About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>  o6 W3 m: P2 |$ I& I( M3 a6 z: j
<TBODY>
/ X1 s+ y! m9 d<TR>- A# @+ J$ w. s1 e! Q8 J3 F, ^
<TD><PRE>Method 01 ! E9 q6 _+ X  m" A
=========0 x1 q" |' z4 D, K

/ r7 V8 b6 i5 x$ sThis method of detection of SoftICE (as well as the following one) is! }1 v# t0 L9 U9 L- p" _9 Y
used by the majority of packers/encryptors found on Internet.# B% W5 c5 T: s( I% j7 Q7 B1 w
It seeks the signature of BoundsChecker in SoftICE3 F! E1 p5 p9 z

  t2 x! S' |7 j& c: L( A    mov     ebp, 04243484Bh        ; 'BCHK'0 R2 {6 z1 v0 Z3 B( m
    mov     ax, 04h( S8 r" X; ^9 V
    int     3      
* e9 t- E2 k2 N( I- N1 \9 r, B+ v    cmp     al,4; t# t5 @1 ?3 `
    jnz     SoftICE_Detected9 o$ @! h/ O8 J: r1 y/ K. G
' Y6 ?; Y: g) [; C6 P% I  E
___________________________________________________________________________
0 l+ ?, C7 V. e) h6 i- Z. G; [
* }) p: t& Y% [& l/ r! kMethod 02
5 W! o) Z* T0 n, f/ i=========" I$ ^! f0 U1 [! |7 `9 h
; F$ d) l* L6 P
Still a method very much used (perhaps the most frequent one).  It is used/ q6 j, v1 A0 K( ?6 J" K2 O
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
! C' s5 ]1 u) a- i. |; M' E( uor execute SoftICE commands..." U  k5 t& ]( w  f* L( U4 s
It is also used to crash SoftICE and to force it to execute any commands
( q2 z$ \; W$ {: S5 x- E1 J(HBOOT...) :-((  * s8 [6 q7 h" x0 c  i; M

! ~; j# c( E* |3 }Here is a quick description:% @1 S+ z) l: a7 C6 o
-AX = 0910h   (Display string in SIce windows)' P& q, |3 _- z* o$ J. l, T
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)# c; W! }8 c& D0 C" L- t
-AX = 0912h   (Get breakpoint infos)* _! D6 v$ E+ v8 K
-AX = 0913h   (Set Sice breakpoints): q8 D* Z' j: t+ R; `- {
-AX = 0914h   (Remove SIce breakoints)/ [1 Y9 k- c3 t- R' r) H$ h8 C

  z% A+ M! b4 r2 A9 ]7 EEach time you'll meet this trick, you'll see:1 X7 P/ p: m$ Z( c0 j6 ~/ h: ?3 p- [, t
-SI = 4647h
5 P! R. G3 d$ a( T-DI = 4A4Dh
& l9 ^. q; c* m/ f6 N0 s! n4 iWhich are the 'magic values' used by SoftIce.8 ~' D) e- y2 @( J* t9 k1 r) V
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.# F: Q' x8 `1 c! V

7 B! E% [9 y/ q+ ?' d) @Here is one example from the file "Haspinst.exe" which is the dongle HASP
. S4 O/ y* s) V- ], Q5 VEnvelope utility use to protect DOS applications:
/ {& P. H+ U. \4 r0 y4 L: }2 G: M! q' O5 C
2 J8 E3 v' q  |4 H& Y
4C19:0095   MOV    AX,0911  ; execute command.
" Y1 i  Y$ C* v, Y9 c( }- q4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).! T- W- B5 z6 w  B& ^0 }  W
4C19:009A   MOV    SI,4647  ; 1st magic value.5 a( q+ K% M' R  v9 X2 }
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
, m6 q! \- N. E1 Q- g7 p7 r7 n4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
: k; A5 D) x0 U$ u7 n4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
: @" R9 A: `; c4C19:00A4   INC    CX. ~! j  v% M: `( U7 U# n. c3 f
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
! q7 k# V  i- l; Y4C19:00A8   JB     0095     ; 6 different commands.
; j- u% J2 T* J# E5 U! H4C19:00AA   JMP    0002     ; Bad_Guy jmp back.' [/ D9 c8 c! U0 u
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)3 a  p+ o; H7 c% [9 ?" }

