Detecting SoftICE by Calling INT 3h

written by: Sam Petrone; article published: year 2006, month 07;


In: Root » Computers and technology » Software » Detecting SoftICE by Calling INT 3h

Dutch French Spanish Portuguese Italian German Japanese Chinese Korean Russian Arabic Bookmark and Share this Article

This is one of the most well known anti-debugging tricks, and it uses a back door in SoftICE itself. It works in all versions of Windows, and it is based on calling INT 3h with registers containing the following values: EAX=04h and EBP=4243484Bh. This is actually the "BCHK" string. If SoftICE is active in memory, the EAX register will contain a value other than 4.

This trick has often been used in the code of various compression and encoding programs, and it is well known because of its wide use. When used well, it may cause trouble even for the more experienced crackers.

.386 
.MODEL FLAT,STDCALL 
 
locals jumps 
UNICODE=0 
include w32.inc 
Extrn SetUnhandledExceptionFilter : 
PROC .data 
message3 message2 delayESP previous 
.code db "Detection by calling INT 3h",0 
db "SoftICE found",0 db "SoftICE not found",0 dd 0
;the ESP register is saved here. dd 0 ;the ESP register will save the address of the 
;previous SEH service here. 
Start: 
;------------------------------------------------------------------------------------------------
-;Sets SEH in case of an error 
;-------------------------------------------------------------------------------------------------
mov	[delayESP], esp
 
push offset error 
call SetUnhandledExceptionFilter 
mov	[previous], eax
 
;-------------------------------------------------------------------------------------------------
;The new address for Structured Exception Handling (SEH) is set here to ensure that in case of an 
;error, the program will continue from an error label and will end correctly. This is important 
;if, for example, the program calls an interrupt that will be performed correctly only if SoftICE 
;is active, but which will cause an error and crash the program if SoftICE is not active. 
;Finally, the previous SEH service address is saved. 
;-------------------------------------------------------------------------------------------------
   eax,4 mov   ebp,"BCHK" int 3h push eax ;"magic" values to be found ;whether SoftICE is active
 ;calls the INT 3h interruption ;saves the return value 
;-------------------------------------------------------------------------------------------------
;Sets previous SEH service 
;-------------------------------------------------------------------------------------------------
   push dword ptr [previous] 
call SetUnhandledExceptionFilter 
;-------------------------------------------------------------------------------------------------
;Sets the original SEH service address 
;-------------------------------------------------------------------------------------------------
   pop   eax cmp   eax,4 jnz   jump 
   continue: ;restores the return value
 ;tests to see whether eax was changed ;if it was changed, SoftICE is active ;in memory
 
call MessageBoxA,0, offset message2,\ offset message1,0 
;-------------------------------------------------------------------------------------------------
;If the return value is 4 SoftICE wasn't found and the program prints out an error message.
 ;-------------------------------------------------------------------------------------------------
   call ExitProcess, -1 
;ends program 
jump: 
call MessageBoxA,0, offset message3,\ offset message1,0 
;-------------------------------------------------------------------------------------------------
;Displays a message that SoftICE was found; any code may follow this point.
 ;-------------------------------------------------------------------------------------------------
call ExitProcess, -1 
;ends program 
error: 
;starts a new SEH service in case of an error.
   mov   esp, [delayESP]
 
push offset continue ret 
;-------------------------------------------------------------------------------------------------
;If an error occurs in the program, SEH will ensure that the program will continue from the ;error label. 
;-------------------------------------------------------------------------------------------------ends 
end Start	
;end of program
 

Disclaimer

1) E-articles is not responsible for the information contained by this article as well for any and all copyright infringements by authors and writers. E-articles is a free information resource. If you suspect this article for any copyright infringement, please read the terms of service and contact us to investigate the problem.
2) E-articles is not responsible for inaccuracies, falsehoods, or any other types of misinformation this article may contain and will not be liable for any loss or damage suffered by a user through the user's reliance on the information gained here.

link to this article