About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>" d3 i: R% d+ i
<TBODY>
8 a  U, l7 e' F$ V% K0 q9 X3 {<TR>, c' u, U: b8 S: I* j
<TD><PRE>Method 01 5 [) o: j7 D  H
=========1 l6 F2 R9 D! k' Q0 Q# c
3 E! y" @# w5 N. h/ p4 h) G* p, D
This method of detection of SoftICE (as well as the following one) is
/ Q# f& D9 ^, C" c2 P( eused by the majority of packers/encryptors found on Internet., B# p. `$ P+ \3 C! e
It seeks the signature of BoundsChecker in SoftICE
7 T1 A0 D# ~! \) c, U% C
; Z  ]* Q/ x( k5 ]7 \) |7 T    mov     ebp, 04243484Bh        ; 'BCHK'
! I3 b2 c! g4 t. L. `    mov     ax, 04h
) ^# Y: M6 d! j$ O) N2 A    int     3      
1 q3 x: {/ t. X7 S' M3 Q    cmp     al,44 S/ e3 O: m  @  U* \) o) E
    jnz     SoftICE_Detected! D" T  x1 J3 Y  W% D( F, l

0 `, T- U* R, y  |) V: P2 C___________________________________________________________________________
+ G# l5 h$ n( P; S. Z7 I$ n  ], A) }9 Y- {7 p
Method 020 a( g- ~/ d% Y; l
=========
0 B( |; b4 k# K6 f) w. S4 o% ]
# K: d3 J( {; m( Z3 o- {' N5 G( dStill a method very much used (perhaps the most frequent one).  It is used
; F4 q% T' V) v! I# Sto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
! Z  }6 Y* N4 U; @or execute SoftICE commands...
3 @- d# c& s1 a! l* FIt is also used to crash SoftICE and to force it to execute any commands
$ X) T5 S: J  |( i& F(HBOOT...) :-((  ) @; ?; _/ r& v' Y; R: ~+ W
; R3 a/ m& n9 Z. `4 u5 i
Here is a quick description:
) Q8 w) }& f5 S) f* k  V-AX = 0910h   (Display string in SIce windows), m! o7 r( A5 x8 _
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
; D& w4 Y$ G; |* F. ^2 a3 P+ |1 m-AX = 0912h   (Get breakpoint infos)2 h/ b- B* ~; U( M; S; u9 R5 @, T
-AX = 0913h   (Set Sice breakpoints)
8 E+ J4 X% D4 y5 N: ^3 H-AX = 0914h   (Remove SIce breakoints)
0 j# D* s* ^- E9 Q2 D( J- g% M7 Q& R0 i' n/ k; B4 m& h6 W+ W
Each time you'll meet this trick, you'll see:
3 @- B/ r- P# y  d+ N; A1 ?! C6 w" P-SI = 4647h
, x/ _! v9 |7 E; r+ f-DI = 4A4Dh* ~) f+ m( ~( m5 c
Which are the 'magic values' used by SoftIce.
' b! n: {  j! s( l1 g# j3 l/ TFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.* I+ l& E" W$ C7 V
( }" o4 M- D- b; @; Y
Here is one example from the file "Haspinst.exe" which is the dongle HASP
* s! K7 K& w7 U( Y  n% B# U# uEnvelope utility use to protect DOS applications:
$ `$ b+ d# `' J8 _6 I6 p3 O
& c; y7 g, t  u( s
. J, e2 q  Y  o. f8 B4C19:0095   MOV    AX,0911  ; execute command.
- X' p: B4 ]; ~2 a4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).9 h3 J# D" W4 X4 L% @: G6 H( G% r
4C19:009A   MOV    SI,4647  ; 1st magic value.* {* T, ^- a7 C" v( I5 w
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
# p  o, R0 O" p  y4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)9 U- \7 A$ q# V8 b9 y) D
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute8 k3 O  L! C; D2 E3 r
4C19:00A4   INC    CX
. ~* }  Q+ l7 m( D  p& Y7 ?& N* y4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute: U1 w" f- U+ o" n" ~9 y6 ?1 s
4C19:00A8   JB     0095     ; 6 different commands.
' B3 H# l: v( k& Z( ]& N3 g4C19:00AA   JMP    0002     ; Bad_Guy jmp back.+ m4 f# Q( X3 x7 u# ~  H  G
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)" Q" A* Y) y2 ^9 k

