找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>% u& h) ^! }* n, C6 @
<TBODY>  a- h  m5 q0 A4 H- |
<TR>
1 r2 a, X* q* y/ ~' [<TD><PRE>Method 01 % r, K) T% N; ?4 `
=========
+ o; a8 y' K4 h. k5 s/ N0 Y/ A0 A1 w, x, h# y0 n9 P. u9 O) B
This method of detection of SoftICE (as well as the following one) is
* y) U9 {  W7 H6 Oused by the majority of packers/encryptors found on Internet.7 d2 v! A% n; N6 K, @+ m
It seeks the signature of BoundsChecker in SoftICE
+ u$ O3 y: ?3 P; B7 b% S) p( ?& s5 o# A
    mov     ebp, 04243484Bh        ; 'BCHK': V- }6 ^  g# y+ l0 m2 I
    mov     ax, 04h
" r- d4 X& |# U, g! {4 s4 T    int     3       / [3 X8 t1 j" F# V% B
    cmp     al,4
8 \$ R8 B2 S% J7 K! j2 v    jnz     SoftICE_Detected
+ k! y. n, J3 i$ J% Y" l1 N, T% Q
___________________________________________________________________________
. q2 Q8 v& }/ o  h+ Y2 m
3 p( F8 @: `: n# r/ hMethod 02* M2 W- w0 N7 x& B3 |
=========# T; `% f0 N! s! J
: n6 t/ J- n9 w8 D1 Q  U' l5 L" G
Still a method very much used (perhaps the most frequent one).  It is used
, ?7 L7 ^7 H# U  J( D7 Fto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
' v1 t8 k. Q+ g+ g$ Ior execute SoftICE commands...
5 p1 l, B3 W1 G$ g% ]1 KIt is also used to crash SoftICE and to force it to execute any commands
6 E- m( Q. D1 a+ B8 R; t3 @. R(HBOOT...) :-((  3 _* I* J3 p8 [; M- d: ]# u
6 f2 ?7 ^2 m5 P2 B8 X7 q+ ^
Here is a quick description:
5 R# t/ t% V' `  n# V4 j7 w-AX = 0910h   (Display string in SIce windows)
8 e  q) I0 ?0 H: r-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)+ S7 m$ s' F  |* P; e. [3 w  Q9 a" e
-AX = 0912h   (Get breakpoint infos)$ o, y$ q; f/ H' p6 y0 J
-AX = 0913h   (Set Sice breakpoints)
- F2 ~) K& G" u( {4 {6 q0 I# L-AX = 0914h   (Remove SIce breakoints)
  f3 c! _6 v& d; J# @, J. ^3 u5 M0 ?0 ]6 I* Z5 E2 x
Each time you'll meet this trick, you'll see:: s& h, F4 R  f' h! ~/ t
-SI = 4647h' G/ Y2 ?+ T7 N
-DI = 4A4Dh5 Q$ N! S  D# M" [
Which are the 'magic values' used by SoftIce.* l, E- x3 c. Q2 u# |0 e7 U5 `
For more informations, see "Ralf Brown Interrupt list" chapter int 03h., L3 C9 E% g2 f! @2 P

