About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
; a$ r( T  j7 M  y: C" o  g) V# q<TBODY>
% r# [) x+ x; k( C& S# q$ B; i<TR>! e0 V8 i( J: h3 o( y3 D' o  f
<TD><PRE>Method 01
. {) v9 f* _/ V1 \' W! J6 }" M6 W=========1 H' Q7 C) \4 p& I; ?

* _7 q) R4 ^+ t; LThis method of detection of SoftICE (as well as the following one) is) W5 F: d4 Q  @) A) R
used by the majority of packers/encryptors found on Internet.5 |- u' ~+ N! b) S* N
It seeks the signature of BoundsChecker in SoftICE/ X/ B- }( ~6 O( D

. T. O$ ]# M+ f    mov     ebp, 04243484Bh        ; 'BCHK'$ r. t: ^2 @2 Q! @' y0 ?/ O9 D6 d, ~% y
    mov     ax, 04h
% v% `$ b; L! F7 d( h    int     3         s' S! `, |* e2 y  m% X) `# T
    cmp     al,4+ m0 p& W7 k! p  ]. D2 n
    jnz     SoftICE_Detected
' d& w1 A- g, I' U9 m% ]
2 p& R& W; v( i8 o6 t( n___________________________________________________________________________
) b; E0 N7 O" H& V
: y: s+ \% z( e! a, ~% aMethod 02
" y* D& ~# w. T, V, K! ~& `& {. q=========; V7 j3 j' I6 R' z2 j2 @2 p

$ C$ T: W/ }# A" v  X' T1 `Still a method very much used (perhaps the most frequent one).  It is used
) Y- r3 N' c, y0 ]! d! o* yto get SoftICE 'Back Door commands' which gives infos on Breakpoints,' q* o- Y2 v  ?  y! c+ a  Y
or execute SoftICE commands...' \3 c* P- z7 L3 R, _$ j% [
It is also used to crash SoftICE and to force it to execute any commands
' n5 e4 w# }& g! K2 @( A(HBOOT...) :-((  2 Z0 q1 Z1 I  j" l

2 W4 D0 ^' Z$ G) \- N, NHere is a quick description:4 E5 d. H* E) V6 @
-AX = 0910h   (Display string in SIce windows)& p, h! Z; P. D2 j
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
1 B- R4 B4 a  w( ~) h) l-AX = 0912h   (Get breakpoint infos)
0 O4 o2 f3 l* a  A7 G+ W( V7 p-AX = 0913h   (Set Sice breakpoints)" {7 Q6 C( y7 u1 I  W1 z
-AX = 0914h   (Remove SIce breakoints)+ p3 m* }$ ?! Z7 I3 ^$ \0 q" V
# j, p9 P3 O: ?- Z5 u# S6 R8 O
Each time you'll meet this trick, you'll see:
0 V: _8 T: M, m0 |% ~-SI = 4647h+ N: T% E/ c& m% e
-DI = 4A4Dh
# y) z5 M- X- _4 zWhich are the 'magic values' used by SoftIce.
" x$ U1 L5 g' D' H! }For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
& X6 `1 `7 ]9 B3 {7 h% b  l! X% u& I+ B
Here is one example from the file "Haspinst.exe" which is the dongle HASP
. z$ m; b: j* V7 u' v' g+ h7 YEnvelope utility use to protect DOS applications:5 ^/ D. C9 B) _2 [" K

$ v  H1 m7 P7 E  {, ~' \1 s1 A) j+ y4 p
4C19:0095   MOV    AX,0911  ; execute command.8 r3 {2 D8 O/ A3 V2 T
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
  {: y' O9 @) n7 G7 n( j7 U) T4C19:009A   MOV    SI,4647  ; 1st magic value.& L! ]% C$ e! [8 ^9 w4 @
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
  u3 r) {4 P: ~+ V4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
$ R3 _# s, I# i4 d5 ]4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute5 |! H( b( q5 a3 t
4C19:00A4   INC    CX3 W# D/ z9 v# ]  F& u- n
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
6 `) U$ `2 g1 _0 e4C19:00A8   JB     0095     ; 6 different commands.
0 w1 S! w$ j; R" b4C19:00AA   JMP    0002     ; Bad_Guy jmp back.+ W. o- s/ v- a4 f1 O& Q1 e
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)2 j7 K# J, K; A: v9 n
- S( o3 R2 p; D! L; _! e7 A2 a
The program will execute 6 different SIce commands located at ds:dx, which. \* Q$ a/ K' {; l: `3 t
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.! F9 c0 k$ @3 x" Y. @* g( U/ r
0 T2 [2 u6 Q6 p) b5 F0 V' w
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
2 r, Q- S$ c( ^, C___________________________________________________________________________8 e3 {* O, ?% @! g, j, Z9 z- b

