找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
" h! `. L9 l7 ~5 M<TBODY>
/ _4 n4 K% M: s% A1 w( `: m<TR>
6 Q2 o7 s3 M0 P3 K% _8 O<TD><PRE>Method 01 9 R5 [, A! M3 F& [( J2 \
=========
; C( j1 f3 Z; K7 k0 j
3 E7 ?* B* w2 a8 j7 K2 k8 gThis method of detection of SoftICE (as well as the following one) is7 n: N' n4 i# c0 B. ?5 o
used by the majority of packers/encryptors found on Internet.
9 q8 _- Q2 J2 ?! ]& c! iIt seeks the signature of BoundsChecker in SoftICE( C* W' ]4 `& ^' L4 J3 P
7 e, h* `5 R+ g! Z
    mov     ebp, 04243484Bh        ; 'BCHK'
1 M7 C: `1 r+ e    mov     ax, 04h# i3 w7 H2 p: @
    int     3      
# t, Z! N' h0 L    cmp     al,4
( n  T3 {: O' I    jnz     SoftICE_Detected; ^0 s( I, s# n& h; ~# ?+ S
2 L  l" J3 X/ H/ P+ B/ N2 F$ l
___________________________________________________________________________
4 D* v" e  K  i2 H
9 x( V9 F; ~  Y: J) [1 E! \Method 02) T, J5 y+ a- c4 ]; G
=========
% i9 k. V" K9 d1 h: j
2 C+ P  U4 _% L) H) _* uStill a method very much used (perhaps the most frequent one).  It is used
2 t" e& [+ g; h9 w+ z) h4 v* Zto get SoftICE 'Back Door commands' which gives infos on Breakpoints,' S9 `4 W2 c3 T6 l" D* u
or execute SoftICE commands...
  G' ]' }6 m9 ^: ?7 j, BIt is also used to crash SoftICE and to force it to execute any commands
7 I! s  m4 d  @(HBOOT...) :-((  
+ a, o7 ]# @8 q3 D/ H
) y" w) ?( q2 J% q( [4 d5 r7 v  ]  gHere is a quick description:2 a5 l% S6 T1 S, X2 _+ a
-AX = 0910h   (Display string in SIce windows)
% _  @$ m) H( ~; Q  T; A+ f+ H-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)7 u* ^5 s. `; J5 T- G
-AX = 0912h   (Get breakpoint infos)
( ~8 P0 @) M! ^1 m" k" S-AX = 0913h   (Set Sice breakpoints)$ }$ g' R* n4 q4 l" ?7 u+ o
-AX = 0914h   (Remove SIce breakoints)* y* H) G1 [2 O" f- U/ `5 H
8 z8 L% I5 B& o
Each time you'll meet this trick, you'll see:
9 s3 n2 R: s3 H$ X4 Y4 y-SI = 4647h" w# o& J" o/ ^  L) ^
-DI = 4A4Dh
% J+ }+ x, q1 W, ?Which are the 'magic values' used by SoftIce.: F  t+ }. J) {5 p! a
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.( |# D$ l4 t: F$ _& Z
) k9 h  a3 s' @  ], ?0 O
Here is one example from the file "Haspinst.exe" which is the dongle HASP: S  a: l7 x% R6 b) w  z+ K; Z
Envelope utility use to protect DOS applications:
% U& W7 N8 ^" {2 m! P% [6 ~1 C+ E+ Q$ N

4 V8 r, Y. i4 j6 O& Q" W4C19:0095   MOV    AX,0911  ; execute command.
. b0 ]6 D% k/ m0 t4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
0 i9 n9 |6 c1 d" }" r+ B4C19:009A   MOV    SI,4647  ; 1st magic value.
1 R7 G6 R; [$ Q4C19:009D   MOV    DI,4A4D  ; 2nd magic value., i+ X3 l' H1 w
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*): ]8 K1 F& V  {' a& r& N
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
: ?/ x' w: o+ Z  l: |4C19:00A4   INC    CX7 D( \  T' ~& P8 K* t% K) `
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute/ l1 R$ x, D* W2 A0 W" s# @
4C19:00A8   JB     0095     ; 6 different commands.
5 q! E4 v  i; o3 j8 X2 ^7 U4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
" E; X0 m+ C- o" V- t& O( l4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)* [/ k% x; U9 O; f, n9 X

