About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
0 I' q. Q4 ~. r) g. M( b0 `+ ]<TBODY>
7 b% Q8 K4 b' }  a<TR>
  }7 f  s4 e2 w- ?, d# x1 ~<TD><PRE>Method 01 0 V$ P) f3 c& ~( l# i
=========
; p- O5 i8 |" ~5 G* S
/ c6 q7 U1 @5 u. E" D* e7 u# hThis method of detection of SoftICE (as well as the following one) is
; `& h6 z- R  ^8 z" G: M" Y# Qused by the majority of packers/encryptors found on Internet.7 N% \0 B% l0 Y7 i! O& C; q+ {
It seeks the signature of BoundsChecker in SoftICE  J( Z; m. Y5 c% e5 r
' [+ P9 \% F1 J" u$ O& m7 C5 O
    mov     ebp, 04243484Bh        ; 'BCHK'
7 N% y, b( r$ S2 k% [    mov     ax, 04h; C6 X0 v  n4 Y8 ^
    int     3      
# W9 E, U& `* T9 ~5 ~7 ?    cmp     al,48 r4 N" M; w' x/ H+ w) k# A
    jnz     SoftICE_Detected
) v( Q' K" V; V4 i1 W2 n2 x+ k' d0 F- k9 r1 Z
___________________________________________________________________________/ [, Y1 o, s" H: [3 x$ }

% `5 b: _5 w3 j; v' o1 i* G3 aMethod 02
# F: n( Y$ q' F* u1 c0 C=========) r1 q4 ~$ D- N8 W+ x. B

& m! |0 f$ o8 W$ b' I6 \Still a method very much used (perhaps the most frequent one).  It is used
# y  u" I0 o$ y7 Jto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
7 J. K3 _  x5 F! W2 {; T5 t8 eor execute SoftICE commands...
5 j4 o3 L$ t8 n/ H/ P- `It is also used to crash SoftICE and to force it to execute any commands
6 B9 l" g, G/ X% @(HBOOT...) :-((  + @+ x- @; R9 N8 `. ?  C5 o! V& z
7 {* @1 H0 ~$ f( d# Q
Here is a quick description:
& F( L2 b$ g4 q* _. C; A5 g  M-AX = 0910h   (Display string in SIce windows)( [: Q% _" J0 [1 \
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)( t1 K* E  i, X
-AX = 0912h   (Get breakpoint infos)
& V- Y" X) x: R0 T2 S2 ]-AX = 0913h   (Set Sice breakpoints)  E9 ]/ p* |) s8 }  H2 ]* |9 W& u
-AX = 0914h   (Remove SIce breakoints)
: G' @% N& v6 w6 l5 z9 q
3 `3 n$ f! |* k1 {Each time you'll meet this trick, you'll see:
% e% a0 P9 V% s* t( n$ F% ^-SI = 4647h
2 N( U1 T# i7 _& c6 q3 y-DI = 4A4Dh: J' N- d& t( x" d& Q
Which are the 'magic values' used by SoftIce.
1 \8 W4 W. B, nFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
$ O. M6 [; A8 L3 H) F- }6 b$ B7 {
# F3 [+ Q  s, }' _1 R! {Here is one example from the file "Haspinst.exe" which is the dongle HASP
) H9 p. I4 K+ l# M7 N' oEnvelope utility use to protect DOS applications:/ Z  G$ P# t" x# d1 Y% C) b' Q

7 G  x3 y# p" z+ ?8 a4 N
8 w- ~6 I$ d1 {; Y2 b3 l4C19:0095   MOV    AX,0911  ; execute command.* @1 a' m* f0 F" {
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
! \3 D4 D& X& j( h' G4C19:009A   MOV    SI,4647  ; 1st magic value.. _* q& E: a# x8 M" w# x  b
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
% p! ]! [5 _' I+ J' i; A4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)$ \+ r7 U- O& [+ |+ m5 M  S3 q
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute( d- |9 h6 u) v) b) E" B
4C19:00A4   INC    CX
7 H+ k+ K7 S( m0 c$ K4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
# j* W9 H! R" U5 p4C19:00A8   JB     0095     ; 6 different commands.
; m$ Q6 e( t7 s: Q4C19:00AA   JMP    0002     ; Bad_Guy jmp back.- q( {- A- u! ?* B/ H
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)& f; o* V/ @' ?( `& N! G& N
9 w: g2 a6 P4 V5 k9 C
The program will execute 6 different SIce commands located at ds:dx, which+ \, u& @4 D; s2 V: N/ g# Q
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.5 G8 d1 A1 q9 a5 f

