找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
# Z: k4 M9 ^& T4 w4 m/ X4 m+ D+ D$ |+ j<TBODY>: a- a! r' s" t' [) v7 F* O
<TR>
" D$ H+ E6 `( ?! A0 p( [5 }<TD><PRE>Method 01 " S' ^! d4 W" \& `) d( O/ l7 I
=========
7 m/ F% l' `( }1 j& b! ~2 [$ e$ ]
1 n2 `1 c3 e( f" a# QThis method of detection of SoftICE (as well as the following one) is
5 r6 V, C+ {& o( R3 w' y: vused by the majority of packers/encryptors found on Internet.) S& C' ~6 N# n* F4 ~; f2 c4 Y
It seeks the signature of BoundsChecker in SoftICE
/ q$ }0 H+ [. |, U# ~
' _' X" `+ Q% M. B3 a    mov     ebp, 04243484Bh        ; 'BCHK'/ P$ f5 O! \( Z! R" G
    mov     ax, 04h
) V; L' z( d( t    int     3      
5 l  A8 a, G4 Q" I8 S9 t    cmp     al,4% t% [7 J9 S/ C5 C0 b% b
    jnz     SoftICE_Detected3 t9 Y) Y1 w( C# }2 j4 m* ^& n( k: Y
7 ^0 n' Y- e, x: D
___________________________________________________________________________
% q$ R6 X. s5 C3 L8 ]! b3 k
  ~8 o, {. e2 v0 xMethod 02# j* L7 s, r7 C, V' J
=========1 y' @4 T" H' P

0 g+ k' M/ Q9 j- z$ e6 k) n% aStill a method very much used (perhaps the most frequent one).  It is used
2 W3 P' I1 _( h9 x5 O9 Y4 Fto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
, S' t! c* y" K( b1 I3 t; zor execute SoftICE commands...& ?2 `& }7 ^& v5 G& t8 X8 k, X
It is also used to crash SoftICE and to force it to execute any commands9 V- ?2 i: y; @5 K2 q
(HBOOT...) :-((  . t" ]4 m) k5 r* a) v+ S+ f
0 j. p) }. j6 ^3 X6 @- H: I
Here is a quick description:) ?: v, F# U% A/ [' ~
-AX = 0910h   (Display string in SIce windows)
" u# f! N2 X. f# j, f0 I5 H-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
) Y8 H3 q, s# _* v-AX = 0912h   (Get breakpoint infos)
# m" m" R9 M& c9 e-AX = 0913h   (Set Sice breakpoints), P  r. w/ x  y0 m4 q
-AX = 0914h   (Remove SIce breakoints)
3 [+ Y3 e1 {9 V# B* t0 r. R4 |$ i( j- K) M- J3 p! C
Each time you'll meet this trick, you'll see:
: H, m( T& U/ B2 u" i-SI = 4647h; `+ ^, s) A# t* G' H3 q
-DI = 4A4Dh3 }, o! U! S: P2 y' S* Q
Which are the 'magic values' used by SoftIce.2 e9 l  m7 S, c6 ~5 R, O
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.* ~7 y+ z8 l8 l0 [) Z

2 U( u2 H0 F% S+ f3 o. xHere is one example from the file "Haspinst.exe" which is the dongle HASP) T, B- p2 _6 W% G& f
Envelope utility use to protect DOS applications:
& S: i4 `- x% S6 A- e* |& ]* r
1 l, |% A. H% Q0 m) c0 n
. Q6 i8 ]- Q7 d4C19:0095   MOV    AX,0911  ; execute command.
6 I; a3 b$ N; X) w, d/ X$ s2 s' o5 z2 s4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).6 M3 }) d) _5 X( E6 K
4C19:009A   MOV    SI,4647  ; 1st magic value.
' t! k2 f: Z9 U3 J) m/ f' P4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
$ k$ q2 f$ a0 Y  I  A5 O4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
( d* d' L" u+ P/ y2 j4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
* i. K  a3 }/ F  U4C19:00A4   INC    CX
1 W6 L/ ~, S4 k6 h' O4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute' E, c5 K9 P) k5 y' |
4C19:00A8   JB     0095     ; 6 different commands., \* F! A) F4 [4 a! n: [
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.6 j& ?4 D' b7 E$ {2 L# z
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)# ^7 M: l) Q+ Y+ G" a, t
* @& A7 N2 X+ j) R" r
The program will execute 6 different SIce commands located at ds:dx, which
  Y9 l5 a* Q# s. z3 O4 kare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
  p7 C  v" [/ S: ~% Y( ~( ?0 P* S/ `* E) {4 r; f9 k
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
! [/ I  {5 S9 f6 z/ i* P___________________________________________________________________________6 G7 @6 T9 Z$ |6 H& C# {

