About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>9 F( [- K. y) ~0 T' s& `% O( h/ T% G* ]
<TBODY>
( g# X% T2 g3 l9 A7 f<TR>; z- O' y6 s: F0 P! r) @
<TD><PRE>Method 01 ; u% H9 P5 x  o: d& r2 J
=========
" T7 ^: X. R* l/ [9 B  Q: o
# ?* q( @2 c: D; @8 `0 SThis method of detection of SoftICE (as well as the following one) is
2 I+ m( @7 J. n5 T7 Cused by the majority of packers/encryptors found on Internet.
5 E, g9 z. X2 e& L. V) H9 KIt seeks the signature of BoundsChecker in SoftICE
4 Q0 A- @5 `% [! l6 n0 v. A5 M' ^7 h" v$ ~; s, R
    mov     ebp, 04243484Bh        ; 'BCHK'# d9 o$ w8 H- u) ^
    mov     ax, 04h& N: o4 x9 t" v! v  N( h
    int     3      
- V% }% `# C- i, v9 L, R    cmp     al,42 ]: d: [2 M7 n- L; S' U4 s# u
    jnz     SoftICE_Detected
% ]" v1 e9 S$ J8 v' B7 r9 F
3 W2 N$ w" y  j9 {4 F6 |& @0 [8 o___________________________________________________________________________  _$ b+ V0 L& i) _8 |+ y

4 l" X+ ~- u4 wMethod 02
7 T/ F9 W6 a# M0 ?=========2 ~5 f2 P; m& ^1 [' l( m
5 u# L' u& r2 t' a, W6 g
Still a method very much used (perhaps the most frequent one).  It is used
, M1 f% k( R9 n6 Uto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
# c0 S) k) B# ]+ u6 gor execute SoftICE commands...
! r; \% X8 `9 {  q( m5 y, rIt is also used to crash SoftICE and to force it to execute any commands
/ ?1 T) H8 P$ o6 o, e6 h" }$ N7 X(HBOOT...) :-((  : }+ k% j: U2 g: z" m( S, K

9 X; i  u+ y$ c6 fHere is a quick description:
8 }0 J; ?  \, g5 J% N7 u-AX = 0910h   (Display string in SIce windows)* D  h9 C9 M* u0 s
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx); S8 x2 U6 u: o" l" M  }. s: R
-AX = 0912h   (Get breakpoint infos)
! f7 r" T- w7 ]0 w3 i-AX = 0913h   (Set Sice breakpoints)
# a; T0 m- B9 G8 j' Q% e-AX = 0914h   (Remove SIce breakoints)
, Q( y! L4 t( Z- v& y5 G
& d* x: }0 q1 K5 rEach time you'll meet this trick, you'll see:
/ A0 t) A0 i* {' x' U/ R' k-SI = 4647h
- f6 ?$ F; q: h  W-DI = 4A4Dh
4 n- @/ j2 |" a0 xWhich are the 'magic values' used by SoftIce.5 r  j# ]9 s' m7 _( r
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.0 q- l! z. m* w  d2 K
2 ?9 c" A- a. Q# |( d! u  O
Here is one example from the file "Haspinst.exe" which is the dongle HASP: {) R4 @, u! A7 O: }
Envelope utility use to protect DOS applications:- q; [; D: P3 l' V' g
" Y- ~- y% V  s1 s$ F5 u

; }& r; q! R; w4 p4C19:0095   MOV    AX,0911  ; execute command.
0 n. b, c$ m8 Z/ n& R9 p" U( c4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).: o' |3 I: q8 V! s/ L
4C19:009A   MOV    SI,4647  ; 1st magic value.
4 ?! J0 \  l6 [2 d- P! `5 P" C. u6 e0 ^4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
8 r+ v0 s7 [  b; r' p7 W4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)1 m8 S9 X9 D" o# O# W! Y
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute/ }& e  J- `. H, J
4C19:00A4   INC    CX
+ `" |. Z9 u7 M& `4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
4 |1 B  \3 _: s! h0 a& k  _( U4C19:00A8   JB     0095     ; 6 different commands.% L6 `8 E9 k- Y7 B2 C! F
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
) u$ t9 u! I5 r4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)* Y7 X! {. W/ N" j
. R9 z% @( X) w
The program will execute 6 different SIce commands located at ds:dx, which
+ R  N0 r. x; a! D6 N( Uare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
6 f" m$ B" j, r8 Q/ [4 [$ ]  C8 @+ {. r% J
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.( R0 R, P* n/ B  r
___________________________________________________________________________- n8 @" |% u" M; Q3 P# Q