  R8 V) r% {2 W2 uThe program will execute 6 different SIce commands located at ds:dx, which
: t: {, j) r& q! b9 u! K$ mare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
; ^3 S0 N2 L+ M. d8 Y3 i3 J! e7 R2 \5 T
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
9 S) d0 L# j  [- I___________________________________________________________________________
# x5 r3 O% h7 Z( `( s
5 Y- C; Y* d) Z  X% a; Y! b4 L6 m0 I8 C4 F3 F
Method 035 P( M  v' L8 S9 D: N2 W
=========" G, m& T8 ?. P5 K3 s7 Q( n
5 x3 P( n+ v8 M% x) R0 \* p
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h8 A# ?$ h, `) v' H8 I+ @* c
(API Get entry point)9 K; X6 p/ i/ D# Y& G7 d6 g
        ' I" s8 Z: x4 A: E* H8 y" u! g& c6 ]- R
. r6 l5 J7 @+ P$ `7 [3 a
    xor     di,di. h# y# E! d3 @) j" \8 q) q
    mov     es,di( |( U8 ~: P  b! l
    mov     ax, 1684h       # H+ l+ D0 L/ {; i1 p  U7 {6 c
    mov     bx, 0202h       ; VxD ID of winice2 X, J! ^1 ?+ I
    int     2Fh
" h3 ]5 l/ A$ @    mov     ax, es          ; ES:DI -&gt; VxD API entry point
" @5 D" B3 h  X; ^5 n    add     ax, di
+ n* W. F5 \  d- J' m    test    ax,ax
; c) k8 _* j' x7 @    jnz     SoftICE_Detected- w8 @+ i5 X+ u% J8 Z& V( w

