找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
; z7 s7 e; M  s2 }  f<TBODY>0 G3 p  U2 h( a* r' H
<TR>
8 Z4 ]3 r% T# b<TD><PRE>Method 01
" m2 g0 c  |1 X; w2 G=========* K8 `% e( ?  Y

8 h! c- v: G3 k; }- v4 SThis method of detection of SoftICE (as well as the following one) is
; h+ ]" \# H' b7 z2 }) k+ Rused by the majority of packers/encryptors found on Internet.- L' \# k/ `, L
It seeks the signature of BoundsChecker in SoftICE
( b0 ]* L+ X  h. g: i
" D4 q" {) S  L- m    mov     ebp, 04243484Bh        ; 'BCHK'
4 [$ o& @6 w2 u8 l; Y, V, Y: g    mov     ax, 04h
4 I: @* l: B7 U" J( d+ H    int     3      
3 k% F$ W8 z: D/ d4 B) G    cmp     al,4
, `! S4 B! a+ U- n    jnz     SoftICE_Detected4 ]+ D4 A3 T" P  k" x: ?! y8 B
6 r) o/ s" @+ l
___________________________________________________________________________* Q+ V) O' D2 y5 g* p4 k

2 s3 {: C% `$ p: p( W2 GMethod 02
) ?* P3 Q# J, B; S' @=========1 l" U7 U% y3 ^4 S3 z

& m. b1 U0 F/ UStill a method very much used (perhaps the most frequent one).  It is used: j/ ]- i) D- S% o  k% n
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
4 y) P5 c$ S2 x  f& Aor execute SoftICE commands...
& `; j) \) t) X' cIt is also used to crash SoftICE and to force it to execute any commands; V" k2 k; A0 |! ~1 o  K0 J2 D
(HBOOT...) :-((  : A, V7 p2 x* B" e5 n
# r9 M3 I6 \+ R- A
Here is a quick description:0 D7 _5 m) P; L3 v, U1 \
-AX = 0910h   (Display string in SIce windows)
2 Q# q. q$ _' N1 o-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
# r  X& {- \% P6 H+ Z. ^& L; v-AX = 0912h   (Get breakpoint infos)9 g" b' C7 Q# s& f9 D- _% p% ?
-AX = 0913h   (Set Sice breakpoints)
' O; x. \" C6 v- y: ?-AX = 0914h   (Remove SIce breakoints)
4 z8 T! S4 R3 A" H9 `- N3 U* s' p5 U6 N+ s* }( Z
Each time you'll meet this trick, you'll see:
, U4 E# D' n  Y% Z-SI = 4647h1 \! Y" {3 F; y$ _& q" G( R3 w
-DI = 4A4Dh
- `6 Q  t. b  }$ f/ ?) i% ~; }Which are the 'magic values' used by SoftIce.
# b4 o8 l; E5 V: p! ?( uFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
, V- ?1 F$ M' L! D/ m% k: U8 q. u8 v1 E- Z# M) m* u% l$ z
Here is one example from the file "Haspinst.exe" which is the dongle HASP
, |9 R  L9 ?$ m- WEnvelope utility use to protect DOS applications:
3 h* y) |5 x7 @! V
+ J; X: v- T6 b- t7 [" r! s0 p
* {$ G" l; u+ u4C19:0095   MOV    AX,0911  ; execute command.4 \; x0 S' u4 m4 p3 W6 J
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).+ L& C) f9 b% \9 H" S4 @2 O
4C19:009A   MOV    SI,4647  ; 1st magic value.
, R' y# W+ j1 W+ D8 N- v6 s7 J4C19:009D   MOV    DI,4A4D  ; 2nd magic value.2 O# O, Q$ K( p2 J4 A/ u
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)/ ^# @1 V4 K/ Z6 G, W
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute# i( z& L. o) x. W( x
4C19:00A4   INC    CX
; [, S3 r- |: Q& b; ?# L4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
+ K2 Q6 S2 ^- }2 K4C19:00A8   JB     0095     ; 6 different commands.4 h1 }; I9 n3 m
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
8 D" x. H% Z9 ^7 Y8 P) T9 c: ^1 I4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
1 T$ [! N! n- m/ \, s
6 I& n5 i' |" p0 v$ ]; h3 `The program will execute 6 different SIce commands located at ds:dx, which
( O9 z# z' t+ G$ Y( a- o+ jare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
+ |5 S4 A% k0 p8 x( ~1 m0 s, Q1 f
# Z, R# z9 _# h) X' Z* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
# }. o& Z6 c& n$ V___________________________________________________________________________% |  N7 T2 O! t, q% Q6 v