$ x8 u5 A9 V: [  F# p# {4 k/ c7 w9 b: d8 n! Q4 C* M9 a
Method 039 x# j0 B9 z9 }  x' V
=========5 g: ~) r) X" v, Y3 D

, A/ F6 H. X( G3 oLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
# ]$ g( ?- u. C8 Z# r7 Q7 u! `(API Get entry point)
' k1 ?0 j& D0 r' `. W        " g0 i0 `' f: Z$ F" p- B

  v0 {* P7 N9 p! v    xor     di,di
/ a/ Q  z( x1 X4 y$ U    mov     es,di
/ ~0 k5 K; s: Z, F5 A    mov     ax, 1684h       # A7 Y4 s  j0 i; P
    mov     bx, 0202h       ; VxD ID of winice
) [2 i* ^0 z6 v& E" Y& b    int     2Fh
/ W+ T1 a2 Y5 Y5 l& E3 _    mov     ax, es          ; ES:DI -&gt; VxD API entry point
: e( x: ^& v( F5 n# R" T+ O6 t, o    add     ax, di/ d- y; m/ S" X. {( h; w( H
    test    ax,ax# G, _* }& f0 k. y
    jnz     SoftICE_Detected: O' G. P! b0 P2 q  l
0 x3 U9 m. i% m: }" }
___________________________________________________________________________
! _3 r7 D. h/ D) y0 z; E( p( P. s9 U- P4 f+ v" u. Z
Method 04
" Q& ^2 T, T# k' E=========" [8 W( L1 \/ I4 t, J/ E7 A

. }, o" X9 S9 V2 \  D2 N" T8 JMethod identical to the preceding one except that it seeks the ID of SoftICE
' {  d9 a/ s, q% X, JGFX VxD./ g3 S" N$ k' g# [9 D

