About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
: P, P+ U$ i+ `$ X& n5 y1 [4 q5 |2 E<TBODY>
, \7 U- F# \6 g/ w/ f9 F$ U$ f, x<TR>
! v+ g7 d1 H- m$ }4 O. M<TD><PRE>Method 01
6 E8 Q4 a  a# L3 f, o- m0 c=========
% I, U0 i# y2 d3 D% A8 @
- z4 ]4 U4 f" T. |& A& AThis method of detection of SoftICE (as well as the following one) is
7 l( ]' A7 v5 z% Y: s; p. J8 o- g1 pused by the majority of packers/encryptors found on Internet.
3 v1 Q5 T. b; O) }6 i4 f! z: z0 W5 ^It seeks the signature of BoundsChecker in SoftICE
7 c0 A- \$ J3 m- |$ [  u9 B* R$ b9 m6 Z! k$ ~6 l' ^7 ^
    mov     ebp, 04243484Bh        ; 'BCHK'- w* p5 H7 ?, A* j9 Z4 U% z
    mov     ax, 04h
% o2 p4 y$ V3 Z1 n7 Z+ K. o+ g( P    int     3       . U& ^7 |: V3 I
    cmp     al,4% x7 K+ \0 \, c+ \8 Z9 Q
    jnz     SoftICE_Detected
, x0 u, U( A$ k6 k8 @' v( b% i# p
" \# |& \+ ]" N( X___________________________________________________________________________
' R. l7 E  V2 a3 K
$ G# l' X  a- VMethod 02
0 f* _  T+ }+ t7 {0 Z* r. C+ t=========
" T) i0 M/ y( h/ m5 O. o, f5 o
4 |, |! l  G' v* m" r- Q0 zStill a method very much used (perhaps the most frequent one).  It is used3 P; L$ {- }3 K3 E6 M
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
+ p' @2 P/ s- _4 V& por execute SoftICE commands...0 P5 K# f. |: G* M8 c  ?1 M
It is also used to crash SoftICE and to force it to execute any commands7 x+ ~; X6 h/ M% {- ?. Z- F7 \
(HBOOT...) :-((  - O" F5 w1 x- o5 _8 C2 a
( Z7 s# u: a% F; X# V7 E* t: L
Here is a quick description:3 J2 H; z% {# S' M. U( E
-AX = 0910h   (Display string in SIce windows)
: L4 v) a* X! Z: Y  `# ^8 Y4 W-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx): ^4 v3 B0 Q3 P' p# D& @" r: M
-AX = 0912h   (Get breakpoint infos)
4 {# t% ^  N5 `  }6 E' G-AX = 0913h   (Set Sice breakpoints)
7 P, {5 ]- o3 q" r6 o-AX = 0914h   (Remove SIce breakoints)
9 Y) J: g) s! }4 M8 \, ]9 c) S  q/ \; l6 w% Z
Each time you'll meet this trick, you'll see:3 o6 \6 K9 D8 I1 @( u9 I
-SI = 4647h% T( n; I- q/ p, {  g3 R
-DI = 4A4Dh& Z% k8 O6 u5 W
Which are the 'magic values' used by SoftIce.4 S# ?$ n# k3 Q4 d3 `
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
, v  Z# k8 J7 U7 {9 w
  c( Z/ P- L2 O2 L0 }, Y# [Here is one example from the file "Haspinst.exe" which is the dongle HASP
9 I! i; _  A4 V6 u/ K6 J6 jEnvelope utility use to protect DOS applications:
# Q- o) C$ `7 P
+ L- Q  @- s) k' [# V( g; L
6 r: M6 k3 @% \* y; M; b: l4C19:0095   MOV    AX,0911  ; execute command.# O- s7 u& @) r: W6 `, v
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
+ M: e# s3 I& s) B& u  o' K4C19:009A   MOV    SI,4647  ; 1st magic value.
# I; w* K; k9 |4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
1 v3 W2 \1 w& X2 Y0 @/ r4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*), z0 d  M# V  r* Y/ ^/ T# k
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
0 |  O' e; K# ^; P4C19:00A4   INC    CX
) T/ n) y5 @7 P! C% [( m4 ~5 }! e4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
2 u0 D1 `9 f3 }! Y% }4C19:00A8   JB     0095     ; 6 different commands.
% p- x8 x7 n& I& i: r9 q( h# q4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
, x1 _0 ^# d: G& Q9 ^1 w' g3 S$ c4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
. J) v* v2 T6 c8 x! v! ^. m, W! s) I# S$ B8 L) K/ V
The program will execute 6 different SIce commands located at ds:dx, which$ v0 t. o5 R* C8 E9 `$ b
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.* G- Q; A6 I/ a0 ~
7 H. q5 ^. e: s* a% |% d
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.( B) ~; \: ]5 ]; o4 F
___________________________________________________________________________
3 L7 |/ ]+ [3 `! j! ?/ X5 o% t

