About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
7 m7 l( X- ]" b- x" |# y9 _6 w/ |<TBODY>
3 O$ n9 ~* j% O9 Z, _1 n<TR>% d7 N1 X3 f, j# g+ A0 }
<TD><PRE>Method 01
. ^: T# F* a4 e3 C=========' c1 K) D7 `$ l0 z7 }
7 x5 a7 l5 `! v' ?9 }
This method of detection of SoftICE (as well as the following one) is  P' u( m+ k( w& I4 {9 L# ]
used by the majority of packers/encryptors found on Internet.: h' N# T8 [! X( P) |
It seeks the signature of BoundsChecker in SoftICE
; a& P' `# z2 p! v  o& Z$ i$ l0 s: B8 c1 @, p3 o& D" d
    mov     ebp, 04243484Bh        ; 'BCHK'
. b3 i8 N4 b1 ?1 L- _  \    mov     ax, 04h
3 Q6 y, d7 @, i) D    int     3      
- T. c, }& U0 a4 L    cmp     al,4* }% {8 d, p9 r  M1 z( v4 K
    jnz     SoftICE_Detected
. {, G# u1 T4 g0 M% e& A- V) i9 E1 p' V! A. P
___________________________________________________________________________+ q; z5 O) o  m' c$ Q6 u+ u
* z0 B2 n8 ^( f* {1 A, i
Method 020 H% J+ w/ J7 L) `3 l
=========+ I, [+ k' G* X' ~
- j3 E5 [' e3 c
Still a method very much used (perhaps the most frequent one).  It is used
4 Z$ {5 k, X0 `1 U, vto get SoftICE 'Back Door commands' which gives infos on Breakpoints,2 j6 d4 i8 D1 W; O$ K
or execute SoftICE commands...
% Y/ I! X: Z, \) R5 h0 z' T+ G8 TIt is also used to crash SoftICE and to force it to execute any commands
3 l+ _9 L& `8 ?: r6 ^% Q(HBOOT...) :-((  , @6 X" U4 X/ G

! Q. `# K' E; YHere is a quick description:. x& {2 G2 e6 ^" q  i- E9 t# ~
-AX = 0910h   (Display string in SIce windows)5 n" B; I6 v; A- X1 j* m: {. W
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)* g' b* ]0 n1 v2 C: n8 J0 e
-AX = 0912h   (Get breakpoint infos)
8 o! H2 P) t* `-AX = 0913h   (Set Sice breakpoints)
+ b  m  ^; h) t8 e6 @-AX = 0914h   (Remove SIce breakoints)/ V% @3 P. Q+ O2 O

8 }' S4 D; {, S. dEach time you'll meet this trick, you'll see:5 T- ?2 w0 u, Y) n2 h
-SI = 4647h
# p/ b9 E) l" |2 `  W9 N-DI = 4A4Dh
" E" f: Y9 ^! R) R4 g/ B. IWhich are the 'magic values' used by SoftIce.. C$ i# G: R+ G9 Z* j: \
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.2 H- P( s$ q9 \" R, T5 `4 l
& y1 e9 g- c4 V$ M7 q
Here is one example from the file "Haspinst.exe" which is the dongle HASP
! j7 ~4 n6 N" `, ^Envelope utility use to protect DOS applications:
3 W' |' o7 [, F4 O9 W# B
( T7 K: o2 c, K: J
* j% e& ]$ s/ k9 J7 b" Z4C19:0095   MOV    AX,0911  ; execute command., D1 ~3 M3 v% o; G4 v$ s
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
5 x  e) _: h1 {4C19:009A   MOV    SI,4647  ; 1st magic value.( M  ~. g5 D+ @9 }7 f% Y9 {
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
7 W! t; y' W* A$ B& t  Y) T4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)' H9 G9 f6 |: U( W. x/ N8 e
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
# P6 d' J. p5 j4 M+ j4C19:00A4   INC    CX: w: x0 e& @6 e$ R: D
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute$ o. l* r0 D* Y! m' E9 t
4C19:00A8   JB     0095     ; 6 different commands.$ C8 p0 F% R7 J9 A; f
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
4 c  Y! W6 y% g$ q% s1 D4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
6 P- [& `& _8 B( d; h
- A% z' d$ Z) G: C& fThe program will execute 6 different SIce commands located at ds:dx, which
; Q5 i1 [' B2 {5 e* P1 Oare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
* s/ |7 I5 l  \; `1 y* {, N. }
" R. R) Z+ X# ]6 {  ~6 |* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
: H( i& w* a* g* `; F___________________________________________________________________________, i( g! \* K9 j
& E! i7 a4 i, Y% R+ b/ G7 u