3 I$ R( }" t9 q5 J
. ^9 k4 m5 x' |* q6 g  M  CMethod 03
$ m  Q, K/ u1 L% M0 g. m$ o) L=========/ r/ X8 m5 E' S1 u9 G% Y" z% ?- x

+ X0 v# F9 k: w/ v* \Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h$ H- a: Y# `* B! {
(API Get entry point)
! C" E5 i2 L$ [9 T; A) I# Q+ C        4 K* ?) E2 m) P! T: A( E0 S+ u
4 ]" I5 }( G- ^' @" M
    xor     di,di
, {- v+ N9 O, r7 J: A9 |! T4 m    mov     es,di
9 W& b7 F! u0 c7 e; V' \3 F: W  O    mov     ax, 1684h      
! q- s" A0 u/ i    mov     bx, 0202h       ; VxD ID of winice! V! `) u- a2 z: M$ ^5 U
    int     2Fh
4 o; _- B/ Y6 B1 k) l    mov     ax, es          ; ES:DI -&gt; VxD API entry point
$ E! k" |0 W7 A0 b3 W) C4 S. [    add     ax, di) F" t8 X6 w2 O1 }. M$ ?
    test    ax,ax% _3 i' U" ^( p% l
    jnz     SoftICE_Detected
# i5 w: o* y8 e- r+ w/ n2 }% v/ Z
___________________________________________________________________________( F& {; N* S: N7 ?3 o! z. y: Z

# J( r& |2 d3 }! e, ^Method 04
# r1 c& x- \; \, W5 h) m4 @=========
8 H7 T) s4 J7 g5 H; L: ~( f9 K! p0 |5 E6 b+ K6 [* W$ r. x0 y  K
Method identical to the preceding one except that it seeks the ID of SoftICE
! I8 K* e( \3 S1 `) hGFX VxD.+ R* W9 e& Y$ I7 d3 }, b

% D8 u& ^3 ~; f- I) z    xor     di,di
. _; v# Z9 `! k0 ~    mov     es,di+ X! `* z9 |; C* {. D* {$ j; h* ~1 \
    mov     ax, 1684h      
6 n4 x  \; X' a! W8 b* h    mov     bx, 7a5Fh       ; VxD ID of SIWVID. @) @. |1 l! Y# u. r+ J6 Y! Y
    int     2fh3 X& m5 N' k  P
    mov     ax, es          ; ES:DI -&gt; VxD API entry point" b( l* {% @. R( K
    add     ax, di
. I: Y) f0 B& ]3 I    test    ax,ax& E; U2 X6 o3 h, c( K
    jnz     SoftICE_Detected
* e9 _; i' S3 K6 E, G0 c4 Y
' ?5 V( Q4 K; ^* y$ P__________________________________________________________________________
) [+ N. h2 o" T2 M: j* o! U( L1 p- h7 A& `

0 w; ?0 N. k) [. R- }5 w/ DMethod 05
* C2 L$ A3 z8 Q" k5 q6 \=========2 N' J4 F! k, @
. p1 U9 K. W. f- b2 `/ t
Method seeking the 'magic number' 0F386h returned (in ax) by all system
7 P4 p2 K0 d; |debugger. It calls the int 41h, function 4Fh.
' p, T. F. A6 jThere are several alternatives.  
7 ^3 k  z- N2 t7 s6 s3 r& b
& M) d: _7 f- I0 [3 j/ x  h5 SThe following one is the simplest:* T2 m. [4 I0 d# n5 |
( [7 \  y% E8 i4 y! j0 i
    mov     ax,4fh
% J. O/ M6 W7 o  E9 `+ [    int     41h
/ ^5 n5 y' u% n) R! {    cmp     ax, 0F386# J7 X7 C, X3 `+ _1 c! F
    jz      SoftICE_detected' x  U/ g$ q1 p5 N
( @* l  g, C) L5 B0 Z

