About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>/ S" s9 P: F" i# V& I
<TBODY>" i$ S1 w/ Z% D7 z
<TR>
' v7 Y# n5 r/ M& c' d<TD><PRE>Method 01 ; T% M) G) B2 m% p" C
=========
: ]2 [6 f: G* Y1 R# w, f7 C
3 m' E# R1 N7 ?This method of detection of SoftICE (as well as the following one) is2 ^) y# ^5 H3 k1 L- ?& y
used by the majority of packers/encryptors found on Internet.4 c# w5 i* U& M& p/ d
It seeks the signature of BoundsChecker in SoftICE
9 |# a1 N/ W" M+ ]5 M6 V
; W3 |* k; x( U5 G# Z5 ]* w! @    mov     ebp, 04243484Bh        ; 'BCHK'& l) [& a& v6 I+ N$ x  p4 e% K$ f' V
    mov     ax, 04h
8 a6 F; p3 ~* p+ ~, z    int     3       - z3 U, b+ V, F! y* b- R
    cmp     al,4
7 M0 M  C2 Z5 j, X* K    jnz     SoftICE_Detected( F  k7 b- n7 {5 `
1 W8 R0 L* q/ N8 g0 B$ k4 N: F
___________________________________________________________________________# _# _1 ^' t/ m/ L0 w

5 y( B& |0 T( i6 h% ^8 C0 N5 ?Method 02
2 f1 W5 b+ _! |! o6 |! E3 @: l: m=========
" S/ C) E) v+ t* w% b
9 Z' |9 x) q5 c, ]) }Still a method very much used (perhaps the most frequent one).  It is used
- }2 S8 l* S, I5 E. Ito get SoftICE 'Back Door commands' which gives infos on Breakpoints,
- `( X2 q4 a+ |. g5 ?) ~or execute SoftICE commands...
, M3 Q- B& E+ F) K0 r( o; SIt is also used to crash SoftICE and to force it to execute any commands2 x7 s7 H& K" ~" M7 j
(HBOOT...) :-((  ) s' ^/ d+ y+ f5 S
! U7 d, a$ Q4 p
Here is a quick description:
9 Y3 w/ v+ b+ b-AX = 0910h   (Display string in SIce windows)- s) P* m* y3 n  b. x$ r
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)4 v( ~. o  Y% K$ _5 `
-AX = 0912h   (Get breakpoint infos)' z% c3 V( n+ o
-AX = 0913h   (Set Sice breakpoints)7 Q/ X& W/ ^5 Q+ P0 e. Q# v
-AX = 0914h   (Remove SIce breakoints)
* t8 i5 g% O0 A" H! W
. B& {( w) y/ z9 ^6 [, lEach time you'll meet this trick, you'll see:' V  t9 I# \3 T% q1 H9 w
-SI = 4647h
) _8 K, \2 c( [. c' }-DI = 4A4Dh
+ R% V* a) z' K& f8 EWhich are the 'magic values' used by SoftIce.
! f4 O9 p/ ?$ i( @6 t* j! LFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.5 w; m1 z0 {& d  m1 A9 Z
& z& l2 J. z# G; ~! g: p
Here is one example from the file "Haspinst.exe" which is the dongle HASP) [+ a! ]9 S( B$ ~: I/ j  e: L
Envelope utility use to protect DOS applications:
  U3 R- G7 `; c. L
( f/ I1 s, j9 u) k9 e; K! B' H+ y( Q3 N' V5 D1 a; z) T) _
4C19:0095   MOV    AX,0911  ; execute command.9 [8 w3 j. h* e* B6 p7 q. x
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
6 S) z4 o/ ]1 _( k4C19:009A   MOV    SI,4647  ; 1st magic value.
! d* D7 Q; V! k3 Q! A8 U3 N4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
5 y% {* V  D, ~5 g; h4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
5 U% V/ Q, t  L3 |; k9 \. \7 u! T4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute2 U' m% F) s2 V1 S
4C19:00A4   INC    CX/ B6 b' Y2 U2 q1 I, q8 P
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute' Y& b# t1 T% q( W
4C19:00A8   JB     0095     ; 6 different commands.9 ^* s: l# K; N) C& ]  j, W1 n
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
( b; H' T, I+ k% x3 P0 N: {4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
/ P) b+ K5 q- R  {2 }$ }) o5 E: R6 ~1 ~% r' m
The program will execute 6 different SIce commands located at ds:dx, which+ y' r' o7 s7 u7 q' ~- n
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT." N" Q* Z% l& \* O
2 k4 e4 s2 r$ k- Q) j0 u
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.1 ^' k5 h& V( h! G
___________________________________________________________________________( m7 u' _' v2 @0 u
- ^( e" B6 V$ s: N( p" H

