找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
4 c/ ]3 {# I7 N. P% l4 S<TBODY>0 N9 Q  L0 Q  Y
<TR>
7 M7 r* G  t5 c<TD><PRE>Method 01 6 V" j% y1 S' H! e9 x
=========  z+ G" G+ d' Y+ M3 W* Z

# }/ s5 F0 c1 ZThis method of detection of SoftICE (as well as the following one) is
1 r: x, i* D/ M) e' r4 Hused by the majority of packers/encryptors found on Internet.
/ ?! A( C/ P0 N- L% T1 T/ v5 K$ JIt seeks the signature of BoundsChecker in SoftICE
/ h" h/ @2 N& ]9 a  f7 A8 f7 R6 s+ K8 a! N( d& r
    mov     ebp, 04243484Bh        ; 'BCHK'- V% }) m0 O( x$ X
    mov     ax, 04h0 y& ?6 V& S( {- a! s" [6 A6 {
    int     3       5 r, T7 }4 T1 n4 }
    cmp     al,4
: q0 V: L0 d* [5 D! p# Q  T    jnz     SoftICE_Detected: J9 [5 M! Z/ p+ Q$ P
4 e, k( e1 _- I! e
___________________________________________________________________________/ u* X% ?4 V1 L; p9 I0 J

/ U1 n. f, p- h$ u7 `9 `Method 02* \. ?/ F2 @8 \, j9 C  _9 y2 E0 S
=========
! ]4 m2 B2 d0 e) V; m5 _# ?
& Y2 L; \$ w7 z4 d4 r( |/ ]/ O& nStill a method very much used (perhaps the most frequent one).  It is used
& D  P2 m; x! @, j4 n! h, W# [  _5 |9 bto get SoftICE 'Back Door commands' which gives infos on Breakpoints,7 x- W3 Z4 |+ r1 P  w" R' o+ t
or execute SoftICE commands...
8 M$ H* x( d, p% W1 G( RIt is also used to crash SoftICE and to force it to execute any commands
8 U3 I: V- h' O& w! u! A(HBOOT...) :-((  
4 w& V  M4 {2 Y$ E& X3 f- w( d+ W2 \! V! x$ j
Here is a quick description:
4 c  `8 Y4 K" H' J/ ^' n-AX = 0910h   (Display string in SIce windows)5 Y( T8 u7 ]0 j* g8 r- k8 T7 B
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
' n! W) C8 e# [& [-AX = 0912h   (Get breakpoint infos)9 @/ e& d* D# z& F, J  F
-AX = 0913h   (Set Sice breakpoints)
# l, p+ [6 N8 y0 V/ a-AX = 0914h   (Remove SIce breakoints)% d/ w' I7 @* E" A/ F# n( s; ?& D

; W! Y, b) q4 {' ]9 d7 AEach time you'll meet this trick, you'll see:
3 w. c% x" I  ]5 W  R( z  L-SI = 4647h
4 A' L% F( J0 ?-DI = 4A4Dh
: v' Q5 e( Q$ ]3 YWhich are the 'magic values' used by SoftIce.
4 Q4 D% A& _$ c6 Q. @; sFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
& Q0 k# g. \5 U7 k+ c+ f' W+ y. Q* [" ?* V4 w# L( F& o
Here is one example from the file "Haspinst.exe" which is the dongle HASP
) {% D$ U2 j0 D4 ]2 |Envelope utility use to protect DOS applications:4 f5 u0 K$ A/ ^, Z, C8 m" T  e

' j. }) p0 P9 F% v4 N; P6 P  g, s) N, F! g! I( t4 q
4C19:0095   MOV    AX,0911  ; execute command.
2 W; H- l$ o& k! x4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
0 b) K! u0 P/ \7 j4 T& w3 i' ]% o4C19:009A   MOV    SI,4647  ; 1st magic value.
6 I, Z; L( r* P4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
" {+ ~2 M1 V2 K% }4 n! y6 j/ h( G4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)4 B/ W$ x( L8 @* r/ e
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute" b/ e+ s) F) D# ~7 [
4C19:00A4   INC    CX8 H! J4 _" K; p# I* H8 q' ~
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute6 |* o( N6 r3 N7 j/ M+ S" w8 }* o
4C19:00A8   JB     0095     ; 6 different commands.8 Q2 {0 R+ z9 R0 p1 t
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
) L5 v4 Q& A! K- e' I4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
( ]* k  Q) i; ^- k7 ]) |2 t8 P
$ x1 {$ P' F, `: X3 MThe program will execute 6 different SIce commands located at ds:dx, which
# l' r) o. h+ y' iare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.0 m8 c' I* a# D$ w7 D) ~: C; Y# C1 x

