找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
+ L; J' `/ r3 j1 ]4 {# I<TBODY>: ?7 d! ], [& D* l* r
<TR>
/ v5 i+ Y) Y8 V7 U6 l1 y, E8 ]<TD><PRE>Method 01
8 |) D2 [0 A  D% }=========
" O# z, ^- d0 {) k" ~; ^- Z3 Q; ?; x% \3 z6 e6 j( `# Q
This method of detection of SoftICE (as well as the following one) is: ^% V* v( O7 O/ m8 J- i" j' w/ h
used by the majority of packers/encryptors found on Internet.% K# y4 [9 r0 P4 r( H& O. P
It seeks the signature of BoundsChecker in SoftICE
  ^+ e. r; w, ^" n! D5 b3 l' m
5 b3 |& j3 }1 f* ^; e0 U    mov     ebp, 04243484Bh        ; 'BCHK'
* A! E" c5 ~$ J! V, J1 B    mov     ax, 04h% N& E8 t3 P& _5 ^$ ~
    int     3       / W9 ^! b8 N  p5 T5 [9 x
    cmp     al,41 Y0 h9 x) M9 U4 Y4 j7 S6 u
    jnz     SoftICE_Detected
( n7 n  v+ E# _! k$ V
+ ^0 l8 g1 l" E, U___________________________________________________________________________
8 U1 H/ o. i6 z6 o7 |+ w" p" R+ k
Method 02
6 z$ \; i% ?) S+ g8 U  `4 x=========
, h8 }, I1 C5 V: t9 m: f
$ ^, y& t3 ?; M3 ^+ Q% }4 yStill a method very much used (perhaps the most frequent one).  It is used3 S, l7 {9 y; s! L+ U+ _
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
" ^0 v) _$ F# ror execute SoftICE commands...+ w) J2 `3 H$ q  R  ^7 g% M
It is also used to crash SoftICE and to force it to execute any commands) `4 _/ k8 K8 R. s9 F2 l0 \
(HBOOT...) :-((  
: v0 ^) ?, i! h$ q, n' r* z, ^: V
Here is a quick description:
; u; R6 y0 a# e" M$ d6 B/ p-AX = 0910h   (Display string in SIce windows)/ a$ D4 a$ S" s: D* j$ S5 ~+ Q9 w
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)& u- w: W. @& H4 h3 l! M8 M
-AX = 0912h   (Get breakpoint infos)7 t2 L/ D/ o) z
-AX = 0913h   (Set Sice breakpoints)
% x6 ?( `" E. ]* `, y7 N" M-AX = 0914h   (Remove SIce breakoints)
" R) [8 P- q& S2 S! M( d
: h9 _- \+ ?8 w0 Q2 @" WEach time you'll meet this trick, you'll see:! Q* ?' _' N" r/ p3 {9 z* k  X6 D
-SI = 4647h
2 W. Z' d. v& E-DI = 4A4Dh" _, y0 v( S! C) X2 h3 [
Which are the 'magic values' used by SoftIce.
: e$ m; {7 Y/ NFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
+ x" e1 j. E% O! U4 @2 w1 T" b9 Z
Here is one example from the file "Haspinst.exe" which is the dongle HASP
. D6 \. B* K5 }# {4 y# }" G) [6 S. bEnvelope utility use to protect DOS applications:
+ Q0 I, W9 I: G4 I: b" {  h, {! J6 {) r5 U2 O8 Q' x. \
! b4 F  c  P0 J6 b  U+ m) ?4 J& }
4C19:0095   MOV    AX,0911  ; execute command.
- s" `- x* J8 N* l5 r1 p4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
' ~, i# h% \* L4C19:009A   MOV    SI,4647  ; 1st magic value.
* b5 B) F  E; N7 Q2 N+ s' ~3 w4C19:009D   MOV    DI,4A4D  ; 2nd magic value.9 J4 o% Q' K: A" a
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
* q- i% E: ?6 T0 `  k4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute+ k4 ~- ~  Y6 C: e8 n; M
4C19:00A4   INC    CX
% b" g# \( P9 n, w9 i4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
4 Y4 T0 w! S9 K. [( I4C19:00A8   JB     0095     ; 6 different commands.' F5 h5 v9 [2 f7 \
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
+ b' s  v* }  @, h' Y4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :). ?- H% R8 q' m
' G; J0 d/ P, m6 A
The program will execute 6 different SIce commands located at ds:dx, which
5 u! E6 v9 d4 h8 s! S. w/ Oare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
& `7 V) N( s: h4 n4 N, r0 R4 j5 q4 ]7 I) \8 {* I6 O
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
4 u; F9 Y" F# l: J/ m/ m: ^# h5 I___________________________________________________________________________; i) u. ?, D% S. {2 q# a

