About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
6 Z7 ^. z3 {, g+ W( }<TBODY>
$ P; s0 L& S9 t; S3 j) d0 F! U! C3 f<TR>5 ^6 i8 Z; k& j0 z  |4 I
<TD><PRE>Method 01 ( N0 K0 q! P) c
=========$ h5 C+ _0 w# V% r6 A, _

1 X% x' v" e; M( B  X3 x1 T# y1 LThis method of detection of SoftICE (as well as the following one) is
1 G9 I  o7 p9 J! l: Iused by the majority of packers/encryptors found on Internet.; i& f0 g, U& k" I/ `* o* r
It seeks the signature of BoundsChecker in SoftICE
( |+ k6 J4 L1 e4 K
3 U7 }) ^& k3 l$ C    mov     ebp, 04243484Bh        ; 'BCHK'3 F* M$ _% w$ W, d
    mov     ax, 04h1 d& g* r/ H# U7 G3 a
    int     3      
+ l; E7 n6 ^$ O9 \    cmp     al,43 W% i5 B! q4 |; i+ r. q
    jnz     SoftICE_Detected
9 e7 P3 G+ t7 ]! T3 [% j* h# S3 t9 B& ~+ c, \9 p2 B
___________________________________________________________________________
0 v2 |9 _" G+ P1 `- |' ^$ Y  I
& J' \# a, F  s1 k( A% lMethod 02
; d5 p4 w" M) x/ k- R=========
( d# ]' J7 @7 e' W
' m1 s8 [: T7 z8 S; vStill a method very much used (perhaps the most frequent one).  It is used
3 T. }# u4 Y3 f2 Q. ^+ [to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
# m. k1 T6 t% S  `or execute SoftICE commands...
" ~. E; l6 A( _* b( ]( d5 TIt is also used to crash SoftICE and to force it to execute any commands0 Q6 g3 E* i4 ]8 o' Z
(HBOOT...) :-((  * b/ W; {' o! B4 K6 ~0 @; a; y! H

* g; A) o5 i! [' e& CHere is a quick description:. @) {# }4 r4 k6 V
-AX = 0910h   (Display string in SIce windows)- y4 p# c' ]- t( |2 M1 j- D% @! V5 ^
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
- S2 d9 v- i$ k/ p2 q2 n! f" p0 Q-AX = 0912h   (Get breakpoint infos)
0 W+ ^+ l. ?0 o. A. \% l- ^-AX = 0913h   (Set Sice breakpoints): d3 u: Z/ _: ~
-AX = 0914h   (Remove SIce breakoints)
) P& l0 J: s( u; ^4 s' g+ M1 L4 Q# z, B
Each time you'll meet this trick, you'll see:
1 @" T0 C; [! g, W: _) q3 {, i) c-SI = 4647h- a, C3 s; i1 I
-DI = 4A4Dh" ~6 N+ j! {: q9 N5 J( J
Which are the 'magic values' used by SoftIce.
9 P8 V  d. F- d* B, {# c$ p) n# U0 n9 nFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.) \9 V( Y" c8 ]6 j' @8 X

, }9 T! U# O; w( [. ^: |Here is one example from the file "Haspinst.exe" which is the dongle HASP
+ ?# W7 D( B; f/ |4 iEnvelope utility use to protect DOS applications:
( ?  H: ^+ t- l6 d$ f' x5 N- u
8 V# O6 J5 Y4 q% f
9 S: g! n. ], n" [4C19:0095   MOV    AX,0911  ; execute command.3 Y6 E6 u/ E# T' {8 o6 Q) I8 Y
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).6 [/ _- `9 ?0 p+ ^
4C19:009A   MOV    SI,4647  ; 1st magic value.
' `8 n1 v6 i' C/ O; O+ {4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
0 n3 @. m8 Y. ?; g7 Q$ b, L4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
1 V! @% R6 m& o$ A8 M4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
; K- c% k7 x4 d/ ]* C( i# h4C19:00A4   INC    CX
3 x/ y, ~$ o* f4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
: a1 U/ r" h1 o8 l# l. O4C19:00A8   JB     0095     ; 6 different commands.
' R) c' g3 P8 d& @, `$ x) I* }7 u8 C/ E4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
" O8 l2 {4 ]7 B0 f" H4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
# }' L! I# o* H0 u* X2 B. L* x+ _% o; Y( |, [8 U. R2 |* ?- Q0 e
The program will execute 6 different SIce commands located at ds:dx, which3 L* a5 R0 ^& ^0 z( W' [
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
+ [& e; J2 Y0 V/ l4 k& ?6 D
! V# ^! I2 S' u' j, N  W* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.: k9 R% c3 i% R4 E7 b
___________________________________________________________________________( @. t! B5 Y' Y' x$ F: M5 n
6 ]% Q, @0 G" i# b1 y

