About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>, i. E$ q' T7 R, c
<TBODY>
" |3 a2 `/ [2 }6 O* m" M$ C* j4 t<TR>
6 Y7 p( p4 Y2 x* J" a. A<TD><PRE>Method 01 $ ^6 a7 q) B3 w* ]0 N
=========
( X# }0 ?0 O, d( t
, Q9 j+ ^" P  I( p0 WThis method of detection of SoftICE (as well as the following one) is/ U; ^! p$ j7 ^0 M4 _
used by the majority of packers/encryptors found on Internet.7 f+ N8 ^; `- K9 t2 Q( `3 N
It seeks the signature of BoundsChecker in SoftICE
6 t! j. D9 V- }& a: I" ?
1 W5 z; w+ @, V1 v    mov     ebp, 04243484Bh        ; 'BCHK'
) H& m  Y  {+ X    mov     ax, 04h/ R. m% i, x' Q  e
    int     3      
' J1 V5 @4 k4 M5 K0 B* P3 l    cmp     al,47 t, X3 E2 \' u9 d0 G* q1 \& J6 x
    jnz     SoftICE_Detected% r) o1 D  g5 w! G  S- ]

% P4 i  ?6 H9 H___________________________________________________________________________
7 U3 m% E$ a6 D% f  f: |: Y/ P+ ?
& B* Z* s, s+ C% X2 t7 T6 KMethod 02
; @  w; G  g  k% j& D=========
0 b4 Z4 v3 B! O3 X3 ?6 L  L4 X2 x* F  F; X  m" ]
Still a method very much used (perhaps the most frequent one).  It is used
/ {5 w2 ~' U. k6 P; sto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
" f, u9 C8 h7 Z! ]/ H! C3 s9 `( H- @or execute SoftICE commands...
8 D  l1 h# Q  J' X# w: YIt is also used to crash SoftICE and to force it to execute any commands
# W' x; |) w1 }(HBOOT...) :-((  ) j- r2 X1 M+ ]9 {- {1 ]! g

* z% h5 W& c% U$ Y3 i3 hHere is a quick description:
. l  f! k/ v  E1 p9 G6 c& ]% \-AX = 0910h   (Display string in SIce windows)1 W1 {0 M3 P( T! a3 a0 M0 M: W% K
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
: ]6 f2 @7 ~) s4 b; x-AX = 0912h   (Get breakpoint infos)
) k5 V7 h; I/ S  a-AX = 0913h   (Set Sice breakpoints)
9 L0 b7 ?. E% }- A7 x-AX = 0914h   (Remove SIce breakoints)
) l/ b$ f; `- t; F* ]) Q% E8 a( `) g2 H9 w' \  _5 H" F
Each time you'll meet this trick, you'll see:2 M7 X' R. r3 j' p" s& k0 B
-SI = 4647h
# q& W: ?* Y1 [0 b! |-DI = 4A4Dh+ W/ L1 J0 C1 O+ S$ I" W6 }. F
Which are the 'magic values' used by SoftIce.: e* Y+ P7 I! G: x7 X, c) P
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.( T( p( T* Z! G# J! O  m' M

  Y& Y6 o8 C7 H' wHere is one example from the file "Haspinst.exe" which is the dongle HASP3 ?$ P. a9 q6 {8 B5 i
Envelope utility use to protect DOS applications:$ y$ L  O+ _$ V3 C+ N0 l8 y
( k) J2 L& Z: E! V! S; ~
* y7 E3 W" h- Y; l7 j
4C19:0095   MOV    AX,0911  ; execute command.
! E' L+ T+ T+ O  |/ w4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).; C) E0 I) D7 Z; n! f
4C19:009A   MOV    SI,4647  ; 1st magic value.
- y8 Y' \8 C, |) ?* g4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
' g6 y7 Q) i/ G# o! {4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
. K3 j: d+ }1 h. K3 r4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute2 S0 ]9 X) u/ n
4C19:00A4   INC    CX
/ ?% @$ ]5 b( w) t& v0 x1 p4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute0 b5 @) v% b, [( q' A9 J# O
4C19:00A8   JB     0095     ; 6 different commands.% {. Y9 J+ F3 ^
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
! x( w1 q) J3 x4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
: y- n$ e" d. ~* u! }# s3 Z* k( X* x% S0 M1 ]7 |
The program will execute 6 different SIce commands located at ds:dx, which( I8 ]; S; C- K% P
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.9 |( J" m' w6 D) x6 f" Q: Z/ L

