找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>2 o0 Y& }3 b3 b3 Q
<TBODY>8 d% [. e- |6 `7 I! ~7 P
<TR>' w  N$ |7 r9 U" v. {
<TD><PRE>Method 01 , ^- _$ @# c% |( x- t- j6 j
=========% Y  v; ^$ F# ^+ j9 w

( C* A3 I# f; q$ M6 GThis method of detection of SoftICE (as well as the following one) is
7 G0 B1 A1 D  r2 ]: rused by the majority of packers/encryptors found on Internet.% H  Y* q5 R6 y% h
It seeks the signature of BoundsChecker in SoftICE
, f2 \% \2 E( D3 [% u7 m) _  ?6 Z9 Z5 B) g- }
    mov     ebp, 04243484Bh        ; 'BCHK'
4 W8 r( A# n# N" V9 V    mov     ax, 04h
, y: J% N/ {, z    int     3       1 u. e0 |- p9 \
    cmp     al,4
% Y( F% C6 N% p6 A0 D" S! F    jnz     SoftICE_Detected. @% s& R4 k+ p- I3 v

8 \* S7 W" @: j# z# `. u___________________________________________________________________________
1 h5 l7 ]! a8 i' @  f3 n6 C8 @; K6 P5 N! ?& {: Q
Method 02; D4 B0 h/ a) X- s' _. M0 q( ^' F) V
=========
& Q/ x$ _+ h1 f1 A. W; M6 a+ b( H; z* X& ]3 b, |6 U
Still a method very much used (perhaps the most frequent one).  It is used
1 ~& {& k' d9 T& E; m) }) _to get SoftICE 'Back Door commands' which gives infos on Breakpoints,3 l  z( v- r0 u- H
or execute SoftICE commands.../ z9 C. B$ }# A( |4 m, k
It is also used to crash SoftICE and to force it to execute any commands9 n* k5 X4 v& Z3 ^. a' G
(HBOOT...) :-((  
) r1 q& b8 l  B) s3 q$ }6 w; l
; `  `% F4 Q1 P, bHere is a quick description:
$ `, @8 Z, u) s) i: d4 O-AX = 0910h   (Display string in SIce windows)* _" r; l5 X2 o3 P1 ^/ ~
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)# ~! E, V/ u! z7 x' K
-AX = 0912h   (Get breakpoint infos)
% m+ [# W' l4 {' S- z-AX = 0913h   (Set Sice breakpoints), ^  h+ }7 a! ]/ m
-AX = 0914h   (Remove SIce breakoints)# y8 e  b& x# S, j; z9 m

& I# N) Z2 d% G! S" D2 FEach time you'll meet this trick, you'll see:
* t6 ]- k; @1 u4 V3 ?' ~-SI = 4647h
7 k3 h" Y7 I# u6 J% E1 O-DI = 4A4Dh
5 T9 O3 f" ~2 B4 b' ]Which are the 'magic values' used by SoftIce.3 L5 e; a0 s7 d* e! ^) {: W' ?6 K
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
4 j0 D6 E# P; }+ ^/ X
; [$ g4 ]# k! D2 [2 t: PHere is one example from the file "Haspinst.exe" which is the dongle HASP
. ?" n- \6 k# i. FEnvelope utility use to protect DOS applications:
3 }: |8 H: N( G
& v5 r& m% d0 e. v$ c+ ]9 S( I$ ^. t2 L3 j3 s' L
4C19:0095   MOV    AX,0911  ; execute command.
, r$ K. Y- m4 a, j4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).7 Y; J+ Q" y; e; _7 K
4C19:009A   MOV    SI,4647  ; 1st magic value.5 J1 e: n; `9 J
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
5 r& y6 x! u- H9 x+ f, d4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)/ E8 u! {( b3 R6 x
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
# l+ f/ H& S. ?6 B* O7 A$ _7 ^4C19:00A4   INC    CX: w* ]% t1 u  i5 h& O5 x, ^+ i
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute: t) A5 A* Q: d0 A
4C19:00A8   JB     0095     ; 6 different commands.4 y& [8 Z1 [+ L9 z% v
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
- b) C; w7 n9 Q4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)0 z' Y7 h$ [) b0 H, D% L

