找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
7 d% o5 `# i/ u0 S- B9 q( f" {<TBODY>
- {+ k3 v6 G5 U: G( b<TR>- k. l5 Z7 y7 N- {' Z- g% a; A1 H7 |
<TD><PRE>Method 01
9 O3 X8 g6 k/ M! t$ B=========
9 \5 @& y% H- Q$ H% S- w
5 n, s- F& A2 q. H5 L. @This method of detection of SoftICE (as well as the following one) is
: [# ~5 @8 W1 E/ E' L6 yused by the majority of packers/encryptors found on Internet.
  y5 Y! V$ Q7 r5 t3 g/ cIt seeks the signature of BoundsChecker in SoftICE: ?, ^: P/ y; m; S- R! r  L
6 C, q( d; w# ^6 s2 q! S8 ~
    mov     ebp, 04243484Bh        ; 'BCHK'4 c8 r. J. i7 `
    mov     ax, 04h
* b; ?( W. ~" X. j0 i    int     3      
& g2 q) @! l7 x. m& j" m, B, K! J    cmp     al,4: f0 s, x9 f6 R) b/ ]$ u3 |5 t4 M
    jnz     SoftICE_Detected
/ h3 Q  Z. L2 x" _/ D  s; n' U- z" Z, O$ ]7 Y& x, e3 m
___________________________________________________________________________
' j$ p* z- _; Q; f7 j2 k
# A$ z0 F6 [9 ^, q% A1 _5 QMethod 02; \8 o' _  F3 |7 i) k# Q2 I- _
=========: ]7 n) U9 n5 y5 Y
% d+ @8 @2 j& t
Still a method very much used (perhaps the most frequent one).  It is used3 S6 |' @1 C7 X- m2 b% [
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
0 ^' P9 }7 D# L2 n  q, bor execute SoftICE commands...
. r; T8 w5 l9 w/ u) gIt is also used to crash SoftICE and to force it to execute any commands
4 H7 Y. r4 G% M(HBOOT...) :-((  , W5 R' p8 ]2 l6 f& F% w

5 G% V- B% y6 s0 i# S) KHere is a quick description:
7 f2 I! U( u" W- r+ A" j7 e/ g6 G-AX = 0910h   (Display string in SIce windows)
7 P' c- w# P, V+ H) d# q-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)  y5 J9 K" T$ }; {) j/ @( W
-AX = 0912h   (Get breakpoint infos)+ e5 J: A3 N# ^0 k3 K$ d% g. u" Z
-AX = 0913h   (Set Sice breakpoints)
4 C% Y/ r9 a  s& b7 y3 a$ V-AX = 0914h   (Remove SIce breakoints)
/ S9 \# @  B- \! f4 X5 q
" K( z0 D1 K# }( z6 xEach time you'll meet this trick, you'll see:
# J8 i- H) D/ h/ z-SI = 4647h# N; e* r( D# o, @1 I2 A0 `
-DI = 4A4Dh
( L$ b2 h  b1 ]6 f( r7 P7 J2 PWhich are the 'magic values' used by SoftIce.
0 X; E; ^' _1 k. {7 y, NFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
3 P, x1 e; b2 i+ w
9 q8 O& X. C  _5 X% S6 Q3 D$ B$ MHere is one example from the file "Haspinst.exe" which is the dongle HASP( c2 S& d1 D' \
Envelope utility use to protect DOS applications:
1 P  _5 t) |- {6 x: O6 m9 h
, B' ~. l3 c* z% P
& }, L. f2 Z) ?/ S# b4 H2 F% Y4C19:0095   MOV    AX,0911  ; execute command.
9 R9 J: z" z4 ]) b# Y4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).+ J0 \, r: d7 U" _% d
4C19:009A   MOV    SI,4647  ; 1st magic value.
3 E8 \# i8 F0 i4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
3 n; Z" k: `  U( s( D2 e1 `4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)' ~+ e% T' a  \
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute( D4 |* T* E  y& w9 h
4C19:00A4   INC    CX
3 R9 w* Y. s. H; ?3 R4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute' ~# f+ p. Y: _8 i5 S# Z
4C19:00A8   JB     0095     ; 6 different commands.8 S0 g( b  X. }% d# z' ^" W  ^3 H- a
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
- w  g4 W# c* ~+ T, f$ D4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)' m, p1 x/ Y6 p, _( ?* ?

