID of SoftICE
^0 E- ~. J) t! h( R) _4 o2 ^GFX VxD.
! x; g, p+ Z, o1 W3 r
: v K0 D8 a1 v5 o$ p- L7 R xor di,di
, n( [& e7 g4 V mov es,di! A& B/ t$ A: ~! `
mov ax, 1684h
7 |3 y1 C; ?* f4 n: C% B# Q. F; c mov bx, 7a5Fh ; VxD ID of SIWVID3 p/ A; S# F" N4 F" w; j; m
int 2fh
0 O, B3 k* N2 _/ |0 _; L& H mov ax, es ; ES:DI -> VxD API entry point: G: V- Q5 S$ x5 O5 X) o1 l
add ax, di
: m' p8 Z o% S! q( f1 l5 ?7 V0 [ test ax,ax
% e3 w/ L, `3 Y' ` jnz SoftICE_Detected' D" P- D" N3 W" r8 d( h+ y
8 W7 A/ } @3 c__________________________________________________________________________: R/ ~9 j% V. `9 k
3 Q8 O4 {. w( j7 U* x
# |" g8 J4 j1 f& A- [Method 05
( G& ~) V- o& U# k=========6 H- ]) g* `9 X
4 v; d% k0 Y4 S9 p$ N' A
Method seeking the 'magic number' 0F386h returned (in ax) by all system
3 U: ~! s" E7 s9 H wdebugger. It calls the int 41h, function 4Fh.
3 u& Q2 m0 b) L- N9 y! x; }There are several alternatives. 9 I# K$ h6 F8 ]# V
5 l% S9 L/ @2 b. p1 b8 UThe following one is the simplest:
0 P, R) \' v) } Y! b4 Y: [5 ?7 a7 K |3 n; r* B. j
mov ax,4fh
4 _6 w `% i3 F; A7 P" y4 E int 41h4 O! X5 H& G! g# r: z; T/ @9 {
cmp ax, 0F386( A: {: \5 `+ f' Z9 Q/ H1 i
jz SoftICE_detected
& q3 i x4 s0 z2 n# g% K: ^- r
* _% x/ O9 y# g/ T3 x
- J/ E, q+ b9 s2 @5 b% p+ [Next method as well as the following one are 2 examples from Stone's 7 M) u/ _% }% t
"stn-wid.zip" (www.cracking.net):- l& w& M) |' H
$ A# n/ T) |2 f2 ? mov bx, cs
6 d# x% s) F0 n* B9 d lea dx, int41handler2( C; r" p6 b6 j! o: H+ S
xchg dx, es:[41h*4]( \- T X0 T" ~% |/ x
xchg bx, es:[41h*4+2]
2 Y+ _9 W) B! R% v+ {; w4 ^ mov ax,4fh
: e6 C7 Y; p: k7 W! U1 k6 a2 y9 v B int 41h
2 ~: H9 l( q1 b' t. c8 ` xchg dx, es:[41h*4]" h) V8 k2 P9 {3 z3 P, j9 P; ~3 a
xchg bx, es:[41h*4+2]" ?7 l- x) ~( Q9 F F; |+ A o
cmp ax, 0f386h
# D) X7 u3 [+ }0 U. Q$ ]3 } jz SoftICE_detected
7 k- G2 i! z7 e- I- s) a |3 C3 x5 k# |' j4 h0 J. k( S# r
int41handler2 PROC
7 m: K' V# M" |1 F0 k iret$ ]9 E0 c6 C/ e2 q' b! A
int41handler2 ENDP7 O/ x3 I" ~! C
* t/ @" M* \% ?( S4 U5 k/ Z
; r7 G' F2 a: l b2 ?4 o$ r_________________________________________________________________________: p) y' z& g. Y, n3 ~- H
# ?; K9 W9 T! R1 H8 c& M9 O0 i4 O6 P8 X) l- J
Method 06
0 C# F$ @, I& I: }/ L=========
* p0 d. [4 q% y( q* n( }
: x7 b) i9 Q7 e R% A
# V% _4 G* V& e. v2nd method similar to the preceding one but more difficult to detect:
7 I: C* X6 s M, N
7 \. g5 O8 t) J0 H" i8 O# I7 `# I0 C T
int41handler PROC
/ m* l7 W& s# r mov cl,al
3 `( T: R% A3 b! Y iret _3 j/ J6 L- D$ S1 j6 d
int41handler ENDP
+ g- b. F* ^" U1 Y" t7 r
9 L/ j0 y7 I" \: T% b% }$ h; n) y/ q4 n
