About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>% {5 {8 N5 [' b! _
<TBODY>2 r6 Y0 l- q. O+ P( F# X
<TR>
- ?2 B& y$ {3 v5 m1 g6 G<TD><PRE>Method 01
! ~9 q4 t, G" c! z: B( i=========
' g2 b# Z  W. J4 F  e" K9 g0 l7 c5 n& {/ ]+ u+ Z2 S1 u2 n% P
This method of detection of SoftICE (as well as the following one) is
  A+ [( Z8 V; l1 Qused by the majority of packers/encryptors found on Internet.  ?* K* k  |; d$ [% [0 w
It seeks the signature of BoundsChecker in SoftICE1 _0 h' L( g% h& q% Z5 G$ G
- m- d6 u! P8 \9 v3 y
    mov     ebp, 04243484Bh        ; 'BCHK'
0 r. n1 \; Q& Z* `3 T, q1 K    mov     ax, 04h& T+ E+ ^4 E* J% |/ P7 N
    int     3       6 H- s; w1 ]2 `
    cmp     al,4
* h1 ^% h, i& \) Q    jnz     SoftICE_Detected" n/ G( v* s0 o8 \* [
$ z  H' F- p) n0 @
___________________________________________________________________________1 J0 Y5 d3 `7 m& y

( B" F1 N. l& r, bMethod 02
! |6 W' d  F- V5 _=========
  d2 b; Q; s. x8 S! X* {6 i! S$ q  u5 J
Still a method very much used (perhaps the most frequent one).  It is used* p/ k. y& l4 _5 Q3 R% R/ Q% j
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,! V- b* q3 G' u7 q- R
or execute SoftICE commands...% z) P( M8 s- h0 }& i; Q
It is also used to crash SoftICE and to force it to execute any commands* C# e7 s# @0 p1 |# h! s9 L; b& R
(HBOOT...) :-((  
' L1 G: E/ T: A+ p+ W3 n1 g0 ]$ E. D) T+ A+ n& V4 ]( C/ n; e
Here is a quick description:% n. |6 R2 N& v7 b: G: [
-AX = 0910h   (Display string in SIce windows). ]& x! K) F/ V. o7 V& ^! q
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
# v6 V  J/ K+ i; [-AX = 0912h   (Get breakpoint infos)3 v+ H" P* Z9 k
-AX = 0913h   (Set Sice breakpoints)- _# ^! k# X3 A/ y0 y! g
-AX = 0914h   (Remove SIce breakoints)4 J9 S) M) P. F3 b: D0 d

8 g3 ^6 F3 u9 `+ z. }7 ?Each time you'll meet this trick, you'll see:
7 N6 R' \" l" z( v7 ]# `3 [+ _! v-SI = 4647h: L4 {7 c* r; Y' b0 O" b
-DI = 4A4Dh6 e% m& i* t& e
Which are the 'magic values' used by SoftIce.
- B1 w0 z# M6 c* Q4 d, S$ nFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.5 \& Y9 S" n% z+ K$ H$ L

4 B+ v- L  e) G' Q, z( M- e" h6 eHere is one example from the file "Haspinst.exe" which is the dongle HASP
$ y0 @8 w2 q, c. Z/ FEnvelope utility use to protect DOS applications:
! n) s0 k/ e) {# A4 x8 A* k. {& q! @5 p0 q: I1 E' g) J; T# e

" Z( ~; i7 D' t+ y" g6 Y/ K, Y7 \4C19:0095   MOV    AX,0911  ; execute command.$ }: i' V: P9 a: h" K7 V% M
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).5 s# [; j. }7 b8 p
4C19:009A   MOV    SI,4647  ; 1st magic value.' ~9 r: a* {% X
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.3 G* p) \) L  k2 M
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
' N  \) c) k6 J& T" L7 h4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
4 ?$ a5 N- O8 B7 b4C19:00A4   INC    CX/ W- n. e  l6 u# Q
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
% z) y2 t6 O  t! ?; n5 Q# E4C19:00A8   JB     0095     ; 6 different commands.# Y4 L9 \* A! I: W" G) \. [
4C19:00AA   JMP    0002     ; Bad_Guy jmp back./ c6 D6 T5 i" ~: B
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
; C8 I$ \7 M6 y& T5 P& Z5 P
9 S  k9 f* ]1 s& n5 D, }The program will execute 6 different SIce commands located at ds:dx, which8 H+ U: g9 u1 m8 r
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.  A* k4 Q% D; D4 Z3 [
  |4 V% ~) K( ?
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
" `/ }% n9 J! u___________________________________________________________________________4 y2 a7 V8 Q  r0 r) Y* n