% }  q  T) i; ]6 JThe program will execute 6 different SIce commands located at ds:dx, which
$ c$ ~) z* v  q" Aare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
9 _2 n8 j6 ]- n9 Q& E+ [( d) r& H  y2 z2 L- Y) W' L
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.3 g5 j: O( A6 H- u& [
___________________________________________________________________________
  J; r6 G; D- u& `. r- P' Z* R. N- f8 Z% Y& A% e

. a" Y  \% J3 u5 L; SMethod 03
2 m9 g" J! R! e=========$ o! F* r$ w9 w! g

" ]# ]# k& _! }5 J- mLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h% m/ }' E, Z) W0 u( k
(API Get entry point). k) c" |2 I( b8 L8 h# r8 ~
        
: l5 ?" i" M  n5 c9 q5 Z$ H) U" v" Q2 F
    xor     di,di. O# H, O, ?' ~, H& Y7 q# R7 ~
    mov     es,di
* Z; |: Q6 o& K4 `' P. [( Y    mov     ax, 1684h      
) B7 M. P) d1 M3 h/ H    mov     bx, 0202h       ; VxD ID of winice3 {7 F% a: l* \5 G$ S0 X. B# v3 J
    int     2Fh$ d0 z+ H: m( r3 ]8 @( ]9 g" {
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
7 Q0 w" X- [+ g" H1 T+ E4 u    add     ax, di
3 A# Z3 T2 Q  G2 g, I. b    test    ax,ax4 G, n0 T! M+ y& m# H1 r1 r
    jnz     SoftICE_Detected
2 k% B. O6 u3 O$ D$ u' L
" e2 l" m  c$ e1 t___________________________________________________________________________
! p) p  @  T; l+ ^, m6 ]* y2 }+ J. u2 m; X6 F
Method 04  R, D7 Q* h% x( Y
=========; v( ~# D( l. C( ?  Y

8 V7 R% I: y/ w2 J3 bMethod identical to the preceding one except that it seeks the ID of SoftICE9 X1 s+ [, K. F
GFX VxD.6 p4 o  s. @) B, }/ D) r

# g0 Q1 m* a$ L2 L" ]7 ]    xor     di,di5 g3 s" l0 `8 K' ?+ E( ?
    mov     es,di! @7 u0 B$ C# x6 z$ }  V  ~
    mov     ax, 1684h      
( Z# O8 j; A6 V5 k4 m    mov     bx, 7a5Fh       ; VxD ID of SIWVID# m+ V; h' R, J/ N
    int     2fh0 p; e1 P' {: e
    mov     ax, es          ; ES:DI -&gt; VxD API entry point: o; [/ Z8 x7 N% V4 q
    add     ax, di
5 @+ p) u+ ]+ _$ {: @    test    ax,ax, `; M: ^0 J% k2 `
    jnz     SoftICE_Detected; A7 g0 ^. F/ ?1 r5 ~

2 R9 P& W0 Q/ E7 V9 p+ h__________________________________________________________________________
: a, A$ y( l1 ^% z" {, |; O
# f" F, s7 W" m1 p% |" c' W( W6 H+ v7 h$ Z0 Q2 O
Method 05. e, z( Q4 ]* T5 {2 M+ H( N/ B
=========5 y  M: K0 @% M. _: r; a  a6 I

1 W1 a1 P. e/ t. G) VMethod seeking the 'magic number' 0F386h returned (in ax) by all system" w$ b2 v" B; W$ J
debugger. It calls the int 41h, function 4Fh.
: _- K) A( r# l/ zThere are several alternatives.  / P& }& U6 O6 {4 \7 I/ L* h5 z

