About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
7 _3 Y6 @9 I. |$ W3 n& H<TBODY>
" c1 x7 {) t( z+ b. ~<TR>
* M/ s2 Z1 ^+ A- K, F. _" r<TD><PRE>Method 01
8 C7 `) N/ k4 s# ]=========5 u* A* U- H! \8 ?& N- D

5 v( |& _. D- yThis method of detection of SoftICE (as well as the following one) is
- M. v/ d/ A. lused by the majority of packers/encryptors found on Internet.! H0 T! r1 _5 m! V; L" k% `5 Y
It seeks the signature of BoundsChecker in SoftICE
8 g& u8 _" M5 O+ v0 L8 S+ P8 W7 I5 D. k- P0 \; A. f
    mov     ebp, 04243484Bh        ; 'BCHK'
; s5 o  O$ [/ T    mov     ax, 04h
0 J' Z% E! L0 L* @& @& U% I' \# v    int     3      
0 a  n+ W  |, p# N    cmp     al,4
$ G6 W: q) R" o0 O3 I2 [! c    jnz     SoftICE_Detected
7 \+ p' a  ~, J  i8 k
" v8 L" R3 m. G/ D! ]___________________________________________________________________________
0 w" {& l1 d* E; f
% s( B" ]# m! A7 @! ~# M. o" TMethod 029 y3 M# |0 M- z- D  |. P8 u3 O
=========
! F$ I8 |5 n. a) h; P, h
$ g$ [0 m" ~7 T5 D% m' u2 |" TStill a method very much used (perhaps the most frequent one).  It is used* V4 y) r1 I2 J  I$ s
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
! L( \. ~9 ^: l7 T/ U+ lor execute SoftICE commands...
/ }. R  J# o; f/ P. uIt is also used to crash SoftICE and to force it to execute any commands4 ~$ U" E! F) P3 s% Y7 I& T
(HBOOT...) :-((  . X8 U& `7 o9 d* Q' s
5 p, i" Y$ I6 f& d0 l1 |( a
Here is a quick description:0 E4 ^5 a/ T# E
-AX = 0910h   (Display string in SIce windows)
6 l( u" ~6 K/ n7 Y6 K, z# }3 P( b-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)  o. H0 B# s0 M
-AX = 0912h   (Get breakpoint infos)$ l1 E# g9 y1 Z3 j
-AX = 0913h   (Set Sice breakpoints)
) P& Z" w0 o: [+ v, i-AX = 0914h   (Remove SIce breakoints)" @# \  l+ W* r. W' F9 Y: K) z: `

* @# |" N7 P7 O: bEach time you'll meet this trick, you'll see:! g* b' j6 v1 v+ [
-SI = 4647h
: s9 i2 X( G6 T; L" N-DI = 4A4Dh2 M, U; y1 Z/ A! M) E/ O0 H% E3 ?5 Y( [
Which are the 'magic values' used by SoftIce.
9 z. E" k5 d. h6 ~0 S. TFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
/ O5 A: ]4 o3 z8 K, Z( d; W9 f2 ?
' G8 D- D' E/ v1 u4 G2 {: }Here is one example from the file "Haspinst.exe" which is the dongle HASP- y# ^' u6 s3 o( {
Envelope utility use to protect DOS applications:! [8 t8 h0 S7 o0 U! g9 `- X
& j+ L' r/ p" g; q: X5 l; b
; C$ W8 ?+ t; H0 O/ `
4C19:0095   MOV    AX,0911  ; execute command.8 v' H2 Y6 [3 m# @- A7 a8 R
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).- a: t* f; g4 @( L: ?' [! Z& P! j
4C19:009A   MOV    SI,4647  ; 1st magic value./ F6 @- ?1 V* a' K$ O
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
& a6 A5 S. Z. S4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)/ X$ \: W9 F# C2 W3 B
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute( j, m9 ~+ p' X  o
4C19:00A4   INC    CX
& X* d- v+ u7 E- p4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
7 R  d9 I  A/ X3 c4C19:00A8   JB     0095     ; 6 different commands.
" {( A4 d' g' F+ Q1 o4C19:00AA   JMP    0002     ; Bad_Guy jmp back.0 Q3 L4 F+ M  ]* T  ~
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)# s  l7 o( i# s- ?3 V
. S7 S7 y* H+ n, D  P
The program will execute 6 different SIce commands located at ds:dx, which- `1 |1 g1 Q) X, {) C! N. M
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
6 g# ^4 ?- V- H0 j, B. d+ p( Y9 c' c$ J# @! G& L
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.  x) N* g; s5 L1 J7 |
___________________________________________________________________________& E! j2 ?8 d( d# E, z7 t

