找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>) J- x+ W3 S" f% r  o
<TBODY>
4 c$ x0 q9 H1 }; d<TR>8 ]! w0 ^& L! \, c! c3 ~; m
<TD><PRE>Method 01 , @) D; K( N( [/ ~6 U9 t( H5 ~. J
=========
: H! C% d8 A% R' l6 A! z  B- ^' U, U+ G9 N8 D- c/ a4 d0 Z
This method of detection of SoftICE (as well as the following one) is
$ v2 ^4 |  `6 \4 r( g/ Sused by the majority of packers/encryptors found on Internet." j" J0 b8 D8 X- t
It seeks the signature of BoundsChecker in SoftICE
7 N" \4 I" P; g6 N' h1 e7 v! _0 t0 Y% ~
    mov     ebp, 04243484Bh        ; 'BCHK'/ s( T4 f* ?& W' p& n
    mov     ax, 04h
# [: ~& w' a' C& ~$ C% W0 p    int     3      
6 t- D  G' I4 i    cmp     al,4
9 h: U, j% ^& o    jnz     SoftICE_Detected! e; o( K* i$ Z1 `, o* k
# ?# q) [: G; t$ f) c) W" k
___________________________________________________________________________8 W& ?6 D! f( \, l+ y1 s6 }4 _
. K) q% |2 @1 V" B; K
Method 02
; x8 n9 ?8 l3 x1 G* O' l/ Q=========& Z! U4 ^( F. u) \# S! F! h  i. z4 C; d

) ~! F' l+ ]  P1 w1 fStill a method very much used (perhaps the most frequent one).  It is used
' a+ m3 s0 t4 ~4 z0 Y  Yto get SoftICE 'Back Door commands' which gives infos on Breakpoints,9 l( f2 j- e) k8 b/ j
or execute SoftICE commands...
# [4 x2 y1 T; s3 q) ?It is also used to crash SoftICE and to force it to execute any commands
0 ^$ c' f4 o. ](HBOOT...) :-((  
1 G' I: F4 f6 }6 w
1 _, U, Y! r' jHere is a quick description:* t3 F* A, `- U3 P5 p- F
-AX = 0910h   (Display string in SIce windows)
( L& H% j: P2 W-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)- x$ C3 a( ^+ I4 N6 M# n* b' ^
-AX = 0912h   (Get breakpoint infos)
5 q; O# ]  C( `/ V-AX = 0913h   (Set Sice breakpoints)
) P8 a! W0 v2 F. i$ t$ b-AX = 0914h   (Remove SIce breakoints)' y5 H! ]/ o) @; }/ A0 {1 `

- d- P9 j" a2 OEach time you'll meet this trick, you'll see:
/ J; c1 r) b! d6 j# }-SI = 4647h
4 C9 ~* N. j$ u, k-DI = 4A4Dh
; Q9 M6 p, q4 r6 I4 w; `1 S/ U7 iWhich are the 'magic values' used by SoftIce.
; I! Y+ v# K* |For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
: T2 {) }  Y: {# V) V( o
$ q9 S! K# H8 E" r; C$ {% KHere is one example from the file "Haspinst.exe" which is the dongle HASP- d- e, v2 |2 `- n- l& k
Envelope utility use to protect DOS applications:# x" f3 v0 L8 b

$ l1 ]+ h7 w1 _' D# i) e3 Z$ N, r& D$ {5 h
4C19:0095   MOV    AX,0911  ; execute command.1 v8 t2 o! h$ V+ G. ~
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
9 j. G1 N* z& I  L4C19:009A   MOV    SI,4647  ; 1st magic value.  @, n/ A9 h5 A; h% n1 A
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.1 _) ~7 ^% Y4 U( n: }, |
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
" V& ]+ g* O, T1 c2 z4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute- h2 D, k7 s/ ?0 A( j
4C19:00A4   INC    CX3 A* z+ ~+ w5 s: a. C
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
) c  s5 e6 [) V7 ^4C19:00A8   JB     0095     ; 6 different commands.
% E3 r& y. @7 O9 g5 Q4C19:00AA   JMP    0002     ; Bad_Guy jmp back.5 g3 @, m7 |/ |! U9 |1 z
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)& `* f8 |9 D! S' q" t. `