5 P$ j& l3 L: K. b2 q: nHere is one example from the file "Haspinst.exe" which is the dongle HASP7 g$ }1 l( Y& D8 j" }
Envelope utility use to protect DOS applications:
2 s1 N- O! [: ~& Q2 v9 B3 x) |4 w' z9 X" L% A' O' H- X* T
, H& F1 Q! z9 f& u! U# p1 c' d% I
4C19:0095   MOV    AX,0911  ; execute command.
' H" _& A  c1 ^+ s# K7 ]3 k4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
- G( o1 Y$ ?0 r, B: N4 A# m' _4C19:009A   MOV    SI,4647  ; 1st magic value.
# w  E# `( H/ S$ I0 W/ C4C19:009D   MOV    DI,4A4D  ; 2nd magic value.( ^0 Q6 S8 ], Y  @/ D0 Z( L: x
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)- r6 a- n+ Q% G/ y7 M/ y2 D2 [4 I
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute, b+ h; e% d4 G, \8 K" R& s
4C19:00A4   INC    CX0 d. |/ P2 }* M, |
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute) i# F, a6 D% h' k& m: l7 o$ ?3 r
4C19:00A8   JB     0095     ; 6 different commands.
4 L7 _# y* s$ x& d/ j- ~4C19:00AA   JMP    0002     ; Bad_Guy jmp back.+ ^, F8 l0 j7 X' L4 ?  `
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)$ f% p: E: d6 n5 y" s) R  t
0 q  T% p; f0 {% G% x7 ^1 ^) O
The program will execute 6 different SIce commands located at ds:dx, which
7 W6 \5 U8 ~# t% T4 g3 C; C' Z- Yare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
) p4 Z  q0 k" Q1 x- d% s) A1 c* C+ b) R" @! F% @2 E2 j
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.; u* {6 X# e8 C7 Z- T
___________________________________________________________________________
: F, W; o2 P1 a2 g4 P! q) z, d: X
( ]# Y+ \# R( s0 R4 s7 X  z. e2 l
Method 03
- ]  N* ~, X+ }- n$ u=========$ @" F& H2 y. ^$ ?) l; ^) \* K
, b& d- G  K7 J3 ~5 [
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h, f$ }( K# n) n6 q/ F. g# Z. Z* h- N
(API Get entry point)- X. n8 p; b; H3 X: N
        
2 e2 i' E+ ]( l+ }" k
: |5 ~9 a1 K0 z& a    xor     di,di7 O8 v5 r3 l( o3 v7 w$ ^2 D
    mov     es,di8 e9 y  k/ ^2 _* M4 p
    mov     ax, 1684h      
. J0 d. y4 X/ T8 w    mov     bx, 0202h       ; VxD ID of winice- x# ?7 F; A/ l0 f. R+ S& Z1 u
    int     2Fh2 s7 S* s( H  w" Y  e- Q+ N
    mov     ax, es          ; ES:DI -&gt; VxD API entry point! `) \! \) S9 B# }6 m0 @+ t/ p
    add     ax, di
7 G5 @4 O* t, C1 l* ]. b    test    ax,ax& N0 O, ?0 B9 l1 R; e" r/ G# \
    jnz     SoftICE_Detected
- d( x% H: N: X( T7 M/ q0 [& ]
1 p. T: W  N- [+ e___________________________________________________________________________
" k* c) ?4 B( K4 m) g# C9 m$ ^2 a' g
Method 04
! @6 w9 G- @8 F! m& h=========
7 [# {6 @7 a; M& {
# q- d8 n0 }0 U; o4 S/ P6 g, lMethod identical to the preceding one except that it seeks the ID of SoftICE' b, g2 B* h. A* \' N" b/ q0 ]' D, z
GFX VxD." Z, [1 k* Q1 r' t) f
7 [7 M: m& H+ o( J
    xor     di,di
1 T3 R5 H7 n* Z( [5 a% A    mov     es,di
% a. P  [* u1 I0 a+ r6 }    mov     ax, 1684h       ( }* ^1 C  P7 ?
    mov     bx, 7a5Fh       ; VxD ID of SIWVID
- o( v# m( W( }1 H' i! u9 ]    int     2fh- _$ i% A# g9 {0 B
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
6 V" ~; A% W1 p( X    add     ax, di
) C) c/ Y! t  V# \1 ?, ?, X    test    ax,ax
+ m0 B6 p6 U; \* |    jnz     SoftICE_Detected
0 \1 `! _8 b6 |2 D) E- m8 F# k' ?3 D8 T$ m# n1 w
__________________________________________________________________________
$ `, g3 _2 d! c3 S6 _  a3 R! D5 n  W1 Y/ \: S$ t7 a2 K

- Q8 Q3 f3 n: o8 ~" LMethod 05
0 h+ K5 z4 O$ w( {=========6 R* t! C7 i/ J: [( r! Y' j

# i) o" t" H, f4 [Method seeking the 'magic number' 0F386h returned (in ax) by all system3 _: }3 K. O" s0 U
debugger. It calls the int 41h, function 4Fh.
# F2 i# c6 V" J% |3 @9 `There are several alternatives.  # M# p  C& l; z9 E- V3 \
8 R$ z' P) ~! U. p
The following one is the simplest:* A. x" Q; N8 s$ d7 D: I

