About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
1 ]6 A: a9 I9 X3 n7 v<TBODY>
0 G) j- `3 N* e; I1 |& Y3 E2 F<TR>% K* ]  J# r9 ]2 @' c, S' |
<TD><PRE>Method 01 1 a" n# Y# N7 `, p
=========
& c: }% |2 N: {2 b: P6 a+ F; ]0 y( b# z1 p" e' {1 S7 w
This method of detection of SoftICE (as well as the following one) is
8 y' @/ g7 I5 I. Dused by the majority of packers/encryptors found on Internet.% Y" B. i3 i' }% a- W7 T
It seeks the signature of BoundsChecker in SoftICE5 |$ K2 ]& L, d+ |0 k
" x! R# H! O# P  d
    mov     ebp, 04243484Bh        ; 'BCHK'
: {- u# @( _7 X) Z* n1 \( J    mov     ax, 04h# h! I" G2 p' z- `$ E
    int     3       4 N" ?6 Q" |6 ^$ N
    cmp     al,4; k& T+ R& b/ I  }$ T1 p& {" q
    jnz     SoftICE_Detected/ M( |' n. T# f9 @; ?% c' ^
4 u8 O) v2 W" B7 `; s  Z
___________________________________________________________________________
  F0 i; F% M5 b# \- P5 Q# A( W* V/ }/ o% l
Method 02
& }9 \6 Y! ~) N0 n, s; B8 U=========
% m. I! Z% ^; ^: P5 L3 E' [
& D4 @2 G4 b/ `* V8 @$ [" N- C" wStill a method very much used (perhaps the most frequent one).  It is used1 \/ Z- `2 G9 [6 G* j% V7 A" M* s
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
5 W. i7 z9 I: R7 \9 U/ O( Kor execute SoftICE commands...
9 M+ L1 _; a8 l$ X3 K! m5 RIt is also used to crash SoftICE and to force it to execute any commands
3 s9 R" m( @" p& _) V& }(HBOOT...) :-((  
$ A$ c4 A) U7 D7 S% H" K5 K  O% |! ~2 R4 L' q
Here is a quick description:5 O4 v7 l3 |4 X" B; V
-AX = 0910h   (Display string in SIce windows)3 k1 b$ Z9 ]( d9 L3 `  G
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
/ P: W/ g" A# z: _3 u& ?! W/ G7 a-AX = 0912h   (Get breakpoint infos): N' @2 {0 j( o2 W5 ~
-AX = 0913h   (Set Sice breakpoints)* p' p) j# t6 X$ l( q
-AX = 0914h   (Remove SIce breakoints)
4 c/ A% E3 y( p. {
4 {  o% e2 r9 b# |Each time you'll meet this trick, you'll see:
7 [/ R2 v% T" E' {. }-SI = 4647h
4 `) J! ?. b& d) u5 L-DI = 4A4Dh: x& e% d: o" e  O$ j3 B% \2 Q
Which are the 'magic values' used by SoftIce.8 L0 {8 G! p5 e0 {
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
9 J2 A' s5 t0 E
8 {& z* n5 e/ q5 r) cHere is one example from the file "Haspinst.exe" which is the dongle HASP
! }! k, k& i9 pEnvelope utility use to protect DOS applications:
6 z4 t! B; ^6 ^5 ^7 Z+ C/ ^- N  `, d

; l1 e( G& r6 n( n0 q4C19:0095   MOV    AX,0911  ; execute command.2 e8 \7 N! I( @+ l: Z5 l) b4 ?
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).) |1 i6 z. a5 l. O+ I
4C19:009A   MOV    SI,4647  ; 1st magic value.
1 X! m$ `$ G( V$ n) N8 s, A! D4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
. {$ D$ ]7 Q/ H5 S. b5 J0 {6 C4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)4 i& X9 b9 `$ L2 t6 f% f" R3 ~
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
) V7 x. J% X2 h9 T! Z4C19:00A4   INC    CX
" [3 j1 k1 T  ^. Q' x+ Y* n& M4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute5 x0 @7 Y5 N0 k) g
4C19:00A8   JB     0095     ; 6 different commands.( [. U: M4 E; c( p9 A3 s
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.# E1 p2 Q9 D9 Z9 c" `
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
3 ]$ {/ X5 y! p( [0 z/ d, o
: `0 y/ j- k/ IThe program will execute 6 different SIce commands located at ds:dx, which$ m8 g: c- e# U; o* f7 d% [- D3 Q
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.5 w8 C1 _/ Z0 A& E  c, Y  G

