找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>/ h. B, }7 r4 v& r8 }  R
<TBODY>
2 D2 e+ {) S( w% P- h# w<TR>
3 `7 D8 `, K5 Q<TD><PRE>Method 01 0 u4 L! s! M2 ?  i
=========
* b* n  P9 a  L9 x1 j& w) i5 o7 ?! k  m& n5 n4 _- @
This method of detection of SoftICE (as well as the following one) is) u0 k; @. O. F% B
used by the majority of packers/encryptors found on Internet.
2 n& m2 ~. P% K+ K# S& ~It seeks the signature of BoundsChecker in SoftICE3 P$ F4 J& N. f  v1 C7 C

9 J" x3 T9 h! P1 p" A8 B' r+ {$ t    mov     ebp, 04243484Bh        ; 'BCHK'
6 T% @: }! u' t' s$ ~    mov     ax, 04h8 h3 N7 S- V2 i2 I( U0 Z6 n
    int     3       5 L3 `2 J" ~# a  v" k# h
    cmp     al,49 k5 X. d% q: |4 h/ O
    jnz     SoftICE_Detected- Y& o. K7 Y8 {

# A9 K% v7 [7 I; T8 U___________________________________________________________________________. J8 b$ s5 U) F1 R4 Z
2 p' Q' ~% `6 H* c" P
Method 02" ?( Q- l. R, z" B7 L! y6 N
=========% t3 o+ J* l" V3 `, N

3 Z' O- m' J* U( b$ a) E: SStill a method very much used (perhaps the most frequent one).  It is used% @4 c$ n! z) G$ U
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,) }2 u% j  H3 k: i# S
or execute SoftICE commands...; h* J$ p) A% j+ l
It is also used to crash SoftICE and to force it to execute any commands
7 {% w( s: a3 ?; m(HBOOT...) :-((  / t0 R) ^' \- }! C# q. w- I
: v5 O/ J9 j4 C0 @
Here is a quick description:$ l% }/ v. _3 }! U* S' B- _1 L$ d4 w
-AX = 0910h   (Display string in SIce windows)1 q, p# s/ f: O) l: `
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)/ r# M& Q; ?& U3 g
-AX = 0912h   (Get breakpoint infos)8 n8 |: y1 Y) c& c9 t  {
-AX = 0913h   (Set Sice breakpoints)
$ h# d! \* l3 V: _6 V-AX = 0914h   (Remove SIce breakoints)
7 w3 g; {1 _; U' b3 X
( z* r8 r5 X" ~$ f! JEach time you'll meet this trick, you'll see:# C* S# `5 [6 y' m; S/ ]9 \
-SI = 4647h
& l# x3 S5 Z: j" |+ v-DI = 4A4Dh
# c& u9 p1 U7 t& e4 W. x( `: ZWhich are the 'magic values' used by SoftIce., N8 r  w0 l" Y8 c, x! v
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.  }8 Z( y; n0 U2 i/ H* J1 o, ^1 _" C

7 W2 C* _; }; P7 [. i+ b" zHere is one example from the file "Haspinst.exe" which is the dongle HASP
. Z  O1 L! W( ]Envelope utility use to protect DOS applications:. a$ l) z) C% j, O

: I5 m6 s) c0 p3 ^2 w/ F% Y
5 g; |3 O! Y) y* a$ l9 g4C19:0095   MOV    AX,0911  ; execute command.
$ P% [3 v* q* R$ R& T4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below)." O7 J6 k9 K2 n# A
4C19:009A   MOV    SI,4647  ; 1st magic value.% O9 \2 T3 ^* Q
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
; f: f8 Y" _  K2 @& o4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)) N0 P: `3 m0 N0 \; [" y: g, y" B% F
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute# _" a; s% V7 Z6 J* O; q0 [
4C19:00A4   INC    CX
' H- A4 H" Q  b: k4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute- E3 p- h" w4 B/ L; p0 j
4C19:00A8   JB     0095     ; 6 different commands.
+ K2 C& R* t+ K( h# V  T1 @4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
# {# t; |# t9 z3 @; N5 ?2 c4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :), u& ^  t, i0 D# A2 C+ N5 d

