About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>2 n2 R/ R0 @5 J, n1 ~0 e; z# F5 i& g
<TBODY>
6 _4 D* S* {: j; c' c5 Z, a<TR>6 [2 {! ~6 G( O* C, c
<TD><PRE>Method 01
9 _7 A8 _5 z4 @# R5 b=========
& O& h# A/ w; l8 e, C; @. y
* ~& S/ Q' W9 N1 u$ G4 EThis method of detection of SoftICE (as well as the following one) is
, s" W6 l1 [+ A% h3 [8 Rused by the majority of packers/encryptors found on Internet.
% R. T/ r; a0 N% c( PIt seeks the signature of BoundsChecker in SoftICE: F( c0 u1 a* J9 d* Y* A4 l9 b

0 n4 X% f% h" D* h  T4 F    mov     ebp, 04243484Bh        ; 'BCHK'
& l7 d& l& x" X$ f2 O, J    mov     ax, 04h
5 t/ W( I' i9 P    int     3      
3 [4 ?: @5 r4 G( L0 K$ a3 ]0 c    cmp     al,40 W5 C3 ~& b$ W8 B4 ~, v7 |
    jnz     SoftICE_Detected2 A% H' r3 Z/ O+ R; P) _0 `
: Q9 h* N9 `5 ]# J
___________________________________________________________________________! s* Z! r' [; r  d' h" }- Q5 {

, k. T  D% \. j3 vMethod 02
$ m4 p) y5 v+ W6 ]- L9 k$ J=========7 z, [0 w3 j4 r- ?9 z  V; H

, e- B4 _' d, ?1 o/ o/ e. HStill a method very much used (perhaps the most frequent one).  It is used
7 K1 T" N: h" mto get SoftICE 'Back Door commands' which gives infos on Breakpoints,- U3 T, m: Y) \' F% n" r
or execute SoftICE commands.../ L) {" f/ ?. b/ I0 X! s
It is also used to crash SoftICE and to force it to execute any commands
" p: O2 {# \# U+ I5 h0 {- G. L6 i! a3 C(HBOOT...) :-((  
% p/ G$ B) _7 y& q
: q: G! `& c+ `( \/ T& x: AHere is a quick description:
0 |8 l' L* F/ {3 I) F3 K-AX = 0910h   (Display string in SIce windows)- m& {- t( @0 ~
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx). ~# f8 Y* d2 N
-AX = 0912h   (Get breakpoint infos)2 v: L1 _& D! e; U; j
-AX = 0913h   (Set Sice breakpoints)
: a$ u, X' i  \7 R* W" x) h-AX = 0914h   (Remove SIce breakoints)
( A: W6 ^1 S( T; o- O1 s. Z8 a. M
  L4 u; ]2 U5 n  t! OEach time you'll meet this trick, you'll see:
* |& k' g/ e2 _5 ^1 ?; J-SI = 4647h& P( t7 w- e" x( ?
-DI = 4A4Dh. _  a8 X* `) @; i4 u& ]. q) B
Which are the 'magic values' used by SoftIce.
4 J' i! m" s6 A# _4 ?7 S4 nFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.7 L# |. `( c! w( q8 ?
' J2 T9 E; M  D1 p
Here is one example from the file "Haspinst.exe" which is the dongle HASP" c) I; I0 I9 ^; ?
Envelope utility use to protect DOS applications:
, s" w) s' ^; r7 U
6 p( j% t# K% }% I8 W7 {; V; ^; E' N
4C19:0095   MOV    AX,0911  ; execute command.! J1 _# H2 s% x4 t3 g
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).4 A1 t! ~; e6 S0 p; v/ t* q
4C19:009A   MOV    SI,4647  ; 1st magic value.
3 a! R/ L) D! ~1 c; y! H2 b( q! t) [9 |4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
( ?# W- B6 G3 l5 S. u% r4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
0 Q, F: O0 P+ M, a* A) c4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute$ [4 `8 _  T% f# ]$ f/ {
4C19:00A4   INC    CX* h& b/ j* c0 A" y
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute" s0 M% D: u% J4 E6 o; t1 h, _
4C19:00A8   JB     0095     ; 6 different commands.7 B4 Y+ I& @& g9 U
4C19:00AA   JMP    0002     ; Bad_Guy jmp back." C& t* F9 O. q' `
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
. y$ M- S% a+ [, o2 A0 P! V
' H5 j' D6 G3 A/ }  k: e4 e  `The program will execute 6 different SIce commands located at ds:dx, which1 ], B3 F, P7 H* Q6 ]
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
2 N9 i; L  |# J; v& S* W% g; d
6 H7 ?2 ^$ }, o/ r4 M8 Z* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
4 ]- L" F  p% ?# ]! B___________________________________________________________________________- h2 }& E( U& \" l
) Y# U9 ^+ C: c# O! v: s. S# l

