About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>& i: b# I2 V3 J' c/ X
<TBODY>
2 O+ E! A& i' D8 O* J2 x2 T<TR>4 ~) d+ R1 g9 I8 X- a3 M  Z6 R
<TD><PRE>Method 01 ) n$ `* u. Q2 i( [8 k
=========; N8 I$ b- X7 [! w

' K( q5 j, H7 V, |4 J8 W" z: TThis method of detection of SoftICE (as well as the following one) is
- f/ f  ^- y! L/ G- |& O) Pused by the majority of packers/encryptors found on Internet.% ]# k5 O1 d3 ?% ?) q
It seeks the signature of BoundsChecker in SoftICE; O  U1 @9 r4 y2 d) o3 W7 T7 D" u

1 h. }( b% Q1 s6 |2 Q' t    mov     ebp, 04243484Bh        ; 'BCHK'( [+ m' n; U  N/ f, g: t# a! C
    mov     ax, 04h" p1 z/ X4 t; b/ {
    int     3      
" f- [8 }+ P. v& g: s! a    cmp     al,45 \7 l7 U" X5 Y, b+ }. w
    jnz     SoftICE_Detected2 F: S! A) A) Q: p% X2 V% A" J
# H6 k6 U% A5 B- n6 J$ k
___________________________________________________________________________
; w" m8 _) J- ^* A0 R4 r# R0 h3 l
Method 02
1 F, k$ v6 F8 l- `- ^=========
$ k5 n2 Y4 |: Z. a6 @; R- w7 p  K2 |6 g- Y5 t0 n7 Y3 q# t
Still a method very much used (perhaps the most frequent one).  It is used
7 x7 Q7 k7 l9 r+ \4 ~. [! [% Ato get SoftICE 'Back Door commands' which gives infos on Breakpoints,
( R3 H' V$ D( k1 d/ Aor execute SoftICE commands...
4 y& b6 ?) d- S/ KIt is also used to crash SoftICE and to force it to execute any commands
" i6 R8 n/ {3 R8 W- B, s(HBOOT...) :-((  
# a6 S8 Y1 z3 T- \8 R) O3 z$ d/ g0 {! P" x% K) B3 y# o
Here is a quick description:9 `, @$ Z+ _9 y
-AX = 0910h   (Display string in SIce windows), z& F6 w, b5 D0 K3 e8 Z
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
( j( L! m, x* c' A2 M& E, k6 M-AX = 0912h   (Get breakpoint infos)1 }$ C- H: e' |2 a! Q
-AX = 0913h   (Set Sice breakpoints)* r  C/ u7 r" [, z$ ^, u* w
-AX = 0914h   (Remove SIce breakoints)
, ^: S3 Q. e0 ?1 T! w) A( E
9 \& Q) M8 [/ T8 L1 a- h0 M* b6 MEach time you'll meet this trick, you'll see:/ M  G  B* B! [0 M
-SI = 4647h1 ?: O) K& T7 c- M: E1 J
-DI = 4A4Dh# Q- }7 u; o. k9 ~* \: n9 N  g
Which are the 'magic values' used by SoftIce.& H9 ?8 D( L2 u/ L% O2 ~: v+ w
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.1 k6 ~9 ]5 Z3 K7 S* Z

