About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
5 b$ E1 l& ?9 K9 X$ J2 H<TBODY>5 _' h1 g' P4 e: i& Z: u
<TR>7 ~" b% U' W- |; p/ E, u' e5 [
<TD><PRE>Method 01 * G% @8 A3 C7 F% o
=========
4 n$ [8 C1 \5 \3 A9 R+ c7 x8 E" @* [. {1 V/ Z; i
This method of detection of SoftICE (as well as the following one) is
8 L/ t# F0 f, E# X5 {used by the majority of packers/encryptors found on Internet.5 R; A: b" ?+ }, X4 n' B
It seeks the signature of BoundsChecker in SoftICE
1 Z4 M$ I/ Q. Y$ v1 T
6 K  g  ]& a9 a$ W+ \/ Y    mov     ebp, 04243484Bh        ; 'BCHK'
- ~1 X  K! G# v6 F    mov     ax, 04h! X  \2 h* I# q
    int     3      
) r4 j: h% v8 F% i# ~: U    cmp     al,4+ x2 b8 n+ s% l4 Y
    jnz     SoftICE_Detected
- {; Y& o# i6 s& }7 y( S
* k: ?4 f5 q; e* A5 z0 ^___________________________________________________________________________
9 R* _; T# @" x5 n  r# M$ a$ N2 G& I4 T% @3 n
Method 02
  C1 |0 b- a/ a; b=========* j6 a7 s$ C/ I0 v; L8 z3 W. X

; ]7 o9 z9 o, _' `6 N( rStill a method very much used (perhaps the most frequent one).  It is used! E! I9 H7 W  z: s4 w& G- b- G
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,) `0 o! _2 A; P
or execute SoftICE commands...4 h8 o( v, R( c! T
It is also used to crash SoftICE and to force it to execute any commands
7 C, o# E! n3 O: D) C8 e(HBOOT...) :-((  
) Y$ W. F- v& s+ ~& z, U+ g1 `) i( y. k
Here is a quick description:/ L6 S" l) x6 P- D# R' B
-AX = 0910h   (Display string in SIce windows)! y4 {; N2 X0 Q3 s
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)  T& J  L; K  d
-AX = 0912h   (Get breakpoint infos)/ ~- j$ N6 L% k
-AX = 0913h   (Set Sice breakpoints)7 B4 G; G6 _6 M) X# N3 k
-AX = 0914h   (Remove SIce breakoints)4 B/ Z0 X2 @/ ~0 x  j

! U; j" O/ }2 I' `2 p1 pEach time you'll meet this trick, you'll see:
* Z1 Y  d3 _$ X' E( Q4 ^: v( b-SI = 4647h- j! R' ]: D2 Q! {, P
-DI = 4A4Dh
2 l# X4 e. D* s% s4 E) aWhich are the 'magic values' used by SoftIce.+ L- n5 L7 v; j2 I# p
For more informations, see "Ralf Brown Interrupt list" chapter int 03h." n. U) {! M  C7 p8 T

: _. t# g( m. E- b( yHere is one example from the file "Haspinst.exe" which is the dongle HASP
2 B8 p4 c" D4 F- r) n; c+ n( ]2 SEnvelope utility use to protect DOS applications:. w' l; w$ z3 n- ]

4 v8 {0 O1 s, N( `' K1 f
& |) M; R9 G* ]% w  r, U- f4C19:0095   MOV    AX,0911  ; execute command.; C- W2 }, X* X- d% G2 a
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
$ p7 k; f# h3 Z( b4C19:009A   MOV    SI,4647  ; 1st magic value.
( j6 [  V! Z. w9 ~, [4C19:009D   MOV    DI,4A4D  ; 2nd magic value.6 c7 t7 A4 d8 G
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)" b4 t" S* o- k9 v  f1 W
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute, }' e1 u$ X: T7 t; j
4C19:00A4   INC    CX
& \" t6 |. I9 n; C) t% J4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
; Z! u& C# L2 n" p4C19:00A8   JB     0095     ; 6 different commands.$ Y$ {0 D: v0 z1 b. d
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
9 o# r' ?* f0 B9 `) g& G- D- v4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)# w8 W( V& U. o/ _9 Z

