找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
0 d# j2 ~5 x! E<TBODY>6 I9 V4 J! ^- s
<TR>  O( s3 d* Q8 m& `/ |/ {$ V4 ~5 x% G( f
<TD><PRE>Method 01 ! l3 L! c' L8 W8 j4 g( u, }
=========) b8 k' T0 W% S. z  a& d

' j3 w" i% p+ d5 FThis method of detection of SoftICE (as well as the following one) is0 T( H7 k6 M" D- m! `7 l# q3 N
used by the majority of packers/encryptors found on Internet.
# X8 s4 s' ~# t7 EIt seeks the signature of BoundsChecker in SoftICE
# y; z5 q/ s- v8 T  D+ ?! ~* }6 i$ H* n+ S3 d5 U0 q9 N
    mov     ebp, 04243484Bh        ; 'BCHK'  U* r! j; Q5 v" J3 G$ r! n
    mov     ax, 04h
, ^' [2 V: q2 U4 o) F+ t8 r    int     3      
& e1 i7 T: _; Z- b* B& x9 \    cmp     al,4
  l3 s) e! @8 K( `; R4 y) }/ \$ A    jnz     SoftICE_Detected& z+ E4 b+ G: B, h' b

3 j2 }5 Q1 C$ p___________________________________________________________________________
4 I. l/ X/ U7 e3 e! M
4 z: v8 |* o: a3 u  ]Method 02
, `, W* @9 c% C- z7 F! ?, S=========
) u& y; C7 N/ d. G
5 h3 [% y9 e! o. J/ q* j# lStill a method very much used (perhaps the most frequent one).  It is used, r3 ^, u: _# t- t# U) R
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,2 [& F* f( [/ @2 l" X
or execute SoftICE commands...
2 K1 v# W* A* N( d/ uIt is also used to crash SoftICE and to force it to execute any commands" f6 E  T3 n0 G
(HBOOT...) :-((  1 p  f  e; a/ o2 o& t

( _6 H  f& W1 i0 F$ ZHere is a quick description:' S$ N1 E5 m9 Y: R7 K2 ?
-AX = 0910h   (Display string in SIce windows)
& @# K/ ?2 B- P. y; H-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)2 H/ o# K8 _8 u' X& c. |
-AX = 0912h   (Get breakpoint infos)& M# g: \2 v- x" ?6 n6 {, ^
-AX = 0913h   (Set Sice breakpoints)4 a3 y$ _! _9 T5 M" w1 n6 s
-AX = 0914h   (Remove SIce breakoints)
, I4 o* G: s1 m$ h) W" ]- d" l' j2 p* ]  G  X- M
Each time you'll meet this trick, you'll see:  I( k+ y- P! l  W7 @- I1 h5 U' u
-SI = 4647h
6 ^, `: y% E, q, B5 Y  K-DI = 4A4Dh
0 f& r- e" n! u  M9 _" ~+ dWhich are the 'magic values' used by SoftIce.( m. Y) G: @# g6 u1 S0 z5 {
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.: R' `- k6 _) l' m  ?9 ^$ j
" d) Y6 X! x- f7 L
Here is one example from the file "Haspinst.exe" which is the dongle HASP. P. K, ~3 t' b0 W; Y  K
Envelope utility use to protect DOS applications:3 q2 d% O8 `! C/ i) \/ g
6 ^) f/ e) ]* R/ q  Y. K$ C
1 F9 P& A) r, Q  G
4C19:0095   MOV    AX,0911  ; execute command.
7 _# h4 z6 C7 k3 k! T% z4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
4 K+ w: b' S  C2 {, x4C19:009A   MOV    SI,4647  ; 1st magic value.
; `9 H% F" i3 z% c- e4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
9 y0 |4 o5 j" ?& H8 ]4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)' s+ c1 `4 N0 L
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
# Y8 ~! e' J2 W$ Z4C19:00A4   INC    CX. N) x. C$ t- @7 H/ E, |
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute+ t) E1 O8 x2 i  u( L
4C19:00A8   JB     0095     ; 6 different commands.
; b) [9 O, N4 W4C19:00AA   JMP    0002     ; Bad_Guy jmp back.. M  m6 m' |4 k* k; }
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
  N/ z5 A/ @2 r( X; F
! Z, S- p4 }% p% A# v: bThe program will execute 6 different SIce commands located at ds:dx, which' ^4 [, `0 j, d* o
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.7 h1 R$ r/ Z1 v- [& ^( [) E

