About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
. w8 X* z: m. Y<TBODY>9 |( a- ~+ s# C* `( A$ Y5 x
<TR>
; m, v& R* x# R8 C$ c4 n: c8 G% ~<TD><PRE>Method 01
' F/ S& C7 X6 v! q) Z% V& ^=========+ _$ ?3 d! x  ]  ]" c( k0 K

8 h4 ]. d( |4 O& p9 j0 C8 F9 \This method of detection of SoftICE (as well as the following one) is
9 @1 G4 L1 `- I' eused by the majority of packers/encryptors found on Internet.. h  [1 D- m9 }+ i! b: U- R8 i
It seeks the signature of BoundsChecker in SoftICE* D. X4 S+ q0 T; J9 O% J+ B

. w2 d9 r* p0 K1 G9 N    mov     ebp, 04243484Bh        ; 'BCHK'1 k) Y) [; l6 ]: L- J3 D4 ~
    mov     ax, 04h
1 }9 g) S. q' M0 [' y3 w5 Z4 [+ m    int     3      
: ?% X' g9 K! K# v$ [    cmp     al,4
& ~6 r  H5 p/ a6 |    jnz     SoftICE_Detected- c$ `+ H$ ^% g/ P& J! V0 K

# J) c2 }2 E. ]7 X% w* C  g___________________________________________________________________________
$ g* x' E% \& Q* a" z! o  f2 O1 C4 _/ F  f3 ~" f* A8 R# k
Method 02
6 \* q1 O* ~. R=========
  w1 ~; J# Q0 t6 W' g1 v
9 Q; I7 _( R3 {  h+ C2 d8 Q+ tStill a method very much used (perhaps the most frequent one).  It is used& }) w) |. j8 Q1 k% ^# K
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
- [6 R. R2 Q8 T8 Tor execute SoftICE commands...0 g: M! Z2 \7 [, Q
It is also used to crash SoftICE and to force it to execute any commands
/ D1 l# G4 q! z5 T(HBOOT...) :-((  
$ [3 N* H2 c1 m, d0 ~' p, f
; V: d  r# D- T% t& DHere is a quick description:4 c( ]8 k( _# c4 {9 _! {0 \; i6 x
-AX = 0910h   (Display string in SIce windows)
: @# N; B) B- p; @( ?& }* Y-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx); G# `8 D6 U6 K4 r) N9 i/ C% g
-AX = 0912h   (Get breakpoint infos)/ m0 j" T7 Q( f; p& f' x5 W
-AX = 0913h   (Set Sice breakpoints)
9 y& J  h/ {( Q0 h* E, y# K/ v5 l) e-AX = 0914h   (Remove SIce breakoints)
5 b. `% l/ f# r: A2 I1 d* L
2 V+ e) E% ]! m% `" DEach time you'll meet this trick, you'll see:( h$ |/ X% @) J( S
-SI = 4647h: Q4 y9 L/ q1 D" x
-DI = 4A4Dh; J2 G. T% k, f  j7 {4 H
Which are the 'magic values' used by SoftIce.0 P0 ]0 y) t* s- y' Q
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.8 O) H4 g, M! z6 Y- D8 e. A
8 a( h" d' a0 \2 s6 D
Here is one example from the file "Haspinst.exe" which is the dongle HASP
8 `- Y. C$ N5 D% T# ~' |Envelope utility use to protect DOS applications:# I: E! I+ x# ^; [1 k/ V

9 I5 E+ q+ g, c, [2 G' L' \' o2 f3 Y2 O. f; _3 T) B0 s$ Q
4C19:0095   MOV    AX,0911  ; execute command.
* v0 D+ }- I0 z3 `; ^; b4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
+ m/ |5 U( Q- k& g! O0 T# g% Y4C19:009A   MOV    SI,4647  ; 1st magic value.
( H7 m; A+ V) a) s4C19:009D   MOV    DI,4A4D  ; 2nd magic value.. G" J5 x6 b* P6 P" u+ y0 X
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
. E+ J# ~* a! o& R- q6 y4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute8 s7 Y' u" `# o1 D. f# W% ]
4C19:00A4   INC    CX  K7 R; R; h. w% X( V; |
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute# x* z- A8 \' u$ i0 G  C
4C19:00A8   JB     0095     ; 6 different commands.) d/ M0 E4 e% M8 C, q
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.) ~! i' y9 Y! K) x) G- H/ L" U
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
- L( n* N4 O. V1 n5 o* n3 R4 _
5 z# O: X) z  M& UThe program will execute 6 different SIce commands located at ds:dx, which+ ~3 ^- H' L0 F( G
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.; o+ {5 |% H0 J' {9 z0 ]; x4 V