5 a6 S. D$ p  GNext method as well as the following one are 2 examples from Stone's
- ^0 d' }* @3 @: p"stn-wid.zip" (www.cracking.net):
; U6 ]; {4 f/ G, J6 ]- `- R  i) p9 C1 G3 q9 w
    mov     bx, cs. {, H% t* o8 d
    lea     dx, int41handler2( V7 k, q7 ^  B0 f. R, i" n2 ~
    xchg    dx, es:[41h*4]2 d1 p# s0 m, }! a1 Z) c
    xchg    bx, es:[41h*4+2]
; n3 H. {+ j, B    mov     ax,4fh9 O5 i; n* r" n1 t% E1 z6 h5 o9 Y
    int     41h8 f9 T# R1 p7 L* }& T4 ]
    xchg    dx, es:[41h*4]  I: g4 f& |; U' s. q1 `$ }0 y: M9 @8 u
    xchg    bx, es:[41h*4+2]
& P7 [3 ^8 }9 W0 C5 |  N* ^    cmp     ax, 0f386h
' r- t/ V% O  d7 N3 a    jz      SoftICE_detected
8 ]/ q; f( F- \  ~: [; P
; E& z+ E5 {/ a6 I, i3 m+ j: mint41handler2 PROC- Z- B! G$ f  U' _3 J0 ?
    iret' V5 {/ Z6 I- K* z# d
int41handler2 ENDP( o9 c' ^0 v$ i7 f

6 h* ~- S1 ~+ Y' Y/ _0 g9 m3 ]# X
' T8 }; z' L, Y$ I7 Q  \_________________________________________________________________________* A& u& N/ Y' a" g) l$ o
/ C+ R! U/ o6 X0 w
, W% h  m0 f' a2 \2 G3 f/ I
Method 06$ W, R) R$ F5 e, ^3 Y7 K
=========
1 c% c" w8 k: y( C1 R% l8 ?0 r: G6 L* |  [: W1 O. j: w
9 ~! R' ?  ]3 e  _9 _6 d
2nd method similar to the preceding one but more difficult to detect:4 [4 B5 F2 s" y2 `7 W8 o
4 V# G) U" n9 d+ ?

3 p$ G3 a+ j2 U3 k& C, j" O& Uint41handler PROC0 b+ l7 o0 H* C3 A% [9 d
    mov     cl,al
0 n) z# I/ G. X2 g0 j$ Y; {2 I4 @    iret% t+ U8 S+ ]6 F- a, ]" t
int41handler ENDP
8 `- A3 G" y- \
6 i$ O0 d) ]% {7 K. a
! s) F+ }; k4 E8 m: s    xor     ax,ax  f: u5 w; z7 d2 F* I) s3 r
    mov     es,ax' v6 @5 a# D- t) z
    mov     bx, cs
( g+ A1 d* m" P) r* i! l- B+ S    lea     dx, int41handler
1 ]* F$ P' U( m, a$ m    xchg    dx, es:[41h*4]2 ], ~0 L1 d6 ?) j) @; R  K5 J2 I7 W
    xchg    bx, es:[41h*4+2]
7 X% x# |8 O# x: T    in      al, 40h9 x) \( }5 i/ M, q# e  F" V: d+ }
    xor     cx,cx% @: T1 S1 a( c; {# I
    int     41h0 ]2 M0 w0 B# O  L' `) U* ?, R
    xchg    dx, es:[41h*4]' ?( F: \/ _7 b7 p" p0 S+ W8 O
    xchg    bx, es:[41h*4+2]+ ~8 ]: F& |- D" k
    cmp     cl,al
* @6 n( \! W! ~    jnz     SoftICE_detected7 l! }) \; k. x3 v6 ?. Z