( Q+ w9 ~3 D: ~* B, y1 q# f* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.$ \! [/ I* \, v! G. e; `- u, k. K
___________________________________________________________________________
4 X' s' l1 Y$ v6 R* x/ M  Z9 F0 J5 ?/ V. H2 P+ ~

: i% `% r% f' k3 e1 zMethod 03
" Q6 ^& M1 b; T9 j# M# q1 ^1 L1 `: _=========8 ~. F! o3 {. s: D& m
# ]- @- t% `" D. E% z
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
- C/ w$ ^% z% P" X& Z& P6 @# L(API Get entry point)
6 N4 B( H3 z- \5 d- o3 \% a6 c        5 k2 ]' F9 X- Y3 @  }3 o
) d9 q  v) l2 l' ?9 M
    xor     di,di% T* _$ P0 W6 v( l4 U1 _
    mov     es,di
' d2 E0 v- I7 e+ Q# u    mov     ax, 1684h       + V0 ?- S8 }" L8 i  i! J
    mov     bx, 0202h       ; VxD ID of winice& E! G2 l1 u: r, c) T
    int     2Fh
4 M- `! y9 k" W; S' w$ z, M8 X8 L    mov     ax, es          ; ES:DI -&gt; VxD API entry point+ O  _; l  i6 f( c* o3 r5 V
    add     ax, di1 W5 w) h9 I, }8 q0 U
    test    ax,ax: s5 X! p( I$ p/ G/ t) ~9 U
    jnz     SoftICE_Detected
! K  o! ]- P/ E6 Q* l
. S. r9 z" R5 o3 U* l+ g$ b___________________________________________________________________________4 {1 K2 }! B5 a9 U4 |+ d# f

) R) g) a* u0 y3 Z9 ?6 ]5 N2 F3 }Method 04, o: `& i* A7 K, l0 X
=========8 ~3 X- N) Y% M0 h

; ?3 ?, ]+ }  H. g7 u: _  ~1 EMethod identical to the preceding one except that it seeks the ID of SoftICE
- @) p+ }1 X# g  o' S4 yGFX VxD.; P; v; G0 e) ~& [4 B; V/ s

6 c0 f( ^8 {- a; Z/ q    xor     di,di
0 g) _, F: w0 s8 i+ g7 z* S4 ?5 {    mov     es,di5 m  I; [- ~6 e2 |9 o0 [% M+ G
    mov     ax, 1684h       ( d1 H- t  U" ?+ x* `
    mov     bx, 7a5Fh       ; VxD ID of SIWVID
3 y) G& d0 m: K# A( y    int     2fh7 e- G. q- Q! }4 p
    mov     ax, es          ; ES:DI -&gt; VxD API entry point/ ^& _! y( O" o! ?( ?4 D+ Q+ m2 b
    add     ax, di7 j2 I# v# D$ [: u, o( L
    test    ax,ax
4 e7 x; {7 E# S$ v    jnz     SoftICE_Detected5 |9 M5 n( ?5 F0 x* b" t

5 K/ b+ }9 a2 ?__________________________________________________________________________% ?6 x* z7 ?: P( L- C' d

/ A( H* ~. n  P9 d8 D. G! I9 _; {9 M, O3 n4 E
Method 05! q1 N- x7 i; v3 p. R( c; w" R
=========
8 z' W* k4 e/ `* G, O8 o" R/ g$ n" P0 X5 H& T$ w9 h. }& }
Method seeking the 'magic number' 0F386h returned (in ax) by all system
; d, W- H7 K( ]  Q# n  Z, l6 Hdebugger. It calls the int 41h, function 4Fh./ Y: R9 R* W5 i
There are several alternatives.  
3 a4 s3 K+ Q6 t- b) l8 M5 \- J% z2 @+ A3 U/ `* N9 q% A
The following one is the simplest:
  j% U0 u# f' s& W. P7 a* P: z
% H6 |% E' l% A    mov     ax,4fh8 P4 |1 z+ ]2 I! h* o4 `
    int     41h
' ]9 x3 b, g/ i    cmp     ax, 0F3867 b1 a$ k# B$ X& p" i
    jz      SoftICE_detected
2 {5 [( i+ ^# o/ d$ r' h8 n  \& x/ m. v! Q* d7 i