. F5 A2 [) B9 `1 p+ U/ kMethod 031 [+ {- k0 l3 n, O( R3 c. o
=========3 z9 d5 D7 K( T. |3 I+ F. Q$ P6 r

! T/ H( S3 H9 L+ R# BLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h+ ]" @% L) Z7 u
(API Get entry point)' `' H( ]# L  @
        
" B. W6 F  ~* X* l+ \0 R' S8 @; X4 h5 y: H; s0 }" `- @! e4 q& s
    xor     di,di
& u) V6 M6 D8 h, E( g    mov     es,di- ]( H- n: _" i; @
    mov     ax, 1684h      
6 _3 Q( q2 q$ ~6 Q* ~$ Y& D    mov     bx, 0202h       ; VxD ID of winice
1 p; g+ K, E: z& i% C7 u    int     2Fh
" B  z, c4 C  p5 |    mov     ax, es          ; ES:DI -&gt; VxD API entry point8 H! e9 I7 J( f- A1 L
    add     ax, di1 Q# G6 G- X6 A6 U
    test    ax,ax( L% b7 D% A+ o% N8 a7 r
    jnz     SoftICE_Detected/ _7 W( W8 e. @& o( b( Y
% i# i$ w# K2 f/ X- d/ }3 R
___________________________________________________________________________' h5 T4 O4 d* D, }4 N; H, l
4 P/ ^5 @1 {) E: ~! ^( [
Method 048 ~% U% G, D$ W' g: i/ _: O
=========
+ ^. b9 L0 l' m# j
/ y7 a# _" M& y& I: |Method identical to the preceding one except that it seeks the ID of SoftICE2 j" i# o5 y* }  s# }
GFX VxD.
7 _2 ^- [, y7 {4 F1 |
0 e/ F! B" }* D9 F7 n/ x3 t    xor     di,di( l: h0 x  \6 o7 s8 [' S5 n( I
    mov     es,di# k' m' w. i$ @. C" w
    mov     ax, 1684h       ' f6 M: c) J6 S9 C! i4 Q: L9 R
    mov     bx, 7a5Fh       ; VxD ID of SIWVID
: W# d0 F( L" K3 Y    int     2fh, d  d: E: a+ B; q! q, g  _
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
$ K, z6 K7 ]) y0 J; v9 c. q- ]- e    add     ax, di
  ~% H* r# G4 U" o  Y! _  c    test    ax,ax
( @+ A0 B0 F0 m) ^    jnz     SoftICE_Detected
" p. |: V0 o  U# p6 b* q3 I- H, M0 O1 y6 K* k1 H% n) u! ?
__________________________________________________________________________
, y" R8 \$ T( g& T# Z) B: _' V/ T" S- q& Y
* Y4 m8 p9 ^0 _2 Q( z
Method 05% O8 l" P  q- A; K2 J+ o
=========* m1 z" Y& j% Z" M
* q( D/ j# x9 F4 v
Method seeking the 'magic number' 0F386h returned (in ax) by all system
! ^) T2 \" `, B  U) a( E- {debugger. It calls the int 41h, function 4Fh.
1 P) l: z  V8 [1 }) e" n9 }There are several alternatives.  , M7 s9 p; X% X$ H6 q2 ~7 Q