0 O; o( k+ O; K8 `3 j5 l& FThe program will execute 6 different SIce commands located at ds:dx, which* B( D9 [4 O, B4 Q! S4 i
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
6 B* `- U+ J, a/ P7 f% ^2 Y3 @8 J7 S- V) J2 ~7 {" W; }
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
$ [+ ?# H6 @- p6 J( i2 c, ____________________________________________________________________________
+ F- R' B7 ]2 h- W0 n3 b% B7 O5 E4 c2 z" k
$ K$ x" x3 |4 \
Method 03; S, z2 {0 H8 T8 d, a9 e
=========7 k  a! m. i8 ]6 m; X

. M2 \: z- s6 G' N! oLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h* i0 @2 @8 A' e; e/ k
(API Get entry point)
$ h1 G+ O/ q6 S) G" _) E; H        
0 d9 Q# f* E$ O2 S% S8 W. o, X8 X- t" G- P7 z  P3 b% C4 N8 o
    xor     di,di5 \6 L  b- h% ?* b" b
    mov     es,di2 m: ^8 b( ?) l
    mov     ax, 1684h      
6 i# M% a5 h4 w8 S8 O& g6 _/ _    mov     bx, 0202h       ; VxD ID of winice3 b  h8 T) d9 B9 f2 z
    int     2Fh7 x( u6 ?  K) L; h* r
    mov     ax, es          ; ES:DI -&gt; VxD API entry point+ {( C9 N& Q2 ^0 w. b
    add     ax, di1 X% |1 \% q+ U' X0 W" T
    test    ax,ax
8 t+ E1 P: D! f0 U, J4 {5 h/ X% X    jnz     SoftICE_Detected
$ T7 L5 p( M1 `; S% |: n! r& M7 I0 f6 d) \% K
___________________________________________________________________________
6 y2 M: |' b7 I; Y; \' v$ b4 e  B3 z- ^$ t2 K( _
Method 04
6 x7 Q0 [- ?$ U2 O( W5 d=========
  I2 ~& N2 u9 ~$ w
( g  z, h: S  H6 B8 [( m/ q; vMethod identical to the preceding one except that it seeks the ID of SoftICE
" A1 T' ~% Y1 r7 `5 K( }  T3 [GFX VxD.
' @" X  u/ P8 q- I5 {* A
8 N7 k+ @0 q; d; ?% R: G8 J& H    xor     di,di
8 K2 O- w+ Z: d2 b" {' Q. [: D6 ?    mov     es,di
/ d' j, ]8 P! l& Q  J& B& F$ q    mov     ax, 1684h      
/ Q3 R6 s, _: n+ [/ d    mov     bx, 7a5Fh       ; VxD ID of SIWVID1 j! U( W1 P5 m5 _, q3 b- j
    int     2fh% t$ A0 Z* |, ?- X6 u9 n" U2 Q6 T
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
6 v& Q# q. V8 n- Y+ G    add     ax, di2 y8 m8 Y) `3 f
    test    ax,ax
* |5 e% r& v/ |+ _$ V$ X% M. u* s    jnz     SoftICE_Detected, @) w8 g6 D; [5 k& r

- E' _6 ~& H  V) l4 c__________________________________________________________________________, `3 N$ Q8 r9 [1 L, C& U6 _1 X

  n( ]+ K' ?! S9 q7 g
8 x* Q" W* i  x0 [) mMethod 05
% _% \/ }9 l& y1 Q=========8 z& ?% C" b* n& M1 B* w

