<TABLE width=500>
2 {2 |2 h7 d& r: ^<TBODY>
4 K A7 L3 ?! ~1 n) E<TR>
g; r* {, B# |* w* {4 E, M<TD><PRE>Method 01 2 ?+ A+ j* a2 T& p$ P
=========
/ p* m: q, a: U3 `/ j7 N- |: `
! a! l; `5 d9 ?/ ?" z8 ZThis method of detection of SoftICE (as well as the following one) is1 ?2 b( V, v$ L8 H: `
used by the majority of packers/encryptors found on Internet., D8 X" ?: V! t# I
It seeks the signature of BoundsChecker in SoftICE2 m* V$ l/ |1 d2 ]% K! W
" v8 C, Y @3 S: D- k; L$ H9 \
mov ebp, 04243484Bh ; 'BCHK' H3 E$ b9 z5 Y6 S* b+ r
mov ax, 04h& J+ ]' \0 G+ [$ f4 R: L0 ]7 t
int 3 7 @$ @0 c5 ?4 [+ l/ n
cmp al,45 M( t3 q8 K; N$ K, N
jnz SoftICE_Detected
Y4 W" P& n& b2 ^. K3 u9 {3 g
# |7 r0 c& C; A2 w/ {* s/ X___________________________________________________________________________4 U# \& c! D! C0 H1 ^# _9 K3 r r
$ z+ ]. d3 t% N: Q | Z1 B3 O; ZMethod 02
9 q# P D1 O* G6 m) j5 c=========% D/ W" c8 ~& G& C( ^
$ ]2 u; ?4 N3 z" a( C# f8 v1 dStill a method very much used (perhaps the most frequent one). It is used
0 M, \9 }3 o2 Hto get SoftICE 'Back Door commands' which gives infos on Breakpoints,$ ` h$ l) D/ {2 G- D8 ?
or execute SoftICE commands...
! M4 A- x# Q2 n( W- DIt is also used to crash SoftICE and to force it to execute any commands
) s2 q) \" p% M# _( z& i3 {(HBOOT...) :-(( * ?. N" @9 p* ^1 Y) x% l7 ?; {
. L& n- Y# X% d7 q3 dHere is a quick description:
$ c6 h4 `5 Z) b1 k+ z-AX = 0910h (Display string in SIce windows)
+ m' a+ r* s) x$ X-AX = 0911h (Execute SIce commands -command is displayed is ds:dx)- K% r9 }9 P/ X; W$ y6 M$ h. g
-AX = 0912h (Get breakpoint infos)$ k4 ^! Z. K& _/ ]
-AX = 0913h (Set Sice breakpoints)
+ K& E- H E3 d- f" r-AX = 0914h (Remove SIce breakoints)5 Y9 |, W" k9 b& o
* [9 [. Q$ p4 T( m* u9 v
Each time you'll meet this trick, you'll see:( X: _ t5 g3 U7 X# m* v. w
-SI = 4647h9 |1 M5 I) Z1 v
-DI = 4A4Dh! \' U1 S! D. D- a6 }& q
Which are the 'magic values' used by SoftIce.* M8 W" q! B2 g
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.- Q4 `* P! r; q' P; v
7 S0 v) `- x# ^9 _; M9 L
Here is one example from the file "Haspinst.exe" which is the dongle HASP
c* ]: m! y. Q# J, q7 V3 ^Envelope utility use to protect DOS applications:
! j5 o! n' I- B J l- [
6 L+ c) c8 I2 t2 v M9 j0 \9 }9 r3 H+ ~
4C19:0095 MOV AX,0911 ; execute command.* l" z; H$ P6 t
4C19:0098 MOV DX,[BX] ; ds:dx point to the command (see below)." r! U0 w4 o( a" `- y
4C19:009A MOV SI,4647 ; 1st magic value.3 t7 A) C, z( }! d9 P& A2 G8 d
4C19:009D MOV DI,4A4D ; 2nd magic value.. [) c1 k8 ^5 x9 x) u1 |
4C19:00A0 INT 3 ; Int call.(if SIce is not loaded, jmp to 00AD*)
