找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>7 b! {  F/ N" b, X, {
<TBODY>
! K6 H+ T3 x( g. J7 ~! j. N<TR>" G2 O: P0 T2 C4 Q7 F
<TD><PRE>Method 01 - S% b9 w5 q0 j9 |# H4 s, {
=========
" B  N; ?. v5 ^) d. _/ B" R6 d( S# v; _5 f1 C! \- p
This method of detection of SoftICE (as well as the following one) is4 L; W! {  ]4 Q, Z. Q2 x- j
used by the majority of packers/encryptors found on Internet.1 f  M3 y' x  @, D) r( e# B
It seeks the signature of BoundsChecker in SoftICE) \& H! n$ i& N' @) B& a! Q
& u; y0 e. |2 D2 K$ c. c# d1 v
    mov     ebp, 04243484Bh        ; 'BCHK'
4 s! g6 f% g/ W5 p1 C* |    mov     ax, 04h% h. q9 Q" B) O5 _  N6 F8 [! Q
    int     3       1 \( G' _3 M6 j7 ^/ `
    cmp     al,4% t: I" \* l& F7 N& }5 t
    jnz     SoftICE_Detected5 |. N) r8 c0 v

+ a0 d/ f7 f8 |' ]3 P, b___________________________________________________________________________
4 J6 Y7 v$ R  o. X, C: Y7 M7 q$ _( A/ z
Method 02
+ ^" D! K' G. r! ^4 p8 u1 i/ T=========& n9 Y' O4 R' m7 L; G# W: M
( V+ Q; x& T9 L2 P- M
Still a method very much used (perhaps the most frequent one).  It is used3 S$ @% a  q  O: K' |
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
4 b$ {: f: E( Tor execute SoftICE commands...
2 |; g  b' A( r  GIt is also used to crash SoftICE and to force it to execute any commands% w, _! K  A( Q. E
(HBOOT...) :-((  
  {! ~7 l$ E3 u
$ R+ \  c4 U1 e# J2 t% S" ~. T, nHere is a quick description:4 n- ^; k! i( M) w7 D0 h
-AX = 0910h   (Display string in SIce windows)
; ~9 \* k9 `# Z% y-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)  @5 V, h% T( n
-AX = 0912h   (Get breakpoint infos)/ N) Q! w9 s  J: J
-AX = 0913h   (Set Sice breakpoints)
  _0 E% V0 ^1 O9 W-AX = 0914h   (Remove SIce breakoints)3 }0 d+ C9 n2 g0 ]" {6 d

' Z. E5 F. X& v( E5 D3 PEach time you'll meet this trick, you'll see:- ]) q$ ]* @( c' ^, m9 w  M* Y
-SI = 4647h% s& N) ~6 @: j& Y% G$ i- D
-DI = 4A4Dh
; {" l1 J- k7 Q1 hWhich are the 'magic values' used by SoftIce.6 ^  h4 C' m% }& Z  t& c0 A
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.$ H2 n9 ~* p( ^; H" t' N- N
% ~" [' I3 p6 K& |
Here is one example from the file "Haspinst.exe" which is the dongle HASP
; |9 i  }6 ]1 H- |1 i% }* t; A6 Y0 DEnvelope utility use to protect DOS applications:! f/ y8 M  A) Q' q* `  n6 C0 i/ x

; a, @0 P; |& X+ q; C
& i: J8 c% Q0 b) {) h& l4C19:0095   MOV    AX,0911  ; execute command., r4 ~  w/ U: a. b
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
; h3 I; o" y8 I' w5 t6 X; @* |4C19:009A   MOV    SI,4647  ; 1st magic value.5 N# d# q7 I2 u7 Y2 ?+ t( M. A
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
& r' _& r8 ^$ [4 ?9 Y3 @4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)+ g& h3 a8 q# A6 m
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute# b% T8 a' p) e1 I8 a2 a# K2 o8 F+ e9 @6 ]
4C19:00A4   INC    CX
$ A, Z" C- v/ o  M4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute. L& o7 j$ b2 Q+ M( t5 E+ t
4C19:00A8   JB     0095     ; 6 different commands.
( t3 O2 [8 Y  _4 S& \4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
# ^) V1 w+ `* V- u; j4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
  |8 h3 F- M+ M1 U% |/ ]
! d" W) {7 H! S" D# HThe program will execute 6 different SIce commands located at ds:dx, which
& T5 B. z' p. [2 p; I% Sare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
" q5 A" h1 h, D8 C' O" [
+ i$ t# P( ]2 Z  k* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.( e4 x# C+ G3 j  ]
___________________________________________________________________________
6 J; e" H7 q" o9 }' Y2 A0 ^8 ^  g4 M6 M( d