, V8 X1 H, p0 Q  |2 \+ d/ UMethod seeking the 'magic number' 0F386h returned (in ax) by all system
/ \; ?# ~1 \1 ^" kdebugger. It calls the int 41h, function 4Fh.
/ d1 y) D! N4 s; mThere are several alternatives.  
7 H( G, \" J0 o# @% X/ S4 w2 E* w3 Y* ~# d9 A& Q
The following one is the simplest:
/ s  O8 u+ _5 E+ d
" F, f/ q4 ^7 b& R    mov     ax,4fh3 m1 X6 N: ]- Z% n
    int     41h1 `( E6 I# J* {, n' E* J
    cmp     ax, 0F3866 P3 A( s1 Q' ^. \$ s1 P
    jz      SoftICE_detected$ X, v- I7 I: L2 ]* C+ Z& W5 w
* r' N1 i3 ~  Q
+ b* O7 E. c" o5 h
Next method as well as the following one are 2 examples from Stone's
5 ~- B5 z+ `, i0 w/ K6 k"stn-wid.zip" (www.cracking.net):
8 I- A& H2 ?& e- W3 }# O
! B4 F7 Z) J' _, m6 `* R& ?  l    mov     bx, cs  m; g: O# t  R
    lea     dx, int41handler2' K2 P) `0 O( a, F- q7 X1 A
    xchg    dx, es:[41h*4]) d5 w4 |: g& I* a1 i  ~
    xchg    bx, es:[41h*4+2]; ^, x- [  N$ [1 g
    mov     ax,4fh
+ _$ e% L8 D; X    int     41h
9 r+ G* @4 d% i  T' H7 R    xchg    dx, es:[41h*4]
! `2 i6 s  \1 @& v    xchg    bx, es:[41h*4+2]
1 ]$ m% b( P  q- y    cmp     ax, 0f386h
  \. P! m. F" s2 @, c+ s    jz      SoftICE_detected
+ W4 Q% K" B9 I, n! o
. k% [6 W! Y- T3 n6 K' wint41handler2 PROC* s0 o' f$ J& K/ |3 |( w4 B
    iret/ i  T9 E8 Q9 z
int41handler2 ENDP. h$ ]+ p$ }4 X3 L. \) _

1 h4 L9 @" \, K: T! [6 Z0 G: s) m+ k% _$ s) T& q4 f$ X
_________________________________________________________________________7 W  p! \: r8 ?! p. q) `# _) I
" W. P& [! F% |2 l

. s/ V5 w4 o' y3 v: T+ cMethod 06/ J: `2 q: o' ~. S. o! C2 H' g
=========
! o* }& _4 s+ c4 U+ i1 o& ^  [" _4 ?5 E9 j+ m7 X- O- F
4 d- c' N/ E+ ^" K4 C
2nd method similar to the preceding one but more difficult to detect:) |8 b0 J8 g0 w+ L$ t4 B

3 n; ?, o; U0 Z0 B$ x8 l- D% C% y3 s0 X1 h" h9 Y/ ?
int41handler PROC
% s4 V( Y: M4 ^0 z. J, ]4 Q" K1 r; v    mov     cl,al
1 _. I& Y7 D$ ~6 F% A8 g    iret
# V: O2 \) `% d& h( t& v/ \int41handler ENDP
- s8 |7 w; l9 \4 t' _2 g# X/ r! s/ _- X( j0 y

" n6 H* S2 {/ {; j    xor     ax,ax
: K7 u% N9 o  c& Z" f! O    mov     es,ax
5 W% m1 g$ {7 x- A" S3 B    mov     bx, cs
6 e0 r& i: y$ k4 {: Y# q    lea     dx, int41handler
# ^- G" l, F3 I$ G1 q2 x4 O8 h    xchg    dx, es:[41h*4]
- m% u, K, e9 d  ?: z, l1 H0 ~    xchg    bx, es:[41h*4+2]1 ?" r" s' |0 S# g6 N* m7 ^
    in      al, 40h
7 \! d1 W3 N, q    xor     cx,cx/ N, N; |( Q2 e! f
    int     41h* t& Y# S( `9 ?* Z9 j6 ]6 p
    xchg    dx, es:[41h*4]
4 @( V5 ^; t; h6 B( r    xchg    bx, es:[41h*4+2]
% H3 B( [6 L  c& s8 b8 s    cmp     cl,al( x. U3 z" x# v; ]
    jnz     SoftICE_detected# a" {5 B2 |2 `# h

