About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
3 r. {1 I0 p; D<TBODY>3 J' R/ p: `8 C7 f8 Y; |
<TR>9 V5 `2 ^( y  F! B( r0 ?
<TD><PRE>Method 01
1 M! _$ N! b" a=========
( C( f" B2 [( b$ o  \1 F3 O- }7 b
This method of detection of SoftICE (as well as the following one) is
! @- I. t+ e( R. i3 K$ ~used by the majority of packers/encryptors found on Internet.
. Z! T7 C# i9 ]! X: N/ K. DIt seeks the signature of BoundsChecker in SoftICE
# F& P4 Q+ T5 Q9 u6 c1 N$ U+ Y/ i6 `
    mov     ebp, 04243484Bh        ; 'BCHK'
6 j, f: z  T7 p( n/ U3 y7 {+ S! w" Q! e    mov     ax, 04h% w& J0 s* a# ?" X5 w# B
    int     3      
& ]' s6 a9 y# d/ m5 P  T    cmp     al,4+ v+ w: a8 f0 w/ @2 N# d4 G
    jnz     SoftICE_Detected
  W' f  J+ M: |0 t1 v! `3 ?2 b, b9 s+ `4 V6 t
___________________________________________________________________________& Y# ~. z9 `+ \5 E  l

& }5 V# `; e2 w1 cMethod 023 S' e) ]. h+ e" q) x2 x/ x
=========% ?/ j" H8 I3 O* |  i& P. h' S9 n) Y- S

/ [; ^8 _& r' L8 U4 J1 XStill a method very much used (perhaps the most frequent one).  It is used
8 [) v& T: p8 a6 b1 i$ gto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
5 B5 g- `1 _( Lor execute SoftICE commands...
" m) @* `: _- u+ N" Y# z( QIt is also used to crash SoftICE and to force it to execute any commands" L, L" \; D- I0 Z2 L
(HBOOT...) :-((  8 I( J( m% g5 `: [

+ h$ M0 E) ^7 }% K# u* H1 }: WHere is a quick description:+ V& O8 @: Q. u4 p" |6 R
-AX = 0910h   (Display string in SIce windows)& H2 |0 x+ p( a0 r
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
9 U& }  n; Z% w4 L3 H! I-AX = 0912h   (Get breakpoint infos)
- N: X6 Z5 X/ ]5 K0 l) S2 z/ ?-AX = 0913h   (Set Sice breakpoints)6 ~/ _9 n0 E7 u
-AX = 0914h   (Remove SIce breakoints)
) {, |9 K9 i; @. o1 T
, Y6 S$ B* ]6 T6 i4 u2 Q( @5 ~% J% fEach time you'll meet this trick, you'll see:: U# b- _' J& t0 C' v
-SI = 4647h  P' r! N4 r1 m' _' v
-DI = 4A4Dh: f, z/ g" Q0 C4 L) n: g
Which are the 'magic values' used by SoftIce.; D/ [- Z3 V3 D5 J" x. p
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.7 A5 f- \4 _1 v( c5 T, ?

5 J5 ~/ o. ?- X! C, kHere is one example from the file "Haspinst.exe" which is the dongle HASP
* w# W% }7 v2 T! P- YEnvelope utility use to protect DOS applications:
! R/ u! V! e9 [) D0 _2 `9 n- [& [& Y- Z1 l: u  W1 V

: H  S8 w* p( Z$ G, J6 z4C19:0095   MOV    AX,0911  ; execute command.
0 h- w; |2 m% U! S4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).0 H/ i9 t& v. |+ z+ t
4C19:009A   MOV    SI,4647  ; 1st magic value.
* u6 v/ H/ g8 B  Q4C19:009D   MOV    DI,4A4D  ; 2nd magic value.3 M/ V2 e/ a% K. `+ p9 H, H1 H5 `
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
- F7 c1 ^5 `+ ~% X3 l4 N4 X4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute6 L) Y; \/ ?" b5 Q/ V
4C19:00A4   INC    CX
" ]/ @; q5 t% x: N4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
7 H4 p! K( I* ?0 o- E4C19:00A8   JB     0095     ; 6 different commands.
- R5 g6 M3 W" [2 P4C19:00AA   JMP    0002     ; Bad_Guy jmp back.( h+ Q/ M1 Y' {: s
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)* m8 c. V& ~) ^7 m( D