( C9 d' N7 E- b) b" i* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.6 Q8 k0 i7 y4 p" ]+ J
___________________________________________________________________________
& {8 V1 }. ^: ?: b
! e/ K. `. a2 n; D+ `' b4 b! g3 u, n' h! E9 [- i
Method 030 w. D0 N5 q( Y, [
=========
6 c' J( p  w0 Y3 A, r& i7 `" Y+ c/ @
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h" |* V) I4 _) Q  h1 {9 c3 Z
(API Get entry point)3 L- h! F: F4 u3 S9 P3 k% l/ M- D
        
$ M$ l+ g" U" ?4 G! S* r$ T$ V3 }. h0 U5 ~3 |/ A/ D
    xor     di,di
1 R4 r9 T+ j! R& H! q, S9 x    mov     es,di# A9 s& K; u0 ^% [/ \! n4 p
    mov     ax, 1684h      
' ^8 K! l- n) o# V" Q    mov     bx, 0202h       ; VxD ID of winice0 N) n+ @" m) U- `) j: D0 A
    int     2Fh
, k5 {9 r9 F8 q    mov     ax, es          ; ES:DI -&gt; VxD API entry point$ W: W% o; j. h6 W+ p; o
    add     ax, di
  O" k: e. D2 ^/ a8 g" q    test    ax,ax9 ]) h! W3 y8 l  E! u: E; V5 e- J* u
    jnz     SoftICE_Detected  ?4 y+ \* x* t# d, H
2 @0 h2 q8 l6 A- q0 `* g' P
___________________________________________________________________________4 Q5 A8 M% O& d- o( v  W& b

# a; d7 ?6 x4 nMethod 041 @. Y! }6 Q! X; O& A% ]
=========; f) x# t, T4 ~* |9 p5 M+ g) p

$ r9 x: T! L& `Method identical to the preceding one except that it seeks the ID of SoftICE( \1 E, P: V2 e9 A' w7 n
GFX VxD.# \7 I4 k5 W5 t5 L; }2 g; Y! ]

+ N7 W8 f9 a# @1 K" y* @5 h    xor     di,di& [9 E3 `, C* }: C7 F8 k/ O) G4 d% c
    mov     es,di3 K8 d/ {$ Z; |& F, J) S, V
    mov     ax, 1684h       % [- R8 G; _- q- j8 [
    mov     bx, 7a5Fh       ; VxD ID of SIWVID
. J% C+ o9 I" R! ~  k9 M7 x    int     2fh6 P  }# E7 j' V$ x, w
    mov     ax, es          ; ES:DI -&gt; VxD API entry point" }2 H! u9 l. T
    add     ax, di# |: S* V2 P; \% n0 p
    test    ax,ax
8 X  I0 C, s2 j! {# H- `    jnz     SoftICE_Detected
) A. w8 E0 U/ \& U6 v; W4 E: b: O1 r/ L
__________________________________________________________________________
1 P# v# I2 Y# ^! j( [* M9 u
8 o$ n# z* v3 J$ ?- \" b' k. h# L( a! `# y
Method 05
0 i/ ]7 @* C; ]=========
. o  @* Q' I# B3 H" I. ^! Q8 w: ^# ~: m$ c6 e# d, s" t& B
Method seeking the 'magic number' 0F386h returned (in ax) by all system+ p2 a1 O# M) z, v: e, f# i
debugger. It calls the int 41h, function 4Fh.7 k6 G9 c, T, r: ]) k
There are several alternatives.  
) b! L' s+ e4 |3 ]9 c6 f( g& h* j8 s4 `% Y5 C! Y$ A7 a
The following one is the simplest:
% r8 j  m! L% E: A5 n) s9 R* x6 c* T: q9 p* y+ }" s. |
    mov     ax,4fh
  m9 Z1 p* T5 }; J6 Y    int     41h! F1 F' p/ k2 a6 d: [, c; F
    cmp     ax, 0F386  b0 N6 ^4 z2 z
    jz      SoftICE_detected7 Z& _( ?$ D( A