; A. W* q9 U4 j! \& W5 W8 L___________________________________________________________________________
+ u2 n! w$ v: i8 h5 v: c! }
0 k' L( m" V* ^& ^/ B- yMethod 04
3 y+ i9 k* ~9 r( O4 M. x=========
* C/ _& l* D: |0 f/ D  O+ O# m* u3 ]" W2 Z* j. a
Method identical to the preceding one except that it seeks the ID of SoftICE
% {  U! ~5 ~8 ?4 J/ O) s& zGFX VxD.
. n# d! y! |( D9 v& [% s) g" R/ q7 o3 y& n# w
    xor     di,di- a0 m# Y. H6 Z/ N
    mov     es,di
& U3 [/ g3 k$ C& e& M0 U    mov     ax, 1684h      
' k4 o# z) p" M, c    mov     bx, 7a5Fh       ; VxD ID of SIWVID/ b# d5 [6 a& i! g2 _
    int     2fh" i. M& z1 m8 [, T* }: L% L
    mov     ax, es          ; ES:DI -&gt; VxD API entry point$ S2 Q' Y: l( [* I  o, _
    add     ax, di
* r" m9 O" l- W! _+ d: n( j2 M: W" r: m    test    ax,ax4 S% F+ e2 j) A) t4 N% K2 X8 O
    jnz     SoftICE_Detected
% s$ [- t) i, M- O6 _
$ i7 g' C; Y4 w0 D__________________________________________________________________________
; G2 m4 n7 E2 n( I
* C, d8 Q7 z% \8 w$ K0 }" C5 S. e0 r( u5 V) O" S& {& {# O
Method 05
1 a- o. K. u, N. r* d# l& H=========
3 A' K0 X+ j8 n7 P, |' T- O6 L6 y& J" d4 F& I, `$ _
Method seeking the 'magic number' 0F386h returned (in ax) by all system! y& n5 ~. W  d, i7 Y# S8 r1 j
debugger. It calls the int 41h, function 4Fh.
) w0 n# Y- D* ]2 L; FThere are several alternatives.  
" l4 T1 ]5 E' d; g7 g, g) e! ^" I
$ Y, G/ J9 d1 `- F5 {The following one is the simplest:
& S4 ~; w) T/ X5 g3 f1 P" p7 d, A% z  e* k1 y# g: ]6 Q1 s
    mov     ax,4fh
  r1 t$ a1 k: P  q    int     41h( r" V: ]2 v& F/ L
    cmp     ax, 0F386
; L& \( f! t" v    jz      SoftICE_detected
% U% o  Y. K. h/ n( K* m& n3 p, i0 A  H' ~7 F& X' U
( f' a0 A" i8 ~* Z; c+ Z& c
Next method as well as the following one are 2 examples from Stone's 1 V% ^# k8 b: p
"stn-wid.zip" (www.cracking.net):
2 Q  k+ d/ m1 C% O5 g" M; T4 T  g3 U% Z+ K) P1 m
    mov     bx, cs
) Q+ E0 m2 {( A+ U    lea     dx, int41handler21 d9 y* ^( J- c( f( M* F+ D
    xchg    dx, es:[41h*4]0 [4 [) |$ q* H3 L8 W, E# B
    xchg    bx, es:[41h*4+2]
# l  D8 @" Z) v% ~8 H; k. {    mov     ax,4fh
+ A- C5 t% Q; S& H- }1 v4 |) \6 c% Q    int     41h* J# E+ F# B- M) P
    xchg    dx, es:[41h*4]4 M9 L/ T  }' f8 ?" k. i
    xchg    bx, es:[41h*4+2]
7 j8 V# `3 t: q$ T# F, h5 {    cmp     ax, 0f386h
' |/ J& ^! p" S    jz      SoftICE_detected
5 i' O2 [5 Q$ n* f; I! U+ x! N( E" x
) {' U0 r$ p8 gint41handler2 PROC: v9 v6 j7 z. o' Z6 h# j% p
    iret  i) _  G+ p! G% X+ L  M' r
int41handler2 ENDP
# Q2 G, T# `7 [: a
$ [+ a. L9 n& y6 C7 L$ i2 ^3 u5 I
_________________________________________________________________________8 A* f4 w. m/ g7 k* i
- K% q; a8 V) c1 H: L: ]4 p
/ B2 f6 _, j" f+ E4 C7 V& ]& C: f
Method 06
3 A8 L: y, B+ m3 |! K; K" ]=========
3 |. Y/ S& Z( ]7 r# F- K- p
2 i- q/ m# K# i5 ]0 i
. `, X; r. S/ a3 `$ f) n' ]2nd method similar to the preceding one but more difficult to detect:
' ~  N7 K  T7 c; B9 n! v0 X, y( j" d7 j* X
4 Y4 S/ n5 i# D8 _  c5 I; q
int41handler PROC* [" d( m$ W$ V; p0 W1 F9 Q
    mov     cl,al
$ K+ q5 ^3 N( E6 q/ X' b    iret
9 g0 R4 X) J- l- P8 N3 eint41handler ENDP
5 l3 ]' l: Y. b' y8 f8 V- a! _8 S
# Q1 [& O6 Y6 @0 W) i2 d) M% f3 T/ s$ I4 _1 A/ v; B9 U
    xor     ax,ax
' T- O' X7 C6 _1 a0 s$ X& U6 [    mov     es,ax! u4 w( e9 `. a& h1 w- ~& ]
    mov     bx, cs: V  p9 o8 v+ t5 ~: _8 M
    lea     dx, int41handler, a2 z1 p+ ~% V' r8 z' W/ w! g
    xchg    dx, es:[41h*4]1 V4 H2 ?2 c* L! Q5 Y  H# s) p
    xchg    bx, es:[41h*4+2]6 D, e" E1 G$ W3 S# W5 Y6 j
    in      al, 40h& e# o% L9 ^+ s/ z! i( a
    xor     cx,cx
5 m8 {9 q& Z3 B    int     41h
6 K& @# \+ n9 O1 U, t    xchg    dx, es:[41h*4]6 B* V% M+ M+ |+ m/ Z
    xchg    bx, es:[41h*4+2]
) V- m( R9 B' x. _    cmp     cl,al
" m! T' Z8 G0 T0 h' f    jnz     SoftICE_detected4 w/ O+ g' W$ n3 d+ H& u& I
& \2 r$ v0 \; b0 U& r
_________________________________________________________________________: ]! e; V) T( ^$ L8 ^9 K

