找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
. ]  b! f. [7 u2 I# W9 K7 {<TBODY>0 t* v; q. d, G! A
<TR>" @; \8 L9 U* p$ ]' D* ?
<TD><PRE>Method 01 " f) U* ^8 M/ x: p  w- h
=========
; H' _+ [  D% K( y7 {! a. z
# C$ {8 t3 g9 s) qThis method of detection of SoftICE (as well as the following one) is0 R; e1 x& s9 X# e# A7 ]# Z# ~# @
used by the majority of packers/encryptors found on Internet.
3 Q1 ~) D4 _7 F, F+ p/ g$ FIt seeks the signature of BoundsChecker in SoftICE
8 p2 Q1 y* c1 c( d1 y
& S/ j. F( s: e% g, O/ n9 p    mov     ebp, 04243484Bh        ; 'BCHK'$ \. r* [' W( u) ?8 `& d6 n
    mov     ax, 04h
; z& c7 k- B: t/ x2 c( S* V) C    int     3      
2 o4 z* I) H0 a    cmp     al,4
6 [) ~% a* S4 |( T7 _5 A8 b& ]    jnz     SoftICE_Detected! `/ {8 Q; m% d6 s8 d

3 a# s3 x* V; ]___________________________________________________________________________* P/ g+ q1 t: W( T! A; d  Q) V0 C8 f

6 O) Z0 C( @! {( i# n# H: V" ]Method 02
* v9 F5 w+ }% A2 q; t4 G=========& A) v. z+ z. k8 @* I6 i
0 D1 q6 _8 P9 \4 S% a
Still a method very much used (perhaps the most frequent one).  It is used
3 i! o1 A8 \, Y- F/ a# n! \8 Eto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
9 h- F# w/ [( O" f) V5 sor execute SoftICE commands...
, y4 C1 Y& ]6 D  I  }$ eIt is also used to crash SoftICE and to force it to execute any commands& O: R0 E5 F" y  `
(HBOOT...) :-((  
/ f. g2 f7 S$ r  i1 v9 @! S; E; t% m# `! _7 R" C
Here is a quick description:- w" ^& R, r; ?, D  z7 D. X
-AX = 0910h   (Display string in SIce windows)8 U5 `- U8 }! V# |
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
% M7 D1 S8 `  A8 h* R- c; Q-AX = 0912h   (Get breakpoint infos)" M9 Z0 d5 x7 \; g5 D% v+ ~
-AX = 0913h   (Set Sice breakpoints)& L6 t6 }  R2 m- x; s7 Q2 i
-AX = 0914h   (Remove SIce breakoints)/ B; O: ^$ x$ m; j% j3 R& s
) \, X! v% Q  f  |- F' {0 M
Each time you'll meet this trick, you'll see:0 r. H1 B7 U$ s: o
-SI = 4647h
5 r& `$ E0 d+ G) d2 K- R9 X, N3 Q-DI = 4A4Dh" k/ A; a0 H6 r8 l8 _
Which are the 'magic values' used by SoftIce.5 _$ X: S2 c5 f6 p
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
6 D; a* A, V: v. O2 \& D" w) b) i* ?5 Q3 S7 `6 f
Here is one example from the file "Haspinst.exe" which is the dongle HASP
3 v9 @) @' S! ?$ NEnvelope utility use to protect DOS applications:
* ?. e: s0 J# W8 q8 L6 ^
$ c5 f, h5 f. @' q  ?7 X
  Q2 ?. G5 L# K2 b3 y3 \+ N+ \7 B% _4C19:0095   MOV    AX,0911  ; execute command.
) P1 r6 u  z2 A& _% \4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
* G$ E, c* c6 }) r4 F4C19:009A   MOV    SI,4647  ; 1st magic value.2 }& |# \! z0 O7 k& ^+ H
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
8 y. t, O( B2 w; s4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
$ R' R9 g  i4 d. g0 Z4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute8 {  y) W5 v# j
4C19:00A4   INC    CX$ k" z2 ]& T- U4 K- d
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute- m% P" X% w' C6 p
4C19:00A8   JB     0095     ; 6 different commands.
5 `* }! O' z+ m- z6 I+ X4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
% a4 l: Z+ F! d( a! b  H$ C9 B4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
, p) s, U! d% h- x0 x  f
( ^5 t$ Y7 `5 H# WThe program will execute 6 different SIce commands located at ds:dx, which
! ^9 d% G; Q$ o' m4 f- S& Oare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
4 q- q* e) `: Z. ?% A0 w  H
# Z3 {' G# @) \. ^9 J/ ?* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.) `6 Z+ h) G1 T/ I# W3 m
___________________________________________________________________________
- @: o* _3 b# A, ?) G- P  c1 q
- c, X. j; x: x0 L
2 B( x% h  z% c& t) K* c( QMethod 03
0 C  ^2 m. ?' H1 a. _=========) K0 t  W! b$ C9 p3 i8 d/ d
5 k# w5 D& I7 @+ ^/ {: `" R8 u
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
8 F. M9 {, v% q+ _6 }6 J- d(API Get entry point)
$ a( c/ _1 K9 ~5 a1 D% k        
. h# I" b# _& t7 Y- B8 G/ M! D# f& }
    xor     di,di
  [5 i( p9 U; B" x    mov     es,di
; q8 D, \, i0 c/ ]" v    mov     ax, 1684h      
# P: ^. y9 U. p3 Y3 X# U/ N( h* d    mov     bx, 0202h       ; VxD ID of winice
( p# h. P2 K) `0 [2 \! Y    int     2Fh
: Y. {& I' W0 Y1 o4 B" s    mov     ax, es          ; ES:DI -&gt; VxD API entry point
: U8 p4 T0 r: j4 ]: \& Q    add     ax, di" t+ s5 a9 X5 d, ?
    test    ax,ax
' A4 Y# Y3 k% X/ s    jnz     SoftICE_Detected8 Z" g9 q( S) X) H* |; _
! P; ?% }$ n9 M' A
___________________________________________________________________________
- D8 H! _& `( p, U3 E
# |, z, w  S4 J1 Z* q3 `3 ZMethod 04
3 K, \* u8 y& S9 l6 H! T! h' F. _=========, L, y6 H; x$ C# n6 v5 q
; |5 L8 {. T4 N+ m6 [+ Z
Method identical to the preceding one except that it seeks the ID of SoftICE6 T: I( M4 p# H3 l% u8 P
GFX VxD.% ]! O) l& `7 L

