About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
( N* L2 a( W' [# V) S  ~. w, p<TBODY>
9 i( P$ z" D1 T$ v8 y2 M3 z) {<TR>" j  m0 I0 T5 t. n& |; Z
<TD><PRE>Method 01
6 H& Z* P: s' u4 M# n- P=========: g6 A+ M, x! `. y

" r  i# {( w+ |' O; S# q2 `9 UThis method of detection of SoftICE (as well as the following one) is2 R% A- r6 J/ y4 X: k' P$ \
used by the majority of packers/encryptors found on Internet.
( y- G4 S# ~; H* T4 TIt seeks the signature of BoundsChecker in SoftICE- ^8 P: U6 F: T. w
8 I8 f9 m4 S: `, ^1 k8 C5 K. [1 G
    mov     ebp, 04243484Bh        ; 'BCHK'
, P/ w: A; b, I3 |    mov     ax, 04h
0 F8 ]: g& X* L  K3 I" g    int     3      
, N" k& v  }9 g4 @6 _' g9 W    cmp     al,4
1 Z+ W) q% ?+ n; y    jnz     SoftICE_Detected
7 J! ~6 X, J7 {+ w0 m( W6 G7 D* U) g1 n7 a) ^# J9 d' i$ x
___________________________________________________________________________
1 Y4 N" f0 V/ q3 w3 a
! U- P- ?; \) KMethod 02
! X. z- o" }. L0 n* Z5 Z2 w=========
6 u6 u$ b; ~6 g5 j" H
  p7 K# s& C3 NStill a method very much used (perhaps the most frequent one).  It is used
4 s2 s3 `# T, |to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
$ V( I/ ~" p' eor execute SoftICE commands...* {! p; _; m0 h7 ?
It is also used to crash SoftICE and to force it to execute any commands
, ?) R( q8 [/ k5 l, t  c8 z/ W(HBOOT...) :-((  
" L& q, W; A! }  T; H' @& |0 W6 O; M* ?$ M
Here is a quick description:
. v  V/ G) o+ B4 R-AX = 0910h   (Display string in SIce windows)$ t+ M! L0 u2 p1 s5 F7 l
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
! n0 J% _1 Q7 H4 D2 |8 w2 y4 M-AX = 0912h   (Get breakpoint infos)- G* I1 J' a7 S/ {0 s1 p  h
-AX = 0913h   (Set Sice breakpoints)+ w! F5 K1 N; ^3 J6 j
-AX = 0914h   (Remove SIce breakoints)! x/ @( L' M+ J7 Y( q$ V: l5 A, P
  L8 w+ t& r/ L- r, T6 P) C
Each time you'll meet this trick, you'll see:2 Z7 ~) m6 M" [5 a7 x; k
-SI = 4647h6 J! A4 e# m0 c5 x* j- N
-DI = 4A4Dh, }! ^% O2 t: C; i3 R
Which are the 'magic values' used by SoftIce.
3 w" }* A" Y% E. J. j* d  a4 DFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.; C5 i: S5 N  K4 J

3 C1 v% z: t8 f  ]9 H0 A" p' zHere is one example from the file "Haspinst.exe" which is the dongle HASP
4 Z( Z( I" [; |( L; H5 F# i6 JEnvelope utility use to protect DOS applications:% ?3 }& `% S, ^! X5 z& G

+ {  F$ }: A9 A8 G3 t# C' R( `" l8 ]" I/ r7 D, m( ^" m3 f' R
4C19:0095   MOV    AX,0911  ; execute command.
. x- x( g9 R9 |8 R% N0 N3 R/ q4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).. o  u( K9 R, r/ i. i- ~0 S
4C19:009A   MOV    SI,4647  ; 1st magic value.  b6 P. V; v. p# U# y
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
0 L$ u* z9 Y# N5 a, x5 j4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
+ z0 y1 a6 Z- J5 c. t4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute* E2 K2 B9 O3 v* i+ l1 w
4C19:00A4   INC    CX
7 ^. k; ~  |( ?5 ~4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute; ^" T6 w- n; y3 e7 l
4C19:00A8   JB     0095     ; 6 different commands.5 F% _! E% M, C' S/ h/ T/ b4 I5 R
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
) N4 W* h! B5 }) _' Z! L4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)3 t2 M& k# N2 ^; f+ O
9 Q2 _' s8 H5 K* V% a% h: p. Y
The program will execute 6 different SIce commands located at ds:dx, which# j5 ]$ A, ~$ [, O$ q5 a5 J
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.* [6 B3 G4 M" L# ]. m' V
# E, ~4 U5 @7 B' ~! j# F
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
& N7 \0 D6 |8 M6 B___________________________________________________________________________0 D. {6 ?) G& ], Z& C% E
2 O0 y! |- s% }  I" p  v- Q