/ G( S! \6 B5 z+ \/ C" l$ EMethod 03/ A) g+ S. K! j7 }
=========
- @2 J( z( M* L8 ?- c/ n$ x- f; N+ i) h( f$ I
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
1 J) D" ]0 L9 Y) V(API Get entry point)) x2 S9 `$ g, r6 l5 d' x5 C6 m- [
        6 G0 o8 W7 ~4 [2 E* N& I
+ D* C& q/ W) [
    xor     di,di
" h4 y( ^; S( W! g7 d    mov     es,di
6 ?: `/ P/ T- e# `3 G! |    mov     ax, 1684h      
% X# x) \" c# ]" D+ h    mov     bx, 0202h       ; VxD ID of winice% ?9 x( _. ]! o3 `
    int     2Fh
* Z  _, m5 k5 a8 y0 ^' a    mov     ax, es          ; ES:DI -&gt; VxD API entry point
' d' ]& H( ~& l3 g3 i    add     ax, di
! G* w; {% ~- _  l8 l8 y    test    ax,ax
! R; j  D7 Z! s& k  ~3 U4 o    jnz     SoftICE_Detected7 x  W5 z6 P3 O3 ]' j

5 k3 q7 s( D" p% p) Z$ G7 z___________________________________________________________________________9 o% e+ A0 n, u; Q9 N

  X0 T5 w, F+ A( c# t+ N5 KMethod 04( `% Q" s) @7 q
=========
* Y0 J2 ~, S$ t( K. c& e0 q+ Q  L2 ]5 P3 D
Method identical to the preceding one except that it seeks the ID of SoftICE; Z' z% r$ A% s$ |7 K: X
GFX VxD.
5 |- G8 O9 Z5 S' P$ k  @+ c8 V
- [7 `- n0 A$ F    xor     di,di
! ]7 _! w; W& W$ H    mov     es,di6 t2 r2 P; u0 d& p  N. P( W: F% w
    mov     ax, 1684h       * n+ v7 R- c' Y' Y( L7 T- X
    mov     bx, 7a5Fh       ; VxD ID of SIWVID
8 T6 n; A4 ]+ L1 G    int     2fh* U2 \% v$ @: X& ?8 Q" [; c3 B& p
    mov     ax, es          ; ES:DI -&gt; VxD API entry point9 e8 H; r4 L* ^
    add     ax, di3 |3 R' \; L2 S" O* e, j
    test    ax,ax$ [! {* [( o1 K( t) V
    jnz     SoftICE_Detected
. [# i/ O( A; j- R
$ P  j$ p5 G* p__________________________________________________________________________* }3 n6 N; J& O

0 T, \9 I: o7 Y: @8 A
" Z. e. D% t7 y  k& ^, @Method 05
5 p( J3 |! C+ ?- p" U" f=========
9 Y: e3 b% v: H# C# M; k/ b/ x
4 @" P, a* M: h3 e8 d9 \1 rMethod seeking the 'magic number' 0F386h returned (in ax) by all system
* [- e* |3 ~( o9 z4 H* edebugger. It calls the int 41h, function 4Fh.5 D- K: K) a7 \2 S
There are several alternatives.  / k6 r; c0 B- W1 l: ^6 [* g7 q