7 Y' h, K$ \; o" f9 ]1 QMethod 078 f* K3 k" v$ H( S9 h2 z* L
=========. [3 l+ ?1 ~2 F2 [: ^

1 W/ v  ~  N) @% f0 n* [5 AMethod of detection of the WinICE handler in the int68h (V86)4 @! s7 Q( p) i8 D' F7 U& E- g

' j# Y1 Q8 J6 [8 c2 B# ]    mov     ah,43h
/ H  [  m& C8 N5 m6 ]4 Y& H    int     68h. [, ?( d9 s& O2 L* s- z7 k6 ^
    cmp     ax,0F386h  N* {# ^/ R: B* U
    jz      SoftICE_Detected
5 h. b/ S! D1 m9 h2 P: g+ s
" @4 m  Y2 k* l$ I9 P+ E7 e$ q  m; m
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit+ J+ o) w& H% N/ y
   app like this:" W3 h& O: }& V* }; m

: {8 o5 f; j' t" s   BPX exec_int if ax==680 N" ?8 D- X$ [4 J
   (function called is located at byte ptr [ebp+1Dh] and client eip is/ s+ `6 K4 u) n+ k% p
   located at [ebp+48h] for 32Bit apps)
# O" U. ?, ^# r. e9 ]  u6 n; |# |__________________________________________________________________________
+ }! s+ o! @7 @9 A" s+ g( I* D# H/ q' Q+ A; r# T# R

/ U; H4 R0 c0 y% _; }! |Method 08
5 e" \& N1 p$ _, W" c4 i6 M=========* e, W/ B" g1 d  O1 a
  i- ?( u. u' h+ L* I% {
It is not a method of detection of SoftICE but a possibility to crash the
" h* l5 B" E3 \6 esystem by intercepting int 01h and int 03h and redirecting them to another$ t: B4 J) V9 Y/ p! r
routine.
. A, ?, {" D$ G1 BIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points- K. j1 L0 v3 ~: E7 i( i
to the new routine to execute (hangs computer...)
2 m9 j3 k  M/ J8 P, c: y
! Y" [: F3 i* C3 N    mov     ah, 25h/ d% ^* [8 g- s! k
    mov     al, Int_Number (01h or 03h)
8 a3 {5 I' ?* U$ S0 j' v+ o1 h/ R    mov     dx, offset New_Int_Routine
3 u/ c7 j3 _( B# s  M* Z    int     21h
6 z' _- k" @, ^* j1 ~1 L) C) ]
& {2 u, Q3 C1 [! F& {+ h__________________________________________________________________________
: |" G: M) n8 y) @6 i; t) X% X+ Q6 c. o; @- }. f2 I1 ^' S- q0 D5 N
Method 097 q' J6 q' a9 m: E+ q5 S
=========
# v/ ^4 H% u3 `3 H/ t# V8 a- W; t$ R5 l( h0 |2 m% U
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
( D7 u  H, w9 r2 P) zperformed in ring0 (VxD or a ring3 app using the VxdCall)./ B  Q3 g* Q3 q# B& r+ x0 n
The Get_DDB service is used to determine whether or not a VxD is installed% \0 p$ X: Y* N3 f, S9 F) S
for the specified device and returns a Device Description Block (in ecx) for. ^7 J0 t9 y' \/ G# {  y
that device if it is installed.
1 C/ L' [6 O8 s3 W+ C1 n& ^8 F- M" Q8 P4 ]
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID1 H- P: D# x0 n( w2 X
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
6 l1 {2 `( R# b! {8 i   VMMCall Get_DDB
; n1 ~' @- N/ X: O( U; L" N0 R3 s   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
9 X0 p  q9 [- J* U$ R! O2 _$ R' L0 ^% B4 G8 G7 |- k8 c# P
Note as well that you can easily detect this method with SoftICE:$ ^  s5 w/ `3 Z" L) P
   bpx Get_DDB if ax==0202 || ax==7a5fh
% ~' W6 @( I6 f9 g" F& x" O" j* s2 l2 D1 d9 ]- ?8 s
__________________________________________________________________________0 L4 X( `. D9 r5 u% L" N. ]2 k4 ^- K) T7 c