9 ^5 H) f) A6 H8 S& m/ kMethod 03
8 W& t3 l- m3 a  Q5 F=========
7 A3 T& k) y9 w4 V% e9 L3 ~$ h5 r5 W: }1 c0 s) \2 z% ~% `
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
, H+ M! {4 Z* U: H, c(API Get entry point)
( I5 P* {! L# p8 @        
8 O  o9 n- h9 g" w6 ~9 l
& z: P: T, _/ d$ U1 _7 r% j    xor     di,di
4 M+ Y4 N8 v2 y6 }" V+ R3 d( S  E    mov     es,di
% d' \0 O1 C9 q4 H    mov     ax, 1684h       # z6 J* H) O  _$ ]+ N- o% Q# P
    mov     bx, 0202h       ; VxD ID of winice
; P- M& Y. B0 _  K2 `7 T4 ~    int     2Fh
. ?/ I0 W# @8 y( B; f    mov     ax, es          ; ES:DI -&gt; VxD API entry point: w1 P" [5 R8 c$ i8 ?
    add     ax, di
3 ~4 R  I& G5 i! b2 d" m+ I    test    ax,ax
2 e0 W# v, {' U( N5 c+ z    jnz     SoftICE_Detected; N  v1 E, E, Z8 _+ I: E( B4 J

# L% k1 S9 m) ^/ |7 |% f___________________________________________________________________________9 n2 N; Q8 v8 z9 w+ E
# R7 K6 J: ~0 {9 z" z
Method 04
7 j; L& Q5 ~2 _. v; W=========5 ?- p& c# [: ?3 V9 p9 k" u; Z& e0 ]

& R% ~$ Q- y! K2 a' c; H, EMethod identical to the preceding one except that it seeks the ID of SoftICE3 g, c3 q+ `. R4 m5 T
GFX VxD.
; ~6 O" U5 F. h/ M0 i6 W+ G2 o: S: J6 J
    xor     di,di
* b2 W! o/ t  I) y7 {; w    mov     es,di+ ?  n, U0 o0 O; l. ?
    mov     ax, 1684h      
, N" [/ p2 B2 a" S& D    mov     bx, 7a5Fh       ; VxD ID of SIWVID
. r9 ?' q9 O3 p6 `6 z    int     2fh" [, E/ B# q' t- q7 z' B  G4 C
    mov     ax, es          ; ES:DI -&gt; VxD API entry point- i$ }. N( p! b4 G! i1 ?
    add     ax, di3 ~/ G* ^/ T6 q: g# N2 j/ M
    test    ax,ax% E1 ^6 Z! m7 |; b! w9 i5 i+ W, O& [
    jnz     SoftICE_Detected
5 \0 d: z5 P! C( L
/ L9 e+ Q( Q  U8 {__________________________________________________________________________
% \$ o3 H/ u4 |0 x
& K6 }) R4 I: j8 e4 C; }# }1 f
2 I7 ]3 h3 Y& Y+ n! `0 x. CMethod 05
7 D% E- v2 w. {) t3 A3 {=========
3 v/ p7 G4 P  S# C0 Z& e6 J0 ^
1 ]0 t( ^: S9 s' V1 C' g* \) dMethod seeking the 'magic number' 0F386h returned (in ax) by all system
( g% ?" T! L2 X1 Cdebugger. It calls the int 41h, function 4Fh.& f/ A& [9 s8 [$ I
There are several alternatives.  ( q, t$ X+ t( n! a; q9 s3 H
" w& `7 q' Q6 d0 u
The following one is the simplest:
3 {8 {' f4 ]% U" o4 [1 W4 F) L( O; ^/ j/ b2 p- e
    mov     ax,4fh6 F3 v; p' U& \' ^
    int     41h" W; J# {1 W% P( u
    cmp     ax, 0F386
, d  L$ e! w- S" [2 }3 k    jz      SoftICE_detected. Z1 B* {9 \! `

