找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>: B2 J' K, `% }- o: a( W# N' M
<TBODY>/ c+ l$ W( u& f: ~
<TR>
, R. |5 W0 E# w; Y( U<TD><PRE>Method 01
" L# J9 k* g( O1 R  g=========
# V2 [/ o) @; ~2 q0 g! p+ W- Z# j+ N. |
This method of detection of SoftICE (as well as the following one) is2 C3 d, n# v5 r4 |. R
used by the majority of packers/encryptors found on Internet.
3 ~& Q' s2 A9 F8 SIt seeks the signature of BoundsChecker in SoftICE* ]. _) {% E4 S

  u9 p$ y; M! D6 h' G7 ~1 H" n$ ^    mov     ebp, 04243484Bh        ; 'BCHK'
- X) e. I2 w& |; n$ o/ ?' ~5 n" N    mov     ax, 04h
- E# X; U. |4 e5 F- H! [7 \    int     3         ^' Q5 w  {+ t4 b/ ?2 B. H1 p$ H
    cmp     al,4, {! q! W# {/ j( J8 _2 ?+ k
    jnz     SoftICE_Detected# \7 z! P& R0 r( u% }5 u, V4 E

0 m8 J  i5 r& p: n: A" M___________________________________________________________________________
7 P3 Y4 o' {  \) i( K4 J6 G  L4 {0 f$ w/ g# M5 K: A: p
Method 02
; w. V+ {" E/ m) U  c  S* ]=========
4 D1 ]# @5 v5 J: T2 Y9 R+ G4 T$ n( C* T" O( e
Still a method very much used (perhaps the most frequent one).  It is used
  x* [; ^! B6 z8 oto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
1 f9 m* s: G& p$ {) nor execute SoftICE commands...2 M* N  P0 V6 @, V
It is also used to crash SoftICE and to force it to execute any commands$ a2 l4 L0 ^4 {' r3 B3 o
(HBOOT...) :-((  
; J* Y  K. w3 r! j  `  G) H. ?+ F0 m1 U3 y3 h
Here is a quick description:
3 d) Y2 b, T4 D! V2 o-AX = 0910h   (Display string in SIce windows)
9 l" H/ Y4 r% P) ]& M-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)- n2 V8 q' d# p" B, Q
-AX = 0912h   (Get breakpoint infos)* U3 R2 Q' B$ w0 }; G0 Y6 V
-AX = 0913h   (Set Sice breakpoints)( q% U9 S5 S. G3 R$ d9 x. @
-AX = 0914h   (Remove SIce breakoints)! r9 D! b, x5 O& P7 ~6 z. Z% j
" y" L; ^+ y2 |& m) a; O& V
Each time you'll meet this trick, you'll see:
$ @) ?3 j) F: I/ F+ W% L5 D' j-SI = 4647h' X2 u4 S8 E  `) [4 P2 s' a
-DI = 4A4Dh
2 b9 S5 A' [: g( h+ ^Which are the 'magic values' used by SoftIce.2 T( q% S: ^, Y. m; E$ I- u
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
7 l3 |$ {  [9 C9 j! h/ K7 Q8 f/ M
) x( j, u* }8 j. a6 {Here is one example from the file "Haspinst.exe" which is the dongle HASP. I) s/ Z8 L# B  R
Envelope utility use to protect DOS applications:
6 E9 p- ~7 @* {4 x+ R+ n6 `9 R& p. A1 R& B2 c4 s* d$ u, R