0 r$ ~# W4 W0 E4C19:00A1 ADD BX,02 ; BX+2 to point to next command to execute8 y: u( ]0 I' ?8 e9 m3 z( G
4C19:00A4 INC CX
: S# Z3 y# L; x M! }4C19:00A5 CMP CX,06 ; Repeat 6 times to execute
3 P" m6 E7 L/ n( x. V6 |4C19:00A8 JB 0095 ; 6 different commands.4 `. Y+ _6 a7 e6 o
4C19:00AA JMP 0002 ; Bad_Guy jmp back.7 e9 y. @9 X* o
4C19:00AD MOV BX,SP ; Good_Guy go ahead :)
1 ?& m( G: l7 d' W: K J, ?1 D# [3 C
The program will execute 6 different SIce commands located at ds:dx, which
& y9 s7 W1 h7 Z% d1 f, Rare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
: S8 d" W- A8 X6 _1 g8 {
) c! l4 [! m; z) Z* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
4 B4 ^- {; T) h: x0 |* i! H2 w___________________________________________________________________________
7 t4 i9 M1 O+ ^9 a, P) J; G; }$ n" l/ \2 X5 a R
+ R4 E4 p! P* @+ a7 yMethod 03( v! Z; c0 p6 M. L4 Y0 C7 _
=========
2 H# H+ _7 @8 O, w8 q+ }7 {$ E+ c$ b$ V3 ]
Less used method. It seeks the ID of SoftICE VxD via the int 2Fh/1684h8 e5 V; a3 @! e: @4 v
(API Get entry point)
. K$ r, ?' y# Q7 _7 l3 Q$ ~ $ p$ w' P% c( t+ k
& k' H! r2 ^# S+ \7 u" E; X
xor di,di, T9 Y2 Z* L" a9 P9 [2 a2 x
mov es,di" V/ X6 m- G4 p* T
mov ax, 1684h
: u# T8 }7 j. t1 s9 V+ B' r mov bx, 0202h ; VxD ID of winice7 j$ D j8 C, \/ W& J- K
int 2Fh
4 W( v6 r4 h) Y6 I: p, O mov ax, es ; ES:DI -> VxD API entry point" D |7 G) [+ t0 Q; {
add ax, di4 k* p3 F0 c; h' |
test ax,ax
: D) t: m5 b( o3 n jnz SoftICE_Detected
* ^; K% A/ f9 f* J
3 ~* [# e% W9 V/ y* ?) ]' L; v___________________________________________________________________________6 B; i" t# L" |7 Y5 R
- n& ]" K0 `# a" _
Method 048 Q Z% M+ t4 V% k
=========, I/ D. X+ T* Q$ r! A
3 ^0 A- X, v2 r H8 |Method identical to the preceding one except that it seeks the ID of SoftICE! C/ g- v. [: ~1 n6 L# U0 C
GFX VxD.
( b& }0 |2 P2 y) ^
3 @: K2 _9 O: s6 S xor di,di
& V. ?# W/ Q4 i6 x; i. R5 c. U- { mov es,di0 l% c f0 i# h( ^: w9 g; N
mov ax, 1684h 7 p+ M- G* N2 |6 s/ [# b
mov bx, 7a5Fh ; VxD ID of SIWVID* E9 P. l$ k# I3 g, p/ a
int 2fh
3 s0 x. e+ Q2 Z' { mov ax, es ; ES:DI -> VxD API entry point
% w* H0 L# P) }6 ] add ax, di& u9 g. @, q- |7 B; E
test ax,ax% `; M3 V9 I5 s3 o$ J# T
jnz SoftICE_Detected
4 s) z9 w2 x9 z1 f2 |' X7 x! W* D, M& X9 M4 F% l3 z# F) [
__________________________________________________________________________
! E: K9 g1 W1 h8 l- J3 M8 f' w3 p
2 L1 [5 [ j5 @ ?3 Y" l" q% H
Method 05
7 V4 @8 D5 r( C" ^=========
0 k) v# L+ F& }( i! `( W8 }3 I; l. M* q# E; k
Method seeking the 'magic number' 0F386h returned (in ax) by all system
/ A3 K- ]8 U* J \+ L7 ddebugger. It calls the int 41h, function 4Fh.
