About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>* `2 l. T/ d' F- m8 N8 O) z: e2 n
<TBODY>: Q3 y& {3 g8 {$ O2 o. G' {
<TR>' U6 G5 e% l) t( N" y
<TD><PRE>Method 01
+ ~4 n* s6 N, o* ]# U=========
2 z+ a8 g$ ?1 ^! E" `* Z, ~& b3 G% i- X) z* S
This method of detection of SoftICE (as well as the following one) is
) x: d% j2 |/ c1 yused by the majority of packers/encryptors found on Internet.# v" ~' p( _3 A+ A" ~
It seeks the signature of BoundsChecker in SoftICE" D  s$ r" b  r
  l! ]' N5 E- O& J3 B
    mov     ebp, 04243484Bh        ; 'BCHK'
. K$ c( e$ B3 d" a+ u: t* j* ?    mov     ax, 04h
; N" E3 {6 R  w+ \    int     3      
( J! }0 L8 Z$ s    cmp     al,4
8 U% C' E- b( l. H* _    jnz     SoftICE_Detected
1 B$ Z( I  Y6 C/ u' k; n, k: [: s5 I0 ^  b' l6 n/ C9 |# m- N
___________________________________________________________________________
& e* J6 G" a& S% J" i
% u6 X" V/ P6 T$ R' Q9 B! t2 ?Method 02. v4 e2 @( }$ C2 F& G
=========/ `# a+ V8 r4 |- M

) J- z/ a! n' A/ K- tStill a method very much used (perhaps the most frequent one).  It is used2 l" y# a) M& o4 E# _* T
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,8 H; P) g& k" r/ ?3 V
or execute SoftICE commands...
4 L5 K7 n3 ^) t' \It is also used to crash SoftICE and to force it to execute any commands3 X( {/ v( c/ a
(HBOOT...) :-((  4 Z, X  J( I8 Y2 @, a! O

5 g) |, o% q% d# f* d6 FHere is a quick description:7 P! Z( U6 ~$ H/ Y5 C- M
-AX = 0910h   (Display string in SIce windows)
" \  a+ {& |. y-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
" S5 S  m7 v* E; x9 O-AX = 0912h   (Get breakpoint infos); {  `$ f) l% \, i/ A% W
-AX = 0913h   (Set Sice breakpoints)
0 T3 ^+ D( ^5 J8 `4 `6 \4 k, E2 f-AX = 0914h   (Remove SIce breakoints)& N! C$ K+ l  Z

) ^% Y- z) c5 F9 ]6 w) f, EEach time you'll meet this trick, you'll see:
6 ~- q% E6 [0 O4 T-SI = 4647h
2 f" o" {8 w0 h-DI = 4A4Dh
& y2 V* ?( ^* e  Z8 t+ D  C+ P7 f; uWhich are the 'magic values' used by SoftIce.
7 k6 K# `- K/ E6 ^: w9 W; AFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.& e, H* {, ~( E0 e/ ]( G4 W4 g
% s$ T1 S' }+ v/ ~& t+ i7 n- Y
Here is one example from the file "Haspinst.exe" which is the dongle HASP
0 X0 m! I7 _. {: u4 ~" b- Q- ZEnvelope utility use to protect DOS applications:
( p" k& p- [$ H, b) A* T
9 G2 x. P! x, f6 y0 _; e- y5 O: c+ k3 l+ [! J
4C19:0095   MOV    AX,0911  ; execute command.# a8 w5 A5 s( {6 t8 Y% \2 \4 t
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
0 H7 H& z9 H$ Q) c. A1 ]( h4C19:009A   MOV    SI,4647  ; 1st magic value.7 ], G0 O; P. a* Z* W
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
1 \# i0 P( B4 M, m' c# b4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
- \4 Y( t: _# P- Q2 F  }3 x/ M4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
7 o2 ~% K- c" l9 E; M8 S! a4C19:00A4   INC    CX
6 S: x, `" n3 P5 p: ]4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
8 X9 X7 ~8 s( b' C7 d* j, V. q( e4C19:00A8   JB     0095     ; 6 different commands.
6 F( _' c3 D( A% W% T8 {4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
# \  O  Y% c% H& ~& j* N4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)' d2 Z* h4 z7 O& p

