About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>' B! l' M( {4 u* c/ E6 n$ R1 ^
<TBODY>3 H5 g' o& d* G2 Z' a5 z8 l+ i
<TR>' m4 c, I8 T, d) |: L8 N: m
<TD><PRE>Method 01
3 k9 q' C$ m( A! y4 j) Q=========+ Z5 U/ C5 F, ], u: M; ^

! Z& S; L, g3 \, D% wThis method of detection of SoftICE (as well as the following one) is; k5 B- t1 W# {) u1 y8 t% u
used by the majority of packers/encryptors found on Internet.5 ?5 s* Y- m6 U) N% K
It seeks the signature of BoundsChecker in SoftICE
" e7 P& w0 T+ m) w; Z$ D7 c* x( B' f+ q$ k6 w% {; Y
    mov     ebp, 04243484Bh        ; 'BCHK'5 Q4 A$ F2 d; D; v
    mov     ax, 04h1 c' M" N% X/ n5 b
    int     3       . w" l! b. C5 J3 T+ {1 d* L
    cmp     al,43 ]4 _+ f2 L( d# u# A0 [6 C! {
    jnz     SoftICE_Detected
% x# W2 P6 \) H" A- p3 u5 u2 m
___________________________________________________________________________9 D- @1 e/ F5 ^

/ Y$ V& {( m# V% N4 e0 q, q& f, _Method 02
/ t, _' `; {/ Y/ N' u4 ]+ a7 i; g=========
4 a! F) D! o6 G- p) U* u4 ~0 Y$ Q* |% \! g. O
Still a method very much used (perhaps the most frequent one).  It is used. E* y* d8 ?9 V
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,. E+ z7 V' O% c' b" F% S& q
or execute SoftICE commands...( _- @" g3 ]! |3 m# {! x$ E
It is also used to crash SoftICE and to force it to execute any commands
1 U& B$ u- n1 `# d) s0 f(HBOOT...) :-((  
7 X4 ^" \2 T2 I) f/ O; Z
; Z* ~. S+ W8 Z2 [8 QHere is a quick description:
4 ?$ g' H( E* Y; _6 |& T0 n-AX = 0910h   (Display string in SIce windows)- i) b/ p8 f2 O+ G4 h4 S
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)) ~. {. R' d# Y" M; g) z
-AX = 0912h   (Get breakpoint infos)( K1 h7 E0 k6 U! b9 P0 M2 K& C
-AX = 0913h   (Set Sice breakpoints)
* s7 ~/ ?. H! C7 b) [-AX = 0914h   (Remove SIce breakoints)
8 {& ^* D+ B+ a) e8 K0 F# G8 L( g
3 h9 z2 t6 `1 B0 d- F+ V( ]7 UEach time you'll meet this trick, you'll see:
( W0 U) i" v8 ~4 J! ?( I2 C-SI = 4647h; Q  Y2 D; p3 A3 r8 ?9 c# z. f& l
-DI = 4A4Dh
& {, R( U* Y- s* P4 Q2 f' R. g# HWhich are the 'magic values' used by SoftIce.
) R8 k* N3 l: C1 b& n) _2 OFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
% I4 y' D+ e  O1 b, F* Q, J* w* t  O: x
Here is one example from the file "Haspinst.exe" which is the dongle HASP
% c% o. @1 B1 k/ yEnvelope utility use to protect DOS applications:
- }: \% e) D3 E1 N4 A
5 i% k" m3 {* N, B3 s7 m6 i
: v: z! X5 L; ?* C$ C9 Y4C19:0095   MOV    AX,0911  ; execute command., g. r& \7 a4 k; {  c4 X' O, E, e- N
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
+ S* N" @- p( L# B9 O4C19:009A   MOV    SI,4647  ; 1st magic value.% Q) ?( e$ W- L6 w2 m; e
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.5 Z# E' J. c) O. @( `- c7 T
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
0 s0 w6 I+ {+ h0 E! e! p4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute- N' v2 ~, ?: O$ a( ]
4C19:00A4   INC    CX+ e1 f/ Q4 ]# M" y% C4 |
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
, ~. m7 K) [! `3 j( _4C19:00A8   JB     0095     ; 6 different commands.
1 X4 c" _' e+ C/ U, y" J4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
8 J( P6 o) e0 l+ c3 G4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)' i$ s  w1 v0 p, d( J4 a
# J* ?+ h, d: e5 ]% h+ D0 K
The program will execute 6 different SIce commands located at ds:dx, which
, }. ?' ~0 N: b. \are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
+ W* l6 {# M2 }  F2 E
$ @4 a- H7 k% _1 C) w6 \4 t* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.& D8 x# s2 z. i
___________________________________________________________________________
$ |8 E2 H. G8 S& C$ `/ ~' J, {+ R" @4 H- @

