找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>$ F, r- T' v. @; k" Z
<TBODY>" g9 y/ s8 W; Q0 x8 O* q9 \
<TR>: P/ A, P# H, L! U3 b  F
<TD><PRE>Method 01 . R6 a3 P6 F0 o3 Q
=========
8 {: ~: I$ d! l3 I1 S: C
( `( {6 C- {( ]4 UThis method of detection of SoftICE (as well as the following one) is
( B4 L, w2 Q, j/ d$ X/ ^used by the majority of packers/encryptors found on Internet.
% C% C6 K% u( K" a% D5 a% u. k& BIt seeks the signature of BoundsChecker in SoftICE
0 n* L; y& D$ e$ {1 c7 ?2 d& _% l
    mov     ebp, 04243484Bh        ; 'BCHK'
& R: X' l- U$ f- i% X4 i  T6 o    mov     ax, 04h
8 F- h% ^% n0 Q, G/ o- M    int     3      
0 f: R* f( Q2 s1 R$ E    cmp     al,4; h" D# e4 O( C8 s- v* w
    jnz     SoftICE_Detected2 u! y! n6 K1 E" t; Q( E- T" ~
( K2 R4 m  c( ]! _
___________________________________________________________________________, C9 E# Y8 y0 m0 j9 _
  R4 K/ y( ^3 {: ?# T" H
Method 02
2 W- L# H  g! d2 R=========& h. ], `+ ^' `" L7 o1 m3 g" `2 E

( d; ^; q3 n0 e# |$ E4 R. YStill a method very much used (perhaps the most frequent one).  It is used9 E4 g3 I) i: x& M
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,  ^/ A$ n. `" F
or execute SoftICE commands...# C* m+ s# r3 ]: u9 L% u2 v8 N9 }
It is also used to crash SoftICE and to force it to execute any commands
) m% w- O( K& U- q$ C: E(HBOOT...) :-((  3 A4 S! C/ ^, h; _  ?
" f2 r4 |! X2 ]; I  z! ^
Here is a quick description:
, P) h0 [' a2 d& a; ~8 ]0 i-AX = 0910h   (Display string in SIce windows)
5 W$ e+ F  [: j8 J-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)3 Y! n5 ~$ `8 u5 H
-AX = 0912h   (Get breakpoint infos)
# r% r: @1 i. d! P  D" s-AX = 0913h   (Set Sice breakpoints)9 }0 |/ E: V' Q) K
-AX = 0914h   (Remove SIce breakoints)9 g% A9 d+ g5 D+ K- [( [9 |5 D; a

9 q) V* x$ \) J/ k, QEach time you'll meet this trick, you'll see:
$ A9 y1 M3 _$ f, R' a9 R-SI = 4647h
* X7 ^* W. x/ R) m; l( M. ^-DI = 4A4Dh7 z. s# M5 ~3 f4 ?7 `
Which are the 'magic values' used by SoftIce.: x3 y7 r: C. E3 c7 H
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
9 S! m! d6 I( B; h2 W- m" Q- N- h: H0 M) c- a) t8 ^' X) _+ s
Here is one example from the file "Haspinst.exe" which is the dongle HASP2 o. H$ P% l2 O% o
Envelope utility use to protect DOS applications:
  ]; @9 ?; \& G  |  q4 }5 y. g. d- {7 s8 A5 f! l
. e- M# Q7 m- `( D+ t7 X
4C19:0095   MOV    AX,0911  ; execute command.4 e+ J+ m% F& f& T' \# {9 a+ \4 ?
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
. T* r/ ]. ]0 c$ I5 c7 a4C19:009A   MOV    SI,4647  ; 1st magic value.7 x  X. Y) ]! A7 }) K+ \3 I
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.+ m5 ?" T  }/ L$ m8 Q7 J* ~  {
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)( z/ g' w( d- R+ J6 }
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
5 O5 L$ U! [  g; }6 a& w3 L3 _4C19:00A4   INC    CX
8 l; T; m* x" x9 O% P9 O4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute& `' }/ x! ?4 v1 N& e0 _
4C19:00A8   JB     0095     ; 6 different commands.6 u4 g* m& W  F) S
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
/ C( A4 J5 G" \# f, P' ]  }4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
- Q* G* T; g# ~' m1 N) Q2 T' U
The program will execute 6 different SIce commands located at ds:dx, which5 n5 Z  }1 H# M. M, {3 R
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
, r& t) o+ c. ]' f) R8 U- f; b! m/ f( H
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
; H- C7 N! V  \0 y' Z___________________________________________________________________________
. O  J: C9 ?# {  i$ i
9 F. `  u" z: l/ Y& }% r
! u! w3 i. \. c5 g9 W- C& a  RMethod 03
/ A: ~% W/ U' _2 E% R! E=========$ e7 ]( v( ^8 M( G0 M

