找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>8 O% Q0 D1 Y, c6 @8 ]
<TBODY>
3 ~6 ^$ a. S. G3 p$ d<TR>
+ S  X$ g! |2 H8 \6 y/ I( z8 f<TD><PRE>Method 01 $ \7 f8 u5 r' ?8 J  c) P0 I5 x
=========9 g! n4 J, l4 N1 m3 O/ f5 U: a

. P" O% [0 |: r" |$ r# B: UThis method of detection of SoftICE (as well as the following one) is
2 a: U) _+ q( E1 ^9 W  u( xused by the majority of packers/encryptors found on Internet.* I3 L/ ~7 q3 B  \
It seeks the signature of BoundsChecker in SoftICE
9 h( L. Y2 ~) ?  z  {  c7 J& I
0 {( K  ~1 ?" g2 c    mov     ebp, 04243484Bh        ; 'BCHK'
" R- J" j% F' L6 c9 v& i    mov     ax, 04h9 Q* M( }! `0 P* z: C, }" e
    int     3      
1 [5 |' [+ t  ?  T$ |    cmp     al,43 y2 L" U( X9 P0 f( \* p2 o2 C
    jnz     SoftICE_Detected% I1 }% |. g$ C9 c

( x& i/ q. O5 |. J& Z7 |___________________________________________________________________________3 y* E% R& X! x/ ]

1 E' ?0 T( d; |Method 02
6 s& g: Y' K$ f& f* N! L& `. x3 U=========
( {2 O3 [$ T$ E7 |% t( D! P
3 g% a1 m7 `( cStill a method very much used (perhaps the most frequent one).  It is used
- y$ t- \9 U# r1 U4 E$ \# c8 V$ _to get SoftICE 'Back Door commands' which gives infos on Breakpoints,7 B) ?; Z- y2 |
or execute SoftICE commands...
. v5 j* |9 G* k/ ^0 d9 x& ]3 A# ^It is also used to crash SoftICE and to force it to execute any commands
: H: f2 |3 l  a(HBOOT...) :-((  
: b; T: v1 s# D
* ^/ }  X$ a6 W. G2 RHere is a quick description:
  u; @; q5 y' i" d/ M* j, [" `-AX = 0910h   (Display string in SIce windows)
, Y( p$ M8 i) r4 f-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)2 f2 ^8 U1 U* q4 e7 E$ ~
-AX = 0912h   (Get breakpoint infos)
& \( m9 {- H6 b) U-AX = 0913h   (Set Sice breakpoints)
( _. N) a: V5 B9 L* f( }-AX = 0914h   (Remove SIce breakoints)( ]/ D4 Z$ p: [

0 P: t2 H! `) d+ {8 L4 [Each time you'll meet this trick, you'll see:
. k! S4 e& @' e-SI = 4647h0 S5 M: ~3 R' O2 q6 |( _
-DI = 4A4Dh
2 J: K! V% A# j6 eWhich are the 'magic values' used by SoftIce.! p$ a& C& g$ F+ M$ B) ], R) O; l
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
0 f8 o; Y/ F) `' q  s3 l& R' U. D7 l% I+ v
Here is one example from the file "Haspinst.exe" which is the dongle HASP
8 z  q+ V2 F% T7 I, tEnvelope utility use to protect DOS applications:
+ r( B7 N/ I; t$ O: R- H& \6 k: e. D; j
" q5 ]- n. d: Q$ J
4C19:0095   MOV    AX,0911  ; execute command.: q$ N" A2 M. f, t
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).' c" \+ Y* L0 e0 K9 ~
4C19:009A   MOV    SI,4647  ; 1st magic value.
& ~  h0 I* n5 O4C19:009D   MOV    DI,4A4D  ; 2nd magic value.1 q( e8 F2 e( |* I' W
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
3 U6 u" p4 P+ R- H2 E4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute8 B% U* w2 k. i; _7 `, I
4C19:00A4   INC    CX" u: Z) B/ i" ^. a
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
) c$ \6 L) \; N  u4 U4C19:00A8   JB     0095     ; 6 different commands." ?8 `  Y, e" E8 A5 R) |5 D
4C19:00AA   JMP    0002     ; Bad_Guy jmp back., W  s+ }$ P; T; E4 p
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)$ x8 o) A" B. @. s