: H3 T2 ?9 g  ~$ a/ W( m- M( N6 M/ \Method 03
( T# G- Z& i6 K=========
* d% [( ~* O- a- F7 ~, P, `- o/ F$ G0 q2 V( X
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
8 p3 m8 ]2 C: a! x& H(API Get entry point)0 ]& w" a7 K, L2 W9 Z; z4 z0 Y2 g
        " L& @+ R2 l+ C3 x& j: t
, u# ]% }: H  j
    xor     di,di
, ~. i9 `  X: w( t1 Y  S, Z    mov     es,di  b7 v0 o. r$ Y- X
    mov     ax, 1684h       % a5 [) Y# K' b2 s
    mov     bx, 0202h       ; VxD ID of winice
0 ], O% ]* R4 s" E+ l    int     2Fh5 K: S# @& t# }6 n8 V  y+ |$ Z
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
& `+ h$ f  s2 }. F0 Y: c    add     ax, di
$ {0 Z# F. K+ `& l    test    ax,ax! f5 |$ d# I; J9 f  W# ?3 n- m
    jnz     SoftICE_Detected7 i1 I7 K& L6 k$ Z% e/ u9 G+ J. ~

) E9 Z$ ^( Q' n6 V" k  e- p___________________________________________________________________________
. S: @- j, O# t/ b' V3 |7 O& W1 }; V( G
Method 04* W4 `; h5 G/ A. `" [
=========$ Y/ h6 {8 V* k7 q, y8 E5 {0 V/ Q

* C$ g! |- }: N5 m' _4 Q. @Method identical to the preceding one except that it seeks the ID of SoftICE7 V( W' t$ p. y1 w! {
GFX VxD.  i& ]' V0 x- t3 `: E

& M: o1 \, m; ~! D8 L% q* }" C    xor     di,di
' _0 S! }% x; o) g, {( Q    mov     es,di1 N6 Y# p( C& Z( K5 h! s+ J
    mov     ax, 1684h       0 |8 w% c; G& l( v; y1 p0 @# I, n0 ?
    mov     bx, 7a5Fh       ; VxD ID of SIWVID
5 P- i" O9 M% F' v2 R  L% [    int     2fh
0 H1 K/ Y% g' ^: _: R" }    mov     ax, es          ; ES:DI -&gt; VxD API entry point
* ]' \$ i6 h  V/ Z$ `& L    add     ax, di
* @' `* |; N1 Z$ [) [    test    ax,ax
; A% j+ k/ @' ~    jnz     SoftICE_Detected( T9 J2 k! Z8 B5 s: W$ \* m4 m
. U" p  W9 F% u: D. x
__________________________________________________________________________
5 J/ ^& O+ l: H! M# B: B6 q- U  V( i  a4 G) C* S3 r" @4 ^$ V
, S9 w7 s+ e' H6 }. D0 \
Method 052 f5 }# c9 ^* _* z7 W3 b
=========+ p  |. A7 a& M2 _
; |( r8 E% u' t  z& ~0 U/ }
Method seeking the 'magic number' 0F386h returned (in ax) by all system
+ k2 N' h& [# c, }8 l  _1 [) k" kdebugger. It calls the int 41h, function 4Fh." E5 [' Q$ K8 D4 |$ M1 G* i
There are several alternatives.  . {% P3 @0 b  |+ W6 }) X
+ b4 Q# c; N% F. i8 B
The following one is the simplest:
. |' b; t, D6 i" q
3 V! p. d' K# W9 y* K    mov     ax,4fh7 Q- a5 L% @7 g7 }- H
    int     41h6 W' |* H* A+ N: K
    cmp     ax, 0F386
1 Z9 h. M8 P3 Z: A3 J    jz      SoftICE_detected
' w- ]! d% z- ?& Z: k6 {2 u1 U* `3 r% X
& {7 m; N5 h0 r4 n( [/ t3 M6 o2 @& ]' h! ?
Next method as well as the following one are 2 examples from Stone's 0 m9 {6 \2 c! I5 W
"stn-wid.zip" (www.cracking.net):
' L- ~; Z9 |/ D$ a* s. s
1 t/ ?# u: _5 R1 p( U    mov     bx, cs
- W7 x3 v& w& u1 m3 e2 Q    lea     dx, int41handler2, z* L' m1 O# U6 F. C. B
    xchg    dx, es:[41h*4]
* ~9 A% X" {4 q% j( v7 c    xchg    bx, es:[41h*4+2]
" X. h1 P( b5 v% s7 l3 r" }    mov     ax,4fh# B, W( X+ Y& R) {' [0 W
    int     41h# q, g) X  i2 `9 i1 J: p
    xchg    dx, es:[41h*4]
, b/ S2 f% t) O. f7 [0 B    xchg    bx, es:[41h*4+2]  f! F8 X- f3 a4 _9 ]
    cmp     ax, 0f386h% f! K# F9 @; s. S+ \
    jz      SoftICE_detected0 Q# K( w* z7 ?& U% ^7 w9 l

