找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>( }/ a6 C# z1 {
<TBODY>
" z/ N1 N9 p2 w; \* s" e  i<TR>
' B" U9 ^3 v4 e+ O% a<TD><PRE>Method 01 ( e7 D8 L! v8 u! c
=========& `# @# N" }0 m  y  ?, d' {
8 H- x1 I6 L9 w0 U* i; \
This method of detection of SoftICE (as well as the following one) is
" I1 v0 X& _5 h+ p! v4 Y% jused by the majority of packers/encryptors found on Internet.
+ {# N% c* |" G3 o5 q) @8 mIt seeks the signature of BoundsChecker in SoftICE
4 N  n- \' {. q5 ]7 Q. m' D' ?
    mov     ebp, 04243484Bh        ; 'BCHK'
! N3 `) x" {0 _4 c5 j    mov     ax, 04h
9 d  e) ^2 t5 [( d; r* q* q  U- N    int     3      
/ s0 M% {  y/ E0 G2 ?; z- ^+ x    cmp     al,4
( j, E1 L8 U& S+ G: S  I* a    jnz     SoftICE_Detected
! V* N( k8 F% w& v* l7 H  W( E8 q. n, }0 c- k6 l% X
___________________________________________________________________________
; S: L3 G/ D6 [8 E/ ]$ I% i6 |' C3 a6 ^8 a1 i
Method 02  K+ j5 a& X3 T% ]0 P* V  y4 n
=========
4 l* E6 r9 p- G5 w: F) \
9 V9 a  W" E# c9 [Still a method very much used (perhaps the most frequent one).  It is used0 a0 e+ [, p6 s# |+ h% Q- r- L
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
0 r/ ^! m3 u3 T+ J  Tor execute SoftICE commands...& q! m) [6 e+ z( U0 {' [
It is also used to crash SoftICE and to force it to execute any commands1 k4 O0 `) Z4 f& }3 h
(HBOOT...) :-((  
3 g  Z3 K0 P9 D$ y) d+ f9 d5 ]5 t
) V9 B0 K3 z' ^* e4 M% I' sHere is a quick description:
9 b% U. R4 N1 \* i/ p3 D-AX = 0910h   (Display string in SIce windows)
# h2 D1 Y+ [! D( v8 t, |& c-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
9 R' I" J; W. @  y-AX = 0912h   (Get breakpoint infos)
, `. z0 [  e: d0 N( Z3 J: j-AX = 0913h   (Set Sice breakpoints): o7 a* ?6 L" L
-AX = 0914h   (Remove SIce breakoints)
& r# ?$ i) {. I, r9 a- x: A9 I5 J
Each time you'll meet this trick, you'll see:& J: ~4 H: s1 x, {% Y4 a
-SI = 4647h
: X3 R( Q# N* D/ ?-DI = 4A4Dh6 {! C# e* M& R
Which are the 'magic values' used by SoftIce., H7 h1 ?* F' @* ]" A
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
2 C; T" r5 y' w* V9 I! W3 J9 ?& G
1 j" W. Y) T( ?# O, W! xHere is one example from the file "Haspinst.exe" which is the dongle HASP
5 x9 w! E; E& k: ^$ D# p; [Envelope utility use to protect DOS applications:
6 q0 f6 b9 L0 w2 [
; R; y7 G: M% `3 T, a
; S+ ?9 q6 ]( E$ Z& o4C19:0095   MOV    AX,0911  ; execute command.
# ]! [% y# W) ^8 v( q/ y; u4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
$ y. m7 q+ l1 ~3 k4C19:009A   MOV    SI,4647  ; 1st magic value.
- E# e1 b6 Y+ e4 t7 a: i4C19:009D   MOV    DI,4A4D  ; 2nd magic value.3 r0 }0 M) b& z' n$ M: C8 S* s* a
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
+ o$ ]4 ]! V, p8 p& k6 z% H4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute, B8 B! n& q" A9 U1 D3 m
4C19:00A4   INC    CX% q' J/ o8 U) O) k. l1 h& V+ C( e
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
% A9 e+ F' b2 C  \- W; W/ A& q2 ?4C19:00A8   JB     0095     ; 6 different commands.3 t7 u! m% Q# O" F$ U
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.! v1 }) j1 _0 D7 ^7 B
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)( p0 E0 i( w( o1 Y
8 u. Q% M0 Q, l7 A, P
The program will execute 6 different SIce commands located at ds:dx, which
- s+ ~. i/ U7 f+ o2 x( Zare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
/ Z2 I- w. j7 u' p; c' y" `
9 ?3 V0 |  x4 S0 h& x* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
, L( a6 }8 r" m8 D7 N% j: m___________________________________________________________________________5 a# m- n9 X8 l  y; A