  G8 d: ~- s1 I, q* tHere is one example from the file "Haspinst.exe" which is the dongle HASP
3 W8 `$ h7 c# U0 `/ ~Envelope utility use to protect DOS applications:
, ?3 R6 x' t% Z/ ?! ]+ n2 X
( |1 P( h4 Y. x
9 }: B6 b2 e: T- Z4C19:0095   MOV    AX,0911  ; execute command.
# ~- p# `. J2 g- h3 D0 K/ \( X4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
% \+ N7 V/ |; {4C19:009A   MOV    SI,4647  ; 1st magic value.4 X2 @+ f" Q$ v# Z( l# n
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.# T, Y8 F7 p# {
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*). j8 j# U5 A  \: c3 }0 a
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute1 M2 H; e" S3 t6 @2 u* k
4C19:00A4   INC    CX
) v! Y' j, u# D* ~+ M: f. x& ~! g4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute, {" H( N4 u4 U9 G/ N7 K7 h& r
4C19:00A8   JB     0095     ; 6 different commands.4 F2 z# I( A, I
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.5 \. s' X0 C0 `8 J% I+ m4 o
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
5 ?/ @  t( H: s% g5 Z  c$ c- J$ s. P$ ?( h2 r" y
The program will execute 6 different SIce commands located at ds:dx, which
) t. F* h+ D( n( }are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
: C2 x4 o' j% q3 W8 l/ h- z
. A! {, ^& ?( ~# q* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.  n! B( S8 G  G9 q! e% {8 v! j# I
___________________________________________________________________________
, g8 [$ g8 J2 K
! ^1 o( j( F5 x, S5 n, t! L8 ?4 U, F
Method 03
  W1 v3 v1 [9 G; j  U! X/ d=========
: F3 ~0 f6 k4 n+ @/ o
: m& @; N, n* E3 A+ A$ {; j) P' zLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h0 A" h- N1 ~, u" Q
(API Get entry point)! h: [4 P2 \6 g- g5 i1 y- U7 {
        
/ A% C1 u' O5 _: Q8 {3 y# m5 W
# Z0 _& \. m1 J  n% l# @' ?    xor     di,di3 V0 n) C5 ]$ `( b7 c# s5 m$ G
    mov     es,di
" @7 n: r3 H/ ~2 I    mov     ax, 1684h       4 I0 ~- X$ D3 ^* \7 S
    mov     bx, 0202h       ; VxD ID of winice" S+ J# U  \* \2 d8 I2 _) W" o
    int     2Fh
! V' k3 j4 }% \2 C/ }0 R. Y& m' A/ ?    mov     ax, es          ; ES:DI -&gt; VxD API entry point! c4 P7 _$ E& c. w: Z+ v
    add     ax, di
; ?% R1 n5 X' [4 c. v" t    test    ax,ax
; \0 R8 r+ M4 E4 t    jnz     SoftICE_Detected
7 u( [& K2 @, v6 ]8 j8 B1 w* }5 d+ U1 P" u
___________________________________________________________________________
. w5 g' v% ]8 }- O: x+ K' N9 v( W# _' ?3 \2 X
Method 045 y! Z( r6 u5 r! u; g# q
=========
7 D+ ?- a+ P1 g5 F
/ F3 C4 K3 b; c; S3 m' T7 HMethod identical to the preceding one except that it seeks the ID of SoftICE
+ j5 u- n" q& N# R8 U2 H* kGFX VxD.9 r! I$ w. K1 G: O1 N7 f
. w/ i2 i( P+ d$ T# z1 ^+ R
    xor     di,di% f: B; e5 G/ y9 v' z
    mov     es,di
/ \5 D9 V/ ~4 A/ ~6 V    mov     ax, 1684h       % j# L5 K  t! U9 m6 [- p
    mov     bx, 7a5Fh       ; VxD ID of SIWVID
! _, A7 f1 T/ E, O( D8 ~    int     2fh$ r- G: S. |: T2 R3 ~7 S7 d& R
    mov     ax, es          ; ES:DI -&gt; VxD API entry point# ~+ C* j/ T; k# z5 i# g
    add     ax, di, x: c& B6 Y1 _# d. E2 F% i
    test    ax,ax
+ r' S: d7 m. r9 [" @    jnz     SoftICE_Detected
" h  X+ H& ^$ W3 H/ m* x* ^! l, j8 @
__________________________________________________________________________
, B) N; b: w' w$ o; _( v$ h5 U% ]7 J; u* |

