About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
" _) Z  z+ Y& N+ B<TBODY>- D& Z. C9 {" v. ?; J
<TR>
( W' R1 f2 R) V- p7 e. h<TD><PRE>Method 01 $ H; Y* G6 G% D) H1 r% Q
=========
+ q9 p$ j3 R5 e( R. E1 b- J$ ^
, U. P* N3 G! D; h' x* W# O4 U8 LThis method of detection of SoftICE (as well as the following one) is
3 `: r5 \% v5 @used by the majority of packers/encryptors found on Internet.
. j4 r9 ]* P7 h% m3 V3 M! VIt seeks the signature of BoundsChecker in SoftICE
* `, {2 t6 t, F# t2 t3 L4 [8 z1 Q
; S5 a+ `8 v  V; |8 A    mov     ebp, 04243484Bh        ; 'BCHK'
) ~& F3 E; _/ `0 O6 Q    mov     ax, 04h
% o. c1 L) H  C  }" ~    int     3       ) `! |2 g7 o  h
    cmp     al,4
( t4 R; Z% Y% M9 h, x$ ]    jnz     SoftICE_Detected
: s7 K7 I% E4 Z; T& n" _- k1 ?& n- d2 e+ A* g- t1 o+ V
___________________________________________________________________________$ b- t( ^; z& L
( e+ p/ |6 k( X: D1 h" Y
Method 02! d; i5 u" w7 S6 Y1 H0 d0 ?
=========
2 e: }& E1 I, C& I: B
+ u6 r" l3 T$ v' q! wStill a method very much used (perhaps the most frequent one).  It is used3 F6 i% V1 M$ C; g" |: L! s
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,5 r. I) T6 K1 b" |+ M2 W
or execute SoftICE commands...+ R  w0 n! ~/ h5 m4 M. X7 {0 x
It is also used to crash SoftICE and to force it to execute any commands/ ?0 {" y, S# Y6 E4 x1 B7 d
(HBOOT...) :-((    p% x$ C- p% X3 t" j3 H. y

( h( U+ K' v0 W1 {  zHere is a quick description:
1 Q& H1 u9 P# F  Z! ]-AX = 0910h   (Display string in SIce windows)- ?, p) r9 |/ \2 g/ `/ I1 v+ C
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)' d+ B; t0 ^! ]% f
-AX = 0912h   (Get breakpoint infos)
! U! {- M( @: M* T! }# ~-AX = 0913h   (Set Sice breakpoints). l, a: p/ r: A3 O
-AX = 0914h   (Remove SIce breakoints)
) e/ h" [; d* @' k" g! V! a, U. p9 |- Q* y: x) {! A6 d% @! ^
Each time you'll meet this trick, you'll see:
: d+ k# i  c- j9 ]3 t-SI = 4647h4 k  b3 J$ y! {2 i8 i" `
-DI = 4A4Dh2 u  D7 i1 I; s1 s' s7 q- F4 d: j
Which are the 'magic values' used by SoftIce.7 b6 j. t) F- g: z1 [
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
5 w" |$ W/ t0 g8 @4 c9 g% _, h+ ?8 c9 `
Here is one example from the file "Haspinst.exe" which is the dongle HASP
2 a  U4 ^1 h0 F9 T$ [Envelope utility use to protect DOS applications:
, _' {; ?' H# [; E
* J1 x, U4 {" X* D( f! l3 f! C* h+ H6 f. J" V  n
4C19:0095   MOV    AX,0911  ; execute command.6 x$ U/ Q( z0 Z- B3 w
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
$ f4 ~- q5 i% W0 X* _+ p4C19:009A   MOV    SI,4647  ; 1st magic value.
, z1 e% }% Z. I: Q4C19:009D   MOV    DI,4A4D  ; 2nd magic value.2 ?$ |0 g2 |) O' {2 N7 I$ B5 [
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)$ i4 [7 |/ }7 n2 o" R$ h
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
3 e1 R+ G1 v  R4C19:00A4   INC    CX+ m- h0 J# O' t
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute2 B9 r2 K: X$ O* {* ~
4C19:00A8   JB     0095     ; 6 different commands.0 M: e1 r+ N/ h. `  ~" v
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
- W( |+ T- \3 b- b( o. e4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
2 i% a7 x  |6 U) o& V& [! U. z0 b  Y, R  B
The program will execute 6 different SIce commands located at ds:dx, which+ R9 G8 t2 m! t1 m
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
1 p, n: ]: K: v6 u( C1 d9 j: z! R1 Y! Q& D  N* X; U
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.' k  {- `/ N/ y# b5 b  i
___________________________________________________________________________: Z- z4 Q% k' o3 Z' L& G: I