# z5 w% u/ w! mMethod 039 k7 a' [6 K- e' F3 ^
=========$ c5 X# d. {4 u

/ {+ R% Z0 Z6 f+ m$ ^Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h$ D# M# q' [+ P
(API Get entry point)$ j+ K# n. c. @" ]4 D% `0 E- i
        
8 R4 D5 I  n! `6 ~
! O* S+ \: E& t7 ^% b    xor     di,di& L1 ]( x9 B* b" Z2 K2 j
    mov     es,di. A: c5 b, p2 M+ ^4 f, O
    mov     ax, 1684h       ! I& m& W- H8 j( ~9 {) F( }
    mov     bx, 0202h       ; VxD ID of winice
" p" W5 z$ ?/ d+ l; w7 E    int     2Fh4 J( e% w/ [8 m, t( ~1 G- {
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
# x, V7 f$ ]; d" s! M) }. _+ _    add     ax, di: j- v/ v+ h1 r6 |: ]" K
    test    ax,ax& H! k8 t3 d5 N* a2 A$ B7 K
    jnz     SoftICE_Detected: \4 U: x( F% g, `* w1 w% d
2 i: W$ ?$ j- y! A# H
___________________________________________________________________________, l: a9 S1 D# _* ^9 n# U

' e! H  y" X' z* J3 mMethod 04: d/ K2 G/ j- n+ e
=========
- C( u3 g( ~' H, n& U5 o3 f" ?4 ?3 w3 \1 f. _
Method identical to the preceding one except that it seeks the ID of SoftICE
8 p) `: u9 ?  i3 Y7 cGFX VxD.
& d' s1 ?5 |, y' I7 U
. K1 v1 C6 e- u: `& u    xor     di,di
' ]1 i& N! Z2 u- e    mov     es,di3 \7 W: I# u' y" ]5 s5 M% G2 O
    mov     ax, 1684h      
0 m6 j2 B* Q2 U1 v# k7 I4 B+ H" O    mov     bx, 7a5Fh       ; VxD ID of SIWVID
6 J* F+ L2 j* l5 u9 r$ y    int     2fh4 F9 y% l8 e' w" v' F! i
    mov     ax, es          ; ES:DI -&gt; VxD API entry point; ~) M) y6 a+ l0 b7 Q
    add     ax, di- n: [+ N% _) F
    test    ax,ax
, }- Y) P8 G0 J: M- S6 ]    jnz     SoftICE_Detected
. a- P9 _6 ~& ?: y& O, D
( U" D1 R2 Z- {. o4 [# s+ a. F. u__________________________________________________________________________, D) f% F$ K  I' h6 \
' p7 v. k4 D2 K/ J$ h
; W+ m. Q5 }9 S4 D5 T5 Y; h
Method 05* G9 i: U6 N" S$ d( N5 {2 R
=========
! j4 k; E- N& }+ D  [6 S
0 F8 Q, s; _$ gMethod seeking the 'magic number' 0F386h returned (in ax) by all system) Z% r% P  @$ `; f  [7 Z! C/ {
debugger. It calls the int 41h, function 4Fh.; c) U, B1 F9 t* p5 [1 U* }
There are several alternatives.  
: y$ e% k) e* ?7 R; V" z- k- \; k* C4 k* U; O* `5 w
The following one is the simplest:
+ f6 {6 U* e, B. y* d2 L' V/ D2 ^3 K0 R
    mov     ax,4fh
$ O$ L, k; |: t( ^) @' f  O    int     41h, {; D7 K  p0 B4 E. r8 a
    cmp     ax, 0F386
& p/ D" i/ N: W% z5 u. Z    jz      SoftICE_detected+ s' R4 [$ b2 L, [3 |