$ N% n% `3 }1 F; IThe following one is the simplest:! e: ?7 g. C! L9 @- W

$ y( w0 b2 o7 D1 [    mov     ax,4fh; S  X3 U( A5 x- W6 d' L  u$ _3 [
    int     41h9 Y8 k! p& s4 d* ^1 v* O
    cmp     ax, 0F386# R' ]; Y% x3 s' r( h/ G
    jz      SoftICE_detected
4 b/ ]% A. o; [9 m$ I6 U& [: a# }5 |

: e( l2 I, W, P# P& U3 CNext method as well as the following one are 2 examples from Stone's 2 w% r2 v6 ]7 Z+ U3 J
"stn-wid.zip" (www.cracking.net):
, O7 {* V2 t/ d0 r+ _
1 F8 q9 |( w* w5 Q9 c) a' P% M    mov     bx, cs
1 o7 k  `9 G+ ^5 l8 U) g+ ?+ w* q0 U/ {    lea     dx, int41handler2+ a" w& k+ o: T  e
    xchg    dx, es:[41h*4]+ x$ K5 ^  E3 f. @- K6 w; Z
    xchg    bx, es:[41h*4+2]
9 B( t" I; P+ z0 ?    mov     ax,4fh/ r( H. V) _9 B4 G4 G
    int     41h
% |% x5 S8 A- K6 g7 ^1 t    xchg    dx, es:[41h*4]  t6 A1 y) m: Q5 v3 @4 Y, F
    xchg    bx, es:[41h*4+2]
" u. e5 X  F- }# N: \( j. G3 U5 U$ U    cmp     ax, 0f386h
4 l5 _$ s. R' \# ]    jz      SoftICE_detected) W5 ~0 g1 P( P+ V
3 k! \& b- }9 V3 ^/ J# `/ D
int41handler2 PROC& t( D+ h5 Z1 L) L4 ?! w
    iret2 d3 V: W8 R: v; S/ H
int41handler2 ENDP# }) }% q! w! |0 l) ]9 E( _

- G" m: b, R! o( m! ^5 B5 b( V. m; t% a
_________________________________________________________________________& h7 |- E: T/ Q4 x+ l5 A
4 z3 }3 y8 Z1 P% O( o5 V; i9 s

4 @  X3 h2 H0 m+ VMethod 06
0 {) Z, ?/ K0 J4 Y) Z8 ]6 c& }=========
- H! Q2 y& ^, ]; U: Q) [+ W( Q( p0 ?! n  S- q/ R! w

: R6 V9 z: C  }. T: U$ L) _2nd method similar to the preceding one but more difficult to detect:
; b( r5 S! n1 [( N/ Z# l
1 s* T; ]; q5 p# d
0 A4 ]  J- \2 J/ Z1 ]8 P0 x1 Wint41handler PROC
7 }; e5 ?9 x6 t. z* }    mov     cl,al
% w& V( j1 g! G  Y1 ]5 o    iret5 |# N9 ]$ E& Z: Y" K1 N; |9 F
int41handler ENDP
# z0 b/ j- F7 W$ I% a
" }5 {3 B: i" \# g& w
6 T  F" R) Y# p+ O5 e2 H, W; w    xor     ax,ax. m8 z6 f5 k& S1 W& O( U
    mov     es,ax9 @+ f% V, |2 a0 V3 {- M* S7 y# _
    mov     bx, cs
. a; d) N  d8 k    lea     dx, int41handler- H" w% {6 W/ W) d
    xchg    dx, es:[41h*4]
  i. p# k) `% x) O9 P, Y& k7 Z5 c    xchg    bx, es:[41h*4+2], M& r/ D8 q: j& ?/ f  ~
    in      al, 40h' {7 d  T* H9 z3 ]* }: ^
    xor     cx,cx4 n; A3 C( W0 q* B3 I
    int     41h
9 c/ S" x3 V) v8 n/ o( U! r    xchg    dx, es:[41h*4]
4 v' k7 Z" Z( Z! G; w    xchg    bx, es:[41h*4+2]
! E6 m7 k4 m, }% d8 h1 @0 P$ }5 F    cmp     cl,al5 L* l( G: }$ F. h% F' O# `, E
    jnz     SoftICE_detected: ]6 V! V  B8 b