7 _1 K0 c) w/ v& d5 D    xor     di,di: K* @7 q) b" U2 g' X# V5 J
    mov     es,di; C$ R4 D, u, t. y4 W
    mov     ax, 1684h      
6 h  N" N3 \" J$ N    mov     bx, 7a5Fh       ; VxD ID of SIWVID4 D& v) G, F  n& B4 a( ^
    int     2fh
/ I7 D, r4 }, o% v; _2 d9 d    mov     ax, es          ; ES:DI -&gt; VxD API entry point
* E# s# Q- |7 |+ _" c/ n5 z* z    add     ax, di
4 }* i) T7 s1 M# m2 p( W% C4 K    test    ax,ax
8 a/ P/ v7 I7 {0 `" c$ ?3 ]    jnz     SoftICE_Detected
( @9 R- g. v/ ?* \& ?: l/ z' f9 m8 c; {2 ^0 |  n4 E& X9 T& u+ b! F
__________________________________________________________________________
) `; I6 X5 Q8 n6 E2 C2 X5 k7 A4 `7 o8 o! V

# F( O" ?- s6 BMethod 05
2 [8 ^; y2 N: _' q9 z( V=========
& q- {7 R5 a9 f7 V7 j) E  C0 g( W. u, X! H. f. J
Method seeking the 'magic number' 0F386h returned (in ax) by all system
: v2 E) O. k# F1 T: C/ xdebugger. It calls the int 41h, function 4Fh.& }* \; M8 ~: h. P1 \/ z
There are several alternatives.  0 P5 @  }1 {& B2 F( H6 s
" {. K, l. b4 {6 e8 i* b- a
The following one is the simplest:0 W% M4 n8 u3 q
- Z" S3 |+ k6 b& P( Q
    mov     ax,4fh8 l2 _! |  u2 a6 A
    int     41h, g, R" v! c& K  x" J  R4 ?
    cmp     ax, 0F386
& \7 |7 v! w" z* ^5 }0 V    jz      SoftICE_detected" f& h& q: y) F( X
0 a4 I3 x# @9 _& U
0 u. d+ w8 t6 K5 o4 I
Next method as well as the following one are 2 examples from Stone's
( r" ?! C) \$ \9 i" G"stn-wid.zip" (www.cracking.net):
6 }+ u7 V- [: Z6 ?: r0 V% x+ q6 I3 Y
, R. K! B. @- D8 T  P9 U    mov     bx, cs
/ f+ w2 J4 }. O$ P3 w$ n    lea     dx, int41handler2
/ a6 Y$ F& q4 e; e- C) X, b6 `! T; ~    xchg    dx, es:[41h*4]
2 k1 X4 p5 p5 S$ Y! B    xchg    bx, es:[41h*4+2]$ R" b: X3 L2 J+ r$ t
    mov     ax,4fh
5 s7 ]1 p9 |% g4 V4 @    int     41h- r" b0 ^- w! s$ R, a
    xchg    dx, es:[41h*4]$ S; Z! v$ J/ ~$ W; n# E7 ?
    xchg    bx, es:[41h*4+2]
' @9 u: g$ c8 ?- [: _: r    cmp     ax, 0f386h6 y  U2 ]* K7 `- P
    jz      SoftICE_detected3 m: t$ T* M8 w6 g+ S% s
