找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>5 U6 r9 B3 I8 f6 U
<TBODY>
1 T8 i6 F  E9 U<TR>
) ^1 ^5 \9 }! S, h4 a" X<TD><PRE>Method 01
+ j0 {, Z' e; ]7 {7 q7 e=========
9 ^( _) W* u8 I6 a" E
  r1 ^2 |/ |( K- Z9 z8 _This method of detection of SoftICE (as well as the following one) is
0 a* ^0 @- ^# q3 \0 j5 g9 ]! h. g9 uused by the majority of packers/encryptors found on Internet.0 f. x8 m+ t3 G& c+ ~
It seeks the signature of BoundsChecker in SoftICE
1 W( [6 u+ X. ~" A2 X1 E
& Y! Q$ k6 J/ I+ [    mov     ebp, 04243484Bh        ; 'BCHK'4 J0 {4 l2 O0 c$ ]  a# d/ S  B
    mov     ax, 04h
6 `0 d) L2 [' g% G    int     3       4 m/ o' |2 j# I) T9 D  t
    cmp     al,4
& }! R- [. b& f4 Q  C    jnz     SoftICE_Detected7 B  ]5 k! N, V4 ?* X4 r& L1 d
' K! S3 V. C( e, y6 x4 r0 b
___________________________________________________________________________
, K7 M# f- u- C  l3 a" H2 k. g, o9 V
Method 02
+ K  Y7 J6 J/ |! E& a3 z=========
9 N9 T( J  r5 v0 f
' w: {0 ^$ t! J' E0 i- o/ fStill a method very much used (perhaps the most frequent one).  It is used0 ^, D+ _0 K$ `' J& l: i
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,- Y' p! h4 s3 O% W% q' Z
or execute SoftICE commands...
5 s  ~: P: s% c2 {  x4 p4 s; F1 B( ^It is also used to crash SoftICE and to force it to execute any commands4 A9 G: u" X. Q4 V1 }3 i
(HBOOT...) :-((  
1 W" h4 m& D/ U( P2 A) i8 U. \7 F- X" `5 F$ |
Here is a quick description:
9 a1 v- j1 ]2 d0 d7 {-AX = 0910h   (Display string in SIce windows)
1 |. U. a1 x( z7 L; P9 s! w-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)6 A; b3 O- q6 V
-AX = 0912h   (Get breakpoint infos)" }# o! M0 A5 I: b: _5 T
-AX = 0913h   (Set Sice breakpoints)7 c# H" T- s. X/ Z- L  }% ?) p$ O* j
-AX = 0914h   (Remove SIce breakoints)1 o3 K% O% S4 F! V% _: ]/ y

5 t* H* ?' ?+ {: kEach time you'll meet this trick, you'll see:: n# ~* p5 U2 Q- Z4 q2 Z! f( r
-SI = 4647h
( ?9 u1 v* T5 Z: l9 k8 S-DI = 4A4Dh
) M2 i. u3 r) C* P% AWhich are the 'magic values' used by SoftIce.6 R! z* t9 g0 A8 O+ e/ g+ D7 `+ U
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.% D' {4 u* K' k2 b9 }/ [
" x4 ]) ?6 W  s$ c( M  S
Here is one example from the file "Haspinst.exe" which is the dongle HASP* s* Y0 g( d/ S; Q
Envelope utility use to protect DOS applications:
7 H/ ~0 e' J2 Q2 S2 G" N$ I# i% N  q5 U( M- N& c! c; l# c0 z

