找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
  M# r7 v5 [# b( \# r3 T0 |<TBODY>
  g% e- b6 K& z4 z4 d; a+ e7 U<TR>7 B. s' j" f3 w3 O6 X( p& k" V
<TD><PRE>Method 01
# d2 ?5 N& C/ r# Z3 M* {# ?  X=========4 W! n; y4 s3 T. ]
7 l+ g$ M) T" y+ l6 u
This method of detection of SoftICE (as well as the following one) is
0 s* g0 p! ?" n; G; G7 Vused by the majority of packers/encryptors found on Internet.3 `1 \" x* P5 q3 |  G2 P& p6 b  y) {& v
It seeks the signature of BoundsChecker in SoftICE
" q; J/ Q; X4 D2 _8 z( v8 y4 S
' t! w/ j& l# a3 @, C1 A' G; {    mov     ebp, 04243484Bh        ; 'BCHK'
8 V0 V  m5 O0 f5 _' s- [    mov     ax, 04h
  R, {! {) W: Y. i    int     3      
1 E1 ]9 N$ g4 A3 v4 w9 ~2 g( U    cmp     al,43 Z% i& ~7 b7 O4 }& ~) m2 V
    jnz     SoftICE_Detected+ F$ f) X# y+ Q- D( K3 d

1 F4 z/ }$ _/ H0 C: L___________________________________________________________________________( Y8 s9 u9 ?0 [9 ]* ^

( T* `4 j4 ?: R& g' y' Y, AMethod 02
! U9 d) U" w6 ]  j4 _! L: f) q=========3 n1 P; F$ W& Q/ f: A& @

" E* |. p2 K1 x6 lStill a method very much used (perhaps the most frequent one).  It is used
! V) Y6 A6 K. o% v$ w3 Wto get SoftICE 'Back Door commands' which gives infos on Breakpoints,) u/ }( U# K& z9 c- ?! ~) _: U
or execute SoftICE commands..." v/ @/ `. H* t; U
It is also used to crash SoftICE and to force it to execute any commands+ v# }* g9 I. h" d; V: s& N( y
(HBOOT...) :-((  / X4 E2 m+ d7 _6 |' V+ ~

$ x  ]' @* E! M, |3 x8 D* q6 THere is a quick description:
: Y# d6 C; j7 `3 P. q  A-AX = 0910h   (Display string in SIce windows)& P; \8 R# f- I1 C. ]2 k6 }' g
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
. p2 R9 }, s2 S& H1 b-AX = 0912h   (Get breakpoint infos)! |: ]2 I* ~9 ?  q/ k5 t4 U* Y
-AX = 0913h   (Set Sice breakpoints)  K* p' _  l2 I* W6 a0 x  C4 c* Z
-AX = 0914h   (Remove SIce breakoints)
& ]; q) n. _( |) V3 G/ b! X8 _- N, Z+ F( T6 i+ t+ T
Each time you'll meet this trick, you'll see:
# A. m+ N/ K( Y7 R0 P$ ?* U-SI = 4647h/ a- X% x! ^; z" ?, o9 A$ \+ \' _
-DI = 4A4Dh4 L2 j) \6 T. z1 o% ]3 I) v
Which are the 'magic values' used by SoftIce.) l8 g* o$ T$ f2 L& M
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.9 j  C: x9 O" @$ R& b, E) {; {
+ C  g! P4 K: v6 ~. S% e7 e
Here is one example from the file "Haspinst.exe" which is the dongle HASP! q1 x. ]6 X1 e! B7 a
Envelope utility use to protect DOS applications:9 u' Z5 j) u$ B
+ S$ q& y! K" \1 `
" ?$ d# ^$ Y# v: J- y9 _3 v
4C19:0095   MOV    AX,0911  ; execute command.
2 y* }( @& Y* G  X5 N4 A0 X4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).+ A/ s! g; l1 b6 f
4C19:009A   MOV    SI,4647  ; 1st magic value.7 \) l1 f! A% a$ v
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.4 {$ X2 l4 E: X
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
) N$ j% b( L$ R% t5 u' L/ p/ \7 Z4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute) E0 C8 `, ?& m% t9 q, F
4C19:00A4   INC    CX
" c. ~  ]- q$ L0 K. H. q4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute( W. i3 T/ L1 f& h* `$ q
4C19:00A8   JB     0095     ; 6 different commands.* {9 C3 a) T% \: R6 b: X
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.# W: S4 U% W' o9 u) j
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
3 t8 K( {  n" {$ J1 K
. g! \' G4 @2 V4 C/ \- \The program will execute 6 different SIce commands located at ds:dx, which
$ o& b8 B- M6 y1 {; yare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
- t* P" g. u. u* T: T# \: q
% l% C* A6 L3 t* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
! c' _+ T9 k# q1 E) ~( p3 l___________________________________________________________________________# }- O( M: ?& E5 _: G
$ A; L2 ^3 G  E! |( W8 x