7 T( N( K. z1 f! l    xor     di,di
/ x) O# f% t# T; p) [    mov     es,di+ Q) c) B7 z$ F* z. b. d
    mov     ax, 1684h       " s, o) j: A. A$ ^5 ]! z
    mov     bx, 7a5Fh       ; VxD ID of SIWVID0 }/ D' C/ Y* U9 ?; |( L# c
    int     2fh) J9 a; @! J, H8 g5 E2 `! q) ]& Q
    mov     ax, es          ; ES:DI -&gt; VxD API entry point. ~- K; F+ Y. K! V& t
    add     ax, di
. a  f# E9 R. J9 H" ~: f1 N, T. c    test    ax,ax
8 S5 R/ A" K1 T- m& K6 j    jnz     SoftICE_Detected
+ C- @! M1 l  A& N, E/ D- A( v1 O3 r/ |" a* B
__________________________________________________________________________
$ |4 p- G7 |5 S( N* ^4 j
$ \# ?: F" w# Q; N, q6 ^0 t! ]! \
7 K& x/ |: }6 T5 d8 Y3 D; [& tMethod 050 k* c* J2 ~+ ~, ]5 W8 h3 L  D
=========  ?% w4 t; v0 c0 |* A* o6 y& Y
. M) n. A" x% g+ }
Method seeking the 'magic number' 0F386h returned (in ax) by all system
/ Q5 [" _& L4 y; P1 _& `5 ]debugger. It calls the int 41h, function 4Fh.
, Q- h# K! l9 nThere are several alternatives.  0 J; Z# L- p& R9 m+ [
4 v2 |9 d7 B7 G' H6 e, @
The following one is the simplest:
! r% i% F' t4 c
! E- S6 {4 L9 C; o5 }( A    mov     ax,4fh
; g3 j. Z5 y$ g    int     41h" a6 [3 C& i6 ?. Y; d2 _- a
    cmp     ax, 0F386
& ]. V- l0 l% V7 D9 M/ T    jz      SoftICE_detected
( r' `( A" c& D9 G8 C; E$ [' ^
6 M+ T! J" V4 j7 l3 t' ?6 Z6 b+ ^) d% D, L% Z3 I
Next method as well as the following one are 2 examples from Stone's
! C" ?5 [0 \. m, a1 P6 a- k"stn-wid.zip" (www.cracking.net):
+ l( F2 p0 R- L! Q8 ?9 ]2 J* k- X, m0 W$ O& d$ W& q# K3 a
    mov     bx, cs
; F; }" j1 k7 G& D. G. {' \    lea     dx, int41handler2
# ]& E& O1 Q8 b2 ?9 @. i7 _    xchg    dx, es:[41h*4]1 T5 y( L( X; i
    xchg    bx, es:[41h*4+2]
, N( k. e) Q: y    mov     ax,4fh4 B9 |4 P4 _" r% V
    int     41h
- R9 K& L6 r, q3 N6 h    xchg    dx, es:[41h*4]
, W; Q# |9 T! G- i" h( p    xchg    bx, es:[41h*4+2]
1 j- w" s7 E; V9 r/ P. \    cmp     ax, 0f386h
8 q0 \: z5 E9 b( v  a7 T6 R$ ~    jz      SoftICE_detected
1 }+ s* R& N! ]0 ?3 L0 E& T7 j: P# i: m; Q( I
int41handler2 PROC  }3 O7 s) }. j4 t4 }. a
    iret
& B7 n! x( R8 D7 [, Q' j# D0 Bint41handler2 ENDP5 V4 ?$ w4 y% l4 e7 z. V2 G5 g
: _6 \6 y9 M  m# k
' t- T) ?$ d6 ~! t2 y  j( r$ v' m
_________________________________________________________________________5 l$ p% {- e0 ]" \. M
/ x* e3 \4 k% ~% u
& }3 ?3 w9 F, {6 w7 s
Method 06
: e  g" }5 K) j, m/ ~=========
! o- g7 \9 C- a# M
0 b, p6 b9 g# v. d- W7 p1 I' c% m" ^, F
2nd method similar to the preceding one but more difficult to detect:
5 h) n  ^3 d$ d  m; @. K6 R3 N% a
7 e0 F$ [- [7 c" d; ?6 @2 u; `& e$ @+ k
int41handler PROC
3 l* s) G6 h: [" k. b. I* j    mov     cl,al
/ ~+ Q& o' T* o1 Z; B    iret
9 s! q. e8 l9 \7 o+ Gint41handler ENDP! h( M2 w* O9 f

! [# n4 |- T  O! e$ R
' N0 n+ Y1 I& J    xor     ax,ax
# w3 \4 f+ q6 q2 V( W    mov     es,ax
1 ]% `0 R1 Q( }* i( ^. ^    mov     bx, cs+ l& Q; ]+ \# Q! R
    lea     dx, int41handler9 Y$ ^  N/ H: Q
    xchg    dx, es:[41h*4]
! B) Y$ {1 J) T+ d' s    xchg    bx, es:[41h*4+2]6 O: `1 l6 s: a4 N) E
    in      al, 40h
# C" f$ L9 A2 {( u    xor     cx,cx
7 I+ A) `8 Y! J2 V& [    int     41h
% m# I6 n$ A& n" Z3 m. N- e  H    xchg    dx, es:[41h*4]
. v1 Q/ \9 S$ R8 a0 W9 L    xchg    bx, es:[41h*4+2]
5 G! C/ U/ d; q/ Z, E    cmp     cl,al
. q0 @7 ~% i+ d" i    jnz     SoftICE_detected+ _2 w2 K. y" W% b: H
: a6 A" ^, O7 c7 |
_________________________________________________________________________
8 K" E4 ^. M" O/ j0 K7 w
: H( _& C: A) Z6 sMethod 07
4 ^0 w" F* g" U: v) [, I0 G$ Y=========
, A' k- H+ _8 ~6 f3 A$ V
9 v+ Q" Z, U; [3 w# kMethod of detection of the WinICE handler in the int68h (V86), I& U% z# x. P
: c# F) @8 D7 b
    mov     ah,43h' `# I1 P/ J6 t( p
    int     68h, W7 E4 g8 t+ r* p
    cmp     ax,0F386h
% k& M  R9 f' Q6 P: l7 W3 \    jz      SoftICE_Detected
1 T' H: N5 Y# C4 B* j5 C7 ]/ ^3 D( Z