- B2 o! m% q& F( O3 q& p8 H# [* T
) U6 h! I% E& `  A9 o- N! X" t! Z( iMethod 03  ?8 O9 ?3 W+ ?( v" C
=========3 F# J/ _4 S* l) j9 I
# h$ {1 h: a) H& [+ Z2 J1 d# g- N
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h8 p" ?8 }* }4 E5 G9 Y% i7 |7 J' Z
(API Get entry point)* C) K  A9 X7 P* `
        
; M: M; Y- R' V- ~2 c  Z
4 k# B7 a  c. H& i: e: A) P    xor     di,di
) z1 f7 z& |/ A" [    mov     es,di8 w, l. ~7 g, Q6 z$ r+ u. ]
    mov     ax, 1684h      
7 l) c/ o4 i/ I- n3 C* P  u    mov     bx, 0202h       ; VxD ID of winice9 r, W7 C7 `; S, v% h% z/ i
    int     2Fh; A. G0 W$ P+ y5 D" `
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
6 i$ `0 m2 W$ x    add     ax, di
2 q" ]  x0 X+ z: y% j0 K    test    ax,ax
' e4 T5 j# {/ t7 t& z0 ~    jnz     SoftICE_Detected$ Q# z8 k3 Q, {1 b& Z2 e
4 D7 S, m; C* x; I& y
___________________________________________________________________________# |% n% Z% I0 q" v' G: C
; Y6 x; k" _% }4 x" `
Method 04# `& x' v( i  _1 y
=========
6 [& c9 f% J1 g# b' D5 z$ _( S  c5 U( V+ K$ K
Method identical to the preceding one except that it seeks the ID of SoftICE5 e& R: ]9 W2 G6 a
GFX VxD.# n2 _4 u  n9 E. ?& }6 Y. T' V
; L3 D2 ^, ^! v' a
    xor     di,di
' S4 B% [( j' K) a    mov     es,di
& a- k9 f! `" O9 [; U9 L    mov     ax, 1684h      
) i* b$ I  W) x/ Q% C( r    mov     bx, 7a5Fh       ; VxD ID of SIWVID- \8 i  l. N) T) z, |- i2 B
    int     2fh
4 p# {5 F0 ^% T$ F! ?    mov     ax, es          ; ES:DI -&gt; VxD API entry point. f' {3 A! _; m
    add     ax, di+ t, J. U( Y7 H! L6 z
    test    ax,ax0 y5 ?% R( h  x6 w  j) f$ U
    jnz     SoftICE_Detected" F! k3 P, n4 Y

5 y; n- G5 ^9 c$ s! u$ x__________________________________________________________________________
* R9 S( ]. b% K1 Z. |6 Z, k4 z+ J! M3 M* H3 p- Z) h1 l

* n* W! v+ P* w* P) C# }Method 05) k& {3 b0 ~9 Q( h
=========  B6 V* E3 {5 U, u, V