% S# s$ Y# {! t& o7 R. TLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
1 _6 T5 l1 i# r. @: }(API Get entry point)
; F% }% J0 j: {; t2 V* p        
7 _1 F" N9 t! O3 d- J6 U
) H7 c. F5 @! I% |% ~    xor     di,di
4 O8 k7 \9 t" Z  o9 Z" Z5 z    mov     es,di& h' S4 A! G5 I" ^
    mov     ax, 1684h      
2 Z6 M! N' E  N! v+ q# o: l  C  n    mov     bx, 0202h       ; VxD ID of winice3 @$ M) M6 N& p
    int     2Fh* u( c" u9 g9 {" C8 \! k7 p
    mov     ax, es          ; ES:DI -&gt; VxD API entry point4 o* p. ?" K& N; Q# h
    add     ax, di/ D; n; j' Z% _  I
    test    ax,ax
: x0 i$ ^2 k8 Z) y    jnz     SoftICE_Detected
, V8 d) q3 N! E1 g  n- \. Q0 a# t. E7 j: z
___________________________________________________________________________
. n6 n- T% v7 n) h/ Q- \2 O% s. X- S) P8 u) j
Method 04
- `# t5 \) i, s5 B" }  r; Q=========
1 a3 Q, N' o' l$ J5 g7 B7 K: o; P, D' A' m% s
Method identical to the preceding one except that it seeks the ID of SoftICE
6 f/ C; F5 b7 A" i- W+ GGFX VxD.
- f; \; x6 |8 M# q0 T9 m& Q! u( J% f/ r7 F9 u# |; {% u) F
    xor     di,di* N: @+ i$ |: y0 k# l) ^- t4 {
    mov     es,di& e' g$ D4 e1 l
    mov     ax, 1684h       & j( {3 b- W$ F6 g4 `$ d# v& V
    mov     bx, 7a5Fh       ; VxD ID of SIWVID! t% W+ b. C3 z* B2 L! f
    int     2fh- f3 i* C! l3 U! t$ N6 z
    mov     ax, es          ; ES:DI -&gt; VxD API entry point" u0 Y& t' E0 D8 I( x
    add     ax, di+ C6 s$ G/ S- {) W% _0 G: Q% _
    test    ax,ax9 u# k. v, h) G% \" d" }) i" x! U
    jnz     SoftICE_Detected
/ x  z, e0 m, g+ B/ m
- c- c4 `. Y" b6 M+ I__________________________________________________________________________% O( i! c% a5 P3 K! P6 s
- I: @6 ]" E4 x3 S4 m
2 Z2 }( @; F# V) m
Method 05
7 d( q9 u) O* a5 D  i=========; o5 G; X5 N" O; w2 E0 V
% R' W1 ^1 M/ Z6 E* Z5 r$ \
Method seeking the 'magic number' 0F386h returned (in ax) by all system+ `3 O+ V) I8 e0 |( N" X+ y( y
debugger. It calls the int 41h, function 4Fh.
4 B1 o& l* {+ G, }4 [There are several alternatives.  
9 j/ t; f  m$ x+ \% ~
2 J7 p% j5 g3 D. T4 aThe following one is the simplest:/ s7 V( {, A* O& A( V7 `# v