% R6 Q% J& r* ~/ H4 x' P$ c/ l8 F    mov     ax,4fh
2 z7 ]$ I# t8 x2 e* j: d' T! a4 O0 r    int     41h  G7 ~: F- G7 c2 E
    cmp     ax, 0F386
: K, q5 h$ U4 `    jz      SoftICE_detected$ q' j' `* @. ~3 ?/ ]
! h8 c/ C+ s; A
9 j  v+ N1 P/ L) r
Next method as well as the following one are 2 examples from Stone's - ?% Y7 I; L. _; r  V9 d: i) w
"stn-wid.zip" (www.cracking.net):
; p1 y9 ~6 C9 L8 L( R, ?. _7 O- v( j6 z. C2 s( X5 U
    mov     bx, cs. }) G5 a2 W) c9 F. z/ P
    lea     dx, int41handler20 b$ F4 o' t9 x
    xchg    dx, es:[41h*4]) X- c0 P0 V1 V1 \% j5 u" l' Q
    xchg    bx, es:[41h*4+2]
1 {' {" R7 m( E9 }    mov     ax,4fh
6 |. h5 X, C( m/ E8 ~    int     41h  k2 V% }3 a4 o) z# |( p9 w# z" }
    xchg    dx, es:[41h*4]
8 f/ R6 g9 k3 A5 T    xchg    bx, es:[41h*4+2]4 y2 L- m  V1 i3 `: O
    cmp     ax, 0f386h
4 f& t4 c" C' A6 `2 Q    jz      SoftICE_detected9 s' {# I% ^  f& p4 S
3 q3 b4 a  H$ E2 M9 X4 ^
int41handler2 PROC6 e% s  {& H, U" A
    iret+ N' n- b4 `( c
int41handler2 ENDP
7 z! u, q2 o# h) g/ Z3 x- m/ q# y  K4 ^4 K9 N5 E

2 j  G" e: d/ }1 `0 I: m& ]_________________________________________________________________________1 ?, h$ l* K8 `. O, z- I
& R8 t6 @  `$ B7 H, j; H+ D1 i# J( l

( X  }; `6 C* `2 V  l0 O# A! eMethod 06- h* b' d$ p- K# [) b
=========0 ?5 K/ q4 W3 p8 e* P4 C% r
5 n$ ]2 R/ J2 O+ {- t' l: q  z

$ Q: U; e, o( X) F, D( [2nd method similar to the preceding one but more difficult to detect:4 y, h% g- _8 V
, a1 S4 k! Y. v( E/ e$ Q: \% e9 F. T

6 y% J: |4 H' ^- i$ f$ @  xint41handler PROC
/ v- d5 J* H3 u8 F0 A# v9 r    mov     cl,al: O2 n/ @5 m3 [" ?0 [7 V9 V
    iret+ b% W; h. |# F) N* ]+ M7 \* V
int41handler ENDP8 P/ L: o7 o- O8 R5 W3 [% l3 a
, T  w) z  N5 E
4 J! n" w8 T  M8 |
    xor     ax,ax
0 a: E; {* N3 R9 u  |7 X# [* `# b$ r    mov     es,ax
2 ]0 i  C5 G  Z4 {/ b3 b    mov     bx, cs
) b+ h4 v: y: y3 F    lea     dx, int41handler4 ^4 [5 @1 |8 c$ e/ p, V
    xchg    dx, es:[41h*4]
5 ?2 ]2 \6 [! t* c2 z$ S% U9 i" L    xchg    bx, es:[41h*4+2]5 V1 G% o2 J" }, h  @
    in      al, 40h* l4 s# p0 u; R4 i
    xor     cx,cx
. s4 u" q0 p. q9 T$ }9 a    int     41h
- ~8 K% _! r/ S/ ?$ m, b  y6 H    xchg    dx, es:[41h*4]6 r* [6 J9 s# K8 o% f
    xchg    bx, es:[41h*4+2]8 m! P' U) L, h) Q$ @0 Q0 o
    cmp     cl,al
, r* F* b- |) C- @( U1 w& N$ _% G    jnz     SoftICE_detected0 D0 D/ K' z8 N3 W9 j: o& \" t
& G+ r! s6 Q' X
_________________________________________________________________________) ?- M! t& W# o7 d
) K! I. J; b2 o+ s" U7 o
Method 079 ?2 A+ l8 k( d$ G" c. f  |- |% {
=========
3 b3 n8 v) k" o$ A
3 Q9 j& Y. K6 ^+ [, E6 mMethod of detection of the WinICE handler in the int68h (V86)
  H. l* [5 ?2 ?* e+ O
! p6 u' |: S1 |; s% i8 x. R8 y) e    mov     ah,43h$ v% [1 }. B/ R( A, M
    int     68h2 A5 B7 ~& G3 H, y8 R
    cmp     ax,0F386h. h# \6 ^( \; ^! j  z+ n$ @& B
    jz      SoftICE_Detected
- M$ B, R# A! Z5 t/ V- F" E) u) s, B# w7 D