1 W% O+ _8 T9 B: DThere are several alternatives.
! u% B c; M$ X9 B0 G U0 v* G* S Q6 p# v( t
The following one is the simplest:
) l, W$ a: h; L( i' D& t M$ R' v# J* l3 `
mov ax,4fh
7 O4 u+ P4 \2 z5 ?; y int 41h
- d6 D7 O! |4 y- E: @ cmp ax, 0F3868 J5 G8 d+ I6 Z1 Z( | @% t& G
jz SoftICE_detected% C/ }1 x* \% b8 t& |
- I& m4 z4 G# `- R. j0 T0 E
1 x i) K( W u, H J' UNext method as well as the following one are 2 examples from Stone's
2 N! ]- @3 u; f9 d9 R' m! M"stn-wid.zip" (www.cracking.net):9 l" y% K8 q- C
8 N. m/ y0 }9 B/ {) }
mov bx, cs
# ]2 k2 I3 ^: h: D# l; { lea dx, int41handler20 x3 @7 \- {% g4 L$ q: z
xchg dx, es:[41h*4]& \: P: \2 g4 Q) x4 k i
xchg bx, es:[41h*4+2]& H% c4 H% k* N1 a, ~
mov ax,4fh8 x8 M0 O- I0 N# J+ o
int 41h
) \2 d5 y! ~8 W xchg dx, es:[41h*4]% I4 Q- h) [; }! A& p
xchg bx, es:[41h*4+2]
8 a* U" B2 T/ |+ K6 o, o2 h1 X cmp ax, 0f386h
5 q5 A+ q! j1 ~. W$ ], f& d jz SoftICE_detected
$ N7 O9 f# Z' {) j6 q* z: O! ]2 Z
0 ^& z+ W; ]: j3 Q. fint41handler2 PROC u9 J! Y4 g* B8 l' U
iret+ j. D) e6 g& ?! a/ `) D
int41handler2 ENDP% ?+ x( n8 H0 ]' O
" ?9 Y. V* P+ ], D' Q. |
( t$ A B8 E" \_________________________________________________________________________
8 ^; X1 R$ F" B: k# Y/ D9 W' H. N( N1 d* G. p I3 M
' z8 s% r. a% S: Y6 Y. o
Method 06
" f+ z$ w0 a7 \, D3 |. f+ Q=========
% _) v' ~8 h; J" ?4 x! H' I# b
/ U2 T2 J/ w/ z9 J8 n5 g# i8 B/ h& ~8 T1 @4 T$ }# }5 h9 ]
2nd method similar to the preceding one but more difficult to detect:
F3 v4 n. m9 B' d6 l) I5 i+ g. h0 n- x' ?0 D, K
( A9 Y1 X7 g3 L2 B! T |int41handler PROC6 J) L, M% G0 i& P3 X
mov cl,al
7 a0 `; |+ @% }) p1 D iret
/ D! [1 e# o2 Wint41handler ENDP7 b- B" Y7 u- T# S
# Z& L: n& l7 s. L' a; D( B
/ J- K$ F& }# I6 Z6 Z xor ax,ax. i& T0 g T5 T0 O/ R
mov es,ax
( A4 b+ T0 A. o1 \& a8 _ mov bx, cs. q5 u- r" b1 o6 I2 J% I
lea dx, int41handler& j; e# c: e" F( B9 U
xchg dx, es:[41h*4]1 v( E& M6 V8 ~0 x" c
xchg bx, es:[41h*4+2]7 S* m2 y" t( m4 \# c! p1 \1 _
in al, 40h
( W: a" b% i7 p; F u xor cx,cx
( e) R( l$ M& g m int 41h
: e. t0 H8 \; ? V; t8 z8 Q xchg dx, es:[41h*4]# T5 J* A2 s: |; i8 o. D4 C
xchg bx, es:[41h*4+2]
7 @; [, d, ]" P5 z' \ cmp cl,al7 J) w; y' W0 X. x$ s9 @0 g7 G
jnz SoftICE_detected
3 w5 U; A4 i: Q; |
