About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
. }9 y+ u- G& D4 j<TBODY>
2 c/ x7 Y" }2 k# N. D<TR>) H- Z; }- W0 U* |. E5 s
<TD><PRE>Method 01 + |6 d% x( P9 Y2 }
=========
; V9 a! Q- y1 z9 `+ [" o- k) c* T0 V8 ]2 ?- O3 c* @
This method of detection of SoftICE (as well as the following one) is
; d! N" ?' ?# W; y" U2 Z( R- Eused by the majority of packers/encryptors found on Internet.
, A# J  x+ Z' F- oIt seeks the signature of BoundsChecker in SoftICE, N* Q1 L8 v& w/ l8 I

5 k6 O, H4 g0 W" ~0 Q6 x1 Y    mov     ebp, 04243484Bh        ; 'BCHK'
& p2 {/ ~1 K. f& D+ \6 s  K    mov     ax, 04h
3 G4 E6 x# n+ I2 k# d# H3 o    int     3      
2 X4 ]& g# b, b" N    cmp     al,4
9 T6 V/ ~  i# U/ M: W# B    jnz     SoftICE_Detected! y5 i* U0 J9 ]) v1 F9 \

& J+ h$ h" K( b9 n% r  W___________________________________________________________________________
, {+ e% s4 F9 d0 |7 j. B( l
& Q, y, W2 I1 X, }Method 02
7 u3 r& z& E3 f=========# f/ f6 Y& [6 c1 R- y" I% P2 V' t
) E  b& g4 [( h% ]' ]* _
Still a method very much used (perhaps the most frequent one).  It is used
9 R2 ^$ B* U' w5 B" k8 Jto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
. D! O, `# A1 @4 `2 u5 j; Ror execute SoftICE commands...
0 I/ M2 X. W# r# X2 HIt is also used to crash SoftICE and to force it to execute any commands9 w7 \* S2 r. U( h$ S
(HBOOT...) :-((  6 j0 M$ ]& P0 |( j* B0 t
  Z4 i* W, R5 b- g+ ~3 q0 H
Here is a quick description:
: w: F6 e; u5 ^$ L! r-AX = 0910h   (Display string in SIce windows)5 d  h. v$ G  n4 I' L; W
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)7 F2 m# h# ^( L( \
-AX = 0912h   (Get breakpoint infos)- J) c& ?6 _$ ^+ A! ~
-AX = 0913h   (Set Sice breakpoints)! z* m8 t, K9 _6 K+ ~
-AX = 0914h   (Remove SIce breakoints)
; x, n3 s0 M* G0 V5 ?" y) B) c
( a/ H$ y  n6 \# l# ]% [* FEach time you'll meet this trick, you'll see:
7 `& L! w1 `3 Y-SI = 4647h
( @% ~4 T( b0 x* T6 H9 d-DI = 4A4Dh
6 K2 S4 x% h# {9 B' jWhich are the 'magic values' used by SoftIce.' O' n7 P( n8 H$ q3 \) m9 \) G
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
* G0 h) f: L& o- \' Y0 |, y7 i: ~1 d: p
Here is one example from the file "Haspinst.exe" which is the dongle HASP
+ E! G3 B! Z# _  N, A. A* `Envelope utility use to protect DOS applications:
: V! f% K7 }( F6 k- ?
) Y" B3 E- k# Z
8 _% u2 b3 ?+ O7 z  I4C19:0095   MOV    AX,0911  ; execute command.
4 s6 h% W9 Y1 v7 A% P* g  n4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
' i% U1 K: \7 m6 q- T) d4C19:009A   MOV    SI,4647  ; 1st magic value.: o  {( @/ K) ?+ {, [
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
  |1 x' ]$ g% q5 W4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
0 h9 U9 M- k+ O! O  N. M4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
7 H4 t: Y& x% }4C19:00A4   INC    CX
( W! q, r8 V8 q1 x% w4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
( X; e3 B2 c5 w/ @7 n) h4C19:00A8   JB     0095     ; 6 different commands.3 T* w7 w7 T2 h) m; Y9 b  g# F! ^
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.+ E1 u0 q; i4 O
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)  R, E' J* l& R2 S& ^+ f* \

