找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
9 n  l0 ^& c6 x/ U8 `, k& ^<TBODY>
9 ]1 O% I- o; J! M' E<TR>
+ [9 i; o, ]% q7 m0 N<TD><PRE>Method 01
$ }0 {' \$ |$ X  X1 `: Y=========
, f1 C8 q: T8 F
9 p% K$ C5 Y- s6 j* g: s5 K  _, iThis method of detection of SoftICE (as well as the following one) is
7 q% D1 E3 R* w0 dused by the majority of packers/encryptors found on Internet.
3 }  G! g$ p4 HIt seeks the signature of BoundsChecker in SoftICE. k+ X) [; R2 V1 E  s

3 }+ U% p- Y* u$ X9 |8 W    mov     ebp, 04243484Bh        ; 'BCHK'* `- D: Y7 W$ V; Y& X' A8 r
    mov     ax, 04h/ m- p3 H9 t" f. ~
    int     3      
% ~4 j, t. P3 D0 w    cmp     al,4
( C9 E+ M1 q* @( M* C( d; |5 M    jnz     SoftICE_Detected
# Y3 v0 x- ]; L( q+ h* b1 h
! g' K0 D* T; w! c___________________________________________________________________________% J8 M, g  @( M0 q' W
& I# c' V1 K+ ^0 v2 r
Method 02$ t7 ^/ D$ J, |8 q9 n& }; i$ K4 f5 o& t
=========
! F5 w) X* B1 f# _/ Q
% N# Y" _7 D: w& x" ^8 DStill a method very much used (perhaps the most frequent one).  It is used/ G" W' E, S! U; ]. f9 `
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
' ]1 a( C8 l" Y6 o; Lor execute SoftICE commands...4 B7 A# L/ `* \$ p. l% s
It is also used to crash SoftICE and to force it to execute any commands4 s8 a$ B9 F' @8 }
(HBOOT...) :-((  
/ c8 N% j9 |. Z, a* q  e% X: \8 u9 D4 j2 f* w4 ^
Here is a quick description:2 o5 o4 L* |8 s7 |0 s$ J! V, B
-AX = 0910h   (Display string in SIce windows)
$ Y9 j# l; G9 [-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)" a$ B$ |& @$ }
-AX = 0912h   (Get breakpoint infos)
0 Z) s  X, U" S" a' l" H" A8 m-AX = 0913h   (Set Sice breakpoints)
& E( z4 N( g; F6 Z$ Y2 q8 J# E2 E-AX = 0914h   (Remove SIce breakoints)
% _, k& N7 s- u/ A9 u. ?: j; ?
: p( w6 V+ w" `4 nEach time you'll meet this trick, you'll see:
$ a% R, E! A8 T9 `# U-SI = 4647h+ r  {- m( _8 ]
-DI = 4A4Dh2 b2 v9 i2 T: D' s9 {: `3 w* y- Z( [
Which are the 'magic values' used by SoftIce.6 F$ l& y: n1 g6 H
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
  N; h) u8 T  E& x! v' y% ~( s1 p0 c, r/ f( @" O3 \. G2 @1 v. G+ Z
Here is one example from the file "Haspinst.exe" which is the dongle HASP
6 {# W4 h+ n) `: S4 U$ V( Z( x! EEnvelope utility use to protect DOS applications:
# U2 x' V) S! ]3 g: b# F" K. ]$ h. t# b( N+ x# t& E* E! {
1 q& n' ?+ _1 K
4C19:0095   MOV    AX,0911  ; execute command.
, b2 _: T5 s5 K4 X3 {4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
9 @- L6 U+ t2 j- I4C19:009A   MOV    SI,4647  ; 1st magic value.
0 j' K; q. D7 j5 |4C19:009D   MOV    DI,4A4D  ; 2nd magic value.0 H' |6 F- f# f; \9 n# d
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)0 v3 L: C& k' v! p! R( Q! a8 Q8 j
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute: W. W) ~# D7 C$ c9 S
4C19:00A4   INC    CX
# B8 Y6 G! V$ E; ]5 y4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute8 R# d( i9 \/ a, d+ R
4C19:00A8   JB     0095     ; 6 different commands.
) o% _& _4 [0 @6 U4C19:00AA   JMP    0002     ; Bad_Guy jmp back.9 {* h- u$ F, L+ m5 n8 ^
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
4 H' C) {& k' ?, y
, u, w% P/ c6 v' sThe program will execute 6 different SIce commands located at ds:dx, which0 W# f* ]) n$ \7 k
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.6 U  F' R/ E1 X