- e; C) [: ~( `& vMethod seeking the 'magic number' 0F386h returned (in ax) by all system, w5 D1 P* W/ R. r- w1 c5 G1 y
debugger. It calls the int 41h, function 4Fh.: _# N& Z4 [( L- W$ E
There are several alternatives.  
* T4 L2 s" q5 E8 a, h
5 w) \7 c1 j) LThe following one is the simplest:
3 |- {2 K  [: N: ~2 ]4 E) }3 {# `8 M, r
    mov     ax,4fh* U! D! B; i" S; z2 T. Z
    int     41h3 y; n  l: Q. N, d0 c
    cmp     ax, 0F386
8 O% v, V1 K; I  K( G5 A9 r    jz      SoftICE_detected
* d2 M; N5 b& C; H1 j3 @
" e+ j6 \( w" M" J# S/ m* h3 n; y1 Z- x
Next method as well as the following one are 2 examples from Stone's
5 h4 I. a1 [2 K- J% P2 e"stn-wid.zip" (www.cracking.net):) f% n0 W5 w- q9 V3 q
% d1 n  }5 p. b: n) p" N! r% r
    mov     bx, cs2 p- G4 G' e* W6 {# P
    lea     dx, int41handler2; h' F4 }& u9 z7 h; m6 A" T" X
    xchg    dx, es:[41h*4]
: t* K7 I  B; ?. k    xchg    bx, es:[41h*4+2]% ^3 ~4 H# t6 P1 Y6 Z, X+ u
    mov     ax,4fh( j4 ~/ V3 `; s2 B, C
    int     41h
9 X0 {- O% N5 D, e    xchg    dx, es:[41h*4]9 H4 t& z3 D7 Q2 E) s0 v! b
    xchg    bx, es:[41h*4+2]
; j' ~9 z, w% k; K# `    cmp     ax, 0f386h
) I9 K6 R& a2 w  C2 t* M    jz      SoftICE_detected
9 w: H3 h# h* p: h, P0 \8 j& P; g! b# B* ~( }+ [! j. l. P! S
int41handler2 PROC
9 ^/ x1 C+ L# S8 y    iret
3 v9 v( a: Q9 i$ _int41handler2 ENDP
  S$ n0 w9 B% O. W3 [0 E4 \0 j6 a

. M3 Z$ ]# C" @" q, i$ T_________________________________________________________________________
" i' |5 l  z( K
3 R5 e; G. c+ n6 H/ G
- X* r% @- F1 U/ Q/ TMethod 06. z# A6 R2 z, X" i( t) d
=========
: J* g: ?- x8 ]( e" \
) x3 x3 A  X5 X6 @; j1 Y0 E
) X" e1 M/ c- S+ i2nd method similar to the preceding one but more difficult to detect:
$ W4 I  i) Q: K- c4 W; S& d/ G
/ G) R3 e5 v9 o" O1 V+ M7 j' g/ K8 Z. Q
int41handler PROC: `' Q+ Q1 _: b3 v
    mov     cl,al
1 D" Y; F2 P2 ]5 Z' U    iret
  |/ t- x- G% C7 F) jint41handler ENDP  p1 ]$ y% l) r7 h- M7 \! \6 q6 b