3 M, |. F& x) e" ^The program will execute 6 different SIce commands located at ds:dx, which( s) p0 B4 u  P7 d/ `* |/ Q
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.. m4 T1 n6 E3 a" v! \$ e
5 }  {( e) S/ m% T( D  I8 H7 z
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.7 G' u" ^& S3 P; |- q$ k* M) u
___________________________________________________________________________" i3 Z8 t2 A# u
/ z+ {0 t# U9 {0 x/ N

) ^" t/ {0 B/ {$ O; @/ CMethod 03) _3 c4 F' H3 x* n; G  M' Y
=========9 d2 ?. K- S5 b: E
9 ^- q5 r" T5 ?& [5 Z+ S; `3 A
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h5 H5 J0 z) s- @6 N6 Z1 G
(API Get entry point)
  F% v. j6 [. a        7 y- F6 V& ]. X" G1 d' s

* m7 J. z( A( J( C3 _) {. b    xor     di,di% M( C8 i5 `5 P" }
    mov     es,di
3 ~8 F6 C6 f" M6 r+ v' U2 K& [2 e    mov     ax, 1684h       5 M! E$ q0 t5 w2 F3 M+ a
    mov     bx, 0202h       ; VxD ID of winice; S* r; B) n/ P0 b( N
    int     2Fh, ?2 N+ R5 j/ h: m6 J& [
    mov     ax, es          ; ES:DI -&gt; VxD API entry point" ]5 X5 l0 v# m7 j7 m
    add     ax, di
7 D6 i4 C* P# \! C6 J    test    ax,ax
- y& j4 L0 x6 H" _. z% v2 i4 p    jnz     SoftICE_Detected
: `9 d. Q  U8 Z% t4 G- K, [# Y& E- D. X2 v6 ^4 S
___________________________________________________________________________" [. z! N, _. B& u* \1 P
4 o) g0 X1 b* v
Method 04
3 `) C/ s  D$ w4 j, f3 p=========" }5 x) D- d7 f; ^* p

+ ?" [7 E, x$ V$ D& oMethod identical to the preceding one except that it seeks the ID of SoftICE4 G8 q; i) T0 q$ K0 u
GFX VxD.
/ \! \- F  Z* C/ r. A! x' P6 R8 M. w- G  O! Z& P, U+ \. ^
    xor     di,di
( \1 d0 |/ j0 W, {    mov     es,di
8 k. }' A( [& r% s' l0 K: Q9 L    mov     ax, 1684h       # d  |/ w  K  Y" _& ~
    mov     bx, 7a5Fh       ; VxD ID of SIWVID
% p# b5 t2 d( \! T# p    int     2fh
% ?5 v8 y) K- c, s    mov     ax, es          ; ES:DI -&gt; VxD API entry point  r: ~) q5 x' N) ^8 ?
    add     ax, di; h$ T* `% N4 R: V/ s
    test    ax,ax6 z$ N% L' f: K  U& I
    jnz     SoftICE_Detected8 d  O1 M  {! l4 J

  O3 X$ L/ [3 }0 p1 m__________________________________________________________________________" X3 D$ B6 G* p& Q5 L8 c8 s1 J

/ x2 f# a  Z! a2 x) s2 k- g0 H7 }& L! }2 F: R+ n& g, J# ?( p
Method 05: X* d2 _# ^& k& w; b6 U
=========
8 `' y- t) s  [" M- F; s- V# z8 N2 o# S8 d2 B- q9 i0 A0 b( |# L
Method seeking the 'magic number' 0F386h returned (in ax) by all system
! k* z5 X6 g( l1 d& V9 Z- [) R2 t5 \debugger. It calls the int 41h, function 4Fh.- y8 F6 o. a& r7 l1 |) K
There are several alternatives.  
& e7 V: ^" U  J$ Z# V- ]
: O6 r4 T! Z9 W/ o# aThe following one is the simplest:+ r) M$ Z+ l9 O- |( ?  ?; u
1 g$ [4 g$ o4 v& }% |
    mov     ax,4fh
" x8 B' A$ n4 S7 Y; G: S    int     41h
, L$ ~7 y; }. U. K0 m) p$ x    cmp     ax, 0F386/ O1 t5 }& h4 Z& ~2 e/ z
    jz      SoftICE_detected
1 M* I8 t/ J2 L% @+ U1 K
# w; G" X7 Z% [+ T" @# K8 Q1 E0 W2 ]5 ]1 R, A+ q
Next method as well as the following one are 2 examples from Stone's ; }6 H( j; q1 i/ V5 H. m0 m9 N
"stn-wid.zip" (www.cracking.net):+ I4 X8 g6 n( J2 u* y