5 f% ]8 B- |5 E9 W& f( s* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
" U8 l0 x3 O7 I___________________________________________________________________________) \0 r  [8 ?1 a& o4 T
0 J0 v% O% Z' t
0 e, A& T; F9 F) m) _5 }) F
Method 03
& j2 O; b0 J  c6 f0 s=========
) e8 z" |# u( g
+ M4 }7 ]7 a+ m0 t7 E( kLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h& z4 n/ A/ a2 d6 z
(API Get entry point)7 h7 ~: L% l( {* T" h6 N  W. F
        0 W+ `! N5 `0 e5 D# h2 C7 a
6 o: D! k2 B: c
    xor     di,di
# `- Z% S2 Y! G    mov     es,di
+ ^6 D7 {% M7 q& g8 I$ K9 n    mov     ax, 1684h       4 P5 I  _, B* H; U
    mov     bx, 0202h       ; VxD ID of winice; ?$ b" u. h7 V
    int     2Fh! [# c3 X# B4 S$ V$ M1 U
    mov     ax, es          ; ES:DI -&gt; VxD API entry point3 J  c$ o$ y9 [0 {* V+ v2 a
    add     ax, di
2 R5 [, N) [' r* O    test    ax,ax% E+ C! l( z1 m
    jnz     SoftICE_Detected
; ?) ~) Q. V& t
" M; ]: i8 X) [: |! b___________________________________________________________________________
# k4 v1 c& P+ q3 G3 i# g& Q' B# q  |& i5 U8 b& [8 x" g) x
Method 04
* n5 ^# o$ J% s0 C; k9 `9 r=========
0 g' y5 ?5 X  }% L  Z5 g4 o4 M
3 \0 X3 t9 i' w: N# M" I; y# ~Method identical to the preceding one except that it seeks the ID of SoftICE
9 m% E4 `$ e( ?: W) dGFX VxD.! h3 B) h3 S$ H

9 J' V* @  ^! m3 y5 c, B4 K9 S$ r    xor     di,di' E; ^9 W2 G" C" E0 t' `
    mov     es,di
/ O4 y. e. R3 ~" i5 N    mov     ax, 1684h       2 a& B2 h4 }6 P; ^2 h' T  W
    mov     bx, 7a5Fh       ; VxD ID of SIWVID& S) Q* C6 t- ?
    int     2fh4 E) K7 k4 F- u5 ]3 I# \
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
9 M( c2 e4 g( f    add     ax, di5 n0 c. F' g/ \0 Y/ K. a* l* a
    test    ax,ax: t& N9 O+ [& b1 K' K/ r) {
    jnz     SoftICE_Detected" y0 j2 [$ \: |$ @0 I- S& M3 |) Y9 n

! ?4 |. |5 m: _! O8 K% e__________________________________________________________________________
3 q6 }) Z' m& N# B9 L! e0 U, B
8 \$ [: R2 z$ S; c+ z+ b
Method 050 f+ i2 C5 U2 V1 t4 f7 y  [
=========- |3 f# `5 ?: B5 z5 o: _" h7 ]
% F, h% v& n, U2 H0 y
Method seeking the 'magic number' 0F386h returned (in ax) by all system$ [, w8 m+ m8 [2 n6 G
debugger. It calls the int 41h, function 4Fh.
( \" U4 t( P1 w- @( e3 Y! |$ E& q3 ?There are several alternatives.  + X& O2 U. X( o: }% c0 v0 u
: ~: n4 G" l1 Q
The following one is the simplest:( u$ Y' k$ U: @
+ i" e  S5 k0 w2 @0 R) m$ g* U
    mov     ax,4fh
8 @: m9 y4 T' B    int     41h
( j; B* o7 [4 c2 o/ A    cmp     ax, 0F386
$ d; C7 A: G" y+ v    jz      SoftICE_detected6 Q0 C  I2 F$ f& m
4 f' @) |* C# y' F7 _( t0 @
2 E; U( ]* j4 D; u! l2 b; R* f* W
Next method as well as the following one are 2 examples from Stone's - r! u5 {6 c& b% I% Y7 b
"stn-wid.zip" (www.cracking.net):; F* X0 ?8 w( U5 w

