找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
+ A: k: y  @' {8 D<TBODY>/ a3 n( A" Y+ H9 q5 b% T
<TR>
8 ^  g  g1 {3 L) M0 p; N<TD><PRE>Method 01
1 d. |3 [: U) N9 s6 f, S8 m=========$ u$ [" k  c; _8 h, e& Y1 c, K3 h
" k, o5 i5 p) r& Y$ g6 F: o# A" L2 {
This method of detection of SoftICE (as well as the following one) is# x7 k% x( J. u& o( _7 h9 r
used by the majority of packers/encryptors found on Internet.
( B  w6 d6 I3 o# q! s9 W, E; ]4 dIt seeks the signature of BoundsChecker in SoftICE
' L! j3 ]$ p1 K" K
% Z# G$ a) q1 z! X1 G    mov     ebp, 04243484Bh        ; 'BCHK'/ [8 N. ]2 L6 Z7 x3 W! {
    mov     ax, 04h
/ e. \/ r8 D# O% O2 L/ T    int     3      
0 x; q9 S* j' H6 t' I    cmp     al,4
0 W, J. [, z& b    jnz     SoftICE_Detected
. L9 p) J  x( E- C6 |9 h& G9 g; {: _6 ?# S
___________________________________________________________________________1 e( f1 Z: [3 B& g, F- q
) r3 }: ^. d) l! l, `  a5 q* ^
Method 02
3 b% G) }0 x) J4 [# I=========  }( j6 C" }- O0 V8 i
/ ?: I3 Q; F. j
Still a method very much used (perhaps the most frequent one).  It is used
" h" T1 l: d; i- Nto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
7 V! I; \1 u! v8 p9 b7 T/ z2 z% bor execute SoftICE commands..." A: V% T; V. e8 g2 m
It is also used to crash SoftICE and to force it to execute any commands
6 _; P% O. w. ~3 Y) B9 N- E(HBOOT...) :-((  % _# y$ |/ k* N. ~; `
" C7 Z; x, o" w( [! g6 S
Here is a quick description:
; {& T" n, k* ]. k4 D-AX = 0910h   (Display string in SIce windows)
: [7 n& `4 }. F/ j' C-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
5 ]% P6 u) Z1 y$ M- `1 W, n9 J/ C-AX = 0912h   (Get breakpoint infos)/ l" h4 P6 K4 K$ e+ r9 _9 P+ y
-AX = 0913h   (Set Sice breakpoints)
! W: ^2 X8 T- ^8 k) _& O6 j9 L-AX = 0914h   (Remove SIce breakoints)
. P$ |4 g8 P& b
% i# A1 {) E8 [6 {7 e, S2 nEach time you'll meet this trick, you'll see:
3 k, k  t# Y% S3 \-SI = 4647h; E/ w% S. r1 x/ y; z5 V' b0 ]
-DI = 4A4Dh$ q* N. C# z7 _2 \/ S
Which are the 'magic values' used by SoftIce.9 y" f/ Z0 n1 B
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
# e! q" P0 J; t9 y
3 T4 i# T* g, HHere is one example from the file "Haspinst.exe" which is the dongle HASP
: W" ]5 o9 O. h* m0 `, B$ zEnvelope utility use to protect DOS applications:' s9 t) u" N8 h

