找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
/ M; k' [1 c# y& H$ [+ w2 t<TBODY>
+ ?/ h( ]7 i' W: `% p; Z<TR>, v; i# u+ @2 d: h, g$ R- z
<TD><PRE>Method 01 0 B% C% F! j! q. V" w. R' S2 @8 d
=========
% b' m& J/ b4 d) X# Y0 S
% ?$ {, |/ r) N/ x" a- wThis method of detection of SoftICE (as well as the following one) is
& b6 b# W. A) v* kused by the majority of packers/encryptors found on Internet.. R" Y4 @- J+ N
It seeks the signature of BoundsChecker in SoftICE% I( ?- D$ E+ T0 C
1 K8 e3 D, Y3 C8 m1 s
    mov     ebp, 04243484Bh        ; 'BCHK'
3 K1 W# |! b4 v* F  O5 K! ~    mov     ax, 04h
/ @, b; |- e7 Y    int     3       & U5 @. }5 J3 H# a! ]# b
    cmp     al,46 ^0 b$ {( y3 M4 y
    jnz     SoftICE_Detected7 K3 r/ `( z5 w! [
0 h" o! n" T6 b  D8 c1 t
___________________________________________________________________________
  z# C& A' u" B, G- e6 W* w9 q; K" @
Method 02& ^- v  |4 H% T' ~% N
=========
1 A- L- p0 @, ]+ z  D) K3 f5 S. E) V2 w1 Y; H) M
Still a method very much used (perhaps the most frequent one).  It is used9 R% x5 t9 z0 o$ u  G
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
0 g4 g: z# Q- s7 d& j: `) x. Xor execute SoftICE commands...2 d0 V3 }+ \% V/ [
It is also used to crash SoftICE and to force it to execute any commands; v6 ^* y+ r. z+ C+ _
(HBOOT...) :-((  5 E" V" h5 ^9 D2 B8 K9 T# O
2 ^+ g5 `- F0 B! R' N) Z& ]
Here is a quick description:# h/ z6 ^! f- {6 O" i* }: ?
-AX = 0910h   (Display string in SIce windows)
7 E- [4 D  @& c-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
7 _* ^  F' t+ w4 w% D. W-AX = 0912h   (Get breakpoint infos)
. G0 w1 q  y8 s9 p9 g7 n# p$ z( R* y-AX = 0913h   (Set Sice breakpoints)
$ G! T3 d2 b# ]5 L" }% o* u' W. F-AX = 0914h   (Remove SIce breakoints)% n& o9 r' x# L  y% v: u% F9 ^

9 y4 o' C3 S4 yEach time you'll meet this trick, you'll see:8 X2 l( z1 M" u- y+ u! H
-SI = 4647h
1 ?. b& Z$ X7 X: k: ^-DI = 4A4Dh
* [+ J0 K8 N5 Q; B+ @Which are the 'magic values' used by SoftIce.
! m2 Z5 e2 o* `  a$ Z) n+ KFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
, U! Y6 V4 z' T0 e' O6 {- y
; O+ F4 R' |$ e( ^" k0 p- v8 _Here is one example from the file "Haspinst.exe" which is the dongle HASP% E6 Q" {% c+ F8 \8 b
Envelope utility use to protect DOS applications:
8 p7 }, H. u; t4 t/ w5 X  ~
$ l6 `0 E1 u4 ]1 m7 B1 x* v$ W9 `; _' F; A$ l' P; h. Y
4C19:0095   MOV    AX,0911  ; execute command.$ l8 @" s8 A  q. \
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).1 ?; E7 `/ o0 u" j( i7 u
4C19:009A   MOV    SI,4647  ; 1st magic value.& u% `$ k, }' N% i& ^) @, a
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
9 e% ?5 W1 m5 g& }5 J& |4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
7 q% j2 L  J' g# ?9 Y4 C4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute0 G( x3 t" A: C6 K7 H5 Q
4C19:00A4   INC    CX# s- v+ S1 M6 h
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute9 g, O3 w1 k% j4 i, P# S# Z! H
4C19:00A8   JB     0095     ; 6 different commands.
0 ^1 s/ d+ P( }# c4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
, G* k2 T& j/ A- D4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)6 z9 c) v/ v1 \
3 u( j) @4 g: e8 K# m
The program will execute 6 different SIce commands located at ds:dx, which7 p5 D8 S. T9 W! s$ D+ v: ]* R
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
7 v  i2 n: q/ X% C$ Y) i1 ~$ k8 a1 Q0 R" `$ X7 r1 p6 l7 D
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
8 H- R: c- U7 |___________________________________________________________________________7 |/ t9 O5 K  `5 }" T0 Z1 R" `
& S6 ]- D2 D2 q