% y; O$ p) L8 [_________________________________________________________________________) Q4 T) n& X7 o$ ]

; T+ J5 V0 x8 m2 j! nMethod 074 s4 W1 e( `1 Q! f( X1 H. P5 {4 _* d
=========( M) C; p, @# h6 H4 ^9 \3 H* s
# \$ I0 L& y$ A* D/ V( ~* W
Method of detection of the WinICE handler in the int68h (V86)5 P& F! O0 _9 Z/ G

0 |- M2 \$ J2 k3 C! P    mov     ah,43h7 Q! T% S( Y) t9 w8 A
    int     68h% O* \5 ^9 K7 {1 N( b" D
    cmp     ax,0F386h" a/ p: U: o# v# n; y
    jz      SoftICE_Detected
- ]! Y6 T' ~3 M
4 o1 h2 B( c% \3 ^6 ?. f- `0 j
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit/ u' m" V% B/ W; s1 O  y  n
   app like this:
: b, w( }: `' A+ D* N
0 J2 r1 w5 ]8 R- N4 |0 r, J  w$ S   BPX exec_int if ax==68& T: Z  P8 F8 x
   (function called is located at byte ptr [ebp+1Dh] and client eip is
' }4 g2 y  U- m5 C7 _   located at [ebp+48h] for 32Bit apps)
  |" M- T' w8 v# N# ?/ n. f__________________________________________________________________________$ ~* w, m% K# l9 {& r9 r" l
: ~/ X* A3 D/ {, S5 B
6 a3 ~6 ~+ N) G: V0 N
Method 08
0 B, O3 O  O- F: I' J" }9 R=========
9 ], a) M" L4 G" J6 P. K! S
/ ]3 d  ~# }5 x/ O" C4 h* t  F: LIt is not a method of detection of SoftICE but a possibility to crash the1 e' O! |3 a! k% y7 m
system by intercepting int 01h and int 03h and redirecting them to another' A6 @& g6 k% B( u# O* A. J
routine.& B4 R1 D1 A7 I" N4 l
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
! m! L4 D, Z6 s* tto the new routine to execute (hangs computer...). m7 A9 O% G0 e- N, b# G
, U7 h$ b  d3 m6 C; b- p
    mov     ah, 25h# h' Y" @/ z: |; Q7 T
    mov     al, Int_Number (01h or 03h): Z9 u: I1 d! _' O
    mov     dx, offset New_Int_Routine, i, B4 f* v; P* U  }/ k
    int     21h7 U0 s3 H0 T6 K* W3 h, Q1 W6 H

! W  l+ p2 w, H( ^; x* u, ?__________________________________________________________________________
1 U% X1 [' m( w8 w3 W! I, F$ o7 e. `: A$ i+ m$ [% J6 t
Method 091 b7 D8 u8 t$ A0 d* d4 q
=========2 A. F/ M2 c1 H9 {

' V9 x/ R; V! m" w: tThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only  e- b- j/ |( X# y& j' {
performed in ring0 (VxD or a ring3 app using the VxdCall).% Z9 o5 }: f2 E
The Get_DDB service is used to determine whether or not a VxD is installed, l$ m5 ?) h. n4 Z" ~. J- N0 A
for the specified device and returns a Device Description Block (in ecx) for
" E( e4 Q$ b# n. Fthat device if it is installed.
5 Z$ r! z7 C5 ~( v  S+ y
) K9 ^6 U- A2 q   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
" g. \6 q$ L& B1 g6 f7 p/ U   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-). G( m) A) Y  v6 V2 E/ E
   VMMCall Get_DDB
# \+ i: S: @4 W+ z   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed4 R1 d6 a! m6 r" Q  n! I* k. K
5 W. E( l1 e# }
Note as well that you can easily detect this method with SoftICE:7 j7 M+ P) B, g  s" D: E9 s0 R
   bpx Get_DDB if ax==0202 || ax==7a5fh* c' q9 x/ `( j0 O