( q9 Q1 n' p' M# e9 C4C19:0095   MOV    AX,0911  ; execute command.
$ z2 T6 D! t4 \8 D4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).: W& G4 o. ?( t1 O8 @
4C19:009A   MOV    SI,4647  ; 1st magic value.- r5 j" |$ x, l
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
5 W/ X2 j5 D1 N, v# Q+ m1 \4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)9 K  _  Z1 P7 Y) V7 x' k" t
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
* B0 D( Y+ @% [+ v+ D4C19:00A4   INC    CX
/ I. w- [# {) D" k" \8 l4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
( I! M( ~' i% d$ z1 V4C19:00A8   JB     0095     ; 6 different commands.
& p! U8 a4 t: ?6 w: h2 f( N4C19:00AA   JMP    0002     ; Bad_Guy jmp back.. f9 }9 |9 F- T
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
! l- `2 \# |) w7 U: }: T7 r
" K2 T- R1 k! ]: U4 M9 R* RThe program will execute 6 different SIce commands located at ds:dx, which: F7 h" \7 e6 ~: ]
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.# Y  J: F" D( i1 `/ m% @5 k9 z* r
( v5 Z- ]: ]# |
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
" |- _! g; M% {/ j, m___________________________________________________________________________7 R5 G' q1 u- r8 {: e( r$ O
2 e; _$ H: o$ ^% s6 n; U
  d3 e: u: v; Y0 I' x% @9 O, d1 i
Method 03) E/ @/ H  G: u! f
=========7 }" Q3 G/ k; u8 Q! o& s  {

" w/ Y, i  @8 [) L/ q- Z" ELess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h! [. d7 m4 i$ Q4 L9 D* e
(API Get entry point)
- q2 y3 m- {* \1 }        
) \) f: R9 \" P# a7 b2 A
8 g4 V. p. `5 ?3 F* d3 B+ O    xor     di,di
( {$ ^2 l- i$ @% ~; g    mov     es,di
. K. t# G$ f1 N    mov     ax, 1684h       * ]. V$ e' z1 q; @$ j- F* M
    mov     bx, 0202h       ; VxD ID of winice
+ V$ w4 J& [+ s+ H" |    int     2Fh
- P( V+ V6 c( M1 m) Z4 h5 ?) W2 `1 m2 p& \    mov     ax, es          ; ES:DI -&gt; VxD API entry point/ Y$ I# A" t0 e* p9 E0 U
    add     ax, di
8 ?) l& A& B( i1 a# s' w    test    ax,ax6 K. B2 I. D4 k
    jnz     SoftICE_Detected7 r: f; d7 Q2 [% E6 n

# |; o( N2 R9 E3 h___________________________________________________________________________, k! B6 K6 ]: D8 K

& k8 ~# o# \8 Q3 D$ tMethod 04
# _& C! d9 ~$ v* v: q, `=========
% q* D' m1 ^' S# E0 C, V1 E( R
. I8 P2 f$ H2 ^& C! }6 x- `4 |Method identical to the preceding one except that it seeks the ID of SoftICE
" |: s1 [# {; c0 dGFX VxD.$ K1 S- I3 U  h8 y
" V3 d: C3 R3 K6 b" z0 Q
    xor     di,di! _7 l0 T. ]/ c$ _$ W* K$ t* |
    mov     es,di
( [7 j; x* q0 N5 W3 r8 k    mov     ax, 1684h       4 n0 y) [' n1 b0 c" l3 d
    mov     bx, 7a5Fh       ; VxD ID of SIWVID
# U2 W- ~# d+ f; w    int     2fh
! V/ T6 c4 r) E1 i4 k    mov     ax, es          ; ES:DI -&gt; VxD API entry point% B  ~. s+ ?- O+ }! o
    add     ax, di
# h- L% f* W5 }    test    ax,ax* s9 Y$ @4 m! A7 k% K$ z
    jnz     SoftICE_Detected; d9 E3 M# w+ i. I0 B' I

! N2 Y% M; T; F  D2 \( Z! K6 f__________________________________________________________________________
% }" U: E% x# D6 D+ n) z7 Z) n* w( m) D, ^  ]
+ |' F) d7 I" i6 L7 M& x9 d4 }; G
Method 05! Z8 x' j( z3 g' ^$ X* q* ~
=========  k# `- F7 ^) L/ ~; ^. ?
% d+ Z) ~8 Y, O7 G
Method seeking the 'magic number' 0F386h returned (in ax) by all system  b) v' X3 d1 o! U
debugger. It calls the int 41h, function 4Fh.
8 t: M/ d/ `7 K3 M$ d. ~There are several alternatives.  0 p6 B$ Q! ^, i

