找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>) X$ g; @0 ?) V+ s5 A2 h0 B6 w9 ^  `
<TBODY>1 t% v5 m; _* q7 v/ m# \
<TR>; a+ \, f; G9 g2 g" A' j
<TD><PRE>Method 01 9 p) }( d2 t( F$ I9 }2 N
=========7 C5 [4 H% L0 u( u; k& V

+ O+ W) U0 p+ YThis method of detection of SoftICE (as well as the following one) is
; W5 F8 q  Q! e, ?used by the majority of packers/encryptors found on Internet.8 Q) y' F) H* a% ?
It seeks the signature of BoundsChecker in SoftICE
, d) H2 `5 ?, s  x. ]" E2 V6 F  H& e/ u& Q
    mov     ebp, 04243484Bh        ; 'BCHK'
( t) b- F2 _3 l5 Y    mov     ax, 04h$ D( ^$ f' Z& d& ^+ ?
    int     3       # m, z6 E' B! \" P2 N7 j
    cmp     al,4
. H4 x! Y% O5 b; G+ S4 C    jnz     SoftICE_Detected4 L6 C5 r* m( T) C% Q

$ x3 j- u: }- X5 W3 ?, k8 b; E___________________________________________________________________________
- J4 [4 ]( j0 O6 P# i4 C9 H3 |& M1 T
Method 02, o  I* |) {  L1 g' C+ L: M% k) `
=========* ?. C* O1 O& D5 V) \% g. B

% T6 L. }9 C: u& X" G3 H8 GStill a method very much used (perhaps the most frequent one).  It is used
  n! _( S/ N& }' g. T- K7 Bto get SoftICE 'Back Door commands' which gives infos on Breakpoints,/ Z: W- L: O2 ]  v+ c
or execute SoftICE commands...! b( e6 U3 Y. p2 Z/ T  M1 a
It is also used to crash SoftICE and to force it to execute any commands7 O7 Q0 [8 E8 v) Z& E& a
(HBOOT...) :-((  
- V3 K5 D: e3 R" P
& x+ o& s  w1 s: Y0 h) |: e/ L* r( HHere is a quick description:
, o2 C" F  B: t. Y; L' R-AX = 0910h   (Display string in SIce windows)
+ W7 \, x6 X0 O; ]. k# V5 {-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
  @7 \- e( `# Z1 {! e-AX = 0912h   (Get breakpoint infos)
- f  X$ n# u3 R, v( ^+ M-AX = 0913h   (Set Sice breakpoints)
- g5 w: {2 _! o' P+ ~; U4 h, y* V-AX = 0914h   (Remove SIce breakoints)
( R) p4 |+ @6 N8 `7 @0 X# Y- O
- m; G7 h; A/ Z4 b, hEach time you'll meet this trick, you'll see:
1 y3 Q9 ?; z! [6 n( [-SI = 4647h
9 l8 s1 @) n) c3 K: v: j-DI = 4A4Dh. b% B. C+ P1 C" Y+ t
Which are the 'magic values' used by SoftIce.+ `& W* S6 C& x+ a
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
) ^7 S1 z! A% _* k- |( g1 p
0 q; p2 e9 [* N( ?% d- DHere is one example from the file "Haspinst.exe" which is the dongle HASP6 j/ B: w0 Y8 ]1 A0 D9 H( p9 G- _
Envelope utility use to protect DOS applications:$ Q- g+ z( z6 f
6 Z. `; Z. L6 X* v' {. p3 b
: E: s. A& f# ^, ]8 ^3 _
4C19:0095   MOV    AX,0911  ; execute command.7 p! X+ B( y7 l3 ~( w( b
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
! G- f) E0 J9 ?4C19:009A   MOV    SI,4647  ; 1st magic value.
. p; f9 O! b7 |' ^4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
  M6 Z2 Z6 \) F4 l* v' u+ P4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
# @8 e3 m5 F* W9 z1 W) F7 z" b1 l4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
7 _& Q; p+ Q. e& q' ^4C19:00A4   INC    CX8 d' @- x- ]3 Q  ?
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
  s+ U0 i3 [- R+ {6 ?) ]4C19:00A8   JB     0095     ; 6 different commands.& G7 N& V1 ^8 M! Z6 Q$ T
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
+ G9 d. e$ _8 K, u9 r3 k6 ]4 x6 m! O1 Y4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)0 j; ?" j: W! d6 e. A