! |. V: R* ?7 W* j; \# R& p__________________________________________________________________________
6 Z' o& t$ z: ~* |! H: Y
5 w/ @5 u6 b% ~$ v0 l4 EMethod 10! f3 u7 L' O, `3 A4 ^
=========2 V( Q- G3 T& S: ?
; R: u  j7 T) l+ H/ {) ?4 O. A! _
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
& n$ R- I2 e' n# m0 T3 f  SoftICE while the option is enable!!- v- b5 B  S$ T3 Q

2 j" _5 e( X' d; zThis trick is very efficient:
6 i. t& o$ |& d& X" Zby checking the Debug Registers, you can detect if SoftICE is loaded
$ O$ U( e  j9 t0 G& K5 O) M1 X# T9 u(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
- l. r" J& @0 r  G' U+ ^there are some memory breakpoints set (dr0 to dr3) simply by reading their5 A7 V" l9 V4 d
value (in ring0 only). Values can be manipulated and or changed as well
. f3 N- M( K' q7 I(clearing BPMs for instance)8 f5 T. [  M0 j1 D1 O! L
- U/ g9 ~5 E( R6 P/ S: D) N' w- }
__________________________________________________________________________6 _( f$ ?: l# ^! y3 `
8 d4 `4 v  V4 X! n, T$ g( C/ H
Method 11
7 }6 t$ e% X1 ^& a4 u6 D, {" V=========8 a" `8 R1 h+ C1 M& D+ q9 |7 T7 H
8 G7 c& _9 r7 s" }. {- A1 t
This method is most known as 'MeltICE' because it has been freely distributed
8 p' H3 T3 v) s( qvia www.winfiles.com. However it was first used by NuMega people to allow
* Z' T- L' L; _2 c: n  HSymbol Loader to check if SoftICE was active or not (the code is located: e7 Q- H! F# h# [2 \$ K: Z& l( ]
inside nmtrans.dll).7 Q( f' K% u8 l) P

8 L' N2 O& o: D! s) l( P$ X: \The way it works is very simple:& D" o1 D+ A! c8 u0 m
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for5 P# t' p* v1 o3 M9 v
WinNT) with the CreateFileA API.
/ i# D) _1 h3 F- J! F+ [8 s; F. l5 M# K( |  k( q" w
Here is a sample (checking for 'SICE'):' J- r* T' `9 l* V  x- k4 H

4 [) y9 V: D( X; PBOOL IsSoftIce95Loaded()
7 y' O& M5 L! d+ x/ \{
9 h0 t2 Y, u" W. i' z1 A   HANDLE hFile;  ) Z4 U: Y0 `' E; g. P' i8 }" b
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,7 H" K; c4 |7 o- k/ t
                      FILE_SHARE_READ | FILE_SHARE_WRITE,
/ _! p8 C) C* U: u9 s                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
4 M1 u$ c$ P3 f& Q. V   if( hFile != INVALID_HANDLE_VALUE )
5 U  q8 l4 F+ A, Z6 M6 d7 H$ C" ^) `   {& s$ b2 b: r. R% W- x. Q4 Z! y3 K1 I4 g
      CloseHandle(hFile);+ D' B5 L% A* y/ S4 X
      return TRUE;
- t  y* c/ h! @7 V1 X% z& U   }
% l6 R* ^! k3 L  n; g   return FALSE;
0 I5 P; {  T7 B1 C8 [* n}
$ q+ {$ J( L  p+ O& k, H. o( I7 r  c
Although this trick calls the CreateFileA function, don't even expect to be2 `( [- _2 [( Y# j% k* c2 i
able to intercept it by installing a IFS hook: it will not work, no way!
5 [5 d! M% P/ g, r- ^, xIn fact, after the call to CreateFileA it will get through VWIN32 0x001F, Y1 J3 R9 D  o9 L% S
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)0 B% _6 G) [8 l9 V
and then browse the DDB list until it find the VxD and its DDB_Control_Proc+ i* A; U( T# \
field.9 V* ], d1 L+ d% R& c% v) t6 P
In fact, its purpose is not to load/unload VxDs but only to send a 5 [, M5 i( J; R% q& g% d" l+ ?
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
5 Y" j$ p& O5 ^3 ]to the VxD Control_Dispatch proc (how the hell a shareware soft could try
( Q; y, n; T3 W8 @to load/unload a non-dynamically loadable driver such as SoftICE ;-).6 m$ O* u; k2 U& \; y
If the VxD is loaded, it will always clear eax and the Carry flag to allow" S2 c( p! o) g3 N& ^
its handle to be opened and then, will be detected.1 H1 S5 U+ X- _/ V' A3 W
You can check that simply by hooking Winice.exe control proc entry point) n# P1 e1 B5 `4 Y7 T6 G
while running MeltICE.
8 _. b7 ]9 x! M! ]) \8 j4 e
+ g2 |. B/ c: B7 j* P  w$ p, s. }' m( ^. o' Q. J8 C! Z
  00401067:  push      00402025    ; \\.\SICE4 `9 ^6 o* h: k' T6 L
  0040106C:  call      CreateFileA6 ^! R6 V3 R8 a( S# C
  00401071:  cmp       eax,-001' K3 n! m+ y0 a
  00401074:  je        004010919 A/ s, V8 U+ [' x+ z
  j3 P. N9 R% x5 n6 L