2 T: }7 Z7 w- u6 i9 c- e& [. E7 S* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
7 f* {. W  T% W6 r3 A___________________________________________________________________________/ U% L4 y* q4 ?) w0 F6 |+ L
7 m7 @" T% E: l
1 C7 ~3 q  l5 w) Z# ~6 H6 Q
Method 03
/ L8 e7 r- Q" k5 `" X, |) Y2 \2 J=========
# H3 w( U% D$ g. `( e" C# y7 r# x* `7 ~9 Y
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
- V1 J( B8 T0 h(API Get entry point)2 b- q0 X0 g1 q% c
        
0 f4 D  a, a9 |  c% e& A, a# M
4 T. S' A! ?# S    xor     di,di1 q+ c% a! B* w: I! P
    mov     es,di
3 H5 _. M& V' \* \- O    mov     ax, 1684h       $ h0 `* F4 i% r, t8 U3 x3 L
    mov     bx, 0202h       ; VxD ID of winice9 ]6 g% {! P' o; L
    int     2Fh. R$ K. G# Z# c9 i
    mov     ax, es          ; ES:DI -&gt; VxD API entry point' Y& y) E* J1 ^+ s( C6 @3 H9 L
    add     ax, di( B0 ~5 G7 M1 C- t5 [
    test    ax,ax
% Z9 t2 Y1 Q4 `4 A& s$ j    jnz     SoftICE_Detected
, C) M6 p( E( P7 Q) \) n8 ~* k0 N9 D* P/ O4 J
___________________________________________________________________________
& ^: |) {( n" v, z2 G! L$ y, J
$ m% [2 ^" \" Z# O: ^Method 04! k6 O3 C, e1 H2 G6 t( b
=========0 g! q% U9 |, U1 t- D

: s9 b% z3 `% n5 N9 O+ KMethod identical to the preceding one except that it seeks the ID of SoftICE. Y0 M( C+ {  r: p" O% z/ K
GFX VxD.
5 G  _8 m/ d- c- p4 G9 s0 o" V3 r) T; M) {% O: L" n) F9 p
    xor     di,di7 G! J' W( c0 V! M
    mov     es,di$ Y, x+ w. J! J, ^- F+ K: k
    mov     ax, 1684h      
2 L; h- V* n" I# w7 t    mov     bx, 7a5Fh       ; VxD ID of SIWVID6 F. T4 U3 U1 z. s
    int     2fh; B8 E: T: g8 X
    mov     ax, es          ; ES:DI -&gt; VxD API entry point2 H1 I5 B! C. O4 z) ^2 Q7 y
    add     ax, di
0 |' T6 _# e3 C    test    ax,ax9 ~. g8 d% \3 l2 m
    jnz     SoftICE_Detected
! O2 {  S. e% b4 B9 ^' i; x: w0 f: }0 p. Y$ J& C- T& p
__________________________________________________________________________
; m9 h4 |9 d8 U3 Z6 U- T  U
. m, W' L: l6 k7 h
2 V1 X; N$ `" A# V( \# lMethod 05
/ E/ U8 |& c, E' U! o=========
3 ?; S* ?" O6 g3 Q9 r+ q; q0 M% \( t
Method seeking the 'magic number' 0F386h returned (in ax) by all system, _" y5 a4 ]( O0 A8 G2 p
debugger. It calls the int 41h, function 4Fh.
- K5 M0 e* s! {- Z" q9 ?There are several alternatives.  
; e" e) }8 s5 u% X* {6 W, }- t4 m& E2 d4 c/ T, p# t
The following one is the simplest:
( ^* x+ _: Y' R" |0 Z. Q& d9 ]/ G& x' ^9 y6 y& b- I
    mov     ax,4fh! {% b- `9 N0 v
    int     41h
8 w$ @0 G7 k; C4 o    cmp     ax, 0F386( s) o9 W) Z" K
    jz      SoftICE_detected
9 F% s) K0 q6 ]5 }& g" V7 {( p7 r- ~* G6 ^5 m$ r' t4 r