8 T# r2 o0 z/ w4 ^
; K. q/ E/ g: U  S. GNext method as well as the following one are 2 examples from Stone's - h7 t" i* @  F  ^! ~; R) G
"stn-wid.zip" (www.cracking.net):4 H+ b7 N$ {7 U- J( t& ?
0 b0 {3 [' k+ ^1 T; ~) @8 M
    mov     bx, cs
4 n1 f6 M0 {$ G    lea     dx, int41handler29 x* }: e* v- C7 A9 z/ ?4 q
    xchg    dx, es:[41h*4]
5 x- J3 \7 F) T5 G    xchg    bx, es:[41h*4+2]+ g1 o+ b$ b: M8 ^% m2 A3 k
    mov     ax,4fh& X$ J! f' S. t- z: W' I8 Y
    int     41h
7 y7 J( q/ c: Y4 m! r2 z4 u3 x- e    xchg    dx, es:[41h*4]
0 n7 I  k# c. |3 M) @  {6 Y1 J$ _    xchg    bx, es:[41h*4+2]
- L! Z( X& V! T/ M. S. k* e" C" ~    cmp     ax, 0f386h% C& R7 @' n- o% ]$ K
    jz      SoftICE_detected2 D1 |8 z1 g7 C! M. d5 u1 m

- [. B/ U$ p+ F2 }3 Dint41handler2 PROC. i5 l' q' x$ K: E/ f% b6 o6 f
    iret
& ?4 E1 X! b0 h! i, a4 _4 B9 \int41handler2 ENDP8 j3 h; l  F* F4 E; |# P, ?" G
  N$ O% O) j& \: Y7 k8 K2 E; W

9 [" m) y" C4 X7 T8 `* W_________________________________________________________________________
7 e7 O$ |* t  ^5 [0 D+ b5 Q/ ^; |- H& J. q( z- @

  Q) E; s0 t0 G1 KMethod 06
: n9 h& P- y! e. S! B  e=========  E  f! W' |# H
- R% e# z$ m, j1 O# J. k- B8 T
% F+ H% d3 T- g/ @& |! S2 W* @
2nd method similar to the preceding one but more difficult to detect:2 F9 E& [6 c: O% h) a+ q1 S1 C
% E8 L# M" _3 k% n  ]/ V
. K, g. n7 _/ K  r; e
int41handler PROC
$ f+ F- f+ |4 Y- p' ]7 e# `( r    mov     cl,al
3 E' ^: E) h0 u/ G# _    iret* P/ w* K3 }; Y0 ?1 j
int41handler ENDP" H. z: [" ]: a) |# G3 m% s3 K
, C& Z- c2 S3 N$ _1 }5 Z6 z0 x

' l  a  h) x! M- g, s    xor     ax,ax
8 R- [9 b2 M/ a) }    mov     es,ax
2 L* @6 ?) |" A6 a* s: V    mov     bx, cs
: s- @4 f# S2 U    lea     dx, int41handler
. r+ t" n$ i0 P: @* U+ [, d    xchg    dx, es:[41h*4]! K4 N9 d, i0 m5 w& |# c: W/ U9 [+ q
    xchg    bx, es:[41h*4+2]( E7 |' J7 X7 S$ A) W8 Z, l0 D
    in      al, 40h
0 H+ h9 t1 A. y, e. Y    xor     cx,cx! t3 I  k2 X0 G8 n% i
    int     41h. a, g( M7 H- f4 g
    xchg    dx, es:[41h*4]; d6 F; ], t2 M& I  B% \
    xchg    bx, es:[41h*4+2]1 c- G$ b3 P* M* p8 M$ ^+ q
    cmp     cl,al, B. z/ y/ w' R/ o$ u/ ~
    jnz     SoftICE_detected
; D. G, \1 r! X' j& ?
& c7 t2 u: F: Y5 |_________________________________________________________________________& u- _& d$ l6 o; @8 O& z