/ u# G; f1 j+ S/ U6 W+ }" w3 u' s=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
8 W0 `/ R0 @( R! ~3 @+ a   app like this:6 X6 w2 z" L' |
9 T7 Q& @: s: [1 O- f5 D% A
   BPX exec_int if ax==68
3 G$ m& B# B/ E* K5 o" q: r/ @   (function called is located at byte ptr [ebp+1Dh] and client eip is0 y" f, _0 n6 L9 W
   located at [ebp+48h] for 32Bit apps)( Z2 ^: t& u/ C6 Q5 [5 @# I
__________________________________________________________________________
' [1 n( h$ }3 L9 C9 @
  M6 p" r  d3 a2 r- K8 R' C8 x
) s5 |  `$ Z$ e. r! k" F8 DMethod 08) e4 d1 z  i" z/ d' \- Z8 z& m
=========
" G& [0 t% E! R8 M& v% ~8 f/ ^0 i* G2 F; @9 V
It is not a method of detection of SoftICE but a possibility to crash the
* p8 J. F5 W: H9 i& z& U5 wsystem by intercepting int 01h and int 03h and redirecting them to another/ Y5 k' ?; U$ ?+ ^
routine.4 z* j% m- Y0 G. Q' j0 h7 k' g
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
( |% _' }# d; \! ~to the new routine to execute (hangs computer...)+ n( _$ b; W' E' }

1 Z/ s2 M. e. B& V    mov     ah, 25h
0 k  Z: K# C5 g* E. ]' u, p1 `+ n    mov     al, Int_Number (01h or 03h)5 W; V$ X" D1 b$ Q* x1 l
    mov     dx, offset New_Int_Routine& X; J$ h2 T* f; B
    int     21h
! n. z. g+ ^% V, L( @+ u: O' u
# t3 ]4 \+ e) W' U__________________________________________________________________________6 w) Q) q. u  H$ f3 P4 y
; |! ?9 O1 @! m* _: R& [  @
Method 09
3 D  {! n3 o2 K=========% W5 x- L) T: t: \