/ [- t5 R1 j5 X- d/ L2 |0 |1 j" @_________________________________________________________________________
; o$ C: r" g0 o4 Q: i' Y$ g: z( y
' t0 H+ }0 @, _7 V- Q. YMethod 07
* H) Q! M! @& G' v, m! |! P. V1 C=========
/ r. @3 Y! W; _2 p6 I  Z! V7 b/ ~: J  E3 d' l! b
Method of detection of the WinICE handler in the int68h (V86)% z* C+ ~$ T  _% r6 B2 W

! f9 H+ @4 k* ^( V. E. u* w/ I    mov     ah,43h
$ ~6 ^" ]. F& f% U- c' e    int     68h
$ Q% p" \! C& m8 N3 v! O+ |    cmp     ax,0F386h
& n$ L& G% [0 [6 Q    jz      SoftICE_Detected. x1 ~/ b+ S3 I0 L5 U0 k( B
/ v* `0 k8 m3 {+ B$ P- ^
/ S% f  [$ O/ ?. o
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
) D) m+ k2 @8 M   app like this:
% T$ S2 K( X* ~! _) W+ O  _0 y" {# m$ C' G
   BPX exec_int if ax==680 c! i3 K1 P6 @
   (function called is located at byte ptr [ebp+1Dh] and client eip is' Y% O( C* }- E. a0 G/ r
   located at [ebp+48h] for 32Bit apps)
7 y8 }8 K# @- `__________________________________________________________________________
+ J$ M4 _, [: L/ o: D+ ^9 H* }( f. {0 S
/ s& t) B$ s. [; c/ E
Method 08
; D# h  W' N$ S+ j$ o' Y/ v=========8 \# I5 i+ E1 x, R1 {1 p
( z% E; u# c; d# B) ?8 e, i
It is not a method of detection of SoftICE but a possibility to crash the
1 ?* c, {7 s( z- X; u/ M1 k$ tsystem by intercepting int 01h and int 03h and redirecting them to another
* P2 f) [& a* ^# e" i: l+ i; Proutine.
1 H6 b% F9 {; c: c- ^It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points( Z2 F# `! U8 U! e6 \& o  f; z2 d
to the new routine to execute (hangs computer...). [5 E+ E2 c9 U" R/ {& b9 M7 q- |
7 ?, o: _! F2 r. \& e& f2 ~
    mov     ah, 25h- N/ M  h% Q% C7 K1 g; f1 R
    mov     al, Int_Number (01h or 03h)1 \7 @6 k! X4 Q8 I
    mov     dx, offset New_Int_Routine) ?; P! X5 l' `  t
    int     21h
) }  A9 X6 }7 [8 A% v
3 B- Y$ d! ~! M__________________________________________________________________________
8 s; ?- o  s6 \+ q; G3 `" Q5 B+ @) V
Method 09
; [1 ]4 o8 f  [& l: R=========1 W3 g$ a+ e1 k
8 K/ F# T# i; t  k" H  C
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only3 o9 G1 c: C; t) }9 }2 e8 c
performed in ring0 (VxD or a ring3 app using the VxdCall).' E% h% ?( {0 x/ G1 i" n
The Get_DDB service is used to determine whether or not a VxD is installed" V- K5 e. Z! G5 ]
for the specified device and returns a Device Description Block (in ecx) for
+ p7 f8 |: R- B3 \1 E5 |that device if it is installed.
" D6 I$ ]+ P7 m: j/ D2 |* _! s  c& @3 O! _7 M+ N
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID/ j7 p# y8 _" ?& J: @/ y
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
) ]0 R8 c0 J- L4 z% B. s& B" N   VMMCall Get_DDB7 a/ p1 M) @/ f, j
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
: W: p$ ?( P. R7 d  P/ I0 A8 n/ }+ i' @! C$ J
Note as well that you can easily detect this method with SoftICE:
- m) B- W0 t# W   bpx Get_DDB if ax==0202 || ax==7a5fh
6 _" v) U8 k5 E$ l1 N
1 B( S; J4 m+ U" D' z" y4 z__________________________________________________________________________
& p6 E& w8 a( I; J
! t8 g5 ~0 S; C: z# T2 QMethod 10& E. G# e) _/ `, c
=========' k8 z. |! }1 o4 C8 y, p5 k2 a
) s: J( h7 w* z# [
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
% }# s2 p6 c" i1 g  SoftICE while the option is enable!!
6 }" r0 W3 y& l4 V5 Z; M' R' b, s- X* `
9 N: f: C! F$ _, \/ zThis trick is very efficient:" b% _3 B2 {4 Z7 L, u' G
by checking the Debug Registers, you can detect if SoftICE is loaded7 i% z$ H! F. i$ N6 D
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
! {1 V  ~7 j  p6 X. m& d) \there are some memory breakpoints set (dr0 to dr3) simply by reading their
9 y: B% }% M& A5 X  hvalue (in ring0 only). Values can be manipulated and or changed as well
: y  W/ ?1 D% A* }9 C(clearing BPMs for instance)" n0 w1 j! z& W. r9 R
5 t; ?3 m4 k$ L" R" e5 k, I2 ^0 Z
__________________________________________________________________________
* X$ t. Y* J2 W0 T: ^' [/ }1 D9 r
- E! Y) ^- B. J5 H$ d% q# t2 s6 w- L5 aMethod 11- t) d3 C( y$ V8 Z$ ?
=========8 p3 ]1 [2 E9 g