# f' F! m& U7 S4 nNext method as well as the following one are 2 examples from Stone's & e8 V3 [+ ^- Z
"stn-wid.zip" (www.cracking.net):* k3 {! l5 Y1 e
/ u# |& e& v6 D9 L( C" {) |4 k6 G: m
    mov     bx, cs1 @) `6 `- @7 {
    lea     dx, int41handler2
' `, t& e8 X3 }( t, g    xchg    dx, es:[41h*4]. }$ [5 m% s9 R7 P: R- e& d' Z; ?# x6 e
    xchg    bx, es:[41h*4+2]2 z( T& X4 ^( m! b) d
    mov     ax,4fh% n2 Y, |( X* Z6 O5 u9 d
    int     41h
5 L7 D) p7 N1 f    xchg    dx, es:[41h*4]6 A  M, _  b3 f" c9 K( Q
    xchg    bx, es:[41h*4+2]! |' h( ?- X6 ^$ \
    cmp     ax, 0f386h0 F4 j8 L: U5 B' D( Q
    jz      SoftICE_detected1 U/ s5 d2 y) w
! m  N7 p3 b8 n- I
int41handler2 PROC) u" l( z; |' P3 N
    iret6 `# P3 G" q  i7 p# ^
int41handler2 ENDP
) M: c3 {  g: @1 o! \7 Y. i
9 p. Q! T5 \* S) N5 E2 m. I; R9 [
2 a  y& k! a0 j% \% [4 d_________________________________________________________________________4 a4 E6 p3 {4 j- c

) u# i0 t$ x, f# m* {6 L8 i1 S0 u
  X; f: v1 V4 p  K" FMethod 06
; _& R3 K7 ]. W, c$ T+ C=========  Z6 B1 Q0 f, ?7 E6 `
" j5 I9 x0 o2 X2 c- `

: ~  i% f. T: W+ H2nd method similar to the preceding one but more difficult to detect:
- w3 a% H6 q* h7 A; S+ p! _( H; g% R& F

% T/ E$ D9 C7 |7 B6 W7 iint41handler PROC8 ?# Q& s& x, r
    mov     cl,al8 k$ S0 s; K/ \9 C, ^- o: L
    iret$ B' H, D* S3 ^0 V$ \/ I
int41handler ENDP' u3 l' M4 r/ I
7 d) h1 H, F: q# W; s1 s! s

, s* d5 \! y& K- j8 l  W& H1 l( ?1 [    xor     ax,ax
. D4 C8 l0 m' ^4 l2 W    mov     es,ax1 v+ ?( O1 g" g( k' T+ [& v
    mov     bx, cs  E; s8 [. e* g7 t% P
    lea     dx, int41handler7 p& B, p- D+ O( k
    xchg    dx, es:[41h*4]1 G/ r9 d0 Q  l/ O% t, T
    xchg    bx, es:[41h*4+2]' d6 v7 ]1 \$ Z4 A, L- Z# Z) o
    in      al, 40h$ ^1 Q! w& n5 G9 ~: O- ^
    xor     cx,cx
3 r* @2 b. U* i! z4 k7 {2 k  G+ z    int     41h. K, G& C4 p" n' u& N. R; [  [* O
    xchg    dx, es:[41h*4]
) g: C/ s0 a/ S& r/ f    xchg    bx, es:[41h*4+2]$ j# H- b) D+ @- v) ^! y
    cmp     cl,al- f2 |. `: q; Y
    jnz     SoftICE_detected: [# ~1 k0 ^  x5 S2 h
4 v. z/ M+ c/ Q' Z4 Z; ]
_________________________________________________________________________. t- x! [$ b0 r