3 A; {: p+ U( P$ A5 w6 Z8 G2 DThe program will execute 6 different SIce commands located at ds:dx, which
; J2 g* {3 ]9 T: @are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
+ N) X/ T1 `  E2 f$ x8 K7 x
! A/ N+ _1 ^3 R  h: S* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.0 s/ ~1 i3 G6 }$ k2 {. d& b* U
___________________________________________________________________________
  f' ^0 h7 D6 L* F) ^# x% T
! Z8 s& e2 H% [8 k9 s' ?' Q- I- y' o, a4 J6 Y4 R
Method 032 T( q& c- p5 Y" g+ C2 z
=========. d9 {3 h7 @' L. K- U

! Y/ P3 N0 d" n! s' ELess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h, \9 G; N& k, b5 F4 Z$ G4 W0 ~$ ]
(API Get entry point)
% D1 K! P+ T4 p, F9 f& O        5 }  P7 r8 c) k

9 ?' }8 u1 v+ W& v5 z5 A$ f    xor     di,di7 X+ H$ Z' W# [8 s" Q! v
    mov     es,di
7 z  G5 F& U0 d" y, @    mov     ax, 1684h      
- C8 n* d2 l5 X0 G7 {0 C' t" q: {    mov     bx, 0202h       ; VxD ID of winice5 j/ C" J6 E- A; M+ [
    int     2Fh
) P2 S" G/ @$ U' b" Z# v    mov     ax, es          ; ES:DI -&gt; VxD API entry point
/ C& ^+ J) w2 |5 M) G+ [# S    add     ax, di
1 X$ U9 h& e3 z& S    test    ax,ax! a  ~4 r2 X  J) O2 B. z
    jnz     SoftICE_Detected" e7 ?0 Y+ h  U% r

. s# O3 {9 [8 r% [: ]  Y___________________________________________________________________________8 E5 q, k2 G/ {4 `9 [% D4 c: s

: a8 Y) z. E; o7 ?" oMethod 04# e2 b6 o' J9 ^  l4 s
=========2 _1 `$ ]' a% t9 |& h6 b- i. _. m
1 r& I3 C5 I& {- C; N( j
Method identical to the preceding one except that it seeks the ID of SoftICE/ Z% Z0 T6 B$ Q0 f7 I
GFX VxD.
1 k  q9 s  f1 u2 ]9 C, R, n% a' P7 m* G& r) R* }
    xor     di,di' N! a% o( `. b$ l
    mov     es,di
# f1 V1 Q2 a4 k9 E0 D$ A& s- M# _  }    mov     ax, 1684h      
# c1 F7 |5 ?! A. w    mov     bx, 7a5Fh       ; VxD ID of SIWVID
- @2 ]4 p4 K' r, G4 W3 D" D  b    int     2fh
: N: m; y9 C; m  j6 T    mov     ax, es          ; ES:DI -&gt; VxD API entry point
5 [1 g9 ?& K$ j9 E8 F. A$ Q    add     ax, di
- k6 W* z( n# _0 m    test    ax,ax
& a9 y2 B5 |4 C, J- k& u) R5 ^    jnz     SoftICE_Detected
5 k5 {8 O3 q  s! ^; L
7 ~& m4 c% D& D  D, l$ u__________________________________________________________________________
  r! t8 c, A+ P' ?% e  S! o- e' K) `7 M8 W# W& {5 U
8 q% D8 v1 `6 G5 ^
Method 055 r- h9 `) E8 K
=========
( p" N+ N7 }4 D/ S" m- X3 _6 s/ B, Z+ i& R
Method seeking the 'magic number' 0F386h returned (in ax) by all system% k) q# G: X( p+ e( s. P; h
debugger. It calls the int 41h, function 4Fh.
. ^7 w# i1 `, m' f1 uThere are several alternatives.  3 B: |+ s; ^) z

