About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>! c5 I: h2 s2 y9 J, I, W: x% M9 A7 y
<TBODY>3 o' |: p$ O8 f1 i9 K
<TR>5 ~. c) A9 V% U6 m8 }
<TD><PRE>Method 01
* \) w0 d* U: J" r# O4 Z=========4 ]# W, H! w) a& s
' h4 I) Z% n; Z& O) a$ [
This method of detection of SoftICE (as well as the following one) is
& a% D/ j% R/ N1 c1 ^" yused by the majority of packers/encryptors found on Internet.
! Y9 q) ]. b# M& G, UIt seeks the signature of BoundsChecker in SoftICE
5 X( L. L* [) ?8 Z$ S* s% g+ V* W$ L9 u3 `0 K2 N6 i; y
    mov     ebp, 04243484Bh        ; 'BCHK'
+ {9 V  m! L  d$ G+ i+ l- v  I* m    mov     ax, 04h6 J' q5 v) G* M7 ^7 }* j
    int     3       8 s6 H# f' E2 D, i1 N$ M0 ^  A7 X# C7 f
    cmp     al,41 ?6 Y. x8 k2 k
    jnz     SoftICE_Detected
* D5 e+ D4 `, h, Y5 |! ?$ D- A  R' Y
___________________________________________________________________________) K; u0 b; d/ g1 d' N0 k/ W

7 J2 K# p2 ?& Z. T6 LMethod 02
. J* L& v  k" p+ k& j4 k; n=========, x3 U3 p2 P; X

6 N& V* M0 F* R: _; z; }( WStill a method very much used (perhaps the most frequent one).  It is used
- }: c- g. }! L" Eto get SoftICE 'Back Door commands' which gives infos on Breakpoints,- ]: I3 e7 u! j4 w
or execute SoftICE commands...4 u: w) }- i6 ?: K
It is also used to crash SoftICE and to force it to execute any commands
& @3 \# k" y( i: v1 D! |(HBOOT...) :-((  
1 h0 Z, H1 y0 b0 I; K) U7 b2 D
0 q- U5 I1 t0 }/ ?1 |Here is a quick description:
: r3 C. L0 Z$ P! ?% \- N-AX = 0910h   (Display string in SIce windows)
! n# X; ]9 _, v: }/ ]. _-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)4 e/ C1 \, j0 L
-AX = 0912h   (Get breakpoint infos)- L2 `  H+ ]! C9 k: d
-AX = 0913h   (Set Sice breakpoints)
, b' Q1 n; J' m* W5 R5 _$ u-AX = 0914h   (Remove SIce breakoints)4 {7 }; P0 j: t$ P

5 I" @) b0 r) f* k. Z/ t% ~7 Y8 R) QEach time you'll meet this trick, you'll see:
) d. a" g4 x3 x# H! C-SI = 4647h
, h* ^  X% P) H1 p4 O-DI = 4A4Dh4 `! }$ o+ _! S  x8 X" {+ N
Which are the 'magic values' used by SoftIce.8 @6 e$ Z: p- Z( @7 Q. a
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.' W# j6 D" U' ~( K; Q) F& F. `% N1 G
8 N) J  O% Y6 g6 a' b( u  Z$ X
Here is one example from the file "Haspinst.exe" which is the dongle HASP
" ]/ G8 n! I$ z  w3 oEnvelope utility use to protect DOS applications:
7 g+ _1 l+ X1 R& F8 S3 [8 H
$ o7 w4 w! e8 ]. ]" |" _# t% Q; u8 c) l7 E8 V# D
4C19:0095   MOV    AX,0911  ; execute command.
  |9 z; z# o+ Z3 R) V4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
5 J- [. n5 m* R$ Y7 H4C19:009A   MOV    SI,4647  ; 1st magic value.
/ ?* O3 K: A  T* P8 D. Q4C19:009D   MOV    DI,4A4D  ; 2nd magic value.. g) I* T! f; O9 j+ n
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
4 Z7 [) V; R. a4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute' M" o& j! {. _# z2 u
4C19:00A4   INC    CX- W9 p- O/ h' C1 q3 h% C
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
' v; P5 `+ s4 D. R: H8 G4 u4C19:00A8   JB     0095     ; 6 different commands.
$ b- W8 ^) W/ V7 `: `7 g# G/ R4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
' X! x* Z) v5 y3 p* k- `8 a. J4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
4 g+ K: m+ ?, v3 a5 t3 B8 f% S3 r3 n1 U4 P9 q, a+ u+ e/ k  \
The program will execute 6 different SIce commands located at ds:dx, which$ `4 d8 o4 v/ E% [% ]+ n: E" u- \7 T0 a; S
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.8 [: J8 i2 u; k8 g7 g: A! @& a
) p& L+ ]# F/ i2 V
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded." b/ t4 a' c  h3 c: h  `
___________________________________________________________________________
- H3 Y1 Z6 A5 q% }; C& Q
' y; o& U' ], k. j# M7 w' _+ l& I4 s
$ X' u$ ]" Q; c# \Method 03+ D$ \( C/ v. J- U
=========8 U* W0 c9 x. D( y+ O  a