) N; _: p+ {" s! t! `    mov     bx, cs
+ a6 S/ r, ~+ N" A8 ]# K    lea     dx, int41handler2
6 O( v2 c/ M4 i/ D' I1 W& V1 I    xchg    dx, es:[41h*4]
6 @" E8 n5 h5 p. d) L    xchg    bx, es:[41h*4+2]. b4 e. S4 @" Q2 d( u0 ?
    mov     ax,4fh8 p! A5 J+ K- E  H! N! H6 N
    int     41h1 y( U' f8 B2 t- ?' t
    xchg    dx, es:[41h*4]
) y9 W( ]# r7 {0 v$ b' t6 u    xchg    bx, es:[41h*4+2]
/ B6 o4 q( L" {( c) z    cmp     ax, 0f386h" ~; Z- ^- N6 l% b+ G  q* }
    jz      SoftICE_detected" U. ?7 u; w& d. b
9 w9 r6 y' i+ e6 R4 G
int41handler2 PROC
1 n2 v1 z3 D3 h- I: \/ ~    iret* ?! ^0 J( k# l- L$ g: o
int41handler2 ENDP
: Z) C* t+ v0 t6 P  n# h9 n- l2 P" }' F1 |

, U  W- Q9 s) q5 R* {9 K_________________________________________________________________________7 }5 d! S. B1 T+ D
3 E& \& L" A7 F  M

$ \- v$ p0 W  C6 m0 Q/ l) NMethod 06
% [# {! N* u6 S* L" [=========
2 R( u. J, J" Z- v" R. b( p; ?- O6 _

& b: X7 j" S/ L3 w1 c1 l, ]& T2nd method similar to the preceding one but more difficult to detect:
0 d1 n& M3 [5 U; ?% H: {7 I0 f1 V: N  B7 R" ~* `# ]

! j6 ]. {/ Q% C% q' z1 R1 Rint41handler PROC
0 v4 ~7 }# x- N+ _. T+ ]    mov     cl,al
6 H5 y7 k; C3 w0 D7 y; O* `    iret
/ n% T! q9 ]7 i' Z6 u9 ^/ B0 j1 x& `/ vint41handler ENDP
9 v6 l  B2 t1 s! c& h! g6 N( O1 t6 F6 _, Y
9 O; I7 c% m5 {3 K1 ?) o+ U2 C
    xor     ax,ax8 C! {3 ]3 P2 t2 d& W
    mov     es,ax
+ s2 |3 I- a$ [: |" P7 l    mov     bx, cs
' n1 y" S7 W7 _1 |    lea     dx, int41handler. m6 a/ s$ z4 x$ o7 Y1 @
    xchg    dx, es:[41h*4]
- M3 J; T: o1 Y2 W! a' d    xchg    bx, es:[41h*4+2]* n9 v) ]4 |' Y; B6 n
    in      al, 40h! F( V. H9 L4 @% O
    xor     cx,cx! U+ a" z- W2 |, q& T; a
    int     41h6 q: Q$ J( e' b- `: w% o
    xchg    dx, es:[41h*4]
6 g; k* b  M" @4 ~" a$ B    xchg    bx, es:[41h*4+2]
# W! q; D/ s  B% g( ~: z( A    cmp     cl,al( c: G5 m6 P( _1 O
    jnz     SoftICE_detected. y5 i& O0 M8 y6 T- \! U4 `
8 B7 s6 I. Y% M) ^+ e' C
_________________________________________________________________________
1 z/ O+ a, Z% j! u  ^% j. u: o) H) ^& v: a! G
Method 071 n3 b& z6 `; L! U* ^. z( R7 E& {
=========
$ A; s+ W" Q* z$ H, z6 h3 L* K" `# |% u1 Z5 ]) r$ a
Method of detection of the WinICE handler in the int68h (V86)
/ \$ n& @6 B* ^' x/ `, N
8 v9 f) t3 u; r7 `    mov     ah,43h9 L. D" F6 R' T% O
    int     68h" ~+ y3 U3 w1 g& h9 y0 e/ n* i
    cmp     ax,0F386h
* p  ^6 N) H, u( Q) |    jz      SoftICE_Detected( z; n8 \$ Z1 [5 x7 ]' {
" h* r; C0 L' Z0 ^( ^/ x  W
. l* U4 M1 y6 |8 d3 k
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
! i7 Q9 n! z. r9 m4 b   app like this:
: y6 [) _9 J# J' B3 @, r& C- @) V2 I% M/ x7 e9 f. [9 G. K3 F
   BPX exec_int if ax==68
, k9 o1 @' U( J) d# d$ a* u   (function called is located at byte ptr [ebp+1Dh] and client eip is; q7 _: `+ G- E! _# T
   located at [ebp+48h] for 32Bit apps)+ J: T7 j$ P4 A6 \7 e" e
__________________________________________________________________________2 |+ [  c# r" D+ N* d2 a