; W8 j. Z# B9 U: L( x  K1 t! R+ `  j8 y- K5 U  ?% M3 o* u* `8 H
    xor     ax,ax
) _# a6 e: ~% Z7 u& M+ W    mov     es,ax% w) Q3 i9 E& V9 a9 M: Q. H
    mov     bx, cs
( I+ D7 w; _9 e/ J    lea     dx, int41handler5 i  l2 m( p8 Z" t2 k% K( J( L
    xchg    dx, es:[41h*4]
0 J% p) l6 G$ S2 k& ^! ~" n    xchg    bx, es:[41h*4+2]& V3 N: G+ y( `
    in      al, 40h5 C5 m& u8 L2 N
    xor     cx,cx
, i' \- ~4 a" ^4 g: g8 S    int     41h
0 z* A# u! @3 X1 p    xchg    dx, es:[41h*4]
: D) _0 f* a6 X    xchg    bx, es:[41h*4+2]
4 B4 x) _- p4 T1 b9 p+ C    cmp     cl,al
8 Z! o! ]( u" c3 O    jnz     SoftICE_detected
0 a: h1 o# U3 F! q
8 j/ ]; @, J& i: e' k' Q_________________________________________________________________________
& ?3 X. P# t& @7 ^$ v. d8 L! J9 h0 A9 R1 R
Method 07
% S* l+ F: o: o=========
4 Y1 n* S' d4 q. L. T7 ^
  B2 @" m3 H& R' d  w  K) W0 Y. B+ oMethod of detection of the WinICE handler in the int68h (V86)
* N3 u! w. J0 b5 }
: [8 {  ^% J: s! ]    mov     ah,43h6 L4 G# j' ?; n
    int     68h+ ~+ P0 I6 Z7 B0 O9 x! ]
    cmp     ax,0F386h! ^% b5 H) \- r7 B
    jz      SoftICE_Detected
( C/ ]* p+ N+ q! o0 _( M0 m# }5 @% b7 H' i6 ^% |, t1 C
" |, r8 ^1 Z* @
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit3 U7 a$ U, b' W% T; B; e9 X
   app like this:
8 \* o& Q% L2 M, g/ G* Z; b1 _, v: W) U5 F0 U* t
   BPX exec_int if ax==68
8 U+ H+ v$ S: W* Q0 Y' ?   (function called is located at byte ptr [ebp+1Dh] and client eip is$ s/ E; Q' X" E% V: Z5 j
   located at [ebp+48h] for 32Bit apps)3 k( P) E; |! R5 T6 ?
__________________________________________________________________________5 E* i9 @# m: n8 L3 T" E; I

! B. m* I) R) U7 K
; {  |% x  }+ g; I8 CMethod 08) R  ?% t) Z" e7 o1 g! z
=========- h* n+ k. v$ G9 l6 B
; q0 W( K6 w2 g! y
It is not a method of detection of SoftICE but a possibility to crash the
; U) K( O2 L7 d8 I# V% j( k, O8 Ksystem by intercepting int 01h and int 03h and redirecting them to another
' c0 }$ }3 q. E9 k/ @# g+ v& Sroutine.
* z/ J" C5 x3 E3 w/ [9 _It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points: q5 u4 T. Y/ ^/ q; h
to the new routine to execute (hangs computer...)
) u$ I8 g) K- n8 u  _
5 ?/ o5 c' l: r/ i    mov     ah, 25h
9 _3 i, M9 }3 O2 ]# K, z' y, G    mov     al, Int_Number (01h or 03h)$ S: z0 A: N; P
    mov     dx, offset New_Int_Routine! h) D1 Q' v, Q. ?, {
    int     21h5 k& k; H! B1 q, Q2 o+ D
# g# R0 x9 V& F, s% |
__________________________________________________________________________# Y6 r7 Y. d. n# d4 R/ ?3 Y0 ^

+ Q: J$ W4 N) j" LMethod 09+ d8 [5 E9 ~, v% n# K
=========
4 y4 y  p2 ^+ g8 M! @& c9 c3 w
' X2 i, ]3 L5 S9 \) n4 u% v, ]3 t+ N; ~This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only- I9 }* n0 ]3 G$ o
performed in ring0 (VxD or a ring3 app using the VxdCall).
& B9 l; w+ g) B, K0 F' E5 MThe Get_DDB service is used to determine whether or not a VxD is installed
' F: k  `! z1 H/ Nfor the specified device and returns a Device Description Block (in ecx) for
9 ?1 _& O1 {0 N1 m0 r: Bthat device if it is installed.7 T# p0 m6 X4 o+ n* o- r, h

( V) l* Z0 @; D; Z6 ~, k" W   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
/ ?/ O: O1 N- d5 q7 {7 j( o   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)9 k4 T  }8 J/ ~  p8 H& [. D1 W  `
   VMMCall Get_DDB
) j4 P  o' T1 L7 P* g   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
5 y- G7 n; D1 X4 k" l. t4 ^$ ~  m( w, M
Note as well that you can easily detect this method with SoftICE:# E2 L* b# M& _+ `2 c& ~
   bpx Get_DDB if ax==0202 || ax==7a5fh2 I: S: ^* h. ]* l

' G* D9 e( K3 k: p) A__________________________________________________________________________
7 A2 E! _8 W( q. v
, e& D  k/ W* p" d0 nMethod 10. O: C, g  ]$ u/ }& Y6 B. u
=========* C, ]# L: l* [+ n/ z( T% ?