' f2 p& v* D! b5 }! P8 A+ O* [; L. Y" O
Method 03* s% k6 C5 U7 M( Y( I
=========1 L9 }+ m. ~. C' t6 m6 ^* j. o: z1 K

' _5 ~' A/ p7 f& |- DLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
& e5 A0 c% {, k& o8 S- ^' s(API Get entry point)- O4 u2 d5 ?1 f+ r% x$ T8 O
        
9 l1 @8 M4 [' G; v' B: C
+ o7 q2 E, |% A7 w4 n- B: Y2 ]) }    xor     di,di" x8 v" B4 L8 V
    mov     es,di
4 t$ T' i9 }9 i3 Y4 j3 O* ^3 u    mov     ax, 1684h      
/ q- r! C3 i; w6 i+ N" \    mov     bx, 0202h       ; VxD ID of winice: d- |: W6 k' J' O! g9 d% P
    int     2Fh/ V# u4 H: Q) _7 M6 n5 ^
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
3 g& I) A$ r- \, V0 Y1 I$ b/ V) h    add     ax, di
) E8 i4 j1 Z/ N+ D0 M6 U, i    test    ax,ax
& B) k3 X2 n. E: Q: y+ }+ b    jnz     SoftICE_Detected
" u+ }. m! h! Z& C  v
5 q8 m' I9 Z) V# Z) y# M___________________________________________________________________________
% P0 l  {, i" T: o
* B. ]1 w4 z1 k+ f9 N7 k# h  DMethod 04: L9 Q" W# W3 e7 m
=========1 H/ R. t' M6 ~! l" D% j

% Q1 M/ u3 D; v, s" X( KMethod identical to the preceding one except that it seeks the ID of SoftICE8 N9 B4 c  a' Q+ m  x: s- d2 s
GFX VxD.: }/ }: p* L, q& a

, j8 e3 w* g2 K# Z1 b3 Y  X" _    xor     di,di7 D+ i- p& i6 Z! A( _0 l! S9 O
    mov     es,di6 Z- S( e9 ]6 g' F
    mov     ax, 1684h       * M1 N/ c8 q) F
    mov     bx, 7a5Fh       ; VxD ID of SIWVID* G: d0 F! f) a( t5 u( m- ]# g
    int     2fh
! s* X7 [4 h' w( U    mov     ax, es          ; ES:DI -&gt; VxD API entry point. |# T4 p+ m8 k5 m$ K  q
    add     ax, di
2 ]8 ^2 s& H" W& n    test    ax,ax& Z& n6 w: l# V1 z8 ]
    jnz     SoftICE_Detected6 C( N0 o# f9 B. @% G- T, \* m& s

& g7 s! N8 o( O' \6 k__________________________________________________________________________0 ~) U7 n/ m8 l