) }( P1 Q4 R; j. X  @0 b! \8 |Method 03
5 o" i& l7 Y7 B+ u# D3 V# X2 L=========
) ^; n' j) p9 S
/ s6 I# W/ H& d4 U4 l* GLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
. P+ ~5 k8 H. r$ r6 J(API Get entry point)) x* f! R: Y7 O# ?9 z3 `0 a9 b7 V4 L2 N
        4 c! X8 ?2 D9 A1 q

0 M; I4 V: d" ]$ D% B6 c/ I2 X0 `$ D    xor     di,di% @) ~. F) X/ n5 s
    mov     es,di
; C8 P6 h% S1 M" o. R% I9 M7 T+ C6 V    mov     ax, 1684h      
8 I7 w  V. V- G! [# X    mov     bx, 0202h       ; VxD ID of winice& m7 C% t5 p, Y1 t* j
    int     2Fh4 J  q% F  o0 H2 y) p
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
% ~. q% L4 U2 _/ B+ |    add     ax, di, H0 F; q/ G' U
    test    ax,ax
) X' |, Q, z. _+ R( y7 L& ]/ J; R( l    jnz     SoftICE_Detected  k+ _& S0 ~& c/ z) q# @+ o
) Y6 b7 r8 H3 ?9 ?6 c, l- ?
___________________________________________________________________________- ^1 P& z8 I/ M5 l4 _- s
) q# ^" [9 B; t) q1 p+ a
Method 041 @( _: M0 k$ N) _/ i, t
=========) j' o* J1 t$ d9 b" j# }

) v3 h4 Y) o# G$ n7 c6 D" JMethod identical to the preceding one except that it seeks the ID of SoftICE. w6 f2 W0 N. N( J5 }' b) E& s
GFX VxD.
) r: S4 d4 r4 C! Y- T% M# R. }/ g: _3 }8 D8 y! G# o" d
    xor     di,di
# c5 p+ ~2 s2 V7 q6 H  d6 ~    mov     es,di! A0 y: T. {9 a6 [1 ?6 \9 P" j2 }
    mov     ax, 1684h      
% T" m5 [- n. F! A0 `# \: U    mov     bx, 7a5Fh       ; VxD ID of SIWVID
' K1 x7 C% R9 H) z4 S% ~    int     2fh: w4 b* |4 ?8 H- D
    mov     ax, es          ; ES:DI -&gt; VxD API entry point# a) X% }! W: ^; V" R3 G/ }& e- i1 @/ s
    add     ax, di
! q# o8 a0 B1 y6 U4 J" G9 j6 ~  [5 T! j8 n    test    ax,ax6 @6 q( t/ J' y3 I
    jnz     SoftICE_Detected5 B$ _/ O( l1 y1 a# p* l$ ?# X0 ]

+ P6 L' Q( w& J" ^. O1 T) A  M__________________________________________________________________________. m4 k4 M; r- @

6 @! g% |: o- A3 X: I, D
6 \! o: }. j1 U) A. fMethod 056 s  }0 q$ D6 @
=========
/ w) m3 \; X8 B
* r, a* {  w/ b$ ]: ~' k) mMethod seeking the 'magic number' 0F386h returned (in ax) by all system4 m2 B( |( m: ^% G
debugger. It calls the int 41h, function 4Fh., ~+ z) I3 y3 |% ]
There are several alternatives.  
! F/ }/ [: a8 K/ d( ^( i4 B' @' B" L% S% ~: y
The following one is the simplest:1 `  I6 G+ C  o