1 K# S4 S& Y$ v+ S- A5 R: bThe program will execute 6 different SIce commands located at ds:dx, which
7 e$ s" ?* g! r+ S1 a/ g2 Z# X. d, `are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.  |4 e3 o1 Y/ n# G, w1 t/ f

/ i/ p5 g' }' U- U* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
. X& S; N% O- j4 {6 i___________________________________________________________________________7 E3 p) \0 Z2 u* E5 r9 V$ B5 \
& ?5 n- M( d) z' W$ n
" F$ T4 [. d  t7 b$ Y$ y
Method 03: ^" N. D; b1 N. o% U! L
=========' Q2 ]9 b9 s1 ?  F; _. ~
3 e, G- o5 P* l2 `! I- T
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h) @( e* q9 z( w0 D3 h) o/ O
(API Get entry point)
" j1 Q3 O! L. I) Q        
7 @# q8 Z9 U8 f/ E" C
5 v& ]) l# X5 J+ O- A) N& i    xor     di,di9 i1 B" V9 v( D* R+ W- ^
    mov     es,di7 b1 q: l1 m/ z9 k7 D& V
    mov     ax, 1684h       . n) p3 I+ L5 i( L
    mov     bx, 0202h       ; VxD ID of winice
0 k( C" k( h) W; H    int     2Fh
9 w) h. g' E1 L3 H1 i" h+ k& n    mov     ax, es          ; ES:DI -&gt; VxD API entry point. ?$ [7 d- m% `4 B/ |' a: p
    add     ax, di  s- C" f4 H/ Q/ U; Q  j. a
    test    ax,ax7 g2 H8 K( R5 d5 D3 j' E* w8 }4 L
    jnz     SoftICE_Detected' z) \3 }  U3 I8 d% x

3 ~8 Z% ?7 a  }7 ]. x___________________________________________________________________________
$ Q8 H+ m0 A: p3 _  B: k5 {- R
Method 04
6 _$ G& K, ^# Q' e! Z=========
8 z% k- Y. O( ^% i0 A: M; F" @1 k$ C2 r3 W$ M( o7 \
Method identical to the preceding one except that it seeks the ID of SoftICE
  [" n5 e' e& x" _5 V+ {6 g" F9 SGFX VxD.
3 r! E0 t: J7 d* Z1 G
2 ]! P! G9 b! J' D    xor     di,di
$ |# l. k* q8 R' r. \# f) f/ n9 C    mov     es,di7 l; ^- I0 |& J! p2 R+ G% _
    mov     ax, 1684h      
* s6 F3 Q, i! C7 C# A% _    mov     bx, 7a5Fh       ; VxD ID of SIWVID% h) F9 }: q7 R- `: m: d; H* ^0 [2 B0 S
    int     2fh
+ P" C! g7 A/ n# `  [" I9 R1 W+ U    mov     ax, es          ; ES:DI -&gt; VxD API entry point5 q3 K" R$ ~" \; e- C
    add     ax, di9 U3 o; i  N2 K$ n; k7 p
    test    ax,ax
- l7 J6 X! N+ ?9 h    jnz     SoftICE_Detected) J5 Y8 }# p  X

$ ]$ E( X# J. K) S4 H5 [: u__________________________________________________________________________* @0 |: ^4 X% Q( E% J

9 Y3 i9 f! ~1 V) ~4 h4 z: ~5 v* a, y) i$ P8 X$ Z
Method 05
/ S* m. R/ O1 K7 c7 v/ K9 G3 {=========
7 x+ M: H. e# p0 S* ~. }
7 ?/ }1 D) f5 c# Y1 k2 h  nMethod seeking the 'magic number' 0F386h returned (in ax) by all system+ ^8 F5 F: `5 L& i" r4 V% Z8 {
debugger. It calls the int 41h, function 4Fh.
6 q9 g6 D9 f4 H  L2 g7 P5 E9 }6 j# DThere are several alternatives.  " T3 ^" F  G' O* n