/ ?+ t* ]' |5 r! N7 _9 f5 z6 fLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
5 R% H0 @, Q+ V(API Get entry point)$ S& w+ d1 B! |0 _& @) h; T3 p
        
. H/ w0 W4 s4 ]1 l, |* @, d" G* D! E: T2 _
    xor     di,di
7 z' N7 Z9 U; l0 O    mov     es,di- `& N8 D0 g# O5 |, f; Z( |' ~
    mov     ax, 1684h       9 V% Y# @* l" \, q
    mov     bx, 0202h       ; VxD ID of winice
9 F) E0 R$ o' k# }    int     2Fh
& l8 X8 y) H( R    mov     ax, es          ; ES:DI -&gt; VxD API entry point
8 q( E+ A  P& M# N( i    add     ax, di
: C- S  O- U' F; W; u9 ^    test    ax,ax7 o) h% K4 s4 [: R& G
    jnz     SoftICE_Detected; l# I9 ]" ?( T4 e  V2 t
* M9 H' t; ]1 |" H
___________________________________________________________________________3 Q* c1 V: _; f9 A
' Z2 T3 D0 Z# \- _. f" d
Method 04
2 H+ B3 x' d  a% d8 \=========
) H' L. `- Z1 T+ ]0 ]: ^  p9 D/ ~$ X' Y' E8 @7 j* v
Method identical to the preceding one except that it seeks the ID of SoftICE
9 _5 C2 ]6 u5 z& E; R  l' @" yGFX VxD.$ m/ x9 @) N: c* U" e% `" V! u- U# v

' k, w) Y) L& ~- w8 C  o+ C; E    xor     di,di
6 D! E' s' R) i) B7 \3 ^$ y    mov     es,di/ G1 A; h8 w! P1 m8 Z0 \7 G: Y
    mov     ax, 1684h      
7 W9 N& x9 I4 }- P7 X! k3 i    mov     bx, 7a5Fh       ; VxD ID of SIWVID
( z& P2 i7 {" N7 d& b; P" d    int     2fh
  m/ F- ~7 m  @4 q2 n2 r/ `    mov     ax, es          ; ES:DI -&gt; VxD API entry point& [# H$ D" J; }+ O
    add     ax, di1 j; s% y2 r8 s1 x2 X0 s, ~
    test    ax,ax
) @) [/ s% j; s9 g7 I( E6 w) {" ?    jnz     SoftICE_Detected
/ x+ W  y) F6 n6 `7 g4 P) C
8 t1 u- g% b: M! x__________________________________________________________________________* M! `1 g) O: c5 I
+ z0 L  `; o+ S4 }

) B6 {+ ]6 L+ A. y  yMethod 052 f) V% E+ O2 A. v# t# X
=========1 o9 L, @- m; W( e; r
: L1 O! _$ d1 P6 x
Method seeking the 'magic number' 0F386h returned (in ax) by all system
: B+ B6 D  D; y: I. W0 Ndebugger. It calls the int 41h, function 4Fh./ x# q1 U, ~: l  ^' h
There are several alternatives.  6 O" G* n7 t) V2 n. u1 N