: v+ ?% q* M3 E; G1 B9 ~+ @' g/ K2 Q8 h; m- m- M) z
Method 033 Z5 q4 C3 c  w4 G* J, E% F
=========* I9 c# N2 b$ w# s2 I; w
: K; B. X7 R$ r7 i. B
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h/ h& X$ Y; {/ H( B
(API Get entry point)& e) F. p- P* ?9 Y2 }; y- ^
        
& _0 r& J1 J0 J( D" X
& K! }* Y6 }9 o& q    xor     di,di( B# N8 ?( B' w0 w4 F$ B
    mov     es,di; |+ O! K' r  _
    mov     ax, 1684h       ( s0 F) `3 P" ^7 s, p
    mov     bx, 0202h       ; VxD ID of winice; N0 m7 p# }5 o' L6 ]2 x& {
    int     2Fh& m6 H% e' I2 K
    mov     ax, es          ; ES:DI -&gt; VxD API entry point7 _4 L- Q9 d" P% B3 w0 D" a. J3 A( s
    add     ax, di
  [& M2 L  P2 `. N    test    ax,ax
4 n1 ^) X9 k; G: N# m; n# z    jnz     SoftICE_Detected" y: v, [5 T' u, Y

; J7 N& H8 X+ J7 _& j1 _- _7 F___________________________________________________________________________4 c5 Q" V$ b# V( k- W+ I+ [) X' x7 i
& v' ~4 h% I+ t% G+ R# n. ?1 S3 [
Method 04
6 G9 z( T4 g3 ~' Q9 @* G: \=========9 g, N% n: f0 u! s
4 `) x7 B5 M, e. V# e1 {$ Z
Method identical to the preceding one except that it seeks the ID of SoftICE4 v# R7 |% L( m/ I# v
GFX VxD.
3 Y1 }4 V' Q3 d& Y( n' `# d, O( ]& R& B* U+ J9 v
    xor     di,di
( U$ E- t/ O( e3 _8 }/ w) ]# e    mov     es,di% C6 j% U1 T2 |4 [1 L# J+ Q
    mov     ax, 1684h       . ^$ i$ Z* |! X$ c; M1 K  _6 S
    mov     bx, 7a5Fh       ; VxD ID of SIWVID
2 O, B  Z* @6 ?5 n& c, o9 n    int     2fh! U8 h+ D3 E9 Z/ X3 h
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
4 ?! i3 d+ r0 B3 m) p6 x  u" q    add     ax, di/ [7 G- I9 b- G  ~
    test    ax,ax$ \- C; [: ~2 \6 z/ ?- ~
    jnz     SoftICE_Detected: [- m# }5 K- J; h' ]: X

0 }. d" G& U6 T! _; c6 V__________________________________________________________________________
; {) v6 v5 n6 @+ z* y
' [% v( A" k: s( p- ?; [: u  W9 k, G; a8 {
Method 05
. t9 S; c% z- t) w, [  \) g=========3 y0 B' @# l6 ~