: u3 P+ p! y2 [Method 104 i9 H/ [7 b; {
=========5 K, l; m/ @: z! O, w9 N/ w
5 u6 [6 z6 E5 K2 G
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with+ ]6 _3 v, W8 {! b  \. g
  SoftICE while the option is enable!!
3 J7 D& F: R- Y* S1 W; v* V7 c7 Z2 |/ _. w  A
This trick is very efficient:
: L* ^" ^. @- w% x; Vby checking the Debug Registers, you can detect if SoftICE is loaded  \4 M" ], _- }! p( i: S6 v
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if0 K4 Z( a+ w7 s
there are some memory breakpoints set (dr0 to dr3) simply by reading their3 E/ }  ^4 o. ~/ d# j
value (in ring0 only). Values can be manipulated and or changed as well4 R6 w" l  h- N2 X9 e
(clearing BPMs for instance)3 ?; v4 P0 k- q/ P$ p: V; R: F  o
7 Q0 h: o4 ]  F1 u2 D
__________________________________________________________________________+ V0 c- I  ?% J; N- p% J1 `

+ n, g* ^0 G8 ~; e/ ^8 lMethod 11! D( h8 O0 ~6 S0 \3 E
=========
* s2 N+ r( ^, B6 W, @1 C$ E9 t  s3 V  g9 s3 ]! N1 @
This method is most known as 'MeltICE' because it has been freely distributed
9 M" k8 V7 z7 u4 Jvia www.winfiles.com. However it was first used by NuMega people to allow/ X) v  Z# }) ^/ ^
Symbol Loader to check if SoftICE was active or not (the code is located
; U% o9 I) u3 ^1 minside nmtrans.dll).
* l1 }! B2 @8 D- `) p
6 |8 f/ Z8 r8 @. W! o) B  m# I  H7 {The way it works is very simple:
  q9 [3 i( c! q; ?' N) qIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for+ n0 g6 h& e/ q) p& r+ U1 B
WinNT) with the CreateFileA API.
. C9 i1 o* {" S" J( }
- T8 G1 b$ B) l( e- g, \6 CHere is a sample (checking for 'SICE'):
% S  M6 v3 O$ d, H7 ~- y2 |$ i3 X5 m8 e3 ?* M* O9 _
BOOL IsSoftIce95Loaded()
7 q& j% }7 V8 f. N0 O6 F5 Z{! t' k8 \1 f( c( ~& J5 c
   HANDLE hFile;  % L# b4 j& K, j) f0 H
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,! [, H& S5 q3 l7 B) p2 G3 C
                      FILE_SHARE_READ | FILE_SHARE_WRITE,# T7 {$ c( ^; \. I& S7 W! T9 H
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);& N7 c+ F$ `# n) X$ K
   if( hFile != INVALID_HANDLE_VALUE )2 Z+ X7 {  V% l0 Q
   {8 B; `, m! C  h
      CloseHandle(hFile);
; W8 G) P4 f4 n' M! t  \      return TRUE;
) T# |' ~" f4 Q- I- A% K   }! {: O# d) {4 v( Y
   return FALSE;
5 W3 L! {9 c! U$ D' E}
+ Q' o9 ^/ a# B, r5 n2 f
2 _5 e/ y5 j" p3 T- F0 `! `; RAlthough this trick calls the CreateFileA function, don't even expect to be
3 M. O2 [$ \' `' W( `able to intercept it by installing a IFS hook: it will not work, no way!
. S/ e8 y% Y+ Z, A  ]8 n/ wIn fact, after the call to CreateFileA it will get through VWIN32 0x001F/ R1 ^8 q2 \9 v2 l- A  j  q
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)( J. u" R+ O0 r) n# y/ A9 C
and then browse the DDB list until it find the VxD and its DDB_Control_Proc& _" J: h& [' s/ B# K8 M( S7 D
field.( V, {  `; R1 p7 U: b
In fact, its purpose is not to load/unload VxDs but only to send a
7 e- R8 J4 N  v7 l- G6 nW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
8 \7 u. y  w  q$ J  |: F) V8 X6 o& Kto the VxD Control_Dispatch proc (how the hell a shareware soft could try2 {- Q! t1 b- l7 ]) j7 ?  x3 G
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
3 O  ~* k0 k( aIf the VxD is loaded, it will always clear eax and the Carry flag to allow+ [) d2 p) |# G0 A
its handle to be opened and then, will be detected.
) I" x3 N9 Z+ W0 BYou can check that simply by hooking Winice.exe control proc entry point6 U4 C9 O5 x2 \* M1 x& c3 g
while running MeltICE.
. F, E9 g) r' K# H. X" @8 S6 I
, R2 |! V+ A! I  A. {0 G: ~) a! E2 B5 u. ]1 f
  00401067:  push      00402025    ; \\.\SICE
9 O. U0 I: @4 n9 p, B3 r# k  0040106C:  call      CreateFileA
0 W3 S' r4 X- E4 I  00401071:  cmp       eax,-001! ^- b% F/ x0 ~4 S) k6 B9 g
  00401074:  je        00401091
7 Z' u' k" G+ S$ u1 {% @4 k! T, ^/ A