3 U. u* V7 B. _# iThe following one is the simplest:  b4 S! o4 _6 @& R" J! n

0 W6 V, Q2 }. h" Y  M" R" Q    mov     ax,4fh
5 ]7 H% {2 I) g    int     41h
. I8 G, |- e, c# k1 n    cmp     ax, 0F386% ]0 V% m  m! ~* \: o9 D% M
    jz      SoftICE_detected
, ^1 Y5 a. f9 W& W0 ?9 u7 I; ^. w# k; }; `
6 }4 A. k9 g9 V; l% C( [0 p  n
Next method as well as the following one are 2 examples from Stone's
8 \) J! Q; F  {0 l+ e"stn-wid.zip" (www.cracking.net):
# I2 \  F7 U% ^' U4 L( L) I6 ^0 P5 N% U
    mov     bx, cs
3 `+ F, R; A  e) z. ]' \$ ^0 W7 ]    lea     dx, int41handler2
" u: D& D0 d  v- \: r    xchg    dx, es:[41h*4]
1 Y4 ]4 r) K+ ~2 c    xchg    bx, es:[41h*4+2]
3 q( m, ?+ v7 Z! E/ X9 \    mov     ax,4fh
+ h! I6 b) e0 l& g% k! }2 I; z) Z    int     41h5 s& d" K- E. ], j
    xchg    dx, es:[41h*4]9 L* S' f1 S- [* p, ~
    xchg    bx, es:[41h*4+2]
6 [+ F: k4 g" i) k0 f" V" L  g, C- T    cmp     ax, 0f386h
) a* t; |/ P; J# `    jz      SoftICE_detected0 ~  S5 g" [& U$ B- @

/ W4 L  V% }6 [0 P+ S- @3 Zint41handler2 PROC9 t8 w+ \, {. b9 {
    iret; E. N4 `' @3 X# D9 J* @
int41handler2 ENDP
) a3 v% K+ Q! u: c+ \! n+ t  e
$ F. u. S$ b6 X' P6 c6 p" p! w% b" Y. o) o* \
_________________________________________________________________________
# _1 W' X5 h0 W/ e( w
- i  f% h) A2 F1 ~* G$ D8 f
- A/ n! b/ b% j7 q5 j# k% Y, iMethod 06
8 n0 r0 J6 K& s: p; _8 {2 P' I1 {=========
; a( k5 [$ \! y/ D
. q0 v2 l4 D9 ~- \8 y. r, b; C, M8 Z4 N- b
2nd method similar to the preceding one but more difficult to detect:9 x* @! D: s7 i
+ ?9 Q9 T, y: S" @
. L2 t) r& @2 \4 R$ [8 T
int41handler PROC
' c# f; W5 t; L# h    mov     cl,al* g! Z. S  L# F$ n* V. Z
    iret8 J1 f0 V3 g& ~# p4 v
int41handler ENDP
& z/ ?# ]+ z+ m! P) m+ P# y) {% l+ B( r" S+ M' s0 o+ d5 q

: O0 j; i8 z( |    xor     ax,ax. M# k3 Q0 I$ \+ H* y# K5 h
    mov     es,ax
$ y% l, i: t  T" {& W    mov     bx, cs4 J  @2 G4 P; V! w* G) Y
    lea     dx, int41handler% i$ P. i$ O* j
    xchg    dx, es:[41h*4]" s' c; x9 l. e* U# [/ Z) M3 L
    xchg    bx, es:[41h*4+2]
! u: {! m+ A. A0 I* I4 o    in      al, 40h
9 O' {/ g6 R$ f+ M0 l% t; q3 `    xor     cx,cx
2 w$ w* p( r, x# a! ^5 h. n    int     41h
- u- K8 \' s3 l/ N8 I, F1 w; k' B    xchg    dx, es:[41h*4]; X; p$ L9 f/ u. Y
    xchg    bx, es:[41h*4+2]
- K& L7 I' F* d* V5 K  U5 z    cmp     cl,al) E# k2 l' \' T& i! M
    jnz     SoftICE_detected
; Z$ q/ A9 t+ i# r  y, W0 L$ ?5 j8 Y
_________________________________________________________________________- C( ?2 {0 p+ b9 O3 ~& M2 U* C

