找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>; t$ O6 A: E- O% _0 z8 B
<TBODY>
% F  v& s& {3 p6 s1 Q4 l' Y<TR>
( r( Y( p3 h) g& ]' Y( c<TD><PRE>Method 01
4 \" G+ T9 h& J" ~' P=========
$ z! @1 Z$ W9 `/ T
8 _, R3 x% ~- w: r) c6 r/ zThis method of detection of SoftICE (as well as the following one) is
# C! d! \0 [& D4 C3 ]used by the majority of packers/encryptors found on Internet.* [, [  q- f; M+ D$ n$ q( }
It seeks the signature of BoundsChecker in SoftICE
0 V+ ^9 _0 ~8 N. j: p
6 t, I$ a$ H* d3 G* N" N    mov     ebp, 04243484Bh        ; 'BCHK'8 U  v- t( n- P
    mov     ax, 04h. R, a6 |9 a1 s9 }) p
    int     3       " m& W" t9 J4 p% p
    cmp     al,4/ C1 N. _% o4 ?. I
    jnz     SoftICE_Detected2 S* E7 g4 j- K- C0 R; Y

! Y7 W5 h8 ]" H0 e( O1 c) o___________________________________________________________________________6 n$ C7 j& R) t3 O: p
8 O  c: @" ]  f( A) `2 n
Method 02! z+ d& l# C5 }, M! X1 E
=========( b* C$ E* `; W7 d6 ^

% _% c3 o) x" fStill a method very much used (perhaps the most frequent one).  It is used
( o, P9 W$ ^9 C- o6 `to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
2 b; Q$ R, C6 Z  }! uor execute SoftICE commands...
" A6 Y0 C5 ~. dIt is also used to crash SoftICE and to force it to execute any commands4 I9 Y* z  Y: D- t
(HBOOT...) :-((  
$ d: @5 m0 x4 M6 Q6 C4 i. o7 m& L7 P9 E# X5 h5 M) {: B* N& c
Here is a quick description:
( M% N! \  B. q-AX = 0910h   (Display string in SIce windows)7 y& t* w- c1 J1 X% u9 h- i/ F
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)8 q0 N9 w  \6 S. Q0 `& I: Z- e
-AX = 0912h   (Get breakpoint infos)6 z; M/ I0 [+ l$ c- g
-AX = 0913h   (Set Sice breakpoints). G! ?( V7 I) f+ \
-AX = 0914h   (Remove SIce breakoints)
2 B) E. s7 N) Q' H3 J
0 }4 |% l0 L) ^1 L* X4 S. ~Each time you'll meet this trick, you'll see:
' G5 c1 S& k, [1 J7 s2 ^-SI = 4647h
" W; l" O& [% y; x- m-DI = 4A4Dh3 p3 d! M( V# L
Which are the 'magic values' used by SoftIce.
( X' V" }9 [! }, P6 a: M7 nFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.8 e& T/ Z$ g# t- k! B2 C9 V$ k
: ]1 z( C/ k) z! w: Q: z) V
Here is one example from the file "Haspinst.exe" which is the dongle HASP2 g9 u, @7 \$ T( S
Envelope utility use to protect DOS applications:& R) C, U2 j  g2 ^. G& s1 p
7 X- K( J' O# T: o7 |+ p5 E. _; K
3 v) B* u6 E1 O  K! [  r+ H
4C19:0095   MOV    AX,0911  ; execute command.1 Y% ~% G# s3 ~* u1 ?
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
( s+ X, r' u" {" W4C19:009A   MOV    SI,4647  ; 1st magic value.5 @, |( W2 I1 U: o# Q
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
+ B4 _  f- D4 [' v  V4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
6 Q* H# J- Q* i& q0 D, L4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
7 j3 {7 m9 b% h& Y+ d9 ]  {' B4C19:00A4   INC    CX
9 p: x7 h6 T& V. `& i0 z1 _4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
$ ^  ^4 }* p5 V) {0 _4C19:00A8   JB     0095     ; 6 different commands.
7 v/ [8 |& f0 w: U" f7 \4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
  D  y# `/ H: O# G  u5 e4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
* \: c' J: J$ S+ E; z7 U- ^% }3 s7 l7 m* W1 P* W! O: t/ A
The program will execute 6 different SIce commands located at ds:dx, which
% Q6 U- V' f* e3 J, C( nare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
- A/ x7 X  K* y- W# g; T
7 S' R; ^. k) }* c; w* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
+ L+ _. v, u7 p9 l___________________________________________________________________________8 y: W) ~2 c  N- l9 f