# s( X' H+ M# P5 S% O, tThe program will execute 6 different SIce commands located at ds:dx, which
, q/ `$ z; S/ N4 i% r! L6 pare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
' D8 X4 A" v+ C0 z+ y! P
/ H0 Y: Z9 w+ F; x$ d0 f8 d* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
3 l7 l( g6 H9 M. `7 D___________________________________________________________________________9 q6 W& f& R2 q& Z$ [- ?; ^' d
6 a( c0 d" {: I1 E
# A( [" ]! O* r6 u* \! P: ]9 W1 f
Method 03
0 o2 D" i. j0 Z5 g, e( G+ J/ T" B=========  T: O! r1 d! ?# a* P+ c8 G4 w
3 ^  B! F! H, \& B0 X% ^: [8 _
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
; k& {  N- m+ G; M' L- J( x(API Get entry point)8 ?3 p4 Q' b5 ?, z# Y; T2 S* u
        , Y( y; d* ^+ z* w% c" _

) X0 X* E% E# h2 g& p2 A2 ]3 W    xor     di,di
# v; e  R6 P. ~% y  m    mov     es,di6 v; ]: {5 I# ?, |8 V) a
    mov     ax, 1684h       : }. @8 V2 W- {
    mov     bx, 0202h       ; VxD ID of winice
9 Y. O8 P% c' G- x+ I! {2 C0 |    int     2Fh: O! o) V2 v0 G/ i( T
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
( C+ x: @* E0 g) K! h    add     ax, di
: ]6 j+ k0 h/ j9 V    test    ax,ax6 T$ Q# T  l( [/ ]6 i
    jnz     SoftICE_Detected: T' {% j+ o; e# [4 ]) o, @7 ~: s
' z. p: F# d0 j
___________________________________________________________________________9 M- ^; q1 y& ^! g1 \
4 z3 {( `, z- Z0 |
Method 04! n, }; Y& l5 z6 O
=========" \, k& X* Q1 Z- n; X4 n6 o5 R
* d; |/ c% c( g% L) j; G# F
Method identical to the preceding one except that it seeks the ID of SoftICE% w* h* H; W) c
GFX VxD.6 e& [8 y  v  g  Y, ^9 F% c
6 b" {; d: z4 G3 f
    xor     di,di
0 r- i) W; _7 D) C4 z7 {    mov     es,di
6 I; t" B  M0 T2 B* P    mov     ax, 1684h      
2 _) [9 v( L6 y  F5 @    mov     bx, 7a5Fh       ; VxD ID of SIWVID' N/ s' P7 }! `( J
    int     2fh
5 G! p+ a9 q" I( F: Q1 {1 p    mov     ax, es          ; ES:DI -&gt; VxD API entry point6 p- O' i7 i! U) j# V+ r" q" m" n
    add     ax, di
$ O0 S( c  y: k4 K7 n9 P9 l- N5 D    test    ax,ax
- G: K! r# e* x; R; C    jnz     SoftICE_Detected
: f0 Z2 q0 Z% E6 ]8 d) a% v( c/ d1 @. u$ _2 E. K. U
__________________________________________________________________________/ o+ n7 H2 |+ x4 k1 n8 U* u& N

+ n" Z. S% p/ e# F
( k! D3 Q1 z5 }4 c5 GMethod 05
1 T; j9 [6 w6 X; O, u  \4 L=========
  ?1 J: z( O+ G9 y9 P
+ z4 S$ T& x: a( w; bMethod seeking the 'magic number' 0F386h returned (in ax) by all system, N1 B9 k, D( x" [
debugger. It calls the int 41h, function 4Fh.
8 w5 e- q5 l8 j7 \$ G, VThere are several alternatives.  
* |1 s3 |3 Y/ z- ^. B! W$ B1 E2 T8 Q: g
The following one is the simplest:  c( h: x7 L- s3 A