. j* A% N8 }/ @. j" w5 NThe program will execute 6 different SIce commands located at ds:dx, which" s1 u9 x+ q6 A6 F' B+ C& b' f
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.# t" D" |  |+ L8 Y" @# `  R

2 r3 U- H' l' s$ [  u$ G& l* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.* ?1 j1 C( E2 c7 v+ Y; y8 F3 T) x
___________________________________________________________________________0 j4 Y8 g2 b/ [* K

' [6 V! f1 o) L  P6 I
& [' U  y8 D  uMethod 03  c+ `; p4 G  y
=========
8 M8 ~3 e5 A: |# z  ]/ q* o' K. @) y. @
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
8 Q! c) B( o5 G" U% z5 c: ~; g; C! ](API Get entry point)2 Y4 Y7 Y" u8 R' A
        
+ h$ H5 k! Q6 U+ q: Y0 N
+ r" e2 Z2 x% A    xor     di,di+ I$ [# j) r+ i3 J6 d! _. C/ Y8 c/ A1 v
    mov     es,di5 [# _5 Q* L( M5 C! {
    mov     ax, 1684h      
/ C- p* z8 \2 T    mov     bx, 0202h       ; VxD ID of winice
9 D( a+ l8 I4 S& ^9 p/ z# T    int     2Fh
$ ^$ r  J8 D; b  [    mov     ax, es          ; ES:DI -&gt; VxD API entry point
' \0 B  `' J+ n# M' G1 @% }- c    add     ax, di
# u  \7 B* @2 c' S& k3 U. F+ M    test    ax,ax1 |; d' X2 k6 b# Z
    jnz     SoftICE_Detected
# ]4 ?2 ?- H5 S( o& b: Y% R! B7 y$ M6 C1 }, i, A2 L) F! i: v
___________________________________________________________________________. \# Y3 r+ t6 a' i( U  Q( p+ D

3 v% Y- a3 N) D$ ~Method 04+ ^# k; Y$ {% M: j
=========
! a0 \# _$ J* O5 k
9 k7 P* b& i7 y+ ~6 j3 @7 jMethod identical to the preceding one except that it seeks the ID of SoftICE9 A& k8 p* s/ [4 e/ H% w. H
GFX VxD.& f0 |8 e3 t- d( }; N
4 X6 a7 a4 Q& b8 J$ d  M
    xor     di,di5 C# t: G8 E# e4 a6 [
    mov     es,di
9 b3 h3 ]  u9 h6 K4 D; X8 f4 b    mov     ax, 1684h       6 O' A6 {$ Y5 N0 J# O
    mov     bx, 7a5Fh       ; VxD ID of SIWVID% k+ h) J* \* u! K. P% j0 r' }
    int     2fh7 I' N1 w, _7 L7 [
    mov     ax, es          ; ES:DI -&gt; VxD API entry point* a8 c+ E( K0 e( a* `4 w
    add     ax, di
" ~+ g/ b- V8 s    test    ax,ax$ L0 ~3 ?: ^0 i
    jnz     SoftICE_Detected6 f# D# L5 s  @' y1 Z

% Z  ^5 k; v6 }( Z__________________________________________________________________________1 F1 m" V" z, H2 o, V+ P
0 u: q8 c9 e7 B0 ?. V

- D: }3 u! f5 q! H# ?: H0 c* cMethod 05: g: O. |% j, M( O. z5 ?
=========4 y9 K$ m6 z, [9 i8 V  N

; z$ s' q) m/ g9 v- E  R% C: cMethod seeking the 'magic number' 0F386h returned (in ax) by all system
' n( {7 b7 r$ }. jdebugger. It calls the int 41h, function 4Fh.# j" a/ H) Y# v; z8 W2 ?9 [8 }
There are several alternatives.  7 L: ]7 J: v1 V8 j0 r
. Y( \9 T8 J" q5 ~% S# |9 U
The following one is the simplest:1 P# J' R% Y$ ~) h( G* b