- B% ]( `+ B% @: RMethod 038 l, e( X) O4 |& z: M; |" i+ R
=========
5 x0 M2 p( b' h( [4 i& z; }$ y0 L* M  j* S
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h; H8 d& ?' P1 V: E' v
(API Get entry point): u$ G) q/ N8 H5 [' m( C
        - v3 j  L8 E8 y% B% }
8 o# n& r) Y6 ]# l
    xor     di,di& B$ A% Q6 K% f  b/ p# ~
    mov     es,di
  [$ y9 F' F" @1 S7 A    mov     ax, 1684h      
# \1 G- e" B# J6 S' o    mov     bx, 0202h       ; VxD ID of winice
, k" F- A0 a7 ]* b1 o    int     2Fh0 `+ c% W- k/ ^  j- F6 l2 D
    mov     ax, es          ; ES:DI -&gt; VxD API entry point+ {! k' n$ p- u; x* K) i# b: s
    add     ax, di
  L% [3 n. f+ ?    test    ax,ax
1 L( ~9 L- i8 y1 h) l1 ^6 x    jnz     SoftICE_Detected
' \8 E/ x$ Y! Y* r/ R  @# E" X4 ~! d: Z1 Q2 j
___________________________________________________________________________
0 b/ j" d6 k3 L7 o9 N7 Y$ f
! }: c* |; p, v( [! a1 NMethod 04
+ w3 u' `, A$ c=========5 n: g) v% l( z# a, ~

* v6 N- {( n9 f5 v6 q% iMethod identical to the preceding one except that it seeks the ID of SoftICE
/ J: }+ m% m1 p3 l( d8 |GFX VxD.$ \  G# D; ?/ P& `) y
/ j  I$ w, h# k- G; r  M8 A
    xor     di,di& b: V& q1 b) W; J; a
    mov     es,di
3 o% v. y' {$ P: j8 m+ J4 N& E    mov     ax, 1684h      
, _7 R# r5 m. C* `4 w    mov     bx, 7a5Fh       ; VxD ID of SIWVID5 P" ]6 |8 L& L) n; G8 z% B
    int     2fh
9 [/ c; z5 O1 ]' N5 k- n9 ?    mov     ax, es          ; ES:DI -&gt; VxD API entry point1 f; \4 |% n, E7 `( Q- \
    add     ax, di8 c3 V/ O3 u" Y0 z. {6 d
    test    ax,ax- }& V* f: A  m' v7 R
    jnz     SoftICE_Detected/ X- t; {6 X+ ?
  T* `* B; ~* }; |5 O
__________________________________________________________________________3 W8 }! L. Z0 _; X

* e$ k% P, d" g$ [7 {7 K: N0 {8 n. `3 a) c, H" i+ x5 L( h
Method 058 r1 K, o$ {7 K' U, c
=========2 c4 R, `$ C( c9 C# k# @8 m( X! |$ V

, t2 g/ h' B/ R, [0 \Method seeking the 'magic number' 0F386h returned (in ax) by all system
1 u! ~; n2 U. \3 M1 Q& S+ _% v7 jdebugger. It calls the int 41h, function 4Fh.
7 g0 w) w; V; J+ nThere are several alternatives.  2 W8 X2 z/ k$ a# m$ q5 \# l