" X2 b/ ]7 W* H+ f% O& L; E$ KThe following one is the simplest:
& u: O) I/ ~; x. {$ Z0 N
# F5 F) ~& Q8 l1 {- F    mov     ax,4fh
% z4 [6 ?& s5 ]! r5 Y) J* w    int     41h
- R9 I. A! i3 j- L2 }4 m    cmp     ax, 0F386) r- ]* s/ T: t' F5 w( m6 C+ [
    jz      SoftICE_detected
9 b! U# c2 y3 S  F  b
# j- n3 w2 T! }( g4 Y' K* ~3 T8 j1 u) F9 L7 k4 R
Next method as well as the following one are 2 examples from Stone's . W. }* P9 p+ c9 Z. p6 r  s
"stn-wid.zip" (www.cracking.net):
1 }" c% i1 l7 Z1 O+ t9 P
& b1 i+ t9 U6 J% O9 {7 Q    mov     bx, cs( L, j1 M1 \( G
    lea     dx, int41handler2
) B5 Q/ J/ }3 d* Z    xchg    dx, es:[41h*4]
- N* n1 A+ b$ Z3 m8 [( h    xchg    bx, es:[41h*4+2]3 E" x1 {' j7 e/ Q. j* S# C
    mov     ax,4fh- Y! F1 h4 A" B3 h$ P
    int     41h# s6 p0 k  A5 Y' S$ q: D# x
    xchg    dx, es:[41h*4]* W8 v0 o8 {6 a* Q5 S; O7 {
    xchg    bx, es:[41h*4+2]
+ R. \; ?, w9 F    cmp     ax, 0f386h) ]0 }, F8 W- U6 L
    jz      SoftICE_detected
7 [5 J. q* ^# x* Y' P7 L. d) q6 S. I; B; ~
int41handler2 PROC! Q+ @' G  U; f
    iret7 z6 @* p/ O/ p
int41handler2 ENDP
* l9 l  d- M; r" a
0 G; b  N0 Z. r" p: }3 h- e5 X9 X* E
_________________________________________________________________________
: M+ ]1 C1 T+ Y& h6 w# t8 d9 ^0 z  b4 u1 a! W3 N* Z7 u: N2 a  t; r
% X. B# M+ E3 Z3 Y8 ^
Method 06
* N6 D6 ^! ^. D4 N=========  `/ `1 N' d+ `( g* \

% E& C' J! d2 T" }# h' C/ K
& N& x: b* a  A2 F3 y: K2nd method similar to the preceding one but more difficult to detect:& M: l5 L: b9 R5 z" B

6 d1 N. W1 q/ ?! [0 i% F4 {- o
7 }1 q7 g% I7 @2 \& E3 Kint41handler PROC
9 h. u1 U7 y# g% _" d- z    mov     cl,al
) G* S4 w$ x! [, p    iret! ^8 J5 r! L; c- @5 [) i
int41handler ENDP
# d' W- f6 \9 T6 ~3 A
. Q: d! I0 s* ?" o- @" m& W
2 I9 [+ m% Z% {7 _7 `6 g0 c    xor     ax,ax
# @' B0 R+ D) Z    mov     es,ax
5 k6 G# W+ U- {( ~9 G5 c$ Y8 J    mov     bx, cs+ I0 y9 c" D1 }. k
    lea     dx, int41handler% Y% w! d+ g! n' s( w/ T
    xchg    dx, es:[41h*4]9 v" _- Y. |7 I
    xchg    bx, es:[41h*4+2]1 ^% y" d# y) B* R- C7 ]
    in      al, 40h
5 G7 j0 y, f1 U* u. ~) V    xor     cx,cx
( N9 G! A3 o9 L9 u* h% B% ~    int     41h
3 `, Z  P# ?& x' b6 _    xchg    dx, es:[41h*4]
' {) ?( n2 y8 u# l$ X    xchg    bx, es:[41h*4+2]
% s$ _1 E8 R  [: V; s    cmp     cl,al( y# }+ q" R% t2 E5 ^( b& W4 o
    jnz     SoftICE_detected5 |/ K7 Z- b  g; D+ y3 H) @
7 r+ \, ~8 \( ~( f! }
_________________________________________________________________________
) L6 H0 r+ T, |( T8 `! f$ r5 @! }, B7 _
Method 07; U7 o6 _& P6 C3 v" x0 q! g
=========  Z/ s8 s8 X0 e9 O