6 r0 T* r! M: f3 ]- j/ l) r
6 s% @7 d  L. X9 w% X9 \Next method as well as the following one are 2 examples from Stone's
- X0 n7 |0 ~, i"stn-wid.zip" (www.cracking.net):& u) k' D3 ~: @. X
: W8 s: s/ ~+ w: O" ]
    mov     bx, cs
7 C; Z/ ^- V0 Z: n- V    lea     dx, int41handler26 u7 [- M  t2 Q: V; i
    xchg    dx, es:[41h*4]
7 O2 H) r' }6 J  ], Q7 ?    xchg    bx, es:[41h*4+2]9 Q. t" G9 `7 X
    mov     ax,4fh
, T" O0 d& U  c* o    int     41h
  w% q% _# t* d: D4 z. T$ G    xchg    dx, es:[41h*4]- H8 p6 ?8 m7 K) Y5 _5 x$ [  L+ p
    xchg    bx, es:[41h*4+2]4 x: g0 [" Z- l2 R3 W+ Y0 P0 k; O2 ^
    cmp     ax, 0f386h  r4 k: e2 Y0 w2 p: w
    jz      SoftICE_detected" R8 `) R4 n0 E7 g) d

# h, W% h3 H: {& T. l( b7 Q7 G/ c$ `; Jint41handler2 PROC1 B$ \9 h: w+ y4 m
    iret7 _7 l. M2 D8 w3 ?7 L9 |1 h
int41handler2 ENDP/ \" k, A1 w. g

6 ^5 @+ ]  ?4 w4 u+ D
+ U4 Q. h/ U; g& F+ J3 o) U# m5 Y8 k_________________________________________________________________________' ^& g% K5 H' ^5 w3 K

5 K2 b$ n: q* ?, m& L% P2 L4 U6 |4 i
Method 06: m8 d7 M: R+ T$ \) Y4 c# P
=========
' F9 g! B) }2 ~% l' A
3 O$ x7 T! d6 R& |: E; b' n  ^/ f* c+ F5 }. x. S; T2 U+ @
2nd method similar to the preceding one but more difficult to detect:! J. `" L4 g0 ^' x! O% n% A1 V, y- Z

2 N! x" c( I4 A! M( g( t
: C5 g. D7 h3 G$ l! tint41handler PROC& ?/ ~/ o, z+ x. }% l- {) ]
    mov     cl,al
, W6 ]4 E0 I9 s+ S( R* c7 v    iret
- h; Y2 x0 N. I) M3 gint41handler ENDP& @  L5 r7 r7 H! D7 S6 x' h
+ D4 u( I! W. Z- }- p4 t

0 V& [$ j- y1 s% M/ r    xor     ax,ax  s) K" o. a% M- ]1 y; [; A- u
    mov     es,ax8 e+ J; ?9 P9 z/ A' D+ T
    mov     bx, cs( ~2 G! c- r* h* s( ^
    lea     dx, int41handler
2 o. U0 `8 R- Z1 B    xchg    dx, es:[41h*4]  f, g' B2 `6 a; d; K- K' h
    xchg    bx, es:[41h*4+2]" h( q) t$ n* s/ N" C1 ?
    in      al, 40h$ w2 }/ B  U) @: C
    xor     cx,cx# l' S8 N' U) k& ]
    int     41h
3 f; E* p% S/ C" O) }3 a    xchg    dx, es:[41h*4]
" ]/ R- O4 `4 E9 V5 }: n0 F    xchg    bx, es:[41h*4+2]8 q/ F6 b$ j% Q' N. I$ D1 F% c, ?' ^
    cmp     cl,al
1 O4 Y6 i! t' u: {: i7 M) t. \    jnz     SoftICE_detected
/ t+ q6 s+ X: N- |6 [1 i; K
# {; G  @7 E( U4 l: ]; }3 g_________________________________________________________________________; t8 x0 E# }1 p/ S4 y6 I