! C( g9 G9 G* I) Q: FThe program will execute 6 different SIce commands located at ds:dx, which
; A* V* f- V: P/ xare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.( j5 D" w" z/ n* K- r+ e
# v8 \" Z5 ]1 {; @# j: e9 R" e
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
8 b+ R5 `/ U6 p  d4 @7 \( A) D___________________________________________________________________________. Q1 g0 {; t" D" T+ Z6 S" j

0 \% B0 K+ J; W. S* e
' Q' e; j! |4 KMethod 03& G. Z8 J/ F* S. ?. A
=========
, d% M, |0 x- [$ o2 ~( y9 d4 i! L
+ T8 }& s" D; I6 b" d) `Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
# A  p% v$ p  k4 B(API Get entry point)
4 F7 W& e: h4 M, a# _  u, o( ]: l        
* P/ ]: ?; \) D! d% _2 u9 M: {0 r9 t, r( b8 T
    xor     di,di
* ]4 j/ u! o8 Z- v    mov     es,di: S. G) F( ]0 k6 Y
    mov     ax, 1684h      
; m& D; ~1 e& f; \9 R    mov     bx, 0202h       ; VxD ID of winice
# v$ T9 n; \& d5 t) G    int     2Fh
6 w) f& ]4 b* t, M* x9 w    mov     ax, es          ; ES:DI -&gt; VxD API entry point9 Z9 W' w% p+ D
    add     ax, di' R# U! Z9 R7 L3 D
    test    ax,ax
+ A, Y$ h1 `& R: H5 e: j    jnz     SoftICE_Detected4 s" d2 G: q* K0 }

$ w; m2 {; ~8 T. F% h4 y( \' h! G) ^___________________________________________________________________________
' _# u7 {, b- f% b7 P7 K: Q
: H$ v$ G6 j0 u3 S. }2 vMethod 04
+ J6 M& e3 ?; S% K2 f% }=========
5 {/ {% y& k2 q" T& K- A4 z$ Y0 k! j0 X' d8 d, r( M* t
Method identical to the preceding one except that it seeks the ID of SoftICE6 j* g" `( A0 M/ a, I5 l
GFX VxD.; s1 o0 `% F( L% ^5 r  T
7 D$ R/ X1 E7 @4 t$ q5 s
    xor     di,di
. y, G& F$ h8 G% N( I! y' U    mov     es,di, z: P) r/ e1 c. m) {- h% l
    mov     ax, 1684h      
* W5 a) e" K# N' b3 ?& N    mov     bx, 7a5Fh       ; VxD ID of SIWVID) s- W# r% Z3 e! U6 e* ~! M, L
    int     2fh" y. R- b! O  Y: ^9 T, c7 S
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
8 ~8 C& j; w/ \  ~5 z    add     ax, di1 Z$ C7 A0 u; f1 n6 a; s% w5 w
    test    ax,ax
3 k' f" Z. a; C$ E6 [% H9 [    jnz     SoftICE_Detected
6 ?) K% w2 H- G* I, O+ M: U/ [$ k
$ l! w$ D3 z" [( k$ ^__________________________________________________________________________
. y* ?5 I8 F8 `' j- p& i
1 s& z8 d1 ^$ F) w8 E# \
* j/ s! N- `0 v5 S) [8 PMethod 05( Z) Q& V+ T9 U4 H9 B/ M
=========) k: O* j. }4 u