4 m% _1 ^- e6 R1 a- T1 [The program will execute 6 different SIce commands located at ds:dx, which
' s& n& Q9 z: a/ ~& }- ^, fare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
/ G, i, N7 u1 k7 T3 b! N% I  l: u3 Y! I
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.' s6 x4 {! u7 D) u. J
___________________________________________________________________________
" Y1 S2 z  X: ]6 m* f4 g
4 i2 r/ d0 F8 X! o  k
( l0 ]5 ?& R$ wMethod 03  p5 k6 i! G5 M* a1 l7 @
=========
) M2 C, B8 m; N7 C* K
7 G6 \! w$ Z$ l+ c( n, m; {7 nLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h, u" M; G. s# H: @9 n1 @) }* }2 B) ~
(API Get entry point)/ d3 @! x/ J1 P1 P! Q
        " J9 `3 M  U/ X4 s

  @; t* ^1 {) K3 v% c    xor     di,di
, n4 d+ Q# W" V+ [9 h4 I9 i  U    mov     es,di1 a1 E# ~; r. C( t$ X
    mov     ax, 1684h      
5 _1 z2 k3 r4 @- ~    mov     bx, 0202h       ; VxD ID of winice
* F5 B9 c; g* Q9 z+ J5 P    int     2Fh. K5 X# v0 c. L1 o/ A, E9 h5 c; {$ b
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
. M5 r) A$ ?, S& R; d5 G2 h    add     ax, di
. p6 @* L# ^9 O    test    ax,ax
5 B  O& X  R9 g7 p; ?    jnz     SoftICE_Detected8 {' ?0 ]" q" ^, s- V5 T& m' e

; o% U" x8 \. C3 _! z  r9 E& V___________________________________________________________________________
1 r( X: ~' Y3 {$ q
  p$ o4 `) D, {* c% M/ wMethod 048 o. G- ^' J% z+ O# ~
=========1 F9 |2 z: N# m: P5 H: R5 n

$ O$ V4 s* |' h2 Y4 UMethod identical to the preceding one except that it seeks the ID of SoftICE* k& c2 V/ S' |# {( u+ _+ b
GFX VxD.& ]6 J+ c" l! \( E8 y) o; w
6 c6 _- V- W8 @, d( r
    xor     di,di
9 @6 r3 X- \9 ?3 [7 Z! A    mov     es,di$ I" i+ V2 p# @& C# H" e: \9 D
    mov     ax, 1684h       ! ~$ G' B5 [  F! X8 j& K- \! l% p( Z
    mov     bx, 7a5Fh       ; VxD ID of SIWVID; Y! p$ E1 V7 g5 G9 t
    int     2fh, ]$ k8 g7 p- ~
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
3 Z( b+ R. M$ p7 s    add     ax, di
$ T7 [. I& r* d  ^. u    test    ax,ax
7 G, H. w5 W5 G6 }4 b# ]9 A    jnz     SoftICE_Detected
) G) r6 f9 h  D- v+ {0 r4 t% ?2 _
# J! |/ U$ H& f$ g+ ^" B__________________________________________________________________________1 _1 g1 }$ @5 u$ l, c- L

9 t- C; V  |2 |! O5 b" i7 T: v7 ~1 Q# G0 ]
Method 05+ [9 m' @) ^( A, a+ z8 N8 z
=========
1 u; {$ _) `+ p+ l8 M
( i' A. A( Q# PMethod seeking the 'magic number' 0F386h returned (in ax) by all system& ~0 f: w; O, T4 N( `
debugger. It calls the int 41h, function 4Fh.
$ ]4 L  I: C7 S7 C' aThere are several alternatives.  
6 h  W) h& M  k9 E2 ]. ~# |3 m9 M; S) A9 b  H
The following one is the simplest:
$ w# R; c" y7 ?2 Q2 C
4 E2 ]' A9 z5 b0 `; G3 K( _    mov     ax,4fh8 b! `, A6 Z+ q3 V/ o* t
    int     41h& x9 n& f) i  D- c9 S8 \
    cmp     ax, 0F386
) q0 L. k: O0 r2 F  j+ o4 P) z+ f+ w4 G    jz      SoftICE_detected8 W# A2 h* [: D1 n/ Q, M' g- }% {