+ v2 J: E& r2 f2 T. X
7 \/ Q6 G5 G9 g" h: uMethod 03
. i3 U8 [$ G3 K+ F=========% i5 \' `9 o' t0 n+ t# A
) C9 l3 c4 j; s) z: D7 j  ?% C
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h7 f- [0 G: h7 r4 U
(API Get entry point)3 N1 D  P8 Z7 W( b$ B8 P
        2 n0 _& \! O' b; t

6 W% ~8 b1 M) C/ r4 `6 N% _/ K    xor     di,di
0 p/ X/ ], ]2 _9 [! u6 P2 h& X    mov     es,di3 e/ V  w, M! R5 \% }/ b
    mov     ax, 1684h       / J0 I0 {% l1 Z5 x, S8 W5 E' J1 @
    mov     bx, 0202h       ; VxD ID of winice6 b5 {* {) C5 q6 e6 b
    int     2Fh
$ E: v0 \- j, ]4 N, u7 v4 M# P& \8 O    mov     ax, es          ; ES:DI -&gt; VxD API entry point
7 r9 o9 j0 I$ h7 K3 n    add     ax, di
! J/ V% e6 I6 w) h( g/ w    test    ax,ax7 A: J/ ]6 H- ?0 S& S' M& ^; O( j
    jnz     SoftICE_Detected
3 y. V+ w, U, P; l2 M. k3 `
5 W7 O( J8 T7 h) C/ u: I! V& ~0 g___________________________________________________________________________+ t: ?8 O& `' o% w# T" L
' n8 D% K( v' H8 }% |/ _
Method 040 z9 ~6 {# @9 a3 H1 Y: t7 I8 Q
=========
9 G; O2 q! `" ^# H: e/ `" z% b/ W8 b$ f4 K3 W& T  t
Method identical to the preceding one except that it seeks the ID of SoftICE
6 {7 ~# X/ g4 GGFX VxD.8 `/ E9 J7 \' Z* ^% i, U% N" W

7 U2 G. a! x' H; H* M    xor     di,di9 ~. m. }2 Q5 \, Z& W( k
    mov     es,di: t$ _& t+ N% ]$ h" p: U
    mov     ax, 1684h      
( _9 W% P4 Q. E) W* ~    mov     bx, 7a5Fh       ; VxD ID of SIWVID
& n3 ], W2 e% n) J% x& @  q    int     2fh- O6 F# J) C6 w/ o  S
    mov     ax, es          ; ES:DI -&gt; VxD API entry point3 S8 G( A, u' ?) [' s
    add     ax, di
. I4 r$ R, t/ T    test    ax,ax/ y4 t8 F5 ]4 _+ o/ x' W7 w7 a
    jnz     SoftICE_Detected
( }" p4 e' {% ]8 J  d/ ?4 f  P* b* O: j" b5 J9 L$ ]
__________________________________________________________________________
: I8 t8 g& |; w/ I9 r8 {  M; L% C+ }8 U2 |( Z+ Z

9 h* g8 d, k! B, T7 o. j, kMethod 050 ]& Q3 u( m+ u, k+ S
=========
9 `% g4 M- F& r: d7 F" w9 {
$ w6 W5 z+ Z0 |  u# ^5 |3 m# wMethod seeking the 'magic number' 0F386h returned (in ax) by all system
' ]4 A8 |5 b+ u* @: J% E, s9 ddebugger. It calls the int 41h, function 4Fh.. M7 ^- A# [1 L( h* F
There are several alternatives.  
, |. t$ C0 Y/ k% m9 }0 _" @8 K, _% z  ]% Z: B. A3 m' N
The following one is the simplest:# H! [6 n2 \, u  m7 Y3 ^