' H( v3 z9 f1 }, S: q; l# VMethod 05
! F, r# m7 C2 P9 ?. N9 V( i=========
9 @. ^% o. X6 b+ `/ u, x
% _' h5 B! L& }' ^" Q# JMethod seeking the 'magic number' 0F386h returned (in ax) by all system
2 ]$ C% G$ B5 J# c. g2 qdebugger. It calls the int 41h, function 4Fh.
# {% c: _& \, O5 GThere are several alternatives.  
( x' B5 c7 x# z, a0 @# K
+ ]4 i1 O6 T) sThe following one is the simplest:
* C3 i/ m  _  p" K7 M& g: `% y0 Y( E% z
    mov     ax,4fh9 c5 g5 R; a7 {2 S5 J, e$ a
    int     41h- O& s, |" T4 `
    cmp     ax, 0F3863 X9 P9 N. g( z4 O; ?* L4 b
    jz      SoftICE_detected
% h! ~6 u" z' p- s9 i
/ A4 e. \  Q2 E( A  z# Z" S# W3 q5 P! ]: ?
Next method as well as the following one are 2 examples from Stone's
! Y& n  g8 `6 R. m5 n! v"stn-wid.zip" (www.cracking.net):: Y. ^+ `8 i% C9 g: t

/ ^& o4 q# F* ]    mov     bx, cs
0 e! y9 X" {7 b$ ^: g    lea     dx, int41handler2# V% \% t+ W3 M/ y8 I0 O
    xchg    dx, es:[41h*4]
4 K' h7 {4 o' j4 o% _    xchg    bx, es:[41h*4+2]$ B$ @+ l  O. L/ `- [& q- d
    mov     ax,4fh. P( Q- t0 d3 r
    int     41h
( e7 t: b! S9 D0 g& w: ~    xchg    dx, es:[41h*4]
# Q6 q, b* n4 L) x: P2 _6 B2 |    xchg    bx, es:[41h*4+2]
5 R8 v# h6 k& a6 X! L: h7 l    cmp     ax, 0f386h- l4 H( J- T6 A. u3 h$ S
    jz      SoftICE_detected
; W. w- I+ h3 T- m
! E3 k: ?8 W+ m% B9 uint41handler2 PROC
# L( G9 Q6 ]- S# a* h    iret
* f5 p1 t$ d, iint41handler2 ENDP+ k1 b+ @) q; V: r

2 {' q  O  F4 R1 F4 G4 O) f8 d' O" ?# p
_________________________________________________________________________& }+ i( b' ^& g6 \- Y( E3 m

' H; H4 P6 X5 q! r& N7 e
( W! L7 o, K9 ^Method 06- D, s# K1 b3 t: W
=========
- L- e: z1 t2 @$ k" w5 I; C* O, K: ^# Q4 h+ B
, {1 S( y* o9 |0 w) z- m
2nd method similar to the preceding one but more difficult to detect:; R: H7 S: [! \& h% x* M

/ o$ P4 {8 ]4 P3 t
' P$ q4 B2 ~" k1 ?! F9 jint41handler PROC2 A5 Z! U" i" w' J
    mov     cl,al
' P( E" x% |, g0 I  ~, `& l# m  A    iret# K6 P& Y% c( v, D! Z
int41handler ENDP
& D* h5 O! X! l! {9 a; C( o2 m+ \* F' \" O9 z$ O- h; M% d
1 g6 [; H* }% H7 y5 \+ I: t
    xor     ax,ax" Z5 c# d/ h2 N  i6 S, b$ l
    mov     es,ax: O8 o; D' a( ~! j: [& g
    mov     bx, cs  ?. ~4 d6 w( T9 t5 E8 t
    lea     dx, int41handler
: e& C7 `2 J6 q5 c7 A. M    xchg    dx, es:[41h*4]
) ?* x3 Q6 x9 ?# f8 l7 x. N  y    xchg    bx, es:[41h*4+2]
6 d+ K  j( z0 h0 x! Q5 X' [0 g  N    in      al, 40h' Y! q* r2 G! J5 w5 T
    xor     cx,cx( x2 q4 C3 Y6 I+ r4 W' _% }: R
    int     41h( Y* i' {! M3 c3 |* x4 j# ~5 B9 _& u
    xchg    dx, es:[41h*4]
* i& C1 W  t3 ]; v- g: R    xchg    bx, es:[41h*4+2]
6 J* r8 f6 z' l' C! ^    cmp     cl,al
( r6 L9 Z  ?* n8 O9 W- q/ u7 `  t) ?    jnz     SoftICE_detected
& ]5 ?0 [4 X+ Y( i6 n
5 g) y6 I. U( t- i8 x! R2 i3 ?_________________________________________________________________________
2 C' ?0 ~; h, S" V" u  F, p; @1 E% G4 B0 A& `& t- J
Method 07, ^+ \! \, `% m. {
=========
, p9 t/ D5 K2 r* j" p6 C# ?/ T0 ?' V4 `
Method of detection of the WinICE handler in the int68h (V86)
, d+ B/ v  a* ]1 k- |0 U9 w) `# M$ _; N( ^
    mov     ah,43h6 E2 a7 |) h3 \$ h
    int     68h
; n& d. o) h! }, X$ {) B% f    cmp     ax,0F386h- H8 i/ ]$ r5 B$ H& U$ `. H
    jz      SoftICE_Detected8 i# W7 O( [0 ]