7 G. S9 j) I. G. f- f0 p/ s# u& V9 E' Z
Method 031 r) r, R. ^+ B( l  z. g
=========
4 k' S; u* P" p- A1 f6 E' P
8 e$ ~8 B% p5 ~6 _' {7 L+ d8 B% ZLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h( K) Y3 E& L2 y& @
(API Get entry point)
$ d$ s2 T2 q2 E        ) o3 O' v9 w& Z% f, k
' A! b9 n# @# f+ S
    xor     di,di
: n- F! i# T( B, N) v1 U( V7 A    mov     es,di. H- b  _, t/ S* K) @
    mov     ax, 1684h       % L7 r! K5 U, c' Y
    mov     bx, 0202h       ; VxD ID of winice+ s, D; U$ g, \9 Q9 R2 K' y$ u3 l
    int     2Fh7 {, H9 e- c. g+ {
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
2 m8 [8 V3 r* ?    add     ax, di; i9 i1 T0 w) T
    test    ax,ax
1 L5 E+ c5 a- C1 n, J6 W, a6 U    jnz     SoftICE_Detected$ @, d  t9 q$ }( r- Q

& ^" v8 E3 V7 @/ R___________________________________________________________________________
# O+ D  l4 e7 m- b- A  _- |1 [! E( k3 c+ N6 N/ q, O
Method 04
% M0 s3 l% C9 [5 w) B, d. ?8 Q=========
, G5 b3 B8 U: }8 `. `: s
: G" [3 s; \$ y0 DMethod identical to the preceding one except that it seeks the ID of SoftICE
: |& V3 L: ?* L. W! q( ^GFX VxD.
' F- D6 j  w' \* ?, n( y( ?
# z' h8 t7 Y9 @5 `    xor     di,di% e. {3 a* w) C1 M8 D5 j
    mov     es,di
6 h% T  [+ I6 a    mov     ax, 1684h      
. @' L4 w1 i: q' ~3 B& G: F    mov     bx, 7a5Fh       ; VxD ID of SIWVID
4 n1 u6 }+ |( R& B+ Z# i. `    int     2fh) Y7 r, l9 S9 U$ T3 p& B1 q9 j
    mov     ax, es          ; ES:DI -&gt; VxD API entry point! ^4 W; I6 E+ \
    add     ax, di8 O; H& S. q6 t+ d( [% q! n
    test    ax,ax4 H! v9 d' V" `: b8 ~6 y
    jnz     SoftICE_Detected- N: @! B9 a; E% z

1 A" J7 D% E! q+ P1 a# q# h7 ^__________________________________________________________________________
8 g8 K7 D7 @) y9 b; W* ^: y. Z5 ~5 N9 C( q+ w5 e% @
4 m' M2 F7 d' X1 j' H' ~
Method 05
; r* h, L3 P) W* J5 T; m=========0 G6 I$ \- f* Z  Y3 I
' j1 e6 A5 c; O2 K" U" L3 `# k8 m; w
Method seeking the 'magic number' 0F386h returned (in ax) by all system, ^( t7 L9 l: B
debugger. It calls the int 41h, function 4Fh.
# \9 `+ b3 j! W$ n. E7 jThere are several alternatives.  
! K& G0 ~5 S* `# j1 i9 j9 H
$ U  K  i4 r# E, a8 qThe following one is the simplest:
" L! |3 G/ t% d( i4 N8 ^5 U. t% X# p- k- u; w4 x
    mov     ax,4fh
. P8 z& q2 R* [. v& S$ q2 W    int     41h
) u: T$ v, k  r' v3 s, m    cmp     ax, 0F386
$ M0 Q% p  J1 R    jz      SoftICE_detected9 G4 d7 B- Z' p- A- \