( I1 O$ o/ X$ J  d_________________________________________________________________________
5 m% G4 u+ D9 E2 p* G: U9 K& t
/ k4 {+ U5 Z5 ~7 yMethod 07' |: ?- h  }2 {3 j) B
=========
7 h; g4 A" X( b
' h; n9 w7 A7 h# ?$ B2 sMethod of detection of the WinICE handler in the int68h (V86)
, A1 o# [/ m3 [, H4 t- |- z8 g& v* X# J) A5 E
    mov     ah,43h
, q2 O3 a  F1 |% Y    int     68h: c. Z# ?" \: s
    cmp     ax,0F386h, j9 {( @$ `( ]4 k! C
    jz      SoftICE_Detected$ Z  f/ p+ x' W, g7 q

# n% V. b, M% |5 H2 M( w/ p  s7 I: C/ Q; ?% `7 Y
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit9 a3 @  u  ^& m& s9 i
   app like this:. l; L$ i+ c" ?, m6 Y7 k  o8 L

3 `# B: T5 G% l2 [   BPX exec_int if ax==68
5 b4 ^4 D0 h5 x& W0 F   (function called is located at byte ptr [ebp+1Dh] and client eip is7 q6 `9 b/ n1 v4 t5 S) F
   located at [ebp+48h] for 32Bit apps)9 h  M1 q$ P2 m, D7 r5 q; u) p
__________________________________________________________________________: K7 A. U8 n+ V* T

' q/ R; |. j- {5 k3 u; s" C) O# v2 O# |' x" P4 P* Y
Method 082 P4 ^- |  r! v0 p5 g, F
=========( a$ r7 ]( Y/ h4 R- Q
1 t; l' Q6 f( s4 _: q7 M1 L
It is not a method of detection of SoftICE but a possibility to crash the
8 f. x: g" o! [- _2 ^$ A& s5 Isystem by intercepting int 01h and int 03h and redirecting them to another
! x. C; x! w# K) ?$ vroutine.1 z; ]$ r1 w: c3 I/ A/ e+ F
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points7 O* |4 {! R3 d5 [0 V) D
to the new routine to execute (hangs computer...), a( D, k9 A* d/ [
2 I( o$ K% C8 j: g2 p# _4 s4 \
    mov     ah, 25h
8 [  D5 u+ p* R) l- A    mov     al, Int_Number (01h or 03h)
1 R+ m$ X+ G' d2 f7 F    mov     dx, offset New_Int_Routine
2 m5 q( x2 H  C) d# l    int     21h
  j$ Z4 t: X: v4 R+ _# Z6 Y4 g0 W
__________________________________________________________________________4 I1 A1 a! K& F" T6 H. @$ k

1 c8 E9 K8 ^7 H  n& y$ Z9 x! b+ tMethod 093 V- C4 q( Q5 w& T
=========
  i$ H" O8 Z' O& t  @5 I
) k, u3 N( c( b4 H7 O3 t2 L9 |This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only5 t- c) i) t$ ?
performed in ring0 (VxD or a ring3 app using the VxdCall).
9 \/ `! c6 z" E# @$ X& ?4 D: |The Get_DDB service is used to determine whether or not a VxD is installed5 n  S# \7 ?: |1 D* Y8 X
for the specified device and returns a Device Description Block (in ecx) for
: b5 _/ N6 N$ ]& f' E+ vthat device if it is installed.- N. s# B4 A4 g
! @+ J: }3 e2 r+ |
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID8 I! R$ O% Z6 ~* J! h
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
0 n6 f$ x# Z! N1 B# Z3 Z   VMMCall Get_DDB% p; B4 e! V6 Y' u7 _& h
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed% ?/ I: V4 u  s0 D