# m) [" _! T/ a; U) R; |=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
& J" P( l5 Q# z4 O# C  SoftICE while the option is enable!!
0 k& X% r' O1 N2 v& r2 t
: n, I4 V  M' o; n1 UThis trick is very efficient:. a% {6 ]& U7 n4 L7 A
by checking the Debug Registers, you can detect if SoftICE is loaded& C7 D1 w7 F9 B7 j6 K$ l; K
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
3 K& ]8 v4 s4 ]& _" a& i  gthere are some memory breakpoints set (dr0 to dr3) simply by reading their
/ M) Q0 x9 k& p! i: x& svalue (in ring0 only). Values can be manipulated and or changed as well
8 T, f' `1 S9 k4 [9 X$ A(clearing BPMs for instance)
9 Q3 c- l5 `& \  E  {9 l& k9 X1 D0 U  F# B! `( m' I6 B
__________________________________________________________________________9 J# J6 [# h3 x

) c- V& ^; e+ G0 hMethod 11
4 u2 E# O! ]5 I, Z' a: R3 p  ]: l=========! h5 ~! h, ?6 ~# T
+ X3 B- K( x; C, {
This method is most known as 'MeltICE' because it has been freely distributed* E- N8 k( l% v- V. \3 G* Y
via www.winfiles.com. However it was first used by NuMega people to allow
! Z# s1 x" f$ `) |4 b/ WSymbol Loader to check if SoftICE was active or not (the code is located4 l, X5 l; W, B3 O% F1 x; u
inside nmtrans.dll).5 E7 V. q$ N8 q3 E

% X# d, G: x8 c' ]8 zThe way it works is very simple:' T$ N6 o' F/ O7 s1 \: r8 @
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for. D. |: @# _; A# F( f' E# t3 [1 i
WinNT) with the CreateFileA API.
2 V5 c6 }0 e0 u8 |' [  |! b
1 c- U& d; C! E% m0 sHere is a sample (checking for 'SICE'):
. m9 A% f$ h& d; J/ P$ h3 K% o2 U3 K+ g) {
BOOL IsSoftIce95Loaded()  a- g9 i3 P9 i& }
{
. ^1 l4 Z$ M. n2 t+ |1 K3 g   HANDLE hFile;  
/ z, g& ]2 y) k; Z   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
8 @! x( ]1 ?4 [  D                      FILE_SHARE_READ | FILE_SHARE_WRITE,, K$ i2 m3 Z; M" H
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);3 \) G! D. m0 _2 r& B
   if( hFile != INVALID_HANDLE_VALUE )
- C1 S2 M' T/ Q( h' P; B4 r2 l   {
% }; G5 ]1 v% n8 |  _4 C6 y      CloseHandle(hFile);
1 P) p1 B; \8 S- Z9 m      return TRUE;
0 X: z6 o7 O/ t& l+ L' }' q   }) }& h. K3 i6 r8 M5 s9 T) c
   return FALSE;
, w( k2 Y3 l: b3 B}' V  s2 S% h) Q8 {, k* j

