找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
* i" V0 Y/ B8 s: d4 X<TBODY># n- T$ w1 C/ i  b8 V
<TR>
# f1 x; s: W) Z1 g<TD><PRE>Method 01 5 j( n3 o: v, G/ O+ B( \$ u+ c
=========
- j- B- w/ E4 e) h' \7 L. o
/ F# X0 l8 f- |$ g3 ?5 c/ lThis method of detection of SoftICE (as well as the following one) is$ H8 j, `* W  l/ _  o) ~
used by the majority of packers/encryptors found on Internet.# t( i2 V; d/ P
It seeks the signature of BoundsChecker in SoftICE3 j( B, {4 @) [
, J  l( K  M7 j! X& A8 L
    mov     ebp, 04243484Bh        ; 'BCHK'' _5 A9 h* ^7 h2 W/ W
    mov     ax, 04h; j' J$ S8 Y$ S$ Z& I
    int     3      
; K. g3 n* Q0 \  R+ p$ B    cmp     al,4- A4 k8 }4 d% t0 M) ]% V% ~  h3 |
    jnz     SoftICE_Detected
2 n- I7 M5 D: D+ j5 O# U/ ~( s4 B: X5 |3 V3 R1 |5 `: V
___________________________________________________________________________
, f; @9 O5 ]/ S6 c& u8 G' p) i7 K2 i% M/ @0 D
Method 02% Y) m) Z$ V/ p# k2 ?
=========* c) j8 m1 M) ^/ Z6 v" Z
+ ]- ]9 f% m) ~4 [7 r
Still a method very much used (perhaps the most frequent one).  It is used' U& R( a  P% ^/ X+ I3 g3 I
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
  {! e) z5 U+ s; \$ o) `7 z# uor execute SoftICE commands...
8 N% O; R( Y1 ?$ O9 wIt is also used to crash SoftICE and to force it to execute any commands
0 O9 u5 h, ]/ R% K! i+ J& }! u(HBOOT...) :-((  " Y" ^& h5 j8 Q8 t

0 s9 |# q3 A' i4 k7 q* U1 r/ t$ kHere is a quick description:3 O5 V# G% ]/ C- ^- e( e3 u
-AX = 0910h   (Display string in SIce windows)8 d* u4 ]2 P" q- f% V
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
, n, P0 F4 R- E4 i: z-AX = 0912h   (Get breakpoint infos)
5 h/ q' W* w) \-AX = 0913h   (Set Sice breakpoints)
2 b! w% C: ^7 u. U. ]8 n3 w. {-AX = 0914h   (Remove SIce breakoints)
6 z( z( L6 @! Y: a3 C/ W
& z! U2 r, [0 Q& _! vEach time you'll meet this trick, you'll see:
9 p2 K, z# @" k; N* \. t-SI = 4647h) s* b7 A: ?  O, `& t7 D
-DI = 4A4Dh+ X5 E0 m0 v- i" s0 [
Which are the 'magic values' used by SoftIce.$ \+ S- h' k# M% T7 y, H; `. u
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
* I9 h& Z2 l3 {  M1 B( @' Q7 X* [5 e8 M; k$ c1 d
Here is one example from the file "Haspinst.exe" which is the dongle HASP$ H: j: K% w, n& F1 ]
Envelope utility use to protect DOS applications:; }+ j4 p9 _% y( c