" J2 W% r6 g) X2 z. o, \8 I. g% k. q) u; u
Method 05% c$ k# x! p2 `2 d- Z, Y
=========
$ ]( n! }+ e6 O2 E4 o+ {4 l' b& ?+ Y1 K6 [4 y5 y4 u
Method seeking the 'magic number' 0F386h returned (in ax) by all system
$ U2 n, Y8 A5 [& J3 O8 F8 i; Pdebugger. It calls the int 41h, function 4Fh.6 V3 _3 C8 y1 B% ?$ Z( [
There are several alternatives.  
( ?2 E( l6 T, \# ~0 e
7 p* C( K. v8 j& A- i$ \/ \/ nThe following one is the simplest:
0 [. N, r$ Z* C& c7 L+ ~, F! e7 a. e1 ~1 Q8 k9 }3 U3 [1 ]/ u; M2 p1 C
    mov     ax,4fh8 |0 m" a+ E5 d3 Z6 @
    int     41h
" o# Z! j; T5 V# J# B$ X& r( G    cmp     ax, 0F386- P- H( H8 l: Y. a  F" ]
    jz      SoftICE_detected
" q$ \  D: o6 v: N
& p; h/ H" y4 H8 r3 j, ~( Q- O$ n- ~0 M. m0 `
Next method as well as the following one are 2 examples from Stone's
% P5 a  o  T( B  c"stn-wid.zip" (www.cracking.net):
1 M3 j# ]" n- v0 u$ l# m% q- I; s5 p
    mov     bx, cs
+ P: u0 l6 P  C$ V- }' v    lea     dx, int41handler2
. C. D5 m5 R2 r2 y# n    xchg    dx, es:[41h*4]* c* R& S! D1 o! y& d& t
    xchg    bx, es:[41h*4+2]/ D- G/ ~9 L5 m3 F8 t! U5 I
    mov     ax,4fh
* ~6 V! B1 u$ e* x# ?, h& V) [$ D    int     41h
+ _  K9 l) ~  c; |    xchg    dx, es:[41h*4]
# n8 o% _8 M0 _4 Y    xchg    bx, es:[41h*4+2]4 l% G( n9 a) Y9 j, i* z( l# D
    cmp     ax, 0f386h
3 g# u% _# p+ y; v" X6 b& S+ q& |    jz      SoftICE_detected$ G, N; D* l' T5 a# R
2 a' Q) ?+ O- e+ ^
int41handler2 PROC9 j  D. G/ I. T
    iret2 G( K; c  G6 F& D& Z+ d# P
int41handler2 ENDP
# y) W; n$ k3 a! k5 g) M% f, `* |
5 y: u! \$ [$ g7 u" i( P) [1 I2 k! Q; h
_________________________________________________________________________
3 M3 v( y7 T, o8 V0 k
6 p4 z1 k( T" ^4 y2 o2 P6 Y
9 I3 y) @4 {% v; O9 LMethod 067 d' E0 u5 {& L, |4 U
=========
, q3 e* w9 X/ Q! B/ L
# J1 h( \( _9 Q: y' j% N3 a5 _
& G& c( k" @) o2nd method similar to the preceding one but more difficult to detect:
9 z  A6 v9 I( U* U+ b/ b6 Z
4 d* j1 P6 ]' v8 N$ x) {3 T
7 F2 s- F% y: D/ d3 c7 ~) iint41handler PROC
3 g; z! g6 x8 G% ]+ Z8 i    mov     cl,al, b) @! Y- A0 s# e) S5 x
    iret( W0 X7 Z) M9 a2 h" B0 H4 B) ]
int41handler ENDP2 |" v* e: P2 S  w& e' P
0 u% N5 ], P. ^3 z2 B