# {2 y* ~- L3 E. {( j: V5 t
4 b& A- a6 l, k) [1 }3 wNext method as well as the following one are 2 examples from Stone's
" k5 s+ B/ d* x2 Q0 r4 Q* E"stn-wid.zip" (www.cracking.net):! ?! Y, }8 y( x4 G" t

5 M4 d2 e& M* w6 K# x4 P    mov     bx, cs
$ r' Q- c4 m! J2 T8 u, W+ s+ {( \5 a/ z1 ?    lea     dx, int41handler2
/ i( A$ k) P" D/ z* C6 `+ n, Q, l  B6 j    xchg    dx, es:[41h*4]
: U' W9 O& J# j; K& j8 q    xchg    bx, es:[41h*4+2]6 n  ?5 P4 K" O. v( O+ Y7 n; R  F1 g
    mov     ax,4fh! m2 r  h# L& ]5 d& B
    int     41h  r) b' y+ O% {, Y
    xchg    dx, es:[41h*4]: S" c7 s3 |) b9 P
    xchg    bx, es:[41h*4+2]' }  g7 d0 \$ N9 _7 S
    cmp     ax, 0f386h
0 Q6 V7 O  n" H) S6 T* N    jz      SoftICE_detected
) }2 b$ X: b# }
9 y  r/ i3 Y' \9 G$ J* ~+ o* Rint41handler2 PROC
7 I" M* _# d! \$ r) W& O& {% [    iret+ I6 x* S4 a+ R2 c" r+ U, Q
int41handler2 ENDP- }% y+ L8 G: L" u# X: L
) N% O; n( q- H. b9 r
- u+ P' v2 w* P! w
_________________________________________________________________________$ V4 P5 J5 r/ ~2 E& P
4 F; s, r' G4 y8 ^" k  v

: f  l% H/ [; R* |Method 06: H2 v1 H2 A4 E' t4 ?, N6 M
=========1 o: J/ |" v+ V5 b
0 b. C6 |2 K' Z! Z2 d  c4 {; J
/ A5 ]% V5 E) F4 W  l
2nd method similar to the preceding one but more difficult to detect:
: C5 f- Q1 Q) `; r! P% x% q1 e
' d5 p2 J8 v. T
# c* T! ^! W# s3 q- T) Iint41handler PROC) w( k4 Z) A& ?+ x* E  m7 E
    mov     cl,al$ ?* w2 r8 L, Q. f
    iret2 ?0 ]: ~" W& i
int41handler ENDP
" ?$ X9 F% G" u/ o, Y+ u4 c7 D  y& \3 Y6 O' n8 e
& Y6 q; e1 j9 ~" u8 Q
    xor     ax,ax* ]! u* u+ [& `
    mov     es,ax( O. G* i. W9 A! }) c  l% q
    mov     bx, cs. d2 e" W* b& ]
    lea     dx, int41handler
7 S  n; A" N; X    xchg    dx, es:[41h*4]
' n0 Z# m/ Y. P) m6 Q    xchg    bx, es:[41h*4+2]
) K% k0 a+ t; B. \1 A' a    in      al, 40h* F9 j! `7 b" r& a/ L
    xor     cx,cx/ W" i+ T# f8 _2 X5 u1 b
    int     41h- e8 C% q( \* k, a' I6 M+ g
    xchg    dx, es:[41h*4]; |* G) L0 Y. ~* W1 P
    xchg    bx, es:[41h*4+2]
' d) t; O: J- y- l6 J5 v' t9 E' {; M    cmp     cl,al+ q- H$ v8 q) }: B' \5 g
    jnz     SoftICE_detected1 W6 Z5 k! l4 X' Q; W- y4 j
3 A; s" ^( h9 @6 ?  C& b; ]
_________________________________________________________________________2 k/ t) {, c9 C' _  T
9 t% A/ R8 V. Y$ F, E3 Z7 @
Method 07/ d) d7 A* ~$ o8 `
=========2 i, a/ g# z! g/ e5 ^/ z
% n6 W4 _. e+ z0 {& E; K
Method of detection of the WinICE handler in the int68h (V86)
9 @' R  \# z3 `; j6 b
  I2 I) a0 S& c& ~. [- u- \2 I    mov     ah,43h7 O+ R6 v# e* J3 {
    int     68h7 D9 U$ }) s3 b+ m- _/ R. v
    cmp     ax,0F386h: ^) r: ?! K1 A8 V& n5 Z
    jz      SoftICE_Detected
8 F$ L1 S# m+ W& N8 S
% g/ O- `9 q$ _. z
6 e5 m  a8 b* l: f=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
% N/ b, _1 @  X( t3 t6 A2 x   app like this:6 y( E2 ~/ S7 F