8 f$ ]5 V8 ~0 R; \, Z( l
( l  ^7 S: z6 f% G! z) e3 @+ F$ _- l( eMethod 03* C3 H( w" Q/ y+ o$ G
=========& W8 j  S/ A0 i& z& `1 g

+ P* f! F) F/ `Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h! C5 p) U/ d1 Q5 d
(API Get entry point)
& S6 i% Z& f+ J" p- R$ T7 }        2 X7 T3 j9 S9 c. ?
$ l: o! j' S  Y7 y2 ^/ _6 T0 }
    xor     di,di5 H' F$ j* V5 f# m+ `$ h
    mov     es,di
7 ?2 D' E8 l* K+ Q    mov     ax, 1684h       1 a1 x8 F8 E* Z, ^& d: p4 v
    mov     bx, 0202h       ; VxD ID of winice
1 M% l. }& ~+ }7 M    int     2Fh/ p. Y/ y2 f+ f+ ?4 D7 O  I" ^
    mov     ax, es          ; ES:DI -&gt; VxD API entry point. r! ^# Y/ Z5 c, @3 a
    add     ax, di
7 M) w3 ~' Z" i+ F: [  F2 i0 Z    test    ax,ax
( A0 F' A) p( j9 d% J  `( n( A( h: Q    jnz     SoftICE_Detected
! S: a. O7 q8 _1 h3 R5 q  k4 U0 S: B, i* [$ w. B  c  }+ w
___________________________________________________________________________  o  G/ U/ S/ g( M( ~; W8 Q* _. y

3 B  E2 m4 u9 ?Method 04
0 _3 Z: A/ {0 o! ?  E=========7 b7 V1 b( W' g9 x. S2 W6 R

8 l8 i, q& F/ |1 q9 ^Method identical to the preceding one except that it seeks the ID of SoftICE9 y' p& w, F  y+ Y4 x7 h0 J
GFX VxD.9 d; S! f+ S( e8 C. i6 a
2 j& y) R, t5 |$ ]: c
    xor     di,di- x, l" q  I: p6 F) F
    mov     es,di
6 e& g- N1 @8 k. z    mov     ax, 1684h         e6 _$ V' U$ p
    mov     bx, 7a5Fh       ; VxD ID of SIWVID0 k# Q2 l. V: y. j: o# a3 X4 V" c# V
    int     2fh
: a9 R0 l5 D; `& h& I  k4 e# e/ Z+ `    mov     ax, es          ; ES:DI -&gt; VxD API entry point+ y. h" Q! X) `& H9 a
    add     ax, di1 x5 h' E' y0 w* r; F
    test    ax,ax( q' m" G4 R- c& t5 Q5 K
    jnz     SoftICE_Detected
, ^4 @( s- ^2 f
1 {! {/ J- y: ]$ ^/ ^. {( q% g__________________________________________________________________________
2 y9 x) w6 p0 X2 E% u: Q% ^5 t+ c8 X: V/ p3 Z# ]( k% U2 Z

9 T, d8 p4 ~; d$ r! f. l4 tMethod 05
4 U3 U- ?6 @9 N) t9 c8 b=========% o& K! t0 Q0 M2 {& q/ m" h' {

, V1 @9 E7 Z" ]+ ~Method seeking the 'magic number' 0F386h returned (in ax) by all system
3 V+ t* k, R+ f" Mdebugger. It calls the int 41h, function 4Fh.. U! x$ ^4 ^" b+ X/ _8 {# G7 X
There are several alternatives.  
+ H0 I1 \  h* W5 p. V  X3 h' K
8 {$ X! H0 j- h+ ]6 C) B# OThe following one is the simplest:2 s+ E1 \% I% J3 w1 v