2 L, S. U; R% M. }; `$ y    mov     ax,4fh% [3 v" D* h1 _5 P$ S, V
    int     41h) b) b* c+ l. E& S' _
    cmp     ax, 0F386
) `7 A% `: Y- D    jz      SoftICE_detected0 {2 i; @( q% k; F) ~, Z

4 S+ |: `( F- G& ?( I# X$ t' p2 v3 K' f  n9 T6 S6 y( `
Next method as well as the following one are 2 examples from Stone's   t+ Q! q3 Z/ Z1 J5 \+ J" O' v) r
"stn-wid.zip" (www.cracking.net):. ~3 Q+ ^, j- \. ]

' |5 U: T- u& s2 f3 ]9 T' o    mov     bx, cs
7 @& q. m) Q5 d) H* z    lea     dx, int41handler2
( A: D6 n# N( B+ G    xchg    dx, es:[41h*4]
; M+ r2 }5 p4 }; F& A: \+ x    xchg    bx, es:[41h*4+2]
2 d4 Q9 |; e8 B$ ?6 R* |+ D    mov     ax,4fh
0 G, K* G6 {( `1 ^    int     41h) Z! A. i7 F8 Q; ~6 C8 A( R
    xchg    dx, es:[41h*4]1 W) }5 \6 l; ?# q
    xchg    bx, es:[41h*4+2]" ^) A, j* f: k; x
    cmp     ax, 0f386h- `0 w8 k" |. j8 _( t
    jz      SoftICE_detected& r+ E9 g/ @  x7 N
0 @* @) n9 S9 S/ c! m8 C/ g+ g
int41handler2 PROC* Q) L8 Y; u' z1 _2 R! T; m
    iret: S. `' F& w0 [* C9 u$ ]
int41handler2 ENDP
- {( |4 a# D9 N# n/ N( r
0 p9 O3 o- J/ h! E8 L0 P. K5 w- d6 Y2 Y
_________________________________________________________________________) u; i8 ?8 h! j
/ l. c# g' o8 \: `& D+ r& J
) b& P8 U! M; V7 R  k7 f
Method 06
4 @+ N% d* m6 q" L=========6 Y% e4 q* Q2 h+ v9 [
. ]- z) V/ C! v4 D8 A  P5 l
0 V) Q9 z; N* r, y
2nd method similar to the preceding one but more difficult to detect:
4 C: z! j( I% \: G5 w8 M5 e0 k
7 K' C) K& v( H1 V3 w: u. e) c5 P9 J4 g4 E5 a4 x
int41handler PROC
/ w' M  \: }8 y    mov     cl,al
6 v3 }9 J$ u, ]8 q1 k    iret
6 M7 ]5 @  z* u5 O2 Q9 wint41handler ENDP
% F/ s; ~  L/ R- }
4 u% }/ w7 z; P) P2 y$ i
0 G  k8 R# T! ?; r: v. O. s1 E    xor     ax,ax
% c/ P' |1 s" l- v% i    mov     es,ax
  F& _$ X- J( f( @& S: `) _9 C    mov     bx, cs
0 }" z8 D& g; J. y$ _    lea     dx, int41handler
3 ?$ h7 }0 a9 j    xchg    dx, es:[41h*4], X% u  c& I% V
    xchg    bx, es:[41h*4+2]
4 [3 a* ~& r: s% T8 E7 Y) S) `    in      al, 40h
4 o! b* r/ U) J& j0 Y/ }5 B* t    xor     cx,cx  r7 H6 t+ Q" q9 \& N
    int     41h
, O1 @2 @4 O0 O4 A( W8 B    xchg    dx, es:[41h*4]4 I/ a6 B& s- B6 t0 `8 h5 [1 \
    xchg    bx, es:[41h*4+2]  R$ ^! x, S$ W; S. B" i* p
    cmp     cl,al
: R' _, B$ \: y% R    jnz     SoftICE_detected& ]2 [' p8 X4 r4 {. O
0 J- W* L4 N2 A) C
_________________________________________________________________________
& v" q% o1 a  W1 }, {3 `7 a$ Q% h+ j- g1 {% h1 F
Method 071 a3 {3 z' b) [$ b. h+ @
=========
* K4 D; A. p- L3 W7 \6 g, c0 l# [  ^' o9 O: f8 T
Method of detection of the WinICE handler in the int68h (V86)6 J$ v2 N3 m3 T, |, r
3 h1 c7 ^4 ^$ h# @6 i0 H8 s, ~
    mov     ah,43h  ?0 x2 z# l$ F( B1 s& e6 n
    int     68h
+ X# Q8 v3 G2 K$ S2 V0 p8 u    cmp     ax,0F386h6 z/ W! `+ k& B; b! d+ R# U
    jz      SoftICE_Detected% g. O& M* o- v