* D8 t7 F  l0 b. ]The following one is the simplest:3 d" ]/ W2 \+ I- K9 X

9 u& R! t  T6 b# I: I    mov     ax,4fh
6 E# q* V4 [( t2 f- y6 ~1 z    int     41h8 S% P( g2 q. N8 P7 J  a
    cmp     ax, 0F386
. M% X- g" ]8 n7 Q) b    jz      SoftICE_detected
  W& O+ C9 o9 W' k3 r9 a/ y4 |' e! j$ a% N5 F% H+ a, p# K

8 O: ?: }8 S' c8 y- j, PNext method as well as the following one are 2 examples from Stone's . T/ U" ?+ Y. v: \4 `
"stn-wid.zip" (www.cracking.net):5 M$ U) N! c5 Y

$ x: H) U9 h/ J    mov     bx, cs- K2 x; c/ r0 Q: v) _
    lea     dx, int41handler2
$ g. R9 c+ e) v" n    xchg    dx, es:[41h*4]7 Y: s! a/ {2 J4 n1 t
    xchg    bx, es:[41h*4+2]
4 S9 d. y; c8 n! m0 l0 A6 q. ]1 X    mov     ax,4fh
- p- j. \0 S: @8 U/ d) b    int     41h( S- Q# x( X! }- a
    xchg    dx, es:[41h*4]0 z  D* v" I0 k6 n+ [
    xchg    bx, es:[41h*4+2]# i: ^% {7 u7 y9 a. T9 A: r! K5 v
    cmp     ax, 0f386h
1 W# u! F" D; U* a) Q  v  X    jz      SoftICE_detected
# R; @) l0 |7 D! Z& A: Q; y% F/ d5 t; q1 I
int41handler2 PROC
. M/ G2 J! V" j8 p( w    iret0 L- r+ P9 X# K5 U
int41handler2 ENDP$ F; D) o0 E, [% L3 j8 e
2 G9 }4 z! k1 G. j/ @

7 \; Y) f/ `6 N2 |8 e2 d_________________________________________________________________________7 f* @8 Z; Z: R1 ^! }) k% y8 e
5 D- l. c; k: o7 D* [5 ]
* P* A' k8 E6 z- }; t' W" [$ H
Method 06
8 c5 A. t  R& I9 Q3 Y- t=========
4 L9 A# P* `1 Y8 s9 |+ Y$ t* q; i4 ?; \+ f; x6 |, T

2 Y* G: o# Q0 c1 k! W2nd method similar to the preceding one but more difficult to detect:+ A& A7 v2 X8 |

! ]+ `/ l+ P7 F
/ O' w3 d" x6 @# Tint41handler PROC
+ Q) [; t( @+ k( t- ]    mov     cl,al/ _* o9 Q3 U! z) q: T7 L) J  {
    iret: t1 D! Q4 e# q! n' o/ D4 [& p0 f
int41handler ENDP8 N1 t' K1 B" d$ ^; u
, H2 V$ e. v* a

8 L8 `: [, z, ]2 m$ U% i- H    xor     ax,ax
* T2 l8 _! [6 F* l9 y    mov     es,ax/ Y/ \7 d1 W! S7 T$ S# S
    mov     bx, cs8 O) E+ x1 _% F/ t' c- j0 z+ }
    lea     dx, int41handler
$ @4 U* Y: D7 D' l0 k5 C& E    xchg    dx, es:[41h*4]3 m5 A; M, l* q, I/ W
    xchg    bx, es:[41h*4+2]
( V8 }5 W, {/ X/ W0 Q% l  _    in      al, 40h* }, x+ A, _& M+ ^
    xor     cx,cx4 m6 B* P9 e( u2 f! P, n
    int     41h
: w; V  w, ?) A- p3 m+ p, D* @    xchg    dx, es:[41h*4]
7 Z; g  S! |+ |% C7 T    xchg    bx, es:[41h*4+2]
; E3 s4 a7 @( n    cmp     cl,al- |  e2 @& r7 A- p& S
    jnz     SoftICE_detected
; S' s/ V& p. w
' y6 I- w3 `: y$ s+ |_________________________________________________________________________2 ?3 m( U  E3 R' _  {4 p
2 X. }- E; x9 E7 ?5 g
Method 07
6 L8 z; T  [8 J+ ?/ V2 k=========) T. `1 q* _' O  ^