( Q  f' t5 v3 OThere could be hundreds of BPX you could use to detect this trick." I/ m2 R6 ?7 O' r
-The most classical one is:
5 g: i: U& P' d/ R  \2 c3 Q6 R  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
  O+ Q, J1 f4 V: @% o- W    *(esp-&gt;4+4)=='NTIC'0 ~5 l. X" W+ R1 Y' Q& o/ ~/ }% M# x

) c9 P& h' i8 ~! M-The most exotic ones (could be very slooooow :-(
( d5 H. F& Z+ J   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  & J, k1 o" W7 E
     ;will break 3 times :-(
# c1 A. _0 M5 x2 R! n0 [* A: M& E) x+ ?
-or (a bit) faster: 6 z" c6 E" l4 t2 L& w
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')! L* i4 i# j; c! u: |
" x' b# w  y) W
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
6 Z2 j0 r" F3 z5 d+ [+ {" c0 [     ;will break 3 times :-(
6 i- N2 G2 a1 H% g9 c: P/ \. n, w* |5 i  a; ?- {8 N; V( I2 q( y2 J
-Much faster:- E$ F# G  A  _0 W: @* K1 Y
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
& Y" M- L9 W7 w) g3 B9 S2 ^( T& k# i4 w4 [  D
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen9 x9 G) @+ [, v8 V" J3 r
function to do the same job:8 l' S+ S% u; E$ z" m
6 c6 m$ l( J0 b% [) v+ f
   push    00                        ; OF_READ
6 l$ P, Z8 n# J) ]   mov     eax,[00656634]            ; '\\.\SICE',0
1 s; g; @" E, ~# e+ f   push    eax5 S7 B7 a1 p6 Y, @8 s9 @; D
   call    KERNEL32!_lopen
6 U7 ^% q) Q+ u7 V+ J4 A" y   inc     eax
8 ?. T* A* b3 S9 F$ l0 E  d   jnz     00650589                  ; detected9 @3 ?3 {" h/ B+ h: j% @6 k
   push    00                        ; OF_READ
2 p: b% b- {3 r& X5 f( ]4 p# ?+ C, k   mov     eax,[00656638]            ; '\\.\SICE'0 c/ H5 [1 E) w6 ]% M
   push    eax* i' @& T9 u, o* @9 r: k
   call    KERNEL32!_lopen
( q8 z9 d& c6 S. k1 Q4 i" N3 @1 X   inc     eax' ]% a6 `7 f' Q# U/ G" w# z  C
   jz      006505ae                  ; not detected
, O: i( U* h+ t0 P
! t! `" T1 \) ]2 ~5 `
; W/ E- Q; U6 j* K9 i' T__________________________________________________________________________, e1 g# g- a& G6 N- Q6 |  n

" G+ w! C8 |: V( F+ A; rMethod 12( @4 Y. f' M2 x2 S# p9 W
=========
0 [7 E8 F! A' o# B6 Q+ R$ H# T5 i' d1 d5 k. \' e; F
This trick is similar to int41h/4fh Debugger installation check (code 05
. G) F& T& B1 j" I( u& E&amp; 06) but very limited because it's only available for Win95/98 (not NT)0 d: M" H* e0 m$ s$ s
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.- E+ o& b) ~% @% _: {3 G