2 ^$ G$ V# V6 C2 T8 H% }3 r% k( b. H( s- w0 N! n! n- W
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
5 F& u$ h: S7 c, ]1 E4 o   app like this:
3 a: U& X+ B$ S2 B& {) ?! R9 S- j4 Q2 K% }2 ]% u- m
   BPX exec_int if ax==68% }; j' F8 @  @# p; B8 H  \
   (function called is located at byte ptr [ebp+1Dh] and client eip is6 J* a! g; }, E6 o( n
   located at [ebp+48h] for 32Bit apps)
- l) N. J# q& i% k__________________________________________________________________________
+ Z6 f6 L- Z9 a! j& a% z9 Y( T4 s. \1 q; e8 p  H7 G
2 [1 ~9 n+ W5 B
Method 08, Z2 b% h. o- J$ [$ S9 k3 Y& j
=========
6 m: F# T) f  i$ D: \$ |' s& |) [2 T5 [! W* [- e% C
It is not a method of detection of SoftICE but a possibility to crash the
* P$ _: c( J5 G& Msystem by intercepting int 01h and int 03h and redirecting them to another
, {" d  e3 ], }% [$ h$ xroutine.
" S  j+ T2 J! g% [* oIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
6 }  X# [* K0 p- k- c3 w- Qto the new routine to execute (hangs computer...)
8 W$ A' T; q) S# f, H1 R
# n+ h) c, S. R" o9 ]    mov     ah, 25h
& c8 D9 c8 e. `* |    mov     al, Int_Number (01h or 03h)* h$ y' @+ q6 x9 }
    mov     dx, offset New_Int_Routine
. ], |. G7 r* L  h) V5 l, D    int     21h5 s1 X; v* Z* l
4 }. \; T1 M; J7 v# A; p, [  C* G9 r
__________________________________________________________________________3 Q+ D* m6 l. i4 n' O  {
! X6 N! i; |; _) J9 w; H! Y0 M
Method 09
9 C, }# O2 y, U2 _8 o=========, e$ }% i" M+ T3 [7 v8 z

9 m; e& Z" b5 J8 gThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only; }* B: S) z  I
performed in ring0 (VxD or a ring3 app using the VxdCall).
# \/ C: t9 ^6 l: w* v# ]The Get_DDB service is used to determine whether or not a VxD is installed
8 Q- {9 ]% L7 k$ o  M" v& m1 I( m8 B, bfor the specified device and returns a Device Description Block (in ecx) for/ n( u3 u8 B8 T6 i1 h$ Q5 k- W! P( ]
that device if it is installed.0 @, i4 e* R* M( h5 a4 i

