About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>3 o' p+ U" n9 ^
<TBODY>
# N) N) }( J3 U# x' f<TR>
8 i  H7 [$ M4 |6 W<TD><PRE>Method 01
2 y" f( O, o$ v" K4 B=========
* @+ G: a+ h4 ^3 O' L1 X
4 O5 U7 e5 S# v: ?# eThis method of detection of SoftICE (as well as the following one) is
5 i2 C) Z- \! p; Wused by the majority of packers/encryptors found on Internet.8 X7 O$ c2 Q# Y7 ^3 ~! k' w/ H
It seeks the signature of BoundsChecker in SoftICE7 f/ t& u/ t. `" v4 a

/ F+ V5 v; `; ^7 i3 ~    mov     ebp, 04243484Bh        ; 'BCHK'
. ?" G) C7 o! [    mov     ax, 04h
1 u6 A0 ^6 b7 p0 ?! z7 ?0 H7 p    int     3       * X3 l3 B! W. Y6 T
    cmp     al,4
" z# v; }  O  P1 N    jnz     SoftICE_Detected
# z2 G1 o1 @! n- M, J. J) S% l% {/ ]  \1 W. k% w
___________________________________________________________________________
4 z) Y1 o; G1 {8 Y0 E0 p7 ?# b; M' Q1 E  r
Method 02
. S7 s; `8 c9 }1 O=========
- }9 ?: t/ n1 K# p- y# h* X, n. V( K- F
Still a method very much used (perhaps the most frequent one).  It is used& I' Y$ L# x& j( l! |: @
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
9 I1 D4 D8 [4 h5 |. Yor execute SoftICE commands...
: ^/ l" I8 y. D  N% \It is also used to crash SoftICE and to force it to execute any commands
0 P) v6 E, ?. k9 K: X(HBOOT...) :-((  
; h. I+ A: W! [. P+ P- O. q" Z1 P8 A2 z5 ^% t% c
Here is a quick description:# h# R% t/ [7 B3 l  S+ ?
-AX = 0910h   (Display string in SIce windows)5 o. N8 H" Z% N6 d
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)+ E# r4 _6 G1 _
-AX = 0912h   (Get breakpoint infos); ~$ V4 i. y- \: i4 Q
-AX = 0913h   (Set Sice breakpoints)3 j. `$ A# ^4 Y% T* I  H1 T+ t
-AX = 0914h   (Remove SIce breakoints)3 F2 ?- \1 P% M+ X( P
' t5 F4 r) O" w' _0 c7 k
Each time you'll meet this trick, you'll see:
& F- Z; b$ L+ r-SI = 4647h
9 U- g% ~: J, B5 C-DI = 4A4Dh  d( E- e( l. C- ?3 |
Which are the 'magic values' used by SoftIce.' W. L3 q# s* K" ~' i3 N
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
# d2 @, n7 m. V/ v4 @  z% f! P4 s
% X& d" ?! G9 c+ xHere is one example from the file "Haspinst.exe" which is the dongle HASP& h0 ^/ n  O7 m: Z. P
Envelope utility use to protect DOS applications:
  ?) z$ Z4 D5 r: ]3 J+ n
. A$ w% [0 [: V2 X) {! ?
. v5 t$ _0 H; q8 K7 L4C19:0095   MOV    AX,0911  ; execute command.
! Z- u9 C( X2 T2 n" L6 ?( e4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).* S  s. F' S$ V' T$ p) u6 o
4C19:009A   MOV    SI,4647  ; 1st magic value.
% j" T3 z4 [+ l7 N4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
/ e9 G3 Y8 ^5 b( ?4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
' P, ]0 y8 _! {; m$ q4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute6 x( L9 }. I% i" q) j
4C19:00A4   INC    CX
: |$ m3 H5 F% }- i. s  ~9 m4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
  ?3 l& m% H! P; U3 q4C19:00A8   JB     0095     ; 6 different commands.
; c- ^# F+ L, ?$ R7 g5 V/ Y- Y& S4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
- ^' J" P' i+ o$ y. k5 P; m4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
2 {2 ^- F4 \7 ~6 d) V; ^1 Y
! D/ R' L+ H& g! h( v9 O- v1 f9 u3 v! SThe program will execute 6 different SIce commands located at ds:dx, which
4 O0 ^. G8 W$ R6 ]are: LDT, IDT, GDT, TSS, RS, and ...HBOOT." T7 \1 [' l) B  L' a  I
) d8 D* G( H# a  `4 V
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.& `4 ?$ H' P" g1 i. I# {
___________________________________________________________________________
1 }) c6 x. A  Z' q  N- k0 l5 `$ a; D  n- Q8 W

