About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>3 P+ e. Y3 f  }' l3 G6 p" U- Z" [
<TBODY>
* X3 @8 y; B2 `) v- R<TR>) a5 U4 x. x9 G: F
<TD><PRE>Method 01
2 b& `% Y( w! J- V/ P; w=========
. N, Q/ J/ m# _, Q. U5 v1 G2 ]3 {1 E4 w8 Q8 Y- [9 e* c" L) U
This method of detection of SoftICE (as well as the following one) is0 S+ D' X. i) \8 P
used by the majority of packers/encryptors found on Internet.
" R; }* w' S# `9 CIt seeks the signature of BoundsChecker in SoftICE7 J1 B! r, m9 Z& a4 O

. P' l! s5 M' i7 M6 ]/ F5 d    mov     ebp, 04243484Bh        ; 'BCHK'
1 ^8 y$ t+ c% M2 s, F2 X    mov     ax, 04h. j( e' ~+ f* B  k% o) ?  J
    int     3       & T2 L1 z$ f; [1 r
    cmp     al,4  x0 q5 B) X# T! _# u$ O
    jnz     SoftICE_Detected1 y* z( \/ e& Q4 A

( {/ m5 X3 i$ ?& p; ]* Q/ M___________________________________________________________________________  P+ z5 v. \& P6 Q

# f" B0 d% }# _' fMethod 023 Y; P4 A1 x( \. J/ _1 R
=========" L2 |) g$ p! @% W% T/ s8 j( w
( r# [, l% S8 D0 O" j
Still a method very much used (perhaps the most frequent one).  It is used
8 ^3 c9 \& V9 I* Pto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
4 J4 e+ t7 g/ E1 Q- J6 a9 m  F+ _3 ~or execute SoftICE commands...
: w9 p* m) @# O7 p: `* j* nIt is also used to crash SoftICE and to force it to execute any commands
! O8 d1 f1 G% m% x6 d5 C(HBOOT...) :-((  2 w& X: F% i4 f/ M: `$ l
( R2 O2 \6 i/ y+ d
Here is a quick description:+ `: \& D* T8 }0 b5 h9 |6 ^7 {
-AX = 0910h   (Display string in SIce windows)5 C6 i* m7 C1 S7 }
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
" Y- o3 j) v# T4 ?! C-AX = 0912h   (Get breakpoint infos). r! a/ b, S. s* ~: e
-AX = 0913h   (Set Sice breakpoints)
. T- C$ Q& u) @% }# a-AX = 0914h   (Remove SIce breakoints)1 d$ }2 R. k( A6 T+ ]6 s  f; m
; ?& H& S' R% E- A" \9 M! i
Each time you'll meet this trick, you'll see:
0 M  r4 ?9 T5 E% e6 T% J1 _) \-SI = 4647h% [$ {1 P0 X( k5 z' \, o% `, j
-DI = 4A4Dh
5 j* s3 r0 U) Y1 j1 H) ?4 a( {/ tWhich are the 'magic values' used by SoftIce.9 v2 F" B) H# \4 N
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.' W, @' N8 c  c% u8 ?

/ ^! O3 E( i/ q9 V; r9 f/ G2 n* q9 DHere is one example from the file "Haspinst.exe" which is the dongle HASP
6 Y; P0 J3 T; V0 [( e# k3 X, BEnvelope utility use to protect DOS applications:
9 k& \0 s) M# \8 {4 J
9 G1 m0 z* q9 j$ _' l+ g$ x% e/ k- J; x# h) f: X! o
4C19:0095   MOV    AX,0911  ; execute command.# J2 u# X: }: V" L1 z* @/ [
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).3 a( F1 A/ [7 |* g+ A
4C19:009A   MOV    SI,4647  ; 1st magic value.2 K8 u; u1 o. m+ p6 [
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.2 G! v0 w1 n" \% Q, l% I
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
# v' J% ^* E( s9 Z% F6 O4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute& i; u& E% c8 i& v6 _( y
4C19:00A4   INC    CX6 D5 ^, o! @8 V' S$ r: s& q2 a  ]
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute" K' d' H( G- h4 V0 B
4C19:00A8   JB     0095     ; 6 different commands.
, b# o' N$ H, K3 y; A. l5 g* q7 D4C19:00AA   JMP    0002     ; Bad_Guy jmp back.( x; U  Y; U' q
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :). ~9 u9 P7 k4 m( z" D
; a" `* X& j7 c& g1 g  w
The program will execute 6 different SIce commands located at ds:dx, which! K0 T% ?5 v5 m0 q; I
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.# ~, I3 G7 }) n* _- f