* ?* Q3 J8 N7 T: z: C5 J: FMethod 071 l  F+ g- k( \# G
=========
- c5 C0 i3 U. n0 {9 |8 }1 W+ y! x5 g3 W  Q+ ]6 j9 o
Method of detection of the WinICE handler in the int68h (V86)! Y' G; ^% {. \$ d$ p- }) t' M3 y
  n. l" H: w/ w
    mov     ah,43h
. x7 e* U( `% q, o% z" m    int     68h
# k, W. n! B; Z5 e( C# Z    cmp     ax,0F386h
& W' _3 O+ [: y$ k6 D, V    jz      SoftICE_Detected
$ t* P1 a* {2 K6 F) h: V, Y5 t4 V& x) ~" \9 }$ S

. S6 {4 j: e, [/ }3 `=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit0 m+ i6 L0 U+ A( o6 N
   app like this:4 \" x! J5 K" h. q3 g

; B' |" Y2 ~5 m) H# M5 S4 u* p   BPX exec_int if ax==68
7 n0 f7 T7 ^# f) f* y   (function called is located at byte ptr [ebp+1Dh] and client eip is4 F4 n" V2 W5 y% Z
   located at [ebp+48h] for 32Bit apps)
( ^4 g8 I- q( o+ I+ S% d: D) _& L__________________________________________________________________________
- C) a0 Y# f# Z) F7 w2 C; I9 E& D4 X  Z& M% [

3 I& K: E6 k0 I& x) Q' q3 uMethod 08, {. H9 n6 b- l* z' d4 p* k5 v
=========6 U9 X% D$ S2 M

6 p$ [6 G7 O1 F' z0 PIt is not a method of detection of SoftICE but a possibility to crash the
# u5 {7 S( R6 e6 A+ t; w. ^, P- gsystem by intercepting int 01h and int 03h and redirecting them to another  n# a: Y6 r( j/ z4 K9 C& i- z
routine.
( t' R8 H9 y# \, A6 i- aIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points0 f: P8 i2 s7 X+ q) W
to the new routine to execute (hangs computer...)
! z. ]7 L6 F  g2 v) u/ f
+ N# E- d, C3 L    mov     ah, 25h
3 ~) a+ @4 s; p  q) o    mov     al, Int_Number (01h or 03h)) F  p) P  {  _( ~- z1 A' o3 Z
    mov     dx, offset New_Int_Routine6 t6 b6 O. t. X4 J7 d- ^3 j
    int     21h
: s  F) c+ r3 ^/ L/ }5 u9 {8 `+ t& u1 F- I
__________________________________________________________________________0 b& P2 L. Y1 v+ u4 |
) f( C, `4 Z  T: Y7 a* v
Method 09
: Q( p. i% C3 I& U# [( G* p% S=========
, b5 h7 |2 k; E+ J' ~; K# `
7 Y, V* ~4 i* r, K6 f  v3 f; E* E. iThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
8 e, }* @1 r/ m' w2 N' U! b' qperformed in ring0 (VxD or a ring3 app using the VxdCall).( Y9 y: p- D" W( s0 U, }' p/ _
The Get_DDB service is used to determine whether or not a VxD is installed
  Z8 V5 j% [+ rfor the specified device and returns a Device Description Block (in ecx) for
' I# ^) i+ ~) a6 s* F$ E: Xthat device if it is installed.
+ W* W5 f; J/ h9 I: V; v1 e( |% m# a3 A$ ~8 f+ [5 {% x+ ~4 B3 s
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
2 g  n  ?9 V- b. O4 Y& D" t6 O   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)2 K7 F% ~  I# u& F! r* |
   VMMCall Get_DDB  @* Z6 q( q( u0 R- K2 K0 k6 P3 @
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed9 @: c0 ^0 U9 B2 F