# D' x' j; `. m& _* PThe program will execute 6 different SIce commands located at ds:dx, which
* D9 Y& A) p' D! {$ N: Ware: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
- Q' a3 n" s5 j9 Q" z) M+ T; z+ f- t4 `8 U( I2 k- C1 w& Y
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.. z! c0 `$ |! g; L" j! h- A* o
___________________________________________________________________________
$ v, ~* z# w6 V- O/ r' P* l5 H
1 ]" g: W/ d% A% B! o: o8 \  `; c
Method 03
0 ]9 S6 Z2 a$ l- q- H5 [=========! T$ S2 H# e8 H' w/ C

  v  C' x) B7 l: t. i& p& h) hLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
. y. J1 p% Z  [3 G# |(API Get entry point)
7 o  H6 Y/ n( f% ?. _        $ A; Z* x  m+ M- [  e9 ?

: M7 j9 T% u, c( C# p$ i; t! d/ v    xor     di,di8 g+ W8 Y5 P- b) S7 ^
    mov     es,di
+ B8 U: x" D; K    mov     ax, 1684h      
2 h  v. }9 h" e6 q$ l* J3 R; h3 x7 ]    mov     bx, 0202h       ; VxD ID of winice% ]8 I" J  e$ j; j' x% g
    int     2Fh
! V" @+ d. h) E- B' J- g' S2 b' W    mov     ax, es          ; ES:DI -&gt; VxD API entry point
6 F& ~* `  H* h5 {' H7 X( G) X    add     ax, di2 u8 q; t( n; e
    test    ax,ax
- v- B) k% U; D" N    jnz     SoftICE_Detected
* j4 H$ [- _+ s$ z% C4 i" m$ N/ M: v; ^$ g  E/ z4 t
___________________________________________________________________________# d! z: o& C1 T. k" v

& C2 H. o# W5 l7 |8 S. h" T. zMethod 048 P5 ]; ~$ b5 @! l- F, U  X( x
=========
: F- Y: T( x8 [' L
2 ?% e0 K+ ^. y( D& Y0 O/ fMethod identical to the preceding one except that it seeks the ID of SoftICE! P. I5 S% {; D" L  f. D$ S; @
GFX VxD.
$ i) a+ g; n2 S: }9 _& j
. D. X. s; a3 K- E7 l2 b( S. ^' y    xor     di,di
- g' a& T! e9 j* {    mov     es,di, V8 ?4 u7 w/ |* r2 c6 X! c% D
    mov     ax, 1684h       8 T- D/ u* M  ^+ b' G5 c
    mov     bx, 7a5Fh       ; VxD ID of SIWVID- v5 E* c: I6 a7 a% R
    int     2fh8 x% m! Y3 s$ U: L* g% f
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
/ h" d' V$ m0 J: z    add     ax, di
' q; U# A! ?$ b7 H    test    ax,ax0 z- ~; n3 J: j" Z4 b1 V
    jnz     SoftICE_Detected- H1 d9 q- v! n  U

: Y4 m! K# b2 U__________________________________________________________________________: d8 Y( _8 x' J4 u
. V7 E0 }1 ], h) _4 C. ]& W/ I