" ?* R/ R' s0 e( Y* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.5 y  u3 `/ t: ~& M
___________________________________________________________________________" Y- z# T% B& s; Z

# v; f, d; A+ t: a( |
" D# s$ t  y) W5 A' \2 h8 N* BMethod 038 {9 x( E. J8 |2 f! ^  s
=========
3 T; n5 [! A2 Q3 r% L
  a4 |, i0 h) m( ?7 DLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h0 W& d. a: h/ p$ H1 j2 d& b
(API Get entry point)
9 j( a1 O8 b# ?1 R7 _        
& R, y6 O+ ~9 i* c
* t9 O# ^5 h$ ~- O: o9 V    xor     di,di
+ g3 W# R: M3 Q    mov     es,di
6 d! }- J  W; l1 m, Z2 ^# y    mov     ax, 1684h      
& U) |/ m' w6 u3 w    mov     bx, 0202h       ; VxD ID of winice
6 \/ I4 B' J; C; w3 Q, p; z" d" I9 r    int     2Fh
+ L2 `: G0 {! x9 z" j    mov     ax, es          ; ES:DI -&gt; VxD API entry point
; l& C4 u6 [9 e  P( `* t0 R4 z    add     ax, di
* l" W5 \5 e% I: h    test    ax,ax/ Q4 D" U7 F4 k
    jnz     SoftICE_Detected
4 M! t$ S6 f. c. F' |- K# H
  f+ h5 Q- j8 E; B; ^2 s0 ]___________________________________________________________________________
2 @1 i) }, e2 r  I  L# J) t5 M: a/ G4 \: R
Method 04
2 N( h. |7 U; ^& Y3 C0 m2 ^=========
% ~1 I( b  W1 R0 g. l, u  u9 O8 i3 e
Method identical to the preceding one except that it seeks the ID of SoftICE& v1 G& L9 W8 M( F4 j6 O4 u
GFX VxD.
8 u1 _' c) b6 }5 ^7 U9 i% W! w- x; u: A# c- s4 t$ _; M
    xor     di,di
( }* R) H1 B) w1 v( v/ O0 f1 _    mov     es,di
+ G3 u) Q, R' x& P    mov     ax, 1684h      
8 `9 G6 a/ y! H- e' _" f    mov     bx, 7a5Fh       ; VxD ID of SIWVID
& l/ ~5 b! y! I2 i5 n1 ~0 @    int     2fh
3 _3 g' g( c( j/ f    mov     ax, es          ; ES:DI -&gt; VxD API entry point
2 n. B' m; v% ~* ^    add     ax, di  o. l+ Q: \' `# F$ C
    test    ax,ax
6 H5 R4 [/ i3 H* O2 U5 e- H9 V    jnz     SoftICE_Detected
4 E1 j1 O) l2 d, ~. N. P" C3 o, o  O! p; h
__________________________________________________________________________% J+ z) a2 w# _

) _$ @5 Z2 u4 p1 s2 T- M; \: u) B6 w% U) L, p2 a
Method 05
' P2 t/ Y9 b% L& j8 k=========! g; ]3 f6 \8 d  M& p. {+ h" u
- d6 H% M8 i6 P
Method seeking the 'magic number' 0F386h returned (in ax) by all system
& q4 Y6 p. ^# R: {; G" _+ y6 ~9 Udebugger. It calls the int 41h, function 4Fh.
/ e$ k# u/ t4 TThere are several alternatives.  
. e$ K' g2 \5 I3 B- P! e  v& R# v, Y) d! Z: M$ ~
The following one is the simplest:) H) E, v. }- `. s5 f8 V