3 p# @9 W9 p' e( F+ g" r( ?Method 03
$ x  {  M  ^1 ~& `& D$ a: m8 U' f=========; s7 a9 Y8 v  q; F0 p9 i% [0 u7 {

' F! g; |' ~4 I. VLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
) f" b' o: ]% L% `! E(API Get entry point)
, T- V" y4 g% E0 ], o        # z4 ^& a, u6 G4 W. h) X; s! X' c, \

! s! L7 G' M, V: [. K, S# N    xor     di,di6 _8 O; L8 P$ t7 ^1 U
    mov     es,di5 X7 S8 `. ^- @3 I8 t4 p5 I
    mov     ax, 1684h       / _- C  D# |; M: y) @9 u* _3 P1 M5 N
    mov     bx, 0202h       ; VxD ID of winice* x& i6 M+ I: [/ E
    int     2Fh
; i. ?% r; J, L* r# s5 c- J    mov     ax, es          ; ES:DI -&gt; VxD API entry point
; B& H! Y* F/ u7 O* f7 Z) |- C    add     ax, di. }- [3 p' ^  z- g6 d) C0 b" o& t& K
    test    ax,ax2 E8 o2 x3 w, {% c* ^! L: ^
    jnz     SoftICE_Detected
2 z, ?/ ^' C- m; _$ T
! \; N. b: j1 a" W+ V___________________________________________________________________________; Z/ t2 m3 U6 L8 s( m4 Y" A# T5 }
. a; R) ]8 C) B$ {
Method 046 z! m% ]+ J1 ~9 f8 a" N8 @: _0 p
=========
  h$ f1 p" ~( O6 ~
/ _2 c+ d% `# h, vMethod identical to the preceding one except that it seeks the ID of SoftICE5 v, N- z  _. y* b2 X( Y
GFX VxD.4 X7 r* c2 V8 n% F% b% p$ S) k8 h
! t4 ~6 n% l8 t; O
    xor     di,di
6 A/ y2 a7 \! `' i- c; T    mov     es,di
' l2 ]8 E# T" j9 d    mov     ax, 1684h       ) I$ P" V+ ]" {# N+ T, `; w
    mov     bx, 7a5Fh       ; VxD ID of SIWVID4 Z* q% |2 b# z, `$ `$ a" D5 Z
    int     2fh' r: _( C  P+ {4 K1 |* Q5 Q
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
% _) d" E2 ~# M' ?) ]# D5 y    add     ax, di2 a& ^$ s2 m$ |1 ~9 D
    test    ax,ax# \+ E& G2 Q# j. @" h6 d* |
    jnz     SoftICE_Detected
, v, e2 O/ _) N1 s4 |0 s$ F4 ^
. |) \- w9 Z0 K! ?! h% c$ H__________________________________________________________________________
* N+ S$ b* R" F2 i  m7 L5 v+ f# M% W. ]. i
2 v+ k& w9 \2 K+ V1 f- q! a
" k" M% ^1 x4 W( RMethod 05
; I# [: H: i) X" H5 _=========  e  E( b, \8 |3 t