) U5 A3 P, W" W! ]
$ F3 w) [5 H  L5 l' ^4C19:0095   MOV    AX,0911  ; execute command.
, y4 c6 _: v+ e' g1 j1 ~9 B* n5 N% P4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
, \  k& r% S% ~$ ]$ q# B4C19:009A   MOV    SI,4647  ; 1st magic value.
; o7 a; M! i+ }4 y% F  ?- E5 d2 j4C19:009D   MOV    DI,4A4D  ; 2nd magic value.7 z) k+ Z5 R+ d+ n  M8 s! g
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)$ h0 ~2 e; \: y9 Q0 K# T
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
( k: e5 O$ L9 h7 z4 w1 Z. ]0 M4C19:00A4   INC    CX* S( D9 Q* R1 ]. v) x% K7 c
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
, u& @2 W  |4 S$ s" i6 D) f4C19:00A8   JB     0095     ; 6 different commands.( Q" m9 J* d  Z0 w& F  ^
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
8 t' Q8 }9 |, S4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)! |$ C; s( V$ {4 @% R. C
2 N/ w) Q) [+ P1 f
The program will execute 6 different SIce commands located at ds:dx, which+ r- O; t6 K* p  e; A: }- ^  E& G
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
' M) l8 m; X- {0 k1 Z9 k
. z1 H- f9 o- t1 @2 E* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.7 D3 A/ k* A  Y, O: @% q- I% _
___________________________________________________________________________& ]* j1 n- i( F5 B; ?3 c5 V: N
  a" _( g# s& Z9 z0 \. R

- v) e: p$ y9 SMethod 03
8 ^3 ?5 u4 L4 {6 G  T" {3 C=========
6 ?1 e" d2 z) G! U' x. q* p# X' C0 |* |$ z) ^7 o' Z
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
, n0 q$ L/ X2 |4 O. w(API Get entry point)
$ c4 m/ y3 u: d  z9 L( \        
$ \: U  C8 t/ |7 Z6 a3 m
: ~2 k/ Q4 |0 y: S: E+ D; I    xor     di,di' e' m/ f$ q- Q5 v2 c& T) c8 ^
    mov     es,di# s1 w; i" i# M/ |* Z
    mov     ax, 1684h      
- k$ ]* f" j" O, I; l2 T    mov     bx, 0202h       ; VxD ID of winice
$ D6 o1 Y" o, D2 U6 K    int     2Fh4 O2 Y- ?3 J/ M. \
    mov     ax, es          ; ES:DI -&gt; VxD API entry point7 E+ _4 @6 a; d' J2 ^4 d+ Y
    add     ax, di
1 v0 S6 m8 X  w* ?, i' W) C    test    ax,ax- B6 r' l" e$ F+ c' j
    jnz     SoftICE_Detected1 i: q8 N' F$ y% }
; d$ f1 i7 F4 f% ~
___________________________________________________________________________
: c. G8 j/ d& I$ \. c5 K% Z/ @. `' b
$ ^. K* t/ Z: G) t! K$ e, A& K# xMethod 04
$ j# Q4 Z2 ~2 G3 [=========
: C2 q+ ^2 U# t6 f: m* C! i( Y8 u8 v& S
Method identical to the preceding one except that it seeks the ID of SoftICE
+ d, k* A- T  d& E$ f2 X( Z0 n0 qGFX VxD.( D+ V9 e' `) y( f! A

! I9 i8 c# Z& ~1 G    xor     di,di
  A3 [9 J. @9 u# i0 \' R    mov     es,di, k9 w. `% u3 }
    mov     ax, 1684h       8 q( [" }1 a, ]& V8 z* l* K( y4 A
    mov     bx, 7a5Fh       ; VxD ID of SIWVID
% o* _* T* Z3 x7 i    int     2fh0 a; p4 L* V" Q- V2 u% A$ E
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
  D8 Z6 V8 ]. `  e- w    add     ax, di9 L3 w/ j! H: o  `0 H" U9 H% R, ?
    test    ax,ax1 s0 M! O9 J7 v5 N! D& ]  u
    jnz     SoftICE_Detected! ?2 B6 F4 Y5 u2 R% r- |" x

  J: \8 d  E% ~6 X: }6 l__________________________________________________________________________: W+ B9 M% S- H1 f/ w

2 z4 ^. D6 M1 e3 V3 L+ X# k2 \0 F" j' X4 r
Method 05
4 D/ S# G. h! ~- ?  l8 g1 P, j=========
5 p, o6 b* q/ A/ U& y# L( a
5 x. a# I$ e6 l8 w0 G# D# EMethod seeking the 'magic number' 0F386h returned (in ax) by all system8 }& ]( m) v8 s" I
debugger. It calls the int 41h, function 4Fh.
, S, n! W2 ?4 ?5 `: N9 zThere are several alternatives.  7 L( D8 p8 b2 D9 Z8 p