- a6 K3 ]7 T7 U% c! ~3 P    mov     ax,4fh( W+ E- ~4 _# m, z" b. ~- W0 o( Z
    int     41h
: D6 i; m/ ]9 G7 P    cmp     ax, 0F386
7 @! U0 D* P- g    jz      SoftICE_detected& T" C* Z) ^" |8 d

4 {1 M  b! x$ e  R  f" N& `! s  }* W! }1 r  a
Next method as well as the following one are 2 examples from Stone's
; T3 }4 x7 Q1 N6 |+ o* }9 v$ L"stn-wid.zip" (www.cracking.net):
& `5 G3 W' J) q, ?' Y+ I" t+ V; |+ n( B  t
    mov     bx, cs) E$ }1 K, X# G' f* \0 S$ x3 {+ [
    lea     dx, int41handler2+ l$ h1 _8 s" i
    xchg    dx, es:[41h*4]
( b* {3 F7 a$ F) {& t/ d" p    xchg    bx, es:[41h*4+2]
; d) W5 E' C4 J/ h: {    mov     ax,4fh
' r4 y- w5 ]- M$ t, A8 |    int     41h7 @1 O$ {3 z- d& U( K. C# x3 O
    xchg    dx, es:[41h*4], Z* a) O8 r) h! O
    xchg    bx, es:[41h*4+2]
/ `" R* G' S9 Z0 c- q    cmp     ax, 0f386h: e4 P2 L8 H  h
    jz      SoftICE_detected
+ j* J" e3 f; [  `0 G/ C2 P7 x( ?& H9 c& A$ t1 ^: c4 W0 ]
int41handler2 PROC* ]* P# n* I4 U
    iret3 D$ Z9 _3 v1 M, A) v
int41handler2 ENDP
* E4 i+ s& f$ S3 C0 z$ k9 o0 K  V8 R( G  B
$ R* w2 [! @# t1 o5 }, U
_________________________________________________________________________
3 w, u# o2 q4 J5 u6 I/ F: v- w$ t, f* o2 G6 }$ O/ T7 F( N
; l- K, \4 L1 b
Method 06* f! M$ e4 k- |) S
=========  x; s# {; \# R) h* P- f

* a% U# P6 Q( S. w* P# g: \0 N* S8 Y- x; P! G) v* f
2nd method similar to the preceding one but more difficult to detect:$ K  V; I. p' F. {6 Y& w. Z( z
8 c& m  B7 Q% B$ B

# ~1 `( f' j# [2 z  |int41handler PROC
# S; s- U: L7 j4 U) p7 |    mov     cl,al
1 n3 r# I0 U2 L    iret0 o+ m: ]8 J8 d) [. Q
int41handler ENDP
, K! O# [2 ]/ _* Z5 K. a$ u! M+ Z
( R9 D  }1 ?. _* z% O; X/ s% }. h! G+ g, a
    xor     ax,ax
- s5 b8 Q. S) a' s8 b2 X! \% O    mov     es,ax( X% A  v% h8 f8 n4 p! D
    mov     bx, cs$ E& i$ [/ r" W$ _7 r3 O2 P" T3 X" a
    lea     dx, int41handler3 ]# {+ ]& X+ L4 r
    xchg    dx, es:[41h*4]" g8 V9 B$ D) p7 q6 D5 _
    xchg    bx, es:[41h*4+2]
8 r; W( l) v  l( s* u, h6 w+ R    in      al, 40h
# U# V/ k* h4 m6 _" Q    xor     cx,cx
8 X; G7 l& X; u+ r    int     41h% [/ v. j2 A! a
    xchg    dx, es:[41h*4]$ L+ r. U8 Z, L! `! d0 N/ t
    xchg    bx, es:[41h*4+2]$ R. r3 m  g3 O* }
    cmp     cl,al
  h% X; M6 w1 X( e    jnz     SoftICE_detected
1 k% M$ C' ~3 P' J
! o$ v  {6 l' w5 K" D( c# T3 R_________________________________________________________________________( i, H% c, @! Z
' T2 i( {3 \6 _8 S9 H/ [
Method 07* S4 O  A, E: \' i4 A, Q% J
=========
0 e" z! Q6 Q3 O  s- R" d
" x& p$ ?5 c7 c$ cMethod of detection of the WinICE handler in the int68h (V86)8 o7 p/ {) b1 W+ r# s. f. [+ \