6 x- \9 A% X; o1 XThe following one is the simplest:1 L# F& T& |5 D+ p! a" A, v

: j, X# S; v' J* L* I- D- t5 ?    mov     ax,4fh
" b$ V$ S9 g" _( `: J    int     41h
* Q# D2 o8 H, L. G- Q$ ^8 M- p. s+ l    cmp     ax, 0F386
# P+ R5 m, W7 B+ o+ i    jz      SoftICE_detected. l' h$ b/ k: F& B, P' l

+ D# v% |( F- a8 y
$ C' J$ q8 c+ U8 v; Y' E) CNext method as well as the following one are 2 examples from Stone's
4 ~; y. c6 e8 i0 d"stn-wid.zip" (www.cracking.net):* t  r4 H1 t3 |( C) X6 L: o
1 g5 w* }& m; m0 [
    mov     bx, cs
1 h0 b. S6 Z6 y$ ~    lea     dx, int41handler2
8 U9 H+ [5 g" l" C    xchg    dx, es:[41h*4]( f3 d; J" F8 O- F7 n
    xchg    bx, es:[41h*4+2]/ I# f- ~5 V* Z5 B; N5 R  ^, r
    mov     ax,4fh1 z% H1 B% L0 T/ Q
    int     41h
3 m/ N1 _' V* l& V0 i# }    xchg    dx, es:[41h*4]
$ u# I7 j3 `$ ~5 v1 c" l# `    xchg    bx, es:[41h*4+2]  M! s, I8 @+ A  W; v. B
    cmp     ax, 0f386h! V$ U( @1 l$ |( e# [
    jz      SoftICE_detected' M% N% |8 q9 @; y0 R% p7 V
& B& @5 C# ^7 q0 G1 [* D5 i
int41handler2 PROC
) C8 [9 s4 k9 Q4 Y    iret
' g+ y$ \: d) y( m$ q; Yint41handler2 ENDP
: x0 g: _9 x4 |# y
1 A2 o9 J& {3 {9 y# p# R' Z! m" G$ @
_________________________________________________________________________
- E5 b* S5 p# h0 }; E' @6 _- B) o
( p" \& c2 L/ Z8 n1 q  _1 N7 R( b0 ~  t
Method 063 _! F/ L/ L% z2 z
=========% @( M  @  K* Q- Z/ w

& H$ P2 D- J! i4 r: j: E# d- u) t' h+ M" K/ {
2nd method similar to the preceding one but more difficult to detect:
& c" W) Z8 J' w3 X& E1 c4 R. U; T6 Q; H7 y9 s' n# H8 O

3 b1 G) ^8 J$ z% m2 xint41handler PROC
8 i4 `) h& t. h. f" W( i9 b    mov     cl,al, P2 N* e" Q2 t8 O. l
    iret* _' c; T2 Q- @/ g4 g% O1 _
int41handler ENDP& x' c/ ^" k0 L* \* u
  h+ j% P3 Y& F0 u1 u+ m

& x; {$ g# u. O8 `7 j5 H0 l' O    xor     ax,ax
& f0 X" U. f3 F    mov     es,ax
6 J7 l$ J7 K' J+ S    mov     bx, cs
1 @; x: u: [+ ~    lea     dx, int41handler, s& N1 N! R; Z- b/ C, N! \  @; x
    xchg    dx, es:[41h*4]7 b3 R# M5 R! B6 _7 p/ x! ?
    xchg    bx, es:[41h*4+2]
: d6 V( j. p" |- T+ M6 G. ~0 ~5 R    in      al, 40h% Z3 B9 H/ B: V1 B5 p8 V  \
    xor     cx,cx
5 Q4 t# v2 o1 Y0 `8 S( X- C    int     41h3 `' @3 l0 S" r) d  a/ h
    xchg    dx, es:[41h*4]
: a7 G/ H+ d, e/ R" d$ m    xchg    bx, es:[41h*4+2]
  n+ ?8 l- s* W0 l2 V    cmp     cl,al+ B% W) K6 N, y  c; C4 c
    jnz     SoftICE_detected" Y) @$ {$ L3 u