xor ax,ax8 o/ v' b: }2 q) Q5 T, M5 j/ f8 [
mov es,ax( a* Y* {# ^) E
mov bx, cs1 m7 o; n( H2 v% `" P
lea dx, int41handler
4 E$ f& J, [; R* ` xchg dx, es:[41h*4]
1 N1 W8 ~# W6 j, `/ e" X xchg bx, es:[41h*4+2]
. u# J2 u V) ` in al, 40h2 _. h/ c5 Z% x+ k
xor cx,cx8 ~7 B9 z! x1 W( l; l) w4 n
int 41h
( A" @$ o( Q7 o* V( u: g xchg dx, es:[41h*4] c9 z2 U# Q! @
xchg bx, es:[41h*4+2]: J+ W3 y8 V) N- m5 o
cmp cl,al
" s$ U$ {% p' j jnz SoftICE_detected
, Q# v) u4 O% Z
/ _( N1 p& j2 m# I9 U/ f* T_________________________________________________________________________2 d7 k" i# x$ n* E; k+ }) t/ H/ L
' v5 i, N; r. \$ I/ b0 G( w* dMethod 07* d" H& S9 ` F: F" ]5 h I. K
=========6 H8 |- W. r% z
2 ]8 t% d9 x$ i. F/ l
Method of detection of the WinICE handler in the int68h (V86)' P! s1 N2 v7 I) u5 L2 i& Y" R
; u& ?5 E& U8 K u" _4 K9 Z% P$ K& {
mov ah,43h1 e) F/ h4 `: p2 y( w x
int 68h
3 p3 G8 v/ o1 ~+ e cmp ax,0F386h
0 ~% {3 l7 P* w! [2 J jz SoftICE_Detected" e0 t7 t. \9 L7 q( G
) X* R, f$ a5 ~( w0 p) U6 W% B
# ?. m- N" L. B/ o P) Q
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit1 M# g9 f- }6 g; ^ S6 j. ^: l: s1 \
app like this:! r0 t3 _! w* t2 [
, q( \+ V3 i: G3 i6 `6 ?" b
BPX exec_int if ax==68) S- n& Y4 B$ m: J% c t) \# L0 T% J
(function called is located at byte ptr [ebp+1Dh] and client eip is: O! u" [+ h* y3 ^, H% M
located at [ebp+48h] for 32Bit apps)4 {2 i& R0 e! k" J! J' \' B
__________________________________________________________________________6 V- E Y7 W+ G$ h2 s P
8 t& a% D6 ?9 [! B3 b9 N4 m, K
C2 D, K8 p7 d7 z _9 j( Z) SMethod 08& ~" W! z. z5 ]. Y
=========
, r. }0 v; e5 x2 s# }3 F1 B) x% G b9 I) J- b9 d4 V
It is not a method of detection of SoftICE but a possibility to crash the2 [1 l' ~" E. b$ e& h9 Z( ?) F1 X
system by intercepting int 01h and int 03h and redirecting them to another
; P7 F& u% ]9 s B1 _routine.; z5 y- D% q! _ U. ^) p$ @1 |
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
3 g6 A: T3 m4 x& `to the new routine to execute (hangs computer...)2 c# {4 P% q3 I$ i% P: \, v, {3 b( ^
$ t4 O8 H0 R+ o) O
mov ah, 25h$ [9 J6 t3 t% c+ I$ t) Y
mov al, Int_Number (01h or 03h)
. S+ t5 i) W. [ mov dx, offset New_Int_Routine
# `) N3 y: r* i int 21h
; s \2 s: U7 p1 E
% w, Q' j" ~) y7 d7 m, l8 e__________________________________________________________________________+ [2 k7 H7 W! _
% ^* _+ @8 f( v/ B. C1 z H. u) {
Method 097 W0 ^* c8 h5 J
=========6 P- l$ X& Z# \" H/ s
0 f, S/ ~* P2 J( [ i/ ?- FThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
; w' Y7 B( C( C$ W+ vperformed in ring0 (VxD or a ring3 app using the VxdCall).
