About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
8 V! j; E. j. Q. C<TBODY>
  D& ?/ [$ P' c1 c/ X5 }7 P<TR>6 j# c% ?- C4 E  v
<TD><PRE>Method 01 5 Q# E( h) ^7 ?1 M
=========
+ g+ n) N$ `/ k& O
* Q' g, v2 t1 s- u1 O# MThis method of detection of SoftICE (as well as the following one) is( u( k' t, _3 Q6 x5 k( i& a* l
used by the majority of packers/encryptors found on Internet.
+ Z& g* ]: P1 t% Z5 i! O8 bIt seeks the signature of BoundsChecker in SoftICE
5 ]2 M/ K7 V% _5 n: w; G5 E% o& T- i9 w& _8 q7 L
    mov     ebp, 04243484Bh        ; 'BCHK'. t2 K. X6 j+ B: l$ r$ V3 F
    mov     ax, 04h
# Y  I) N  y/ a( {4 E; S9 A  B7 ]    int     3       7 C( s; P& c2 Z) A% A" N3 u- ~
    cmp     al,4
- ~8 A# K6 P& c+ C1 E    jnz     SoftICE_Detected- A% ~1 Y* a1 U: n& X* K

0 I3 R+ O" \9 J6 f$ O8 Q( r. L% }___________________________________________________________________________2 i6 e. k1 ^  x" I  M
, q; y! j* J0 K' P+ e) x
Method 02
: N; E5 P! Y6 M/ F( o( J6 }9 M4 q/ V5 T=========" F( V" P: w4 }9 M# }

" D' a1 p; w6 ], CStill a method very much used (perhaps the most frequent one).  It is used
# t8 P  G" W$ x; R' _, p$ S0 g: yto get SoftICE 'Back Door commands' which gives infos on Breakpoints,9 b1 }1 A; i1 Z! s
or execute SoftICE commands...! Q0 o  e% W5 Z/ u1 |  u. w
It is also used to crash SoftICE and to force it to execute any commands
$ N4 c6 C' n2 r( G( L  K$ B9 x7 }) D(HBOOT...) :-((  6 h; Z% }/ r$ ]6 l+ u

5 F8 c# z% m4 O( h- kHere is a quick description:
2 e* Z) d. e. p% \-AX = 0910h   (Display string in SIce windows)4 j% ?1 G- c7 H8 n
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)2 M" T0 K' j7 ^  o* Y/ V
-AX = 0912h   (Get breakpoint infos)2 S0 P* J/ |7 X2 g5 ^
-AX = 0913h   (Set Sice breakpoints)
! @$ C0 D: A2 i-AX = 0914h   (Remove SIce breakoints)( ~, f1 T7 w  Q& x& J3 D' I9 e

) o2 v. E  w% ]0 GEach time you'll meet this trick, you'll see:- m5 B' F5 F5 `0 c) g! s
-SI = 4647h! j/ n4 \9 \& \' O8 q1 K3 {9 S+ h
-DI = 4A4Dh
+ k0 ]! m9 C* l! e$ s& q* ]Which are the 'magic values' used by SoftIce.
1 j" z% u) h) e/ xFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.: R+ X. z. R* B

7 {  I6 p! o; Y5 [$ LHere is one example from the file "Haspinst.exe" which is the dongle HASP! `  [" u3 E3 e. q, a
Envelope utility use to protect DOS applications:
) O1 N0 Y4 A7 \  F# e
2 P! j" d8 l) k6 `- u7 K8 X/ q( ?0 L
' _, g8 v" y# p& R4C19:0095   MOV    AX,0911  ; execute command.
! N0 \; L: |7 {, r" W4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).8 U( r6 D6 ~+ N+ x* E$ g/ j  a3 ?; r
4C19:009A   MOV    SI,4647  ; 1st magic value.
7 r  d& d$ R' _+ _4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
9 Z1 e6 t1 k. A& q8 Y1 w! {/ \4 E& ?4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
. b; y; d! M$ R! R3 T7 d3 O4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute# N9 _; q1 r$ h$ o9 U, |2 f  y
4C19:00A4   INC    CX
1 u- T# O* {  f( b4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
8 i7 f% j, t/ Z; t4C19:00A8   JB     0095     ; 6 different commands.
& |& p" M0 Z; S) Z4 @1 m+ _$ P* ~4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
7 c7 J! w( ?* c# i4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
$ B9 B6 c0 n/ m. g2 I/ E
: R2 A9 z6 }/ s! n6 b7 W6 ~The program will execute 6 different SIce commands located at ds:dx, which) f* }3 M2 R8 M6 B/ \+ K$ y" t
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT." b" @! i% E& h" b# Z4 J- b) C