$ h( t! ?1 u' X* {  \5 B: m1 ?% V    mov     ax,4fh
5 Q5 K! B% x' u* j% q    int     41h
! h5 W+ l( Y' h; O    cmp     ax, 0F386! i% g* w2 Y2 p1 w5 @
    jz      SoftICE_detected) r6 H. {% w* T" J- I2 D6 U* T
, T9 E, T# e6 X& N' Y1 Q

  Z; r* Y3 w' B5 `& XNext method as well as the following one are 2 examples from Stone's 5 P) W# y3 E- N7 I; \# E+ P" |+ J
"stn-wid.zip" (www.cracking.net):0 x5 v3 D& b5 ~" i" s
2 H5 e2 |/ y$ ~8 x+ j' Q
    mov     bx, cs
2 U: W7 N. q3 t0 o5 `    lea     dx, int41handler2
; E3 s! v% e/ v    xchg    dx, es:[41h*4]3 }. w  ~$ m& D. k! H
    xchg    bx, es:[41h*4+2]
5 |: a* u; P# e$ P    mov     ax,4fh
4 J( q$ X& c( q* }7 ]4 y  W    int     41h
) l' J2 N0 X2 Y+ u& C. J# D$ i    xchg    dx, es:[41h*4]
7 F% R7 Q' ?1 c7 Y    xchg    bx, es:[41h*4+2]
  G7 t* k, R! s/ ]: ?    cmp     ax, 0f386h
6 R6 q- P' Y" _! N& q% d    jz      SoftICE_detected
4 O1 s- x! d' x  V
7 J( m1 D+ s% \# _) Iint41handler2 PROC
9 v6 n+ G  E0 E    iret
1 u1 n* s- @/ mint41handler2 ENDP+ ]4 z& t3 R( F$ \5 t* @/ O

% l0 V0 V3 ~8 E- B* U/ i- r% C2 }" l0 h6 A" B+ o
_________________________________________________________________________
2 s. u0 Z; i% `, {9 M
) v& `: N  _, h7 x( E" v- B
' C9 a6 S( f2 f% Z& Q: [Method 064 D! B  G3 \/ F9 A9 W
=========
- S! N' [& \( d4 @
9 ?! c9 ?4 b) s0 O! t$ I$ X: d4 h  {% }
2nd method similar to the preceding one but more difficult to detect:  {$ @& ?' Y. M$ M" [

4 E' }& Y: B- J! T& \
  b6 C! Y: u3 Qint41handler PROC
5 r2 b: `3 l3 b: E* d6 `9 n    mov     cl,al
0 ]" Q% F% [" s' J* O2 {4 a    iret
1 R+ V8 L- N7 Jint41handler ENDP
, i5 z/ ]. `  [4 ]# i' v5 B8 f3 U& X( d8 t+ x. Z: [! g6 r
1 r, [$ Z0 j; D9 }# V
    xor     ax,ax
& g' p* p5 ]& a    mov     es,ax! i  A9 n3 C( \# W4 x
    mov     bx, cs
. b9 X0 O& t! k! Y3 M    lea     dx, int41handler
9 f( ]3 ~* A/ D7 h) p: _4 ]" }* F    xchg    dx, es:[41h*4]
% Y# j/ \0 Y7 h; P+ k    xchg    bx, es:[41h*4+2]1 D" z/ w" g- s: m$ @) O0 H
    in      al, 40h5 i8 O# H. ?! ?( `9 B: N# s! T: Q
    xor     cx,cx* ~4 j) d' K6 B& ?0 p+ M
    int     41h
/ D8 j# E3 s' p1 G& _, L    xchg    dx, es:[41h*4]" n* d. m0 \. P. i
    xchg    bx, es:[41h*4+2], o2 `( g" q3 E3 O( w
    cmp     cl,al
6 g& K7 _/ d* d. U. ?. T& e' }* L    jnz     SoftICE_detected( a6 }$ c) L' n7 [8 Z
' _: O; Y( R* e$ @7 ]  |, Z: u
_________________________________________________________________________
( A& h% ?' n6 Y4 S! a- h% l! g, |: n& y( p0 I6 W
Method 07! n8 r4 S" W- i: l
=========
+ H& u% {% y0 S" w: H
5 F4 V# h9 ]  C# R3 H. |Method of detection of the WinICE handler in the int68h (V86)
$ c9 O! o/ \6 P  ~1 v1 U, }, {2 e, Q3 b8 i  u( u5 u/ }" X: b7 I
    mov     ah,43h
* s* F8 m1 B9 [* J    int     68h& R+ ~& N4 C# t( R$ h7 o2 K+ O
    cmp     ax,0F386h
  p2 F) X3 p$ k7 v: y- P5 E    jz      SoftICE_Detected
) P) i1 s4 q) P$ F! `$ d8 [; K! d5 Q: Y$ {% ?6 L