) N- E: H( Q8 |6 n2 yThe Get_DDB service is used to determine whether or not a VxD is installed: R+ V& g. L' t3 r' l. V
for the specified device and returns a Device Description Block (in ecx) for6 M7 v2 \3 e/ n2 q; J# J5 O! v
that device if it is installed.+ X) m r1 t1 Y7 ^2 @( J9 C
6 c% d. ~3 M4 |! e1 q! ^7 k& S
mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
5 y6 F/ t' k0 t: @' W" O: { mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
( G+ z! _% T3 ^7 B$ D& I* P. ~ VMMCall Get_DDB# P- p# }' G! L- Y. I1 F: t
mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed% h: o7 u6 W) [' O2 ]
# O* E$ a) `$ F# O6 `" H3 A5 rNote as well that you can easily detect this method with SoftICE:( C7 K3 v# h9 Q W6 | @* B3 _
bpx Get_DDB if ax==0202 || ax==7a5fh
) v# f" E' t; A/ I/ A6 E
I' N6 j" S! K( y( \ \__________________________________________________________________________$ C8 N& R8 n) @$ y5 Y( {7 f4 U
2 E/ A: X J: y, d6 \5 v
Method 10, H3 J0 F) G9 c* n
=========
5 S8 I( W6 e6 ]2 k) j0 {0 v5 y: ]
3 C, i# |1 d8 P6 G" ~=>Disable or clear breakpoints before using this feature. DO NOT trace with
! o9 k6 P3 `& {. B' r4 x+ @ SoftICE while the option is enable!!
, F( M" u1 o' I9 [( \% M
& G( I5 \5 l/ t( C$ VThis trick is very efficient:6 x \$ j' D. x) [2 S& [
by checking the Debug Registers, you can detect if SoftICE is loaded
! n8 R4 h' z2 t9 @5 C" y& a2 j(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if8 \6 e8 I( A- [
there are some memory breakpoints set (dr0 to dr3) simply by reading their" O0 I# y% i, Y. k
value (in ring0 only). Values can be manipulated and or changed as well
/ F O# a% a: Q( i/ B( R(clearing BPMs for instance)
4 A9 K5 \. y3 j1 J% W1 r: Y$ G
h' {: F! U# R8 _# v) p9 \9 Q& e$ j__________________________________________________________________________
3 [4 J2 g9 H6 \1 y! g# g6 ]/ d, A6 L: E: z( g! b% D
Method 11
4 e; G9 A; U, |# ^=========6 R0 a7 ]. G" }# f( M/ c3 t( L
" ` p( ~# Y1 g3 F& j; w+ D3 XThis method is most known as 'MeltICE' because it has been freely distributed
; J% _8 B2 L n6 Y, `via www.winfiles.com. However it was first used by NuMega people to allow* D1 \4 x6 K3 d
Symbol Loader to check if SoftICE was active or not (the code is located# E* S6 d* L/ D
inside nmtrans.dll).+ A( n( N$ r. Z7 Z7 r6 o1 F
8 W7 a9 {6 p2 [6 |& \9 c7 DThe way it works is very simple:1 E9 e7 S) q7 J9 _
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for3 j: ^4 Z: e6 s L& K& d6 s
WinNT) with the CreateFileA API.) v1 m) C3 P0 O' @
2 A7 Y& T0 {9 b( O$ y0 E+ wHere is a sample (checking for 'SICE'):
9 \: I8 O: I7 r- M6 t
6 w5 b! W, ~( O! j9 `" oBOOL IsSoftIce95Loaded()
' Y6 U+ w; Z8 }) W1 B+ ?{
$ J+ c4 W+ @$ i, }, o& {$ `5 ^ HANDLE hFile;
% U- C4 o( @% s2 W- R: C hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
/ r1 r: T% m9 A3 K! {$ l3 G FILE_SHARE_READ | FILE_SHARE_WRITE,' @5 m f9 T& \1 E7 P7 n+ z
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);) z0 c" U1 h' t% L" P& _
if( hFile != INVALID_HANDLE_VALUE )+ B a8 C0 A7 n" f8 I$ ^3 b
{) K/ z# u6 Y' `. v) ]& G% r
CloseHandle(hFile);
/ H& o/ B+ O# s: h, S- q5 G% n0 |4 \8 S return TRUE;
9 h9 T3 I, J: R! {, f( `% A3 V }8 R o& n u. p! {# F4 F0 U+ J
return FALSE;! f. Z! h: C3 a! {# ?
} i# y4 |) o% i
/ J/ o g6 n4 D' c* iAlthough this trick calls the CreateFileA function, don't even expect to be( w/ u2 s% {2 i- C7 h
able to intercept it by installing a IFS hook: it will not work, no way!