( A% h/ V/ [% _3 P1 D. }* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
( R# d, z# M( {3 P- l' m___________________________________________________________________________
: ~& n. }! {3 Q  j7 n3 Z
' M# ~1 s) _- r
) w8 r: }) x5 f8 i- cMethod 03
& j' {# ?; r' D1 ~: K8 k=========
2 o% G0 J/ Y9 N+ `2 d9 P2 S# _. a; v- X3 r+ d6 j+ }4 S
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
3 S) c. B2 T  @" G( k(API Get entry point)
6 D7 X0 ]# I8 e% H  a) S  ]        
0 ^2 m7 b7 l1 N  J3 w/ D3 X& J$ H' {/ m4 S- L9 n9 g0 m, o% D
    xor     di,di
2 I4 [; T) }/ C; f    mov     es,di% p9 {3 m; u2 r, |& Q  J! f! _
    mov     ax, 1684h       8 k) a8 l/ D: [( o" H  G# p5 Q
    mov     bx, 0202h       ; VxD ID of winice
% M3 A! ?# I( ?    int     2Fh* o+ j6 W/ K2 w) N) y7 H6 [
    mov     ax, es          ; ES:DI -&gt; VxD API entry point3 N  L4 t& a# I2 T/ I
    add     ax, di, L) s1 @  a4 v6 o1 g4 B+ K& ~
    test    ax,ax6 r2 E, q$ w" ?  R! {4 j9 _2 a
    jnz     SoftICE_Detected3 z  F1 d3 s$ \

- y6 O! q: Q# [. t0 q* W___________________________________________________________________________) u9 W4 e! L5 z9 k* J( c
/ |4 l# `/ W6 m" }2 U0 B; `
Method 04& ^$ T+ S* W# V6 l  B& {) v; O
=========
) g  X/ X. `2 T0 B8 Z$ I; J- P) G, l6 X( e3 n1 g( k
Method identical to the preceding one except that it seeks the ID of SoftICE. I% R  R5 r/ m4 @9 B! ^) Y7 g
GFX VxD.9 I4 S1 `) {' Z" Y. e

1 t6 C& @. I/ l# _    xor     di,di
( f1 p/ T9 U0 N! l7 F    mov     es,di
8 S, s  p+ O' o9 v# G% E    mov     ax, 1684h      
: N# G( ]9 A& G# _    mov     bx, 7a5Fh       ; VxD ID of SIWVID
- [, j7 h2 v2 `- x" n2 j1 A9 F    int     2fh9 }9 \! j. D+ j5 a! T
    mov     ax, es          ; ES:DI -&gt; VxD API entry point1 N/ J  Z$ O: ?" {( G4 A0 A8 T
    add     ax, di- ~; m7 ~  g0 n3 H5 M
    test    ax,ax4 }' ~. g$ ?8 `: t8 v4 H
    jnz     SoftICE_Detected! u1 K5 I# L4 S; b3 @" ]3 H, I
+ T) \  w$ a" h6 b, M
__________________________________________________________________________
' w! R! O* C1 }  M- m1 `
# l& E/ S( p5 P! o7 O
  ]2 ^  W3 D" H! xMethod 05* `8 C2 R* `  d
=========
6 Q& @  Q# k4 L
: y' B! Y! S- f! f; `) bMethod seeking the 'magic number' 0F386h returned (in ax) by all system
7 u/ t7 g; ?" l0 B0 _debugger. It calls the int 41h, function 4Fh.
/ h- \7 U5 o) W; h2 p' GThere are several alternatives.  
2 T5 t& w7 `7 v3 z) N
" T" Z3 P9 H  f9 e  PThe following one is the simplest:+ c/ h. m0 D% ]) a9 N2 C1 y! S

