找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
! ]% \  @6 ?% i  q! R9 p<TBODY>
* d5 ~3 P: X& a' a" n<TR>4 S1 N( F' h+ e( X
<TD><PRE>Method 01
$ L8 `. \% O: b! k2 P=========
/ A. s3 W/ y6 @2 w6 \
6 f+ q6 e& P3 M& Q: W; X+ k9 S' d1 rThis method of detection of SoftICE (as well as the following one) is( _# n% _! }! h5 g; \) p7 ^' G
used by the majority of packers/encryptors found on Internet.9 U5 ~! G$ x. f" U( M
It seeks the signature of BoundsChecker in SoftICE
0 F, I. o  N2 b* F. J) w  ~
, }$ `8 L( Q5 R! I$ _    mov     ebp, 04243484Bh        ; 'BCHK': T: ^- `8 ]! N9 s/ t
    mov     ax, 04h
+ N. G1 e1 e3 b" O6 Y) H4 S* r    int     3      
$ {8 j4 u/ j$ z    cmp     al,4
/ H! c7 D9 g3 t; H  Y- u: u2 v: b" G    jnz     SoftICE_Detected( }% W, Q" `# U& h: H
# I+ l* ~5 U( F, e( a
___________________________________________________________________________. m3 r3 h' y( H, b9 L' c) l2 p

4 ?4 |# M* g- pMethod 027 w9 b0 f2 Y; _. p# d
=========
  h' M( d# ^$ ?; F
/ m. z' Y+ z/ r, t) m6 WStill a method very much used (perhaps the most frequent one).  It is used
$ ~4 r: q# \$ sto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
: c/ c9 `0 }1 g7 Ror execute SoftICE commands.... P8 n( m; ~( n( q4 w
It is also used to crash SoftICE and to force it to execute any commands6 p/ ?, y) N2 z( H
(HBOOT...) :-((  
; B6 q8 m5 I+ j' n& d
8 k& h& `- J, y# q( E$ a3 o" KHere is a quick description:/ [+ C  e0 T. _* g) n1 L3 c( C% N
-AX = 0910h   (Display string in SIce windows)
  z$ n+ ~. ~8 s6 J$ M% {) Q-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)7 c5 H/ o' n* I9 b
-AX = 0912h   (Get breakpoint infos)% o: G6 A9 H3 w1 [5 L
-AX = 0913h   (Set Sice breakpoints), x. D7 k, k, \# t- M2 s1 `
-AX = 0914h   (Remove SIce breakoints). p% B' `& B4 h. m9 y3 r' G( k
3 u: l5 B& Q, |7 c, w
Each time you'll meet this trick, you'll see:
$ \: m$ ?" @( l% ^) M/ y; j-SI = 4647h
$ g; G  Z$ d4 K, t6 N-DI = 4A4Dh
- d% z- s! G3 e+ j* y; s7 UWhich are the 'magic values' used by SoftIce.+ }) x' |7 S1 p# n2 r
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
, A% ~  K7 l, e5 |; u: N7 v7 Z, e* q
Here is one example from the file "Haspinst.exe" which is the dongle HASP# e" g* F  t1 j
Envelope utility use to protect DOS applications:8 h3 p5 ^# y% X1 r6 {! \
2 A  O+ a2 ~1 a7 f3 P. S; ^# i
  a) b$ M% F# u" A6 u* C- L! b0 h
4C19:0095   MOV    AX,0911  ; execute command.2 G0 O: ?2 L8 o8 B+ l$ Y
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below)." m' a& G* w0 `1 W, }- a: ^0 U
4C19:009A   MOV    SI,4647  ; 1st magic value./ |  `; S0 p' B- B
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.5 o2 @0 L/ {8 o* o! m  S( I
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
2 G+ C& P7 o; Z& h: W+ s4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute$ G5 g3 M3 w: {9 d5 b
4C19:00A4   INC    CX$ a9 r3 Y8 ]! B) n% g
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
# z' U. Y! L; h' O- [  W4C19:00A8   JB     0095     ; 6 different commands.
; y9 B" G8 q- Y$ w6 G2 h1 ^4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
  A8 u1 k: M  n: m4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
6 X2 o. b2 `5 U) ?$ N# w2 v# B8 d* D; y$ y: O1 Z9 k2 N! U
The program will execute 6 different SIce commands located at ds:dx, which
) ^- T6 e: ^+ ?are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.( h7 M, _4 J6 ~" w- B+ o
3 Z2 U* W) @$ h& c
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.* t) m! {, G5 H# z/ P, t; D/ O
___________________________________________________________________________1 `9 r6 y3 ]: a  o# J, z& a5 V