0 `" L0 Z3 S  x* b7 O" q- S9 [, X2 ~Method 03
1 y8 \" f% d7 M1 V' p: y/ Y5 _6 a=========
& P  B  ^' d, }" ]  w8 ^
% C+ j7 O9 B% h  ^Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
, Q% _3 W$ {' C- S7 [( I(API Get entry point)
4 r1 |. `5 h# l- _        
' E( }+ g) `; }, `, [& U+ z* @
2 x- W- n. D" v: h% b8 R1 D    xor     di,di3 y1 H6 P2 B$ V
    mov     es,di
) L; n! O4 ~! w6 j    mov     ax, 1684h       0 ~7 w; X& Y% p1 J
    mov     bx, 0202h       ; VxD ID of winice5 E; b2 o, w  _2 H3 W+ i
    int     2Fh
% j9 x- Z" B3 ]& q. {. Y    mov     ax, es          ; ES:DI -&gt; VxD API entry point
' c( Z) G; z+ Q2 j    add     ax, di
- p& L0 z% ?0 \) Z# u5 B7 D    test    ax,ax3 |+ M0 f" r) _" h. E' r5 B
    jnz     SoftICE_Detected
# W7 u& O. i$ ?: ]1 i' M# o) B$ z5 z& i( z0 T& C/ ?' Q
___________________________________________________________________________
: E# Y# W7 l- A1 `/ C) @
) d  B9 O7 Y1 ~Method 04( U% ?- Z3 z4 ^7 I5 W$ P" J
=========% K# n" Z" O9 Q7 ~( z9 c
1 n) @. H5 K* v, C4 B
Method identical to the preceding one except that it seeks the ID of SoftICE  L9 y4 l6 E- I
GFX VxD.
# }$ f& y; S/ [. K0 z5 |
& g$ N7 Y+ e- h2 F" g0 _1 m    xor     di,di
% n' l' h6 x3 h( l    mov     es,di9 G. m8 {3 u3 N, R  P( L6 }
    mov     ax, 1684h      
9 f' V, r$ ]' V" H7 s; v( s& U    mov     bx, 7a5Fh       ; VxD ID of SIWVID
, ]3 E" E& o  H" @; z$ }4 J    int     2fh
2 V4 K# f/ e# b( i0 L    mov     ax, es          ; ES:DI -&gt; VxD API entry point7 C3 a; O& s* _6 j) M( c5 V( N
    add     ax, di8 `5 M1 g! l+ h( b$ M+ Q9 m
    test    ax,ax6 Y  l' A# n: T8 v2 e& T9 }
    jnz     SoftICE_Detected
+ P- L3 f9 d/ Y1 o* P& z( H" z) b9 q* o
__________________________________________________________________________3 g$ u! i* Q( e/ k
  l0 f1 y  Z  T! K

# v& M1 H" t3 y6 {Method 05
& C1 s# S, |! R. o$ |% L7 `8 B=========6 _! u3 P; w# K6 [; h. S# O

8 A# P8 u4 ^* s' @& J9 i( pMethod seeking the 'magic number' 0F386h returned (in ax) by all system
& D- `4 v8 E8 {/ ]! d  B) tdebugger. It calls the int 41h, function 4Fh.0 f! ?; X0 x# t# [9 H  a/ J6 m4 N
There are several alternatives.  
+ I4 ~# P; G, X" {7 J7 h
9 q( a, L  U8 l8 cThe following one is the simplest:
: U+ B6 H/ ^1 a
5 O- }; Y. U' s: U    mov     ax,4fh
  j5 L) G0 B" v  ^* c    int     41h# O" T6 Q6 T' F! f4 D  D* ^
    cmp     ax, 0F386
* ^/ M* m$ f/ s2 ?    jz      SoftICE_detected/ G/ P5 [  M* Y! X, o/ p4 z4 {
8 p) _8 \; d+ g" V$ C) G% M4 d