1 l7 F' m6 r) ^' u) W9 }4C19:0095   MOV    AX,0911  ; execute command." c, j/ d6 Y! T$ p' E9 ]5 U, a
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).0 _* J- u) _. ]. G
4C19:009A   MOV    SI,4647  ; 1st magic value.- g0 H2 F! H* H
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.* d9 E$ |3 R3 y; h! H6 e
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
. {% d6 A! E$ d. k% d4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
3 S. F. s" V4 J' ~# Q4C19:00A4   INC    CX- \! I8 N6 b( M- b- F( L/ G
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute7 v( V, c# s6 f# I
4C19:00A8   JB     0095     ; 6 different commands.! x5 ]( j( `* P
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.# l6 D! `, `5 _
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)! ]% v2 d0 d# y5 J4 U
# I+ z0 R' ~2 K: P/ p( S: j# W0 i
The program will execute 6 different SIce commands located at ds:dx, which
3 w( r  `  p* E+ Uare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
9 Y8 y; e$ N6 A& j4 F4 U
  E, V5 k, M5 n  c( e) L3 w* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.5 t9 G: F, B- M) }" g9 G! q, m8 F
___________________________________________________________________________
( M! a9 V! |) w' I: P6 M* ?& G0 ^" O  s! C' [0 i; d/ |, b5 `

. J4 e8 ^9 B+ H7 QMethod 03+ u) d: G& _0 ^0 L9 F: \9 U
=========! k" l. ]' k2 b4 D
: {2 G4 P  |! M
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
: L: W* k8 U* K" X% w( h* X+ ](API Get entry point)
1 V4 p( N+ v$ B# K& ~        
  v, e' A8 A% T% f6 f( l4 v) j( `4 h
    xor     di,di: m0 c) l& Q3 E( F
    mov     es,di/ ]" k0 N4 J2 o
    mov     ax, 1684h       6 S) U* O) z0 k
    mov     bx, 0202h       ; VxD ID of winice/ c3 ]4 ]: b7 ]$ u' \2 A9 c
    int     2Fh
2 R# [: j+ z) y    mov     ax, es          ; ES:DI -&gt; VxD API entry point! \+ t; A5 ^7 _
    add     ax, di
1 ?5 i1 z4 f7 i* v, ^3 p1 P    test    ax,ax
0 R2 W: J. I, N7 g7 {    jnz     SoftICE_Detected
3 \: H5 v; b/ Q; q* ^( I0 H  l. {" F' p6 S2 Z1 K! c8 G0 }' |. o
___________________________________________________________________________* S' d$ P, v2 I5 l: {/ T

+ H- T# x- g1 P5 G+ KMethod 04
* C, k  U2 m2 Z9 ?; g7 G=========# s! K3 S0 g) l) F4 V
( p" s* S1 Y) Q# s/ [1 h- n
Method identical to the preceding one except that it seeks the ID of SoftICE
% t9 I; [$ w& p5 }+ IGFX VxD.' u* c9 G/ D! [, f
) X: A1 w$ ]# F7 T
    xor     di,di
1 V& d, K- T3 w) ^8 A. @7 g* t    mov     es,di
" A. M& Q" F4 X% r  }3 q9 M    mov     ax, 1684h       7 t% h$ a( r5 q( A- `3 f
    mov     bx, 7a5Fh       ; VxD ID of SIWVID
9 Q* d. |" ^5 D$ i/ q/ L    int     2fh
% r' q. q( {- I! G6 ?    mov     ax, es          ; ES:DI -&gt; VxD API entry point' p5 M8 T& [. {, F" Z) O; K/ n
    add     ax, di5 Y+ Y) w: c8 Y, H# e8 ^) X; P
    test    ax,ax
" j; G3 _) ^* [7 V+ {2 {    jnz     SoftICE_Detected% o/ V# q9 u/ m
2 M' r! m1 L2 K5 c" I# d
__________________________________________________________________________& X& R# \2 p: H" H' w! m
: I4 Q% z" S, S& |& }
: Y: d" P: Z. y
Method 05
- v3 C& G/ s$ p2 h=========
1 G/ z8 \! \' w) S3 v2 D* G3 s  T8 N7 A; b( z5 L. m
Method seeking the 'magic number' 0F386h returned (in ax) by all system
0 U. T: h+ a' M4 s2 Q7 ~6 c+ o; t/ mdebugger. It calls the int 41h, function 4Fh.9 z3 j8 E- z( f3 I$ {1 P' b/ W
There are several alternatives.  : [% v1 a$ @5 n! K# B* V$ O, b& ?