3 p2 v; J! {5 o3 A# U2 u* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
# L" j* }, ~( |2 [, J2 K___________________________________________________________________________
% ~$ m1 L2 F0 `: r3 {! T! g2 [( y) _% }  p% l% d7 X& |: a/ W9 {, b
# Q" f% x5 [* W* Q
Method 034 e/ t% k* l! x( V& E9 H/ g9 e) q, i
=========
5 G  c  [" g5 u# r  E' U  x. K4 z4 p: ~" Y/ X+ v7 Y9 _. l( ~( P
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
% W3 M6 B6 o1 C# C& ~(API Get entry point); ~; \  _0 S) B1 s6 B# A/ h
        
) T+ a: W! L5 h+ G! u! n
- Z# u5 ?: A3 r    xor     di,di* p+ J% H) v) O2 n; A% s
    mov     es,di3 U# f4 Y2 E: Y9 D% Q% v
    mov     ax, 1684h         u& p; @* e$ N7 Q" p" [
    mov     bx, 0202h       ; VxD ID of winice
4 ?0 C( G, J2 C/ @& j/ v    int     2Fh( J& Q. U- {4 V( {) b6 O, I
    mov     ax, es          ; ES:DI -&gt; VxD API entry point; u, Z  G* R2 k9 {
    add     ax, di# j# d0 U% F- K! _  E- Q
    test    ax,ax& P+ k1 L& D# \/ z" P
    jnz     SoftICE_Detected) ?6 N/ {$ a2 o+ M7 w

& @+ p- c6 Q- b3 `( D0 `" W* N___________________________________________________________________________
# s4 Z0 h" i. e$ }& w. i% k
2 [, C4 s0 C7 }$ O1 w! ^# A- O2 C6 wMethod 047 y% h* ~9 [8 w' K/ x9 B. Z
=========/ \6 R, i! I- P$ v  ], u8 _" a
5 |9 |8 n) A1 O* N' b$ t; X+ l! w
Method identical to the preceding one except that it seeks the ID of SoftICE
' S8 w8 R% ?( B% h5 W3 [3 VGFX VxD.3 g7 V1 ^' z. [4 \0 q0 X

5 N* R3 \3 ^9 w; A  q& Z    xor     di,di
3 X1 Z* e1 I$ g4 g# O    mov     es,di' H' C0 v( }! L& G: R3 A
    mov     ax, 1684h      
0 C/ L6 v4 z, S! W1 C, b3 ]    mov     bx, 7a5Fh       ; VxD ID of SIWVID* N7 |. ?; H" ]: K' l, O8 N
    int     2fh
' J5 _) B# x: N    mov     ax, es          ; ES:DI -&gt; VxD API entry point
4 O0 G" s! m4 O+ b5 Q    add     ax, di
/ C4 a1 s4 c. J' ]5 h7 D    test    ax,ax4 o' L1 p+ q$ {# B! E
    jnz     SoftICE_Detected
' P& Z- x. o9 l  E; U/ S, i  ?# F5 G5 K: I( F" ?
__________________________________________________________________________9 ~. s& A7 m" h( L9 u5 ^+ p/ N

