找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
' V: q3 g7 c3 @" e3 y<TBODY>0 d& y% U" t( q( E9 d
<TR>) M- b( _) N$ M" n1 x
<TD><PRE>Method 01
* Y% |' v& l8 K% c, s  t( O=========6 W. y0 c: K& O8 U7 W- C; Y+ H( _  Y
! d7 c9 m5 t/ S! z% |  f
This method of detection of SoftICE (as well as the following one) is- \! q" o# p# h2 ]1 o' {
used by the majority of packers/encryptors found on Internet.* s0 N: g  \9 b, q5 A: d2 b
It seeks the signature of BoundsChecker in SoftICE
, D. P* n4 _2 X! `# w7 I. X& s8 \" |4 ~) S- w+ Q
    mov     ebp, 04243484Bh        ; 'BCHK'7 [5 M9 H5 G7 d1 a4 j8 g, R
    mov     ax, 04h1 t+ m, J# ^1 a+ ]7 b" u* E* G
    int     3      
$ x$ }5 K  \  [. J' t! B    cmp     al,4# a9 q: n+ q9 \) ]7 A
    jnz     SoftICE_Detected, g) L, B, Y- d) M9 |

+ U, A8 c6 V5 i& s* k( n/ u: |___________________________________________________________________________' U' V" ^  ^4 y, F3 i
2 r/ h  j& a$ R  R% f5 c
Method 02  m& ]/ H+ a9 m! x
=========
, S4 C  F4 v( X- R/ _1 i. |, B' L' a" U( A2 z
Still a method very much used (perhaps the most frequent one).  It is used
3 ?( P+ B9 f# J9 j+ P! _to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
& ~5 O  S; `" B9 e! M# Lor execute SoftICE commands...
: z" }$ t# T/ W$ Z  ^It is also used to crash SoftICE and to force it to execute any commands
% M; ~2 s/ u5 b/ c9 b2 h(HBOOT...) :-((  9 |) K6 \/ r( y: N: V/ r
: e7 h; c/ p2 |/ F9 m) e7 |: u
Here is a quick description:( l: q9 M, q3 h+ I0 T
-AX = 0910h   (Display string in SIce windows)% B1 S5 r' V. K
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)% x* t" C$ W4 @  d
-AX = 0912h   (Get breakpoint infos)! b: m! u2 I" s: [4 ]. l
-AX = 0913h   (Set Sice breakpoints)* }- w) `3 s. P1 ^3 |3 [
-AX = 0914h   (Remove SIce breakoints)
: |/ v; c. p5 l. P* @2 M/ G" F# P/ [
Each time you'll meet this trick, you'll see:
- o: f9 J8 J0 U( S+ V" q+ H-SI = 4647h
0 X1 h( E) |. G2 Y. a( v-DI = 4A4Dh, X" p6 f+ l$ a' F
Which are the 'magic values' used by SoftIce.* M6 [8 w2 F; d1 K+ }. s! D$ |) S
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
4 p8 _; Q: s6 g0 Y3 }3 k) _# y
3 X5 o( c1 Y6 B' R( s( w2 `; \6 x4 ]Here is one example from the file "Haspinst.exe" which is the dongle HASP
& {6 y- m! `  }# uEnvelope utility use to protect DOS applications:9 V! D& q9 D" U4 F5 Q3 |

% o2 [% V$ \% E! t* U" J  T! \# b7 W. \0 w
4C19:0095   MOV    AX,0911  ; execute command.7 R% ~4 @/ u; g+ E
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
" [0 e# D7 H/ P, A% Z; v1 M4C19:009A   MOV    SI,4647  ; 1st magic value.& s  l+ \3 u* w9 ^$ z
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
" W) d. \7 h: }* p  R+ ~4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)0 y8 t5 i" t& }( ]5 e  l# y( L  L( D
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute( p& {2 i; X2 h* B: [
4C19:00A4   INC    CX
6 |/ Q, m, L' V' ]4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute8 i" h  i) C" z0 ^/ c9 G% ]
4C19:00A8   JB     0095     ; 6 different commands.
! A3 f" A& R7 j4C19:00AA   JMP    0002     ; Bad_Guy jmp back.! f5 t% Q- @$ W8 Z# L9 B1 d7 d
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)' n1 q( G) z7 q
4 S" T0 A! ?1 |+ v2 Q% z9 t2 Q$ Z
The program will execute 6 different SIce commands located at ds:dx, which( |$ v: H( E% \4 a: Z
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.+ {( C$ T( }6 I# f5 S+ d8 |