9 ^3 G, b4 D; m4 {( \Method 07$ _( {& Q$ U/ F5 E& s
=========% m6 x# A* `2 f
1 _, S- W* c! F: F; R
Method of detection of the WinICE handler in the int68h (V86): f  C7 z' ~9 X6 ?/ w

* R; a) L" J) f9 Y    mov     ah,43h6 r" e6 o5 [  Q! G/ ^
    int     68h
5 ]/ y# T( t& T" L& M% m    cmp     ax,0F386h
( m8 M( `! h; a. t    jz      SoftICE_Detected
6 O( c. {: u( Q! M" M! r- z. @. H: [! K, {: B+ |
. W1 t# b) ?6 e9 f5 N8 b/ n, ~; P* l
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
; u' B2 R0 X4 v* K+ f3 ?# s0 z   app like this:
/ k1 O% {. m$ S3 F
  K6 {% [' o. f0 K   BPX exec_int if ax==683 K; J# x3 z8 \# T
   (function called is located at byte ptr [ebp+1Dh] and client eip is
4 v- y) O  L/ M/ q, Y   located at [ebp+48h] for 32Bit apps)9 J+ C, [$ ~, c  y' g* a. Y# N# U
__________________________________________________________________________$ e: m/ a" z# J, T5 P( z
$ n$ S2 r+ u. G6 M$ e3 u

. ]) W# X& w7 p+ {2 v# g4 \9 EMethod 089 l5 ^/ D+ x3 C- @- e- Y4 s
=========
( D( H5 W" @' @) C" N: Y8 s2 n9 b  Y- T* l
It is not a method of detection of SoftICE but a possibility to crash the
( [0 g% ^' ?6 {$ h9 lsystem by intercepting int 01h and int 03h and redirecting them to another& g- A6 [- V, j8 |8 m  v
routine.
% ^, H  Z3 X  I+ I- \) z2 zIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points' g+ r/ u3 X6 u5 C7 [. T+ S
to the new routine to execute (hangs computer...)1 h; H$ }2 p, j' x
1 V. b6 N3 e5 E& e2 n  {
    mov     ah, 25h
: q8 j% z7 R( T, a2 t    mov     al, Int_Number (01h or 03h). V$ q3 Q6 G6 x8 ^
    mov     dx, offset New_Int_Routine0 G" G2 {  E- i3 s1 H& e
    int     21h
6 w" ~1 P1 ]7 s6 ^, v  }0 m  n
__________________________________________________________________________! j% Y" i7 X3 g' W2 Q7 L& Q
4 Q. t) N! e( g3 {: }
Method 09/ Y4 M$ [' D; u- q( L+ k( u; A
=========
. }4 o! U. H0 e$ j9 u( I) Z' X2 b
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
* I7 G' L5 W+ i  fperformed in ring0 (VxD or a ring3 app using the VxdCall).
3 S2 E' D6 l* B9 L- O+ gThe Get_DDB service is used to determine whether or not a VxD is installed" f# ]* w4 C( c+ O& Y$ v7 x
for the specified device and returns a Device Description Block (in ecx) for- e* W* G( S4 V3 |4 z: K# _. G
that device if it is installed.- n5 Y- G- T8 z) {( l1 `# L, ~

" k; C: Z9 Q! Z7 I  t4 f3 p/ E" Z# n   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
1 Z: t6 z3 O; s9 t9 |# n   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
; X# F4 i: k1 `1 g4 @   VMMCall Get_DDB- [2 {; w6 G! s( }3 O) _/ x' p
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed/ b- ?( d6 j# x) [

* x8 d% T" {; J  h" J6 t- A( _Note as well that you can easily detect this method with SoftICE:) J6 f8 x: [$ |2 l. I/ T. ~+ K3 g
   bpx Get_DDB if ax==0202 || ax==7a5fh
! _) r9 k9 d3 e, _+ e/ j7 F! t4 i6 K- }( T* p* f3 h& }8 M, [" J1 V6 t
__________________________________________________________________________7 ]8 t0 }) c4 V( d% G9 T/ w- s
7 u  Z0 B4 ]' h2 R' O, K8 r% C2 i
Method 10( v9 h6 e% i  u% \
=========: ^. Q  ?4 E; S: n