# B- S1 W, S+ p/ zint41handler2 PROC, t7 H5 |) L$ ~  \
    iret
5 {0 }4 R! `9 e. Y% ?  ?( jint41handler2 ENDP! I- l8 |; e* S! @- O) w$ \; M

* k( Q& E8 i0 J. O4 Z7 q; l. N& U; O5 V
_________________________________________________________________________& G! Q. F# W, ~# d

0 F1 l8 M( F# ^' M4 b" R" k, y5 Z: G+ ]* ?' H, w  l
Method 06
0 ?" Y! @1 l# o/ J  W. L$ Y. m% B3 e=========
2 }. X( K' {/ t: X4 C' e/ O: W/ K, r0 \
5 ]1 k3 u; Y! g* @: G3 X% S
2nd method similar to the preceding one but more difficult to detect:0 z% v. N# }) `' J2 J+ I: T
" G9 w2 w( ^) ^
5 c' ?7 f9 G0 O/ h+ d  O  S
int41handler PROC* G: T3 x+ S7 |0 i
    mov     cl,al+ ~; q5 ]1 e  ^+ i! S5 b
    iret
" h: W* |0 G! Uint41handler ENDP4 Y* Y3 Z7 x, N) @

( w$ Y* J: i; _- E/ M9 B
  I. j7 N/ {( M. e. Q5 A0 X# W    xor     ax,ax9 ?: y! ^1 y& u/ q" r$ N
    mov     es,ax
8 N& J6 y; E9 H3 O    mov     bx, cs% y3 j8 s3 @( M4 X( U
    lea     dx, int41handler
- z7 l9 _5 t5 R    xchg    dx, es:[41h*4]
) w" X/ Q  j7 h9 k6 J& G& V    xchg    bx, es:[41h*4+2]
. w% Y3 E0 F! G" W$ Q: }8 V$ Z& L    in      al, 40h, J" x- w: A  x$ Q: r2 \
    xor     cx,cx
! v. O, w/ K) P1 y# T, u  p    int     41h
; z( j' T. g" }# r: ^) J0 C    xchg    dx, es:[41h*4]" B! M' u' v1 y% |: d% f: }& r# N+ b
    xchg    bx, es:[41h*4+2]1 t1 A4 [9 d: C' g8 I  Q% P
    cmp     cl,al8 b5 k+ k+ H4 F& l/ L
    jnz     SoftICE_detected/ `1 ~# C2 x# W% ]0 k* Z: _' P
( r  ?; Q( h( C
_________________________________________________________________________
3 {2 a, z/ {+ |+ o* M4 v# S& L' j7 z" k& @0 v# f/ G" w- _
Method 074 e- k, r& ^: {$ c/ V
=========; t- l& X; m5 p+ R