- D3 W  \2 q6 S  NMethod of detection of the WinICE handler in the int68h (V86)" G* z; B! o& N! }) J4 @2 Y( ?) Z

; u$ ]5 w8 d7 m7 i' q    mov     ah,43h! |) [1 p( F/ w' o% [
    int     68h5 ?# x& t, p, G1 A
    cmp     ax,0F386h1 ^4 W, A# W# F# a% M) a; r
    jz      SoftICE_Detected2 A2 Q, w' m' d" u
3 x) k- o4 W& }$ g, y9 u

5 P9 U5 k1 T+ M# N=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
/ Q6 T, @9 J& J   app like this:
3 y9 }: ^% X3 {0 X$ K1 n  E- J9 [# |: E3 Y% Q
   BPX exec_int if ax==68) i# n$ d' W% ]) N$ C; U
   (function called is located at byte ptr [ebp+1Dh] and client eip is
# U; ~  g, Y4 s+ [   located at [ebp+48h] for 32Bit apps)
' i' q$ q3 [5 v+ w( R1 s6 L__________________________________________________________________________
4 f' e$ `1 h; ]. _, P4 c  Y0 X. W8 ?0 g( Q: d3 z* Y2 N( p5 }# h
' w9 [: ?& c/ x8 d( e$ T% t3 l. a7 s
Method 08+ o6 k0 i1 y3 ^: ]! }
=========; T$ H4 j4 c1 u* t- X8 d% m! J

' {) A* K/ ]) t9 V& uIt is not a method of detection of SoftICE but a possibility to crash the
$ }) H# N& R% z9 D  esystem by intercepting int 01h and int 03h and redirecting them to another
( K2 C* ^0 b$ Uroutine.
: m7 _4 F7 H0 i  j: L$ \+ `$ lIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
& r1 W& Q$ f5 I) E! C5 s/ }to the new routine to execute (hangs computer...)
$ ~+ A" K: e5 _" @
/ ]6 B& k& h/ [! M; n: D, j7 `    mov     ah, 25h) Z& I% p5 U& l" G4 d
    mov     al, Int_Number (01h or 03h)
0 N; Y' V: A6 s6 [( G/ a. h    mov     dx, offset New_Int_Routine
7 ^' h7 \6 e5 Y  j* E* Y+ n    int     21h
9 F, H, x. I3 }
% W; I$ q& U! ]* _0 W# ?  z__________________________________________________________________________
6 \' f. ?, R* n0 z4 E6 e
+ }0 F* Z1 ~- a$ xMethod 09
4 F' l' k: |$ [+ ~9 P' Y4 `=========9 S; [; p" ]- }/ F' e# v

+ r4 k4 d2 M8 a; A0 I' o; T( H' ^/ FThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only  X2 j, M1 V0 ~+ q1 n: Q3 f; c
performed in ring0 (VxD or a ring3 app using the VxdCall).
, ~  }" o. t3 b/ g* Z" H5 T9 \The Get_DDB service is used to determine whether or not a VxD is installed, b# w! }( \1 Z5 z( `) `
for the specified device and returns a Device Description Block (in ecx) for4 W$ c( N9 @- a% d" d% r+ p% E
that device if it is installed.1 s+ T! E; g: f5 a1 U$ u
5 [( f& z1 g# I0 b* i3 k8 P' F6 g$ S
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID# S* @( H( u; n4 X/ a! n* v
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
: v7 z! c. X9 W4 T0 r# J( G   VMMCall Get_DDB; V  p0 \- L' L) {" k
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
$ k8 f! d! e; w& o' u7 o' C: H# g& a# Y* j2 ^) q' k
Note as well that you can easily detect this method with SoftICE:0 L: S' U. \8 W+ n# U- m
   bpx Get_DDB if ax==0202 || ax==7a5fh
) Z( l' Z) t8 s
. ^* I( ?" H5 h* g__________________________________________________________________________& X7 ]+ e2 K- W$ Q7 K