5 V, X  Z- x9 b6 sAlthough this trick calls the CreateFileA function, don't even expect to be
$ G; \4 w  A  j* _# {8 F2 F) Xable to intercept it by installing a IFS hook: it will not work, no way!
% Z! p( }1 ~" ~1 WIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
/ p& A" h, [( M+ @" b: }5 `, Uservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
7 V  O7 X9 d; B7 O; _3 F# D4 |; Yand then browse the DDB list until it find the VxD and its DDB_Control_Proc- x! n. u9 |" M* {: _
field.% A. q* ]5 W0 o9 o1 Z) c, O! O
In fact, its purpose is not to load/unload VxDs but only to send a . X; X$ H; d8 W& O
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)1 ]% m' m; E/ [; T6 ]
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
- P' `' I/ C4 S' N5 C1 mto load/unload a non-dynamically loadable driver such as SoftICE ;-).2 F: M- A. Q4 |$ m
If the VxD is loaded, it will always clear eax and the Carry flag to allow
& `" [0 `2 N5 B; n. S0 `its handle to be opened and then, will be detected.0 ~0 X2 d/ h$ ]( `$ O* t4 \; }
You can check that simply by hooking Winice.exe control proc entry point% z3 q9 q0 a# u, e- g
while running MeltICE.
( D. D6 w: I/ A) U4 G3 N$ O' J) G$ |. P/ [4 k
/ w# z# K! g$ W6 Q- G7 A
  00401067:  push      00402025    ; \\.\SICE
2 s& z) P( _/ N7 y0 l  0040106C:  call      CreateFileA: Y1 r4 ]8 k& P1 P1 R
  00401071:  cmp       eax,-001: |  R/ i# G) d0 m- Q8 Q" O. \
  00401074:  je        004010910 C0 ?/ V4 Z+ u6 g9 B% S' V

7 O0 d; J) d. @+ S% C9 g  o5 D
, [- t2 q, f; M" Z' aThere could be hundreds of BPX you could use to detect this trick.
; \+ L6 G% d7 S. x! H2 }-The most classical one is:
1 J8 @/ P. j, }" i" _' [6 u  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||, Z' u# q, O3 p+ I; p+ c
    *(esp-&gt;4+4)=='NTIC'7 V$ q; \2 S  m% B' I' W
2 P( X& ~% d( n4 q7 r* z% t
-The most exotic ones (could be very slooooow :-(6 O% [% M6 q# j) Z
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
- n. ]$ W: Y4 \$ r' D) D     ;will break 3 times :-(+ ?4 {$ X$ |# `0 I( ^4 K" L
) L9 X" l; ?' c2 L) w$ ~" v3 C7 {
-or (a bit) faster:
% p1 h$ v8 S4 J   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')3 W. B) z; F2 Y, i9 v
3 o0 w$ [) j2 Z# u& P$ c$ g
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'    ~5 y4 q, q# F+ l  {2 i. J" @0 @
     ;will break 3 times :-(
- Q7 c" c% q& y; E0 k) o5 i
, z  ?5 H( g/ s0 b7 X! O-Much faster:9 E0 R  L0 A2 S. ~7 b
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'- \4 Q7 X' ]" Z

( |# c/ I. m7 w; I  _8 JNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
6 v$ H& S, t! ?  _function to do the same job:* B* I" g( n: O6 p, o. K0 {: E

$ c9 W! j' n6 u( c0 N7 d   push    00                        ; OF_READ: l9 ~+ K1 m! _" }+ u9 G
   mov     eax,[00656634]            ; '\\.\SICE',02 b! \$ Z  [8 A/ k# k
   push    eax& l6 M" o( j! S' v& K6 U  H
   call    KERNEL32!_lopen
4 `0 i0 W1 x" z- Q   inc     eax
" w4 v9 @& R6 \   jnz     00650589                  ; detected
* W# F: P: H: ?3 S   push    00                        ; OF_READ: t8 c& X2 U( f" j1 E6 g
   mov     eax,[00656638]            ; '\\.\SICE', A3 F7 p1 i. b6 u: E4 f
   push    eax8 A/ i6 l7 h, o; k0 h2 F
   call    KERNEL32!_lopen
5 P9 v5 y7 A* u/ F, v' ?   inc     eax
# j1 O! u& z3 A  z   jz      006505ae                  ; not detected
, O8 I2 r, o7 r9 h2 b
: j5 i7 o5 J1 [1 @8 @
* \, Q/ P1 C* r* n) P4 n3 v__________________________________________________________________________# c5 y" d2 }4 J$ ^5 {$ P7 ^: ]" W
; t" M9 Y$ V% |
Method 12
# {9 f. L2 V* K! I% d=========% o! i# M, I9 C