- d0 W! t% j% z. P' |' K9 M3 oMethod 03
; {4 ~# d3 w5 m& ^, [0 A* b2 Z=========
& @6 n* r8 P- h. P2 u! e/ G3 P9 ^% G& B! I, H% f
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h6 t1 g9 G! i" e3 \8 K
(API Get entry point)
# D5 T' l) w  w        ( S2 `- c- y% p6 E$ p( d
9 A1 l; `/ }. r6 t2 z# h
    xor     di,di
3 P: ^7 q& X' }    mov     es,di! d, }0 [1 B5 A+ ?' a' W6 p
    mov     ax, 1684h      
5 M3 O' Q+ e' ^    mov     bx, 0202h       ; VxD ID of winice
" O% N. s" Y5 |0 b& U    int     2Fh* x" p  N" x& Z& e) K
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
$ s- Z- e( |' D& }    add     ax, di9 p) D1 b7 U8 }
    test    ax,ax7 N$ @" t( @0 ~, w. ~" q& D/ }' [
    jnz     SoftICE_Detected" X! V% u/ c8 |8 V. ?  [

7 B1 I% J* A1 R+ x, w0 N# A" g___________________________________________________________________________+ {) u! A, `6 o1 H

% |- g' T0 Q* @% j2 p7 ~Method 04( M6 P% ^) ~: ?5 E' e& a9 J' S
=========
: _5 ^/ c9 Q3 e$ s: M
( q, C' o; ?) z( SMethod identical to the preceding one except that it seeks the ID of SoftICE
* ^1 g* ~# c# VGFX VxD.( ]% L* l1 h4 X7 W. C; \* p
: R; W0 }; T. \6 R
    xor     di,di( R( M4 Z$ N$ @
    mov     es,di6 h, J, E8 p- i) ^% B% N, f* k  S) i& R
    mov     ax, 1684h      
6 Z4 S) p- i8 Y: {  K% F0 V* n8 z    mov     bx, 7a5Fh       ; VxD ID of SIWVID, L4 P/ H1 H0 ]. s9 P8 E
    int     2fh' E3 q" t) w( m( ^/ l& D
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
0 \: Y0 }' T, e; _4 b: C; l    add     ax, di$ z% p# B. j. y7 g
    test    ax,ax5 v5 J6 D% I: O
    jnz     SoftICE_Detected
4 |7 N& X- W% z5 x4 h9 n/ V/ _9 {1 {' ~' V5 C5 [
__________________________________________________________________________
" X& R% c# O" \/ `) J" U" i
8 m# P1 b9 ?2 B. I' L) k5 k( a. d4 G- |3 I6 v
Method 05! K) {9 k. K. V
=========- J1 M+ _. z% Z0 V" G+ L, v

1 u. w' Y1 U: }$ g  D) `, QMethod seeking the 'magic number' 0F386h returned (in ax) by all system6 v+ D) L9 d" ]: r: Z6 f% c$ |
debugger. It calls the int 41h, function 4Fh.
0 L! |! e6 a8 X: p  wThere are several alternatives.  " ~6 z) x; Z& o# x