. E& M6 X1 m  ^3 f& ~: G9 }
% |. \5 g7 a" LMethod 03; ?, B2 h0 [. d2 Y% I
=========
  r+ @; J* j! P; q% ]& {: F/ ]
; A$ W3 ]( B) C7 P( Q5 z7 m% t; y) oLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
$ S$ D  G# ?1 j2 p/ N- v5 X4 Z(API Get entry point)8 _$ |) g. }$ _0 ]* h% Z
        
* q& ~5 A5 G. D& L
8 ~% P6 G$ B' @# E7 y, f: H    xor     di,di/ G6 O$ m4 S$ |; ^
    mov     es,di
; M0 K9 p/ O7 F$ r    mov     ax, 1684h      
- p5 h3 h, X6 L    mov     bx, 0202h       ; VxD ID of winice
) R8 L0 m+ w7 E    int     2Fh) b6 N, b% ?4 A: p
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
5 C. G- H/ R) v3 F: F& \) j& G    add     ax, di
2 c& p+ ~  g8 T5 K    test    ax,ax$ @4 l2 S+ ^7 h$ W! `6 `
    jnz     SoftICE_Detected
& D+ B2 p( B- y# h* ]. N# v6 S9 [
' r: K+ h9 r8 S% U# K___________________________________________________________________________8 Z8 V4 Q) K# d9 _+ p8 u$ ~& {

- e# {. |5 W( k0 m9 Q4 uMethod 04
5 q. E- A' h7 I/ _6 d# x" {=========- C, z" ~2 Y: g& S$ f. G$ M! @
3 s8 n  w- b/ G1 \4 R
Method identical to the preceding one except that it seeks the ID of SoftICE
1 a6 f: @4 x. u7 w- ^  QGFX VxD.4 t2 ?* b& [/ W* z# i1 I3 q) l
1 \# b6 h( [8 N2 E. B4 `! M
    xor     di,di1 A2 [0 R0 ^& T3 W$ e
    mov     es,di
" O! @5 H9 L1 H/ F2 x5 i4 \    mov     ax, 1684h       $ P4 X8 D! l, I
    mov     bx, 7a5Fh       ; VxD ID of SIWVID
. T& Z+ c* h" p4 b# M5 C0 [$ S) w    int     2fh
9 L/ I8 X6 g+ f/ h4 T2 U' V    mov     ax, es          ; ES:DI -&gt; VxD API entry point
. `4 p; Y8 Y- {3 i$ M! n    add     ax, di* R2 {7 l2 z& e  E' G( W  x
    test    ax,ax
1 A3 p( p# a* y! g3 ?! I7 A    jnz     SoftICE_Detected' a4 j3 ^' t: j0 c

. ?1 X4 M7 W: j2 P; p, q__________________________________________________________________________7 X2 d/ e: A+ |2 I* a  m, ?% C
) O  T" {0 v  `8 H/ J
+ g7 |. J: G( x$ G1 o- P' [
Method 05
- x0 G* W9 C6 S6 b; X# m' R=========
7 [/ s( J& P6 v! u- [- Q! q& i, e5 h2 K& K
Method seeking the 'magic number' 0F386h returned (in ax) by all system) f! s& K8 {- Y0 P
debugger. It calls the int 41h, function 4Fh.
8 n0 L% g' {) H( qThere are several alternatives.  3 h5 I7 ^2 o0 p. a8 a8 d0 Z$ W

$ u+ y' {( b6 E2 a; d% }& A$ o5 XThe following one is the simplest:- y9 v. e& a: ~/ ~9 y* n" `$ Z* Q