! X5 _& i% l! G& g2 \# uMethod 07$ c- f8 |% [# `2 T0 E- y( K) y1 _
=========
: {& i) L7 z2 T  g9 E* J8 g- V. Q8 Z8 X+ Q: b; e: e8 m8 l( ~( E
Method of detection of the WinICE handler in the int68h (V86)
9 k8 p# L: i4 d; A' ]' Z; L2 n8 w; \+ Y  z6 \* q
    mov     ah,43h/ s; l; M5 j1 Q3 A# E8 Y9 w9 u5 y$ j
    int     68h. f1 b$ x- i# I4 {4 x+ Q" J2 D
    cmp     ax,0F386h
/ c, j" U/ H7 ?& H    jz      SoftICE_Detected/ `# m$ p/ B! L* R4 D: z5 M
- u1 I6 @. U8 Q7 i5 E0 ?/ `7 y

5 h* K/ c% O+ x; R# R3 ]=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
0 g% Q  |. P6 j) C4 L   app like this:
" p* Q) g& ]# T" t: m; Q9 M/ N. v# O- h9 l1 g
   BPX exec_int if ax==68: l* E& ^7 C) R. M' y/ V
   (function called is located at byte ptr [ebp+1Dh] and client eip is! B- U8 K" @7 r+ p) j/ y6 x# J
   located at [ebp+48h] for 32Bit apps)
, T* j' ?* _% R" X$ M: R__________________________________________________________________________
3 S9 l/ g$ a1 p
# I8 v5 `' G) ]* ?/ I$ T
% f1 [4 Q1 {3 \3 s! m- l) @: fMethod 08, L* w3 m  s3 D& D2 i4 b
=========) \' j. q0 p4 |$ I7 u/ G' S' P) p

7 \; A6 c- \" [1 n- J  lIt is not a method of detection of SoftICE but a possibility to crash the: d, u; F3 I& D: y, }& q
system by intercepting int 01h and int 03h and redirecting them to another
, B7 R; Q' w- _/ k' L' froutine.
: b7 H# ~( Q' E  a- |/ ZIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points$ w2 u( w1 c3 w2 m
to the new routine to execute (hangs computer...)
) Z& E7 K; K* Z4 I* R
+ _) H6 C5 |' Z5 ]! l    mov     ah, 25h5 f% F& a# a( L; u' R. P" E) a" I
    mov     al, Int_Number (01h or 03h)5 ~# P( @; [2 A5 v+ j# i
    mov     dx, offset New_Int_Routine2 ?4 r' |# K- J3 [
    int     21h
5 x, m2 p2 }# P: ]$ k
3 q8 W: }: h8 k4 [3 Z# [3 V__________________________________________________________________________
+ H' r$ H/ S5 V3 T) ~9 m1 F% m) L8 T/ d3 ]5 Y5 {
Method 09! G& T; }3 C' a
=========
( Q1 p+ f" ~( r+ d( q# E) g+ `" G+ r  ~+ ^7 ]* K5 d
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only) \4 z- _+ h3 q6 ]4 w: q: k
performed in ring0 (VxD or a ring3 app using the VxdCall).
7 v4 U& I* M% `/ W# @6 {The Get_DDB service is used to determine whether or not a VxD is installed
  s' [  {- u! C8 \+ |# \0 Jfor the specified device and returns a Device Description Block (in ecx) for+ D$ T9 R' X) O6 |
that device if it is installed." [( B$ k2 d/ C2 y) n
) X7 \* h: V2 w
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
% F5 e" E& t& }/ x, f2 c/ E7 @5 {   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
9 A5 W  ?% M# c2 v* d- j6 g7 j( K, G   VMMCall Get_DDB0 C8 x% Z1 H/ P; y/ j8 q. L
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
( R0 S# {1 E1 v! U# b9 z$ \
8 Y0 x6 s7 ^$ ^$ dNote as well that you can easily detect this method with SoftICE:
! Y5 r' I: ^+ j: l* p) r   bpx Get_DDB if ax==0202 || ax==7a5fh
0 Y) s/ H* c$ B" @7 S& L
' \1 J  ?4 ?, ~__________________________________________________________________________
1 ^( O$ V" x" u5 k# ?( x) x. C, H6 I# M/ A6 I
Method 109 _* U, b" P/ O, `( |' Q& r  O
=========
) g0 u3 V( n9 _! H
/ `' j, h& }. }% s=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
/ r9 B( U; a( Q& |3 j4 H  z; ?$ B  SoftICE while the option is enable!!
5 b0 ]1 C5 Y4 \" j" v6 L  ~' W/ t  S$ Q1 Q/ m/ `/ f
This trick is very efficient:% W7 w8 _) N2 \% _0 T5 b0 ^4 X
by checking the Debug Registers, you can detect if SoftICE is loaded
% g$ k9 d# M2 M# u" M(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if' x3 x1 H& U" x0 Y8 Q5 s
there are some memory breakpoints set (dr0 to dr3) simply by reading their6 ?8 T/ R. g$ B" {' g* d
value (in ring0 only). Values can be manipulated and or changed as well
" Y% U+ |) d3 z4 G/ P3 h1 _" K(clearing BPMs for instance)' J3 t' }$ N) l9 ~5 C