" D/ Q3 @* i6 B9 [% \' _3 m" HThe following one is the simplest:/ Q- M3 g9 O6 I1 r; v$ ?- v

  n* y" O4 w( v  c    mov     ax,4fh/ E+ B1 m8 e8 e; V0 S; G
    int     41h
; P* S, _2 c4 P" i$ [) f2 T  [    cmp     ax, 0F386
4 R# _' a# b) v# Z. R1 i    jz      SoftICE_detected
! d) Z3 a; w6 c
/ Y' u# d; V% M  T% A# y7 s+ e: q. |# x
Next method as well as the following one are 2 examples from Stone's & |7 i" {- N( F/ L" c2 b$ o
"stn-wid.zip" (www.cracking.net):" ~! P' d+ M, x8 ?) p% n9 N

, t' v3 ?0 B! p/ K) s    mov     bx, cs
2 O; t: Y8 C% G7 ^    lea     dx, int41handler2( m; \# }. P- J7 z! s( y( h$ o% l
    xchg    dx, es:[41h*4]$ q2 ]- L0 V' p/ o, U' ?( g
    xchg    bx, es:[41h*4+2]
" D+ _4 D) l9 ]. F  L( h4 ]- T9 A% Q    mov     ax,4fh. I% e: i$ S5 X. Y
    int     41h/ T& z5 `+ g$ o& i
    xchg    dx, es:[41h*4]$ G& g; o4 d: U; N
    xchg    bx, es:[41h*4+2]6 M7 x$ e2 Y0 x6 B1 _
    cmp     ax, 0f386h
+ k! ]% j, {- e( z3 f    jz      SoftICE_detected7 a- b  g: o& W# O
, }6 o: T; S  N5 N: H& j
int41handler2 PROC
2 o" Y# V* F. u    iret
8 c4 c1 D0 Y9 h# Xint41handler2 ENDP/ R% m3 A' D, G: F: m3 F8 S  I

! i4 S* [7 O0 S! S4 z& l) ]1 f6 Z9 `, e8 g
_________________________________________________________________________1 T- ?1 I8 A8 ?$ X+ T7 `* p
( W& N% ~9 f3 j3 j. A

( g" y  z* ?- F7 vMethod 06
6 R. T6 J8 B, q( ?4 |* _" v; l=========' s* @1 F8 A+ U* @# W# m' Z' s

0 Q* _1 C3 d( S  j$ }# [- v, ~) S! i7 c7 D; B! {/ X+ f  F0 o
2nd method similar to the preceding one but more difficult to detect:
& X8 i6 q% R# I% a" ^( k
# [, J/ m7 u( l5 }- G9 A
; w& |' M9 B% M6 g+ c1 Nint41handler PROC
' S& k( J: X! `) o' A3 Y5 `: v    mov     cl,al& g# u+ e1 z* A$ x) `
    iret" m5 [- ~7 O: z: [) N* u4 Q
int41handler ENDP, O% e. _! v# I: C; K  q! w8 x: z
( X5 b( y  h! W1 q( L2 h  ?

: Y, b/ T3 }; Z    xor     ax,ax8 E' I0 |2 b; [# ?1 C# o# i
    mov     es,ax
. b1 \) W+ g5 U" u# [    mov     bx, cs- f: g9 A* H! t9 G$ T) Y' ], g
    lea     dx, int41handler
) o0 Z9 v7 d8 k- L) J. O# J+ _    xchg    dx, es:[41h*4]% a+ [" r$ p0 G& C4 O9 S
    xchg    bx, es:[41h*4+2]
! d; w; |& Y1 `( Q  [    in      al, 40h
% Z. S1 M" s' _% A  `    xor     cx,cx
  F5 O' J- @# j0 {. @    int     41h- s3 V6 a* Z7 |
    xchg    dx, es:[41h*4]& F+ ^: S& h; `+ E+ w) J& ]3 u
    xchg    bx, es:[41h*4+2]
0 e! h4 d* b3 ?    cmp     cl,al' ]$ U; N) E2 c1 T
    jnz     SoftICE_detected
# r# t* K2 O3 z9 A( _( o
. Q  E# Z9 H+ S* B_________________________________________________________________________
  V. M9 S9 j( T- Q5 \% A' G' c4 m) T) a2 G
Method 07
( V: |$ m3 O6 X+ ^( Z* V9 [* E=========4 @1 H) u- [) w5 S
( A7 w$ {0 h$ a9 A! X( b0 Z: S
Method of detection of the WinICE handler in the int68h (V86)
' D: \, [, ]' a, h* x: s  \; m1 Y
7 K2 {. z+ U4 `7 F4 B$ A    mov     ah,43h+ H  I8 u! }5 o6 \$ L( r
    int     68h1 t) I2 r& ?; h$ Z: h
    cmp     ax,0F386h
' k% @' I/ h3 I( c. A# d0 ~# n. h, W, p    jz      SoftICE_Detected6 ~0 u. [& T! Q- G7 k5 o
) \; P, V8 T' G% z