! m2 p$ j5 y+ w
int41handler2 PROC6 ?" H8 M5 i! S, P
    iret! X& T& p- Z$ Q5 g! P+ X8 ?, z
int41handler2 ENDP
4 l. y. h! P2 L( J! V
2 W4 X" t/ l+ n5 n! H5 h, q0 m4 o( ]
1 m0 Q' r( l- O1 p- ~; e_________________________________________________________________________9 h* i9 V5 M* R+ Y- V7 G
: f9 P6 V- _' i
4 \1 l- \2 |, E
Method 06
) ?' t" z0 D! W" }. F% J=========
) M* M6 `" A7 v, ]: z3 w. I5 ^/ g6 a( [$ y" u

- g9 c0 ]* \$ _0 E2nd method similar to the preceding one but more difficult to detect:& Z; F+ i  `1 U/ d* [. A$ {

2 v4 Q& ]( D$ C! i9 J4 Y3 }' [0 @* Q4 @
int41handler PROC$ F' C+ u  s6 {
    mov     cl,al2 G8 I% V" R" i' n3 b) N* d
    iret
9 Y1 S: ~( K! w9 `  }int41handler ENDP
$ l6 w, Y9 P7 S6 q. z8 [! Q2 e4 M5 c' A' W! U
+ e! k5 X" x! \! w! W+ |
    xor     ax,ax4 [6 b6 X; |0 _2 S
    mov     es,ax
: P1 p9 y7 }! G8 D# [- [4 d+ p    mov     bx, cs3 `; M4 v$ U) d, a+ i/ H, A
    lea     dx, int41handler3 N( |8 s3 Q2 }" S" O$ b; n- Y
    xchg    dx, es:[41h*4]% W. k8 _9 k7 g' k* g
    xchg    bx, es:[41h*4+2]! g+ ^7 @# N& T( P( h
    in      al, 40h
, u3 J3 l0 v. N/ q# ?3 P+ R) Z4 ^6 @    xor     cx,cx
/ A/ v8 w1 G9 e3 }9 H$ H    int     41h5 H0 w7 D9 y! C1 O/ j
    xchg    dx, es:[41h*4]
- C+ l/ A, [/ n, K) |. I+ U    xchg    bx, es:[41h*4+2]  Q" G# T; A2 Z: }# F9 _1 j
    cmp     cl,al& v* I0 z/ H0 z7 H) j" a' ]( d
    jnz     SoftICE_detected" q0 h- r4 G; Z; |
8 G4 u% y- l  W* c. R
_________________________________________________________________________
9 `* I. v" @: k6 |7 A0 C; y+ p
2 }$ S# F& B0 ?4 Y* m$ {Method 07
- l2 }4 z$ ?2 C4 T, A' I9 F; ?& ^=========* U# @+ d$ L( Y4 a7 ~
" n0 m* n# a' D# z
Method of detection of the WinICE handler in the int68h (V86)7 p! E, `; T& \# [6 V  p
2 K$ j* i( ~# R# W- c1 S
    mov     ah,43h
' N. S% x. A, l1 W: h    int     68h/ ?6 J0 ]1 K! q. ~5 H& m4 M. Z
    cmp     ax,0F386h
* e, p: m# z+ ]0 P    jz      SoftICE_Detected( g; Q) H' ^7 D5 Y- o1 y$ `( B

