About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>7 A0 ]: l3 d) g% t! S
<TBODY>
+ K5 a! p! J7 e& {, h<TR>
+ e( j$ d% X( o$ l+ m7 u" a<TD><PRE>Method 01
1 o5 G4 F1 y' [8 L- E- Y: t# `. t3 k=========' U" \: f) C% u  G0 J  p
6 P6 n0 r9 @; p
This method of detection of SoftICE (as well as the following one) is
5 I9 u; {9 d# l7 t% A  W3 dused by the majority of packers/encryptors found on Internet.2 a' X+ D7 h3 Y% w& B8 N( r
It seeks the signature of BoundsChecker in SoftICE
( C5 v0 L  s- |9 B& R! h% n5 n, a
4 |. }9 k* g: X    mov     ebp, 04243484Bh        ; 'BCHK'
$ U$ m# R( ]$ n8 J' Y& x( @( C7 a  _    mov     ax, 04h
1 |) z: K# L) @+ x# V+ X    int     3       . v& H6 r; I0 K, s' q  o7 j
    cmp     al,4* z5 Q7 E% @9 F7 L' ^, Q
    jnz     SoftICE_Detected7 F# L0 u5 x, ]
, G' l- _3 L3 j
___________________________________________________________________________
6 {/ n, {. ~/ h, I$ ^# G: `6 k9 n1 _  s
Method 02: M: b5 J0 J8 r& N6 z
=========  A8 D# E; ]2 B9 B( S5 G$ X

3 B1 f' j" j" `( zStill a method very much used (perhaps the most frequent one).  It is used
1 ?+ o4 t9 N0 l4 Q; \to get SoftICE 'Back Door commands' which gives infos on Breakpoints,8 ^7 p4 q4 I' i' w/ M) ?
or execute SoftICE commands...( S- G% o0 I# Y
It is also used to crash SoftICE and to force it to execute any commands$ F) H) k8 ]6 M. G8 @& |+ W# e! s
(HBOOT...) :-((  ( L# N. ~1 W3 B2 R
& ]8 O9 P1 G4 u
Here is a quick description:+ V3 M; X, D( g& H! B) E
-AX = 0910h   (Display string in SIce windows)
7 O. E) d3 O- R  H% J3 G% ?8 W-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx), ^/ H" A/ H- ]! i" o# D5 M
-AX = 0912h   (Get breakpoint infos)
5 S9 b+ x, _3 X: i$ F& R-AX = 0913h   (Set Sice breakpoints)
: U2 T( I" z' Y& B-AX = 0914h   (Remove SIce breakoints)
, @0 W" i+ |) F( R0 X: Q
8 L, r+ Y+ _. H& CEach time you'll meet this trick, you'll see:
5 V9 T! s8 T1 n$ `-SI = 4647h6 J7 W; ]# u) U3 z5 s' j
-DI = 4A4Dh
* E& H3 R. @+ B9 @5 N2 r5 @Which are the 'magic values' used by SoftIce.+ G/ B+ @1 x1 `! p; z6 W
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.2 O& Y- U3 d6 M5 z) e8 B! }6 T

$ F9 K* ~  n, @6 n% y& a; nHere is one example from the file "Haspinst.exe" which is the dongle HASP
' u  ~7 o  h1 q- P7 uEnvelope utility use to protect DOS applications:* g+ O/ ~1 Q  `- x* L3 N3 N% o. K