+ \; ^5 ], x* G. T4 S) b2 Y=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
; t% s* q2 v/ G% X0 P! {. l   app like this:
/ f0 z# t8 S) d! J& z
: ?& W5 ~  u4 F) [# F   BPX exec_int if ax==68
, }" Z( }' o, x; {2 j" T, L   (function called is located at byte ptr [ebp+1Dh] and client eip is! ]7 M8 L: \6 C  Q" @! b( a
   located at [ebp+48h] for 32Bit apps)
5 m# V3 e& c' K4 U6 ?( r__________________________________________________________________________
, j, G! b% |' O2 x8 j) s0 H! U4 i
. l, `1 I5 A2 n# O
Method 084 [- W% o" v; P0 j8 S
=========* x# v. W( U; D: c; i

9 z1 j/ i$ f+ J/ pIt is not a method of detection of SoftICE but a possibility to crash the
; u" j% i/ g" Ksystem by intercepting int 01h and int 03h and redirecting them to another
4 R7 {! Q( S8 q( z' Q2 hroutine.: v$ u2 t/ t$ a& @+ w' Y% O1 j
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points8 u7 \" @; I" q; ~! l: ]- d7 s
to the new routine to execute (hangs computer...)' K) u8 t. {. `# X$ t* i/ j- N/ B
" r7 k) W5 F% J  p8 W/ F: f) |
    mov     ah, 25h
+ L: c3 S4 k1 R    mov     al, Int_Number (01h or 03h)
: C& g/ a. X2 a/ n% D( h* M    mov     dx, offset New_Int_Routine! G2 t- p/ q: Y1 D/ H$ \" X' H" r
    int     21h+ j: u" H2 \! L1 J! R  {% h

  R- x6 ?; y& {( A7 {__________________________________________________________________________
. }8 j# k: q0 g9 n
% `0 h. e* t0 I3 u  \* TMethod 09
3 ?4 t/ H7 n" R2 C8 h* Y=========! J& t# f1 \6 W
3 a5 C- G9 A/ n5 B6 G. X5 k
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only& z' \: t- a% F1 R0 x7 L4 f
performed in ring0 (VxD or a ring3 app using the VxdCall).
) C# n; d4 w3 `. o5 U% W/ T1 hThe Get_DDB service is used to determine whether or not a VxD is installed
9 Z- S- |) B( y% Ifor the specified device and returns a Device Description Block (in ecx) for
! A" D. q& g) j7 {" S3 qthat device if it is installed.+ m) h3 U6 F6 b9 Y+ X
$ C/ L/ a/ b* q5 r/ D
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
# l1 P5 e0 l! Q# G8 n   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
! H7 k8 a1 T, r8 W2 R2 I8 k   VMMCall Get_DDB" H6 V( y: }0 M8 R! Q- }( g% F: E. O
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
; }. I0 R+ x# a- G; {2 v/ T" q: i4 l' s) c) P
Note as well that you can easily detect this method with SoftICE:: O# [& W; C" q! G2 S& o8 p
   bpx Get_DDB if ax==0202 || ax==7a5fh3 o7 ?# P( d& H+ v$ S4 g7 I
4 g. U4 S/ a+ c5 O, \' h: G
__________________________________________________________________________3 r) u9 H( b+ O) U& m$ _
8 A. \/ g" x$ Z1 D
Method 10; f" D$ \: I: e$ D( u" Z5 [" U# B
=========
! A$ O6 p8 M( @2 P+ m
4 i0 ?9 ~2 [2 N7 }% d" D7 M=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
8 q/ l: m3 u* U% e! X; N' E- F  SoftICE while the option is enable!!, t; |: p/ v/ b; S5 y8 K