: O4 J# K; L6 N$ A1 A' t( wMethod seeking the 'magic number' 0F386h returned (in ax) by all system
6 p, j1 f) L2 L/ g6 T4 i, tdebugger. It calls the int 41h, function 4Fh.
/ C& ?! b$ o" S& Z8 t7 ]$ VThere are several alternatives.  
8 P2 q  B9 _& \0 v) T' f
$ U6 q" ~9 d2 |. G2 p5 S2 JThe following one is the simplest:
" j. e6 \) n  }4 u: u9 x
) `5 x# K. ?% h9 H8 ^% n) u    mov     ax,4fh
# A8 B1 e# J) P/ q    int     41h# j1 v% ^2 c* l- K7 F% \- f
    cmp     ax, 0F386( w# n$ \# q2 F" {8 j; Z+ O- [1 I
    jz      SoftICE_detected$ L% a+ D# i/ L; W
* u6 \" W3 J+ I! f: C+ A
3 v% @5 n6 I" U( p
Next method as well as the following one are 2 examples from Stone's # a: p& K! i  `2 F5 X
"stn-wid.zip" (www.cracking.net):# o8 u# t' r& Z1 q. |

+ S! \  ?( C5 m, |  f, ^    mov     bx, cs
; j3 ]  D! Y* M9 Z/ [    lea     dx, int41handler2' L$ e8 _4 A9 `' e- R
    xchg    dx, es:[41h*4]
- R9 ^0 |+ N! ]' N5 a; Q; s    xchg    bx, es:[41h*4+2]
8 Q! x1 B3 @: h+ M4 Q    mov     ax,4fh
( V6 K& J# Q& p* w$ Z    int     41h6 m  Y1 E1 V9 T" z: Y
    xchg    dx, es:[41h*4]
$ q; |9 Z( ]8 u1 ]7 L    xchg    bx, es:[41h*4+2]) i& O: D+ \( T- I+ E8 }
    cmp     ax, 0f386h
3 L, S$ R5 g6 Y) r. x. v( }    jz      SoftICE_detected
" {& G1 ^# m; t5 h" J% u1 T+ n5 Q5 k7 \  t/ c8 L' v5 B
int41handler2 PROC" R; ?& A8 S6 J" V: V
    iret6 a( C0 J% s& I0 y& B& N1 F% y' C
int41handler2 ENDP! a, p& e' Y7 J( w. g

' U! T$ U( E; T7 {/ y: B% s3 l2 D3 N; o. \, y
_________________________________________________________________________
7 }$ @6 N7 k& x" }9 t; J# J
/ J- V! n% s+ i  S6 o' {( ^/ D3 q+ A) @0 y4 ?- H, M9 w& U  ~
Method 06& g7 k: _  J( U) W1 a9 P0 K" E4 {
=========
6 j  m0 E( Y1 A6 Z: ^7 N1 p# b  ^* _8 H, p/ ^7 X  S* C

$ ]/ ]) U: _+ A% ^/ I2nd method similar to the preceding one but more difficult to detect:% m! X3 `* @) c8 N
* m. P: o5 c4 u2 u

# z; _) Y1 A) z  yint41handler PROC
1 U2 D  f+ n/ b2 \) @) o    mov     cl,al% ^  @3 m6 t3 h' N9 X/ F* k& {
    iret0 N4 y( j- `. r1 h" g1 H& Z
int41handler ENDP8 O$ q4 ?0 U# A8 \2 t5 W

+ Z! B# L( B" z) z0 S
; R( \) }1 Q; t) T    xor     ax,ax  F6 n- [6 k5 N+ ~* c
    mov     es,ax6 o4 Y/ ], C$ N5 U- ?
    mov     bx, cs( j# a! G( A6 L' k6 k! J
    lea     dx, int41handler
. f; m3 ]' Z+ N, N: k& |- w+ z    xchg    dx, es:[41h*4]+ z- L+ ^# }: K2 T+ _+ q
    xchg    bx, es:[41h*4+2]  x+ D2 s3 i0 l4 T! W9 ^$ N
    in      al, 40h3 p5 d2 G9 i5 M* u1 G0 D* H
    xor     cx,cx
( J2 w, @/ D8 ^! k5 c9 N3 o    int     41h
: x5 I/ ]3 C5 b. [3 ?    xchg    dx, es:[41h*4]) l8 }0 o0 R% C* y
    xchg    bx, es:[41h*4+2]5 ?: B4 m. \2 \
    cmp     cl,al# L0 a& f1 `5 I5 G* }
    jnz     SoftICE_detected3 c) `8 _# l2 R7 R' i