$ i7 ?3 a% ^: c! w# h& R* n0 i: [  r* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
9 P' T3 q4 D/ I7 s! \1 I___________________________________________________________________________
7 [' p3 s0 v0 ^* d, C
6 g- o8 U  V& @3 w4 M- E, c+ G$ C# ~, G6 z0 |" D8 W
Method 03
. o* Q) e* g. x+ `( G- X=========5 L4 O4 y% z& A6 R2 p: F. [
( K) t/ p0 S" ~- @
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
8 k3 l* F8 e7 }' q(API Get entry point)5 d' _9 r( x5 D! R% B) F
        3 K- @: Y: w0 X) K9 Q  ]7 z
5 a  d; T! I$ x% d1 d
    xor     di,di
9 t% J& F/ h; I: M    mov     es,di
; E1 ?- Y3 h8 w    mov     ax, 1684h       4 y" H& ~6 ?9 g
    mov     bx, 0202h       ; VxD ID of winice$ m& E- V- y( Y9 U
    int     2Fh
- k" N1 q: \$ a1 ~! _9 B% x    mov     ax, es          ; ES:DI -&gt; VxD API entry point* v! |: K' p, D' ?
    add     ax, di* P: f) o* j- E4 A2 M
    test    ax,ax9 b- r  b! G; e  A
    jnz     SoftICE_Detected/ m& v- `8 `1 {4 O/ y" X
/ Y) L/ ~( E$ J1 O, ?
___________________________________________________________________________
/ e" D: R: e$ Q7 `- S+ v& L6 W
2 r" H! W, k1 i6 vMethod 04& r) N3 s( w4 n1 J, _2 F6 k  v
=========
9 n: b0 ~) |$ a4 X; R4 M% T) V- Q* {8 Z6 |$ s( i) d5 v/ Y6 a5 _( q
Method identical to the preceding one except that it seeks the ID of SoftICE
+ m1 f2 w9 V3 |1 Y5 {2 tGFX VxD.( a2 ~" ?& `% ]% I! A: y3 a

0 ~, v0 K% |7 l. C! ~5 |- {    xor     di,di
; v3 T% t$ I7 B    mov     es,di" L- Q6 Z% n& O8 T1 A6 Q
    mov     ax, 1684h      
5 |% J. I6 z, c# H, }' O. W+ ~    mov     bx, 7a5Fh       ; VxD ID of SIWVID
8 Q0 ^( m0 B" K! F    int     2fh" Q& t2 N1 t/ X# c1 ^7 L: B
    mov     ax, es          ; ES:DI -&gt; VxD API entry point2 R% C/ s( c6 a$ C0 b! e
    add     ax, di
% t9 s* a  \& h1 `: g    test    ax,ax! Y0 P3 m5 A( T; i. |
    jnz     SoftICE_Detected
+ I2 b$ h' A( n, F
6 W) A4 ?5 D! L__________________________________________________________________________
- @  G& ?, r9 |7 t2 H( M3 k; m. w9 h1 u: I/ I# m& W5 v
2 ^( C6 t2 }' y# [" p5 o- C# F
Method 05
! t! B' Q4 y4 q=========
( q) g8 f7 Q9 b5 L, Y; ?& W! ^5 [1 L- y; G& U1 J* `5 d
Method seeking the 'magic number' 0F386h returned (in ax) by all system' P8 S% f2 x, E. d
debugger. It calls the int 41h, function 4Fh." D8 i5 o" N! G) H
There are several alternatives.  - }7 E( ~3 T. _! K) K1 ]
! ?$ y+ X3 M4 Y
The following one is the simplest:+ ?) l# ?. c1 O  W: }