' U( b! o% ?4 X9 C' c; O( v_________________________________________________________________________
; L$ v/ U9 o# O4 Y$ u. Q& T, v
3 x+ \. f, d3 ]Method 07
8 t. I( ^8 S: ~+ F=========. m" X2 A) g% ]3 `- t
4 l/ N. r5 O) U
Method of detection of the WinICE handler in the int68h (V86)3 c, W6 r' u! q3 J: G

* N- m' r5 X: K1 y! g/ ^    mov     ah,43h
& I4 X& N5 y- a8 S    int     68h
  D- W2 A: `- o5 M# i" r* d    cmp     ax,0F386h0 @- s0 I( [9 C, t6 Z. J+ M
    jz      SoftICE_Detected8 s( g- F0 G' y" N  R% F+ F
, u# K* n- l1 W/ S! V, T: U

0 g. M( o8 R: Z6 W$ F7 b) R' ]9 J=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
/ I: [; G/ y% R2 H/ z   app like this:3 Z; A" }' |5 I3 J' u* S7 L3 k& F
2 b. Q$ a( t3 X
   BPX exec_int if ax==680 ^/ X4 M2 B- f
   (function called is located at byte ptr [ebp+1Dh] and client eip is
7 |; }6 T& q4 H1 r   located at [ebp+48h] for 32Bit apps)6 Z" c% L% |- u2 q- f
__________________________________________________________________________4 Y% Z$ v" `. y- r! i8 ?- ~& y

. ?4 i3 O0 w+ O6 p) U- X% |+ ~7 s. u& u8 h
Method 08
: ?/ {7 k8 q7 j  V$ H. s4 ?8 G/ ~=========
5 x- X  |- N% d- [; o
) j7 U6 g3 W+ G! dIt is not a method of detection of SoftICE but a possibility to crash the+ J7 k# _& Y# k1 Y8 D: }4 q$ G+ x; ^
system by intercepting int 01h and int 03h and redirecting them to another
1 Q: @0 k: @5 ~. I' N; broutine.
4 d+ d; a$ y* s+ v; i5 C' Z$ b0 J1 z  fIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
$ }/ t+ s! Q% T2 P4 B3 ?to the new routine to execute (hangs computer...)
. c' j7 ?& c" u6 r9 z
7 ]& A( e, k7 @" \4 s5 l* l/ S7 A    mov     ah, 25h; `' v% f1 Q' K  B
    mov     al, Int_Number (01h or 03h)" ^! H9 D0 }+ c+ I6 m( N: b
    mov     dx, offset New_Int_Routine
7 F, j: W4 A( ^; L! A9 z$ n    int     21h/ x6 p9 a, r3 c
7 O7 N: c9 O+ x6 X+ q1 N' v
__________________________________________________________________________8 z# a: ]2 i0 [1 @8 Z) U( l7 D
' V# k; \) L( x/ B" P/ Z, M
Method 09
% I; X2 n/ w/ @3 g8 S=========
* k6 W, \+ a" V' E; K& E1 u9 F3 L" I
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only9 m/ \- b# M& z5 }' r+ ^" N
performed in ring0 (VxD or a ring3 app using the VxdCall).+ q$ \1 o5 K9 _  K: g
The Get_DDB service is used to determine whether or not a VxD is installed
( s; r9 E. Z( d" b" l, Cfor the specified device and returns a Device Description Block (in ecx) for
8 n8 {) J! J9 wthat device if it is installed.
  ]3 `8 d9 j/ q! y2 e8 E2 m& u: ~; B  L# A9 w+ |
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID3 y. u! d4 L% W9 }5 H5 X/ y0 _
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)) m  D! p: `* K, g( s. l
   VMMCall Get_DDB# _, _; r9 s) ~; V' g  l7 `1 F: a! w
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
! `3 F) r, m, l# {' H; s/ f% m- z% b  |- Y8 b) O% k. x2 Y: _
Note as well that you can easily detect this method with SoftICE:
8 _3 y. d" [  ]# h   bpx Get_DDB if ax==0202 || ax==7a5fh
. H: I7 s/ c2 c5 i; |3 R/ q6 j' v* N5 f6 d6 h& T3 ^/ r
__________________________________________________________________________% c7 j4 d! X6 v) M  ^