. L9 w4 r8 ^/ e) _8 F( Y6 X3 I5 Y. P& ~2 w; E. a. r! o2 @/ J
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit; F8 a  `  c8 i0 w( Y
   app like this:
5 q1 M9 v6 s% U6 f2 K/ S4 ~7 ~  d* o+ S. C
   BPX exec_int if ax==68
, j% V9 c% N1 j5 j9 `- x: O) h' V   (function called is located at byte ptr [ebp+1Dh] and client eip is
- B4 A  A# @! J3 @  Z+ q3 t   located at [ebp+48h] for 32Bit apps)  d, Q: H! _8 W# O
__________________________________________________________________________
+ _" w# q3 B! x. Z4 t, @! g% g
9 Z$ x' R  A8 V3 \. \9 u+ D3 t. v, p3 O( f
Method 08' }) e- X2 i2 ~# u# a& r- n
=========6 q' x9 r. U3 t
4 O$ C5 w: s9 a2 R
It is not a method of detection of SoftICE but a possibility to crash the; [  V% s% P9 o6 G7 l# R
system by intercepting int 01h and int 03h and redirecting them to another
5 j" {: R6 m+ j/ r( s/ C8 y9 sroutine.
( i1 |- {' W  @" `6 Q( VIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points5 S* w: H7 W" e+ k  Q1 l$ }! @/ _
to the new routine to execute (hangs computer...)1 r$ t" I9 C8 W- D
0 I1 w" D! y) b2 T
    mov     ah, 25h5 c) {! C" |$ D1 W
    mov     al, Int_Number (01h or 03h), B# ~- N/ U  N7 ]6 W$ T
    mov     dx, offset New_Int_Routine
, R' f  W- P1 d" `# Q3 Y    int     21h
8 F! [4 O  E* Z( ]# D, j# k
1 z3 _: b. Z! Y__________________________________________________________________________% H2 X* P6 W8 |) ?8 q4 ^' S' [
& b- Z' y( s1 B$ D4 _' B) Q9 c$ ?
Method 090 ~  h7 w3 [1 y9 I
=========: C9 D7 \2 p/ g' P
* r. f; Y2 S- m/ Z+ R
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
6 y( a2 R* E* ?8 V! i& tperformed in ring0 (VxD or a ring3 app using the VxdCall).
# N. o5 E& `3 V- t0 V* x& ?The Get_DDB service is used to determine whether or not a VxD is installed" a. n' e8 J! U" c6 p/ W  F
for the specified device and returns a Device Description Block (in ecx) for
) F6 _4 A4 y& X! z) l& Tthat device if it is installed.
6 s* \: H) w8 j9 o* `* h
3 S9 q8 j4 _7 P: v   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID; @( w, G5 P% U  w& [
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
( l6 m9 J( w' F   VMMCall Get_DDB# \; d$ |3 M* Y+ o$ ?
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed. P2 ~' h' }4 Y2 V  \
1 t2 Z5 J5 S0 {$ B* {
Note as well that you can easily detect this method with SoftICE:
( f$ ?4 ~% `$ Q  M* N; ^( q   bpx Get_DDB if ax==0202 || ax==7a5fh: V. I/ w! I6 h0 F2 k
; u6 x$ o/ g- n& b, c- ~
__________________________________________________________________________
  W1 O: n* V6 Y2 ^, Q& D1 L9 k/ A
8 J+ _  ?) P' \1 S  O: [Method 10) ^0 b! a3 `0 P3 I; p8 ^
=========
: ^& p% T1 @5 b
* i8 x& ?0 c- G9 {6 M=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with( ~' b8 A4 p* l" u% Q7 p- v  x4 _
  SoftICE while the option is enable!!
$ C. {! H5 y$ B( e5 ^! X0 ^: \: t) G$ H( G9 E
This trick is very efficient:
. j' _) J. ?8 |: j* @: ^1 S4 n7 eby checking the Debug Registers, you can detect if SoftICE is loaded
1 c( j& K' i9 L1 ^(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
0 q! j+ U  g* j$ Nthere are some memory breakpoints set (dr0 to dr3) simply by reading their8 J" |1 j! Z4 j  K
value (in ring0 only). Values can be manipulated and or changed as well" p" z9 K2 s! [. ~; y5 G! W  v/ V
(clearing BPMs for instance)
" Z# g$ G0 }  x9 J! R: T2 ^! z( T9 K5 j6 p. O0 \
__________________________________________________________________________: @1 U0 |3 I3 _: A  ^