+ P, |* j8 j! n$ m% g" L5 I7 t8 p* A7 M  z8 ~* o
Next method as well as the following one are 2 examples from Stone's
  B# n' l0 I* \"stn-wid.zip" (www.cracking.net):
1 N. @' ^6 f2 p/ U4 k; R# {( k
- Z1 C6 ^' U% y0 S; w    mov     bx, cs
) }- u* N# M# x$ Y3 D$ v    lea     dx, int41handler2- q  Q: i) `: Z2 Q
    xchg    dx, es:[41h*4]7 M1 k8 O, y& z
    xchg    bx, es:[41h*4+2]
+ B& H6 a' g0 D7 }    mov     ax,4fh+ C4 u/ K) ]: h5 {7 C7 F* S
    int     41h7 E* N- x$ D! N4 a, P0 b/ [0 B
    xchg    dx, es:[41h*4]$ t  U% ?# N7 B# h
    xchg    bx, es:[41h*4+2]
- u. b7 u. z; m' [    cmp     ax, 0f386h( t( F0 u2 }- U
    jz      SoftICE_detected' \, j# w4 V  I7 A) A) f" u

, e* x6 z- U5 c" iint41handler2 PROC
# k7 |  A* \+ T; k% M  o0 j$ B    iret5 ?6 g: V3 J% C; F: O% X; Z
int41handler2 ENDP& z5 y2 X' r' m
5 p2 K2 e+ b/ C, ^3 Z
( B! e6 F6 a8 D% j
_________________________________________________________________________
4 f. F, F8 F4 E% }2 T, U' F! B
( h" T( [9 j3 P# p8 a9 a% f! H1 x+ ~$ G; ]3 j  f
Method 06  P4 v: t1 G6 Y3 ?
=========
3 q. d. v' z, S) M1 a% g& N9 D) |2 U5 r, j: |7 N. B
( p% e) R) D2 v% x- q, y- {
2nd method similar to the preceding one but more difficult to detect:5 B# O+ D; Q8 H0 H$ Y3 G' h
4 _5 B3 I8 W- Q0 x
/ W$ i8 O3 ?" P3 T* T5 d
int41handler PROC
- |- a8 J) t4 v0 _. i, v' H+ J, q    mov     cl,al7 E" V6 b# x. K, a7 Y
    iret
1 f8 K; u4 P0 [5 p  N4 f: n( g& \int41handler ENDP4 I3 x4 \$ F1 K

7 b+ c3 X0 N" P% r7 t8 k( R0 i. K. C& `
    xor     ax,ax
' m0 n, G' t* U  ~# |+ H; L" M    mov     es,ax
# m# p: M  h# c2 w    mov     bx, cs4 V$ Y- g. Y; }  o8 y
    lea     dx, int41handler) F" H9 Y! M, [9 p# x( G+ ^; N
    xchg    dx, es:[41h*4]
5 a; J+ P8 u- c. x    xchg    bx, es:[41h*4+2]
5 ^$ _. i& M+ }, a0 V: u; f5 a! a    in      al, 40h4 C1 J- X0 ?5 B$ b
    xor     cx,cx9 c7 a. F+ y/ E5 }/ A, Z; `
    int     41h5 P: l3 t4 z0 t, L5 f
    xchg    dx, es:[41h*4]6 o, s; Y( Z8 \# W# X6 D
    xchg    bx, es:[41h*4+2]: z: W; z" P0 B# `( w
    cmp     cl,al
* ^' i& b1 R% @2 \    jnz     SoftICE_detected8 z& ~$ K* q0 `3 h) s
& I5 _: w3 H8 z& u- d- z
_________________________________________________________________________
* t# f/ G0 \- D# k% y% F( n
, G6 M6 o6 d1 D3 oMethod 07
( T6 s. S' }. X6 [- c=========; g$ e. h2 S$ ^* z1 o- O3 k5 Y