! K7 U: l1 o* I' K& a( I5 K1 h/ m+ B3 ?2 r& t5 v* A
4C19:0095   MOV    AX,0911  ; execute command.. r6 W% D7 e" i; ]. ?; V( q6 {( V
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
% }# s: g' H; f  z% b3 J& l4C19:009A   MOV    SI,4647  ; 1st magic value.
9 R  \4 Y1 L4 _/ i' @8 ]4C19:009D   MOV    DI,4A4D  ; 2nd magic value.# e3 i$ m0 W0 f) T) K2 }& a
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
7 ?1 f0 E- F; Q- _4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute, }5 _6 m% K) b7 \
4C19:00A4   INC    CX- T: j5 Y, k) |' R% p  D
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute9 U1 ]3 R4 Q% v) t
4C19:00A8   JB     0095     ; 6 different commands.9 k+ M) ^; Y' ]3 Q# p  F
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
; x) D; @  a4 n3 G) x' `0 G( u4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
* o& l& K6 F& I/ h9 n8 @/ z! `
The program will execute 6 different SIce commands located at ds:dx, which7 m) S% g+ _$ {9 V. h/ ]
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
2 q; q1 G5 t8 _6 `& v( O' ~1 a. S* d0 v2 v
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
5 L+ Q6 z% o4 V5 u% q! c___________________________________________________________________________
2 ^, C  m/ w  ~
: p$ `/ |% D* Q9 ?; s1 F; R! ?) E. Y6 l" q6 v2 W
Method 03
9 R) U9 _; `& Z+ j$ f4 U=========
+ @! Q( Z, d9 Q/ A! }
: N9 ]! b0 U( }$ i  }Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h! m; v8 N6 ?0 c# g/ {8 n3 t6 @
(API Get entry point)
/ o2 o& m5 e" s1 ?4 I        
8 t$ |% @7 v% u5 ~/ H# P8 E1 f
& }+ N3 c% m6 i4 q6 L( r    xor     di,di& X, E+ D3 @# K5 N5 E9 z) N
    mov     es,di
0 T- i0 y1 g  E9 a) b; S    mov     ax, 1684h       ; S! L% x) P6 d( V5 H9 ]: E- f7 u
    mov     bx, 0202h       ; VxD ID of winice) e% Z" H; z  e$ c9 R; U
    int     2Fh
0 V* E2 S) u5 M+ b, R    mov     ax, es          ; ES:DI -&gt; VxD API entry point. W- I& s% L8 J4 {# f$ K
    add     ax, di
3 H$ e; V, p' o; m  }6 F$ O5 H2 c    test    ax,ax
2 @' I0 R0 Y" T    jnz     SoftICE_Detected9 J" g: d5 W2 [; J9 }- {; b; Z. D
; p% A; ]9 T+ H
___________________________________________________________________________5 z# ]" K7 h! [! q4 _0 J

# [1 ]4 w9 q' O# h3 QMethod 04
; [9 R! [- `8 C! ]6 c5 ]0 J1 J=========
! E/ ^; t1 l! x% b- L0 \3 z1 j  ]# G8 S& n! c' P
Method identical to the preceding one except that it seeks the ID of SoftICE
- ~) ~9 @& k5 _# EGFX VxD.
) r8 ~- Q4 V7 w  \# p  d" x: w# G& O' k5 D6 L8 y+ I
    xor     di,di
8 m2 X6 p) Y) O    mov     es,di* m5 M. I3 A! U, l& S; q" ]+ m# j
    mov     ax, 1684h       % E- d) j; z5 |- s
    mov     bx, 7a5Fh       ; VxD ID of SIWVID
6 V2 [6 G5 }- U- j2 H! |    int     2fh0 T6 r' J  P) A- I
    mov     ax, es          ; ES:DI -&gt; VxD API entry point: G) W/ k1 v" |7 t" V
    add     ax, di0 T% x* B+ i7 x, [
    test    ax,ax: [7 [. F2 {/ e8 W* w  J
    jnz     SoftICE_Detected! Y1 ^& l( l: `. y