9 D3 A3 Y/ c7 ?$ K" [. D/ u$ R3 F  J& e) A6 q# u9 R
4C19:0095   MOV    AX,0911  ; execute command.
" \6 x/ x* F: ]+ ?3 \6 L. p4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
- X% [+ c0 e3 [8 D: [" J6 O. v. K4C19:009A   MOV    SI,4647  ; 1st magic value.# T3 X1 Z% c1 x& ?6 f1 o
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.. F: D; G% l2 j0 I6 o8 _! F4 C
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
0 Y0 S$ i! A% @8 P0 K$ |4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
2 N4 J  X& R) p9 Y4C19:00A4   INC    CX
  \+ |3 {# Y; B4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
; H" X3 b( f  Z' r) C* r9 E4C19:00A8   JB     0095     ; 6 different commands.
  E  {7 O- w1 v% G! q4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
9 |9 c1 r& f" P: k' D$ G4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
' E& `% E! L6 J# [8 a
  C7 J  j3 ?6 L, Z2 kThe program will execute 6 different SIce commands located at ds:dx, which
- z) t3 s5 x( ]' nare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
4 d+ k  H( @9 l: h" y& N4 H" l$ x5 ?+ R
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
2 Y1 W0 S& R6 y9 ^& k___________________________________________________________________________
+ Q( n+ M; O( k
- r1 g# Q6 w" y4 r2 }4 `  W+ T  v; m7 O: o, G, |, z/ q, K# T
Method 034 ]2 E% U0 D& i8 m4 r: V- L) [2 V
=========
1 B3 ~$ L$ l7 P, w0 p7 x
( w) I: X  l& a; u. LLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
6 y" j  G. n, a2 j. J" o+ S' y(API Get entry point)
- i" I/ e0 {. Y6 P6 J4 r( B5 l        / A4 w1 |% l: F# W, b
( W: L8 E3 P# \( ~
    xor     di,di! \4 \9 M( Y6 k5 K$ t6 b. J! m. x
    mov     es,di
! @% b5 U* l- t- E' w; ~' T% E6 c    mov     ax, 1684h       7 Q% z: E* w- t  E
    mov     bx, 0202h       ; VxD ID of winice
/ O# f! a' ], o    int     2Fh- A( V& H( o4 V7 t5 y+ i  V2 ?
    mov     ax, es          ; ES:DI -&gt; VxD API entry point( g! C" `! g" d* o
    add     ax, di. m6 F9 W  Q8 t( k7 J, B. J
    test    ax,ax- i5 y# g5 m6 v  S; t! s& F' I4 z! r  @
    jnz     SoftICE_Detected' A2 Y+ ]) v# l' G; C( R# }

! _+ Y- o- H1 `6 P7 b___________________________________________________________________________+ A( B% H6 k/ C& B* C4 z! U; v! q
+ T0 L3 o# ~2 q3 d) }+ F
Method 040 [5 Z, e% R. b4 t
=========% v* V8 N0 b4 [: T0 H& \

6 Y, B8 k; _& \. Z9 B. \5 K3 q! AMethod identical to the preceding one except that it seeks the ID of SoftICE
4 S( y7 |( u  r/ {8 o  `% @% T1 sGFX VxD.
: i) K1 X. q' h" F. N; {5 l
8 d. d* k6 v0 I5 ]1 @- L    xor     di,di, o! d5 @0 A* T5 y- r% u" s
    mov     es,di
4 E4 z& F, Z5 W* K+ F) c% {& N    mov     ax, 1684h      
, l* C4 ^  a0 u: N/ P6 n    mov     bx, 7a5Fh       ; VxD ID of SIWVID; C7 G7 e1 `! e" w' Q
    int     2fh3 O9 g' s1 K0 V
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
; t, b* X# C& a. @    add     ax, di
9 B3 j1 x% V: W. n! Y* I    test    ax,ax& P3 t. c- e+ Y$ ]3 U
    jnz     SoftICE_Detected
' F% G+ T$ ^" I' h6 O5 L" K1 a
8 u2 B1 U. p5 r2 x1 U6 C__________________________________________________________________________, Q" m! L1 c% C' N! U  B4 ?- y

! O6 ^3 {# x  t* S0 M  z+ ]* C2 L1 Y- M% l2 @0 w* |& F1 S! J% Q$ `+ J, P
Method 05
2 ]4 i1 F3 L% C7 {. N  b=========
8 h$ z' p3 f! {+ D: f$ k/ J
4 D4 j6 O% ^) x$ S# S7 SMethod seeking the 'magic number' 0F386h returned (in ax) by all system
* _& x" O& }) l8 ]1 zdebugger. It calls the int 41h, function 4Fh.% A4 i. _; X, g& x' S1 E' D
There are several alternatives.  
! s, c8 \; ?/ x) F# f. S% ?7 q7 D8 C/ s: A+ P& C- C  w5 I
The following one is the simplest:
9 R; Q1 J; D. t# S% A& J0 B1 e& A# r% M5 p6 H4 E, J; g
    mov     ax,4fh; r# N3 }$ C! J6 C/ x8 r) B& U4 D
    int     41h" c5 U4 L1 H' s6 N# c" u0 Y1 I
    cmp     ax, 0F386
/ T0 a( V. z' C: K! T6 p6 h    jz      SoftICE_detected# ?( |. B. X& W: V4 s
4 e8 v) f+ S& n