6 V0 p4 h: j0 k: y( z6 Z) z1 z% d7 t# `7 }
Method 05
8 G- N& y6 f- U( r# _' ~=========, r( q; ~) A+ w' N+ P
4 l: ?2 b0 }: H9 j2 u- I8 i
Method seeking the 'magic number' 0F386h returned (in ax) by all system
  H. Z+ f* T+ Y8 g+ b- x% u) b4 mdebugger. It calls the int 41h, function 4Fh.
( G% r  M7 m! }6 W! {There are several alternatives.  
: m; M# f( }2 s" D5 H( P0 B2 F
$ ]* Q# B0 I' P) P# d. }The following one is the simplest:
# P3 S- u3 E' H3 T5 Z" g$ N; n& g. |
    mov     ax,4fh$ d" U# k. m+ Y
    int     41h
$ I4 ~$ ?- ?0 e6 P4 [2 k    cmp     ax, 0F386
1 d; d$ m0 C  y; R8 K    jz      SoftICE_detected
. w3 y0 \, z, o% V3 ?+ ]( N( e  Y  K1 N, }
8 K: R/ i: Z; N: R* B
Next method as well as the following one are 2 examples from Stone's   n% J7 s" S: N( [4 w
"stn-wid.zip" (www.cracking.net):4 u- f. T. l2 D: x  T
% ]& E. h' p6 x
    mov     bx, cs* b' F( E, y% _! s2 i
    lea     dx, int41handler20 h; M0 I7 E5 q& q( U
    xchg    dx, es:[41h*4]' g+ ]2 c% u8 @# {/ s2 q
    xchg    bx, es:[41h*4+2]" ?- s) t# u8 r( {* g
    mov     ax,4fh
3 e& Q3 u$ C, Z6 _1 ^! a1 _, {    int     41h
7 F' j5 E1 L& `8 I: _! L    xchg    dx, es:[41h*4]
9 n/ G, c% W0 J& s" J( n  \; [- k( \    xchg    bx, es:[41h*4+2]
% N% V8 C" R0 v( e! u1 y* P    cmp     ax, 0f386h3 o  S: T8 o5 L
    jz      SoftICE_detected
5 V. }1 y3 E+ }
$ d" F2 L- e1 }& I  m+ bint41handler2 PROC
+ A7 }" k3 v$ f% Y( b5 ~/ h    iret8 r: A7 ~% D9 i1 p! {8 m
int41handler2 ENDP
/ ?, x$ N+ O# h/ }% U" j8 h6 i& w! ]5 f  i$ E2 d6 Y1 A7 k- R

- M3 \- |1 e# |- i_________________________________________________________________________
- V# j3 o# ~- _. D! r; ~5 h
. [0 e4 L4 e! h$ G7 m8 K+ Z* S2 W& r
' N0 m2 }( M0 B" D9 X: VMethod 06$ w4 L1 v4 f& r  q+ v
=========* Q1 l1 z; ]0 c
$ ]4 F! b6 N4 O- A" f% p/ f% m' j
8 N- O9 K7 S7 L& X2 v* Z
2nd method similar to the preceding one but more difficult to detect:
: p& T6 ?6 @% A+ ~
0 E4 f( r, K/ w/ o; b0 b
1 N  d8 X9 y- V$ r' D: m; A4 Cint41handler PROC/ K& q' ]& E1 k) W  x- \  }
    mov     cl,al4 U' }! T0 u7 K7 _: C
    iret* W8 i# s! E1 Q7 f+ R' f
int41handler ENDP9 A; ?0 ^3 ]) J& l2 \2 h

- X. n: L' M6 ?7 R
3 |. y0 W6 r" t3 n. I" _    xor     ax,ax
* {5 n! u- M/ r) b    mov     es,ax
% N# n8 m* h  i  g9 {    mov     bx, cs1 D, T% W) p' M, o- g" R1 @# K
    lea     dx, int41handler" ]* b3 V) l% t0 ?. ^( }
    xchg    dx, es:[41h*4]
# ~( X3 S4 g2 A0 E8 w9 O    xchg    bx, es:[41h*4+2]8 G/ }; v" S8 r3 j" d
    in      al, 40h
# v4 j8 \* w' [* q5 g; ^) R0 A    xor     cx,cx/ X; ^9 B, c* s4 f& i# B# H4 F
    int     41h5 N9 J1 q' H( q# C% X1 V: l1 L/ s
    xchg    dx, es:[41h*4]7 G6 P- G. U3 K
    xchg    bx, es:[41h*4+2]- f8 ?/ r3 a" G# h! H* N, w
    cmp     cl,al. C, r$ w  u+ w: F* Z6 r! }+ C
    jnz     SoftICE_detected
2 t, H& Z6 f8 X( j0 Q2 ]
% b/ v8 y. q, G5 F+ E- Q_________________________________________________________________________
7 u# R) ]3 Q  y4 n; R  B
" w+ H" l% G$ R: F, }+ V/ J+ Q: A8 QMethod 07
# F" u/ O2 B, E=========
" [0 r  g- ^/ y- k8 _6 I% m
. K6 n9 @. }# y7 b. [! U$ _Method of detection of the WinICE handler in the int68h (V86)' v- _/ |( m  `' g, S9 t