4 N" G+ R  ^4 x" pThe following one is the simplest:
" z% g; `! ^9 B, K0 U2 q! h
; W& i/ X7 L" z9 E0 o2 H    mov     ax,4fh8 x! T' M( V5 }/ a3 A8 O
    int     41h
! p& m7 Y; \# e* _; j3 j  f) }    cmp     ax, 0F386
+ n1 g6 s1 X0 P  @! r    jz      SoftICE_detected/ t( @9 I, K$ x2 q+ B  [
& a5 [. H3 [) N: n( W; F

/ A, z. n* Z) d* U) {Next method as well as the following one are 2 examples from Stone's / Y) H2 P: J- @* O( j
"stn-wid.zip" (www.cracking.net):
4 D) z# ?7 U' B) m
, R2 S+ S8 O& ], y    mov     bx, cs/ n5 ]3 r$ B# H4 h4 c
    lea     dx, int41handler2- u* C$ A: q6 O" }$ \
    xchg    dx, es:[41h*4]
" P9 r' D- a7 G1 ?. t* Y9 f. L    xchg    bx, es:[41h*4+2]
4 ^, g; I* l/ l    mov     ax,4fh
$ O  H: Z+ I! _4 M1 V    int     41h! q& E9 F' R6 E( g- Z
    xchg    dx, es:[41h*4]. \2 _+ H2 x$ _, o8 H$ G5 C$ [. C
    xchg    bx, es:[41h*4+2]
: M$ Y# d- ?8 X$ {$ s    cmp     ax, 0f386h
: C# f& Z3 E% o; I    jz      SoftICE_detected
/ x) V& C* O) p/ X- z
  O1 \" ]' K& ^: Xint41handler2 PROC
! v# B0 V+ Z. F; l    iret
, z+ o* d, }  d+ z& o) hint41handler2 ENDP: C) z% A0 X7 K

; ?- t6 U3 P; T5 {# w3 Z: A& e
! U7 L+ c" t' E6 e_________________________________________________________________________
  @3 {% h+ N" f# n8 X
! c1 [1 T2 Z# k" V; q1 K% k# k
Method 06
2 z  @7 v* E# C=========( B( U1 O* I# C& C- d
) P7 A* N1 i* W1 y) o7 m. T/ R% K  W

- ]! f' \9 l3 T/ H& e9 E! K2 K" v) X2nd method similar to the preceding one but more difficult to detect:6 R1 _3 O  u5 e

/ |" W6 f8 G8 F
" B* V1 k, I, Bint41handler PROC1 O; g- k( r' U7 Y
    mov     cl,al
. s" \: w- v" }; d. X% K+ K    iret( W2 {" j9 V; x, j
int41handler ENDP4 Y* S- k. p6 w) g0 ?2 U, o5 Y
' W! B$ f. s2 Y7 c
* k0 w. T1 V$ s4 |7 i* M  }' @
    xor     ax,ax
1 q9 q' F, W: a6 P* C    mov     es,ax
7 Y) `* E* V+ D% }; R    mov     bx, cs
+ Y7 u! u; L) k- d$ M# Y( b    lea     dx, int41handler
# X# V9 O1 ?3 g  u3 w    xchg    dx, es:[41h*4]3 B( C  |; P) F! b' ?6 B1 x
    xchg    bx, es:[41h*4+2]
& L1 e( P' A5 ^    in      al, 40h
) d0 U3 |  M5 B& v    xor     cx,cx
- H: s* z% u& o; @4 |9 I5 e    int     41h  E# _/ B* q+ [* C0 ?$ p( G
    xchg    dx, es:[41h*4]
1 N8 e, @8 P! ?+ a( J3 l3 y" b    xchg    bx, es:[41h*4+2]7 |6 y% H+ y9 R% a4 C
    cmp     cl,al
! d' E/ L7 t* f6 F& u. L5 x    jnz     SoftICE_detected' D$ q1 Z- H# Q. k3 a6 ?! D: o