$ ^) K2 ?1 t# a  W( e3 I, MMethod seeking the 'magic number' 0F386h returned (in ax) by all system& ]% u8 w  R  B& O4 E$ G3 q0 y
debugger. It calls the int 41h, function 4Fh.
6 m4 x+ A6 `, }& U3 w0 u& {2 a, n) Z2 BThere are several alternatives.  * z1 i1 W! f" T4 p$ @$ x- X3 K
4 R6 k1 ]/ d) C% ^
The following one is the simplest:
6 k& @/ f* l7 D( x! G; {( L
* e+ E; I: I: C8 c' v4 J    mov     ax,4fh$ N* F  E3 W  ?) o
    int     41h
( ^$ }/ f( F( ~% b! \    cmp     ax, 0F386
1 u7 D3 e8 J$ E8 E' ?8 r5 g    jz      SoftICE_detected# g3 M$ U: Q7 ~4 A

+ d, D9 x6 v! X  r
" o. l9 s, Z* |$ H" C8 nNext method as well as the following one are 2 examples from Stone's
. e+ S+ _  F( d8 v  r! o"stn-wid.zip" (www.cracking.net):
+ N5 b% `1 ~0 S, z/ @& O; T2 T1 e' }- G( J( F, O
    mov     bx, cs
. F& b$ z( D) u* V$ |    lea     dx, int41handler2
' T) N) x9 |7 K    xchg    dx, es:[41h*4], r; a. i% f6 O. `
    xchg    bx, es:[41h*4+2]4 `" t! }% a2 ]4 D0 B- S* i) P
    mov     ax,4fh5 q- V; R- I3 O' p
    int     41h5 w0 C' z2 w" b
    xchg    dx, es:[41h*4]) r- y, m7 O5 ]$ K6 Y7 T
    xchg    bx, es:[41h*4+2]
' h) y7 C2 q4 O- e    cmp     ax, 0f386h, R. H# o) W- d
    jz      SoftICE_detected. S6 L+ Y- w4 c. v0 N2 [
5 s% P9 I* T' r6 F" F( W
int41handler2 PROC
$ m% g. F5 p# ?) f" k9 b    iret2 y; N7 P5 u& w
int41handler2 ENDP
# V/ R* s( ~, P# F; d" U3 g6 P# J* w3 t1 x, ?7 o

! @0 H9 v" ~/ y4 @5 N- Q% a_________________________________________________________________________
0 E, q( c4 t3 n% v( D
8 {8 x9 r( D, L  F
1 E. O3 Z) m, H; E& LMethod 069 d4 p$ j+ H+ m7 v  N0 q
=========
9 M, K6 g/ N6 |: C0 r, L% v8 a4 I  E. ~5 j
. Z. W5 O& q; {
2nd method similar to the preceding one but more difficult to detect:& E& r8 h# Q2 G& P- w
- B1 Y- m: W0 ^
8 i- B. |& K* F/ i$ {3 e5 j" {
int41handler PROC8 l3 d# ?  e, x" [, Q( N) [5 G  k9 Q
    mov     cl,al
4 s, \0 _9 d5 ?/ c8 M( u" y    iret
" }  i/ ]; t- B, X# X& r* @3 M, ?int41handler ENDP( i1 A! j& n( D* J( v4 A/ K' w( t6 y
4 F; p8 C9 O8 s! O! T

$ z& Y( O. P  }+ [/ \    xor     ax,ax; Y& R) h4 H5 Z$ K0 F- {) c$ `
    mov     es,ax- J' k2 ^4 C2 x: d- ~/ _5 A! o
    mov     bx, cs9 c* ?  X' r3 D1 b( Q( K( L
    lea     dx, int41handler
2 U" T  a  g- V8 l2 e1 c; G( W7 H    xchg    dx, es:[41h*4]6 l7 {- q  O+ d: ]& J% m
    xchg    bx, es:[41h*4+2]9 v. r- X$ U2 M2 M9 f
    in      al, 40h
4 u( Q% T1 C$ I. Z, J    xor     cx,cx
! Q$ F8 L  a( `, F+ {6 |    int     41h7 c/ ^2 |. z$ F1 k- N! C5 M
    xchg    dx, es:[41h*4]
0 {+ T2 I. n, r' A$ ^( w    xchg    bx, es:[41h*4+2]
) J) l0 t9 R+ H4 D* C1 W    cmp     cl,al7 Q8 ~% k% f& f5 _8 I7 J: n0 Z
    jnz     SoftICE_detected
1 {# J4 @0 c" C* }/ E! B
( r3 o. C/ @* m# |- r, A; p_________________________________________________________________________4 b4 X: ?+ P3 t+ p; {' O  o. y3 O