- f: g* v- h1 H& u0 h) \+ X# s: t+ kMethod 10# k7 y' x  b7 y( S+ R1 S3 Y
=========
* b; S# W7 X; c: s0 o% @/ i2 M( L1 _" ]- F2 k
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
& }  c! J4 S+ x6 @2 J! f! ]  SoftICE while the option is enable!!  y& p4 W4 s7 P! P( J- V3 q$ }/ j

# G1 g6 v8 P* E. u2 S  t7 jThis trick is very efficient:
' N1 g* c) _: `; D, j, Lby checking the Debug Registers, you can detect if SoftICE is loaded* w% k! O2 w0 D
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
& S- l% ?$ D0 V0 Ethere are some memory breakpoints set (dr0 to dr3) simply by reading their
% R7 V( l* R' H! O7 I% ~8 F+ lvalue (in ring0 only). Values can be manipulated and or changed as well2 I; J/ x1 G3 N/ `
(clearing BPMs for instance)6 ^0 h. c- b4 f

3 u/ @) T. b! C__________________________________________________________________________* q* T: y* b" z
) W/ d) O8 q( x/ v0 l
Method 11) [3 a6 i- {$ u* C. v$ u; `5 ~
=========
. ^) I7 ], ?3 m* E2 M. _; Z: b; N" q/ D! N$ r2 B
This method is most known as 'MeltICE' because it has been freely distributed
/ X+ S  N: D' d4 m' L3 m) [4 hvia www.winfiles.com. However it was first used by NuMega people to allow; A; o4 e4 e, T+ c) Y
Symbol Loader to check if SoftICE was active or not (the code is located
" ]2 m7 D: V1 Tinside nmtrans.dll).
4 h0 D6 e7 z3 r. v! v3 M. c
: b& M/ q* Y9 ~8 {3 w* a1 G  B) t+ OThe way it works is very simple:
& R. c6 [- E, d" AIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for# p# h0 r! D* }. @' a( X3 W
WinNT) with the CreateFileA API.
, `$ e! c8 y; W! ?6 }5 N( i; b8 Q7 v5 Z0 Y& G/ E) n  B
Here is a sample (checking for 'SICE'):
1 s8 J4 P: K! L6 R
. f+ K% Z9 f$ [! w' m( p. t( Y  ~BOOL IsSoftIce95Loaded()1 u" _8 \2 j' R( B1 O& f
{# C5 T) B0 |! F* z) y
   HANDLE hFile;  
7 i) J, l) A; m7 \- v: K& n$ V   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
- ?: Q% G- \& ?4 l2 p                      FILE_SHARE_READ | FILE_SHARE_WRITE,/ _) ]( V: s  }( t* F' m
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);" f$ ^7 I: T, G, T- T
   if( hFile != INVALID_HANDLE_VALUE )
5 I& K# l. U5 h! P: G   {
+ f- Z0 s$ u" e7 e. U' K* ^      CloseHandle(hFile);6 u0 a( z9 H' j3 Q: ^
      return TRUE;
- Y! e7 N! x0 h9 f$ j) H8 |; r9 `; Q   }  S9 T6 B5 ], D# B0 _) B! q  }
   return FALSE;
: X$ z" ?& s) w  \) S}
5 u1 ^" S4 R4 O1 c7 w4 H( A9 E2 y& C3 G. t+ I
Although this trick calls the CreateFileA function, don't even expect to be