  l# q% ]4 J1 ~8 ]Next method as well as the following one are 2 examples from Stone's
) E! {2 j! Z5 [5 ]3 y( Y( _"stn-wid.zip" (www.cracking.net):! @! \+ M; u8 v, M/ m  }' U: {
, C0 P* g; ^) C; z3 v! V
    mov     bx, cs
% Z8 l2 @5 t3 c# e" E    lea     dx, int41handler2
- \9 {+ O6 F8 H9 S# K    xchg    dx, es:[41h*4]
4 j  f% b; s5 j, g' Q1 A) {    xchg    bx, es:[41h*4+2]
, q1 o9 _$ @' ]8 \    mov     ax,4fh. p0 K8 j+ h3 d. }8 |  B+ z
    int     41h
& E$ z, e# y7 b+ C% z( Z    xchg    dx, es:[41h*4]. K. I- p6 Y9 v6 I, ]8 v
    xchg    bx, es:[41h*4+2]
5 P5 {3 R" Q& D: P% C& a( p* w    cmp     ax, 0f386h7 [/ w: ?# F3 f7 L* d& T7 c% B
    jz      SoftICE_detected1 v% H; d; q: D0 B" |4 L$ y: q

, y5 `# C5 Q5 O, Mint41handler2 PROC) K2 q) L1 [9 }
    iret
- X# ^$ Y% g6 d) `int41handler2 ENDP! c6 e# C5 v; s% U
" Y2 y8 O: O4 S# O, U
6 W- Q4 M( p0 P/ S$ A9 O% i! S
_________________________________________________________________________7 s6 z- h  i0 X. `6 F

( R: d7 S6 K4 N; h0 _8 X1 C7 D; e2 T3 [- d% Q* I$ n: V
Method 06+ @( t) f9 n% _' J3 c
=========  u: J. j6 E* g! B# ~! h) w! e. f

! ^+ O0 M7 x+ F$ b  z2 Z& k. e! i/ h) q+ |6 D& ~" Y& u+ C
2nd method similar to the preceding one but more difficult to detect:
; V! N: s. X% t; o8 E' Y) P. `! e4 N+ l
  l- I7 [. p9 j. n5 _
int41handler PROC
3 j" F% }0 A3 b( i+ ]( ?    mov     cl,al
- F) z% C* w! e- U: s1 Z6 B6 n    iret; U6 W7 n1 k4 X5 M6 s
int41handler ENDP
9 [. M* h0 i) M6 s
1 n! U$ [& f, m7 M+ d& u4 p/ o
2 I- ^: |7 z6 T( m* `    xor     ax,ax
0 M6 Z5 s7 y+ j    mov     es,ax/ T' q: i) W  o" |% i
    mov     bx, cs
2 W/ i3 q0 b  |( a( e    lea     dx, int41handler
  a+ }3 @6 j. F$ P: \$ N' F! F6 y* X    xchg    dx, es:[41h*4]
; S+ \  f- f! B' u% c  w, F+ b    xchg    bx, es:[41h*4+2]! Z6 Z' X/ [1 e2 s
    in      al, 40h# G8 W3 t) T# ?
    xor     cx,cx
4 ]# u) j) ^- Q    int     41h+ g/ n+ [0 x# W  B- C
    xchg    dx, es:[41h*4]
8 P$ D8 s- w$ S. K" A1 @2 k7 `    xchg    bx, es:[41h*4+2]" |8 H, E( U6 g+ X  p' Y
    cmp     cl,al1 W9 L$ Y% V; B* q
    jnz     SoftICE_detected; Y, Y6 f. N8 N, C
, r! O# ~' v& l6 R
_________________________________________________________________________) t( v: f& }0 T  u# \
. ]% L0 o: [1 l
Method 075 d$ [5 l( s1 r7 ^; _# k
=========$ E* @5 A7 B$ g! g7 I7 a
3 U) T# M( C) ~% l, [) ]
Method of detection of the WinICE handler in the int68h (V86)
2 h$ K6 C. T. l  n$ P' A% f$ Z6 Q, U) d0 x# Z: S% p
    mov     ah,43h$ C) i' E' \& J* i9 l  E
    int     68h
7 \) B% a1 F" W    cmp     ax,0F386h: [. w2 x$ D4 w$ _  V6 s1 M7 e3 [
    jz      SoftICE_Detected1 t8 z- s  c9 @: n5 n