$ w2 v- O+ m* w  x    mov     ax,4fh4 {, y" {% s+ ^( d4 a* g  ]0 e
    int     41h' r, w8 h- X! x1 n/ @# q* F
    cmp     ax, 0F386, x& T9 K; L1 @  g
    jz      SoftICE_detected
/ g$ C8 T* d& s1 i2 \$ d2 p
1 g6 j1 y) b! ~  u% s/ e6 [) p7 F! u; o
Next method as well as the following one are 2 examples from Stone's 3 {& B0 u, d$ N
"stn-wid.zip" (www.cracking.net):; v% q( }+ X6 U& Z, z, _

( g: f) l' Y. d  l    mov     bx, cs
- b# o5 J8 c' g! ]: G) W0 x( h    lea     dx, int41handler2! J3 G2 R7 o8 W9 E5 d  E
    xchg    dx, es:[41h*4]0 r: Q7 \1 _, L, j
    xchg    bx, es:[41h*4+2]0 D$ T: C. f3 s7 p% o8 h" H/ E
    mov     ax,4fh
) \# a/ V8 h2 N% h3 m' Z1 e2 i    int     41h
5 q2 ^) f5 }9 B# X6 Q- U0 R4 s4 `; J: I    xchg    dx, es:[41h*4]
' S. J; U5 m: Y" H* o, z6 b    xchg    bx, es:[41h*4+2]- V9 o$ c3 G' P7 S5 w
    cmp     ax, 0f386h0 z7 A+ D; h, X- p' M) W' S/ a
    jz      SoftICE_detected
0 J0 m& G# X+ g" X' v0 V7 n+ I1 `( O+ B
int41handler2 PROC- q  W2 \( `; m5 p
    iret4 C: w0 h! @4 V% v% Y; R, _8 f
int41handler2 ENDP
8 r, V% s1 J* b( }" D7 b& u/ b) a* s1 ^
) |- |1 c; p- T4 t8 y7 _
7 s+ g6 G& U! s_________________________________________________________________________" f: M# ~/ L" Y3 x+ m! H
0 h( z; M2 K! a( z) `+ [* U. y
% d. _. d/ \% Y
Method 06! V: c- A, O4 J+ z  |! i! V
=========
& s3 e0 N  k/ D& u% R+ _8 v" _# ~

. I2 [5 R$ u7 z- ]% R6 o2nd method similar to the preceding one but more difficult to detect:6 G2 j  l( \8 D0 Y5 `. f- e# ^2 t
8 i4 u8 p2 O0 a: y

/ c$ O  b" ]0 c  h, iint41handler PROC; u% E( @- `6 K
    mov     cl,al
- g+ w/ \/ n+ q# k% p; A% b    iret% c7 |9 _5 i$ ~! _/ P, n6 }% h
int41handler ENDP
! G- L. s5 _: g% c( T6 Z; _8 F5 I1 R+ x3 ]

# p. G7 t- y, i8 f    xor     ax,ax
. C4 F6 M& _/ |8 V6 H8 K- P. z    mov     es,ax0 v" h7 c$ ^# n2 u0 o
    mov     bx, cs) D2 [5 |$ ~% i. g6 R. F' E
    lea     dx, int41handler
& h; w7 y) L! ^5 C    xchg    dx, es:[41h*4]
) Q4 c2 N) O; ~0 y0 ~1 f7 o( ]' c$ W    xchg    bx, es:[41h*4+2]
, k* ]6 Y1 H: H' {8 h    in      al, 40h8 z/ W* ]- S2 ]  \3 |8 F4 ]
    xor     cx,cx
$ n  ]  k- a8 t9 f1 e    int     41h: v7 D* n' J! |5 Q2 a( b
    xchg    dx, es:[41h*4]
' v6 l7 S7 F$ o9 ^+ |    xchg    bx, es:[41h*4+2]- n9 f3 C; G( B% i' ?
    cmp     cl,al
" z# v4 K: v" J- u; O    jnz     SoftICE_detected( U: N% d9 ~5 w