. J6 X- E* t! O$ t. |/ nThe following one is the simplest:6 y% \( q9 A+ t$ S6 f% i
8 X, v- k3 Z9 x; z0 E
    mov     ax,4fh) ~, {+ z/ H4 C
    int     41h# U9 m- L: P& M, s0 A$ o
    cmp     ax, 0F386
% x* @8 P% L( _+ F    jz      SoftICE_detected% [! C& Y- _! \2 m

  F( H( F; i& z0 o
/ ]7 L& p& ]6 a4 GNext method as well as the following one are 2 examples from Stone's 4 p. a* I. R, G& v- k2 u8 ?+ c
"stn-wid.zip" (www.cracking.net):
$ H( T1 H0 N' b1 g( I' w  [0 D  j6 x, ]' U( z# [; V
    mov     bx, cs. j' T% R6 K' s
    lea     dx, int41handler2
3 ?' y# p+ g! @4 D    xchg    dx, es:[41h*4]
$ n$ T& ^, N# z9 I! k! ~5 ^3 N    xchg    bx, es:[41h*4+2]# ]; Y: N/ @$ `
    mov     ax,4fh) m' d' n* @  l
    int     41h
0 s0 e  C- I4 q+ \3 K    xchg    dx, es:[41h*4]
& l( I) W5 |( g% N! c2 z; d" U( P    xchg    bx, es:[41h*4+2]1 Z4 z1 [* l6 t# ^
    cmp     ax, 0f386h
3 p9 |( v) [  J9 D  W- [- n; E! B    jz      SoftICE_detected9 f$ y' s1 ?: D3 l( B; I

8 w, e6 V6 E: G! J5 E3 ~int41handler2 PROC
8 J: t. k4 Y# M1 y2 e  Z    iret
9 g) Q5 n& z3 \' C4 }4 Q( Gint41handler2 ENDP$ {& p& {2 i9 q: R
  [# v6 h/ T. a: H9 \# E! }

  q* D" o( T6 y_________________________________________________________________________2 Z: S  p2 @7 }
! w1 m  r3 l) `9 l; o
3 K- O4 Q0 m( a
Method 06
, @) E4 I) d! b; f3 ^% d=========6 {, m' O; u- b# s% B; t- ^
, n1 M. h/ o* m: z( v

) _& n, ~6 w& P( {2nd method similar to the preceding one but more difficult to detect:3 W& Q2 y( h! p# f$ Q
% b! @) Y- ^7 S3 o8 u% [' ]6 j
/ Y6 i: ^+ p% e9 e$ h2 j
int41handler PROC
, b& w8 U+ L' ]! E) Y    mov     cl,al
8 @2 {6 D5 d- N) \7 G" P    iret
! y# \% w( N" F% Qint41handler ENDP. `) U& K2 t9 _" T5 R( n+ I& A4 L

6 m+ \8 N& p( I  Q: i6 \+ O. o" _- V* n5 j$ y1 {
    xor     ax,ax( n, v& Q' |; o- Z3 z% S0 d' N
    mov     es,ax
2 R' F( w* A9 Q# c) i  r    mov     bx, cs/ O5 \8 p+ I  w0 J7 j9 P; K
    lea     dx, int41handler) z: V) n2 |! R
    xchg    dx, es:[41h*4]8 E5 K& Z( ?4 U9 c1 S7 `8 x5 I* f
    xchg    bx, es:[41h*4+2]0 ]1 }9 |3 ?. Z. z* I# a6 D
    in      al, 40h9 b1 N) x: f: h& u+ F) H4 j6 P( b
    xor     cx,cx
) _( i# P5 t5 j1 f+ X    int     41h
. k$ Z' T% w9 O5 V    xchg    dx, es:[41h*4]" @3 K1 y" p/ }% s: A. D9 {
    xchg    bx, es:[41h*4+2]
  ?+ _6 ~. P/ w    cmp     cl,al
# k& ]8 d. ^, [    jnz     SoftICE_detected) D4 [- v& |3 R- {

6 g5 `1 I: y0 ~# Z& ]_________________________________________________________________________- G8 P9 V! K2 B! i, a) q. m