& a+ m3 V$ G# l( FNote as well that you can easily detect this method with SoftICE:
2 H* {0 s/ n8 D) x5 u   bpx Get_DDB if ax==0202 || ax==7a5fh; g5 w) i- \- q! s
3 P' S' Z" C4 `- _& N: b4 q
__________________________________________________________________________
2 e8 s' f2 w# O$ t
& Z! g3 s& l2 L6 ]% H3 r' LMethod 10" W( d# H! V  J% h" H
=========( @4 R' v! ]# E& C
7 g* R% _2 ]0 n+ _. I- N* m
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
) Z& N# l/ w' c2 M9 j0 b9 r- q# c  SoftICE while the option is enable!!, V( |8 }! f% w
  K" s/ y7 r# V: Z- b  \" o
This trick is very efficient:
8 B0 f5 R  ]. n( @& L# Hby checking the Debug Registers, you can detect if SoftICE is loaded
4 ~  s+ O) Y( n/ X: _  B(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
7 t7 s0 d, C- Athere are some memory breakpoints set (dr0 to dr3) simply by reading their' a' ^8 ]; A/ Y9 L- p
value (in ring0 only). Values can be manipulated and or changed as well
2 I0 X0 X3 U' j0 ?9 f6 |(clearing BPMs for instance)  j9 \+ k$ I4 q/ i4 U! G) G+ g& F
% G5 K- W/ R: ^0 W' s: r
__________________________________________________________________________. Y" B& O0 S3 b5 e

7 T; d- \. c& X& A0 NMethod 11
3 ~2 ~; H/ W6 d" e" M# f. k; e=========5 I' b8 X. A" q! V4 a* ]  D
$ {! ^1 j6 I6 K0 G2 U% V6 W
This method is most known as 'MeltICE' because it has been freely distributed6 z. }1 e/ R( S* X1 t
via www.winfiles.com. However it was first used by NuMega people to allow+ C- K' R' ~! r  G5 y: e8 Q8 n5 _
Symbol Loader to check if SoftICE was active or not (the code is located  V0 o* i/ y& k- n; a: g) }9 y
inside nmtrans.dll).* I. g& B$ ?: `" H% U' B' Q, S+ x
2 p# O: y: w; k) E
The way it works is very simple:
2 i% L3 J3 G' L/ [6 P6 EIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for$ \8 \  q' s$ \0 c. @2 j* t! H! K
WinNT) with the CreateFileA API.
+ J8 z. E" f/ ~8 v% z4 k- S9 L1 v0 i
Here is a sample (checking for 'SICE'):: B; V4 k# S% u% m" Z& q/ f
5 u+ |+ {4 b0 g9 L" u5 I0 o5 Y
BOOL IsSoftIce95Loaded()' |+ c6 k, r. Y
{3 ]. V% Y( o( J; K* _
   HANDLE hFile;  - H. P" g6 x1 r" B+ `' D
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
- w& a, Q6 E5 Z0 {& T- \                      FILE_SHARE_READ | FILE_SHARE_WRITE,
. B7 S* L  [8 _2 E' ]; N/ A  V                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
# H1 g) e1 q  w  D6 C8 U2 a   if( hFile != INVALID_HANDLE_VALUE )
) D" B  A+ _1 X, w   {
6 r) w9 z5 ?" L8 Y      CloseHandle(hFile);
) x  e) i6 I) T4 L% \      return TRUE;
7 b  m2 s1 t2 H9 L+ {6 _- G   }8 z+ n" m/ A# t5 z3 b* @
   return FALSE;9 P* Q6 l6 {) C/ u
}
, ~' ~# C- ~- O# ^9 V1 w7 M8 q. i5 l' M  L& D8 X* z
Although this trick calls the CreateFileA function, don't even expect to be
# |* n4 c2 [; N1 j- }2 Mable to intercept it by installing a IFS hook: it will not work, no way!" K# Y2 T2 l% D2 l
In fact, after the call to CreateFileA it will get through VWIN32 0x001F3 v/ V7 i' Y! M6 o  g  g  S. f! ^
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)# v9 X2 F. Q+ Y1 h' x; ]5 A1 E
and then browse the DDB list until it find the VxD and its DDB_Control_Proc9 E8 W( W. }! u: b
field.
4 E3 J, Q  Y; HIn fact, its purpose is not to load/unload VxDs but only to send a
+ q0 `# Z8 P2 Z) ^( T& N# rW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE), v  k+ N! _6 ?1 u" |
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
7 L4 r. U, I+ o1 Eto load/unload a non-dynamically loadable driver such as SoftICE ;-).
  S& j: ?9 A# E+ W1 Z# B7 M! ZIf the VxD is loaded, it will always clear eax and the Carry flag to allow
+ N9 M3 S) ~3 Gits handle to be opened and then, will be detected.
9 g7 N! w3 R7 ~( [1 }, ^* {5 ]' vYou can check that simply by hooking Winice.exe control proc entry point
: ], B6 C$ W& w- s- Cwhile running MeltICE.  d9 `; x) J" H