8 z* \# R. b6 r! W# c! lThe following one is the simplest:6 i: K. Q1 H: k+ \8 }( U" r

' H5 O  g6 J8 N7 y. Z    mov     ax,4fh1 }5 s4 Z: W( I1 @! |& [1 [
    int     41h
1 ?" h: T" `$ o+ [  c    cmp     ax, 0F386& q6 }) A( y0 n4 B9 |& P
    jz      SoftICE_detected/ t! ]. C1 @3 e
4 x9 N: B0 g4 j
" q8 w5 H& R* K. ~/ O
Next method as well as the following one are 2 examples from Stone's ) C& w" S  s* b4 c
"stn-wid.zip" (www.cracking.net):  F' k' p" Y$ b

$ G. Z* n2 ^2 X; h8 C    mov     bx, cs. g6 }/ y- m, i$ Z" l# W4 X
    lea     dx, int41handler2
2 d1 n; n/ ~& j8 r$ t    xchg    dx, es:[41h*4]
5 k: Y8 Z( x1 s; z: j8 S/ _0 k* g    xchg    bx, es:[41h*4+2]
7 }; u7 A8 I; g- D7 m( f    mov     ax,4fh
* t, e- [% ]% Y# j$ X4 K0 k    int     41h* ]  v* w. R* T0 ]/ r0 p
    xchg    dx, es:[41h*4]
, ~* X6 Z! z1 ~& G/ s; L    xchg    bx, es:[41h*4+2]
  l; B8 O0 o% v2 V    cmp     ax, 0f386h* c8 N- _2 n  Z/ \
    jz      SoftICE_detected
0 k. a% G6 x/ E  I" i2 C( R# a$ i8 O7 C9 T/ n
int41handler2 PROC' X) U3 e/ x' q1 c$ q
    iret
7 p! D2 ^% D/ Q2 \6 Q9 j. dint41handler2 ENDP3 S. @8 r! h! R6 l5 ]" C+ [/ B7 F

4 w4 c7 i/ N2 x6 S5 z; j/ w7 e0 _" q8 C
_________________________________________________________________________! q+ \6 Q' ?0 r) ~8 {0 a

0 s$ e, B0 |& \& U+ y! o$ m3 ^" F1 ~+ N5 `! d: }- K; G9 \
Method 062 S4 v& Z6 R  w
=========. @- Y% x" Q. V7 H+ F
/ i9 m) q. Y6 M# `
( z! Y% g- A; T- R
2nd method similar to the preceding one but more difficult to detect:( U! M" M/ l" F& a

8 h! K& a  y; a3 E/ Q0 V7 M6 ]6 i1 e8 B) ?
int41handler PROC
. j/ Q; J1 V1 d0 \4 \& V5 W, K    mov     cl,al
: J6 Q) r7 B. k0 J4 w1 f& {& V    iret
4 U% s( P0 ]" R0 ~* K9 w  @int41handler ENDP
# c3 F: T& _8 W. y( j( Y- q: |9 J% ^8 H  p+ s2 v1 B- y
3 ?% i9 M; V5 [
    xor     ax,ax& ?  B: n, x# s2 |' v9 c2 E( V
    mov     es,ax
+ o* @+ G" `# ^    mov     bx, cs9 F9 X2 f1 x* e4 O( j/ b9 F
    lea     dx, int41handler) c! c! A6 Q! _9 G
    xchg    dx, es:[41h*4]
; U9 I4 X5 m- a; W! h& p) @) Y    xchg    bx, es:[41h*4+2]
9 z8 L- R* \( n2 {# w    in      al, 40h' a3 x4 ^3 P0 @0 `& S4 L! G7 Z
    xor     cx,cx
6 o" E9 a2 O5 @+ K) E) O. N& Y    int     41h, ^2 X0 W/ g" b2 n/ B
    xchg    dx, es:[41h*4]
# {$ p! I+ i1 _7 I" \( ~/ Q    xchg    bx, es:[41h*4+2]* v6 e. W  p( O* u3 \
    cmp     cl,al3 c9 C7 b& _" F5 y8 r
    jnz     SoftICE_detected
1 |/ b" K5 ^8 A" S
+ [0 U, ^) I( L7 Z  _% k_________________________________________________________________________
% p6 q+ w: T2 A4 L
% l3 A6 M3 c% }, E; L7 qMethod 07
" f2 I: a/ X9 ]4 ~0 z' j=========6 ?3 Q1 s, f& x7 D
6 o7 K. c  u0 `" h) h4 D5 a
Method of detection of the WinICE handler in the int68h (V86)- g+ G. L9 g8 @" C+ F0 T4 t" ?