# {8 n7 ?, ^0 M) G4 i: O6 ]+ {% _Method 050 `) G& P! Y: V7 [; k( t. L* l
=========# d4 n' D4 x5 y+ e; J/ T6 |
0 B) u0 x6 ^* D3 Q+ R
Method seeking the 'magic number' 0F386h returned (in ax) by all system
+ o( x0 N! `2 p/ Odebugger. It calls the int 41h, function 4Fh.0 ]& t, }5 }2 D- C& ^- F  l
There are several alternatives.  * f, S' {/ a8 T! ^4 }/ e
: z( i. t" H/ U: B( q) f7 ~
The following one is the simplest:
7 O  ~6 L& v) k/ \8 V+ M. `9 V8 i6 r' x9 B/ w% E1 o8 J. |
    mov     ax,4fh
6 w( {- h& f+ F    int     41h
9 ]$ u0 j# f( L. L0 U    cmp     ax, 0F386
- @: F" G% l" d1 E# p1 i  a    jz      SoftICE_detected/ W0 @/ g. J; M
' \! s7 L+ `+ A6 q5 M
* ]! y+ f8 E" M" a- A. L, B5 d
Next method as well as the following one are 2 examples from Stone's
% u! p6 z) E$ B"stn-wid.zip" (www.cracking.net):
% u! @$ i$ U) k6 P  u; A0 g0 o
' j+ S0 y5 v( J    mov     bx, cs) a( _( J0 D/ H( O2 O8 r
    lea     dx, int41handler2$ Y5 S4 U: u0 X0 }8 ^  W3 E7 D
    xchg    dx, es:[41h*4]
" p; v- P: v% X/ M5 C    xchg    bx, es:[41h*4+2]& S) I7 P  I4 a0 n
    mov     ax,4fh
+ T1 l: z! Z/ b  L    int     41h2 w! I- d' Q8 y- {0 h
    xchg    dx, es:[41h*4]- U6 X- P/ O8 O* V
    xchg    bx, es:[41h*4+2]
- p' g  ^6 F9 o% f    cmp     ax, 0f386h) o8 ?. ~9 R: ?9 w' i, d  e
    jz      SoftICE_detected  a, U# G2 f+ a: S0 w

" {9 L7 [. ~8 N9 H  G$ g6 ^& xint41handler2 PROC
5 W; s6 V4 t! g    iret* o9 D% m2 A" l' y) W
int41handler2 ENDP
+ M6 q7 i2 ~" c( x! k7 ?; |( \" y2 c2 x+ [& C

, o/ t% T9 [7 a1 s3 V8 W_________________________________________________________________________
1 V7 P+ h, i% Y
0 ?0 Q" m3 ^0 v3 j
3 y. A$ z- G4 }, MMethod 067 Q% h( G' J$ w* @: o+ n
=========
7 g* Z  r( }: F, D, Z
  |/ `' Y+ {& P: {7 P& T( }* F" T" t0 r$ \. G" E* w, R
2nd method similar to the preceding one but more difficult to detect:
; @" S* K* c$ O" g. `9 E7 Y) f% O- I  _0 m; t- m$ t8 M- U! P

7 K" K2 C& Y5 x8 a# A, c" g/ Nint41handler PROC$ h- C# W$ R  ?& E+ x( z$ s
    mov     cl,al
$ ~3 Q1 F  ]& l: U5 [    iret
5 K/ O- o  ^, |4 Q& \8 o1 vint41handler ENDP) `2 M0 G% c; F1 o6 t. ]
: G. G7 i1 |) f, X+ b5 @' N

, j0 z/ q5 a! T# D" Q. t" ?    xor     ax,ax8 F4 v6 e4 O/ W2 u; @
    mov     es,ax, c, q$ d( h3 ]+ Z
    mov     bx, cs
8 @5 L4 H+ b9 V: M    lea     dx, int41handler
9 Y1 S. \! C5 X! s    xchg    dx, es:[41h*4]
& }/ {" U3 @% b! D* u    xchg    bx, es:[41h*4+2]; p2 y5 z% T: k  K7 U" Q' b4 E
    in      al, 40h" I+ L/ ^1 V0 w0 y$ l' G& Z; f
    xor     cx,cx' N0 `  C; H( T6 B, B/ z
    int     41h6 }- r: F/ R$ o  b9 u2 t
    xchg    dx, es:[41h*4]
$ |: y" P3 a+ n0 ^( m0 M3 s8 \    xchg    bx, es:[41h*4+2]4 T& I: w1 N# [% ^# ]' C% @3 L
    cmp     cl,al; N$ T9 D) ], `9 B4 y
    jnz     SoftICE_detected2 ]& u. o0 K4 Q: t! n9 W