3 D4 j- U7 [& K; V% ]& P5 M& H7 J__________________________________________________________________________
# k* T8 Y4 Y' {6 M9 D
# R5 ?. X9 H7 v- g& X; @Method 11+ c3 J/ O& T9 _  H! {
=========1 X0 p0 @4 J1 X0 f0 A+ u, O# f) @

+ y- ]; G& g3 h5 X1 m$ tThis method is most known as 'MeltICE' because it has been freely distributed
  [, Z/ g% Y" x; `via www.winfiles.com. However it was first used by NuMega people to allow
8 T8 O( H2 E6 r4 v* O2 @) hSymbol Loader to check if SoftICE was active or not (the code is located
+ j0 W& @% V# qinside nmtrans.dll).
, P. w) G- G7 p! C) W  U
# m) x' U9 Q+ ?, m% y8 M& hThe way it works is very simple:
9 [: h0 i3 A: j! K( s- AIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for8 B& \- ^+ g. m0 g' j5 O0 E3 w
WinNT) with the CreateFileA API.
" W0 k  B+ J2 y
- V* H+ N' u- {Here is a sample (checking for 'SICE'):
2 c' ?7 G: ~' X0 l& A' R' y2 N& O7 Y9 o. b# r
BOOL IsSoftIce95Loaded()
& ~% u" `" Y6 b, L' A{1 v0 J( h# h; x" {+ M
   HANDLE hFile;  ) i% d5 w4 O  y' `7 ?+ e
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,9 o/ i4 w9 K7 {
                      FILE_SHARE_READ | FILE_SHARE_WRITE,
' J7 F. m# q& Z' S+ P                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);" |" t1 H$ z9 U/ c# f5 F3 o2 b
   if( hFile != INVALID_HANDLE_VALUE )
1 L' Q+ I. r# w% _+ m. S: z' E   {
! \+ Q/ `* |  Y* ^/ D+ {+ ^      CloseHandle(hFile);
; o' R7 S" f  R: ^  B! v0 J      return TRUE;0 j; ~8 W) w6 V2 x
   }4 r' G  {- J9 A
   return FALSE;& u$ n1 n0 y( T8 f3 p
}- K4 \* _5 M' R" [) A. D( W4 v4 L/ ?
* w% e, i$ ?" w' J5 a! ]
Although this trick calls the CreateFileA function, don't even expect to be
5 A/ n6 n( C5 Z( [able to intercept it by installing a IFS hook: it will not work, no way!% r# T1 x7 X  }
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
5 B8 s+ ?1 V& O& lservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
) f/ a9 X7 w0 k' w- x4 V+ Eand then browse the DDB list until it find the VxD and its DDB_Control_Proc, y# q+ b: }, ]; `, Y, _, E4 ^
field.: M- s, `8 l7 @* n( S) G# y# O
In fact, its purpose is not to load/unload VxDs but only to send a
1 O& \5 q1 _$ lW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
' @) |! k7 m1 Z) bto the VxD Control_Dispatch proc (how the hell a shareware soft could try# ?/ Q5 N" x8 }
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
" l) _9 Q8 T% O6 P$ n  SIf the VxD is loaded, it will always clear eax and the Carry flag to allow
9 U$ {7 w  k" l8 \its handle to be opened and then, will be detected.
. I8 R5 x/ C5 U- f6 i; DYou can check that simply by hooking Winice.exe control proc entry point( m6 C4 s2 G  ~9 T5 F
while running MeltICE.5 J7 o2 R8 R: |5 [+ Q2 e- V9 x
7 [( ?: I( S6 R6 C/ G: p% B
) b9 J& t/ V( Z; ?  q& s
  00401067:  push      00402025    ; \\.\SICE2 |( X" u3 L5 l/ o1 V7 w$ w& ]
  0040106C:  call      CreateFileA
0 a2 C. r, \0 ~  _  00401071:  cmp       eax,-001  ~9 W! ]# x" K! h9 n3 K  k
  00401074:  je        00401091
4 p' O" `3 D$ Y' v# _/ N0 o* p8 \  L, l6 M1 V0 ~4 i

