Bypass Skype SoftICE & Integrity Check

With all the political mess around Skype, Joltid, Joost, Index Ventures and others it would be nice to call out the liars. Yes Volpi I am talking to you and more than two handfuls of co-conspirators and at least seven companies. However doing so requires proving without a doubt that Skype contains code that it was not licensed to use or is to be considered as intellectual property theft. Keep in mind that this isn’t all about Skype as we will dive into Joost and others down the road.

Firstly in order to prove that some code exists in the Skype binary we need a non-obfuscated, non-compressed and most importantly a non-integrity checking version of Skype that will run under the context of the SoftICE debugger.

Unfortunately the code changes with each revision however each subsequent bypass is a minor headache at most.

The version of Skype I am working with employs two SoftICE checks with a single binary integrity check in between the operations.

Bypass first softice check:

Change:


02 00 00 01 74 1c 6a 00


To:


02 00 00 01 [74 ==> eb] 1c 6a 00


Bypass crc check:

Change:


71 ff 84 c0 75 1d 6a 30


To:


71 ff 84 c0 [75 ==> eb] 1d 6a 30


Bypass second softice check:

Change:


e8 94 6e 6b ff 84 c0 74 1a


To:

e8 94 6e 6b ff 84 c0 [74 ==> eb] 1a


Run the final patched Skype without problem.

This is a demonstration of how to use the JMP command to breakdown the autonomous barriers of object code.