+ K! R" C; B# K7 F/ P) t8 JMethod 10: ~* A+ S& M+ r/ J1 Z/ d& |( j
=========" n8 C: r4 w' I" t$ Y  T1 Q' A/ N
% p- C4 y% H6 L# N$ P
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
0 y6 I  T# q$ F( ?  SoftICE while the option is enable!!
+ L+ D( ]3 N( c* R0 a' ~1 V9 }8 F4 B8 X
This trick is very efficient:2 {# _1 U# \1 ~
by checking the Debug Registers, you can detect if SoftICE is loaded. [( Q9 G/ V" o5 F/ u
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
! h+ M& L0 |/ [there are some memory breakpoints set (dr0 to dr3) simply by reading their5 q0 T' ~4 W9 |( W% o7 I
value (in ring0 only). Values can be manipulated and or changed as well
- _) k- K( Q9 c. i(clearing BPMs for instance)
3 [1 M/ L. ?' U) d" }- M- `
4 r6 O# |2 t4 h9 N__________________________________________________________________________8 g& ~$ j0 [' P

" S" {& d# M7 v! z( {Method 11
" f0 v: d. q5 k& N: G8 `, q=========
  U, M* @5 h5 j  A4 X- v' a5 C1 X$ U
5 ], ^. r1 K# q, G1 x4 J6 wThis method is most known as 'MeltICE' because it has been freely distributed" V6 W6 n: @: T" q6 i3 Y
via www.winfiles.com. However it was first used by NuMega people to allow. ?( _) [" o* c
Symbol Loader to check if SoftICE was active or not (the code is located  i3 y& x* v- ^! }4 R
inside nmtrans.dll).. M1 [! a1 Q$ W" X1 h. |" j& |

) ?, Y$ B* p7 tThe way it works is very simple:
; Y$ ]* n6 P  y9 y# u' \" i0 O6 t# BIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
; L! Q* M% C* h# w7 }4 n4 gWinNT) with the CreateFileA API.; G$ x; ]4 p- G" }

" k, K7 M' v5 \Here is a sample (checking for 'SICE'):
  I: U- C$ t4 {8 F
, j% }& I: `$ _% z  @+ WBOOL IsSoftIce95Loaded()
; U4 ~- u' n+ J, ~3 i/ q( x{
/ v2 @1 V# ^& J. ^. V: \% p2 ~3 j   HANDLE hFile;  8 M8 |) `! e2 S/ B; J/ E  e
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
9 ^8 K- z+ ?. G  _- B                      FILE_SHARE_READ | FILE_SHARE_WRITE,; _& ~: ]% f) z# _" a
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);1 E/ g: ^4 }( ~8 o# e- I
   if( hFile != INVALID_HANDLE_VALUE )
, W3 N2 d' n: O1 x& C: d   {
& @0 q# k- M' W; {1 n0 K9 R7 T6 K      CloseHandle(hFile);
4 z7 G. j( |2 D  \. m4 a% W9 n% i& ?( d      return TRUE;
. d0 _# K( w- k% V   }
8 _$ [8 O3 A; h# ~   return FALSE;
) v6 Z* Y4 b7 w9 H}
% ?8 i8 W$ f# ]# r1 E. H3 y9 @) I
Although this trick calls the CreateFileA function, don't even expect to be
" W1 Q9 ^0 l( {' o: A" kable to intercept it by installing a IFS hook: it will not work, no way!
+ P! J, s. h; f/ h9 N  YIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
! R. [1 e& g. @9 m  }) t# Rservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
( i2 z( h1 x7 ^! N4 x, T3 i' L, \and then browse the DDB list until it find the VxD and its DDB_Control_Proc
& Y/ Q4 S7 `$ X7 |field.7 k- h- H( A; ]; d; D' r& x
In fact, its purpose is not to load/unload VxDs but only to send a
! U, d4 c$ s2 g9 UW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)/ ~, u) x5 N1 ?2 O- E4 u/ v
to the VxD Control_Dispatch proc (how the hell a shareware soft could try; }- z/ z8 \+ k, o
to load/unload a non-dynamically loadable driver such as SoftICE ;-)., a: K2 B' ^5 C  P
If the VxD is loaded, it will always clear eax and the Carry flag to allow( v7 h0 b  F3 S' j
its handle to be opened and then, will be detected.
. d3 _# z! s. b1 D( _2 H" sYou can check that simply by hooking Winice.exe control proc entry point% t0 }9 d4 \0 q, M3 S: J
while running MeltICE.6 c. q" g+ j0 p& e+ N+ O% y. Q8 E
( Q9 d6 t6 S) n9 V
5 }# [) S( V, |- B
  00401067:  push      00402025    ; \\.\SICE! Z7 v' ], y- ]- l' x! j4 u5 T
  0040106C:  call      CreateFileA
% v! T- `) G8 z- |  00401071:  cmp       eax,-001  u% D' I6 _9 T* I) t9 Z# p; R
  00401074:  je        00401091
* ^3 q1 g/ ^$ m$ [: Y- N! `+ y3 E; ^3 M( o2 j