, R5 _! a, d6 r1 a$ z" q    mov     ah,43h
% g$ T; P, H+ o% L/ O    int     68h
8 d# g" e0 x0 W5 Q3 [    cmp     ax,0F386h
/ u( k. @1 J$ |& n4 Y, K$ M- ^" x    jz      SoftICE_Detected
9 ]% l; Y* o3 C' W+ V
' B4 g. s4 m) p
+ }3 Y5 w& k1 j* m2 r8 E=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
: K, B  M  E( X. r( X/ E9 _5 p9 b   app like this:8 Q6 k. L' d* x
4 O1 U% Z' Q' \( w2 C8 G
   BPX exec_int if ax==68/ ^' L- |6 o1 c( U- z; @
   (function called is located at byte ptr [ebp+1Dh] and client eip is
& u1 b4 V% S8 A* [6 n% S   located at [ebp+48h] for 32Bit apps)
" F( g5 L* F1 [+ N3 K__________________________________________________________________________
# `& q. z* P" e( a! k. F! P
! T  U9 D( b# {+ u/ w& X! q; {6 V; F+ B2 ^& t1 ]6 z
Method 08
+ A/ y1 p5 s% k; j=========; o9 n- r- h  O0 L* |, N

* X$ U4 y1 S! X& O7 B: aIt is not a method of detection of SoftICE but a possibility to crash the
3 T* m! ~2 t, h' Esystem by intercepting int 01h and int 03h and redirecting them to another2 e) L- G! H2 y) D
routine.: _- V" J8 {( u, H- w
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points+ x9 M# B$ f- p1 u1 j
to the new routine to execute (hangs computer...)7 W3 g' i( A1 _& ^4 s1 u/ C( Y/ d
+ Q; R$ u% K. B& t% y6 z
    mov     ah, 25h" X! k* h- K. O
    mov     al, Int_Number (01h or 03h)
( U# b/ z, P& m+ G    mov     dx, offset New_Int_Routine4 c- n0 |: j# F6 A+ g+ [4 l
    int     21h. _* ]  h6 i/ T# c' M# u9 m! v0 b

4 x7 ?+ G6 H% d/ h__________________________________________________________________________" R; b% Z6 r3 C) d  e- E; u
) G% U3 }0 V. a* \4 o6 J, c  L& }3 j
Method 09
0 y+ c7 y' K5 M+ r8 n=========
* d5 ^5 o9 p4 @# v9 G. x( U+ r" @! k* e1 r  ^4 A
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only, B- Z  J5 `4 O
performed in ring0 (VxD or a ring3 app using the VxdCall).
4 S2 l4 h0 f3 Y2 r; p$ e* r+ _The Get_DDB service is used to determine whether or not a VxD is installed
1 m0 {( }) w* {% X) W0 efor the specified device and returns a Device Description Block (in ecx) for
  t' s/ N0 C  X0 ~that device if it is installed.
* Q# _3 g6 g9 e9 x9 ^
9 D7 B2 I1 O3 U* ?   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
9 t/ v' Z4 ?' I, k+ W; H   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
- Q  @* @/ D# G5 i2 L* y   VMMCall Get_DDB+ b3 l/ U: r! e! `0 c2 W( U0 @
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
$ ~( S8 R  l, p# R, r8 [# E& A
# \/ ?+ C& s. ^Note as well that you can easily detect this method with SoftICE:
0 n0 a/ C9 ?9 m* Y) a$ K. f   bpx Get_DDB if ax==0202 || ax==7a5fh. z2 n: W# n$ X, Q1 m& R. c+ [; [0 d