/ D, c* ~8 i& E/ J! H9 [4 fThere could be hundreds of BPX you could use to detect this trick.  Y; C; \( S0 R* z9 M8 i
-The most classical one is:
  S+ D5 d0 Y8 L: f0 i( A4 \! h; N  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
6 N0 [: h; `, P+ t' |" r    *(esp-&gt;4+4)=='NTIC'* F  N9 T7 Q2 i4 w) t1 ^0 }8 s4 F% t

* m+ j  y" }# K1 z-The most exotic ones (could be very slooooow :-(
# b7 Z9 |2 |, P! h% g" Q  U   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
& k. z5 A% D+ U0 G; ]1 V! E     ;will break 3 times :-(
4 [, W& R" Q* @- {5 W( J, _& r( V1 y
-or (a bit) faster: ) W* L4 ]; l+ `1 ~# ?
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')' N8 m7 }8 s+ U- M! p, J! N% N

$ q: P7 Q% p5 V4 _. p0 W9 H' s: `   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  1 ?* {7 {9 ^7 [1 Q7 v
     ;will break 3 times :-(
: ?( f+ g* j. k! l  E# u! \7 N3 r, j; }0 I+ m4 c: `4 R
-Much faster:
+ b7 t& z2 E6 Y0 u   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
* `3 j' a% z: N2 I9 Z# W- d
- d0 _- S* z$ s( c0 I% ?0 A1 ^Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
2 d5 p# b2 Z  p% M: c+ ufunction to do the same job:  _; v- n, |; r. r) v9 N
2 g4 ~/ D+ y1 V
   push    00                        ; OF_READ
7 Q2 P8 \& l# n& j   mov     eax,[00656634]            ; '\\.\SICE',04 m1 W% h# B! C8 D0 ]
   push    eax
# H& T6 I. @6 P: q6 c1 P, W   call    KERNEL32!_lopen
( {6 y. O2 L5 I: g( i   inc     eax+ Z' C1 {; B/ R2 |$ J  a" k
   jnz     00650589                  ; detected% z0 d5 u" Y% @- j+ k
   push    00                        ; OF_READ
' A! _* |5 h$ L   mov     eax,[00656638]            ; '\\.\SICE'7 z4 r) j; n' i
   push    eax  D  T% k! y. H" U& _
   call    KERNEL32!_lopen
$ z& q# g" Q+ {# r$ F$ F   inc     eax
6 G' g2 K8 I5 _& q5 E- i   jz      006505ae                  ; not detected
7 s) N8 @! I- b/ ]
; C3 b: y( {$ a4 j  H
# T7 h1 n9 ^6 _9 ?: N( b2 n__________________________________________________________________________
3 s, e5 L  p. _+ [' {9 N% h( z2 }9 X0 K4 P3 H, i
Method 12, Z5 z& W% b3 F( t( C
=========$ w1 M; Q" o$ Y; |; H% S. N) F