8 X: D" p7 y- Z1 g    mov     ah,43h
% C* b" z* U4 {+ {# c    int     68h
# P3 p9 w6 _, _# N  a1 P    cmp     ax,0F386h7 X# E8 ]  }5 f2 F. W% L) ^+ U  G
    jz      SoftICE_Detected
, A2 L7 A' ]' Z/ g  Q
, H, [% q' \) U# `* }0 q. L. X5 Q" A7 F6 h' G5 d9 `8 \1 {5 P
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit- u& t: P! U; r  w) ?; E6 m
   app like this:
* l5 m2 r: ~; [* D* b( ^" T, ]
   BPX exec_int if ax==681 \' J0 q' ?0 D
   (function called is located at byte ptr [ebp+1Dh] and client eip is
# Z2 o5 E8 q$ ]   located at [ebp+48h] for 32Bit apps)
. G( x' T! g7 L7 Y6 G. f# q% ^; O__________________________________________________________________________1 J: s' ^: }8 I" c/ A; s/ n/ p
# J& H0 Z$ Q+ c2 g$ G8 p

2 Z) V) `8 H: E1 V7 F7 [Method 08! a8 Q. d0 R. _' B, ]
=========! _* \! B3 p- ~! B
0 R9 W- {" m+ ?
It is not a method of detection of SoftICE but a possibility to crash the
2 o: U" \; B. y1 {. n( B6 m% X& jsystem by intercepting int 01h and int 03h and redirecting them to another4 K4 |! T7 ]; O7 x: x8 T
routine.2 N" J  c1 C! @5 D- c
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
! z; F  x" z" S, z& ], d6 J/ gto the new routine to execute (hangs computer...)
. f  Z& `2 L: G+ a" Q: l* g# s* n+ M5 @# Z
    mov     ah, 25h  M. z) K7 ]6 B( g
    mov     al, Int_Number (01h or 03h)+ \* c6 y- D8 s/ N& H, y
    mov     dx, offset New_Int_Routine- r$ G! u; W, ?& E
    int     21h
6 O- J6 w1 l/ ~; B( {& S7 z. }5 V2 [7 M% }) `& t8 r# }
__________________________________________________________________________
, @, V9 X# l0 }# D& @7 K6 U
5 W/ p  n5 M6 @+ U5 r3 JMethod 09
% D3 X7 Z1 y1 Z=========9 g0 [7 I, c1 k& {1 {; e, C

; A" Z/ h) z6 B% |7 F3 y  {/ FThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only! h9 l. |) u% Y% ~( r
performed in ring0 (VxD or a ring3 app using the VxdCall).) u0 _6 Z. Y/ n7 d
The Get_DDB service is used to determine whether or not a VxD is installed- n$ D4 [7 @: D/ y
for the specified device and returns a Device Description Block (in ecx) for
. ?; b5 n3 V3 B/ f- ?/ I( w: l4 rthat device if it is installed.
, a0 e( j) }& t: x" q& g, j: ~& |. M5 j; X  T& N" Q5 o, z
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID6 |3 T8 f: E# j5 l4 j
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-): h4 \2 A/ |8 [0 N6 c& N7 Y3 ?" J
   VMMCall Get_DDB
, E/ ^  k1 X# M! w0 X   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
8 ?7 j: L: p" N& F2 G9 k  Q# `5 w& C0 W! M  Q4 D
Note as well that you can easily detect this method with SoftICE:
. H- U& m! Q4 s: E8 Y  C6 Y   bpx Get_DDB if ax==0202 || ax==7a5fh5 Q7 b" k5 p- U
5 i' O+ g- U3 _( p$ q& ^7 ?3 r
__________________________________________________________________________6 ?) j$ `5 k+ e/ f: }9 z  b