& ^$ t2 ]! O4 o9 V) {, G+ h6 r: u_________________________________________________________________________2 G! Y, U! z, A: s
9 e9 K6 r5 h/ X  s3 U
Method 07
. ]; Z7 a! O% F=========
3 S$ C+ ^4 w: w. I6 x9 z* z" i; e
Method of detection of the WinICE handler in the int68h (V86)
, T! m( D+ Z! k
! i% B% j- T! Z! H3 g% E* K    mov     ah,43h
6 Q6 z1 Y0 i+ t6 Q    int     68h* T2 J0 s1 h2 O" I/ n7 o6 {: g" Q
    cmp     ax,0F386h7 r5 W2 c- D6 d% z! U
    jz      SoftICE_Detected3 {) k8 @+ b' M8 h: @
/ z2 K7 x" a& p* _( B3 T

& ?/ m6 r5 U7 d* D3 N9 [# E=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
& G- [% g' ^- \  C- p2 h) D6 J   app like this:
. }" `$ z/ @: C! _) {* p; X$ j9 \3 f7 \$ J! @
   BPX exec_int if ax==68
5 d1 d& w$ D* E7 A" V1 @4 i5 n   (function called is located at byte ptr [ebp+1Dh] and client eip is
1 Z4 k) x# o2 p* {5 I6 v   located at [ebp+48h] for 32Bit apps)
+ f6 v. m; O, F. D2 K__________________________________________________________________________
" ~2 Z2 n/ ]3 p# \/ S3 R2 m$ g" f3 |6 C$ r; t$ q( r0 S

3 @( a8 m) f: D6 f( J" U9 ?' [: ZMethod 08  Q$ m/ o, e( B! r8 f
=========! L4 l* J5 q( n+ M! c, u9 h

& D  N( _  l4 }, w: @+ ^* \5 i* V# z4 pIt is not a method of detection of SoftICE but a possibility to crash the
- H* h2 B3 J# {' msystem by intercepting int 01h and int 03h and redirecting them to another1 R" T, ^$ w% m# k: f
routine., n1 R. t) j, E: C* F
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
7 m6 m6 z" K3 n! G7 B1 p* Wto the new routine to execute (hangs computer...)* p" m3 I" N0 {/ `$ _) {
7 P, H; ]8 h' {
    mov     ah, 25h
5 g! @2 O6 U: }    mov     al, Int_Number (01h or 03h)4 i% Q' E' c5 d+ l0 ~( c% I; x
    mov     dx, offset New_Int_Routine) y* S% x2 e8 e
    int     21h! |0 ^4 n( S! l9 A( G% S7 S
  Q( f, i6 V# b0 n6 z4 N
__________________________________________________________________________
8 h0 M/ w) b$ ^* F+ M6 k, Z
8 M& _+ H. p) u3 t  GMethod 09! j7 \0 H5 j$ u: ^* T
=========
8 X+ a, e' c" U9 A5 ?2 g* V+ ~2 x  G1 M1 \
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
& p' u3 W+ U8 Dperformed in ring0 (VxD or a ring3 app using the VxdCall).
. O/ u- ~) l9 d" t& FThe Get_DDB service is used to determine whether or not a VxD is installed
+ D* ?( c$ V: t5 B$ Mfor the specified device and returns a Device Description Block (in ecx) for
1 j( N6 d; x6 F  L8 P: rthat device if it is installed.6 H: g8 G3 X4 [
4 g9 W- l7 n6 P4 g
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID7 j) z( [; `3 H6 o2 E! d6 S# ]" L
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)* e2 N8 N8 ?# ^8 p( F2 _9 E
   VMMCall Get_DDB" \0 `; b" L+ y1 n& l3 H
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
) |- }4 ?& u0 Z! v( i) |5 g' d, @: u0 R
Note as well that you can easily detect this method with SoftICE:) Q, e) k4 D% x+ Q; q
   bpx Get_DDB if ax==0202 || ax==7a5fh
9 _) q) Q  W4 q' ?+ p+ p  A  `4 D7 w" ]6 N' y9 t0 e
__________________________________________________________________________
% Y+ f' l0 V4 p) h% p. U. A5 E: C% b5 K& P1 z) v/ l
Method 102 T, q) h7 ], B" j- ]
=========1 p9 k2 H0 h0 J- }( ^+ d$ o( m