7 w# r  [. ~0 F    xor     ax,ax7 _; J- f) J" I3 x- M5 f
    mov     es,ax$ b0 `2 N2 w5 {  g  D. p2 e
    mov     bx, cs, |# A& g+ h, n8 K
    lea     dx, int41handler; i0 ]* T2 w8 S* O0 t7 P  g# w0 h
    xchg    dx, es:[41h*4]" _/ K/ r! g1 z7 V( I
    xchg    bx, es:[41h*4+2]
$ v5 h! |' V  u    in      al, 40h4 P* X( k# t  f0 j# K! O
    xor     cx,cx
& K- N$ j1 d3 k9 B1 j' t! s    int     41h
9 [/ W. \* B8 Z) V5 G7 H    xchg    dx, es:[41h*4]$ b, w2 A- B: [6 Y. I; U
    xchg    bx, es:[41h*4+2]/ b2 {: ~, B! y7 z+ u) K
    cmp     cl,al1 H: x% e) b9 ^+ h+ L3 V8 O
    jnz     SoftICE_detected6 \5 j7 _3 j3 i
# x, W/ J3 e4 `3 h- u7 D
_________________________________________________________________________
7 i# C' e) Y8 @8 P9 `+ U4 j# y8 G5 \
& O* E3 P7 }2 |/ N8 K( iMethod 07
* e' H5 i# G8 H* Z4 l=========1 f* p- z& _+ Q5 I4 @: `
. ?) K( v6 p8 ~5 {& d) ^
Method of detection of the WinICE handler in the int68h (V86)
, n" O+ R& u9 D5 I. ^+ Z; v8 l6 D7 ~
    mov     ah,43h0 \7 s2 m3 C" \# K2 h
    int     68h/ P* b; A3 K( j7 w2 N
    cmp     ax,0F386h& @8 [5 I9 W/ h7 @' |- p+ Z( }. g
    jz      SoftICE_Detected
+ c1 e7 s; @  u
, _# I2 e2 Z# k# W6 x+ v5 r% j! w2 Q0 Q0 V
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
0 }0 \- p: R/ S; d& [2 X: L   app like this:
4 X- T6 ?" R. V& [# v) E+ Z; D! R
. H+ v" ~; y: W/ a1 o6 G   BPX exec_int if ax==682 @, t% Z6 y5 ?6 R
   (function called is located at byte ptr [ebp+1Dh] and client eip is
( j' \- N8 J4 c; V9 ~6 u4 O   located at [ebp+48h] for 32Bit apps)
3 F& H: v$ l+ K0 T: i( g! ^* y__________________________________________________________________________
8 t) `# B, o/ `+ m$ {% [9 W" f9 h. H" x
  G; L, g/ I& x/ \9 ]  a2 I0 d* d, w# g. h) J* S5 F
Method 08
' c2 @( a* M1 R- H=========& w4 F! M3 ]' r% F& H  M- ]
9 l$ [5 v) q1 V- K3 P
It is not a method of detection of SoftICE but a possibility to crash the" ~- \4 [6 I3 ]/ }
system by intercepting int 01h and int 03h and redirecting them to another* M0 {: A; m) |. ?! e! [) A
routine.: o) W9 S# I" y4 f
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points+ f' ]% p* ]% I7 B* {) v6 {5 B
to the new routine to execute (hangs computer...)
2 w) ^2 e, ~9 e
2 f; P* U' ]5 N" ]! P, C+ L    mov     ah, 25h
. e# A7 R9 H) S+ l" k    mov     al, Int_Number (01h or 03h)' L- c# [, i" I( ~; Z
    mov     dx, offset New_Int_Routine( X- v+ A% o0 W7 j
    int     21h
1 d$ g; T+ q1 D8 W6 @7 v
, ?$ _& h# r& }  J' H__________________________________________________________________________
- a3 D1 k, t% m1 z$ |5 z0 t5 T/ Z8 M% V, ]) s- t+ F
Method 09
3 m3 M$ g: O4 r0 j5 V5 m* y=========1 {6 ]! J0 e6 L3 }8 x

# s6 a' l8 h" @0 s4 K0 B, i8 _This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
6 W& a6 \' c3 D0 T! @0 h$ \performed in ring0 (VxD or a ring3 app using the VxdCall).
3 I1 j0 B" p) t( m( g8 ~; p0 m( ?' [The Get_DDB service is used to determine whether or not a VxD is installed5 i  Z2 {9 W) F+ A- I! g
for the specified device and returns a Device Description Block (in ecx) for
1 I) m- D$ z" Tthat device if it is installed.4 Y  J+ Q+ i5 y, [* b" E* K
' |- @4 M+ C: U9 u8 ^# R: P
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
; Q  C, q9 W' g+ u9 G4 K6 E* R( P   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
. H/ V7 D, [  M) [1 e% o   VMMCall Get_DDB0 k) L/ E  q# \; P; H! q( U
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed% m! \* {0 G/ V9 u% M& u) I0 D+ H

8 v( J' _1 @; L8 b8 E; t$ PNote as well that you can easily detect this method with SoftICE:- H4 s, i2 P. e0 K. z/ Z4 U) z5 l
   bpx Get_DDB if ax==0202 || ax==7a5fh
; p# N$ Q2 G1 j! f3 A- g6 q
* a: H  g1 _1 O* u% T6 |# k* M__________________________________________________________________________6 p8 i; |4 l5 z3 h- N
3 w. |$ j3 q) f/ J* i0 A
Method 10
6 Q5 n, p% ^9 ]7 s=========# n. z2 t6 V, ?+ J