; @/ _+ _4 g+ ^% _& G' G% K; zMethod seeking the 'magic number' 0F386h returned (in ax) by all system
# P8 ?( N7 x+ e1 vdebugger. It calls the int 41h, function 4Fh.3 s3 V3 d: }$ Q' M$ x; N  T! b$ a
There are several alternatives.  
5 x$ @5 {: p& ^8 X' @8 {) u& h, _: y; A! ]$ ?+ l; Q1 E* ?
The following one is the simplest:9 P0 A0 k) K+ F+ a0 d4 j6 n8 J" f/ ?
1 N* W! K- b& o, |. Z% I5 c6 N
    mov     ax,4fh7 P# t) R- n/ J$ K7 ^: t
    int     41h
+ V- N; s& ~8 E$ ~    cmp     ax, 0F386
8 P' `4 A2 ^5 d8 v) W2 `, t    jz      SoftICE_detected
! M+ p9 Q( e4 k3 w( m+ i% G" Q, M* J6 a( _1 E# Q4 m
+ g9 E5 R7 K$ i" b# S5 U+ s; j
Next method as well as the following one are 2 examples from Stone's ' K' g) [' c, @# M+ {
"stn-wid.zip" (www.cracking.net):
5 N5 C. p! ]4 d9 D: l* s. `! x* G+ P9 }. w4 [+ S, _: k
    mov     bx, cs
+ l3 _3 N+ Z4 [- Q" n4 H2 B# W' ?4 n    lea     dx, int41handler2" V, ]9 P) W! b6 S2 w/ P& X  q
    xchg    dx, es:[41h*4]; P1 m9 @" {. u, k. G$ F$ F: k# F5 J
    xchg    bx, es:[41h*4+2]
$ A8 k5 r( n+ t  n. J    mov     ax,4fh8 A* U( _4 ?( {- s2 W: n! M
    int     41h
) S! d  J% L5 I3 e& U    xchg    dx, es:[41h*4]6 G8 Q7 H3 k6 m5 X
    xchg    bx, es:[41h*4+2]
+ r0 H$ _% A" `    cmp     ax, 0f386h% G- J3 \6 y9 m
    jz      SoftICE_detected$ Y4 S- W7 c$ j7 Y" S2 Y

: f$ B  Z  X5 W0 ^int41handler2 PROC
/ K( V# l1 H9 q- y" |    iret% [. {6 ~8 ]9 m% f- o
int41handler2 ENDP) E5 w- ~5 E) F6 s, K0 m% R
& H+ \2 s; ]- }
- ?6 ?' g: p8 F+ H- o
_________________________________________________________________________8 t- h6 P2 r! @  v: x$ {; _6 G
) Z! v% U; _" ?1 v! c% Q
8 Z4 M, z* ^& ^* O- H& w. M
Method 06
2 q( u' Y  a! C+ c+ r=========
8 G3 B  V( J$ o0 b- Z3 P! |3 b1 Y$ F0 o
; x, |* O4 J; n9 S
2nd method similar to the preceding one but more difficult to detect:5 a7 c+ o8 k$ \; \* y3 A" l+ i
# S% c. Z& K4 t" O/ e  ]
& \9 V+ B3 M. t4 b; _2 C
int41handler PROC
$ C6 w  H2 R: }1 q/ i  S) V    mov     cl,al" T# |' b% K" R) `4 X  C
    iret0 h5 L, I( o, |& @
int41handler ENDP
+ |, G8 T- N) r- K: F% i+ O. Z% B0 C5 P9 B8 B5 P

$ \' c0 k) A+ ~$ J- O( e    xor     ax,ax# I0 P. J  A+ q" g! v0 }
    mov     es,ax
; _: O. R* t5 J6 C2 C. E7 l    mov     bx, cs$ s6 E, e% t: a  p" I- G* N0 h
    lea     dx, int41handler: o) ~$ X& L1 n2 l3 O% J& T
    xchg    dx, es:[41h*4]
4 i: w) B& z' q1 e6 H8 X: F    xchg    bx, es:[41h*4+2]
# P8 h' e# G! _& U5 A    in      al, 40h& V9 f( O4 c& R; c; X+ }
    xor     cx,cx
/ g/ K+ ^9 F8 d! l3 W, a    int     41h( |" n; E3 ]. q& a* t5 q
    xchg    dx, es:[41h*4]8 z/ `' F' c: C3 H
    xchg    bx, es:[41h*4+2]5 g3 m3 W! {0 n% @5 \
    cmp     cl,al* e* y! M; y% k
    jnz     SoftICE_detected  l& f4 F6 g" @& j: @# d! P# f( ~
6 H. ?8 {" ]0 L
_________________________________________________________________________
6 k2 ^  @( \9 Y- @7 J7 T8 G+ K- K! K1 s- e+ {6 Q5 {
Method 07% y* l6 Z1 e: J4 k! n" t6 I1 }+ C2 t
=========  s: Z( j9 l. L! Y# O( L0 P) f