" `$ @% }4 t$ }% m/ }    mov     ax,4fh
3 [& k- b' _# J1 h/ _4 r) ?. g    int     41h, h" Z& [' {0 ]+ }  C' I$ Y9 T, e; u
    cmp     ax, 0F386
! d/ C, o9 z" p% Y0 H3 Y    jz      SoftICE_detected0 h/ b2 q" U2 Y2 {

6 I  b9 q! W5 w, g3 v0 h  ~, J  a+ {$ W' j# w. \' s: X- J& o
Next method as well as the following one are 2 examples from Stone's
2 n) b" v' q1 {! b5 n"stn-wid.zip" (www.cracking.net):
6 R, S7 s5 I& H3 }7 K, Z
' f0 a9 M3 {7 z0 u    mov     bx, cs- A- C' D! w- w4 [/ t& u9 y7 O
    lea     dx, int41handler2$ ^+ |% W( n% w7 L  P
    xchg    dx, es:[41h*4]: D8 T# C8 l$ ]; s
    xchg    bx, es:[41h*4+2]7 L6 b$ m& R! X4 _: c
    mov     ax,4fh* J: ?1 J0 a+ Y0 |8 w7 e
    int     41h
5 |3 t; g; U3 {, x7 f- R% Q' T; a    xchg    dx, es:[41h*4]
" _+ H0 [% u: T' W$ q    xchg    bx, es:[41h*4+2]
- E1 p4 E: l% i; j3 ^' T3 O, P3 A3 f9 k    cmp     ax, 0f386h' }' W0 G% P0 q
    jz      SoftICE_detected
# t* F# n8 y1 k! a
" a; y' Z/ b' F0 ~* i$ rint41handler2 PROC  w3 g7 d0 [: r3 u
    iret
+ U1 a' ]; ?% A$ Q; _. X* h) xint41handler2 ENDP: `  x# `$ r! F- C
! K! M1 A6 H/ [0 b8 |+ X

* i8 g2 r& W% u# e4 m_________________________________________________________________________2 D5 T; P2 n  }7 P

( W  W7 P7 \1 j$ i( Z& u7 \+ v1 Z* j* y4 o/ E* e
Method 06
7 Y: j$ _2 D0 }  j=========% A# |5 p6 s- b7 c
$ ~  Z" P) I" I% z$ V. g

+ G( y# Q+ f! \/ m4 A2nd method similar to the preceding one but more difficult to detect:: H, H' G1 t7 J. b

) k+ u$ c5 \3 {- q' N2 o9 U$ i$ U
int41handler PROC
: E) t+ B) G; M! N2 c/ a. g3 h    mov     cl,al
  w0 n# H( v* Q0 g4 s3 \, C    iret2 d* [& |  c0 `. F8 f! r, F
int41handler ENDP8 b0 L1 {7 A1 ~  @