0 u7 _  \4 u/ LMethod 07
" b+ D& W; x" \' a=========# g% ?5 h0 l, w; X# J# \
2 z4 \8 c$ H/ ^$ H+ B( S
Method of detection of the WinICE handler in the int68h (V86)# R+ ^! \( C+ w& P3 U" [7 K" P
2 f/ @# Y9 N( T6 c. ?
    mov     ah,43h
5 U4 Y6 r, c: f  `1 V    int     68h
7 i  d0 Z( _  d    cmp     ax,0F386h; l6 p' D& }9 `5 _" g
    jz      SoftICE_Detected: f# V2 J/ B- C

6 m# C$ p) w' B- W1 s
. a6 v" R# f& `5 _=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit+ P# h- `5 f- h2 ]0 S5 ~& Z! e
   app like this:$ b: @' P( K9 Y! x3 K* T6 ?1 y

& J) f8 z& o7 Z( O: A   BPX exec_int if ax==68; w. r3 i8 `! t* Y! X* T+ Q
   (function called is located at byte ptr [ebp+1Dh] and client eip is
) l4 g. x- H; x9 n; T: @* w9 _   located at [ebp+48h] for 32Bit apps)
: p$ z# f/ k1 z) K1 a$ j. y' ?2 u% X__________________________________________________________________________2 t  M8 v4 m4 _* [  ?. ~- i: c
# _2 x& s4 O* A4 f3 V3 S" j

% S' z& c$ G5 _+ K: ], W- r3 zMethod 08- L" V* t6 T- C& y9 s. u8 @
=========# M" T9 k) Z$ s& _1 I0 a3 L

5 w' I* G6 u  g' \) `It is not a method of detection of SoftICE but a possibility to crash the5 ~5 E  E' ]0 h- Y8 t
system by intercepting int 01h and int 03h and redirecting them to another
4 O5 |) B' L$ w0 c! n  k0 Uroutine.* ?: M) ^3 F7 E" j& p
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points- C  {$ c0 _" W- q$ B( A4 z
to the new routine to execute (hangs computer...)0 X, I( A/ A" }, N
  C- S6 u& T& c* U4 b; c( x
    mov     ah, 25h
- b' D6 k5 q4 G1 [. f% t    mov     al, Int_Number (01h or 03h)1 v( E0 f: p; h1 q9 x# P, [
    mov     dx, offset New_Int_Routine( u4 P# f) A8 ?; x' V" ?( W
    int     21h# x( j8 |* a* M
/ X. `! N) X$ U4 u' n
__________________________________________________________________________3 K2 M/ Q) R9 k" O0 t4 w# L: M9 N

( G8 @; T, D9 P8 F4 S9 \  GMethod 09
  |! A6 f& ]! p1 O- T) f* r=========* N) E( A: _% Z- H$ x2 Q

+ E$ P$ Q2 i" L5 B/ }2 OThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
0 M! a1 |* N7 nperformed in ring0 (VxD or a ring3 app using the VxdCall).
" c$ {# ]1 e% V; Z, {5 BThe Get_DDB service is used to determine whether or not a VxD is installed
# [( s* h, b" c0 m7 Efor the specified device and returns a Device Description Block (in ecx) for
+ O4 m/ A0 k$ m+ _4 x/ Pthat device if it is installed.
1 @4 V9 c0 }6 A: X9 h; Z& h
2 D9 [& k, t. O/ `! w   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
; w4 A( [0 z& P* l   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)$ e$ ]) j  U2 \
   VMMCall Get_DDB
: A1 B; H: m% Z0 E   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed1 f& n$ @* l" f7 Q

3 I7 j0 k6 s% l( f) B0 ?Note as well that you can easily detect this method with SoftICE:
3 t; n# h5 Q' P6 ^   bpx Get_DDB if ax==0202 || ax==7a5fh
; y, q) t& `/ r' A3 O# b* n& o; K$ s
__________________________________________________________________________! I: {* U; y+ B& a