( W  u4 G! i; U__________________________________________________________________________
8 X8 l9 n  R& o, n  h: N
0 q$ g1 u8 a9 U6 q( K  @0 |' E* Z
) D9 ^' K8 w7 [Method 05
9 s* l2 n1 J5 J" `& d1 l=========
1 v. n2 \+ a# I( }% M9 M5 W6 x( k
% w6 l4 S; t! RMethod seeking the 'magic number' 0F386h returned (in ax) by all system
1 p' u7 `1 K* n+ J0 hdebugger. It calls the int 41h, function 4Fh.
1 m/ I2 O9 E4 C' P! Y  TThere are several alternatives.  
% _( b. F. G2 K7 D1 r7 V; q5 ~" s$ i' P/ p3 h4 P
The following one is the simplest:
# p3 m8 F) I, e* r4 S, n# X; A  Z* v$ t' k, u4 w9 z
    mov     ax,4fh
6 Q. E! E9 X/ S+ s+ O1 q    int     41h
" K0 f- r0 D" \+ _* R7 D( l" U    cmp     ax, 0F386
7 ?$ |' ~- u, G    jz      SoftICE_detected' s3 ?2 E$ y# P5 c+ ^0 S, V
7 W6 m5 L/ G* b3 n$ ~! U
4 b: g% x% w9 w6 w! N5 K* d
Next method as well as the following one are 2 examples from Stone's 4 K7 T8 U. r: t' A
"stn-wid.zip" (www.cracking.net):2 ?) a: C  y8 @" ^8 Z" G

' E/ s$ o1 ^0 F/ {# f3 v    mov     bx, cs: r9 |# C/ r5 d' l+ G
    lea     dx, int41handler2' L/ x+ o, Y: ~5 C1 n
    xchg    dx, es:[41h*4]4 _# I! C- X' B) F+ p
    xchg    bx, es:[41h*4+2]
. i6 m# |$ R- ?1 q) \. e# Y    mov     ax,4fh
9 g7 W; B4 ~5 T! q    int     41h
, I: v2 ~+ W' `/ S5 _+ B    xchg    dx, es:[41h*4]
4 d+ o/ u2 c2 F8 L6 M% c    xchg    bx, es:[41h*4+2]( U) }6 k3 v! ^8 g; D4 B
    cmp     ax, 0f386h* W* n  x( i0 O4 S* i
    jz      SoftICE_detected
( A9 F* }5 S$ U" r# w+ C: d' b- z$ I- \* L% u( g. g
int41handler2 PROC
0 _' o3 {$ D+ S" I9 D3 m    iret' a2 h" `9 |+ }# w( M
int41handler2 ENDP" a2 x1 A5 e  ~. q2 W; w
' g6 v( f6 W( A3 h

9 ^5 n3 L0 k. I  ^; O_________________________________________________________________________
/ ^( ]2 R- y1 C* ?! h4 b2 n0 J; d- E
1 I8 E& Y3 K# F1 v% @" B1 w, [
Method 06" e: _2 Y) c8 y2 A" k+ W
=========
* j& u5 l+ C2 |2 q# ^$ N0 d! y; A- u9 }0 C1 E

  v0 D# _/ L4 P4 J8 p3 K+ N2nd method similar to the preceding one but more difficult to detect:* ?8 I% Q: ~4 p2 Z6 L0 m2 |& L8 T, ?