0 L6 f' e2 R; B* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded./ C1 L  b$ U! ]" P% u
___________________________________________________________________________7 b  s* Z0 S# y/ ~8 ^
' ?4 [) R' P; O" S3 w3 v
& C( n/ H& b. ?
Method 038 _0 ~* G, U0 D0 |
=========
: r# C) O9 O* W9 u9 R7 w! c$ K, U: v6 ^2 A; s! e) R7 |) y5 _
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
% `1 k" i1 m) f4 j- W( ~$ }0 i(API Get entry point)1 R& C! K* L: y; v
        % ?8 H* e6 }; `$ c. |

, ]2 p9 @: @- ^    xor     di,di/ ~: C6 h7 r. D' e
    mov     es,di  U; ?7 D% D7 q& B
    mov     ax, 1684h         H1 L" Q% f% B- g4 `& o2 p
    mov     bx, 0202h       ; VxD ID of winice- g0 T8 u) N( p
    int     2Fh
2 Z0 M" |# `% e$ \" N+ D    mov     ax, es          ; ES:DI -&gt; VxD API entry point
( `; o* @4 Z, S. W  }    add     ax, di
- c- Q( ?1 |, z    test    ax,ax
1 e0 K  f$ f: A    jnz     SoftICE_Detected
6 a  l# P% b" o6 F
1 a: y/ I  ]: C- ?( ^___________________________________________________________________________
5 ?' W' a9 z) Q" ?% S8 e" N
/ F0 A1 t% b5 O) C: D) j* uMethod 04' _& H& N! M( R; e5 k# J
=========; x; T2 P! @1 ]$ B
3 L6 d$ j# a8 B# K3 g$ g
Method identical to the preceding one except that it seeks the ID of SoftICE
' n, s! N9 j9 n% [& H& mGFX VxD.0 e1 c# L& d  ]/ c5 E/ ^
  G8 A3 Z5 ?' q/ H
    xor     di,di* @% o4 E% M+ _& O1 f& h& i( Y
    mov     es,di7 z8 d. q. f8 M( \! J  e3 |: I
    mov     ax, 1684h      
6 F0 y9 v  [0 \    mov     bx, 7a5Fh       ; VxD ID of SIWVID
7 `0 Y1 c. i  l: X( O    int     2fh. D, x& J9 R: w. ?: W% M- o/ g
    mov     ax, es          ; ES:DI -&gt; VxD API entry point* m& l6 c+ n& m
    add     ax, di6 m/ M1 N. F2 y0 G8 L1 S6 X3 U
    test    ax,ax
3 o7 T: _0 y( X. D    jnz     SoftICE_Detected: h% F6 P/ s/ E; q1 C
( k# U/ I: C4 y# m
__________________________________________________________________________
. o% q) t) B; E, W% t
4 j) c4 G; J' F7 _3 c( p& w
1 B8 i' a6 `1 `. E# qMethod 05, z1 ]3 m$ v8 f" v
=========$ [. F+ W) Q9 M9 _2 E% u7 N# m

4 B) M* b7 y: O' z' k! aMethod seeking the 'magic number' 0F386h returned (in ax) by all system9 H2 b. G; `! O% u( Z2 R
debugger. It calls the int 41h, function 4Fh.
# W- `$ J) k# b  NThere are several alternatives.  * e( A) O3 M) d$ G2 \2 X

8 S# K! A% \1 f- p6 \The following one is the simplest:
) A5 G2 c/ y; A: I% B7 ?- ]3 Y. U; _* P% c
    mov     ax,4fh
$ |6 S) ?" v: L' v8 D5 ?    int     41h
( G' Z% x9 [! l+ g0 _" x# ~    cmp     ax, 0F386
& j- B$ V8 E3 m. a    jz      SoftICE_detected6 @8 Y; h- ^5 H* ^  V+ E0 T$ M
/ M& M: j' f# v6 O1 ?5 ~5 T