0 S3 J8 q4 _$ t% _ ]( L$ @! GIn fact, after the call to CreateFileA it will get through VWIN32 0x001F9 v8 `4 z. G7 q# g
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
+ Q6 T. u2 m+ Zand then browse the DDB list until it find the VxD and its DDB_Control_Proc
8 H4 \' k" v) L2 _/ Ffield.
. \; m3 s% o# k4 p% c2 _In fact, its purpose is not to load/unload VxDs but only to send a
) A- z4 Q8 o; {W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)$ U4 a4 o1 b8 u {
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
; B! g0 ^: ]" ^( X) F9 Vto load/unload a non-dynamically loadable driver such as SoftICE ;-).
0 r6 Z; F9 V9 M& s ?' w. g4 C4 w% yIf the VxD is loaded, it will always clear eax and the Carry flag to allow' w6 ]2 ^7 k% b+ F8 i; G4 E
its handle to be opened and then, will be detected.. `! _; i4 E4 V! F8 b8 x* Z
You can check that simply by hooking Winice.exe control proc entry point
/ Q, O/ u1 T1 G' {( E0 n5 Y6 K0 Jwhile running MeltICE.2 l: }: x( O2 R; o8 I" A
r+ Z1 ^) t. g$ y
' Q# F2 Z. \9 y: u4 _- f+ B5 o, c 00401067: push 00402025 ; \\.\SICE5 \: ~$ }; S( ^0 I3 g/ F
0040106C: call CreateFileA' V9 q* F/ P( A L! F6 q
00401071: cmp eax,-001
1 ?" m( |! p \: b# Q' `" C" L 00401074: je 00401091; U$ Y f6 C# H& P# ]
8 `) p! S7 P+ x, }6 d$ l4 n
- t1 h' l2 T2 M* hThere could be hundreds of BPX you could use to detect this trick.
# _# {; b9 q2 @) l0 @7 h" p9 O-The most classical one is:
5 e* h6 ?' [' M; v* ^+ y3 E, W9 j BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||4 X ^$ O4 Y; f
*(esp->4+4)=='NTIC'% d: x, V1 g% S, `1 `$ f" ^
5 ^' W- l$ a7 d2 P-The most exotic ones (could be very slooooow :-(
8 I0 L, ^; ~! `" G. x3 I BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV')
1 k3 D' O! ` a+ s9 W ;will break 3 times :-(/ p2 a% I% N% _4 o7 o; C
- b, X3 G8 T0 U7 p- r* T+ ~-or (a bit) faster:
* [3 i9 b. o; a: Q2 H: a/ x; T BPINT 30 if (*edi=='SICE' || *edi=='SIWV')8 l2 u8 H) z* x! l
j9 k7 d6 @" e1 w1 @% w* i BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV' $ @" Z$ o' I2 Q* ?5 B
;will break 3 times :-(
( K$ m+ @ d# N9 p& @8 E. Y: v
-Much faster:
7 U& E* P5 G7 I+ R& \$ j BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV', u! Z' I: Q A& p
1 T8 [3 S# j' M2 E
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen- S) T# j/ h, ~2 K
function to do the same job:
# P& y: H4 p4 f4 O7 b$ E7 g; X
5 e( }& B) @+ s) q4 p8 {0 r9 Z push 00 ; OF_READ
$ p0 [' d& B$ J3 n& f m" s, i mov eax,[00656634] ; '\\.\SICE',0
0 d+ d5 s5 S! u" q push eax
z- D! Q% M& H1 @; n call KERNEL32!_lopen4 y" B' ?# g1 Q) E: p. T/ N
inc eax
! @( m& v" @, s/ r$ ?5 I1 l jnz 00650589 ; detected
" B+ C9 U1 y( W8 o2 |9 k7 y push 00 ; OF_READ
2 e# \( W Q5 e; C mov eax,[00656638] ; '\\.\SICE'
( r1 l0 O/ ~: R0 L9 S$ ], d' B push eax
' f8 M7 Z) [2 d, f I. w. |1 Y2 \ call KERNEL32!_lopen" g3 H- r% g* l0 \: @
inc eax7 m5 @4 @ c. g: R9 _9 x+ p1 w- X
jz 006505ae ; not detected
k" b& J% s- j; h+ B/ R& ?5 V& _. m$ N9 i
" r f+ H, J& k2 Z; n9 I0 o8 R" {__________________________________________________________________________& r- C* j% n0 [$ G" I7 B( I
( [* B) h3 G4 H2 ]4 |% P+ i1 \Method 12
& L/ x) v$ q3 e- W=========% v2 y9 G% p- h. o