& t0 l. s+ f6 ?" R" c, p5 I# B8 @    mov     ax,4fh$ \" Y8 u. n3 ?9 t. p8 d% ~
    int     41h1 l& H% r4 ~9 ^' [' |+ J) r
    cmp     ax, 0F386
: Y$ \6 v2 W$ o5 ~" {2 l    jz      SoftICE_detected
+ |) ~% k8 [( z$ j! L1 E. r: q4 A8 o* i4 a5 g9 e
' B6 S; O" n; p/ A/ K& A9 g
Next method as well as the following one are 2 examples from Stone's 2 d4 t' N: E- y7 l9 A1 ?
"stn-wid.zip" (www.cracking.net):
8 Z2 {0 g( H) h
, W7 F! L2 ]8 a& s- F: X' D5 I2 I    mov     bx, cs
9 m) c/ G, d8 e7 R, |9 N$ f    lea     dx, int41handler2
) m* n9 Q6 M6 C+ k, ~' Q4 v    xchg    dx, es:[41h*4]
2 @$ |. j! M' {9 c6 a1 c+ e1 ^" u' Q    xchg    bx, es:[41h*4+2]
8 ~% d9 m2 K- W( n9 R    mov     ax,4fh
- ?+ L/ q3 m. M% B3 H. G3 ~4 H2 `    int     41h
2 G) _& q& v% `( x+ h! k. c' C    xchg    dx, es:[41h*4]4 R4 ~9 N$ |, o2 j
    xchg    bx, es:[41h*4+2]
: ^& h4 \) f9 T. f    cmp     ax, 0f386h! F4 O! H' V1 _( [( K
    jz      SoftICE_detected" z1 A$ r" [& K- u+ U1 b" |

" G2 }# a" X& h4 hint41handler2 PROC
  Q4 j3 z2 t3 p% d0 \/ t/ H8 r' M    iret
. o' x1 w4 I3 Y3 S" Q8 Mint41handler2 ENDP
) D% M/ P. y- u$ ]  N# _, a4 m0 h4 s* D2 L

5 g! ]0 n4 z. G& Z1 X0 {7 i; ]' G_________________________________________________________________________
2 `) W! q- T+ f  P1 |6 a
. i# i  s' K; U, S: o, J4 O) S/ X& S" I. G: w- a/ q7 a/ _
Method 06& G) g3 L1 R7 g
=========
( e( y, j0 H# v* z( W8 K# S' r5 n- l; O- L
& }8 `2 |/ \- P3 {- v
2nd method similar to the preceding one but more difficult to detect:
, S1 K6 B7 q, n( m
! S- ^" ~  J% L% g' K) Q
) p) I$ G% {" t5 t+ D: cint41handler PROC
7 f; K6 r4 a( y9 o3 X, c    mov     cl,al
" S( D) h8 z' R8 ^    iret# @0 q% A+ n" p. C( I) C$ ~6 A
int41handler ENDP2 U# o6 H' ]  D- ~( a
! T. M5 g& \. Q& y) \
; h9 j/ g' Z3 I
    xor     ax,ax
3 q3 G2 F7 M) @9 S: f2 i    mov     es,ax
  w. F  C: }. Q. I3 f4 T' L    mov     bx, cs& l% K% q& N$ r! H8 R- t' ^
    lea     dx, int41handler8 I6 f0 ~* A8 M  w/ e
    xchg    dx, es:[41h*4]
  q- {  M: @7 \# G6 X. Q$ L    xchg    bx, es:[41h*4+2]7 U3 h  S1 ]) G. d
    in      al, 40h- Y4 Q9 ~; D, G3 G% \% v% M) o+ c) Y: x- C
    xor     cx,cx
+ \: f( N* I4 g- A8 x) ]3 ?    int     41h+ e- Q; y0 ^+ O) _
    xchg    dx, es:[41h*4]; ?, x- X$ G: M4 l; ?# p
    xchg    bx, es:[41h*4+2]( J( X" j+ Q' Q, H9 S& c
    cmp     cl,al
% J7 k6 \7 N7 S7 n8 I    jnz     SoftICE_detected
2 s5 w. E% r. O$ R  a& e6 Q/ \! {6 E; Q( _1 Y$ z# ^
_________________________________________________________________________
- x5 d& k6 n& F  l: U4 {' r
; X2 S% U  p1 A7 G8 S2 TMethod 07; J# X! e1 J' Z) [! H8 o
=========9 M2 O# W; F; @  J! l- E; z