' s$ |6 a0 v* Y! V* r6 NNext method as well as the following one are 2 examples from Stone's & A1 d9 S; R7 `! q$ }( v5 T  O" b$ X
"stn-wid.zip" (www.cracking.net):
- J- i& z# T: w  @: H: R2 m# p  v7 K, Y; N+ a. T
    mov     bx, cs" R! }4 k% e! k8 u
    lea     dx, int41handler2. h" n  K" m- ]( n6 B" `
    xchg    dx, es:[41h*4]: y+ ]3 e0 Z, q- Y
    xchg    bx, es:[41h*4+2]) T& m: `2 K1 n2 i  y: X" u
    mov     ax,4fh0 K! M& l$ s) ^/ ^6 Q7 F8 X
    int     41h' O/ w' N& `: {" A/ L& U4 y
    xchg    dx, es:[41h*4]: s* t$ Q9 @" j4 H
    xchg    bx, es:[41h*4+2]0 B  w) D' E- Z! e0 \! \" ]
    cmp     ax, 0f386h6 ?) I, j& r. @
    jz      SoftICE_detected
, P5 }. d' p# a  p" ~% L+ ^" v% T; ^  E' Q- \' w  \
int41handler2 PROC
' q# `. ^: b5 p* `; w    iret* P; j1 o5 X+ K1 O* |
int41handler2 ENDP
# J& p* P$ y1 q! y! h: ^, q4 d
9 e, y$ t8 `* n& Y: |- v0 w  s8 @  C& x$ f: N
_________________________________________________________________________
1 v* C0 k4 M: B! o  ^
. P+ z( ~7 ]" P  n1 W8 w3 z9 N  W2 t! w
Method 06
: d- g! F7 u6 L+ T2 [7 M=========
2 O1 ^, I& [. P  g" U. ?
, C# c7 N8 I% f
7 s+ b2 H. C, u  }( Q4 W9 ~2nd method similar to the preceding one but more difficult to detect:4 K/ r" z3 ^. I0 j1 C( J( v
- o* r. B+ ~. M# b8 {# V& o
+ x& d; r/ F  n3 z
int41handler PROC/ x$ ^2 b: k- E
    mov     cl,al
! e! _. h8 c) r* W4 @    iret8 ]( h0 i& h' p/ `% }
int41handler ENDP
1 Q4 `7 I' }# y, k/ t6 |& D7 h) W$ C8 @
. u. A7 C% ?' A6 \
    xor     ax,ax
2 |5 ^; D/ n/ ]* p9 v3 q* {2 L    mov     es,ax
! u$ K+ G) V% B* z7 W( y# I    mov     bx, cs/ B0 u9 E' y( W0 D. T9 ~) Y% T
    lea     dx, int41handler- c% Z, w( c5 ]' m) d# u* ^
    xchg    dx, es:[41h*4]6 f6 V. `# q* F. @, g: Z
    xchg    bx, es:[41h*4+2]' Q: `0 e8 \( j/ _6 d* o6 y; z. Y
    in      al, 40h/ g4 U& ^) @1 L% o& U
    xor     cx,cx
6 i- V$ l& U1 @    int     41h! }1 w; H9 ?1 ?* t+ `/ {
    xchg    dx, es:[41h*4]6 r/ F0 ^/ b% N& D9 ?9 p9 }% _
    xchg    bx, es:[41h*4+2]
7 ~' W4 B+ ^6 T    cmp     cl,al8 b# t, m! k+ _$ C! U) E! B5 h& o5 n
    jnz     SoftICE_detected
7 k& N, t9 f5 D3 V
' J* |0 {2 s, V9 j. j) w: `1 I: V_________________________________________________________________________
1 z) p1 ~9 g* f7 g9 Z4 T* W) Y. w; m" y5 q2 E7 f4 l4 P
Method 07  q. g% ^! h3 m: W% ~
=========
0 \1 q& S* N1 z3 T
. {5 i9 ~- x2 W. q; u' pMethod of detection of the WinICE handler in the int68h (V86)1 [! S, B5 y+ [6 u
7 Q1 ?- Q- z% ~  h8 @; e2 [8 O8 M% n
    mov     ah,43h. X) N" {( |2 b, d% G7 T7 [) ?
    int     68h
  h8 B7 e* Y' i+ K; Q7 S( X    cmp     ax,0F386h' M, [: Q) O/ B9 ?8 s( u8 w8 N
    jz      SoftICE_Detected2 S4 U6 o3 r( d! t7 i