. D0 ^% J4 L5 M; Z, x   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
; X6 B; L7 W3 ~- L6 W   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
' ^4 W" z  D! z, x3 q5 r   VMMCall Get_DDB% Y- b+ v5 l* ]. c' h9 o; n9 u
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
7 R( y8 X9 Q& K2 F% [- D; U
# A2 ~% B9 e5 m" X- i5 h: HNote as well that you can easily detect this method with SoftICE:$ ]+ w% b2 F, W" q; M
   bpx Get_DDB if ax==0202 || ax==7a5fh
- S% J1 k4 m/ ^; G) F" q0 S. P3 u" A" T: `) f
__________________________________________________________________________
8 z6 q- ]2 k/ x! k/ _+ |: R3 ^. v# O8 N0 D4 I9 q, C8 R: I
Method 10  s- w8 [2 d! z& ]6 M
=========
! A& `* @0 I) A0 R* G; U% j
- R. A2 f8 @" V1 i; c/ R5 a7 t=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
3 i; _& m& h. Z/ @  SoftICE while the option is enable!!- C. Q! O& Z2 L# _
1 Z7 `7 T7 ~( d  f! M% H3 {( m3 p
This trick is very efficient:
9 G2 n7 b/ D2 ]3 y2 t& cby checking the Debug Registers, you can detect if SoftICE is loaded
  u- P! @9 T2 B, ~8 {/ R; D6 K(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
% x5 F: L# y& {1 `0 Ethere are some memory breakpoints set (dr0 to dr3) simply by reading their# ~  u' }4 _( C0 E
value (in ring0 only). Values can be manipulated and or changed as well
7 S2 v! L# D" w(clearing BPMs for instance)
) T  B2 S8 q; [: g0 a# u/ c- T, r# i3 [! d
__________________________________________________________________________
4 R: X, _3 J+ U9 V1 ]/ Y/ [2 ^$ R+ `$ J" _5 k
Method 11
  F! }3 L, [2 ^) K- s; O=========# V2 ~2 @; w1 h' ~. O0 Q

$ i  S, x  o7 n3 z7 b- A- e3 _( r! `7 JThis method is most known as 'MeltICE' because it has been freely distributed9 a# W- t8 @8 e4 K" u/ q
via www.winfiles.com. However it was first used by NuMega people to allow: {" ^: M- q& C, ]+ |, |& e
Symbol Loader to check if SoftICE was active or not (the code is located
) g1 W" G5 k! c# i( z; [% Cinside nmtrans.dll).
. Y7 N/ z# A# V! ~9 [2 R
1 Z9 e$ Q! U. q# B7 xThe way it works is very simple:' V1 i& }/ ~8 X. V
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for6 R+ T9 P' z$ z
WinNT) with the CreateFileA API.; G/ Q+ R+ b9 Q/ [
9 Z) ]! l3 E4 g( {5 Y, C8 e
Here is a sample (checking for 'SICE'):
9 @! z6 d  v$ V$ P' V5 l
. j, K# Z0 j4 p# _0 _) `BOOL IsSoftIce95Loaded()
, N3 i, m- `& l% Y0 m{
5 ]5 {1 \% g8 }1 h# s$ y# g# W   HANDLE hFile;  
2 h9 c2 _, z+ M$ H6 G   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
$ _( D: B. K' V                      FILE_SHARE_READ | FILE_SHARE_WRITE,% g  G- B% |) V
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);& L3 t7 Y4 k) ?( p# }! W% ?
   if( hFile != INVALID_HANDLE_VALUE )6 e; B, |* Z- q4 `* E0 D/ g6 K4 D1 ?$ X
   {1 j$ V- m  K" `
      CloseHandle(hFile);5 x1 A) d4 F1 d+ G4 a
      return TRUE;' w7 [+ K; {- j7 n
   }
: J; d4 e% p) E5 {  Y' {   return FALSE;3 E) ?% b" ^8 e3 R  @  @
}
' u& _  {, N& _- ]  u3 X" z5 a' }
Although this trick calls the CreateFileA function, don't even expect to be# i* k8 b" s. Q$ z. x
able to intercept it by installing a IFS hook: it will not work, no way!
2 w. h, _: [* c* }2 _) SIn fact, after the call to CreateFileA it will get through VWIN32 0x001F& ?& i* l- H- Q) u4 A- Y, H# c( d% S* |
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)- r( K. l9 j" }% z5 p) V
and then browse the DDB list until it find the VxD and its DDB_Control_Proc- l& Q$ z! n: a$ e0 @1 L: k9 ]2 ]
field.
# k* w0 @8 C& H$ y6 D7 NIn fact, its purpose is not to load/unload VxDs but only to send a : S2 V' ~, h* B7 w
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)& K! W- n; D! G2 b" d
to the VxD Control_Dispatch proc (how the hell a shareware soft could try1 x8 j# z' L8 |# f8 W
to load/unload a non-dynamically loadable driver such as SoftICE ;-).* l. j( K1 S9 c& |
If the VxD is loaded, it will always clear eax and the Carry flag to allow( N9 N' y* M# |) b6 u
its handle to be opened and then, will be detected.* f5 P8 z0 Y0 x
You can check that simply by hooking Winice.exe control proc entry point
# Z, q& S5 z) \1 b/ Awhile running MeltICE.& E$ k7 b! c+ D0 [8 R% I