7 \0 F' [1 F) l+ _9 j: x' NThere could be hundreds of BPX you could use to detect this trick.5 K) d2 b& q8 s, }4 {/ j. N" p
-The most classical one is:
) e7 W8 U7 P: m, X# l  H  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||' z- M1 T( n8 K
    *(esp-&gt;4+4)=='NTIC'
3 H) {2 ^& R" R& c- G# W
  H# C+ t+ E# C1 i" b7 N; ]-The most exotic ones (could be very slooooow :-(
/ n9 \3 N* x- H6 l5 I! t' r8 _   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
3 u% p" R' L, Z     ;will break 3 times :-(! L' F8 B2 J8 U3 |1 j0 H! {

8 l1 T1 `* I8 _-or (a bit) faster: ' f; U9 u. s' I5 I  C, i
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')6 E" \5 s% T* D3 n4 G  i
5 m0 [: u- D. \* y4 {4 _
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  ; J  o' W& k4 A, h+ L
     ;will break 3 times :-(1 b! a  b8 p. z- H$ L  u* {
- S! O# k9 ?: r% C* y! }% N
-Much faster:  s1 E/ |4 e% I0 }
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
5 q" y7 P7 Y. R! @
6 }2 A$ Y( e! L+ R4 h4 KNote also that some programs (like AZPR3.00) use de old 16-bit _lopen- t7 b, e: y1 Z
function to do the same job:4 S: v2 R& \% @: j
3 G0 W/ Z. r, D
   push    00                        ; OF_READ9 F5 q+ x5 y% n6 v7 `% n$ Z/ A
   mov     eax,[00656634]            ; '\\.\SICE',0
/ t, h) m) ?2 A" O   push    eax6 N1 b4 \& |2 m, P+ c9 m
   call    KERNEL32!_lopen7 F2 V& O2 a8 s
   inc     eax5 R! A: Z% h" i; a% p& |: \
   jnz     00650589                  ; detected4 n3 V* d! x" O* {/ `6 a2 @1 h8 m
   push    00                        ; OF_READ
$ u; h, `$ v/ E. C& p   mov     eax,[00656638]            ; '\\.\SICE'3 }/ t4 Y( v$ f9 Q8 ~
   push    eax
( ^/ t+ l1 E6 t& _6 Q  x   call    KERNEL32!_lopen
: i- T$ j- r9 M- C& _   inc     eax
- D1 ?6 ]/ L$ n! V   jz      006505ae                  ; not detected3 l3 N$ y4 c1 @& ]) W( H