# y7 O4 v  _( V9 t" x. \/ uThe following one is the simplest:3 M4 P0 w' `) Y' C; Q; O

7 @; J5 |! B; L8 [% R6 j6 F6 }    mov     ax,4fh. D$ T( l- m$ e) [3 p; \* Z
    int     41h; q1 ^0 l2 `' K3 Q
    cmp     ax, 0F3865 k0 \8 ^% o* N! P( w
    jz      SoftICE_detected
% s( f7 x9 ]% a
6 B, k" u4 o7 r) Y) {- n+ @9 S8 K/ O4 P  A4 r+ V3 z
Next method as well as the following one are 2 examples from Stone's ! M# `+ [1 g' f1 ?9 U: {! s
"stn-wid.zip" (www.cracking.net):
' x( F" u8 n2 F& d3 b* ~6 `5 {/ I# n: ^/ a3 V# @8 w
    mov     bx, cs
2 h/ Z; y" o" t! p7 w    lea     dx, int41handler20 U5 `8 T, t: A. Q
    xchg    dx, es:[41h*4]# ]+ S6 o4 D  l! t& B
    xchg    bx, es:[41h*4+2]
4 x+ @3 w* ~* ^; W/ S    mov     ax,4fh2 u2 v8 B0 |( i, l
    int     41h
: p. {( L, O: n5 @    xchg    dx, es:[41h*4]0 N5 I; y2 @1 T* A& s8 A# j
    xchg    bx, es:[41h*4+2]
  W% i8 L1 [& q" ~: l/ o6 i    cmp     ax, 0f386h
4 l6 j/ {. ~4 u, Y( x    jz      SoftICE_detected8 ~! c, ^" F( b8 b
& N. b* h* c! G! |9 s
int41handler2 PROC
1 Q0 W4 g8 D% x2 \' U    iret
& Q% u/ i1 M( y' H" m& N! Bint41handler2 ENDP0 j- _- `3 l9 e9 s
$ S1 \2 p' G% z: P3 v/ b& g

7 F/ @1 p- ]$ {5 W; w' L1 k_________________________________________________________________________0 `% T7 j  u' l% H$ n: O

2 l! p+ K- c. C( U3 h! b2 ~+ V  L  Z3 Q
Method 069 a1 F/ ?0 d' S2 A0 L1 t% G
=========
9 |' ]( ~4 o4 c4 [' l; a$ l4 }! T4 i
. |) Z9 s' V) O1 a4 V
2nd method similar to the preceding one but more difficult to detect:# h3 K, O0 ]  r3 [6 ?$ Q

8 ?& S, y5 n/ g5 D" c
& i. E: ?% f. qint41handler PROC
( S! t  b6 X7 B    mov     cl,al9 D% v4 C( w- T( k
    iret4 O. O- M2 z3 E8 E4 t4 \
int41handler ENDP
" j+ }$ }5 C& d7 G1 P8 L3 N1 x( X( ?# O, L/ W, C  q0 ~4 u& Q
; a9 C9 j+ }3 m% g
    xor     ax,ax
# O7 `( F# [4 L# z. k2 L2 v# U& I% T: W* s! G    mov     es,ax3 ^& F1 [1 H, O
    mov     bx, cs
0 B/ n5 v* I" ?- f+ h; P9 B    lea     dx, int41handler
" S8 D8 x6 v) ?9 e8 X0 ]  S: ]- B- I    xchg    dx, es:[41h*4]
9 D% U8 H, W: F* l  R% M5 o    xchg    bx, es:[41h*4+2]
7 z' Y0 f* a$ ]# z: l. g7 S, g    in      al, 40h
; _  C4 U8 R' k0 e( t# \    xor     cx,cx5 }; X" t& V% ^% P9 Z9 R" c
    int     41h
) @# p: K. U( m+ }    xchg    dx, es:[41h*4]3 O' f3 D. ]) s+ |/ h! W  ?
    xchg    bx, es:[41h*4+2]1 g! @. A! I1 `- X
    cmp     cl,al9 n/ T7 r) u$ m" t
    jnz     SoftICE_detected" m8 P$ T, @- b" e5 K7 B
  \4 v$ m8 O/ K1 a5 E% L
_________________________________________________________________________$ x5 ~% V' q6 O3 X
& V4 l; N! |7 j3 @' R+ q
Method 07
0 f/ H" O' I, Y=========2 }% h9 ]* g- v: i
4 F4 S. F) `& D5 s
Method of detection of the WinICE handler in the int68h (V86)" D( N( |0 r! {) M; W7 }6 u- \# v