9 b+ `, o: ]- ]: |. U' c8 M=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
3 L. X9 S% K1 M- H% c% W2 d# S) `  D1 M6 Z   app like this:" J6 j* I4 c' [% O# H  U+ W  V/ y
8 ]5 {, g7 j; L/ `6 p  q- a  y
   BPX exec_int if ax==68, p2 n7 O' W2 Y& _; e9 c
   (function called is located at byte ptr [ebp+1Dh] and client eip is1 \( g: s6 T5 ~4 }" k
   located at [ebp+48h] for 32Bit apps)4 c7 B4 C8 b2 i- m+ u9 ]
__________________________________________________________________________
4 ^; y+ s" r1 m  A. ^9 p4 W# S$ z* |. g" P( @# N
# |' ]# \% _. l
Method 08! P/ y% `7 N) v% d  }# K( ^
=========
2 J0 X0 a& G% U  {" T/ A( P  o3 f4 C
It is not a method of detection of SoftICE but a possibility to crash the/ z7 H( |( l9 q7 p! n! e
system by intercepting int 01h and int 03h and redirecting them to another
4 f, P3 T7 F/ I2 a+ kroutine.
7 g' G( }. @9 I$ P% @( AIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
: H( f9 l$ f8 ~1 P4 W7 W6 F4 B+ ^to the new routine to execute (hangs computer...)! E: B: f/ S* c+ E
" X- W5 m& b# n. i
    mov     ah, 25h
% S7 H4 b, l( l! F. |    mov     al, Int_Number (01h or 03h)
# X! P* x$ H( Y- x    mov     dx, offset New_Int_Routine
% Y9 M4 W, [& a( v& f  ^    int     21h' s' X7 G6 @/ T# M# H+ U( j: N

5 P/ L( j/ j7 Z8 y4 p  X__________________________________________________________________________
; {$ E$ ^6 m9 V' v7 F; b$ n' ?) D4 j" Q* m" Y- c/ T/ C: I
Method 09
' l- F- o9 G4 a, t=========
  X% T8 _' C* d9 k" [9 ?: c6 o$ m3 r# u7 {
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
. ?7 S' {3 M' J( k- E9 Y9 x* a4 Yperformed in ring0 (VxD or a ring3 app using the VxdCall).
; L; a3 J, i$ P# L) [The Get_DDB service is used to determine whether or not a VxD is installed
' \+ `# [  c$ Afor the specified device and returns a Device Description Block (in ecx) for1 B# P5 f( q* K2 ?" s
that device if it is installed./ n% p9 {* p( q; S) \

0 t0 I9 L0 D. \; [* l! b) s) l   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
8 v0 h9 _6 `) Y5 G% p   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
8 N# _! d6 E2 b) i. @) B   VMMCall Get_DDB
" W; g9 F' c4 a: n2 X- z   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
9 N8 k0 N: q: {" v" t. B: i# W
7 u, a( @1 C( z: [- {- H: F* cNote as well that you can easily detect this method with SoftICE:
; N" B7 B* H$ [1 M* ~   bpx Get_DDB if ax==0202 || ax==7a5fh
6 b$ s: x6 D- V$ q+ h2 o2 E/ E! k& v4 ~
__________________________________________________________________________
  r$ @+ }; z2 `, H% C/ ], O3 A7 H! F2 L1 j9 X7 h
Method 10
& {# H' q0 ]2 `9 e$ u" F=========
& m: A& ^+ z. s( C; L) u8 q1 ]1 q3 r9 `7 X( V
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with0 [9 z% w" ?# f3 x
  SoftICE while the option is enable!!7 `7 c9 v6 b: X