- m9 I( v3 L' Q' w: W6 I' r! Z. u_________________________________________________________________________0 Y8 n$ m$ I: n+ q
9 ?: F1 [) n4 I" a) i2 \
Method 07
5 s7 n: x: ^+ M+ F=========
3 d8 U6 q4 v: g' Y+ |. w. F8 I/ O1 w/ W
Method of detection of the WinICE handler in the int68h (V86)
4 L. E( q" |: J) c4 o. n7 S2 i
, r* n3 c+ y/ E    mov     ah,43h; b, f- N( H* U! W. w
    int     68h
) X  O4 }; Q) t2 \  C" ^+ x# e" ~# w4 t    cmp     ax,0F386h
4 T6 Y  }- k7 a7 v8 A2 o    jz      SoftICE_Detected
- f# Z& X& G% o0 D3 {
1 h9 M  [" i: V) H5 h1 I" U9 {, ?2 c+ ]( @1 Q
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
! M1 a8 ?- P' ]5 T  n   app like this:/ W: A8 |& I( Z
6 n$ `) p# }/ {: x( }
   BPX exec_int if ax==68
' O: S9 f( n5 P4 q( ]' V   (function called is located at byte ptr [ebp+1Dh] and client eip is' p7 T+ K$ X. q# W$ {% N
   located at [ebp+48h] for 32Bit apps)5 e2 Y( U  w. [
__________________________________________________________________________5 w" X" H! ?3 h6 V& B

* S- l- D3 u2 o3 y2 @8 g- c# `& f% _* h+ z
Method 08
8 ^. ^  v; ^! Y=========+ C( T4 o* C2 e5 X: K% V

" u8 S# W- D0 b  WIt is not a method of detection of SoftICE but a possibility to crash the
$ N: u5 J  n, B1 Z' t$ Wsystem by intercepting int 01h and int 03h and redirecting them to another
) N! H  X3 v1 Z' [' mroutine.
6 a6 }6 I* }) c* a2 x- JIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
4 t5 p, K+ l- ?to the new routine to execute (hangs computer...)
8 h: X( t3 `* U/ J
4 r% S0 E0 |( t2 m9 }    mov     ah, 25h
. `$ S$ n( p  B, ^. t0 k    mov     al, Int_Number (01h or 03h)
" [, A$ j# ], m: z$ p+ j    mov     dx, offset New_Int_Routine( M) d, c$ T. v# B8 F
    int     21h
% f* y5 ]9 h( V- r& s. _/ f% p$ e9 [: a" V) W! a. m. h6 ?4 S8 S+ Y- u
__________________________________________________________________________
6 J9 C! C+ P+ ~9 w# k& `8 @" Q6 ]9 \2 s1 ~
Method 09% j  C. V! J+ @  b- L
=========
. c% H6 {* B, u4 j: {# l6 Y7 G& ?! a. w" L5 s/ l
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
& [4 N# S* E: ~; b8 k* l2 i) uperformed in ring0 (VxD or a ring3 app using the VxdCall).; I5 ?! g& n5 I: T* K/ F# B/ U
The Get_DDB service is used to determine whether or not a VxD is installed! |7 o6 J2 i% H4 C6 j5 |6 x
for the specified device and returns a Device Description Block (in ecx) for
( _! A, B% v- K8 g$ a2 s6 C* C) Ithat device if it is installed.+ D, l! ]/ f. h1 y