; w: r1 F6 w. |( d* X- X9 INext method as well as the following one are 2 examples from Stone's
& ^7 F% o0 |- ^4 K2 z, x  ~"stn-wid.zip" (www.cracking.net):
: U2 T" ~# u5 t) d
) m" q# B7 I6 p5 C4 Y" j$ U: l0 l) u    mov     bx, cs
; S) l3 ?" g% G3 h% J/ @- b2 U; r    lea     dx, int41handler27 \4 g- C' I' B( A0 _, o/ v
    xchg    dx, es:[41h*4]
& p7 q3 S7 T! n# j% O' B9 V. s    xchg    bx, es:[41h*4+2]( y5 S  Q1 Q% `6 h
    mov     ax,4fh
4 `3 w5 r* T9 ^  B  n) t3 T    int     41h
9 C& a5 G) O4 i) A+ m1 g1 C    xchg    dx, es:[41h*4]
) P9 H! S4 O( c8 z6 y1 h    xchg    bx, es:[41h*4+2]5 B- ^$ a+ s. l- `/ g% T
    cmp     ax, 0f386h- B. k. `0 K, d2 X* v4 d8 W
    jz      SoftICE_detected
# E% }/ V/ H0 Y( F; K9 l$ Y9 j' M& Y6 G! G6 c
int41handler2 PROC; j: V3 U# ]. ^% r$ a8 E
    iret
/ X2 D( q8 O! y1 M, F, M" eint41handler2 ENDP
- v7 R6 [9 B/ {% G* [7 Y  l6 d+ T' e3 z, {

3 B2 t8 n, A7 i7 e' |$ l_________________________________________________________________________. A9 K8 S6 ?2 @. e0 O1 C+ D/ c6 Q
8 x4 u- ~! Z8 g4 ]9 L. y* ^( j/ A

" R/ e8 o( n9 Y0 ?# DMethod 06
7 _1 s8 l$ {& e4 g/ Q=========! `9 o# `: c% O: v9 R1 w
6 c* N2 S* U$ Q# D
+ Z5 X) b  R# W: V
2nd method similar to the preceding one but more difficult to detect:
4 c' \. \$ N/ J9 @% h! @, Y) \# h; r4 m
2 S' R2 _$ c( H
int41handler PROC: O7 E' N, C  l( u1 J9 i
    mov     cl,al
" m" L( V, N2 k1 \# p' C# _    iret, s2 q- h& A# a0 m
int41handler ENDP
, m! }; w, y) P9 ?! m& t
: p' A. {. `! L: }7 n' K+ u0 A1 g
: J' E8 B* J" y: p0 c    xor     ax,ax
' I* @2 v7 q' w" y    mov     es,ax9 u0 X* H' ?3 Z) M4 Z/ a5 E" Q
    mov     bx, cs1 j. j) u5 P  h( m, [& g; |$ k; r9 O
    lea     dx, int41handler1 M4 h" C( Q1 @% y" U/ v* n0 _
    xchg    dx, es:[41h*4]9 _3 p8 `/ R; }
    xchg    bx, es:[41h*4+2]! T! Z% u9 n; D( v, R3 H
    in      al, 40h
* D- }# m/ u2 _9 J    xor     cx,cx
  B6 @/ Q: z1 C2 Q7 V3 C' f    int     41h" }) f. P+ C3 \& `% s: |- b
    xchg    dx, es:[41h*4]& r$ W( j; t. p7 G
    xchg    bx, es:[41h*4+2]$ L; C* F9 [! g) k
    cmp     cl,al
3 b. R0 P1 j. O' |    jnz     SoftICE_detected
: R8 i: Z9 i5 L1 D/ I: _" Y
4 J! N9 e( [; j6 O* e  b0 d_________________________________________________________________________
' U7 \5 R. o3 V1 T3 O, J( k& W2 E9 e' M0 Z" |. u3 A9 j2 b
Method 071 ^/ B* |; u5 [. q
=========* C  i% {4 y0 E8 m1 _: ?4 b
! h8 e) x0 J# P) ~( _
Method of detection of the WinICE handler in the int68h (V86)% C" x% \$ O( W6 N2 M' X& @0 [% X
7 [6 |/ a: M  G" I( O$ p' Z
    mov     ah,43h
$ C5 u6 [" \$ R" d' b    int     68h
1 T% Q1 d. A. h( d; L    cmp     ax,0F386h5 H; v$ M" A& x: |( A( W/ h+ a
    jz      SoftICE_Detected2 _& E) F/ f8 q/ ^2 B) x
: P* J  {) q3 ^! S  y
0 m7 o! g% l' ~" `8 R
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
% s$ J# b! a' K  \0 R   app like this:& `) C- \! s, Q$ v4 J( J& o