) [' R% I$ x$ w  f& TMethod 11
0 @$ O; M; m6 ]; U; b# Y" A7 W: e1 V=========
. h* T3 J, @& H6 g
# z" ^# i2 Q4 y; C1 k) B. j0 u9 k' QThis method is most known as 'MeltICE' because it has been freely distributed3 o. [, a4 ]: E( p- Y" A
via www.winfiles.com. However it was first used by NuMega people to allow, i3 g  ], R( U/ q
Symbol Loader to check if SoftICE was active or not (the code is located( ^& j$ \9 f9 Y- ]1 z8 S1 Z
inside nmtrans.dll).( ]! r2 ~" i# ^: ~5 Y" O/ C+ T

4 Y' \) R- z! z1 NThe way it works is very simple:+ [$ p4 t4 a5 B. |5 Z: L/ X1 ]/ [
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
" W* Q9 z( [0 Z' DWinNT) with the CreateFileA API.  p' f( V4 T9 d& N: W" T. v
, q2 u! V1 X: T) ?3 H& L
Here is a sample (checking for 'SICE'):; b4 w1 \- E+ @3 n

( y: t7 @# A* o, OBOOL IsSoftIce95Loaded()
5 [0 F2 x0 S1 s% r{
3 @( K2 \3 x* a$ Y4 `/ L   HANDLE hFile;  4 P( ]: i' c3 U) i
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE," J& @0 J9 Q, u
                      FILE_SHARE_READ | FILE_SHARE_WRITE,- P$ M3 I8 ^; u5 x/ `2 I
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
# `' o7 L9 t( |1 _+ z3 a/ ~* f   if( hFile != INVALID_HANDLE_VALUE )) Z2 F; n4 h! S! {% d0 a( L/ h
   {7 D5 e6 Y. d- b6 G: w
      CloseHandle(hFile);
# [2 [: N* K% V1 u9 `$ O      return TRUE;3 f) a  E% a1 s5 {/ p7 b
   }8 \+ W  I( W; y0 J
   return FALSE;0 e  l: k6 i7 V  w4 T, F
}/ G8 i: G8 @' |, `- b) ^