6 i% K1 l- a9 M  f  x=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
, t6 M7 q9 O$ D  SoftICE while the option is enable!!. C2 z3 `: T/ Q+ Y( Y0 n& n9 L

% j0 `& |; U/ B5 [( M6 |This trick is very efficient:
- H% H3 }' C- eby checking the Debug Registers, you can detect if SoftICE is loaded
: q3 Y1 V4 [5 x8 g(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if* v1 v- ?& O( _# L
there are some memory breakpoints set (dr0 to dr3) simply by reading their3 l5 x6 K! ~6 c( {
value (in ring0 only). Values can be manipulated and or changed as well. H/ ~5 k4 m- ]) I3 u
(clearing BPMs for instance)
, c5 S8 _2 D( U6 [+ \* W7 [+ J# W' B6 Z) @& E( T
__________________________________________________________________________
" p, X; X' Z# {! |" |0 j& B/ N$ c& H9 ~% u8 ]4 D/ c
Method 111 w, I3 d* n) |; U
=========
7 K' r0 J( }' X% k- h9 I( L! d5 L1 C' [0 u$ N' r" ?  N4 r
This method is most known as 'MeltICE' because it has been freely distributed
; R7 L4 Z0 O5 J4 Uvia www.winfiles.com. However it was first used by NuMega people to allow1 w  u% a1 c, K; S4 K
Symbol Loader to check if SoftICE was active or not (the code is located
9 K+ H5 b# ^" r8 N' c) [inside nmtrans.dll).
+ R4 k/ l4 D8 C6 H1 q% T' p& K: Y; N0 I+ b
The way it works is very simple:6 n! \" r! T6 S: I1 o' a. r
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
9 q4 S  e0 z' Y1 NWinNT) with the CreateFileA API.
: \6 n( \" l8 d7 |# l! r
' T6 |  M: u# x# N0 CHere is a sample (checking for 'SICE'):
6 r1 b7 c$ f8 H' ~7 s& M" J( V# U
BOOL IsSoftIce95Loaded()
* M7 N5 L3 d3 X0 I: Q{  ]6 l0 o  G6 d2 f4 Q0 X/ C8 q
   HANDLE hFile;  7 A1 L: g8 L8 M
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
  m8 m" I! k- b/ K( F                      FILE_SHARE_READ | FILE_SHARE_WRITE,
1 Y. P/ t1 B4 |* l! G! F                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
9 S  ~" i, v2 H4 s" l   if( hFile != INVALID_HANDLE_VALUE )
6 I" \( {/ n7 _! ~( K5 c   {
2 H  @$ I- W& W/ O      CloseHandle(hFile);
6 Z: r4 L+ Y- u, F" i0 K- ^% ?      return TRUE;8 B( x0 `# h3 U5 D, ~
   }3 d% B* u/ R5 _& h0 w: ~7 c
   return FALSE;  K' T& Z9 s# s5 p5 u; |
}
; T6 k) z! W  ~* ^' z7 `
3 ~( m  S, C# ]$ NAlthough this trick calls the CreateFileA function, don't even expect to be' L5 F2 T" U1 m& L0 O2 r
able to intercept it by installing a IFS hook: it will not work, no way!% S+ w( @/ h& ]
In fact, after the call to CreateFileA it will get through VWIN32 0x001F9 p8 q- H; v4 H( E* c/ e9 s! u
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)1 ?9 G6 Q. r4 A. @- T8 B  p& t, r
and then browse the DDB list until it find the VxD and its DDB_Control_Proc2 O+ X0 \9 r$ A
field.
+ u( W; p1 E! }: M# g- zIn fact, its purpose is not to load/unload VxDs but only to send a # m7 w& H/ ~. O" ~; z* N7 F- |* V2 c
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
) T' t6 h/ N$ T2 M" p$ Y6 o3 O/ mto the VxD Control_Dispatch proc (how the hell a shareware soft could try( p0 S4 @6 w/ G$ X8 m
to load/unload a non-dynamically loadable driver such as SoftICE ;-).  f: ~/ q) M% o
If the VxD is loaded, it will always clear eax and the Carry flag to allow
$ B6 t5 M; [5 ^5 Y# `3 jits handle to be opened and then, will be detected.! x: |% s/ m- {+ `
You can check that simply by hooking Winice.exe control proc entry point! r  o& v) ]" v2 p+ t' A
while running MeltICE.
' u0 ]6 d# v4 C! Z9 @, z
% V9 h% E# ^: S
: f3 I- u; f, @: v# L8 m  00401067:  push      00402025    ; \\.\SICE
0 {: ]: l" ~- }' C6 ^  0040106C:  call      CreateFileA
" N% m& [/ H1 |+ c7 r! A( m$ |  00401071:  cmp       eax,-001  l2 a; {; j" n/ C  H" w9 j
  00401074:  je        004010914 d2 b" j6 j8 {/ }- C5 {% L& l
: J( ?+ L! w+ C( A/ B! f
1 {3 q) B9 z7 c' p6 k
There could be hundreds of BPX you could use to detect this trick.
( b  _+ y% E; \6 r: b8 q0 M-The most classical one is:, N0 @6 @7 B/ b  F( X
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
8 {. B) k: J; ~) V1 N    *(esp-&gt;4+4)=='NTIC') Y# {( V) L+ e, w8 p