% Q* }# j" C/ \7 r+ RThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only; q5 h+ w5 Q4 e0 f" ^5 R3 B
performed in ring0 (VxD or a ring3 app using the VxdCall).
  }: j! e' r, D% ?9 zThe Get_DDB service is used to determine whether or not a VxD is installed( ~0 Z" G* v" ?6 h8 U/ w* L( z
for the specified device and returns a Device Description Block (in ecx) for! D: m  V6 A* J, o
that device if it is installed.
9 X; S/ v. X) e+ }% U. w
0 ?/ ?: c- J, k   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
( d6 q$ ]4 T. v8 R1 x% e; `   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)* A1 S# s& R0 W7 O8 S
   VMMCall Get_DDB
( e/ b/ c/ g7 H/ l6 w# {   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
- O! Q4 [3 m& C
( c; s8 Y8 Z  |) @1 rNote as well that you can easily detect this method with SoftICE:
) Q8 d$ |# e* U   bpx Get_DDB if ax==0202 || ax==7a5fh
/ h; y" ]" f# D& }! S/ D1 ?4 j7 v: u/ x; m2 R* z8 v, s3 Q# l
__________________________________________________________________________
0 t/ T7 d, U1 p" m
" ~( D" m. F9 k4 PMethod 102 |$ W' ~" g0 F2 H
=========
4 H; Q) L4 u# {! M+ j2 B) `) m- _" j* h
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
& ]3 m1 w5 R9 i2 b: X  SoftICE while the option is enable!!' K+ V& Z  F$ P/ L+ z* C
3 p3 ^+ M5 X; M) Z$ `
This trick is very efficient:
! w2 t! g2 I) u9 g7 Eby checking the Debug Registers, you can detect if SoftICE is loaded5 v# b, o1 [3 E' L  s# M! u
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
# Y9 o# ^2 S+ X* o" C  Dthere are some memory breakpoints set (dr0 to dr3) simply by reading their: v: a4 j- {4 W5 ~; u7 L
value (in ring0 only). Values can be manipulated and or changed as well
% a& c1 ?9 Z+ z6 n0 ?5 d& x8 k) F/ y(clearing BPMs for instance)5 N7 E: l# U  X+ h
! R2 l) s* ^; B4 `' m# o" f& P' C
__________________________________________________________________________
7 }* m" B: Q  D: o5 q7 r$ I+ ^, f5 V% D1 O& \6 X0 d9 P% Q
Method 11
2 E# @! W% C9 x- G; [$ Z; X( r=========
# ?8 ], E0 [' S7 O( F$ u3 a& Z4 G/ K. A3 Z: P
This method is most known as 'MeltICE' because it has been freely distributed
) M; A$ Q% X) Z4 tvia www.winfiles.com. However it was first used by NuMega people to allow
9 e" L8 M  ?* D+ ESymbol Loader to check if SoftICE was active or not (the code is located
+ b( u0 s# K# _5 K6 Q4 L* ninside nmtrans.dll).
- E9 g5 X- R* @3 D) L+ |  p6 {9 _
) C5 |9 g- P- J8 w2 m( N2 k  QThe way it works is very simple:+ Y4 n: T+ W# f+ d4 V
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for& g) U! b' @  q
WinNT) with the CreateFileA API.
! [1 j# r. K) {) ~, _
, G  X+ K% f& P. s6 u/ m+ Z- WHere is a sample (checking for 'SICE'):0 q# [) z$ S' }( i; S4 ~  ~& r

: S. O! t7 o  o5 R& I0 B* ?BOOL IsSoftIce95Loaded()
4 H9 \# M. ]) X6 W* T{% B/ {6 e/ s6 e+ G5 Y
   HANDLE hFile;  5 G; C' L5 H' X' s$ w8 Q: u3 W) ?
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,' ~, U2 X0 I2 b" ~! @, K
                      FILE_SHARE_READ | FILE_SHARE_WRITE,) r3 }& O8 }5 q2 V7 t; w6 D% ]
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
+ ^+ @$ D* m) [& o1 }8 H* d   if( hFile != INVALID_HANDLE_VALUE )% e, b6 K2 T1 B  f* U0 i
   {
# g* {( v% V- Z2 A3 R      CloseHandle(hFile);
2 B( \; A/ P; r      return TRUE;  x+ l% |  E  a) [* K) J! z
   }
* b) R4 q0 S/ E4 b3 ?( I2 v   return FALSE;
! f- k0 U! _  l, W( g* O0 P+ o9 v}
5 s# a5 `5 @% x, K- P
* ~1 \( \$ v$ f) t9 |: U* A+ ZAlthough this trick calls the CreateFileA function, don't even expect to be
; Q/ X$ W7 ?- {$ C2 w, c8 }able to intercept it by installing a IFS hook: it will not work, no way!2 j& c$ Z: O4 _" e1 k
In fact, after the call to CreateFileA it will get through VWIN32 0x001F) E) x* G* q3 e1 K+ a" W7 I
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)) b4 m: B" E  M2 I' n# k# Q$ C; S
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
) \( I  i" c$ [  Wfield." w  j' k5 x; _+ t
In fact, its purpose is not to load/unload VxDs but only to send a
6 c* v2 P# A3 I# A1 O; X* m; s7 AW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
' y3 }" ~2 N( ~3 {to the VxD Control_Dispatch proc (how the hell a shareware soft could try
! O# f  a; w3 M% d+ l- Ito load/unload a non-dynamically loadable driver such as SoftICE ;-).5 P, E8 Q, ], Y+ a
If the VxD is loaded, it will always clear eax and the Carry flag to allow6 B0 Q+ T) Q% O& h
its handle to be opened and then, will be detected., o7 A' Q) d- ?, b. p' e
You can check that simply by hooking Winice.exe control proc entry point3 X- S* W* y9 a, G, F
while running MeltICE.- x  e/ P' }; ]9 @+ k6 c
2 E. |6 _% g- `
/ H4 _3 G9 U: q9 [
  00401067:  push      00402025    ; \\.\SICE
+ \' y6 ^" s# u6 C  0040106C:  call      CreateFileA: E4 o$ v$ r# G$ D3 V
  00401071:  cmp       eax,-001
1 }6 D7 Z% ]  W; S0 D. ^8 r  00401074:  je        00401091
* Y6 e5 R( {' @) {
6 F+ E6 f8 H% C: [: A7 }& z3 \+ f/ n) s
1 X0 \: ]* E! I$ ~There could be hundreds of BPX you could use to detect this trick.
1 G  b9 S2 V3 F* |( |4 S9 i-The most classical one is:
5 h3 t8 V3 ^# R# Z- ^( E/ s( o  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
: h8 G! V+ {( S& }& h0 ~    *(esp-&gt;4+4)=='NTIC': |! E. ], R/ i6 Y5 d# b( B) a