& t. U( _) y, ?The following one is the simplest:
' V3 l: T+ |  P8 W- ^7 Y
1 D% @* ^6 z! R2 {. P; g/ J    mov     ax,4fh
. C3 B' [! z9 c# \" _7 x  q4 ?    int     41h
- P: P8 D) `5 O3 y' k4 {% U. G    cmp     ax, 0F386! w3 Z/ m% z; P9 I
    jz      SoftICE_detected
4 K3 R. l, c$ K! s* c& `0 I
+ Z& N* x" j/ S6 m, ^" _0 `( V: k6 F- k6 P& o
Next method as well as the following one are 2 examples from Stone's   Y+ h9 O" Y( ]
"stn-wid.zip" (www.cracking.net):' q+ Q+ c4 T6 C8 G( ^2 T! }9 c  z
" S6 [: r% y* W. M9 s
    mov     bx, cs9 s7 I( z* _* z/ Y; k, C
    lea     dx, int41handler2
* v2 s8 b& h! s( X    xchg    dx, es:[41h*4]# y, V9 j# \* Y8 Z; ]7 m/ j
    xchg    bx, es:[41h*4+2]7 w) g4 h$ w  `) R/ \0 V; I
    mov     ax,4fh+ O8 ?& j; {8 q; }( T% ~
    int     41h
! Y; ^5 N, k' g9 x) u7 i4 G$ L    xchg    dx, es:[41h*4]" B+ Z2 _9 Q: ?+ y/ x  m- O
    xchg    bx, es:[41h*4+2]
& ~- c. @* t8 n6 ^9 ]1 P0 Q    cmp     ax, 0f386h2 E3 y  h+ ~: B' q/ Q4 n* t
    jz      SoftICE_detected
2 R. t4 T! a9 w& D8 e& u
7 r7 d  A, p6 k4 oint41handler2 PROC) s, t. U  g* s+ Q" a3 P! d
    iret
2 z& d8 A7 a7 [. m" {5 ~int41handler2 ENDP
- H, D3 I# K5 A6 k# E& m% @
) i6 x/ Z! s" Q  [. o9 l# R
5 _) k# s: b* t_________________________________________________________________________
2 \# ~) H* \% J% Y6 Z' R/ k- e0 h5 y3 S

! J5 f- m7 e3 U6 rMethod 06
4 _/ M2 j6 D7 ]3 r# p=========
: \9 p4 W; }2 T! B
* ~1 w8 ]8 [: n/ F. C( J7 L
6 \7 f0 p. b* o5 J2 e2nd method similar to the preceding one but more difficult to detect:( s: L) u9 `6 r* a5 O

, J9 F' A0 R% ?0 x/ r7 m: c
* U. k$ Y- I( ~2 K* fint41handler PROC
9 D* V3 z) V: @5 U4 g/ T2 l3 a    mov     cl,al
( Y- O) v5 {1 {+ w: ~$ T+ j    iret/ D, @- J/ c. }3 `
int41handler ENDP
% O/ w7 I% X" i3 B: a9 a2 Y- M
; \3 ]- [5 v, h9 ?( v8 F  f. Y: n4 X; }  _, r- I
    xor     ax,ax" S7 g1 Q, Y  K- R2 Y
    mov     es,ax5 N2 A7 ?* W0 p" [* ^
    mov     bx, cs% p- B' A1 a; Q8 w) I
    lea     dx, int41handler- _6 [0 f' o9 V; c
    xchg    dx, es:[41h*4]
/ t9 s6 y  V# B0 ]8 k1 g" E& ~    xchg    bx, es:[41h*4+2]: T+ L% P1 {: Y0 a, d4 d- P
    in      al, 40h
# n9 }! O# F7 |0 C; _    xor     cx,cx
8 }* S* K! P4 t' S7 t    int     41h/ H$ F* `4 Z: \3 R: h* s4 Q
    xchg    dx, es:[41h*4]: I) r6 m9 x. V; o
    xchg    bx, es:[41h*4+2]
' Y# k' ?+ q! P6 ~0 e- P" M    cmp     cl,al
. O% w; ~* g# v    jnz     SoftICE_detected6 c" {: d; ?; j2 @
8 l- {; b, b  K/ r; F
_________________________________________________________________________' M/ O0 w8 B0 V