  O! \6 U& b. y__________________________________________________________________________
; y$ \% p6 J1 {, [) B& p' u
0 j% L0 R3 ?8 y* G8 n; v2 R& S0 PMethod 10" M( y% a% g. V
=========
( A. v0 a& z+ U# i. g' _4 }5 l2 u" b' ^3 `. t0 u' ~5 J. t1 j
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
% l! L, S. I8 t# R2 a  SoftICE while the option is enable!!
  b, I; S; {4 J8 A+ t- I; ?
& C& F3 J' l% W; LThis trick is very efficient:% H" q0 _  J6 W' [( E, @0 ~$ p
by checking the Debug Registers, you can detect if SoftICE is loaded
; l0 E0 \( n' i2 @(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if1 B2 d8 h' p" j6 \
there are some memory breakpoints set (dr0 to dr3) simply by reading their
$ m' j; i- C. M! K* H6 Q# Lvalue (in ring0 only). Values can be manipulated and or changed as well8 f7 B' S) `. r9 y4 G" L( J, i( ^
(clearing BPMs for instance)
% h$ H. m5 K; U) R. D0 I  ?! N
+ }1 @" {$ T; }. X, ^5 J* t__________________________________________________________________________
5 C9 x. S+ d* ~9 `( A5 w2 y$ [5 i2 e0 G# h0 s
Method 11
! Z/ [' F3 C& |5 \5 ?, W=========1 X( j$ Y' d) I; f2 Q5 r
, |  n1 t# V( k  D) w
This method is most known as 'MeltICE' because it has been freely distributed
7 O% v4 n' n( ?# M0 Hvia www.winfiles.com. However it was first used by NuMega people to allow
- }1 b5 M: ~" H5 a7 Q, X& zSymbol Loader to check if SoftICE was active or not (the code is located) b2 o2 ^/ d. ^" _6 O# M# r
inside nmtrans.dll).  K, e, {: b( X( q( i3 H

3 d- z; d* L7 A0 `& I1 Q# QThe way it works is very simple:6 y* }8 b6 w8 K  {% G
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for* X1 b! ]; S" n7 h* d+ y0 Q; B
WinNT) with the CreateFileA API.
! s+ h1 O9 r+ D" D) w& _& g! j2 E5 b2 m! J' j" \5 j& A
Here is a sample (checking for 'SICE'):. T" C0 m+ s8 J  e; G2 c

# P7 q9 W! u) N! IBOOL IsSoftIce95Loaded()
3 S- b5 U& A: D& b{0 [# }3 ], n" Q9 x) }/ ~
   HANDLE hFile;  " l; a! ]/ \% A
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
: N5 N3 s2 L; y! e( }5 U2 J7 R                      FILE_SHARE_READ | FILE_SHARE_WRITE,
- q+ O, d' _4 p9 ?                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
) K- W/ R; a# y3 w   if( hFile != INVALID_HANDLE_VALUE )7 A* v. ?5 z" j4 [, i
   {
8 M6 b5 Q, i  n* [  c, ]4 ~      CloseHandle(hFile);
; ^$ X: c6 ?  p9 A4 m1 K. @4 U      return TRUE;/ f: j& A: K' U: d+ S: y
   }5 K' h  M, S& s# W
   return FALSE;
, n! u6 w# t4 ]& B0 H& y}9 T  T1 d3 _/ u2 d- ~

; R* B% f5 Q& sAlthough this trick calls the CreateFileA function, don't even expect to be' ^  A- }( L0 _4 t% o4 a
able to intercept it by installing a IFS hook: it will not work, no way!
# `. i. F# d# [! S4 N6 z; s  ]; IIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
. f$ ]; b6 |7 q; {  Uservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)6 V/ w& G8 y$ e) P
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
) i* a0 n& k6 U+ O; tfield.
8 ^( e" `" p; J/ _# p, KIn fact, its purpose is not to load/unload VxDs but only to send a
# T+ B& g" |$ T% k: j1 q9 IW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)1 q% p4 b5 e+ T$ A1 d$ }$ N- X
to the VxD Control_Dispatch proc (how the hell a shareware soft could try- `; s- M* b# D. |
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
$ ]0 I4 N: @1 i' \) L; _" fIf the VxD is loaded, it will always clear eax and the Carry flag to allow: ], Q$ ]( y% k# B. a8 l  Q+ P
its handle to be opened and then, will be detected.
! N% ~% p( V2 x1 l& i& p4 N% v- EYou can check that simply by hooking Winice.exe control proc entry point* g8 G3 e# V: t5 g# T8 g9 ]  Z4 w; {
while running MeltICE.' f: j2 W0 @+ S3 o' o+ J