8 d+ r2 U0 H* {, K$ z7 X
5 ]3 k: L7 F: U& ?Method 030 b* v  m: _5 c) u0 z% i( E6 h/ Y: ?% o
=========. A6 F9 ~% [& _  e. _

% U9 R7 V* F$ i: K* R* QLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h& }+ q' n7 }8 r1 S! H, M
(API Get entry point)$ `3 ]% ]: v' y  ]# a" C* L
        7 x2 g' i% ~. t3 i  Q
+ C0 j  g: u9 Z9 q0 B# H3 K
    xor     di,di
6 q5 {8 D0 N5 Z& v    mov     es,di4 [$ Y, D8 @, {- B* S$ c
    mov     ax, 1684h      
. I2 W% F2 F+ o9 K    mov     bx, 0202h       ; VxD ID of winice
+ W- }  G/ L1 }) E' G    int     2Fh! h7 P6 M2 ^/ c' N4 X. A
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
# P: H4 H6 h4 N5 d. D    add     ax, di" p! p9 q) Y7 O1 w+ u4 Y0 I
    test    ax,ax
7 y3 g  p( R! m9 S    jnz     SoftICE_Detected( K! r# i! w( {1 x
2 R, b" h0 B+ A" G
___________________________________________________________________________+ Z  j& E: ^$ n- C3 N+ D( D2 S
; x( O& F1 _$ {8 Z% m7 m
Method 04
7 K: y( O* K! O' V/ U  F' M=========$ i! o" o1 q/ P" Q" B% i
! J: v, V  O3 |. N1 s& N  t) |
Method identical to the preceding one except that it seeks the ID of SoftICE  P, P& h7 N7 K
GFX VxD.+ V% v8 [7 `% K% g
4 F+ b% T! {- P# J4 ]
    xor     di,di% h1 p1 b  s* m5 v. q" R
    mov     es,di1 r! n( _9 y# B% I) D$ P# K
    mov     ax, 1684h      
1 K- o  N. c# h! R6 d& P% M' z    mov     bx, 7a5Fh       ; VxD ID of SIWVID
/ G3 L6 ?  j4 r/ r* I) M* B    int     2fh  B, a4 A6 W) ^; X
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
' y2 g# r3 T( P. p( Y: J    add     ax, di
% |# L1 M) L3 K    test    ax,ax
( k" ?; {9 u" n, }    jnz     SoftICE_Detected* D! X3 v2 K' {/ \5 \4 u7 B1 _+ B' {

0 s3 A9 J8 |! J- ~2 y; D__________________________________________________________________________2 D' s; V, I+ [6 h; e* M1 f
7 E9 `+ ^  ^& |9 J2 G# Z
. Q: b( s. N/ K
Method 05
* ]- r: J$ A2 I' }=========4 ^& Y1 }2 r+ c' V9 O; D4 R

# r0 Z% f% ?  U. LMethod seeking the 'magic number' 0F386h returned (in ax) by all system
- s: t; P# J, h7 I" Pdebugger. It calls the int 41h, function 4Fh.
  n, l2 ~4 ?0 F9 `5 C: Q* IThere are several alternatives.  
, l+ a$ x  b1 O9 {# L! B/ h' N7 K) Q( O4 c1 ]
The following one is the simplest:; V4 L" @- V9 d. z) Y/ g

/ W- s: v  j: K" j% A  Q9 e2 V    mov     ax,4fh" o. t' X; \1 t( ?7 p2 Q- B! Y
    int     41h- @7 ?6 j+ K& q! q" j* Y3 B
    cmp     ax, 0F386
: o2 Q# m0 h1 \, B4 W# `1 L/ r& y. O    jz      SoftICE_detected
2 \9 E, t6 ?& ?7 T1 ~2 r3 K2 X: d0 B* V/ \# l