, \# _9 R' h6 z' p4 n: @% D! lMethod of detection of the WinICE handler in the int68h (V86)
8 @# u$ f* j; E% K
; d) q7 d& Z& b& j% u4 y* G    mov     ah,43h
! V& K4 D! U$ b$ s9 t    int     68h
; `5 R% J9 ]" }$ I    cmp     ax,0F386h
4 h: f) Z  v$ s7 U    jz      SoftICE_Detected
2 l* m$ S, r0 J% E7 P
# K* ^1 B0 a( E' }" w+ q, V9 j" k6 ~1 S/ \& T; E4 {* R6 T, S- H
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
: X+ X2 }+ b. ~: H% N" i9 X' `   app like this:5 F+ x$ ]8 B$ Q4 [
, U/ P. C; J0 W2 x. V3 B% B+ W
   BPX exec_int if ax==68
: k, D- C9 n, T$ Y   (function called is located at byte ptr [ebp+1Dh] and client eip is
$ u# V$ V1 h* v/ R# G2 i   located at [ebp+48h] for 32Bit apps)! E$ O& {6 X4 }" ]6 t7 b8 N1 l9 p/ f
__________________________________________________________________________
& T7 N2 ?2 j- q+ ^4 @1 ^% S& D3 F( J9 c( _2 ?, C

! R0 c: O+ r/ r4 ^Method 085 |4 ^0 G. _" n! B- ^
=========% b- P9 H; x: t; f
! k# E. j+ _% a8 `4 q. Z8 p
It is not a method of detection of SoftICE but a possibility to crash the
; N6 {5 B% X) @' X8 vsystem by intercepting int 01h and int 03h and redirecting them to another) S; _# b2 g: L. Y
routine.5 ^, o/ D" \: X; Q
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points7 K! k1 M3 |, J
to the new routine to execute (hangs computer...)4 D( t9 C7 X8 [' }, n
! r9 r  o; q  ]* @
    mov     ah, 25h
! @9 F0 }9 o8 _. k7 e0 V    mov     al, Int_Number (01h or 03h)
: m: B9 P" ~9 M; {, d( Q    mov     dx, offset New_Int_Routine
& u5 @& h7 i+ K/ g    int     21h# w( C% |7 z: z) w7 U7 U

, O# y) |7 Z: `6 Y0 `) ?; K__________________________________________________________________________
: n8 s6 B* p) `% M- H' {  S
) }; b# @+ C- p5 D! |3 AMethod 09
& B, |3 w9 v# l; R8 f; o=========; [4 M: E* W5 ~0 t8 V1 @
+ n4 M" Y" h( H0 J7 w
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
1 H9 l9 ~8 D% `) Dperformed in ring0 (VxD or a ring3 app using the VxdCall).% k+ p( X5 w9 I( l& y' l& \% b
The Get_DDB service is used to determine whether or not a VxD is installed
5 M1 v0 d' j4 S0 w, l/ W, Jfor the specified device and returns a Device Description Block (in ecx) for. W5 w" B$ Z, ~- g' H
that device if it is installed.. v! W% K5 q* l% R& ~2 M! `" |

6 ~& Z: t6 b  [, E0 |  T   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
4 |1 U4 _; D4 U0 e   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
5 J$ o- p, S9 ]& Y6 p/ U- F   VMMCall Get_DDB
& d, }" \) n" P9 N- f   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed1 {8 ?1 @4 `. C7 E

) n6 k. c& c8 M  f0 o2 L# v( _8 Z5 uNote as well that you can easily detect this method with SoftICE:0 S! R$ c# `2 B9 }( J" k$ _. l! V
   bpx Get_DDB if ax==0202 || ax==7a5fh
' `. V# R0 D  V+ Z# J6 N3 _/ I  p& l- k* y
__________________________________________________________________________8 s& ~. l8 M, u! N; v% N/ J! P* [