+ H0 I0 A  @  r" k$ g$ }Method of detection of the WinICE handler in the int68h (V86)
8 Q2 u4 J0 ?, F' i* l3 S
' R. L. a/ T. V$ u9 V    mov     ah,43h
1 @4 n$ g: e+ c) {2 d    int     68h
3 b' H; X  c2 H$ l    cmp     ax,0F386h5 G, C; b2 [# @0 @) B- m6 p
    jz      SoftICE_Detected
" }! N9 W& u! r: F8 ]7 Z* g7 [- d$ a" o0 {0 Z

6 \8 G3 d+ j. d=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
& ~. K, Y# {) ~% @0 k   app like this:
' D! C, _) ~2 z- a% F8 H8 C
$ Q/ \9 H3 l2 L( ~  G8 T8 }+ i   BPX exec_int if ax==68
9 G: X8 t3 i& i- v( x7 ~9 h   (function called is located at byte ptr [ebp+1Dh] and client eip is5 `$ k" b5 t8 v! q
   located at [ebp+48h] for 32Bit apps)4 y. Z: n$ l+ t6 ?& \- p/ \+ t
__________________________________________________________________________- ^' C2 A" P; N: n

: K6 M3 x1 r5 w1 a; D5 m: d5 B. b7 t) ]2 r
Method 08
& f: o1 N/ a6 q9 c- a3 X8 u- `=========
; T, p' e, ?1 Y  E* U  }
, _4 B+ U3 I& L+ L( v0 CIt is not a method of detection of SoftICE but a possibility to crash the" Y+ F5 J9 `' H0 t
system by intercepting int 01h and int 03h and redirecting them to another
' z; R! J" {8 ?& G$ v% Z# qroutine.+ s; z2 U2 n& q
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points1 @( b, K, _* E$ G* V
to the new routine to execute (hangs computer...)
( _  u: v4 A" x* z
$ W7 x3 q. Q' o: X6 h% w  l  j2 P/ Q    mov     ah, 25h
  g) X  s+ x- X    mov     al, Int_Number (01h or 03h)
. @  n7 _* F5 O  T( T4 E: s    mov     dx, offset New_Int_Routine4 q/ h" n8 p, U# }
    int     21h1 |( K$ p% c7 N; f  L$ P
3 N. k, I" z/ L! e( b9 {: e
__________________________________________________________________________. s+ `# Q& m! G" I
+ H. M4 T' g! u
Method 09. W7 a; _9 |5 _/ t0 v$ k+ N
=========) b% b; b% T& {9 D, y

' U- V  E9 y' T, r. M) rThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only! v( R( e/ _% Y$ v' ?- h$ d- w) L; h
performed in ring0 (VxD or a ring3 app using the VxdCall).
* D/ s5 p, t5 BThe Get_DDB service is used to determine whether or not a VxD is installed& P# J; H( v( B  |7 B, j& ^
for the specified device and returns a Device Description Block (in ecx) for
1 y- D. z5 g2 C* ethat device if it is installed.
. i8 q9 {5 d2 A) }" n) s, C# m8 s. B) s( z
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
7 T* H& j- C. q   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
6 g# k! k. d  I   VMMCall Get_DDB; k6 r+ o4 ^) U) r5 M4 ?
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed) v7 b2 l  x" p: o8 E. m; V3 L

. e) k, u" q0 L0 E2 d6 Q* T. HNote as well that you can easily detect this method with SoftICE:
4 T: o: h4 |- V. t   bpx Get_DDB if ax==0202 || ax==7a5fh2 x- O5 V7 b+ S: H9 b
/ `( U% X( Z. c6 b1 y( {
__________________________________________________________________________
0 ?, A+ O) R. H4 |( m3 \7 X- @, r6 m, m/ @
Method 10/ n6 C& q6 Q' R2 L4 W5 E
=========
# c0 ^* X0 Z  ^4 o. R- |& V1 T0 a6 o8 n5 d! |
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
- D4 p1 [. B* j4 S0 \1 \/ ]7 f  SoftICE while the option is enable!!# Q" E7 z3 i  q3 O0 x' A