4 @7 \0 x0 P6 J7 @The program will execute 6 different SIce commands located at ds:dx, which0 L2 ]7 `$ g, I6 ~+ C
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.6 Y. ]6 ]$ u6 D6 Q) j* P; _

, P5 F; e4 r( B) |* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.2 e! e2 Z, ~% F( v
___________________________________________________________________________: M( z* r7 h+ p

5 u! s" i5 |$ q: O9 P( ^
5 X$ B: P8 e( m  h( c' `+ T4 }Method 03; S  b& Y( l& {, X# w2 b% t
=========9 M* s6 |, A5 ?2 g/ b

0 T% V: l. T6 {8 ?0 vLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
. y3 X/ y: a! ](API Get entry point)
. a% ~1 w: E7 i" N  k, G        7 T( N7 {+ ?2 r0 x! B1 A3 l$ [

8 g2 u7 N& y/ W7 Q    xor     di,di
) N1 n/ s3 l/ z. a8 C4 p5 f5 s8 m) p    mov     es,di
7 M, j) z9 z. F    mov     ax, 1684h      
( @) X9 ]5 x1 U1 r6 H4 K" _    mov     bx, 0202h       ; VxD ID of winice
  d% M. U6 [& o, w0 T* `    int     2Fh. x2 P9 Z7 A: A% f
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
# g) x# ~: D+ C3 X5 g    add     ax, di! I6 R  D, `! A+ d% m8 }
    test    ax,ax  [* m% R2 g3 N7 V
    jnz     SoftICE_Detected
4 q. b  s3 S  ]9 ?) {
6 t4 i; T: e' B___________________________________________________________________________
# |$ \/ z# ^" y  _) Q& h* a
3 k9 N4 D/ Z! t8 s5 WMethod 04
7 e, C* L2 O* M/ ]5 r$ K7 x: u=========
3 |: M  w7 M; G/ F2 b/ j; M
2 f' q2 ~6 x5 S% B; L0 VMethod identical to the preceding one except that it seeks the ID of SoftICE
0 c8 a2 y' `' W) WGFX VxD.' o! G/ U- l/ N  |4 T) ]
3 {: x; T# L9 C, ?
    xor     di,di
  V% M% m6 {& P$ r, U6 r  B, m    mov     es,di
, |+ x5 A8 V7 }    mov     ax, 1684h       5 [' s  g6 Q, b/ j7 u7 e
    mov     bx, 7a5Fh       ; VxD ID of SIWVID/ k; J+ I8 L5 H
    int     2fh
) g. j7 @0 D! u; H% X    mov     ax, es          ; ES:DI -&gt; VxD API entry point1 g3 I0 G3 |# e" }9 s( H
    add     ax, di
+ Y7 p/ j# L( L    test    ax,ax/ h2 v$ b7 }; {5 ^
    jnz     SoftICE_Detected4 j6 v# b9 b$ g( T. e
( O. w% g# i% v
__________________________________________________________________________) L9 q& O8 p( p/ i5 q' v! x
0 m2 i5 i7 {3 r5 P7 d: C, i