" Z- x+ U/ l* h" }. wMethod 07$ M# R% @' D& s' U7 @
=========/ I0 U' b5 Y/ m3 a0 S6 _" z! W& O
! K9 i. Y2 I! A- j
Method of detection of the WinICE handler in the int68h (V86). B; t; T. C0 U
; r" f, k2 Z( d2 Y) Z8 [
    mov     ah,43h" `5 p8 N& e; I7 f
    int     68h" u" m; T2 |: G" ?* d( N$ [, n+ P8 `
    cmp     ax,0F386h  C4 s7 u1 t; B5 c- {6 E8 p
    jz      SoftICE_Detected* A9 M8 y8 d6 D0 |* _, I

! s2 T5 ^5 g' M1 d6 l
7 N, j9 k  ?/ f% s=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
( Z- r* N& m$ I1 i7 p+ @   app like this:4 X# w/ m& T4 D; X7 P& U( j

. C( R5 U9 O: t; \- U+ t8 i. u   BPX exec_int if ax==68/ {$ d" \' Z$ d7 U0 n
   (function called is located at byte ptr [ebp+1Dh] and client eip is9 Z, r& }8 `$ ^' s7 i  _4 N) t
   located at [ebp+48h] for 32Bit apps)
, D! N6 \. c- |+ J6 ?" f. F__________________________________________________________________________; @4 r1 d- _7 T4 w- z
) j: ?! a& {* I  f" ?) s

- d2 Y& k4 V8 v* CMethod 08, I  N5 q8 q- m6 S3 K* N8 J9 ]$ q
=========
; v$ a9 z* \1 N2 M, ~3 _6 |9 }7 s- K* S  j/ q$ _1 D
It is not a method of detection of SoftICE but a possibility to crash the
5 M1 g& v% a& r: Zsystem by intercepting int 01h and int 03h and redirecting them to another
. p+ f$ D4 J/ B& _$ ]' Uroutine.
9 G+ w: y3 g% m% I+ x" [  pIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
- ~! J9 ^6 c9 j- T1 Mto the new routine to execute (hangs computer...)
* L# g: m# ~4 s5 f
9 E) \, S" \/ c, J6 h    mov     ah, 25h
. s* ^$ \/ I$ s1 G) B, ^0 r    mov     al, Int_Number (01h or 03h)! j- ~; ^% g. Q) t/ \
    mov     dx, offset New_Int_Routine
8 v6 X) p8 B9 O: ?. \    int     21h9 C6 j' I; a# o4 z% ^- I

  ]0 D6 W/ }, Q7 m__________________________________________________________________________; A! j2 [. a( n# H

# r' s- K4 C. g" Z+ hMethod 09+ ^2 \4 ]" Q  O# c6 T
=========
. J, z7 D+ S7 D5 g
7 G3 r9 o9 l& H1 c% wThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only$ E& ^' C3 E- C) F, r+ r1 ?
performed in ring0 (VxD or a ring3 app using the VxdCall).
8 z( D9 x" q9 q7 s/ VThe Get_DDB service is used to determine whether or not a VxD is installed
' W% f0 {8 |. w  a& \* V/ |for the specified device and returns a Device Description Block (in ecx) for
2 K. G& a1 M% O1 pthat device if it is installed.
3 O. R0 T+ I$ F' d' q! o$ p$ l/ N, I$ C! i2 ]6 Z0 Z4 i: y
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
- I2 d( n# z8 r3 e9 }: R" |5 i- u   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)6 {$ R$ m6 O) {. S
   VMMCall Get_DDB
2 z- F7 R, E5 t( V2 S   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
; c% c4 Q" ~! s
$ k8 [5 h! J  b8 ^5 g# a% cNote as well that you can easily detect this method with SoftICE:
5 W) P; Z8 n5 |8 M' u/ s1 w   bpx Get_DDB if ax==0202 || ax==7a5fh
  D2 u2 ?/ z9 L/ Y3 z( ?/ _! a1 i1 y/ s
__________________________________________________________________________
7 c% b: L2 H0 ?% K6 \$ v
/ S6 m0 ?1 D0 v! w, DMethod 10/ Z( {" p& p2 C) Y
=========
9 F  p. s& a, @  Y6 K% q5 p0 o& I9 S. O4 @+ G( Q1 R
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with) R# m2 y! y/ }/ q4 p) [
  SoftICE while the option is enable!!0 A; u; p2 D& R3 u4 d* p3 L7 b
  m* {/ e( _) O% H
This trick is very efficient:
+ v" Y3 J2 {' `by checking the Debug Registers, you can detect if SoftICE is loaded4 J3 ~$ q1 E" ]9 _( I
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
5 p* q! d# H$ m9 s8 X* i# w5 y- w' Qthere are some memory breakpoints set (dr0 to dr3) simply by reading their$ E! _( g/ T5 a& ?6 x4 @1 m% c
value (in ring0 only). Values can be manipulated and or changed as well
" r) D# U, f* z" i( c( n8 s# p+ f(clearing BPMs for instance)8 S/ g  t+ `! E5 N) y