+ x* p5 q! T/ k7 L+ A( H    mov     ah,43h9 R# m4 W  [* h
    int     68h) j- Q3 M, {% O; j
    cmp     ax,0F386h" |6 d  A* A! c4 _8 U* Q$ A
    jz      SoftICE_Detected
7 j3 j- e, i8 H3 ?7 P  M! f8 d  Y" w' l. I

/ I; s  A; }# F7 U, _6 T4 [=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit" H1 \! Y/ X0 {: E! S) G
   app like this:# y( w& n: k- l" E. Q) b) ~

. S" b& {5 F* s7 E' p   BPX exec_int if ax==68. \; m7 l6 _- \) H0 ]
   (function called is located at byte ptr [ebp+1Dh] and client eip is
: m9 e6 E( D$ l$ F& g   located at [ebp+48h] for 32Bit apps)5 j0 V3 t8 Y& g7 O2 a1 g: i
__________________________________________________________________________/ x) t% O; N6 P( D
! i) f. y& x/ T% y2 r
' W: r! s% K" e7 C- b: C
Method 088 E! [  O2 k$ p# y
=========
/ b8 Y! f" ^- @0 S5 E1 G* Y3 N( C% V! X* G6 }; e
It is not a method of detection of SoftICE but a possibility to crash the
5 Y" t8 e- F6 H: J. `2 q6 S, jsystem by intercepting int 01h and int 03h and redirecting them to another. t4 \1 }9 }5 _) A
routine.4 K0 E- ^* K9 z- `3 }
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
5 ]4 S: J8 g" Q7 ^+ i/ rto the new routine to execute (hangs computer...)+ ^" a* u; z+ u3 R) n

6 j) h* u9 X9 c+ d$ U    mov     ah, 25h4 p  O9 t7 m4 M2 w9 ~7 }" z
    mov     al, Int_Number (01h or 03h)  ]2 H) r( H; Y8 }
    mov     dx, offset New_Int_Routine: U8 F4 `: j6 ~7 p5 L
    int     21h4 g" J3 \2 s6 n6 _3 Y8 P" {2 h

' s8 [" @1 z4 H: ^4 w__________________________________________________________________________
7 ?+ E4 X; U% X8 m# M* {9 I% S+ v
$ s& l6 e) L# {Method 09+ e0 k( M5 X: F0 g0 z
=========
- o% n0 @9 _% S; b& G7 o7 o
* ?6 I9 D: E* X  GThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only1 W; D( p1 z; Y' R2 P
performed in ring0 (VxD or a ring3 app using the VxdCall).
" @7 _/ U5 e2 x5 ?The Get_DDB service is used to determine whether or not a VxD is installed
' w7 ]" Q; k. J. o5 |7 rfor the specified device and returns a Device Description Block (in ecx) for
* A  f. O% a% d- p3 X# A; Dthat device if it is installed., [# {0 s6 A7 U2 k0 ]6 s
! I# S+ j' ~- n$ i% {' m
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
% \( h* S3 Q3 Z- X   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
( i8 S: X; D- o$ f# B   VMMCall Get_DDB
/ Y  m4 |$ R# X) K0 b9 G* ^/ D   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
. j4 a8 D% Z& S: L! }# J, i5 B3 t& a( T. S, a; {% U- Z" t
Note as well that you can easily detect this method with SoftICE:$ S. H' ^0 D' S" `
   bpx Get_DDB if ax==0202 || ax==7a5fh; P0 ]. g. {" a/ u+ z! j