$ u8 {7 B1 V: P5 V) o_________________________________________________________________________
$ v, j+ e  p- l
# d" e! v) Q1 W  Y2 OMethod 07
. _# Y1 U% F, h2 |" h( o$ {=========
  q( A! i$ A: b; y, i. r- a& `* D' v' j  n1 d! `
Method of detection of the WinICE handler in the int68h (V86)
2 Y$ o: n# N! }3 }6 r5 U7 H6 y$ G) D. ?' {- i. `
    mov     ah,43h
5 _3 ~% @. y. I0 Z    int     68h
( D8 r/ h% y, R7 A$ c    cmp     ax,0F386h+ v# C" q2 N) }5 P
    jz      SoftICE_Detected
3 K" W3 D6 c" U8 ~- F4 R  d
/ T  {' v7 O, `% T4 x/ L9 r" D( h2 |; K% V! T3 |. v1 L
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit+ g+ w! y7 F- L* ]+ Q
   app like this:4 r3 h; G# G/ n+ W0 I

0 q+ X1 U  |1 y# r   BPX exec_int if ax==68
! r+ w$ u1 Q: I, ]" b0 W5 ?' L   (function called is located at byte ptr [ebp+1Dh] and client eip is/ ~! P: j' Y3 G, G* Y( _5 b8 T% y
   located at [ebp+48h] for 32Bit apps)
9 J! i  _0 A4 c0 M9 l__________________________________________________________________________  @- g3 P: R. p6 t

1 }- {/ ?3 h: B: k4 p+ v$ E
  P& G3 q7 G" g8 p+ t9 hMethod 08
( K. Y8 R' ~1 T4 `; K=========
' K. l* q6 n* W0 d
9 A4 X# ]6 z# K5 \1 m$ k; _It is not a method of detection of SoftICE but a possibility to crash the
8 d, r/ X1 j- w" ]( K* g! e/ J: Rsystem by intercepting int 01h and int 03h and redirecting them to another( L; p" x" A" y
routine.
7 P: v: E7 }0 c) y( K7 J: \8 LIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points3 t0 e9 h6 ~* Y# ^7 J5 B4 f% {
to the new routine to execute (hangs computer...)
0 L$ S: V$ u/ y) \& [, {
' `4 }6 f* Y! X0 W0 s+ X    mov     ah, 25h
( n# K6 `5 s/ @3 P8 A) _    mov     al, Int_Number (01h or 03h)
. X! P. E& J8 h7 J8 {    mov     dx, offset New_Int_Routine, A" O; p. t  [7 I' b& Q
    int     21h8 |- G% A, [( j/ }

" [" Q. j. Y! S4 s- `__________________________________________________________________________
0 r0 Z2 A  Y. e. c8 h5 l6 {# ?
  w2 J# J8 E% d( o- ~Method 09
0 q- b2 k$ K) m4 u; g& S=========
/ h6 D) @0 S6 M, D! K
  z0 a! [1 L) L- H0 p& BThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only: W! E0 f( P8 t# c
performed in ring0 (VxD or a ring3 app using the VxdCall)." H- Z2 K& S, Q/ S
The Get_DDB service is used to determine whether or not a VxD is installed
- K! x9 ?$ [4 Z! Tfor the specified device and returns a Device Description Block (in ecx) for
8 D) G9 I3 M  L/ lthat device if it is installed.5 Q8 Q- K" ?/ s9 a

5 C: g. C# Z7 N7 l   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID8 N2 x4 G# u* o3 I& W) X
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)& C9 \# S1 N9 q9 K+ o: I( ~
   VMMCall Get_DDB
9 j; l9 t0 ^5 w4 Q   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
( X. o% Z0 j3 \4 S. g  `. F9 T# C4 `" q7 x' B" T, b
Note as well that you can easily detect this method with SoftICE:
) J4 k5 B* Y9 e0 s6 E   bpx Get_DDB if ax==0202 || ax==7a5fh
& K3 |# U" a5 Z) L
! w7 I; ]# x5 ^% G6 _/ a9 L__________________________________________________________________________
) Q, j* U5 _$ V. M# L; P
; j7 ]$ p5 {& @4 a7 r: ?Method 10
1 G. }* w; K% Y/ Y=========8 Z" R6 M! z; Y5 k0 E0 Y. E2 M