- {9 d2 A2 F- [Method of detection of the WinICE handler in the int68h (V86)% m- z5 Q# [' H. D

( q( U" G$ i, k) \; Y- b, T    mov     ah,43h" [+ `7 F* y  Z9 E3 s& R3 f
    int     68h
: k3 i% K& j9 m! ?1 \( j. H4 s    cmp     ax,0F386h) Q8 K, l" D9 f7 E- D! K9 z
    jz      SoftICE_Detected
! T/ L& e" a/ m" a; `. F! \6 `! F. L) c2 ^
% A5 _' d- S; a. r
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit, B5 M, \6 L8 Q
   app like this:
& L) {' K5 z6 x! L& W* h2 g0 E% u9 w+ [
   BPX exec_int if ax==68
! a9 G" }" b" m6 I( K# f9 p1 q   (function called is located at byte ptr [ebp+1Dh] and client eip is
/ ?# v  N+ u+ n, b/ N   located at [ebp+48h] for 32Bit apps)+ V/ @( s' B& m3 M- ~. d0 W( _
__________________________________________________________________________" k+ W5 `$ ~  ], e) K4 \

7 R) }# d0 _1 v
0 r! {2 T/ {* H6 hMethod 08
6 i" j0 L) d" e=========
1 _& {: u0 v+ b0 P4 u2 O2 h5 b  O# K  i
It is not a method of detection of SoftICE but a possibility to crash the
8 X# c% }3 r& ]system by intercepting int 01h and int 03h and redirecting them to another4 R* J4 m0 \* ?
routine.
$ c5 ]% v0 p' s5 `5 @2 `  kIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
' e0 o0 r+ m1 Z1 A6 L" i3 e7 yto the new routine to execute (hangs computer...)! Z% }9 U) g2 Z' M+ B# i# J

! n; S# ^, i2 F    mov     ah, 25h) m, @$ A" F) \1 C. b+ Q
    mov     al, Int_Number (01h or 03h)  F  `; S/ {# X2 d: l% ]0 U5 O7 D
    mov     dx, offset New_Int_Routine
2 f) k% B# Y) h0 y0 a    int     21h
; Z! T  f, U' h9 J9 |2 M+ T5 N
: p& F+ {, {" e2 c' H__________________________________________________________________________
( {2 N9 }" p9 I! i5 m
" C# Y4 ^# ]9 X' IMethod 09
1 O& `& o0 W* T=========' v# m3 D5 c# w6 B# B. a) V

) E  n1 ^( A3 V( X) w9 B1 ^  EThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
* n6 G/ F8 C4 |$ j0 p, z6 Wperformed in ring0 (VxD or a ring3 app using the VxdCall).
6 e; o& i4 X3 fThe Get_DDB service is used to determine whether or not a VxD is installed
3 H& K+ y. z  [( E8 ?4 w5 e; m- Bfor the specified device and returns a Device Description Block (in ecx) for
: m3 o* n0 G' T7 mthat device if it is installed.& D$ G2 ]% x' L3 c& P
& \+ b4 L/ F, g/ I2 w1 @% r
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID8 u# T# j* M' C+ o1 K
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)8 q7 Z& m. W0 i: {4 b
   VMMCall Get_DDB3 Y* }- ]) g' c  z
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
" E4 [& B! q( Q: F& \2 L. _+ Q2 w8 P: i" ?& j& _5 v1 d
Note as well that you can easily detect this method with SoftICE:, Q5 \, E) q# m3 R9 T) q
   bpx Get_DDB if ax==0202 || ax==7a5fh
9 |: y8 p$ a( ?' [
' r( w7 \* o( x6 i& B__________________________________________________________________________
1 c  D8 _; `$ R% z+ C( K
, T- Q5 C/ U9 y: {Method 10
: b& {( o$ w' s. F; W1 H; V" r=========0 W+ ^4 }: T/ i7 [+ |$ j