. @; ?( K0 F# D; I1 S5 B
4 L( S* L- D0 c+ x0 kint41handler PROC
4 F7 _1 d5 N5 `    mov     cl,al
& l9 r1 D+ j5 q& _$ Q9 o% g    iret/ E) O3 t/ C, K: s+ Z/ Z8 m
int41handler ENDP3 a2 Y) Y) e! m! u* y$ _) [
' N) K: s+ R3 }7 q
! h( q. S  l6 n# _) ]' [
    xor     ax,ax
/ o( Q0 d: @5 M) U, s1 s7 Z- D: h    mov     es,ax2 V. A( S. f2 W2 S/ i
    mov     bx, cs
4 N  j5 B9 Z! `9 m1 w! n0 E    lea     dx, int41handler
( v, |) h! k, p    xchg    dx, es:[41h*4]
5 Q8 K* I! G/ W; n7 r2 ?4 l    xchg    bx, es:[41h*4+2]1 |( G8 S2 ^  l% s# n2 D- ]- D: V1 T2 ~
    in      al, 40h. Z( ?  m" R/ i. z
    xor     cx,cx
6 {6 E" M# G- T8 u4 @    int     41h
9 z0 t. I' l( k/ _    xchg    dx, es:[41h*4]& N( L7 d! |1 m" |' Y( e) `" i  S
    xchg    bx, es:[41h*4+2]: F1 R* W" [- Z* W
    cmp     cl,al' f2 S/ S5 l' y  Q
    jnz     SoftICE_detected
2 M7 j& e+ y( B# Z# k8 X* J( D- A( K. X2 G% R4 k; Z: [) R8 j9 ^. z
_________________________________________________________________________- x7 \  x' L. G/ B* l
( E, p( H/ k: J
Method 07
* |6 ~* ]# j+ ~4 e$ ]3 r=========
# |( J/ R% n3 L5 a* s
% r6 `: E! r( S/ iMethod of detection of the WinICE handler in the int68h (V86)
+ n3 y7 k; [4 N; A+ F" p; o" Q! j# f7 e7 }3 z7 f" f- t4 {
    mov     ah,43h& S0 g: t' O/ \1 x% x
    int     68h
. e, m+ h7 R* C6 a% q  m    cmp     ax,0F386h
, p. y* v; \. Y    jz      SoftICE_Detected
* J; z7 v+ [0 U9 @4 y
+ E5 H' {8 E. E5 A. Z" \8 O1 n
* |7 C5 W2 Q& t- Q7 M! l+ V6 o& ]=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
( ?' G' z1 v' E7 S, e& S6 V   app like this:$ \+ ^; H4 }  }* y3 e8 l9 D
& o7 l& l+ ^2 i6 _
   BPX exec_int if ax==68
( i/ a. [+ V3 q$ g9 \) L9 Z   (function called is located at byte ptr [ebp+1Dh] and client eip is# R0 H6 }" _# ^& w* Q$ D
   located at [ebp+48h] for 32Bit apps)
2 g; V7 o1 m: R/ h7 U; d__________________________________________________________________________) E+ S  F& i- M7 N( h! Q
7 {7 s+ q2 @' ?/ Z3 P. ~

3 g7 [' J: j3 i/ d4 o$ NMethod 082 p8 y9 b" Q6 a5 y2 r' Y# Q
=========3 U1 I# m" i/ X; q' ]/ \9 a6 T( `

; Q7 b% D) }4 F+ c# S0 rIt is not a method of detection of SoftICE but a possibility to crash the0 n. {7 _. k9 F( c' ^1 h% y9 t4 t# t
system by intercepting int 01h and int 03h and redirecting them to another
" H7 ^. T4 {" w9 Hroutine.4 ~: _/ R& Q0 I  i
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points: s5 b8 q0 C8 b; N
to the new routine to execute (hangs computer...)
( I" b, H: J) A4 m1 e0 C0 H- Y% k$ }% R5 e( j5 h, P
    mov     ah, 25h+ q( H) Z6 K' x) k1 j
    mov     al, Int_Number (01h or 03h)0 {* q+ u: q# {3 U5 w, f+ j: [
    mov     dx, offset New_Int_Routine
$ A$ Q  o" E6 b" t' \! V' ~  S    int     21h
% l4 _+ U" s5 {9 a( F4 l5 [
% c8 d* b* a# W  X* O3 P__________________________________________________________________________
6 o: U6 M: {  J5 \) S* `* \) \* {$ [9 d, M
Method 094 D8 t+ |) ^: J! a) o* u8 @
=========; S1 F: `1 l7 R8 s5 I
$ [% A- Q- H/ }7 ]) p; S: h7 K
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
, D0 c. Y4 b$ @performed in ring0 (VxD or a ring3 app using the VxdCall).1 U! }& [+ `; J) V9 C
The Get_DDB service is used to determine whether or not a VxD is installed
# ~$ R7 l) F- H. W7 Sfor the specified device and returns a Device Description Block (in ecx) for8 H. U$ b! n* y  ^
that device if it is installed.( }8 E$ Z* |& z/ Y8 ?' B
0 J7 ^( {2 D& m. @: U: U4 Z6 E- j
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
% @9 m" c  N" t7 n- D0 {   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
5 e) X) C) {6 j# `   VMMCall Get_DDB
8 A" n: }- X' g- @& L. ]+ n& D   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
% L# c) r+ k" M' p5 G$ h+ w" m" T2 J$ M7 D2 k  y+ ~
Note as well that you can easily detect this method with SoftICE:
0 ?4 p8 ~2 n+ A  E. z! `   bpx Get_DDB if ax==0202 || ax==7a5fh* I' R' G6 h: K, m1 e. A0 }  Z