2 P# u& u+ N0 j; sThe program will execute 6 different SIce commands located at ds:dx, which+ z5 l" P: s& s/ ?  d$ Q5 J
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
" S( Q6 Z7 L" \0 k: B- ?# ~
( V( U; x3 N' J* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
5 w9 |; ~. h1 s' k+ }) X___________________________________________________________________________
- B- F4 n2 j2 ?+ n7 y. i- u4 Q6 f7 m5 T  |" Y

% {& R; _* J' v) Z% a( w1 g$ O7 bMethod 03
( m  _" f6 Q8 K. Q=========
: x9 o2 g0 S. v  _
" v8 }8 V/ J* v4 ]2 o. b4 rLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h7 x- e( Z0 ^  h1 B! v
(API Get entry point)
* U! p- V& C0 L4 n        
" B- s% r: G# u) {
$ s9 x5 R+ c8 o9 \9 ~* p    xor     di,di
' k# U; Y( F  S7 o    mov     es,di; b* n( b8 c& S( ^) j! m
    mov     ax, 1684h       4 [0 o+ M  F( m7 _
    mov     bx, 0202h       ; VxD ID of winice
7 \: H" C# f- U: u6 _2 b# a    int     2Fh7 I2 Y& _# ~  g9 g
    mov     ax, es          ; ES:DI -&gt; VxD API entry point4 J1 k& W+ l* ^3 s+ }5 B
    add     ax, di
2 Z+ Q- h7 U3 A+ G* N4 d; u) o    test    ax,ax( D" l# e; @$ s- d# O3 P+ J8 H
    jnz     SoftICE_Detected
" R- k7 S# X5 W, a, W# b5 ?+ t- W+ a* P3 J5 Z8 I4 @6 b
___________________________________________________________________________
5 _7 N3 ~4 R. g; }( g6 B4 }1 F: j1 w. V7 \- {6 f2 P0 b! j5 E) i9 W: C
Method 044 n/ V1 T- s% H- e3 W1 z
=========6 j3 d( R1 k% D5 L  o
+ ^" d3 S1 U% C9 t
Method identical to the preceding one except that it seeks the ID of SoftICE0 X8 u6 w- ~+ \) A/ N
GFX VxD.- K* m4 I" |( G8 T: \- Z

; Y% T6 b+ Z+ e5 A4 G6 y# R3 I    xor     di,di. w8 {' G$ K2 [: S5 h6 y
    mov     es,di
( p, @0 `* T2 T! F    mov     ax, 1684h       2 J$ Z/ J2 Q4 Y5 |  Q
    mov     bx, 7a5Fh       ; VxD ID of SIWVID
3 U6 ~. f2 Q& X* S    int     2fh
, n% J, p8 }# m& w6 _  A    mov     ax, es          ; ES:DI -&gt; VxD API entry point2 f6 k' ~  O- t; J' ]
    add     ax, di& Z7 {- N3 F7 Y2 T
    test    ax,ax/ Q/ }+ s8 c3 x& f
    jnz     SoftICE_Detected
) J5 r# A$ h# w" X
! n  v) x( d1 \__________________________________________________________________________
# e- F3 W+ L9 _' {8 O% i- Q4 ~; ~
2 h) I' o, l2 ]7 E
) l) [9 u2 a# C9 NMethod 058 @8 ^1 }6 q* w# a' A* y7 ?
=========
3 }2 y3 k; B% `" p1 {
8 ]  z& O: B* |, B& IMethod seeking the 'magic number' 0F386h returned (in ax) by all system
+ F& t9 i% e6 d) fdebugger. It calls the int 41h, function 4Fh.
5 S: Z* C2 l1 g' sThere are several alternatives.  3 z4 U% l) O0 Z' w

" Y9 E5 R: I$ X' |# vThe following one is the simplest:5 p7 `7 ~6 a8 W4 o' H1 O$ q* V