6 `& S0 |1 h: @1 X$ }! k8 N=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with- A7 `  ^. n* [0 `; p+ M- ]
  SoftICE while the option is enable!!/ \1 y* R, s- O
' v2 Z5 \- l0 S
This trick is very efficient:
2 }# W+ {7 A' w- xby checking the Debug Registers, you can detect if SoftICE is loaded
/ G6 K. M) `6 i. y# \" z9 F(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if: a" n. Z3 J1 p% l: i
there are some memory breakpoints set (dr0 to dr3) simply by reading their, I3 a; H. b( a5 U8 S( o3 {
value (in ring0 only). Values can be manipulated and or changed as well
  t8 g, a. A: J+ K; H& D(clearing BPMs for instance)
7 [0 J! x2 L5 @5 }8 i. R9 g) _  Y/ ?* y6 N/ F) t7 t; X
__________________________________________________________________________
' V# n% h0 k+ B7 c; a& X! ~: t0 [7 m8 c6 _
Method 11
% B" w* Z: M" P7 c" _' }=========6 f9 g/ v8 ^. j1 L9 [

9 @+ N  ?+ D: }1 L1 kThis method is most known as 'MeltICE' because it has been freely distributed; B$ s( D. {2 ^; s" D7 P
via www.winfiles.com. However it was first used by NuMega people to allow
; k" |2 A$ W; kSymbol Loader to check if SoftICE was active or not (the code is located
7 ~+ ^$ x8 d3 {+ Y' O# Rinside nmtrans.dll).
/ ?8 c, [$ [: V# X5 ~+ m2 h
' P3 Z8 s7 B7 Z0 T" I2 T& LThe way it works is very simple:% l/ A% L3 S; D; t& c
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for/ X. q, i: R/ _; v  ?* U/ b) F
WinNT) with the CreateFileA API.% e  ~; }- m1 A

( X; Q! F/ b! B9 v! eHere is a sample (checking for 'SICE'):
: ]% K! ~2 l2 c' {; q. G
8 @! g$ }* ~2 R3 ~1 pBOOL IsSoftIce95Loaded()% t1 v9 N4 X* s) q  T
{+ ?9 u! \( n3 T' k: t
   HANDLE hFile;  
3 o: j8 |! {5 l. A' _' N   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
( q8 o7 G* V4 s                      FILE_SHARE_READ | FILE_SHARE_WRITE,% A& p/ _" \: F5 e$ F8 T
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
% [3 b/ g0 O" W+ [   if( hFile != INVALID_HANDLE_VALUE )0 M& ~) w+ q4 s1 ^
   {  D" ]2 G1 K7 `: v' q: x. p
      CloseHandle(hFile);
, L6 M  E. k: O' I( J7 ~      return TRUE;7 A1 C7 T* s2 L3 k, X
   }
+ `: g  [% G' g# b( j* }   return FALSE;. z0 @  D; f) Z$ S4 _" s
}
9 G) c" ?  d" C9 v: V
* S6 j# n) I( w4 r- P: u/ Q) b' zAlthough this trick calls the CreateFileA function, don't even expect to be
: L6 W" N1 R/ aable to intercept it by installing a IFS hook: it will not work, no way!
' @  u- d+ \5 e  X7 ?" z& D1 ?$ UIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
1 F2 T6 O, A  I# a1 Xservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)7 B8 r9 }! T# K/ D8 d, F
and then browse the DDB list until it find the VxD and its DDB_Control_Proc5 U6 l5 f- i' _( l
field.
9 r: r0 v6 f& L# W3 A* \; iIn fact, its purpose is not to load/unload VxDs but only to send a 3 t! v* x/ D3 }  a: N$ W
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)9 i5 ^( |7 v. U. R/ h8 |+ l3 `7 @
to the VxD Control_Dispatch proc (how the hell a shareware soft could try' S" x: \1 X3 t( L/ [" M. R5 [
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
$ \; n+ y/ E! a# QIf the VxD is loaded, it will always clear eax and the Carry flag to allow) N9 a% X; b- ?% Q, ~; }% j" o5 r
its handle to be opened and then, will be detected.
# D. _- x5 V. x* p; f( k) iYou can check that simply by hooking Winice.exe control proc entry point& F; ^! h- Z' a9 u. v
while running MeltICE.( [9 h8 V; p. q4 ?: E0 b% m