0 [8 \0 A) M2 }1 j- c
1 p' P) G: _/ o/ g: y" TMethod 03
6 d/ L- D4 [; L6 ^; f8 P$ t=========
) F# D% o/ I8 B9 B6 s) v% A+ z% i& E. u
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h) D4 O4 S# ~; t0 W& a- K
(API Get entry point), X2 s+ W2 N2 ?% x; x. y9 f5 o* Q0 Y
        
4 A4 R; i8 e! A% `
' Y) x& M& J. U9 E    xor     di,di
4 E$ j1 l6 g- B! _    mov     es,di; x! S2 I7 v7 d
    mov     ax, 1684h      
( k6 h" `, |# h, ?    mov     bx, 0202h       ; VxD ID of winice
: F' @) @2 g$ u; Y2 T' F/ D: R- t9 H    int     2Fh9 W' Q/ N% R% H' y1 v
    mov     ax, es          ; ES:DI -&gt; VxD API entry point+ {' @+ X+ J, U
    add     ax, di; N4 I2 U0 ~' ?
    test    ax,ax% _" ~# D- f& y& \9 y/ c2 T% b2 i! E
    jnz     SoftICE_Detected
2 Q' ^! ~+ F# g4 y/ x2 Y! c" d
5 K8 i) \; t1 P$ J! h___________________________________________________________________________
. P/ H( a3 M; t; \0 g
, ^$ E- _/ Y# j! ^. NMethod 040 r, t: T9 H: R) N/ J2 t: q
=========6 R$ @& F, a4 o2 r; d
! j! e9 P5 _. n8 r
Method identical to the preceding one except that it seeks the ID of SoftICE
/ ~/ v. D# v# eGFX VxD." P9 A! C( A3 j6 p/ j3 _: H
7 o& C5 y$ P# g% |* ~$ {
    xor     di,di& ~  e1 i$ E6 K, `; j
    mov     es,di
4 K/ l# |: K, f# {, Z    mov     ax, 1684h      
" W4 B8 F) u& f7 s    mov     bx, 7a5Fh       ; VxD ID of SIWVID: w5 r4 b" i: f# X
    int     2fh( }& b' c% G/ U1 `
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
: M3 z& X. B4 p0 l* h* K; R    add     ax, di
( U8 Q: u5 V# [  ^+ \    test    ax,ax$ ]5 i: @# A* f! \
    jnz     SoftICE_Detected
; Y" A- k* ~0 N: ~7 f+ }7 B& G) c! Q3 E
__________________________________________________________________________
& G5 z) X4 E; z2 W8 [
" w% y, w& g2 C
- O4 E" V) t+ PMethod 053 D$ n% c2 ^3 c5 T. F' J
=========
- C2 Q" a  [$ T" t/ }
# I2 t$ O% z! q6 rMethod seeking the 'magic number' 0F386h returned (in ax) by all system
" z; @6 u; h6 x% Ydebugger. It calls the int 41h, function 4Fh.# ?% K7 F& O7 D- k/ ]
There are several alternatives.  
/ t) z0 Z* ^: k! q; s/ [: K$ d# j2 l9 _2 |' {
The following one is the simplest:
3 C8 Q; T! {8 R! A4 U! G
4 }* u- m4 ?; J4 Y. y    mov     ax,4fh
7 Y3 u1 r# a# H/ L  O    int     41h
* M$ h; b7 B- {2 A    cmp     ax, 0F3869 G# j2 s) R) y8 u/ A* b  {; [
    jz      SoftICE_detected
- y8 o# l  {" K9 L: ~4 e7 n2 N/ o% w/ F* j
  `2 s6 C4 I) c. d/ Y: Z. L
Next method as well as the following one are 2 examples from Stone's % \& ~) M- l  E; y
"stn-wid.zip" (www.cracking.net):5 J& y3 L5 ^8 H7 b3 w
2 g0 u* [* A+ m% Z6 L7 h$ R- r' u
    mov     bx, cs
8 Z% r# |! H1 C) y$ ~    lea     dx, int41handler2# z/ e$ {1 F- U
    xchg    dx, es:[41h*4]
1 V4 f+ d, n' Y    xchg    bx, es:[41h*4+2]/ L6 x. }# S1 V7 Z
    mov     ax,4fh
% t! Y) N0 w6 r. E- v, y    int     41h% F+ _8 P: O: L' l" \
    xchg    dx, es:[41h*4]
# d* G+ _$ D' J6 w/ S7 w) U    xchg    bx, es:[41h*4+2]1 u9 d4 m& R5 S  z  N
    cmp     ax, 0f386h" O2 a: H5 }1 _5 L. u$ h
    jz      SoftICE_detected
! h/ r, P- A/ J% _0 u0 i2 q
) z4 r1 _; {& E# J& pint41handler2 PROC
2 D6 w2 g" f1 o6 p. t    iret
/ |! x7 u( n- A: n5 ]7 L) @- Sint41handler2 ENDP
/ W4 e9 O" w# |  i7 k0 v1 T; w5 }4 c0 P9 m. _8 h: a