' Z" V  B1 I# z
1 s+ g9 k9 U5 s. m" p=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
/ }/ ]4 \3 u" x; R# i   app like this:2 s* J) m5 Y$ }7 F( ?
) w  w3 Q- p' O) k2 @
   BPX exec_int if ax==68
1 a$ t' t" t7 I8 c+ A/ v   (function called is located at byte ptr [ebp+1Dh] and client eip is& E( q9 x0 \- i
   located at [ebp+48h] for 32Bit apps)3 D4 U/ C6 s' T' U
__________________________________________________________________________
- H% \0 G- Z8 A4 d" k7 ~/ \+ ~" B- N! ~% V& A: L7 e- N! v. E
, S0 i6 A7 S, Z, X5 G
Method 08
3 z# z( n: L1 ?, G6 o+ `& M6 c$ v, Z* E9 `=========
' l( [! r% x1 ]: ]# k
7 O8 X. x( @! S4 MIt is not a method of detection of SoftICE but a possibility to crash the6 T3 b+ r8 X: E7 ~
system by intercepting int 01h and int 03h and redirecting them to another+ G$ _. w/ d3 x' P. q+ {% @& ~
routine.
; {. {' h7 k3 K. A& ZIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points1 R2 D5 q. z& `* S8 ^7 N
to the new routine to execute (hangs computer...)0 x. _, z9 k) B. a5 w5 \9 Q1 U4 X
7 n# n, u  g7 g2 i4 {- O" w% J
    mov     ah, 25h
. Z$ E7 e! e, ]& x% C# e    mov     al, Int_Number (01h or 03h)
/ o+ B2 @8 ]7 Y/ r  A" x    mov     dx, offset New_Int_Routine" n3 S$ Y! U& X0 |" Z
    int     21h
: T4 p+ \; @2 M4 M' ?  R* D7 X, w& L! j& y
__________________________________________________________________________( ^& ]7 o( W8 r
: M4 f% q- T& Q2 ~9 c
Method 09
4 G+ L. P$ B; p=========9 T! j5 y% k1 X$ [3 A1 A. C( H( T

+ z' W# }# }3 D# EThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only$ y+ h5 o) V2 p' P2 `) ~6 f
performed in ring0 (VxD or a ring3 app using the VxdCall).
) y+ X& L+ f0 R& m7 j: VThe Get_DDB service is used to determine whether or not a VxD is installed
0 m' L! b8 o1 n, [' |for the specified device and returns a Device Description Block (in ecx) for
5 ^( ^2 f  R9 S, w4 Mthat device if it is installed.
; Q/ {; i1 ^& J! w1 \) X, S# U- W6 f$ S* q- f3 Z& ]
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID+ W- z) h( G, A( S8 @' [& `
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
  e& {: R* a+ p5 A0 D6 h+ c0 x5 q   VMMCall Get_DDB$ K; k8 G2 n  r$ V
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
# U3 O6 ]2 L5 z; Y  D( O( a
1 }/ o3 }6 g& t6 P) KNote as well that you can easily detect this method with SoftICE:* e9 \; D& q. W/ n" d
   bpx Get_DDB if ax==0202 || ax==7a5fh' i( g" U3 Y9 d! Y/ N8 J
! ^: O" D9 P" E: {
__________________________________________________________________________) [* t! U5 O2 ]% y/ f! y5 g
7 a: w$ `, W* Z6 @* O" [
Method 10. A  n+ O: J2 W; U+ P. [% j
=========/ ^. E8 R8 H7 M. |- G# B4 K$ [
- d0 W/ I1 S) c6 x
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
7 M) l: I; C( _6 J7 |8 m  SoftICE while the option is enable!!
( q4 }, q  U/ j. P% _2 H9 g
! `! V3 i: ~4 z9 v9 P" pThis trick is very efficient:3 C) I3 m( B9 p& E$ H/ G
by checking the Debug Registers, you can detect if SoftICE is loaded7 @9 {6 j8 |( [# t, E, K: \2 T
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
% x/ N# O8 ]7 H8 J. v2 Cthere are some memory breakpoints set (dr0 to dr3) simply by reading their3 _+ P) e) q' P, Q/ g
value (in ring0 only). Values can be manipulated and or changed as well
5 t8 B3 S. _% Z* E" W# G  r. x(clearing BPMs for instance)/ J, K, a7 V9 }! {/ o8 C