' ~; Z2 t9 Q5 m7 N2 k7 ?* C. s: r_________________________________________________________________________
; R( q* `, B$ {& a( U6 D4 E& O- m+ B! N% V6 c! F
Method 07
% I9 X; R4 }! l5 {1 l6 U=========
' F; P4 Z0 i9 h" Z$ k* T$ j3 n
, @6 X1 `2 f$ p; L$ F2 Z: n! `Method of detection of the WinICE handler in the int68h (V86). E; i$ _0 ^! J2 s, H0 S! f
) f  |; o2 _+ K" q& B" G) s9 G
    mov     ah,43h
1 {- r/ L' q2 W) l/ z    int     68h
5 g, S: S; p4 l* t9 O- D3 s    cmp     ax,0F386h
! V6 I* ^; M+ U+ a$ @1 A0 _' n8 @    jz      SoftICE_Detected# L( j/ F6 A; Y% [8 H# M

+ B/ i" w" j3 ^8 y
% a* N/ {) N" ?3 A6 e4 g=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit$ K# A- F6 Z3 K+ y5 ?3 R
   app like this:
+ Q  f) d' l+ J1 @: `0 o7 q3 C8 i& K4 l: r" v& ^
   BPX exec_int if ax==68+ H+ ^7 f6 Z4 j1 X6 R9 ~
   (function called is located at byte ptr [ebp+1Dh] and client eip is
$ i0 \% W3 \+ J- D   located at [ebp+48h] for 32Bit apps)
  n$ F; g9 |$ B* k3 r__________________________________________________________________________
8 B: K, s, v' N" m; _0 ^( L, T* W. S6 ]# q

6 \4 c5 g+ Q8 E0 oMethod 089 H; {; P+ ^3 q) X3 k$ G9 R* B
=========
' b7 H/ T; O7 W1 E- K7 T3 s1 I7 {! O5 J. r
It is not a method of detection of SoftICE but a possibility to crash the
% p- _2 ~  W7 t  nsystem by intercepting int 01h and int 03h and redirecting them to another: h! w6 d8 k' d' m4 ^
routine.  s+ k! g! Y# q4 `( r2 S5 x
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
/ N' v& C) A5 ^) B. S# gto the new routine to execute (hangs computer...)" T) b% c' `6 G6 B+ u3 _, q
0 O- P) F  L4 g6 A4 A
    mov     ah, 25h5 @6 E" i4 B$ `; T# g; a) a4 o
    mov     al, Int_Number (01h or 03h)
0 a% Z9 M' a* n9 |    mov     dx, offset New_Int_Routine2 m" y: Z" G! t: {
    int     21h
; M0 P1 U9 H0 f3 ]  b* q; J+ S% z
__________________________________________________________________________
# t* F( ?; J; o' f4 x, I5 n/ Q/ @7 n
Method 09+ R& Y- B0 [' `' \% K& {
=========2 Y! i, N: a5 d- q8 L8 v4 q

1 m6 X0 L' z  Q& r3 s) |This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only: G9 v, V; ?$ p/ T
performed in ring0 (VxD or a ring3 app using the VxdCall).
- Q/ f/ Z2 h! K8 q) sThe Get_DDB service is used to determine whether or not a VxD is installed+ [0 |. {, h( f$ v& Z
for the specified device and returns a Device Description Block (in ecx) for
/ h6 Y0 S$ }  K  d: k% M! cthat device if it is installed.
5 P0 E( \# i+ b0 U: j( E% ]/ }3 O. `! {" s* J; n
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID$ L! X* [) B! ^' T4 g) x
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)* Y3 C" A; P0 x8 r0 O
   VMMCall Get_DDB$ b' o( n( s3 C: ~
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed* k( I8 N: F1 J0 s2 v# O
* b+ R1 H. \" p
Note as well that you can easily detect this method with SoftICE:" S: m, ?9 y  D$ [1 ]; m" M6 W
   bpx Get_DDB if ax==0202 || ax==7a5fh5 B5 l( E. I4 w6 z3 i. ~