/ I2 P, Y- Q- O1 v9 YThis trick is very efficient:4 y* R  A7 o( o! L6 w
by checking the Debug Registers, you can detect if SoftICE is loaded' [) H( D8 ^7 U! r+ o: a& M: M
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
" Z+ C# ^* A& B# l& {6 Bthere are some memory breakpoints set (dr0 to dr3) simply by reading their
0 E; i. S  \% I" e* v- ^value (in ring0 only). Values can be manipulated and or changed as well
' i/ }9 T. F8 s( q  e- o(clearing BPMs for instance)
' B- S7 m" g, L. H0 _+ w" w# P3 J, \. e$ N# {
__________________________________________________________________________' q  T; t9 a1 h
7 n. z$ m& k: p  m, i, }, s; w
Method 113 Q& J2 C1 B. L9 r* v( v* L
=========
/ A/ u) q5 W' }* Y1 s& L4 M: i% e( }* N, G
This method is most known as 'MeltICE' because it has been freely distributed
/ N$ H& U! d( D+ p) K/ V2 \via www.winfiles.com. However it was first used by NuMega people to allow5 f' z/ S, a  n) I/ a! Y
Symbol Loader to check if SoftICE was active or not (the code is located1 j2 F/ Z* {0 S: ]+ m# G. f
inside nmtrans.dll).$ `, B7 K3 b! v5 T6 i2 S' d

$ r3 A  Y+ a% F- _The way it works is very simple:/ J, X7 d3 l. h
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for% A  J! r/ Y7 G4 V
WinNT) with the CreateFileA API.
& ?  ?8 ]% ?7 n4 ?7 Z+ u
& ]! Y* w0 w: K% U! N: l; Q7 J" NHere is a sample (checking for 'SICE'):
, ^+ e5 J8 s( x4 k% T% [! a0 j
) `+ p/ G! a' W! vBOOL IsSoftIce95Loaded()
; P- E( |) m- q4 Z. @/ |4 K{7 v: x* A0 ]( H3 k2 T* ~
   HANDLE hFile;  1 t2 N' @+ q# m* p
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
! \' u6 a, M8 d  z: e( c& x9 w                      FILE_SHARE_READ | FILE_SHARE_WRITE,
0 f! G3 `+ U1 F/ f8 p6 |                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);* g% u4 R+ H+ A0 G- \8 |6 C; @
   if( hFile != INVALID_HANDLE_VALUE ). S+ z& H3 F9 X. s* |- n, \1 O
   {
, K; X4 ]8 W! R0 m$ M3 l+ B& g      CloseHandle(hFile);
. P) h5 W2 G5 T      return TRUE;
: B+ h% {' m. j# [   }
3 g3 `& K, \3 i  s! K2 ~! A+ ~   return FALSE;
+ d9 ]& l# M, Q& t' l, e( F}
' X# p1 |+ F: `; S
* _' d/ r" v2 c# T+ k" M4 Z! }Although this trick calls the CreateFileA function, don't even expect to be
" ?* R; P* B. d$ U, S% ]! sable to intercept it by installing a IFS hook: it will not work, no way!
" [, B+ f6 f- M) ?In fact, after the call to CreateFileA it will get through VWIN32 0x001F' x7 K5 M0 f' N$ _: m# E: t" {; O9 h
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
; W+ N$ z5 y( u% B5 t6 m5 O( Rand then browse the DDB list until it find the VxD and its DDB_Control_Proc
# M$ ^* I# `& efield.
& p! a! |' m# s* z6 F. y% v' XIn fact, its purpose is not to load/unload VxDs but only to send a " q! W: ?- z3 D1 d( f, r3 o2 k
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE). Q6 X, p1 O4 e) x
to the VxD Control_Dispatch proc (how the hell a shareware soft could try' v( d% p( W: S4 A
to load/unload a non-dynamically loadable driver such as SoftICE ;-).8 y4 l3 S9 _$ U/ c: B! U
If the VxD is loaded, it will always clear eax and the Carry flag to allow
+ |$ J; }& O) Q* B$ vits handle to be opened and then, will be detected.: c( z  W' g/ e% |: K) N
You can check that simply by hooking Winice.exe control proc entry point
" N  `5 y% p7 I3 B# {2 bwhile running MeltICE." o) w% C( ?3 _' K# O; r