6 M/ Z& a( w$ }  R__________________________________________________________________________% c5 x) k" W; @3 N
, ?, `1 {$ ~; P) _& T5 d/ E8 d
Method 10' {2 k0 a$ n/ L
=========- i% J. J; s6 \" P% w

) f. K; Z9 F, j5 W: {) j. n=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
0 R2 b- C9 H" f' o  SoftICE while the option is enable!!
% J0 e! I1 X0 j7 m( h6 [/ ]! l: m" ?/ Y2 C
This trick is very efficient:1 y( t* w& {5 |* L
by checking the Debug Registers, you can detect if SoftICE is loaded
# m0 M7 p/ N: ^, V$ B(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
0 g  C9 w( A" T& Z& v& qthere are some memory breakpoints set (dr0 to dr3) simply by reading their
9 ~5 X1 F3 O2 U9 G$ T% Wvalue (in ring0 only). Values can be manipulated and or changed as well
6 M  r; s# j' a) F6 y' m(clearing BPMs for instance)
6 Y, {3 b& S1 D( e! F6 p' a' }! [8 O; ]% P$ s- A
__________________________________________________________________________9 L. r% H8 _* ?
) m* I/ |: K$ }& Z7 \
Method 11/ P, n: R# L4 `1 @
=========
4 x6 q0 `! U, b' m% X- w: K6 O
4 }5 @2 p2 K! r( y! V& XThis method is most known as 'MeltICE' because it has been freely distributed) f! B$ w4 h  P# H+ F! y( k
via www.winfiles.com. However it was first used by NuMega people to allow
9 T2 O8 K$ ]" g+ i) v0 ySymbol Loader to check if SoftICE was active or not (the code is located% f8 L& i7 u) \! H5 k9 e
inside nmtrans.dll).
) |, M" z+ ]  Q! N& S! d
6 g7 |! V) E1 t. X* i8 J) }9 \The way it works is very simple:
6 I, |) n* v3 g+ L8 ZIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
, S, P2 T0 M0 M2 ^WinNT) with the CreateFileA API.7 j7 ?5 M8 r' S. I/ b