/ `2 [/ |% Y$ p6 v    mov     ah,43h  \6 l3 n7 f; j; _* Q
    int     68h5 a! N, g% S2 U% i" x( M1 S
    cmp     ax,0F386h. _1 U# @, ~: C- ]' M5 F0 L3 B* k
    jz      SoftICE_Detected$ Y, N  A" C, j" `, J5 I0 c
3 l* ?- x, \$ U) k2 ], o% ~2 R
5 ~& V& m, i# I
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit9 z: X* K6 r2 |
   app like this:
3 I( j- t" H. D, @/ y
6 y  g, d; t4 N# g. d. N   BPX exec_int if ax==68& O) ]$ _6 J; Y) X# C) B$ _8 R; S
   (function called is located at byte ptr [ebp+1Dh] and client eip is1 X3 B/ H4 r2 s/ k. @
   located at [ebp+48h] for 32Bit apps)
( V  s, ~% J1 {8 A__________________________________________________________________________
2 ?+ F" g8 u# {' N! l3 ~  S; h0 \1 Y
/ v6 t, y7 n6 r8 F) f( F
Method 08) A9 a. Z6 u+ X- [# z
=========
  b$ I# b# x9 c0 m7 X: m
% \0 o( Q, E+ E$ WIt is not a method of detection of SoftICE but a possibility to crash the
7 |# Y' v1 D) ~4 {0 l* c9 M# c, k+ Rsystem by intercepting int 01h and int 03h and redirecting them to another
, w7 R4 \0 M; Xroutine.' T% r4 l3 M! _' ~
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
* r8 n1 M( G" ^7 jto the new routine to execute (hangs computer...)$ g+ v3 n4 c6 n1 w3 Q7 O8 C( H: ~

( m. R: [8 k# B8 o    mov     ah, 25h. |4 [' f7 _# F+ G- r5 _
    mov     al, Int_Number (01h or 03h)+ B! s3 x. K2 l
    mov     dx, offset New_Int_Routine3 B( \# r5 Y0 q" m* K- D7 B* ~
    int     21h
: t( L, I: ]- S7 b
5 w+ K1 {0 Z4 w! c1 u7 T__________________________________________________________________________* I# \0 n+ Y3 O3 i  C0 I5 {

% {# a% o/ L/ H4 O4 u6 ^1 sMethod 09+ X  ]- R/ {' a! U% ^2 [' x
=========, T: Y$ i5 }, ~9 n

: P$ f* d7 \+ Z# oThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
# L9 p# e* K: n9 {: B- Aperformed in ring0 (VxD or a ring3 app using the VxdCall).
( H6 r  K1 w; h1 X1 m: J; gThe Get_DDB service is used to determine whether or not a VxD is installed8 Z% u: O% w1 i  @
for the specified device and returns a Device Description Block (in ecx) for; B# h+ R( ?6 x. ^+ @. x4 v+ @- G7 Y
that device if it is installed.: h' H4 \- G9 P! y4 ~' C2 w

+ c# Y: T+ W) Y* V0 S& e8 V   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
0 X& t3 s0 k3 P( F0 Z   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)% n3 ~6 g5 |3 ?+ x0 i
   VMMCall Get_DDB6 \4 R1 y9 e3 N4 Z8 I# d
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed' b$ Y! Z8 r7 c
9 h; a% n( V5 d) o/ W- \
Note as well that you can easily detect this method with SoftICE:! `$ p0 L! Q; ^0 G
   bpx Get_DDB if ax==0202 || ax==7a5fh5 J+ M: i  Z- U+ ?