$ c, M" V- d) c6 ?This method is most known as 'MeltICE' because it has been freely distributed
0 L( M( L& E: F7 d" \via www.winfiles.com. However it was first used by NuMega people to allow
$ p8 y5 f$ V6 C+ W* kSymbol Loader to check if SoftICE was active or not (the code is located: f) m  Y8 z& |" e  L
inside nmtrans.dll).
# M4 l8 S, c2 {$ |5 ^$ b- o" O! k" q' w0 Q: C1 }" o
The way it works is very simple:+ I! H' h+ G1 r9 |! I+ s% t
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
5 L% U4 V% ?/ k( z$ E+ o4 pWinNT) with the CreateFileA API.
& L9 ?/ j. W) j
: y/ }) v. i0 a8 `Here is a sample (checking for 'SICE'):
: C+ w. _7 J9 J/ x
6 i4 A/ M8 T- m3 G' h+ E0 L+ t, SBOOL IsSoftIce95Loaded()
8 i) K; J2 c: ^9 g% a7 j5 c{
0 c2 W$ H: J" W4 f& S   HANDLE hFile;  , O4 Q9 V3 d( L! _- Z
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
% Q8 E0 n, A8 w( Z5 c* H& e' h                      FILE_SHARE_READ | FILE_SHARE_WRITE,
7 m5 H4 U2 A4 T8 V* x                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);4 r0 _: u7 G! I* X# A, C% {9 ?7 Q6 U
   if( hFile != INVALID_HANDLE_VALUE )
7 t% X5 n0 z5 g% }' C  l   {
" B8 G" K/ X2 W5 _) L      CloseHandle(hFile);7 h1 M/ A# H" \: }
      return TRUE;
+ f. [6 T5 _7 S1 b7 z   }+ _7 d% U4 U, S( z: m
   return FALSE;
7 f( k7 m9 R4 b) w}
7 t/ B$ x1 Z, U: U5 d* [8 C7 Z/ e4 a$ m5 c# i! V( R# v. p% K
Although this trick calls the CreateFileA function, don't even expect to be) I' P+ ]$ B5 j4 S; E
able to intercept it by installing a IFS hook: it will not work, no way!
* P. p; r9 i* X5 a2 E% j5 jIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
1 G3 g. e4 k: Z& F+ Eservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)5 W. M8 q4 H: H
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
' e9 n  r# L9 ^field.
: w! Y( h) y& s$ ]6 ]+ tIn fact, its purpose is not to load/unload VxDs but only to send a
0 K" d/ r7 K5 s" v! V; TW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
+ V! H& g+ B4 Z% ^& Vto the VxD Control_Dispatch proc (how the hell a shareware soft could try
0 y: V; ?* e/ y) b0 ^* Kto load/unload a non-dynamically loadable driver such as SoftICE ;-).
5 z3 M+ p) ^9 Z  \; t8 _If the VxD is loaded, it will always clear eax and the Carry flag to allow
# |+ l4 k. U) ~8 i  }) rits handle to be opened and then, will be detected.
, _9 T. |, ]. Y* MYou can check that simply by hooking Winice.exe control proc entry point
$ a" M/ K% V2 uwhile running MeltICE.
" C' @: b: W4 i* t; b3 e7 o4 b: L' h( ?2 ^" ?

