Problem - Kevin Tafuro

The int3 interface can also be used to issue commands to SoftICE by setting the esi
and edi registers to magic values, then invoking function 0x911:
#include
char *sice_cmd = "hboot";
BOOL spc_softice_command(char *cmd) {
__asm {
push esi
mov esi, 0x4647 ; "FG"
push edi
mov edi, 0x4A4D ; "JM"
push edx
mov edx, [cmd] ; command (string) to execute
mov ax, 0x0911 ; function 911: execute SOFTICE command
int 3
pop edx
pop edi
pop esi
}
}
Finally, the presence of SoftICE can be detected by invoking function 0x43 of interrupt
0x68:
#include
__declspec(naked) BOOL spc_softice_ispresent(void) {
__asm {
mov ah, 0x43
int 0x68
cmp ax, 0xF386
jnz debugger_not_present
mov eax, 1
ret
debugger_not_present:
xor eax, eax
ret
}
}
SoftICE detection and counterdetection is a continuously evolving field. Different
versions of SoftICE have different memory footprints and runtime behavior that can
be used to detect them; however, because most software protection crackers have
modified their versions of SoftICE to foil known detection methods, it is advisable
not to rely entirely on SoftICE detections for protection.
See Also
• “About Anti-SoftICE Tricks” by Frog’s Print: http://www.crackstore.com/003.htm
• “Anti-Debugging Tricks” by Black Fenix: http://in.fortunecity.com/skyscraper/
browser/12/sicedete.html
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.
Detecting SoftICE | 687