$ f! h1 e( t0 e4 m4 _* `    mov     bx, cs& v6 F6 o6 ~3 @. A9 j# I
    lea     dx, int41handler22 `% h1 S  A" q% u1 `) p/ T7 O
    xchg    dx, es:[41h*4]' A# i4 x+ @! ?
    xchg    bx, es:[41h*4+2]
7 B1 o5 B% F5 e" U6 U- ?* b    mov     ax,4fh5 o' E& ?2 G. T6 Q9 X
    int     41h( L1 i. U, @; f" _+ _5 R+ A! V
    xchg    dx, es:[41h*4]
- h/ i1 L3 w4 A- a    xchg    bx, es:[41h*4+2]) r; A5 ~6 ?" E' V' q: ~
    cmp     ax, 0f386h- T( ?- N; _- y- Q1 u# U3 I2 h
    jz      SoftICE_detected
$ D! e# h, C  U1 P* I/ a$ a; I) O; U' p
int41handler2 PROC  Q3 r) H2 ?0 g6 F/ V& X8 G$ r
    iret$ f  n/ b" Z5 ~  t# ?
int41handler2 ENDP8 Q3 r: h) v6 x7 N& e4 C& h: ]
: I- f/ x6 V3 f* ~
& M, \1 \* a& h' ~9 q
_________________________________________________________________________5 l3 s" L0 h6 \( P3 S3 x0 X& q1 ~
! B- }  A/ B( \- r# _1 I

9 ~6 S( ?* [. x! N7 v3 N/ sMethod 06# v" E: h/ K/ V
=========3 J6 z; a: \& }6 L- \0 K" d8 F
9 Y8 Y/ D( g, j/ s+ ^
0 C$ R1 V  a( v0 d5 N5 L' K
2nd method similar to the preceding one but more difficult to detect:
- Z) k9 w9 s0 ?3 v4 [
6 N1 H7 Q5 R) C8 W" F9 G" V5 }4 k; O1 M; A0 ^
int41handler PROC1 d4 G+ L4 B5 @5 ^0 h/ O
    mov     cl,al
1 T7 x. Y6 K( z1 c- x& V4 r$ _8 F    iret: F4 S  T$ ~) Z$ d  t
int41handler ENDP
" ]1 C0 D# E/ K! c1 M0 L7 @( \  J3 T/ b+ B7 N+ ]% C8 D