$ S- M" Q$ e1 x, a, V- F% N' k8 h$ z9 N1 |, M, T! b
    xor     ax,ax
/ O$ N  C* v8 j% w7 ]- j    mov     es,ax2 h; w: L: K& \7 K9 m
    mov     bx, cs
4 F- @6 g: i: a) f    lea     dx, int41handler0 I: k$ g: ]5 j/ v* u  D( @
    xchg    dx, es:[41h*4]% T! w5 d6 [* f. y/ G  H& G
    xchg    bx, es:[41h*4+2]) u0 D* t. M# _9 o1 ?9 U, [" L
    in      al, 40h$ M- v2 N  Y, e( ]/ K1 a' v
    xor     cx,cx
4 X/ H6 Y& G+ c! g& Z! k    int     41h
6 N) A- u: U! a2 J% q- r2 i/ c    xchg    dx, es:[41h*4]
" ~, `; F6 O( @) T& G    xchg    bx, es:[41h*4+2]
' Z3 Z5 [/ N$ x# ?4 r! i    cmp     cl,al& v- O9 j' H1 k" _2 k
    jnz     SoftICE_detected
2 o& N' a3 S* g
7 D5 Z7 ?! D- Y1 |( L$ m9 z_________________________________________________________________________
6 r: H, s$ U5 P, B* \
* O8 p9 J) b* J+ e) I! i( kMethod 07  @: Q# E8 D9 d
=========
' d& j& u$ \& {9 G  W# }
3 b3 I" N7 M4 o3 W7 \Method of detection of the WinICE handler in the int68h (V86)
6 F& \2 g* F; b& T% n% w5 b& U
% k" y. v. c8 z: p" m% h: L$ m* S  Q    mov     ah,43h
, N9 ~  u9 K2 `& z4 c% A  J    int     68h
4 Q" _; p) V/ Y/ _6 j    cmp     ax,0F386h
4 t3 z" |. v5 |. c    jz      SoftICE_Detected
6 `$ O. J, X7 {6 T( V- d7 S( u/ O+ I
: E% d8 s, M. n# L, ]
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
+ {: P% z* y2 R8 [% D. {  f7 ~   app like this:, d! W  ?1 K* J& n
( |# {. S: Z. _# T" d. P
   BPX exec_int if ax==68& D9 J* u: q/ y7 h3 H# B" a
   (function called is located at byte ptr [ebp+1Dh] and client eip is& `; K8 o( P0 o; J* T
   located at [ebp+48h] for 32Bit apps). D1 b; `! f% n, n+ U
__________________________________________________________________________
1 A; N- Q* b" X/ G  C: O9 X! p2 `/ K% Q' Y# E: g
! ^3 j& c* T! C( b5 V6 t
Method 08
! _$ M; R, P2 K! ~! C$ I=========! G8 }& }3 c( P/ J8 R, \

6 S7 e: e# v& j+ `4 ?It is not a method of detection of SoftICE but a possibility to crash the
0 v4 l* _2 K* l# X% q# Asystem by intercepting int 01h and int 03h and redirecting them to another3 X; t% I0 d' s, d( S
routine.
) _! g( E* }8 r4 S" e  z' JIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
8 V6 M, W. `0 N* e1 J! l+ Nto the new routine to execute (hangs computer...)
! _/ G. d! I! i' {4 G" U" p) P* x7 x4 G1 f
    mov     ah, 25h+ d9 z; ^- q8 m6 B1 ^  j. b
    mov     al, Int_Number (01h or 03h)  G% [2 @0 F4 |- S# F# X
    mov     dx, offset New_Int_Routine) ?) N. ^9 w) J7 W/ u: X
    int     21h
- h, r3 k/ z2 z; X
6 F! ~6 ?6 t" k; ~1 L__________________________________________________________________________
: O2 ^" W4 |- ~3 z1 R3 L( ?0 E$ p4 `" ?5 b% ~# S
Method 09, z! ?! e3 {0 k7 g( e" G4 K% t
=========
) Z) g! W' Q! c1 y% p3 D  C) {) U
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
8 J$ o% A6 ^- z" X8 H2 Hperformed in ring0 (VxD or a ring3 app using the VxdCall).
1 E, d# z) [# UThe Get_DDB service is used to determine whether or not a VxD is installed1 [+ f6 i2 M4 ]* L) U1 `! i
for the specified device and returns a Device Description Block (in ecx) for, N0 g& P: y1 r- S0 M7 @
that device if it is installed.
8 }, V) r, E7 c" z1 F! Z0 t- K' g3 X5 L
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
, {3 F# P/ x! U- ]$ W# l% ]   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
$ \& a4 A8 K' j( S   VMMCall Get_DDB* d( [. `" ?  r1 J6 w( @
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
* T+ J; z3 k0 Y! N3 S0 p: l) Q4 g$ i7 L. c" c. i$ Y1 p  U" G
Note as well that you can easily detect this method with SoftICE:  ~4 V& x: A  j/ E( R% n! z/ z1 a
   bpx Get_DDB if ax==0202 || ax==7a5fh
; @. _% h, n! }6 D! H* |
' @! V% _+ l4 ?) k9 Q__________________________________________________________________________2 F3 ]8 b6 N  w- F* o