7 R& E2 i( M& r2 |$ `    mov     ax,4fh5 s/ w+ M( y  F; T/ ?5 N7 s
    int     41h
( S6 d4 ^# T4 Y  R/ e, I* x' |    cmp     ax, 0F386
) N+ Z1 a. u1 S9 c7 y- s, U    jz      SoftICE_detected
9 e3 R' p( g- }* }2 E8 `3 n' g" Y

) m+ w$ ^/ u) u, yNext method as well as the following one are 2 examples from Stone's 8 ]* P& w6 @6 u6 Z, _" l
"stn-wid.zip" (www.cracking.net):- M0 U: ~8 o: x" g6 X% [" a9 }
4 ?5 v/ T8 [  Z7 U) b
    mov     bx, cs! T" ^2 a& V3 j6 F% f3 b
    lea     dx, int41handler2$ ]$ i" c% R3 z$ P" I3 B
    xchg    dx, es:[41h*4]  u' O, p( u* t' A, p* h* H! |
    xchg    bx, es:[41h*4+2]
* `! I: S) w$ \) C) w( G% }4 D7 W    mov     ax,4fh
' d$ C4 J/ W3 L; q# z    int     41h
6 ]+ q7 V0 Q, F) E    xchg    dx, es:[41h*4]
8 \: L% d, H# W+ v5 ^' c8 ~    xchg    bx, es:[41h*4+2]
1 W2 m9 ~% |& l/ _& h( B; ~    cmp     ax, 0f386h
4 b- m7 I2 E. x5 m5 i    jz      SoftICE_detected4 G1 R- O# p" \+ r

) A. H' s# v- |- Y4 qint41handler2 PROC0 _  L4 L5 T6 r% T) C
    iret
5 y3 _# ^" k0 R7 O) Zint41handler2 ENDP8 P, E# s0 Q, m9 R

# Y- n) X2 W8 W+ J! s
' s! ^8 U, ^, y7 O4 W_________________________________________________________________________1 v: X, H# R- P" W6 r

, I! R, l4 P" h1 g, i1 t+ C  M3 H; c
Method 06
) w9 d  R8 u) J+ j=========
. [. C+ V( g+ P* n# _. u; R
  M/ |; O  K, {; m! F4 {
3 D' A& r, h4 b% a( A7 V2nd method similar to the preceding one but more difficult to detect:
' j4 V9 ~9 p% H! E- Z! U7 k# K( ?9 H" u+ z# ^
( y$ Q: }) C$ g2 x1 a  u6 b, G# }
int41handler PROC2 L$ P% s' o, c. D" _
    mov     cl,al5 U8 [1 w0 _% `
    iret3 }% H( \! A$ R7 s. k
int41handler ENDP, S( D# T% P/ W5 j, q7 \, b
  T+ n. Z' P7 t1 Y" ^

' s, b/ g: s$ A% U    xor     ax,ax- m1 X- G, T* B- s; n
    mov     es,ax& Q. s! d  K" Z) a
    mov     bx, cs" I: E- h( Y+ z. _8 v$ |" S0 J
    lea     dx, int41handler
* m5 j8 s: }7 `$ [' l    xchg    dx, es:[41h*4], T7 F2 G' }  m& W2 A
    xchg    bx, es:[41h*4+2]
4 I( d7 u" c- R6 }% ?    in      al, 40h8 y8 r3 y6 O( K) Q# A4 ~7 n% W
    xor     cx,cx5 g4 o& j( X9 z' Z/ W9 g
    int     41h/ x3 x1 {( T4 b. T* p. \4 k
    xchg    dx, es:[41h*4]2 g9 H- A; d7 M
    xchg    bx, es:[41h*4+2]# \8 P, j, P9 v. [
    cmp     cl,al
4 L$ |* o, q# Q9 T8 q0 `    jnz     SoftICE_detected
$ \% M" V; Z2 }/ K5 X5 w& s$ z% U/ u% n/ }9 p# s9 x# G" K% Q
_________________________________________________________________________
  {" X; q- J) a! h# e5 F6 D. I/ g1 B! S) U! S' X2 r" i; U
Method 07: Z( S. B$ I- D4 {* i0 N. I; l7 r
=========
4 h% @5 y" Q* a+ w, x4 P5 e" p4 ]0 C+ E1 |! B6 o/ |
Method of detection of the WinICE handler in the int68h (V86); O% d: m0 s8 l& V3 m