, A  X! d  a$ S+ F# BThis trick is very efficient:
. g. E; I, ~7 H+ Y" }by checking the Debug Registers, you can detect if SoftICE is loaded( D6 e" H" J$ e/ }/ A& y& L
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if' o! H! ^+ S- v" e+ ~
there are some memory breakpoints set (dr0 to dr3) simply by reading their
5 O; p, H8 I* x! d" M" a  wvalue (in ring0 only). Values can be manipulated and or changed as well
) ?2 g  q) o- z- ~5 `! y$ u+ F(clearing BPMs for instance)
1 y6 }* S2 {( b4 t% x  I
) K" x9 p5 u# L8 b, h6 I' J& y. J__________________________________________________________________________
. a' Y9 p; ^7 R; U; l- Q
7 K! n3 o7 M. P7 L0 C2 g0 C: SMethod 11
( M+ g# v2 M- A. |$ O  W7 w=========
( R/ ]8 ~6 r- m9 P7 J/ I# s
' ]' {8 t+ B' g7 m$ F; UThis method is most known as 'MeltICE' because it has been freely distributed/ @2 J- G& b5 i/ G4 q9 ^, ~3 _7 w
via www.winfiles.com. However it was first used by NuMega people to allow
# y0 e5 P1 ~4 ]' RSymbol Loader to check if SoftICE was active or not (the code is located# G$ @9 F# W& z. L4 c* g! b& H
inside nmtrans.dll).
) s9 e6 z0 I3 w8 G6 Q
/ G0 V# s# B; ~, Q8 V; `: a. F% nThe way it works is very simple:) o( G4 X$ l" q4 a9 w! e4 O0 i
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
0 [% p! O8 F1 L6 q' _1 IWinNT) with the CreateFileA API.8 C5 ^9 o6 ?6 o4 h# p' c, ?# Z% ~

% b0 ~2 `2 \% o9 l  A9 k; NHere is a sample (checking for 'SICE'):  t5 B# q6 c5 K/ F& K2 _

0 |0 b5 ^4 f& E6 U+ A& `+ H# i, _9 UBOOL IsSoftIce95Loaded()+ d7 T3 F. d; N) ~: q
{
5 n1 C* c6 s% P- e# N& A  x* K   HANDLE hFile;  
+ n% m9 ?. K; S   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
7 i- [  P5 H# X2 C                      FILE_SHARE_READ | FILE_SHARE_WRITE,
+ H. l8 K4 c/ M% j" O; t+ y                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);4 v4 t1 j5 f8 W' L/ k8 c
   if( hFile != INVALID_HANDLE_VALUE )# x. n" M; T$ U
   {2 Y$ Y3 r0 y- U$ L
      CloseHandle(hFile);" g+ W9 P( k5 E& _+ S0 W" A
      return TRUE;7 a  _" t- t% ]4 T
   }/ Z  d2 A9 S6 x+ N
   return FALSE;
. K# A! x- O) Q$ |5 z}
2 V0 Q& `" L$ j$ }( n) A: V, P  n4 @7 m* q5 d
Although this trick calls the CreateFileA function, don't even expect to be* e# y' A" r* `7 a! d
able to intercept it by installing a IFS hook: it will not work, no way!6 q  g) F" u2 b; f/ f( C  A3 W! ?( i
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
7 F# j, D3 [$ H; |. E, Jservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
" n5 I; z* j$ nand then browse the DDB list until it find the VxD and its DDB_Control_Proc
# J0 V* X8 ^! B$ Gfield.3 h7 j- \5 t* q
In fact, its purpose is not to load/unload VxDs but only to send a 9 s+ ^0 C: k# k+ ]1 n- l0 }
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
" u, r- D, F: _1 C8 }8 w( Ato the VxD Control_Dispatch proc (how the hell a shareware soft could try
8 G7 E( Y& W" |0 @2 }& Wto load/unload a non-dynamically loadable driver such as SoftICE ;-).
% V0 s8 z5 E' vIf the VxD is loaded, it will always clear eax and the Carry flag to allow
, [: A' P! P' m; v' y$ Sits handle to be opened and then, will be detected.4 c9 c2 M& y. A
You can check that simply by hooking Winice.exe control proc entry point
4 [/ L- p. |& Owhile running MeltICE.% B7 L9 ~! t0 F: J3 D