! s' R1 J$ f/ H4 y& \* c$ S  zMethod 036 Y& @: Q' K( H' b5 [
=========2 a( {+ i$ A! |) D  \

4 Q1 q, s* O0 X, X6 c$ RLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h/ f2 O2 k* ^+ ]% K# j5 N9 ^
(API Get entry point)
! o$ @3 o* R1 Y- A' s0 l        3 v# [: \% Z9 G0 K

/ h. B1 E' f5 ]- N$ ?) S    xor     di,di" X! b. _; M. Z7 s7 g* x
    mov     es,di
, g, J7 A. j6 K    mov     ax, 1684h      
4 h. D" M. f) a& Z/ |    mov     bx, 0202h       ; VxD ID of winice
, \/ J8 F% h7 P+ n3 Q, J$ x$ \    int     2Fh- k: k2 I7 F% R$ L. k4 q
    mov     ax, es          ; ES:DI -&gt; VxD API entry point, P9 a& h5 G* B5 f; l! l
    add     ax, di
- O7 h3 Z, E% o) g  D/ w    test    ax,ax7 d# i4 N2 h& d2 |+ b
    jnz     SoftICE_Detected! w* `- }' K* L1 T
8 `6 K  o& q- M) M1 N# G
___________________________________________________________________________
# Q: T( s" I5 ]! V/ Z
+ e4 I8 }, E/ |, E  x% N  \/ qMethod 04' S) `. f: P# B9 c$ v1 X' y
=========( ^/ m% O& k- A5 F3 k& |

# z* b( o* t6 C. QMethod identical to the preceding one except that it seeks the ID of SoftICE0 l% E) Y% v+ N+ V
GFX VxD.
) U( t. f1 B, c. Z1 A
, [4 J3 @" T8 J$ K+ \6 {4 ?    xor     di,di
) Q7 {" K8 b7 o9 v4 _' K4 N    mov     es,di
& L6 @4 L$ }' I, h. l& f! V    mov     ax, 1684h       : x! I% g. M/ z1 f4 b2 D; A
    mov     bx, 7a5Fh       ; VxD ID of SIWVID+ g3 d2 ~! ]& [9 P- F3 p( V
    int     2fh
/ }" D/ n/ l5 t9 O3 k    mov     ax, es          ; ES:DI -&gt; VxD API entry point6 i3 F' z8 E: ?1 d9 [
    add     ax, di$ ^% n. H/ W  y1 J9 ~: r
    test    ax,ax
& I% b1 J# M% I6 c. P    jnz     SoftICE_Detected
+ v( ]. ^; q- I2 {" v0 v! |2 _( I3 i+ o' R
__________________________________________________________________________/ u4 s5 H+ ]. B- Y, a* Z6 [
" m6 |" ?% Q9 U0 u' O7 ^% F% B- `" U: _
% u. e: l7 r' F; z/ z: i: w
Method 05
2 L1 z& e, X( T: ^' ^% k=========
$ k- H: `* x& Z6 ]: n
6 A6 b- Z" K* Y# p- E+ AMethod seeking the 'magic number' 0F386h returned (in ax) by all system( l- [/ I  I$ }0 u( q7 ?
debugger. It calls the int 41h, function 4Fh.8 f% ^  _/ q0 e& V  I
There are several alternatives.  
+ D8 K- Y, J( h1 ^: @  o  j6 N  P& V  A; ^% h
The following one is the simplest:  _- A: y' C- q