" h4 ?' U, g1 E+ lThis trick is very efficient:
9 d  f8 s, f8 t; k* vby checking the Debug Registers, you can detect if SoftICE is loaded
0 b, a& X9 N1 x1 O(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if# T, {% q; E! c' O: L
there are some memory breakpoints set (dr0 to dr3) simply by reading their+ X. [* c5 T4 C, B8 G6 ~! k0 K% a
value (in ring0 only). Values can be manipulated and or changed as well$ I1 R: J) L0 H- j7 o
(clearing BPMs for instance)  e) e* f4 w* w
! g8 Z6 d* K' Y* k4 k; c0 B
__________________________________________________________________________* r: _; w9 Q) X# E6 i: S

5 b9 |8 y4 F) i& a" t( W1 u) P( vMethod 11  b& [" X  ~. C4 ]; m2 i7 b/ g/ q5 m
=========
- q$ l$ t$ a. h, L- b4 O7 m
+ E/ \. k3 ^$ y5 t) q$ \This method is most known as 'MeltICE' because it has been freely distributed- d, h0 x7 U- v9 @
via www.winfiles.com. However it was first used by NuMega people to allow
& }/ \* M  H! W. T+ h, cSymbol Loader to check if SoftICE was active or not (the code is located
/ J- O: H9 i  q3 `) D- Y1 G. {inside nmtrans.dll).6 U- n1 {( K" K, |- F
9 U" W5 L, ~  `5 }7 n
The way it works is very simple:
; c5 g! \, Y4 z0 T, yIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for9 ]1 v3 X7 c5 o- H! A
WinNT) with the CreateFileA API.* r3 _4 O! C( o2 ^, X- r" S( t6 }
" m, ~! Z* u6 ?, g! F; U
Here is a sample (checking for 'SICE'):
# |4 |$ u6 K% }* J3 J$ Z. B! e, T: X% r; u' ~' I
BOOL IsSoftIce95Loaded()
' a$ ]$ |6 e' _0 e/ x: L1 X* g{6 b, H; P/ Z2 p! K9 G0 s% z
   HANDLE hFile;  
7 y( Z: ?' Y* v, i- O! ~" Y, h4 u   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
' j3 G6 P+ v% |7 V/ b                      FILE_SHARE_READ | FILE_SHARE_WRITE,
4 u" |& z: z1 A2 O4 v                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
4 H% v! n( _* g2 ^7 ?* _# ?- a9 G0 k# e   if( hFile != INVALID_HANDLE_VALUE )1 \; H/ B( m% t- _  F
   {
0 d! K( g2 N& B, L; n      CloseHandle(hFile);
! ?) r+ g8 g% b9 v      return TRUE;( q' Z: U2 [( ]- K6 Q3 c
   }
! @! V. [" ^9 v8 Y9 k* ]; t" T   return FALSE;
( O$ y& L! m% M: U( B8 a; J}
) q+ u6 V+ s& Q/ _, [
" J. m/ d/ l# W( G& CAlthough this trick calls the CreateFileA function, don't even expect to be: T4 D! h$ S: S9 x) o% h
able to intercept it by installing a IFS hook: it will not work, no way!/ n5 M) a& w9 t; k; e/ `+ Q
In fact, after the call to CreateFileA it will get through VWIN32 0x001F+ o& r. y: W% L: W4 {
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
3 |2 J, }2 P0 b: R; X0 f0 a  D# fand then browse the DDB list until it find the VxD and its DDB_Control_Proc1 a5 e4 @+ H$ M1 G5 b' Y
field.
  s" [: g8 q* {3 {; u# HIn fact, its purpose is not to load/unload VxDs but only to send a - t0 M1 L% G6 T7 b1 I1 x$ r
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
* s* c* {# f, L% G( W; s# \to the VxD Control_Dispatch proc (how the hell a shareware soft could try
+ K8 @8 \0 P) R6 Lto load/unload a non-dynamically loadable driver such as SoftICE ;-).! J4 B0 b$ S* q$ |! V( }1 H
If the VxD is loaded, it will always clear eax and the Carry flag to allow, I9 R6 A8 R; V7 f* d& o- B
its handle to be opened and then, will be detected.5 a: p0 i: i# a
You can check that simply by hooking Winice.exe control proc entry point
8 J* Y/ O$ X& o1 i6 pwhile running MeltICE., d0 X9 a% _( F