. t( C( |/ a( ]  A1 t9 \0 N" x" ?    mov     ax,4fh1 F! B. L3 F8 H, K( C1 i- ]+ Y) J
    int     41h
- `5 }; t6 l) n# I, F2 B    cmp     ax, 0F386  O3 B# [3 u1 m7 ?' D
    jz      SoftICE_detected: I: j2 B" |( c" ?
/ Y" E- i+ s, g  `( H) @
! u# f; |& P% ?
Next method as well as the following one are 2 examples from Stone's
/ a1 p3 h! k, R- ?( h& S"stn-wid.zip" (www.cracking.net):
+ ^/ A6 }$ f: U6 Q3 i; l9 s
1 _9 a6 {! z4 |2 f1 k    mov     bx, cs
  S: Q" ~! F! q% v0 A$ ?    lea     dx, int41handler2
0 D6 v8 a  ?3 x% r+ n    xchg    dx, es:[41h*4]
3 ]9 t# q% g) a    xchg    bx, es:[41h*4+2]3 u; ?6 c- i& D' p- f8 Q3 N; }1 e
    mov     ax,4fh, \+ _, e( B9 A5 Z1 H0 k. K5 l4 ]) n
    int     41h$ _! _* ~5 K" Y- B1 o% ?, ~7 z
    xchg    dx, es:[41h*4]9 m) X1 F1 T: V" p! v- `! l: x3 P
    xchg    bx, es:[41h*4+2]3 r$ y9 E5 M( O- C! P5 e1 [0 k
    cmp     ax, 0f386h
1 z- Q$ k0 f* J5 P" R+ k    jz      SoftICE_detected/ V+ u% B& |; E

- t; ]5 R. j" |9 R. Pint41handler2 PROC
6 y: f# p( ?1 o7 m    iret/ K& `, T* k( ]5 F3 H& `) T# V
int41handler2 ENDP+ o. w5 c; N3 ~1 @- K

1 K. q: ]7 H9 C' R, U* ~$ O1 F' b3 J) _4 a2 |" B. y
_________________________________________________________________________0 A, n' n7 R3 k5 Y+ n, j+ u1 W' l

/ H& v: }. K+ }7 u, g+ w
# u) L9 j& W1 _8 `7 s6 RMethod 06
  H' F# Y8 D' Q3 w=========& C/ S; g4 m1 ?! [0 n

; L  ~7 M  u( p3 m- N: P0 u$ K5 T" m$ a
2nd method similar to the preceding one but more difficult to detect:
  }+ i, C8 B6 Y" O5 ]% O: X; `7 c/ u$ q' z
. m- `7 U6 S8 v7 G) ]
int41handler PROC
- u, S: T# y0 D- s) Q6 L) {    mov     cl,al% F. o* D! b- L; O. l% @
    iret! {5 x; `+ K! Z4 Q) ^
int41handler ENDP
/ @( V- l. L9 {0 E2 L* {5 P" p0 {
2 X1 R; w& m$ T  a' C6 h3 a& s. |
    xor     ax,ax
+ b$ t" @" w3 M! M7 V1 l! Z% w/ x) E    mov     es,ax3 {* `% A* B) i9 J& t
    mov     bx, cs! K  O  R, Q& Z; P# `5 d1 }9 y
    lea     dx, int41handler3 M1 o# D: G: L+ \) K; ^" f' j- t
    xchg    dx, es:[41h*4]% p- D( F3 r  f8 |
    xchg    bx, es:[41h*4+2]
7 C7 [: {4 {, W2 z) Q    in      al, 40h
, T( `6 Z: R& {; ~: b) g    xor     cx,cx5 P' L. y7 ^- S
    int     41h
8 F: H/ W0 N; P4 |    xchg    dx, es:[41h*4]
' f' l3 ^1 d6 l/ N    xchg    bx, es:[41h*4+2]6 F6 E2 f) F6 k3 Q  }, B+ p
    cmp     cl,al
" D* f, ^+ J" o# @( w    jnz     SoftICE_detected, ]$ H/ ^7 [% C/ d! W
& y, u6 F6 h9 V* I4 ]3 s2 Q
_________________________________________________________________________; p+ q8 y& ~6 H6 c7 z6 D/ r