& j1 B' X$ [4 `& dNext method as well as the following one are 2 examples from Stone's - ^8 u  ]0 H$ Q2 V
"stn-wid.zip" (www.cracking.net):: q  v  `- ~/ ~6 D

: Y: {  U; f) _3 z* r7 K    mov     bx, cs. H0 I# d1 L- @+ x6 J0 t' S5 C
    lea     dx, int41handler2
- |  p# n* a- l( O    xchg    dx, es:[41h*4]
0 }  e! X4 W: }  y    xchg    bx, es:[41h*4+2]
( w$ X' Q- G: t5 F# x    mov     ax,4fh+ F! r0 {+ p& G& g
    int     41h
* d4 ^  h& _* k- @4 K& ]8 X    xchg    dx, es:[41h*4]
% `8 \4 z. s, p) ~3 e, G) g, p    xchg    bx, es:[41h*4+2]9 Y* l  S' V. @. B+ Q
    cmp     ax, 0f386h) ]) p( w( ?8 F! k- Q# S4 y
    jz      SoftICE_detected5 ?6 e* ~/ S8 z! H# A

( y" M; t% p7 `8 |$ j: p" hint41handler2 PROC3 F* L6 w- r- R1 f! q2 R6 T! S  Z
    iret
1 n' \# y# A3 F2 A7 Uint41handler2 ENDP8 P5 B; w# u3 R& S+ X$ j1 A" t

- ?+ r7 ~9 K0 g
0 `7 A4 h% B+ ^7 |% R! S, P_________________________________________________________________________% Q4 x& Q; L- t
; g5 d/ a. P, m+ `; }
/ n$ ^3 Q7 U% Q! ]2 b$ f, ?/ O+ W
Method 066 Z; Y6 l0 c- q! n9 e# g% Q
=========: v9 I1 I% Y) ]4 V# \9 @- ]
: t9 ~4 A  x& U; \5 d7 ?1 v
  U- ]9 y; ]2 C3 o) Z2 [) R
2nd method similar to the preceding one but more difficult to detect:( X& l  R: X) D6 ^
' l% n% W/ g0 F5 C; B

3 Y/ O5 `6 a) h: W! Dint41handler PROC7 k2 Q5 F& o- j4 E3 S
    mov     cl,al
% c. P0 X/ `5 f, H$ j1 I    iret4 S" w5 M8 @6 w  Q) U7 y
int41handler ENDP  L$ G- v0 z$ i/ m; q
8 z6 Q4 m: a5 q5 q4 w

/ l* _  d3 R. l/ v: Z! }0 e# [    xor     ax,ax
6 E8 @7 D0 ?& |: F1 [! i- s    mov     es,ax; P) G/ |3 @  A2 @' C+ p
    mov     bx, cs
( v) h) ~6 J% B5 \" X, o( Z    lea     dx, int41handler0 F/ S) `8 U* ~3 V9 [, t! ?
    xchg    dx, es:[41h*4]
: {& S- B2 o8 o7 `* C4 f% I8 q    xchg    bx, es:[41h*4+2]. X- Q; C/ C1 j" \7 Q; H
    in      al, 40h3 ^( n6 X" @& ~1 y4 o
    xor     cx,cx* `( y6 ?: B. q( U$ _8 i
    int     41h
. c% l; ]1 c5 Q3 C    xchg    dx, es:[41h*4]% K/ m! U/ T3 n. j
    xchg    bx, es:[41h*4+2]) k) N  B& P' E! L$ U
    cmp     cl,al
4 I2 \) Z/ C% x9 @6 Q& \* b# N% g    jnz     SoftICE_detected
7 Q; M  C5 P9 O! Q- Z0 ^- Y) O! `
5 H5 ~" D. x5 }( U+ Y_________________________________________________________________________2 Z% P& V1 s; S+ L
" m' s  n0 c3 }$ C
Method 07
" F& l/ U0 T' ^! m=========/ y; b6 i5 T, t! s7 d: O
8 a/ K' {- h8 A# g
Method of detection of the WinICE handler in the int68h (V86)
; Z1 y. r( L" j" r0 D' D0 P3 y- Z% ]' i% Q( ~1 x3 o' \$ V
    mov     ah,43h% P8 }  V4 H# e- _  B. X3 u
    int     68h  v7 H! v& V  y
    cmp     ax,0F386h
1 U6 Q5 I: c/ a& M+ `% t' X$ ^* r' a    jz      SoftICE_Detected: ]1 p% G) U/ }; Q$ @
* E3 x' P5 A+ e4 g/ a" q/ d5 G