3 ^0 `1 ~) q9 u& T" `8 j0 c: S=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with: }$ j7 L  J9 z! v6 j& s
  SoftICE while the option is enable!!8 s( G2 J( \9 j# L, a3 R  s
+ m) W! O+ d. z7 V2 w- y
This trick is very efficient:( g0 P( z) D5 F/ R6 h
by checking the Debug Registers, you can detect if SoftICE is loaded
6 D" v8 t- n, F- l5 M  }- U(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if0 r: f+ S7 F; `6 `# H. o2 Z4 @0 h8 U
there are some memory breakpoints set (dr0 to dr3) simply by reading their
; t9 ~. P  A2 P" ivalue (in ring0 only). Values can be manipulated and or changed as well% _% K/ E  K/ k/ Q' V- G
(clearing BPMs for instance)# {& d5 O, E0 d( r9 t" z

/ N9 n- Y9 T# R+ _- A! C__________________________________________________________________________, G. r1 `/ M$ A( s' e

# k- q" H; n6 L1 Z+ [Method 11
$ _4 y. H7 j9 t, A4 [=========
& h) p- q, r6 j2 L% H
$ {# v2 u  Y- E! r2 zThis method is most known as 'MeltICE' because it has been freely distributed
; }: N# V# r2 Zvia www.winfiles.com. However it was first used by NuMega people to allow
6 O2 @0 u7 }% T& D/ o1 U; eSymbol Loader to check if SoftICE was active or not (the code is located
8 ^' I/ u1 W/ d; C' e( H- vinside nmtrans.dll).4 K* V) p) @# i  f

& k' ]# s. X6 J. S+ ?! I$ U; v5 P& R; I0 xThe way it works is very simple:
/ @, @8 V) V3 x1 z+ XIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
+ X/ S8 K1 V+ Z' {9 t: i/ wWinNT) with the CreateFileA API.0 H% |6 F* ]% c. R1 ^! f3 [! k
0 s3 q5 L  c9 ~" c# |2 m( ]7 \
Here is a sample (checking for 'SICE'):' z! F" h7 J/ x7 E( o4 C3 k

! b/ |/ T$ S: k1 K2 W" m, Q$ I8 yBOOL IsSoftIce95Loaded()' H: [$ I5 c6 u& R# j
{$ F' N! J- S, r. P, Y5 ?1 z) N; e; f" x
   HANDLE hFile;  
4 t1 j, J& S0 b8 Z- Y, ?: t1 G   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,0 y$ y' E$ l/ o& ?6 t5 A
                      FILE_SHARE_READ | FILE_SHARE_WRITE,! w, c! ~  W  m4 }7 s. A
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
+ @5 W" J8 {7 j. m2 i   if( hFile != INVALID_HANDLE_VALUE )! D, r, L+ p6 A5 q6 [" d. ?
   {1 I8 @5 x8 I- W" g) }/ k* q, S
      CloseHandle(hFile);
4 ?# b4 \1 h4 A5 P; Y, U* Y! B+ R' b3 S      return TRUE;) y2 {9 x  w/ ^
   }" m' v; I. F! O- O) p9 n5 D/ T
   return FALSE;9 Z' ^# |9 Z" q/ G2 C6 g- J
}. j- b  a- V+ s* B8 f* s
) t7 [' x; u5 E, L3 n
Although this trick calls the CreateFileA function, don't even expect to be. O7 e; r- w6 }' |+ p
able to intercept it by installing a IFS hook: it will not work, no way!1 j  M$ H, |3 u* @2 Y( t6 W# T* G. A
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
% {2 [) X& g+ V! Xservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)( v$ u2 f: b; E/ w! ~" v5 ?/ A
and then browse the DDB list until it find the VxD and its DDB_Control_Proc) i) v' w) v& u2 I
field.$ t1 F& y% f* Q( o1 v9 D
In fact, its purpose is not to load/unload VxDs but only to send a , h* |7 `- V$ [  s% d3 E- p7 z
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
' h" C- E" J0 ~8 w. n  N  \4 u$ G6 eto the VxD Control_Dispatch proc (how the hell a shareware soft could try
5 H& A" w  b' ~, c+ {0 \3 rto load/unload a non-dynamically loadable driver such as SoftICE ;-).
* E" [8 {( R& z3 V" Z  ZIf the VxD is loaded, it will always clear eax and the Carry flag to allow0 W5 e# R, x4 Q, @/ V! S/ o+ D
its handle to be opened and then, will be detected.
6 B& }! Y0 u+ Q5 F% S; ?4 zYou can check that simply by hooking Winice.exe control proc entry point9 Q6 D; E( G' F+ p' n
while running MeltICE.; U3 n9 e8 \1 N/ O6 B
1 a# M5 Y  B, q2 F- z2 i