$ s. `  L: I2 R5 ^) rNote as well that you can easily detect this method with SoftICE:: m8 j8 `! t1 Z. n' p# _4 m
   bpx Get_DDB if ax==0202 || ax==7a5fh
8 P! v4 N3 g$ f) W+ ~
- v9 W9 F% `# |9 H__________________________________________________________________________
: A4 E& Q: u0 Z: H, \4 ]) h
4 b$ n" C! \/ ^* G* S2 V! CMethod 108 ^0 E" }" M( B+ V6 `0 h* T0 A
=========
7 e/ S* }7 q8 `- v
+ F1 |1 C( R: s=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
/ `+ p1 Y. b; A; z  SoftICE while the option is enable!!
# e: u% U2 \& u' y: K) y8 P
* O+ L5 o" M/ JThis trick is very efficient:6 o) B8 _& g' m% [
by checking the Debug Registers, you can detect if SoftICE is loaded
( y- I9 O0 [. C& f% a' L(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
' i; z* i- O" q& z3 O$ ]9 ?% Sthere are some memory breakpoints set (dr0 to dr3) simply by reading their) M+ `6 b% K0 |  d% k# Y2 S
value (in ring0 only). Values can be manipulated and or changed as well
. u" a% Q& F4 T  X* M(clearing BPMs for instance)2 \% U* p1 k6 R# _2 h. E
( R. E+ e" W' Q9 Y; N
__________________________________________________________________________
: R. p& V" b$ C+ O6 H
$ R8 c! T4 q1 r% t6 MMethod 11
+ P2 n% e) Y" C& @=========$ R5 U+ v: G5 P. ~( R

- q* Z" R7 `$ @This method is most known as 'MeltICE' because it has been freely distributed3 d3 k2 j7 }( s2 a3 X
via www.winfiles.com. However it was first used by NuMega people to allow0 v  m5 N1 |+ Q- E; U
Symbol Loader to check if SoftICE was active or not (the code is located4 Y' P* @: n" k1 n8 n  v
inside nmtrans.dll).) m# n) @$ k$ @

+ V1 r8 \7 H3 q/ x- A: ~3 ?. WThe way it works is very simple:7 H1 Y' O$ y, [
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
) q/ ~# B: P$ ]! P+ y  R! VWinNT) with the CreateFileA API.
% ~1 ?( i. y  C" F" {/ \. A0 I. u0 J% k2 ~
Here is a sample (checking for 'SICE'):
; _1 |" h/ u- p+ f& }5 \# m5 m* w& [3 Q$ S5 E5 H
BOOL IsSoftIce95Loaded()  I2 V; u, g1 x* S. m! [9 s
{
% B6 Z( H5 M. y* M# I+ k( \   HANDLE hFile;  8 v& c; _) A, Y/ ?) g
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
+ x& e6 }. ?, X' h- h& f6 \# y                      FILE_SHARE_READ | FILE_SHARE_WRITE,
0 s" s1 n; }. I  n7 [* j) i                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
6 c" F6 Z' d! q& ~   if( hFile != INVALID_HANDLE_VALUE )
% I, w+ C! V7 |$ g( f   {
1 c; ^) |4 q5 p! \# q- j2 Z: X8 [& {      CloseHandle(hFile);% b* `/ ?) F1 J1 u) G. e* m% N
      return TRUE;6 n+ h, \6 D  _: P$ ?3 {
   }0 W4 K0 q0 A* m* k4 k+ J
   return FALSE;0 b7 Z  M% b! Q
}
5 ~6 B2 a$ K+ o8 A* O$ u8 Z8 m6 ?0 z1 a- \: z, n
Although this trick calls the CreateFileA function, don't even expect to be
' a, z/ I6 _1 C2 ?0 k1 yable to intercept it by installing a IFS hook: it will not work, no way!; r! t0 X2 X, {* X8 Q
In fact, after the call to CreateFileA it will get through VWIN32 0x001F: t. W1 x; e2 |7 q/ G4 @: w
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
3 s( A8 P+ T% {  Z( l' S$ gand then browse the DDB list until it find the VxD and its DDB_Control_Proc$ k1 n+ y3 w/ [+ f
field.
! ^, G( U: Z- f- L. |In fact, its purpose is not to load/unload VxDs but only to send a
2 }  {: m9 r7 a2 q" h% D" KW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)% X1 ]8 \/ j- F) ~. u& p
to the VxD Control_Dispatch proc (how the hell a shareware soft could try: j3 Y/ p+ X* L6 w: _8 C
to load/unload a non-dynamically loadable driver such as SoftICE ;-).; M4 N0 I! U. |* n9 ]: }
If the VxD is loaded, it will always clear eax and the Carry flag to allow
, i0 e* l$ J; Uits handle to be opened and then, will be detected.
- N6 J8 w* M+ l( T: HYou can check that simply by hooking Winice.exe control proc entry point
& Q) N) _) Y6 c+ T% y) ]" bwhile running MeltICE.
7 L' Z1 P' s* g$ e* G
5 P7 @; p- |* ^& P
4 G* X* N, _* K6 v( {. p% r  00401067:  push      00402025    ; \\.\SICE
! q/ k; ]' j* t  0040106C:  call      CreateFileA
, `) k- N. z5 ?) |9 v( X  00401071:  cmp       eax,-001, `, f  q# C* H, ]6 h
  00401074:  je        004010911 n# B- ^, F0 o2 o3 ~$ r
8 V+ `4 r2 W9 M! J. e