* v7 C3 O( P! E% w& Z/ q__________________________________________________________________________" n0 ?: [; U4 F) ~8 B1 F% c

5 q8 e1 p0 f! uMethod 10; t! k; Q( T4 |, s# \7 v
=========
3 e* j+ I4 f5 j) s# {9 Y/ g5 C9 R& C) b) K3 M
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with+ l5 n6 y# R# @* h5 G9 k
  SoftICE while the option is enable!!
7 T6 f3 o6 W1 Y4 K. [. C5 h
& r$ _( b- D+ u7 B1 vThis trick is very efficient:
; N# f4 g" g: t, C0 d2 z% Yby checking the Debug Registers, you can detect if SoftICE is loaded
2 Q) }( m. ~' I3 ^( n/ q$ `3 e3 i(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
, R/ C: R& ^+ r+ gthere are some memory breakpoints set (dr0 to dr3) simply by reading their
# x& h! e/ `# i# kvalue (in ring0 only). Values can be manipulated and or changed as well
# Q4 a: n1 o( ]* l2 b: r(clearing BPMs for instance)
" K; V, c& q4 y
5 y& E* V" z2 _5 b( Z  m. e$ W__________________________________________________________________________
% j0 O1 @( p! U' M5 z! x3 {, s- A/ s" \8 O% h- s; Z
Method 115 o3 i/ r, T* {
=========3 X# e& t4 P$ w9 C6 e( H
+ ^2 N* v  k9 U# i' ?# K0 k" n9 a
This method is most known as 'MeltICE' because it has been freely distributed
4 j9 |9 f2 e5 @via www.winfiles.com. However it was first used by NuMega people to allow
$ K- U, g" d* ~8 q+ oSymbol Loader to check if SoftICE was active or not (the code is located/ }: V8 [$ b. e% i, }+ e( c
inside nmtrans.dll).' C9 q/ G* F* b( N8 h; ^
, N# r3 U2 [7 _/ Z: R. ], C8 G  F8 z
The way it works is very simple:
0 P! `9 s* V# g0 |# ?It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for/ w( H# B9 n* v& G
WinNT) with the CreateFileA API.# P( G5 u" S$ h

0 t1 J" R  ]) sHere is a sample (checking for 'SICE'):9 x4 m' f' }9 u" n# v) r% ~
6 E+ R; D* V$ `7 B6 W' O+ U; m
BOOL IsSoftIce95Loaded()
, W4 i3 T- w) \6 d, J+ k{$ o4 f* b3 Y$ M4 n* _3 h
   HANDLE hFile;  
2 t( }: k  ?4 S* ?   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,  ^6 v% L. \% M; r9 a  ^
                      FILE_SHARE_READ | FILE_SHARE_WRITE,$ F: c- O( L" q1 a# Y4 I: R
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);& \5 M% X) E; s; j: v! a2 F
   if( hFile != INVALID_HANDLE_VALUE )
: K5 B5 S1 A, @( I9 t" }* l   {' J) U' I# k1 a: }
      CloseHandle(hFile);
$ D" q! R! s  ?/ o9 v      return TRUE;' z: i$ S# ?3 |- M* V( F0 f
   }
1 b; b! E, s2 T; `   return FALSE;. p2 c& B# N, V8 C( @* x
}, X( V) {  V0 L8 E0 _" V7 F
# A3 @8 q6 ^) o  r; O3 g
Although this trick calls the CreateFileA function, don't even expect to be- W9 {9 `( M/ v; R* l/ k* f+ E
able to intercept it by installing a IFS hook: it will not work, no way!3 x, Q8 M/ m5 T
In fact, after the call to CreateFileA it will get through VWIN32 0x001F! u( ~& p$ n( S. Z
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)* p6 K6 g8 O, u* [3 u, T  e
and then browse the DDB list until it find the VxD and its DDB_Control_Proc; ?8 t# D2 B/ y2 i" u
field.& V7 u3 y9 M5 [; Q
In fact, its purpose is not to load/unload VxDs but only to send a
4 O( C5 o" f% L! I. b& H$ xW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)# M! B: I3 I* ~$ E9 f8 t
to the VxD Control_Dispatch proc (how the hell a shareware soft could try0 D) V, E; I0 i
to load/unload a non-dynamically loadable driver such as SoftICE ;-).% f2 p0 b4 V# N4 g
If the VxD is loaded, it will always clear eax and the Carry flag to allow! v0 A9 s' s9 D$ b3 |
its handle to be opened and then, will be detected.! p! L; C& ]0 L0 s" y- c
You can check that simply by hooking Winice.exe control proc entry point1 b2 R+ r% w4 ~9 O
while running MeltICE.8 a1 Q& }. g( z7 p8 a; V