; p. r1 v3 }' f6 M( p=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with" Y; m$ W1 `5 M2 i' m  u
  SoftICE while the option is enable!!0 v4 L. U8 u: p, Q9 Y- E8 E2 ?/ B
, C" h( X. Z' D; `% ^9 |
This trick is very efficient:
8 ~  f  u% k+ }) O/ \+ jby checking the Debug Registers, you can detect if SoftICE is loaded2 V8 p! X) h: w' I% C
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
2 h) d" E  r% t# I. g: t3 {, G0 othere are some memory breakpoints set (dr0 to dr3) simply by reading their
+ q& Z$ P0 [4 T9 [% a5 Kvalue (in ring0 only). Values can be manipulated and or changed as well
3 J$ z' c! }, `9 @( T1 k(clearing BPMs for instance)
! t7 M- G2 ]- p% e$ a+ O- B5 q7 e6 W: y
__________________________________________________________________________
, R# `* U7 @  t/ J& j4 x/ b! \. D+ h
Method 11+ I7 _8 ?$ R1 @9 _# E1 u- V! M( V
=========
! I* a& O& }* v7 j& j8 a" O, |9 Q1 q. l% f
This method is most known as 'MeltICE' because it has been freely distributed
4 N: C* `+ j8 F$ ]  n- z, pvia www.winfiles.com. However it was first used by NuMega people to allow/ K/ R! M7 [7 a! ^0 F
Symbol Loader to check if SoftICE was active or not (the code is located0 B# M! u9 Y1 H
inside nmtrans.dll).
! r  I; Y1 X- r* x6 |7 X
( g, t. Z- \+ w+ Z. O) M# uThe way it works is very simple:( i$ s5 `. a" o. n. B: {8 @! X
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
2 W% ?' d  y0 o' S1 J1 f* dWinNT) with the CreateFileA API.
, e! V6 L, h& d, l7 S( U: D) i- z9 r5 T4 Z1 q% b$ y) x
Here is a sample (checking for 'SICE'):, j9 g, x  `( e. Y& n, j- J
9 W/ h9 P- r2 d' `1 x5 c6 ^1 I
BOOL IsSoftIce95Loaded()
" D; D. s, T) D! D2 t9 K5 |{6 c# U. l5 e& j; g: N: m( Y
   HANDLE hFile;  4 @& j# T& K% i3 k
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
6 o; i  A* B' |- g) g" A8 _                      FILE_SHARE_READ | FILE_SHARE_WRITE,( H& X6 X0 f) k5 |
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
2 E/ V5 r* g0 B+ G   if( hFile != INVALID_HANDLE_VALUE )
6 Q6 ^0 M0 g' W   {
7 y% j$ o8 Q  I- p      CloseHandle(hFile);
6 U' G% I4 B0 F6 z3 m& T      return TRUE;
- d6 N4 [/ x! J   }
; E3 B" j( A* J3 s   return FALSE;1 j; L' X; e. w" l
}! E$ `0 ]8 a( _9 K& L- h
. M6 W. r8 ?. M! A: h6 i6 P6 N' X
Although this trick calls the CreateFileA function, don't even expect to be. c+ h+ n" }) y8 U
able to intercept it by installing a IFS hook: it will not work, no way!% k; l$ S, o3 n' @+ g6 N  C6 e1 R$ w
In fact, after the call to CreateFileA it will get through VWIN32 0x001F9 y1 n5 c( |# j
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)" i# l( X2 w. D; Z( d0 h( j
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
7 C+ M2 I3 t/ w# y( `1 z, Sfield.
: u# m7 v0 X. t( jIn fact, its purpose is not to load/unload VxDs but only to send a
( P0 Z3 D' Z/ N7 W$ pW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)- Y7 E  q7 q; p" R4 E
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
, P' p4 m6 q. `5 lto load/unload a non-dynamically loadable driver such as SoftICE ;-)." B' l* |2 b* t( M3 {, Q. C
If the VxD is loaded, it will always clear eax and the Carry flag to allow2 d0 |4 g; d2 m6 v" I
its handle to be opened and then, will be detected.: u) d" k: M8 B& w
You can check that simply by hooking Winice.exe control proc entry point  n, c% F9 x; I
while running MeltICE.
9 P1 N/ O/ c4 Z( Y1 q" {& V2 u; A) e4 s0 i2 \