0 T0 x% _9 t: u7 JMethod 07& ~! p$ P( T) \* ~
=========0 c1 ^$ b5 j8 x& K) }
2 Q9 |- Q7 f$ t/ g
Method of detection of the WinICE handler in the int68h (V86)
* w1 O3 b( @" e$ _% K3 }
" n6 j8 H4 A+ p) [; h* s    mov     ah,43h" S, f/ _# R2 ?) k: W9 O' w
    int     68h" h0 C: l6 C: i- j" S2 V9 _
    cmp     ax,0F386h
; v. N6 b- ]6 h0 \4 F) J    jz      SoftICE_Detected
% t8 X. l/ x# D  `+ V* @. y9 \/ k7 J, o$ N3 x. z; M3 N4 [
+ G8 w9 W; x7 g& w2 d3 _9 b
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit( L& o. O0 p$ w( k
   app like this:
& `( L# v1 z# c# g0 p. i( t5 Q' M3 ^1 R, }' W) y3 F
   BPX exec_int if ax==68
# r/ D1 \3 B" a0 H" {' T2 ~/ @   (function called is located at byte ptr [ebp+1Dh] and client eip is# N9 A3 F; V# `$ s
   located at [ebp+48h] for 32Bit apps)9 f3 q% C0 G  e
__________________________________________________________________________6 ]- b. \# J& |7 [& m; N2 ~
- p" U* q: A1 p: o9 u  \/ T
- U- u4 w" R3 W$ i
Method 086 p2 z$ K( ^! S. R" l$ k2 `  R! J$ m
=========) y# Z2 x; ?' g# b

/ r& K& u: ^' L% W1 ~) E2 gIt is not a method of detection of SoftICE but a possibility to crash the
% Z1 Z6 S" n" T4 x- m, t: Rsystem by intercepting int 01h and int 03h and redirecting them to another
% P9 f9 n: A8 i: wroutine.
& j  A, Q% m8 x3 LIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points! S, @7 ?  f$ o4 C& _5 X. `7 V
to the new routine to execute (hangs computer...); J5 L3 u5 Q2 g* p
# S  E5 p; E) U5 l9 f
    mov     ah, 25h% s. M: X* ]5 ?5 o1 r* D/ J
    mov     al, Int_Number (01h or 03h): K( P* q1 G7 \% c4 _( a
    mov     dx, offset New_Int_Routine
8 f) @5 M. g5 a, R    int     21h
: J! r6 A" a3 j$ I# U* V
9 h2 x* ]* E9 I1 ]0 V__________________________________________________________________________
7 ]0 Y/ h5 }. s9 j* n( K# r% p
* Q0 n* H, B% v% @Method 09# w, N0 m7 r1 y6 s: h' \
=========7 d; C1 Y$ s% d" X