* S: t8 K2 @* `0 m  b/ H4 G; L
  ~1 {# I" r$ @: b! h6 d  00401067:  push      00402025    ; \\.\SICE2 g! H. e, M8 O6 n: y/ t
  0040106C:  call      CreateFileA3 W" K# ?) d9 \7 H5 |) S7 ]
  00401071:  cmp       eax,-001
8 P, @! L' a2 n( K1 a7 A  00401074:  je        00401091
: n  Y" s) x+ ~4 s5 R8 z( p" C. d5 u& K8 b% f6 ^/ C0 G3 Q

5 S0 e; |% F6 RThere could be hundreds of BPX you could use to detect this trick.
3 P7 c" @# O( A& I) U-The most classical one is:1 j8 W; j9 c5 ~5 y$ H3 G; p) R
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
# R. y. A- \$ _3 y( ]/ V    *(esp-&gt;4+4)=='NTIC'
8 Z$ x8 L$ w4 l- ^' Q9 b
8 w# J* z: y& [  g, |) v-The most exotic ones (could be very slooooow :-(
" D" y: ?& r" }. J1 N, R   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  " p* c4 o. v9 P
     ;will break 3 times :-(
9 B) n. X' T3 L) W7 }/ m* y) v9 ]0 [- D3 }
-or (a bit) faster:
  X; ?. E' P+ \3 f7 c- D" y   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
- G" @" H! O: l0 {
$ C5 d: n& D( ^: n7 E   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  ! B9 w: _& }: Q- U- G# c
     ;will break 3 times :-(
) b+ M. u% X0 ?  r2 W# d
/ O$ {* v7 x* [! Z8 {8 x-Much faster:; ?1 e& b9 [1 s1 E" z
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
* J* @2 E3 O8 q  c- ]' `% M0 e; @6 N1 Y9 T. y
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen1 m8 }9 J9 R( S" y$ A! h
function to do the same job:+ N/ d5 C; n/ j; y. |
; P3 D, u# o& k. {4 F
   push    00                        ; OF_READ# g; Y" g+ F) l
   mov     eax,[00656634]            ; '\\.\SICE',0
- G- d  @5 l" j   push    eax
: E9 w$ q) l$ i& J3 Q   call    KERNEL32!_lopen' |4 B8 n# T2 B0 B. {& b' s
   inc     eax
, r3 A- s$ P2 ]4 N+ z# J! G   jnz     00650589                  ; detected
  r- g9 |0 P( ^- I+ J" `( B' _   push    00                        ; OF_READ
. F' ~2 f& r3 L* P; f6 }   mov     eax,[00656638]            ; '\\.\SICE'9 L( e9 {; H; m2 ^0 Q
   push    eax
% \! G( t% e+ M% a' m1 Z5 U   call    KERNEL32!_lopen; ]% {* ^- V7 V
   inc     eax
$ g# s/ O8 m8 ?; P8 \   jz      006505ae                  ; not detected
, n& U1 n5 }# G& h% w
0 q5 S& Q9 t3 h- L+ k7 j/ E2 |# ]' m; R! h* V
__________________________________________________________________________
/ j/ h# l* C( ?9 f, {( Q/ v
0 P; v. V5 Y# p5 `Method 129 A  a2 r  [! ]! x) _# \9 `
=========
) ^" u. L* S3 a0 \4 C" V0 M; g$ q$ d% ~, }# [2 x: v* ^
This trick is similar to int41h/4fh Debugger installation check (code 055 ]/ e7 ?7 ]5 N# {
&amp; 06) but very limited because it's only available for Win95/98 (not NT)
* p5 Q, D) v0 T. Q* _& m1 s3 j# m7 Jas it uses the VxDCall backdoor. This detection was found in Bleem Demo.4 z: ]. b+ g" K% X- K: P
& {: O9 Q9 t1 j. x$ j, S
   push  0000004fh         ; function 4fh0 f" f: d4 A! ]  T
   push  002a002ah         ; high word specifies which VxD (VWIN32). ]' O7 d4 [& `- u9 O3 j; P4 T
                           ; low word specifies which service
8 v" n7 @* \  K: U" y4 c                             (VWIN32_Int41Dispatch)1 k' L# v2 w; Y- X6 {4 r
   call  Kernel32!ORD_001  ; VxdCall8 n7 n5 I* O) o) A& c
   cmp   ax, 0f386h        ; magic number returned by system debuggers
  R8 Y3 V$ ~0 E9 w   jz    SoftICE_detected3 O! k5 @3 R- E3 ^