% z1 i" t5 q! ~  ~% y$ S5 GMethod of detection of the WinICE handler in the int68h (V86)0 Q/ u6 E3 v# ?
- g( Z2 J! @9 e4 {# `
    mov     ah,43h
( m" b/ n. K/ o2 Z: z2 S( @    int     68h
$ v& B8 B" l: w  L) h5 P    cmp     ax,0F386h
2 `" ~( `8 d6 k: c, Y" M& C    jz      SoftICE_Detected- k! j4 ~+ {; s
" C+ H. @/ ?, b9 W7 {+ Y

* h- N& m8 l$ B& }8 E0 L=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
( m6 q( Z( D. n' r# q' U- j   app like this:
* R. L1 M8 T  k# F" n3 u
5 x2 f8 I- O/ a" E0 r   BPX exec_int if ax==68* j% R' z+ V: c5 e. e
   (function called is located at byte ptr [ebp+1Dh] and client eip is% c& S5 j2 G' p# A
   located at [ebp+48h] for 32Bit apps)/ O/ i% a3 m2 \
__________________________________________________________________________
1 a8 }8 z1 Z, N* [1 F8 ]7 @/ E' T
" f6 a7 g& Y; N# S) ^6 Y  |# e# L; A' Y# K* V
Method 08. ?# T% ~9 b  ^1 {- q
=========8 {) g2 m) t# a3 C% U. L
, b3 h" m$ Q$ s$ ]" `* \- `
It is not a method of detection of SoftICE but a possibility to crash the
8 |" c' x) R* e# Fsystem by intercepting int 01h and int 03h and redirecting them to another
! R) G) {: B$ I% E3 r; `" croutine.
2 {8 P4 T1 g5 A  G0 j8 G' P) c* FIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
  a0 L' }1 _' R5 H; yto the new routine to execute (hangs computer...)
/ G. \; A- v2 C5 f2 Y* v
- t3 L1 u; h. F+ b    mov     ah, 25h
. T9 i5 S* C: u5 I5 g. Q1 X+ ~0 J( W    mov     al, Int_Number (01h or 03h)) {0 g% f6 t8 w3 o& L* ]
    mov     dx, offset New_Int_Routine) E4 J' F0 P0 @5 k+ D. J7 [: b9 I0 k
    int     21h
8 j8 z; I; {+ |7 W8 q% z2 e& C0 r- R8 f, @/ K
__________________________________________________________________________
- d6 [! w: r) B4 j  X6 T7 N! I0 W+ v! p; \
Method 091 E- T- z) [8 |- n
=========
  }3 o9 W5 q( u3 Z$ r  F7 J( L4 r3 z9 [
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only4 r3 b# z: \/ ^6 j
performed in ring0 (VxD or a ring3 app using the VxdCall)." \) p3 Y# Y+ q0 j) t! Z0 x* I; L6 I
The Get_DDB service is used to determine whether or not a VxD is installed
) ^6 A; B' y0 v% sfor the specified device and returns a Device Description Block (in ecx) for
9 k# {9 C- K) D# `that device if it is installed.# J1 Z" ]. Q  S8 o: O
1 d4 E" Z  c; L) l
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID' x" y7 Y  Z& \( k; l
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)* i2 D' h: c, ~* k/ E* A# |
   VMMCall Get_DDB
9 B$ _0 K7 v& ~+ l  G  w. c   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
0 X. _# G. O; y9 R0 m8 n& I7 K: G2 h8 m! |
Note as well that you can easily detect this method with SoftICE:
" F. r6 a+ v/ t  V2 M& V( T0 |- f   bpx Get_DDB if ax==0202 || ax==7a5fh; x3 g  I* b( g