% X3 P& p, T" {( [* vThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
% [+ a" j( ~: Q+ x  K" @performed in ring0 (VxD or a ring3 app using the VxdCall).
4 Y. Q& F1 Y! }; v$ VThe Get_DDB service is used to determine whether or not a VxD is installed
3 j: C* s% I' }4 a. j' ~, pfor the specified device and returns a Device Description Block (in ecx) for( }! G4 {0 R' s2 h; l" s' Y* B
that device if it is installed.$ T8 I- X$ H1 N  [, Y7 M  p
6 w/ M  T7 G" E$ }
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID) O, Y, {! |. \) L& ]- N
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)$ m$ N! h+ U4 s. _' I; G
   VMMCall Get_DDB
0 I9 y' H- S1 ^! x' U, x% u   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
3 K8 b. F& k* [- y
; k; e. W& K6 Z- }9 ~Note as well that you can easily detect this method with SoftICE:
5 p5 x* {$ d% L/ p9 t( K   bpx Get_DDB if ax==0202 || ax==7a5fh
% n2 |) D2 N$ q0 a
6 `  @5 B" Y$ ^) ___________________________________________________________________________: a; T0 u8 l) }$ D0 N
4 \8 u5 W+ x7 F0 N1 B: ]
Method 10
* n& u; K: L& [' w* I9 g& `# u=========
# |1 J8 s3 S( k; B% i
5 l9 y. J6 x2 Z; n=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
0 {! Z" E3 r* H1 R3 g9 I5 f  SoftICE while the option is enable!!
  R2 p" I* e$ K: W( T9 q$ K8 X# L: q' q- B0 Z/ v4 ]
This trick is very efficient:
* p# ]% n8 s( Q  ^$ @  k' bby checking the Debug Registers, you can detect if SoftICE is loaded
$ s/ {# w# b! h( I. g+ n$ a(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if! R7 ]& C/ J7 j( t% _2 U
there are some memory breakpoints set (dr0 to dr3) simply by reading their
' H! \% G$ h1 M, _value (in ring0 only). Values can be manipulated and or changed as well* D8 Y7 m, |$ x& B$ V# P
(clearing BPMs for instance)
5 m: o  a* D# F: j; ^! T3 E8 B& ~( a5 x9 s
__________________________________________________________________________0 m+ Z! }0 m+ ^: m. w  s
& _8 \' v+ m/ a; _7 }6 g
Method 11: W( h1 r2 W2 D7 C1 J6 _. H$ J
=========3 }/ G$ z7 s4 k

9 \( _' N! [+ y0 E. _This method is most known as 'MeltICE' because it has been freely distributed7 Y8 @# {' \+ B* u2 L, {
via www.winfiles.com. However it was first used by NuMega people to allow) F4 m( S- C- R
Symbol Loader to check if SoftICE was active or not (the code is located
: d! \) h8 X* o8 t; h6 Einside nmtrans.dll).
$ c/ M$ N2 {$ |1 o# g9 e3 f
; [" k" z' c+ l! r! S: n: eThe way it works is very simple:
1 ^: C! |8 x$ l: KIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
- {) _% J) N9 y0 rWinNT) with the CreateFileA API.
2 `2 Y& N" Q1 E4 o7 X% O: e+ ?6 o$ g: `, W( z! O4 {! }
Here is a sample (checking for 'SICE'):
  A7 ^, {* W9 Y- ~4 W0 n- f; l  f6 L. V" W4 i5 P  a' ?
BOOL IsSoftIce95Loaded()
) J% P' [* Z+ E, k{
, }! N2 u. |' x7 x, V) r) f6 [   HANDLE hFile;  , J3 W3 V) P# Y1 V7 H
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
9 a; O. U3 }: F' {  X2 ^3 \                      FILE_SHARE_READ | FILE_SHARE_WRITE,$ v- A% C6 I7 B2 x, x9 ^& Z
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
3 _8 h  _/ y6 s7 }2 D   if( hFile != INVALID_HANDLE_VALUE )& F: S0 \3 f4 W  }
   {5 P! ?+ x- j( q" r8 H
      CloseHandle(hFile);* o! m+ z5 H$ g: [  _3 A. ^5 U
      return TRUE;  e5 S% K8 ^; k
   }9 e0 p; r* ]( T( k4 W1 w' I
   return FALSE;
9 r; i- t/ T% R1 V- w3 |: v}
! i5 H/ v* |! L1 ?) g/ X, G) S6 G8 ^" x0 W. V, b+ i2 w% h
Although this trick calls the CreateFileA function, don't even expect to be
) z6 K4 n. K% d8 U. {able to intercept it by installing a IFS hook: it will not work, no way!  d8 P" N, {% H4 r) [% g
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
, E4 `8 L3 _7 m) d4 e/ }service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)0 E) l) ~6 N) s: a
and then browse the DDB list until it find the VxD and its DDB_Control_Proc' O4 b; q. ]. C( w2 r0 k
field., F# _6 L1 Y* u- }. M1 S) `+ k7 P, n# f
In fact, its purpose is not to load/unload VxDs but only to send a
) y# ?5 R; D" FW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE), j4 R& q) t' b* _% ^" G
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
4 W$ L+ M, g6 hto load/unload a non-dynamically loadable driver such as SoftICE ;-).
7 S5 C: f# ?: `: f" e% q' D2 _If the VxD is loaded, it will always clear eax and the Carry flag to allow
+ }8 W3 A1 B: mits handle to be opened and then, will be detected.
7 ?' P: C$ m& z8 v3 Y+ [/ QYou can check that simply by hooking Winice.exe control proc entry point
/ N' w0 _) X2 B7 }$ lwhile running MeltICE.( [* {: ]4 `3 v7 A3 `
& D! y9 ]5 q2 u. x5 r# h