6 w  E  \* x4 \3 _Next method as well as the following one are 2 examples from Stone's / q+ v- Q* q% P+ M" U/ ?
"stn-wid.zip" (www.cracking.net):' U" k' I8 N1 k% F$ L- x
' [/ s9 }2 [# A# U% a* ~5 k
    mov     bx, cs
- l  x! \- p/ ^! X$ d$ S3 g    lea     dx, int41handler2
/ Z1 a  f. H- G1 t7 G  E4 P' {    xchg    dx, es:[41h*4]; Z/ A$ y6 [8 |0 d5 e, G/ _4 `
    xchg    bx, es:[41h*4+2]
' V& d, D' c) c  U: K    mov     ax,4fh
: U: I6 T- x% H    int     41h
- @) Q- I* s' O    xchg    dx, es:[41h*4]
5 D: c) y. h8 H* h# J    xchg    bx, es:[41h*4+2]
# b  q0 u. i4 m; l. v9 {8 @: T5 B    cmp     ax, 0f386h
" E9 g, f  A: M$ L2 `    jz      SoftICE_detected! D9 c, Z& J$ b
: K( F. F# |2 |6 S' K
int41handler2 PROC8 h3 j. {7 |5 [7 l6 _
    iret
/ E4 B& ?4 }5 \int41handler2 ENDP
9 v' x) J5 c( B) ?- b) U6 L$ w  r/ \$ R0 E/ o
1 X! x! n2 c: `# Y7 g% r
_________________________________________________________________________
7 I2 A$ `$ c" Z" w0 @( @
1 H- g% Q: O( [6 b" U5 A# G
9 k6 T  D8 R) nMethod 06
2 k' D' k2 @8 t( s# |$ @=========
  d. H( s3 O, c" m$ K# T
# |$ M2 }) S0 I) C5 J7 v1 e5 a7 E7 L8 N$ R. O! h& a. c8 j2 g
2nd method similar to the preceding one but more difficult to detect:) Z9 r4 L7 Q% r3 I7 s& d

6 I2 G- `$ x$ V# V3 T. h2 U
. w# D8 z0 y8 h: X7 C/ Sint41handler PROC( i7 @0 t& V  @4 n* s
    mov     cl,al
/ V# h& N' E6 B4 U" Y, B0 z0 B    iret
, L2 y! r# E" W2 d- o( eint41handler ENDP
; ~: w* k! ]5 ~& v. q+ N
* ^0 m! P6 L3 q) k3 B6 z' a
( B( j, O; U! L; Y5 q& r) y/ T' `    xor     ax,ax4 G$ H8 b1 j9 Z; N* V* q
    mov     es,ax+ ^0 n& G' u9 C; z0 `; q* }
    mov     bx, cs7 x+ I/ ~# K' Z. i
    lea     dx, int41handler' O9 n/ H! J5 P/ P1 H0 m' G
    xchg    dx, es:[41h*4]( w2 O' K6 I6 v6 U, W
    xchg    bx, es:[41h*4+2]
& p3 f9 T  K; l/ H: F# `  ]    in      al, 40h
* }3 K! v3 M! `+ H* T9 d; C* f    xor     cx,cx) X2 R5 A% i" n2 {# d
    int     41h8 T. K9 N9 x6 F4 u3 U6 f0 t; g
    xchg    dx, es:[41h*4]2 n1 o- b7 O2 m3 }3 w
    xchg    bx, es:[41h*4+2]
, {9 ^  E+ s4 s- v* ~3 Y  ~    cmp     cl,al  n2 f+ |# O/ Y7 g7 r
    jnz     SoftICE_detected( s: b. l/ z6 v6 ?3 Q* i9 c

. l# S0 P2 o7 X_________________________________________________________________________0 I8 h7 d, O! g