- {: ?# r! k6 Z. `% [  @! E
' ]4 Y; x% r6 N7 N/ e- u  t  00401067:  push      00402025    ; \\.\SICE
/ x7 x4 ~- o1 g, y% m6 D! @  0040106C:  call      CreateFileA3 }3 N/ q) b  V: |  w: x; q/ o
  00401071:  cmp       eax,-001
5 u) S/ o8 f9 x6 o; F5 t  00401074:  je        00401091, B: y% f0 l; B0 j

/ V+ l9 R# j1 }( g+ o1 A; A& @
- \1 y: R3 k2 hThere could be hundreds of BPX you could use to detect this trick.
6 d5 `9 e9 ~9 S6 P6 ?" Y! m4 s-The most classical one is:
6 s  f$ u+ J# _9 L' |) m  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||: G8 T1 |, z$ n+ w* h% d5 n+ l
    *(esp-&gt;4+4)=='NTIC'
. M" @8 q. ~& K
+ Y+ M: I0 j! x0 Z- K$ u& l4 Y-The most exotic ones (could be very slooooow :-(+ H2 G" x& v. ~% z/ P* f$ v: Y# e
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  ! |/ t; b8 h) E8 y4 X- \1 S1 W0 D
     ;will break 3 times :-(: }) Z# M: m* {& n: t* W$ I
8 j1 }/ Q) d- u  C- {& V9 _* \4 @
-or (a bit) faster:
& D0 H. l' d; q! x% \, H   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
4 S8 J  C5 {0 \: |
( }; C/ h: [) y$ |9 s5 a   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
& @# T6 k+ t; C  ^% ~$ Z     ;will break 3 times :-(3 ~4 }  [1 S* q' w6 W- q
9 @3 C" F7 L( ?$ H
-Much faster:
; a( t3 p% H  }! W   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'1 V7 G3 s5 ?! l5 T: c0 K7 n4 ~% _
+ n, n; b4 q4 s. Z5 _
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
/ f0 F8 ^4 g! Ifunction to do the same job:4 q% m! f. A# X' ]* K, U

6 a2 A7 z. w- y  B   push    00                        ; OF_READ
2 d% v+ Y8 r0 M  n1 w: R+ h6 s   mov     eax,[00656634]            ; '\\.\SICE',0
) s  v8 C$ w, e6 G   push    eax% b6 p2 v2 x1 a& F- V
   call    KERNEL32!_lopen
/ x- T9 Z" Z) K9 r5 m4 ]+ N   inc     eax' {: \5 K% z$ |
   jnz     00650589                  ; detected
4 W- T4 t! {# |   push    00                        ; OF_READ
, }- y5 Z6 T0 g8 s# K- \   mov     eax,[00656638]            ; '\\.\SICE'
$ ^& J& f/ _& B2 w, o; D   push    eax- Q3 v4 K' R9 _) a$ x/ Y
   call    KERNEL32!_lopen
* [+ a8 u1 T) n9 C6 _; a7 k   inc     eax7 }1 r) c  n0 _6 A! ~/ C' r
   jz      006505ae                  ; not detected, ]# e8 v( n. B# s% N, a

! V) B! ^8 r/ s
4 ?0 y4 d. C! t' N2 ?; V# Q8 e__________________________________________________________________________
, f' W) P, Y! h- U' P, Q$ f4 U6 E3 }% T& M# C- K
Method 12% i5 X8 h" s6 M7 X2 H/ L
=========: I; t  G4 R2 w5 J( {3 e