! v, l- k" {% o* Q' J3 s# O( {3 a* _. ?  S+ y8 d1 x3 Q1 Z
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit  {( r) M3 {" X5 R( J
   app like this:
7 \( Z( u, k3 p7 K6 |, _+ r
: y5 \3 i- X5 s8 O. x   BPX exec_int if ax==68( g: _* o% ^& y& _
   (function called is located at byte ptr [ebp+1Dh] and client eip is
, V6 k! y9 z: y* V+ M: I4 ?  y( K   located at [ebp+48h] for 32Bit apps): a, T4 ~/ `5 p* j- q" l
__________________________________________________________________________
/ U) J; B& l4 A4 k; U& p6 d' [
, i0 t2 D! R9 I; o, a  b) p, f& s% u% Q
Method 08# d7 ?  `& I% \9 V0 Z6 u; a
=========# {7 o2 n8 |" k, E0 F
/ ?. u, N) R7 t' ]  A9 v/ A
It is not a method of detection of SoftICE but a possibility to crash the
5 `& V. Q' x# q/ z& Ssystem by intercepting int 01h and int 03h and redirecting them to another
0 ^, f8 S3 U! k( Sroutine.
0 t& G2 @! w) v( eIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points$ K- ?# A& n: i- Y( z5 o6 `: u
to the new routine to execute (hangs computer...)
1 s' ?4 Y, a$ X8 ?" T9 _7 z3 m8 ?4 @0 B1 Y# ]
    mov     ah, 25h
- v8 n# Z1 z2 y& Y( U- z    mov     al, Int_Number (01h or 03h), ]$ S. _- E! S: q4 A
    mov     dx, offset New_Int_Routine# ?' C- n0 z' {1 T% P
    int     21h
3 H" a7 V& H1 m
* M; X- F) B: N6 N2 j( K__________________________________________________________________________' M) d: W( t+ l. `  O3 w
1 E3 x4 g: e4 A: \( j
Method 093 L" n( I- P  M% ~
=========
/ I  L$ K; x1 s* F7 y
- p! e/ S3 C, LThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
6 H5 g( O& ^( B/ bperformed in ring0 (VxD or a ring3 app using the VxdCall).+ T1 [" N! c2 ?; H7 d* c
The Get_DDB service is used to determine whether or not a VxD is installed
9 ]4 I! R1 l! l: \6 o! L4 ^- K, W% r2 efor the specified device and returns a Device Description Block (in ecx) for4 z3 t# y( ?. Y- t4 z
that device if it is installed.
8 \+ g. Y4 ?4 P/ Q! L
1 x% s0 v" I! {   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
( b2 H8 O+ o+ c+ m- T5 ~   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)  _" v4 a9 j& ^5 b
   VMMCall Get_DDB' _5 _, m* N" X8 B6 ?
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed. L5 u8 }) B# k. V& x

5 V( }. K* v6 v: ]Note as well that you can easily detect this method with SoftICE:# M9 [  `2 v7 `6 v
   bpx Get_DDB if ax==0202 || ax==7a5fh+ A% `, f! O# H/ C, T# [5 q2 }

$ A; J' F5 Z% E8 b& v- _$ [__________________________________________________________________________# n+ L$ b9 W: A" M+ J) F& C' Q