% H- _2 Y/ D) L2 ~This trick is similar to int41h/4fh Debugger installation check (code 05/ G. \1 ^9 C3 Q* _/ ]) i
&amp; 06) but very limited because it's only available for Win95/98 (not NT)/ ^# @( G( ?- n. k+ {- q
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.& g$ w, U" S1 J
4 H' ^; Y) b5 J) F- b# W
   push  0000004fh         ; function 4fh
6 I+ f7 u) l0 G/ u6 m9 x   push  002a002ah         ; high word specifies which VxD (VWIN32)% P) L* O$ }! D2 u# x
                           ; low word specifies which service2 s, Q4 v2 R9 O( X9 P; }
                             (VWIN32_Int41Dispatch)
1 K/ L- O6 t4 w. D3 p' b   call  Kernel32!ORD_001  ; VxdCall
* L) o. K( |8 d0 A# l) o4 O   cmp   ax, 0f386h        ; magic number returned by system debuggers
# A- e) I) t( M( ~   jz    SoftICE_detected
9 Y5 z5 ]; x) t2 s
: S: D* A+ u0 {! V- O2 JHere again, several ways to detect it:; M8 Z0 [8 X* X

, p; `1 _. O& d8 C5 H: t    BPINT 41 if ax==4f
" O. U2 q: L8 I4 [/ Q  Y7 G+ }& I8 S1 i
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one5 {- k, K$ f) `1 s3 _1 z

1 I# P& T" Z- E9 \& J- Z    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A/ t2 L6 }* P) h  Y1 p. A7 w* ]
7 U: y& ?/ E7 B# H( D0 J
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
7 N, ^4 E: l) @9 k  F6 l+ n: C8 j! U2 d
__________________________________________________________________________
5 D1 L- Q; E6 D) R. ]8 B2 K
# U9 g9 M6 O9 @4 L$ f. \Method 13
6 ^' K% f! w. a- z& H2 x, N=========  n0 \  w/ y/ w0 W0 b" T( q! q( U

1 S. q( L, _9 j9 n8 n* wNot a real method of detection, but a good way to know if SoftICE is
6 U8 P8 H6 n& [; L9 t. Kinstalled on a computer and to locate its installation directory.
( y' t9 s! y! A+ t5 PIt is used by few softs which access the following registry keys (usually #2) :# |# F$ A1 x: A* c

' q0 `! B1 K, \, s# k! D/ C; _9 k. [-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion7 V- ^" x! g3 m4 O
\Uninstall\SoftICE
, A/ p3 ?3 Q0 ^/ G- t5 J" ]3 }-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE2 b7 f- r- f0 H0 _4 M
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion# q5 z% E' T7 i; S
\App Paths\Loader32.Exe
% p" U# Z3 @# w  B5 O9 E2 G5 z" |" V% M

: v5 u/ q. h0 V7 n' a* H5 eNote that some nasty apps could then erase all files from SoftICE directory
; j4 L1 ^5 v7 a9 D(I faced that once :-(/ _4 f1 _# a& p
4 i5 r& P! Y! u% y3 ?6 H
Useful breakpoint to detect it:
1 N3 A  j6 ?- t3 l+ Y
0 T! M; n. w3 r6 a( k/ O% J0 u( F& X     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'( |# H" i5 m) Z( e& T9 ^6 M/ r' n3 h- [
; i0 \7 h/ I1 r" y5 l5 }
__________________________________________________________________________  D9 b3 v. o) B4 q/ f
3 R% S) ?* H# T" [) O% z' l* p

  I3 g! G" m. [Method 14 ' ]4 M2 d6 C) V; x% j; L1 a: U+ |9 u
=========8 V$ Y0 H0 R) S! \# t
* v; ~3 _. F' X) J2 e
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
6 Z; p: S: d4 P: Wis to determines whether a debugger is running on your system (ring0 only).
4 ?: y4 l# @7 D2 D- h7 D2 E. \- f" ]; [1 i- H- n4 v' ]; F
   VMMCall Test_Debug_Installed( B3 ]* |9 Z: i8 l$ c' G9 G
   je      not_installed
1 s3 y9 U  H- u. T
5 ~* M9 s- [& HThis service just checks a flag.7 V2 Q+ T0 ?2 @1 H9 H
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-7-23 10:31

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表