1 F1 B3 R. [( ^    mov     ax,4fh
$ C9 p/ ]7 ~3 V* O+ k% G- I    int     41h6 K& R* E7 `: v9 H
    cmp     ax, 0F386, ^0 S( C  c6 q
    jz      SoftICE_detected& G0 P* E5 M6 p3 W

- z" b) H: w: ?0 ~
8 s: f* L4 A# X7 xNext method as well as the following one are 2 examples from Stone's % z, M9 L( Y0 {" V7 }
"stn-wid.zip" (www.cracking.net):
' a. E+ f$ g1 I& }4 l( E. o3 T% I) }. S
    mov     bx, cs* N- P3 O0 f+ o) Y( i1 V
    lea     dx, int41handler27 t: w( b( a' r- k5 A4 y& g
    xchg    dx, es:[41h*4]
, V9 E1 J. |( ]4 G7 z" n    xchg    bx, es:[41h*4+2]& ^2 H% q  h6 ^( c$ v
    mov     ax,4fh$ R- D& L  B% H
    int     41h( J$ }5 F  }, x
    xchg    dx, es:[41h*4]
8 O5 R4 _, S9 O- a- B    xchg    bx, es:[41h*4+2]% E- _" [, f$ ~( C
    cmp     ax, 0f386h
/ v8 T; ~/ ]/ C& L, \6 `# {& w    jz      SoftICE_detected7 ]3 [; A9 m9 V; v7 t
  A. q4 ?& p! h+ ?7 E) I- w
int41handler2 PROC9 i2 u4 V5 z8 D
    iret
8 w8 c; J( C3 T7 uint41handler2 ENDP
/ r. v# J8 e2 z& G* G* [5 A% N3 V7 y& C; r: n
4 D$ B* o' t: o! m* C! u
_________________________________________________________________________
  ~5 A* Y( U+ {* Q/ R2 _- @; K5 K, r% a4 W; L

( b, {1 q. o2 `' ], kMethod 06( g( _2 l/ @4 W5 K* [8 U  ?
=========
) m4 f2 ]1 K% Q# M2 ^" |/ T
+ {* r5 |# {9 f; r0 i( H: z$ j1 b# O" b4 [. k
2nd method similar to the preceding one but more difficult to detect:
. N0 D4 ^+ R. O1 Y
' L5 D7 a9 w5 v4 b9 m' V  a% ?' m* P% d: X" D0 t7 v8 f2 o
int41handler PROC
3 G# C$ y! {) m" z8 M0 \7 ?+ J    mov     cl,al2 T5 f1 h7 f/ o! ?9 D4 x
    iret0 h/ `, K2 v  K! |# F% C7 A0 W2 T4 }
int41handler ENDP/ O9 D0 {) N  e  @+ T$ `

! l  [  A5 ^: o2 C& G9 ?0 S9 Y! ]6 X- V* P$ N
    xor     ax,ax4 ?8 v: k3 k5 C' k0 v
    mov     es,ax& B5 j: T# R$ X, M1 M
    mov     bx, cs
2 T3 ?1 p* c  _' w: _# |' N# G    lea     dx, int41handler# V: P; Y% H9 U! f7 G
    xchg    dx, es:[41h*4]/ o5 Y$ s8 k' {' R4 G" E
    xchg    bx, es:[41h*4+2]$ U8 r5 q3 v- m# G$ j& t: r9 _
    in      al, 40h1 i$ y' d6 \# H' {6 u
    xor     cx,cx
  ^) n0 Q3 W* J8 e; P    int     41h
8 g: h: d6 J6 ]% Y8 w    xchg    dx, es:[41h*4]1 Q5 D$ G8 {5 M- g5 M
    xchg    bx, es:[41h*4+2]
) Q. w7 ^4 Y' k( _! ^0 ?3 y& t    cmp     cl,al3 H& Z) m. |. y- K: v( |( u& B
    jnz     SoftICE_detected
9 p1 E! |2 c: W1 y2 F3 [
3 B0 w4 L, C4 C7 I_________________________________________________________________________5 B$ \" ^3 l6 N+ y; n' a" H# {
; S" R+ f: b" B* c# N
Method 07$ w* f2 F  A5 C3 R# x
=========
. ~  s) _# ^4 G" L' w: c, a
1 C7 F* y/ N* S+ |Method of detection of the WinICE handler in the int68h (V86)
; [9 u5 w& s, W' K( ]6 C+ @( |6 \/ w( Z; W( J1 B9 ~
    mov     ah,43h
# K+ ?9 @. d: l  \! M    int     68h
+ Z$ D3 a6 e; n& I# Y    cmp     ax,0F386h
2 I6 s) L, ^! o5 O1 V; K: s! S    jz      SoftICE_Detected; f0 t: L6 C' f9 \' h; q