7 o& g! r% g, y! Y0 [- dMethod 101 A5 c& X% a8 Q! n0 X+ N0 b" I8 D7 ~3 m
=========) X0 a' Q) A9 |: g4 |* X/ g
- o' r" {. @$ j" x. `& e
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with- [4 L! n3 |& ]# D: o, h+ ]
  SoftICE while the option is enable!!
2 t# d  z3 V5 m) K0 \' u4 ]4 v7 W* Z( J/ z. b6 i4 `
This trick is very efficient:
5 J" Y' d2 y. ^! v; J; Dby checking the Debug Registers, you can detect if SoftICE is loaded
* B. J; B+ ^0 {(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if% p+ |/ f# p  ^8 l& e: w$ X; I
there are some memory breakpoints set (dr0 to dr3) simply by reading their
) \- r. D2 v  G/ {6 I* w4 u3 ^- pvalue (in ring0 only). Values can be manipulated and or changed as well5 s5 Q- J& K, W9 }/ B
(clearing BPMs for instance)
; @* Z/ q6 _( t5 ^$ q, H! P* Y7 q
__________________________________________________________________________
) n' W0 y, b, @/ i5 g0 ?5 v; M. a; p
Method 11+ j  f2 {6 H2 x& ?% \
=========2 r5 W5 R0 L( _8 x- f2 ?7 K' k
$ K" U* @' ~& ^! u9 g5 [
This method is most known as 'MeltICE' because it has been freely distributed
2 ~+ ]' J. K- G+ ~- U2 Z% ^via www.winfiles.com. However it was first used by NuMega people to allow
! d. w% P+ j" t! v# i# J& W" u" ?Symbol Loader to check if SoftICE was active or not (the code is located8 z& O: H4 d) l; m/ u$ `. F
inside nmtrans.dll).. u. {% i/ `- v
' l2 v& P( V- ]
The way it works is very simple:
2 W5 h1 F" a  V1 YIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for+ [7 e9 A+ Y% J- g, r3 O( z% W
WinNT) with the CreateFileA API., @% r$ P' N! n( b. e) \

2 M! g9 |, |' F' KHere is a sample (checking for 'SICE'):1 [# c/ [# l6 m0 a* [% u! [$ }

. T2 ~# F& W2 nBOOL IsSoftIce95Loaded()3 S+ ^0 A0 a' j* z
{5 {$ c& A! _" }: l  Z
   HANDLE hFile;  
) d* k' P  l, A$ @   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,& B- O7 s7 Z* u
                      FILE_SHARE_READ | FILE_SHARE_WRITE,
7 m* N4 h6 D) t+ f; x" H$ [                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);( E. Y. A6 T/ t2 g  l
   if( hFile != INVALID_HANDLE_VALUE )
' M3 b/ b* i$ W* |$ ?   {+ \" m" J3 A3 Y- C
      CloseHandle(hFile);
2 x  d' R- I1 |4 W# s4 d* d* w/ t      return TRUE;
6 @& S, x& ?: K1 \   }
/ Z8 r1 y: w1 U( e% z& o" A   return FALSE;( v& _. Z9 w$ ]% l" ]4 B; X
}
  w7 o! U5 k2 ^% X2 Y, d- n
$ f8 l1 c% h$ U- v* gAlthough this trick calls the CreateFileA function, don't even expect to be
6 A' p/ P$ O7 a3 P$ L9 P4 {2 M  xable to intercept it by installing a IFS hook: it will not work, no way!
2 v6 Z9 y2 r) G* w$ A. aIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
' p* X6 f/ u* h4 n: A) b1 I  M: N" [service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)5 ], \' x  a( y- Y, a8 Q6 {
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
1 B' P* d0 S' i' i" ffield.
$ V9 W9 A4 v, N! UIn fact, its purpose is not to load/unload VxDs but only to send a 9 Z( I  c; R; C# Y
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
. _; Q; w- R. \# I- a4 Uto the VxD Control_Dispatch proc (how the hell a shareware soft could try
; r8 `9 g4 n8 u. W; {' rto load/unload a non-dynamically loadable driver such as SoftICE ;-).4 R' W! S  e3 x/ ]2 A
If the VxD is loaded, it will always clear eax and the Carry flag to allow* ~( f9 O2 l5 Z1 c9 Q8 f! J
its handle to be opened and then, will be detected.* H. G& w# {9 z  T! s& e$ a
You can check that simply by hooking Winice.exe control proc entry point
; {, r7 X4 a8 B0 Y' c+ N% W, I; `& Wwhile running MeltICE.: r: P! S. v" Q  x2 r9 G" s- |, M