2 n5 g- V  \6 C+ A6 K( H  00401067:  push      00402025    ; \\.\SICE
# q. N) l+ A2 J0 g! @0 q: S  0040106C:  call      CreateFileA, Q' W$ W. m$ g2 L8 W
  00401071:  cmp       eax,-0017 y' }0 O, V+ Z0 ]3 z
  00401074:  je        00401091
9 w: d$ G. K; z/ B3 Q4 ~8 _0 ~+ M$ J- S
& K0 g, R" i! ]3 v& j
There could be hundreds of BPX you could use to detect this trick.$ k: G* I+ W, i1 u6 m' w
-The most classical one is:
' A9 \" X  S  ]- E" }, t  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
: Y3 p# i( q& w) U$ J/ y+ b    *(esp-&gt;4+4)=='NTIC'+ B( `; t& R" H. [- [5 l
4 i. H9 e3 [" S7 \2 [
-The most exotic ones (could be very slooooow :-(# H. n' {9 Q1 I( b3 a
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
1 ?- V0 i' c" @9 |0 _9 c     ;will break 3 times :-(
9 _5 U* D# Y- |9 |* k4 U2 J. W2 z2 C% i0 S# ^7 r  |
-or (a bit) faster: ' P4 ]/ c% W7 @2 K8 V
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
) T- ]8 `$ M& S$ L$ y
4 d% ]. I& I2 ^! o. h1 ?. H* I3 ]   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
/ K  `2 v) Q( n: f     ;will break 3 times :-(. Y( b4 L+ |7 u- C+ b

5 T6 G8 J, Z/ g% I+ G5 ~-Much faster:
+ t: q( ?1 ^% V* {# y   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
7 s) L! x3 ?; g( i$ Q4 s
& I4 g4 ^$ l% Y( K* A0 gNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
" o. p6 ~, [  G( \% afunction to do the same job:
2 c/ z% O" d/ D' Z: l/ h9 [2 `1 z" U
$ o3 z" b0 W, G   push    00                        ; OF_READ  t. P/ f. T1 H1 I# u7 ?
   mov     eax,[00656634]            ; '\\.\SICE',07 ?6 v1 {: e. a; Z, h, t6 b/ }
   push    eax* q4 e$ Y( }/ J( n/ x" S) c
   call    KERNEL32!_lopen" p: q1 {6 y5 {4 J- E! M
   inc     eax' S" }% v/ G$ Q: w4 E2 g
   jnz     00650589                  ; detected- T. E, _$ s4 ?; y
   push    00                        ; OF_READ. {' C" p2 y  ^
   mov     eax,[00656638]            ; '\\.\SICE'' Z! G2 e* U/ `+ E. U7 z4 E$ [# B
   push    eax
+ t' i9 t. a( v4 |8 A4 ~   call    KERNEL32!_lopen- {) C; D9 R9 K& @5 t
   inc     eax" M3 B2 V; Y% |. p, k- G2 T/ Z! ?
   jz      006505ae                  ; not detected
6 h5 Q( X3 F% A6 w1 H7 i
0 m  r; h! C3 z
  ?  C/ X' H  N6 g# m# y/ V1 r( Z__________________________________________________________________________" a* q, O; P  u, z; T" O2 q+ Z