$ S7 n! j' y6 M& J  A: IMethod of detection of the WinICE handler in the int68h (V86)
# j% n) i  j8 m9 E2 D* i0 U: [% m
# @- E) C, }" H5 x. }% T* E7 ~' d    mov     ah,43h: ~8 Q2 W+ K; ~( z
    int     68h" a0 v. T, N8 y" V0 A
    cmp     ax,0F386h
- O5 A9 k3 a5 A! x% Y, T    jz      SoftICE_Detected, l5 h: r/ U$ x  K, v) o' N

0 _( F3 g8 r; Z% I* z9 M9 L! ^! Z. Y7 g+ q. J9 H
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
! S& D$ `. M# I" g   app like this:* d& [: P6 M3 s3 [  p
  }. M' \* [! P9 e+ [: `# |6 C9 X
   BPX exec_int if ax==68
" o' W! z9 q1 D! Q   (function called is located at byte ptr [ebp+1Dh] and client eip is
( m1 \: c9 y! C& P3 w   located at [ebp+48h] for 32Bit apps). K% J7 n/ [5 ?" U* U
__________________________________________________________________________
6 v5 ^$ a$ I6 Y# r7 z1 n$ ?
/ {+ c3 T4 z2 \& r. z  b( N8 s0 q3 d. e' l+ D
Method 08
" U! q$ j! s9 n=========
1 b7 ^3 N# i' o% M
3 g1 j" ]* t# H7 \+ n3 ~It is not a method of detection of SoftICE but a possibility to crash the) H3 C/ a2 e4 G
system by intercepting int 01h and int 03h and redirecting them to another
, @& X/ l" ?' r) @  y) j& |routine.
6 A7 M3 |5 [+ T1 F) l) LIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points4 V3 J- u. k9 i) h
to the new routine to execute (hangs computer...)! w5 q3 K; y! G6 X
$ T* d. v" e0 R& ?5 l$ |( Z
    mov     ah, 25h" e3 h4 |2 `& |$ P. H- V
    mov     al, Int_Number (01h or 03h)* z) j' x: x! {+ C# b
    mov     dx, offset New_Int_Routine
* i8 M* x3 v' U. o8 O( j0 e2 n    int     21h
7 r2 V* M6 ]5 ~6 H8 o2 R
; d& M8 p' [; }$ ?__________________________________________________________________________# W8 J8 f( f( V
8 h, k& u& U2 B4 f; X- z) R
Method 09
' [' k: U" q4 @8 ?) f3 a4 Q=========7 r7 |* |' u# Y4 l( V' j' j3 n  P6 U

: P% A# R2 @6 S  e2 zThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
/ }* Q& d/ T6 K, |/ e* ]% {2 lperformed in ring0 (VxD or a ring3 app using the VxdCall).: P: d. [7 p5 a$ p, k) n
The Get_DDB service is used to determine whether or not a VxD is installed
3 l( O: u2 K; O; w/ N/ F$ Z+ dfor the specified device and returns a Device Description Block (in ecx) for' M% e# v, Q# _7 j
that device if it is installed." Q0 P% ~3 X/ h% ~0 X5 k+ n
0 _7 v7 a5 c2 f4 _1 e+ S. h
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID# |8 F  p- ~. ]1 l4 S( E/ G; y- c
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
7 o; B. [, m' F5 k2 y2 {$ a* C   VMMCall Get_DDB* x* X/ A# q/ N0 v- p$ I5 ]
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed' p( ~" c! \7 n* Z6 C