7 f( y, u+ ?( g4 SMethod 10! A. b+ A/ w- b6 s! T* d
=========
$ i# B6 l% O; E& {
( Z7 `, Z# w6 d" }=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
1 H' ^" q% [2 M# W  SoftICE while the option is enable!!
$ q5 m  c' s$ _% L( |8 ~
: J5 K  i* O) cThis trick is very efficient:
8 s. `! l0 P% s/ {by checking the Debug Registers, you can detect if SoftICE is loaded: I1 M6 e' [- D
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
' U  V/ _$ n# n. P7 p5 L0 c! c# {there are some memory breakpoints set (dr0 to dr3) simply by reading their& Q2 H7 p! C/ j' L! X1 \$ G) m
value (in ring0 only). Values can be manipulated and or changed as well) ]- A8 o  K- P
(clearing BPMs for instance)
4 X2 M+ E8 w& }$ Q0 p7 ~
  H2 ^4 E5 N$ o  U2 U* `+ L__________________________________________________________________________* y# h& i7 I# r  F

$ X2 S3 |- l( l0 X. [8 T: D) FMethod 11
/ {: D, c7 B/ }- ^3 N; l=========
4 Z( ?, S# @. F
- L& S+ Q. y, {+ v$ }" yThis method is most known as 'MeltICE' because it has been freely distributed
" T6 Q1 Z+ U4 z7 C. {via www.winfiles.com. However it was first used by NuMega people to allow
; [  M! U8 {9 v: g4 `. [8 J! \Symbol Loader to check if SoftICE was active or not (the code is located; B9 E7 O) H+ B0 v, |7 I
inside nmtrans.dll).; d0 E1 S2 e8 D6 a( O  b
/ o) O+ o5 n  E4 A0 S- \9 I
The way it works is very simple:& L; c  N# l- c' d4 h
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for' o- C. s. ~" _* h' M( T$ ^
WinNT) with the CreateFileA API.; r% N: t0 R; N; p
7 x5 D  S. H6 h. T  K
Here is a sample (checking for 'SICE'):) p# W" a+ s4 q) e9 E3 T$ C3 k9 }
4 r% F" P9 o, a, \: N4 m
BOOL IsSoftIce95Loaded()6 z% T5 z8 `4 T7 d  d0 z
{
) v6 t7 j; X$ @4 Z( J   HANDLE hFile;  
1 b# S* j) N  j2 u8 T! U) |   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
( P# I) H/ {0 _! v! ?8 B                      FILE_SHARE_READ | FILE_SHARE_WRITE,$ H6 m/ R, G; @. J3 d. ?2 ~
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);* F  `. x) \+ {0 N  }$ S
   if( hFile != INVALID_HANDLE_VALUE ). H- M. \0 B& l$ Z5 ^$ q# C) Y
   {$ e, L- L9 B; o0 U! y; D0 ^3 z
      CloseHandle(hFile);! t' N( p0 P/ x; c
      return TRUE;
) D$ S" l* C1 a( z" c   }
/ ^1 T6 t: m3 g% ?   return FALSE;$ B0 S# K9 Z9 E+ X7 i8 [( R, _) V
}: J! a, r! b! l! Y7 g3 t

% I4 ^  g* w( c& SAlthough this trick calls the CreateFileA function, don't even expect to be* T: z; B  W9 ~. t8 c5 O# E6 R
able to intercept it by installing a IFS hook: it will not work, no way!+ j( |3 v* g8 [' Z- [/ M7 R
In fact, after the call to CreateFileA it will get through VWIN32 0x001F  g: P( |' C6 Q$ R3 O$ v, c: T' g% }# @
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
) j  }$ q$ z+ [$ I# M6 Band then browse the DDB list until it find the VxD and its DDB_Control_Proc
0 J1 [, `) V& H) Pfield.
1 \, P* `$ d4 f7 d8 |In fact, its purpose is not to load/unload VxDs but only to send a
+ B  c% a: U  k) l7 o( j' T, CW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
/ {. F! X' p7 t; O5 }to the VxD Control_Dispatch proc (how the hell a shareware soft could try; G! P: u1 l0 C4 S* p
to load/unload a non-dynamically loadable driver such as SoftICE ;-)., k$ Z; g# ~: t& t  j
If the VxD is loaded, it will always clear eax and the Carry flag to allow
" u  _, C# v7 h6 I' `its handle to be opened and then, will be detected.* h$ ?. \; E8 {9 u$ n9 T, a3 n6 |; D
You can check that simply by hooking Winice.exe control proc entry point1 U, b  r$ I+ b
while running MeltICE.
  e5 J/ ^: O' i6 |+ R+ F' W/ A+ Z+ h1 x6 _2 f