6 I( a# A% C& ^- L& K    mov     ah,43h( H: }% s0 T# K' v% Q6 a
    int     68h2 ^9 Z- \9 m3 J3 L
    cmp     ax,0F386h
+ |8 }! f; T7 d$ ~" r& _1 M    jz      SoftICE_Detected
+ u+ d7 M1 K* u# }: C4 B# L* p( }. N. G& ~) z  ~  }. a( b% s
3 j3 F0 [( U9 M  H; i
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit: f; e: `, H: [
   app like this:1 X9 v0 l1 O0 |2 j

9 B- B0 T, R) L9 p% u3 r( u8 ~$ n% ^   BPX exec_int if ax==68
, k2 `& ]  s2 H0 a$ U- t   (function called is located at byte ptr [ebp+1Dh] and client eip is* V; l6 x& q, {, C9 ~; n% k
   located at [ebp+48h] for 32Bit apps)
" r3 z: Z- m" O3 ?& {" Z__________________________________________________________________________
! O0 @5 m% k* f. a1 f6 d- T0 [3 d: ?4 B/ n0 n/ C
+ E5 }& Y+ `2 s% X# f2 k3 k2 I' d
Method 08
- |1 N( N: W- u( ]=========, ]6 h# _% w* Q9 ]+ }& R+ k# R
! @& {' V5 }& q  w
It is not a method of detection of SoftICE but a possibility to crash the
* p/ K. d  G: K& D1 M! csystem by intercepting int 01h and int 03h and redirecting them to another
7 J6 j  l5 ~- z8 e& z7 d8 ^0 q, Troutine.4 K* k/ x( l; r
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
8 y2 N4 D2 l# q2 _" s3 B/ R; m4 U) Zto the new routine to execute (hangs computer...)1 E0 K$ D7 ~1 j+ c4 R

2 d" l* u7 w0 u) F- M5 @& W    mov     ah, 25h
$ ~) n# C4 F4 n/ C) a    mov     al, Int_Number (01h or 03h)
4 }6 S: c1 |, A9 P9 Y  j& p( |! r# X8 g; c    mov     dx, offset New_Int_Routine; d( N: u& x) c! k" L, p
    int     21h
2 l6 d& ]6 H8 w# p, u/ N3 M8 v7 a
__________________________________________________________________________
9 H- F8 \  f2 W  g# x" S
' J0 E1 N3 z# v& [* Y/ dMethod 09" n" ~' y* h8 h8 Q- R" R
=========
7 h" B- J, ^8 [4 r) |0 i
0 r8 n/ u$ ~3 r+ N8 e  cThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
9 m$ F" V. j0 f, J1 Mperformed in ring0 (VxD or a ring3 app using the VxdCall).. [- _- @4 l9 h) H! i5 N
The Get_DDB service is used to determine whether or not a VxD is installed
# o0 \: j2 l8 kfor the specified device and returns a Device Description Block (in ecx) for: q- _% Y: K% }. L3 Q$ e  r
that device if it is installed.5 S1 _; Y* z0 h' o
, f( q- f% D; T( A5 u- H
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
. a  \5 b( J) s" |# O2 j   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
7 o  U/ q/ a8 \7 p; Z, [   VMMCall Get_DDB5 B4 E) Y+ s% E1 d* _- [7 V
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
/ N+ c( s  U' R1 `4 s8 v' f" f. `- s- y, w1 ?
Note as well that you can easily detect this method with SoftICE:  Q6 M) J+ N0 a' r% Z; Y! R! C
   bpx Get_DDB if ax==0202 || ax==7a5fh: _9 z' {' T4 i: P3 C) |