& L# W6 k0 C1 C  00401067:  push      00402025    ; \\.\SICE. A/ S) E7 L" u4 h4 e0 _
  0040106C:  call      CreateFileA
% M3 i" M' \1 n  00401071:  cmp       eax,-001
* l1 i9 v( [4 D6 E  00401074:  je        00401091
. o$ q7 x; m6 G2 j, @- E) ?$ ?$ R, _  z) n
% J: m$ ]8 c2 l) K. m
There could be hundreds of BPX you could use to detect this trick.
) u9 K2 c& ~% l& v. M) `6 H-The most classical one is:
7 m& H9 U$ Y  U' n3 J  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||* G7 z) w2 k) n+ C
    *(esp-&gt;4+4)=='NTIC'
  L# E+ `+ J; W; F; ?- I. w! L2 j: L9 |* o! H6 S4 v
-The most exotic ones (could be very slooooow :-(8 d! n# m( J" }
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
) O) a7 B/ \; I     ;will break 3 times :-(
3 u. z4 r9 ]: s6 X
! J2 {2 m0 q/ Q: d4 Z7 P! t& i2 ^-or (a bit) faster:   j6 D$ s$ r7 H( d# x: a
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')( z6 ~" ^* R1 Q

) K7 E( j% B8 S! a4 ?   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  : ?9 R0 m; U$ y$ l0 Q
     ;will break 3 times :-(, _+ R( G4 ]) G/ u1 g+ R1 p+ |
5 X& t9 t" i7 O- K
-Much faster:# T8 k  e, ~. ^" k/ Z0 {
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
. C# s8 e3 `/ H! R% ^6 ^+ F* w6 \+ P) V5 L/ C6 S3 @
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
( G0 x5 i0 N" N; s2 E/ Wfunction to do the same job:
3 r* B+ [! [# ^( V' J; P" i; m5 m- {; a3 g, Q9 d2 ^9 _1 P. U8 }* \& t
   push    00                        ; OF_READ( I6 d& e" v6 W1 ?+ X7 H& N
   mov     eax,[00656634]            ; '\\.\SICE',0% d1 [( X2 K& U* X$ {1 t
   push    eax
" Y: i/ u$ q- }   call    KERNEL32!_lopen. o- {! o9 h2 ~. x1 u
   inc     eax
! h9 U( z# `% X* t& i0 E0 H   jnz     00650589                  ; detected
3 b1 K2 N4 l# D1 Z9 Q   push    00                        ; OF_READ
3 u. u. p3 b" U3 e, f   mov     eax,[00656638]            ; '\\.\SICE'0 g. b: S" Y& q; E2 M+ n; d( k" @
   push    eax/ t* n* }; e4 `% F2 P
   call    KERNEL32!_lopen
$ v- p  f* v' d7 ?3 @0 r   inc     eax
  a; W) h6 m6 E3 d   jz      006505ae                  ; not detected6 e) B9 G; W: S/ b" ?