* a; U" N1 d, g% @Method 07# |* L3 q% D# [& h
=========
- t# R* @" n. G! T3 [+ Q7 L, W8 N" ^& N/ k5 O- n4 W# ?$ y
Method of detection of the WinICE handler in the int68h (V86)' l( @2 {1 g" F6 y! k' N" C
9 V9 E9 J, X4 b' P
    mov     ah,43h
; e7 y4 F6 y7 y' s5 x7 V    int     68h
( w0 s* t+ s0 L/ O5 E    cmp     ax,0F386h( N+ T% e5 [* j
    jz      SoftICE_Detected
: ?' d6 ~5 e6 d4 R
/ r9 r( e9 t# O5 V" y9 y6 H! H9 e0 N- m. O" Y/ ^
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
3 B. l2 @% q: V8 l% K9 z   app like this:
* f& D# s, F$ \" y# g' I$ J. ~, ], S" H4 [. F& R* |$ n6 m2 U
   BPX exec_int if ax==683 W) U4 c8 K" D$ {
   (function called is located at byte ptr [ebp+1Dh] and client eip is% Y/ j, r& |* u! Y8 i! V
   located at [ebp+48h] for 32Bit apps)" w/ b, v; }0 R6 f* n8 Z/ l
__________________________________________________________________________* a5 {* C- q3 ~- j& d0 V% @
5 X( H  f' E* n0 I5 D' Q5 q6 w
9 A5 q6 _: J- _
Method 08
) I$ z3 x1 R1 T, Q! N=========1 ?7 f, ~% t3 N! \, H

2 O) f$ `  t, k. MIt is not a method of detection of SoftICE but a possibility to crash the
7 D1 X9 B" b8 I  w$ b' tsystem by intercepting int 01h and int 03h and redirecting them to another7 n1 v( s* C9 m
routine.
. E$ [2 f5 T1 H6 ~8 X  Y0 _It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
% ]1 ^# X+ @4 K2 Zto the new routine to execute (hangs computer...)
% a7 `( K1 D( U- X
6 A/ m/ z7 |$ K$ O6 }4 m1 O    mov     ah, 25h3 ^/ I# D0 H4 ?9 R2 j1 p  j
    mov     al, Int_Number (01h or 03h)  w$ X6 c0 S$ H
    mov     dx, offset New_Int_Routine: z7 P6 u/ U. k8 \# I5 L
    int     21h
) A3 n0 B8 ?3 ]0 \0 n& @3 z0 z
9 h) c# \: W( q  n3 H__________________________________________________________________________/ X* a" y" `  e5 L* w7 x
/ b1 ^; L( }& g
Method 09
; P6 h( u+ U9 k=========
7 t3 \) Q' q3 x, g. P/ W- [
# M# w" [9 a! g- [9 nThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
: z9 }) I# J& x5 K( R$ {performed in ring0 (VxD or a ring3 app using the VxdCall).
2 I" r9 \, H" rThe Get_DDB service is used to determine whether or not a VxD is installed
$ H0 o1 b1 P2 o3 ~/ A' vfor the specified device and returns a Device Description Block (in ecx) for
; D7 ^! q8 O& a2 f% uthat device if it is installed.
2 J" ]1 j  m1 b/ L7 l* k+ I0 o9 c' ?
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID' O0 y6 f" A5 j4 X
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)0 q" |5 X* x$ f7 I( f- @
   VMMCall Get_DDB
3 N0 u( A; K' S" i9 E   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed# _. W% i$ [( q  K( E/ I( B: w! f/ R
4 L7 f) G; M  h: d0 c
Note as well that you can easily detect this method with SoftICE:
" Q5 a8 S4 j$ {; m   bpx Get_DDB if ax==0202 || ax==7a5fh
8 u3 x, U1 b8 ^+ W. Z8 w2 R2 G& L3 Y1 U0 u6 Z/ o, ]: E1 t1 M
__________________________________________________________________________
: i& k9 C6 {9 X; ~1 k  X* q* y
: T  q5 G# l* Z2 q0 p6 }4 OMethod 10* U- D! s% S8 J' r' {* G9 V
=========
3 S+ `2 o$ J% e1 t' Z# E- ?. o4 X1 F5 C4 m  R
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with4 p  U$ ~: \9 W3 z+ o5 c
  SoftICE while the option is enable!!( {5 k( u3 a; m; x% G  |