. Q! H8 J1 f( h0 d3 [" G; A__________________________________________________________________________
  g7 E# i; l/ E) j, B0 Q7 ^5 g* M9 P- m  y1 d9 B" }
Method 11; F9 }' g' {7 S2 k4 m' N5 I2 S
=========
, W. K$ z# h+ O- f6 H
5 k7 n5 }+ s9 o: {5 b, B5 OThis method is most known as 'MeltICE' because it has been freely distributed5 o" N$ J0 I$ ~' D9 }. P
via www.winfiles.com. However it was first used by NuMega people to allow
# w9 z% h( V! |1 h1 ISymbol Loader to check if SoftICE was active or not (the code is located
+ g* j1 |" J( ~+ Z( _1 C! k1 ^inside nmtrans.dll).
  v( {- f+ q# I" K
9 h4 S' _/ L5 g5 C! y! ^The way it works is very simple:: m. Z5 T* @3 ~3 g' Y. J3 d
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for& J; g+ k" W6 K, W' Y, Z
WinNT) with the CreateFileA API.2 o1 y) m; o. Y7 J% H( |- c
7 t' b4 L& B/ q/ I' T5 b
Here is a sample (checking for 'SICE'):: W' J# g3 [& U& ?4 U% d
6 W7 E* m2 O" q! F: w! K1 @- m1 t
BOOL IsSoftIce95Loaded(); j$ i0 P8 \4 m2 }
{
/ y+ ?0 H' A( l. ]% m9 t2 N   HANDLE hFile;  4 T6 x" L4 f) X" p) M
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,$ S" x. @( Y' N  F+ b, l5 M( @0 C5 D
                      FILE_SHARE_READ | FILE_SHARE_WRITE,$ ^3 n' G3 T- |. G
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);8 t5 t: K8 Z* |: v  G
   if( hFile != INVALID_HANDLE_VALUE )) F/ o: N  V6 w$ P7 a. r
   {
. i: B8 {3 h. p) q6 u4 b9 W      CloseHandle(hFile);4 t6 v6 d+ Y0 D$ b/ @
      return TRUE;% y/ G$ r) U- W! g- J/ E
   }' x. [; K( U4 T2 M4 G6 T. ]3 i
   return FALSE;
5 z+ c+ i. t% s1 L2 s" M}1 ^& d' L6 O; {0 t2 Z

" d: G/ C( o( K& {- zAlthough this trick calls the CreateFileA function, don't even expect to be
% n( x; f/ s. u& hable to intercept it by installing a IFS hook: it will not work, no way!3 k; u1 E" r1 z. K9 I+ d2 X
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
; ~1 L- {' T; O; iservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
* E$ c. a* q: O+ rand then browse the DDB list until it find the VxD and its DDB_Control_Proc5 R3 y' w" o: O: R, b
field.
+ u! _6 t6 h: T7 ?In fact, its purpose is not to load/unload VxDs but only to send a % m8 n' A; i9 |
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
( F: M7 u0 q- b+ g  g2 w9 e" _to the VxD Control_Dispatch proc (how the hell a shareware soft could try
( y3 l# t0 v" u; Sto load/unload a non-dynamically loadable driver such as SoftICE ;-).
9 ]0 t# n( x6 sIf the VxD is loaded, it will always clear eax and the Carry flag to allow% d; e+ c) u% `8 k
its handle to be opened and then, will be detected.6 B6 R; L  k, ?* l3 ?
You can check that simply by hooking Winice.exe control proc entry point7 d, i* a9 n6 @/ R+ n
while running MeltICE./ U4 o2 m7 z( T# q
' c! n5 i2 S$ _5 [& L3 O