( i: W5 S2 K" N) m/ S% H( `$ \   BPX exec_int if ax==68
% q" J0 C; C' u4 d0 P   (function called is located at byte ptr [ebp+1Dh] and client eip is" F% m- O+ c/ `; }; b' Z6 g7 \
   located at [ebp+48h] for 32Bit apps)" E- Q7 ~" S& V$ l
__________________________________________________________________________+ K- @) A- ^" `% U1 h9 I2 ^* _

: [$ G7 t. K* \! j2 \. l, a; i/ d4 `) r
Method 08' t" h* G6 e) g& v* z
=========, s& q" O  N& a+ U5 y! R3 t; o6 R5 ]
4 @! |) O. @  `8 n3 ?* ?
It is not a method of detection of SoftICE but a possibility to crash the
6 `% h# b' q$ ?3 Z" T" C$ L" ~system by intercepting int 01h and int 03h and redirecting them to another4 a6 U9 ^+ P1 ~- T) r. l$ T9 V& A
routine.( F2 W, p( L8 C5 _1 N
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
* s& P. O9 s3 q; D: i1 I5 {to the new routine to execute (hangs computer...)& ]6 i+ e; u. B$ a7 s/ U6 K

5 O1 a! E& h, `, |, e8 g    mov     ah, 25h
) F. i% E; R1 ?% j: S    mov     al, Int_Number (01h or 03h)8 d, z% a. W5 D! |
    mov     dx, offset New_Int_Routine
' m; u+ @. D' M* H. t$ i* l    int     21h
. H+ r9 N$ S" h! D$ y* [! ~$ P" q
& `" b& H/ k8 K+ r__________________________________________________________________________
% |/ C. o% @8 V& f& C2 u6 T3 B. V( z8 G
Method 09. A: X+ [8 Y4 `' ]5 g
=========( u* o( W& |5 \+ [( L( Z
+ }; q8 w! k( E; p' O
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
0 S6 h. c5 E; ^performed in ring0 (VxD or a ring3 app using the VxdCall).0 Y" _, c9 a; q: K6 {4 L
The Get_DDB service is used to determine whether or not a VxD is installed
9 F) r. J, S" `& |  G0 Qfor the specified device and returns a Device Description Block (in ecx) for+ k4 _$ G/ ]3 L( E& m% Y# h- v
that device if it is installed.
2 F4 H# A7 }- `* d4 z7 ~# Z- O, X" |$ m/ h$ w9 m  ~
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
2 Q5 @* d$ ?1 }9 V   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
& u6 D' E- ^0 P3 j  Y4 c   VMMCall Get_DDB! M* {1 E" c; }
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed4 Z7 f9 t" E: K  L$ n5 F4 C3 [9 Z
" u. J" |* Q  l! d
Note as well that you can easily detect this method with SoftICE:/ B4 l: F$ v  L# m! F
   bpx Get_DDB if ax==0202 || ax==7a5fh& {, }7 j/ U# }. ~2 m
3 ~9 S+ x$ q5 r6 K+ B
__________________________________________________________________________7 m! [- N0 Y. l  M8 G* v1 _! w