$ ^  `$ a( h" h, G: P+ o8 xThere could be hundreds of BPX you could use to detect this trick.2 j0 U- k0 i" X6 k! N" }% K& J
-The most classical one is:
) |0 n9 N$ u! H" w; ^. x  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
; y# v; ?8 M# V4 P5 d3 T" h& E6 f. h    *(esp-&gt;4+4)=='NTIC'2 Q1 k5 ?( t1 [; J# ^$ J; H
+ j! F, |( {7 s* l
-The most exotic ones (could be very slooooow :-(8 {: {9 I1 j8 m% Q8 }$ k* I
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
- q) g; A& W& W. F! P5 {, r     ;will break 3 times :-(5 Y+ r# e& _5 n# v) a# D
8 ^8 p$ T+ }7 D9 n
-or (a bit) faster:
- D$ M9 g0 i) ^& u* l" d) q/ ]   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
. G6 H$ v; t; e6 l8 M6 i4 D  J5 W: y* W
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  5 V$ w/ {' j! X& N2 M  ]; f; \/ p' m/ U- O0 }
     ;will break 3 times :-(
# c$ k# l9 F+ N4 c1 t! A. W0 O. _/ Q( J/ g( s. [+ F8 J% X
-Much faster:2 p' J7 O0 [7 c  U  H. A
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'* {0 l! l" ?1 G# a4 h
- Y& M0 S5 z$ f* h7 x& w
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
% Q' g# j4 y8 U0 V# I- b1 ]& L6 rfunction to do the same job:
6 B, _- L. P+ y8 c' M  S
7 |1 p3 b( N' V% k1 Z! E7 k- F   push    00                        ; OF_READ8 l) E! d# C; u& U
   mov     eax,[00656634]            ; '\\.\SICE',0
% s# v/ m- A" k/ d2 I' g! f" y   push    eax
' u; I. \" p8 I. [2 _/ T0 j   call    KERNEL32!_lopen
% J( F3 g2 H5 x   inc     eax
( V% {- U* s  @4 F3 [   jnz     00650589                  ; detected
. w$ }' [8 i+ q+ x3 [1 f   push    00                        ; OF_READ
. C8 o: R& d5 r" g, g   mov     eax,[00656638]            ; '\\.\SICE'* [. n# |. a) }/ \
   push    eax) f. ~0 p5 y0 A" G. p
   call    KERNEL32!_lopen/ b: _: ]% s" k% S
   inc     eax
$ W/ |0 S6 Z) [# ?   jz      006505ae                  ; not detected( |( }& R5 I' `- d

* D. o; x9 H- z  j. l: h3 I3 ~+ i2 Z! T& r% n' P! s3 B
__________________________________________________________________________! b1 u" H, ^6 y+ k, p