5 c/ H+ T4 k3 B4 D+ k) T2 dMethod 10
4 Z" k$ l: j7 c  l, F=========0 i* k( C3 ~7 R/ r5 A$ K- D: f
3 F* S; ?$ t% X( L
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with, g3 h$ P4 s9 B/ z0 e
  SoftICE while the option is enable!!
5 s8 S+ ~7 ~( m- m/ f& `8 m# y8 q) D
This trick is very efficient:
; H' E2 |0 g- n% G1 xby checking the Debug Registers, you can detect if SoftICE is loaded4 o; x; A; W4 M* t  B- h
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if& Z' v& L0 L- c0 ]3 f* H5 J
there are some memory breakpoints set (dr0 to dr3) simply by reading their9 L+ Z# G9 Q8 c! }
value (in ring0 only). Values can be manipulated and or changed as well1 M2 v( W+ [( Y* z6 N- \* |
(clearing BPMs for instance)
; x. @" O. d2 n
) {# N7 G7 t6 o3 W- E__________________________________________________________________________1 |. i" D0 h; E5 Y4 C- o

* o  o% K" Q% W- P# A/ ?2 g; F( z1 g" ZMethod 11
* M% t* x- x# E# i3 O=========5 S# h+ \& h- M
6 Y7 A' Y, s7 }' ~
This method is most known as 'MeltICE' because it has been freely distributed+ q) W- _3 G9 v
via www.winfiles.com. However it was first used by NuMega people to allow9 p" N8 y6 l; |5 g( S( l' V0 g
Symbol Loader to check if SoftICE was active or not (the code is located
$ M6 n8 ~& }* G; |2 u$ Z. V: Pinside nmtrans.dll).
0 b/ F8 F9 r) a% u! t* @
& D! ~! k" N3 SThe way it works is very simple:
! v. @( g! X; |. B- N$ V. p9 f. rIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for8 k$ B' i% e0 j2 u) e0 ^
WinNT) with the CreateFileA API.
7 d: A: s  O, k  x, U
+ ~0 R+ Z  M# i8 d1 @4 {' CHere is a sample (checking for 'SICE'):
# H+ D3 B- X% {$ L: k6 K) \$ x
) t# ^* N9 w$ M& XBOOL IsSoftIce95Loaded()" n/ G) e2 J% }# j7 O- ?: D
{. e' N5 O. x; ]# h* C: d
   HANDLE hFile;  
( @5 X9 @1 E0 z- H   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
0 g  i; j1 b1 ?  O7 k+ ?2 N                      FILE_SHARE_READ | FILE_SHARE_WRITE,* M% m& Q/ O- ?( m- x' n& P
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);* _$ h" I0 k9 |: R7 ?* O8 Y
   if( hFile != INVALID_HANDLE_VALUE )
* t: ]; ]' M5 Q/ J$ w2 C1 _0 M/ E   {! N4 R: p- T/ C& |% [3 E
      CloseHandle(hFile);  V1 s! \: l/ X  F& A7 F( z
      return TRUE;
" p+ h" F9 @' |( L, t8 |" y   }2 a5 i/ z# a; R9 E
   return FALSE;
! I% p" s( ?: p/ I* R5 i, D}: J" Y; D( f* a( V% _  u

( s8 @5 @5 K: hAlthough this trick calls the CreateFileA function, don't even expect to be& Y7 X: a" N$ p+ @5 y
able to intercept it by installing a IFS hook: it will not work, no way!
6 [5 I. [$ ^  ?- DIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
  x" _4 B2 u  f3 K, M& bservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)# Q; j  X! G) b1 k* F2 z3 Z# m) w4 i& k
and then browse the DDB list until it find the VxD and its DDB_Control_Proc' s9 o3 W- U$ R
field.
5 Y4 H$ I: \. R7 }4 {3 m8 f" i& PIn fact, its purpose is not to load/unload VxDs but only to send a
! q9 |. v% x8 ^7 eW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)/ a# @% ~: I  [9 Z
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
' X+ @0 x, c9 l- Pto load/unload a non-dynamically loadable driver such as SoftICE ;-).
7 d' V9 s$ i; I7 C% s8 fIf the VxD is loaded, it will always clear eax and the Carry flag to allow
/ K* w/ P+ x( B0 Q/ o" Aits handle to be opened and then, will be detected.0 w# {% l8 X! q0 Z+ t0 d
You can check that simply by hooking Winice.exe control proc entry point
2 U& J: p2 K6 y9 Q. \6 K& ywhile running MeltICE.
3 b6 y  R+ w- t7 r% ^
( k* p% {! x/ h. i3 B8 C! H; f: B% z$ j7 w6 R+ `* A. q9 t" c3 ]9 V
  00401067:  push      00402025    ; \\.\SICE: D; O) Z; v/ W+ _( Y) }
  0040106C:  call      CreateFileA
9 N# r" p2 c. R1 S% U2 ^  00401071:  cmp       eax,-001' j& `' \0 C5 F, P! k
  00401074:  je        00401091$ [" s9 f4 B' `  c6 i