7 X6 b( }$ ^% S' g& k. l1 J5 pMethod 07
; r9 ~- B+ N: d" K  V=========' ~7 w* t) |; X$ r2 j

2 x! X$ A1 D! ^8 n0 }Method of detection of the WinICE handler in the int68h (V86)
( k! t- L1 ^+ R$ _! U; }4 Q
0 D; Y: Y, I* D7 n    mov     ah,43h
2 V* Y, F% _. ~+ S9 B* d    int     68h( u0 q7 R: F' I+ B! v* k# o, ?2 H* n
    cmp     ax,0F386h
- O4 y6 w9 U# p$ |1 u    jz      SoftICE_Detected' J- ~- P( k1 x# E9 {# O% M1 m

/ P: X( C3 p2 p7 w4 @$ Z2 g
7 _3 j  B" Q. W5 u+ |9 ~9 c# F=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit4 {% t( W1 k( l1 b: m7 ?1 Y
   app like this:3 J4 C4 w$ R5 r/ |9 ^' S4 z% Q
) b/ O, L+ {+ m/ \& [4 m
   BPX exec_int if ax==68* g4 ?9 P7 W% R
   (function called is located at byte ptr [ebp+1Dh] and client eip is' ~9 t# ^7 ]1 J. M0 O! `
   located at [ebp+48h] for 32Bit apps)/ h( l- C  K5 f2 v( `0 y
__________________________________________________________________________9 W; V& n/ E# f0 n+ C

5 Z9 p4 k  ^0 k) }5 `5 \* |+ F, ^1 t! D0 U; a/ D2 v8 d% H4 L' B3 Q9 T
Method 08  {% s: A% c$ N
=========$ r  w, q. F- _; {, Q: G1 G
8 A1 {" S8 t9 {0 _% D# j
It is not a method of detection of SoftICE but a possibility to crash the" B3 n6 \+ c( X* i/ v0 A! Q, _
system by intercepting int 01h and int 03h and redirecting them to another
$ S7 N8 K6 h7 P! C+ h; Kroutine.8 O, n! u: _2 F5 i
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points. y0 j/ c5 `9 R- Q  A: n
to the new routine to execute (hangs computer...)
) E3 f$ r7 j* \& \" Y% F6 P0 i
1 Q/ t, g( \+ R6 F1 _, B    mov     ah, 25h. s$ k$ T! E* y
    mov     al, Int_Number (01h or 03h)( g: s) w& q5 Q- C( `& }
    mov     dx, offset New_Int_Routine
6 R+ T6 @* A1 b) Z: {; }' k+ E& ?  i    int     21h
+ ?- _8 d" J9 G7 g; H6 s4 ?7 {! U& n" _. {* X8 B7 d3 x% k7 {* I! |
__________________________________________________________________________
. C2 `: x1 h1 k4 p. F# m
3 t5 |7 ]; c! S, y! H9 wMethod 09- K0 {( x6 q' ~$ t; ~
=========
# w7 j% u) u7 T$ ~6 t) S# e, Q9 N9 x+ q; d1 C
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only' B1 u' k; U" M( G0 _
performed in ring0 (VxD or a ring3 app using the VxdCall).  u+ f2 X7 V% H( L: {. Q# X
The Get_DDB service is used to determine whether or not a VxD is installed4 A/ L3 L! w  W% B& l9 a
for the specified device and returns a Device Description Block (in ecx) for2 d1 k: `+ F3 d9 ^4 t
that device if it is installed.
* k) Q( ?5 X" ?6 \$ g& y* V* k) I7 g# U
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
! X; ?) c+ j5 R: ^2 y   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)+ w2 C" {$ r5 [9 J) L7 ^
   VMMCall Get_DDB
0 T2 F8 R& c; p% ^; q: W   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
$ ~, ~  @: |" |8 r# u
9 \3 G2 c: }# l  A/ YNote as well that you can easily detect this method with SoftICE:
" J* T4 m5 P# }   bpx Get_DDB if ax==0202 || ax==7a5fh+ B# D$ O8 r3 V& z' t+ N# ~8 C% ^