2 G& s+ c7 z! V  [0 X
5 ?" i; w( _+ a7 c" A  r  00401067:  push      00402025    ; \\.\SICE
1 ?9 b3 J! L) v& W2 X0 L) q0 O  0040106C:  call      CreateFileA# L) A: |6 c* I$ Y7 a
  00401071:  cmp       eax,-0012 p& Z) j" r# f. r
  00401074:  je        004010913 j; x3 z$ D* u2 N0 i. L
. U8 {3 D& Q+ ]8 }2 p* K/ C

1 }: [+ B3 l+ M9 r2 n% s; P6 D: hThere could be hundreds of BPX you could use to detect this trick.2 z8 _4 R! S' X+ [) m
-The most classical one is:, y5 T% s* e2 G* e4 M- f
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||. {  h0 l+ l1 w0 @5 t. h
    *(esp-&gt;4+4)=='NTIC'
3 E1 Q, M  y/ t; ]3 z; W5 C: F6 ?( H+ k) g) q
-The most exotic ones (could be very slooooow :-(
# l3 l  d' s3 ]7 b4 G   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
. v/ U3 O( e6 ?3 N+ m     ;will break 3 times :-(
! \1 N( V1 M5 I. h6 M0 C: _
0 b! ^# P% c2 i! u% q, D  J3 i-or (a bit) faster: # s8 @1 _- @3 U
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
7 D* }! l+ ?/ a) x2 [* B( F7 A( Q- i" `6 _5 c
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
9 }9 s  g( i& p5 Q$ Q& {     ;will break 3 times :-(: \  F# L2 x: c, D

9 W/ e  ~) E# V7 f& P2 U( N-Much faster:7 i9 x6 |5 E: w, T
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'! ?! ^9 E: w; t- N- F
4 E$ Q# N/ j* j) Y$ B
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
1 e7 i; U4 L% g5 Lfunction to do the same job:8 v1 z5 `) c* a

  j6 k4 D) W9 ?2 p% Y, p   push    00                        ; OF_READ
4 k6 N5 a; [: F   mov     eax,[00656634]            ; '\\.\SICE',0
7 O, ?3 _8 u1 i   push    eax5 O* C( S5 m" X
   call    KERNEL32!_lopen6 ~7 T: K) ^# u8 j5 z3 I
   inc     eax( \8 g; l! ?7 l
   jnz     00650589                  ; detected
) D& k; W( H$ S3 y' _2 H   push    00                        ; OF_READ
6 U  w/ r4 ^; N6 ~+ X/ ?* ^6 J   mov     eax,[00656638]            ; '\\.\SICE'
5 N% X. G) c4 t0 p, ?  S   push    eax' W  K2 [4 s/ c+ `6 A3 |
   call    KERNEL32!_lopen9 u4 d. c3 @' }' B, z" L0 C
   inc     eax5 W0 J5 N5 b( D' z2 G
   jz      006505ae                  ; not detected
5 ^+ R8 r& H5 Y4 O" N/ t& f$ @$ S0 a1 o# c

) c0 b$ y5 w' V$ m; A. N7 U__________________________________________________________________________" l$ r  x  _; u! [
& q$ }" |6 j. ~3 B5 f' o
Method 12
* k( L9 K+ l- z9 l=========
& t$ q/ ]& V8 h4 s* B3 p) B9 R1 t0 x7 X
1 y( X1 M! L* ~This trick is similar to int41h/4fh Debugger installation check (code 05
& D& g- w8 B+ h# e( u5 {# j&amp; 06) but very limited because it's only available for Win95/98 (not NT)
& ?4 Q6 }: c# B4 h, q+ Mas it uses the VxDCall backdoor. This detection was found in Bleem Demo.; Z+ s0 u% t+ d# M$ }( y8 @