" g' ?9 B3 x- o    mov     ax,4fh+ g9 T+ x  ?% a! F) M
    int     41h/ i5 c. u2 t2 J$ a$ n) {( A4 ~" x) u5 i; [
    cmp     ax, 0F386$ h4 C/ q, m) u! n) x" f
    jz      SoftICE_detected/ t# a; w0 z" M+ h" u+ P

8 y- i2 ?. H; G; R* X* H  Y0 m3 y3 @5 i2 e+ t+ v# D
Next method as well as the following one are 2 examples from Stone's + ~) e' L. M" E$ n' ~5 v3 w
"stn-wid.zip" (www.cracking.net):% S0 u& W4 J9 `2 L& i. }; g8 d

) x7 V2 a& Z2 y: p5 q9 k    mov     bx, cs0 n% K3 w" r6 I% X6 S
    lea     dx, int41handler2, X2 f8 _. w' K5 ^
    xchg    dx, es:[41h*4]1 q8 t2 @, V1 o0 F+ |
    xchg    bx, es:[41h*4+2]0 ~0 H; h' U8 _& _0 k1 W
    mov     ax,4fh4 g# Z5 G( {# v2 l: T3 Q7 }/ H
    int     41h; S3 E: F1 J( E
    xchg    dx, es:[41h*4]
' y7 H5 C7 i$ k7 |. N0 w    xchg    bx, es:[41h*4+2]
; q9 ~) r! u2 A6 c    cmp     ax, 0f386h1 y! t$ {' n% w& ~
    jz      SoftICE_detected
% |! }' ]' B' O8 U1 v! V6 {. P* n0 c1 t; e, W
int41handler2 PROC) y3 H1 Y# t( {8 Q% J
    iret$ ~+ |4 p- `8 E$ j& O) e0 E
int41handler2 ENDP7 u1 |" h: }. O) L

5 d, {; C6 Y: K0 r' e! b& R
* u2 c0 b8 N$ i7 k: v_________________________________________________________________________& y0 n( ]" z, N! }, E

, Y! O; t! b" ^1 f, V: P) j7 V; |1 e; `  s9 r
Method 06  m4 ^+ M! N) z/ {! r
=========
" U8 U; w, ]5 O' m, u# \- C
7 ]8 E# K6 V! D+ g% V' z* g( \$ |, m" O+ d+ S% p
2nd method similar to the preceding one but more difficult to detect:/ t# U; M+ W4 h# I# S
0 c: D! J8 x' M7 K3 t
7 h+ X. ?) \1 y5 b3 x
int41handler PROC' l* K$ d8 L. r' m3 r: }" [
    mov     cl,al
. ]! c2 |4 u( d    iret, o( `: x" J: ]8 f# [, y: p
int41handler ENDP* u* P4 F" s& Y4 e; G
( Q' l. B7 x, j, v  p$ q* n" {  m
5 J# t( r& X/ g
    xor     ax,ax" y7 F3 a/ X2 d- O0 q1 l
    mov     es,ax( m& O& d& ?3 g: u
    mov     bx, cs
+ W0 D  V* p  a) C; T    lea     dx, int41handler3 a, D1 B8 x! i7 w  C4 F
    xchg    dx, es:[41h*4]6 n- v. }: p' ]! k6 P% l! C6 B
    xchg    bx, es:[41h*4+2]
; t1 J) P2 k/ ]6 g# s2 v    in      al, 40h
% u" ?9 s; ^. q: R3 v: u) F    xor     cx,cx
! R# k5 B- [+ o$ [" b( E    int     41h
6 b3 s, A  G! g. Y: G" G    xchg    dx, es:[41h*4]
5 y* \& z* w- e$ t    xchg    bx, es:[41h*4+2]
1 a9 ?$ s( i# p- r3 {    cmp     cl,al
2 X. m+ {0 @2 l+ P' q    jnz     SoftICE_detected
* A. P/ l/ m2 U& L" w$ u) }0 x% _6 J9 D- D; E
_________________________________________________________________________
1 p4 O, c8 A& D( o; Y2 x* w) _  L! K3 z1 Y, O: Z
Method 072 A5 G" h3 F/ U# O* s
=========. o9 J0 l4 j2 e- S! |1 d& ?
" ?1 D! f" w7 W& w4 j& ^7 R
Method of detection of the WinICE handler in the int68h (V86)! U0 k2 K/ \5 G) F
( ^; e1 m2 o  N3 S! O" |( x
    mov     ah,43h9 ^1 D  S1 l; e3 E, }8 O4 r0 h
    int     68h
! X9 ^  }9 X) w. g: R    cmp     ax,0F386h. W0 t4 T$ f! N5 E+ R
    jz      SoftICE_Detected7 F% j  v0 o3 Q
: m! }0 o2 e& H