5 J2 R! ]' }4 O0 x. f+ N4 m) rMethod 07* V. |7 ?' X6 U8 s8 F
=========
. }- k& Y! }/ Y8 ?  O2 E2 H* K  p$ ?, {$ Q
Method of detection of the WinICE handler in the int68h (V86)& P8 B6 A0 o9 L/ T/ J  V: h

" o! Y3 _; ]% S    mov     ah,43h) p; Y9 p$ Y$ |! z
    int     68h8 t. R+ X2 @# t' O1 R
    cmp     ax,0F386h
3 J- u# }) i/ Q3 H. s    jz      SoftICE_Detected
- r3 R9 }, N: S! n3 g5 C9 w/ }3 Z" N, i& E6 ?- x( D8 F1 X! d
; P5 D2 ?  W6 @+ K
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit8 m0 H  j4 N9 H8 p' F
   app like this:
2 q0 O& f, u7 _8 N" ^4 B
  W. F8 w# @7 o5 z1 O# @   BPX exec_int if ax==68
" x  P6 M9 j2 V* b$ G- I' j   (function called is located at byte ptr [ebp+1Dh] and client eip is) p' r9 H6 _/ Z/ X9 k
   located at [ebp+48h] for 32Bit apps)2 i6 T# B' w# {% O6 I
__________________________________________________________________________+ e8 V# b& S4 u

6 S% S! P) ~) |9 S4 I: t. B: b5 Z9 f+ e/ y: d9 T
Method 08
( b* P  Q" w! u# n% G. _=========- b$ V1 r# H$ Y& L; f

/ `5 ?$ ]1 F3 V0 z5 I$ PIt is not a method of detection of SoftICE but a possibility to crash the
6 u( |$ H3 C3 Z3 J- Csystem by intercepting int 01h and int 03h and redirecting them to another. Z: g1 I! z) A0 A0 h
routine.
- E5 g% E$ o& G. K% t9 aIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points1 ~1 a9 Y8 W# m  E
to the new routine to execute (hangs computer...)
3 ?* N# T. M. G# l/ f! E: c6 n4 \( A8 l/ ]3 H: e3 x) m
    mov     ah, 25h( \( v/ z9 ?4 Q
    mov     al, Int_Number (01h or 03h)4 O3 a: u) |. w* A$ [) k* m
    mov     dx, offset New_Int_Routine
, h9 _  ~5 h: a* G9 J$ O, ^    int     21h( }8 I6 w" j& K4 t- J$ i

/ g. ~- W- t4 k# A: q8 E9 \) w__________________________________________________________________________; k3 U6 A) q+ |# K
' [. R- U' M  n2 h) }1 m) @
Method 09
. p, b) Q. a1 p1 u6 p=========3 S4 d2 k- ]0 z! x* k, b5 W! V6 U

1 H; x$ k  M; z2 K- f; @This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
* B$ s. M9 r8 k, U, A+ c6 Cperformed in ring0 (VxD or a ring3 app using the VxdCall).
  t. Z. x8 w& EThe Get_DDB service is used to determine whether or not a VxD is installed
: P* I) S; h; F) X: e9 Nfor the specified device and returns a Device Description Block (in ecx) for9 [$ \% m+ z& _# W9 L* q
that device if it is installed." `; c* `7 ^: k3 B8 Y# j7 S: j/ Q- u
" F6 E3 U1 C9 W$ d/ F, |' A
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
6 Y; g) A, S4 M6 c9 |" ?2 _   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)5 A( G& ?0 g$ U
   VMMCall Get_DDB
0 D2 X. H) j# d0 q6 b   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
/ b+ s) i! w4 h
; F2 [: H! A5 h6 VNote as well that you can easily detect this method with SoftICE:
% o1 Z. Y6 }8 ]! W( c( z- C   bpx Get_DDB if ax==0202 || ax==7a5fh7 w* A2 Q3 e0 B% q. \
2 W/ [. w" h# N+ y  K
__________________________________________________________________________
, a! O8 J4 v3 h- J; |& J0 v% w  {3 J, i
Method 108 H: W' j0 L: j
=========7 z3 J9 K: c" g& t, N: u9 C1 w
7 Y1 R' ~. A1 x. x7 g
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
# h( \' q) q7 ]- m. I  SoftICE while the option is enable!!
2 j- f3 D) b. Q# |* |! l
. Y0 l. I1 o, G9 N7 PThis trick is very efficient:4 M' V" b3 f4 J; n1 i
by checking the Debug Registers, you can detect if SoftICE is loaded3 `2 a2 e# B5 {* _- N
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if, }% ]1 M0 }' g% d/ u
there are some memory breakpoints set (dr0 to dr3) simply by reading their
: ]* v3 T: b0 ]' x, j; m. Vvalue (in ring0 only). Values can be manipulated and or changed as well: P9 A* ]* {, F4 @$ H
(clearing BPMs for instance)
& k9 F* P& F: [/ b0 {/ o* m- k- a/ Z+ d
__________________________________________________________________________. ~  T) Q0 j8 I3 v