: B0 G: G2 G! L6 q# I4 p
' y) G, h8 _% i, X=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit" f9 ]/ a) ?+ y) h
   app like this:. \, M! w4 R, G  C7 R
2 B2 X0 K( K/ p6 x9 }1 o( N5 b
   BPX exec_int if ax==68
& T1 V& n* I3 m5 g! L0 O. e   (function called is located at byte ptr [ebp+1Dh] and client eip is# W  e; X: ~2 ~7 N6 M
   located at [ebp+48h] for 32Bit apps): o8 x0 n# M; o, g/ e5 n  ^
__________________________________________________________________________% Y6 A8 B8 p8 T4 m- R2 ~) P
& G2 S# Q2 g+ A

; ^% m9 i- ?( K' c8 PMethod 08
, d! N8 T, g' I4 U9 `=========" w+ {( ^/ Q4 [" e( H

. a6 X" J: J% W1 B. eIt is not a method of detection of SoftICE but a possibility to crash the
6 F6 ^- t6 I- ~) osystem by intercepting int 01h and int 03h and redirecting them to another+ d# X+ j$ i* z/ N) q0 k; X; u4 p
routine.: E" L% K! J5 F8 d1 A3 Y" ^
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points$ D$ n# {! G# W4 u9 {
to the new routine to execute (hangs computer...)
5 J' `; M6 U; ]; T" O  @7 D5 [$ W$ K% ^% P) x8 \* H! Y" P- O
    mov     ah, 25h
! y& B7 V& B  p4 K    mov     al, Int_Number (01h or 03h)
1 ?- u1 e3 y$ M, h" F0 _    mov     dx, offset New_Int_Routine8 ]2 @# C  D. c& m  j0 W- i
    int     21h6 G7 e4 X  R. r$ Z* }! I

% @4 I7 Q; {3 {: i__________________________________________________________________________
$ A+ f( o$ h+ ^$ g. `3 D& |8 P) C% O5 O" [4 t+ y* r  z+ e9 ^4 T
Method 09+ V9 V# I- U* b. r$ P" o: L' k
=========6 E% k% I: i' i  |

2 }  K5 S7 [) `1 v' [) bThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only+ ?* \0 G4 L! U) N7 ]
performed in ring0 (VxD or a ring3 app using the VxdCall).
+ I. y  H% j  `/ y6 y; ?The Get_DDB service is used to determine whether or not a VxD is installed, K: f2 }( A9 @8 l3 _5 v8 a
for the specified device and returns a Device Description Block (in ecx) for8 U+ s0 f2 H2 i; @9 i
that device if it is installed.- s! I0 A) ]" `6 I3 l) a5 l) M  b

. {3 a* ~' x9 D) h2 A' t   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID3 w/ q1 b# V- o" _$ B
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)2 o$ g' g) j4 s# z1 c
   VMMCall Get_DDB
+ A! z; e9 x3 w, K0 _- M   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed# y2 W0 B# f; y  y