+ g! Y: c1 {0 F# y, R& x" Z$ |! b__________________________________________________________________________5 S+ _' z4 E4 i) N. ~) F' }: K
/ P% s6 Z/ {; i8 Y! t% j. k4 }
Method 10: h5 t" F6 \  O: @0 q- g. t
=========0 g  u% ^- m# _; ^' ^
+ \9 _2 X# D2 y+ H3 P2 M. k
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
$ H( a0 [7 a$ J) C. u' H3 v  SoftICE while the option is enable!!6 T2 e  q/ X& c, s, ^7 h+ y% `' s; \

( h/ p& W$ I- xThis trick is very efficient:6 B$ p, k+ L" a0 v* M
by checking the Debug Registers, you can detect if SoftICE is loaded
; j) F0 J0 H+ E( x1 c7 [8 O3 b(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if! Z+ `1 W+ C$ c4 q
there are some memory breakpoints set (dr0 to dr3) simply by reading their' B7 K4 f* W. l; l4 F& r2 P+ w" i
value (in ring0 only). Values can be manipulated and or changed as well) v! {  Z; {: Z, u/ l
(clearing BPMs for instance)8 z4 s2 Q5 q' D
: R# j3 U% ?0 f) \7 Y
__________________________________________________________________________* r, e% q2 d% w9 }+ Z

( |( o. `, Y  P# O& tMethod 11
" Y8 N6 _  H. B+ \' {=========
# \5 Z6 [4 h" s5 i5 h. x5 E# B, q% c  p# j' z; ^
This method is most known as 'MeltICE' because it has been freely distributed
# P( Z3 f9 g/ wvia www.winfiles.com. However it was first used by NuMega people to allow) N" i+ |) K2 R6 _4 `6 [
Symbol Loader to check if SoftICE was active or not (the code is located/ C3 T9 Q3 a' n( A
inside nmtrans.dll).
" X  f, h) E0 r3 {( ]1 z; ^  u! L2 {/ a) e4 S6 M- r# s
The way it works is very simple:
  C9 _' X. l4 b  d! }5 @It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for+ @" ]) G8 k3 `( V2 I
WinNT) with the CreateFileA API.
, B. d% R5 ~9 l! ~8 m: B' Z/ v
1 S# @: F4 n' C  p: b( l" P2 iHere is a sample (checking for 'SICE'):$ v7 X5 f, k: C
# }' P. `( k6 w9 P0 i5 n0 ~
BOOL IsSoftIce95Loaded()+ r+ K% I, D, r6 L0 Q/ ^
{! Y0 s2 T  t( Q- M( D/ H- @  K
   HANDLE hFile;  
& y( J+ m" z4 ^2 G9 l* P7 h/ ]   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
3 s; I7 q. z+ W; e3 a' p! p& q                      FILE_SHARE_READ | FILE_SHARE_WRITE,
! j: R$ Z+ m5 I8 H" u$ f. Y' U) L: d5 S                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);! B! F' V; m+ E7 T& q0 @; M$ H2 J2 w
   if( hFile != INVALID_HANDLE_VALUE )4 N9 U" v5 _: J' k& U, z
   {
$ _1 s& \( `1 u& F      CloseHandle(hFile);
! M( n0 r2 R) I/ @2 n      return TRUE;! B+ ?9 R! ~3 ]8 H
   }
6 D; e9 H3 n: F$ q, A8 Z0 `3 P   return FALSE;
" y" r  ?: o4 t4 W  f}" s, ^$ D8 ~' s2 [( m
# k$ H  j3 ^2 ]- n: V& ^* c
Although this trick calls the CreateFileA function, don't even expect to be
5 m) v: ]& e' I6 \% v2 }able to intercept it by installing a IFS hook: it will not work, no way!( ?  x8 r) g* [6 C% ^) ]5 J
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
# g" U' v! Z$ P& {) Aservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function). G+ F6 V* m, k
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
- T4 z( D. [$ d8 @3 @field." [5 S' B: w) I7 d* i
In fact, its purpose is not to load/unload VxDs but only to send a
4 J! y. X  H: \+ [& ?: e& R- |* |  R. uW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)$ G& u; p( F/ i& {2 C/ I
to the VxD Control_Dispatch proc (how the hell a shareware soft could try  M9 T: Q" W$ z' H
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
3 \- q% a4 F; m/ p" s$ FIf the VxD is loaded, it will always clear eax and the Carry flag to allow
/ R0 ]4 B% X0 q3 q. [2 o6 F5 @its handle to be opened and then, will be detected.- A2 z/ ~  K, W! F# c! D6 F; g
You can check that simply by hooking Winice.exe control proc entry point0 Y$ R' b0 F6 N- X" O9 P0 `" @  `
while running MeltICE.# s5 J2 H2 C5 p