2 x {; N7 d, ]$ J) q& y+ b_________________________________________________________________________
6 n) F1 A/ Q5 Q2 v' ]$ J" {. i$ |5 z' R
Method 07* d, f3 _9 R+ I! s; U
=========
4 l# T. W7 h, d4 m0 G8 ^
% |8 {/ T" u: GMethod of detection of the WinICE handler in the int68h (V86)& d9 I- ^/ ^* w
: u' l- Y2 O A5 Q
mov ah,43h8 W& r: N( f" ]6 P& l
int 68h
* J/ K8 a8 `5 V5 m! B# U" e! D cmp ax,0F386h
6 n/ j: y- t. H7 X0 a! n( c jz SoftICE_Detected2 Z7 Y* Q( B- t% x% h. R
2 T. [2 [, F' x. b0 u- }: @: @" h z! Q/ ?& v! S" r k5 A2 a. I0 W
=> it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
]& a+ z R' T7 _# F app like this:+ [, C, a% s4 C9 Y0 Z# F
! [; _! Z; Y9 A5 E% f BPX exec_int if ax==68
0 ~; ?" v+ a; H2 r! S$ D (function called is located at byte ptr [ebp+1Dh] and client eip is
6 B1 Q; T& f6 X6 }' {- O located at [ebp+48h] for 32Bit apps)% Y6 h( ~+ M2 l t4 i5 b
__________________________________________________________________________
. q+ O# a( O5 D& d% Q N- Y/ V) H$ G
. r% i& v% q9 B, s: B1 zMethod 08$ ^! b2 H* o T4 |9 a
=========+ h5 r) j* u. [ R
: h1 _, [1 w& U$ u qIt is not a method of detection of SoftICE but a possibility to crash the
+ f2 K# W j6 Y$ @system by intercepting int 01h and int 03h and redirecting them to another0 W$ D4 A# o3 h3 u& H
routine.
5 o L5 G# X5 W) HIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points5 J$ S# u4 {/ w) P0 V
to the new routine to execute (hangs computer...)
; m/ L/ D* [' x; X' R2 p1 p$ X i: P
mov ah, 25h6 u& a- m5 r% G! }
mov al, Int_Number (01h or 03h) v; P# A; d+ f6 j9 E
mov dx, offset New_Int_Routine1 f3 Y+ L+ h8 `0 V7 u! t7 Y* @* q
int 21h& E }8 k: @$ T. `5 }! v5 x
- _( s' R# N1 u R3 j! F
__________________________________________________________________________
. t! s" x$ G5 B9 j' k, x8 z7 X
l$ d: Q& A* c/ l7 A; Z( D6 `3 VMethod 092 o! _7 ~1 ~) ^8 I
=========4 T9 o$ D: Q( N+ {
t* ~5 e; t; v/ E2 b( [1 X. K
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only& h6 n+ ~7 g, B4 F
performed in ring0 (VxD or a ring3 app using the VxdCall).% O5 D/ V3 ]0 M, h( v
The Get_DDB service is used to determine whether or not a VxD is installed" ?5 @- h+ ?, ~/ @
for the specified device and returns a Device Description Block (in ecx) for
* Y5 S, R) p4 }5 e( w6 jthat device if it is installed.