, y7 Z5 X! i; c3 P# |__________________________________________________________________________
/ G$ Y& t4 g  d' N3 a
# ~3 B9 L  X1 Y# X1 nMethod 108 E; o' r" W. J- o
=========
2 C! j# s4 v2 F' t$ S) f7 u2 E( G& s8 y, `  Z. e% T
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
: ~* C* u, n' m9 F% w  SoftICE while the option is enable!!
. @- i: ?5 {0 y3 C& q4 J) f  n8 Z! Z5 p
This trick is very efficient:
' S# _  i5 Z! ~' Oby checking the Debug Registers, you can detect if SoftICE is loaded5 D4 T: h6 v  Q( @. }1 }
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if2 S, y$ i0 z9 Q$ T8 h% y
there are some memory breakpoints set (dr0 to dr3) simply by reading their
6 p# t% R, y. Z; d' {, jvalue (in ring0 only). Values can be manipulated and or changed as well
9 M: s+ ~! P7 \! G(clearing BPMs for instance)
0 h/ l: a7 _& A/ p( q4 T6 l* W' I: X, F
__________________________________________________________________________8 E+ E  B( j( a& k1 P
8 i* o7 \( O1 C/ c2 M
Method 11: v  j& u/ ?' }! R) b
=========( k3 w% |, d' Z3 R/ G; t6 B
2 S5 j' ]/ b1 O- S" R4 e
This method is most known as 'MeltICE' because it has been freely distributed
  \8 ?; p) ~6 g8 Wvia www.winfiles.com. However it was first used by NuMega people to allow) ~2 Q- `3 y3 A
Symbol Loader to check if SoftICE was active or not (the code is located
5 I+ `" |9 O" M' k8 cinside nmtrans.dll).
6 K6 _7 a' _. b2 V! D5 n7 l8 d- r/ v8 n5 u
The way it works is very simple:" i6 M0 `3 C/ L8 A: A1 i. B. R" U
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
* F) m: h7 I3 `8 H0 AWinNT) with the CreateFileA API.
% d* b& ~& T! T7 V& J/ k/ E" L0 P; W1 `+ G, E2 w$ k8 o* S
Here is a sample (checking for 'SICE'):
' L$ W2 M, @# P7 O( D
$ v$ t* T: R7 p& f0 H( w# R' u# yBOOL IsSoftIce95Loaded()
; i/ r3 |9 p8 B: p{. U+ ]; Z; d6 S9 C& d5 i0 R$ i% L4 Q
   HANDLE hFile;  
; [8 T- X) l+ A4 b+ c; l% ~) _   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,* h6 J& K0 R1 A
                      FILE_SHARE_READ | FILE_SHARE_WRITE,
& `+ D, G, J( D3 I) f1 `1 A                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
& w. u4 e7 h: v5 |; t3 B   if( hFile != INVALID_HANDLE_VALUE )
: p9 F. R" `' W+ I5 A( v( I( S( e+ b   {
, j; _! V1 ~4 S$ @+ M      CloseHandle(hFile);0 |( A% B0 }, b8 E* |8 Y
      return TRUE;
- Y  L" V) ~' h9 U, k( y' u' f5 G6 y   }8 L1 G' I0 H/ y* Y7 K
   return FALSE;
  @# s* ~% a5 J% v6 @2 p, D9 h}
2 \6 ]: I' o9 z  C% J# g3 ?# l7 ~% H6 D
Although this trick calls the CreateFileA function, don't even expect to be0 ~  F# _& X. Q. T  e. J% |; k
able to intercept it by installing a IFS hook: it will not work, no way!- f0 f3 M8 Y4 F. E9 n- G/ c
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
/ f1 ~: d1 G3 N/ v/ Mservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
; w# _- ]( x/ J1 Y7 `( Vand then browse the DDB list until it find the VxD and its DDB_Control_Proc
- ^8 [8 A1 @0 |$ r* |field.
% e2 m. [' {1 TIn fact, its purpose is not to load/unload VxDs but only to send a 3 {4 Z/ {8 F0 ?% H) c
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)/ {! w& l' ~' R2 n/ u+ g8 |! K
to the VxD Control_Dispatch proc (how the hell a shareware soft could try/ M# \/ Z2 [! z& ?2 O. y% I4 }
to load/unload a non-dynamically loadable driver such as SoftICE ;-)." {, q# N) N+ c" g( c" }  ^5 [
If the VxD is loaded, it will always clear eax and the Carry flag to allow
. O) K* V- u" }% v- H9 Rits handle to be opened and then, will be detected.
# N4 e# x9 J4 k# GYou can check that simply by hooking Winice.exe control proc entry point
/ J# y2 S$ M) c: Hwhile running MeltICE.
/ T  J1 O& [' v# U! b, z7 l0 z4 O4 A! `9 ]