9 u! X! N8 {6 Z4 |& ^1 i  00401067:  push      00402025    ; \\.\SICE0 M! Y! M* s' a; Y; D- {
  0040106C:  call      CreateFileA
8 @, P8 ?% I/ h6 g. [  00401071:  cmp       eax,-001
( U% z) E+ U) w3 R6 i. I/ _  00401074:  je        00401091
9 c5 I2 A1 W; t" s' g& `
) Y" S, W. P4 b. {, h7 k
! {- B/ G4 l0 i& |There could be hundreds of BPX you could use to detect this trick.# w7 u( f2 j/ h6 N3 u6 O3 X
-The most classical one is:
6 I7 [$ s7 H! o7 ?% P9 `: C, r  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
% d; W& y. O  [- {    *(esp-&gt;4+4)=='NTIC'& e5 I: [& {, e
- m$ [: E3 d8 n' i: K/ f3 a* o5 q
-The most exotic ones (could be very slooooow :-(
& [0 O0 u% X; L1 g/ G   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  0 U) ~* u4 Z7 Q! f
     ;will break 3 times :-(
  X' M% p5 @. i5 Y$ i' S) A2 C3 x2 S7 l% g+ |
-or (a bit) faster: 1 Z# Q$ t" A% w9 N
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')7 [8 l% k5 Z# R! M9 y

0 \1 e6 ~, M9 z   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  ) w+ k0 N: c, e/ \6 A. I6 z
     ;will break 3 times :-(  \* A0 j; A- n0 Q
% D& q' x9 _4 j+ a$ z' V
-Much faster:; `7 Q: E: d" B& v$ R
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
8 O& T8 Y( A3 M$ ~/ u6 \, O; L' `4 N' S+ [. \' y, Q& u0 w2 O! k) O
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen8 Q  y  M% {: Q, e
function to do the same job:  _& W% k& M+ k5 p* m* G

) y8 _! _  M. K: e& e/ L6 D   push    00                        ; OF_READ
, K3 Z9 P8 `+ p) m. S6 x   mov     eax,[00656634]            ; '\\.\SICE',0; D( r9 G! @8 N" G( [: p! o% {
   push    eax6 t5 s( r& E$ U" Y
   call    KERNEL32!_lopen; P- B* o, g. E2 H: \) X
   inc     eax
1 F% {& S% L0 D" S7 g7 z8 p   jnz     00650589                  ; detected# Y0 j+ U7 Q& G( r
   push    00                        ; OF_READ
) A# g7 [# Y% S( e( _   mov     eax,[00656638]            ; '\\.\SICE'& d" Q1 c0 m) @$ D1 T
   push    eax9 t2 s3 {5 y( S- y+ e) G  P5 e
   call    KERNEL32!_lopen3 a* Q- d. h' Z$ I0 E  ?- a
   inc     eax9 k, v- N+ K% ]. a) W9 h( T
   jz      006505ae                  ; not detected" e4 U0 W: ^2 G8 O- k* q/ P: m. U

: C+ w# ]; M% T9 S$ n* W3 X( I
7 \9 l/ U8 e. x. G1 |__________________________________________________________________________9 R9 l, O6 x/ Z$ b6 `