( G, |1 T' b6 l# W3 I    mov     ax,4fh
0 |. T' i; X* l1 }- x    int     41h
2 x; [7 R! c  t6 I- K  H    cmp     ax, 0F386: w5 K$ D, ^5 q" i7 ~- h
    jz      SoftICE_detected( M1 d1 d9 x( E0 V; X
+ R" D/ m$ E# H* t9 [7 t( R& u* o$ b* G
* c7 L' D: C' b0 D
Next method as well as the following one are 2 examples from Stone's
* C9 a4 }0 d3 q7 [0 D"stn-wid.zip" (www.cracking.net):
& B6 F2 A" G; D9 }( s: [* _% K0 V$ \  O: n" w" d
    mov     bx, cs1 z9 z, f: `1 b
    lea     dx, int41handler2
3 p. j8 s  M( j  y* w    xchg    dx, es:[41h*4]! t; N: _0 w  k% Y
    xchg    bx, es:[41h*4+2]
3 o, ]3 v% t6 x    mov     ax,4fh
" W8 ?8 k8 J( ?( q4 ?    int     41h9 M8 m/ j( U" i1 J
    xchg    dx, es:[41h*4]2 `+ k: c2 D  _- F0 T
    xchg    bx, es:[41h*4+2]0 K4 Z6 P& [, ^' R
    cmp     ax, 0f386h
* L& k  w9 i- ]1 U. H6 M    jz      SoftICE_detected+ e. ~! o% x: ~$ j  a

" w& V6 u/ _$ N5 w$ E4 [8 `int41handler2 PROC
4 b7 d4 p8 L/ k    iret( R8 i7 H5 p8 H/ s
int41handler2 ENDP
, e9 m0 ~" l; ^% v  p/ h; V& P! A! R$ l. O/ c/ k  b- j: q
. h8 t2 Y$ n3 C& {$ U' a" B
_________________________________________________________________________
* {% d0 r! `) Y# x5 Q- v, y2 ^$ C* p$ `7 A

$ a: e4 {0 `$ G2 F" LMethod 06) c' _' u$ o8 f! E, f/ H
=========  c3 H& m2 a6 X+ r0 K
# u0 o# Z. I7 n' H2 B% }
2 C0 g4 U' J; {8 [
2nd method similar to the preceding one but more difficult to detect:
  K' Y' M$ h# F" h% q3 H; `, {. g% V: X, G0 B4 ?

' s  M' R, b' j" u6 d: zint41handler PROC
. H1 Z  p4 U8 m( A) r. e    mov     cl,al
, r3 V0 Y: y+ g    iret
* |; i4 x8 C( h6 v5 w$ Hint41handler ENDP
# Q) [' M  D$ ^& ?# L3 Q
& e' _9 Q, \; F. @
# x6 t5 D% e; S8 Z9 [' y% e    xor     ax,ax4 e! c- k7 N! W; @) ~3 v3 S7 W
    mov     es,ax2 w5 b) l9 t; }& u$ ?* e
    mov     bx, cs: U& J* c0 U. ]& r
    lea     dx, int41handler4 Y: H7 A8 l$ q/ S% b
    xchg    dx, es:[41h*4]% z( j' f7 m  h) w8 ^
    xchg    bx, es:[41h*4+2]; c. K8 i# b$ g; W4 W+ |' u
    in      al, 40h+ v7 o% f! B. t' A8 Q
    xor     cx,cx
" ?) r% K! C: a' y' f' T2 T    int     41h
9 E5 V2 T/ D; O( f    xchg    dx, es:[41h*4]( p7 O7 t2 G( e* J! g
    xchg    bx, es:[41h*4+2]$ c0 B/ R. R: k* Y/ S) y) x
    cmp     cl,al
6 d; i: z% v( ^8 F, z8 j2 `8 S9 V    jnz     SoftICE_detected! c" ~6 O: A2 l, k
1 V! r7 p  s5 v+ ?2 t" e
_________________________________________________________________________& e4 [/ X& H4 P' Z+ q, T( m! v