% L1 s9 E7 n, G9 m__________________________________________________________________________7 P- i# I' K$ u

; F5 l/ n" E7 {: G! n8 HMethod 10
. W/ G; L+ a, W' w9 I=========$ ~- l; Y3 K8 [
; C0 z9 g& X* ~/ [/ x
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
; V. i' c# i, g- J! J( n  SoftICE while the option is enable!!+ p0 b' O! `1 _" ^5 e  s" l1 W; H
% p9 J! @' G( J8 ]6 u- ]  X
This trick is very efficient:& A: S7 Q1 q2 v
by checking the Debug Registers, you can detect if SoftICE is loaded
' X* E( ^+ \8 d$ q! e(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if8 `& u8 ?5 ]% k* s" W
there are some memory breakpoints set (dr0 to dr3) simply by reading their8 E0 l; H: f- X8 F; f; u1 G# x
value (in ring0 only). Values can be manipulated and or changed as well' [/ P' P& \! ?  I: N3 P
(clearing BPMs for instance)# h+ j8 o( q2 _

8 a2 k8 L7 [& n" R7 b. }/ @__________________________________________________________________________# q1 ^. k% c( y8 \* w  a6 I

1 i( V; t& i4 N, ]3 ZMethod 11: ]; V- L  r! A2 h
=========
* M. X$ j- v3 ^% I+ h7 p: a& ~  _6 ^
This method is most known as 'MeltICE' because it has been freely distributed0 f; C, s' _: }2 |- E0 D! s, g1 @
via www.winfiles.com. However it was first used by NuMega people to allow, I7 m% l9 ]/ H! R0 Q
Symbol Loader to check if SoftICE was active or not (the code is located0 m6 O# o" Z4 c7 s) t& _! A- t
inside nmtrans.dll).2 a) Q- G3 @: [4 T

' ^5 H, Q. Z2 h  X$ ]The way it works is very simple:
( V/ @: M0 s, b4 ^It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for& M2 q2 w% X3 G- g0 K% e2 f9 k
WinNT) with the CreateFileA API.$ ~* ^5 }, ~  B9 w! V
4 N2 n/ h' W) `* y4 u5 u
Here is a sample (checking for 'SICE'):4 d; }4 \  W5 `3 i3 B
" J- A+ ?  q+ b% x$ M8 j
BOOL IsSoftIce95Loaded()
$ {$ r& ~0 W4 f) n: ^4 |{: N& K8 B& H- S1 N; i2 }9 A% s
   HANDLE hFile;  
/ |) {4 q0 i: W: U  n   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,. X$ K2 v% N( n0 [* B6 i, F
                      FILE_SHARE_READ | FILE_SHARE_WRITE,
: Q  k" T7 H2 C                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);3 M0 P* f5 k: R2 k+ v7 R0 s
   if( hFile != INVALID_HANDLE_VALUE )
: n7 l. ?$ `( p& p% v$ W# J/ X. v   {
! q9 O, F- K* I1 V7 i" R3 t$ G. g      CloseHandle(hFile);
1 u2 D7 w4 u/ F  O  n" F( s      return TRUE;) M% w. |! {: t+ \* f+ w/ k
   }; q( G8 b7 [. ?8 ?& r
   return FALSE;# [# N; H2 _* F2 Y4 b
}
* \; g- I4 p) n- p
. F+ W: z; A$ Y" E) N0 W( SAlthough this trick calls the CreateFileA function, don't even expect to be
- ^  K; K3 V2 x6 c& u/ lable to intercept it by installing a IFS hook: it will not work, no way!
0 @+ o0 S: U/ x( B8 p4 AIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
; V; |0 D5 p& m4 }$ u: u4 Wservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
* G, A) ^# r( T5 Z: l/ p4 K/ fand then browse the DDB list until it find the VxD and its DDB_Control_Proc
, a1 D  r2 D  A2 k( t, nfield.
$ S+ b  N0 x: wIn fact, its purpose is not to load/unload VxDs but only to send a
( S8 l" h3 h. R: r# W+ TW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)% R& o/ ~, K) v1 [
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
' M1 x; T& i+ V! |4 N+ b6 Mto load/unload a non-dynamically loadable driver such as SoftICE ;-).
$ c- I5 x/ Q6 x0 K$ v8 i+ _5 {% r! zIf the VxD is loaded, it will always clear eax and the Carry flag to allow
; k0 R" u* t  Z, F# n: r% x3 Kits handle to be opened and then, will be detected.
- p/ C1 t# T! ~9 s( o/ WYou can check that simply by hooking Winice.exe control proc entry point& P9 g9 f3 v+ A$ y
while running MeltICE.% W' a* b$ h% W) ~, m
  O* v5 o: c3 W  P& E  `1 d4 G3 `
/ d6 X* W' }4 `/ R( }/ Z
  00401067:  push      00402025    ; \\.\SICE
2 J1 E+ d: g  x3 D4 c) ^  S  g( i  0040106C:  call      CreateFileA
' K: m7 A; ~0 U8 q& q, ^. S' Z9 m  00401071:  cmp       eax,-001
/ N7 {4 [% ?7 O4 B& \, V) l: h. A  00401074:  je        00401091& f  C- I9 a3 B) A