: v. ?5 W! d! J- E( pMethod 12
  \& h' E- Z# J0 H: ?' X=========
$ Y! \$ P* s9 d1 f% |& _
7 ?8 A0 j5 m5 o# N! e0 p' h* O5 JThis trick is similar to int41h/4fh Debugger installation check (code 056 v& I3 ?8 L2 f5 ?& q9 D' R2 U
&amp; 06) but very limited because it's only available for Win95/98 (not NT)3 R. [9 v* L+ G- f! O( S
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
! y7 c- K4 [9 T; d
/ O2 z+ e0 l- [* l: T2 p' t   push  0000004fh         ; function 4fh. C6 }: T8 u1 N3 m! T
   push  002a002ah         ; high word specifies which VxD (VWIN32)
4 O& ^- p, h. U9 M6 A. e7 F                           ; low word specifies which service
6 |; d  T" S7 x+ y                             (VWIN32_Int41Dispatch)
3 B8 j# `2 s, H! a   call  Kernel32!ORD_001  ; VxdCall; D0 }$ d6 m- n8 e6 s1 u) @
   cmp   ax, 0f386h        ; magic number returned by system debuggers% w" _3 F0 |  T+ ~# s
   jz    SoftICE_detected
9 O6 q, i4 K) N* G& O( j( e" s/ v! m' L
Here again, several ways to detect it:
& K5 {( ?2 b3 e- P  d6 `* h6 M
7 c5 z$ |. n4 c, f& e3 n    BPINT 41 if ax==4f, B6 j, t- g! a8 W
+ A5 W0 {1 L" r  E8 w6 T
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one  L+ i3 r6 P7 z# L+ R! i
0 w% {7 g- T7 W* V) B
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
" B! [: U: f2 y9 A7 V% e. d4 t5 S- d$ `# N9 |5 d9 n# L0 b
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!* a/ Y0 e" M6 G
1 T% `  E) |& k( k  ]
__________________________________________________________________________
  d0 z8 b# B+ d* f) ?! H, C% K! p( r+ r# f1 S) H
Method 13+ T# p' n# C9 w$ q$ o2 k8 u
=========
! |: I; A# s* _& P; B3 b- f$ F2 v& ~, `* A) g; o( G6 I
Not a real method of detection, but a good way to know if SoftICE is4 C/ T! @7 ]) l
installed on a computer and to locate its installation directory.
* q9 D. o0 N- C* m- Y% W3 ~+ i& F9 UIt is used by few softs which access the following registry keys (usually #2) :
1 _% Q3 D( w% `9 v, \* w
2 Y+ {" M6 |+ L; O# l. _-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
! i5 B7 H1 A" H1 k( S) s& Y1 l\Uninstall\SoftICE
- r6 D0 X5 A5 b9 O: r-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE% ~/ c2 m+ s$ S- j  l2 r: ]( T
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion& }+ x+ y8 h( ]/ d8 p, {
\App Paths\Loader32.Exe
* v& e) \" G2 u2 W+ e4 F3 i
, i" _; f! [- ]
% M! g9 N$ h; q9 ?Note that some nasty apps could then erase all files from SoftICE directory
3 I  E& H# [% w- L( y(I faced that once :-(
9 r, y9 X& }  ~+ f# r* G! B' ~) M3 P
Useful breakpoint to detect it:
' n* }+ y  R3 c4 v: y, {7 r. g& @* j( U0 w7 h6 j+ ]' p/ U
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'" n& c4 N% t3 z0 |% v' ?6 _
/ w$ }% ^0 Q3 z: U& n* u5 [4 r. B- l
__________________________________________________________________________9 k- W: J3 R+ t: H: z; g+ }) Q

6 H2 ]3 g( O$ [
+ W+ |/ ~7 U; q$ j$ Q' }" ?Method 14 6 r5 u- J6 R+ r: ?7 o5 h: e
=========
5 c+ d1 k* N# a6 ?
6 Y, N2 B& |) i" R: ^2 }8 ZA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose! [( A& C  }: n9 l8 x, K) l
is to determines whether a debugger is running on your system (ring0 only).. T, z! k: e  O
" m: u5 e+ e6 ~
   VMMCall Test_Debug_Installed
5 V7 }5 A5 w! E   je      not_installed
5 Z: ^9 \3 q+ k7 h% G/ F: }- c$ L8 s  \' K& K! A! p
This service just checks a flag.
9 }- T; h9 |$ |  R& q& o( h% `! U</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-8-1 17:54

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表