( F. e5 q, S4 W: u) S2 a
' ~7 R  s$ X8 `6 ]0 W  00401067:  push      00402025    ; \\.\SICE7 l6 v2 n8 d7 w7 s# _
  0040106C:  call      CreateFileA' B# d: K$ h0 h
  00401071:  cmp       eax,-001; j4 a( w" V; O
  00401074:  je        004010914 _, R6 c3 S4 h

3 y9 g% h& k4 ]! b# M+ V
7 Q; l" E  }/ h* M! Q) k: A$ kThere could be hundreds of BPX you could use to detect this trick.: J/ T) K! c* H
-The most classical one is:  r- m" V" L  M
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||% B9 b" o; y: \6 F
    *(esp-&gt;4+4)=='NTIC'
' U0 m- S5 ^8 @
' `) ]% {; n0 _) u( F-The most exotic ones (could be very slooooow :-(0 g# s! y- ?* z9 F
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
6 x# Q* p4 A/ z8 ]     ;will break 3 times :-(
, ~8 L% S1 q  m* ^
. ^7 X% J4 p6 p-or (a bit) faster:
( C, n5 n. }5 A! F5 ?   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
4 J& U+ ^. p3 T! ]6 S) z# E
" f1 W, Q. {) `: M   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  + f4 G1 P% c) X2 z9 G5 p& g( S
     ;will break 3 times :-(
+ [4 ?7 o+ s0 Y" I. q( T( h3 F, ~) k9 K0 f2 p2 ], L9 V9 [
-Much faster:
% v' A  c1 A* F   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
3 n! Z, _& y1 Z1 p1 c# c6 M8 ?
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen' i' |: G# c8 [
function to do the same job:; ^& v  N) h( o& h0 D

# O: q/ K+ M+ b1 M0 P( i   push    00                        ; OF_READ
; ^; J. g# s4 p, P   mov     eax,[00656634]            ; '\\.\SICE',09 i5 V2 M7 m5 t: J6 ?, E
   push    eax( Y, z/ Y4 q5 K6 G( y+ T
   call    KERNEL32!_lopen' B( x' z! Z# R. J* q
   inc     eax6 P0 F( i0 t) h$ E0 v
   jnz     00650589                  ; detected
( f& c/ P; V( Z7 x5 s4 F   push    00                        ; OF_READ$ ?) w( g% D' i+ l* {
   mov     eax,[00656638]            ; '\\.\SICE'; f6 c1 J) c+ A$ i* |
   push    eax/ E+ A2 ]5 x1 ^
   call    KERNEL32!_lopen
8 V# q& J/ `3 w+ J2 {/ S( D  _3 X   inc     eax
6 l/ j2 e+ `9 Q3 M, i/ d. F# {   jz      006505ae                  ; not detected3 q; u3 L" B1 x9 f& ^: Z$ U
& r  x( L1 v% x. t4 m3 }  x, Z

. ^( T. d+ z* L% ^& C) `/ Z__________________________________________________________________________
! a' }8 \2 V  z
  ^% {' P2 i- x% L' q6 ?  aMethod 12( Q  g3 Y4 B0 W+ D
=========- M- j3 P6 R4 W9 M8 I+ ^