; j, ]$ v/ p; N0 x3 z__________________________________________________________________________
2 u; U( I: r7 a6 \
  `) _, R# X5 r) g+ f6 u8 rMethod 10
& y9 K4 U* K0 c3 T5 K% i=========
" t+ L( @; E6 g9 {# E3 e  w/ \' k- b+ h  C& t# K4 H
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
. V1 M' X3 q0 Q/ O' u! Z7 ~, n  SoftICE while the option is enable!!
  B5 n( w( |- v3 _0 \3 i" a, h4 S( ~2 H
This trick is very efficient:" c6 ^3 E) t2 T$ Y# C% m) S
by checking the Debug Registers, you can detect if SoftICE is loaded
2 g. P" `# c* s! O0 u4 d: w4 _(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if& `/ [9 G6 t" {" s) f
there are some memory breakpoints set (dr0 to dr3) simply by reading their( X6 P$ i( q7 b2 R; ~
value (in ring0 only). Values can be manipulated and or changed as well
% x# o' m! @8 u3 V- p) a" l8 m0 v(clearing BPMs for instance)
* i/ F6 o0 |) s
2 @0 J2 ^! M/ e1 J- Y# \9 [; p__________________________________________________________________________7 B8 _  E. _- y3 \4 n2 w# {: q1 Q- F

$ i" P, `& d0 G! S; vMethod 11: s6 |4 b' Y9 \6 m7 l
=========1 A4 _9 i1 l+ R
6 [( S+ L9 o7 Y, V
This method is most known as 'MeltICE' because it has been freely distributed' g( X- S  r! {( o: e0 Z# `! f
via www.winfiles.com. However it was first used by NuMega people to allow! j' M9 E2 J: C& [9 f3 H. U, r9 v$ T
Symbol Loader to check if SoftICE was active or not (the code is located
. |7 A. P) e5 w& uinside nmtrans.dll).6 K- n1 s: u9 Z& |, n8 d/ {$ A$ ~
5 n& Z% O( B' J# P4 k
The way it works is very simple:
$ D6 \& _% a) k' e5 D% f/ \It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for6 L% a  Z  ~  K. ~" d( n3 f2 Q6 x1 }
WinNT) with the CreateFileA API.
# C. V' m3 ~1 v# h" M, _* d! M
8 D7 B+ t, j2 e- J3 h8 p7 W4 ^Here is a sample (checking for 'SICE'):7 Z6 w) H$ h. ~8 t, v
9 c# p* X/ H5 _
BOOL IsSoftIce95Loaded()3 I" G7 Z) B8 @+ v! \: _) a2 _: u
{1 z5 p: n, ~$ e9 T
   HANDLE hFile;  % _8 ^" z' f+ N, l. z6 z
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,+ p% H$ i2 c% r3 o
                      FILE_SHARE_READ | FILE_SHARE_WRITE,
1 y* Q1 {4 q/ U$ H, g& A( ^$ U                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
, F. u$ ^8 M" K' a5 K: @% z+ o/ `   if( hFile != INVALID_HANDLE_VALUE )
1 d' t# d- m1 t; y6 D, Q   {
8 z2 J: j; f  Q( V1 a% ]      CloseHandle(hFile);
+ C+ D" |8 D. p$ u% x6 k: C      return TRUE;
! F  u9 h# r# @8 i# L   }1 _3 z4 x1 l/ A( B" H8 [
   return FALSE;5 M, F) I+ h: q; R; N
}$ v: M/ w+ a4 T9 D. s
9 l9 k) N3 t. \' C, `& o' }
Although this trick calls the CreateFileA function, don't even expect to be3 H9 E2 V! Y: W
able to intercept it by installing a IFS hook: it will not work, no way!% L& S' }# _( C; e
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
0 ?) ]  X2 D* ^% d' y: d* pservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
% w, g' q0 S# G6 Iand then browse the DDB list until it find the VxD and its DDB_Control_Proc
; b/ L: b; q9 m: c9 {. q" gfield.
$ P4 F- U4 p. p$ B4 |! ~In fact, its purpose is not to load/unload VxDs but only to send a 3 L- Z1 V7 Q+ h) H
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE). h* b$ V$ a) H8 o/ C% S& e9 t6 I
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
3 Y; [9 s+ _) `/ w/ ato load/unload a non-dynamically loadable driver such as SoftICE ;-)./ F/ [. @/ i3 V' g9 Y" `/ R
If the VxD is loaded, it will always clear eax and the Carry flag to allow
( R! G, R- W1 |0 O- }( [its handle to be opened and then, will be detected.3 l$ Y9 r8 L& g1 i
You can check that simply by hooking Winice.exe control proc entry point) }) v9 r* z# |# r3 q+ V4 ^
while running MeltICE.2 M4 Z$ x8 S5 y