* n9 f# i+ q" `7 f" V: H: Q$ o+ i
  00401067:  push      00402025    ; \\.\SICE. x* v6 f: L* f, N
  0040106C:  call      CreateFileA
' R1 z8 o7 o: F& }) `) X  00401071:  cmp       eax,-001
& Z% r! G; U2 j  00401074:  je        00401091
6 D% J: [) h: x7 ]7 R. z& `  W. @1 W5 P
6 G# ]& Q4 X2 X' b% D: v+ H3 v
There could be hundreds of BPX you could use to detect this trick.
% K9 z0 E- ?0 }: m2 U-The most classical one is:- O9 v+ K+ [- k# d
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
  b8 Q. H8 V1 W    *(esp-&gt;4+4)=='NTIC'
3 F3 Q2 w- E' k- N( ]; g$ f
, j. Y" K7 _& X7 f8 D-The most exotic ones (could be very slooooow :-(/ j8 t' R4 V$ q& b0 E* P3 J5 l
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  ; |9 [/ S+ {/ ^. g$ \" C+ w9 Y7 [
     ;will break 3 times :-(# \) ?% K7 \* V1 K9 a) `) |
7 `! a: k& ~4 I$ y
-or (a bit) faster: & D3 R& m& X( C  J7 X5 {# R
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')& c' K1 a( z- j; y. s7 z  K; C

% |) [( L7 O1 c+ v$ S   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  - B2 C/ z1 Q' H9 i- m
     ;will break 3 times :-(' o7 O3 q9 J# h2 h* O6 I

) x* e; P' z* A& e. h$ r' {-Much faster:
. q* N, P, N( Q4 _   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'0 _- W& ?; \: s7 ]  J

) j! X: I8 n% r$ aNote also that some programs (like AZPR3.00) use de old 16-bit _lopen8 I# c1 r% |) Z, u# o( d
function to do the same job:) Z. ?: G/ N( P: V0 h- b

4 Q8 j! x2 X4 r( \8 L% s3 i3 M   push    00                        ; OF_READ4 Q; `* G6 y" @5 D' W* U6 V
   mov     eax,[00656634]            ; '\\.\SICE',0
; f8 V; M1 j& _5 \   push    eax+ H$ }" N# N; p7 X, N3 _4 w$ V
   call    KERNEL32!_lopen
/ t1 e# R# O9 C% w7 i/ e4 e% a) E% O   inc     eax
. T! j, F6 b3 [: E: v# v' N* j   jnz     00650589                  ; detected7 N6 \  ~' ]! u: e0 t3 x
   push    00                        ; OF_READ
. A. T2 t# j- C" |3 L( z  X   mov     eax,[00656638]            ; '\\.\SICE'
5 r  V  H( H+ _* V( v- s   push    eax
/ ]) |- ?# q. Z. `" O1 @   call    KERNEL32!_lopen3 G% P7 b# `) M; Z2 h) k
   inc     eax  r+ h; I3 X) Y6 \+ l: h+ k0 O
   jz      006505ae                  ; not detected" W/ h5 R$ J9 U. ~2 U% f/ {
/ V9 o% g& {- z! s1 R

( G& a6 J! Q1 N7 q8 V__________________________________________________________________________
- k' A' Q, \% K: d/ {9 X; O+ Q2 r( C/ Q% U& J) s% Z
Method 12, i1 z/ {7 O3 C1 j' g: I
=========1 k3 q5 f" N$ V, _6 @3 S* T

1 }) G1 M% \. {, W# T# K  qThis trick is similar to int41h/4fh Debugger installation check (code 05; _4 k7 _0 A; r
&amp; 06) but very limited because it's only available for Win95/98 (not NT)( [/ A2 `, b4 r- c6 s
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.) k7 P, e+ p3 C3 I8 ?