4 q& p" K# \6 H1 A, f0 RMethod 114 k# ~1 S! K; q3 `6 V" E  p
=========& |! U; T' k! I* o5 n4 I
& o3 ]1 m) o: S: ~, u, C
This method is most known as 'MeltICE' because it has been freely distributed! F8 K$ u, r5 {4 c' E, n& _
via www.winfiles.com. However it was first used by NuMega people to allow+ w' q" j  M; m# q; f
Symbol Loader to check if SoftICE was active or not (the code is located
8 ^1 ]- g& x' h# R: _2 [2 Iinside nmtrans.dll).% Z! c/ a! M, x: B& n

1 U& \$ S) R) ~; T+ GThe way it works is very simple:) z# I: x1 x' e+ R0 K/ g0 \: O
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
6 n- i5 p, F9 W+ F3 `  t+ n) {" [WinNT) with the CreateFileA API.1 ^8 f  V7 K" F/ j

; P4 }/ N, t2 K& y; VHere is a sample (checking for 'SICE'):
3 h! P8 `9 b, Q, N& s# T- l6 I  x" ]% r& W- q! d' f7 C) g
BOOL IsSoftIce95Loaded()
4 _' `; u7 @" Z' Z6 Y{: l4 J) l. A9 c7 @( x) ?
   HANDLE hFile;  6 S4 T& ]! }* V. p
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,% V' t1 s$ P3 M1 i4 g# o
                      FILE_SHARE_READ | FILE_SHARE_WRITE,
% w8 |$ F/ u8 X3 y9 s                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);4 R2 Q7 T2 d, g" V/ W2 T7 n: Z
   if( hFile != INVALID_HANDLE_VALUE )
- M4 g) `; R) g1 ~: h8 f0 U# _  x   {
9 u& Y* f5 W3 _# ]! L; d, B% V      CloseHandle(hFile);
- l. L$ N- d6 t! x  x* {      return TRUE;2 ~  D. a& h0 v2 z( F6 ?5 _* k
   }
. W! A% D! O5 F3 K' w5 @1 ^/ I+ b6 D   return FALSE;
* Z- G1 ]. d! h}
' K7 c: _9 n8 b$ @6 X
* ?: E5 m' |9 T  F/ O& m/ |Although this trick calls the CreateFileA function, don't even expect to be9 \$ @3 k9 T& H9 M8 w
able to intercept it by installing a IFS hook: it will not work, no way!$ K& o3 c( }$ `" m
In fact, after the call to CreateFileA it will get through VWIN32 0x001F0 j/ f9 e- {2 M- c4 n& J& B6 U8 Y" _
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
$ i* f, C4 [% p% N$ c2 V2 K% Aand then browse the DDB list until it find the VxD and its DDB_Control_Proc
7 f& d/ J  M7 ^7 D+ I$ `+ ^field.. l3 E/ F: o) u( W
In fact, its purpose is not to load/unload VxDs but only to send a
9 }7 B) ~4 ^3 D( QW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)2 r% j, d, A+ e+ ?9 }0 P
to the VxD Control_Dispatch proc (how the hell a shareware soft could try1 J. x$ W0 U- n6 m& |3 Z
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
- P5 m: [7 p' Q9 g3 GIf the VxD is loaded, it will always clear eax and the Carry flag to allow: R5 Z. d+ L/ S5 b: B; D
its handle to be opened and then, will be detected.9 p8 j' s1 |& [3 A$ ^( C' n7 N
You can check that simply by hooking Winice.exe control proc entry point
; m+ N+ p+ L+ S$ f$ uwhile running MeltICE.# @" F2 {# I( r0 k5 X1 O2 S
) o3 i" m1 f0 ^7 G* h8 T+ |2 B" Z
9 A8 y( [- A( c! P& A, A7 [
  00401067:  push      00402025    ; \\.\SICE5 G6 O1 T( w! K
  0040106C:  call      CreateFileA" _( X, u5 A. Z- ^$ t) x# `
  00401071:  cmp       eax,-001
+ g, D" V& \  p- L& {( \/ x  00401074:  je        00401091
* l+ G- t+ L3 p+ P" C$ T+ Y1 Q
4 C% G# x$ G5 J" n0 s8 h9 p0 k3 U5 c6 c) _( D( p
There could be hundreds of BPX you could use to detect this trick.* V: v) ^2 d, I: u7 a, b
-The most classical one is:* v9 a: v/ O5 F& U
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||* \2 L8 r0 _; J" `! C
    *(esp-&gt;4+4)=='NTIC'2 q2 r3 f/ B: o% m; j8 L