' P, @  K  z3 i8 A9 X-The most exotic ones (could be very slooooow :-(1 Z, [  c( T$ G$ P) A: ^
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
* ]3 d& m! z  b2 z5 |# N7 g     ;will break 3 times :-(
0 y. C# @& r: Z% S2 O1 y8 C) o/ r6 F, q  C- G( R
-or (a bit) faster: & r2 \6 t# f+ l3 E
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
" P7 K3 @% D0 ]- O' h- Q
5 S% D; m9 N  C4 T% c   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  4 c4 y- _! B5 G6 r4 J' j0 x
     ;will break 3 times :-(. F; p+ g5 _- O; `  p
8 m! \! ]. k5 N$ ~9 l, y* e
-Much faster:
/ j5 m3 q1 [* |0 M   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'% G, f1 h$ M& e# k: Z
8 K) H, W& r& e' \6 d& {& H, o
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen' J6 `0 Q: `. i; G" t
function to do the same job:
% n) \8 {% j0 g
- W! v8 z2 u. g6 M7 }8 E" x   push    00                        ; OF_READ
1 \% ~) G, q. |5 T& L4 M   mov     eax,[00656634]            ; '\\.\SICE',0
' x0 V8 n4 l& l* y. R, u+ J, K   push    eax" ^* W" a( a. {1 T5 a+ ?+ I
   call    KERNEL32!_lopen
% ~1 K8 g# I6 y9 c1 Y   inc     eax
$ _! d% B6 {$ R% u7 S5 q8 x   jnz     00650589                  ; detected4 z5 T1 @/ A7 R
   push    00                        ; OF_READ
% t, v- {# Q' j   mov     eax,[00656638]            ; '\\.\SICE'
! y7 B! @+ H/ _( d4 f   push    eax- D" o, l8 D' J. ^
   call    KERNEL32!_lopen
5 n; S, j. y4 K; x" e   inc     eax
( U: \# d& f9 M& _  w; [( R# H1 l   jz      006505ae                  ; not detected
% A& b: J3 P3 c2 R3 p/ |2 c7 ^. O( V# V
: v! P" v- Q6 m  G  {+ C# ]; ^
__________________________________________________________________________! E% [& B3 f6 N

' H! _# M2 x! X' Q& p& k! ?Method 12/ ^! S! {, O& r3 e
=========
$ v# ^: P" a9 E( j7 F/ A& o7 t7 h% C
This trick is similar to int41h/4fh Debugger installation check (code 05( |& N, g7 v3 o# Z) I* n+ G! s
&amp; 06) but very limited because it's only available for Win95/98 (not NT)
4 l8 @- p3 O# s2 H/ D1 g$ Oas it uses the VxDCall backdoor. This detection was found in Bleem Demo.) a; [* S: w, b/ O7 ~/ E