2 Z8 Q) m8 v0 q+ [0 [2 wHere again, several ways to detect it:
! c0 ?% b0 q+ u- W
5 j3 ^3 f: Q7 ]$ v0 J9 X7 {    BPINT 41 if ax==4f
/ r, K( i* ~0 L9 W' Y2 b8 R  z7 s' V% @8 y* i7 p! l
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one& }! s/ k) @8 d2 ^
( ~3 d2 h) e% ~8 B, y# S
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
3 x2 d+ ~% D$ n/ g
- n& b! n6 J) @0 J' e& L* J% H    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
9 B# S4 Z5 r' Y
9 k. E" t( \% T__________________________________________________________________________
/ w# R3 p8 G2 j: t, {. Q$ `/ O2 c' D
& u( \" ?* E1 y2 gMethod 137 e$ k# S/ c5 _  Y/ F
=========8 }- o1 S0 ~8 |, _9 F( N% w- z
. h$ C% N$ e0 P- D
Not a real method of detection, but a good way to know if SoftICE is
4 R/ o6 b2 q* U- [5 Iinstalled on a computer and to locate its installation directory.
+ W$ G/ `1 Y' ?4 Q+ v$ PIt is used by few softs which access the following registry keys (usually #2) :- s9 J4 W4 ^4 I: c! X3 f
1 N/ C7 _5 |# m& p" e) W
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
$ b  R' X. A2 Y4 k( V9 p\Uninstall\SoftICE% y5 ^2 c$ c9 n, Z7 p- D
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE1 s  h& y6 _* `$ l! w, y
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion! q) I+ `  e1 o/ p& Y+ n; U
\App Paths\Loader32.Exe1 Z! d! v5 r* W7 q1 c

" k7 }/ t5 V1 E7 H1 a0 J- U
* [6 }/ {6 Y- N4 l+ G8 U! lNote that some nasty apps could then erase all files from SoftICE directory
: M5 e4 H- v' `! N1 \(I faced that once :-(! o/ L/ R  g) J. L

; I+ E  y5 `: L, M1 ]1 r4 dUseful breakpoint to detect it:
% E) {$ B! S* H; J
$ X  x* y7 M4 R5 j     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'! ?/ s- c# M6 p

* Z& J! n, b+ Z; P__________________________________________________________________________  P. @- O# J) O4 u
' ]1 p7 t6 j2 P) L9 [
0 i* @/ u" P- _0 R( P
Method 14 3 c1 b& ^7 l$ l% ~. h
=========
4 h9 ?7 Z* r, S* c8 }
- p' Y# p. A9 w' p% O' W4 Q  \9 aA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose2 B5 Y1 K' [1 ]+ r3 z
is to determines whether a debugger is running on your system (ring0 only).
2 ^$ l) E2 a6 ~. b) I0 M5 V
! b$ q6 P: A* r3 Y9 \   VMMCall Test_Debug_Installed
8 }( q; E. S$ Q   je      not_installed
, \$ J% n' Z# h$ p% d' I  `3 o$ x7 P6 I& q0 d' r# G
This service just checks a flag.0 c. I) l% ]1 b; [  m& C1 v
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-8-13 01:18

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表