$ c  m$ k; G. l6 ]: K  00401067:  push      00402025    ; \\.\SICE
! i. t, ]$ ~5 B! @  0040106C:  call      CreateFileA) }- A+ }. X; k. Y
  00401071:  cmp       eax,-001+ ?7 e1 y: _) u3 G. N
  00401074:  je        00401091) C* {  }5 t0 i2 |( G& k9 j
. o  Y' H$ @3 g5 T- M
. ?+ i" y* W4 D7 \' Q- `
There could be hundreds of BPX you could use to detect this trick.
% ?, H0 h; M$ u; [% ]-The most classical one is:
- A/ d- J% o; F/ T; d7 f$ {; }9 {  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||! W: E. J. h8 @% i% ~
    *(esp-&gt;4+4)=='NTIC'
8 L2 R! M: @0 I0 C( S% g- T* f, ]6 v# g" u4 W; x& D# ]
-The most exotic ones (could be very slooooow :-(
. k' L( U$ {/ h   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  & [6 ~& N0 j; }! B7 N0 F2 z
     ;will break 3 times :-(& O1 n6 b1 ?$ [5 b& x% H* K1 e

, _9 s1 U& B& e  E4 }. x-or (a bit) faster:
' _  W; }. {1 C4 Z' s   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
7 p1 H$ y) I8 ~+ G9 ~3 a, o
& Y+ l( j. `6 g2 x5 M   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  ( y! p$ m/ N7 \, [+ ^" @) c
     ;will break 3 times :-(8 \) A' r2 ]3 a1 T1 o+ v- [1 z
: r/ _2 o4 ?4 a( R! ]# g+ Z
-Much faster:
+ g7 X1 }/ n6 D( H& j   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'8 t7 I, u* s+ \; Y# k

- U3 d: Q( g2 E! j! L: l8 ONote also that some programs (like AZPR3.00) use de old 16-bit _lopen
$ s! j5 u) `& i/ A/ x( bfunction to do the same job:0 P* ~4 c6 _& ]

8 w, y9 d2 O; T" _: k& R' c! c, L% X   push    00                        ; OF_READ3 [4 U( x9 d% D0 i0 [* t. m
   mov     eax,[00656634]            ; '\\.\SICE',0
& S1 m1 u) z, z  {, M   push    eax
; \; A% C% _% `/ e   call    KERNEL32!_lopen
! O- v. g" u) P8 M   inc     eax
  [/ l) L6 ?9 R* Q( u. r   jnz     00650589                  ; detected1 U: V8 c& {& u0 u. ~( j. B8 Y& r) {
   push    00                        ; OF_READ# R& U! J4 O' A
   mov     eax,[00656638]            ; '\\.\SICE'7 x1 \7 n6 w- w# z* o; o
   push    eax5 F6 a; J0 ^+ t* n
   call    KERNEL32!_lopen
) V$ z' }/ [" [5 @4 l% P   inc     eax
" w; Q3 d' J' s) v   jz      006505ae                  ; not detected
( ^8 k8 ~& Q; ~( @4 G% l( t  O" L) v, Z2 p7 R9 W9 e- X" k; {

( I2 h4 _+ k& c7 W) ~$ n% a__________________________________________________________________________2 }9 S  s' e" T