' c7 q" k, q4 y1 n! r% _, z: y-The most exotic ones (could be very slooooow :-(7 I( o( Y- p4 o8 P2 {6 c
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
$ @: E& j' z7 n     ;will break 3 times :-(
8 `- c/ P; @8 d& {7 q# R2 g; @# Y- ^. E
-or (a bit) faster: 0 `; _) e) b- ~7 j+ s! [0 K+ ]7 m. `
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV'), X. f# y' |7 K4 _4 ]8 M  C+ G# b
9 A4 l6 {/ i3 C0 y8 u
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
. r% {7 T5 u6 v" T! t1 R  a     ;will break 3 times :-(
# S/ y+ s7 c3 ]- s+ _$ `( f* M8 q  ^2 n* G/ X
-Much faster:
3 Z3 W1 k1 L! Y1 F. V   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'2 F4 m% E: B/ o3 Z
1 o: f% r0 G5 I! f
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
% ]! o2 R# S; t& o6 U' k7 Bfunction to do the same job:" v4 ?: Y* S5 p* x) \) k

" [  _/ R0 \  u" x( x" i   push    00                        ; OF_READ% Z& X3 v8 }3 p
   mov     eax,[00656634]            ; '\\.\SICE',05 W6 W2 H) m; ^5 q- m4 P( m1 r7 z" z
   push    eax) X* V1 W  s, M+ T
   call    KERNEL32!_lopen
9 N" r# K6 @( d( J% y   inc     eax  I4 U# {( j6 O% _6 A
   jnz     00650589                  ; detected
6 }# N/ F% B0 l9 s; g% C5 v& R   push    00                        ; OF_READ7 M& I) y- {* ?; t
   mov     eax,[00656638]            ; '\\.\SICE'
  |9 Y( E1 B! ~9 W; l* g( ?1 I: O   push    eax; a9 [0 ?) W& A2 i2 f: t2 x
   call    KERNEL32!_lopen
; D3 H, `7 r- e# J   inc     eax
" B3 T9 t- a7 E0 d   jz      006505ae                  ; not detected0 O) i. N( r* _/ y

- z' p5 ~5 k/ _% S- Y0 q4 }, k$ ~* F' x8 B0 c; m! U
__________________________________________________________________________* T3 a) ?& s, r8 P

$ u# J9 p2 V- V8 CMethod 125 l1 ~# e" y' L! n6 K" F1 n7 N8 |5 ?
=========
" B3 @7 D! C: I% z
- i3 l7 z$ X1 t. ]7 nThis trick is similar to int41h/4fh Debugger installation check (code 059 ~1 X3 D4 u( i; a7 V5 e2 c, ]
&amp; 06) but very limited because it's only available for Win95/98 (not NT)* |# K9 T  q) s0 ?; h  b/ J1 X$ e
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.# ?# p7 `* i9 @2 L+ p' H- F; S$ Z( H