- y) y, ]) U; ~0 n* a, vThis trick is very efficient:  ^3 i3 U7 a$ Z% X/ H( U; y8 _$ s
by checking the Debug Registers, you can detect if SoftICE is loaded
$ {; V+ N7 u6 ^8 m. _(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
/ b- z& Y2 \% u) Pthere are some memory breakpoints set (dr0 to dr3) simply by reading their) v1 B1 J. @, [, Z
value (in ring0 only). Values can be manipulated and or changed as well- N! W+ _( p4 G7 e$ c
(clearing BPMs for instance)
3 l: ~) X# n3 S5 K, C/ L1 ?% Q4 g5 V4 b; E6 s( f
__________________________________________________________________________
  ^- u2 j! B  v4 W3 C
; N( M6 E, C3 D1 u% v! j/ MMethod 11) k5 `8 W2 ]0 i# t4 `
=========
3 r2 Q/ @0 l5 y! b. s- z5 n2 L$ |% c9 B9 K3 L" m
This method is most known as 'MeltICE' because it has been freely distributed+ l4 q- Z1 x! C  [& k
via www.winfiles.com. However it was first used by NuMega people to allow
! r* X. W2 s- `0 ?! kSymbol Loader to check if SoftICE was active or not (the code is located
0 I2 O" z- I/ pinside nmtrans.dll).
! Q# a6 \: Z& s5 P2 d. b, X& m
( ]1 Y& k# c) q! n! v: \The way it works is very simple:
1 Z4 h. \& t- Y- r! \% N2 \It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for  M. ]' N3 l" \6 l
WinNT) with the CreateFileA API.& @3 H* G5 ?  I

. d1 W0 a% H" q/ _Here is a sample (checking for 'SICE'):
8 f4 D* I% Z& Y; b, d; ]% D7 N
, Q8 s+ \2 z+ {8 U) kBOOL IsSoftIce95Loaded()8 z  {. u% F# I# e4 p
{* r6 N( ]6 Q3 V" N3 \* G
   HANDLE hFile;  , C4 P/ P+ \* J5 M! @& [5 f8 h( b
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,* H! u9 d/ K! M! k
                      FILE_SHARE_READ | FILE_SHARE_WRITE,( R/ C4 I/ d- R
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);' y1 Y5 A. i1 [+ c, v# t; ^/ ]9 V7 {) W
   if( hFile != INVALID_HANDLE_VALUE )# X) I7 J$ G* A2 g# A
   {( ]& ], F8 H2 l
      CloseHandle(hFile);* O$ O* O; q. ?& X. n* K( O
      return TRUE;
% A( g) ^% e1 _, E   }
* t' M4 C2 w1 A2 y   return FALSE;4 R# ~& z$ E( [
}; E# l" x! T2 n6 ^: _
, q% F2 n( C7 u: N
Although this trick calls the CreateFileA function, don't even expect to be
. M1 M- n! G$ j  N6 \" ]" Bable to intercept it by installing a IFS hook: it will not work, no way!
* `0 i/ n3 x2 r: a# X7 s& KIn fact, after the call to CreateFileA it will get through VWIN32 0x001F% N: X" I- {2 a- o2 ~7 e
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)8 }4 ?2 O9 D# `& s* Q! _- s. s. ^
and then browse the DDB list until it find the VxD and its DDB_Control_Proc  @& ?' \' {: y6 Q' ~) n5 {  i* f& h6 Y
field.
4 w2 J; J& p* q9 `+ l) nIn fact, its purpose is not to load/unload VxDs but only to send a 3 |1 @% e) l- `! T# V, \& a
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)# s" x) R4 m8 Y/ O
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
0 @$ Z3 V( e0 I4 ]to load/unload a non-dynamically loadable driver such as SoftICE ;-).
) B3 Z3 t9 b5 d, pIf the VxD is loaded, it will always clear eax and the Carry flag to allow
4 k+ d9 L9 ?4 P+ ~0 \, a8 ?$ i) bits handle to be opened and then, will be detected.
! |2 T) f. K! b; ~You can check that simply by hooking Winice.exe control proc entry point$ D2 B* a) t* `, ]1 ~# T
while running MeltICE.
8 Z' S; l2 p- c5 C: B0 t6 {+ j7 {, ~. v, K