7 L) F2 c% s# x8 Z- p* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
8 Q9 @4 Q/ t$ [9 O' D___________________________________________________________________________
. ^9 q1 U5 m. L1 a5 |* o- N; `. h2 |0 B+ F# Z
+ J- O/ }5 [3 x" C
Method 03( E% R* t4 F3 {  `7 `
=========& s0 y6 c3 U9 [) L# v* |
5 v* g4 ^7 y' f
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h/ @$ K4 |! K; B  t' N1 C
(API Get entry point)" a; N8 T! O% U
        
- N' N- o5 Z$ s: y- t& y% ]; X
2 e) i5 [' w; K  d& O% f# O8 n; q5 I    xor     di,di
- b8 v5 X' b6 \9 o. K    mov     es,di
, P# U, ~* h3 R+ a    mov     ax, 1684h       3 w0 a  P6 s& e
    mov     bx, 0202h       ; VxD ID of winice
5 E; [' F' F+ R3 R% m    int     2Fh; v* Z  M/ _5 I4 h7 Y
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
6 h0 `3 R$ c) v$ L3 v4 H) u2 v* k# J0 J    add     ax, di  h- U# F4 d9 f
    test    ax,ax( B" l" f7 [8 Y& D& b: e; Y) D
    jnz     SoftICE_Detected
8 _+ K6 Y6 Y8 u* m( k2 u  w4 g$ ]" o7 d+ _3 {0 ?0 ?
___________________________________________________________________________
+ y0 n+ I+ ]& }$ M6 o3 k1 n  |
3 N* [( ]0 t6 v0 e9 @Method 044 q- E4 N4 {8 h, W5 v
=========- c; Q9 J- B6 J# l, ]# A3 G8 K
- {6 I! V; f7 D* N5 M1 Y6 H
Method identical to the preceding one except that it seeks the ID of SoftICE
, U8 Q2 b) r  G1 ~GFX VxD.# c  f9 M% h+ ]0 J. Q
/ B# E# k5 t: s3 b8 z
    xor     di,di1 p. u9 H) b! d
    mov     es,di2 e+ E6 L+ A4 T6 I/ [2 M
    mov     ax, 1684h      
6 I$ h3 D4 h& K1 `/ ]$ ~* {/ ^    mov     bx, 7a5Fh       ; VxD ID of SIWVID8 b  ~  }, w. m, Q
    int     2fh; x" A3 I, {2 E
    mov     ax, es          ; ES:DI -&gt; VxD API entry point. @# }9 x7 g: L" v
    add     ax, di
6 n# R  w* U: c    test    ax,ax
0 e0 J& y2 U4 F5 Z" E! T; Y    jnz     SoftICE_Detected
/ q! N& C0 Z- R" P
& ^- s% S/ l! S( K__________________________________________________________________________
  J; _) C: B- ?& ]3 B
7 [/ J% |! Q+ K
4 O! T6 ^4 R% f  K( S1 jMethod 05. B# H' \  M  y6 O' k. N# W# X- d
=========
# B1 g+ j$ J* Y1 d% u9 y: U) U
. R( o9 t( s7 e  a- J$ @Method seeking the 'magic number' 0F386h returned (in ax) by all system! g! b, z& u3 C( x" I5 Y0 j5 x
debugger. It calls the int 41h, function 4Fh./ P$ V6 _6 ^% e( h" `1 [
There are several alternatives.  
% O# z3 j; Y. n3 T( J
' Q" y' r& ^; s% I1 M1 M- a7 H7 CThe following one is the simplest:
+ F3 |# S* e7 F% j1 `1 l" r, p  L9 v4 Z
    mov     ax,4fh$ P" O2 f- M  f7 E1 f/ q# m
    int     41h
2 g2 }( l9 }* b- Y( g    cmp     ax, 0F386: w: @. _: t! S2 g! a6 J7 s
    jz      SoftICE_detected; \0 ~; h* ^! r8 o