; {4 z4 R' m& S1 D   BPX exec_int if ax==689 ^8 s$ [/ U* B: t9 G
   (function called is located at byte ptr [ebp+1Dh] and client eip is  s; _6 X" B, Y5 T) e, ^; g1 K
   located at [ebp+48h] for 32Bit apps), c. l6 A, b( Y; k
__________________________________________________________________________
. o# g( g6 @/ j' D
/ c7 t( C8 b5 ~) M( L, @+ D
" V  a( J3 P' o& g8 M3 ?7 t* N7 Q# A8 RMethod 08  C# [& C6 d, g
=========
5 a( n9 a& C- p: t1 f; P" V6 ^) ~
It is not a method of detection of SoftICE but a possibility to crash the& z: E) l0 c) H" r% y
system by intercepting int 01h and int 03h and redirecting them to another
/ C/ Z, t0 L& q4 w/ n# \routine.
) u8 R" z7 P  a8 V0 l; lIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
1 I  A' ?& i, o. n1 D% yto the new routine to execute (hangs computer...)- i- d9 {% C- x1 n$ q0 _5 ?7 \
+ g$ i3 \* r3 z/ D+ I
    mov     ah, 25h
  N( I( k0 l* B: b# s% K7 Q/ ]    mov     al, Int_Number (01h or 03h)
4 H6 o. @* S; p; e: }% U    mov     dx, offset New_Int_Routine, p0 ~* \' ^8 P7 ]
    int     21h$ O( `, q2 ~4 z* H

. K" P  W) ^! u__________________________________________________________________________
3 d) R( u9 \, b( X8 g; e$ q
. O: p( X6 {) |$ s7 L- `3 ?Method 09
, Z  Y( ~. b, j9 s/ A, T! H=========/ E) l- ~8 R0 w* P