7 K% C6 n9 p1 \( @3 [" y0 }6 d: J' p+ U
  00401067:  push      00402025    ; \\.\SICE5 f0 E2 ^; _" `! X/ _' A' h: n
  0040106C:  call      CreateFileA
! w3 C) B  [6 l% {1 m  00401071:  cmp       eax,-001
8 ~2 C4 ~- V* i; q5 u5 a  00401074:  je        00401091+ @& Y( ?7 X2 z

9 O; g7 b" ?# z$ ]$ X% C: w. @( d" k/ l) g. s, p) s- P
There could be hundreds of BPX you could use to detect this trick.
/ G. s, M' L% k-The most classical one is:7 g' m, a* }4 L7 f- g1 g
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
  T8 {5 N5 X/ |& c1 k9 }    *(esp-&gt;4+4)=='NTIC'/ Q# R, Y0 @0 n, h& r$ B' m
4 W3 f! |. K- p) k! \5 S  `
-The most exotic ones (could be very slooooow :-(6 a; t/ q8 M( V5 D0 U; ^
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
* D2 K2 U( {. R- L5 Z& M; t+ @     ;will break 3 times :-(1 r- ]9 g6 N, K, t( \# _2 k. C) a
1 B  w7 g' W, q# x, r
-or (a bit) faster: ' e0 E2 }* Z1 u* C3 b' @% v# H
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
% P" X/ [; V" K) \5 K7 h2 W+ q: Q% f8 R3 u. M3 x0 N- n7 p' d0 `
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
2 R0 z" D* U) h( b2 c: v! B5 ?     ;will break 3 times :-(
3 j+ [6 Q* [# j% ]; k/ ^4 {, |% g1 d" T2 W9 g) A9 i/ S9 o5 |, }/ t
-Much faster:
: g( p5 _- T! ~9 l   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
7 o, h/ X- o8 q9 E$ W: Q# t3 M( q4 z( h# ?' j2 z2 l2 `
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen9 \" m1 k& `' m; h+ A
function to do the same job:
. `4 f+ N8 a  q/ B9 S# Y
' @; ~8 u' m+ I8 k( x5 I  a   push    00                        ; OF_READ
' P5 t* j! |7 F- \, Z0 Y8 W! ~   mov     eax,[00656634]            ; '\\.\SICE',0
5 u2 z* G1 S) M9 g) u   push    eax
, ^( \" f3 g, U% X   call    KERNEL32!_lopen
! [' n9 C* ^' U" c- G) k7 F! _   inc     eax6 M& P5 c; D/ P( I3 q& E7 `
   jnz     00650589                  ; detected; P- Q4 M( A. M
   push    00                        ; OF_READ
8 f+ E2 q+ C, Q& |   mov     eax,[00656638]            ; '\\.\SICE', Q! j/ I5 i% Q0 b& q
   push    eax
1 \1 V; s8 N% X% T   call    KERNEL32!_lopen8 [0 U! S1 j* w7 r' w
   inc     eax
9 y# S% f4 {9 R4 R  s( \   jz      006505ae                  ; not detected
% p" B. K* b- `* E$ `+ ^( f' ~( d. y) f# F
( d0 B/ O% ?# W+ q) c
__________________________________________________________________________
  ^( \. L( @2 j* `& u: j- g, O2 I% }  o9 R# b9 W
Method 12
& }/ {) e6 x1 u, R+ q/ c=========' o3 ]8 p; y. ?* q& K
& q. K6 W- K# r: u8 g( v6 U
This trick is similar to int41h/4fh Debugger installation check (code 059 N+ z# d; j# n
&amp; 06) but very limited because it's only available for Win95/98 (not NT)
  j" U+ H" w% @  W  @6 Q9 Sas it uses the VxDCall backdoor. This detection was found in Bleem Demo.
7 i% l  c$ u% {! X" Z7 K
9 [; I% w- T' }1 M4 C9 p   push  0000004fh         ; function 4fh" N% L, U6 c! J3 A/ n
   push  002a002ah         ; high word specifies which VxD (VWIN32)
+ x+ h: i' h- P: I$ s6 g" j6 h* D- z                           ; low word specifies which service
# d3 l& B4 b3 ?! P) ~2 b8 Z+ B                             (VWIN32_Int41Dispatch)' i- B1 A6 n, I! w& u6 C
   call  Kernel32!ORD_001  ; VxdCall. M' o( o2 s9 V+ a& e# x
   cmp   ax, 0f386h        ; magic number returned by system debuggers
7 ?$ u) s" l7 v% \   jz    SoftICE_detected( o( Q* ?1 R! O9 _