% @: k/ N! p) m2 S' X5 @# |   push  0000004fh         ; function 4fh* ?: j4 H; E7 u; |5 Q3 [6 ^
   push  002a002ah         ; high word specifies which VxD (VWIN32)- x7 s" a) u8 g+ f. [1 [
                           ; low word specifies which service; A6 y* `3 _- f4 h. [. U# c  r8 i
                             (VWIN32_Int41Dispatch)
' y& O- X% C9 G0 h/ ?. q- E6 Z   call  Kernel32!ORD_001  ; VxdCall2 s6 d5 D6 c# f
   cmp   ax, 0f386h        ; magic number returned by system debuggers) N7 h1 y" R2 S/ c) O
   jz    SoftICE_detected
6 k. S$ R( ]/ i# C# G& {& i9 Y4 V; O( s# v, W+ j1 p1 d0 D" \, [1 E
Here again, several ways to detect it:
7 Z  Q/ p5 r9 y2 u! ^/ d
: l# e/ x  c+ S% t8 G  ~3 H    BPINT 41 if ax==4f* U2 N: X# q/ S8 G0 @* C2 q7 @9 m
+ U. n7 g; R+ `
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
+ |) h( x2 ]  W* [3 j
5 t; X2 y) {& _" C    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A0 R7 f% u1 k- O* z0 g7 n# G

! h, x+ J. [* E! I  J    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
! z  D2 ]  U5 R$ `! q; z' A* n- ~
; E! O+ Z( j' A1 j7 F__________________________________________________________________________( W$ N% d& R/ b' ]8 N. B7 B

; i3 \" M1 Q2 ?4 P; u) OMethod 13# c4 t: ]* R+ h$ U% S
=========& u! m: f" S3 S' f4 w' q

% K' w% J# }. H+ b1 i$ @! c& PNot a real method of detection, but a good way to know if SoftICE is
1 X/ I7 M# R! z+ ~3 |installed on a computer and to locate its installation directory.
5 ?: d7 V0 u8 G+ O6 Y1 p5 QIt is used by few softs which access the following registry keys (usually #2) :
7 S, W3 K) M  U. E' M2 ?
9 @. }  h1 z$ e& G! O' i  c6 ~3 a8 c% w% r-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion# Q5 x& U4 \" g. {. k# e, a" F
\Uninstall\SoftICE. h4 @! a) u. s$ @- D, n; o
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
, d' D% |9 Y. c-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion5 c; L: Q% E" ?! t' J
\App Paths\Loader32.Exe. n' F5 `6 T& g" R. j* s; b
5 I" d; ]1 R! E- A2 O( ~
' _0 m3 j* a+ e: u, N
Note that some nasty apps could then erase all files from SoftICE directory# l: J+ Y; a. m* h  L* p
(I faced that once :-(4 }& v6 Y8 Y3 r$ `4 y5 H7 w  {
' g* D( r) I  v$ Y
Useful breakpoint to detect it:
. r' K6 U3 L; r6 R; Y) i. s& ]4 K- M
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'0 I1 Y5 a; Z) W% i, S' M2 R
4 Z0 O7 f1 M+ C% Q7 N
__________________________________________________________________________
% J8 M: f5 R+ n  Q) S  S  n( e1 |! l7 Y# S$ C

" n8 I/ a/ j3 e7 Y* a  TMethod 14
) d; [/ O# U4 W=========
: T! B5 b$ T- o  J: x$ P) |  @0 b8 d/ j0 _  s
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
$ r6 s# f, C3 `is to determines whether a debugger is running on your system (ring0 only).
3 c& u5 q7 ?1 Y5 l) a% ]) l1 @% C, H, q' p
   VMMCall Test_Debug_Installed: V! k4 T' r' T4 e; y' M+ a" o2 S
   je      not_installed
3 p5 S8 w3 K2 Y$ |3 d/ u" Y9 r6 s8 \& @3 v" A
This service just checks a flag.
4 H8 ~. e) _, G  Y$ c& B</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部