4 V; B  q! G8 U. f4 t  S7 @
. W- u; L. I2 t0 n* y& l) D9 R0 F4 ?  00401067:  push      00402025    ; \\.\SICE
: N: F; B. q# T  A  \  0040106C:  call      CreateFileA  i* E/ `2 r5 u- g
  00401071:  cmp       eax,-0019 G8 c0 ]  }2 \8 k4 }! t% J1 L
  00401074:  je        00401091
/ |& e$ F' D% C6 U( u' N) A0 t
, D" I, ]" J0 o/ Y/ R+ Y
9 b4 B1 U0 X+ k) o& l/ lThere could be hundreds of BPX you could use to detect this trick.
3 s6 i8 ]; u$ h; w) ~; I# C-The most classical one is:0 m, z  |$ V) m/ l
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||2 a) b! D: T+ Q( s, h8 n. D
    *(esp-&gt;4+4)=='NTIC'
2 @# g# k0 x- y; r2 I: P* Z
0 V/ y; ^; e$ r: N. j1 l7 B  u$ Y-The most exotic ones (could be very slooooow :-(
; _9 K! b8 ~- F) p9 A   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
$ o3 `1 Y6 i% [     ;will break 3 times :-(( I  }& {: l$ ^
. w2 H( o' x$ b
-or (a bit) faster: 0 [4 W6 K: |0 T7 A5 ], [
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
) }# U+ J5 F7 x! f. O/ H; B0 b6 u( {6 D2 e5 O
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  7 V% H  _- E, q, h
     ;will break 3 times :-(
8 n* p9 `1 D7 Y/ o
9 C: {: N9 x" |- S-Much faster:3 Q' l/ h- R' |& f) M4 H3 k" G  y" R# f
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'- m0 x+ Y7 ^% x+ a& t( L8 m" X
* f1 T  Z$ x+ ]$ k
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
' {% W6 T2 G7 Y3 e, ffunction to do the same job:& K# k1 x7 o& N1 ~
& {) ?9 A/ R5 F  q1 A6 y
   push    00                        ; OF_READ* ^6 r7 O9 T5 \+ R- Y
   mov     eax,[00656634]            ; '\\.\SICE',0! L) J+ j( v) {" E/ E
   push    eax$ R& [# e- I8 ^; x7 U
   call    KERNEL32!_lopen, o) t4 V0 a* J3 F3 A7 Q/ t
   inc     eax% O  M$ _7 n) g8 P
   jnz     00650589                  ; detected" [, V$ Q% S9 O
   push    00                        ; OF_READ2 B! b. M4 ]9 N2 g* O; T
   mov     eax,[00656638]            ; '\\.\SICE'* A  L# F! K# |
   push    eax
% L5 t* s0 Q, _5 s4 x9 J   call    KERNEL32!_lopen
- Z% D& q- G" M5 V8 ^1 ?   inc     eax
7 F' |/ Z$ k# b   jz      006505ae                  ; not detected
/ [$ @1 e0 h' t. u. ]; B$ u+ U: X8 m/ Y) W* z/ n' ~