& B, O6 f% ]" d2 k! e1 O$ d( a4 ~  M8 {& z$ M; q" E8 A
Next method as well as the following one are 2 examples from Stone's
* B- r4 J9 V. @: s"stn-wid.zip" (www.cracking.net):! ~% S) N2 j8 b% K2 V
' c. Y- P  w) p4 y+ T4 v, g
    mov     bx, cs2 y" E+ W( _5 P( w3 {( q% Q
    lea     dx, int41handler22 H; I/ R& o2 {4 h, R& F
    xchg    dx, es:[41h*4]  H: J4 D# r2 `& u
    xchg    bx, es:[41h*4+2]( `1 i. z: X  ?
    mov     ax,4fh
) a. V- l! g7 G5 v9 e    int     41h! R& K. M6 u% E3 N/ C! J- P- a6 ~
    xchg    dx, es:[41h*4]
/ [; m2 d$ L; T3 B+ g2 s3 ]0 C    xchg    bx, es:[41h*4+2]4 G& o0 l2 l, e$ o1 u3 q
    cmp     ax, 0f386h: p- \- f8 B+ C, H6 y) R
    jz      SoftICE_detected
% e, y! M1 \3 R! [: L! f) N0 g) @1 q: \# f9 N
int41handler2 PROC# h' I8 E7 S5 T: }
    iret# P2 ]+ e( a/ m1 E
int41handler2 ENDP) Y9 ^; n# C6 _! S. o
  [) I1 Y, |% m) ~
7 C1 |9 v+ ~* j( @% Q4 \
_________________________________________________________________________" d" J! J" b3 c) y, K
! V- e/ s2 J6 K2 t. Q* n

7 f. P, I$ ]1 a, `* |$ g' wMethod 06# x0 N* G$ S6 V
=========
" h6 i# d( O7 r/ |3 j
9 W9 Y6 s  h# I5 W( _, |& s( Z0 D0 u1 G9 s* v
2nd method similar to the preceding one but more difficult to detect:6 T! r1 n9 I" r) x& y) G+ s6 L

2 K) Q( A1 J0 U- C
! a+ r2 O0 y4 Z- N7 [, oint41handler PROC
* X2 Y3 D2 Q: s" T% z# |5 W1 U# F    mov     cl,al
8 M: Z  y$ V: Z) g    iret- o1 v: _. ^: M) B! \. g" `! h
int41handler ENDP
. o9 U/ Y3 b+ w- X2 e- T% ~
2 o8 z5 @" k- ~" s7 e7 i' `3 J
. [. D% o- x$ {4 j    xor     ax,ax. M4 v8 s% j9 v: I0 f
    mov     es,ax* S1 U( H! I5 F2 l3 c2 c' C
    mov     bx, cs
6 N! \7 D0 y: f    lea     dx, int41handler/ i1 Q( d8 f- i4 {2 `2 R2 G# u
    xchg    dx, es:[41h*4]& n/ K* M  I5 \; g
    xchg    bx, es:[41h*4+2]
  n) S2 [  Y/ \% R) o& [    in      al, 40h+ E2 f  l8 Z( ~/ |5 @) S3 n
    xor     cx,cx
; u1 F7 ^2 V, C, M# }  k% f0 k) x    int     41h# q+ Q; f) z& @( f% H
    xchg    dx, es:[41h*4]
( p1 Y, H$ T$ E6 d    xchg    bx, es:[41h*4+2], x- j0 T- W8 c! i% m3 p1 F
    cmp     cl,al. g& v, [& L2 R* n  H( q& f
    jnz     SoftICE_detected* s% }0 U" P& ^: h
* Y$ F9 v5 B7 ^3 s# ^" X
_________________________________________________________________________, Y: N+ c4 z0 r