6 U9 p& U6 e  ]$ \1 @=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit1 h) a4 T4 H8 g9 a7 p1 H% o
   app like this:6 }2 H/ Z$ x/ U0 a, s
- h1 w9 ]2 c1 A& o) ~
   BPX exec_int if ax==68
1 Q4 U$ L! g) G   (function called is located at byte ptr [ebp+1Dh] and client eip is/ g: S' y7 k/ K' M
   located at [ebp+48h] for 32Bit apps)6 {3 I0 ]! t/ J. R! p) q- i8 u
__________________________________________________________________________
, r* v7 C- i2 u# S7 r
. t8 m& g; }8 y! r0 E( s. G0 D* q6 t5 D, n/ B- ?2 [
Method 08
6 Z, E' S8 e, S1 ~7 j1 _1 H( D=========
. N3 ?( v' p5 }. S( B9 Q9 V9 l) K# h7 U! ]2 M1 f% o0 P
It is not a method of detection of SoftICE but a possibility to crash the+ Z! F) M2 ~1 M5 T& G5 w9 G
system by intercepting int 01h and int 03h and redirecting them to another. b+ ?6 m% L" c- C* b2 |
routine.
' q# \' g  E& l8 y, _It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points# q  o8 D4 J" F5 j) V' b& b
to the new routine to execute (hangs computer...)
3 ]/ q- P. l* `8 s% S
8 G2 }' I& J, ~    mov     ah, 25h- {/ I8 n/ E! q/ }+ }+ h2 O
    mov     al, Int_Number (01h or 03h)
2 P& i  w3 ~; ]  x9 E. T% o    mov     dx, offset New_Int_Routine
5 A3 x' F2 E8 I% g3 t2 u    int     21h
& P3 _9 n7 Y! W
0 v3 c- y6 H" u/ ]7 W__________________________________________________________________________8 r+ \+ }% a. ?- ^, q

/ D, y1 ?/ j- R6 n1 }& TMethod 09
) d, w, C6 f6 }2 a; O=========- w) c6 a3 Y; Z4 |

2 |' N8 K/ S: VThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only* y7 t" e4 p  U' {/ A
performed in ring0 (VxD or a ring3 app using the VxdCall).
. K" `! M; t# Y" a/ Y) NThe Get_DDB service is used to determine whether or not a VxD is installed2 c# a' g  x# @" K. z5 w
for the specified device and returns a Device Description Block (in ecx) for) ^# J6 b$ M% I& g' Z
that device if it is installed.
; B8 y. ^# p5 J2 |8 t5 a- E' Y3 B6 {+ q! z  @" I6 j( c
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID( G9 ?* ^& c& O
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)# O  p. x& S! J& `
   VMMCall Get_DDB8 `; C& N( h- C6 H2 ~0 t' K" h
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed7 D5 c$ E& }0 D  f: f: g

8 J5 s6 N. Y9 B" f5 e$ u: jNote as well that you can easily detect this method with SoftICE:
* h& p: r, C6 @3 Z8 A4 g. L( P/ w' P   bpx Get_DDB if ax==0202 || ax==7a5fh
5 [1 Y) o0 V( r* s0 p$ t8 R) M! Y# d; S1 c7 @  U' H3 ]! I% c1 g
__________________________________________________________________________  h/ x6 o9 y# M
2 D7 e/ v7 D8 m: }+ b  ^3 X
Method 10: a- V, ?; h2 N/ i* ?) U  a
=========0 s5 E4 `  F6 S" g1 J' J, J
5 @9 J4 I$ l- h% C5 D% D* g+ M7 w
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
7 ]3 [: D) Y) G  SoftICE while the option is enable!!; @! Z8 L5 g) j9 H+ G& Z7 b* t