( I9 R( T# b/ q# b) Y  u2 V9 x1 r, ]4 |4 Q
  00401067:  push      00402025    ; \\.\SICE1 M/ H, \# W" l+ U; I/ j
  0040106C:  call      CreateFileA9 X; {4 n# Q7 t7 X. D2 N  E
  00401071:  cmp       eax,-001
2 y6 h2 u5 `6 J+ ?' h  00401074:  je        00401091
2 C9 P. y8 j+ J& u3 K9 E. R% ]
* g5 W: N* C9 e% d9 A
4 r! M' i. J% l7 U" ~* c1 nThere could be hundreds of BPX you could use to detect this trick.
+ p6 v1 @, R% k5 x6 I7 D/ @7 m-The most classical one is:
' @( Q! `3 O/ H( F" X  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||$ m$ D5 }2 a; b: B4 M
    *(esp-&gt;4+4)=='NTIC'
( s+ ]6 V6 ~/ r2 |0 b( s+ @/ U
: m/ l+ M4 s) d, n& X-The most exotic ones (could be very slooooow :-(
- a6 p6 z- d7 q/ G* Y2 E   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  : N* I+ D6 E* V  ~
     ;will break 3 times :-(
- M  b* Q+ X# x' j  m7 j4 R
. L9 B, b* ]4 o7 |8 L' ]-or (a bit) faster: : F9 y; v& h7 D1 o7 u
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')- f. z1 N. S) y7 v3 q, F  ^# I- Q
/ G- e; U$ W3 z( ^, w( A
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
' o- ^, n* D7 w; E; d* a3 w% n3 Z     ;will break 3 times :-(
# y; G! m# F" t
3 R, C: @9 ^7 U4 E4 ?" {2 e9 l-Much faster:' f( q9 N, E5 C, W
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
7 j" P  O% c0 o1 Z  h: c1 B8 v
# A$ f  I' N. J6 J- ENote also that some programs (like AZPR3.00) use de old 16-bit _lopen
- u# L; b- C" o0 afunction to do the same job:1 r) ?2 N* g. `# `

0 H9 D! H; |2 e" D! ?! q7 s& C$ K: U7 i   push    00                        ; OF_READ
% j# O: ?+ N/ b7 w% O% U   mov     eax,[00656634]            ; '\\.\SICE',0
' T8 \+ g6 B/ J* T0 t   push    eax* F) I4 b' B; P* l0 _
   call    KERNEL32!_lopen
" d* q6 I- P& i( h- D3 \7 @" z- [5 j   inc     eax1 w; G- [  h- t5 i2 D
   jnz     00650589                  ; detected
8 L7 R- `/ l5 K+ I- b   push    00                        ; OF_READ
% k  l& V$ Z8 T   mov     eax,[00656638]            ; '\\.\SICE'
9 t$ E5 u% ]/ u! T   push    eax5 j- x" t; `) r7 b8 `
   call    KERNEL32!_lopen
% \  r$ ]  I) p, ]. q7 L   inc     eax
9 e8 R4 j, [% R   jz      006505ae                  ; not detected
+ P$ O8 {  r2 m! m! y' V/ k& W8 q4 J# A; T