4 F- j0 o9 f( m7 ]' z4 TThis trick is similar to int41h/4fh Debugger installation check (code 05# B7 {6 Q5 E0 P3 _/ @3 ^, h; c
&amp; 06) but very limited because it's only available for Win95/98 (not NT)
" d# X& D2 v: ]: k" g8 [9 tas it uses the VxDCall backdoor. This detection was found in Bleem Demo.
; Q( M, O" }4 f8 V4 C' R
6 g9 o) x  C, G' h. |5 x, I   push  0000004fh         ; function 4fh1 C' L9 @' `5 c* U; X/ c$ z  I
   push  002a002ah         ; high word specifies which VxD (VWIN32)
) p$ Z4 _- c# Y6 C0 f2 r                           ; low word specifies which service) g! p4 Z9 z! I/ H- l7 ~
                             (VWIN32_Int41Dispatch)0 \8 R4 \; R% y% o. Q
   call  Kernel32!ORD_001  ; VxdCall
' h, i; C& Y8 W' T% q5 Q: O   cmp   ax, 0f386h        ; magic number returned by system debuggers5 U: w2 Z0 e& d5 m. f" r
   jz    SoftICE_detected2 ]- m8 ^+ V. O& B* c" x$ ^( h  K
' p% M, }" g, T8 U
Here again, several ways to detect it:
3 y- i  _# h& z; `" q
6 |! F  m) F- @- {' X0 k    BPINT 41 if ax==4f
/ G8 I. t% B. ~$ c; ?. l4 [
4 J5 _, [, _5 d    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one  ~+ i$ ^& j3 B* d- Q: Q" Y

1 M# i0 a; O1 a8 f    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A2 Y/ H4 g- w4 {' A5 T
& y. \0 @1 J6 N2 U* D
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!  B4 H; }+ d+ ~" d$ j! M
/ b- I5 {! Q$ b9 R6 Z/ h- G9 D
__________________________________________________________________________  F  J5 E( _5 c! o, U" }+ n3 c
, |! T/ q' Y: ?! f
Method 137 }0 \: X5 e+ s/ H/ C
=========
  V( i* s- ]4 u- j7 L! f' \: C) n! ^9 \! m+ ?
Not a real method of detection, but a good way to know if SoftICE is! p5 n. \$ \8 v6 O# x1 }, Y: R
installed on a computer and to locate its installation directory.
4 p- d9 a& [1 n) f4 j/ |It is used by few softs which access the following registry keys (usually #2) :0 ^9 C+ W& w1 f
+ m+ ]' ^" ^0 _, E, Y* T
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
, l7 r- X! C  }0 E\Uninstall\SoftICE
! |$ J: d6 ^( S) O, ^-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
3 t) p' v- d! M. r! v1 p-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion/ v- [  }! c3 V0 H) q
\App Paths\Loader32.Exe% ^/ b! o& {2 Z/ }* O

) V, ?8 N- N/ ^/ k8 H) F2 T1 x' g3 y1 b
Note that some nasty apps could then erase all files from SoftICE directory
! ~" I* L' }+ ]+ b- ^! ]* a/ i(I faced that once :-(. V# D1 \& U# o
$ O, q) d+ A9 Q7 N8 H# ?) f
Useful breakpoint to detect it:
; B5 z1 u% N& N: s- i. u* q4 F0 H  D& k, y$ }9 t
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'; G; Q: T4 k$ f4 p( r; a4 v- S
3 c& v' j1 `& I5 `5 S4 P( a
__________________________________________________________________________
& P. q7 C1 @6 P" c9 r" s# ~
5 `2 |  y% y# {& t, Q
+ k, g4 n  D! v1 v  q! F/ F. C: G- x/ _Method 14 ' l9 p4 |7 d. u
=========
8 U5 L/ n9 W  Y( v: o; L- t" u8 H1 |# h4 R" A
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose6 C5 {) `$ p- |
is to determines whether a debugger is running on your system (ring0 only).
( @& j  r! W5 p2 T2 n
1 X( U& Q  Z( y3 A; f   VMMCall Test_Debug_Installed  _. O" U: q' W8 b# V; e0 l
   je      not_installed. M- \: q( u. i- D
8 x: t$ Z0 C+ D4 I
This service just checks a flag.
+ ~- ]& r' @+ m8 C+ S* c9 z. l</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部