9 X3 _7 X0 Z  s, r3 u* R& O# i0 Y__________________________________________________________________________
3 i/ _: u4 S( ]/ r9 F2 t
+ e8 J( O: j3 U0 f8 g6 AMethod 10
% t/ K  Z/ C0 c! L/ V5 f3 e6 H! C, w# i=========$ ^/ k! s' T" L6 i) |3 J
: v$ c0 ~8 y7 g- H
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
8 s' f8 A7 B& s9 Z% `) J! M5 u  SoftICE while the option is enable!!5 C' y; e# X/ L/ m

) ?" a0 E; K5 M5 g2 z$ DThis trick is very efficient:$ Y. ?1 M+ U! W- d: ~: b
by checking the Debug Registers, you can detect if SoftICE is loaded% j5 {7 l3 E& k1 D1 K8 P
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if. ]. z2 M3 w% k* }% ~) v6 c! \
there are some memory breakpoints set (dr0 to dr3) simply by reading their+ V. j  \, o  v" }: V9 g
value (in ring0 only). Values can be manipulated and or changed as well
! s% `+ l$ D/ A7 \; ~(clearing BPMs for instance)$ k/ Q: s  B" L5 k0 D0 t6 ~; H
- O  f; T2 q* N2 b1 A
__________________________________________________________________________- Z/ A+ p5 s; V
" e2 C! G7 [; c  b# f/ B9 X
Method 11
( Q& n2 _8 R0 Y5 H=========* c/ |. Z+ \6 F2 W
6 L5 l: N; _3 r* B5 N
This method is most known as 'MeltICE' because it has been freely distributed: x% g+ n, _5 L  B
via www.winfiles.com. However it was first used by NuMega people to allow! n0 t2 ?- D8 ]5 x
Symbol Loader to check if SoftICE was active or not (the code is located$ w6 D# p9 z( C
inside nmtrans.dll).
2 b* \: C8 w+ x8 ]* C" U) [0 m: t# d: R- H
The way it works is very simple:3 I' y! k2 l; `- ?& Q% _1 E
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for* ?$ Y; |0 j, u/ R; r0 k/ K
WinNT) with the CreateFileA API.2 M6 m' ?; A' y& [" q6 [' `6 g; V

8 Q/ Q, g3 T  ?- \Here is a sample (checking for 'SICE'):
; O1 ]/ k  v. a7 M1 e0 U
* z$ k9 f! j  Q) QBOOL IsSoftIce95Loaded()
0 E  n: c1 e4 L1 d{1 t( v3 N) R! w3 p* g
   HANDLE hFile;  # u  l+ A/ e1 c, ~9 Y/ V1 y  t+ [
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,+ K3 z& u. w1 j$ T$ l4 |/ ^6 U( M
                      FILE_SHARE_READ | FILE_SHARE_WRITE,7 K. t% d4 y$ w  A% Q: j
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);' B5 o- a* K5 R. [0 l4 r6 U6 [
   if( hFile != INVALID_HANDLE_VALUE )
( u; U, K1 u& \% I% b   {7 n$ Y. @- r% j/ @- x0 j9 u& v! Q% q
      CloseHandle(hFile);* D4 \8 ]8 ?% V# z
      return TRUE;( u3 q3 R6 P& m
   }- J2 W- C3 M- ?+ i2 v
   return FALSE;
- z  s* V( s# v}
7 d/ f: _% h( ^/ q, ]% X) a7 s( G! S. }3 f5 ~4 K. S
Although this trick calls the CreateFileA function, don't even expect to be2 w) W) {) Z. q
able to intercept it by installing a IFS hook: it will not work, no way!
9 H) A/ Q1 h, f- X+ NIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
- M& I1 [/ j- o! Z0 i& }service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)3 N$ |; S1 s) l0 A8 ^& {6 l
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
1 Y2 ]: j& q- d0 rfield.- x* ~+ Y1 A1 e
In fact, its purpose is not to load/unload VxDs but only to send a & I7 ], b9 S8 o/ A7 E& n
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)/ {, Z8 ~! T0 I8 [) Q0 g) W
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
& [' M9 j4 `& \! v% Uto load/unload a non-dynamically loadable driver such as SoftICE ;-).
4 t; `. p" w& gIf the VxD is loaded, it will always clear eax and the Carry flag to allow
7 t3 g' j5 `7 E0 Y4 ?its handle to be opened and then, will be detected.& |9 D1 L: W1 l& L/ }  O: q9 [  w
You can check that simply by hooking Winice.exe control proc entry point: K/ A. O, W" Y2 ]+ G
while running MeltICE.
! a( u; g: e1 j; G" w& g7 S1 \' S: T+ O6 l, F% I8 `  `