  V0 v: u; O2 [0 O. P6 R$ I- @There could be hundreds of BPX you could use to detect this trick.' N9 F+ M7 L: p7 W
-The most classical one is:
& {+ [$ |. ?, o" V/ V  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
' I/ G6 Q1 v  j    *(esp-&gt;4+4)=='NTIC'# h1 x0 m3 J- C, @6 z

8 D5 p( l; Z9 R. j  M; g- `# w-The most exotic ones (could be very slooooow :-(/ |' y2 I9 u9 ~
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  6 Q* X2 x7 S" {: b& b1 @
     ;will break 3 times :-(
4 c& A# Y8 O( \4 E( v, z9 d
; N' e8 l8 z$ P4 q" A-or (a bit) faster:
9 k) D" f1 |, `" g" V) I   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
& a1 j) S+ V* N: S1 c! w  [! ?/ z! U; X9 R6 o" p, L+ p
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
1 L( L/ _6 Q, p/ I0 z4 j     ;will break 3 times :-(
$ ]+ C  d, q( A% o% p% a: L$ f* k8 Z. R. ~1 S
-Much faster:( p. [) C' j  K1 j
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
' a9 g7 g5 f. K( b: s) U* u9 H+ V9 v& o' N! \
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen* ~+ r5 ~8 H5 X' i0 e( S6 H
function to do the same job:5 h) U* |" A9 }; B, \& s# {

. k0 t2 X  O) o4 }/ t1 q2 x; j   push    00                        ; OF_READ
+ Y/ A6 j  W0 A   mov     eax,[00656634]            ; '\\.\SICE',0
2 I: \; f) z0 ]& p   push    eax' x4 ~8 A# t) @2 u
   call    KERNEL32!_lopen- S7 A8 g: U# I7 D" Z* G
   inc     eax
+ S' [9 A/ p2 |0 a; C& h   jnz     00650589                  ; detected6 T. a/ Y$ A3 B8 V1 P; c
   push    00                        ; OF_READ
/ Z0 l5 e9 s0 R2 X4 f   mov     eax,[00656638]            ; '\\.\SICE'
1 v9 ^, v: i3 h, i) \   push    eax; j- ^; ^; ?9 i, b( |# e
   call    KERNEL32!_lopen" O" |1 v) F$ i! J
   inc     eax  u) @% V3 d( s3 G
   jz      006505ae                  ; not detected6 o, L  m( }+ C0 r1 I& \% f
# d! f+ }/ s4 M) ]% w
: e9 ]2 G0 I; |5 c  D3 ^
__________________________________________________________________________
4 t  u* D: ^5 \, I& n: P7 r& F7 [% z- r  Q. Y8 f
Method 12
% e1 h! n1 M1 p=========
' g) \. p' Z2 w+ y) N0 I3 A8 O+ R6 s
This trick is similar to int41h/4fh Debugger installation check (code 05
5 \( q9 D7 }4 t1 X. Y&amp; 06) but very limited because it's only available for Win95/98 (not NT)3 Y7 j+ P4 w- y, I3 c4 m3 o
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.$ [# `% I8 n/ U* q7 Y' i* A3 p
  Q8 C: o6 L" e- k9 s
   push  0000004fh         ; function 4fh2 o$ T4 ]; `; F. H: W
   push  002a002ah         ; high word specifies which VxD (VWIN32)0 t' t: A' D' t6 J
                           ; low word specifies which service
  b2 e0 H6 a  ^* p/ X                             (VWIN32_Int41Dispatch)6 n% V6 @! P" Y+ }% ^
   call  Kernel32!ORD_001  ; VxdCall& s9 O, T* p1 N) t! _( T; R1 g
   cmp   ax, 0f386h        ; magic number returned by system debuggers; x8 u' x2 L- X; Z
   jz    SoftICE_detected' ?- h$ T$ g! V$ y