/ A# o1 C% v  N* f; |9 L  00401067:  push      00402025    ; \\.\SICE
, ?4 x* n( v3 j  0040106C:  call      CreateFileA
/ i9 ]% C) O6 l4 k7 a5 K& j& ^( ]& M$ \( N  00401071:  cmp       eax,-001) ~. d* i- J' I3 I
  00401074:  je        00401091$ O$ ~2 U7 A$ [: J$ N
* H- L9 E3 x$ Z. G& Z. \. z& O
- H# Q! p) b0 t* K) f
There could be hundreds of BPX you could use to detect this trick.7 \. j/ N/ j) A4 ~( O
-The most classical one is:
" T- H# V7 l' B+ ^& ~5 n  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
5 i6 H$ A" ^* r- Y    *(esp-&gt;4+4)=='NTIC'
' Q- Y/ k5 _0 }5 C, e3 X
6 C3 x8 u% ?* U3 i0 Q; u; M-The most exotic ones (could be very slooooow :-(4 E& o/ n. X: d, Y9 G, j0 T  [8 I
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
/ x+ q/ y% _6 @5 I     ;will break 3 times :-(7 S( I( `% e1 b5 n7 L
+ p/ Z5 ~& u& ^/ g0 R
-or (a bit) faster:
: w! B8 q3 E5 [& p   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')3 E1 {" e) |) }* C" x6 @9 M8 O
% k! n8 {" a) g2 L2 f8 X) H
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  ' w* C4 a% p- g
     ;will break 3 times :-(7 |$ o$ X+ S2 D6 [+ t

# Y" v- O5 L2 j3 b$ X* y-Much faster:) V: M8 {4 z2 p
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'! [& Z2 H9 g2 U7 ^8 E
# {, }7 U: i, e
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen# L: c9 K# J8 N, Y7 q
function to do the same job:
! @3 p" S" Q) G# ~! f: {3 H5 T
1 _6 R6 S8 W4 E8 ^   push    00                        ; OF_READ! _& k' j% E3 z% B/ ]
   mov     eax,[00656634]            ; '\\.\SICE',0
4 m8 F) c* r( P   push    eax7 X4 G/ n2 V3 W( [
   call    KERNEL32!_lopen
& X3 a+ q. ^6 G3 F: m, |3 ^   inc     eax  @- S) |1 G7 N- \& A- A" b
   jnz     00650589                  ; detected1 u0 P0 d: z. A9 Z
   push    00                        ; OF_READ- I5 W. N% X* c" Z: t1 d. d9 _
   mov     eax,[00656638]            ; '\\.\SICE'! U2 Q; U; V( S/ W% n: ~. n/ `
   push    eax
+ a: p! y+ O5 E' q+ Y6 I  ~9 _; f' Y   call    KERNEL32!_lopen
, f: D5 n! H* @9 q4 m1 }& s   inc     eax
$ h5 t- C* _2 I# w6 G   jz      006505ae                  ; not detected
2 O& c* `- i2 b/ `& v+ ?: A5 Z+ ]% u
; r$ T- t' n/ o6 J- I6 ]0 o/ f% T. l7 V6 m% c$ ^2 d8 i
__________________________________________________________________________, p" z& B+ r: [6 c  o/ {
* H- R8 U6 c9 d3 G( {9 g
Method 12
: Q$ B" u8 b% ~+ @* \=========
  |- [/ p1 p5 c8 O1 o! b
6 |$ I& q8 W& H# SThis trick is similar to int41h/4fh Debugger installation check (code 05" V2 b$ X+ l' o: `7 R
&amp; 06) but very limited because it's only available for Win95/98 (not NT)
' E% [/ `# Q, B) u$ d1 X. }* sas it uses the VxDCall backdoor. This detection was found in Bleem Demo.
8 w6 V/ Q7 B  a: `+ `7 F0 @
( E1 o' c# m4 J2 A! K" G   push  0000004fh         ; function 4fh' z8 l: T: ]# s, `) ~$ u
   push  002a002ah         ; high word specifies which VxD (VWIN32)
+ Q- C; U! u; j( \                           ; low word specifies which service
/ y6 _) u4 L: C4 C                             (VWIN32_Int41Dispatch)
# a+ o5 [( n2 Y4 {7 M5 _   call  Kernel32!ORD_001  ; VxdCall: ?4 F( |# i' E/ [
   cmp   ax, 0f386h        ; magic number returned by system debuggers
' Y6 h( ?* h0 k2 C   jz    SoftICE_detected
8 \9 F6 p* H" U% Q/ V: Z1 B4 _" R; u, \1 M" e8 Q  m
Here again, several ways to detect it:
$ u/ Y2 J: N5 F- x( v4 T6 _6 g( W' s" \3 z1 s, `
    BPINT 41 if ax==4f- A4 U& R( n) h, g; V  T0 n