& P0 T3 B/ }. y8 A  h=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit$ K3 [1 {! t, Y' a5 W
   app like this:2 R* s& \! o7 _3 q1 }6 k, y

. ~/ m0 Q$ F( L8 I" T% M. _   BPX exec_int if ax==68
( ]! k  l  B% z. v; b7 a9 A/ z, q9 v   (function called is located at byte ptr [ebp+1Dh] and client eip is
. M6 j& V  ?6 V5 H. c+ U   located at [ebp+48h] for 32Bit apps)! }, L2 ~& k  J3 g* X  [) F
__________________________________________________________________________
! M' a: n; S1 o  @7 C) F% Z- F5 X
  a- u; z/ c5 d
Method 08, V& O3 N& ~8 L/ B( q$ @
=========; H5 A  @* ^& u  \* z
) c' }' b  J& [8 M
It is not a method of detection of SoftICE but a possibility to crash the& E9 I  F( p1 `3 P5 J, V0 J
system by intercepting int 01h and int 03h and redirecting them to another
& s) \" C2 b) W$ {2 ]4 Eroutine.
) I/ _, A' ]5 s* t0 Z2 b4 k5 mIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points. j# Q9 n5 {0 T3 I: U$ M
to the new routine to execute (hangs computer...)
  n1 ?8 u5 J5 n. b3 M
$ ?9 x- _$ i8 v( S  q2 E8 q    mov     ah, 25h2 p9 Z5 C- K5 Q& ^/ m+ V5 [! z7 `
    mov     al, Int_Number (01h or 03h)
" x) Z0 i& y+ r) l0 Y- j    mov     dx, offset New_Int_Routine7 s- f  u# g& j' ?$ z; V
    int     21h
6 ^/ ~* k& F4 {/ T- G/ A% |
& ?8 ^4 L2 R3 F+ p+ k3 R, v__________________________________________________________________________' T" C6 [6 r; L! [' D  }$ `' t0 ~" s

- Q* G9 D  {% y( q% K& K9 @Method 09
$ o+ m0 b1 ]2 d) G6 E=========5 i& K! w! W6 ]% l- c. M

. v/ S1 K8 s, h7 h+ k5 p. {( kThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only: _+ p$ l3 u2 M& ^# R
performed in ring0 (VxD or a ring3 app using the VxdCall).
* G7 a: u' I# W0 l% iThe Get_DDB service is used to determine whether or not a VxD is installed
2 s& v, x/ R& B8 V" w1 J* Lfor the specified device and returns a Device Description Block (in ecx) for' u/ r- q3 a9 g8 D$ z) i7 T$ D
that device if it is installed.7 d/ K4 u8 P. A/ S