% [1 D! E9 u' T% o7 Y    mov     ax,4fh- F/ u0 b; C& {2 `0 O- B; [
    int     41h' s' o* r7 @( u
    cmp     ax, 0F386+ z1 b6 L. Z: {0 e
    jz      SoftICE_detected
+ l) g, D5 n/ o/ @/ S
3 B3 I! b0 a$ V" p2 h' l! A* ?) d7 I, u
Next method as well as the following one are 2 examples from Stone's 6 K! B: q$ g* m' d3 l! m) S& R  b
"stn-wid.zip" (www.cracking.net):
8 ?' Z1 U8 @1 f+ ^5 [+ }; B  o8 o' V) I, k
    mov     bx, cs" d' \9 u; ]' o0 Y3 t: h
    lea     dx, int41handler2
7 C" Y0 r0 z- ~( R  \+ Y$ Q    xchg    dx, es:[41h*4]
0 k3 ~# m8 [; w" M2 b8 G% t    xchg    bx, es:[41h*4+2]" a# x) u6 ^/ ]# b" [* h
    mov     ax,4fh- w/ B9 }  g& l; x$ Y/ k
    int     41h
! ^* r* x0 E+ z. ^+ l    xchg    dx, es:[41h*4]. T0 u5 c4 B1 }
    xchg    bx, es:[41h*4+2]% O8 w5 C8 X8 Y4 I' [
    cmp     ax, 0f386h8 F2 E, ]  B& E: y, W6 a/ l
    jz      SoftICE_detected+ x4 G- g* u, O1 v

& H" F: w' A5 ~9 u* vint41handler2 PROC
1 {! U8 U8 n( h: Z8 Q3 U2 w    iret
; s2 F, K6 Z7 q% vint41handler2 ENDP
# ?: l) z8 u2 N) z
& U/ k" e; W. S+ @% i2 Q% j" |' r3 m5 ?# b
_________________________________________________________________________
4 Y0 m* w4 a5 ^$ Z6 O8 ~! d( [# W- K
3 S; K* X* l) C5 \6 K1 ~6 S7 D
Method 060 A: ?3 p2 {( t- K
=========
0 x% B* K3 H1 X4 q' \* Z- N
6 u' \% `1 C2 M5 R  p6 ^; ]8 E' P9 l2 W" L$ v' ~
2nd method similar to the preceding one but more difficult to detect:
; b( v  S0 q3 m+ o2 Z
, Z+ e7 Q8 `  v0 Q9 C" M5 X2 [( {
& s4 y3 p( i2 S9 G  Z" {int41handler PROC
" F* X& H$ w  q5 S( Y3 M( y! ]  J. K    mov     cl,al2 L* d& x1 {: |1 i" m( t: ]0 P9 h. s
    iret$ d8 G, ~5 p( _* }1 ]4 T& i0 n9 Q
int41handler ENDP
* u, }2 n' X5 L; x7 F* `5 B8 v# v3 M

- i' @7 V7 Z4 M8 F* H8 q    xor     ax,ax
, }. T4 j; c% K2 y3 B) m8 }! g    mov     es,ax
. {" D8 z0 Y7 b    mov     bx, cs, m* M3 j: q( P2 P) J
    lea     dx, int41handler
1 h) @" W8 c5 n$ P$ U( h    xchg    dx, es:[41h*4]
" G( j3 {. b+ O9 F    xchg    bx, es:[41h*4+2]& v* V8 L. |# r, j1 S
    in      al, 40h
2 D; Z- S' K! t# P$ f2 ?1 a9 {    xor     cx,cx
( n4 ]& G" l" B, L    int     41h
- t( j8 b% {: I4 J    xchg    dx, es:[41h*4]" O. `( g) g2 M6 h' N4 T
    xchg    bx, es:[41h*4+2], ]" {% U" t8 Q6 v
    cmp     cl,al9 q  [' O8 x$ r0 j$ B1 p
    jnz     SoftICE_detected$ k3 u0 ^  y! b* q- x! J
# [6 R+ D% d& |
_________________________________________________________________________2 C' N' s! m# N* R: j
5 L( J0 D. P3 m% h1 A6 H" |. l
Method 073 ^% v7 ]. L, F& [% K
=========
* I: p  ]9 [0 J/ A1 q
6 W- z" T3 m8 Z# a* J% C+ cMethod of detection of the WinICE handler in the int68h (V86)8 `# M* j6 \( D2 `
9 E- p) d* y6 m3 H
    mov     ah,43h
2 P. A. Z% [1 X+ E5 J    int     68h8 _& m( c! E! Z$ R
    cmp     ax,0F386h  `$ u' i9 c6 _
    jz      SoftICE_Detected/ o% _* e/ l, ]0 s+ _- e+ o" n, N
$ `  P3 x8 Y2 l1 X5 Y$ Z