; O8 I  k' g8 _6 J0 Iable to intercept it by installing a IFS hook: it will not work, no way!
: T: J5 J$ ]9 ^5 [% v: z) UIn fact, after the call to CreateFileA it will get through VWIN32 0x001F! ?( _- p0 p! x3 t. h! B" a' m% D
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)- y1 V+ w; C& J3 R& h% M' i7 A& Y
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
0 j7 V4 T. `3 d: ], M* V3 r& i8 dfield.8 \2 {! X8 G4 x  e1 Q
In fact, its purpose is not to load/unload VxDs but only to send a
/ n4 x4 }5 b% ]! KW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)/ l" G' q4 N6 w7 \
to the VxD Control_Dispatch proc (how the hell a shareware soft could try4 R8 H" Q1 a$ D' ^# q8 f8 s$ y
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
& b' S( k) I3 E) @' zIf the VxD is loaded, it will always clear eax and the Carry flag to allow
5 V2 Q& Q! l! l- Y( l- J- tits handle to be opened and then, will be detected.1 d- ?4 N3 Z  P: ^! S4 d
You can check that simply by hooking Winice.exe control proc entry point
( C5 W+ F! O3 x8 nwhile running MeltICE.
; o; \& q5 E; K' c0 ^" y& t
+ c8 y' `+ h8 U/ O) T: x- v
/ ^) Z8 `4 p5 i  00401067:  push      00402025    ; \\.\SICE. l( @- P+ \2 Y: G& z8 D, I
  0040106C:  call      CreateFileA+ y- R: T2 U8 R7 X& p: [
  00401071:  cmp       eax,-001
& R! W- @* W  D9 O& ^' D7 D  00401074:  je        00401091% k# ]; e6 I3 u; }0 [
" {+ A2 U1 e1 e
3 {+ X6 q" O# Q# F( D
There could be hundreds of BPX you could use to detect this trick.
/ n  q4 _/ U5 W4 _9 D-The most classical one is:7 [4 ]  k" d( H0 H
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
4 T0 R6 N) i! ?  z    *(esp-&gt;4+4)=='NTIC'* L) K% j- K2 }. M
  m9 ~. q1 w* W. j1 ^
-The most exotic ones (could be very slooooow :-(
" O# a* J  a: C* U) t   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
7 C* ]; V+ N8 R7 i" Z     ;will break 3 times :-(
# X5 P* H" c5 I1 Z2 J, P2 o$ T9 E9 H' ]7 n6 J" Z3 t
-or (a bit) faster:
; s; f3 S, @( b0 K1 f/ V   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')# A% w) B2 [% g( c4 ~4 N1 ^
( w7 F( o  n$ N4 T" W: w5 _7 C
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  # I, |! S" d8 Y/ T2 g& u
     ;will break 3 times :-(
7 o0 Q6 U: M1 E- q! d1 y' z; m. G% E
-Much faster:) y) y1 K8 @# s% U# C  v
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'$ x8 J# x' W9 f9 M" `& f! O0 t
2 f) M- x) z( u" j
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen; W. G! T, r7 k4 {9 h' R9 H' O% [
function to do the same job:& F3 o! i% E" p& k1 @/ ^