5 e3 {$ u% K/ n: }* O# [Method 05
/ d! P3 w( Q! Y8 \8 U8 J  [=========
5 b7 e* b. {7 h5 w, t
4 ]$ ~2 x+ `8 L) i) i/ _" GMethod seeking the 'magic number' 0F386h returned (in ax) by all system* Y+ j6 @/ W! T" h- x: m
debugger. It calls the int 41h, function 4Fh./ w, O. ~: X0 O- Y; E4 ^$ O0 Z! U
There are several alternatives.  
2 r1 q- g; B# w6 [/ X( x" {2 g- ]# Z$ O- ?$ w' l, g- N
The following one is the simplest:
4 \: I; }9 l, t
. v* S+ ?. J5 {4 _) c/ V    mov     ax,4fh8 d( e, O; p2 P
    int     41h
2 C+ ^  H- f. x: w3 w: J    cmp     ax, 0F386
! ~9 s) R' G4 _. `! X7 U5 ?    jz      SoftICE_detected$ _* O# @6 s$ v$ q/ s8 U% R
0 |% S0 \) X) x  N
$ m6 u6 [3 ^, y( B. f; P
Next method as well as the following one are 2 examples from Stone's 9 L5 F6 O2 G+ ~5 J# ^7 w
"stn-wid.zip" (www.cracking.net):# ^0 l' V0 \' n& U: B
. Y5 _4 }, c# u% \. R; q
    mov     bx, cs% j) O+ r& A# g, J+ j) V
    lea     dx, int41handler2
0 V0 o+ z9 [! M3 x! p3 i    xchg    dx, es:[41h*4]
; F4 ?$ J" [" G; e$ w8 K    xchg    bx, es:[41h*4+2]
7 g% P' k/ ~) o2 e/ Z' d    mov     ax,4fh( W, q2 i: n" O3 `
    int     41h
, H3 b% ?- L* Y& ?5 ~1 d    xchg    dx, es:[41h*4]
: }0 a- d2 }* s+ y& r    xchg    bx, es:[41h*4+2]
1 m0 O. r  F. o& F$ w9 X    cmp     ax, 0f386h
4 E# P' m0 }7 C    jz      SoftICE_detected( `' n; @/ [1 d# Y3 O) x2 V+ w7 H8 V
9 B' h, b6 A0 V( F$ Z
int41handler2 PROC
, p" Z# l' k$ A3 d) M5 b    iret/ H9 b* X0 m! e" i
int41handler2 ENDP7 L" e3 A+ o; Q  _) S/ H( F* V! U

2 \( c; s( U2 b. s" `2 |: O8 S' a9 U6 L6 U; s
_________________________________________________________________________( P$ O& S8 G3 s+ H$ i
$ ]7 X- V5 K& u7 s" J$ @+ ]0 E
, o7 A5 z8 i9 Y' n% ]/ ?( H, L
Method 06* a$ X" @2 a& P. P& w  e
=========5 O2 I5 }8 o2 V) Y1 X! |

- |- s( y  ^. S: r; r- s3 X7 Z; h
8 P/ B' f5 w9 }9 r* p) G2nd method similar to the preceding one but more difficult to detect:
  L; V: w# G! q. u3 d. r5 y( P# R' E. ~7 B. l

$ i* f9 f7 x: {' W! u4 X+ F8 dint41handler PROC
' l) J5 C8 e' Y2 E  g    mov     cl,al) E0 w( ~$ Y! Q" i# n4 U6 w
    iret, z+ [# s9 `/ k9 t) R  Y
int41handler ENDP( I; u8 r0 Y& t

0 x, H* Y- R/ B  B% V1 v# |0 Q8 u" k
    xor     ax,ax
" s  D# Q' ~3 D, U1 E/ X. F: A    mov     es,ax
3 p2 c/ b& k! ?' P, ~    mov     bx, cs
8 H1 z  n, n) t1 f5 h" q6 T    lea     dx, int41handler! L+ p% x8 ~" U. V" V4 V
    xchg    dx, es:[41h*4]& {& ]. y* w5 W3 A
    xchg    bx, es:[41h*4+2]
! v. A( G' D+ B; j1 O# h    in      al, 40h  T0 r- N: W0 c5 L1 I; H" x$ G
    xor     cx,cx5 s6 Q2 |  m( K" F
    int     41h
7 o7 x0 c+ T, `# Q. G$ T. y) y8 Q    xchg    dx, es:[41h*4]
8 u8 i% O  ?5 C1 s& c# b    xchg    bx, es:[41h*4+2]
6 D, ^/ O4 L* j$ {; T    cmp     cl,al
7 a. C, \2 G/ Q# K$ o    jnz     SoftICE_detected) u7 Z/ a! C: u/ L6 t( K  ^4 `( r$ Y6 p
/ b& @% I6 C+ n
_________________________________________________________________________& H" Y3 T+ k5 e. c2 p/ y8 l
( X# q* A- o; y
Method 07
0 l3 q- o, [2 `& |* i$ W" y  x=========8 G: s. D% E' N5 L6 k