9 k& B# f9 \( n  00401067:  push      00402025    ; \\.\SICE
2 H1 m$ h1 x. Y3 Z6 ~! w( w& m! ?  0040106C:  call      CreateFileA
) {! b  P* \' M; v2 e  00401071:  cmp       eax,-001+ e3 `" H2 T1 x$ T
  00401074:  je        00401091
  l, {, r4 U$ l" w+ O2 e  w- Y& G9 ^$ B8 E& c$ n, c

& M" ?  u# ]5 D3 QThere could be hundreds of BPX you could use to detect this trick.% k' Q3 {" t1 k5 k4 }
-The most classical one is:6 `$ e6 I& U0 n8 }: A
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||* u2 I2 i% g0 l
    *(esp-&gt;4+4)=='NTIC'$ Q: h( E* z0 }, [& `5 E- {! q5 n
, S6 r8 n- R) m" `$ k+ z: O
-The most exotic ones (could be very slooooow :-(8 F+ S9 ]; r$ I) \% F  h% ~7 u
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  % j" P  c/ ?; N
     ;will break 3 times :-(
* R- a4 @& q# l" [+ W
/ P+ \8 _' t  S% _" l-or (a bit) faster:
8 z! N8 L' |% a+ z. E   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')' |7 M0 |* C3 T) D9 z) u1 X

  o4 k% G# M2 s% N+ ]4 j   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  * i, ~# k8 T& a
     ;will break 3 times :-(. H. D8 f4 r& T  m
8 d2 O1 H1 N3 D
-Much faster:
5 h. q7 U( L# W   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
* n7 a' Q! ?# i) ~8 [0 h# g) Y( |/ {; D2 m" ?, g
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen  I0 h) [( c1 C+ m+ p2 m
function to do the same job:
2 m! a5 D% E6 g# ?0 D
6 \! s  {, V6 L; X5 `3 A3 ]   push    00                        ; OF_READ
1 Z) w& H1 T: o' e& e$ N2 ~   mov     eax,[00656634]            ; '\\.\SICE',0
& ^# j2 n; I  k- `   push    eax
# Y& R1 s( m; t) X) y3 W6 r: @% e) u) d   call    KERNEL32!_lopen) G. v' Y1 t3 Z* T4 B
   inc     eax
3 B7 W# g6 b) M+ S" [7 M$ n   jnz     00650589                  ; detected
% ]- d1 c; s! P2 a% Z: P   push    00                        ; OF_READ
0 `# u6 z% D; U/ h) B2 f1 L! ~! U   mov     eax,[00656638]            ; '\\.\SICE'6 S, \1 I. s; u$ w/ S& h2 G3 F
   push    eax* X( Z. l, S7 A. s  ^8 e% N
   call    KERNEL32!_lopen8 {6 p5 i2 u) N4 i
   inc     eax
* k& J& A& @' k5 b$ b   jz      006505ae                  ; not detected
6 v& P  ]( F) @3 u# T) W) r1 v. Q7 C& z2 Y$ P/ P
. F9 B' O- p: }
__________________________________________________________________________
* F; y0 n" z3 ]2 T3 e
# ]! n7 z; Z* h3 a2 c9 [Method 12' I8 F) Z7 u* U3 B
=========
9 M& X- F5 x6 q% B) S: U' @) L( O* q. B
This trick is similar to int41h/4fh Debugger installation check (code 055 N6 V0 V4 C& H. M4 Q0 B. _9 x
&amp; 06) but very limited because it's only available for Win95/98 (not NT)" `1 {( @+ M, A7 L3 o  a( H
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
/ B7 q* q. t! N2 y! l5 o! c( d. i9 a4 }6 x$ m! M
   push  0000004fh         ; function 4fh" ?; }7 [$ F6 k5 t( i# `  t
   push  002a002ah         ; high word specifies which VxD (VWIN32)
$ |% @7 J8 d1 p1 O- {5 _                           ; low word specifies which service+ L% Q$ f- D: T% v
                             (VWIN32_Int41Dispatch)
( d4 A5 ^5 g- T4 P: j9 E   call  Kernel32!ORD_001  ; VxdCall
- k) t8 C$ i) _   cmp   ax, 0f386h        ; magic number returned by system debuggers. |: k1 i  ]& ^- _
   jz    SoftICE_detected
$ w7 `0 ~: W, ^  a& X+ ]  B' O& j5 a/ \6 E5 E" @( O* y1 w
Here again, several ways to detect it:& F0 h' ?; L4 [7 z