7 v2 f+ m) l* R' R: G/ p+ u. W1 [( ?8 E9 `. m( ?9 f
  00401067:  push      00402025    ; \\.\SICE" S: D! a+ ?5 Y& Q
  0040106C:  call      CreateFileA4 `2 e7 e' u1 M7 v/ e" z
  00401071:  cmp       eax,-001
) I# n$ l  }% B" m; Q  00401074:  je        00401091
6 T& U) H! K; \; V9 W; p. w& p9 S8 G7 ^
* A5 t7 C) s( p- A, c# m# I
There could be hundreds of BPX you could use to detect this trick.
; B' e5 \9 Y3 n. D( D$ m5 v, G-The most classical one is:* P. `  M, q8 ^# ~5 |0 z
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
2 F6 J* e8 D; v5 k  F( {1 |  r    *(esp-&gt;4+4)=='NTIC'$ S- }/ F0 ~( R( Y+ i5 h7 t

, W* m3 h, S$ Q( h- ?2 t-The most exotic ones (could be very slooooow :-(
* E0 p/ s" Q8 B" @5 f2 m" T0 j   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  - v* F- m$ o7 u$ g6 C- m6 |
     ;will break 3 times :-(
2 g5 q7 P! ^$ U7 ?4 q1 J% b; o' r1 L
-or (a bit) faster: 5 z7 A0 u% T9 f8 z  W) Y$ G
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')2 ^( z9 B1 q. _9 G" r, h! G+ g2 j3 t
" c; ]4 l; R1 `" t1 i7 {
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  ( _. D/ V8 |7 g0 O# N% R6 Z
     ;will break 3 times :-(
. P% o: J* I! Z+ m3 x0 x$ @
% s8 `( L5 o2 j' @0 R+ H* @* L% S-Much faster:9 w# A3 v. t; k$ L
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
! V: i0 S. S: |+ u- |
4 H5 @# d" L, w5 K" Q/ ^2 |5 j7 K) J4 lNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
5 p3 d, q1 @) n. f8 C8 p$ L3 V& i# [- kfunction to do the same job:
& v9 U* z( D3 |$ c! S9 O/ w+ C# m# f4 |" U! E
   push    00                        ; OF_READ9 R  h3 A$ P7 E( g2 u0 u
   mov     eax,[00656634]            ; '\\.\SICE',0
* d9 v/ G1 h' _# Q. [% `   push    eax( ^1 I' I$ B5 E9 @
   call    KERNEL32!_lopen( J) B# {  X, p
   inc     eax
( e7 e) n* o% H8 B   jnz     00650589                  ; detected
9 F; I' M* I/ z$ B$ C   push    00                        ; OF_READ
; k; i; W/ I2 q: s7 e$ U0 I: d   mov     eax,[00656638]            ; '\\.\SICE'
" g6 d# j, {+ W$ ~* R9 w! x   push    eax0 g! \3 `7 k( S9 ^# V" C
   call    KERNEL32!_lopen
8 q6 ~4 ]! p7 h5 \& w# C   inc     eax
; P! G" a! h: u; o   jz      006505ae                  ; not detected- y' `2 H! {+ W+ S3 c
9 m3 K) |  }4 c! ]$ _
$ U! f/ E5 M  A5 Z  A1 I: o+ j
__________________________________________________________________________
5 t, H0 m; v! ~/ ?! }* z
/ D7 ~8 ~4 {/ f5 W3 ?! ^Method 12
) U6 a/ F1 d; I. |. M$ d=========
4 R. U- A) y' ~' _4 X) G( `  ]9 s, }: `" w) u
This trick is similar to int41h/4fh Debugger installation check (code 05  B: }. Z$ q. ~: H
&amp; 06) but very limited because it's only available for Win95/98 (not NT)
! k9 g( f; B% K6 }# ]! Cas it uses the VxDCall backdoor. This detection was found in Bleem Demo.
3 U6 @% u: I# Q3 R
" Y3 W0 q8 W% m   push  0000004fh         ; function 4fh) z$ G  f/ K  m
   push  002a002ah         ; high word specifies which VxD (VWIN32)# T8 e$ l, F9 P& `- D! t" @
                           ; low word specifies which service
. O8 }  Y' T! d/ {                             (VWIN32_Int41Dispatch)
+ A5 b5 b3 `, N; c* j$ p   call  Kernel32!ORD_001  ; VxdCall
6 a0 e1 V6 S, \  `- f7 S9 i' X   cmp   ax, 0f386h        ; magic number returned by system debuggers( {) M' l' p& r: e
   jz    SoftICE_detected
  N/ Y/ _( \  @/ X  z
; J- z2 j& V% c- x) {- DHere again, several ways to detect it:, [+ {- r( K) u5 f/ U5 W
/ ]  ~1 Y8 R, v3 l5 {
    BPINT 41 if ax==4f
( W/ q1 t8 F# A* y8 r3 D  ]0 W% `+ \7 j3 Z. `# i6 w
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one# \7 U* p5 Y( M: }# N- R