- H+ n) v" H4 ]' R) }2 R3 WMethod 075 ?) w, T( g) d5 M* ]
=========
2 n/ O- j; A/ n( l6 G
  t( E- }9 p" O$ I9 c1 D% m' f$ Q9 zMethod of detection of the WinICE handler in the int68h (V86)
3 U! q7 I1 Y# q& p, E/ {( ^$ D7 x1 Y: L
    mov     ah,43h
+ B7 k$ N' c- E5 r3 _. C6 C    int     68h; k7 u3 Q* t0 X6 f! j. @$ G/ ]
    cmp     ax,0F386h: W5 O: R9 s5 c7 }  x# q* n5 p0 G
    jz      SoftICE_Detected* o, g8 Q7 G" Z' O6 q
5 r1 V1 k; ^& ^5 H. d  X& g  Y

7 u0 h4 q9 a9 c4 R( K=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit& Z: F0 u' R5 G8 t) b' }
   app like this:& B9 c0 @) G+ h* [% |- k

" f9 K1 E& q) n   BPX exec_int if ax==68, E! q( y3 p0 g
   (function called is located at byte ptr [ebp+1Dh] and client eip is
' ~2 }6 s  ]4 i; I' e$ g$ E   located at [ebp+48h] for 32Bit apps)
& U8 V- n# C# i7 c3 n5 V__________________________________________________________________________
- {/ l% z4 n0 M- P0 H  i; Y1 m: T/ l- t# o! p
* W0 g. Z8 g1 W/ [+ V
Method 087 ]" e$ @6 I9 M
=========$ u6 B! q3 H* ]3 Z+ Y0 u

% Z' x- u' i7 b8 T+ d7 wIt is not a method of detection of SoftICE but a possibility to crash the: @" ~+ j4 s1 N0 Z2 Y! N7 \, U
system by intercepting int 01h and int 03h and redirecting them to another
" l! |9 C' \8 l9 M- d; E" W# s, hroutine.7 m0 g0 k( z# D& ]
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points& j8 \) x" P  n0 p" b1 `9 Z
to the new routine to execute (hangs computer...)/ w& ?6 ~% Y- l0 [1 p
  _% n/ ]/ t( a1 u; h8 |; {' |
    mov     ah, 25h
$ f6 O# M% {' c! G1 @, c. O    mov     al, Int_Number (01h or 03h)
$ C' O) m, r! a1 ^6 N+ H1 G7 h    mov     dx, offset New_Int_Routine
$ E$ `& u5 v7 a, ]% n* z& w    int     21h$ J( K7 o: k# b' S

% j; U& {" e0 u$ z2 V7 D2 ~! V__________________________________________________________________________
3 i3 r2 z2 y* e( }( c( @+ r' Y0 g
+ t0 q; _* H3 D& V# @7 Z8 O* }Method 09
/ x% x/ o3 W" v: M3 f( g- i=========
7 ?0 a+ u% K0 @; g! h
3 K9 R9 Z$ M, V! o$ q& }This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
' @* _. Z# u2 O8 a, d# Hperformed in ring0 (VxD or a ring3 app using the VxdCall).
( e( z- D' s; x, `The Get_DDB service is used to determine whether or not a VxD is installed4 U) ^; @3 _' E8 y
for the specified device and returns a Device Description Block (in ecx) for5 s2 p/ Y% g, u: v  G4 w6 P3 w
that device if it is installed.. {. A7 o; L! M( @0 i
7 }5 m- s: s# O  |2 P
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
0 j, l$ O# h1 ^   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
! P, C5 n3 h7 K7 [0 u+ j8 i   VMMCall Get_DDB
& _2 F! J# D3 {   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
+ e  b' G8 P: e, P
4 k) I$ z: e/ g% xNote as well that you can easily detect this method with SoftICE:( W! P* e1 K% C6 g+ v, w
   bpx Get_DDB if ax==0202 || ax==7a5fh% Q" f; v' M3 f

* g% R4 C4 Z3 z0 v6 M2 \__________________________________________________________________________
" \! A- k' H; O4 @7 B. m* O2 d8 e- D+ a
Method 10
; @( y) g! h, B5 O5 ?- W- C=========% p: M+ m, R. Q8 t  q* l' N: G