4 d% F) A/ M# w: D: _: QMethod 104 |, l9 e  a& C5 ?  n
=========
5 h2 Y! [' \: ^& J8 |' n/ v9 P, H0 i3 a$ g; r) p+ s8 k& D
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with/ e+ }  e( U% X" U# n. ~% l
  SoftICE while the option is enable!!
# ]: o) I+ P  ^9 {* |: |! E: l- m
* s" B$ j5 S+ o' ]This trick is very efficient:
) u! c% i6 I9 q- @, h9 xby checking the Debug Registers, you can detect if SoftICE is loaded4 o- f. ?2 N. Y  ]5 m
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if- |: B1 t8 d, m, D) Z  [
there are some memory breakpoints set (dr0 to dr3) simply by reading their
1 l% S* O  Q/ Jvalue (in ring0 only). Values can be manipulated and or changed as well
5 ^" D0 J. f! J& T+ ~9 S(clearing BPMs for instance)
" }4 J; w5 M7 v% L+ B- g1 z3 v+ f7 t; G" ^+ |; `
__________________________________________________________________________( x, r2 }* b# K, r* c" b4 W
- Y3 V. |# Z+ \# X( X- R: x
Method 11. p! q/ d# H4 A/ s! B9 y
=========
$ I3 v$ O+ h5 t+ V0 T0 G" W2 Y6 w4 A, [
This method is most known as 'MeltICE' because it has been freely distributed
) @- `, I, |/ s) X  N" k7 |2 Pvia www.winfiles.com. However it was first used by NuMega people to allow) W! r# Q  A" X( |; z
Symbol Loader to check if SoftICE was active or not (the code is located# p  ^0 k, c/ g2 g
inside nmtrans.dll).1 v; A8 A+ \6 i

4 \- P  ]5 [* |5 S. {+ GThe way it works is very simple:
1 G" y) g( k4 t& E9 pIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
1 [) `" o/ D8 _: DWinNT) with the CreateFileA API.  L2 u& b' c+ W8 @0 F

: N7 ~" A/ A6 E3 O- [, YHere is a sample (checking for 'SICE'):
- P3 P4 G+ _# u6 n3 D4 U+ V  V- p4 q6 F9 o# G2 d
BOOL IsSoftIce95Loaded()
: Q9 h2 i6 u; f) r! H{
4 \, }! Q% H. e& m4 B' p' a, i   HANDLE hFile;  ( l' Z0 C: t6 Y9 h4 r
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,% l* p/ k: |  B$ N( ~2 c4 j1 \
                      FILE_SHARE_READ | FILE_SHARE_WRITE,
  S, b( B. F5 N                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
; f0 ]! R8 V0 q* |* |! ^) }3 {   if( hFile != INVALID_HANDLE_VALUE )( K- M0 g% E) o0 [9 G  M  U
   {6 u" B$ E# S7 w6 [, }. U; e
      CloseHandle(hFile);
3 z4 [! @1 O( f6 I3 `      return TRUE;$ K& C$ A% g0 s
   }
, H6 @3 I; g9 ~! b( t: W6 s. `   return FALSE;
0 ]$ U( ~9 C7 ^}4 w2 i$ h5 X2 V% \( ?: t& ~
: B- d: c+ ~$ y: a% k8 l
Although this trick calls the CreateFileA function, don't even expect to be% n" b6 d) e$ n; i. E' c7 h
able to intercept it by installing a IFS hook: it will not work, no way!: m- r9 p' K  M- v7 g
In fact, after the call to CreateFileA it will get through VWIN32 0x001F2 d; K; ?2 ]) f
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)/ n/ }& q. x" m6 x9 c* q
and then browse the DDB list until it find the VxD and its DDB_Control_Proc( `2 _: ?$ v, Z4 r" p# T% r1 U1 \* v
field.( z& b$ S4 k0 \% [
In fact, its purpose is not to load/unload VxDs but only to send a
  t5 I3 Y0 G3 g- W$ L1 ], F, n) e8 BW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)4 U& k) q- K, y2 t; y0 i
to the VxD Control_Dispatch proc (how the hell a shareware soft could try  P5 t4 ]" I/ O5 x* J: m# ?
to load/unload a non-dynamically loadable driver such as SoftICE ;-).2 ^+ \1 D( S/ m/ y0 S
If the VxD is loaded, it will always clear eax and the Carry flag to allow8 |' H! \  c/ t
its handle to be opened and then, will be detected.
8 F& j0 I) e$ ^- }& _, M& V9 ~You can check that simply by hooking Winice.exe control proc entry point
7 Z) U( V; A& H* Vwhile running MeltICE.6 M' D2 z- A, ?3 W- L2 I) d" z
1 k3 y$ \5 x" T