8 B5 @  m' B; ]9 B2 R) Y. ~* N=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit) ?7 E: |, d& A4 G% A. N. ~5 l$ r
   app like this:
! z% G1 \' @  w5 W' F" [9 a8 ~" e! j, Y$ ]+ e
   BPX exec_int if ax==68
& Y- X' M: s# ?  N+ a/ P   (function called is located at byte ptr [ebp+1Dh] and client eip is" I  ]8 F' R6 m. f
   located at [ebp+48h] for 32Bit apps)
  d  Z1 X3 P  n__________________________________________________________________________& ]* ]& W9 M5 h$ w5 Q

" F1 {' O3 Q. G) s
6 U" d1 Q% G2 }  _5 m7 Z# L& bMethod 08' R; v5 e9 o0 v; [: H. W
=========
. S$ [5 d6 C$ R) H5 W* `( e: e/ ]1 d" g' Z
It is not a method of detection of SoftICE but a possibility to crash the: e6 Z. p6 G1 l! N: ?3 c& M
system by intercepting int 01h and int 03h and redirecting them to another
' c' K; i8 y( {8 Lroutine.& n; u2 [; ~  \
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points8 C* X2 ?: K/ J  f2 E7 w- L# l& s: ^
to the new routine to execute (hangs computer...), Q! J! C/ A- f; I4 H/ n

+ O8 z$ S9 @; X4 p; ^+ E6 x: ~! ?6 M    mov     ah, 25h
7 y% _. O' @. b% j    mov     al, Int_Number (01h or 03h)9 Q* q; Y' a8 E& K% {+ [7 C
    mov     dx, offset New_Int_Routine; q+ T! w# O3 M- l( J2 ], @- ^' o
    int     21h
- K7 x4 P& R7 k2 w) ]' v' c% U: e3 m0 _. ~
__________________________________________________________________________
+ {" s4 J% s( z6 x1 X2 [
/ z' L# R. _& Y# B0 d" SMethod 09
4 o( |1 x- O$ r# }) {% o=========
+ L! Y  I9 A$ x# ~' m1 i9 O7 y! m7 F( m! R
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
/ J. y! F" b  e9 E0 u- r% gperformed in ring0 (VxD or a ring3 app using the VxdCall).
* @# n; G9 Z+ b9 T! |3 n1 Q, [The Get_DDB service is used to determine whether or not a VxD is installed
& t/ M9 w( W8 F! ]' Bfor the specified device and returns a Device Description Block (in ecx) for
0 b$ s5 A  Y7 O* p8 o- Fthat device if it is installed.0 n$ F) _8 W1 ~# i. H+ f1 S6 @6 Y
; U! H" m5 }- P5 l, t- p. `. {8 u
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
# ~" C* F& h) K- _( }   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
- O; A* s0 V& O  k/ z/ }$ a   VMMCall Get_DDB
0 r  t. l" f" W" m& `   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
% r+ h9 i9 D6 r$ C8 G: E4 b  W
* c5 f3 z- b+ B* V. _3 w" xNote as well that you can easily detect this method with SoftICE:
; I. V! J2 M3 N$ Q   bpx Get_DDB if ax==0202 || ax==7a5fh
8 a; A3 \1 _6 m1 h/ v5 j  [" H8 O/ z# B" d7 m; d1 @
__________________________________________________________________________
) _7 J3 N4 f' k- V% w% l  S4 I* E+ S. h- C. ^+ A* ^: D
Method 10
4 v# y$ I# q1 C5 D& Q8 h* a=========
, L1 |  V! W0 Y+ Y- S4 M8 j( u9 J. R# j+ ?& V% F" N$ e) p: }
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
% A: I4 w7 ]0 P2 V: [0 k( H! Y  SoftICE while the option is enable!!& ?2 k2 o- e. X( a( {+ r0 I! F