2 J0 d: L- c: @( O, X& T& ]8 MMethod 10' q0 n6 u. J2 i" @' n! U
=========4 w! Y. K. `5 V1 D8 {3 o& D

0 _0 f, u" b- Z  }. \=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
8 A/ u7 L0 Y( M0 R& Q5 K# C3 h6 U  SoftICE while the option is enable!!
; j% D  @% p8 B+ ~& M+ {$ m7 t: c* p! E7 m
This trick is very efficient:& m/ j; b0 V3 q. d
by checking the Debug Registers, you can detect if SoftICE is loaded
$ T: F3 m; I& J/ x2 y7 M(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
8 b7 N. g7 q. U; [7 ]there are some memory breakpoints set (dr0 to dr3) simply by reading their
5 u2 N& A- \, Uvalue (in ring0 only). Values can be manipulated and or changed as well: T; w0 F7 i4 u% }# _* J+ i8 A
(clearing BPMs for instance)( f: O9 T7 v3 O; q- y) }( |4 @

% Q8 u, {, i1 w8 H; e1 s__________________________________________________________________________
$ B- T3 ~' L, ^% N8 Z& u% }
3 I2 i8 W0 o5 ~' L" Y+ M( }Method 11
3 T4 M) j4 B" x. l) y=========
1 g7 J9 `1 f' q* F4 f$ l/ w% ?- B7 j# j- x# z: o& d
This method is most known as 'MeltICE' because it has been freely distributed# l8 {  N' l- T# L7 r+ _8 c
via www.winfiles.com. However it was first used by NuMega people to allow
% G4 p4 N  c6 E, T2 J* O8 MSymbol Loader to check if SoftICE was active or not (the code is located# P; u2 z$ Y* |4 a
inside nmtrans.dll).
/ }0 D7 I( ^" ~1 h  N
6 E! k  {5 K8 `. c; B4 rThe way it works is very simple:6 v% w; k* _& n1 J- |$ p# M, U+ ~
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
1 j: n, s1 M3 z6 N5 Q! T$ Z7 n, lWinNT) with the CreateFileA API.9 q- I3 v; _4 \% G! a; x
" @0 w  a1 R; S1 P+ b* ^
Here is a sample (checking for 'SICE'):  ~" j  ^. e5 z6 y

! D3 ~' y. g3 T7 ?BOOL IsSoftIce95Loaded()
$ T; ^$ j6 A  }{
1 H& N' e) G( o   HANDLE hFile;  
. I* z7 F" p* p! R3 c0 {9 \' i   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
6 L8 V4 `1 z/ B* m! O: z" V                      FILE_SHARE_READ | FILE_SHARE_WRITE,2 t) t& H, M7 k  p1 C6 g- l" ^% y
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);8 F. L% |* @( b" G: j1 f  v
   if( hFile != INVALID_HANDLE_VALUE )
( g" f; ?3 q( A* c   {
; k8 V6 z! b/ y  }8 ^      CloseHandle(hFile);
2 h' v$ R( I$ a      return TRUE;
9 a8 B, G1 f; f   }
. b5 J1 K* G: A   return FALSE;
" I4 K4 x. T! H; _; D3 }' ?' L}: N) Z5 Z) R; m+ w
& X# W4 [9 ~) j) Y
Although this trick calls the CreateFileA function, don't even expect to be
0 {2 e2 i8 ^, \# E7 Nable to intercept it by installing a IFS hook: it will not work, no way!0 \! p6 C2 l0 i$ M( d3 B2 X
In fact, after the call to CreateFileA it will get through VWIN32 0x001F* D$ ~4 I& \9 z. w9 l0 ^; N
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
. ~; x0 |8 l) O1 g; \' p  q& Land then browse the DDB list until it find the VxD and its DDB_Control_Proc
3 b& o2 t! w4 k  ufield.
# l, \/ M% q( J9 b* PIn fact, its purpose is not to load/unload VxDs but only to send a " R9 g0 v0 ^; U( ~4 ?' V; \
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)  E9 ~$ ]3 X8 [' |1 R
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
6 A3 a% _6 U' t2 i3 w; g3 {( Hto load/unload a non-dynamically loadable driver such as SoftICE ;-).
  L% F; Y9 Q, ~: lIf the VxD is loaded, it will always clear eax and the Carry flag to allow
1 _  L1 E2 t( p* aits handle to be opened and then, will be detected.6 ?2 H8 y& }4 Q; v0 |0 W
You can check that simply by hooking Winice.exe control proc entry point, A; w+ {* @, t2 A, A( ]
while running MeltICE." w; I. o/ ~- {& R  ?) n  |
. m" n4 G7 {# d5 d  K* D