0 Q4 n0 \& }9 a) y' G2 s   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID3 K1 s) [& K7 A9 b
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)9 @+ G1 k, ^, ~2 A- W/ f7 A2 `7 N
   VMMCall Get_DDB
  i. m2 q0 B, w2 ^& ~   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed- S! n! U% |; p
# C9 l$ N/ F7 @0 ]3 r! r
Note as well that you can easily detect this method with SoftICE:
# O8 z2 {9 D! }& }- H  `& E' U& E   bpx Get_DDB if ax==0202 || ax==7a5fh
. G5 l! k% j" s  w8 Q
" t& N4 j, R- t) }8 U__________________________________________________________________________
" n. _- B- Y, F7 F6 [8 k* W. G; I" b5 Z' J- O9 q0 r2 G8 o
Method 107 T8 \% N6 U+ q" c
=========
& F" S& o5 X6 U
- N2 }9 ]- c* C, j/ G=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with7 Q) S0 V+ m" ]: p$ A7 e! G0 D
  SoftICE while the option is enable!!
' E7 |6 d% q) _
6 ^3 V5 c) i7 h& J9 M; tThis trick is very efficient:
, S5 E0 v$ a" @; M2 ?# h- u& Yby checking the Debug Registers, you can detect if SoftICE is loaded" F* }. i+ k9 w5 G$ h% [
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if" K, K+ b9 y  e9 f& _) r& c7 t: M% ^
there are some memory breakpoints set (dr0 to dr3) simply by reading their
- O2 U7 [" L6 T* qvalue (in ring0 only). Values can be manipulated and or changed as well3 c, m' Y. T5 P; L* x
(clearing BPMs for instance)7 m3 O8 ~1 a+ _0 y# [! c9 d% ~

" ~- P& J* _, x__________________________________________________________________________7 n1 E) ]8 w) d& j7 b
: R& E4 o# u) G6 ^! c! t
Method 11
) J7 w4 J* d3 P. ^& |, E; i=========
( i% G$ ~1 k% H1 Y
  U5 J7 [. X' ?$ _/ U1 u. hThis method is most known as 'MeltICE' because it has been freely distributed
# Z1 V/ I, y% Z3 @via www.winfiles.com. However it was first used by NuMega people to allow
% `/ r6 _# M) X& i  f  ^2 t; @Symbol Loader to check if SoftICE was active or not (the code is located! z  |) u5 k4 ?( F  |# `8 T
inside nmtrans.dll).
2 j8 a6 s5 z9 r* N2 V0 _  L
! S) R% Q3 z1 LThe way it works is very simple:
% {) {+ b* d9 B) J# W& e  kIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for. `9 H# r, J& S0 r' k
WinNT) with the CreateFileA API.% `0 d5 W) B4 U/ L
! s/ {9 b/ s  x4 h8 a
Here is a sample (checking for 'SICE'):
( w- h# k& ~; o) D/ ~$ A. M- ~& T5 }8 a  m+ N( F
BOOL IsSoftIce95Loaded()
4 H, \7 Q  S  L$ U5 A; |{  V8 B' J, g9 `: f1 Y: ?3 Y
   HANDLE hFile;  ; {( k6 j) ^8 ]& g0 u2 O6 t3 Y
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,. J1 V" K& ?, n; @, Q+ W
                      FILE_SHARE_READ | FILE_SHARE_WRITE,
; M7 h5 K, `- I- Z5 _9 {                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
. @) M( V. z9 f2 q# ]: D   if( hFile != INVALID_HANDLE_VALUE )
6 i3 O" g- @; g* y  x   {  g9 d1 E9 P; a) [, w
      CloseHandle(hFile);
' Q; x) H2 M0 ^3 A# t4 J      return TRUE;
5 W$ R5 {' {' L1 T, u" s' N, Y$ Q   }- A, ~3 Z3 C3 _+ D) t. B5 C& F
   return FALSE;
& `9 g4 }6 L$ _}
& d' j2 U+ s% t* U6 ^! u
3 I3 D& N  p$ ~: v% P, zAlthough this trick calls the CreateFileA function, don't even expect to be
5 ~$ ~0 U+ C- R  B9 J3 _able to intercept it by installing a IFS hook: it will not work, no way!, W* S; `% f1 ~- l
In fact, after the call to CreateFileA it will get through VWIN32 0x001F- i1 n6 q# [& \
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function). ~- l& P3 E* i1 E0 ]
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
) L3 E1 b# d% V& F8 kfield.
, q, {2 _" |6 h; `8 ^9 {In fact, its purpose is not to load/unload VxDs but only to send a 3 ?, k2 \1 j, W1 r, r  ~# R
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)& \6 o; _: Y2 I/ e7 [
to the VxD Control_Dispatch proc (how the hell a shareware soft could try% V& o: J- J3 V. W  V6 T' P  B
to load/unload a non-dynamically loadable driver such as SoftICE ;-).: Z" C; f+ t' ^# p  f& ~
If the VxD is loaded, it will always clear eax and the Carry flag to allow
" h, T" p3 e$ k- q, O0 h' T" u+ Mits handle to be opened and then, will be detected.& g% H" g' m4 m/ e
You can check that simply by hooking Winice.exe control proc entry point& P5 |  `0 R. F( y
while running MeltICE.7 x' |' z4 S3 b% C8 I' S# _7 y
/ a! c+ \$ m% d% B6 D, |
% G& X6 v  U% O
  00401067:  push      00402025    ; \\.\SICE
/ F7 H, @# V! c  _9 g+ o  0040106C:  call      CreateFileA7 \! b) a" r- J2 r9 q4 u
  00401071:  cmp       eax,-0011 z0 I) f8 X6 E7 d- e3 d# g5 `" @
  00401074:  je        004010915 S' Y! f8 u( O, y, K  m0 P" P