  S( @1 G0 o) p+ `- B  S* h   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
  ]- o- w3 [9 x: B   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
( i* f$ U' w8 Q0 ^   VMMCall Get_DDB
( `* L" S) ^& [6 }0 g/ L% `1 X   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed* b( G6 l  J, c3 W) q
. V. j6 T3 H6 l
Note as well that you can easily detect this method with SoftICE:
& j% I2 q% o( e* b- k+ c0 ^   bpx Get_DDB if ax==0202 || ax==7a5fh
" w0 g! z0 b! @; z* p. m6 H* h3 g+ u0 g7 u' F
__________________________________________________________________________
4 C- ^/ U' Z" P& Y( k4 ?4 t: ]$ ~% i0 ?6 L' b( Q' t/ q
Method 10$ k) B0 M0 C& T# ]# G/ X( V% [
=========
7 D: Z+ X; t; q+ k8 x( |$ v
' z5 y7 c/ T! i* B" D=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
8 n7 g4 ^- O1 b; K5 M2 G8 a/ m  SoftICE while the option is enable!!
+ r/ M# d6 i/ L" h* _' V: O, x# a! @# d% H, E  j& A
This trick is very efficient:
2 d% B- x+ S9 a8 W8 Mby checking the Debug Registers, you can detect if SoftICE is loaded
/ j3 w% q! H9 I' b: P  w! Y' J(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if  ?; e1 l; ~2 @/ ^9 k
there are some memory breakpoints set (dr0 to dr3) simply by reading their9 j( j1 q' v/ L/ X% L0 v
value (in ring0 only). Values can be manipulated and or changed as well
5 \# Z4 i7 S1 k! a$ w' a(clearing BPMs for instance)
, B7 G! ?) K5 G4 P: ~' ]: t5 V; |( I* r1 R( N7 l' k
__________________________________________________________________________
% l0 b: C0 N  P2 p  A  z( I6 w/ L2 O( `8 g2 Y- Z7 ~
Method 11; P: A% Z: C, k) R+ j
=========2 I& o0 s. W+ \
7 T' H0 B0 `1 a; C0 H9 x
This method is most known as 'MeltICE' because it has been freely distributed
* _0 _: R, x$ F4 b: X% s- I  v1 H" U! svia www.winfiles.com. However it was first used by NuMega people to allow
% \+ ?  }6 }5 K% vSymbol Loader to check if SoftICE was active or not (the code is located: d( y  q  f" G: [
inside nmtrans.dll).
' d6 P1 o6 u- f! z& O8 V
: G( h" U. R# @# J8 BThe way it works is very simple:
# l7 P- V$ Z, Q+ G- [, ~4 bIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
2 Q4 T& o9 q+ ?, S8 m, ?WinNT) with the CreateFileA API.
( [2 I, ?' P1 c& j3 C% u- @" r( z; u& P
Here is a sample (checking for 'SICE'):
& T) D# R5 A- x* d' H
5 _/ ~$ \" `+ @. R0 L* Z% E" C1 tBOOL IsSoftIce95Loaded()
3 s$ K4 a; L& z{
2 s8 t' U7 g$ W- k% |( |+ w. K   HANDLE hFile;  1 K) L# {5 S" C, I  Z5 J5 F, m$ l, f
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
9 b6 w2 i2 q4 K; D2 F! V/ L4 T                      FILE_SHARE_READ | FILE_SHARE_WRITE,' Y' G% ?+ M" j) ?
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
, I/ c; B0 z) h/ {0 n- `5 L2 e/ Z+ z   if( hFile != INVALID_HANDLE_VALUE )
3 T1 w# y. @$ `# u   {6 B( R( x4 y1 f7 n7 e
      CloseHandle(hFile);; x$ W' s2 y9 K) k  |) n- K
      return TRUE;
+ I# K: W9 r9 E4 R; s- h   }2 s  \2 K% m  ]% x$ t' g
   return FALSE;
1 ?* s4 ]7 D. ~0 I0 a: q* q1 s}
- d/ v/ o" A% m' [' l
4 R1 V9 y! m# l; q5 F( w8 l% F6 {: _Although this trick calls the CreateFileA function, don't even expect to be
1 {8 W) d( e- S& {6 {/ A- o' T. Aable to intercept it by installing a IFS hook: it will not work, no way!
& \6 z* i4 n! D5 c+ c; OIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
6 T) }. e  V' c; d6 O! ?service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
2 E$ m: w+ l: F4 `# \% e" Tand then browse the DDB list until it find the VxD and its DDB_Control_Proc
" m3 ]* B- P, w( R0 dfield.
; P  B% ~$ L; w4 Y& Q+ uIn fact, its purpose is not to load/unload VxDs but only to send a
2 L/ _# C/ U% b9 U/ k% g# e/ RW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)5 T/ I. M+ ?0 [+ D4 k; ?+ k+ x
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
1 w6 K# `* G/ K7 t* r) yto load/unload a non-dynamically loadable driver such as SoftICE ;-).8 `. v6 g) @7 v/ _
If the VxD is loaded, it will always clear eax and the Carry flag to allow
* P6 L2 i$ A/ @( R1 dits handle to be opened and then, will be detected.
$ {# A: J" P" ?You can check that simply by hooking Winice.exe control proc entry point! w  ]8 P" P4 z; ^
while running MeltICE.7 |" Y# v4 D' s. t% I