2 ~! v; s" N% ?. k1 fThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only2 \1 u$ j" {  y1 A) p4 y+ h6 w
performed in ring0 (VxD or a ring3 app using the VxdCall).
  T9 K2 U. W8 S0 bThe Get_DDB service is used to determine whether or not a VxD is installed$ B  L, ?" g, i- R5 h* p5 {; s' o' I
for the specified device and returns a Device Description Block (in ecx) for
# ]  \; Z  ~( P# V; Vthat device if it is installed.
, o, I7 Q* V8 ]6 }& N" X5 j3 J: e$ M- X# a* D) z) [# v1 ?
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID8 u0 P" X; L# e& v) G
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)' h9 s# J% K2 V# J( F
   VMMCall Get_DDB2 L4 v" W% L7 S7 j; w4 O4 A1 [" ~: Z4 E
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed8 F  }! |0 O, v1 w# A  n
- l9 i% O; g" z. O
Note as well that you can easily detect this method with SoftICE:
& c0 Z8 x+ y2 T; r* D  b   bpx Get_DDB if ax==0202 || ax==7a5fh( [, A1 Y  u7 g2 t1 Z, t) x
6 `: z+ Y! m! [
__________________________________________________________________________! d$ S9 }: e! o  b5 }
) d2 O! V) e( p( P$ D# V& ]5 G- H
Method 105 y& l/ }2 Z# y; ~/ a
=========
1 X; q1 m9 R0 J6 @  Q; U6 e8 R9 |3 |6 p, p
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with. o+ u8 W5 ~" q8 ~& ]6 Z) [
  SoftICE while the option is enable!!3 z1 T1 T0 ~  D- l) ~, W. A8 f0 n
% H. [* c9 Z/ c1 X% {
This trick is very efficient:2 l* u" M- R3 d: H, n1 y
by checking the Debug Registers, you can detect if SoftICE is loaded) j* k) y4 r5 R8 Y
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
) e- h' O3 h" ~3 _/ z- n$ _there are some memory breakpoints set (dr0 to dr3) simply by reading their
7 _9 ^7 z# I( U7 l7 s: P7 nvalue (in ring0 only). Values can be manipulated and or changed as well- @" R) @- n0 r; o; w. ^9 S
(clearing BPMs for instance)# C1 q( Y1 J5 S: m
7 N2 w, _. Q/ p7 k) c
__________________________________________________________________________
; U  ^8 v7 O. u" j
; ]' O/ A0 d( `; h5 tMethod 11
; a9 r6 @6 E7 F=========
# m4 x) Y, n0 }2 R6 W7 x
4 c8 P; H  B2 t9 s6 ?This method is most known as 'MeltICE' because it has been freely distributed
/ M, G7 {7 _/ _' e- v' I/ G* Yvia www.winfiles.com. However it was first used by NuMega people to allow; m' M' Q) b+ A+ N) ?* B/ A
Symbol Loader to check if SoftICE was active or not (the code is located
; M1 g. l9 U, ^0 i3 K& S; y* z2 I% ]inside nmtrans.dll).
+ z$ y9 W) v- z# Y. \4 [1 B' E, P& c+ m6 y# ^
The way it works is very simple:0 X% c, K) L6 M$ H; i9 {6 S) W
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for1 J$ V5 ]2 A3 T5 A
WinNT) with the CreateFileA API.
2 p3 Y+ |/ r6 r8 _* U/ [9 N5 s& S- x
Here is a sample (checking for 'SICE'):% f3 Z! W/ V/ N  M3 R

6 Z8 m2 o% S7 J% K, G- lBOOL IsSoftIce95Loaded()
8 w8 S" O5 {9 m1 E{
6 X" @, S& Z: `4 l: J6 {6 Y. i   HANDLE hFile;  % m- I0 `( o  _0 V
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
" X" E. x0 c! G! T9 w  F                      FILE_SHARE_READ | FILE_SHARE_WRITE,
0 s+ C* M' c! D                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);8 }9 I4 H  [% D6 y! V
   if( hFile != INVALID_HANDLE_VALUE )6 ]% W9 Z3 G6 O3 l
   {
) L# h3 }# E; n5 [+ g- |      CloseHandle(hFile);
# F6 C2 T0 P* G8 F2 G1 A. n      return TRUE;* T, X; j( Y4 U( S
   }9 T1 u' x8 v' I$ t
   return FALSE;3 q3 i2 z4 i. m. C
}
1 D4 I& [" `% @9 e
! A2 W5 w$ y: w2 ~7 X, LAlthough this trick calls the CreateFileA function, don't even expect to be
/ P, h8 F& V) M5 Nable to intercept it by installing a IFS hook: it will not work, no way!. Q2 J. g7 V) ?  Z1 F
In fact, after the call to CreateFileA it will get through VWIN32 0x001F2 x- ^# n* w% ~6 K0 Y
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)% ?( |3 I* n  G3 Y) j
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
& H/ j  D* a9 R& F& H3 lfield.4 D. X) n% s5 r
In fact, its purpose is not to load/unload VxDs but only to send a $ {2 X4 B( v0 A  }
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
  D0 B7 X  m% r# r% a% P8 l" B& tto the VxD Control_Dispatch proc (how the hell a shareware soft could try
; r; P) v  f9 a2 {0 |2 J* ?to load/unload a non-dynamically loadable driver such as SoftICE ;-).. x( h$ x% J% }* {. z  T. S
If the VxD is loaded, it will always clear eax and the Carry flag to allow( V$ }( F: g5 J4 h0 A1 R: a* y
its handle to be opened and then, will be detected.
5 O, }) Q) b' F* q7 pYou can check that simply by hooking Winice.exe control proc entry point
2 _% E. ^: @8 D' G; G  H4 l* Wwhile running MeltICE.# I; P( e' _. L& s" |8 ^
$ w/ R4 Z! D% f4 {- I; y9 f