& N) u2 f9 i1 M3 o1 \: c& \7 F& G% }- j0 z
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
( a; C& q; @3 a" P$ E9 n   app like this:. C; l( C, T/ \# `0 X9 L3 ]4 b

* g1 F8 n5 u. z* f+ o   BPX exec_int if ax==68
& W5 `# Y9 A+ Z  D- D0 z   (function called is located at byte ptr [ebp+1Dh] and client eip is
% p+ b2 c1 X9 [- ]6 j' `   located at [ebp+48h] for 32Bit apps)7 E# T0 I" `  _
__________________________________________________________________________% g1 d3 E1 P$ g$ X1 ]' k0 W+ j
( y# ]4 ]2 C6 t& V1 n
$ p# J  U3 d) G8 }6 a" ]. p
Method 08
4 ]4 \9 f) `0 i! r=========
3 I8 v) p4 w4 u3 y
5 _% [* P1 e4 B0 W3 P* y, YIt is not a method of detection of SoftICE but a possibility to crash the- A" J3 q% U7 t( _
system by intercepting int 01h and int 03h and redirecting them to another
5 c1 p5 ]6 y; V# mroutine.
: D% l! p9 e- q0 bIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
% e% |) D0 ?5 I1 h3 V5 C9 v7 rto the new routine to execute (hangs computer...)& Z! r+ x1 O2 P* j6 W% Z
5 p/ ?7 m! x6 a# p) x8 j$ S# l$ ]5 f  @
    mov     ah, 25h8 V. V: s3 f, m
    mov     al, Int_Number (01h or 03h)% U5 |- p% G6 Y( O- B
    mov     dx, offset New_Int_Routine
  W8 ^4 @9 s/ Q% P4 ]    int     21h( I& N3 V1 f* ]  X/ e" {! N

5 e& _$ b: d0 }+ }  U, L__________________________________________________________________________
/ G* Y  h1 b/ @4 F$ m( |# O3 g& k0 p% O- y% I
Method 09
  p+ X5 K( r; t=========
& I) V* }8 k. E; c! H. }; c. Q% M0 u# }) Y( f. R/ R, n- d
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
6 L; ?* b; M& ^1 W3 xperformed in ring0 (VxD or a ring3 app using the VxdCall).
) d2 a' p- R# n9 {The Get_DDB service is used to determine whether or not a VxD is installed
) B, i3 Q  e  Y$ v8 Ifor the specified device and returns a Device Description Block (in ecx) for1 T: V' w! e' H
that device if it is installed.
6 m  y/ h) p$ W/ m. E# t6 k% \4 X/ d+ K
- ~( K; Z' B7 a) q3 x, Y$ H& t   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
* f4 \! q; h: g& T! v! @   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
" c' Q& F0 i' u* X4 _0 t+ A   VMMCall Get_DDB7 ?5 k1 f( D3 _7 a0 i+ S4 }
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed8 G/ j6 r  }% Y. s' D