: x" f) d, G; }
1 W) H. o! T% h" X& q/ }  00401067:  push      00402025    ; \\.\SICE
* N3 s) j) ^% j8 `  0040106C:  call      CreateFileA1 |( o; p0 k8 A; u- p
  00401071:  cmp       eax,-001
1 X/ o0 t# _3 B9 x( P  00401074:  je        00401091
9 }" B7 M/ a5 X. f) ~' W* _$ J- `0 o4 k% o7 N! D5 D
$ J; {+ p6 e5 d$ ^* e0 K; `) ]% C
There could be hundreds of BPX you could use to detect this trick.2 Y8 B- z) i3 L$ l  U) H2 z
-The most classical one is:& J# j9 U- c/ j9 g; e% b( \! j5 H
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
& i, D$ d" \7 ?% A" S3 B$ o    *(esp-&gt;4+4)=='NTIC'
& E, }2 e% d3 A
+ D6 p( m9 w8 Y) f% {-The most exotic ones (could be very slooooow :-(  d6 U3 G. B! @" u
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
( F8 x+ n- `8 W* ^) _9 ~     ;will break 3 times :-(7 F$ t+ `6 A0 Y: `' ?) u* a

# ^  D7 \; d) S2 d-or (a bit) faster: + b; U2 T  \7 q" ^/ L
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
# V; r" E) r0 b3 H- o
6 ?- n5 i5 c. H* W& ?' B   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
4 _$ q: f0 t/ @5 j9 R) r. S     ;will break 3 times :-(! J5 j# e- u4 |: [6 v6 z) x6 ~$ k1 C

# o, D; C8 Z" Y. q! r0 i& Q-Much faster:
: |% a: D! q" D% p: e   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
. I& Y/ e' z6 m$ S9 a1 Z  i4 A
& M# D$ |9 n8 f4 J- X- JNote also that some programs (like AZPR3.00) use de old 16-bit _lopen# m1 v# E% Q% W* W5 f3 e1 u& [
function to do the same job:
# T  w9 g( w2 L4 d5 ]) z1 B; n  Y+ r; f# ]2 p
   push    00                        ; OF_READ
: U/ }4 s5 X; D6 R0 c; m% ]   mov     eax,[00656634]            ; '\\.\SICE',0
' i7 y1 ^& i/ F, U4 Q+ f) m   push    eax
7 V7 `! L/ U7 G2 X2 |5 r' Y   call    KERNEL32!_lopen
* D' ]4 S) D- ^9 b# _( O/ L   inc     eax' u' s& R: J2 f' Q
   jnz     00650589                  ; detected
5 T9 _% o' K$ E  Y; C   push    00                        ; OF_READ+ T: A9 d7 Y3 J) w3 q# g
   mov     eax,[00656638]            ; '\\.\SICE'  l2 N: o% L3 H
   push    eax
# Q7 ^  E$ y# s" v/ y1 b2 U* W   call    KERNEL32!_lopen
7 B, F3 v$ f9 }% E+ t. K+ S   inc     eax
+ Z4 k( d) B. r" ?   jz      006505ae                  ; not detected
2 D  A3 u9 J$ U! \" M
/ b$ x4 W- e( }; X  A' X9 Z
  ~) y4 o' Y1 x% y$ ___________________________________________________________________________8 u1 K; L$ I! K! c: `  l7 h' @
# ^2 d* E: v( I: O) [8 l
Method 12$ m3 s- N! z! |; S) A% I3 e8 k9 n
=========
! ~. ^' n% f, [& ~3 s  x0 F- W7 M* Y0 ]3 ^( O7 X- l4 B
This trick is similar to int41h/4fh Debugger installation check (code 054 r; ?8 T. R* }# M) c& O9 T
&amp; 06) but very limited because it's only available for Win95/98 (not NT)  q4 n9 v3 p7 D, k
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.4 H* ~/ D0 t, I7 l6 x: }9 G
+ e+ `- X0 P1 o7 y2 J3 D  h( u7 J
   push  0000004fh         ; function 4fh0 d: N' i  ~2 m
   push  002a002ah         ; high word specifies which VxD (VWIN32)0 {& N# J3 W4 A: h/ m1 j/ |9 Z
                           ; low word specifies which service2 m0 F& |- a! d  K8 }/ r4 W/ c2 v4 c
                             (VWIN32_Int41Dispatch)
2 B1 ^2 e7 a% x+ m) U! w   call  Kernel32!ORD_001  ; VxdCall. o3 D% D9 m) J2 G5 X5 Q6 `& B
   cmp   ax, 0f386h        ; magic number returned by system debuggers
! e. p/ \' S% k   jz    SoftICE_detected
; Y6 W9 n0 F: N
- I6 A/ S/ p, k; SHere again, several ways to detect it:7 w0 M) s; ^/ m! @/ k