0 c! ~! ^: x! {+ R8 U; p3 `1 w    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one+ t4 {2 J$ {# C& o' J8 H9 m+ L
$ G; K& r) R5 L' O! x6 p( F
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
9 Q! r1 n3 [' V) e8 Y- {2 ?% f- ^5 h0 y3 d. S/ D& C
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!/ C6 ?" H! ^) g5 U1 R* T  ]

$ o8 C# h" ^2 O9 u__________________________________________________________________________
6 _( C8 H* U8 v7 n) p
8 ?% I# z/ D5 `2 {3 IMethod 13
$ J/ L- E6 b, ~( z: y2 z$ _' H=========
0 v- P8 K6 s0 Y# d
. F% ^9 S2 L9 e" b" mNot a real method of detection, but a good way to know if SoftICE is, @9 U' I$ s$ x5 w( h
installed on a computer and to locate its installation directory.% Q2 @' z) W( `0 |. F- q" u$ X: t. C
It is used by few softs which access the following registry keys (usually #2) :
4 B; B7 S% \. u) R7 J; Q6 w1 l# C9 P4 s' W& |6 e
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
; ]/ @0 t# q( _\Uninstall\SoftICE
# g% E- J4 e( ~1 p# I  s-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
& |0 h7 t" @/ V! u5 O-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
# }# ]+ h. @. B* b' m\App Paths\Loader32.Exe& V' F0 G3 U4 E& n) [
! w- s+ F/ J, D, i: c) e: e
% ?" G9 v6 t3 g# n5 F( F2 \
Note that some nasty apps could then erase all files from SoftICE directory
6 y: k, z! l' t(I faced that once :-(
- S; S+ A1 x7 V, W
/ |% v2 W  \$ k' `( }Useful breakpoint to detect it:% N* R, V: U* Q6 A8 o
# y1 R3 U+ S% N9 |6 [
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
7 J+ l; P5 _& L7 Y+ N3 x$ Y3 _, }
__________________________________________________________________________
' A. T  @! v& X) z! b2 w  q  ~+ i6 K$ L

4 g( F! Y) {; a$ L9 @Method 14 + y; ^# i6 @6 Q9 a
=========8 P  s& ^5 `' \; z4 }6 D
" z' C) J* A9 A; D, l* I
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
; y# J$ R6 P% c( _" iis to determines whether a debugger is running on your system (ring0 only).
) P4 k: W0 ^7 v& K
& \2 B5 O: A" ^4 N  {   VMMCall Test_Debug_Installed
) l2 p9 a- F& a& `$ [3 y4 M   je      not_installed
& W9 B+ z. I( G9 y4 L5 ~, x9 v$ g; p' y% j
This service just checks a flag.& E. h  q8 ~2 J" |5 v  ~
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-8-14 03:33

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表