( [+ @/ \* {# {! l
# |, \7 a! \5 `  P# W% }Next method as well as the following one are 2 examples from Stone's
, s# ^& ~8 B+ a, U/ c, |"stn-wid.zip" (www.cracking.net):
0 ^- B+ ]( A, R! Y$ g: x
: I% `1 p; i, M! ~    mov     bx, cs, f1 ~& ^8 b; n2 f9 b4 Y* d
    lea     dx, int41handler2
1 a8 ^$ Z9 s& f) V% x2 C    xchg    dx, es:[41h*4]
" p4 ]" G. U8 ^7 T    xchg    bx, es:[41h*4+2]% n) T9 M, I9 A7 U# G0 H" P
    mov     ax,4fh7 w# I1 Q" ~* ~! w# ~. L
    int     41h
, _! j# e$ K* o    xchg    dx, es:[41h*4]
8 N; E5 g7 F: B9 s4 P3 g$ R    xchg    bx, es:[41h*4+2]
' o, i2 ?' z* n' S2 W    cmp     ax, 0f386h7 Y9 r3 m. ?8 f; V
    jz      SoftICE_detected' x! ~- J9 h% l2 d+ i" j& [. X  Y
( g" _. z6 {. F  z7 ]
int41handler2 PROC: ], q2 i$ k$ v9 C
    iret5 w& J- f, s. j) Z" L
int41handler2 ENDP
8 n, Y# C- {3 o: e2 G% J/ ]/ E% J! O* j4 m
7 b. k2 a9 k& m9 P+ M2 g$ r' y
_________________________________________________________________________/ O& {9 \* q# |$ ~
( ~$ e. D, Q) S5 r& c. ?0 A/ o
; r/ \- O, j- W: M1 ]
Method 064 S8 R+ O) y: w0 B' e1 u
=========
1 L% V  t. r  ?7 V* y. K6 ^1 ]" G1 _: D( p. y4 d, T' _

; p& }2 q2 E5 L% {0 ]2nd method similar to the preceding one but more difficult to detect:( D" ^4 w+ b7 h  Z, v* }% J1 V

2 {' ]* {9 W( M4 j
1 }/ t( d# o; ~int41handler PROC
: u6 H7 `8 e& U( P$ h0 n    mov     cl,al) |5 s, @; \7 d& i, Y  M5 [
    iret
+ o' a3 O( ~: M- X4 s/ zint41handler ENDP
- y4 x+ e; F$ b8 o' D8 F
' m& C  X* O3 T* l; g# |" H
! ~+ v/ H: v1 W6 ?) Y    xor     ax,ax
: q- J* @8 k# f) m- @" F: Y    mov     es,ax5 i' `3 @2 M5 A
    mov     bx, cs
3 d! t) ]. ]1 f, m/ B    lea     dx, int41handler
! s$ h0 q- d4 u. r& ]2 _    xchg    dx, es:[41h*4]
2 q0 w" U$ H. l7 l    xchg    bx, es:[41h*4+2]
, v' B' I  j$ p' O7 Y& u7 Y; k    in      al, 40h* ^& b1 b5 ?0 q" ~0 ^4 P  N
    xor     cx,cx- [: c* j+ K$ _7 Q" E
    int     41h
7 }, V1 z7 A& }. Y: J4 B    xchg    dx, es:[41h*4]
, M7 w+ P2 P' J! w4 t' ]: t. t3 A    xchg    bx, es:[41h*4+2]
8 J1 v5 c! q1 C) f    cmp     cl,al
% S2 x% L6 l, z2 [, Y/ ]' N    jnz     SoftICE_detected3 I' L9 b2 {8 |8 m