5 k# x. }/ v7 C* V3 ZThis trick is very efficient:" z" U8 M  a4 O) X7 A9 {
by checking the Debug Registers, you can detect if SoftICE is loaded
1 P2 z6 Q/ n; W1 }2 {- x0 T(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if# m# \1 b8 }/ Q  V2 ?/ k
there are some memory breakpoints set (dr0 to dr3) simply by reading their
4 D* {" F9 S) uvalue (in ring0 only). Values can be manipulated and or changed as well
6 o1 b- _) S6 N5 ^(clearing BPMs for instance)7 _" ]$ v2 p4 G$ P
* k5 x' e- B* k6 Q1 E
__________________________________________________________________________
  P# |0 m. ]' G
* g8 s4 B! ?5 T; q/ S& SMethod 11" z/ P: z8 ], V, p
=========0 _! }6 \/ \2 P3 S
5 C# t1 m) v9 M2 Z
This method is most known as 'MeltICE' because it has been freely distributed
, I0 k) D$ O. ?9 ovia www.winfiles.com. However it was first used by NuMega people to allow
: ~# A: D5 g- ~* G. I& S+ k8 CSymbol Loader to check if SoftICE was active or not (the code is located
7 G+ b' S- r- O/ ?2 Q- V  V& R6 |inside nmtrans.dll).+ g$ F, W' K4 a  {5 K! O
# a9 E7 g5 g8 S( B. V# Y& K
The way it works is very simple:
$ r3 K# f! ]6 v3 [It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
/ S& s1 J0 U* p8 f* M; hWinNT) with the CreateFileA API.
9 g3 F+ f# s/ _" `2 ^$ f9 v& Y
# j: u! q5 c: K- vHere is a sample (checking for 'SICE'):
  {! \( g+ w% V! ]3 E5 {$ F/ g$ Q, W2 B+ H4 K# x1 a
BOOL IsSoftIce95Loaded()
  J. Y& o& T0 X8 r{& i  z. C# f/ Q
   HANDLE hFile;  ( J) s5 ]3 O' ~* }. }2 v
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,9 N3 h7 o8 h- ]
                      FILE_SHARE_READ | FILE_SHARE_WRITE," A4 P! l9 Y4 ~4 v4 E0 m. L- K3 {
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);# X6 @# ^  t+ S! s' E; X' j
   if( hFile != INVALID_HANDLE_VALUE )
8 x( _. @  f  W* C, M   {
5 Z3 K% N1 e: V& }# T' _& W. d, \/ P      CloseHandle(hFile);
8 k# C# y5 Y& F/ ]      return TRUE;) e; Q6 i8 v, b2 r3 T7 H+ k
   }
/ Q7 [/ [6 c2 `- O2 T" j   return FALSE;
1 W# M0 y$ b. R}/ m' [9 j* U1 t( }
7 g1 a5 ^4 v  |' Q
Although this trick calls the CreateFileA function, don't even expect to be- k3 O7 ?3 w' V! x# o
able to intercept it by installing a IFS hook: it will not work, no way!$ L* Q, z4 W  C2 ]) k; n
In fact, after the call to CreateFileA it will get through VWIN32 0x001F2 w1 P& g. u6 M" I- Z! s
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)7 Q5 G2 b1 O  S. k
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
4 @0 p8 f( l, v& c2 O2 [1 K* }2 Cfield.4 C3 F6 A3 X/ o
In fact, its purpose is not to load/unload VxDs but only to send a " u5 n+ ]9 D4 I% y$ t
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)) M7 ^5 M; `+ |/ }% [8 ~0 y2 b3 c
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
( c2 h* \. L) J& [8 J% {" nto load/unload a non-dynamically loadable driver such as SoftICE ;-).
$ v* }0 W$ I( KIf the VxD is loaded, it will always clear eax and the Carry flag to allow, k! u! q4 Q9 @9 I7 P; m- d: B
its handle to be opened and then, will be detected.
" g- e/ X! x/ j! G9 wYou can check that simply by hooking Winice.exe control proc entry point% U1 Z2 k5 Y* N4 _9 x2 A6 L# k
while running MeltICE.- D& _0 H( D8 a8 o! ^