3 s; b7 k- M4 k, K; N$ n% A0 U+ }# o6 c9 ]0 `2 v6 n
There could be hundreds of BPX you could use to detect this trick.
4 e" P% ~+ W& A6 i4 a-The most classical one is:
3 }) ~% t7 }* f% n- e  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||4 s, [, a+ j7 w8 h) b5 c# U( ]
    *(esp-&gt;4+4)=='NTIC'
& x3 p5 ^: v' J
9 ^$ T" T' n! B4 E  m1 Q( Y" E) Y4 {-The most exotic ones (could be very slooooow :-(7 {, T2 ^5 E* ]0 i3 `
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  0 V5 b1 f0 L9 j0 [" c9 i  ]0 ^
     ;will break 3 times :-(' P9 ?$ ^" D3 c5 [0 V9 X& g3 U" O

$ g" b) M2 Y" z  ?( u  ^' ~. K-or (a bit) faster:
' j& Z3 x3 a5 r1 m( o   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')4 W  c- n4 T, ~: \# C! L

8 d. h/ s7 R$ U8 I) n# l) N7 D   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  - N& ?1 C5 v. Q% r0 E
     ;will break 3 times :-(
: ~8 ^$ k  A% s1 [. ^$ q. r, u5 d4 e
-Much faster:
9 X( V7 ?: A) T9 T% }2 n- G   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV', _+ E0 O/ y9 o; H1 }' R: A
+ ?7 J4 ?, J& P, i( L, t
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
7 m' n2 V5 D, W( T. J: }; ~function to do the same job:- U: x: ^% a* ~  S  w0 F: Q0 [

( c8 P" \% O: ], A* T6 y   push    00                        ; OF_READ
  d7 N' o8 q# D) R1 g$ @   mov     eax,[00656634]            ; '\\.\SICE',0
5 r9 T) W( g3 M8 ]( W6 n   push    eax
' ~) [" L6 O7 m& I1 u   call    KERNEL32!_lopen
1 X: c$ o: d1 ]+ _) M: a, u   inc     eax0 ]" E& P& ^, K! S
   jnz     00650589                  ; detected; r7 g$ ]$ {  P) _
   push    00                        ; OF_READ2 v8 W8 r- [: [0 c
   mov     eax,[00656638]            ; '\\.\SICE'
/ d8 R( n9 g: s   push    eax
: d- B: T' L. ]   call    KERNEL32!_lopen8 f2 @( b9 s' O$ n4 G$ E
   inc     eax
( M0 M, F8 P% g5 P   jz      006505ae                  ; not detected
; B6 K, ]  m! M  X: K! c/ p/ _  M
  N" H9 x. Z& U1 ?5 r; Q/ P
__________________________________________________________________________& ?8 X$ i/ ~7 b# c! A: _5 V