. i/ J0 ^4 r& K  00401067:  push      00402025    ; \\.\SICE
) ?/ u7 U. D8 V( A  0040106C:  call      CreateFileA
" Q3 e  N! e6 Q  00401071:  cmp       eax,-001
. X' c  w9 {) C$ c# K  00401074:  je        00401091
; p& a% c% X7 \4 G' j
5 R) A% l$ f: I4 Q/ ^" w3 b
! P5 n. M0 _: cThere could be hundreds of BPX you could use to detect this trick.
+ p7 B. C9 l7 w-The most classical one is:  S  r3 z, E* f) k
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||* s. D# I' d. ]" r7 v. K
    *(esp-&gt;4+4)=='NTIC'" d' L* f( L. o+ w* Q

8 I" S$ @1 F" v" b( `4 z  b2 J-The most exotic ones (could be very slooooow :-(
; S3 {! x( Q, h   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
7 ~$ s4 \0 {( a     ;will break 3 times :-(
/ q, c2 [; G6 T8 |( w4 P) I) E" ^
- I! K' y$ B! r4 h2 U- s! N# Q-or (a bit) faster: 8 t( B5 D/ ~. t' F- p0 U$ A
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')- U4 o, |; I, P0 e

% I" p2 h. l) W   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
$ Q3 H. E: u# }* Y' N7 K4 G     ;will break 3 times :-(
+ f! J1 |9 w$ R' S; a$ i* w( {1 d) I3 d( D8 r1 x7 ?8 Q5 }+ Q
-Much faster:; R, V- Z" P: `5 L' }+ N9 Y& s
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'5 W0 r$ @6 X/ a  d% i" c; \

3 q. P/ h* f. ONote also that some programs (like AZPR3.00) use de old 16-bit _lopen0 c( o: w- [+ f+ [4 b7 N
function to do the same job:" \' S4 n( |) g. _