4 T8 x# w/ X7 [" N6 d7 R   push  0000004fh         ; function 4fh
( ?+ Y0 A4 \) E8 P" D5 [   push  002a002ah         ; high word specifies which VxD (VWIN32)
' d9 r! e- ?9 j; c  g* W. E                           ; low word specifies which service
! c6 S9 |* j0 a$ l3 V+ a                             (VWIN32_Int41Dispatch)8 H( e0 ~" M( p
   call  Kernel32!ORD_001  ; VxdCall6 j2 P/ z) e! L' Y
   cmp   ax, 0f386h        ; magic number returned by system debuggers
: r, q0 A$ Y* F9 ]+ m5 N% C   jz    SoftICE_detected
- o- F. C: g& Y% j* a
" B( T6 T5 |; h0 pHere again, several ways to detect it:
! Z; [# P3 E$ @, ?  p3 K& a, ]8 h
    BPINT 41 if ax==4f
+ Z6 U7 T8 c0 i) s9 Z+ S# v" H' J% `+ R+ g* P" H
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one  `; \  C+ l5 ^1 z% w( u  r
0 E" w/ p9 T% _! f
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
) x2 i# v+ c9 E7 X% \( x3 V4 q# P0 [$ t" G3 M
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!- x( p$ d3 F: N2 B+ Q, |

2 r2 P: t: B* p, {6 D! o__________________________________________________________________________
, H6 M( l  X) y$ L
2 K5 U" M7 p/ W- }1 ~: n2 @Method 13: @7 f/ k  e8 K) Z2 ~  r
=========, e6 F4 ]6 j9 V) L+ e1 L
* v  Q, t/ w+ y5 D4 g5 L5 k
Not a real method of detection, but a good way to know if SoftICE is! `/ \$ R: v, W8 _) Z6 F. l
installed on a computer and to locate its installation directory.
7 D1 I: ~9 ~( P) o* t6 B2 VIt is used by few softs which access the following registry keys (usually #2) :
  Q; ~, Q( Z+ S
2 V# K4 ~$ w% q4 A% a9 j-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
1 g/ e( \& T* K. h  e2 w\Uninstall\SoftICE
3 Q; J6 G1 j$ Q! d- a-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
3 r) d/ `8 u5 h* ]" L4 m) }. d2 U+ U2 T-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion; X9 b* B( u% O' R% T2 T
\App Paths\Loader32.Exe
4 H! X4 u4 p0 k  D5 B' v1 j" X& s
2 ]# I4 V! c. r9 b' H5 K( p
' V7 d: T! q6 l, P& J& @1 t5 t( s+ vNote that some nasty apps could then erase all files from SoftICE directory
0 s. K1 c8 }6 q6 K% [(I faced that once :-(/ L+ ^5 P) i- o) |4 n
7 }+ ]+ p% |" S) w
Useful breakpoint to detect it:3 e: L. D1 x, V3 l6 ^+ W# W0 `

" r3 v& C8 Y$ R     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
4 l4 a5 p- T' Q+ f; }6 V7 `8 e* d4 u) V: d0 @) Z  C0 [9 ~  U5 {
__________________________________________________________________________$ u- v6 m3 y# m4 C. L

- B) d# u! Q1 z& j- R! x# W
0 F* q; J$ s7 U. k2 t0 pMethod 14 ! z- p. K& b! o9 D0 `% R/ r
=========! `3 E0 W4 I; E: ?# N8 Y5 N

& M3 Z1 B. ~9 X) X$ L0 RA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose- p  E) @3 V/ A/ `
is to determines whether a debugger is running on your system (ring0 only).1 N  R, K0 c) e- k, E: x
6 |) a* g3 V! R' P/ i2 ]4 q
   VMMCall Test_Debug_Installed  j5 ?+ v# B% t
   je      not_installed# f4 }; M3 O' p: Z

1 h% {8 g- _; `$ QThis service just checks a flag.% M2 s& _3 Y& \9 b2 c9 \, t' x5 S
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-8-19 00:43

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表