# E6 O) q/ V" k, KNote as well that you can easily detect this method with SoftICE:
0 }; j9 C, O- q) ^* \1 z9 T" M1 }   bpx Get_DDB if ax==0202 || ax==7a5fh5 v( s# K& A* J; K9 D
0 J' r+ p7 O1 l, C: [% D
__________________________________________________________________________
; ~# W7 c7 Q- z) p1 l: e0 D7 e' g, Q8 i
Method 10/ X% w1 U7 ]. l" s1 i8 Q% o+ h
=========
) ^+ Q1 X1 x7 w) C) d& N/ T% `/ `! g/ v! w
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
$ s- g  b! j7 f6 w+ b5 P  SoftICE while the option is enable!!" y0 D% K) w% l, z( _
0 Z# K6 m% I$ I1 g7 J9 u$ T
This trick is very efficient:
  _: t* Q/ J" C, l, b! k. t3 Aby checking the Debug Registers, you can detect if SoftICE is loaded
7 ^, H: ]0 b7 F8 D+ c& ?(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
' X4 Z3 T$ p$ _) z# Pthere are some memory breakpoints set (dr0 to dr3) simply by reading their
5 {; X/ U' q$ Z) r: J5 X( m) jvalue (in ring0 only). Values can be manipulated and or changed as well, z7 z: a7 S. I" v% ~
(clearing BPMs for instance)
# E3 a1 q& }8 H3 I9 F8 j$ Y5 H; }. R3 Q* ~+ D5 W# n3 u8 _
__________________________________________________________________________% v9 D! W# ^8 @) w: |! W$ Z
% h* l. O" @/ z
Method 11, T8 n& z4 r! P5 h, i% F, q- I6 r$ t$ i
=========  F; H  J4 L5 F
" m; U2 D  d1 f$ k9 m8 ]' O* x# J
This method is most known as 'MeltICE' because it has been freely distributed
* R- X0 B1 w1 Y5 ^( Jvia www.winfiles.com. However it was first used by NuMega people to allow
, ], R& c. I7 H" f* ?Symbol Loader to check if SoftICE was active or not (the code is located
: e& E2 x$ _0 R0 s$ x( D& Kinside nmtrans.dll).
' q4 a0 `$ g6 S; Q$ o
/ y( w' ^$ V/ V  v0 H3 W! c. BThe way it works is very simple:
* m& t7 a- P! i/ R! g  hIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for# O2 B- P/ w& y3 w$ A7 i% S* y
WinNT) with the CreateFileA API.
7 `( e0 q5 R, _& f
* C1 E. k% D. O  d& {5 Q( W+ |Here is a sample (checking for 'SICE'):; Y5 }0 s3 V1 }7 K& X
# N  r8 _/ M7 K% t% x
BOOL IsSoftIce95Loaded(): p+ ?7 J) S( {+ D
{
  [% V6 L% n1 X; [0 W$ v   HANDLE hFile;  
7 c( O: W. {& D1 b   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,/ u/ j  q+ R) z; }* j& V8 ^
                      FILE_SHARE_READ | FILE_SHARE_WRITE,
" S) j6 \1 C( _4 ?( x  p% E                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
9 P7 s- C* j- }' t( L5 [' B   if( hFile != INVALID_HANDLE_VALUE )
! g3 m2 Z. Z# H$ q   {2 s$ A/ d% I5 f: B6 A
      CloseHandle(hFile);
; y/ l) Y0 Q5 I      return TRUE;: M/ t( V: v7 Z: W1 Y' W8 ]9 T
   }
* Q6 V0 Y/ d' l4 `   return FALSE;
% o8 ]. n6 [; E1 K; d' R}
: Z6 H. G- b: I4 Z
7 q/ U* a4 f5 p1 ]* p& {$ N# WAlthough this trick calls the CreateFileA function, don't even expect to be7 I1 e4 p+ }0 w. ]  [
able to intercept it by installing a IFS hook: it will not work, no way!# K% _; K# b7 Q4 d/ x4 M- q7 a* t
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
8 O- d* Z0 ~, @service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
1 w0 @1 E' ~" {( f( t* c, [and then browse the DDB list until it find the VxD and its DDB_Control_Proc4 l3 |/ V* W2 m. H" N
field.
# l' I2 W# f8 K5 `7 sIn fact, its purpose is not to load/unload VxDs but only to send a 1 W& c7 M& ~& F; n8 j3 g4 [
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)! P$ r; c2 y% n1 Y: T
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
+ ]) {4 A  \( o1 L! q0 A6 Kto load/unload a non-dynamically loadable driver such as SoftICE ;-).
8 l$ [  [* Q/ g; C, G5 G( wIf the VxD is loaded, it will always clear eax and the Carry flag to allow; k: b" s- G( O0 [+ l! R2 z( |" p
its handle to be opened and then, will be detected.
' v4 p2 x1 ^! O" B6 d! i% ^; s# BYou can check that simply by hooking Winice.exe control proc entry point+ n" g5 b6 l* T% v" c
while running MeltICE.9 i; ]; _, x6 y: S! m
1 c# Z+ i- C+ g( k8 n$ I