& R) x" e; k$ c3 Q' O; M& G% E- JThis trick is similar to int41h/4fh Debugger installation check (code 05
7 x* N+ C' D# V1 I3 u&amp; 06) but very limited because it's only available for Win95/98 (not NT)
" ?, \( F5 Y* g/ g* Q+ las it uses the VxDCall backdoor. This detection was found in Bleem Demo.
: e+ J9 J. Q2 O6 |% t# L! Y# ~' [1 F* `5 w
   push  0000004fh         ; function 4fh
, w1 |. P: t3 X/ _9 N   push  002a002ah         ; high word specifies which VxD (VWIN32): m$ j7 a. u. D
                           ; low word specifies which service8 s/ H. O( L& h$ `* R8 L5 g, c/ s1 ?
                             (VWIN32_Int41Dispatch): H7 X/ \- Q' I
   call  Kernel32!ORD_001  ; VxdCall' C. f/ ]; R; H9 {0 m1 a' R2 s* S" o
   cmp   ax, 0f386h        ; magic number returned by system debuggers
( o, |% r) ]) v8 L: |9 ^/ n# ?   jz    SoftICE_detected
" |- n( ^; c/ s$ F$ q( p
: D0 z9 v- l2 o3 r" `9 I7 KHere again, several ways to detect it:
7 @* R- a( I7 [' X
* Y6 D$ L7 k/ E. g% x# _    BPINT 41 if ax==4f
" R$ o1 i9 |& _# E& `& U3 x; ?/ T' ?' q5 M
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one  n; ?* y& }0 E5 a

. }; |% d$ Z# `5 R    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
, }, h) J+ O, l1 s9 C. {) Y6 o& ?
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!& T7 Y6 j; }# w+ E" ?) V$ D

; ]1 C0 U: g* w__________________________________________________________________________; _! s, A8 w, y2 `
$ J* ]3 a- B2 s% W2 W
Method 13' _: I( i& E* }% S5 C; b; {
=========
3 l8 k3 I" h( K5 G4 j6 s* l$ i: ~% g; K4 }
Not a real method of detection, but a good way to know if SoftICE is9 y- T( n1 o' V' \) N4 G
installed on a computer and to locate its installation directory.) ~, V; D* c8 n" w4 S( y
It is used by few softs which access the following registry keys (usually #2) :, R" h2 _! B2 C* r  A- E4 D
! R, e5 M2 X( n) g/ w
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion& W# E  Y+ }: n7 k3 t- u( d% Q
\Uninstall\SoftICE
6 y: Q+ J2 H+ _7 i4 o-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
$ O4 z' S/ b6 ?% J( p. W& X" G( b-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion' D1 x+ |- T2 u0 [0 |0 N
\App Paths\Loader32.Exe
! w2 V/ _. \1 b% h! g/ H- h1 P, e
  q, F5 ^/ s/ N4 X1 I
, J% C/ M. m/ V) ZNote that some nasty apps could then erase all files from SoftICE directory  k% H1 ?  |6 @$ g
(I faced that once :-(8 b4 Y$ w- C0 K: i/ L. Y9 G

! g- Z- Z( h- ]; f+ w+ h0 WUseful breakpoint to detect it:
5 `6 T5 K4 ~- a# |3 }4 K
! Y. M; p- Q7 w     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'3 e4 \% P3 W  ~# h! Q  R: w' I
' U2 n7 g, U. N% d" N4 n
__________________________________________________________________________
, s/ |4 Y" _9 @% M7 p5 a8 ^; T1 O" n# B: @3 u& z+ u

9 F" E( _: G; U7 h! L6 c+ k- LMethod 14
1 L2 a! B/ R  {3 i6 D3 q$ v2 I=========" E0 w% U( h2 u8 ?+ D$ B
5 {( L( S; s2 Y3 b+ z2 Y. ?3 r& Z
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose4 ]. F+ r5 {, n' o! R) Z, ^3 g8 I2 U
is to determines whether a debugger is running on your system (ring0 only).0 Z- i/ a. `4 o' T9 I

3 Z3 a6 E, o5 H7 A# y   VMMCall Test_Debug_Installed8 ]3 G. |# A- ?5 L6 B  V2 D0 Q
   je      not_installed, i5 }* }* ^1 J& v) M
- k" Y' ]" l- _, K* r: R
This service just checks a flag.* l# m  ^0 K7 i# O9 Q
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部