; N+ N( j) ], v" H0 \7 p2 }! [- bMethod 07
$ j" n2 ~/ o. g=========
+ V: e; i8 C( ~6 S! s- \2 e: t2 X9 C, |1 Y) `
Method of detection of the WinICE handler in the int68h (V86)' u# {' H& r1 A/ y+ }. J" `
, ]( @: m% l5 F# e5 ~4 Y0 I
    mov     ah,43h
9 _0 O  ?( O6 f% x, w* P    int     68h$ T9 d( q7 v$ F/ C: H4 I
    cmp     ax,0F386h' Q  w: g' }5 C6 L5 p8 a
    jz      SoftICE_Detected, m1 _7 q" r6 x+ h& f/ Q
8 o1 B# O; z1 @1 U+ ?/ e, T
' ~! Q. o5 a2 t  y  \: f
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit/ O. y0 b# H; U5 _) G, F
   app like this:' z  x7 j# a3 J/ Z

- Z" ]$ |. i- Q+ d2 c1 x   BPX exec_int if ax==68
: ?# X/ V  s: X4 C9 |, F3 w3 u   (function called is located at byte ptr [ebp+1Dh] and client eip is! {: Z' c* N" _; S# r
   located at [ebp+48h] for 32Bit apps)
& r5 u3 V. m* {8 d5 W# ^# l__________________________________________________________________________, h+ Z. e; |0 B0 s. T/ G
1 s6 k; J6 l! K9 b# Q7 G8 W
" t2 a9 H& U8 ]/ C
Method 08
# z$ y  r; u6 ]! M=========" b4 m$ ^% I3 K# i  q  X

- w. v) m! \$ ^' {6 |5 e% G, H% @; n* G$ FIt is not a method of detection of SoftICE but a possibility to crash the
7 q' k+ F; h/ ]7 Lsystem by intercepting int 01h and int 03h and redirecting them to another
& g$ T/ j7 H3 b. {$ v1 groutine.5 {' [$ n' |  _$ O: C9 }, O
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
4 ^4 q7 S. H- N9 t5 I4 ?. [, A$ xto the new routine to execute (hangs computer...)3 d- L7 g5 f8 O

5 t6 k" @# |& s7 S    mov     ah, 25h
% E6 Q2 @. q6 x, _# Q* g' S0 u    mov     al, Int_Number (01h or 03h)* ]* r& F- r- z) R7 t
    mov     dx, offset New_Int_Routine
0 b7 M; o. |  g) H3 W1 h1 D    int     21h
: @) O  I9 r( e1 q! ?
8 D  W5 u4 v  h& v' v__________________________________________________________________________
, z( a0 q8 E- I& ~, A1 l+ [+ D. A  S+ h* x
Method 09* u- w: E( C# o
=========, i$ g9 o8 V9 ]( D1 o
& f/ \' C- m6 \( \' I! }1 Z* }6 S8 d
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only8 K1 d% h% z. }( K  `
performed in ring0 (VxD or a ring3 app using the VxdCall).
; ]& `* ?: r1 QThe Get_DDB service is used to determine whether or not a VxD is installed3 M6 g: S- D4 Q6 ^# B2 ^# [
for the specified device and returns a Device Description Block (in ecx) for: w$ V% g$ X3 d& |
that device if it is installed.) C7 C9 u8 q9 E0 d; X
9 ?- g/ k1 q2 y0 E
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
  x+ H3 m- t" v3 q! g. P- }' |$ E   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)# a6 b  P, T+ d- E: l' y, Q
   VMMCall Get_DDB
8 `# j$ I, x( K" M( M# y- m4 F   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed+ m- g5 J! b: t4 f, q4 |
5 c0 `' G4 Y0 i  Q* ?/ p
Note as well that you can easily detect this method with SoftICE:
8 H) l6 A% x  E* w' |   bpx Get_DDB if ax==0202 || ax==7a5fh* Y% s5 j9 q7 @0 _& K