' U. _2 s0 z" ^! M$ ^' W8 Q! Y3 y  J_________________________________________________________________________
3 I! B$ U% s  |# z5 y
5 |% D/ n% f- n7 I0 T$ m) G; r/ q% y8 M/ B* X; w, _* o8 n+ ^
Method 06, t' R: ~* m* Y  k5 }
=========$ \. P2 B; [( H  r: t

5 l; U2 |$ n- i- N4 Z  m7 W  j: O- u* Z+ K* ?$ W$ k
2nd method similar to the preceding one but more difficult to detect:& i1 e) d! t" Y" B/ ?' v
; g' O, {  x( z5 Q
) Z% D0 @0 K' G# s2 l
int41handler PROC
1 Q4 D% U4 K% k' l( a    mov     cl,al: H; H/ w% {( [( j* i4 G: L
    iret4 j8 ]; }. z2 S! S( |
int41handler ENDP* N1 [# w5 G1 a  h  X: u. a

. D0 N% q* T3 [, \' C" V9 f2 j0 _5 H6 H! A- Q
    xor     ax,ax) Q) _9 ]9 L5 F/ N7 R: E
    mov     es,ax
0 B: |7 c' Q8 Y0 i4 u/ {& m% y    mov     bx, cs* [- \4 F0 c  j7 R1 ~
    lea     dx, int41handler: G8 @) `& s0 G1 F
    xchg    dx, es:[41h*4]
1 K5 R& _* n9 o: M: z; ]! L9 W    xchg    bx, es:[41h*4+2]
( M* Z: V- @9 A- q5 B1 g% P+ ^    in      al, 40h
6 N& o6 a3 q, c    xor     cx,cx
# `6 m& `* u4 o6 N& ]8 l2 R/ B8 D    int     41h5 q. M9 h( Q6 [. B
    xchg    dx, es:[41h*4]
6 M4 w9 i1 z" H5 o, g+ e1 d    xchg    bx, es:[41h*4+2]# |; r$ v% D( Z' z" U5 q, Z/ Z
    cmp     cl,al
# |! ]) l, j. h5 b) t    jnz     SoftICE_detected
3 B( x& f4 t+ [8 O! Y( a- D% L# o7 W. E* R1 P" E
_________________________________________________________________________7 X6 R0 |( w8 W' s) r
' S! \4 T% @( v- p3 E
Method 07+ e) O$ ]) u4 e6 L: w; s
=========
; w7 I1 h' n: c& p& s$ a/ E- `
8 _7 k9 {0 ~- S: NMethod of detection of the WinICE handler in the int68h (V86)
' I  L9 w* T) r" d3 \; F( D. D
) R, |( u- l, s; G8 _    mov     ah,43h4 H/ N8 ?8 p6 p2 B$ Y2 I6 T
    int     68h! d3 G/ @' v% F) g5 p, a
    cmp     ax,0F386h
# R4 `; u6 I4 n$ @+ F! M5 c  C7 ]    jz      SoftICE_Detected
( Z5 ?% V# I2 r' l2 _7 A) R5 J( D. Q4 D& B5 ^

