Problem - Kevin Tafuro

ecause of its power. Four well-known methods for detecting the presence of
SoftICE exist, which are detailed in the “Discussion” section.
Discussion
The “Meltice” technique is one of the oldest methods for detecting SoftICE. It
attempts to open virtual devices created by SoftICE; if any of these devices exist, the
debugger is present.
#include
BOOL spc_softice_meltice(void) {
HANDLE hFile;
hFile = CreateFile(TEXT("\\.\\SICE"), GENERIC_READ, 0, 0, OPEN_EXISTING, 0, 0);
if (hFile = = INVALID_HANDLE_VALUE)
hFile = CreateFile(TEXT("\\.\\NTICE"), GENERIC_READ, 0, 0, OPEN_EXISTING, 0, 0);
if (hFile = = INVALID_HANDLE_VALUE)
hFile = CreateFile(TEXT("\\.\\SIWDEBUG"), GENERIC_READ, 0, 0,
OPEN_EXISTING, 0, 0);
if (hFile = = INVALID_HANDLE_VALUE)
hFile = CreateFile(TEXT("\\.\\SIWVID"), GENERIC_READ, 0, 0, OPEN_EXISTING, 0, 0);
if (hFile = = INVALID_HANDLE_VALUE) return FALSE;
CloseHandle(hFile);
return TRUE;
}
SoftICE provides an interface via the debug breakpoint (int3) instruction that allows
a process to communicate with the debugger. By loading a magic value (“BCHK”)
into the ebp register and executing an int3, the Boundschecker (originally the
Numega Boundschecker utility) interface can be accessed. The function to be called
is loaded into the eax register; function 4 will set the al register to 0 if SoftICE is
present.
#include
__declspec(naked) BOOL spc_softice_boundschecker(void) {
__asm {
push ebp
mov ebp, 0x4243484B ; "BCHK"
mov eax, 4 ; function 4: boundschecker interface
int 3
test al, al ; test for zero
jnz debugger_not_present
mov eax, 1 ; set the return value to 1
pop ebp
ret
debugger_not_present:
xor eax, eax ; set the return value to 0
pop ebp
ret
}
}
686 | Chapter 12: Anti-Tampering
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.