+ R" r# M( p7 i8 x+ s4 d- y/ @7 cThis trick is very efficient:( I/ Z  n; H/ y$ {( w
by checking the Debug Registers, you can detect if SoftICE is loaded
1 V$ [* F& n$ y. I/ j(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if' Q# J  y( q7 h+ |# J: M2 |+ L
there are some memory breakpoints set (dr0 to dr3) simply by reading their- u' D, T# _. j. ^
value (in ring0 only). Values can be manipulated and or changed as well0 i# u" \: C& @; n! A: ?5 n
(clearing BPMs for instance)
9 t3 e4 ~) i1 E
0 J, [% M6 Y9 P$ u6 i__________________________________________________________________________
% j/ r9 m9 R# O& j, r) \& C7 ?. ?, I6 Y' `3 o( x" y$ d
Method 11
. ^; I: t$ x0 t3 u% g: _=========
- D% q' ~' a1 V2 |4 y8 G# b# O1 v' J- x. `- M6 v$ K/ `; d
This method is most known as 'MeltICE' because it has been freely distributed' c3 `3 d& G" e2 s" v+ H; a2 w
via www.winfiles.com. However it was first used by NuMega people to allow8 K+ w* B4 i/ h. P
Symbol Loader to check if SoftICE was active or not (the code is located* b5 Q  `1 X% w9 f
inside nmtrans.dll)." \4 ?2 x  ?$ f- T6 o0 L

% \" F3 G3 T9 a/ YThe way it works is very simple:
9 O) v2 W4 S! H" i+ o, N6 F) P) WIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for6 K& o( P9 t6 ^3 n. g' f
WinNT) with the CreateFileA API.
% _4 A: }5 T  K5 d
& E5 k7 s% L# p, j: b7 ^, L9 |, i2 fHere is a sample (checking for 'SICE'):2 m# E( w5 [( Y$ r+ \# C

% s" f) |& i( V* C0 I% ZBOOL IsSoftIce95Loaded()( k  l2 g" @, [/ F% U% P
{6 ?2 e9 K, k5 A$ g7 _% g
   HANDLE hFile;  
; E+ R5 H4 a$ s( {, C9 J6 G5 F   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
' C, N( u8 Z  d5 i; T$ s                      FILE_SHARE_READ | FILE_SHARE_WRITE,( K) q# D$ R9 |3 D( l  a
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);+ U8 S$ _9 I! K& z: J$ U
   if( hFile != INVALID_HANDLE_VALUE )3 f; V# P  p3 y. Q$ a$ V4 T
   {  h+ F2 B: p& Q  Z! M
      CloseHandle(hFile);
% ?) d% @4 Q9 F# b      return TRUE;/ D. ]: z% X$ ~" |: J+ G
   }! x7 |3 Q# N- g! _8 M3 V
   return FALSE;+ y/ e; R# X, {/ J5 S' m& C1 u; Q( k
}
' v. z% k5 G1 c3 I: N- B
- k, g2 b: J# `& UAlthough this trick calls the CreateFileA function, don't even expect to be
  h2 l8 k: W6 n5 a, w1 `0 t* Jable to intercept it by installing a IFS hook: it will not work, no way!' l# e) d& O8 V% z
In fact, after the call to CreateFileA it will get through VWIN32 0x001F7 B6 d/ p9 o/ F2 z( H
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
3 g3 C4 T7 u" M0 g6 b: mand then browse the DDB list until it find the VxD and its DDB_Control_Proc
6 B* r1 X7 t: Kfield.
0 p& c. ], I& ?& F& `In fact, its purpose is not to load/unload VxDs but only to send a
. m$ L  G. b8 m& I' jW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
! b% N0 r/ [# Q) d- D6 t# N' Xto the VxD Control_Dispatch proc (how the hell a shareware soft could try
* v1 Z0 E+ X7 L9 v! `9 S5 Zto load/unload a non-dynamically loadable driver such as SoftICE ;-)./ t5 X( u4 p4 u: a
If the VxD is loaded, it will always clear eax and the Carry flag to allow
# G. d" s* T6 L1 Z7 Wits handle to be opened and then, will be detected.
9 V  d) o+ _4 \9 [4 q; c9 ~2 jYou can check that simply by hooking Winice.exe control proc entry point
' l1 B4 f) k1 c( Ewhile running MeltICE./ n& \6 o" g' @" p+ c
9 L; M" {0 M, H