7 U* l" t  f* ~) K7 w4 c' N6 V& U; i% D=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with& r5 N+ ?3 X& _9 ?
  SoftICE while the option is enable!!
8 U+ z' o6 H* K3 r8 r9 U
5 w. U2 `' q% k# _" U9 D0 Q) jThis trick is very efficient:
+ v/ U# ^) U4 c+ ]! A4 t8 V  @" L! Zby checking the Debug Registers, you can detect if SoftICE is loaded
7 l) P8 P6 E4 u(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if7 |0 d' m' a* D9 K4 v0 c0 D0 j
there are some memory breakpoints set (dr0 to dr3) simply by reading their0 \1 B- k4 U' y% Q/ T7 @* u
value (in ring0 only). Values can be manipulated and or changed as well
7 N* l1 u; g% V. }1 Y3 \(clearing BPMs for instance)
; u3 c+ z! y  o: j5 w
! G0 W/ a+ K) f) T+ X# n__________________________________________________________________________
( E$ T  _4 {2 t; C9 K# C
8 c1 v- Z6 f9 R  j3 zMethod 11$ k. e, {  ^1 e! B
=========
* f& a# f4 F3 b0 ^) p; X% f0 W5 W5 p5 k& }1 t. F$ h
This method is most known as 'MeltICE' because it has been freely distributed
/ b  Q+ c  b& f$ `via www.winfiles.com. However it was first used by NuMega people to allow
1 g2 \9 w" M7 {: E' YSymbol Loader to check if SoftICE was active or not (the code is located
( V* z. C2 e7 o& l$ Hinside nmtrans.dll).! ^# A% c, T; u1 b
4 a# z4 O. ~5 {6 G% M5 K
The way it works is very simple:: _+ U2 d' Y+ o$ Z9 u
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for) i5 T. \0 Q# y
WinNT) with the CreateFileA API.# B8 q$ g7 C" d+ K* v: q
3 R7 u3 @; _$ A
Here is a sample (checking for 'SICE'):" r) M+ n6 ?) j9 J" \
$ V4 K5 }2 g: f& w3 ?3 J* S
BOOL IsSoftIce95Loaded()
4 ^$ {# `: V7 k! E: o{
+ Z+ r  B7 Q0 z3 j/ D2 _   HANDLE hFile;  7 \7 N) O8 t2 N; N" b. _
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,0 ?2 t3 G% V' h( @6 ^- D
                      FILE_SHARE_READ | FILE_SHARE_WRITE,, b8 k" P3 }/ T3 U. U' \  ~
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
2 P+ U: N) Y5 f' P   if( hFile != INVALID_HANDLE_VALUE )% T( n6 G' `5 \
   {0 H1 w+ G. a/ o! z: j4 v0 d9 F! S# U
      CloseHandle(hFile);
9 v$ L4 L: i, o( Q, T0 d      return TRUE;, \( g0 {# x3 U3 t- e, \
   }* d' X- c) W3 H4 h) O( A. N
   return FALSE;  G: Y% ^* `4 {  f* b! W0 I5 ?
}4 ^4 d" V' ]+ I! s5 r! }

2 \* Q! q; q" O9 a' bAlthough this trick calls the CreateFileA function, don't even expect to be3 }, N. S) u7 z% N5 E- B0 V8 G3 p
able to intercept it by installing a IFS hook: it will not work, no way!; k( K% s0 \2 q5 v+ N
In fact, after the call to CreateFileA it will get through VWIN32 0x001F/ P7 ?  F! d4 \
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)  s) _0 G9 r/ {, p- i; J
and then browse the DDB list until it find the VxD and its DDB_Control_Proc* p8 I$ p) D: H9 E0 i* f' J
field.
& o: o/ V$ f$ D: ^! aIn fact, its purpose is not to load/unload VxDs but only to send a
+ l9 s9 C) T1 |5 \W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
: l6 B( {: u- L( g3 b9 ato the VxD Control_Dispatch proc (how the hell a shareware soft could try
3 W2 \) L0 p1 o" h2 m$ O4 F2 y8 ?to load/unload a non-dynamically loadable driver such as SoftICE ;-).
% I" K' b% B0 [" l% b: R2 I7 Z" A' p! ]9 MIf the VxD is loaded, it will always clear eax and the Carry flag to allow' ~+ x2 f5 Q. y  b
its handle to be opened and then, will be detected.
( P3 F3 H4 M! g9 G' vYou can check that simply by hooking Winice.exe control proc entry point
6 G6 `- @, I) Gwhile running MeltICE.6 e4 d0 R; A7 F4 c