. J& C0 w: ?* j: U    xor     ax,ax
* G) E; i4 O8 K6 T. N- N/ A    mov     es,ax; E% G# E+ q$ q+ O
    mov     bx, cs4 e  m: [. V: g/ a
    lea     dx, int41handler
3 O6 A/ r7 S. G: B7 M! Z$ K    xchg    dx, es:[41h*4]
; x2 j! y. v& t) U& J) o, Q! w    xchg    bx, es:[41h*4+2]
# \- \: V4 V0 g8 j( `$ w    in      al, 40h" C9 X! r, q- {" F! u# W
    xor     cx,cx) \; o. k# c$ u* I
    int     41h# v" t! B  r( B
    xchg    dx, es:[41h*4]3 S  L4 U2 V6 H- d7 E
    xchg    bx, es:[41h*4+2]
% i) ^7 K( O' W( F2 L    cmp     cl,al/ i  @: c! G' o" b
    jnz     SoftICE_detected
  |; j% L3 ?( z1 L' W! |8 A9 n; d1 k( R- a) n* q$ @
_________________________________________________________________________
! n) T' x  w# L7 B& Q  B  v- T
) F% M& `9 Z, |8 w* _& }Method 07
* |: h' o  U  ?% ?+ D0 O& `=========
1 d; F5 b5 h% v0 \) b' ?  B
  @7 S. c1 x# b2 w$ JMethod of detection of the WinICE handler in the int68h (V86)9 d. q+ x2 ~2 |) U  K) c" d
( p: f6 h; d; ~9 x7 ]1 z
    mov     ah,43h
" V" W( }. o. g5 P# T( A( z5 t    int     68h
' k" a: b* Q1 G4 w  l: L) ~5 q! n; `( F    cmp     ax,0F386h* G" i& Z* r; d
    jz      SoftICE_Detected
* X$ V) `/ N/ J' n+ o/ |& `: m
/ h% E& I) c) G. R; T( ?0 m6 q) m$ S4 d- H3 I: Z! E
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit7 P* p7 O( R5 S# d" z. p
   app like this:
% \% Y# o! F0 [4 b
6 b, M! n& G( a3 B# Y   BPX exec_int if ax==68
  y, h; E3 q; E1 U2 f   (function called is located at byte ptr [ebp+1Dh] and client eip is! n9 B8 V6 F( b% k  J/ X  h8 J( [
   located at [ebp+48h] for 32Bit apps)$ R0 J, p0 h' J1 l6 _. u# R( E
__________________________________________________________________________# q) x8 I; Z0 k9 ^/ M2 ]0 E
% B' K! g2 w0 m
, B: `. S0 ]3 F' a, ^# G' y1 L) _
Method 08
* J. ]1 n5 }( x4 p! \& ^& d2 J=========5 i  I+ f" j% q, F# v

$ R7 p* E# I7 @It is not a method of detection of SoftICE but a possibility to crash the
% i6 G2 G/ A! \. ?: o4 H; l& W, Nsystem by intercepting int 01h and int 03h and redirecting them to another' ~$ H* d* U% b$ \) q0 G
routine.
0 @( n+ J& J& o- _! [It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points6 K* a* }. |5 m! Y2 p, T
to the new routine to execute (hangs computer...)5 [7 B& c7 j9 f
1 ~( T. k7 N- f! _: R
    mov     ah, 25h, m8 x( h5 a5 S3 t8 }
    mov     al, Int_Number (01h or 03h)
7 x5 J9 `/ f7 D6 x    mov     dx, offset New_Int_Routine
: I6 s# Q. q9 h1 h" O    int     21h
9 @( \. \8 A; y+ V6 b9 K9 U8 L  t* _
/ Q/ L+ u& r) D3 y! ]/ }: r__________________________________________________________________________
) F9 \! |+ _! Z6 U- S  m( K+ z' \, @
Method 09
( j" i8 u5 _( N5 c=========# f! H  k% s' a, l! d( O

) A* f4 m# p. k0 s0 m; wThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
! j% U+ L% N9 H( K0 H' L/ Operformed in ring0 (VxD or a ring3 app using the VxdCall).
& J7 I9 A0 A' H: U: U7 ~The Get_DDB service is used to determine whether or not a VxD is installed
6 n& F0 l9 G) E4 e% dfor the specified device and returns a Device Description Block (in ecx) for
; T+ p* R3 X' f6 e1 P- Fthat device if it is installed.
. K: C' g. r( t" X) G" [8 D- V, W, H, p
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID0 j+ R. s7 M1 O2 j
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)  X8 I% r; V1 z0 O
   VMMCall Get_DDB
# n6 d8 A* N( ^. e6 J   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
+ r, x! s8 c, i$ z9 _; T
4 a) a: u4 I' e) m# A  X! s. kNote as well that you can easily detect this method with SoftICE:: O; {0 a9 g4 R
   bpx Get_DDB if ax==0202 || ax==7a5fh
) c+ |) s) E& l3 j+ _# l; L( z, D2 q( X% e
__________________________________________________________________________5 b2 j7 [0 F) n1 O; n6 m. w
" W/ @/ Y1 h7 o3 s2 {2 x5 u7 N) s
Method 105 l# ~: r; I! ?6 o: N
=========6 ~( C# E+ Q+ L- e- U5 t
. X% V$ P6 ]! Z2 ^3 Q8 R( R
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
5 G8 L: x6 c7 p  SoftICE while the option is enable!!1 j; c2 u% I: }4 e' Z