& n. h  O; j+ w. \8 RMethod 12
1 ~6 U2 }1 l6 y' Z=========
$ I! K. O% A1 ~2 Q  y9 g1 v. f- q- h7 }; M% f0 y5 E6 N3 q0 n
This trick is similar to int41h/4fh Debugger installation check (code 05
/ N5 M: S) x; Y6 U! C8 n. ^3 q5 p&amp; 06) but very limited because it's only available for Win95/98 (not NT)4 H$ v, A& d- ~* y/ H2 H7 E0 D
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
' j: G* J+ y+ Z, ]- w
* }/ u% x( w& i+ Y  B   push  0000004fh         ; function 4fh: J$ d  i. r* o% b9 g+ m" a
   push  002a002ah         ; high word specifies which VxD (VWIN32)* w( D7 R( ^) S6 H+ i1 h
                           ; low word specifies which service% q3 o! M& [( [2 a" [: F
                             (VWIN32_Int41Dispatch)$ e/ `4 p2 j& ~: @" e& [
   call  Kernel32!ORD_001  ; VxdCall
% d7 J& Q/ {/ G2 G   cmp   ax, 0f386h        ; magic number returned by system debuggers
% p" C3 P; F# O( j   jz    SoftICE_detected
2 E5 P& f" K: s7 g# N- M* o
) |/ m2 X4 A. xHere again, several ways to detect it:  t! g7 o. n& S. V
# f9 F' Y; P! E- D( V
    BPINT 41 if ax==4f
; p! U$ S& u5 d
* M9 w  y8 |7 Q1 D5 q2 v, G    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one! z" N& y1 u7 P+ X  B3 c* ~' V
9 U' Y, k/ }7 D' H
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A4 N3 c* ?0 S& R9 m
5 v/ _2 M  y, ?
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
7 U2 w; }/ _+ f1 z
! J1 ?; p. u( i! K. A% C__________________________________________________________________________
" t( U( w' ?( F, y4 P: S- }0 w; l6 C: c; l( Q
Method 13
6 J9 U* U1 t. m0 |/ s=========+ ^) L5 Z1 P  F1 u$ l
8 A0 `; U4 p4 X( O, J& L
Not a real method of detection, but a good way to know if SoftICE is
: M" h" W% i+ k* d- qinstalled on a computer and to locate its installation directory.  I7 k5 g0 x5 e/ u; k0 x
It is used by few softs which access the following registry keys (usually #2) :
# H( [9 i3 C: D) t) L- q. g/ @/ u. m4 y
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion9 `4 \) ~: ~" H3 q
\Uninstall\SoftICE
. G; j( y4 q* U0 C3 I-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
- y1 F, F3 B" i. a: R# P-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion4 Y; U: d, P% f' {. M
\App Paths\Loader32.Exe# a  M& P: R: ?* N+ b0 y5 g  E+ f

0 N7 F& W% [' n' k, V* v+ A; e0 k  b6 v& H$ b9 x  u
Note that some nasty apps could then erase all files from SoftICE directory
/ m$ t& @5 Z6 E8 i/ Z/ C8 [( B(I faced that once :-(2 S8 v4 n5 O1 a4 B* g# F# \

5 I2 O: d6 @- Y- J: S; Q+ `Useful breakpoint to detect it:
0 M  m, I/ G9 P* \0 ?& `) C1 S- b6 T& x
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'- E7 x3 Z0 _3 `' N0 ~

5 Y# A% c7 D* s8 ]: ]' C__________________________________________________________________________
: d& j, s% |  y% R4 X
, B0 \) g) o2 y! i% Y
  Y8 `- d/ C8 t8 r  \Method 14
2 P! ^5 [0 W2 b" l* ~2 i+ H9 U1 z+ M: T=========5 i# |- u8 p: W" v( Y* G5 X
& g! D" n$ S, i# O5 q, ?
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
7 |. `5 B& n* v: G/ H8 V3 x8 }is to determines whether a debugger is running on your system (ring0 only).
) B: @& i7 h7 l! X, m: F" O
, H& [; U. f8 v. a8 F# k, e   VMMCall Test_Debug_Installed. h8 t+ ?4 Q/ E) N: ~. t
   je      not_installed
7 e4 N) x- }! N/ E* ~8 r4 `4 v, F( F, r* ]' U; x/ u" @, \7 v, i% {: d( h6 j
This service just checks a flag.
" y$ {& y- @+ c4 S* ^* a</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部