' F7 |8 S7 y0 i2 X
2 F9 w& C5 I$ P* e" d6 D$ ^Method 08
- k+ t; v3 m1 q$ b3 N' i- r- s1 A/ F=========- T1 U; y/ [9 A

  K& z+ W# |- o% S( wIt is not a method of detection of SoftICE but a possibility to crash the
2 d, B4 `6 N" }/ Usystem by intercepting int 01h and int 03h and redirecting them to another
3 x# `2 c0 [; Q1 Q0 T+ }! C# f  \routine.
& }+ G% L  t/ T8 R$ V" bIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points6 c; b" t4 x- ?. K. i
to the new routine to execute (hangs computer...)- n6 x" V" G% q/ T: R. P. |
$ \! C5 s9 [8 z) s
    mov     ah, 25h0 L6 B! s5 k/ K2 Z" Q% e
    mov     al, Int_Number (01h or 03h)& P: x2 ]/ d! h$ l  ]4 u4 X
    mov     dx, offset New_Int_Routine/ }- X4 W) `" _. u" R1 t# d
    int     21h
4 F* k2 V- c* c  \- C( Y5 L* d3 r, N+ f/ j
__________________________________________________________________________6 H; F% E+ W. ?# D. i; c7 J- `
) ~% d1 v5 G/ y0 d5 L: j2 D( g
Method 093 B( h" R: m/ r$ M8 B- A' {
=========2 X5 E0 L1 J% d% Y2 W) q  s
: i/ }6 @( G5 ^( Z- h- Y
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only, s! f2 |- y  P
performed in ring0 (VxD or a ring3 app using the VxdCall).$ y0 m$ n9 v7 w& I$ o; _: X
The Get_DDB service is used to determine whether or not a VxD is installed
# M. @  S1 @6 H: w7 ~4 I: }$ R2 Ifor the specified device and returns a Device Description Block (in ecx) for
- S: f# f0 X6 ^2 M$ S2 ?9 Jthat device if it is installed./ X" [4 u8 R# o- D/ F4 t5 h+ C

1 o. p8 @8 d# u' f, M9 d   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID+ {6 e+ N8 t3 g' M( _
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
6 Q1 N2 e0 N9 H1 ?   VMMCall Get_DDB) G& z* ?+ G0 M1 k% ~/ g7 D
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed  \4 u# j: u) H8 f9 S& S" I