& a4 `1 n, B  P1 G# ~% G8 m6 y6 X  00401067:  push      00402025    ; \\.\SICE
2 b6 I0 g3 s) b7 L# c  0040106C:  call      CreateFileA
3 X$ C* \0 R$ |5 ]7 w. R3 B  00401071:  cmp       eax,-001. }) v9 `2 Q  F" o
  00401074:  je        00401091  I/ ~. k' g  }, ]2 G, m5 z: f

: a. x, f1 O9 M* {' Q" O$ J$ H: F3 C! I/ R- |' q" h
There could be hundreds of BPX you could use to detect this trick.4 T6 C* d3 Y& ~' N* @7 P
-The most classical one is:6 A7 u; l2 a) N" r7 _& c- U2 J
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
6 |9 w( g; e* q8 a- {, x# H) }' O    *(esp-&gt;4+4)=='NTIC'
, l" _7 |& Z6 O3 v7 P8 k
  W+ M, c4 Q+ [9 f1 O8 e-The most exotic ones (could be very slooooow :-(; X! v4 D9 E" Q' Q
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')    k7 Z- y0 _# f% e0 w3 P
     ;will break 3 times :-(
8 ^$ N! D2 V& J# `+ a2 P5 @4 r5 I( P6 m" X9 Y* {" Y/ B  e
-or (a bit) faster: 8 I9 m7 I2 c8 h. |! g
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
0 W; S8 f* u- e" @, v1 M9 B# i5 K( T  \" b+ ~$ @3 Z9 z1 j
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
7 s2 M) `/ Q! h. K8 H     ;will break 3 times :-(2 P) Z' L. u* ~

9 B$ L' j, v& {) X8 G8 M-Much faster:
7 O* h4 w& b; z1 i$ g   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
3 P( d0 l8 `! s' P5 y8 \8 O& v+ |& g& F" O! |8 s9 C8 ?
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen- K# z; i1 s. r* `5 r
function to do the same job:
5 B6 X% l! G- |
2 u/ ~" [  \" o3 m   push    00                        ; OF_READ
% M8 d5 i4 g8 [8 L: _0 l7 b5 M   mov     eax,[00656634]            ; '\\.\SICE',0+ S! r2 S) w2 G9 t  W7 F9 R1 L8 v
   push    eax2 K8 n8 ^# O  Y2 \
   call    KERNEL32!_lopen5 T, A3 W# {; v/ u: y
   inc     eax
  c, V; c0 k! A9 w   jnz     00650589                  ; detected# C1 O1 U3 d% [, {2 J
   push    00                        ; OF_READ
* U2 B& n3 J) o# {5 z: j   mov     eax,[00656638]            ; '\\.\SICE'
: ]- b- Y, F9 Q! z* |5 f   push    eax5 q  F3 h5 N3 }2 y: w* C& V
   call    KERNEL32!_lopen
9 M/ c% d* w3 {: @9 O3 ]  K   inc     eax
& w0 F" x8 `: t0 K# p' V7 f' P, A   jz      006505ae                  ; not detected1 R0 g' F: `" e7 e  k# p% u8 U