3 ~" [; z* Z. r! y. v3 ?Method 12: a  f/ n# u! v' f) k' \1 i
=========
$ }& J7 P( R( E- i% F" R9 Y9 J8 x/ a1 K
This trick is similar to int41h/4fh Debugger installation check (code 05! ]7 e# M  I+ `9 P, \
&amp; 06) but very limited because it's only available for Win95/98 (not NT)
1 d% H' j) ?, v$ n% z+ y! x9 ]! Kas it uses the VxDCall backdoor. This detection was found in Bleem Demo." g8 h( v$ E, Q1 ^# a0 Y" V, b
/ I$ \7 u# J" a
   push  0000004fh         ; function 4fh
, O* E" t5 V9 U   push  002a002ah         ; high word specifies which VxD (VWIN32)/ T+ R& f! `# S& m) i2 c9 o! v
                           ; low word specifies which service
7 D( m) z7 N% @+ J                             (VWIN32_Int41Dispatch)& l- o5 b  a  _' C$ A* l
   call  Kernel32!ORD_001  ; VxdCall
/ B, d5 a( W8 B! k/ x+ v5 W   cmp   ax, 0f386h        ; magic number returned by system debuggers; X; D$ R. k: x3 C# K" M
   jz    SoftICE_detected  W& R$ `5 @8 O' o8 V4 j# X

# g' H* V7 P: ]1 l. B2 d) n- f1 Y7 bHere again, several ways to detect it:6 O* X6 }1 n# m9 f+ {7 t
9 p( X2 c; ?" |7 m/ u$ X
    BPINT 41 if ax==4f
$ Y) y. Q% V* c, C+ h
! ^) t4 j& {6 {) k    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
( |) T) c7 n' U9 f- {
: ~5 J% G7 g# f/ d$ T    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
: }9 b0 o- D6 V: i/ a2 X5 q3 s. S5 ^
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!8 |. G, s1 S4 z, f0 O

7 w, |! K1 e4 u4 z__________________________________________________________________________, S" L5 n( e  D( _

* Y! O9 p" E/ \( x$ i1 y8 n+ [* T, |Method 136 |7 r( c2 y/ ]) U- H6 @
=========
2 }* ?6 d- \2 Z. p# W$ O
4 x+ k2 i0 a! lNot a real method of detection, but a good way to know if SoftICE is6 K, M; a% h. a& L: j
installed on a computer and to locate its installation directory.
" I+ U0 \+ d  r, B  jIt is used by few softs which access the following registry keys (usually #2) :
6 E5 t: k1 e7 @3 O3 x
& T& E# k; z  p: y" W-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
+ c# p+ K4 A8 {" e8 X\Uninstall\SoftICE  U4 R7 _, j/ h6 X" L* W
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE3 u$ x6 R4 |( B  z9 p( N
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion9 u* u2 f# b& B# Q
\App Paths\Loader32.Exe+ m0 b( W# a$ D" I: _4 \! y
: n9 e# w$ s( ]
4 m) y9 y3 x. h9 o8 j
Note that some nasty apps could then erase all files from SoftICE directory
- P& @9 |1 p4 H' G0 q(I faced that once :-(
$ C4 l0 r7 Q4 |, n% Q
! ?/ a* n" O7 tUseful breakpoint to detect it:# r4 h& g- R/ o8 j$ h1 _

8 b4 a" W& m( D$ P& V     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'7 v9 w1 z" {$ }+ s8 |0 H% A

5 S  k5 i6 D. W/ H: E: L__________________________________________________________________________
% W" [- P" T- w( d$ W
  Q1 M6 X. ]' q6 F7 @6 k0 M; Z: x6 |8 {1 o5 y& q+ z3 H. e) N
Method 14 . v; k0 |0 r4 [, w- @6 d
=========2 Q* G4 t2 V2 Z+ j
6 z2 ?' T6 V: \% g" r. i1 e
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose5 Y, M& U4 ?" I) E- ?
is to determines whether a debugger is running on your system (ring0 only).
; L: g$ Y$ i3 O, M- d5 c, w2 Q  \
. n- ]) e" J* [! D   VMMCall Test_Debug_Installed3 ?8 s$ r, S; F- s3 }
   je      not_installed
) e$ P6 p/ h6 ^. T2 _! }% f& J8 @0 J
This service just checks a flag.
5 Q3 ^' W/ e! K/ V$ G# M</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-8-7 20:44

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表