, C' u. `/ c( m! ^/ ~6 r, NMethod 10) E7 K3 [2 H4 J6 i, E& @$ u
=========) Y; f, I8 g' R

7 B+ I2 [% d( q# x=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
& B$ H& o6 i- G9 m  SoftICE while the option is enable!!' J" P4 H! q' [3 X6 [* H6 T( A
/ A: y" B, Z) q" Z8 U6 F& T
This trick is very efficient:
! h# w  D% \) @& O- }, N& ?9 Kby checking the Debug Registers, you can detect if SoftICE is loaded
9 V3 b5 z- A- T7 [(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
" W8 \0 y% J8 L( hthere are some memory breakpoints set (dr0 to dr3) simply by reading their# R9 O7 x" J6 M$ S  g* T( J# {3 t( i
value (in ring0 only). Values can be manipulated and or changed as well
$ T5 f+ Z  [1 x: q( Y(clearing BPMs for instance): J, H- \  W' h3 K8 d! u# M0 E

, V+ l1 T$ ?% U$ x__________________________________________________________________________/ H" N' M+ c; I6 o

4 [3 B. e' q9 S& U& xMethod 11
* @3 E5 D, o/ c/ S=========, `, {* x( V4 s' U
0 R8 I' D! b9 E+ C
This method is most known as 'MeltICE' because it has been freely distributed6 s$ Z, r$ T6 _' A( j6 v
via www.winfiles.com. However it was first used by NuMega people to allow1 _7 [% V$ |# R; u, H4 N. I2 {
Symbol Loader to check if SoftICE was active or not (the code is located( [7 B8 j* u+ R# {
inside nmtrans.dll).
0 s: e8 k% i; P3 ~1 B( {, e) D
# J8 h- G* B6 i3 H  L/ ~4 nThe way it works is very simple:) m& W  k* ~) t" t# _2 q# {
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for* l6 w! _% H$ t
WinNT) with the CreateFileA API.
  p- U" X0 u5 V1 }5 T  n3 f4 D4 j
  F% I1 v% W. k$ G: \Here is a sample (checking for 'SICE'):4 V  X0 C! f5 y: A& d