0 X, L( \: v# Q- ?This trick is similar to int41h/4fh Debugger installation check (code 05; H/ {& P/ i" q4 z0 Y! U/ q/ j7 T- O
&amp; 06) but very limited because it's only available for Win95/98 (not NT)
; C: _$ g# {0 nas it uses the VxDCall backdoor. This detection was found in Bleem Demo., z9 ?# g7 ?6 ]2 [6 C$ T6 k
- o+ q! G3 V7 r5 ?
   push  0000004fh         ; function 4fh
$ i5 `9 d1 t% o) _- L$ X   push  002a002ah         ; high word specifies which VxD (VWIN32)
  p$ h5 h+ ?; l                           ; low word specifies which service5 W0 r6 ?- \$ h- K$ \
                             (VWIN32_Int41Dispatch)
4 K* g* C0 b3 S# z: ?" i7 h( n   call  Kernel32!ORD_001  ; VxdCall: P7 [' y: T5 n8 j* d7 Q
   cmp   ax, 0f386h        ; magic number returned by system debuggers1 l# B5 u  Q% G
   jz    SoftICE_detected
$ A2 j' G  v1 v, C' n) R: Z1 `3 T( b* s1 g$ l0 S
Here again, several ways to detect it:
, N$ ?5 W7 l. O& o2 @- e( n# R; p9 [) U9 t6 Z1 E' O
    BPINT 41 if ax==4f1 R2 s, u9 `( L1 W2 f
/ k- N8 B5 H7 R- K  L+ w- r0 m  j
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
0 `" s) Q) k: k! F4 J% c" A  l. j
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A8 C7 {+ L! m" e+ f- t
# f3 _2 j: P2 U/ R
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!; X6 i9 D- i# N3 k0 q
/ W7 y. Y9 w( v0 d$ ^
__________________________________________________________________________
5 Z7 F3 `+ {6 R  x" t! d8 I
( @- Q" P8 d  V/ z7 gMethod 13. J5 L; a2 A8 l5 z- h$ j0 R% h
=========6 R; Z& V$ y. g3 i3 V1 {

9 \; \! M* L+ g# J$ Q8 l- l( PNot a real method of detection, but a good way to know if SoftICE is& i- i- s$ T8 l& j( q3 z4 e0 E! I5 e
installed on a computer and to locate its installation directory.
5 O; L. D1 J; jIt is used by few softs which access the following registry keys (usually #2) :- t5 n- o) F& y2 f

! [5 a6 }, {- j- {-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
) Y9 L) p- L  G\Uninstall\SoftICE
9 z3 K6 ~: E- r-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
; O" U5 f$ }; }  u$ s-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion1 e& g6 G5 X) E! w" e
\App Paths\Loader32.Exe
; z, H% L" E# i- e1 A, Z2 P  p; G
+ ?" Q: P! V! ?  }% Z- N% G
( ^8 V/ I- U: dNote that some nasty apps could then erase all files from SoftICE directory! a- D- L, E7 N2 }
(I faced that once :-(3 k0 J& S7 L: }9 S& x

) h, w& L+ u0 G2 [( B! [Useful breakpoint to detect it:. A5 u* n' `: |( q/ m& }$ z

2 E5 ~  A2 i5 _     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE') E! f8 u2 r9 H! T& Z
3 o2 Z3 [% n% g* |/ b
__________________________________________________________________________
9 ]3 c/ {8 h1 _7 P1 Z. e2 ~  ]: s4 t  p) a7 i- Z

3 c5 ^/ B( r8 j. U! @8 T) n5 pMethod 14
  B- ]0 M8 E$ [( m: i6 I=========5 u1 H9 r4 Y4 \# J) I5 T8 z/ T
% l/ B* w: w: V
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
9 I) g' c7 L$ o0 lis to determines whether a debugger is running on your system (ring0 only).
( b9 r+ `+ H. O+ [
1 X1 W/ r' g; ^( Q7 l( k   VMMCall Test_Debug_Installed  R% f6 G) r/ K1 `2 N
   je      not_installed
8 h% U7 J; {1 R( V- `0 ^4 w
* R, U; i  Z! D3 @7 YThis service just checks a flag.
2 X; k0 p) Y, D+ p" v</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-8-17 06:50

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表