About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
7 r$ v' W) q& B9 ]<TBODY>6 k9 r8 D' r$ a3 q+ J/ e, f2 l
<TR>& r. H% Y1 H1 a. {' {
<TD><PRE>Method 01 7 H; ?  x" f4 p. I5 z. d' R4 {
=========
$ e2 ?8 E1 D: V5 n- H( o+ q. w% n: Y2 b9 h# s
This method of detection of SoftICE (as well as the following one) is! ~4 C+ Y8 g7 g, ^* Z3 l, j7 H
used by the majority of packers/encryptors found on Internet.
9 ~1 X" j# w; \) g- n9 i3 qIt seeks the signature of BoundsChecker in SoftICE
. C8 E% l/ E$ H8 n8 [) P; r
6 i& i$ A! m  Q- U, X) W    mov     ebp, 04243484Bh        ; 'BCHK'
' v7 Y9 _5 r# |4 J7 {    mov     ax, 04h
- e& S: ?7 U$ T8 }  ]    int     3      
! w  T+ b6 }1 _) M& d    cmp     al,4
+ ]2 J2 s8 G0 s! X5 n7 S    jnz     SoftICE_Detected
( I3 t1 I# K7 L- k2 K
& J# W% E# [$ }% s/ y, S___________________________________________________________________________: s6 D6 X: g8 W; {8 y

% E, x  e8 D, N4 c7 SMethod 02
5 L- @# {' x9 S# O' T=========9 p7 S+ e, P: b7 H
6 U; y, Z4 @0 Z( r
Still a method very much used (perhaps the most frequent one).  It is used
2 s- z. u" T2 ?$ b- N, _: \$ i! vto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
8 E  u$ @6 x6 ?8 @+ aor execute SoftICE commands...1 n" i% m0 `3 w3 o; V
It is also used to crash SoftICE and to force it to execute any commands" P  ?$ _- i  Q2 w9 e& J+ g. S
(HBOOT...) :-((  # Q, V; O" H7 r
+ j2 M1 L0 Z/ b! @+ s
Here is a quick description:/ U/ z4 G+ ?5 c! H) N
-AX = 0910h   (Display string in SIce windows)
1 c- I- @+ [" \( A-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
; x) Q* c3 R, K. p$ ?; r# U" O-AX = 0912h   (Get breakpoint infos); p. \: E6 w  ]
-AX = 0913h   (Set Sice breakpoints)1 R. ]: e4 V& D$ _1 Z5 G  C, h
-AX = 0914h   (Remove SIce breakoints)
& Y5 N7 q: z$ y9 `% ?; R8 p2 H. M, g% u# N3 a. u# g8 g
Each time you'll meet this trick, you'll see:
+ p  v' K9 ^0 f! R-SI = 4647h1 R0 h8 o3 V* Z; Q$ A7 b0 L
-DI = 4A4Dh
% F, C6 F$ n% b" x6 o. V# aWhich are the 'magic values' used by SoftIce.
0 I9 ~% D) T3 u" @For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
6 w5 k4 J% R  a( f; X- i1 S5 j( r, C8 ~# U0 `, n% G# E
Here is one example from the file "Haspinst.exe" which is the dongle HASP
/ I2 ^# c  v- u6 m& O6 aEnvelope utility use to protect DOS applications:" [, T. k7 ?( s% ?6 r4 K$ n0 G! P

! g! @' S5 W5 o$ ^5 Y1 L; ?+ \8 m0 u; _/ |2 e
4C19:0095   MOV    AX,0911  ; execute command., Q- L  A2 l& h$ s% i" M* O  I
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).( F9 g5 v+ G0 L2 e" l( Q- l
4C19:009A   MOV    SI,4647  ; 1st magic value.! G6 r; ^- F4 z/ J
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
% G8 ^3 j1 Z; b$ M4 J( |4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
/ [6 G! ?% Y* L! _1 k- {4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
; n" r+ ^/ [2 z" p3 ~4C19:00A4   INC    CX2 B8 @3 F. O8 @
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute5 a. W1 x, h" U- d8 v' ?, j
4C19:00A8   JB     0095     ; 6 different commands.3 Y7 s) {. `: }4 W# C; I) Q9 I" J
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
2 @4 {# d+ b- C/ z, n! W+ l+ |4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
1 H: h+ v7 M" D5 A& i) Z4 O  K9 U% \4 a, i! T
The program will execute 6 different SIce commands located at ds:dx, which
. w, e: B# S. i) Iare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
2 W. O/ Z! Z; t8 ^, F9 L# A0 P( o# F! ^
  n) a. U( ?' |" w) ~2 |) t# [* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
4 y; h( \8 H$ G: `, U  D___________________________________________________________________________. h# o* p3 R1 x: o* c5 u3 `