. P/ y8 m2 w6 }  00401067:  push      00402025    ; \\.\SICE
  d5 i6 K6 O# l7 y0 W' h( T5 s  0040106C:  call      CreateFileA& D: e, y0 @2 P
  00401071:  cmp       eax,-0018 M+ _% r3 x* y+ ]
  00401074:  je        00401091
. A  r0 `& I7 @' L7 r- b- C
% B' g* b) h. }8 o/ ?1 Q' g& q+ \; |. a) ~% J. S
There could be hundreds of BPX you could use to detect this trick.
" B5 w* U1 M8 a  j! l3 M-The most classical one is:
7 q7 Y$ u% Z0 ]; ^0 T* ]: g  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
5 ]: Q! f/ V/ n5 j  q    *(esp-&gt;4+4)=='NTIC'3 X9 _5 Y* a; R4 ~1 P/ H2 @$ L

# d2 I# R- Z2 Y7 q-The most exotic ones (could be very slooooow :-(' O( c8 a  V* O- m- q
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
  b1 N- e$ ~( z* K* {. e% Z     ;will break 3 times :-() a. y0 z# ^) y3 f
! b4 D. g9 ?# D& w! p9 A
-or (a bit) faster: ) [. }# M  |; f3 Z5 N: F
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
4 V  W5 N* u7 E4 h4 ~4 i2 r
  f# q5 L8 h  c0 r/ T   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  ; ^3 i4 {: n) {
     ;will break 3 times :-(4 [' m6 t* t  Y3 K
+ ?" W6 W% g" ]
-Much faster:# k3 _% M3 ^. |/ y% a! r9 Y( n
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
) G, M' q' j4 f% Z& e1 T
8 v0 q0 r6 N3 U6 U5 rNote also that some programs (like AZPR3.00) use de old 16-bit _lopen6 v+ F2 u/ L+ p6 A, P1 U9 D
function to do the same job:
. o4 c) D0 N4 F
$ g" r+ i9 J, d  E2 O+ r   push    00                        ; OF_READ: e& K! C6 d5 H% l
   mov     eax,[00656634]            ; '\\.\SICE',0
" T5 ?$ x& d* p: l   push    eax
+ @2 p+ m1 M- l! u; W6 }; Y   call    KERNEL32!_lopen
6 G! @0 I) n' l2 I# f   inc     eax
: v# x1 V. j3 J7 W! ]   jnz     00650589                  ; detected
0 a8 W: V4 `0 x) h   push    00                        ; OF_READ; H' |; ~& `, L3 o4 ^) ^$ q! U0 V
   mov     eax,[00656638]            ; '\\.\SICE'
6 b# z: z' m7 X: J+ y   push    eax
& c" a* P* c. |   call    KERNEL32!_lopen+ x" K7 J$ }9 q6 K
   inc     eax  I& G2 {! `( C% e: u
   jz      006505ae                  ; not detected
4 E5 t( `* ~' m% e
4 C8 T# @4 c+ m2 A
" T) J6 N, h5 Q' r$ q9 U& I9 I__________________________________________________________________________" `7 s' _' q: Y* g8 W+ y# _
5 H- ]0 [! a2 t
Method 12
2 }- G+ g# S* z& I4 h1 u=========
* X" `# e$ _* o. j8 {0 @/ |+ l2 n; G/ e  B6 a5 N" o2 S
This trick is similar to int41h/4fh Debugger installation check (code 05; r7 e' n9 g5 D/ a1 Y4 G
&amp; 06) but very limited because it's only available for Win95/98 (not NT)! O# R) p3 t" I5 ?# h9 j
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.2 B& `4 X, Q5 o' [# m: A1 d