4 J5 l5 |8 a8 a- {
This trick is similar to int41h/4fh Debugger installation check (code 05/ ?" I5 v9 G( Y0 V( O9 G
& 06) but very limited because it's only available for Win95/98 (not NT)+ E! }( t7 R# E- Y, g" s" {; X
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.% N: B1 F; F3 c( c5 S7 ?1 F
) c9 e0 R% f$ G) N4 _
push 0000004fh ; function 4fh. ^' I6 z* W5 {9 o
push 002a002ah ; high word specifies which VxD (VWIN32)' b9 Y+ y$ X: J; T# t
; low word specifies which service
9 l/ ]: a( d1 w1 k) I( e0 Y( L0 N' |$ P- j (VWIN32_Int41Dispatch)$ g4 ?0 H" s% }: I: V) U
call Kernel32!ORD_001 ; VxdCall
! E0 s2 s; O% o3 D9 X: w cmp ax, 0f386h ; magic number returned by system debuggers' W8 }, f& |- V9 P. ?" k
jz SoftICE_detected& R) p. X4 P( X# E
3 P/ Z/ r% S& ?8 l1 X" X
Here again, several ways to detect it:
$ X9 V3 G! j9 m) Q3 j0 `
4 F: F& r9 H) I' f' U. `% `" S1 V BPINT 41 if ax==4f, X6 ~% x, A) r# z
. {2 m0 K( P" o, L BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
1 l/ B2 P1 o# o% [- w$ n! k- u
BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A0 {- b: [" p3 E$ ]5 ~, ?( a% D' _/ |. S
. P9 N+ B0 Q+ o) _' l
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!
4 g) F; u4 z1 o1 w( E5 Q4 _/ Z4 k$ s6 S2 P* H1 R
__________________________________________________________________________7 A: L0 u, m/ h5 u# A
6 b% L! f+ c! C: \* ~, f- AMethod 13& D; u( ^" O0 B2 b4 q
=========
9 i' c( C, h: ~4 c3 g y
_5 Y* [6 A0 X( ?+ ?: n1 `Not a real method of detection, but a good way to know if SoftICE is
( u3 g' @. d* o% o; ]0 Z/ ^installed on a computer and to locate its installation directory.
2 Y7 Q/ Q6 ?0 S" B4 e. oIt is used by few softs which access the following registry keys (usually #2) :/ D" ]" b! p0 n e/ U/ k
% r, ]' z5 V% F, v8 g& J
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion r. W$ F0 m8 j
\Uninstall\SoftICE
" [0 g* F9 x$ u. A-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
0 Q/ P8 d+ A! H4 J! a-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
* ?$ K3 p/ t' n' V& L& `\App Paths\Loader32.Exe
. M0 U G1 e5 d' q/ `# d/ f# D
/ I6 D# K# a3 G8 U9 K% m0 U
& t+ |4 o9 P7 G5 ]) p/ A: yNote that some nasty apps could then erase all files from SoftICE directory) d4 \4 k/ p& D" q
(I faced that once :-(5 s* J, r& ?( O, y# ?6 C$ M! G
0 ]# [% `/ }* a: e& R r) B
Useful breakpoint to detect it:
' l7 l. _ C' P1 L- X. a0 T! g% H+ t K! @0 m. [+ S& a
BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE'
5 s- s: O. y+ {$ e. F+ H1 {; V. t/ T+ i* ~" c; h) D4 y% v
__________________________________________________________________________
g. P0 i( P( p
2 M7 y+ D" [( }7 u6 f+ S
$ m7 `1 N8 ~# v. y2 I6 b* ]Method 14 3 w- G% w$ B& y# B, k: c3 P
=========
7 }+ t) a& b/ k! j. f4 q: Q- X' \( g" l2 A; \9 n# j& G4 n8 q$ k/ j
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
1 ~/ v/ z8 ?7 \% m% o% _/ Fis to determines whether a debugger is running on your system (ring0 only).
2 N4 Z( W- A! w1 r2 v0 j" U+ S
VMMCall Test_Debug_Installed
& I, ]: a% {% S6 z$ G je not_installed
) U# a. p7 z" ?7 |% R# c* f
4 U- `0 I3 R' QThis service just checks a flag.; O9 t$ h* T9 v4 W& t ?; Q: C
</PRE></TD></TR></TBODY></TABLE> |