1 a( J+ a. ^9 L0 e8 K; j   push  0000004fh         ; function 4fh
" k# w5 W% B  M3 v   push  002a002ah         ; high word specifies which VxD (VWIN32)
' B. t9 k% \4 o: H0 n, c                           ; low word specifies which service+ K1 R1 T9 i  L& s
                             (VWIN32_Int41Dispatch)
6 d7 w4 f7 `! o/ K   call  Kernel32!ORD_001  ; VxdCall
* f( E8 h) o6 E% K  ^   cmp   ax, 0f386h        ; magic number returned by system debuggers
% E+ m/ T% d3 [; E3 [   jz    SoftICE_detected+ g% }9 S! J: Q) U
2 Y) M& V- P% h$ m& Z
Here again, several ways to detect it:
2 x- `% b- b0 w+ ~, w8 T2 a: U# t( d. t$ t
    BPINT 41 if ax==4f
2 |4 B; ^6 X/ t% g: X4 `3 p
8 B$ c2 a: p$ ]    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
: O! z" ?* X8 K- V% e+ F& X  O" J, W
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A  m! [/ q3 p, ?: B% I+ |: u

% u" `9 F5 T6 @5 P3 Y8 c9 `: h    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!1 j; f3 Y9 f- n

" S1 ^* _4 U' Z__________________________________________________________________________  A+ o! [5 t3 W  c
3 K, ?5 b* K3 {8 k' N% Y' ~$ Z/ r
Method 13
+ Y) R  y9 h( |. P, V, y$ o  V! d=========; J+ ^3 N" C$ P! s' T
* G. o, g8 q3 `7 I! U: q/ i
Not a real method of detection, but a good way to know if SoftICE is6 g% h! @4 g8 H! C; x
installed on a computer and to locate its installation directory.: U- i5 u) v: e1 c; E
It is used by few softs which access the following registry keys (usually #2) :
$ G8 J; b$ h- V% U6 e
' m# c/ n0 i. a-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion& v" j1 A6 x" N
\Uninstall\SoftICE
/ d; A- j* u& B- \" r; f" `-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
( |$ C3 O# K* r6 s! s8 }0 Q6 f-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
! |* e" b7 u2 ?( _) w( L( l\App Paths\Loader32.Exe- C) l5 K2 j. Q9 ]

* X+ ~+ y( \# s# m, K$ _3 R9 F
% b, h; n! G. B8 D( X& @3 VNote that some nasty apps could then erase all files from SoftICE directory
  q. r* g/ g# O( c) c! c9 a; y(I faced that once :-(; c- ^+ o  x* Q; A( Q4 O$ ^. O
7 q! W4 @! e' _9 u( H  {
Useful breakpoint to detect it:0 w2 P3 a9 e5 ?: u+ l; d
2 O. p5 l2 O, [: G8 H. z  e4 m0 V  L
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'! l$ e9 B  N' w, |4 _

1 Y) Q! b0 ~4 l* T__________________________________________________________________________
) \1 f+ H' ?" E' a  E" |( }3 X# O, {+ }0 v& x/ s0 l
# Q& I6 F4 d  ^0 h1 _, L
Method 14
. ]3 @- E+ e  n$ G6 K- E+ p=========
8 ^; h. U- N  h9 O& \( w2 T& @+ k8 ]* v" f0 G$ h
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose* M" j6 A8 A$ M, S5 e. f% ]
is to determines whether a debugger is running on your system (ring0 only).  @, L* Z/ w+ ^! k) S* B* S

# n  R# A, W9 y  _# ]* }5 u" O   VMMCall Test_Debug_Installed; N0 Q; H8 F$ B! O0 `
   je      not_installed
7 b1 ~+ W& k$ R9 _. h. y- M1 j7 J
This service just checks a flag.! [1 F* |0 N( S
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-8-19 07:05

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表