# `* ]$ R: A- S2 o8 u  00401067:  push      00402025    ; \\.\SICE
) v: S2 z1 F: C2 |6 A+ [+ |  0040106C:  call      CreateFileA5 X/ N( ~1 O) A- E. K
  00401071:  cmp       eax,-001% n& ]9 S6 |) C, b3 x% c+ j3 v
  00401074:  je        00401091
4 y4 N/ ~( c" f( r0 V+ H! L2 R" a0 X  m
2 S7 M$ R  P* G2 z4 S
There could be hundreds of BPX you could use to detect this trick.+ X3 e* B9 T7 h; K5 \. p9 i# a4 U
-The most classical one is:
1 T: B' f: V8 E% I9 ]4 s& t  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||  B$ y' B2 K) |3 [
    *(esp-&gt;4+4)=='NTIC'
: {9 @& A1 \' U, d
# |8 b/ z9 M5 Y' c: H-The most exotic ones (could be very slooooow :-(
# l& D$ W5 J8 y+ B0 `6 R   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
# K: L% C% W2 y0 h' f2 s     ;will break 3 times :-(
, H3 J# W; O6 B. b- _9 Q0 {, C$ `
-or (a bit) faster: 6 x1 e5 N+ u, Y, w8 v+ f
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
$ D* ~9 P$ B5 @) `7 C* Y: s4 U3 j3 a' ^
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  7 E2 F! ]: h) U; ^$ R  P4 L4 _
     ;will break 3 times :-(
* e3 _# S! C" ~+ l' _6 j( k- a4 ]
$ J& T& M' Y& y; I  M$ R-Much faster:0 Z/ R) O9 Q4 r4 y- F; \
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'$ l7 J1 }7 x5 j/ J  Z; c
- s) U  h1 f: `# `" j
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen4 b/ R% x2 ?1 u# V, V  _
function to do the same job:" c6 o$ Q) ~" `" q" F
0 Z6 b5 d3 G" _; u) C- C4 ^: V& `  C
   push    00                        ; OF_READ( t4 i! k  z! V6 Q
   mov     eax,[00656634]            ; '\\.\SICE',0  Y/ k2 Y$ [6 P: }
   push    eax
: u! _& Y) |. p' R   call    KERNEL32!_lopen$ T  Q' M5 r- k0 L, F5 t: a
   inc     eax
" d5 N$ J& P9 K! S* Q1 M   jnz     00650589                  ; detected
4 m4 }( C/ o3 E; t( s$ [" P   push    00                        ; OF_READ  Q) S( O# Z" c* C( }
   mov     eax,[00656638]            ; '\\.\SICE'
8 U6 E) Y" s3 @/ q3 M   push    eax
- ]" `1 ]! Q+ Q  P6 \. v. @   call    KERNEL32!_lopen
: `  J1 i" J: V/ a4 b   inc     eax3 I, `/ A5 y$ C; S6 Z
   jz      006505ae                  ; not detected
1 A9 x9 K" O: Q5 L5 c: J  f/ q& g3 Y8 s8 q$ K/ h1 {; Q  q' G

/ s: |2 x2 }2 L$ G: ?7 q" j__________________________________________________________________________
) J' Q" |. r. I! I" a+ q* I# E  g  O; t3 [7 Z$ G1 v* q
Method 12
3 ]- _; u6 l6 b# r% o=========' m" x( [/ K( `4 T