/ d/ q: \& n; v0 _  Q( {9 z# B=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
: [% N+ G( S* n0 S; f9 l2 U   app like this:( p0 {% {, ?$ O* \- d- G/ z# G
1 a2 V! o" n: y0 V5 Q
   BPX exec_int if ax==68
$ F% ]( ]7 w, q# G: z; X4 m   (function called is located at byte ptr [ebp+1Dh] and client eip is$ e7 W$ {8 c! T' ]: r/ h, P' R. G
   located at [ebp+48h] for 32Bit apps)
$ k) r, z* E9 r( o% R1 F__________________________________________________________________________$ ^) Z" c) F, u" q8 X+ w2 j
# W* E  p2 g, W8 U
6 ^" f7 [% A. I, a5 K
Method 085 ^- |% E3 U( t: l! |
=========
  {( O- _3 \1 P7 j; E0 b
( c" z2 H+ s- \0 h0 hIt is not a method of detection of SoftICE but a possibility to crash the. d/ r& Z  `# ?" ^# w. c
system by intercepting int 01h and int 03h and redirecting them to another* n7 }0 X+ g8 ]7 i: }, Y
routine.; i" C9 h( C4 Z% `" ?
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points1 Y) z+ @6 l* a& o! p
to the new routine to execute (hangs computer...)
+ B5 J1 L- N5 y0 @% |' O# j. Y, O* A" i2 E1 W& B4 N
    mov     ah, 25h
9 p" C4 `% E2 L+ |% D    mov     al, Int_Number (01h or 03h)6 @5 V' Y' G% {2 g
    mov     dx, offset New_Int_Routine1 M. g: `8 o8 N- V
    int     21h
& `) H7 V5 l, b$ c; N! X4 `5 E
" ~% l5 q( q" k- B* G; V" r5 m) ~' C5 F__________________________________________________________________________/ D9 L. W1 E+ z  z% E0 m7 x( @* ]9 n
& v0 u4 M, g% `1 H
Method 09
: c3 w& L5 s6 O( `7 i3 m# H4 c" G=========
% ]( f  _) s7 U, `' w4 j( J: w  O
# @% z9 G6 q* k2 g& ZThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only( o8 @) E+ c9 S6 o% t
performed in ring0 (VxD or a ring3 app using the VxdCall).! Z# q' X% n) g4 \$ `% B
The Get_DDB service is used to determine whether or not a VxD is installed- e. ^7 G0 f1 e8 T5 ^; g; Z" S& I
for the specified device and returns a Device Description Block (in ecx) for
( o1 w' h, P. ethat device if it is installed.  n5 _1 q8 d+ j" H7 I

% [) H% {$ {4 |& F; s   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID0 K8 R. A9 z4 S& p1 R& T
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
2 }1 j- j& J& K- L   VMMCall Get_DDB- f) X& E$ c/ u8 e
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
* {2 J! \4 h8 a
) g, E6 r/ L$ R; A) {, _! l) oNote as well that you can easily detect this method with SoftICE:( E! U7 M9 u% a
   bpx Get_DDB if ax==0202 || ax==7a5fh& `" F) K& ^! x6 z2 R& @+ T1 u
2 _$ I! p# P" O3 P1 m5 O
__________________________________________________________________________8 D: @+ p: G3 f, s7 O