2 B( e7 E2 V0 T  A, BMethod of detection of the WinICE handler in the int68h (V86)
' f( m) ~0 ^' A3 e: m0 r8 c% Q2 ~+ `0 F" y* b
    mov     ah,43h/ I5 X0 w8 w9 r
    int     68h
6 H  @' w+ ^& v$ G6 _3 _0 {3 ^" [    cmp     ax,0F386h
( |5 l6 w! {, }    jz      SoftICE_Detected
' x7 O/ w% z" o
% f8 Z% Q  R) N
* g$ _/ h9 ~# c. Q7 e8 M1 N& I1 K) o=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
- m2 Y5 U+ {# u& x! c2 @) r   app like this:) g! G: x7 v) C: N# f& |, b" X
6 J5 w* D3 I/ |, @4 o( I, I8 C; M
   BPX exec_int if ax==68* S8 j2 F$ E' U3 w/ q% c
   (function called is located at byte ptr [ebp+1Dh] and client eip is
, ~& z9 `& f3 }6 o   located at [ebp+48h] for 32Bit apps)
  o( @# |" t5 ]) e__________________________________________________________________________  F3 n4 B, O  j4 c0 F4 h: b6 y- L
$ a: U: i, B4 Z
/ g/ I* w% F- F" X. E3 [$ t3 ]
Method 08) Q0 a5 Y! W! s6 n; X. z2 X3 w# {
=========
1 r3 V/ }3 ]* b" H  y. f. D% c3 K; n; G3 z/ f" M
It is not a method of detection of SoftICE but a possibility to crash the
; \! e4 [* Q2 J! |& T5 dsystem by intercepting int 01h and int 03h and redirecting them to another
/ m0 ^; e% X+ z$ A- Froutine." K$ P0 X9 r& Z' P
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points( g% p" X- B; h6 Q( e* |
to the new routine to execute (hangs computer...)
+ t. G3 H# D, J+ C( d7 s6 a3 T: r' t7 q0 ?; \' |$ C
    mov     ah, 25h
  V5 {2 }) {: j; V" {2 M& i    mov     al, Int_Number (01h or 03h)
4 K; f" {# \, T7 C  \! ]    mov     dx, offset New_Int_Routine
% Z  K6 C3 l4 Z& z% K$ \% v* c+ m    int     21h% u0 c( y* f! ^. M* I
% ?+ n& r- z( n8 S
__________________________________________________________________________
; A7 X  {% v" i; G6 d( o* M' e
1 H: h0 J2 ^* y! g" {Method 09% G  [  D7 P$ T! B
=========4 K; O0 B6 D% U7 A

% U. j. n! ^# ZThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only! w* j- {7 H$ M7 j
performed in ring0 (VxD or a ring3 app using the VxdCall).
/ z4 v# i9 q8 y$ y) `( E6 }The Get_DDB service is used to determine whether or not a VxD is installed8 n  X+ W7 U- M9 N! ?
for the specified device and returns a Device Description Block (in ecx) for
. q: N0 n4 ]/ j3 Wthat device if it is installed.
) a5 C, X1 r! K' O" Y
( f: E, T' h, K  M   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
: @" x0 r. f4 ]6 ?; H4 `   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
- X9 O/ Y2 a( y   VMMCall Get_DDB
8 N* h2 j8 d6 K/ }2 o   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed9 k: g% W) E) w. J
6 N% i- {1 ^; G% B- e5 _
Note as well that you can easily detect this method with SoftICE:, z$ b: O+ ?0 e3 M# B5 h7 j- F
   bpx Get_DDB if ax==0202 || ax==7a5fh
2 X+ t: W& r: d0 r4 s5 j- K) P( K6 Z% h
__________________________________________________________________________
2 P1 F( U$ v. P1 }5 j  e& T. z
! ]9 V9 I2 \5 _( ?! B! uMethod 10
+ z$ Y4 x& m# o9 y, G=========
" t0 y" D" i0 @
( T5 ~8 W  \) t2 e7 }' E=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with* Q, v& j' n; ^, f/ [
  SoftICE while the option is enable!!
1 v) B/ Y$ \2 e6 @
* t. M0 p& z6 L! q3 _This trick is very efficient:. G  l7 F  l5 d* n" @
by checking the Debug Registers, you can detect if SoftICE is loaded; {3 r* o4 w& P  P1 A$ i% G
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if5 |" A7 n" y% F$ f# |
there are some memory breakpoints set (dr0 to dr3) simply by reading their# A4 j* m7 i. R; b8 r; Q9 ?$ |
value (in ring0 only). Values can be manipulated and or changed as well
% `& @1 U0 P* K- |8 d6 W(clearing BPMs for instance)
" x9 o$ Q4 _' g' P+ p
; f0 P" E8 n* x. M__________________________________________________________________________
3 K/ ]* g9 D0 {; b: L
6 e" A$ l* H  mMethod 110 y0 @8 N, j) k. J/ l
=========6 |4 Q1 {+ @: Q