8 L8 a9 c% C& z6 W  Z! T__________________________________________________________________________
% ?% |4 T! `5 x
( e0 n7 p$ k; V9 x3 B4 u1 MMethod 104 X7 K3 {7 u& W& ^: I
=========
# N" i/ H! s% S# |5 a
  f5 t, I1 W3 B% j% `) M=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with$ T2 m4 L, q# [$ ?
  SoftICE while the option is enable!!0 p# h2 ?: S# H, I! t0 E8 A' `& S4 h/ L7 u
1 H6 N1 |$ C5 T7 T. @
This trick is very efficient:, x" u- L. M; L' \" c
by checking the Debug Registers, you can detect if SoftICE is loaded
# G0 P! B4 B( C) d(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if' C4 P# s. t$ K; {" X! r. G/ L
there are some memory breakpoints set (dr0 to dr3) simply by reading their9 }3 d+ S5 X3 N, i
value (in ring0 only). Values can be manipulated and or changed as well
! A" Q2 R6 k  W) K& H1 Y(clearing BPMs for instance)
6 X6 W( w1 l7 @6 c. ]2 m1 h! q5 A1 X: e2 \7 a
__________________________________________________________________________
5 N6 r) g- A+ K# z
, D: C% l' U' `Method 11- Y8 r7 I6 A5 p. x
=========
: z. ~  ^, z7 E4 Z1 j2 p! }) Y/ W& c
This method is most known as 'MeltICE' because it has been freely distributed
/ c/ @$ G: A0 Q1 n" h, ^% D$ xvia www.winfiles.com. However it was first used by NuMega people to allow$ ~& E5 z# |7 Y( [+ a5 \( a
Symbol Loader to check if SoftICE was active or not (the code is located
1 c& j8 c3 k8 F4 v' z1 f. Jinside nmtrans.dll).
+ I4 L1 A" _" R) h
: Z3 |1 V( ~0 HThe way it works is very simple:
' O/ Y$ E# M# w( HIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
6 T. g$ l3 Y# [WinNT) with the CreateFileA API.
9 D# K, \, c& p1 S. J" i' J# d" H7 t' u! \/ |+ N6 ]% E2 p
Here is a sample (checking for 'SICE'):9 e: y% j& z0 C; m5 C4 k9 J

+ ^( U- I  k0 a, b# d8 p7 W" WBOOL IsSoftIce95Loaded()
8 D2 A2 v2 b2 s! d; M, n% L& e{: x; N$ G" M4 @! a" `7 h0 G
   HANDLE hFile;  
( s, w7 S' U; ]. o; {/ w   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
; `6 Y. b  c0 x, o                      FILE_SHARE_READ | FILE_SHARE_WRITE,1 L8 {9 @( D7 b% O8 U% Y
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
  S, a: N6 o8 i3 d   if( hFile != INVALID_HANDLE_VALUE )
4 Y% S* ]& c6 Y( E) C   {4 y0 X. |3 j; {- F8 E
      CloseHandle(hFile);0 H3 H# i. W; s
      return TRUE;
; t& F5 ?( |' D# I   }
) |+ j; l  Q) |& r; u: |+ y. R   return FALSE;7 t- i1 J) p) }) T9 V' z, D
}
9 c9 X2 L' B9 v3 F4 p/ ^0 K( T% n* d/ x: F7 w+ h" u
Although this trick calls the CreateFileA function, don't even expect to be- v/ B1 F6 }% Y. `9 V
able to intercept it by installing a IFS hook: it will not work, no way!* [5 g! f, D$ r! F' r( N  b
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
' }: _/ @+ u  \, {/ R5 o: E+ @service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
1 Y- \' r1 Q( w$ yand then browse the DDB list until it find the VxD and its DDB_Control_Proc
) u4 z8 r: C7 t$ M/ P; f1 Ufield.
  T# @" R6 I. |9 {! uIn fact, its purpose is not to load/unload VxDs but only to send a
9 o$ g& O# ^" ~7 H+ ]$ ?W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)& q4 F+ q' ~" s1 ~/ y# N. I
to the VxD Control_Dispatch proc (how the hell a shareware soft could try8 ]4 e8 C# P  C
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
) }& F# h  ?* F/ S! wIf the VxD is loaded, it will always clear eax and the Carry flag to allow
% f7 }5 p: _3 C9 c2 oits handle to be opened and then, will be detected.! I- [( r- b% A- k3 J7 g7 T$ P
You can check that simply by hooking Winice.exe control proc entry point- W% w$ _) R! x& }
while running MeltICE.
3 p7 }- I/ y+ r; {5 c- z  O2 O
9 x- T/ u$ z: Y- d4 q* {) A" R4 e" N& ~" g8 l. Y1 ^/ J8 a+ H0 d
  00401067:  push      00402025    ; \\.\SICE# {5 ]- _4 X; X' P4 {7 N
  0040106C:  call      CreateFileA
" |/ @  q. k6 k( K  00401071:  cmp       eax,-001( X; [& s6 ^/ R6 w# f6 o" U
  00401074:  je        00401091, F; A; R& I) T9 c& n
3 n5 D7 a% V' n9 A  ~
) @$ b" x" `6 J( ]# N9 H. Q
There could be hundreds of BPX you could use to detect this trick.1 }2 H, Q* U* H2 U- ^& x8 p
-The most classical one is:
+ }& J* I/ ^1 J3 m5 ]/ {7 Y$ N  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||+ U( c& D' L: v! M: c  P- W
    *(esp-&gt;4+4)=='NTIC'% A9 D/ y% ?* H% _, N