. A- ~$ W& u; C0 v) W) XAlthough this trick calls the CreateFileA function, don't even expect to be
3 _' J+ }) J7 F5 J' S* zable to intercept it by installing a IFS hook: it will not work, no way!
" S% m# |" p5 N0 B7 V3 N3 vIn fact, after the call to CreateFileA it will get through VWIN32 0x001F5 u' y! Y8 b5 m, l; I4 }$ E" m
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
' G) B7 `' J6 [2 h4 n; f7 mand then browse the DDB list until it find the VxD and its DDB_Control_Proc
5 ^- i* C4 P. ~- nfield.3 l' x5 f2 `& F
In fact, its purpose is not to load/unload VxDs but only to send a
3 {5 l* ~; r' f3 V; h# HW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
% m! P! m, ~0 K  vto the VxD Control_Dispatch proc (how the hell a shareware soft could try8 D* b9 n  P- ^9 |/ S7 [
to load/unload a non-dynamically loadable driver such as SoftICE ;-).5 D* h' l& @3 k5 F
If the VxD is loaded, it will always clear eax and the Carry flag to allow, k/ c+ m- t  ?7 T$ `) f
its handle to be opened and then, will be detected." Q" I$ R7 ]% i7 r6 a, {4 f# x
You can check that simply by hooking Winice.exe control proc entry point- j7 r5 z& I1 K  L/ I9 V
while running MeltICE.
( e. p. F( |8 i1 v) L' q. ~5 B
1 Q. O3 x9 @& N; ?! c) q
; T) ~, ?# J( n) K( ~/ T5 F4 d  00401067:  push      00402025    ; \\.\SICE
# p  e8 L5 F& m- Z$ j  0040106C:  call      CreateFileA9 ]1 y) C- f) K. H
  00401071:  cmp       eax,-0014 D% m# T  y2 m) r8 p
  00401074:  je        00401091
8 I, o2 s8 X0 @, y: m  |' L7 s  U* k. e+ k. O: M% V% O
" M/ k0 R4 }( n, k# E
There could be hundreds of BPX you could use to detect this trick.
8 n& F/ m4 u( N5 }( i% ^8 C-The most classical one is:
8 B! x9 }! E4 ]1 B  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
. m/ z2 f; V% w9 v) d7 b    *(esp-&gt;4+4)=='NTIC'$ g7 N1 {: G: V! U  ]
& b5 t$ k  d) j5 F9 t
-The most exotic ones (could be very slooooow :-(
9 \1 b6 V6 H  R# k( e0 q   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
( m& K& x/ S0 A  u     ;will break 3 times :-(, W" y  {5 V2 H0 k

. H( v! B0 S( W-or (a bit) faster:   s3 a1 G) A. a0 M6 b
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')! T8 [8 B7 c: w7 M- y" s, L$ U

% ]" y9 Z2 T" c  X& I8 M( [  |( ]   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
5 Z" ?( ^# U1 D, N/ V" `: E4 L     ;will break 3 times :-(
- Y" t: D& i" |& L- x
3 g6 d. a8 z% n8 a& T-Much faster:0 y, u. q6 ~0 ~( A! O& Q+ P
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'- M7 V' o" S7 ^. I. H6 u

* {8 o, u# s, {/ l5 HNote also that some programs (like AZPR3.00) use de old 16-bit _lopen9 `: l' B& `) t; s
function to do the same job:( ~$ n7 g8 @/ Q# R) f
5 u6 k6 P5 p) e* T  f4 Q
   push    00                        ; OF_READ
: X% F3 h% e6 q4 `( K  v$ f7 `   mov     eax,[00656634]            ; '\\.\SICE',0+ F; a; p7 L+ z* _, M  P/ X" [! d1 a
   push    eax
+ l4 o7 {% U9 i+ T/ N! N7 J( h3 p   call    KERNEL32!_lopen/ w, B3 Y0 V( z4 d% |+ L( s
   inc     eax. d4 X+ C( o. b. \1 D( \
   jnz     00650589                  ; detected
# a# J' Y6 K5 m' c) x   push    00                        ; OF_READ/ I: ?; u* B( T
   mov     eax,[00656638]            ; '\\.\SICE', Y0 `- {8 x0 n, I% R. y
   push    eax% |# Q8 L% @9 n2 a! u1 J
   call    KERNEL32!_lopen
# G2 }, i# X- v) r$ K0 e   inc     eax
1 x) l) m- y. F8 c. K+ \9 ?   jz      006505ae                  ; not detected
) l' |/ H8 C/ s, b
4 s9 O* S: o+ l! v0 W0 d+ q7 t0 |% H+ ^- y4 B8 l
__________________________________________________________________________
, h1 @0 a+ X% [! J  U
. N# l0 H7 j5 x9 `" ]" ~Method 12
. [1 }' P3 ?  @2 K: O/ J=========
- _" U+ L. `2 r  n: n6 p1 ?; s" l. h* Y) `- D0 z- A
This trick is similar to int41h/4fh Debugger installation check (code 056 {7 G, V9 y5 _2 T8 c3 x2 X8 H
&amp; 06) but very limited because it's only available for Win95/98 (not NT)9 D, U0 j. g$ K. R0 }  q3 r! r3 `
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.; N$ N* \# _$ x6 {