: E) R  P: O- G' i, Q    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
* o4 A6 f7 O$ W4 _" H5 G" [  @) M( w3 _4 O2 S
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
+ J& s/ A, ?6 C% k) E4 b# d* Q8 ?( h! R2 Z: j" i
__________________________________________________________________________9 ~! v4 `, ?) N  `
' p" ?+ {! J4 g- Y
Method 137 v8 N9 v" I: P" Q/ e1 _+ `6 ]! ]4 W& N
=========
, t5 F8 c1 i! I- [! `
$ w& T1 c, s/ o# b7 LNot a real method of detection, but a good way to know if SoftICE is
$ Q- x" R5 I9 ^* K2 |% q5 G/ ginstalled on a computer and to locate its installation directory.
- v& y1 A8 Z- UIt is used by few softs which access the following registry keys (usually #2) :1 y' j1 j2 {6 M6 ?1 k0 I* \
" A% Y3 ?8 g; d$ l6 D8 I
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion) L" Q4 ^9 D2 `. S7 k5 ?; H
\Uninstall\SoftICE+ i* N) _8 Y" K3 Q* ]  l6 k( M
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE$ J5 t$ o# U$ A/ \( z. C1 T
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
7 h# s- D% O# A8 B3 [\App Paths\Loader32.Exe
( ~6 \$ j) @' K+ }/ H( B# N3 U; Y9 Y, Z# z1 Z
0 S& f- U: j) u- [" R4 Y4 M% l
Note that some nasty apps could then erase all files from SoftICE directory8 V* t. O+ a% {8 ]1 \1 |) o' k
(I faced that once :-(
, s8 K5 x9 r5 J* ^2 c1 }$ g7 i3 N8 [! ~' Y( X
Useful breakpoint to detect it:* _7 `1 U9 w7 i) }/ H1 `% Q! k' f6 ~

) g( p3 D& o; C4 M. m$ s     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
0 {7 o) ?0 F& }! A" f. _
$ G- L* ~1 x" \" ]( S__________________________________________________________________________: M/ M* @; A3 |( \, V6 g1 ~# e

+ u3 O% ~! h" `& I
: L6 Y+ q2 }# g% d, DMethod 14
# F! ~: P2 d4 R7 d( p* K: w=========) u2 v. z1 D: ^; d1 p/ E, r7 O" J. C0 k

* I5 c6 i2 l: p# f1 @/ R# IA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose$ \5 L# k3 M1 P) W9 |
is to determines whether a debugger is running on your system (ring0 only).1 w/ b! o$ Q* ], ?* r2 x- r9 r% x& @

8 N' P3 g( d: f   VMMCall Test_Debug_Installed. ?, C) |0 P+ V4 r
   je      not_installed
+ G9 C- l, q( g1 G' Y- `7 A3 T
( y6 N3 [3 [! t, b5 m6 T( ?4 rThis service just checks a flag.
+ Q3 u/ |7 c8 Z# {</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-7-23 23:02

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表