' a. X) V) d2 H3 K   push  0000004fh         ; function 4fh9 {+ s5 s, `/ w9 ?
   push  002a002ah         ; high word specifies which VxD (VWIN32)& B7 e+ N, Q  ~
                           ; low word specifies which service3 [7 t$ |" d) l8 m
                             (VWIN32_Int41Dispatch)4 V& o* f* p/ t+ e
   call  Kernel32!ORD_001  ; VxdCall
8 _- A5 ~( C6 Z0 R3 K   cmp   ax, 0f386h        ; magic number returned by system debuggers2 k9 m1 Q+ m3 e& C6 _/ r2 g0 G
   jz    SoftICE_detected
* s# u! }- Y: X) A$ ?$ w3 J, R6 c; B; y
Here again, several ways to detect it:  Z* j) f/ t9 R( a( ^
' y8 `5 Z! G( f0 m% j- y5 N% N5 U
    BPINT 41 if ax==4f- M; \: C2 t1 ~' w( q

# q6 K, n. h4 g9 [8 b7 `# u    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
- C$ C* w9 I. G/ b8 ]6 M2 ~/ a- B+ ?" `; _$ m5 ]: a8 B
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A# {8 @. y! R/ _" \

" }& E5 [7 y* l# }/ n9 v    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!# C/ E) a) u7 }: @2 A
( T7 s# y5 T; {( E1 W
__________________________________________________________________________: ?' m" J' G( N' v6 p: X
7 ]/ {+ C$ Z3 u& }- S
Method 13
( j6 X# T6 u' j5 V=========$ V/ r" V, o# H0 A. Q$ T8 a* {5 J1 `
4 k- Y' G6 V3 n! }
Not a real method of detection, but a good way to know if SoftICE is
5 H3 P4 t' M2 Y3 A/ Xinstalled on a computer and to locate its installation directory.4 p4 l6 J/ O( y$ L. e3 O0 C% c
It is used by few softs which access the following registry keys (usually #2) :
! y) E8 N, G8 y+ {4 S$ g
# ?8 U2 g# c0 s6 ?9 p# N-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
. L0 Z& ]& Y2 Y" Z3 c: e, k\Uninstall\SoftICE
! Y; M4 ], a* w3 v2 C% o% R-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
# l/ e4 z- S: k2 x) [-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
8 u" S. U2 B( x& [5 \- T\App Paths\Loader32.Exe
2 Z' k1 Z7 G1 E. ]; h% v6 x, m5 a+ N* W, e0 n2 }
' V& V/ l% g  |- b3 n; d. ?
Note that some nasty apps could then erase all files from SoftICE directory( J& t$ H: [$ b# H9 v
(I faced that once :-(0 M! q1 [) D$ {
8 m4 Y; T# T" C) e
Useful breakpoint to detect it:
3 t4 c% j1 a5 a& u# K$ f6 j' f3 |
5 w7 s$ C  k% {5 m3 p' {     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
- p! e9 Z7 j5 L* y3 U: ?. a5 r- Y2 d$ M4 y. s2 |+ V
__________________________________________________________________________2 B% X( }. a& z3 H/ o1 f2 Z4 G

  {  U' Q3 e  W, ]# c( k
4 J' Y: v5 }2 ?9 |* GMethod 14
, b4 i5 h7 m# V: q! j' x: m=========
' Q" G! [5 o; b+ ]) j6 }! G8 M# [1 M+ b4 @
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose) ^- q6 p% {2 q, g
is to determines whether a debugger is running on your system (ring0 only).
3 N" R, q$ X# I  u9 A  ]
" ^: x: z8 Y+ N, i2 N, X   VMMCall Test_Debug_Installed
  u2 ~% b# r& ]% w0 ~$ C; I* x   je      not_installed
4 F1 ?* ~0 X& e9 M8 h: a% u9 m  V, H9 `8 S. a3 i7 F* q
This service just checks a flag.6 W' `  h5 K$ ]0 B* }* S0 `4 f
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部