+ x3 w  Z. F6 _2 i, a-The most exotic ones (could be very slooooow :-(
6 A1 m6 s: }5 N1 C7 B3 z" R  ^4 b7 X   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  - ?7 s/ k4 Q# k4 v- B* X7 n" m' p- \' E
     ;will break 3 times :-(0 P) Z$ @& Q+ U" H, d
8 W' Z  m( g3 J  I
-or (a bit) faster:
* q# n) p7 a8 T  q1 l1 ^   BPINT 30 if (*edi=='SICE' || *edi=='SIWV'): R) k1 t, I& d9 L0 s- T& j+ W
& e6 @8 b/ A7 m# g
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
8 ?2 B! ^5 c1 H0 u: z     ;will break 3 times :-(
, \9 v% d" _$ B' X' n% A3 c0 E  M+ m9 F
-Much faster:/ M0 E+ C2 a9 w) w
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
3 m3 e% T; W$ u8 S, V
% q% C+ x! R) zNote also that some programs (like AZPR3.00) use de old 16-bit _lopen: S* N( L6 l! ^+ R+ j
function to do the same job:
, D( h+ ^. q; q8 U, y& R
( h  E$ E0 w% }   push    00                        ; OF_READ
& }# l1 c: a, Z! G  u   mov     eax,[00656634]            ; '\\.\SICE',0& E" n4 _2 b; s
   push    eax! |! Q  k" l% V9 H
   call    KERNEL32!_lopen
0 y6 _& V  h2 p0 g! h  G% G   inc     eax
) |! \( {) I# M' x1 R' C   jnz     00650589                  ; detected( P  u" Q2 h& c# ^0 ]# ]2 ]
   push    00                        ; OF_READ/ C0 E7 Z! y# ~' K
   mov     eax,[00656638]            ; '\\.\SICE'. |" P8 v1 Y* M6 A9 J* X& t" b6 Z& b
   push    eax
( U" E1 g/ N: }/ r& D   call    KERNEL32!_lopen
0 a5 o  P, S/ V. ~   inc     eax
7 R0 ^. g5 I+ A* H7 l   jz      006505ae                  ; not detected0 K% G0 o1 O  h: R
' f' B) k. K# a, A

2 `/ {# w1 n5 d& c4 N$ G__________________________________________________________________________- B: j* H1 _& H% B3 S, h

% _8 d3 {  W1 i; H/ H0 qMethod 12
) P8 c0 Q0 L6 a9 j- w=========
/ v  J( z  P* X& x* L
3 B- y1 N4 G9 g( ?  |This trick is similar to int41h/4fh Debugger installation check (code 05
. S# @) f8 @$ N- j; _&amp; 06) but very limited because it's only available for Win95/98 (not NT); n6 n2 A# B8 j; m* R! [
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.+ F2 K- y8 l  o; b. P! R0 s/ Q) }