/ [7 t/ }" N4 [' ^5 tNote as well that you can easily detect this method with SoftICE:
6 \$ {2 R2 E8 H: H- g$ N+ F8 k2 w   bpx Get_DDB if ax==0202 || ax==7a5fh" V. I% B2 D$ T6 n
2 H& e( X0 K+ j1 ?( Y- I9 _5 d$ h
__________________________________________________________________________, ^8 j/ z* D  A" }! V
$ ^+ e: Z; A# ^8 \0 T
Method 108 A3 Y8 o" S3 `* K& X$ ~# g* y
=========; Q+ I" M  A- [2 [/ c* g. m
, m. `+ B2 m4 }# _6 V
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with8 M: V' S& c2 i* {0 J1 s/ X
  SoftICE while the option is enable!!% z. s- C* e. `8 A& H& f
; |* i: Z/ a0 w3 O- u- S" {
This trick is very efficient:3 X5 n/ c& t3 y/ E6 m% R
by checking the Debug Registers, you can detect if SoftICE is loaded# W% \* f, U9 W7 f: b
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if4 t7 K8 n, |* B" I
there are some memory breakpoints set (dr0 to dr3) simply by reading their
. L; V* C3 w) M0 s3 j0 k2 U& Ivalue (in ring0 only). Values can be manipulated and or changed as well
' T$ [% g& y8 {/ B' P1 }6 w- A2 R(clearing BPMs for instance)
& Z" r$ T. B& E" v
  N0 i1 E% m7 d. h6 m__________________________________________________________________________
# u3 e1 o  ^1 j, r0 r" M
5 q. P& [+ O/ V% vMethod 119 w4 @8 B" N4 X, p6 G
=========
+ ^0 T0 G3 F+ U) {0 Z8 `3 e/ M/ m- c* B% ^5 l% v: i# V
This method is most known as 'MeltICE' because it has been freely distributed9 k* v5 R. Y- K. w
via www.winfiles.com. However it was first used by NuMega people to allow4 G5 J  w$ w+ \* Q4 x3 j6 I) n7 I9 @
Symbol Loader to check if SoftICE was active or not (the code is located; F' U, D0 t! G. m. n; A
inside nmtrans.dll).
. g, T" }) [' b) ^2 j9 g
+ u, _' X) W9 ^. U- q/ s* v6 uThe way it works is very simple:4 r+ h. k, `0 a! p$ C  H3 k
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
/ K* r; @. w; P0 a$ LWinNT) with the CreateFileA API.' W' O/ C  e  c9 M1 Z; P$ W0 \
1 i: W9 S6 W/ w3 Q
Here is a sample (checking for 'SICE'):
: B% D' q# i) M) {  ^2 M' [% k1 W5 L% i7 L( J
BOOL IsSoftIce95Loaded()( S$ G: g; T: O+ \$ j/ o$ j5 b
{
+ l( Z3 Y4 S: X# |3 Y6 T4 ?   HANDLE hFile;  
: b8 q6 b) M" r! b; t4 g( k   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,9 H% \% `2 ^$ _' L' a9 e+ ~, o
                      FILE_SHARE_READ | FILE_SHARE_WRITE,( L% ]" [/ m' y8 b3 G( j2 u9 @
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);0 T4 B6 p3 C) l/ m
   if( hFile != INVALID_HANDLE_VALUE ), `; d8 B; S( I5 h( x. U
   {+ V( s7 W4 n0 ^0 K  a) [
      CloseHandle(hFile);& Q% o) U% s8 j- k! s9 }  j
      return TRUE;  n3 f  ^1 _) S0 z3 s% ?) g
   }8 r# c5 O$ |: I: ^6 z1 D
   return FALSE;
: U2 I3 M  S. F( P}
. f  F3 N5 [! _* l) q  n1 T) s4 N4 m7 }& u( x$ k! Y
Although this trick calls the CreateFileA function, don't even expect to be" {% ~8 ~) m% y3 X1 U& a2 L
able to intercept it by installing a IFS hook: it will not work, no way!, h( M4 i3 u6 G1 `3 G
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
: O! u: v5 X' p/ Q6 W& o* p/ u, fservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
6 F- m3 d* f# g# y/ A: Jand then browse the DDB list until it find the VxD and its DDB_Control_Proc
0 ~  T$ \& Y6 D. Bfield.
+ z0 }2 v# Y( _" C5 B4 eIn fact, its purpose is not to load/unload VxDs but only to send a
1 U9 A* K# G4 [2 g5 J! y9 q( xW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)% f7 q9 W" I) j% h2 \- [' L
to the VxD Control_Dispatch proc (how the hell a shareware soft could try0 ]7 h: E" N5 k
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
$ C' J: B9 J0 hIf the VxD is loaded, it will always clear eax and the Carry flag to allow+ {; D3 j8 T2 @5 ?8 |" H
its handle to be opened and then, will be detected.% c) H& L1 H/ K5 [  Q+ g) d; \% I  P' C
You can check that simply by hooking Winice.exe control proc entry point
4 x, j9 k  D) G* Qwhile running MeltICE.9 |+ j0 P( A9 x8 m' M