, d* j7 X( O% _& h3 F=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit$ W, m3 c$ |( M% A4 S7 n# \# i; ?! e
   app like this:
$ s: Z- v' P' n. Q" H  K4 `$ W7 C/ R* t: g8 @$ C
   BPX exec_int if ax==68
, @8 X$ q8 i7 D' d# E5 Y) d   (function called is located at byte ptr [ebp+1Dh] and client eip is
- u4 w" ?- ]) [: E( B   located at [ebp+48h] for 32Bit apps)) a+ m( a6 W3 T% a* r( j! p
__________________________________________________________________________
# _1 W# \7 P" h0 e3 |. ]
" {4 c6 J+ I" Y
7 J9 Y+ K' A0 w# }. M0 {Method 08
$ d0 b1 V  a% D- P4 ~$ c- D=========
9 C/ n2 K' {9 k2 H* |/ A( O% j! W9 \" l/ F& O+ P
It is not a method of detection of SoftICE but a possibility to crash the
6 V) j8 V7 m5 ~1 b1 X- Xsystem by intercepting int 01h and int 03h and redirecting them to another7 I6 X. Z/ p3 {4 G
routine.0 l) y* b$ m( X( L
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
1 U" ]( h1 S6 `$ i4 T! q- Dto the new routine to execute (hangs computer...)
* }& \  f8 Z. B5 t% ?' }# }8 ]- C- D: q0 g; x
    mov     ah, 25h
$ O' g- {) i" z* P7 a$ `    mov     al, Int_Number (01h or 03h)
% \& i1 Y. ~) a; D8 Q/ v" M    mov     dx, offset New_Int_Routine+ g- }+ _, |: L" r* b, g
    int     21h
" Q7 H3 f  T* r2 G( a
& Y8 X+ w, o6 y: Q__________________________________________________________________________, i4 g7 v% j, a  Q

  g. B# ~, B  }: |Method 09
7 g8 _7 k, ~' l! @& Y=========
6 Q6 l" _# I1 V0 y8 [% Z! }) G: x6 o. o! j& L
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only7 l) E! y) L6 U5 _: d) P' \
performed in ring0 (VxD or a ring3 app using the VxdCall).; G& Y4 f2 Q, M: ?$ k( ?* u, }, M
The Get_DDB service is used to determine whether or not a VxD is installed/ M' y' z/ m3 c. x) U# S
for the specified device and returns a Device Description Block (in ecx) for
7 B/ U/ t2 d# W& U& |2 z  _2 |that device if it is installed.& z8 D0 g( R0 s4 e+ b/ w9 l4 |1 m
" L5 v' Q$ ?8 @
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID5 ^2 K; J; z5 c
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)7 U, }+ m: \' Q* h( F" l) G' i
   VMMCall Get_DDB: a' G* e: k. p9 K: }2 v3 b
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed1 W6 K7 X' F3 u% f& A* \
, Q( T' r6 u9 U' M8 t1 |* B0 T
Note as well that you can easily detect this method with SoftICE:% f# H! U6 |* N5 Y5 P
   bpx Get_DDB if ax==0202 || ax==7a5fh' V& N* H; c5 r- ^  B) B) ?
* f$ x* A6 [% R2 t6 @
__________________________________________________________________________
" l( N0 @0 D$ w* a  B7 T6 V" Q7 @: t- t9 X1 r7 A* R
Method 10
* L* b6 [8 h4 s  p" u=========" _1 A* h% D  G/ [8 W' |  M' A% e