/ b/ j: J& Q9 S# o) J8 c) C) H$ q7 }1 w
Method 037 n$ z: w6 z( K6 D+ T' K  v) W
=========
3 y" z9 r2 u  E5 F% p0 u4 X
- r% I" k+ G1 O" aLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
( ~; Q/ ]  ]) E! y( {(API Get entry point)
2 P% c; G- Z  v5 Y* ^/ y! X5 U1 P        3 x+ u7 o- E! a' D: l

" ]/ a" W+ |/ T, K6 [& }    xor     di,di) N% E% b8 b! e6 v/ y* {' l& h
    mov     es,di
/ z$ [3 K6 E/ [  V( N: W    mov     ax, 1684h      
/ U6 y* @/ B6 q- C( q    mov     bx, 0202h       ; VxD ID of winice
- S# w! ?5 [: e; S6 L    int     2Fh
* w# I6 p$ {: }  a    mov     ax, es          ; ES:DI -&gt; VxD API entry point
1 K: }+ d6 ], g3 N/ x    add     ax, di
' S7 ?) q$ b- g3 S9 b. k9 ?  n2 K    test    ax,ax
9 }# E* ?/ {3 Z8 K& l% {; r    jnz     SoftICE_Detected
4 e9 u2 N( ^+ t* ^! b  O: z! n9 Y8 a5 l& x" X5 B) @: J7 [
___________________________________________________________________________# P: }1 R& T& Y# Y, ^  ~

0 l. n% F' V8 H/ N5 E" _Method 04: n' ?( b6 W$ d/ s' [
=========
# v1 q! p7 T( b+ K% F- {; `1 t; [% {( x& ~, x  E
Method identical to the preceding one except that it seeks the ID of SoftICE
  V% i% c4 f2 v3 WGFX VxD.' m; b! F3 w0 m

' R( a  l+ [$ e  Y    xor     di,di, Z2 X8 v' d0 d) f- T
    mov     es,di
8 q/ i. S  p+ D8 |4 a    mov     ax, 1684h      
# q' S2 f1 i1 i" Q- e. r    mov     bx, 7a5Fh       ; VxD ID of SIWVID
4 y+ P, |2 `) J: r6 w    int     2fh' g4 K/ I2 s, d
    mov     ax, es          ; ES:DI -&gt; VxD API entry point6 ^. S# e1 w& p
    add     ax, di
/ p# R6 X5 l7 `, t: z3 |  ]8 ?    test    ax,ax
. N1 y( d. W* c- c    jnz     SoftICE_Detected$ q' ~: p+ O& d4 o2 _
; s, T  v. n" Q2 h7 E
__________________________________________________________________________8 m# ~- S7 ~8 z/ q! k; T

) A4 Z/ y' y5 G# A- h6 K6 s2 K: t& J
Method 05+ \! j4 r0 Q8 v4 G( I4 N
=========, ^3 M) k; f4 y+ N5 f

5 V, {5 e* H3 }, sMethod seeking the 'magic number' 0F386h returned (in ax) by all system1 E6 f8 Y) i& J
debugger. It calls the int 41h, function 4Fh.
3 `0 i4 {0 R/ BThere are several alternatives.  # D7 ]" K) \! P5 F6 B