2 L( m' n8 b0 ^% L7 r
8 w, k" Q9 _8 U( }7 |__________________________________________________________________________
3 e* C7 a+ I# t" C- w& }% p2 k  M4 H6 V; K+ z( K& ?
Method 127 U) d. i) s' R+ O* ?) a
=========. U, ^: `* b2 s. h8 x/ e
% R' d9 S0 `7 k8 h" Q3 [7 F
This trick is similar to int41h/4fh Debugger installation check (code 05& O0 P: f$ M( M7 E7 u4 e- ^
&amp; 06) but very limited because it's only available for Win95/98 (not NT)
. o7 ?: q1 G8 k- b9 [1 K% ]as it uses the VxDCall backdoor. This detection was found in Bleem Demo.* N- ?  G  R# a; k6 V
! D; w, x" K' a1 }2 C/ O) U7 g# V
   push  0000004fh         ; function 4fh
6 E$ T0 I$ x+ l: H( i   push  002a002ah         ; high word specifies which VxD (VWIN32)
* R# n# Z3 B5 I3 G( h3 t' w                           ; low word specifies which service% d4 M) i8 `7 ]% M) O
                             (VWIN32_Int41Dispatch)
7 i& t( m% z1 N0 C   call  Kernel32!ORD_001  ; VxdCall! @4 e6 R0 H) `
   cmp   ax, 0f386h        ; magic number returned by system debuggers
! Z( R9 i/ r- b   jz    SoftICE_detected# r7 q' U- t: c6 Q" e0 U+ q
) d! O% I# n+ [  J; S2 d
Here again, several ways to detect it:7 |* T5 J0 Y" J

  x. k  q$ @5 Z1 l7 R. [    BPINT 41 if ax==4f8 D# Z+ D* k2 a  l0 Y

  n) @: a- w; n! X- U% a- `# n    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
8 ]* W* _4 \; M2 {9 J
2 m3 c* y* S% ^6 t& S  ]    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A* z$ N" z9 `  X2 b

$ j  a% K* _* ]    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!* H- m6 i: L, ]/ J# k

8 i( X# `& R* L1 e, {__________________________________________________________________________
0 V" L8 d1 c# S2 ~& M  d+ E6 R
) X- K0 k4 r& C8 R% M/ R* tMethod 13
; L7 S/ t# z- w=========8 l4 N: m* v% b% `4 \5 I

7 d0 `2 Y3 y6 M- e; RNot a real method of detection, but a good way to know if SoftICE is
0 u( X% j& i/ s% d6 T/ \installed on a computer and to locate its installation directory.
8 e# f5 ^3 L* X3 n% G6 U# w! u# l3 GIt is used by few softs which access the following registry keys (usually #2) :
0 q: D! I! k% J' z
4 I6 M: c' c2 ?& ~; N) A# g( z: n-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
, u8 w7 S9 e; Z* m\Uninstall\SoftICE$ @( L# B% H- t! z9 x
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE5 ]& Z" z$ Y# ?$ T% W
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion$ R2 D) X2 C$ q
\App Paths\Loader32.Exe& K- w& J' _1 l2 w/ x
$ a  N# V2 R1 L6 ~. ]
8 I( r  V1 h9 H! O6 m/ r- c, i7 }
Note that some nasty apps could then erase all files from SoftICE directory
# v8 \3 D3 `2 z' v+ q(I faced that once :-(
9 @8 r, m; `- Y  I
: k; z: Y6 l" n( |9 [Useful breakpoint to detect it:
. ]- k" T+ O7 \0 V8 p2 m
9 ]. d0 t' }: k     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'% J9 `' t/ {1 d2 n' W" \! u6 e

* M& W/ W) a* `: R__________________________________________________________________________0 G2 M2 p5 m7 U& g1 K# f
; M4 h# o  [4 J( a

2 {1 {; k, M/ L1 S/ HMethod 14 3 F% J# ^+ g5 P. m' b' T
=========% w4 h3 I6 ^: U9 G) O

' B# M( z, C2 |4 G/ x8 m4 W5 ZA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
) D, q/ D6 E# u5 I) uis to determines whether a debugger is running on your system (ring0 only).
7 \) |7 @+ W/ j2 t$ a
' c8 S! L! Y3 I; H. K2 U& q. i5 W   VMMCall Test_Debug_Installed
8 H: s4 D4 J7 l) e   je      not_installed& n# S$ {) k; j" [* J1 {+ i! J
: u' h& F7 ?' l/ O3 S
This service just checks a flag.
% v6 H9 t* Y+ c* o3 G2 p</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-7-28 16:33

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表