+ {  {4 f4 Y, t! W. j__________________________________________________________________________" u# e6 B6 y# O( d! u& ~
! I+ c! m% l$ }6 E4 y0 f" L; N" Y
Method 12- G+ v( R' s. C4 q+ |% u
=========
" x+ L1 O( E* t, k% [* d7 j3 P) }4 v3 f. f
This trick is similar to int41h/4fh Debugger installation check (code 05
3 i6 C0 X! t$ [+ x&amp; 06) but very limited because it's only available for Win95/98 (not NT)  i7 ^/ F( u& E) @; l+ d
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.2 c9 a' h' T: J" o1 c( }
& w# r: I, e5 j! j
   push  0000004fh         ; function 4fh
3 ]/ q  b: V0 J+ w# V+ c   push  002a002ah         ; high word specifies which VxD (VWIN32)
( O7 c; L  }" D                           ; low word specifies which service
0 A  A" p* k( @3 l! @                             (VWIN32_Int41Dispatch)
4 c2 |5 |% k% k" C* N5 C   call  Kernel32!ORD_001  ; VxdCall+ e  {" P/ ?4 L. H& W
   cmp   ax, 0f386h        ; magic number returned by system debuggers; i2 ?% W  D: U6 q6 t& ~! Z5 E
   jz    SoftICE_detected
# F6 r* L- ?: C9 L6 s1 @7 H/ g8 E: j. L% i
Here again, several ways to detect it:
. g' @5 ^; }: |$ d' ]' p+ R* H
( _/ t2 U& D3 H7 [    BPINT 41 if ax==4f
9 M7 Y1 k! l* d& l% p; ~0 h( I8 _; _" m( y, P, i; ^9 I" H+ ]  a
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
# E/ V( u- }. ]5 g) e: y
0 E1 u4 Q4 R& R1 R5 T* s    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
) _% e$ s5 V6 @! e( v- J4 k% C# @  o  A8 ]  }3 x% P: u% W# ]
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!7 N8 }4 W& C# B

3 m6 r& p: K: @+ O  ]1 k__________________________________________________________________________
5 p, v. z3 t# J  s" k4 y( z% s1 f7 ^: X; F1 U0 q- j- I1 U9 X$ ^
Method 13
. h8 x+ T/ \* V. N9 k; \=========
# f+ x- \3 b2 n- P: T/ }
+ ?, l. ?- J, g7 {2 a- `Not a real method of detection, but a good way to know if SoftICE is
8 r$ e# l3 G$ M& ]5 e, Cinstalled on a computer and to locate its installation directory.
5 R) m' E3 f0 d2 @6 C; C) DIt is used by few softs which access the following registry keys (usually #2) :& W- o* \1 W* i3 G( O9 q0 j
2 v, ?2 e  ?. M+ _
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion  b0 G8 ^( u" U5 M% V. X5 }
\Uninstall\SoftICE5 _4 i8 M0 R: K2 E& ?0 ]
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE3 G6 |, Y8 b: z: ~0 i
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
4 f  @5 q1 _0 k6 U! ?# |\App Paths\Loader32.Exe. p5 @3 y, R4 t6 e

3 O: Z, o5 K1 A! i5 J1 F" ^# @8 P' A
Note that some nasty apps could then erase all files from SoftICE directory
; t9 _& L& h5 i(I faced that once :-(
$ `& u) n& }8 h0 p+ J7 i9 U1 X2 S! j8 N4 C) X9 P
Useful breakpoint to detect it:
( m7 F( j* g7 |4 a  r: {+ r: a, {/ L! }6 I
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
9 f; O( c) P3 |( i/ p: |9 O  w; \1 A
__________________________________________________________________________+ O$ L, T  u2 q7 m) h/ t  W

+ c/ o2 X$ r/ F( d, {; |0 W# [" R
( p: z6 a& {( L3 B# S7 gMethod 14
% T; R3 k4 p8 l* Y7 W% m0 U, J# J=========
+ |2 f, F( I4 K' F( k( w2 A9 v/ w' c. |3 T
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
8 d$ k) {9 t" f) Sis to determines whether a debugger is running on your system (ring0 only).
, V( V6 s# A1 i" I/ n+ a4 T4 g& U  `4 P) s7 b! ?  o
   VMMCall Test_Debug_Installed# F2 {! r/ j7 i# s* j" ~. p, ?- y- i
   je      not_installed/ {. {. I. Q, g5 T3 p  _6 Z

& h( A0 [' V& c# d6 m( tThis service just checks a flag.
0 ?+ C  Z, t0 O' ~2 I8 f' P7 C</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部