2 @1 n) o3 @9 ^, h6 aHere again, several ways to detect it:
4 i; C* V1 ?3 y: {! i8 }& y$ T, t% S
    BPINT 41 if ax==4f* i6 a- }& {- P6 c: v
. {: z$ m+ G, W# L; ^3 C$ F6 f
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one0 @* J/ w& b: l( _1 U
- i1 Y! D! W7 h. P; `
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
8 ~$ |$ L' z9 c' W1 V- ?/ [( e
$ b. d! s% e/ b$ X; f) x+ z    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
  P8 k- F# O) {% R( T  f' b0 z; d/ O2 R
__________________________________________________________________________
. r, e9 E" F2 R0 `% J8 i
, z2 {3 m- i6 j( Z, o2 J( xMethod 13
- J0 F' n  E  w8 z0 w' J=========) \- e3 @1 Y' S0 S. h  |
2 G# Z, B+ A4 p1 g' W$ Q
Not a real method of detection, but a good way to know if SoftICE is) O% E9 B6 |: F8 H! ^6 |
installed on a computer and to locate its installation directory.
  W6 `; T+ b- s6 S% P2 l6 D9 O3 ~. }It is used by few softs which access the following registry keys (usually #2) :
$ Z8 [+ c/ r6 j, v4 O+ o6 \
1 S  Q1 N% U( x! c, y0 w-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
" D" N& U3 ~$ ^\Uninstall\SoftICE
, W$ N# n7 \6 B-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE# E: o, d' q. S- l) S& p5 Y
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion3 r. V( R- c8 F5 y/ m% \
\App Paths\Loader32.Exe
) L' y. A6 i% M* h' C; p! `; l1 L) a

+ t& i# e! t. I5 ^7 T/ DNote that some nasty apps could then erase all files from SoftICE directory) ?! G( o  S( Z) h
(I faced that once :-(7 p+ ]; |3 x' W! F: y3 r* B

3 Z9 L2 A7 L; }Useful breakpoint to detect it:! ]7 L# i- e: i# W7 Z/ j1 r

7 c. I0 R6 }1 }     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
' `; x: f5 U/ [$ f1 F- b4 g/ V6 O- c4 O" K
__________________________________________________________________________
; g0 L( b( r$ j) d. Y. {) H0 @7 L8 [0 V9 m) H& j+ v
' q5 f  d- C/ ]: U6 t
Method 14 * s2 o6 l* S: J# h5 N! P( b1 W
=========! _0 z$ y' \8 J+ W7 E' @% a! G: w+ X
. r/ _  I* K4 w5 w1 R$ O! p; {: u% J1 U
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose2 g4 B* r# I. h7 ]) |) \
is to determines whether a debugger is running on your system (ring0 only).
. M  V7 F* \8 E& G( `8 w& V5 o) U, f5 \5 M' Y; Y( r1 {
   VMMCall Test_Debug_Installed- r8 y+ ?! M9 R
   je      not_installed& ~0 e' ~- @* p& f3 c" a: E
0 t8 y4 X! j9 M. ?+ P
This service just checks a flag." H$ l* ]  n) _+ \- e+ o
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部