( V- A( p, C# l( ], M  p" I  00401067:  push      00402025    ; \\.\SICE
3 T1 M1 D/ j) }! U9 S9 E) Y. b  0040106C:  call      CreateFileA3 a. B1 h2 U% s; a% l6 r' a
  00401071:  cmp       eax,-001: q4 q5 w  r; ?3 Q9 E
  00401074:  je        004010913 a' H6 c2 P! ~! }* L5 m* C: ]: G
  ^3 p1 K% J, d- X  E9 E+ j

2 O3 n; M6 }5 ZThere could be hundreds of BPX you could use to detect this trick./ ~- b' c! M1 B+ f5 s
-The most classical one is:
9 B5 C7 A$ U$ H, p' ?; ?  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||% e, c# \' X" z7 {+ P
    *(esp-&gt;4+4)=='NTIC'
& E0 d  \4 R  D$ h2 l% P7 F% r) a% L3 `  ]" U
-The most exotic ones (could be very slooooow :-(
. t+ q9 C6 I7 |+ h   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
3 j5 Y& K. J2 i. z     ;will break 3 times :-(5 m3 ~$ y8 [8 ?1 H  R

" n; |4 o% W1 M* a* s% d- a-or (a bit) faster: 6 n7 K/ W4 V; j
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
* ~2 w+ @% E5 L" a7 {: H( ]% e
9 l; Q. {. C8 p- i' Q2 w   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
+ X0 i! m2 x$ k8 ?     ;will break 3 times :-(
' j& C8 s0 g5 _% ?+ _
# H( v; \8 O* L-Much faster:
( }5 P9 ^+ d3 i& ?8 N- Y9 F+ n   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'9 r5 X. f( P& d
3 g; L* c7 S1 _1 m8 p; ~& U; }2 x
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
* i9 }5 ^5 d2 xfunction to do the same job:
) B1 O5 ?2 B2 L" s& b# s
8 H; o5 B) y% B   push    00                        ; OF_READ
1 e; n& J3 f! F$ C6 {- l   mov     eax,[00656634]            ; '\\.\SICE',02 {3 n  g6 K) r6 b
   push    eax& k6 I; Q% [! t$ ^( L1 w/ R6 {1 b
   call    KERNEL32!_lopen
! m7 \- Y" e9 F   inc     eax" h$ q. N% k9 R2 X6 y/ q; G" H
   jnz     00650589                  ; detected
2 _1 G0 l: N& Y   push    00                        ; OF_READ
3 s* l. C5 S3 Q, f1 y" e/ n   mov     eax,[00656638]            ; '\\.\SICE'
+ F  @$ t4 P2 _3 |. k   push    eax3 Q" G! T% E' x- G/ g
   call    KERNEL32!_lopen
1 l, f1 j9 R# S0 {/ Y0 j   inc     eax
7 M5 w! [- z" m   jz      006505ae                  ; not detected
+ C, E7 P, k7 ~1 j. g8 _$ E* B4 o7 |) ?% M8 ~

( a0 V4 C+ i+ Y0 f, W__________________________________________________________________________
8 s# a$ h: q; c( J% M  L8 u! i: U' R" B
Method 12
9 h: O3 w3 @* {9 m=========  n4 \! r1 C0 f& ?; X8 c1 j: V7 }