  d4 t$ ~1 F/ aNote as well that you can easily detect this method with SoftICE:0 k( Q5 T# {, O3 A  B" H  z' K
   bpx Get_DDB if ax==0202 || ax==7a5fh+ y$ B+ {) D) d
9 J. q& R1 X$ N, O% C8 r! M7 i
__________________________________________________________________________
; V. M* u$ q8 s' u( t- r& Q: u. y# q
Method 10* Q9 B: B& @) ^8 c, p% c- [) B$ h* l
=========2 ?3 n) I' M4 I
5 V0 B0 e/ E, f0 W- \
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with) Z, z6 r1 O! x5 L- K) ^0 P
  SoftICE while the option is enable!!
. L' H  Z6 e7 j) Y  z. j5 K2 e1 Y+ ~2 E$ s
This trick is very efficient:4 n, [  s1 {' b& J" C, _
by checking the Debug Registers, you can detect if SoftICE is loaded
3 t+ w0 {6 L) B) G(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if) E% v( b+ `" e9 B
there are some memory breakpoints set (dr0 to dr3) simply by reading their5 w# l7 }- ?' p0 g* e) n
value (in ring0 only). Values can be manipulated and or changed as well: L3 x) |+ |7 T5 S3 p
(clearing BPMs for instance)1 f( b) r5 y) [( i- B% d( E, S
  J( ~& s. ]8 K4 n7 C+ Z6 P
__________________________________________________________________________
# o% h/ {4 k" d: Y; N& H4 S
* F( X7 }9 k7 G, P$ W& P1 F- qMethod 113 j/ \6 S; X! b- d$ V" j& q' E/ L
=========" {/ c( N6 N7 ]7 ?; V: V1 |- m; M

  E* |- U9 J" U5 h: P* B- M% GThis method is most known as 'MeltICE' because it has been freely distributed# u4 Y; D+ y, l( z( B& u
via www.winfiles.com. However it was first used by NuMega people to allow: I; @8 |! c( C1 ?& {
Symbol Loader to check if SoftICE was active or not (the code is located; x9 i4 m+ W" a8 V
inside nmtrans.dll).
7 Q7 }2 t6 J$ @5 n6 A0 P
9 e) r7 [1 F8 T! j: z0 ~* A7 h# ZThe way it works is very simple:9 p- h  L% W( w7 @6 v. c
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
4 F! X( P) L; o' m: p/ e2 }0 X3 z( VWinNT) with the CreateFileA API.5 h- j- D6 Y+ w! h

$ u+ ^, A& _5 x8 v* `Here is a sample (checking for 'SICE'):0 O3 a9 U- Y& r! o$ E) t' r6 N6 g5 J
, J5 R; {# A0 ]' H! E  O8 F
BOOL IsSoftIce95Loaded(); V0 f4 a/ s& L) m* }
{/ ~, H  ?; n9 h. X! |
   HANDLE hFile;  6 Y4 O* q* p. c. _. s# s! K
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,, J0 ?$ ^7 [( T. q
                      FILE_SHARE_READ | FILE_SHARE_WRITE,
4 N! a* |* q% s: J" k" g                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);2 \! R1 b2 B) i; V% V
   if( hFile != INVALID_HANDLE_VALUE )) Z% {6 y% o6 |" [3 l& b3 X9 H
   {
5 h2 g( o" g$ I3 V  V* k" @/ A& Y      CloseHandle(hFile);
: G0 O& i0 N3 H* i' J      return TRUE;
+ Q0 O) r; Z7 F* J! w/ _   }* C% V% A6 Q$ D, ?" a$ }& o
   return FALSE;# k' r6 {+ ^; h) t5 R6 b7 t; Z5 `
}+ g, ]4 |$ l' s% ^
9 V, N9 R% S5 t0 g8 Q
Although this trick calls the CreateFileA function, don't even expect to be
- ^/ n. {* O& V/ f  U9 F; Wable to intercept it by installing a IFS hook: it will not work, no way!
  V1 C3 |  L+ yIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
; H7 k# c" D- P( z2 J( fservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function). c6 c# B4 ~  J  g
and then browse the DDB list until it find the VxD and its DDB_Control_Proc8 r- Q& G0 N" ^% `% H( c
field.
1 i, y# v( j! w7 m1 H% iIn fact, its purpose is not to load/unload VxDs but only to send a
) n, K0 ]6 M5 k& u: nW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)9 k6 ]3 e: t/ F: n7 O! |
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
: U' b% i9 q* R3 h% mto load/unload a non-dynamically loadable driver such as SoftICE ;-).
" u5 W" M' ]  A/ gIf the VxD is loaded, it will always clear eax and the Carry flag to allow
, \$ t" e# r6 N$ I' t, Aits handle to be opened and then, will be detected.* O. e# [# D% m" A- ]! A( T: I
You can check that simply by hooking Winice.exe control proc entry point4 b* i" z8 r4 [
while running MeltICE.7 i. r$ [2 u. F$ }1 o) a