1 Q5 w: T( ]1 d7 Z/ Q. @: L# r, uHere is a sample (checking for 'SICE'):" U- m. [/ \" y2 f

. {7 s! D$ D- `7 j/ _) JBOOL IsSoftIce95Loaded()' b5 i& U8 e' c& e; a2 L5 i
{5 d4 t  u  v! A+ T3 {
   HANDLE hFile;  
5 f, E% B/ i: L- r   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
) R, ~1 u( z- p                      FILE_SHARE_READ | FILE_SHARE_WRITE,
6 N9 V/ m5 c2 G; i                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
% m9 K/ l3 u2 l' J3 _5 l* A/ Q* J   if( hFile != INVALID_HANDLE_VALUE )( t  a: ]8 U4 S# x) i  z" {
   {
; j/ \( L) j0 c; H      CloseHandle(hFile);; f+ l0 p) X( n4 i
      return TRUE;1 _. q' _5 _2 v8 Y+ d' m
   }, Y( R0 m+ B! q0 M# O& l
   return FALSE;+ s6 V& j4 m2 Z, q! ]
}
2 I* c1 _7 s0 M1 ]* x7 e6 p  A5 T9 w7 B. V4 A
Although this trick calls the CreateFileA function, don't even expect to be
, c2 Z6 @! h' f5 `able to intercept it by installing a IFS hook: it will not work, no way!
" i! Z! E" S& j4 j5 l) q1 }3 V1 A1 {In fact, after the call to CreateFileA it will get through VWIN32 0x001F/ N+ `9 m7 Q. q3 _* M- h" c/ k
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)3 |& D# _/ ~" _) z% a
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
. _8 J/ C; I9 \: |field.
: Y. q/ G% p$ {In fact, its purpose is not to load/unload VxDs but only to send a " j8 L. h$ a" |, H+ M6 J2 Y7 g
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)8 {! K8 K: N7 A) a  I4 n
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
6 g3 s8 N7 q* A& n4 _2 Fto load/unload a non-dynamically loadable driver such as SoftICE ;-).4 U1 A% J# ?4 D8 Q6 A7 [& [2 k, ]
If the VxD is loaded, it will always clear eax and the Carry flag to allow+ m7 ]% ^$ e: A/ K( i6 L* U
its handle to be opened and then, will be detected.
7 p' ]8 g( q. \4 J) W; ]You can check that simply by hooking Winice.exe control proc entry point
2 I- V1 S5 D* }4 f; N) u- ]  Swhile running MeltICE.
1 M) Z" A! `8 q5 N5 k) z/ j1 Y
- l& h8 Z' L$ e2 z) E! @8 G. a. O# n: p# q9 Y+ F" ^
  00401067:  push      00402025    ; \\.\SICE
1 ?* d' t: r( t" s  0040106C:  call      CreateFileA+ ]* k# e3 k2 S$ w
  00401071:  cmp       eax,-001
8 Z2 @  X' t; A  00401074:  je        00401091
) B5 M# A' }# T4 }* Z
2 d0 P3 s' n4 a9 O# s% Y2 J7 Z! S2 {; i3 d0 N
There could be hundreds of BPX you could use to detect this trick.* a$ S1 _! s& y( n* r" L. }9 v
-The most classical one is:' z3 T+ Z: T! r
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
5 W+ o6 |% X1 ~    *(esp-&gt;4+4)=='NTIC'5 D" ~4 ~. J5 ]# X
, k+ X& Y" a5 R7 z) W
-The most exotic ones (could be very slooooow :-(
6 Q  k5 d" ]8 O" E. D0 O   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
1 ^4 X3 @  i6 _$ O$ n  C- j     ;will break 3 times :-(
' r' k0 V- E+ d8 H# ^3 }/ U& [/ i$ s7 K7 @1 L
-or (a bit) faster:
1 C' i. b2 d  ^7 t' ]4 o" g+ s) J   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')& ^3 R* F1 K3 V

- a8 A4 j* [% j4 c! R   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  9 u2 B5 r: `/ P* K7 h
     ;will break 3 times :-(# }+ ]. T4 z( n( D

* G) n3 T' h# u+ v9 R2 j-Much faster:7 R- f0 G- X$ |3 U) H
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
$ d; U6 n7 S- t  D' B( n  m. s* B& c, K# \, }- M4 k$ {
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
6 O) t  ?9 v' [function to do the same job:
0 u5 @7 R: s; R$ H8 [1 C+ y. S' h8 _$ G3 Y% Y
   push    00                        ; OF_READ
; Q0 s  ^  y% f" ~* Q   mov     eax,[00656634]            ; '\\.\SICE',0
" R! O3 H6 }* z- f2 b! @   push    eax0 R/ e8 R7 I/ h, X( K7 [
   call    KERNEL32!_lopen$ h3 s; G$ U7 F
   inc     eax
& S# X! _# y: Q$ y+ |, K   jnz     00650589                  ; detected% F: |$ n6 ]. @/ u2 K1 C
   push    00                        ; OF_READ7 q) Y/ J3 W- B) y
   mov     eax,[00656638]            ; '\\.\SICE'
( b: V+ g* z9 h   push    eax. j1 k6 O/ k* J- B) o& q/ @
   call    KERNEL32!_lopen% V8 l: [' S5 r( V$ D: ?
   inc     eax
' Z8 \) @* G+ \& I6 E   jz      006505ae                  ; not detected' _$ |" j+ s  {* a6 p& \
9 `1 D& ?3 k& U& v) p6 w3 y" E

# B  i( R/ u, R, k4 k__________________________________________________________________________# |* [4 Y5 V2 d8 v. |5 O. x