1 @4 |2 ?9 g# rThis trick is similar to int41h/4fh Debugger installation check (code 05: |& K/ n. q& l" H) ~( F6 p
&amp; 06) but very limited because it's only available for Win95/98 (not NT)
9 i" Q1 G8 W* @, x+ F7 X" q% s! [as it uses the VxDCall backdoor. This detection was found in Bleem Demo.- L1 I/ s; m& Y* K" A- V+ S
7 @9 y* u; p3 c% z( @
   push  0000004fh         ; function 4fh
" {+ f" m& A' R( g7 p4 V/ e- ^   push  002a002ah         ; high word specifies which VxD (VWIN32)
. f) }8 {9 _4 u* ]' Z9 u8 q4 `                           ; low word specifies which service
, |7 F3 H4 [$ M+ @' i& _                             (VWIN32_Int41Dispatch)2 j  z; D: f/ Y& |% _, [' F$ c
   call  Kernel32!ORD_001  ; VxdCall
  H. Z& L2 D; J4 N* B( W   cmp   ax, 0f386h        ; magic number returned by system debuggers
5 G+ A9 O7 m0 U+ e0 }   jz    SoftICE_detected
0 b. a2 w# A" X$ E* ^; l
7 e+ b6 Q9 l6 w# l1 B; u8 I: q' wHere again, several ways to detect it:
9 _# H  v5 z  O8 L
& ]/ `. q0 ~. B+ J+ s' _/ K, w% \    BPINT 41 if ax==4f7 s# n7 s, V9 ?! s& C
: F% t) r& a& X0 K) f: Y2 N8 @
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
9 r: Y! V" b' _( ]) k0 {" _8 L
9 q* C4 e6 c2 U9 z: U2 H' l  Q    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
+ o0 D# L9 R+ G% K/ }: F. f( u4 B( n0 U$ Y" }
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!% n3 f- Y% c5 L2 f

% l7 }2 [- {: X& r3 I/ t  ?__________________________________________________________________________
: Y( x5 W6 B, O! Y7 ~/ o+ w4 s1 X" u2 ?3 m* Y/ E$ I
Method 13
7 C. W3 l. X. C; k+ I2 e# H7 F2 `3 V=========5 {( o4 h0 d2 X7 X" f$ W
+ D) ~# M2 A& ^6 F
Not a real method of detection, but a good way to know if SoftICE is% v& R- |' U+ P$ T& g
installed on a computer and to locate its installation directory.  U. T7 G1 a. {9 `" @
It is used by few softs which access the following registry keys (usually #2) :
7 Y* d% u) K' Z! U( |( L" X; x# z! I* ?6 e) ]4 ]
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
' E- \1 r# m( O\Uninstall\SoftICE
4 M) o  o2 g- n0 n. q# t-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE: B/ c8 S) c+ J
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
# I+ x# h8 |4 I( k- i4 Y. c' Z) X4 J\App Paths\Loader32.Exe: J9 u" G8 S% m5 y
3 p6 ?3 C! w( J0 n, v- P% q
3 \- v1 V: S; `  c! U
Note that some nasty apps could then erase all files from SoftICE directory/ H. \# F7 P0 q' i. `1 g
(I faced that once :-(
0 |' j) L. ?0 r( M3 a! o- l/ m" G3 S, `5 c1 b1 _8 D( Z4 j
Useful breakpoint to detect it:4 q) r% d6 ~* y1 n
* h# b7 X4 Z, c$ K2 Y& ?
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
. z' ]9 R; h) A8 v# D! V( p: ]# Z7 D% z* S! D
__________________________________________________________________________
6 ?- P4 A: ?/ ^" h7 ]# i2 T# p1 K' i5 V. X1 @3 [3 h7 f! s* i
2 `$ I, L9 s( Y$ ]
Method 14 7 E' l+ w" i; t+ X, N8 Y
=========5 M7 j$ R) T$ t3 G

0 u3 U- [+ H& F7 T* O# j: @A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
2 N* V* V4 e3 v, ~4 his to determines whether a debugger is running on your system (ring0 only).4 K5 S) W* V  X

' Y3 `" K8 n; a   VMMCall Test_Debug_Installed' }5 D! b( E0 K' x. E5 x
   je      not_installed" H6 ?! Z! {. y2 l/ g0 R0 ^. w  a

; G) _( p+ y3 rThis service just checks a flag.2 n# g8 I6 s2 x7 ]0 s0 A, u
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部