- X: [9 A0 W; T) D! G% L* L$ A__________________________________________________________________________
( }5 ^1 I4 R' w! B6 F2 q( K- B9 [8 R4 U* G, z# X- X9 J. j$ ^
Method 11/ l6 z/ l% N5 g: ^
=========' G8 Z& Z4 N; o" U$ _8 i
5 G, m/ |! U% F$ s; g/ Z  S
This method is most known as 'MeltICE' because it has been freely distributed9 r8 s* d: j# r  ]3 w
via www.winfiles.com. However it was first used by NuMega people to allow
: _- [8 _' k# n7 l/ @7 z$ lSymbol Loader to check if SoftICE was active or not (the code is located" M8 S) J' }7 ?% B6 e. y4 ~) ]
inside nmtrans.dll).' P+ t! N! N8 r6 s# i
5 ^$ s: o$ t- O( N- k- [
The way it works is very simple:
: T" S! R5 X( V5 ]* U' N0 CIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
* c2 g2 p! N; H  `' mWinNT) with the CreateFileA API.
2 t; t/ G8 W6 b. v4 p+ }" c
, d% _1 G9 F( a9 r* l0 EHere is a sample (checking for 'SICE'):
: `" C  `+ J3 O4 o4 C" m3 c+ x7 h/ ^  ?2 k* I, V! P$ E, e/ J
BOOL IsSoftIce95Loaded()* Q( P! @6 M- u% T6 Y
{
6 p& e) j+ A! h. Z' {) h   HANDLE hFile;  / {0 q8 A: K7 r- Z6 C0 d
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
" S( k+ ]8 t& R* j0 E8 S4 y                      FILE_SHARE_READ | FILE_SHARE_WRITE,
3 }7 ]+ g+ n) o/ L) U' L  S                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
/ O+ z- g! x7 I: _" D) Z   if( hFile != INVALID_HANDLE_VALUE )
+ C/ l- Y- t( V; t( A   {% D) P3 p$ n! ^. Z& Y  k
      CloseHandle(hFile);6 l* I: E% W$ Y
      return TRUE;3 p! I: f- |! a
   }( _, P; Q% }! @* }
   return FALSE;
+ Z, _' V# n" ~- ]) ?* }+ _}1 e, ~) a0 O2 I) ^' `
9 d5 F1 x  h" S2 T6 u' b
Although this trick calls the CreateFileA function, don't even expect to be
% f: P  S: k9 V- |% a% Cable to intercept it by installing a IFS hook: it will not work, no way!; Z4 u8 s& |! G! O
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
: O  ~  s: F* _- }service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)# E0 Y$ m- N0 F- n% H  Z" r0 `
and then browse the DDB list until it find the VxD and its DDB_Control_Proc/ x9 b1 w! p5 X9 |; R
field.
+ J* r( g* F. m- m/ g+ j) j; H3 SIn fact, its purpose is not to load/unload VxDs but only to send a
5 S. @/ K( }9 \3 ]" x  pW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
$ t. B+ N& n0 r: p- fto the VxD Control_Dispatch proc (how the hell a shareware soft could try" `4 Q* ~  u- R, b1 M; P* \( [
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
% S5 |3 d( M! u/ i6 WIf the VxD is loaded, it will always clear eax and the Carry flag to allow; P( \% |7 _: A9 h# r! T; C
its handle to be opened and then, will be detected.. w- U  s6 Y+ Q( |# g6 J  |) u
You can check that simply by hooking Winice.exe control proc entry point
' c3 j) ?' T- Pwhile running MeltICE.9 l, b4 _" r0 r0 }0 _$ b4 |