& ~: C$ k& ~! p* ~) M   push    00                        ; OF_READ9 x; }' Z# p; p# R6 d. Y- |
   mov     eax,[00656634]            ; '\\.\SICE',00 L3 i% Q# a, W' z7 s
   push    eax
& o" Z0 ~: J! J& F+ ^5 S& \   call    KERNEL32!_lopen
& b# S$ w3 y5 K% w   inc     eax3 c4 f% x1 o- ?8 F  p3 J1 N6 C
   jnz     00650589                  ; detected" r4 j# C3 n! W3 a* P3 k2 o3 i
   push    00                        ; OF_READ! ^4 N1 U8 ^/ M( x
   mov     eax,[00656638]            ; '\\.\SICE'
. s3 I( R! l, P+ G/ b   push    eax2 K( d6 Q5 Y; T( S( o0 R
   call    KERNEL32!_lopen
1 E4 v5 Y+ w$ ?, N, ]& C, l   inc     eax
- C) x; R1 j2 ]  p/ [" X# g   jz      006505ae                  ; not detected; u1 Z( p9 U2 n' @
2 ?* y3 f. I1 W; \7 Y! n
; U( j2 ]/ X8 X" J% y! r' C. q
__________________________________________________________________________
" f4 }- d4 G: U: D
8 \4 x2 y) s% v# z, o8 XMethod 12
4 p- _" D  u( ^$ [' H=========
5 u6 d3 x, q# G, z5 h2 @; u! d
% I7 F) q( L6 E5 I) gThis trick is similar to int41h/4fh Debugger installation check (code 05
" {+ k7 K/ P) R) A5 A&amp; 06) but very limited because it's only available for Win95/98 (not NT)
) X! n4 G  ~1 Q4 Yas it uses the VxDCall backdoor. This detection was found in Bleem Demo.
/ @1 r3 a  Z( V9 F6 d+ m& H& z. E( k( R% s
   push  0000004fh         ; function 4fh
" h; q1 H$ m2 v& n   push  002a002ah         ; high word specifies which VxD (VWIN32)$ a- g  E0 [: w; Z) B+ F# }, w
                           ; low word specifies which service
& L4 Z2 T. G2 K+ t8 o" K                             (VWIN32_Int41Dispatch)
/ V# @6 N1 g0 P- @& R* r$ \   call  Kernel32!ORD_001  ; VxdCall, Q5 e, T# R3 @$ j
   cmp   ax, 0f386h        ; magic number returned by system debuggers4 d$ y8 p0 n- C) }
   jz    SoftICE_detected9 W! y& ]: v; e( A' [5 t
+ I! m) w; V% c2 m1 }5 S  z& F
Here again, several ways to detect it:
# ^  A, a: I2 ]7 }. w1 y6 p
* }+ |8 t' `+ o# R1 b9 O% ~8 L    BPINT 41 if ax==4f: a4 N) y! H/ `1 @2 Q) N
# j& ^( s* ?" S  B6 N6 r8 a
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
3 R3 l7 {+ `7 {- {- q+ o2 V, t0 v3 s- {- |4 v6 ]( a" `. Z. O8 U
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
* Q# K. a1 [8 u# F3 K- j" Y; z  j5 j, L% Z* m% z& g' R( W7 j
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
/ w* @( ~: T& E) N
3 O5 b8 _2 u0 a__________________________________________________________________________4 a. u' i; V- T4 V* S% x
* s$ c2 d8 v5 P, B. S! r- H3 \+ T
Method 13
  B' |' N3 P& v$ k- A4 L9 S1 Y' F2 {=========
5 L* n, ~. e( E( s* M5 [% p0 D9 z! ^+ S- f3 l7 K# S( h7 C9 C
Not a real method of detection, but a good way to know if SoftICE is
9 @' W6 L; h/ P  _9 f7 T: Tinstalled on a computer and to locate its installation directory.; h& g% X! Q3 x% }: p) G. @
It is used by few softs which access the following registry keys (usually #2) :
0 F" v; b) S# E
+ Y9 {" u& k5 s5 H8 _" d% f-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
7 `; v4 @3 {4 E  }+ \/ o\Uninstall\SoftICE
! Q% d7 _) W- `' V-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE' s  U' c4 G0 [
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
. Z9 g( v& m! `) V+ ~! ]5 P0 `\App Paths\Loader32.Exe$ G8 p, {; x' y7 ]
5 ]" y) }  m' Z( M! w" a7 O0 o5 L

5 q5 ]; Z7 r% ?+ @% TNote that some nasty apps could then erase all files from SoftICE directory- J* {5 O- g7 Q  ^
(I faced that once :-(' m5 |) C2 f4 K+ X
& ?$ _6 ^& ]+ R5 N
Useful breakpoint to detect it:( k+ ^$ a. y; `% r7 }7 ~) M

0 [3 C$ J: s. J* U$ F8 Q     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'4 ~3 }- ^1 Y" R' r6 P$ n
7 s: I/ d" t3 l% p; B' [/ K
__________________________________________________________________________4 ~& O, t; W" c8 B

# y& Z1 g3 H9 Y" F- [: ^# V6 _
- m- c4 x. y5 t' E8 ?* K5 RMethod 14 ) q4 ~9 W/ y( o/ ]( `) g
=========. l3 x  F- L& k+ V7 T! b
9 r# o, M9 W7 W& k% Y1 f7 o$ m, d7 ?
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
" `( t! e+ n' jis to determines whether a debugger is running on your system (ring0 only).
/ b. e4 w8 k; M% Z4 X! w1 t6 p0 T
   VMMCall Test_Debug_Installed  {8 N' c% }! w% K' ]% N
   je      not_installed
) T  r. x( `) v+ j2 n. b! r) Y/ c* g$ M- |% P
This service just checks a flag.
; \1 H( |* J; V' T; }</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部