/ [! H9 n$ i& n5 x+ G$ e  H5 ]+ F/ e, {# z
  00401067:  push      00402025    ; \\.\SICE
$ \2 Z# K# M3 V6 U) }( |# p  0040106C:  call      CreateFileA
  T. T2 j3 ]+ D+ r2 O  00401071:  cmp       eax,-001- o' N+ ~6 N1 n6 j. G$ K
  00401074:  je        00401091$ @) U3 M% v2 Z1 V

, H% o8 D$ J  ^: V! g
" R0 g5 Z' M6 y' \& c' v& s6 OThere could be hundreds of BPX you could use to detect this trick./ B9 N; J9 q1 x" }7 M. n
-The most classical one is:
% L3 E- I' i* k* y3 \  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
2 b( r3 m3 t4 U& M. c    *(esp-&gt;4+4)=='NTIC'& P8 @, ~9 V% \; ?. A. e% i
9 C- |9 L5 a: {4 ?" Y9 A5 T0 F$ ]
-The most exotic ones (could be very slooooow :-(/ p5 x6 ?9 a1 z: n- q
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  ! F( P+ b. c! ]  E
     ;will break 3 times :-(
$ ^1 }1 Y2 l$ p3 h  D; l; x. ^7 H
-or (a bit) faster:
' c1 n, m% o7 y$ P2 `% x3 o! g   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')' W! d+ E4 t2 I& n
9 n% n4 k; \0 O) v. M
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
9 x4 ^+ a$ l0 ~! q     ;will break 3 times :-(
! I6 J8 {% O8 D6 r- j2 a$ O+ X. ]8 L/ j; G" A: V! f3 @
-Much faster:
& T( x& c. q5 L4 N# U& s   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'# o; [, S* k$ Z$ Y

; j& @0 L$ [- o4 TNote also that some programs (like AZPR3.00) use de old 16-bit _lopen; A2 l+ L, Z1 F
function to do the same job:5 R) W* h* l) y
* j+ ?8 q/ o$ |6 H
   push    00                        ; OF_READ
: T- g; o- o$ Z% J7 H* n- w   mov     eax,[00656634]            ; '\\.\SICE',0
, |5 U; |/ |) f9 H! A   push    eax9 d- C* m/ z* q+ ?
   call    KERNEL32!_lopen, b+ r2 D) D) a' @
   inc     eax
% S1 @( s1 u9 S9 K. C3 q: @   jnz     00650589                  ; detected
& ?( ^  Y! k: u$ g   push    00                        ; OF_READ2 K- U5 _; J- S2 |7 U
   mov     eax,[00656638]            ; '\\.\SICE'3 x# o: e) q, p8 [- s
   push    eax
3 t% }" H, k. [: Y+ v   call    KERNEL32!_lopen: T2 N( r& H6 I! y8 E, C+ \% N( V
   inc     eax
1 M, m9 h: k: P/ Y$ A9 O  F1 C9 U4 X4 t   jz      006505ae                  ; not detected+ Z) M7 v1 w9 j2 w  ?
. g6 v7 M4 X9 O/ e$ \* n