" c7 i) F& z$ y! [7 \. y- ]5 z" O/ S! L" |
There could be hundreds of BPX you could use to detect this trick.- i+ s. {$ W) W" h# S- \5 b
-The most classical one is:( h, y% M, b1 o' j
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||* h5 w% R( _: @1 K  q! m2 U
    *(esp-&gt;4+4)=='NTIC'
& T; D" c- U% Y8 {; Y% b5 ^+ Z' F
/ g8 i( S0 t' k7 n2 `-The most exotic ones (could be very slooooow :-(/ A4 L1 u2 u+ S4 v
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
  p# A1 d" h3 ?( X. D: i. v! f     ;will break 3 times :-(; {  A# ]4 b, ]

3 A6 O; Z+ s& V0 K3 n6 Y% U-or (a bit) faster: 6 U6 |/ [0 B" U! R. e. y
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')* X5 Y7 |/ Q  Q: q* S& E5 V
) [$ H) B9 q& N: o  }
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  $ Q$ y% S% [2 _+ X. l, x
     ;will break 3 times :-(
6 ~5 \+ j+ o7 |9 y: D( Z) q5 f6 D% w: H) Z' _  t3 X6 Y
-Much faster:3 L- g. c6 v# a- a  J4 j
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
! s) \) W( I. A% `8 V% m! i
! k8 Y5 L& f/ ~9 J/ JNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
, n9 r6 Y7 G. Y6 p% J; bfunction to do the same job:
4 q  ]4 M) C  j) `  n  [5 u) d' W' s4 X( B, I
   push    00                        ; OF_READ
3 M5 F# Z2 p+ r$ ^% j* D   mov     eax,[00656634]            ; '\\.\SICE',0
* f* O) i+ @5 s! |0 E7 F   push    eax; w! A! `- @9 [1 Y$ t# x4 E
   call    KERNEL32!_lopen
5 @; ]$ I+ U" V. a) m" ~   inc     eax
4 X. v6 N' e4 H0 K   jnz     00650589                  ; detected
  v- O! i( R( s4 B2 e7 R   push    00                        ; OF_READ
/ ^+ `( o' }0 h( k& i   mov     eax,[00656638]            ; '\\.\SICE'6 |6 @0 u2 G/ l& _! E
   push    eax2 a$ @3 q) ~5 m3 v$ R
   call    KERNEL32!_lopen0 D0 |3 u# J" q
   inc     eax6 N9 W3 P  g) T! w6 B$ c
   jz      006505ae                  ; not detected! z1 G" X! p: u( W* a) _
  _8 s7 @& d; s8 J
* l& a9 z7 U/ \! H$ d
__________________________________________________________________________
# d" z1 u# \6 L) i1 i. ?9 T9 s  C! k# s$ f# @+ ?1 k1 J( U; y
Method 129 [# N* ], }% m1 u8 F  W( s* V- d
=========
* C1 k. I+ A% T% G' K1 @
9 o* Y0 M/ L# A* T$ t. U8 _This trick is similar to int41h/4fh Debugger installation check (code 053 k+ ^8 \' W) U& n
&amp; 06) but very limited because it's only available for Win95/98 (not NT): |4 t6 O: V$ w" K; c
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.% |9 ~# l- V$ v6 u) W4 @/ C. w. m
* l8 v, x% X& q, r# V# n: ?3 `
   push  0000004fh         ; function 4fh
7 v" Q, g6 t% A7 f, G# U   push  002a002ah         ; high word specifies which VxD (VWIN32)/ R5 \6 _/ m' N- l3 e
                           ; low word specifies which service2 V& H, j4 u0 g: o& ^