$ L/ O3 p3 c$ [9 o& {) |& R4 D  ^0 O' P5 ]3 H6 r
  00401067:  push      00402025    ; \\.\SICE
$ E* p/ q. d* L9 _5 o  0040106C:  call      CreateFileA
+ {) k( }5 l2 V7 e3 f3 k  00401071:  cmp       eax,-001
# R0 i* _# S+ z( n& q# L! u1 p  00401074:  je        00401091- C0 W7 R' z, U5 m5 n# O
2 T" P/ x( X  F9 {4 X1 }4 a$ ?/ F

4 T  d, C1 u& mThere could be hundreds of BPX you could use to detect this trick.
' M! d$ r  U' o5 |6 }-The most classical one is:
% {7 T, N4 C$ R# @0 @  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
3 K/ l* p. Y3 ]$ t+ q- N    *(esp-&gt;4+4)=='NTIC'
5 {+ h( }: e* S' Y* b1 i
. f1 W( L$ q2 [# W-The most exotic ones (could be very slooooow :-(0 s$ U4 K- v. e; u: Y
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
  {  q. y- J) r$ y  X8 N3 F     ;will break 3 times :-(4 g5 R0 M& m0 t% X# }1 Q/ X

$ E3 V  k& X+ P  ^! [  k: O-or (a bit) faster: % O1 }. R2 S' m0 ?2 I9 s) q
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')7 @6 U, I6 O1 X

6 @  h5 g- j( D$ D   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  5 D" Z. q' S7 t% k! ?( ]2 I
     ;will break 3 times :-(
. o% B! ~5 D4 N# N. v! \& {! K6 H$ r% Y1 z
-Much faster:2 l3 f/ y3 |+ P9 @5 }7 m+ g3 X
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV': U9 T" w" y: V9 C2 ?

! h. ?2 t* \  ?; l' [Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
: C* j9 B$ Y9 ffunction to do the same job:9 r% I7 i$ p0 R

4 K1 v- J5 |" e# C1 ?2 \   push    00                        ; OF_READ" O; a3 k% @+ y, g. {' O; T
   mov     eax,[00656634]            ; '\\.\SICE',0% x! a0 C/ s% l$ M* I; y( X
   push    eax% m$ c8 z. H' Q( a# P8 I
   call    KERNEL32!_lopen" i8 W2 h2 P: |
   inc     eax: g0 L3 B+ T& H  w: t) w0 }3 \
   jnz     00650589                  ; detected
+ ?% a  Q; ]% M" Q* r( `) k   push    00                        ; OF_READ" q) ]  Y; a1 F
   mov     eax,[00656638]            ; '\\.\SICE'- u% G6 c1 A% F1 O
   push    eax
$ [0 w; A! L$ v) S   call    KERNEL32!_lopen. \$ C: C! B* f9 Y" g3 _6 e
   inc     eax
0 o* e' L0 }* [   jz      006505ae                  ; not detected
. B* ^: j$ q% K; S5 J; i) R; [. z' [# d+ R3 i
; Z/ S, y: z& P: z4 \0 P8 s! a
__________________________________________________________________________
2 D6 G( x$ y+ K; F9 t- o# ?6 R; A1 g/ P& m
Method 12" h1 u5 j# l$ I) f+ f, T
=========1 X5 X2 f% `6 `# V: [$ d& o" ?