6 U- T3 g0 V) KThis trick is very efficient:
! f0 r9 B2 R. I) P8 r$ A) ~. Oby checking the Debug Registers, you can detect if SoftICE is loaded
* ~8 k# F7 t$ f$ T' j(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
$ t4 B( ?* S/ z( S' _0 v6 q( _there are some memory breakpoints set (dr0 to dr3) simply by reading their
3 v# m" G: ^8 p  |value (in ring0 only). Values can be manipulated and or changed as well' k8 p7 U3 y& J  [7 @5 s- |
(clearing BPMs for instance)
1 N( m. X, y1 l1 k# s2 p2 k" O( A5 n9 v9 q" t
__________________________________________________________________________4 e" z; \2 c2 n2 ~  `- f9 ~
- E; z( i) M% Q0 o6 r5 L6 x0 _
Method 110 B  O1 N; N8 A: ^
=========
8 D, O& x1 n: y! R
: Q$ |( O7 L- B( r4 uThis method is most known as 'MeltICE' because it has been freely distributed
* v  A, T& y% z. ^via www.winfiles.com. However it was first used by NuMega people to allow9 c- b& J+ M5 l6 s1 Y8 h5 o+ l8 |
Symbol Loader to check if SoftICE was active or not (the code is located- V6 M" C; T1 m
inside nmtrans.dll).9 {) }3 Z/ C& `" ~

4 s: n8 G5 k/ m$ QThe way it works is very simple:0 p! c$ B7 Q4 q1 n' m
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
! h( A  q. M" |* ~WinNT) with the CreateFileA API.) }1 x$ a5 r5 Z- n) l

( d; C. ~0 x# F. e9 e$ dHere is a sample (checking for 'SICE'):# g9 S* c" }2 C! x6 U

, o/ [$ E7 ~$ i' Z6 S. ^BOOL IsSoftIce95Loaded()* W. l! \/ M+ R5 Y
{
, p5 e' ?- [2 A4 i   HANDLE hFile;  
. W2 L# v& ?9 ~4 M   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,3 e+ D$ v, e( }& x
                      FILE_SHARE_READ | FILE_SHARE_WRITE,7 ^: g" }- Y8 V' @: S
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);4 l; a5 M. T" w, e/ M
   if( hFile != INVALID_HANDLE_VALUE )5 |! |( ~8 l$ x# u# M7 U% }! d5 p
   {
8 m6 @( Q) \( T3 [3 u: |      CloseHandle(hFile);7 q) a4 U5 B9 L0 H* N- L7 V& B
      return TRUE;# C/ I. e3 z) P+ z. I) u& i7 f
   }) M3 t9 {* h. k; s! F8 a! \
   return FALSE;& M6 i) L. c4 |
}* r+ U) X# d' J9 K. e
! d3 E3 n- J9 s8 i1 E8 x  R
Although this trick calls the CreateFileA function, don't even expect to be
0 k2 \. R+ {5 n; y  j" e1 l& Fable to intercept it by installing a IFS hook: it will not work, no way!1 j' ]: T9 m; P) P# t
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
8 A/ d( L: U+ Z; |* q- n5 qservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
: Y! k7 n6 |9 g) u+ n9 C2 land then browse the DDB list until it find the VxD and its DDB_Control_Proc
4 [) ~( E' U6 y3 D6 n; Wfield.
1 |; ?6 O( a3 Z( r- nIn fact, its purpose is not to load/unload VxDs but only to send a ) Q  `9 b% x: E
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)' ]# f8 B' k0 j
to the VxD Control_Dispatch proc (how the hell a shareware soft could try" ?; ?$ F+ S% K1 }5 j' o, |
to load/unload a non-dynamically loadable driver such as SoftICE ;-).4 o. `6 k" l* Y& A. Q7 _% _
If the VxD is loaded, it will always clear eax and the Carry flag to allow
" I. f' A* s7 j9 r) G- }% R: m: Mits handle to be opened and then, will be detected.
( |4 Q9 c6 z+ t0 x5 g7 C& n" j( o) _You can check that simply by hooking Winice.exe control proc entry point. q8 g' P1 }) |, ]9 t/ }: D
while running MeltICE.
& q# K9 `1 C$ p( Z  ~; K8 U
7 L7 J3 H( a7 }( Q1 b+ @9 f8 o; ^. ^- j5 q( _2 @
  00401067:  push      00402025    ; \\.\SICE
3 I# {" u  v2 Z  0040106C:  call      CreateFileA
" Y, p. L8 W$ @5 E5 W5 b" L  00401071:  cmp       eax,-001
+ E3 Z; j/ j/ u' J: e, r  00401074:  je        00401091
, [8 }: {9 G, ^2 x% g' h) M
7 G* N0 i3 w& ]
6 r3 [; p% K8 Q7 }# k/ yThere could be hundreds of BPX you could use to detect this trick.
5 f8 y! s) t7 ?7 m% ~" j5 t-The most classical one is:( c! H; g: y& z* ~
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
: K6 R6 l  [$ A6 \- k; Z3 ?/ J    *(esp-&gt;4+4)=='NTIC'+ m- }, z# P* W  n- N0 K. A