8 x6 m6 c) D0 h6 ~6 c7 l( R8 R( THere again, several ways to detect it:* H$ @1 N2 {/ J9 R9 u/ Z! y

, E7 w+ [6 R, g5 N4 }0 X+ ~1 c    BPINT 41 if ax==4f
& A; U4 J" [6 N2 n$ U  y% ]- y5 S% [/ U3 V) l9 B/ n
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
* ?, N- k  Y, r2 O& @
6 i7 N+ Y0 Y6 n3 F$ Z! |- {) `    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
# A/ F. O+ e2 R0 j" @7 N' C6 W! @3 `* X1 V2 F8 Y
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!( L7 p6 k* t9 z- `2 n( \' `. G

# k& T! Z5 ?1 S3 o; w3 `9 a__________________________________________________________________________
# `* M  F! h$ m- B
" X# m6 z5 A8 r* d. hMethod 13. z9 h8 l0 S1 z" n! Z
=========
% _3 N. {3 r# j# w) ^! K2 n0 [4 s. K5 L: a
Not a real method of detection, but a good way to know if SoftICE is( `' t5 J7 @4 x; P" H1 U: @2 X6 B
installed on a computer and to locate its installation directory.. r0 Q- G+ e9 v2 T) ?/ x
It is used by few softs which access the following registry keys (usually #2) :
+ y& Z, E( p& p) b$ b& v/ W/ A
- [2 j/ ]7 F# y* m/ a5 \2 Q6 m$ k-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
4 v, K6 Y* w4 C\Uninstall\SoftICE
( Y" h2 L9 Y/ d6 F  u7 t-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE, u, N* k: V  A6 g
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion1 H0 v$ ]% w" }$ l1 F* u& Y
\App Paths\Loader32.Exe
1 w0 r9 T  O! a9 U" B. J# x
% x$ |3 p& T6 O
; J( J3 }2 N+ G$ L! r) sNote that some nasty apps could then erase all files from SoftICE directory+ `$ O  H8 j  l! ^3 E
(I faced that once :-(
. C/ |9 j/ ?, }3 C- _( g) H
( Z! \' `8 \2 sUseful breakpoint to detect it:2 h( F6 F3 m7 x, Z+ v$ h! j
8 L( w: I8 @! c8 E# P  E5 U
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
7 U+ }) c& m) I$ i' K
# l1 u% d! Y4 M__________________________________________________________________________- ?& \' `2 f$ }. R8 l

3 v. I9 ?0 r6 y6 @/ D
+ g9 ^) k$ f7 a+ R  ZMethod 14
( c; {) W" _* O=========
3 e8 ~, }( {- y* O! ~5 J7 K
3 t% Y/ x( d- c! T* f" aA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose+ f( p  U6 R! z- z
is to determines whether a debugger is running on your system (ring0 only).
9 N3 x5 k  |& {9 {/ `0 K
1 U/ n9 Q; [( m4 n. }   VMMCall Test_Debug_Installed
0 }' z) k/ g. G, z  p' o+ y( Y. ^   je      not_installed$ I: ~* @9 C; ]# P9 S

4 h/ \4 z: U( d( d( dThis service just checks a flag.
1 x8 t( @5 t) [* A" p( h</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部