% {0 V. N, B+ f/ t" [
" K7 V$ o/ i6 Y  00401067:  push      00402025    ; \\.\SICE4 b6 w3 R. [* I, W0 |; R  D
  0040106C:  call      CreateFileA: r$ `  I2 f( \0 M1 c) y  P
  00401071:  cmp       eax,-001; b3 z8 D6 q3 l2 i. l1 Y5 @9 }
  00401074:  je        00401091* P2 R; p* {6 |) l/ v

( M% a- `# w9 I6 X4 {- E
5 m( N) V7 I" A: [0 c. dThere could be hundreds of BPX you could use to detect this trick.
. |- _( m9 M! F) t7 ^( d-The most classical one is:% ~! E7 ~; \! |+ [8 K: C
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
+ |# V+ M1 s5 u+ @3 U! r) k    *(esp-&gt;4+4)=='NTIC'9 p: M1 u! U- O% U( |8 h( F
# {/ O1 \) q3 p4 [3 K
-The most exotic ones (could be very slooooow :-(
4 o" |6 r( c& x0 z8 W7 c   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  ( K0 v) [  O0 h( I
     ;will break 3 times :-(5 K4 g- F# B8 f. a4 K
& w& H6 l5 {( ]: A
-or (a bit) faster: 6 L, i: T: j; k$ ]$ M+ I7 }+ p
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')# B$ p  Z7 s" i7 S