) J, _# T. T( Y1 z) ]; N   push  0000004fh         ; function 4fh' r2 K9 i: B) Q+ e% |
   push  002a002ah         ; high word specifies which VxD (VWIN32)
; Q+ D2 {' C2 N* e8 S7 t. _                           ; low word specifies which service
. s2 p( N  w& W                             (VWIN32_Int41Dispatch)
" C$ F( n4 m* ]) U6 d3 X   call  Kernel32!ORD_001  ; VxdCall
. F* c  z6 g  D* Z+ \, ~, l   cmp   ax, 0f386h        ; magic number returned by system debuggers/ A* R; x, R6 z
   jz    SoftICE_detected
& }$ \, ^5 z; z4 T. x2 O9 A9 i7 ]
% d3 P$ N) x/ |/ HHere again, several ways to detect it:' u+ x) N9 S! q5 t

6 ~! J! s* E4 M. q: ~9 [    BPINT 41 if ax==4f
4 g9 i8 E& i9 n: C; r% E
# `4 ~2 j0 X( y" @2 y    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
: r# C! `4 ^8 p" g6 q' x- q8 i& p1 E+ `* ]& Y
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
: B/ e: t% w. Q# p3 g: j$ y. x! B6 j; I, W8 E" ~# X" i
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
$ ^8 O6 V: {% g* @! g0 {3 d1 f
4 ]" o  a; C. N__________________________________________________________________________
6 E7 g. X: X; J9 c' @$ ]) ]+ X8 z! |' @' [  f
Method 131 `+ o. N4 g% _; p
=========/ F3 p2 q9 a, b/ N0 E* X$ [
/ S& [' b: R" H# z% D/ y" o# D
Not a real method of detection, but a good way to know if SoftICE is7 n: m" D8 r3 v# O
installed on a computer and to locate its installation directory.
+ E  Q" V: K- V, RIt is used by few softs which access the following registry keys (usually #2) :
' ~8 W, l' w* ]% i1 Y4 o0 ?3 B! N1 {
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
# {2 v1 H7 _3 ^, Z) t! x4 k\Uninstall\SoftICE  J' {) L; I. \, ?8 k
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE# {, m. Z! h! F% h( O$ O! Q" K8 A7 i
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion" V# P: i9 f( K) _0 e
\App Paths\Loader32.Exe, G6 y' L  g1 x* y6 |- W" p
7 i/ a. P, {+ x$ _4 C* h
1 j  Y1 x! Y5 p) A6 q+ X
Note that some nasty apps could then erase all files from SoftICE directory+ ]$ \. [0 J3 C$ ?" Z3 _
(I faced that once :-(: ~4 ^% R  Q2 ^4 j" t& J

( `9 ~/ i% M/ IUseful breakpoint to detect it:
3 K5 B* r& p" a+ f( D! ~" D/ ]( b+ f5 l! v8 G4 m
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'/ c; L4 O1 }9 n* N5 N- F  V: b  W
' s8 U+ \. Y7 ^' J
__________________________________________________________________________
+ w; W- L2 S" X1 N" h" f: M
, W, O! w" {) q! K0 t3 `. Z. o2 j% T, z7 }$ m, q% v& x
Method 14
6 e+ v8 }& ?2 e  c=========
0 C. s0 a! y  Q1 o2 o
! e% u7 X- r/ _( i* AA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose" F2 ?  j. v6 C) W# L/ v( A8 r3 _
is to determines whether a debugger is running on your system (ring0 only).; x5 O  t5 i* P+ G7 O, Y/ D( {  v( y
6 F7 v- l( z6 x: {% i
   VMMCall Test_Debug_Installed% R$ }% h7 o7 b" Z! d
   je      not_installed+ r. A9 Z/ ~% i% @3 O
5 y5 v. a$ [( o7 \
This service just checks a flag.
, k' T5 I& e% Q  o- d0 @1 A9 T</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部