+ x  ?+ z. M% k9 Q4 m- k- VMethod 10/ e2 ~7 c9 ~, Q& k) B! n8 X0 [/ K8 c
=========
( Y4 d+ ~3 e% f5 ^: ^' z! `
, v; e/ o: o0 Z6 p: K1 D0 A% O=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with) a9 k# j+ f2 S) s# H
  SoftICE while the option is enable!!/ ^4 X( h& G4 {/ Z6 T! `+ R+ z
" F, B, r4 @% B2 I# I
This trick is very efficient:
( k* P) w. Y4 o3 a" T& [by checking the Debug Registers, you can detect if SoftICE is loaded
1 V( s% N0 r0 A. Y(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
' p  R* X9 B* I! E8 S4 ~+ w4 N' ithere are some memory breakpoints set (dr0 to dr3) simply by reading their5 S6 E5 n  _4 |5 E8 x
value (in ring0 only). Values can be manipulated and or changed as well
& {6 V3 }& Y& T. f$ o( h7 A! {, {7 d1 O(clearing BPMs for instance)
1 V2 J( `6 {' P* f9 S3 R, g2 T2 n$ h5 i+ j4 Q
__________________________________________________________________________$ t7 f. W+ n* h

* ]* n5 Z" X# [Method 11* f3 P% D& n8 i
=========
- R8 @! S3 Z' H1 {; m! Z) @, M! h  u
This method is most known as 'MeltICE' because it has been freely distributed
" b3 e9 v$ D" i3 zvia www.winfiles.com. However it was first used by NuMega people to allow
+ ^' `3 j% @" N2 `* l0 JSymbol Loader to check if SoftICE was active or not (the code is located
8 d1 G' D: d: n* J6 Kinside nmtrans.dll).% b2 l. p2 y% i7 @7 V

7 N5 R+ Z! E0 L- Z+ d$ SThe way it works is very simple:
! T5 D  @. ]& _' CIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
* q; b( q: U' a  UWinNT) with the CreateFileA API.$ z, c& R6 G& {' b

, P+ Y4 s* C" eHere is a sample (checking for 'SICE'):! R7 D9 y4 a! u: u

: Q( E: c& R1 UBOOL IsSoftIce95Loaded()# e( L; M( v" z! a4 U; S
{
: e) T8 Y  }4 n6 u; o0 m# X6 C+ K2 g   HANDLE hFile;  2 s2 z: _" B) s" f/ u6 ~+ r
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
* w. @; x/ W; J6 }+ x& U                      FILE_SHARE_READ | FILE_SHARE_WRITE,& ?3 x$ N& |; A+ z
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
$ \, h7 j( m  {" k8 c) ^" q   if( hFile != INVALID_HANDLE_VALUE )
; z/ X4 ?3 X0 T( ]1 x3 M   {
1 X1 h3 M* T  E$ {8 z      CloseHandle(hFile);/ f9 p+ N1 b% S  C2 {
      return TRUE;
' v* a! R) x/ K# I   }
( ~( R/ X6 s7 }( b# K" h* \   return FALSE;
- ]0 a9 ~; s$ [( q6 V/ Y}
+ t0 W2 n3 a- b* S7 _4 U& b- F
6 U; |% X# ]4 yAlthough this trick calls the CreateFileA function, don't even expect to be$ d& f) q) k# p1 m3 U  X
able to intercept it by installing a IFS hook: it will not work, no way!
" ^' |# }0 z* T% i# J' GIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
+ P5 `, U; e2 C: C* wservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)3 U" `* \# E3 U9 L( J
and then browse the DDB list until it find the VxD and its DDB_Control_Proc/ J, t' N1 t4 }% s- g5 }/ z( M, ]. c
field.
. w: b9 D; g: F9 m: e1 AIn fact, its purpose is not to load/unload VxDs but only to send a
& y2 j, T( p- }' @4 d7 yW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)& \' T! Q" a+ j% i( a9 V
to the VxD Control_Dispatch proc (how the hell a shareware soft could try  w. `  A' o& t
to load/unload a non-dynamically loadable driver such as SoftICE ;-).% L& ^% N+ l0 S/ x
If the VxD is loaded, it will always clear eax and the Carry flag to allow# P/ N; r' i4 g4 p3 I- ^
its handle to be opened and then, will be detected.' c0 E  x; c* J6 ]
You can check that simply by hooking Winice.exe control proc entry point, c4 W+ h5 y& j5 A/ w7 B
while running MeltICE.) m3 U- @! i, b5 V4 q/ \