- K; x) S2 W# t; Z: D$ @1 L2 I; h6 `' |
  00401067:  push      00402025    ; \\.\SICE
& N+ R( }; {' T: v; V0 ^: `* A! W  0040106C:  call      CreateFileA
& p1 F) b2 x3 A  00401071:  cmp       eax,-001
( L+ x, S; `5 W% {" O, o  00401074:  je        00401091
2 e: K% B5 {3 D6 R# t; |
$ s7 R7 C) @; t5 H7 s# q/ ]5 s: Z3 b; W, }0 c
There could be hundreds of BPX you could use to detect this trick.
; e7 n0 Z; y, S% d  X% a5 w( s-The most classical one is:
: |# x8 V* R5 M6 _8 y. R" \9 N  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
, e. v% W3 I# o, w    *(esp-&gt;4+4)=='NTIC'
% U% n# Q1 J( p* P  [4 e& P1 v
" [1 V, Q# k6 X& \" d+ G8 ^) y/ p-The most exotic ones (could be very slooooow :-(
2 z0 S  O! B0 K" I. e   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
# e* ?& `1 \# u' Y     ;will break 3 times :-(
/ I7 @0 F( w7 a8 `2 G* J7 l0 ]& _6 u6 A% ^
-or (a bit) faster:
- K0 m( f' K6 k2 N, _   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
) Q4 x5 O/ z5 x
4 q& C& q( ~0 v! K  j   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  6 c( n  _: P: _$ ~1 Y' s0 e
     ;will break 3 times :-(
8 F  j6 o; a- I0 ?8 z( T- Y  j1 m/ b
/ ^) D, n4 B) L2 j6 a6 _-Much faster:
  G4 m; c; |/ t8 n   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
% K3 D+ E  p' j+ x; I! P, L9 Y) N  U/ x- x  k  I
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
0 Y1 m. @7 l* n+ x* R$ X( Qfunction to do the same job:) H$ M0 W! d% C+ q5 M/ k9 r: W" g0 }

5 Q' U. I' B! b   push    00                        ; OF_READ
5 S5 a- b4 k# d4 k) H   mov     eax,[00656634]            ; '\\.\SICE',0
( j% c1 b0 S6 d1 W5 @3 y& _4 q   push    eax4 }! B" O0 M1 ~, X
   call    KERNEL32!_lopen
8 K. e1 t& l! N/ E4 [   inc     eax
$ B, C( y% |, C   jnz     00650589                  ; detected- i, Y. i# I: a% f6 `9 j3 @
   push    00                        ; OF_READ+ J6 d& A4 x, V/ `$ I3 q
   mov     eax,[00656638]            ; '\\.\SICE'. @9 N4 D8 \, b& X4 x# f) f# f$ M
   push    eax
# X' B* [- f' {. M; B   call    KERNEL32!_lopen) [5 G9 s* T# F
   inc     eax. ]5 a* C2 f3 t% \: E
   jz      006505ae                  ; not detected  d* N  |# t& i1 D! b3 z

+ c9 k9 P' L0 U: V$ r8 z$ ~/ j) J0 b7 }- ~
__________________________________________________________________________; u! r* p5 a; j% }9 |% C
6 o8 F! Y- Q# ^! g# O
Method 12/ o# b8 N$ G# L+ s4 L0 Z& Z
=========* w6 M  v& P7 Z9 A. ^+ |. J3 C5 g