+ `) G2 N. t5 g3 p9 V# j  @" c   push    00                        ; OF_READ) s5 s4 V! M; t! R
   mov     eax,[00656634]            ; '\\.\SICE',0
- z& K/ \& f4 R% b/ }) k6 N   push    eax* j. f8 t  s0 O# d, R
   call    KERNEL32!_lopen
9 g# y2 {# n8 G& h2 A+ F   inc     eax) Y. P. P& L  o4 i# T! l  H
   jnz     00650589                  ; detected5 l. l6 p  t5 W' N4 Z: s9 D7 A& j- {
   push    00                        ; OF_READ4 a1 P" G$ B% A. z  f& G7 u" e3 `0 p
   mov     eax,[00656638]            ; '\\.\SICE'' {+ g6 O! p/ R) c1 y' v8 z6 X0 b
   push    eax1 c. o5 p  K3 T) c( V1 G$ W
   call    KERNEL32!_lopen# M6 ]# g; P+ i
   inc     eax
- ^' B2 x3 M. p$ ?# t: r' ~. B$ i   jz      006505ae                  ; not detected
* p- k0 H* x$ u9 m! V, F0 J  Z- ~* P; g' p  i! W3 K$ s) E$ Y

. P/ }1 T+ l5 q% |+ R__________________________________________________________________________
, B1 S) ~8 p+ w$ Y0 ]# F! l. e+ y1 S# w
Method 12& W. [8 d! p/ K7 x; `" f2 K
=========& [- u+ `. s$ {8 S$ @0 M8 o' O
3 e( C! f$ R& f1 s8 w* A
This trick is similar to int41h/4fh Debugger installation check (code 05
- c, Z2 l% L' u6 l&amp; 06) but very limited because it's only available for Win95/98 (not NT)
1 w  C, X  q6 Q+ Vas it uses the VxDCall backdoor. This detection was found in Bleem Demo.) @0 D/ w5 ]+ [3 Q1 s% ^
- J% F2 N/ o( K4 d1 R
   push  0000004fh         ; function 4fh; k. Y" A1 R- W1 B4 j' E2 H
   push  002a002ah         ; high word specifies which VxD (VWIN32)2 K; f; o  }" P5 R  D5 ~
                           ; low word specifies which service5 F4 X( C& P4 N# T) a8 P& Z
                             (VWIN32_Int41Dispatch)
! X3 Z3 B: g  b' o! P9 a   call  Kernel32!ORD_001  ; VxdCall0 c4 h" D: m% t0 ^8 D7 O; ^
   cmp   ax, 0f386h        ; magic number returned by system debuggers
6 i: }0 r2 u% ^7 G! Q   jz    SoftICE_detected1 F( v) u4 A5 z- g' v! C" J

. c: x5 v" C$ q: v3 c0 Y% c: k, pHere again, several ways to detect it:
+ \9 M& F( r7 d# [# S* N7 C; {# }5 [6 Q: |6 W5 S; m7 |, C
    BPINT 41 if ax==4f
7 n. x' }) p4 D- Z1 |+ o: U# h# `3 V' X2 T" a7 N
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
8 U  @3 a  j# Z4 n4 c7 T; B
: {7 D; A$ z4 a  D$ t( _( S    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
" v8 {$ w& k8 U$ Y) ?% P/ A: b. s3 C% C; I
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!/ M' K/ S/ z: {7 m

6 A" T% m5 o0 U__________________________________________________________________________1 T2 c& X" C6 H

* [# B3 x+ K  j7 m+ ]. jMethod 139 e; @9 j0 L& Y, m- ]
=========
. a5 w  B# L/ V# E% P) ~9 L. v1 x6 @+ ?0 W2 g2 x$ G
Not a real method of detection, but a good way to know if SoftICE is
) P1 ?  C2 X2 r' `% dinstalled on a computer and to locate its installation directory.
; H' a- K" w( Q' D$ q7 ?! [& d7 aIt is used by few softs which access the following registry keys (usually #2) :
+ m+ W* |, R; \5 \  F. \
: x: U! d( R& H5 d9 y" ~-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion- e4 h. s$ _6 z( H, U3 Q
\Uninstall\SoftICE. n& W6 y( V% Q, z$ \
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
1 I0 t9 {; V# |) O0 R-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
' q; j" m% }" D" G4 o8 }  R6 Q\App Paths\Loader32.Exe
$ s5 R. o+ \( I) @+ [
8 ^! v. x3 @+ v5 C; Y, b$ T8 i* W* w; w
Note that some nasty apps could then erase all files from SoftICE directory  |# k! V: _6 I
(I faced that once :-(
; q/ P: L& m1 a/ l! L! A0 F- E" q- d; ~$ p6 s/ u  Y! `
Useful breakpoint to detect it:8 P' H) N8 ?/ F" ?

! `7 f8 ?6 r6 Y/ K3 e' E     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
5 |4 I3 k: `: V* A! a- j  G& O+ y
" a  \9 R2 a+ d" O4 s1 P% x__________________________________________________________________________
; I- [, w- a! U/ m. ^3 |  g, H
% ?4 e/ _) [2 P" h3 O& Z  j
6 I  l0 H5 V) |0 ^: A9 LMethod 14
& Z/ U: Y; X0 i. M=========
: {  L2 Z/ i; R  J7 y7 W2 Y0 E  x
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
3 F3 k. k9 W: {5 v- P  vis to determines whether a debugger is running on your system (ring0 only).
' U, H8 Z& B5 `0 `8 w/ c+ y4 B1 D; Z# U( D
   VMMCall Test_Debug_Installed" I! X, ~/ O8 F
   je      not_installed
1 K( Y/ W( p, _! ]  R! |: D
6 E, K) X$ @2 ]! n$ EThis service just checks a flag.8 q1 N& Z$ s/ _/ S" L& Q
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-8-10 15:41

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表