6 u1 O, Q/ P6 a' J% t" }6 P% c2 ~) J
  00401067:  push      00402025    ; \\.\SICE6 H6 A+ C. ^* u$ x
  0040106C:  call      CreateFileA0 u. Z( J$ f  [1 \) c- U" X
  00401071:  cmp       eax,-001
# x- V1 W5 c! o) b  00401074:  je        004010915 D1 s. u# B* ~# p! d( N
' ]' q' I& M9 y

% C1 U: V, G9 B# B. D6 ^% I3 H/ d& qThere could be hundreds of BPX you could use to detect this trick.' L- f. ^& y" S7 g/ X$ `' h* K
-The most classical one is:
- X, |5 ?' r! ^  t  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
$ a0 E/ O3 b: m' c    *(esp-&gt;4+4)=='NTIC'
% H# [- p2 T3 j( \( u; x8 z0 b$ E6 _
-The most exotic ones (could be very slooooow :-(% H, O& ]7 |1 D* F, g  _8 B
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
5 h% I! L' n; k0 U/ E     ;will break 3 times :-(7 l) E- ~, B( c6 T: V

5 C3 [: [# p& {" Y% ?" M, C2 v-or (a bit) faster: 1 N* |6 M, s& l3 w
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')2 B) G8 _: c& @/ B  s7 s4 e* w
5 e2 t- H/ p, Q& r! }
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
, E- g6 a- j4 q+ v0 L+ T& m     ;will break 3 times :-(
5 {+ U  s1 U3 l3 j  ~. G6 w
" V) M0 l; f3 K. t& M. t-Much faster:
. J4 ]4 [  f9 y6 {/ i   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'* J0 q8 t7 a3 _/ E  E. V

* K, l* M/ I9 ~, X! b( T$ @7 MNote also that some programs (like AZPR3.00) use de old 16-bit _lopen6 \8 Y! s& g3 H; r
function to do the same job:  {5 M# v9 B, A1 D! f/ s

( K0 r1 a! j6 k" N4 S$ w* t! B   push    00                        ; OF_READ9 i0 `: P5 g/ s4 `& Q: X2 l
   mov     eax,[00656634]            ; '\\.\SICE',0
) E' y+ H# W4 w" s" _4 Q1 ?   push    eax
0 {7 C: c- p- s3 b( F/ j" p* ]   call    KERNEL32!_lopen8 b3 [# v* g* t/ c5 h5 g$ ~/ j
   inc     eax
0 J& w; f( S" G- B$ X  q' ?   jnz     00650589                  ; detected
4 H4 F- @- ^! ~# E- K: X, A7 }% v   push    00                        ; OF_READ
2 U2 c4 e. A. {" r" U& W3 I   mov     eax,[00656638]            ; '\\.\SICE'
) F% Q# U' b! T: k& Y- H   push    eax
( M: I7 P: N8 o2 B6 W" f* J   call    KERNEL32!_lopen# u  h# R7 |& w8 V5 ]- W0 T( z
   inc     eax: F5 M2 K+ f/ {
   jz      006505ae                  ; not detected
" A) C/ j4 ]0 H5 Y6 A. D& A" ^- R0 J  y8 P
6 Q' G- v6 H2 J$ Z4 L# ^6 d) B: z
__________________________________________________________________________$ d; x# q: \8 S  o& O  s/ P3 u
. G3 L7 {- {5 k2 ^3 ?" H5 t
Method 12
; r( T( B. r/ X6 O1 a/ x5 G=========! ~; j: T1 V& p' r! F
2 L( v& s# ]( G8 d! ~8 l+ t
This trick is similar to int41h/4fh Debugger installation check (code 05
, s" w- t( g! E# w&amp; 06) but very limited because it's only available for Win95/98 (not NT)
2 z5 A7 s  m, d0 u/ @3 }+ B/ n: u7 ias it uses the VxDCall backdoor. This detection was found in Bleem Demo.6 q% j- M% s/ r) w
8 C: a6 T0 ^6 n6 Q5 {+ j
   push  0000004fh         ; function 4fh' r+ U" l! r1 s/ u, D
   push  002a002ah         ; high word specifies which VxD (VWIN32)
* M- n. B) L3 |- j* S$ W. K, N6 _: A, N                           ; low word specifies which service7 f- p& Z* O' O( }4 Y
                             (VWIN32_Int41Dispatch)
* X: U2 N; E9 y* V% R   call  Kernel32!ORD_001  ; VxdCall# a) s- E& I& e
   cmp   ax, 0f386h        ; magic number returned by system debuggers
# |2 h: ]* d! C, ]8 L   jz    SoftICE_detected: X3 L. ], ]* s5 _9 s. N& y! M
/ k/ {. a' ^9 a# P2 O, M) {
Here again, several ways to detect it:0 H# ^. ]! s' N) s