: y) W, V* V; e; W3 `! _# H=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
4 Y% J6 i9 ?6 @) o/ p" O- U4 o  SoftICE while the option is enable!!
! L& a  O7 e% X& E+ T0 w
$ f$ c: V) u2 X( aThis trick is very efficient:( `2 O4 {1 ~( E8 m
by checking the Debug Registers, you can detect if SoftICE is loaded
* a* h3 n& |8 p6 K3 I7 q(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
) M0 [7 R' ?8 C+ Y( F8 ]there are some memory breakpoints set (dr0 to dr3) simply by reading their
2 D' J+ D6 H# S6 ^4 Hvalue (in ring0 only). Values can be manipulated and or changed as well
# v0 r7 a  V8 P/ v! B, H(clearing BPMs for instance)" ^" `1 N, \6 Z

+ W" U& \' T, M6 C__________________________________________________________________________- }. k$ {" s  X9 L" E
3 @+ g2 z1 q0 g1 s- t. J
Method 11
: Z3 ~+ A6 m, D" h* E- u=========
: V" l! N- e, v# }( u0 }5 \& F2 B
' l! d7 K% R, x- a3 o) |' RThis method is most known as 'MeltICE' because it has been freely distributed0 k* Z5 Y$ L- z% a9 m# m
via www.winfiles.com. However it was first used by NuMega people to allow% Y9 [% U' T" F8 i; D
Symbol Loader to check if SoftICE was active or not (the code is located5 U+ E% l& M$ Y; q. E* _
inside nmtrans.dll).0 X) S0 X7 d3 l" ^4 h
6 C/ f" L0 r( x6 l8 y1 _1 c
The way it works is very simple:
$ M/ ^7 \2 D5 g' [2 Z; \- [It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
, m5 D3 g# H4 OWinNT) with the CreateFileA API.8 f5 F% s( e5 i2 U) s: P

. n& E0 y/ v  L$ k+ q  ]Here is a sample (checking for 'SICE'):
% f; F4 {( K+ h" v# }! S
- o! n+ a) R9 cBOOL IsSoftIce95Loaded()3 D" _6 y2 h' Z; ^, X
{) z6 J$ K! B2 e: I$ v0 q1 a
   HANDLE hFile;  
: L7 t5 s" }& t8 z: [: Z3 q   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
8 E0 e+ _* x9 b5 j4 i0 c& V1 ^                      FILE_SHARE_READ | FILE_SHARE_WRITE,* {- U$ u  ~3 \% o. x9 Y+ S9 V
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);* O0 p) L/ ?! Q
   if( hFile != INVALID_HANDLE_VALUE )6 s, H1 U1 H, v  ]7 O% o$ c
   {6 ]. Q- m  }. T) q  |) [! ^7 Z6 g
      CloseHandle(hFile);1 p$ U8 |3 K! E  i% v9 A
      return TRUE;, Y) F/ o% m4 {+ \8 e* l- N( e0 j
   }0 J# n' n8 J8 b% Q. x
   return FALSE;
! m" y. [; t1 F1 R4 T5 f}6 Q& @4 i* M6 G/ y

% R1 n/ L: `$ x0 ~Although this trick calls the CreateFileA function, don't even expect to be
8 T7 v0 F( O3 U' Fable to intercept it by installing a IFS hook: it will not work, no way!
) D, Z7 W( H2 w" PIn fact, after the call to CreateFileA it will get through VWIN32 0x001F( S/ Y" s+ [! a  d2 g, w4 e. p2 f: ?
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
9 c( X' g8 n+ D5 K, o) n4 Zand then browse the DDB list until it find the VxD and its DDB_Control_Proc, q: w7 p5 A& i! s& o! f
field.
1 a9 Z5 B+ ~; \. x" G+ YIn fact, its purpose is not to load/unload VxDs but only to send a
$ S! G% A9 }8 P& {+ ]$ W) DW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
6 H; S4 j* F- m& Z3 b  a) eto the VxD Control_Dispatch proc (how the hell a shareware soft could try
! {4 ^6 ]' \# x' U. d" zto load/unload a non-dynamically loadable driver such as SoftICE ;-).
$ x9 y& S" S3 d+ PIf the VxD is loaded, it will always clear eax and the Carry flag to allow
8 L! y2 [) f3 Jits handle to be opened and then, will be detected.
. J4 t  S. \5 G# G) ZYou can check that simply by hooking Winice.exe control proc entry point
/ I6 Y8 f' ^- }4 Q, rwhile running MeltICE.+ F4 j) U& ]+ ?7 |! \# H) ~" O