! W* r3 e/ k1 T( s+ A9 WThis trick is similar to int41h/4fh Debugger installation check (code 057 v' O$ r9 t7 r5 K
&amp; 06) but very limited because it's only available for Win95/98 (not NT)7 _4 V3 z! ^3 x6 e
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.9 P( U9 n* r" d& B5 W
: F  j& `8 z% Y/ E
   push  0000004fh         ; function 4fh) S4 G& B- r4 s5 G2 m) E/ b
   push  002a002ah         ; high word specifies which VxD (VWIN32)" a! f$ d2 h# x  [; j
                           ; low word specifies which service9 p. H- `! v; k, }
                             (VWIN32_Int41Dispatch)
, a5 w- ]3 `( E9 T% U   call  Kernel32!ORD_001  ; VxdCall' R% h( `  N0 W  e+ t" p5 C* s
   cmp   ax, 0f386h        ; magic number returned by system debuggers8 \. P8 I1 r: h( r
   jz    SoftICE_detected5 H( g; H7 M5 D* M. G5 k
) a' B1 k1 [6 d* k0 O) y; ~
Here again, several ways to detect it:$ P9 ^7 X  Y& Q* I$ D0 n1 X4 r  M
% h2 w% ?; V3 {) _) N
    BPINT 41 if ax==4f
& T5 K; t' x% j) Z9 j3 D& O  e# n/ V4 `' }% T: [" c
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
' ?( _0 V# J; q5 b2 b, U4 C  Z1 l" H; Y; P6 }- H
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
/ @1 J$ i% K" `
7 i$ T6 e: S5 F: m) Y4 C2 b    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!9 l: p6 _! a8 _% Y
. r: t; G* [, i4 I. T& r* ^
__________________________________________________________________________) K7 _: r9 Y3 [; B( a# v, V# j

) \( S2 g6 O5 q: Q* c9 ?; R# ~) [, KMethod 13
* |8 x. v7 N  U$ [6 P" a4 B/ k=========9 s+ s4 L3 D( k' v: s

1 F$ H5 p( q5 b9 K$ @) GNot a real method of detection, but a good way to know if SoftICE is
( f+ K4 ]: D/ t9 qinstalled on a computer and to locate its installation directory.; G) h* G) k1 a
It is used by few softs which access the following registry keys (usually #2) :
8 m! }$ _5 f5 ~0 c- G/ W
! R2 I6 h4 q( _: }( l% u$ I0 `-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
6 T4 Z8 ?" f- J  j- G) U/ X\Uninstall\SoftICE
* T) c+ n, X# r: _-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE( {8 J: d( O5 a: N( X( B6 |" ^* D
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion/ O- X$ z) p5 Y* q( z& ~6 k; ]. P4 ~
\App Paths\Loader32.Exe$ G& _8 u& j% Q- ]1 T- d9 B

) x9 d/ h4 B3 L
' H. S( w6 I, v" ZNote that some nasty apps could then erase all files from SoftICE directory: N) E  f9 K+ b7 W0 q" c  N
(I faced that once :-(
  ]( s, ~  P( S% b! ?  n8 D9 E, A  O/ h" i- w- y5 L
Useful breakpoint to detect it:% z  c( b. V' l; f' c
' V1 F" d; j# Q9 v: k6 v
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
" H1 _+ E6 |5 I( f6 s1 h* S7 `# Y/ W/ C2 ^  K
__________________________________________________________________________
9 K- e8 Z) ?/ q6 p+ v
; b& \8 P3 K, y9 L0 `. b2 l0 |+ T; I/ p" n) t* E/ n, H6 m! x
Method 14 : P4 M3 m% I7 @0 [8 t% f$ k
=========4 \( ^! F$ A0 E8 ^

  F) |9 s2 C" Y" h% iA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
- q4 B5 }: D2 [) |2 {' G2 [$ ^0 @# @is to determines whether a debugger is running on your system (ring0 only).
2 j9 g* ^- {/ b# e& Q. X1 f8 I/ F, g6 d3 |/ f( h
   VMMCall Test_Debug_Installed
( `( J9 E! N7 i9 D$ p2 C" T   je      not_installed( Z0 U9 n) c" d7 c8 g) e+ s+ A

+ `6 w4 S+ H$ e+ h& r. e4 OThis service just checks a flag.
8 c8 `7 p6 T; t) \( @</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-8-4 10:54

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表