3 L( o; C7 }- W4 n# j7 W( b2 R$ Y/ cThe following one is the simplest:6 `( v4 I5 l% @' r4 i( f

3 o' ~* Z, Z. l& i& n    mov     ax,4fh
4 N8 B+ w: h: p# O1 T. s( m. j# d    int     41h
' A' e9 S1 t% Y    cmp     ax, 0F386
7 t: S% D7 @: \( I# O$ X    jz      SoftICE_detected, w/ A1 _- z4 ~4 v5 B+ H

; R" i: z6 @& U$ b, y
% s0 k2 Z9 O5 t  O* l. |" aNext method as well as the following one are 2 examples from Stone's 4 B' ?% O+ C! i" N' u; d
"stn-wid.zip" (www.cracking.net):% T: Y5 M5 P% M( ^& }

7 f; N+ h! N' p: m5 C% V, ]5 V2 s5 J    mov     bx, cs
9 Y% ?( @3 z* O7 ?+ ~9 P    lea     dx, int41handler2
$ `2 W1 S: [( q1 Q4 k- g5 Y    xchg    dx, es:[41h*4]! r6 t2 w7 d1 ?* W3 k$ x
    xchg    bx, es:[41h*4+2]% @/ x+ D* M1 h
    mov     ax,4fh
. \) J( L6 n, N: b5 R  X    int     41h+ F) W4 `" W2 E' h5 o
    xchg    dx, es:[41h*4]  _. [1 x/ H- n. S
    xchg    bx, es:[41h*4+2]$ c+ l1 [2 s9 V/ k* }. C
    cmp     ax, 0f386h
' \0 `5 m) \: P4 O9 @    jz      SoftICE_detected
. C7 J) L- V2 ^% h& C  I
( N4 U( V+ A8 cint41handler2 PROC7 q* {; m7 M4 f. x& }& W+ e
    iret& m/ G* ]5 T# C
int41handler2 ENDP6 Y  [8 X, F, N: f+ }/ @) u; ~4 ?* w
6 T! u" k, s5 Y2 Q: {& L

; A9 x1 D) E* O, P$ M_________________________________________________________________________
3 _* g2 ?) i3 V! x' x( l
. `6 \2 C$ G/ \$ K" E* R! S$ ]- h$ l; [, f) {
Method 06
8 s$ ^2 F; X8 O3 N=========6 o; Q$ H6 f" Y" {+ K
; T1 Y  \3 L9 w

2 G) v/ c( u4 r7 r7 k6 a, P" C8 f# g2nd method similar to the preceding one but more difficult to detect:. _1 f! U8 z+ |! s1 F

& d, V. |. @3 `5 K* @/ G
# H$ n! o, {' B. b0 j% [int41handler PROC
, V: Q: O% x. ?8 m. T- \' X    mov     cl,al
5 ~2 L' k- S' [$ o2 q/ z    iret
5 U0 G/ O8 A( j* {7 O/ tint41handler ENDP9 C0 X, B" _3 f9 s: a

) x6 h" }5 N$ M$ D  a
* B1 L0 c/ M' m6 o) P  |5 P    xor     ax,ax
. T* s8 w; \, Z$ R8 d( F    mov     es,ax
' q$ d8 _8 C( \( u    mov     bx, cs
9 m: a3 I; `/ E% u) {, U    lea     dx, int41handler7 b: _. W, |! q
    xchg    dx, es:[41h*4]
) t- x1 c3 M) q" ~7 h, ?    xchg    bx, es:[41h*4+2]
" e- Q8 ]$ p' ^+ J4 Y$ X/ E, f& X    in      al, 40h7 V; }0 X1 k2 a2 i- e
    xor     cx,cx6 j4 B! R5 a: w9 F. J
    int     41h
9 f' O, R+ |* ^; Q% p1 L. _  Q    xchg    dx, es:[41h*4]
' Y- v6 [/ {: T3 b    xchg    bx, es:[41h*4+2]8 Q( x) t* k, r& n) R
    cmp     cl,al
( e8 d+ t% l7 H7 ^    jnz     SoftICE_detected
/ o+ h/ m) U, Q, U) R( c# t. R( K+ K' k+ ]. A( r( k$ A
_________________________________________________________________________1 P& n: x' \& N5 ?: [7 h1 x