5 p, K2 J) p/ LThis method is most known as 'MeltICE' because it has been freely distributed& D) e1 k0 }0 N6 S  ~3 V
via www.winfiles.com. However it was first used by NuMega people to allow% e& G! M: E8 r! C0 [* {: g8 v6 u
Symbol Loader to check if SoftICE was active or not (the code is located
. q' ~! |# y. ]. linside nmtrans.dll).5 L0 ], J8 `# v- `

4 o; }2 ^& b5 `* kThe way it works is very simple:
  C3 A+ O& P/ S" z7 y! kIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
5 x( \- N' L$ @, B& |; K( aWinNT) with the CreateFileA API.
: T! i* Q1 e4 h, e. W$ Z; K0 ^' ?2 L
Here is a sample (checking for 'SICE'):* L, b& @, z4 ~% v/ I# _" N1 X2 E

( _- N% e6 T6 G. [0 e8 L1 ZBOOL IsSoftIce95Loaded()6 |! |, r: v0 ?3 M" l" K* _
{; a2 B4 N3 `$ ~5 Z; |6 b( v
   HANDLE hFile;  
: @) H) G0 e4 V  w. S( ~/ s   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
) ~4 g( M9 H4 p0 S                      FILE_SHARE_READ | FILE_SHARE_WRITE,
( I/ e& e' s4 p: v0 g                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);1 c6 ?/ s3 k1 }" L& ]4 J! I: N
   if( hFile != INVALID_HANDLE_VALUE ), n  l4 w. {' {- C
   {1 z, ]* D7 U; R
      CloseHandle(hFile);! G5 r. Z( z" E4 j3 q: l
      return TRUE;
3 e- b+ a( t0 C8 ?: O   }" q2 Z- t' f# M+ S) D) g
   return FALSE;
9 J7 Y# \6 [9 \% a2 p5 J! b4 l5 N}% I" _! \6 L5 x  ?7 H  E

: y' R; y4 l# o( c5 cAlthough this trick calls the CreateFileA function, don't even expect to be; T, \) q& W  W5 w
able to intercept it by installing a IFS hook: it will not work, no way!; a! i6 q& q0 @* e: w# K, Q& C
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
0 Y4 f# T  M8 rservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)4 ]) i6 q3 q1 }! f" }. @8 ~3 I- n* w
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
0 {) j8 m. _# g# K* e7 Efield.
& y$ `9 c; ^6 S9 a$ BIn fact, its purpose is not to load/unload VxDs but only to send a
* I* L6 [  ?% x( k& i: QW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
% e% ?8 `2 Z$ Kto the VxD Control_Dispatch proc (how the hell a shareware soft could try
2 q3 D( a8 R4 F/ f9 m- }+ R& |to load/unload a non-dynamically loadable driver such as SoftICE ;-).
5 c' i  |( N+ G0 [/ ]If the VxD is loaded, it will always clear eax and the Carry flag to allow& f; j2 L& F( _  w8 @' i5 W
its handle to be opened and then, will be detected.
  X8 M: q$ {5 I/ _You can check that simply by hooking Winice.exe control proc entry point
" @/ R. v' [- N( X/ k7 h4 kwhile running MeltICE.
. a: r) T& a1 ~4 l/ [6 y
9 M- ~; o4 P( B
- a, e6 H, u5 z5 p, N7 T+ c, M; o  00401067:  push      00402025    ; \\.\SICE1 R& g0 }! T: W: D
  0040106C:  call      CreateFileA. j8 b. e. p& ]4 k& B5 I
  00401071:  cmp       eax,-001
4 s0 y, U7 K7 B' r* Q, @  00401074:  je        00401091
3 T* J/ s5 C# g2 O( U7 R3 v2 x$ u, t# k) p5 |) X