7 b  B& k: a* F4 p8 D  00401067:  push      00402025    ; \\.\SICE
1 J3 u+ m" j. K& T  0040106C:  call      CreateFileA
+ Y& p# g: D3 ^$ {, N; a  00401071:  cmp       eax,-001+ a0 I/ N" C5 i" \& G  _& j% y
  00401074:  je        00401091/ x  D" d4 k) @. T

2 B+ X7 G5 c, u- M7 X' K8 v
% o5 o, S% I! |5 P0 j8 T* TThere could be hundreds of BPX you could use to detect this trick.
8 U8 n8 h2 P* k' j! G: D-The most classical one is:
% A/ s; k4 u: v' i6 ]$ J  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
$ t: s5 W& {- s8 t4 D3 E0 G    *(esp-&gt;4+4)=='NTIC'
0 Q4 g/ X, g$ N3 k. a8 U
! c" A( t) _( O" o% T+ [( D-The most exotic ones (could be very slooooow :-(
: I( ^# K7 \) J, M( ]/ M' b   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
- K9 U8 o' F4 t+ v2 r3 p  N     ;will break 3 times :-(
( R( A# P1 \1 G& C
; F: O" d* X0 H% z2 w& p0 w6 }-or (a bit) faster: , H7 o, }  s8 B/ k/ o+ o
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
, m: g1 T6 L& @3 @4 ~& V4 S+ y& i  w; L0 _; p
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
2 E' o9 }7 b0 g5 `' d& T     ;will break 3 times :-() F+ `* k) B  }1 |

7 ?) p' V2 @5 `( ]( H-Much faster:
- N5 O" q: w6 V5 A% ]) K! m   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
2 ]) i1 j: }4 |! v0 b) h8 O5 X7 ?) V/ X* c9 t( U
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen( u9 g  k9 \$ g/ i, d6 U! V8 J
function to do the same job:
5 g  ]/ m. @) B2 s: O) q9 V$ V2 i. b5 y8 N' M( g& C
   push    00                        ; OF_READ
$ O7 u; D) c; G( C, T: g   mov     eax,[00656634]            ; '\\.\SICE',0) k6 ?" Z9 y6 s/ G; ]& a
   push    eax
6 P- @! P' _" I* @   call    KERNEL32!_lopen
. N9 F' ?2 s( B  b1 o4 h' C1 ?4 `   inc     eax
& U2 v1 f, K- T6 t. M% j   jnz     00650589                  ; detected
( E3 I* o7 ^" Z5 Z   push    00                        ; OF_READ# M+ s7 E& A! S4 g; Q
   mov     eax,[00656638]            ; '\\.\SICE'% B3 `8 Y5 d. V. F; d! z
   push    eax
2 j/ h) i: T) Z) w. W( d) g& U   call    KERNEL32!_lopen
7 y6 r9 Y! X2 _: F; d   inc     eax, P# C0 M/ A/ S& c9 o7 M  e" m
   jz      006505ae                  ; not detected
& J1 c/ a5 O+ S: |8 I: \# Y! }9 u( m8 J9 W) ~0 p/ A