4 a. i% l( Z4 t; s  R% S4 b; c* nMethod 12
# P0 {( a9 z) C! {! V: s& Y=========
9 H# G5 B. f) B' V% H- A5 d" Q. t2 H1 r- B
This trick is similar to int41h/4fh Debugger installation check (code 05
3 Z( h9 A# k5 `( y&amp; 06) but very limited because it's only available for Win95/98 (not NT)
$ n( X& ^; Z+ E: Has it uses the VxDCall backdoor. This detection was found in Bleem Demo.
9 p0 Y# `: R) S8 L: g$ n& J* H# v; H, D( d4 }
   push  0000004fh         ; function 4fh* v5 Q  n# v0 e* w
   push  002a002ah         ; high word specifies which VxD (VWIN32)/ D- S% w4 i2 `  k+ ^
                           ; low word specifies which service- ]/ Q" u' b& J1 \/ r
                             (VWIN32_Int41Dispatch)
5 B- n& J6 l* o( |  a' ~   call  Kernel32!ORD_001  ; VxdCall
8 d' J5 Y- B3 e: U9 ?   cmp   ax, 0f386h        ; magic number returned by system debuggers
! I5 ~  u# L$ p* f   jz    SoftICE_detected
. U# P) k5 p! a* x- w- @
5 r, e/ D! {: u% }Here again, several ways to detect it:
& K8 o# i" \# h
$ w: |! K9 c5 l$ g$ g    BPINT 41 if ax==4f
, m! q3 |* {+ s& {! F( B; R) c& h2 ^' N  R0 O1 X$ U5 X
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
* \; }1 @) H- K& |+ d
6 i4 X  H9 o7 A, f# f% I# U/ M    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
  c+ R3 z+ X. \9 t* V+ C- H$ S; b" T9 {: u- m- s7 U
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
0 z/ o) t8 q& P" D' _2 k1 T# T, ^& q& C( l$ q$ l2 T, ~
__________________________________________________________________________
) ]. R# ]! O4 Z$ ]8 V4 J7 f
) P6 g* V1 Z$ QMethod 13
4 k3 f- K! U8 Z1 ]+ W=========6 t! ~; b2 ?; W# G# F5 s0 d' E

7 C" u4 f% Q& L2 x4 \% gNot a real method of detection, but a good way to know if SoftICE is) W* A% k+ m  I6 L6 X
installed on a computer and to locate its installation directory.
! ], r# Y" ]- U" c# T( JIt is used by few softs which access the following registry keys (usually #2) :6 `7 \% Y! D+ |3 u# j- r2 p
1 ~. Z! T& \$ X; k8 a) v1 N- J
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion$ M  M7 y3 V9 v& H
\Uninstall\SoftICE
' a2 k* L) @. w+ Z7 T6 w$ I-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
9 M" P' R+ ]/ j6 B8 S7 p-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
; G, }5 u/ @! P9 g3 P: S( m4 G, X\App Paths\Loader32.Exe
& z9 }) L3 A6 V4 w  \: I5 t' j! i7 c) @

+ f/ a' l( v2 }6 b9 M) e- m/ Q: K$ c/ UNote that some nasty apps could then erase all files from SoftICE directory
8 s3 o' \6 I1 D9 ?1 @(I faced that once :-(. g' @! }7 |( u6 J
6 ?  J; n- W) |
Useful breakpoint to detect it:" e0 H2 ^1 t" q& i# j

- Q7 x: H" q" {+ \     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
& |5 l0 u6 z: Z7 s5 t+ q1 A- }( K9 u3 c, D, `
__________________________________________________________________________8 d$ `* ]. L$ s

4 w! B6 ]8 M! D7 p6 P8 R/ ?
: m3 _- ~- E  g/ w7 wMethod 14 5 O) a6 k% [' o( Z2 l' q
=========
6 [, x, T7 v( n1 f
: @' `5 j" }  |: e+ JA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose8 G! b4 u4 N3 u) G, h! ]
is to determines whether a debugger is running on your system (ring0 only).$ l% W$ `3 i. g3 I: W

( z( H& i$ @) d" R8 X% F) B# O% _   VMMCall Test_Debug_Installed$ ~( G/ t+ M8 n8 k3 a2 h
   je      not_installed1 N. {5 z$ T' E" Z7 ?

. e; Z% z0 B( S+ k* k: W; _3 ~% fThis service just checks a flag.1 T) g) j9 b" ?5 J$ f- t' o2 K
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部