                             (VWIN32_Int41Dispatch)) V. u0 g; z3 K- E% F  u4 a5 B
   call  Kernel32!ORD_001  ; VxdCall" t2 ]  a3 a: H; b9 r
   cmp   ax, 0f386h        ; magic number returned by system debuggers
* m8 ^, `) s* `; h+ N; z   jz    SoftICE_detected
$ P, h( ^  p: j$ |, ?- ^+ e: W; `% \8 O! L1 J( z* |
Here again, several ways to detect it:
# L3 Y  y; u! l
& g7 f$ F$ S+ K) G9 K" D    BPINT 41 if ax==4f$ _$ M' l( M, o  d9 K3 B% q7 g
' r/ m3 S' [. D' j
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one4 n% k& d2 j2 r6 z8 q
9 H/ m' y( f1 n& t5 @" s) S
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A/ r5 t3 e+ k% i  N  J, h5 a% U
/ B) b0 @8 n  s! o% z# b' W0 @+ l
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
1 n9 r/ e( [' G' z. j  U: a8 q
( k8 m& K8 R  X3 ~5 z__________________________________________________________________________
5 c6 G' u& ?  v4 l& `1 T0 ]/ I# F7 w" c
Method 13" A5 t& h$ L( u6 Y, d1 O- T
=========" L6 w! M2 T4 o; J( m9 f
/ K3 N% W. v) v5 F: z
Not a real method of detection, but a good way to know if SoftICE is7 G. y' `5 P2 l8 p8 d7 [' q( v
installed on a computer and to locate its installation directory.
0 M! [3 p  a: h  c! q! I/ ?It is used by few softs which access the following registry keys (usually #2) :' o2 `$ O( k: `  V. ~& H2 z

3 K9 s( T. f1 K-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion' L$ Q8 j0 p, `: l# W
\Uninstall\SoftICE
. a' e0 Z( H- u; O-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
! W# [1 [: d+ ?' R-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion- n4 `. o8 h8 }9 h# V! p8 Z1 V
\App Paths\Loader32.Exe
# C/ I* l. R8 d+ e# A
0 Z* L6 a) {4 b3 @
, S' G" o- b, U, H, RNote that some nasty apps could then erase all files from SoftICE directory
. C7 e: t" I8 H+ U3 N(I faced that once :-(
! Z6 h7 g9 C3 h5 O  P
6 p# T& u; b8 h( H9 D  bUseful breakpoint to detect it:. E) T9 t' @+ b( g# ?
2 k. |2 Y9 M6 m  S
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'5 r- u7 X6 b) b/ j

' f7 a; R3 z! {" @__________________________________________________________________________
8 J, U) L1 W# C1 ~5 B
; U$ O9 p! s) z9 u
" D9 ^0 e- n5 a3 G  MMethod 14 * d. k3 W3 f5 S9 D7 x5 U, C2 b
=========
* N/ h( V& z4 {0 N$ {% F8 u# i
# c2 e$ M; K- g5 U, SA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
0 U( F* u* ]+ bis to determines whether a debugger is running on your system (ring0 only).
- Z( e4 R) C' S8 E8 _  Q9 Z; g5 g+ |" v# L6 h1 R. w
   VMMCall Test_Debug_Installed3 y! D( ?2 v8 v+ K6 W
   je      not_installed& v, h2 u2 u- V5 _# Z

) P; ^4 z0 l! h3 [1 M9 h7 bThis service just checks a flag.
# W3 T( x$ r! E</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部