: O) ^4 l1 l& ^  m" G) iBOOL IsSoftIce95Loaded()
" h7 ^0 O" A( Z: g, I0 d. z{) D( ~. L/ }, N" ?
   HANDLE hFile;  " ?4 F  i$ Q$ H7 p
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
- o5 R: }" E6 P6 \; R+ J                      FILE_SHARE_READ | FILE_SHARE_WRITE,  l( M; y- K& _
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
' M, b- \% `0 U/ k   if( hFile != INVALID_HANDLE_VALUE )4 L- p5 P' O8 K* P
   {
9 }  H8 _  r7 |; T; K( C      CloseHandle(hFile);
7 M: p, B: _) B% L' U, K3 w      return TRUE;
; }5 p3 K% G5 _; \4 Q$ T$ A   }$ h8 V  I6 j% I" i* R+ p
   return FALSE;
' Z; E( i+ V6 |* K6 a( t9 ?}) P. f+ q) w$ [! y. X, a% e
& j& F9 C9 |3 d, ]% Q
Although this trick calls the CreateFileA function, don't even expect to be1 t, G4 P$ G  S3 M7 `7 N
able to intercept it by installing a IFS hook: it will not work, no way!
, r7 b5 y: L- Y& c7 y; e1 M7 UIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
$ u5 v" O4 a- v# G7 w& }service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
% S4 b) w( q8 R, ]  S% G. N' M. @and then browse the DDB list until it find the VxD and its DDB_Control_Proc
8 \* r) Z' b, k' e9 G' Wfield.
& \. z. p+ [7 w% X4 S+ L9 Z. |1 t: PIn fact, its purpose is not to load/unload VxDs but only to send a
3 a: V; S' c, l7 }W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)" U' o9 `; g* d) u$ \4 P! P: y( I- Y. m
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
! d  F0 q: A6 N. z. j% Nto load/unload a non-dynamically loadable driver such as SoftICE ;-).
3 x1 e- J6 r  ~* U0 m* X% GIf the VxD is loaded, it will always clear eax and the Carry flag to allow) L( T& y; Y. l1 g2 T! l% ]
its handle to be opened and then, will be detected.
  r5 ]% J) q" E4 RYou can check that simply by hooking Winice.exe control proc entry point
7 {6 q1 K. x. e" a" U0 Nwhile running MeltICE.
7 T. ?& a/ ^9 e, t  ~
, M2 Z! F) F) R2 h2 z1 @7 |
. s5 I- W: c" J! d/ l1 s/ ]  00401067:  push      00402025    ; \\.\SICE
/ E0 N3 Z, ^+ `. d' _  0040106C:  call      CreateFileA/ c# \, ]3 k% j/ F& i+ M# V
  00401071:  cmp       eax,-001, r2 {& }; r7 q- _, M
  00401074:  je        00401091
( n) M9 r. E# M( a- u$ h
! n/ _) O% |6 p" `9 i" z5 V, w
3 D: ?8 ^% t- q4 b: B5 {There could be hundreds of BPX you could use to detect this trick.
" ~( {8 a+ _1 F. y* w! R-The most classical one is:& g. T% i% q; I+ @6 d5 b( m, W
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
# C' Y8 Y! U& ~    *(esp-&gt;4+4)=='NTIC'
- q: r& {% S, O1 ^7 \
5 `2 P; c. J( o3 e-The most exotic ones (could be very slooooow :-(. l: P0 C8 u! d  [) P* u; n. ]
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  5 I9 i! n7 E% B2 G; N" ^9 d
     ;will break 3 times :-(
% R: M4 R* f; p- w( x7 A2 m6 w, V- p, V# U. z3 k; B
-or (a bit) faster:
" Y+ z& n5 a; Z$ F! c   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')& O  y% M0 t4 A' O: o+ d

0 Y. H+ Z9 G: j- M( l5 a   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
& f( M: m/ P1 c$ D: A8 o     ;will break 3 times :-(# F" o( g5 M' I' c

' _; R. V7 \- h-Much faster:$ ~( w1 x& N7 k
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'/ |- c. D1 U! a. Z, d6 c" f; t
: F3 {! j- _% \
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen  r+ N' N" e, `$ O" v& {  Z
function to do the same job:
! x/ N' ~7 P& D$ f! S9 r; F* i3 _: `7 r# q
   push    00                        ; OF_READ6 A7 V* T1 d- c! u+ O: p% I
   mov     eax,[00656634]            ; '\\.\SICE',0
/ ]5 o: f# T1 i, @# M: p$ I   push    eax
7 F' E: f/ m- b0 x& B, g5 S* o* i. V. S" w   call    KERNEL32!_lopen
) Z" v1 e# m2 ^) |! {( m4 d7 Y   inc     eax: `4 \7 |6 j6 M' g7 L5 @, a
   jnz     00650589                  ; detected2 J. e" y$ @9 ^
   push    00                        ; OF_READ
. ]  c* E4 z4 M, S  Y8 g7 D, }   mov     eax,[00656638]            ; '\\.\SICE'/ N( H* l, D3 L) x
   push    eax
- L3 x2 W5 T) y$ R1 Y( G   call    KERNEL32!_lopen
, X0 T( k6 ]' q; i1 H6 E   inc     eax' D1 K/ I+ P- g- z, A1 z+ s% B- ^/ u
   jz      006505ae                  ; not detected) p% ^0 o: W8 D: A  c

. C' F% E  t% d9 Y& a& [. T, g( n& }
__________________________________________________________________________; L1 i+ ?# V1 V2 n; l