2 v& h1 E! C1 i" f/ I* r4 N$ ^4 Q/ T7 q7 W3 n, E1 P" E
  00401067:  push      00402025    ; \\.\SICE! A4 V% Y9 k% N! E0 r
  0040106C:  call      CreateFileA4 \  M+ s. @2 E8 I  g
  00401071:  cmp       eax,-001
% `2 q! y- S2 J  00401074:  je        00401091
) J1 t2 ~% @1 E# G* y' W- m: {3 {" F- l
; C; \6 Y( l( s: m/ _  u$ j: I
There could be hundreds of BPX you could use to detect this trick.
' E0 O  N4 e7 Z-The most classical one is:
4 g1 @/ b9 i; n& F1 h2 g  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
2 |" ?2 W0 {  G; q    *(esp-&gt;4+4)=='NTIC'
* z5 c$ [. `- H+ _! G/ f/ K( }) B, U2 \8 ~" B3 s# Z, f
-The most exotic ones (could be very slooooow :-(
5 D0 Q7 Y( ^+ O* M! ]   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
" G9 l; |& Q2 O9 X0 l, `' j7 t     ;will break 3 times :-(
" p( x' j& d: P5 O% v( ]
! h& Q% l- f& K* S9 f. G-or (a bit) faster:
/ \# Y) z6 W% `; s' q5 S2 j   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')5 w. v; x5 a, ]& o/ r" g1 K% T

3 ]# \9 a1 ?7 X+ K( x: c   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
9 c' T, H. u% h2 d8 Z- L; ~0 `     ;will break 3 times :-(- D  f' d: f* W' \# y) r  O

7 }" ^% h, l. ?9 R1 m-Much faster:- Z. X6 A6 v! i# \" O
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'+ A) I; C( E5 F- y
7 r+ k6 f9 S. U9 m: W; y8 M
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
# D9 a4 f* S+ o9 b: I! bfunction to do the same job:% s- H6 M: ]& \. w( ?0 U' B" G
' v- P1 u+ C' m4 L$ |3 ?
   push    00                        ; OF_READ  g1 m8 v% Q# R' R8 i
   mov     eax,[00656634]            ; '\\.\SICE',0
  M9 m  |, R$ F! k/ b   push    eax
  ~6 ]: @& i2 n* A6 ?9 U9 Y   call    KERNEL32!_lopen/ E' `& u% m( o% F: B( ~) p
   inc     eax
& A2 v0 N7 V$ F   jnz     00650589                  ; detected
  U) D. ?8 u* t. X1 }: e   push    00                        ; OF_READ  B' C% O2 r! [% |8 T6 A
   mov     eax,[00656638]            ; '\\.\SICE'% \; c! P7 C2 m' x
   push    eax& _& V: f: u+ v+ h& ?; D. E$ d
   call    KERNEL32!_lopen, R+ @* E0 _6 C- X. t
   inc     eax" h% J4 }- P: J  p2 R# M" `
   jz      006505ae                  ; not detected
! F! y/ b# s# a6 Q" m9 Z. X9 W% R* {4 i) W
7 y: ~  `' y6 E# r6 `
__________________________________________________________________________
/ H3 o3 q1 T5 p# z( H( d1 B3 d
1 E1 z4 a# O+ Y9 Z7 CMethod 12
2 F0 e! K5 m8 c" O=========
2 [7 X. Q" j( W0 {1 F# P
# {3 h4 f2 u( k" t: X5 ]0 k6 lThis trick is similar to int41h/4fh Debugger installation check (code 05) M3 y6 N2 }; a# `8 }! {
&amp; 06) but very limited because it's only available for Win95/98 (not NT)
+ L) U1 a2 g- N9 b8 Ias it uses the VxDCall backdoor. This detection was found in Bleem Demo., V' B2 `0 t) k% Q$ B; {0 B