; t6 e; `* ]# X9 d- }. MThis trick is similar to int41h/4fh Debugger installation check (code 050 q2 `1 x: k" r# {8 K1 Y& b
&amp; 06) but very limited because it's only available for Win95/98 (not NT)  Q) V& C7 z3 u/ o
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
; E7 ^% j$ M9 J3 E7 X1 e! V' D0 I$ p8 [/ C  L3 o  `% S
   push  0000004fh         ; function 4fh
7 h# _" W5 l) I5 W   push  002a002ah         ; high word specifies which VxD (VWIN32)) ^8 ^# X- b7 M
                           ; low word specifies which service
! L% {  P+ d/ X                             (VWIN32_Int41Dispatch)
8 p! I" a5 n5 e) r$ s5 `5 I   call  Kernel32!ORD_001  ; VxdCall' E9 G. |1 C0 N8 |! e
   cmp   ax, 0f386h        ; magic number returned by system debuggers! }! i# C0 v8 q, |3 |" I
   jz    SoftICE_detected
% M! p  l) p- A8 Q& k( O/ |7 x* z" ~' }" \! f$ A% |" z
Here again, several ways to detect it:3 C1 n) v+ \) {( U3 b
  U2 k8 }; @" Y+ p4 X
    BPINT 41 if ax==4f9 Z* W- ]1 e' A5 |
0 R0 i- [6 l' E5 k8 f8 G
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
, k0 P( I3 p: N2 R# U8 s/ X+ C/ y4 q( I
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A3 T. K. S2 {5 L2 w+ X5 g: v8 \

3 O9 D1 [  m# c4 Z    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
/ C/ v- ^# D/ I1 c5 m
3 B7 K/ ]9 p! f. s8 ?__________________________________________________________________________8 n+ w; N* ~* m+ H

' i$ r% L. U: O8 l! a" w/ S! ~Method 13
4 `- q0 y5 p* W: a) s, }=========" Y$ K/ @& \; v& Q& b, _3 N5 A

" }8 a& `2 l; k# M* u8 INot a real method of detection, but a good way to know if SoftICE is
: [% [: C! w6 @7 s! O5 i$ Pinstalled on a computer and to locate its installation directory.* C* `# [) d6 Z5 e
It is used by few softs which access the following registry keys (usually #2) :; G0 f1 b! z: K* H3 {/ s5 A
$ I/ s9 ~$ U9 `# ?+ V
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion8 I# d  l8 P8 I- d
\Uninstall\SoftICE
, V4 `2 e2 p- |/ {/ V- r-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
2 \7 y' ?5 g( r- Y-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion# B  M$ `! g& e+ j- O
\App Paths\Loader32.Exe
  ~/ u5 }7 n* P* o7 F; M5 r) J( k) H! U0 b+ z

7 z- I+ A& C9 O7 FNote that some nasty apps could then erase all files from SoftICE directory
# }: H. A& m; A(I faced that once :-(( x- M8 W0 ?$ }

6 v$ ], K. p6 O, K" `* \Useful breakpoint to detect it:
' B  y0 Y) z9 k' I0 D. M, q4 b4 ^3 r9 _" ^& o
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'2 t5 p0 y/ z# j, P9 U* |
% q6 I$ r% i( |( N- L8 m& w
__________________________________________________________________________1 T8 l0 B; |# c0 q' A' S" k3 V( G' U
" s0 b5 Z2 j, D+ x
; E# x" _0 ]. f( m. D& A9 g8 l
Method 14 0 |7 r( `5 c2 B' t" _7 {( z% y
=========) B9 Y; D' Q- v# L. x

5 k6 I% n9 o9 s2 tA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose: T3 _$ B) ^- b- F; o
is to determines whether a debugger is running on your system (ring0 only).. D( T. w/ d& r; B

3 p! O% E- P# F3 r7 n% q, I   VMMCall Test_Debug_Installed
) B3 E; }3 t% Z) F; K2 W   je      not_installed; J) R* U* m' {% K+ m

9 p5 x! U' O* rThis service just checks a flag.
2 J: `. E# J! @+ }! N</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部