' V1 c; T5 o+ D% ?" s8 i3 a# i* q" m$ k. w
There could be hundreds of BPX you could use to detect this trick.% v" r- @* |1 z. m# H
-The most classical one is:
) c* D) v* J$ y  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
2 u7 ~. c9 n( i' Y+ Z    *(esp-&gt;4+4)=='NTIC'
  E/ E+ y8 v7 u1 _/ s( D- l  ^8 W" F' f/ j: b9 L& X
-The most exotic ones (could be very slooooow :-(+ y, p, f: j5 J/ }+ N7 T9 `
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
% f& _: I* e* Q, q5 n- l9 {  l  H     ;will break 3 times :-(& J% R& \9 W2 k
- m6 E9 _8 S3 {5 V7 e
-or (a bit) faster:
; ~* r; z5 E5 }3 F   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')  b0 o1 z0 k3 k* C! i9 H9 S5 }

4 y* f# u: ^: w8 l4 i0 }   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
! `, [+ j. X! w, j9 l" u% @     ;will break 3 times :-(* v8 m3 V2 U- M) |

7 C4 e4 _1 c$ {  H* `1 |4 o8 D-Much faster:
( c' A/ {$ t7 `. v8 n. u1 o, k( l   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
# Y7 P9 X6 j+ ]8 j) q9 O0 l6 {! a' Y3 b6 r8 @. s. k( P5 J
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
# O8 R/ y% p0 Xfunction to do the same job:0 h, ^# I5 Q* Q

% y2 F8 f1 E* g/ }   push    00                        ; OF_READ
% O" i9 `2 I: w3 o$ _   mov     eax,[00656634]            ; '\\.\SICE',0! i8 r/ R- n/ [  Z; b* @, u6 W8 t
   push    eax' E0 l) d& c" Z* l
   call    KERNEL32!_lopen
5 m+ Y) h! B) w! l8 I1 M3 c   inc     eax
, R# S" F+ A$ O1 U, s   jnz     00650589                  ; detected1 {! o' q6 j, f4 k
   push    00                        ; OF_READ! O. W- ~+ H2 I9 ^5 ]3 u" n
   mov     eax,[00656638]            ; '\\.\SICE'% m% n$ C1 g$ R& I9 d
   push    eax3 [9 n- Y# \1 t8 ?( k
   call    KERNEL32!_lopen$ n% c* g0 M" C$ }* u' g: c6 }- M
   inc     eax; ~3 `! F) G6 a* `
   jz      006505ae                  ; not detected
$ s7 ^: t. \. ~5 h, }9 _
, I1 G8 Z7 K1 r8 l3 n% b% X. o7 e1 G5 q+ a/ |" X
__________________________________________________________________________
* b+ f. Q/ j; s* q% A0 x5 o% Z( l% t# C
Method 12. k9 Q" L) _* L7 j- C# Z3 \
=========
* A9 A% t" M5 _. K
  s# H' N$ r) P  z0 q# c+ |This trick is similar to int41h/4fh Debugger installation check (code 05: X; R: |* s7 t
&amp; 06) but very limited because it's only available for Win95/98 (not NT)0 R' B4 k8 P, x2 c
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
# d- k. S$ W( y2 L3 V" i9 n  {. m& _% }& {3 }
   push  0000004fh         ; function 4fh
  p2 M+ o+ o2 F2 F/ C3 e7 p   push  002a002ah         ; high word specifies which VxD (VWIN32)
) J3 V0 r. W" I# W/ t7 u4 m                           ; low word specifies which service/ _0 H' m; O; n9 U7 t7 n
                             (VWIN32_Int41Dispatch)
; }# g5 x, ~" z4 H( r9 o" _   call  Kernel32!ORD_001  ; VxdCall( r$ f. P; r) C
   cmp   ax, 0f386h        ; magic number returned by system debuggers
3 H2 g9 v; A7 ]1 K0 @  ]   jz    SoftICE_detected, U$ i2 Z6 R; l% x+ S1 s# _* [