4 V" A# _* ^! iNote as well that you can easily detect this method with SoftICE:
) k5 V4 L# h) x2 q3 i5 C   bpx Get_DDB if ax==0202 || ax==7a5fh
$ `5 q1 ^! P6 n! `0 {) M
8 E8 o2 B) x) m+ x) P) J5 D5 C__________________________________________________________________________
, f9 m4 B) y6 i
* a3 U% A; S3 d, M% r( b: TMethod 10( k: d# t3 v1 b  L5 h% v$ ?) {$ c
=========
0 N$ i- K+ D$ c% O
* I5 ~4 b1 r+ G& A=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with) }: @, u0 n1 Z% I$ U% }7 {! }6 d
  SoftICE while the option is enable!!
( z# U7 N: S5 y. j# B% P$ \+ p; }5 e# c  `3 U5 F  E  T3 Q+ s
This trick is very efficient:2 c# k- J# O8 O3 T3 r
by checking the Debug Registers, you can detect if SoftICE is loaded
; C" I5 x4 @$ f+ `) ?(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if) z9 @4 D5 w; F5 r; a# n+ x
there are some memory breakpoints set (dr0 to dr3) simply by reading their
* s: r& M" B" L& Evalue (in ring0 only). Values can be manipulated and or changed as well2 ]: R6 ?  `/ ~* _1 K+ A
(clearing BPMs for instance)
9 d1 x0 [' M  R6 X* o' {+ ^( x, z: I  J; P: h% {4 r& v* S% K5 m2 y  w
__________________________________________________________________________  X# j1 ?8 b& t4 d/ A

: {0 ~* f0 O, M' Y2 GMethod 11# U, Q9 R6 C# `6 V  y
=========' G3 Y1 q9 b) q/ |

1 U# t4 s) N  \1 |  xThis method is most known as 'MeltICE' because it has been freely distributed, h# V5 X' u) r7 W! k0 b
via www.winfiles.com. However it was first used by NuMega people to allow4 Z+ R+ C( P0 i* D2 c1 g: I2 l
Symbol Loader to check if SoftICE was active or not (the code is located
, j3 i3 @- w  u- A3 D$ b/ i( winside nmtrans.dll).- F# ~% F' l9 P' U
" v& X3 I  ^4 g  J
The way it works is very simple:
: A  Y3 z  o" d: a9 G8 q' nIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for& k/ N$ j- ^+ G) z& z+ m. V
WinNT) with the CreateFileA API.
7 J# r* u# b) J$ x0 G
- I* _# v+ ]- i; NHere is a sample (checking for 'SICE'):, J1 J/ O) H8 C; B( }1 L

6 @: k$ w/ _1 B7 F/ i8 jBOOL IsSoftIce95Loaded(), A  a! {. f- K
{
8 R. ~, C. c/ {8 r. }: G8 s   HANDLE hFile;  3 G5 q; H" r; o2 [# w: b
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,0 t( w6 z2 l6 r) j( R8 ]' ~+ f1 j
                      FILE_SHARE_READ | FILE_SHARE_WRITE,9 {: l. Q/ \: K/ T( }
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);# h' W2 j* B: }% X3 u: s
   if( hFile != INVALID_HANDLE_VALUE )* s0 K6 s4 J' n  G0 ?: n# S
   {5 v* Q# f& ^: L3 q( x2 X
      CloseHandle(hFile);/ i1 @4 N# f  l4 d- e6 D
      return TRUE;2 a& h9 g* h+ d9 f8 ]$ V
   }
' o( ~- ^( e& z   return FALSE;+ |- W. w; v" t. l( ?! p( v
}& j: W+ S) T+ _4 i1 Z& c9 q
2 ~% [$ D. H2 m; L. d
Although this trick calls the CreateFileA function, don't even expect to be
0 L: E5 i7 [/ C& `7 B5 ^able to intercept it by installing a IFS hook: it will not work, no way!
: B8 O( A; V+ J, p+ y4 X2 {( |In fact, after the call to CreateFileA it will get through VWIN32 0x001F' T( H( u2 h. J6 I1 e" m
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
5 G7 @; v* _& B  M9 Nand then browse the DDB list until it find the VxD and its DDB_Control_Proc( Z! B# n2 @+ e) n' X
field.
) ]6 A% z' k* H& [% g+ u. `In fact, its purpose is not to load/unload VxDs but only to send a
6 ^& _! F5 H0 J9 E5 fW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
4 u/ g6 a0 H) f; }7 V4 l+ B7 Zto the VxD Control_Dispatch proc (how the hell a shareware soft could try& {1 h! T( i$ ^# |. d
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
- R& T8 _% R% jIf the VxD is loaded, it will always clear eax and the Carry flag to allow
. W0 O" K' {% l( uits handle to be opened and then, will be detected./ c3 v( R( j% z, J" R# G
You can check that simply by hooking Winice.exe control proc entry point) E) P7 z# E) b  ^* c8 G2 }# Y9 K1 ]; `
while running MeltICE.
( R7 c( |+ n$ t. b. I9 P
8 a1 e" s' D5 R4 @! S& z
; v: ^- e8 Y4 {3 ~* C  00401067:  push      00402025    ; \\.\SICE6 q8 Y& K2 U: j; y! Y  I' h" a
  0040106C:  call      CreateFileA
# `7 c  {1 {" Q) v& c  00401071:  cmp       eax,-001
" t! j/ \7 E+ c) ^  00401074:  je        00401091! d' }6 Z9 H3 B$ w4 @/ _
9 @' o7 k( M: ]2 \