: {: L/ u, ?% W-The most exotic ones (could be very slooooow :-(1 \/ @" y# z! s  o) u
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
% k* g/ V9 |( \  y- h; b     ;will break 3 times :-(
4 u$ \: k2 h. U
1 }% L/ w( Q$ {6 K: [-or (a bit) faster:   \; o$ g/ {) u" _3 G& }0 h8 ?' b
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')7 I6 l1 r, e; f, @, h- _2 q% C
# d. L8 z, P& G  @3 d' K
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
" N8 E2 x3 e) p# e; h3 j     ;will break 3 times :-(8 N  C# Q* j& g& m) C1 ^& y  p" r
& l3 `& Z: a" |8 b1 h* I6 Y
-Much faster:
3 H: a9 X  }# B$ ^8 Z0 |1 W& e   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
1 X- {% r+ w1 P) i+ u, ]' U. n/ A+ |; [3 W
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen( k, @5 g9 W0 J' T% o
function to do the same job:
$ u# k) W$ `1 h9 ]  P! U* P3 A$ ^2 a" h2 p( Q- ?
   push    00                        ; OF_READ5 `# y% l( }  M% i5 S$ q
   mov     eax,[00656634]            ; '\\.\SICE',06 R/ Q, o- E$ U0 V" O
   push    eax& v$ e8 s" G6 g% j. y9 D1 H
   call    KERNEL32!_lopen! [. B. o0 Z6 t3 V8 v
   inc     eax* g' u* b7 F3 F; \2 w. A
   jnz     00650589                  ; detected
/ o: N: W+ v; h) W   push    00                        ; OF_READ
  D. L% x: q; ~) x0 q   mov     eax,[00656638]            ; '\\.\SICE'! b9 V% f/ Z* x- }8 |: V- c
   push    eax
6 G: ^0 r& Z0 r   call    KERNEL32!_lopen
& P6 W# h# k  f0 ]) k; T& F   inc     eax
  p7 Z/ K* F& [1 A3 M: k! A   jz      006505ae                  ; not detected
$ H/ K  s: I& X1 d/ S
5 c$ W& u* k* ?8 o/ x2 a1 B0 b9 E# _# K4 B
__________________________________________________________________________
, w; i8 G2 w7 @% K3 l
2 N0 T9 S1 |# z5 ?% f' SMethod 12$ {5 ]! `0 _- g; G  b8 t* `
=========
- {! [% i. Z: |: k
% g' ]" |0 U3 P+ k& MThis trick is similar to int41h/4fh Debugger installation check (code 05& x) n9 `/ j9 ?
&amp; 06) but very limited because it's only available for Win95/98 (not NT)
2 @0 z) B  U, y  nas it uses the VxDCall backdoor. This detection was found in Bleem Demo.
7 Q; n& o4 \" b6 J3 I
  x' H! W3 v& |! Z! `2 N   push  0000004fh         ; function 4fh
( [& }. m( |+ h8 K3 c3 Q  g0 h   push  002a002ah         ; high word specifies which VxD (VWIN32)/ h2 r( W+ j; l% |, n6 c1 m
                           ; low word specifies which service5 Y8 S0 A, }3 c. H
                             (VWIN32_Int41Dispatch)0 z& K+ S" \* {" P7 U# P
   call  Kernel32!ORD_001  ; VxdCall' E2 i0 c5 I2 Z
   cmp   ax, 0f386h        ; magic number returned by system debuggers" @$ [& `' a; y/ e5 f& d$ E- f- V
   jz    SoftICE_detected4 w+ u0 \' m8 n' N