8 Y8 X+ T- `% ~/ b1 R
. M6 x; Z$ j: Q! P mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
' z5 W: y8 D2 k mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)6 @4 {/ z* p" b6 U9 |9 ?+ I" l
VMMCall Get_DDB
$ z0 G5 j, e- l4 V! U1 t( s mov [DDB], ecx ; ecx=DDB or 0 if the VxD is not installed, x& p1 ]5 E# I. [6 F% C
* Q8 j; @# r3 ^; DNote as well that you can easily detect this method with SoftICE:
9 d2 y. r7 \7 S' L/ F( ^ bpx Get_DDB if ax==0202 || ax==7a5fh
/ s" V; {( I$ @3 i. N
0 V# o2 i) A0 M* `* ]( E__________________________________________________________________________
7 K% B6 u6 [* J
) X( B/ o5 w7 b( ^- s+ AMethod 10# g; R, U+ X% \# t. f
=========
5 R! O P9 V% V4 u0 r# ]1 |& t- F. P
=>Disable or clear breakpoints before using this feature. DO NOT trace with4 f" H [* H2 O& _( g( R5 P. O* d
SoftICE while the option is enable!!2 e9 H& q. c5 Y) C. k+ H) P
$ F) A8 K: R/ a* D* f+ C
This trick is very efficient:; z5 X, Y- I+ A. H
by checking the Debug Registers, you can detect if SoftICE is loaded
8 M- C7 @3 o0 s9 u& m; V(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if* E; s) F, u, H8 q6 ^9 X/ U& j
there are some memory breakpoints set (dr0 to dr3) simply by reading their0 \; ]* m- Q; Z9 h( g
value (in ring0 only). Values can be manipulated and or changed as well
% L$ s7 |8 G# Z _ {(clearing BPMs for instance)4 y' l) t1 o* U- w$ A5 R1 i, C
4 O( k# l' J$ V/ ?__________________________________________________________________________
! F. t' M- d, y4 ~+ R
3 w f! a9 [$ u" c$ d. Q3 CMethod 11- \9 s4 A* o4 k' _
=========3 D+ H, J$ }1 |
7 y/ |" w5 j+ [; r& g7 y. j
This method is most known as 'MeltICE' because it has been freely distributed& R7 A+ \) A' `/ ?* Q% b
via www.winfiles.com. However it was first used by NuMega people to allow
- i' A1 f7 v( d. g/ q+ WSymbol Loader to check if SoftICE was active or not (the code is located3 o H( M6 L5 [, X1 c& `5 H# @/ Y: G
inside nmtrans.dll).' t' B- }8 x* ?6 o3 H6 l3 `
0 G4 `; W- Q* b4 R# G& f
The way it works is very simple:
3 _ i3 d. V1 W& d- @9 {" S9 SIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
8 b5 [1 r9 J' OWinNT) with the CreateFileA API.4 u) ?6 g- n1 J2 [1 K
7 z9 [1 S- T& g% n, a6 O% a4 SHere is a sample (checking for 'SICE'):5 C' E9 s0 v7 E0 W3 p
$ g' C# @0 }0 \+ l1 q0 b3 yBOOL IsSoftIce95Loaded()
; x9 F/ p3 K" I9 [' S{
$ C, t. G# _; o1 _% B7 R" J3 u HANDLE hFile;
m' v! ~, G+ t( Z+ H hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
. B4 X6 d% v+ w0 G: i# u FILE_SHARE_READ | FILE_SHARE_WRITE,% i6 }7 W5 ~7 g3 b- P3 P
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);. g' B( l( h0 z
if( hFile != INVALID_HANDLE_VALUE )
. r' d9 I- o* w- [ q( m' S$ m' q {! x; n6 \* t( ]0 z9 `$ F
CloseHandle(hFile);) Z" s+ _2 S C& e0 |! A0 Z
return TRUE;
- }# I* P E/ d; C0 h- } R$ D }6 y* R8 O$ h+ i9 m+ V+ n
return FALSE;
: w, V9 L+ Y& h& d$ J: N}# f6 Y1 E' R# ^3 u8 L
W3 g+ {5 X% H
Although this trick calls the CreateFileA function, don't even expect to be
: ~! r7 b v# p, G5 I# A* W! gable to intercept it by installing a IFS hook: it will not work, no way!% _* |/ d; L, x% Q ]
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
4 P8 o3 A$ Q1 K% B% @3 ?3 Qservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
5 z! d* Q7 U) ^and then browse the DDB list until it find the VxD and its DDB_Control_Proc* x" M: n) D7 m
field.