6 K* R! p9 _) V: k# `Method 12
7 G  D* W3 z: Z: J& e=========3 f  b6 Q! N3 a2 L
) F2 d+ b7 d" g) o- T" W# U) J$ l& F4 r8 f, u
This trick is similar to int41h/4fh Debugger installation check (code 05
. v) a& |; W  a. Z&amp; 06) but very limited because it's only available for Win95/98 (not NT)! L+ {* j7 A/ F7 _1 Q/ S! c
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
* M% z. u! z8 ~- S
. t) b' p- s. J  x: t: a   push  0000004fh         ; function 4fh( N' T  {( R8 M$ \! \* P$ ]
   push  002a002ah         ; high word specifies which VxD (VWIN32)2 V) V* w/ e7 r, @4 A# z- Z3 ?
                           ; low word specifies which service6 B& q# I! D1 X, r" y; z0 p
                             (VWIN32_Int41Dispatch)
- G4 G0 O: P- p2 m, A2 ^   call  Kernel32!ORD_001  ; VxdCall% O4 H' A0 L/ x/ j3 N* ~
   cmp   ax, 0f386h        ; magic number returned by system debuggers
3 X7 @& }8 _' R+ I- [; ?* \   jz    SoftICE_detected5 M5 r' i% p0 c2 X" j6 g6 s
9 ]9 `* J/ D6 ^" }( V
Here again, several ways to detect it:0 Z" A+ w1 ^7 Y: X
( J5 y" x. }, T/ s
    BPINT 41 if ax==4f& O: r( y" @1 }/ }5 A1 W6 t; N
3 `4 E7 Q& n% v" W$ c
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
% o) A+ ~6 J  [+ A
% Z% J9 N4 r  U+ }1 @7 ^+ \    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A  c: q+ R5 c; ?$ c- \3 ?1 ]
  m" c8 w+ R6 R' c& |
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
1 v3 c" |" d0 m+ p5 U1 [8 A% h$ o9 q/ |
__________________________________________________________________________7 c2 ?8 s# M" P; v

' @$ _  O6 ~' ~2 k8 l  {: {Method 13
7 j$ d, T" _8 x( o4 y  l) `0 L& p=========1 l" r' v: f) j  i( K2 t) t! }

, M4 m6 [; }) M& N, \Not a real method of detection, but a good way to know if SoftICE is
3 x- V. w5 k4 J& Q8 Jinstalled on a computer and to locate its installation directory.
7 I& d$ Q, h% {* j$ a- J: f; w4 oIt is used by few softs which access the following registry keys (usually #2) :
0 i! F; Q. f2 ?- W; @$ ~
6 w- Q$ D# \9 }1 L9 z. |7 @-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
6 D$ Z# K& ~7 Y. T4 w# u7 Q\Uninstall\SoftICE
% C$ a; w1 r2 w* Y: i" y8 t$ w-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE, c9 o" Z* p+ g: V4 E
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
$ C5 l* A6 ]) l5 C: G5 ~1 y1 R- Q\App Paths\Loader32.Exe
4 A9 B, F4 P; m! `) |" a% x
3 |5 [( Y- w$ [+ q5 V' Q) I0 s  M8 Y3 W9 u0 f6 M& {
Note that some nasty apps could then erase all files from SoftICE directory
2 J" A9 K1 y; P! N8 ^; s+ ?3 j(I faced that once :-(' |1 g' _2 q: A4 j
/ t9 b* U4 f0 k' M; ~" {
Useful breakpoint to detect it:
# f! @" D3 \/ m& Y: ?" k
6 D6 Z$ o0 p* R* E' H" W     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
; u0 s; h+ q( |* j1 p5 k, w9 P3 i4 u2 A; g8 c+ L- o' ?" l" [* ]
__________________________________________________________________________
$ i2 f. l( K' L/ W7 X: A2 X# x( @2 z( Z( N
. J" [6 [. q6 q- F
Method 14
( z- E) u+ _% @* M  ^' ^=========7 F: n' w6 n6 s1 O

$ `+ {* m" }8 ?; y6 R! h. Q; r4 GA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
- |4 s4 N) j: G) x2 P8 t! his to determines whether a debugger is running on your system (ring0 only).
  a2 k7 Z4 k1 p0 y5 F; _1 o, ?/ M5 j, |% H; I: G
   VMMCall Test_Debug_Installed. Q4 L; l1 l# n/ k  \! F6 `
   je      not_installed
% f: F' |5 L! @% w# S$ S) i* N# m  ^# f! {) E7 ^9 D! o& t# Y/ n
This service just checks a flag.
' T3 F. m2 T% n) r</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部