- M. J1 n/ M* {9 f' O9 S__________________________________________________________________________) Z7 R& a0 i3 S7 [4 R; O
- M. H; \( L& _
Method 12; ^) r& z$ L# I& i" e
=========
- N1 H  E$ O; N& W3 t) }
  N# ?+ F* I4 r+ @" W, P7 \This trick is similar to int41h/4fh Debugger installation check (code 05
# B  e( F; ^6 @/ N) P&amp; 06) but very limited because it's only available for Win95/98 (not NT)9 m( T. _: ]9 L; H; R7 a
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.5 V+ J; l- N& Y  c4 l/ V
- k8 i0 v" g9 j: W
   push  0000004fh         ; function 4fh# d, k8 r, v2 u+ K
   push  002a002ah         ; high word specifies which VxD (VWIN32): u- k( O8 C: V- @: P
                           ; low word specifies which service. d: k, ~. ~+ D& W* [9 c9 n. f
                             (VWIN32_Int41Dispatch)9 R6 M7 x% X7 ?
   call  Kernel32!ORD_001  ; VxdCall/ p: p/ a# H+ A4 G
   cmp   ax, 0f386h        ; magic number returned by system debuggers
0 n; [, h8 Y. t/ o" B' O; D; p   jz    SoftICE_detected" I2 x/ Z6 @8 b; m" ]+ R* ]

, j! `8 W4 j2 ?7 M* }* zHere again, several ways to detect it:
0 l/ H# Z& U" v, G/ S0 K8 F  {4 S# g' K9 ^2 H+ d& U) ]2 T
    BPINT 41 if ax==4f
3 `$ ?# a4 n# l# M& p7 @6 r" E& A. T" J$ G, J, w
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
* \! Z6 v- c% o  v! O1 u% L" S8 i; c' J5 a- q( F( t9 T, P
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
3 r- ~  f* J* @. W$ C
8 A+ N' t# P$ ?- J9 |9 C    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!! _0 v0 k8 u! T0 t  O
1 A7 V: D& H, E& }) K; H
__________________________________________________________________________
' p; v: X% z* }
* e# G$ k- P, j% nMethod 136 G6 U* B" F0 C. N+ c8 }( T- l! k
=========3 t: O5 G% h- l: Q7 B
. ~. j3 ^/ p1 X
Not a real method of detection, but a good way to know if SoftICE is" z$ ?! z+ }8 d7 r! t
installed on a computer and to locate its installation directory.4 v7 ]" p! i+ m, w- d9 E
It is used by few softs which access the following registry keys (usually #2) :5 b! k+ h, p* b: ]( z& K, `
8 j/ l# K0 }8 S/ N
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
3 @5 u. z9 s2 o: j$ D6 V* \\Uninstall\SoftICE
! n9 l7 d- R* Q3 j" D+ ?-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE1 T. \* e7 |$ f" j
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion3 w' _+ n/ j8 i9 R4 a
\App Paths\Loader32.Exe" h  b. m: h  U

% E, L; R+ ]* a4 C% M7 G0 b
1 W" k# E! U: H+ u# }Note that some nasty apps could then erase all files from SoftICE directory
4 W: s0 e$ d# A& `3 T3 K3 T(I faced that once :-(
) D0 x  h& Y5 P3 }% ]" e
% H; e' ^, w3 p2 C) D( _Useful breakpoint to detect it:5 O! s) N0 Q7 F0 `

, J- }7 W3 D' k2 m( {     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
. s6 |/ N* z6 f! l1 E. D
4 {/ }3 p  H4 B7 _/ G+ x__________________________________________________________________________
( w9 S/ t/ z; F% e' G7 u  X5 p# ?( @4 T8 ^# V) ?
8 Y- C" E0 r6 n+ i% g8 x: S
Method 14 5 e1 B7 d& m; y& Y# v$ Y
=========( H5 l! ~+ w6 N8 f, q
& ^1 {0 w( k, t9 o6 _
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose" q. u, `) J3 x% K9 J; c$ U
is to determines whether a debugger is running on your system (ring0 only).
! n' J. F, D7 X) c9 @' F4 _3 o7 s! Q1 H5 e& [# n8 l1 P/ ~9 ?$ }
   VMMCall Test_Debug_Installed8 a5 k* h8 n+ y6 r3 g
   je      not_installed3 n7 q  \0 u+ R, c& ^

* ~7 ?3 G/ s# d8 c' q; LThis service just checks a flag.
+ \0 E& x/ g# D2 r+ n6 i</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部