9 u. i+ z& W, X2 E* a2 ~
( `- l4 r) {. V  00401067:  push      00402025    ; \\.\SICE. x5 C1 y6 c% E* u
  0040106C:  call      CreateFileA: \0 O+ v$ o- h& g' C
  00401071:  cmp       eax,-001
8 S+ s- V- o2 }  c9 B# p# \  00401074:  je        00401091" M) B8 A/ X. m% E$ W! H) t2 R  {

) X. F0 u: C- b% \2 F3 y& {
& D- R! H! A5 ~7 |; a% W: mThere could be hundreds of BPX you could use to detect this trick.5 z6 j) P5 t% `# D0 D& O
-The most classical one is:+ ^. L+ E- ?: e& Z; H, K. B; p) t& J
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||3 O9 u( _8 H5 d3 A( p! g
    *(esp-&gt;4+4)=='NTIC'
7 t  n3 O) W. i, q. @( @
, E: Y% }5 [7 N: G8 V-The most exotic ones (could be very slooooow :-(3 l7 v3 @! T% m0 |& E8 m5 ]
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  8 v! c; e2 ~$ a4 k( U; S* c0 [* y
     ;will break 3 times :-(7 w! _0 H# _/ {. T
4 @$ F) Q0 }* G: W; c
-or (a bit) faster: 4 Z- A) p7 L, J  A, k1 ]* g
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
: B& A' J5 s# g% n
% f/ l: \1 p: ^+ T/ i# n; S5 K  \$ v   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
% T; j* T3 ]2 Y! ?; p( H& E& j     ;will break 3 times :-(
/ L' V3 ]/ G6 Z4 m! T0 V" ]' X  O, Q; o/ F2 Z: t% L% ]6 h5 V
-Much faster:" N- ]/ e' f) y2 t: E
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'+ Q1 H, p) C, d! K# r' E% a' G
# N" O" Y' s) j( ^4 L' W
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen( G8 {! W, t) A4 s) y2 v$ t
function to do the same job:( w% u7 _% o* ~7 y6 O

: G& v! ^9 d+ |( E  M! ?3 e   push    00                        ; OF_READ
7 q) v  }7 u. M1 Y" b   mov     eax,[00656634]            ; '\\.\SICE',0
0 }8 h  ]3 ~9 ?) f- ]9 M   push    eax
! o, z/ G  N6 l+ m& M$ u   call    KERNEL32!_lopen
* A: D2 f! z! F* |1 H6 R4 ~   inc     eax5 U3 n2 T" B6 S1 |( c
   jnz     00650589                  ; detected& C: k  e' }3 b) g
   push    00                        ; OF_READ
1 \, Z8 u" u( l3 o   mov     eax,[00656638]            ; '\\.\SICE'9 f# x" r; p0 [
   push    eax6 P# y# t: P. Y$ Y- p9 `  E8 L) T
   call    KERNEL32!_lopen6 \; j& Z6 g9 b. W7 t
   inc     eax
! Z  R6 s; V8 S   jz      006505ae                  ; not detected
1 N7 y* ?# H+ |% z7 X
' ~1 y' \0 W2 n; a' J7 V4 O1 `5 g/ x6 |  q
__________________________________________________________________________
$ d+ y1 g- |. |$ {5 c6 U8 i1 [
. @. o. e4 p3 M- eMethod 12
; B! p5 a; i) I1 e+ Z" Y- q=========* R+ k% {) j' e2 M! v' R+ U
0 D5 u0 |. [; [7 v3 F
This trick is similar to int41h/4fh Debugger installation check (code 05# G) j  i$ |* R
&amp; 06) but very limited because it's only available for Win95/98 (not NT)3 z' N2 \8 A3 r  }
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
; ]( J4 F6 e) i: g
. V6 n1 I% e* [# h, v: b. P   push  0000004fh         ; function 4fh
* ]; F: j' l) z  U# E   push  002a002ah         ; high word specifies which VxD (VWIN32)8 `0 H6 t5 |/ s, [
                           ; low word specifies which service  Q& f) Y: }. Q- Z' b9 Z
                             (VWIN32_Int41Dispatch)  k) C# J1 O( I/ \1 m5 ]$ r. m/ b; ~. _
   call  Kernel32!ORD_001  ; VxdCall
$ K( ~9 ]4 w6 C7 f: _7 L7 G   cmp   ax, 0f386h        ; magic number returned by system debuggers
5 ~7 Q) n' _; u& D8 `7 }   jz    SoftICE_detected5 n) A; U; }/ ]$ i  m+ i2 L