0 c! e7 W7 {6 F2 K) t- Q   push  0000004fh         ; function 4fh! x5 p; n9 `7 Q, j* S; k  I1 j  [
   push  002a002ah         ; high word specifies which VxD (VWIN32)6 q" \+ f) h0 e* E
                           ; low word specifies which service
5 U" g4 [6 l" A5 M( y. g! w* F                             (VWIN32_Int41Dispatch)
! w  Y3 R+ r0 n: C   call  Kernel32!ORD_001  ; VxdCall+ e' U+ k$ K3 {( b0 Q# n
   cmp   ax, 0f386h        ; magic number returned by system debuggers0 e6 \1 U9 F- V" {  V
   jz    SoftICE_detected+ g7 J6 s8 f1 j4 `# o) r* F2 e5 ?
3 C; S  C2 r* A+ s$ P- |
Here again, several ways to detect it:& h* G8 N  N; @1 b& L# b

: G0 Q  C8 i1 q. k* V1 \$ ~    BPINT 41 if ax==4f
4 B! ^: s+ G5 x6 O% ^3 ^+ e$ K
/ v) Y- E9 n  B: {    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one8 ~5 _  v+ y) w% N5 l

" B( ^. {( {) z' O! q; {8 ]3 I    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A" f1 _/ B- j$ Q2 i% H8 F

9 o  ?$ T, P) t/ l# g- K* d3 |3 j" Z    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!/ c% L/ L& w! C) q: c
! I0 |% G4 L/ Q
__________________________________________________________________________
& W. ~4 J7 @2 B% \5 j, r% A
! q( G8 q) w; I) UMethod 13& c6 M+ z9 r# K1 F# n5 X
=========
- u3 e$ e) g! d& {+ U, J1 H: k8 t5 w) N; z
Not a real method of detection, but a good way to know if SoftICE is) M" X1 {( ?! h9 Z, j% z' d( Q8 ^
installed on a computer and to locate its installation directory.8 g, E) v9 A; [- W; `- U
It is used by few softs which access the following registry keys (usually #2) :
- A; X/ R6 f8 _2 K  c
. T& f9 k+ v. d: E9 D. `, _  l-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
5 h+ Z" h8 r6 g$ n\Uninstall\SoftICE6 g' x( U- l$ c# W0 a3 I0 K0 F  v
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
& o7 ?' b  L1 H5 f2 Q4 U0 K-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
9 C' P& z6 z3 z\App Paths\Loader32.Exe
  A7 a& o# [! r6 R! \. _, i* N4 Q; `0 [
" |% i, }& R% k4 N  M1 v* ?+ u4 ^0 V
Note that some nasty apps could then erase all files from SoftICE directory
% o2 b; o$ p$ O9 i1 W* a(I faced that once :-(3 B8 f$ z/ g4 k

7 e) t' I( \# m- H3 b" BUseful breakpoint to detect it:$ p9 j! r7 F8 ^) p
4 F5 D3 _) r: Z7 A0 R7 k- |; _$ v
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'* K; Z; f, L) ^" R
$ [  w& e8 b( O7 n1 c
__________________________________________________________________________
- m- H; F" K. ]. V" e# I
$ e3 m( l4 p; e- h* s4 k3 A9 ^0 g: l. {, M' p! [
Method 14 - x" t; x& c! Z/ ~
=========+ W+ @+ n' W( x7 s: ~" L4 Q( F
5 ~+ D3 f  v0 M% U3 G6 W# s
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose& k0 j# {+ I: q$ y/ Y
is to determines whether a debugger is running on your system (ring0 only).
* e$ \; e! ~% z3 G. ]: p" e
) x! p" q- K% @! k2 T: T  o& |   VMMCall Test_Debug_Installed, r. F2 {8 q: Q
   je      not_installed
2 S  i6 d' w3 W. {' ^, O; N, g, p
8 e; s: ~7 x  z6 \, {2 L6 bThis service just checks a flag.
  X& ^0 w; j7 k  q6 R</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-8-10 02:13

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表