/ e: l9 x9 k4 f/ w" j" U8 yMethod 07$ M, @" \+ ?2 {3 I
=========
, `$ A0 v5 Y& h4 N
8 N9 t; X5 W9 m6 V8 i& l- X. W4 hMethod of detection of the WinICE handler in the int68h (V86)/ b9 X$ s8 F5 p" H- u: Y% h; f
& i; p4 \' O5 G  p9 r. L
    mov     ah,43h
9 m1 J  \) w0 R  A    int     68h6 A  B! w: }2 l. h5 {- _
    cmp     ax,0F386h+ G7 \% w/ d3 u5 C9 T3 o
    jz      SoftICE_Detected" Y. e# t9 v8 {: m3 Z% q' ?8 V

/ I3 {4 Z5 x/ m- U2 F: ^/ p5 [
! t" f' l: S; ]1 ^! O* f=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
( _  \8 ~8 H- [   app like this:$ j# C: I  L, s% `" N; U7 H
+ q! P! a* L8 m
   BPX exec_int if ax==68
2 i- v( p- R. V9 y2 T! T! Q   (function called is located at byte ptr [ebp+1Dh] and client eip is
% I: [7 M+ ?  e/ f3 g   located at [ebp+48h] for 32Bit apps). X5 |0 f' |1 X" U1 z" T3 u+ I
__________________________________________________________________________
. Z0 M9 g- x2 G0 b- w  v5 M% L. m0 [  D  \1 Q7 s2 _1 ]: Y

# G  P4 z; }! x3 F% GMethod 08$ _% [7 ~7 V5 t3 w# R: I1 D
=========
* g) m0 o; F6 i4 c
1 d( b  O; Q0 N5 j, a. q0 q! _It is not a method of detection of SoftICE but a possibility to crash the
' T( O3 w2 D% p) y; S1 N/ }2 n& Q: c7 ysystem by intercepting int 01h and int 03h and redirecting them to another3 z' G# G3 m7 h3 m- O2 j
routine.  P! E+ H( ]% n, }" }! Y' Z! Z
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
4 ~1 A3 C% [  j0 n* I3 ]to the new routine to execute (hangs computer...)
  X4 Y: T0 @. E: U, ^; g2 P; z  @3 \( X" f/ g' h' o
    mov     ah, 25h
+ m# }: x9 B2 I3 R# L  K    mov     al, Int_Number (01h or 03h)
( x. D4 D! X* T5 C% U    mov     dx, offset New_Int_Routine# T3 |8 }6 E9 T/ t) n; q
    int     21h
3 B  y& i% S* w2 s) G
. H& N3 s) S- |4 ?__________________________________________________________________________
8 V2 Y8 y1 h. D: W( W3 b1 n0 }: |' n) z. Z& r' T/ Q' [) C2 U
Method 09
( N+ n9 }1 G# O$ x5 i=========
4 @2 K: b/ {) e, z- }& l, h! M( j$ d
; A/ i* `" ?) K7 h0 s9 PThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only0 t- @! ]$ q; U# U0 ^) q
performed in ring0 (VxD or a ring3 app using the VxdCall).
+ r5 R: y2 Z" LThe Get_DDB service is used to determine whether or not a VxD is installed4 j2 T, f: C& G0 P- j
for the specified device and returns a Device Description Block (in ecx) for
& r/ T! ~6 X* ?' zthat device if it is installed.2 C9 x7 S; ~! z$ b$ V
% S% q" {! F" [
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
6 u! J+ y1 m  l  C1 m* o   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)( E1 X. M# p2 C  j: j
   VMMCall Get_DDB
: }3 {( k8 i, v   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
* g) x1 {( W3 Q& Y- M+ g
6 L# `. }' h! _! l# d6 q2 C" _Note as well that you can easily detect this method with SoftICE:
' \( e( P1 i9 u6 j4 a1 _   bpx Get_DDB if ax==0202 || ax==7a5fh
) j$ a% z8 o* Y9 ^( w  E% O% i/ r2 B, Y9 V
__________________________________________________________________________
1 L1 v' d/ N2 U% g8 M
5 q( N4 p! U( QMethod 10
0 T) D" ~5 g! F9 k& C: @=========
+ E1 a  L2 q  \, `; R: c/ S$ Q4 G9 j1 D" T
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with) D& x0 p3 K5 Q, h) W
  SoftICE while the option is enable!!  o+ V8 ?! y, `  q$ `" ?
) h) v$ i, I$ R' l$ P' o
This trick is very efficient:
( w: r6 l* h4 k% L8 T7 x9 `  Hby checking the Debug Registers, you can detect if SoftICE is loaded
0 W) o% H! F. H2 D(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if. o6 X0 {: i+ n, P" G3 N$ R: F4 b
there are some memory breakpoints set (dr0 to dr3) simply by reading their
. O- m1 c0 h  q' G/ I$ L" ?value (in ring0 only). Values can be manipulated and or changed as well
# N9 u4 ^$ t; e/ B(clearing BPMs for instance)
2 F( {& @/ o4 B- ]' g6 \0 j) J+ w1 z+ G$ H- q! {
__________________________________________________________________________
0 W! a" z! M1 H0 |  x. {5 e6 x, y7 T( n: P& |) U  C- \4 F
Method 11
5 F0 O. f! W! C3 ^7 C) M1 p=========. @! A. F( a$ l0 m6 `; L* ^6 L