3 t. v& A4 o0 j2 @; {  o=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
( l" n5 U  g+ A1 m+ R  SoftICE while the option is enable!!) }8 G/ Y/ L* U9 l  P
6 {+ i( L; Z, N! a2 d- p% E5 K- @
This trick is very efficient:- v  a- A3 g, `1 i/ v, R
by checking the Debug Registers, you can detect if SoftICE is loaded
/ X8 X$ w' i" {; y5 c4 G3 J(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
' ]3 }( M- {. Athere are some memory breakpoints set (dr0 to dr3) simply by reading their
8 c8 c0 {+ y! n- G" U; C8 G3 Xvalue (in ring0 only). Values can be manipulated and or changed as well- e7 E) B4 @: V' d5 I% s
(clearing BPMs for instance)" [0 c/ T1 y7 n( e6 L
  k" ^% q$ u2 b
__________________________________________________________________________
2 B: W2 o" l6 i8 a' p- E$ v
# |  W" d/ H& j5 Z, d' OMethod 11
" O5 @& A, e/ S6 L' b  H6 ^- Q! l2 k, Z2 x=========
8 [4 L+ k* k1 _" ~; R+ `7 u  R2 S% U& h5 X
This method is most known as 'MeltICE' because it has been freely distributed5 c' m/ G) F% v$ W8 V! {" r0 W
via www.winfiles.com. However it was first used by NuMega people to allow8 F( M5 Q! W4 d* {/ V; l! C$ K
Symbol Loader to check if SoftICE was active or not (the code is located$ g) [, j6 K" ?" U& K
inside nmtrans.dll).
2 P; ^% _! E- h: a- l8 g/ T/ p* ?5 z8 v% S+ B" o; x
The way it works is very simple:
  y- h7 [  a, o1 X& f8 uIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
  x- V( h  i, iWinNT) with the CreateFileA API.+ n0 X# U' R; \1 I( u, x

0 ^$ c+ \& _# b* ?' |- [' XHere is a sample (checking for 'SICE'):
" F& y+ x( G( K0 P* \- y
, C; g7 \8 ?$ G+ F4 l0 x8 z3 NBOOL IsSoftIce95Loaded()
+ B" [( r# u8 M+ P% n- g{! j( _8 i8 c7 ~& o- A. Q7 V
   HANDLE hFile;  
6 E4 \0 N. P0 e6 W( M   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,: u. r' l  g8 A3 |
                      FILE_SHARE_READ | FILE_SHARE_WRITE,2 W* ^5 f# k' W2 \( v6 \: m
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);/ {- b: V# x$ n5 y; J1 C
   if( hFile != INVALID_HANDLE_VALUE )
) n2 @( }2 \) k, Q) t" x/ G( w   {
9 S* Z# r5 U, v3 u! o- M3 g# O7 \      CloseHandle(hFile);
8 ~# j- u+ o- d7 i6 Z; I      return TRUE;7 s  m& b% Y5 D1 T. E
   }3 B9 B8 |( z! o$ z
   return FALSE;/ h" u, T; N$ j- {$ [: H/ z
}' A3 R  E% Z" ^# `& w8 Q/ C) ?
5 h2 q( R1 ^1 c9 w2 W( O1 c  ]) U
Although this trick calls the CreateFileA function, don't even expect to be
0 e0 Z, O% P, d  i7 G+ g6 Fable to intercept it by installing a IFS hook: it will not work, no way!* B4 e* R3 C$ d9 N2 {) Z
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
) O- C$ ^1 }5 h" }+ s0 m* Qservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
0 r# B. v+ E+ `! y2 |7 n0 j1 c' ]and then browse the DDB list until it find the VxD and its DDB_Control_Proc
. D8 X  `2 Q# \1 Y8 C& wfield./ \4 d% S; t% O; F2 B
In fact, its purpose is not to load/unload VxDs but only to send a
. \/ b/ e4 D& zW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE); `: n" c1 i/ K4 W9 U5 ]+ N
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
; j; |( @$ F! ~  j+ ]to load/unload a non-dynamically loadable driver such as SoftICE ;-).( V8 i/ E! p$ p% Z% p! l. d
If the VxD is loaded, it will always clear eax and the Carry flag to allow
9 @7 j) A5 c: Z1 }its handle to be opened and then, will be detected., O, B6 O3 Z$ b
You can check that simply by hooking Winice.exe control proc entry point& E* ?7 I7 f9 U: [$ |
while running MeltICE.
/ ~' l" V" r/ X9 r6 k" P% @8 N4 G, ?& l, ~
6 @4 u2 L3 e. v5 y2 K
  00401067:  push      00402025    ; \\.\SICE! W& x' b5 s1 R* P7 ]
  0040106C:  call      CreateFileA" a, U! M) S! f6 I; G  d0 o
  00401071:  cmp       eax,-001
2 E* }6 N) w7 d+ g  L8 m0 n7 i" o  00401074:  je        00401091# t. \+ N& ^, l4 `! _( Y
5 @7 w. j8 \/ B& p/ \3 o