" |5 j5 O% q) F' V8 g* w0 ^% @0 V  \, b) M4 W% b
__________________________________________________________________________- Q! e4 i8 X3 ]5 R; o2 Y' u0 r
& F! m: y* L$ u* G7 {
Method 12" \0 p( Y3 H; k+ E2 h
=========
" ^$ V7 ^3 D6 _2 Z0 g$ ?$ T8 Z
, f! d: w5 V2 D) X' O/ @+ DThis trick is similar to int41h/4fh Debugger installation check (code 05( X0 N2 ?8 ?8 u) r! C; h
&amp; 06) but very limited because it's only available for Win95/98 (not NT)
7 Z5 b+ U, U! Bas it uses the VxDCall backdoor. This detection was found in Bleem Demo.
  ?- G7 x: p; Q7 B% v4 l2 B' d3 _! j5 @5 P0 S
   push  0000004fh         ; function 4fh  J* Y/ \9 U2 i3 M
   push  002a002ah         ; high word specifies which VxD (VWIN32)) J3 V9 g/ x8 ^' [
                           ; low word specifies which service
, S3 i' e9 K: R8 q! P" d                             (VWIN32_Int41Dispatch)
1 ~+ @3 B0 F/ B6 d   call  Kernel32!ORD_001  ; VxdCall" R- ?4 f, }. I0 |
   cmp   ax, 0f386h        ; magic number returned by system debuggers$ o* w6 `) U+ \( X5 T
   jz    SoftICE_detected4 h7 a) [3 Q' N) {( z
) m4 V5 V6 X! h
Here again, several ways to detect it:
) q/ C2 O7 }( @3 h5 o, f: T
/ l2 T0 e3 z; n% J- Z    BPINT 41 if ax==4f
" ~" E8 u! H" Q& t7 _! @* Q0 X" e: B* J+ z5 p1 w6 ^7 @
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one4 ~+ X$ h0 X2 G
7 v' W  x2 [6 a* @! z
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A0 F) [  V$ ^- i! \( _  Z

3 m6 r' ^; m9 E) U    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
8 `- p4 \) Q" h  j6 Q/ D" u6 ]+ l) t$ y, Z- l: V9 ]5 C
__________________________________________________________________________5 x. `. P; z. p5 P; `

1 K2 p4 V" f7 x0 i7 s% fMethod 137 h) a: ]6 q: p  T. e4 c% U
=========
1 R: h/ s# R! E: {) ?
/ D/ ~# q' {) P/ t! k. L; L& rNot a real method of detection, but a good way to know if SoftICE is) h6 ^: M3 S- X9 ]( }" t6 ~
installed on a computer and to locate its installation directory.$ Z0 E$ m$ T0 Z$ s4 y1 w
It is used by few softs which access the following registry keys (usually #2) :
8 q+ N2 J: J4 s- J! H2 o7 L8 O& D6 a5 T7 @9 y: J
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
9 F7 L% U; E2 O- V5 w" i\Uninstall\SoftICE
. B6 K3 z# i3 k0 k8 b-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE6 }# }& D) @* c" w
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
3 i- e% G6 |; f! Y1 a+ X* t& `: n5 ]2 d\App Paths\Loader32.Exe( [/ j- z! y. Q2 |

1 u3 D4 d7 J' ^6 J2 W, i8 y3 t5 B5 Q$ l
Note that some nasty apps could then erase all files from SoftICE directory1 d: T1 |3 s  O: r
(I faced that once :-(
0 x- m/ e, E- H8 q, C
. x+ p9 ~: y8 VUseful breakpoint to detect it:
7 q$ j  O. n% y, ]! c# c, B& K0 k0 O0 `
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
& X7 j8 ?4 {. a" S8 C  ~" A0 S: f+ ^1 v( }+ }3 ^: i
__________________________________________________________________________7 m  [) F6 x$ Y6 Y
' d$ S: _) F  N& `& A3 }0 S
3 f6 `- x( p4 z: C, a
Method 14 * \3 W  a( ?$ L9 S! O7 x
=========4 x% B+ R& E+ f9 r: S2 H

  S$ N4 t: v9 W1 z& eA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
9 i  m: M2 j- A/ nis to determines whether a debugger is running on your system (ring0 only).  M9 F  y8 ?' v* K# ?6 R; K
; _1 [* n8 L2 _  E
   VMMCall Test_Debug_Installed
6 X8 R1 B0 l  V2 L! E2 o8 P   je      not_installed
& X% N& v, `: ^) d5 m, g. ]4 Q6 P+ z) |& m% X  K6 M' D, U# _
This service just checks a flag.
* F) u0 y" a) a, k</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部