+ y/ L# E2 V" Q- e- w) G# U   push  0000004fh         ; function 4fh$ y9 ]2 R6 r; d1 k5 p& M: Q# z6 }; L
   push  002a002ah         ; high word specifies which VxD (VWIN32)
" i. L5 U3 z8 J                           ; low word specifies which service
9 D% R- j( N' p% d                             (VWIN32_Int41Dispatch)- E0 L3 W3 \! `7 u5 g/ Q! b
   call  Kernel32!ORD_001  ; VxdCall, |3 h$ b  [8 \# [; i& T  Y
   cmp   ax, 0f386h        ; magic number returned by system debuggers# {% }8 q! a, {# U
   jz    SoftICE_detected3 F' s1 y/ R* l* u  V! B

3 [( ?% l0 ?7 n4 I7 @  r+ k5 ?Here again, several ways to detect it:$ c" ~# W6 ]7 Z( |+ j

5 k1 m3 C1 c4 ^$ V) T8 n" a    BPINT 41 if ax==4f* M% J% k1 X8 W4 s3 E

- N* f& f- U  g  b1 b5 J- H) l3 L6 k    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one' Z+ ?, h: |7 H# _  R4 N1 ^

& n- n1 @5 y. K* Q7 t    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A1 }' r$ q* l* ]/ |( Q1 r# b4 d
) N/ Z; J6 |9 o9 ~6 Z( X
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
- t# ], Z$ Y6 B& a$ |' q
8 `% s: @* G0 E__________________________________________________________________________4 L/ L2 v) I0 a) [2 N

% B9 [. y  T. Q7 \Method 13
1 x! |; _' F6 v5 W8 K# x=========$ a6 y" \' G* o! J- X2 A( o
8 J% N4 j) r5 [# p4 E
Not a real method of detection, but a good way to know if SoftICE is2 |  Q  M& H' [+ T
installed on a computer and to locate its installation directory.
; u' r' B+ Y2 |0 i4 P0 L) XIt is used by few softs which access the following registry keys (usually #2) :
; x6 k, x+ C% H7 G% ^: P/ q: r
- Q7 @& H& c5 Z0 ^8 H1 c! P/ q7 S-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
. S3 L' P- B+ g; F1 u( R) ?3 A\Uninstall\SoftICE' ~8 }" R. H& y( p/ O8 n
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
3 ?3 _# l3 B/ x8 m-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
( {0 f" q; i( @7 }7 s5 b+ J7 \\App Paths\Loader32.Exe
! H" f) ?+ C  H# j2 G
2 C: n3 n  ~( a/ G) \' y* W7 _+ A; Y5 f+ S+ w/ @
Note that some nasty apps could then erase all files from SoftICE directory
9 q- M; @9 Q% |& a(I faced that once :-(& x) l- w' R  w; [$ F% B

( B, ?/ s0 h' o# L+ V% }: d. l( r9 }Useful breakpoint to detect it:" f9 k/ f3 h; v6 z7 H$ U8 _
  N# Z5 p0 P7 N
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
( F7 ?: ]' H! J$ g
. U7 l2 H9 V3 |& W5 f$ E; {__________________________________________________________________________
& t1 q  o- i" A& Z) X" }5 s  Y4 H3 ]- ^3 F, R

  M5 {6 K% L: T% S; XMethod 14 : }# n' [0 E5 |  a4 k
=========5 |3 d5 K0 `  Y% Q6 [) g

. b* {2 O4 v& fA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
+ q/ t( l7 G& L# v8 yis to determines whether a debugger is running on your system (ring0 only)./ B5 a% [' F) U6 w' W# p

5 ]# g, j7 [5 a" d' {  h, W   VMMCall Test_Debug_Installed
0 S  P6 A! L+ r8 k$ e7 b3 C   je      not_installed
) K1 u# c+ r  N- d' Z
( N& [  ?1 s! p; r) nThis service just checks a flag.: Y. C$ N% k# u- H' D
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部