3 p0 F& |+ Q- m, w/ L_________________________________________________________________________* f$ w7 I4 i9 j0 u/ p

: b* q3 N% q6 l- ZMethod 078 I$ H1 w9 v- D
=========
, }7 e) ^1 \* a) W5 w
# B+ p; R" |% j$ R7 R9 w" tMethod of detection of the WinICE handler in the int68h (V86)
7 O" c3 Y$ r- q2 _: R
% A4 [# \$ y9 M    mov     ah,43h
$ `% d, n' s- b+ S1 e8 J    int     68h
  M7 h% Y* ]8 _8 G    cmp     ax,0F386h
1 x  f/ c: A  G. ~/ Y1 O    jz      SoftICE_Detected
3 N# L6 Q4 U  X0 ^
1 y! r( }0 C" f2 d+ I+ d' S6 _5 ?( ^5 F
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
2 j' N' Q: g' x0 ~7 q$ e( m! ], S0 e   app like this:# u  S3 y4 g+ C" ?7 G
: V2 S' L7 ~" s! n: j4 f" N6 g
   BPX exec_int if ax==68
# Z' U( D3 a' k" T+ X$ K   (function called is located at byte ptr [ebp+1Dh] and client eip is4 G6 z7 ^0 ~, \/ G. q
   located at [ebp+48h] for 32Bit apps)
! y' _5 ~1 I- A9 s/ ]__________________________________________________________________________) N4 G9 v6 z* ?) ]4 D% B$ I0 k; s

' G* b( J: G3 X6 d
2 T1 `) P: B! |0 Q5 ~* Q4 S, E) YMethod 08
4 i/ @0 L) \) L) ~' m=========: R& K* ?3 u4 }5 }' W
2 w3 l( `* b, y- i0 V5 A7 @1 t
It is not a method of detection of SoftICE but a possibility to crash the
. N- @) M9 x! J4 p9 y) u# msystem by intercepting int 01h and int 03h and redirecting them to another
. A" ]  L& r4 i; w; nroutine.7 x, [4 @" i& C6 }% t. [+ E- K
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points. T% v) Z3 O! v+ N) n2 u* M) J$ M5 r
to the new routine to execute (hangs computer...)9 U: v, a8 }# r: C/ T7 n% P

  I" c4 s8 W# S& a- D    mov     ah, 25h. L$ ]; h( j# C9 M! z4 L+ w; t
    mov     al, Int_Number (01h or 03h)6 U4 |# ]2 Z7 w4 I/ S: i
    mov     dx, offset New_Int_Routine
5 z: R' b' ^( g" q8 h" K5 b    int     21h9 |  p8 S( A! D( I8 {# R

. I/ w  P; P$ t# m5 r0 Q__________________________________________________________________________$ f2 a9 V( V. h2 p

* ]5 Y7 ~6 Y* L- v3 r; U3 ~Method 09
( K# I# \" V. a$ s, N" d" _  F=========  I. D3 q! b3 k5 N- Q( i4 Q
" u& d6 e0 _) C- U: k! n
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
- h: ]8 C7 B% P0 n' r8 i; S  |performed in ring0 (VxD or a ring3 app using the VxdCall).
; N# A4 Z6 M6 zThe Get_DDB service is used to determine whether or not a VxD is installed
4 ]; Z0 Z7 E8 D+ Z. \& k" ^/ zfor the specified device and returns a Device Description Block (in ecx) for
; [3 I1 R" v5 y+ I: n; H7 Hthat device if it is installed.
6 i" W" r( Z& j) e, {/ ~" [4 [3 e; e; l
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID* c" B: h. @2 U( K6 |. a8 ?. v$ J
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-), e  s0 I2 Z( r0 M" w2 L
   VMMCall Get_DDB
0 X$ R. R# P6 T+ J   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed; X( h' F1 O9 I1 B6 p8 Q