! o8 t) u- B& a/ LThis method is most known as 'MeltICE' because it has been freely distributed3 I; r0 J7 E% r7 ^1 b1 |
via www.winfiles.com. However it was first used by NuMega people to allow
& s7 k  ~  s* hSymbol Loader to check if SoftICE was active or not (the code is located
2 W) R* W* a, c; L2 Q5 }inside nmtrans.dll).
4 Z8 b$ `; y' F) O, O
$ l/ f" F- ~0 c/ ]; \The way it works is very simple:
% B$ n4 v6 r9 K  |6 C  i5 UIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for/ d* a+ }4 _5 X6 J
WinNT) with the CreateFileA API.  p5 w. j! E# B2 O  k/ Q

! I% N% S! {' w' SHere is a sample (checking for 'SICE'):
# [6 _  U$ I8 V# E) C0 s4 B" a: T6 [" I4 O& ^+ Y7 G. p  s
BOOL IsSoftIce95Loaded()" V$ z$ p3 ]+ A$ {- S
{+ h% X- z5 G% h9 I
   HANDLE hFile;  
4 X$ _# k* P- F   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,; Z  N+ ]6 ^$ ]
                      FILE_SHARE_READ | FILE_SHARE_WRITE,* u. Q4 z* a2 l9 h  p' B0 F
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
- v/ d5 O% A# |/ b' l% L1 c   if( hFile != INVALID_HANDLE_VALUE )  u: h; W9 L7 r+ \
   {* ?/ |# \, V5 j# N8 w5 X; }. j7 ?- P
      CloseHandle(hFile);
* D' L& V3 e" T+ e      return TRUE;
7 q6 O+ a& A, b' K   }
( ~; b& p! i% `) I   return FALSE;
, G8 M% E: D# m/ }' y- [3 Z}
1 v1 k6 f3 }0 `# \& W3 {/ G2 W7 c3 p% r
Although this trick calls the CreateFileA function, don't even expect to be6 U: x& Z. d  M; ^2 a  B5 M
able to intercept it by installing a IFS hook: it will not work, no way!
7 K+ T. d7 a& K; D' V# S2 HIn fact, after the call to CreateFileA it will get through VWIN32 0x001F% Q& T8 P5 Q( n# X5 C
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
  i% T0 G  I# d$ e7 N/ g8 rand then browse the DDB list until it find the VxD and its DDB_Control_Proc# W- Z# A- n" L7 |$ N
field.
; G. I  K( o# L& V/ T0 `4 @/ YIn fact, its purpose is not to load/unload VxDs but only to send a . J  y$ j( D. o  @
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)% w$ `: ]7 A. e- Q$ Y1 Z% {$ {
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
2 P. B2 f8 |: M  n2 S+ mto load/unload a non-dynamically loadable driver such as SoftICE ;-).
/ e+ x1 g- T; o3 e! FIf the VxD is loaded, it will always clear eax and the Carry flag to allow
6 y) \) ?; {  C( _3 E' T- u" m0 cits handle to be opened and then, will be detected.- e7 q8 C. e) a' Q2 g
You can check that simply by hooking Winice.exe control proc entry point
& n# j, k. @7 h# w+ x+ `* B8 A4 y" ^while running MeltICE.
+ {$ k9 O5 ?+ A4 z6 n* B9 y/ Y0 d( K! ^1 p
5 D$ d% z/ W- h, M% o" O) L
  00401067:  push      00402025    ; \\.\SICE
8 e3 V: P. @" O3 k( d3 g  0040106C:  call      CreateFileA" F/ u: {) @1 ?
  00401071:  cmp       eax,-001
! D; P. X( Q  j& d  00401074:  je        00401091
. V8 M( \$ b& N; D+ s+ d0 Z3 S* X  g; J! [2 f