% x0 o% `$ y3 ^7 L9 ]; uHere again, several ways to detect it:2 \7 c' L0 D* u9 |9 u

( m" o% t1 o5 p" ]2 m    BPINT 41 if ax==4f5 p, R* I9 }  ?' y4 k
& N# r6 |2 r* E1 A5 q
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one4 T+ S/ _2 [, T
" B& R) r* r* p) q. b- d: j
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A6 F+ Q, B0 [4 ]

3 o/ Z2 e# e( {  V! o    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
) {# b# d9 V8 R9 F- Z) j) T2 m5 Z. C, v) l" ~+ s
__________________________________________________________________________
0 I6 I- J  a6 l/ B
0 t' [# {* {5 kMethod 13
+ c; c" I# B( w+ C$ b=========
) U2 H- e, r) y/ T; l) b
$ Z) ^1 M' L/ v  A$ V# N  vNot a real method of detection, but a good way to know if SoftICE is
/ v# D8 r. q4 o! Z- v7 Cinstalled on a computer and to locate its installation directory.6 {/ M2 F( S& d  j
It is used by few softs which access the following registry keys (usually #2) :- L) x5 R" m) l: `7 j2 o
; R$ n' E2 `5 ?1 N/ H/ ?/ V
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion- p9 P( I8 Y6 C, {0 D( p
\Uninstall\SoftICE6 W$ C) A% {4 a3 @2 ^
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
7 G6 h, y: D: \* l-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion- @# ]* m; z* [2 i
\App Paths\Loader32.Exe5 i; k8 p  u9 s- Y8 ]
" W2 w) e: ?2 ~2 _! E# p

  h; N/ s6 b7 V- eNote that some nasty apps could then erase all files from SoftICE directory' p% B- s/ f; T2 w# M, o6 x
(I faced that once :-(
6 e$ N: k2 |% T7 R+ c! K/ s
2 J1 I7 I5 i/ v7 MUseful breakpoint to detect it:
7 Y# x) N$ ~; Y6 U! T; N  k2 d* ]% C1 C4 d) h
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
# y% [; C" M$ p3 {" y  }) P# [. R' C! Z9 O8 n
__________________________________________________________________________
" H; q) F  U5 u6 |* ?
/ J% ]6 z4 E( v, I8 I# J  M" Z9 ~% w0 {5 _/ K
. V+ b, c* i& ^, I% C( ]Method 14   K( o5 F5 @' R
=========
! z6 ]2 |% }; J# x8 ~4 G
/ u. {) F- s2 }8 u  w) N* M. _# SA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose  g% q7 U, V; }6 ?
is to determines whether a debugger is running on your system (ring0 only).  h+ A& b9 }0 e
, b6 Z. d$ c5 Y8 h
   VMMCall Test_Debug_Installed
+ o8 z! \! T& d0 j+ D- h& Z2 ^$ q5 f   je      not_installed
- j8 Y6 r* u" \- D/ ~# P( c+ Z2 [) w4 B
This service just checks a flag.  D  }4 `7 C" c* R" s
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-8-10 09:25

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表