6 n/ D/ z) e: ]There could be hundreds of BPX you could use to detect this trick.. ?0 k* B, n4 [' x: V5 Y+ _
-The most classical one is:: V  ]+ j' e/ V; {$ f  @
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
. X. b2 L; {" M' y7 T* p9 B+ d    *(esp-&gt;4+4)=='NTIC'
7 I1 U& y# b( h
7 e4 f; k8 j  L2 S; o-The most exotic ones (could be very slooooow :-(6 L  ?* p; E/ B
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  / m/ Z& q  n# O3 Z  D. @
     ;will break 3 times :-(
) f4 ^5 i, {: P$ z5 M( v- ?+ m! A4 R7 P- |+ z& b; l5 {
-or (a bit) faster:
$ W) ]1 c% |# I! M6 h6 x, ?7 O   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
) c) q6 n5 C. q
9 x- M8 m) V! L1 T5 f9 [( M+ e   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  ! k  l1 P/ b2 G3 ~' U/ u/ w, F
     ;will break 3 times :-(& y: t3 V8 L) ?0 d

, k/ M, x* c+ c6 G9 b$ ^-Much faster:
8 e' s6 P: X! G; b  }( r   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'( U4 O  N2 j# K# r7 f
( T4 j6 R* W! ~: x
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen8 B, i3 k: v) O! f
function to do the same job:
6 n, y8 b9 Q) u- M5 G" b  i0 j0 Y9 ^/ n2 [" h' g
   push    00                        ; OF_READ
) `7 N1 K4 p& x9 H   mov     eax,[00656634]            ; '\\.\SICE',0
1 L% S2 t: N! U   push    eax
7 k8 q9 F7 E  k& G7 @- v   call    KERNEL32!_lopen% b: _' n3 N1 V3 a
   inc     eax
: G1 J/ {# Y* D3 `5 T( E   jnz     00650589                  ; detected
# z. h6 b2 ~) r; i6 j7 m7 E   push    00                        ; OF_READ/ S# H, C/ Z- j1 X4 d3 K! |% p
   mov     eax,[00656638]            ; '\\.\SICE'8 N  n3 i3 E( Q
   push    eax
9 ?2 i2 ]: R1 Y0 s1 v! L" E: {9 ~   call    KERNEL32!_lopen
6 L& P" F! C1 k6 y5 j   inc     eax8 O; E8 W: T/ s, }. ]4 s5 l) M
   jz      006505ae                  ; not detected: P, ]- h3 @8 n: x

9 h2 p/ ]3 @2 ]' h0 s
! `/ |/ l0 N0 y& Y3 [+ |__________________________________________________________________________
2 D. T* D8 b  f4 g# p  r: m/ L/ b  _7 x$ g
Method 127 S& O2 P7 P5 O1 B) t
=========1 V; G% Y! C% L3 R