$ F/ ?# Y2 }3 X% M- t, iIn fact, its purpose is not to load/unload VxDs but only to send a
3 H6 f, u _- `W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
3 k3 j) ]. }& A. e! b: {/ i$ Ato the VxD Control_Dispatch proc (how the hell a shareware soft could try, m$ |3 ]5 k6 d4 Q
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
$ E4 L6 D8 i( A. hIf the VxD is loaded, it will always clear eax and the Carry flag to allow' o1 o$ p: ^: U; M+ K
its handle to be opened and then, will be detected.1 J2 G$ m1 y9 W9 {
You can check that simply by hooking Winice.exe control proc entry point
+ U( [) Q! ?' `while running MeltICE.# ~/ a+ b. c- l2 |
6 X* C- P; p. _; j. Y" p' j
/ b8 `% ~/ i. Y$ _4 a 00401067: push 00402025 ; \\.\SICE
& d7 \6 C0 u6 @8 X: [ 0040106C: call CreateFileA
" f% Q( H% B8 L& n) v9 c 00401071: cmp eax,-001- s$ E- a7 E0 z/ R
00401074: je 00401091
) D. g W! v& z6 I: p/ A- ?$ [3 Z( k, z9 q/ _
/ x M$ S6 D3 Y( ]There could be hundreds of BPX you could use to detect this trick.3 V, U" X% C7 O! n, _/ t
-The most classical one is:3 C( Y+ ]. r7 y
BPX CreateFileA if *(esp->4+4)=='SICE' || *(esp->4+4)=='SIWV' ||
" m% |5 x& e, o. x, H' A2 E *(esp->4+4)=='NTIC'
- Z- A$ T9 X1 J D+ p1 o& h9 R) U4 J, {
-The most exotic ones (could be very slooooow :-(! h5 r8 b8 C: V1 O9 \: \# x3 y
BPINT 30 if eax==002A001F && (*edi=='SICE' || *edi=='SIWV') - P6 O, a6 V# B# ^
;will break 3 times :-(
5 j ^' K& \" G' u2 I9 I2 u0 n4 j7 r( h, N# o/ d9 L2 ?$ B# t" J1 U; @2 s
-or (a bit) faster: ! t+ r; a( w+ i) c! U; o9 K
BPINT 30 if (*edi=='SICE' || *edi=='SIWV')7 [) V& r. z& d8 J) m5 t
9 @. e D1 I( j8 y9 u) e BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'
$ P, S4 m' o' U. Q2 k# |! z ;will break 3 times :-(
3 |0 V; K) s6 N/ Z( j5 {$ i% o& R9 W6 ]$ R, W
-Much faster: M; T) a5 e9 M! m1 m. c
BPX VMM_GetDDBList if eax->3=='SICE' || eax->3=='SIWV': H( i8 m% g$ @
, _2 ^" H$ P& u& ]3 N8 b$ zNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
4 x2 V1 K2 ? r& e- J3 e# k0 {function to do the same job:
" I: N$ N& r; J, L" B/ M5 X
- C2 b$ p( y0 M% Z5 b. c0 V9 v( @ push 00 ; OF_READ4 T. \! A$ _) J5 ]
mov eax,[00656634] ; '\\.\SICE',0
5 ^7 B5 u$ g) p- K& u push eax
: b% Y* ~& N) z% N% ~% z call KERNEL32!_lopen
+ c$ T+ Y' G9 Z* V/ n: A* c inc eax
$ V* K$ j0 y& ~( f+ | jnz 00650589 ; detected2 ^' @( |( A E; s0 x
push 00 ; OF_READ
" }3 g3 W* p% T9 N9 M mov eax,[00656638] ; '\\.\SICE'
3 T5 t" Z+ b) D0 w, s4 T4 K push eax" V3 j! T# K0 F, l# R
call KERNEL32!_lopen
9 z1 l3 o/ f, P# [ inc eax; r+ i& s" d4 z* I {) D+ i
jz 006505ae ; not detected
2 b4 ?- ?" G. r! V P Z. ^! x- u0 {0 O/ X% r. z' `
7 e% r! J# d8 D__________________________________________________________________________
2 {, {& r, K6 c- e2 u" n" {* h
% a0 V( {7 ~" RMethod 121 F6 ~) M; Q# t' R2 `1 }
=========1 X. D- S4 _4 E( m4 `' s0 }$ i
& E' I) f+ t; c& H
This trick is similar to int41h/4fh Debugger installation check (code 051 `2 ]- W7 D/ W: k
& 06) but very limited because it's only available for Win95/98 (not NT)8 h- G7 X, _+ U2 X. i/ F: e9 ~: s