, |- A& v  N4 |, t3 }5 F; |7 L, e* h+ B! w- u2 S/ e
  00401067:  push      00402025    ; \\.\SICE& H* A5 B& ]' I
  0040106C:  call      CreateFileA
! P# l- E' l; @4 b+ {  00401071:  cmp       eax,-001
9 d  Y# P7 u( @. T# R2 @/ Z& t  00401074:  je        00401091$ R1 c3 b1 [) n9 C9 ?

$ b- C- e7 O& s; {0 j" u: N( j: D2 f; S- K9 `$ u  f
There could be hundreds of BPX you could use to detect this trick.
  g% k& o+ ~" H7 d-The most classical one is:
* ~& {4 U+ E5 k1 y  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||2 b/ R5 P$ i0 H3 Q3 ?  L' ]! N
    *(esp-&gt;4+4)=='NTIC'
2 M6 s; i/ i9 Z/ u' M" V
% W+ P8 V& `$ m9 J-The most exotic ones (could be very slooooow :-(# o* S( M' ^$ N/ \% H
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
8 k! T9 q* [, Y     ;will break 3 times :-(, n. Z+ j, P; s0 m

1 k8 {( v7 |4 h-or (a bit) faster:
# r3 ^# m6 V( y% z: J   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')3 t! B8 b9 f- i' h. r+ S

# p6 b' A" q& T# R( ^. i$ S0 C   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
3 M# p  g. |9 ]& }     ;will break 3 times :-(
5 o* O) q5 f# v5 D. E7 O% p% P; i0 S; h$ `+ E* K
-Much faster:; c4 |0 u9 M( M- ]) c# |8 x# O- q
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'; n1 q0 W. x; B8 q
( Q0 J. [  {! A- I& {, F7 J% M1 J
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen2 {8 I! ]2 X- S, c
function to do the same job:
* I& u/ y/ D: c% X$ L: ^/ a% `" N! i$ }( I* l( P/ O; P
   push    00                        ; OF_READ' ?+ `5 o: y! a6 n+ b
   mov     eax,[00656634]            ; '\\.\SICE',0- o# t5 i& a) Y& y
   push    eax
$ G- C5 L- G: k   call    KERNEL32!_lopen
1 a& x) j) v  g6 g5 Z   inc     eax
+ K# \. T4 Z, y$ V# ?   jnz     00650589                  ; detected! o. I# d* u2 a( D" k! `. [. \
   push    00                        ; OF_READ
" D9 Q* T8 k8 ~$ i   mov     eax,[00656638]            ; '\\.\SICE'0 D( Q4 D$ U) f
   push    eax
) E% R4 e: C5 M5 p   call    KERNEL32!_lopen! k1 c8 B; O- E
   inc     eax4 M& m+ a; ^8 u
   jz      006505ae                  ; not detected; X" v) L/ A9 a( P/ R% \

! Q4 V1 h! L4 I, T, h( S6 k( \$ L* ?5 k4 A( j4 c
__________________________________________________________________________: I; H( t4 x4 Z; \  h

4 B8 z! r# }* z. I1 Z- V& L/ CMethod 12
) @1 E# h+ r& F3 y7 c=========
% x$ E# ?7 P6 Q( x
: {) M3 T8 ]" g# J1 KThis trick is similar to int41h/4fh Debugger installation check (code 053 @9 p: @; U. `' M6 j. [
&amp; 06) but very limited because it's only available for Win95/98 (not NT)$ a  R3 ]; i9 Z- u
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.8 U5 M4 g$ Z3 a+ b: N# x$ v0 Q