1 H& I# b/ g' e  d: XThere could be hundreds of BPX you could use to detect this trick.4 l5 |( i1 F: c, F
-The most classical one is:
. B3 F8 s6 ~* }* }  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
% v. Q6 k. D8 i/ `5 d    *(esp-&gt;4+4)=='NTIC'
3 M+ }: X  i* [5 _8 i
% U; Q, \' a0 `: y  L  a& w-The most exotic ones (could be very slooooow :-() D  t. d" ?$ R2 t: t4 G
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  1 c- y$ `6 o8 C8 _
     ;will break 3 times :-(
" N8 Z8 e4 S9 t' U- \' Y0 h0 _& |% ?) \' N$ }! o- j5 n6 u8 s" R
-or (a bit) faster: 3 y& `, }/ j+ K' h' P  }* `
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
& X2 Q9 [8 m9 J  X. \
6 f$ x; L7 G! y0 P( S* Y/ ]6 t6 N) D; E   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
' N2 k' P! h' L: T2 i8 U     ;will break 3 times :-(3 Q( v* ~9 g1 ?3 G# {

6 ^: P, G: j2 C' Q$ V- g' N5 Q-Much faster:
7 F1 T* P6 G2 k& K' l   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
6 h" C0 h$ `- k: q2 V
) l: \" c4 Y# d4 _& b+ @* H# INote also that some programs (like AZPR3.00) use de old 16-bit _lopen$ _$ W2 g) v# u  O" e8 ^
function to do the same job:" I1 G  O' t/ ?0 I+ ?% |8 M0 }
' K' d# \% A$ p5 \) J/ S& h
   push    00                        ; OF_READ
; Y" M( `$ H5 j* [   mov     eax,[00656634]            ; '\\.\SICE',0
! g) \, F/ |) Z7 Q7 T$ X   push    eax
& C3 ^' e3 ?: I3 n; p/ x   call    KERNEL32!_lopen
0 M, ?# W! e- W4 W, U5 C4 A   inc     eax
. ~$ P% n0 X5 Z4 A! H6 W0 N, a   jnz     00650589                  ; detected
. Z8 O, y' t* B: B3 D1 ?9 c   push    00                        ; OF_READ
# K/ \" N" K: u- P9 e) ?/ c% d9 L   mov     eax,[00656638]            ; '\\.\SICE'5 i5 }7 J5 J. y' k% S& t
   push    eax
/ B- l4 L8 B, J1 C* i$ |; }6 D   call    KERNEL32!_lopen6 X2 }) a* j9 L! h" _) u& {
   inc     eax
0 h5 `2 h% O6 F( R* Z! h   jz      006505ae                  ; not detected
6 ]4 B/ F8 e" e3 p1 W4 n- _2 I- B- t3 g% w. S, M* U: p
9 R& |7 e$ Q! X
__________________________________________________________________________
3 I' R8 M0 v: F) @( N  Q( F8 H% I7 e
Method 12
7 Z0 L+ Z% p9 h: |6 h=========) J* I* x& }5 ^0 h