: H' t% X3 }  fThere could be hundreds of BPX you could use to detect this trick.
$ {6 {$ S  }4 U7 x* b) c/ V-The most classical one is:
0 J( F0 j3 c. n: f, F; C& m  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||, D9 b9 S/ P7 @0 x8 q, B
    *(esp-&gt;4+4)=='NTIC'3 J% T; r9 l: R# H# ?5 U0 y! `5 J$ U
1 [% w: I5 a2 a9 u# q9 I
-The most exotic ones (could be very slooooow :-(
9 z5 ?# K) L0 n% r: B4 c4 L   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
% Y0 j9 Z% Q2 \4 _     ;will break 3 times :-(' f5 D# t1 N% z- R; c0 k4 S( f. w
+ {# ^; q; y3 ^& V$ m0 L8 E7 }
-or (a bit) faster: 6 _6 i7 [1 T% x" i; u8 r4 g5 [
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
( a: K2 O8 g& e0 k# |- @# h/ q% X* i4 L+ ?. E/ p
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
8 Q) J; b6 R% y0 R" L3 c4 p     ;will break 3 times :-(- n( H& ]9 K) ?# `/ r

( z% }* v. _' s- w$ i-Much faster:: \4 ^' ?/ R; B1 Y8 g) b+ j
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV', M7 Y2 x# c9 Z( ^
$ q  @% f; g) A) C  I- K0 \
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen8 a; T9 f9 c; t! E4 i
function to do the same job:6 G! B4 G8 ^2 K7 n2 q( W4 Z

6 F; ?8 W- U$ U. [3 q, k2 G   push    00                        ; OF_READ$ s* z+ n/ x  S
   mov     eax,[00656634]            ; '\\.\SICE',0
" ?7 \3 f; S7 @! N( D( a   push    eax
  l* p9 `6 M6 h9 {' {) L/ o   call    KERNEL32!_lopen3 o+ }7 Y6 a4 e3 w7 U# \
   inc     eax
# i: Q* I# d3 i   jnz     00650589                  ; detected
  H+ v; B& O1 z8 c   push    00                        ; OF_READ
  ?# |& h9 v$ O1 C5 p; j   mov     eax,[00656638]            ; '\\.\SICE'
$ z4 N5 S) O8 p6 y) j   push    eax! ]; h7 L4 Q. ?" r0 g
   call    KERNEL32!_lopen/ W6 M7 X. e( N$ ^* P& t
   inc     eax% u5 M3 s9 A& R4 x9 ]
   jz      006505ae                  ; not detected7 q" E9 B/ {$ _8 o* j' v/ C/ c