9 [0 {) R1 h& r* _' u4 FHere again, several ways to detect it:
+ B5 Z; R) i' A8 H& Z8 ~+ _' |, r# ?+ V2 s0 h
    BPINT 41 if ax==4f
. S9 @/ d7 z; U& r4 d. y$ o/ k0 t& |# u7 l$ G/ i% {( Q; P# Z
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
/ n0 H: f: J+ q/ d+ F
4 Y% F7 o1 y5 I: S  w    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
7 d* j$ ~' O" [% c( k# Z+ t6 A7 s' v0 B) V( v: @1 B! u+ I
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!" K0 @) |. j$ A4 F1 u  A' V
, C  K$ @2 \' l; E( |
__________________________________________________________________________; C( P* j. U( @% o9 i6 I3 W

# b8 S) `! S6 D2 U' t/ eMethod 13
7 c; G; {& m; G8 }& ?, k1 ?=========
8 P1 j+ @7 ]$ I! {1 |
, o; Q9 _- H" YNot a real method of detection, but a good way to know if SoftICE is
) z' a& i  b8 @" s# Xinstalled on a computer and to locate its installation directory.5 d1 U& [( g& S- x" E( r$ x: i
It is used by few softs which access the following registry keys (usually #2) :
$ M/ Z. v1 d1 R
' ~6 W8 E0 \2 J" L5 B% O0 s-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
, R) n2 J* P4 H9 c\Uninstall\SoftICE8 j  }$ W# N+ `
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
- a4 s8 S+ `/ K% e" p* Z% \1 c-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion; w# ]- W9 v8 t. N* q% ^5 l
\App Paths\Loader32.Exe, F( X8 Q' G/ w+ I' ^, m1 U
/ a! B8 ?" A, [  C$ [* S* p
3 B. O  U6 E7 {1 X' p
Note that some nasty apps could then erase all files from SoftICE directory
  G( p) W& ~3 Z7 a! K/ @0 W(I faced that once :-(, T9 ?& H+ a% f. V( n
& c& x5 `& n  r
Useful breakpoint to detect it:, R! R. {7 z6 }2 s. \# |% X1 Y, K2 Q
) Y2 D  P  S7 c3 F- ^
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'( e& G, g# s: t( {

, P, A2 X' `/ Q* Y, {__________________________________________________________________________
6 O$ h% L5 m" j6 S/ Q) z# A+ j
* W5 c8 z+ w) @+ t7 B" J6 z" _: t& H
Method 14
/ H) W4 O( j( T=========
" s" Q1 v) w0 ^$ J
8 m- o6 ?, h1 H7 b) IA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose) d4 [* d' h+ j
is to determines whether a debugger is running on your system (ring0 only).
" T% T) V- e& G7 x% I) K$ R+ Z/ H" j) s
   VMMCall Test_Debug_Installed1 u. Y: ?" [. h7 D! T
   je      not_installed
5 G: @: @5 \" c- j  j1 p7 U+ [5 x( @6 A" x+ A
This service just checks a flag.
0 i7 S/ H% e' I- [- ?</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-8-4 18:05

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表