, ^9 h3 M4 {( s% G  BThis trick is similar to int41h/4fh Debugger installation check (code 05
5 d2 i8 f. Y; [; W% z&amp; 06) but very limited because it's only available for Win95/98 (not NT); Y& `8 t' Z0 C; E( Y5 @
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
2 b4 }# o1 i9 f$ F7 E  d  K% o; t! y1 b; b
   push  0000004fh         ; function 4fh* y$ t, A4 P) ~/ e: j
   push  002a002ah         ; high word specifies which VxD (VWIN32)
1 w0 k  w5 O' M% P' I                           ; low word specifies which service
7 o% G; [' `) G5 `- j) C- O                             (VWIN32_Int41Dispatch)3 }+ d0 o1 ~9 r7 O$ s- M& ]4 g
   call  Kernel32!ORD_001  ; VxdCall
; \* e" ^* Y! ]8 a( ~   cmp   ax, 0f386h        ; magic number returned by system debuggers* O5 M/ }+ P4 u1 [% M
   jz    SoftICE_detected( j* T5 ^( H  u5 k+ Z2 d
* }4 }" H9 X' k, e) N4 |
Here again, several ways to detect it:1 H$ a8 J+ z: s1 n* f8 J# S  Q

$ }4 [2 @3 o0 q/ L# p+ S    BPINT 41 if ax==4f2 C4 W! Z' q0 A! i5 u

; m; z7 P- o2 z2 |6 X* |2 J    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
9 j8 P0 c5 x. ~6 m$ t6 W0 ~& Q: `8 a% Y) G6 ^. A
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A2 v' A0 Z5 c! [  x8 W. ~7 ~4 o
* D1 A4 a  r$ V' C
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
& |3 B0 t5 a4 X  o
. b# P1 D# [/ R' a__________________________________________________________________________
2 B# H8 e  K2 W- @
; ~. ]) v8 J5 T' XMethod 130 w" a& I( o. U5 p. B7 C
=========7 l9 Q' H: P* L7 G8 Z  x
' b" x/ }) R$ \2 R5 J
Not a real method of detection, but a good way to know if SoftICE is1 l) v/ ]  s8 I' |/ F' C; {
installed on a computer and to locate its installation directory.
/ [  h# I. ~$ |, S* h6 ?It is used by few softs which access the following registry keys (usually #2) :2 L* t  {5 q) u0 n8 K: [
* d! }9 T+ r: p; `# ?. D1 ]
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
' W; Y' x5 C- F\Uninstall\SoftICE
4 [. W. [) B/ ~0 f9 v/ t1 _2 A, u+ R-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
  E2 K0 j, i/ i- X- ?-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion& [! r4 o: {: G8 R
\App Paths\Loader32.Exe4 X) Q1 Y3 a8 f7 h6 Z

( y* E9 O; D& F4 G' c# N2 A$ |( `; x  K# a
Note that some nasty apps could then erase all files from SoftICE directory
0 Z) v: e4 E' T. n( N(I faced that once :-(0 c8 P! W: Z0 O# a+ F
: K! ?& Y/ t2 }8 l. G" X
Useful breakpoint to detect it:
) ~. U4 ]% e6 R8 D' d, _" `4 g6 F8 w0 I! d( z
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
; s/ [8 M2 Z* ~: _9 Q% E
( ~8 R; d1 h& z) L3 A__________________________________________________________________________% v! K/ v3 i, Y& z+ i8 t: g

- t, L9 H4 R4 W& b1 W0 ?8 g3 |. A# d! {' a2 F. q
Method 14 8 L6 A' o, S0 z- }. ~& C
=========. a1 ?2 T1 v- v5 D. q$ \, F

% a& T! Q+ p7 n# b! Y' nA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
( |6 |6 [" u: v' ^5 q5 vis to determines whether a debugger is running on your system (ring0 only).& e$ p& }& m6 Q9 k
$ V: x7 U7 t5 a2 B$ v6 ^; u
   VMMCall Test_Debug_Installed
& @5 W6 m- |# i; f2 P1 s7 O   je      not_installed
1 ?% \; s$ ^% M4 J: ~
8 p) \; k( @) Y! Q) }+ m; aThis service just checks a flag.
% y$ _8 A; g' o0 o8 a5 B</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部