- ~8 s; m' O- t& e  00401067:  push      00402025    ; \\.\SICE4 y. c/ d# y" N0 Q( _
  0040106C:  call      CreateFileA7 I4 D4 f- x. s
  00401071:  cmp       eax,-0011 v7 E  C, z) m
  00401074:  je        00401091
, ]  i# w9 O3 m) a3 u# A! T+ {3 |3 _
$ a' e: U& b$ t9 m& ^& ^( K$ T
There could be hundreds of BPX you could use to detect this trick.
6 I  N4 J! m- Q0 `-The most classical one is:
% v* H0 g" z% F: P; [! Q4 a+ q2 \  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
$ W5 ^$ _) j+ J6 m7 J+ W6 [    *(esp-&gt;4+4)=='NTIC'
4 u( e9 v5 v6 L; }6 Z0 X, i6 ^" o. n, G) f9 Z5 C, |. _& T* W. ?
-The most exotic ones (could be very slooooow :-(
' {) G) z& y4 b   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  8 S3 h) o# Q; n, _4 |; O
     ;will break 3 times :-(
8 ?' d( q2 ^) T' H7 Z/ x: v! a& e7 V* ]/ d8 }# i/ b! ?
-or (a bit) faster: ! T$ z4 K8 ?7 ^& v0 D$ |  p# K
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
$ M7 x+ }1 r( Y. L3 J
. d3 H! F/ Q  p4 f- Z   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
! \" l) l( T. j3 H7 \. u     ;will break 3 times :-(3 g( s! J4 I7 L, ]0 D  t6 k; o# u
" `" `$ n6 \2 a; M  a4 p6 S5 f- o/ _
-Much faster:+ i$ }* E! F& y9 S9 I
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
8 y6 w7 r# ~% [% p2 ~$ G2 w
8 S& |) I: m2 Y) sNote also that some programs (like AZPR3.00) use de old 16-bit _lopen8 K( |( w. S1 w9 F" r  i
function to do the same job:
8 r' [. Q9 ~& G1 W
/ S( ], J; I# G0 |   push    00                        ; OF_READ
5 Q) q4 A7 Z3 y, H" @" K   mov     eax,[00656634]            ; '\\.\SICE',0
: \5 w! s+ T. a; {   push    eax/ Z* p9 ?! U/ O( H# [* p
   call    KERNEL32!_lopen
. L. Q$ t/ L1 p   inc     eax7 W, g9 l( R4 x) g+ p" A
   jnz     00650589                  ; detected
; J! G% [0 \8 }4 ^% k# y& Q5 Y' a   push    00                        ; OF_READ% o; B% q! c9 z
   mov     eax,[00656638]            ; '\\.\SICE'
, a$ a1 K7 t( f- D! j   push    eax
5 w8 o. |! W1 j4 F% \- i  ~6 i& d   call    KERNEL32!_lopen
9 [: |  I7 ?) L5 v( f7 a   inc     eax0 R$ `( S' J. l. v1 `
   jz      006505ae                  ; not detected
7 v0 n8 Z1 y7 f$ @* f7 w) t) _. U; q% W* n6 E5 B