/ w% L7 Z$ j; h2 Z; `6 E+ g   push  0000004fh         ; function 4fh
2 k. u! _# F7 A2 Q* B( s   push  002a002ah         ; high word specifies which VxD (VWIN32), [7 I" o+ f, Y' f* c+ b
                           ; low word specifies which service
$ N: O3 }, F* |9 U9 T1 W                             (VWIN32_Int41Dispatch)
4 E! e3 Y, C) }, b   call  Kernel32!ORD_001  ; VxdCall; V" [2 h' N! i
   cmp   ax, 0f386h        ; magic number returned by system debuggers
+ x6 K; u, ]2 I2 a; t/ G0 [   jz    SoftICE_detected
5 t5 m' s+ y# H
/ Q8 m* y+ g# U+ o7 p& T* M- gHere again, several ways to detect it:% }! i5 e0 T( {5 ]: q

# p: s" _; u. c& a9 s    BPINT 41 if ax==4f
' P; z6 ?) n* q
+ H7 }6 z- K5 Q    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
0 B  {8 _) o" q/ K' X9 s' E; A; s) W) X* Z: |' b9 c
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
/ }! q4 H, ]# b: N, R
0 \. x8 b1 _- t* s    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!  R- B; K; I4 }" w9 r% b
4 w2 P1 [: d+ X
__________________________________________________________________________
' I# N& S* ^  J* k% D
% x) q4 c3 o( A; m. ?6 yMethod 13
+ a8 B# z# m2 x, y=========1 i  k/ A! u- C

: W' e* `: r4 Q) SNot a real method of detection, but a good way to know if SoftICE is. B6 i$ P7 x3 E5 F
installed on a computer and to locate its installation directory.- i, Z+ n/ p0 r6 q( d. v. T+ v
It is used by few softs which access the following registry keys (usually #2) :
+ i& r- r9 m% k, ?6 S
0 F7 M7 Y0 I) k+ x$ G-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion" w/ x; K  C6 I
\Uninstall\SoftICE8 K& _9 Q3 S! W9 Z7 T
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
2 `) K1 Q( K2 \' o1 G# n% P" S-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
( h* }( L) `9 }4 y. k& r# P6 D7 \\App Paths\Loader32.Exe6 f: j' \/ X% q4 ^# ~$ J

. E, i9 {5 k# a6 M
7 \+ h) }2 m! k! K0 E- O7 \( PNote that some nasty apps could then erase all files from SoftICE directory
) X& q( f- E# y  i3 i$ S(I faced that once :-(
9 b/ `- A# Y6 _
$ C/ U' e9 D- m9 V/ zUseful breakpoint to detect it:5 F$ ~. }6 G6 M  `, Q. j% p" M

( [6 b4 Q9 i" ]1 ^7 d- u& K     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
( h, E5 ^- ^. a5 F$ P5 D( c# M/ B$ s8 J$ t, Z5 J# k8 n2 k
__________________________________________________________________________
0 G" R' U& X2 r- h6 V5 ~# p
, h4 W$ i3 I1 ]% K, Q) E; s3 m# ~
, \+ p6 R# B/ W  O  J" qMethod 14
) h) d% w1 H( O; T/ V$ a=========
7 F4 j# }- C- Q; C0 W: W2 }- U; u+ C
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
( q$ b5 _5 q, _4 j! H3 h  His to determines whether a debugger is running on your system (ring0 only).# N# B9 f5 E1 n; `2 S

$ p: b$ E+ E9 Q' W: \8 b3 G. x   VMMCall Test_Debug_Installed4 V6 ^3 E$ O3 v* J
   je      not_installed! C* }. }. X+ p+ A( m7 O, Q
9 H' p8 Y7 S7 H: @! ^% [
This service just checks a flag.
8 t/ s' h$ a; G2 U, `</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-7-20 20:49

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表