- e5 J/ P% m/ [) u2 e& b. }. q2 ^This trick is similar to int41h/4fh Debugger installation check (code 058 ^5 L; x6 u+ p
&amp; 06) but very limited because it's only available for Win95/98 (not NT)
6 y' N( @5 G( z0 v: H7 ~" sas it uses the VxDCall backdoor. This detection was found in Bleem Demo.
6 w: f6 J5 O" |0 T  O- L
, _! I6 |$ f' ?: M   push  0000004fh         ; function 4fh
. x" N% H3 Z9 O- v7 S   push  002a002ah         ; high word specifies which VxD (VWIN32)
; K2 Q. V+ s& ?$ E1 E                           ; low word specifies which service
$ i( O8 V3 e7 V9 D  D) T                             (VWIN32_Int41Dispatch)
) f6 @  z4 g+ A  m0 N   call  Kernel32!ORD_001  ; VxdCall
2 q& G5 ~2 ~" \/ A" F3 V4 h   cmp   ax, 0f386h        ; magic number returned by system debuggers
2 c4 `: U/ P1 |   jz    SoftICE_detected' o+ W  ~" q3 ~# O% Q! Y  x- e' y$ C

  j/ ]3 A5 I; THere again, several ways to detect it:+ Y3 Y  L; F& l# v) @9 \, r" z

/ h' x8 {5 h, ?  u7 h2 A& G    BPINT 41 if ax==4f$ e  O" M' o( H6 x- e/ T! ~, a
9 G- i5 u1 C- z( _; q
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
0 t; W3 B1 j1 A2 n* U. @5 W  [: J$ h  u- S. \
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
; O" v1 s, i  t0 j. W
9 t( z, R2 I0 X; R    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
1 ]+ H9 {& U0 p" T5 N" @
9 H5 B- E! H* ]5 `2 I/ N__________________________________________________________________________
$ y/ G5 b) T1 }# |/ V8 ], a" `
+ O1 W2 A: Q4 B8 x: oMethod 13  f5 n3 i" w" [
=========4 b, W& t2 C+ U0 R0 N: w8 ?* ~6 E

! I- g! ?, X: {0 O) A! p" M$ rNot a real method of detection, but a good way to know if SoftICE is
! H* s; C: _* ]7 T) n7 Rinstalled on a computer and to locate its installation directory.
1 r9 b/ l' a: r) L8 m0 D" j+ wIt is used by few softs which access the following registry keys (usually #2) :2 G9 R" `# U* \! J  T6 |

. i" K4 S% j) @9 N" `; w-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
! U* G: j8 ~2 i% g3 L) W\Uninstall\SoftICE, E6 j6 y. J4 m
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
0 }5 ~* r' n9 i8 u8 m5 I, D-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
! H% e9 z- M7 |2 I# S\App Paths\Loader32.Exe
$ \  M* F" k9 ^! a% f+ @0 J- q. [& \. v2 h0 H

; ^4 ?( F1 @' v5 J2 f: vNote that some nasty apps could then erase all files from SoftICE directory
9 P' w0 J0 D' A  P0 W(I faced that once :-(; @  q0 L! T6 @$ r# B
+ Z  L9 L0 p! _* {
Useful breakpoint to detect it:, p$ k* A* }7 L- ]0 `; a$ Q

% }* @$ h* s# H: J     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
2 \  W# U$ I$ D* U3 f3 k' h/ H6 X
7 r9 ~7 e1 `- ~$ I__________________________________________________________________________: s( a5 k8 o- q
  b, W0 Q+ e9 r

0 c# {( l$ ?/ i4 `* dMethod 14 9 ]; V: c: [* ~0 G  u: l2 ?% k' y2 z
=========
8 k- @: ]9 U5 \' j4 S/ n! l) e2 O+ U$ z- l
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
5 t0 _. ~2 V% {& ]is to determines whether a debugger is running on your system (ring0 only).
9 s3 O9 ]8 B3 c# i  Y
9 x9 {- O+ q% f   VMMCall Test_Debug_Installed
$ x: J2 Z% {9 R* f( Q   je      not_installed' M9 z2 ~' V3 `0 D
7 n6 `& ]6 Q! {( Q/ E9 K0 E
This service just checks a flag.
( a, \6 Q' u( \2 t, Q</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-8-20 15:05

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表