' D, F$ M( ~( ]( w- K-The most exotic ones (could be very slooooow :-(/ c. k1 |0 P) s! J2 G
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  ! f7 a9 e: ]. H0 A; [  z
     ;will break 3 times :-(/ A1 f# n& t1 b1 n( n7 K% f( f6 r

- l3 c: d) m1 c) D-or (a bit) faster: ; C6 a- Z$ e: K4 t  R
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
/ D& a7 m. @7 u; ^. _3 x4 N5 m9 W2 B( e' ~2 z+ l5 A# A) c
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
+ i3 \" r2 y, b9 k5 E9 ^     ;will break 3 times :-(
) s) ~+ o, j# E1 ]. Q
$ h! _1 B( y5 Z" |-Much faster:
# L. z1 u) o' X   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'+ X* k, O. v: H3 B+ r2 V& N
' Y& {! @4 ]& }# N
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
# g2 f4 b0 M: j! H; B  {) ifunction to do the same job:
" o' u$ J* {; P( ]/ e1 X. o- m2 \* G6 z9 I4 O9 P  t2 N9 y
   push    00                        ; OF_READ, o% V# A9 t7 X7 h7 v
   mov     eax,[00656634]            ; '\\.\SICE',0
* R+ y+ D& K: ]( a   push    eax" r* z. Q& G& g/ ?2 s; Z/ K: S# v7 v
   call    KERNEL32!_lopen( Q" _1 V" j) K/ i% a5 y
   inc     eax
  t! A+ |- L4 }$ r+ O2 u   jnz     00650589                  ; detected
- d$ O4 f! M# d2 i   push    00                        ; OF_READ% }" A0 x8 \" w8 I0 p' t3 t6 f
   mov     eax,[00656638]            ; '\\.\SICE'0 b1 G9 _2 v1 [# ~3 p: [7 i
   push    eax: {4 Y& [1 E% }# ^3 a% z  M
   call    KERNEL32!_lopen- T+ V! U# {6 X
   inc     eax' ]( V/ B; U" e" j9 W
   jz      006505ae                  ; not detected
9 z0 t5 j  Q& D/ O$ f2 u6 A" r
6 e9 A1 A! A/ T3 r0 u4 w$ t3 W
  l6 `* m7 v; ~+ ?) X__________________________________________________________________________( a  E4 K7 p% \& W$ S7 x
& u. J, H5 S! t' a3 w0 R+ `# a
Method 12
. C: i/ X8 j* ~6 t. w1 d: V=========2 n7 v# y1 b) K0 t1 Q* z

4 w4 e9 e( R- ?This trick is similar to int41h/4fh Debugger installation check (code 05
# O0 X+ x: ]$ K9 m8 G! X/ T6 J+ @& n&amp; 06) but very limited because it's only available for Win95/98 (not NT)
, r+ Y6 t9 l( C  tas it uses the VxDCall backdoor. This detection was found in Bleem Demo.3 ?: c% _: _3 B$ e; S8 A$ ~& }