8 l+ x: S+ I3 b6 O
3 c7 i; Y: P' X4 K__________________________________________________________________________( X: b: u% x, L8 H  U
! c) q* i6 F1 Q: X. M$ i* }: X
Method 12/ T- R( y4 y! f+ E; G" M+ F9 _, r
=========
  [0 i1 W5 `# M5 L0 B( ~) n% g1 o0 N! a" ^& M) v; Y" T7 Q
This trick is similar to int41h/4fh Debugger installation check (code 05
4 V( V8 B  C7 E# o( ^8 h6 }( q&amp; 06) but very limited because it's only available for Win95/98 (not NT), I' w! ^+ _+ V" R
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.  X( ]$ E0 `/ G4 r
3 ~6 }7 o, E( {" q+ z0 D
   push  0000004fh         ; function 4fh: H! e8 ?- @: p( X
   push  002a002ah         ; high word specifies which VxD (VWIN32)
0 h3 W; M! Y5 A                           ; low word specifies which service
2 M! k  O$ u9 [1 n% E! z  W$ A                             (VWIN32_Int41Dispatch)5 ^4 g/ o0 {7 w9 h- Q: B
   call  Kernel32!ORD_001  ; VxdCall" s6 K; N' K$ k: T; K
   cmp   ax, 0f386h        ; magic number returned by system debuggers
1 s( g( Y/ V( O' ]5 V4 Z   jz    SoftICE_detected
2 z5 l  D% [0 ~5 E8 G8 i. O' ]
  I8 j) y3 K' V  T; K9 b) \3 hHere again, several ways to detect it:
- I2 G( ~  N5 c
- _0 L/ }$ o4 ?( Z$ l- h5 D( \" l' ~    BPINT 41 if ax==4f+ Z# J5 [( u5 S, {. h

3 ^% s3 u9 w6 {' P* q    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one6 E& Y, e5 z& Z( o' q6 `/ U* m, C

& Y3 _* r& }  b& \) A    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A' c# b& @4 `% \' l

+ f/ [+ J' D: r$ k, n/ v    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
- A) f1 [. Q! v+ T, @. E. i/ y/ [- I8 b2 x; u4 m$ o! b3 Y1 G$ {" n  u
__________________________________________________________________________8 W, \$ S2 R& n: r
+ I: e0 n8 z# c8 h/ c
Method 139 S/ M, X3 T/ O3 i3 k0 g: b: r/ d
=========* ^+ c+ e& z" |0 ]  i& m3 N7 r

. R  C; G: t# \8 ^* z0 A3 T! P& W; p7 NNot a real method of detection, but a good way to know if SoftICE is
& ^$ y0 g; e$ Y  e2 pinstalled on a computer and to locate its installation directory." p8 v' y. j7 q
It is used by few softs which access the following registry keys (usually #2) :! ?) X% S* Z/ N* {
# z3 s' A8 a" Z. {1 a/ w
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
5 @. X+ g% J, e- L2 \4 {7 C- e\Uninstall\SoftICE5 U) x5 z4 H: {4 ^' M2 n# E
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
) i+ r$ b% F, q) D: _. B-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
: [6 X* ], m0 g, t- }/ R\App Paths\Loader32.Exe
! `) v$ x0 ]1 n; c) ?' q9 i; L- N3 K

1 U" y8 d1 L0 n! m& DNote that some nasty apps could then erase all files from SoftICE directory
) g* [. }% R5 z) U(I faced that once :-(& @& Y$ l) T8 z5 e

6 u) T  k0 X  zUseful breakpoint to detect it:
2 e7 x) \' ^2 s2 Z  ~7 ~+ T3 l' [( r4 ~- K! v
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'- |6 \2 y1 W% k" I4 D

  \( ?* Z) H7 [0 l4 h3 Q__________________________________________________________________________
- j. H& m. j; T4 W2 Y( [- C" D& m3 x' V$ B7 J9 N7 W0 y

, U+ Q/ x/ Z: f% J- JMethod 14
2 ?/ r+ C& p0 r- [! P=========
8 Q! ~( D0 C$ ^: b& q
" ~6 u* V9 K% w# a" U) \0 |% jA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose+ D, f( e; U- g+ r  |
is to determines whether a debugger is running on your system (ring0 only).
" w- V! b* S9 F3 u$ d1 F8 M9 `) X. R/ Y2 R
   VMMCall Test_Debug_Installed$ z5 @. R* q2 R% h* }
   je      not_installed; S/ s9 ~7 Q( K/ a* S

2 `; d; m' Y; e: a7 uThis service just checks a flag.+ B$ l/ t  t6 \" S
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部