9 _/ p1 k3 l- S- ?/ q7 K   push  0000004fh         ; function 4fh
% f4 ]% a$ K% m  b( ]   push  002a002ah         ; high word specifies which VxD (VWIN32)( h$ ]+ Y! y# \# ]9 _, G( [
                           ; low word specifies which service
) Q9 y: v1 M- r7 U# r. j                             (VWIN32_Int41Dispatch)
$ m4 h  I# F5 X$ w# u$ [   call  Kernel32!ORD_001  ; VxdCall
- Z5 g: Z$ j1 l* Q4 i% G0 W4 G; Q   cmp   ax, 0f386h        ; magic number returned by system debuggers
- F7 R6 r! Y0 a" H   jz    SoftICE_detected2 {$ }2 ?/ I* J: M4 \/ p
, K) B$ M$ v4 v& b2 q
Here again, several ways to detect it:, I# z4 Y" P3 Y2 K- K0 E; t

9 e, u( T  ~* Z3 Y; k2 [    BPINT 41 if ax==4f# ]2 m' h. s4 c1 f- H; C
2 x+ z8 t& s, ~6 M+ M" V
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
7 B: B5 |) H. L# n3 n7 [$ H. B
8 G9 ^1 F, Y3 |, d    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A9 {1 L4 o0 `: R$ @; S

* I( W" U+ O1 C; [# z: V2 b3 U/ X    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!! h1 h4 R8 w* s8 r7 t
1 \- L: C, w- M' V. I
__________________________________________________________________________' ]/ G4 t9 o1 G% G
" G4 Q4 `* M6 Q! U
Method 13
4 Z+ l$ c/ ~0 G, t=========6 E( I; m  t1 v" d. s
7 ]# Y' y8 E+ v1 n( |# K+ v
Not a real method of detection, but a good way to know if SoftICE is
# H7 ?2 W' z. iinstalled on a computer and to locate its installation directory.2 D. G! Z6 c7 t) @: c
It is used by few softs which access the following registry keys (usually #2) :
" [5 t2 l5 w7 A8 p2 W% L3 i" n
5 Z& ~: [" z) G9 I' |, {-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
2 v9 x  n6 U. J' S- O& _, D\Uninstall\SoftICE
  T/ }3 A+ W" x0 L# H-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE, \/ D! E& n: k/ u9 r! ]
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion% B5 z/ H. ^6 V% i% H
\App Paths\Loader32.Exe
# o. ^- n3 |+ A  H- H+ g7 ~  J* w; p% w# w5 A

) H/ D5 q7 k4 m" Y  }- mNote that some nasty apps could then erase all files from SoftICE directory
4 s8 t$ c; B. @! j( U(I faced that once :-(1 I' F. V. K: f1 j  M" k

5 K. v* ~* z+ {2 ~9 n- m9 c1 L* ?Useful breakpoint to detect it:
0 G- _- ]9 ^! H+ ~1 J- j% F& h9 w7 T3 v8 i7 l) Z- n  S
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
+ R, z1 w/ r& i; @! s1 k! j* P8 x7 E9 }, d
__________________________________________________________________________2 l4 V+ K7 Q; O: X+ v9 @. S7 @
6 \! ]6 x1 }8 J# K1 U
! B7 K) r, V8 S* o0 y
Method 14 8 B$ q6 j' i  ^
=========
; F; `- E# v) j9 A9 p9 m2 N2 B8 O4 J1 M
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose. T: \  r& q% w4 T. G3 z
is to determines whether a debugger is running on your system (ring0 only).& L( H4 z2 b1 R: v, E

6 r) s3 Q/ H+ q4 N1 b   VMMCall Test_Debug_Installed
  v! J. n' `5 f0 J$ R   je      not_installed
) r% t% e1 ^& {, U% X5 u; @
5 i9 I. g* h; K+ K8 }) Y( PThis service just checks a flag." W9 X2 C  p9 o2 A: }; P. n
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-7-26 22:15

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表