# }2 C0 q& f; }2 R; n__________________________________________________________________________' T+ v6 w7 @# X5 _2 r/ U

: x( {! U9 d# D0 c, xMethod 12
& E2 N- G2 c- y! m# ]  l" m=========
0 W+ N5 {, C/ ^* u$ E. I  G. v
/ p8 [. |7 q3 L/ [( u$ LThis trick is similar to int41h/4fh Debugger installation check (code 05
3 Q, c; Z; u0 Q/ }5 a- A$ R3 u; C( Z&amp; 06) but very limited because it's only available for Win95/98 (not NT)
" ~, N2 d! V7 ?8 }* |7 Has it uses the VxDCall backdoor. This detection was found in Bleem Demo.
, T+ e$ A/ E2 p+ c& i% \
" g% p6 Y& h9 P) ~4 K6 {   push  0000004fh         ; function 4fh& A! D& f9 a9 w' [3 P. P! P
   push  002a002ah         ; high word specifies which VxD (VWIN32)
2 C7 x0 L+ f0 r7 `2 O  W/ |; s# t                           ; low word specifies which service
, [# K" ~) i* p8 Q                             (VWIN32_Int41Dispatch)# N5 ?, v% _! n1 ~  R! v2 Z
   call  Kernel32!ORD_001  ; VxdCall% C; c9 @4 D2 o/ U( c5 V3 F9 t
   cmp   ax, 0f386h        ; magic number returned by system debuggers; `6 T  ^0 F# M4 E
   jz    SoftICE_detected, u1 S0 Q' W9 B! P+ Q
/ Z' v; I( O2 b7 L2 t9 x" u/ E( f
Here again, several ways to detect it:' X) d4 @/ s# c8 E

' d" n; s3 ]! t# P8 {    BPINT 41 if ax==4f8 ~' J/ T$ Z: ]5 ]- x& `, Z3 N4 g/ r6 k

; c5 U) [6 \3 m* M; B2 R' h    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
6 J  k; `9 l7 H9 c
, b- k3 ?/ M  s& C* X4 p    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A$ q! |: q4 Z2 m+ I! M

7 A' E9 |9 j: W- B- g    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!1 B% |+ k; C2 E3 [

( a2 T3 [% i) N6 M( x2 o# @( s4 q__________________________________________________________________________
# Q# K7 s1 j5 E5 ]! h' Q
2 G) L) W" b! \Method 13
6 X7 e! _9 e- C% r4 ?! K=========
- v' l' F( }9 U( E9 B5 Y0 O
3 C) H; o1 L+ y, [0 a- N! }Not a real method of detection, but a good way to know if SoftICE is- d- u# s0 c+ R$ W" ~
installed on a computer and to locate its installation directory.5 U1 {  E) U! E
It is used by few softs which access the following registry keys (usually #2) :
: u# Y7 w) n8 j4 @: a
$ ]$ ?) o9 C3 f/ n2 L2 R-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion$ a( v% H4 h/ V7 ^6 V
\Uninstall\SoftICE
' @8 P* ~  _& m0 z+ \$ Q-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
( ?: K& ^: ~. y3 ?# w-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
% I; h2 Z' o7 O6 C( I; V\App Paths\Loader32.Exe" _& |. B) E6 ^  [" w. e

2 S- M$ d" I+ M
, Z; L) g: o  oNote that some nasty apps could then erase all files from SoftICE directory
( r+ f: C7 f- i1 a' v(I faced that once :-(+ U, B; ?  e+ T3 R0 b/ \
/ @& d# x3 y3 O' c2 J: g
Useful breakpoint to detect it:
" j1 k. c0 T6 `: _0 p# Y
" o' z) W7 o# [5 Z" X1 U: m4 K     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
4 Q( U5 [+ Y% J
- y* {, ~, H2 ?# {__________________________________________________________________________
/ l: _* V+ [7 q" B9 J: x7 P
3 {: u, {- H( [. J
1 x9 d. K" `" m% _Method 14
* f+ r8 H( Q+ E) z/ C1 Y=========$ T* x+ N9 F- S5 R) ~3 G
' z1 N9 U- t8 H. g' J+ b  H
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose% y# S# B; @% D: s7 p: h
is to determines whether a debugger is running on your system (ring0 only).
: b" b; J# @; u* b8 L* j4 Y3 T5 [) d' {: ]! t8 N& t
   VMMCall Test_Debug_Installed% \# n8 I+ n+ ^5 O
   je      not_installed: u# C7 e( i! t! j% {" W" K

: Q' G& `/ ?( j% o; FThis service just checks a flag.
; i4 K/ r1 V" O</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-8-6 08:24

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表