% `# W/ L1 A/ _8 r3 Y" Y' J. IThere could be hundreds of BPX you could use to detect this trick.( S5 @7 M% e* ~' h: `
-The most classical one is:
8 z3 Y4 w$ w1 d  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||/ ?. |$ c6 e2 f! x# e
    *(esp-&gt;4+4)=='NTIC'
% l" ~, h4 ]; W; Z3 [5 v. k" Z* M- F' K* Q( i% L4 G- b& h
-The most exotic ones (could be very slooooow :-(' g  S, r2 U/ G7 i- d1 d
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  7 K# i! V+ w& u. R
     ;will break 3 times :-(
& l9 ]9 T4 R: x( V5 s' \( |0 F! g( o0 d( w+ M
-or (a bit) faster: 0 b( D! [! {5 Y. P8 s
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')" I6 U$ }. u2 q' }. t
6 {3 _: P# e) r6 @1 o; S1 |
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
; p# O0 d$ Z# _3 R7 F+ i% o& w     ;will break 3 times :-(- T! r, K4 [) z
7 b5 @3 C' G1 B* ]! v- q
-Much faster:( T* ~$ z8 Z  s2 V; u( i
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
- G- V( a' {4 t" Y! v( u; s/ @  H1 N4 f( E7 R4 l
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
4 Y6 d- w9 N; O; ffunction to do the same job:5 U; \; N+ F4 D, E

1 [" u& e2 K* u" x$ G- S/ ^' W   push    00                        ; OF_READ
2 x( }# K4 B( U/ D9 N% r# }3 g   mov     eax,[00656634]            ; '\\.\SICE',0! F: L6 Q3 K: O5 n3 M
   push    eax% _4 O5 w8 t6 ]5 g; W$ {6 `7 A6 u) `
   call    KERNEL32!_lopen
; z) N3 k  e& N6 m3 H5 `   inc     eax% d. _8 Y4 r* G# u  V
   jnz     00650589                  ; detected
/ P1 d! s+ O0 t5 U" x* [2 x7 l2 r5 l   push    00                        ; OF_READ
8 T8 R2 `2 G5 o   mov     eax,[00656638]            ; '\\.\SICE'( }, q. f8 t. `5 s% D
   push    eax
( `# ?! H& i7 N. _# X( B! J" q   call    KERNEL32!_lopen
. E8 w) z0 l$ I4 {+ P   inc     eax
& n# o4 A$ Y  c# F: I, c& u   jz      006505ae                  ; not detected3 K( k* k4 b7 u# ~
: i* V% _& |- I9 o! `7 D% W
" o: k1 c$ ^& C+ O
__________________________________________________________________________2 C9 f" g9 d( r8 W! m6 B) v