" Q# M. l1 o' e9 m( YHere again, several ways to detect it:$ B. w: z: K0 j4 U# K# I

# ?9 I: C& _8 ^4 {/ W0 g8 Z    BPINT 41 if ax==4f2 [% t/ b$ G7 \" t) c8 o
9 P2 y6 Z" ]+ V! w( R/ d$ B
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one& S* G8 J" ~; S' S
9 z; S5 _( r; r7 @. d% x* E
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
7 F3 F7 F( T9 \0 }( H& q$ A8 h4 l) p/ N
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
- V1 j& q' I# w  [0 q/ a
+ l5 @& J% W! G5 Z% \5 ~  t__________________________________________________________________________
0 b! @7 g$ w; K: w# F' c# O( F1 d, f# |9 ^2 k' s
Method 139 D3 U% m0 k4 F2 c$ L# y
=========
. ?  ~6 A8 Q" |( L9 w* h  ?$ U% s. A& }1 ~. O( R# ]
Not a real method of detection, but a good way to know if SoftICE is
4 T3 O- w; X) [4 Tinstalled on a computer and to locate its installation directory.
0 z4 y1 k; V* s1 ~It is used by few softs which access the following registry keys (usually #2) :
- A. ?3 ]3 m/ m
6 n) j/ w- s& p6 O' \-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
( M( \( a/ n6 K\Uninstall\SoftICE7 @, I- F7 g/ b7 T/ l
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE* X( D$ l* e! `
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion- a( n) d- v% y+ h3 T
\App Paths\Loader32.Exe" t' T' s' ^1 a  G% |  Y! E5 Y

8 J" ?; }/ \, F( C% p' }! y/ J, B6 x; {% i$ ^0 Z+ }! D3 T9 S; }; M1 }
Note that some nasty apps could then erase all files from SoftICE directory
( E, ^- Y2 K$ y( l5 R$ p4 b9 G(I faced that once :-(6 A2 @; t; S. k6 ]: _
4 L8 T9 O" \" i. ^/ a; F
Useful breakpoint to detect it:/ _8 j, T6 }. _3 r9 Y: d
; s% l6 U6 b6 R: I
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'; p# Z* O3 }. x' r) l4 v6 d' k& g
8 B5 q% M* p9 l. H$ N/ e$ R
__________________________________________________________________________
9 S( Z& E/ j6 s1 y8 N* o6 o  x- I9 U- k( Y  m, B$ G7 Z
* s! R& Z$ F1 b  [) P
Method 14 , a$ c. Y( o) t/ @( H
=========
9 N0 w  D. ?1 @6 H+ _# v" _7 e6 t4 K. Q) y+ U% a" u
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
4 T6 a2 ^. Z& kis to determines whether a debugger is running on your system (ring0 only).) [2 S- u* a7 s$ H6 r: x- p6 d
  \$ ]/ o8 L9 J  j, e. u* V
   VMMCall Test_Debug_Installed/ r- E4 \3 L; c" Z) q' a( Y$ E
   je      not_installed/ r6 X( p6 X6 |0 x

$ |  {/ f1 K" lThis service just checks a flag.
; N1 d1 J2 I2 h3 [0 g3 ?</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-8-14 07:41

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表