# E! ^$ e9 t$ E& o3 f  L
0 t  Y, x& M" P2 Q5 ^& |6 r  00401067:  push      00402025    ; \\.\SICE8 O) h0 Z3 m" s6 K$ Z
  0040106C:  call      CreateFileA
9 w' \  z- R& {" C0 A2 P* E  00401071:  cmp       eax,-001
/ F) m- ]) C! V. M5 H: j  P+ i  00401074:  je        004010914 z2 y& B3 t" `: a4 L' I
3 u3 e& s( v& Z  u0 a
! B8 X* S) C$ A+ S1 Y8 o
There could be hundreds of BPX you could use to detect this trick.- [1 W% k1 j) i7 f
-The most classical one is:
7 I( ^  L+ L8 s0 {2 i  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
. B9 ]5 c/ ]& |    *(esp-&gt;4+4)=='NTIC'* u: C. o/ x2 v5 D% A
* ]! N6 W7 c- S
-The most exotic ones (could be very slooooow :-(
) K" _# C& R! ]1 V4 o% z   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
6 H' D! M( o8 U" v+ W/ q9 t     ;will break 3 times :-() M2 m$ J/ l+ C; J
2 p1 J9 R9 F# }& b' T  u
-or (a bit) faster: ! M5 l; M- q  R& M4 {
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
5 m& I( _! d2 U' v8 i1 S
( h7 v1 d0 `3 `0 w' B, a+ @   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  ( z1 d# m0 r- K& ?  y+ P
     ;will break 3 times :-(- Q5 j5 _% u5 a

) h* A  v- N3 u8 m# Z9 i-Much faster:3 X( S- @- O& q
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
( X+ R5 `8 H7 G  c, x' I8 |
8 Y" r4 j( ^  c- D% ANote also that some programs (like AZPR3.00) use de old 16-bit _lopen1 Z2 m9 Z$ Q: l
function to do the same job:
4 w3 z& b/ G% `8 G8 s. o- i+ |0 K; E) A4 `& C8 k
   push    00                        ; OF_READ
" g- U) H" F; y  u0 |% c& H   mov     eax,[00656634]            ; '\\.\SICE',0  S4 \% j% f2 @; R/ [5 _
   push    eax
* a) C/ P1 d  S$ S   call    KERNEL32!_lopen2 u3 `% [5 I+ B" T0 b9 o2 T1 |. }& m
   inc     eax* E$ m( U3 o4 k+ n# F$ t
   jnz     00650589                  ; detected
5 Q. ?4 f1 ]9 O' V   push    00                        ; OF_READ
1 {; g' T; T  b9 f* A$ ^8 @   mov     eax,[00656638]            ; '\\.\SICE'
+ E; G- _  m% Z, [* X/ }- o8 {2 x   push    eax
  V1 x# e' o/ x" a6 i   call    KERNEL32!_lopen- T' Z: I# [% C
   inc     eax/ _" n2 ~8 `) B4 _8 b
   jz      006505ae                  ; not detected
& z% Q. w7 t( l2 h1 i# m- X/ H1 g' t0 w1 Q4 O. b6 ?9 n& ?
# s0 a7 e% t% W) l) a2 k4 x
__________________________________________________________________________4 E6 O& j6 b( G+ N