5 J- }( k1 K7 [4 ]2 C/ w/ V6 nMethod 12
2 O% W$ _5 N3 j) H6 b1 _6 B% |! X$ O=========
( b- D$ w( e. ]% f  u# d; @9 l0 k# t! t
This trick is similar to int41h/4fh Debugger installation check (code 059 w' v2 Y7 j. G, ]
&amp; 06) but very limited because it's only available for Win95/98 (not NT)
$ Z" R" q8 g9 tas it uses the VxDCall backdoor. This detection was found in Bleem Demo.
. V  q9 j9 Z% ~, J
/ _4 W/ S, |, C8 ]6 a   push  0000004fh         ; function 4fh8 c! d. A! s" Z+ S, X* i* W) d9 A
   push  002a002ah         ; high word specifies which VxD (VWIN32)
; }- W1 o) L% `; w                           ; low word specifies which service1 B9 _& v; t, U+ d1 F7 M5 y1 F$ @
                             (VWIN32_Int41Dispatch)
. m& z4 h" C& |) Z   call  Kernel32!ORD_001  ; VxdCall1 ]/ T+ C' P9 Y6 i' x: S
   cmp   ax, 0f386h        ; magic number returned by system debuggers; S7 K4 \( j, T! T. J
   jz    SoftICE_detected4 T; e) G$ N; S
8 i% O: c4 Q" L9 R0 w
Here again, several ways to detect it:
' i7 F; _4 Y1 O0 T2 t
1 Z0 h8 {0 @$ K" }; E    BPINT 41 if ax==4f
2 N9 M4 i9 }, k3 F" M4 @  o3 E- G5 f* F
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one2 t& _- f* g2 ~% h  s4 z- q1 t+ d

9 u9 i( \5 t4 Y    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A% v5 T/ ?! }. Q. l% B+ G

+ a; \, V/ M; ^) y& ^    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!7 Y" u/ r8 f3 v5 j

: U+ l* B. d+ y4 [  w( s& w3 k__________________________________________________________________________, A, _9 q* Z9 N' U

% B1 S5 r# s" `3 i4 z6 i; [. JMethod 13
8 m$ U3 k! k: Y7 d) e5 I6 l- o=========
+ r/ n7 `4 L5 g' f& x/ j
0 a( _3 @5 ^$ @; p* n/ }Not a real method of detection, but a good way to know if SoftICE is1 o/ x2 h' }/ i7 R5 r* L
installed on a computer and to locate its installation directory.  K! m. b, t. j* Q0 I$ o6 W
It is used by few softs which access the following registry keys (usually #2) :. p7 B0 O. {- _! s7 ^
( M. T: c8 s: K3 B2 j7 Z
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
/ ?$ n5 n1 u: W1 L+ R1 a3 A\Uninstall\SoftICE
8 o' P, A1 C! F7 C-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
* S& v. P: ]5 j3 ^-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion6 L! ?6 ~$ y  ?9 ?) \
\App Paths\Loader32.Exe
6 d% U# O* E: Y& Y+ [9 {( X+ D$ O5 S+ D  H) R$ m& q
1 o+ D3 x4 V( \. D% H: l% k$ d
Note that some nasty apps could then erase all files from SoftICE directory
) ?  x/ i" K" A4 s(I faced that once :-(
6 e2 r4 ^! m% k. a5 Z- @
. ^$ x4 N. ?7 ~4 iUseful breakpoint to detect it:" [; z# L3 ]3 |1 [+ Q+ e1 ~
" X% Y7 D! |% e
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
0 I( W+ {6 ~; `5 m$ f
3 w9 L6 O0 }) B2 q& e5 p, C4 l__________________________________________________________________________
9 K& m. @% W6 }' ^% O0 G1 ]8 p# F$ V$ p* {. r$ I4 c& u

1 F- N! W& H3 YMethod 14 # U' `: T0 L# L' C: d( x
=========7 |' c5 w$ \9 t2 {9 a! j
6 k( K) U! |7 T/ y0 A) }/ F
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
  T3 d1 C/ _; _! X6 ois to determines whether a debugger is running on your system (ring0 only).3 b  z% b1 v3 m" B4 y( t

  K: o3 ]( ~: [0 o   VMMCall Test_Debug_Installed
3 }1 ^, G6 Y2 s; G/ }1 }   je      not_installed3 q. r# T3 y3 ?' w* S
, t" @1 }/ `) j- _. b
This service just checks a flag.
. G2 b9 X" K7 ~4 h2 D- r. A</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部