# f  \/ T/ Y0 u) kMethod 122 T, O' @+ K9 q$ H+ F, S
=========3 Y$ Q8 u8 M* n/ ]: n. P6 |. I
7 ?. v  N. @0 O- m
This trick is similar to int41h/4fh Debugger installation check (code 05
4 |  h7 H7 b- J1 p2 V  g&amp; 06) but very limited because it's only available for Win95/98 (not NT)0 s4 b) L* B$ I& p
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
) [. {+ K1 n$ y9 f" `! f1 w+ L# d0 e
   push  0000004fh         ; function 4fh9 A) R- V* p5 O! v& t2 O
   push  002a002ah         ; high word specifies which VxD (VWIN32), `' w" b6 k: ^5 C5 l
                           ; low word specifies which service
! r9 P, G" \7 f: v+ ~( x                             (VWIN32_Int41Dispatch)
: r3 L, B7 Q4 p& }" J% z6 n9 k   call  Kernel32!ORD_001  ; VxdCall
( q7 N9 l& c8 h% A   cmp   ax, 0f386h        ; magic number returned by system debuggers
" ?! d' B% b7 v- R  J0 g   jz    SoftICE_detected
, ^/ i" }8 W8 Q0 w  x; A, j' ~9 K# |
Here again, several ways to detect it:  W; t/ l$ r' y+ G. Q2 k

6 I) K. n( {8 _9 u5 `  M  C    BPINT 41 if ax==4f
; w8 E" K3 N. G# G$ }$ g' k# a
( \. c  A3 p! L8 I2 I% ?' z; X1 V    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
0 e- {4 \8 |, s2 t! h- ~$ k# |, X3 ]
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A" g: u- M4 g% q- R
3 x5 `2 p7 @9 C2 }& \, [0 |5 l
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!  }: C9 Z3 j/ j7 F9 r# V# k* p& S" h
& x$ Y( Z+ Y" j  V. Q6 x
__________________________________________________________________________
: L- a& ^7 r( d0 T; ^& Y; k( z
: k( x* A* i" u5 V, d& Y9 T. U" {# qMethod 132 Z3 K: N6 Q+ q/ c; W! Q
=========
* r" c: f7 U' z& h* j, X) q$ r- E" v) A7 A+ S" t) a# s+ }
Not a real method of detection, but a good way to know if SoftICE is
+ \1 f+ p1 X: z/ d- `, W9 w2 Cinstalled on a computer and to locate its installation directory.& r+ {( X7 j4 b6 l2 t( Q
It is used by few softs which access the following registry keys (usually #2) :- D' P% u# O% Z1 A

+ I1 |3 L1 S) ~3 L-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
) T4 z. f0 V$ e! ~9 u\Uninstall\SoftICE2 J5 T: O# j  t# {  J
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
8 V! w' v3 _2 t$ u  {# J9 e. ^-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion7 [6 ]7 T) n" _" g) \" o' r* h
\App Paths\Loader32.Exe5 h( T9 C% r9 t  t' y, C
0 P# @. [  A0 ^
& R! ]6 z' P7 U
Note that some nasty apps could then erase all files from SoftICE directory
. G. P& w# I6 r$ M# d& l(I faced that once :-(! u* I) V, G4 Y4 D$ n0 z

. v; J/ s8 }# z7 k0 H4 tUseful breakpoint to detect it:) [+ ^9 t. E" {, `

/ \1 I$ c8 z7 b' E     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
7 W+ t& \3 y( u+ I3 t$ t6 A" m+ E
__________________________________________________________________________" C* T5 }. _( a" j+ M: B4 l# {9 S
0 d# y& I& N8 }# G; H: O7 s

8 `; z) F+ C8 V- BMethod 14
. q0 P/ E7 U& Q1 f0 f! m3 Z3 L=========9 }* A' p8 @$ R- W4 f

+ Q' z; d& s- l$ hA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
4 z' T+ V2 Q& [: |  xis to determines whether a debugger is running on your system (ring0 only).
" f  v/ N) j) h6 Z+ V5 P) w) I6 v' x% H4 J2 r
   VMMCall Test_Debug_Installed
& v7 q1 g  }/ T7 j, U& w+ \6 J   je      not_installed6 A9 [2 E( O+ m% ^) n8 p: @" E- c$ H
/ b6 G4 K5 N% }& N5 ~
This service just checks a flag.3 h) `: }% C' t9 I) _* [
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部