7 [  f' x( J& k: P' l. YMethod 12
: I" @+ Q1 @/ q9 `" l: E" c' j, A=========
3 q# U# I7 T: C+ j8 E. e
3 K4 R( V$ ~# H0 V! X8 \+ ?This trick is similar to int41h/4fh Debugger installation check (code 05
% t4 O! K9 y( m, ?' y$ z&amp; 06) but very limited because it's only available for Win95/98 (not NT)
: {/ O7 s0 Z8 G8 y  was it uses the VxDCall backdoor. This detection was found in Bleem Demo.
4 s2 h2 a6 [: n. P: x) \9 R
/ L; c# U# O0 C1 q   push  0000004fh         ; function 4fh
/ C& \! U8 W  y2 F8 ?4 ?   push  002a002ah         ; high word specifies which VxD (VWIN32)
9 _# x0 B4 m( i/ V, r                           ; low word specifies which service
) h2 F! e  N, ?0 i1 _0 @) b, a                             (VWIN32_Int41Dispatch)
. K) i2 t( c' J; L   call  Kernel32!ORD_001  ; VxdCall
3 \$ H- ?* ~: ]4 X2 _$ t& t   cmp   ax, 0f386h        ; magic number returned by system debuggers! {4 [# W3 C& ]) U- Q# F8 q$ H
   jz    SoftICE_detected- t9 r2 w% e5 h
$ O' |5 p# J( ~; }2 l) T
Here again, several ways to detect it:
5 v& I, l( b8 x: \' j
6 [  n, k* A" E! U    BPINT 41 if ax==4f
$ i; b. P* ?* H8 M" y6 i
) Z7 i. E' N3 \* Z+ K3 i1 z/ O5 A( u    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
& g4 k/ E, A2 E3 d
/ D& m) R/ g' W0 ]    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
7 f4 @1 e) _1 y, m9 @
1 `: D; }) o. k0 X; o, [    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!! |4 S" K3 c8 Q0 m3 o& y9 I
& P& m* K, u1 A/ _, C7 j
__________________________________________________________________________
% E' d- F2 d! P& [5 Z. t
' b0 c2 Y* R4 [% ], h/ `9 g, @Method 137 M; a+ [3 I8 ?& r% g
=========
% g5 \' z5 r9 O$ Q. G8 }6 u! W3 `6 F* s7 b
Not a real method of detection, but a good way to know if SoftICE is
; [$ b! O0 f$ Y, i! Einstalled on a computer and to locate its installation directory." `+ S$ U/ a7 T+ S5 {1 j5 A
It is used by few softs which access the following registry keys (usually #2) :& i" b2 |( j+ ~' Z1 N3 Q
2 V* k9 E% C2 C: M4 q+ b* j
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion7 w  g8 R5 W8 V, z" F. ]! t
\Uninstall\SoftICE9 ?7 g* j# B4 z4 T* r5 O4 E
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
7 ~2 C! t0 G: ~0 [6 E1 @-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
* U( [$ c- A( J$ \9 k5 I- \$ n% f\App Paths\Loader32.Exe' {( R2 S0 d! A

0 q% _# V, Y8 i% }& m$ `" u4 C7 |6 S& p- D0 i
Note that some nasty apps could then erase all files from SoftICE directory, b6 l1 c# _- }; d6 H% V3 |
(I faced that once :-(
, p0 A: M; W# Q& O  o; y* U' k5 V; k2 c5 F8 v
Useful breakpoint to detect it:. S+ q- B* U- n4 e: T/ I5 m6 {: M. Z: A

! j8 r6 c3 Q) O  n* r8 z     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
8 r, M9 V: z5 f- O% t: e+ A3 q
3 A4 d/ ~4 o& X4 i7 W9 F__________________________________________________________________________
, X0 R9 t6 \& V: D" f, ?1 j' t; I6 U( h! H" \. B0 q
# @3 j9 `* V+ j
Method 14 * j; D: z6 s8 @6 o
=========
5 D: j& w2 }: @
; w( F; R5 Y! W! L4 f+ ]A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
0 z5 L3 Z) C% N; Iis to determines whether a debugger is running on your system (ring0 only).
8 O4 h, u/ N8 K) ?3 g  {" T- ]  ^' k$ \9 e2 }
   VMMCall Test_Debug_Installed; o+ S/ H: E6 H- S
   je      not_installed
: n  f5 i- P& d! }
& l8 u9 T* r/ `5 Q  I* DThis service just checks a flag.
' z7 N8 p) S* L" V</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部