) z6 Q: M9 L. R9 y   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
; r! i8 l6 e& f' m     ;will break 3 times :-(
5 `# N5 h' S) j2 y' F8 L( I' \. Z' w& o$ ?9 N
-Much faster:
7 Y0 m6 V# ^) Z' ~  h, y" ~6 ^. u: u   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
( F' _1 E- i/ [9 y/ {# q# i1 v" Q
1 f+ O7 D, A, s! \, iNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
5 P. s/ g9 a, Xfunction to do the same job:
2 L6 s6 B" N3 c
6 H& r+ h0 \8 J( Z3 I& F2 ]+ O1 u   push    00                        ; OF_READ" G% W" J5 X( v0 J' i
   mov     eax,[00656634]            ; '\\.\SICE',0
9 @: w& z! Z+ S5 C   push    eax2 `7 K; w7 z' m; K1 g4 N8 O5 t/ ]- H
   call    KERNEL32!_lopen4 y$ e2 E+ o2 L: X' t5 L
   inc     eax. _1 M- G  H2 M5 O* f  ^( [) `. |
   jnz     00650589                  ; detected
  T: \0 s+ i1 c8 a   push    00                        ; OF_READ! p1 D5 k! y$ o% h' m( h0 A, R
   mov     eax,[00656638]            ; '\\.\SICE'
8 K& g1 X& O( z/ f: V" i+ ~   push    eax  i. [2 n0 X6 b+ U
   call    KERNEL32!_lopen
$ a0 V& J" N0 U1 Q6 ]. ~& @0 u   inc     eax
- l. R3 D& g9 B9 w$ b% N/ ?, O   jz      006505ae                  ; not detected7 n- y$ Z! g# T
1 N5 _$ [: b$ L' J5 n! S
2 V% w* E3 V% s9 ]" {: _
__________________________________________________________________________
% ?" F+ @& \' W3 p, \4 R* G2 W. q8 J8 p3 A
Method 12
+ m1 g5 Q7 Y7 m=========3 |$ W- B- _% V8 K$ n3 v
/ K, P6 ?7 u4 R' l2 w
This trick is similar to int41h/4fh Debugger installation check (code 05
4 u, K3 G( g; C: X/ U0 ~8 W$ \&amp; 06) but very limited because it's only available for Win95/98 (not NT)% \% f: Z5 d4 D) N
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
9 Z) @  Y/ J+ I$ E# d& C
2 F/ ^3 J- M6 ?  \6 [' b   push  0000004fh         ; function 4fh
! ^5 Y) u* |( Z' y* T5 r+ g; g   push  002a002ah         ; high word specifies which VxD (VWIN32): V/ ]5 M( X, L2 W8 f6 p) ]
                           ; low word specifies which service# t5 `, R) `) H: J
                             (VWIN32_Int41Dispatch)
2 @% u( `1 ?5 N+ F   call  Kernel32!ORD_001  ; VxdCall  t/ k% o7 b7 V' X: j* C
   cmp   ax, 0f386h        ; magic number returned by system debuggers% }* r6 F$ F' r9 i2 W$ |; X9 y# r
   jz    SoftICE_detected
! d) f/ q0 }1 z) `! v0 d+ Y4 K  w+ P9 k  V: Y& R& [
Here again, several ways to detect it:
6 p. A5 v  ~5 J7 Y$ t5 ~% T2 O& g: W: t" [9 l/ ~% Q$ N
    BPINT 41 if ax==4f
$ a/ b! C7 ~8 g2 m) }& Q1 n' p2 N9 a3 K. Y; u4 n8 E
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
1 g0 v" L# i0 U5 }; H" a7 O: g' E* `) {3 W
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
3 L; F( }$ h* i/ Y7 e1 t( M
8 C3 ~1 ?4 ]2 R5 f+ H( x    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
% k5 x* y' v9 Q9 w9 t, p5 B- E7 S$ L9 }( y
__________________________________________________________________________
6 b3 q9 i1 O2 K
7 L& n7 v& ], g! A4 b$ t7 h' ], I8 [) BMethod 13/ S# x8 g9 S2 ]% q+ O
=========
! K* n7 Z3 J8 q
# s( y* ?3 T0 G9 }2 J3 f4 t) }* QNot a real method of detection, but a good way to know if SoftICE is
! Q# m7 t) G6 `) S: ]: iinstalled on a computer and to locate its installation directory.
+ \+ q$ @1 i, s" wIt is used by few softs which access the following registry keys (usually #2) :6 O5 g4 }  E1 o6 }6 O5 L
  s1 x$ Q% @: x
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
, N; K$ L* Z: \* h\Uninstall\SoftICE. G( i# D& H) W4 ?; p
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
! z! ~% C; e' c# N, W5 _, ^-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
$ d( K7 e. {  T6 Z8 j9 p- u1 O% F: L\App Paths\Loader32.Exe' ^6 B& r9 D* A1 W

3 t1 W' @' {" K6 ^$ B9 g. \+ u) v, r3 t' [9 m" x7 J
Note that some nasty apps could then erase all files from SoftICE directory
# L* F! H% T7 w, R(I faced that once :-(* m- ]4 w# r; l% N1 G3 B; |
. ?0 n" C7 Y% c' h! V
Useful breakpoint to detect it:
0 |# a1 K  H4 a& D/ E/ l" d: r  v" `7 r$ g/ T
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
) f; h. v$ [' @/ _; n$ [
1 o& X# d  d& K: R__________________________________________________________________________5 g6 z* s7 f: z5 P' m1 Q
) ]6 L6 o, H7 ?; w
1 ]8 H3 g7 X5 D( b
Method 14 # J) G" A& _, p6 n" O# @
=========  P5 @: v7 q2 o2 o9 l# j+ [- s! C
* C- E# K; p8 S$ O& H  ]
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
! A7 }/ Y& d1 N# Qis to determines whether a debugger is running on your system (ring0 only).
8 ]0 y% ], d! J( n5 Q; ~
$ S: B5 Q( c; o4 z4 d   VMMCall Test_Debug_Installed+ a, A8 L1 J. @0 D) d/ f* u% v
   je      not_installed
* F# `- k8 y1 E4 b9 L  k) S) A* }3 c+ F
This service just checks a flag.5 L# H0 a$ i8 m
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部