& B0 x; F5 ?: ]+ ?, B  H& Y. X" |6 i    BPINT 41 if ax==4f2 D5 R# D) O7 Z1 B* Q
" @/ H9 U0 J' n4 w" {9 m
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one* Y' o1 ~* c/ Z! D! @2 y3 M" y2 e

3 u% c( x8 N: ?; V# r    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A& a8 x! L* U7 G# m3 M) E. U
2 z2 ]/ X5 x( D3 s
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
" @8 n; p* m$ Q# v2 R+ p
2 @* _' L. A- X__________________________________________________________________________. \. x# r& k% w. S& v# Z

3 H& ^# a, l, p8 d, @$ GMethod 13
' L1 F( m5 m3 U1 V: r=========% F) w# W* A( ^
9 b3 D$ Q" j# \  [  [
Not a real method of detection, but a good way to know if SoftICE is
/ Z5 P. d2 k7 b1 T' J2 f& E$ dinstalled on a computer and to locate its installation directory.# Z5 h+ D: b) l0 }
It is used by few softs which access the following registry keys (usually #2) :
' H* r5 l( R0 w
$ E$ ]$ e% h* k9 j-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion0 u) y/ T4 g/ l/ c: ]) F
\Uninstall\SoftICE! b" o0 d/ m/ A: `% [2 a) f
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
* K2 N" l" f3 I( I-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion: S4 [/ Y6 }$ Y% P1 S  |
\App Paths\Loader32.Exe2 U" {7 l+ @  B( G% B

# y3 c: \0 k7 C0 D4 o' u4 S# H! X2 s( b- j$ J; n: ^* I7 ]2 y
Note that some nasty apps could then erase all files from SoftICE directory
7 C1 B( \2 y, \; O(I faced that once :-(! }% @2 M0 C* ?4 h" w' i

- T5 S# [- o7 l5 T* x% ^Useful breakpoint to detect it:# P! }4 b7 P* J2 M4 F/ R) x

1 ~. f3 G/ {2 g: K; ~+ r     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'& V4 y4 q0 x  L

; O- z/ i  R: g3 L3 V! F__________________________________________________________________________  W. e" ^) q4 t2 D$ A$ y7 f1 o" A
+ e( }9 f$ X6 ^* A( Y) Z6 b7 a9 i

+ E8 x$ a$ o2 ~" e8 k# L" N' AMethod 14 ! b$ S3 t; i% @2 \& N7 t( k1 P0 `9 }
=========. E! @( a2 H9 w2 ?6 l# y
& k5 F$ d4 H8 K6 D8 @. N
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
1 D, Y; |$ z0 ^2 k. tis to determines whether a debugger is running on your system (ring0 only).% ]  g) Y7 h/ ?

" L6 \- H- l& t8 f, M$ ]$ r1 q   VMMCall Test_Debug_Installed  m7 _" G% Z& ^4 Q. S! b% u& d
   je      not_installed8 \& u# h2 ^+ D9 _  V$ g" f$ [$ j

$ `+ U  R7 T5 w* rThis service just checks a flag.
( h  \  ]4 U# G! K7 F" @3 @</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-7-29 02:30

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表