; N6 B/ s1 r8 K" ]  P$ m1 eNote as well that you can easily detect this method with SoftICE:
0 K9 g0 D9 C6 a6 l# ~   bpx Get_DDB if ax==0202 || ax==7a5fh
; _+ C2 e% T/ v  B5 {7 w* C
1 _% y/ ]  U) O6 k  k( x, L$ h: A__________________________________________________________________________
" P* c0 v2 G' m0 b/ b
7 S% s8 e. U/ A7 ]& xMethod 10
. B  U" _" r7 i8 _& M! Z=========
# N9 Q% S, a* n
" \4 e1 ^5 t7 r5 C9 B$ ]=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with2 I2 f* N* Y: r6 V
  SoftICE while the option is enable!!
8 }: [1 W  O$ N" V6 S1 p
2 y6 ~5 f' j8 N% e+ }This trick is very efficient:. B& ]" M9 z. F& z8 j0 s
by checking the Debug Registers, you can detect if SoftICE is loaded
- \/ b/ t* f3 g  v8 A9 g(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
7 X/ f% }; f( Z  t( M' |there are some memory breakpoints set (dr0 to dr3) simply by reading their# M, A1 K# N& O7 h; X
value (in ring0 only). Values can be manipulated and or changed as well  r, t8 ~, t! q: b1 }, I+ t( x: E
(clearing BPMs for instance)2 I( c, u# X" s3 I# t1 T( c9 E
( [3 n4 L  K. c, _6 v  D; ?
__________________________________________________________________________
$ q! H+ }9 q- {0 x( N
& g9 ~- t( }  M9 A- [7 [: g# rMethod 118 x: B0 }8 ?9 i$ c* n  v$ ]6 `
=========5 u" z/ f/ X. e# O8 \1 P( V
  J! J7 t! A0 e/ q' X( @
This method is most known as 'MeltICE' because it has been freely distributed
; x0 X9 L, k; `' f% S( wvia www.winfiles.com. However it was first used by NuMega people to allow' T) |2 F8 i, y# k; L
Symbol Loader to check if SoftICE was active or not (the code is located
3 r, o; f8 _3 B2 M) ~: j' Q0 k$ Jinside nmtrans.dll).3 S# Z7 d9 _4 Y5 T7 W9 Q

/ w8 _3 r3 m# H4 A7 _: B7 e' O. t+ nThe way it works is very simple:
4 q9 `( J4 h, {$ p- OIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for2 u8 q3 u' V/ |* j
WinNT) with the CreateFileA API.
) Z3 X% r' w$ B% u, F! z8 v% |9 o" H; |' M, Y7 J
Here is a sample (checking for 'SICE'):
2 |  v; Q5 w' h5 s8 b$ Q3 D6 W( ?( [" L
BOOL IsSoftIce95Loaded()) K: k  r: x# P% i4 [" o
{
, Q8 @- M2 y5 }, D   HANDLE hFile;  - d- u$ U2 E2 ^8 V
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,& D0 H. r2 _3 P9 j
                      FILE_SHARE_READ | FILE_SHARE_WRITE,
2 |& u* Z; q8 S% J6 X- ?                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);. Y2 q. c. X" j, @  @) E
   if( hFile != INVALID_HANDLE_VALUE )
" Z2 y0 u, v3 }+ _" y. F   {+ |- s* a6 H1 ^1 h8 l. _% S
      CloseHandle(hFile);
2 K, X& x! g# H" `6 R% `: L      return TRUE;
  ^* V( f# G& H   }
1 ?* V! p7 p% H0 }. e8 j: r3 Z   return FALSE;0 \9 N5 s+ z6 [+ ~
}
0 B5 \2 _: ?7 U! S) L
' m+ ~) U" q1 K- D0 }# ]: IAlthough this trick calls the CreateFileA function, don't even expect to be
! {. G' ]. C0 k, `+ Yable to intercept it by installing a IFS hook: it will not work, no way!
4 ?" _6 X4 ~  }In fact, after the call to CreateFileA it will get through VWIN32 0x001F$ n+ v; {8 k2 w6 c
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
( H# o3 _' c* G' Q( g& [  rand then browse the DDB list until it find the VxD and its DDB_Control_Proc2 F; J5 |8 W6 Q3 B
field.
9 C5 d7 ^0 o$ N  IIn fact, its purpose is not to load/unload VxDs but only to send a & r! T: m+ |4 v+ @
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
. z) T* f% x3 n6 l1 B/ bto the VxD Control_Dispatch proc (how the hell a shareware soft could try# B( b4 v/ E6 t- X9 p/ h' ?
to load/unload a non-dynamically loadable driver such as SoftICE ;-).. H/ x  A5 E' e' w. O
If the VxD is loaded, it will always clear eax and the Carry flag to allow  M; G: B, j/ W
its handle to be opened and then, will be detected.
9 X* I; ~3 x- _* t; r. R/ \( @( BYou can check that simply by hooking Winice.exe control proc entry point
7 r. v& a( O3 C, W2 cwhile running MeltICE./ G+ R( o$ ~5 v
: x( v/ v: u9 k2 o# B: ^2 j) N# R