, o# `: c# V: ?3 c1 p6 \) w# p, pThis trick is similar to int41h/4fh Debugger installation check (code 05
1 l( G" t# y9 \" N- y&amp; 06) but very limited because it's only available for Win95/98 (not NT)% H* t3 l: a( a8 R
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
. s+ K" F9 N7 B; o8 x
- g$ H) {5 ^+ F" E3 ?& D, }   push  0000004fh         ; function 4fh2 ^! N+ r1 M0 V1 i
   push  002a002ah         ; high word specifies which VxD (VWIN32)
6 K7 I. X0 c$ _9 |8 U) z7 b& A% v; U                           ; low word specifies which service
8 z- R: n* _; N1 \! q- x: N+ [                             (VWIN32_Int41Dispatch)9 |, a) F  F$ c% T, I
   call  Kernel32!ORD_001  ; VxdCall, x! d/ R5 t) t$ t) m( t5 D3 \, P, I
   cmp   ax, 0f386h        ; magic number returned by system debuggers
4 @! o0 |/ V+ B; D; X7 b) X7 `   jz    SoftICE_detected# g" c8 Z/ O! S) |) d/ w
% L4 [  G, n. V8 ]% U
Here again, several ways to detect it:
* r+ F5 T3 L7 o& @% g
$ L3 D! E4 H- F: @/ F    BPINT 41 if ax==4f7 P. p/ t3 `4 h
, C  P( w# b* u
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
1 y* I$ p0 s" L1 x
$ g: h6 [+ g) O6 U! w    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
# Q0 w$ i, ~4 c8 U
! E. q  |# D, V# q. d, `& W    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!$ X, y' B+ l/ \7 U
8 q  K) E% i' k* e/ h& C- z
__________________________________________________________________________8 t3 c! D: g6 y3 n3 W
2 X% c, `" ^+ b) y; f' n9 m* h$ {
Method 13
) u- P/ m9 _+ @* G  W) c0 S=========
& B2 ^+ ~9 B2 ~' t8 g/ R/ t0 S0 L0 X) Z  n% t7 S
Not a real method of detection, but a good way to know if SoftICE is% w" \  ?% I* r
installed on a computer and to locate its installation directory.
: H' }/ ^# c- @2 C+ A, J' y) {8 CIt is used by few softs which access the following registry keys (usually #2) :. ~5 C) N2 Q5 }' M* E+ j/ @
/ H( [; g( j4 }3 t  f9 }
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion! a# Q! X2 \8 R+ p0 B
\Uninstall\SoftICE
( R1 K  k9 p) ~, W-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
# i5 B6 B+ w) H0 u; \-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
9 H+ D* }2 D/ s1 k5 W9 \5 g\App Paths\Loader32.Exe
8 p! j  w- t( o7 L5 y! ]
" r9 N7 f( ^6 q8 r% P/ W3 U5 R
8 n6 E& `: w. e5 n! u7 xNote that some nasty apps could then erase all files from SoftICE directory
- O" C1 b3 \0 O5 d3 [4 U" _(I faced that once :-(
9 Q3 y) i# C8 K! w5 C" \5 l9 i  X/ {& y4 s
Useful breakpoint to detect it:  T! P- o/ r4 ]7 m2 e# `9 L
, @# b8 Y6 H+ }) E* n. D4 w
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'5 ?/ o: @2 b& @

5 ]$ ^) ]; U7 z7 n: e; X3 u__________________________________________________________________________1 r; A3 ?4 K7 P* o* d/ O- b! N
& T- y: N. [3 |7 E6 \

+ D5 O5 O* E  s. w9 V' ?Method 14 # K8 H; s( }. W
=========( ?# r# F. n% w
9 `: l9 y: _) M: h( a& d6 Q4 p
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
# P$ M/ H' a  Vis to determines whether a debugger is running on your system (ring0 only).
% U& k( P! o9 _) l/ c# ]( |3 W4 ^  {6 N  {5 M! |/ ]+ X% v/ m
   VMMCall Test_Debug_Installed$ o" G+ B3 ~' S' P
   je      not_installed
3 F4 a) u3 f, T! t, p$ X/ b
; H# E+ F' x# D( zThis service just checks a flag.
) Q# K* W" K1 Y0 q</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部