6 T& O. C# J  @6 _/ u' P  00401067:  push      00402025    ; \\.\SICE" ?# q1 x8 w, s  i
  0040106C:  call      CreateFileA
3 ?! G! `+ W" b1 R0 @1 l/ X  00401071:  cmp       eax,-001( d  {" ?- M+ _2 D" M2 O4 C
  00401074:  je        00401091
0 @" m$ ~: U& t& }. X% ^
' g8 N, n+ B" z: F3 b" y1 n1 r7 y& T" E; i/ ?: ?
There could be hundreds of BPX you could use to detect this trick.
( C: l0 B1 y) {; L: N8 X-The most classical one is:
; Z$ f: Z0 `* j  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||: G+ s0 ?& x0 i
    *(esp-&gt;4+4)=='NTIC': O+ A' L4 I  m( @( _' H

) m) l5 @; L' m-The most exotic ones (could be very slooooow :-($ y1 R7 ^7 g) l& u' C( V% ^
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
9 Q) r& x& W/ A1 p9 r$ J8 g     ;will break 3 times :-(* p+ O) `3 m( G3 I: [: |8 k7 ^
: R: G, d1 H( Q3 o! I2 Z+ Q
-or (a bit) faster:
; r3 I6 F& t6 b! [. }( O4 L   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')5 Q+ U* N5 g6 @0 C- r. y9 P! Q# [, }

5 l9 D1 {6 e2 c7 o3 s6 q8 S! e   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  4 L* {# B5 Z4 J: h8 c" y" \" _
     ;will break 3 times :-(% R- s, k% ]; ]5 M3 K% q% {
: B2 c0 E, G* I! q0 L
-Much faster:6 w  g* j& X4 z% L/ T/ L
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV': {4 \7 ]. C2 F. `% d6 j: a, {+ o
5 x8 f: t9 l' Q8 \+ E
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen1 E, ~: R" m( i) w. ]
function to do the same job:
, l& \: h5 j( |4 d$ V1 u. r# @, g8 y& @
   push    00                        ; OF_READ
' U" u* L, J1 W$ E" i   mov     eax,[00656634]            ; '\\.\SICE',0; s& S8 z8 I& `7 n" M$ Z1 o
   push    eax+ z( W" `! [! b9 R) x. V
   call    KERNEL32!_lopen
* ~+ m& T/ U& z$ T5 m   inc     eax! i: h. V5 m: O. Z9 M; f
   jnz     00650589                  ; detected( l2 B2 D' C6 ]6 Q
   push    00                        ; OF_READ
) W2 C1 V$ [) z6 a   mov     eax,[00656638]            ; '\\.\SICE'/ p8 R7 d' u% _# K8 N  Y
   push    eax2 g; E' H: Z) g' ~% D
   call    KERNEL32!_lopen9 F, y( w: s% I- d' e- Y# c
   inc     eax/ Y: \2 Q4 v  p3 _2 U4 N
   jz      006505ae                  ; not detected1 M' M; L3 a1 W; k6 r
+ ^$ Z, S8 [& F% m  J0 a
( M! v, R9 S' X9 i$ a6 T3 a
__________________________________________________________________________% b( w  \1 J+ k& v5 C