9 {* v/ \. c  _( Z1 C; }/ `   push  0000004fh         ; function 4fh
" h9 _; |: Z# z9 m9 F   push  002a002ah         ; high word specifies which VxD (VWIN32), j  k* Y% Y$ x6 C2 o: U' I$ B7 G$ t
                           ; low word specifies which service' {; E1 C0 L7 j
                             (VWIN32_Int41Dispatch)
9 _* M* y8 @6 o& b   call  Kernel32!ORD_001  ; VxdCall% R! G7 B$ [' g: ?! e
   cmp   ax, 0f386h        ; magic number returned by system debuggers4 J! \' G) s7 x9 ^# s' Y) j
   jz    SoftICE_detected3 I& S: v" [4 ?

+ \. P6 E4 f+ {6 @6 HHere again, several ways to detect it:6 B/ Y& w, |! g/ M

" }; l( \0 H; k, Y/ [$ p    BPINT 41 if ax==4f
/ o+ S: Q$ D( i4 R9 d; ?# z: y! ~$ M
' Y# r) X: y. _! f    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one. n3 M6 R! T6 b# h  U  z
/ s8 q0 E  W6 c  E' z
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A/ Y. j# K1 d! D' }: l+ G

7 B# ~# E% i3 r* |) s& j    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
+ X6 k* D% o" Y0 C: o
: V8 |$ Z2 _; v5 n0 H6 \__________________________________________________________________________! s$ I" K' D! R6 a6 v3 S4 h
& `, ^! x) O3 B$ @
Method 13/ f: s% b! M( h
=========
3 a1 p. P3 y! [; x- U1 R
2 r' C0 k4 |6 _! _' tNot a real method of detection, but a good way to know if SoftICE is
" R0 w$ Q9 H4 w: _0 [- ^installed on a computer and to locate its installation directory.
6 `* U% h5 p! u/ ]  `0 aIt is used by few softs which access the following registry keys (usually #2) :- }5 b" u! z: n' Y# ?7 F; I

% u' t+ ~0 z' I  @( A: A2 u* f-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
- z% S& g! b0 g: _' _, M) G\Uninstall\SoftICE8 n6 B, Q1 v$ F
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE  E- |; h% d/ M
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion3 H# s7 g; }. e. f* o
\App Paths\Loader32.Exe
! t! M! v6 U. g( b6 {& }3 m$ {$ k; p; }  f# H
3 [! g6 o. N8 D  X2 k6 D
Note that some nasty apps could then erase all files from SoftICE directory
% f# T4 `& X+ v, m, {! P(I faced that once :-(
# F! h- ^9 L0 f6 l3 |$ ]2 Q5 B
0 @5 _9 \- W& x$ e/ f9 `4 NUseful breakpoint to detect it:. m- ~% G4 J# B5 \% o5 i( Y, C$ w: E
& T& Z& V4 R9 k: l7 I$ u7 S  s6 w
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'/ F: i& k* V4 O. _1 i7 Y6 T
3 k. l6 W: x$ K& W, ^8 H
__________________________________________________________________________$ k, i1 T8 G, d" }6 K

; F$ x: I, Q3 s, j% G8 v% W/ d! |% M9 P! b; v" f" D+ C
Method 14 % W' Q- B% O7 w/ \* q  k& `; d. G* f
=========. K3 L! Q* A) c, b5 [2 ~

/ q5 }0 F5 C& i% A+ C% y& u  s5 tA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
# s6 c0 B0 g6 J2 b5 eis to determines whether a debugger is running on your system (ring0 only).
% t5 I4 F) z5 c) T( p
  j& K. M8 O" w: g   VMMCall Test_Debug_Installed
* M# s  R" ^" a   je      not_installed
5 k$ `  ]# F2 H4 k2 D' Z  c$ B3 b/ [
# J% P& _3 ?% X7 y4 _This service just checks a flag.) `% H; r0 [' L" e0 i" ?7 \
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-7-30 06:50

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表