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
$ [0 d: I9 L- l, a. h$ r; p- X' M8 k+ i% E, y& o* _1 @, @' a& H
push 0000004fh ; function 4fh5 b$ R' {8 y9 d9 z
push 002a002ah ; high word specifies which VxD (VWIN32)
: r% {! M4 [ l ; low word specifies which service
* J0 \! v; `5 l (VWIN32_Int41Dispatch)& r7 m. J. u; ^
call Kernel32!ORD_001 ; VxdCall7 n8 T; g+ t( Q+ {; X+ B
cmp ax, 0f386h ; magic number returned by system debuggers
, ?8 t4 ~4 R; h: L4 O' g- J- L jz SoftICE_detected
9 l! u% P2 W5 w6 S! k+ ]
5 I; |, S" m7 Q4 aHere again, several ways to detect it:
2 x7 {$ X" p/ k [! X/ f
1 S) H9 @% e1 A* ~' `: C BPINT 41 if ax==4f: ^7 x0 e4 N5 k& M" P* } z
& o* o: E& K/ k- G6 p0 r" y BPINT 30 if ax==0xF386 ; SoftICE must be loaded for this one
' b3 j+ N$ C. Z* L: c" w2 T0 x, z6 ]
0 H! P4 q5 f' d6 O BPX Exec_PM_Int if eax==41 && edx->1c==4f && edx->10==002A002A7 u6 H' H/ }. P/ B; a+ ^
' K& w5 E5 m; t' B
BPX Kernel32!ord_0001 if esp->4==002A002A && esp->8==4f ; slooooow!3 H9 f- C& g( Q( B. v" I9 T
0 \+ y9 v: U; ~5 s- n+ n
__________________________________________________________________________
1 a, K) }! \" @2 f: q K! Y+ ^( S3 p' J) Y3 K, Q7 ?" e4 D
Method 13) @; I( D3 y: b( ?+ x
=========
9 M. ?* Y: W; Y0 @8 P' H! B9 q+ N7 q" k1 Z$ N* X! ?; a
Not a real method of detection, but a good way to know if SoftICE is
! l \% u6 _; y; }+ [1 hinstalled on a computer and to locate its installation directory.
" g1 H) d1 V, ^# d0 Q3 e* L; l' S# tIt is used by few softs which access the following registry keys (usually #2) :
) Z/ R( M. a/ M; C* [$ C) c; X% D [7 y/ U! F' M
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion8 ?" c" G6 m+ Z, y% r6 Y
\Uninstall\SoftICE J" w$ |# k" l# c, G @
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE [8 h/ [- O. [1 Q S3 a7 [7 `
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion0 v$ ^6 B' d9 b% a$ F
\App Paths\Loader32.Exe/ E+ a% W( ~1 |) c
6 L h1 q& S" `3 P5 M2 {% ?, b/ ^1 R1 M6 T/ K
Note that some nasty apps could then erase all files from SoftICE directory
: a# M$ Y. F( C- e' V' f \0 ^* Q(I faced that once :-(
9 \9 l% I# ?8 y, ]3 @, \0 ?6 g. R) u/ Q8 R) Q: W$ R0 v* e
Useful breakpoint to detect it:4 T* ~* p5 @* l+ P# T2 t$ Y1 L0 U
3 n1 Q) J0 I1 y$ f9 f6 _ BPX _regopenkey if *(esp->8+0x13)=='tICE' || *(esp->8+0x37)=='tICE' r6 q4 a4 B" j' j
9 T1 ? e* r1 Z! q w: \# j
__________________________________________________________________________ y2 Y9 i( L% ]. q
- b h$ z- f7 N1 C% \- }' l& o8 B7 r1 C' u7 r, E
Method 14
" R [1 i, N) m2 Q=========
0 Z; C6 m! b* _6 z( p
) ]0 y$ Y/ D W9 v/ hA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose4 u. U8 P9 d5 u; W4 J8 C
is to determines whether a debugger is running on your system (ring0 only).
! ^/ i, c7 J( x0 R. R' L
1 v+ x1 g1 r) Y7 J VMMCall Test_Debug_Installed
) H: O d4 u( f) Z* F% d je not_installed
6 y! Y* f' i8 R4 D) `% s/ D/ I7 y
( s) B: {7 \, g* d7 o- B- UThis service just checks a flag.
, \1 ~ M% U3 f. _3 J6 N8 ^* u</PRE></TD></TR></TBODY></TABLE> |