- m+ Z) [, a) _' P  00401067:  push      00402025    ; \\.\SICE
" J* d' _5 P) r8 y# R$ m! P" g6 L  0040106C:  call      CreateFileA( U" r$ b6 Y" C' v
  00401071:  cmp       eax,-001) \/ a' R  G; U8 S
  00401074:  je        004010918 y7 S+ v" Z% a5 _

. `' ^! v/ Y" Q: a
) O% }( M. j. H* ^% v+ Z( X+ nThere could be hundreds of BPX you could use to detect this trick.) P0 F) e$ H/ c( g, [+ u2 k
-The most classical one is:$ M0 m6 x& ?9 |* U, R
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
7 F( b- l! e& a, a+ B5 F    *(esp-&gt;4+4)=='NTIC'
- t' z! \6 C0 x: x& J$ N7 N" X% I& o( ~- s/ W" A3 A/ a1 R
-The most exotic ones (could be very slooooow :-(
2 e+ x3 a+ S) G  k$ s# h   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  ! F' m. g: Q5 {$ M) Z& H" N0 C
     ;will break 3 times :-(' M- J: k/ r  p6 P4 q- a" B; p) s7 i$ I
' K- L( P) e. c
-or (a bit) faster:
# g7 R. [8 _4 P: v( F6 ^   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
8 T# B+ c! F/ m) J9 F: F" W5 k1 W
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  9 l; [* k* ?6 ]2 X7 K6 \: i3 L" A
     ;will break 3 times :-(
. |, k$ Z- o& O# @7 X" j0 s% z, Y5 Z) @
-Much faster:
7 L- E. A$ V$ r   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
( s) f: H2 E. H
( m& W' t* f/ N+ N8 jNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
* D) Q4 v& H- A" Tfunction to do the same job:
9 J0 C  p* Q/ V8 V2 p! m7 P5 ^7 p3 S8 ]: _, X0 }) H
   push    00                        ; OF_READ
0 a: k' n; x& T   mov     eax,[00656634]            ; '\\.\SICE',08 ~. H4 t# B% r3 d. _8 W
   push    eax
- I! b7 e4 P+ _& @7 @* _6 N   call    KERNEL32!_lopen
0 J  k' X$ t8 c4 \: v   inc     eax4 x3 x6 t# g+ C: R
   jnz     00650589                  ; detected* ~& J: p' L$ v# f5 K
   push    00                        ; OF_READ
8 r) h9 b4 |0 q3 L   mov     eax,[00656638]            ; '\\.\SICE'7 u  y4 v/ ?9 b8 J0 k7 S2 S+ D0 L$ E
   push    eax3 W8 l( n; t  k. u5 A
   call    KERNEL32!_lopen
( s  H6 f, [; g) @   inc     eax
0 |; e7 b7 ]3 k   jz      006505ae                  ; not detected
7 l: k7 s! [* U6 E' [( [- u! P, ?. F% x% a  d" G6 k