4 B" d3 o3 `+ ~4 QMethod 12( G: T: @! k! F  u/ x# z
=========' T8 d8 g9 A, ^" [
. ]3 }- s7 m- L# }0 p
This trick is similar to int41h/4fh Debugger installation check (code 05
, ^4 f# i$ _7 K6 V4 p4 ?$ V&amp; 06) but very limited because it's only available for Win95/98 (not NT)
1 s4 z- m) {' S5 F! j$ f1 {5 das it uses the VxDCall backdoor. This detection was found in Bleem Demo.& H# c/ j( i& P- ]0 G: T7 D5 B
- K) o; o& @& a- F/ @6 j
   push  0000004fh         ; function 4fh  I1 ]! p, g5 m" p
   push  002a002ah         ; high word specifies which VxD (VWIN32)
  ~* M% Q" |2 B                           ; low word specifies which service
' ^9 F) m7 c6 }/ H: ~0 _' L                             (VWIN32_Int41Dispatch)
: F7 W/ ~( U- M, G6 g. F& s& w( D   call  Kernel32!ORD_001  ; VxdCall, b; j4 D3 G, O! B4 t! Z6 F
   cmp   ax, 0f386h        ; magic number returned by system debuggers
" y* b  S" X" q- V   jz    SoftICE_detected) p( M2 u# _6 p6 s' H7 U

( I. U7 f6 J( m- g3 D+ x  K6 {Here again, several ways to detect it:4 t7 f: y- H, v4 w
1 T. o! ?/ O; Q% F
    BPINT 41 if ax==4f
- r$ }# `: R1 R& k! X  @5 ]5 r2 P. Q2 j' e5 v+ V# q
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
9 g# j/ t" m! S2 y* G3 K& ~" a  _7 K( X5 G3 k6 V6 x0 k
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
+ l/ K- U- Q) f' D" R* t& _) K1 |# X! @
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
% }+ h9 l7 D, y  K+ _; x
* V/ p9 h6 O1 M& I7 A1 C5 ?__________________________________________________________________________
% Q# K, n4 M* Y' J/ r% ?" P) T) M0 I/ I0 t: y) }
Method 13
0 _& C, m8 g( Z- q=========4 Q; N* B9 y7 X: F  r4 i2 z3 ]
4 A# F( `$ s- }
Not a real method of detection, but a good way to know if SoftICE is( k, v+ L9 U0 i3 {" o
installed on a computer and to locate its installation directory.
+ C  @% J) B0 _9 W3 XIt is used by few softs which access the following registry keys (usually #2) :1 T! G; i* h% X% k) n( E, z  D8 q

- C) t: l! F/ k. t3 q-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion, J" X& G  ?' Z7 u
\Uninstall\SoftICE2 z2 v/ n6 j2 _9 y
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
" c: l/ R: a7 x-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion) v. h4 G, D2 \2 J0 X
\App Paths\Loader32.Exe/ [) x# O/ H7 K% X

7 ^/ a4 w$ f! o: a# O4 l
4 c% ~7 F) Q% ~, JNote that some nasty apps could then erase all files from SoftICE directory
( R. e9 K4 D- u8 L* s) d, W3 L3 q( J(I faced that once :-(( U% A8 S$ [; w' V
) E7 }- U/ x$ K9 q6 u7 U
Useful breakpoint to detect it:
0 r9 w# ~/ Y! [. a! R1 Z7 b
* n. o  W( {" ]* `) @+ `     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
$ E* O1 M' J# c5 X' `; @3 N2 N" c
- c+ Y! ^3 {6 {$ q& Y; I+ t__________________________________________________________________________
; E8 y; t  S# v+ k
+ u/ S" @8 I/ r/ C% P1 U! O
5 B, \0 Q- y9 N" HMethod 14 * O7 Q! z- D- P8 [# w
=========
4 }% n9 h. @9 K, l, O( s7 f9 m" m3 c- e1 F& B# \% K7 f, E
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
4 U) E5 X% h" I: i$ h6 |is to determines whether a debugger is running on your system (ring0 only).' i/ g5 L5 G: \  x  x5 T& l
& w# d. K5 V2 _: t7 W2 R0 q0 K
   VMMCall Test_Debug_Installed. q6 R. C- C& b1 M* ?
   je      not_installed
7 y8 r( z! q5 {7 q3 i2 `: J
1 [4 ]) q! @2 r, ~1 U2 wThis service just checks a flag.
/ b! w& e* X+ N, \7 z8 {# v& C( I9 {. c</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-8-7 13:54

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表