/ m3 G9 }0 e7 P7 u__________________________________________________________________________
9 q( ]. p: x: F) @
, ~; f+ n; B! V2 Z/ dMethod 12$ J' y  g1 y+ g$ Z/ W
=========# i3 `, I/ a# P3 S$ U4 B$ M
8 }! w  V0 v  {; U8 {; y" k: J
This trick is similar to int41h/4fh Debugger installation check (code 05
# Y6 r" O. p/ E6 l6 R' f6 H4 t  A&amp; 06) but very limited because it's only available for Win95/98 (not NT)
: [4 g/ r% @# V* W4 Kas it uses the VxDCall backdoor. This detection was found in Bleem Demo.
7 j5 c6 G3 K; S; s/ d5 u9 O
8 L$ Q5 s8 ^" i' W: q1 S% z   push  0000004fh         ; function 4fh; Y  Z, x( Z  g/ Z* I* B
   push  002a002ah         ; high word specifies which VxD (VWIN32)( k& z- }; c& A1 t6 E( a& l# o
                           ; low word specifies which service8 m. x* Y8 _- o
                             (VWIN32_Int41Dispatch)
+ ]% d) j5 o* Z- R0 A/ n& }- r7 p   call  Kernel32!ORD_001  ; VxdCall9 {8 c6 S) H- z. h+ Y- x2 o& J* S
   cmp   ax, 0f386h        ; magic number returned by system debuggers) _/ o0 K$ ~& q  `  T0 n4 ?
   jz    SoftICE_detected) }- C' v$ Q; J  k

9 S  \  I! u" xHere again, several ways to detect it:& {7 Y" h  o1 ^% f7 ^8 e6 l. x* n
% ]7 n% C' k% ^$ h: }- R
    BPINT 41 if ax==4f
* i$ i2 ~7 `) `* s& U2 n' W! J; {* i" y# q& u/ j
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one8 F  C' N  n3 V- Q5 ?1 d/ i' ?

* K/ k5 d  \4 X% v4 v9 h    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
/ ]& \* X0 {1 ^( L. j7 x4 a7 L* u& E
( f6 X$ h4 q( A/ u7 Q3 [1 i7 P    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
) L6 z& Z# l0 n0 B1 @# f# Z8 K4 f9 ]- }+ E- S. y+ x% z
__________________________________________________________________________8 O& a$ W2 m- T5 l: _3 j

( S% a. X9 E" d4 lMethod 13; p! ?5 x/ @* s7 ?7 U4 n
=========. Q: l9 e. a0 }# T  i

) O" B$ p# r; n: l. `Not a real method of detection, but a good way to know if SoftICE is
* m. O% B( M5 |+ O8 ~: A) @installed on a computer and to locate its installation directory.9 F! ~+ c* y% e! p* W( f) I8 x" N
It is used by few softs which access the following registry keys (usually #2) :
! Q- W% T2 N. A: {
% y* [3 z/ A  S3 ~+ Z  A$ Y-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion5 r& F  I2 X; |; @4 Q9 x. c
\Uninstall\SoftICE
- b$ |7 N" y7 @# ~6 [9 r' Q( n-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
- {- |# i! E: \2 [-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
+ }- Z2 ~/ B' W) B/ }\App Paths\Loader32.Exe
5 i/ T5 S2 M+ L* L- f4 p
, ^8 U9 m* L1 C( f" q2 n3 L1 W5 g6 w6 U2 @: B9 @+ R) X
Note that some nasty apps could then erase all files from SoftICE directory
1 G3 W- m' g4 b) v9 S+ J(I faced that once :-(- Z8 {+ D+ |, J; B
$ r+ Y( r: z+ q6 Z
Useful breakpoint to detect it:
: X0 b/ `! C4 ]  f- t7 I3 ?
( s( U1 y! h; M/ d) U     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
1 v- `. r' Y1 a3 G! K# ~5 ^5 P" a5 k& `7 n
__________________________________________________________________________7 f7 ]4 x0 H5 f. S1 |
$ s6 ]5 _: R" ]9 v! w2 l' [- x

' j! K( T2 {4 j" P8 C. I) oMethod 14
' ]6 h* T+ r5 ?1 U1 S=========
6 c3 v' v4 N3 ^# b) J, k( d; C, L$ ~- K1 k3 c/ n9 |+ t
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose/ f( m! t3 G+ e! q, R" N/ P) ]4 H
is to determines whether a debugger is running on your system (ring0 only).
# @5 Y; {' }; R3 V* v+ {
9 r/ z  N, c( l& F$ v   VMMCall Test_Debug_Installed
( P7 g) z% ]$ H6 D   je      not_installed
# ~" h$ ^0 o& A. }3 _, k6 \3 l* J8 J6 Y2 l$ G" k, b$ n% K
This service just checks a flag.
  C1 t7 G* F# A</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-7-24 05:04

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表