9 f' x. D4 p  y  V1 ]* _7 @# B% E# r% ~' j! G; f
__________________________________________________________________________4 |& k5 r2 E# B6 D1 h' [5 w
0 E8 c! Z% o2 F6 B3 q
Method 12# x- R+ [  c$ G' }. I7 g
=========  Z& O4 `7 S" y7 `
+ h. F) o, b; l  `1 Z
This trick is similar to int41h/4fh Debugger installation check (code 05
& ]7 q1 J- a- \* W2 b3 w% h4 c&amp; 06) but very limited because it's only available for Win95/98 (not NT): w4 F; ?# S3 Q$ {4 q
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.) l3 e  Y4 c: }& r7 `; N
3 V# v* |- w7 y: f- {4 W3 H8 }
   push  0000004fh         ; function 4fh
# l9 U* E+ U: ]& C1 [   push  002a002ah         ; high word specifies which VxD (VWIN32)6 o0 f, r# a  E; X7 [6 a* x& a
                           ; low word specifies which service7 m; h, }9 a1 @- \
                             (VWIN32_Int41Dispatch)
; `( l7 Z6 Q3 n   call  Kernel32!ORD_001  ; VxdCall. V2 s1 y4 s" q
   cmp   ax, 0f386h        ; magic number returned by system debuggers
5 {  i0 m: U  p+ l6 V) t   jz    SoftICE_detected' J1 E4 W/ [7 H( H" M

* g* c, D' o% B8 LHere again, several ways to detect it:
2 B1 ?) i5 G' t: q9 Q% o& [. H9 ?& N5 n0 c' Y7 ]* p
    BPINT 41 if ax==4f. ^  g4 y- Y( h& h7 [
; q5 d- e: q, g7 C& x
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
1 r" u6 U2 H1 W7 O: _4 y- b- z
0 B8 k# X. T4 _$ ~0 z# ^3 l    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
" B4 i  ~0 F7 U! F9 P; B  k" p) O( e/ Z" a% c% i4 q
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!7 p9 B" S5 ~+ A, q% w# G+ t
) }! p( k5 L. t* f  {$ Z
__________________________________________________________________________, J& r- t5 }5 o3 D- G3 a

6 s/ v, _8 ^( H1 x5 |. UMethod 139 h9 e' U0 t, G$ y5 s9 r
=========
9 f; V: P  E; |$ J. S3 m! G2 }6 b5 v( E% u6 i
Not a real method of detection, but a good way to know if SoftICE is1 V% |& P% j4 w8 t+ C3 W
installed on a computer and to locate its installation directory.
0 ]5 N$ g1 E4 I5 t4 a0 a6 QIt is used by few softs which access the following registry keys (usually #2) :
9 L" ~" E: J. d1 X6 ~4 L% g: T1 m) p
8 D1 j- p* p5 _% T5 h! h4 y8 a-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
$ _# Z: g3 w( z5 Y( T1 P\Uninstall\SoftICE
/ Q' s) u% ^# B% y-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
) |/ E: v0 e6 }-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion: K6 i! x# J. G, R  v1 x6 z8 A. t
\App Paths\Loader32.Exe2 G- w/ U" U- |! y; I/ e( }

) V5 n2 L8 e; t  J* D+ e! _& F9 {2 }1 j) {
Note that some nasty apps could then erase all files from SoftICE directory. g4 q) A* Y* N  v
(I faced that once :-(/ g0 ^; H& M; Z+ K! L

0 S$ F' ^5 u0 B. L/ cUseful breakpoint to detect it:
2 \/ Z/ R3 q' w5 Y6 a2 r$ i
6 Q  X/ T' W9 r% R+ F     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'+ N+ ~* C. E9 T$ d9 e; }: y

! `  z+ m+ Z( G9 k8 A' ?4 N__________________________________________________________________________
8 ]/ d: r) _/ ~5 R: Z' Q; }6 x8 B5 ~$ B0 r9 N1 ?

0 p7 G( D. ]( T' y, UMethod 14
- G6 P: G4 q: X! v4 j=========' ]1 B8 }4 f1 F$ X2 H
, W) x% [# |/ t+ P& F& R% Z
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose& c' X0 m3 T' _- F
is to determines whether a debugger is running on your system (ring0 only).# X7 @" \* {; P5 Z
& j  T$ F& `. g. I  f, c& ^
   VMMCall Test_Debug_Installed
* l+ \, |6 N. a9 y8 W   je      not_installed
( s- u+ B/ T( w* s& n5 C: f" {$ ]$ \1 I  \' q) x
This service just checks a flag.2 ^' i  f( O% K- e9 e! L( X0 R+ l
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部