+ c8 W4 e8 M, A4 f" r) v  w    BPINT 41 if ax==4f
& n" \8 z5 _5 w# ~( {3 |  a, k
# M+ `: i% z. p/ ~) _/ q( L  O1 u    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one3 u  r! \% V4 s1 ?# P
* k5 G, V+ q6 e* o& O
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
- G$ R$ O. ?+ v; v' g" ~9 F
2 e* A5 i& P4 T: y    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!- T% F+ w; p$ C5 Y( B
+ n, o4 p; z4 `
__________________________________________________________________________
: V0 P1 |6 j4 R3 [; l) w+ u$ @% ^, b' R" r
Method 13
0 O& d. ?# p5 s2 D9 h2 @$ ?; X2 i=========
) d8 j; e4 P! X  k) H5 {" v3 ~6 J. G9 r8 `& N
Not a real method of detection, but a good way to know if SoftICE is
8 O$ A; k4 B% u( T' R8 U" V; Q5 A9 Ninstalled on a computer and to locate its installation directory.
5 k) P  j' w. e6 n& n0 X3 A! `It is used by few softs which access the following registry keys (usually #2) :
1 p- Q% t) G" o% a1 y+ d% X5 g' u2 t) y3 U
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion3 ~; K' \- K6 s. w
\Uninstall\SoftICE
9 O* `/ g( ?( Q: T' J-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE1 W% o" p( s& l! p
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion2 B2 ^) y  j$ Q
\App Paths\Loader32.Exe- i3 C; R9 \$ j+ V: N) P( Q
# f' d- l( V* }) @

* G5 x5 Z  q0 v# |/ T% G  UNote that some nasty apps could then erase all files from SoftICE directory
$ r% f( q/ q+ d- H# B* s(I faced that once :-(9 h# e* M* d! u
: w  x! F$ M9 w, q' A% U
Useful breakpoint to detect it:
" r7 h  l) R2 P. l6 i
7 Z) C* V1 c0 _7 `5 ^3 U0 W6 O; q     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
# U& Y, v* m# r" P7 l* |( q" O  \7 A$ V* C! P/ W5 [" }
__________________________________________________________________________
0 }. V! ?, v: I: K3 m' Z# F5 Z/ a5 Q/ H, Y, |2 G9 J' O! @
6 D# J5 x5 f# t& Q( @  b
Method 14 2 U% u( o4 b, f7 L! [
=========3 j% s/ {: c  ?+ f
' T; |0 w9 @. G: o' Z2 J4 u) ^1 v
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
; c3 r8 V+ E9 D8 ^7 w7 Iis to determines whether a debugger is running on your system (ring0 only).
$ h1 Q% t$ J/ I; f2 L' d1 N1 c9 [+ `8 `( v" n1 c0 Y
   VMMCall Test_Debug_Installed
1 ?! n6 s+ ~5 I0 l7 z% J! I   je      not_installed, a) L* P# ]: W+ Z

$ _$ n1 z, i9 N0 B0 K! |This service just checks a flag." L; t6 p; }) m0 ~7 g" B' {
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部