6 A! e5 N, O5 ~6 d__________________________________________________________________________  `7 E/ w3 g: O- s  O$ c5 s) o
7 A* F& O* a# V' }
Method 12
" A7 T7 S- W) A. h% I# w8 q/ [=========
/ h2 ?. Y5 {7 H2 E, Y5 \' }. f% a8 }- G/ t2 J' E) `. Q6 U
This trick is similar to int41h/4fh Debugger installation check (code 05
+ N% }* u% l5 \; _% x  v0 {&amp; 06) but very limited because it's only available for Win95/98 (not NT)7 S8 x8 w% ]. e, A0 c' B/ b
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
& {6 n  w) @& S. V0 Z; g4 d5 i4 G
% m' W/ s; X- p" o   push  0000004fh         ; function 4fh) H; l8 i: v% U$ F' G1 M
   push  002a002ah         ; high word specifies which VxD (VWIN32)
, R! `, r' c( p                           ; low word specifies which service. j* j3 i3 S& ]" g' c3 p5 n5 }
                             (VWIN32_Int41Dispatch)
) f) b0 q# a6 E9 g8 l   call  Kernel32!ORD_001  ; VxdCall/ z5 V$ L, P/ e4 o- t/ z; J3 X7 n
   cmp   ax, 0f386h        ; magic number returned by system debuggers- h* L7 D) |( g$ u5 N# `2 h6 K
   jz    SoftICE_detected
! m' d  \, ?; D& o- n: {# c+ {1 |6 }; Z- V4 W! P
Here again, several ways to detect it:
: o# p; w( K/ x% Z) k2 v' C
+ [0 D% P/ A, I. P+ B& O    BPINT 41 if ax==4f
7 |) n0 _4 t% B/ K7 s* R5 {& }: G& v6 L) J, d1 n
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one* r9 ^, a# U* g& Y9 o$ n$ z2 ?

! S* I( H9 F8 L/ [) ?( |( |    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
& j0 t8 ?' a( R
' c/ h* H1 x7 d9 u    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!4 Y6 x8 Z9 v; {
; M1 A+ \, P, [! b- _
__________________________________________________________________________
: `, J) L1 p" w6 \  T  ~2 \" C% L9 w9 t: M/ g- @) ?3 ]
Method 13* L' O- }9 O  x0 ]( _1 ?
=========8 ]6 Z  j" v+ v5 [. W

: p4 N9 p" c) T) aNot a real method of detection, but a good way to know if SoftICE is* N$ B3 A6 n- Z% [
installed on a computer and to locate its installation directory.
/ y4 i" q2 h  n5 ZIt is used by few softs which access the following registry keys (usually #2) :
: p; ?& a7 w' \& R- M# a+ {- r
- y8 V! q6 }% q  d-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
4 K9 i6 ~+ n& ~0 ^\Uninstall\SoftICE) }# a0 l2 G6 j- H6 F  ]2 W- N
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE. O) q) L* s5 b/ B# i& Q
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
. b" d5 D- r4 A0 j, S( a\App Paths\Loader32.Exe
, D. d& [6 _5 W/ a( h+ f# S, g+ n8 x: J- I1 X. {: m
" z% _6 A1 X0 {0 n3 h
Note that some nasty apps could then erase all files from SoftICE directory! H/ k. m( R, V$ S8 Z4 l
(I faced that once :-(  d; ^( X. L, g% ?6 h3 [4 {
+ x$ w0 G# E$ z: R, T
Useful breakpoint to detect it:% D3 ^# ^9 g) `
6 f$ ^7 ?' w; l  n
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'% ]3 M" h3 O& {
' X* S2 F" i# _
__________________________________________________________________________
+ [! K/ T+ a3 B: n* z* p! X5 b3 S  L: m; s
' G; O# x: w- l9 n1 n' D* ~* }: p
Method 14 4 x* H* e6 X4 B7 F
=========
5 E& }4 w) D. S* k, F% }$ J! q/ X- ~. [3 |' \$ l) K* u# z
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose- p2 q3 G6 Z/ G
is to determines whether a debugger is running on your system (ring0 only).4 h8 Q* @# z+ I$ D( @5 e. j
( V$ \0 b5 |2 D! }5 |; ^$ C
   VMMCall Test_Debug_Installed+ T; b# i" K7 h3 v4 P. [
   je      not_installed. O2 [6 n% I- F8 ~8 l  g

( x9 l  \( b" t! p1 s" TThis service just checks a flag.; x6 _4 s' o0 L. B8 P  Q
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-8-18 09:22

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表