2 X, M7 e4 D: D! f, K9 @" I  [0 E8 _   push  0000004fh         ; function 4fh, Z  o# W$ S! z+ w5 Z# Q
   push  002a002ah         ; high word specifies which VxD (VWIN32)
" h8 C, a! C9 j6 z, e8 u4 X: X% R                           ; low word specifies which service
( I* p$ E  s5 |/ ]* L( K                             (VWIN32_Int41Dispatch)
! I) I  d2 M  t! o" b) q   call  Kernel32!ORD_001  ; VxdCall
$ I- a3 y1 C2 y   cmp   ax, 0f386h        ; magic number returned by system debuggers
& R2 z7 ]: }4 @   jz    SoftICE_detected
; h3 p& t9 C/ [& T2 w6 A2 }$ F! P5 F7 x
Here again, several ways to detect it:
( N+ z. q4 B8 l. k7 Q5 d# j" d6 [. D5 f  `5 E8 c: t( V% V; B, @
    BPINT 41 if ax==4f- Q: l. J1 B" g; T
. M" F( O* l" W0 ^0 Y: M$ `" l9 G
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one/ |, [# w! B! }! I# L/ B' V
7 T3 i; V, G  e5 f2 G9 b  b+ {; w
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A* Q' M' C2 B0 ^- O

! E: a) g( E7 ^( {. q/ f; T    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!7 k/ e, A6 r7 f& [: h

- D6 R( Z5 ~: D; }( H__________________________________________________________________________& n% d2 m& M- Z% n5 J6 e, a3 u
7 i/ r) X3 O8 {1 o- Q  h
Method 13
  x5 w( F! R* ]" h5 z! h=========
- h  K6 _1 s' g5 ?5 ^  p% |
8 G5 ^* ]: r4 F: w, s0 R) ]Not a real method of detection, but a good way to know if SoftICE is
, |3 e$ g/ `0 k& m5 N; i7 M$ winstalled on a computer and to locate its installation directory.
- j% g  u6 ^) E; ], c9 I2 pIt is used by few softs which access the following registry keys (usually #2) :
0 J$ _' z5 W/ a/ Z0 U4 ^: F
, B, D2 X+ y3 U! B( e7 ]-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
% m' _; ]* _, z\Uninstall\SoftICE
/ G& i' R, ?. j+ J/ i5 t7 y4 C% x& g-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
2 A& b% }2 E2 |9 `6 L7 _2 b-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
3 O- s7 V. P$ Q. x/ H+ {4 F\App Paths\Loader32.Exe
$ o$ d- }5 u9 H9 G0 [1 c
! A" R6 ]+ `5 Q/ z$ ]' R
4 b- j' A: f: v; DNote that some nasty apps could then erase all files from SoftICE directory8 M( a; O$ }; A
(I faced that once :-(4 [' }% [. P: i& B
0 U2 }5 h  Y- B0 e$ k
Useful breakpoint to detect it:
& x. U/ W0 a, n& Y) X# a- v  B3 x
9 W' v1 P$ P- v* M4 M& w     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
5 K% L* |1 X$ ~, y/ c! C4 K1 B: [  T# q& n) H
__________________________________________________________________________; v3 m, K( t  _6 ?% z" f# O

4 S+ p  W: u6 B$ I, w, J6 x! \! K4 P; f
Method 14
( h* f. G* e& @& Q=========$ l' U' S9 p+ f; E" C$ `" J
0 A2 n2 r( m) b6 d
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
$ `, q/ V9 A! x. E/ }is to determines whether a debugger is running on your system (ring0 only).
7 m" I1 B0 }% A; `2 Z
* p8 g* b; a4 D' F* c" a- A   VMMCall Test_Debug_Installed
: [2 m( r4 p4 F( @1 `   je      not_installed
- P6 }9 h8 J- J5 q( y& d4 `
8 B+ T- `; i/ B2 F" ~( jThis service just checks a flag.
. F# v+ V* q( s) g- I</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部