4 `6 U6 E6 Z$ l2 P; Y4 n! Y; h    BPINT 41 if ax==4f9 }6 P. A! L( l3 `5 X/ Y
& K! ]3 W& {; U0 A( }# Z' D- r# Y
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one( G9 ^4 q( n& z/ Y3 u! P3 N
6 w- C6 X7 I8 x+ F
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A3 w/ N7 [: n! ]/ l" E

% w" y- t' `3 @, f5 q' _" p7 b    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!$ L, U) X* _6 X% v7 W* d* o% q8 Y! ]
/ x0 @# ^( A) P
__________________________________________________________________________
& Z( Q6 [! O: F  ^# A* d1 b7 E" g% F
Method 13
7 w, X) T+ [4 h/ N0 v9 L=========* i- A! E; {( Q% W3 b5 _0 ^  n

. K: H  [2 S+ V" L" n% D4 xNot a real method of detection, but a good way to know if SoftICE is
' ^  Y+ f% P! ~! u0 E  R6 I4 d) B  hinstalled on a computer and to locate its installation directory.& D7 a0 B8 r) z' l! d5 n8 }
It is used by few softs which access the following registry keys (usually #2) :
" E- P, t" S6 T9 B) H* Y/ I% [) r( M) E7 @
0 Q7 a4 N# p- W5 o/ I  a" ^-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
: Y- v3 [$ Q; V  ~; R. a\Uninstall\SoftICE
5 s  W0 {0 i) s4 {3 ~# a: K, E9 M-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE+ E$ w- F. x5 J2 v
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion- _' S; V) a7 I0 y$ r, U
\App Paths\Loader32.Exe
4 }. b+ X" L1 H# g7 [, v) @% \0 {9 H$ q% a: U/ @- x0 h0 F

3 f/ @) |  M+ E! N4 E  G$ g/ C5 FNote that some nasty apps could then erase all files from SoftICE directory+ e$ Z! N# E. h9 g# o9 P
(I faced that once :-(% |8 W3 _; D9 ~/ B4 p1 I. X' g# n4 ~
* ~; J# S: C( Z! c, D4 [9 L5 M/ f
Useful breakpoint to detect it:* ~5 [: T0 @( V

" v+ _. f# `9 E0 C" [' n     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
  r& }% ]. p- U2 {, _8 a$ e( r
- e! R3 R0 u  _1 V0 n__________________________________________________________________________& G8 x3 o2 ?: N0 B# x; m  ^- s
# N7 n3 z. @6 H$ w& z  U1 F

( F' h4 a+ _9 t! u- YMethod 14
3 j: x9 b8 ]% n$ _9 i=========
7 |% _  K  Q% F# E: A& P# h* d% b3 G' B
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose/ l0 L; B6 T$ r% ]8 u9 E
is to determines whether a debugger is running on your system (ring0 only)./ g1 K( d& S- \1 J" {" I9 ~$ m
3 {) z) o) x* f( k# X6 `4 \
   VMMCall Test_Debug_Installed$ @6 v5 O  X* n* ^0 w) V% a: @
   je      not_installed' I/ f' s) m# `/ }$ q( [/ }# P/ P
' O: X7 R/ s. D, l! i  I0 K+ Y( ?
This service just checks a flag.  }" Q( ^: P4 W+ [- F
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-8-1 00:05

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表