  \: Y4 [8 T# \6 E% x0 U0 {__________________________________________________________________________* X% ?- A# q! P/ \) u$ _
# T: ~0 \/ n' b2 N: d
Method 12- s8 s6 r$ X) v, F1 w
=========
) V6 n1 x: I4 C  i; H
* a5 X8 y  w: f, U, G* K0 jThis trick is similar to int41h/4fh Debugger installation check (code 05, K: E" D5 v/ ?. v
&amp; 06) but very limited because it's only available for Win95/98 (not NT)
* P1 l3 n. _4 c, g% O8 f# |as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
( n$ K- n" h2 w! H) d
" I, d( C# k% n. e5 o) i   push  0000004fh         ; function 4fh
$ e* ^. P1 H; o& i2 a   push  002a002ah         ; high word specifies which VxD (VWIN32)
# x) ]1 P) e4 i                           ; low word specifies which service
7 n# }: c0 J6 ^% x5 _, w                             (VWIN32_Int41Dispatch)( o% A: N6 N) T7 }+ A
   call  Kernel32!ORD_001  ; VxdCall' z3 _4 s9 r8 M* Z4 E8 s
   cmp   ax, 0f386h        ; magic number returned by system debuggers
, e! |$ ?, g  b' I+ e# l. ^4 J   jz    SoftICE_detected2 }  q* Y3 c6 `
- c, R+ s6 M, r4 G0 s6 t1 r" d( u2 _: T
Here again, several ways to detect it:
7 t+ ~4 o: }: |* Z  O* k% p& L8 b7 Q/ G0 k. o" D
    BPINT 41 if ax==4f
) ]9 v# u1 M4 `- J' ~
8 U; ?; A& o+ X0 p# b: K" R    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
* w# l6 K! `; V! Q$ A5 ~6 H" G' ?9 _+ N0 v
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A0 R* S- Z( o4 L# n" R, M

+ c1 R) N: M  A$ e0 |    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!, Z7 @* }+ l: K' Y0 i9 {

4 R" U" q# Y1 Z+ [! r$ \. c; Q6 C__________________________________________________________________________
6 \, g/ i# O! d1 B0 l6 Q3 H8 x
+ O/ q. @6 x; G- `+ H; l3 H1 FMethod 13( p! {8 s# {# ?
=========
! v  f. i6 w$ Z. E- O1 ~2 _& i4 e' |' i7 D' F( E0 o, ?7 b
Not a real method of detection, but a good way to know if SoftICE is
/ r4 \' a, y- i: |! qinstalled on a computer and to locate its installation directory.- F4 g5 |  V! |% i( ~
It is used by few softs which access the following registry keys (usually #2) :
1 x+ x2 g" z3 G' `1 U3 c: j$ p, l+ W1 c  J, B
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
: N) _; {* ]& {: d\Uninstall\SoftICE5 c7 `' m" x& B% a$ D4 G
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE$ m/ V& k4 O! S& h( `* A9 l
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion, e% x( N: p; ?$ P# ^
\App Paths\Loader32.Exe
# s& ^, P( ]7 G0 K
4 v9 b: F8 O/ r; x3 r' p/ Z9 @3 h" ?" A5 n+ K: J) G  s
Note that some nasty apps could then erase all files from SoftICE directory+ A' H# M" H/ @
(I faced that once :-(/ ]2 G  u0 e+ i  s# g

" f* @8 u! V- t- BUseful breakpoint to detect it:
( m2 ~7 N6 o1 y- d: L. ]/ J9 {& e9 j1 E+ f3 O
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'6 _0 f4 A( f+ v+ ?

' }1 R$ M. _) n5 _. h__________________________________________________________________________- j5 q7 A" e0 H' S8 a% Z- C
8 `; ]& z' q* r( @

5 h) H! b8 D- FMethod 14 7 \/ y" C8 |. z5 B6 I1 w3 K
=========8 ~' W( e2 J8 A6 L) N  }- B$ L
( s5 K# O- _6 @* v3 \
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose( P6 i+ c6 e6 ]
is to determines whether a debugger is running on your system (ring0 only).
$ U" X; Y; Y- s( {7 k# |* E! a5 }( y5 _& L0 f  M
   VMMCall Test_Debug_Installed" H6 ?1 w7 x# @
   je      not_installed3 A7 f/ _; B1 G. @/ G; m
  y0 O3 f; Z8 R, o7 r5 G6 }5 S
This service just checks a flag.+ y0 b8 M8 \9 t3 T2 _2 W0 r5 ^
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-7-28 20:23

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表