1 j2 o6 L- r- ]* e# CMethod 12( I2 z, `6 a9 V0 l
=========
5 v) m# W$ ?  n" O
. {" ^4 H% S. U; U$ U: p# iThis trick is similar to int41h/4fh Debugger installation check (code 05  N3 Q# ~1 I- |- V% u5 F
&amp; 06) but very limited because it's only available for Win95/98 (not NT)9 Y6 C' g2 I3 f2 Y- p$ }
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
1 Z7 }/ y7 ?# R7 E7 j. e# |$ D9 f# P- Q7 l* w
   push  0000004fh         ; function 4fh! N. }! a7 Q5 g7 q
   push  002a002ah         ; high word specifies which VxD (VWIN32)
. I) d9 ^" B3 ~6 E1 }  d                           ; low word specifies which service
) g* _4 [3 r- o                             (VWIN32_Int41Dispatch)( g; A0 `5 M! P- N
   call  Kernel32!ORD_001  ; VxdCall3 f3 h" ?- P) t  y
   cmp   ax, 0f386h        ; magic number returned by system debuggers
3 N' J8 [' u0 V   jz    SoftICE_detected9 v( q) L* B! f/ J( Q$ P, X

5 q) C& {- i6 g9 m4 [! W$ zHere again, several ways to detect it:: L  z9 E" N! G8 M1 R# p
3 q' N# ^! `: F: r  R6 z7 \+ ~$ q
    BPINT 41 if ax==4f8 ^" B6 `9 r' f8 c6 i. B
/ |" ~$ S" O4 t! N5 W6 V2 K
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
( T3 L- Q0 s) f! Z
& d! i! ^8 B$ w& E7 m! K- j    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A: j: i& p3 @* C5 S  e8 E$ }5 t

4 C' C6 [. B& K: F    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
2 _: u2 B4 ~5 t- l8 \: P. a. c. E! |0 b0 j6 z. P
__________________________________________________________________________
: J# ~# r( Y/ f5 S4 M) u6 i$ H: `/ P+ e1 H3 n/ h
Method 130 g" q; A! x9 @, ~& p
=========
) u, u- C" y+ H  Q8 ?  u, M7 A7 R; V' S# \. C
Not a real method of detection, but a good way to know if SoftICE is
6 L7 p/ V# F$ n" v( N% m- P5 V% Uinstalled on a computer and to locate its installation directory.
, j" h$ k! \, x, P9 fIt is used by few softs which access the following registry keys (usually #2) :. w( i( U6 m7 L2 ~* N' `/ ]
3 E, X, |" f$ q7 S) ^
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
. A1 O: g- {+ Q7 Q/ C1 O% w: f\Uninstall\SoftICE. s9 Z4 a; |9 d0 |( Z% g
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE% |# Z% s# e. j9 K
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion1 `5 p% [) b9 h) f
\App Paths\Loader32.Exe
3 l: C/ ]2 ?0 B5 q; s/ h3 c5 U2 }' }% B/ j

+ ?7 O! `# E+ {( D" A5 \: qNote that some nasty apps could then erase all files from SoftICE directory
& K7 C( u( V$ K! m5 o3 M(I faced that once :-(/ J7 z3 d: N2 f4 J7 z5 S$ Y
0 w* w0 I. ?1 w+ K$ I- ?
Useful breakpoint to detect it:
0 e: z4 C) C1 D' x1 c% c& I
2 ^+ O3 h- I5 T& h0 n& k     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
5 q! ?, {0 n) T7 T# J" _+ q
6 A! L' p+ A5 V4 a__________________________________________________________________________6 n: _0 {2 ~2 Z6 |8 V4 v+ I

" V& ]+ {6 c" {; F/ N
2 n/ _1 {. c- pMethod 14 $ W) ^1 p, j  ?7 h; C
=========4 E1 g5 B2 P: `! T; ^

$ X# p) N% m4 W' R; ~; T* }A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose0 ^+ T& A0 m8 T8 F2 [4 g. y6 y
is to determines whether a debugger is running on your system (ring0 only).( E. L: u- H( @5 Z

) C4 Y$ m* `2 M0 K0 n: o' Z: w   VMMCall Test_Debug_Installed
8 t6 B" ?0 X: X8 J$ k2 M4 S/ ~1 {   je      not_installed8 n* J" z4 B! i, T8 v/ r+ ^

& e" [' \1 ^* j. T" S) `This service just checks a flag.' H  o0 U% T2 \( [$ w1 H' g
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部