找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
0 }; i7 x! i4 o1 i2 N4 d4 n<TBODY>
" V6 n8 V. Y2 O7 C. P' t2 R<TR>. `0 z. o  _8 {; ^; F' n" W
<TD><PRE>Method 01
( ]! c' D7 f0 ~% q( _3 h: x7 B=========; }! {1 @& M# S: i- \+ h
( F1 P# Z  f0 {: n! d
This method of detection of SoftICE (as well as the following one) is/ w7 n% @4 M" n# y( H2 `# f
used by the majority of packers/encryptors found on Internet.1 u, C2 t" X8 M' A1 Q  x
It seeks the signature of BoundsChecker in SoftICE% R6 s2 [- P  p# Q1 H

5 v  u! S8 R7 Y    mov     ebp, 04243484Bh        ; 'BCHK'! u, K6 T  c: d! V- A9 s. z
    mov     ax, 04h
% z2 t/ B" Z! i8 G  D    int     3      
! A' V6 y% _7 d! }1 C; u    cmp     al,4/ n2 T3 I6 C, D; _$ f4 U; t
    jnz     SoftICE_Detected
1 p% [& _: V9 |. ]
. |$ u: r& a4 Y2 K___________________________________________________________________________
9 S2 R3 f( o9 i- ]: I
3 Q& l  o2 [6 X9 t8 q2 U  M% \Method 02, L) b( W+ m7 {' n! ~  {
=========
" ~9 F% V/ r5 Q7 e& L' S7 `5 N2 \( T& U6 u* h  i2 U. P7 X
Still a method very much used (perhaps the most frequent one).  It is used
) k( y6 @+ |5 i8 b4 s  Hto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
  A( i: p% E: t8 B7 Q. Y4 Aor execute SoftICE commands...
% E! i% K- @; C2 [It is also used to crash SoftICE and to force it to execute any commands; `# U1 \1 i# c6 Z7 C5 h& Z
(HBOOT...) :-((  8 @" W5 g7 m) O/ G+ E$ `; C+ }
" Q$ @: X, n+ E: R
Here is a quick description:5 K( P8 |7 Q1 T+ ?7 J- `* Z6 l
-AX = 0910h   (Display string in SIce windows)7 y2 X+ L9 S9 b4 i: F. |
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)3 y* G# w0 q1 g& d( U
-AX = 0912h   (Get breakpoint infos)* h( W/ L8 M) q
-AX = 0913h   (Set Sice breakpoints)
4 c' d) `5 Q) @6 ~6 r-AX = 0914h   (Remove SIce breakoints)7 f0 S0 O2 l& [" Y
# D. Q9 S: _, R* w* n5 h9 z
Each time you'll meet this trick, you'll see:
6 o7 @2 \7 G0 d-SI = 4647h: t2 e, \) @& N4 k
-DI = 4A4Dh
5 X, n0 F; u" v3 y. m3 c& b4 w9 yWhich are the 'magic values' used by SoftIce.  B% |9 j* M/ H' ^0 I# N+ z8 o4 C, Q( g
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.  F* Q7 I7 Y/ |9 G
/ Y: T% e& i6 E0 r( v( B
Here is one example from the file "Haspinst.exe" which is the dongle HASP
( ~. j/ x- z$ j% |Envelope utility use to protect DOS applications:+ H/ n5 g1 H+ o% A! M

. |6 n7 M, q$ i7 n7 `# |: l+ I- ^$ o
4C19:0095   MOV    AX,0911  ; execute command.
% R# k; t- q( e: @8 J8 D/ N4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
$ p: x7 t) {! f3 s4C19:009A   MOV    SI,4647  ; 1st magic value.2 w8 v8 N! ~% k0 ~9 O
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
: j* p0 L9 X1 _5 q2 F& r4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
! p8 f9 c* \4 h, j5 W4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
6 i+ N: g' _, c1 a: ~4C19:00A4   INC    CX
# L3 A4 S  w! m1 E# X; a3 |4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute9 }6 l' v% W* i
4C19:00A8   JB     0095     ; 6 different commands.2 U: h0 w" c* K4 S
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
! M* @9 D' o* d" i: v% y% R# ?4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)* T: @( ?2 W5 y2 u  z, h1 E

$ b0 `% S+ c4 r3 |8 k- pThe program will execute 6 different SIce commands located at ds:dx, which6 W/ c) y1 p, |0 s3 |5 K% r
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
8 E1 n7 N8 r. O5 h* Z; S2 ]
* C% T2 l$ w1 p. H( r* S* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
0 D* T2 H! g- E2 G  {8 @' R___________________________________________________________________________
; F# \7 _& S3 J! q1 U9 f5 L& a# t- I+ L
' R; V/ d) B0 M! g* ^
Method 03
9 x) `& D6 @+ u6 Y3 A" [1 ^4 ~=========
+ w) ]8 v9 W5 j( l+ h7 A0 h* V' w
2 v4 d5 k( }2 T5 G1 q5 P7 `Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h$ g9 V, x( x% t( ~
(API Get entry point)
) J8 E. i2 q. f: N* Q% D        
! h# Y, f% o. \- k& w; k7 j  I" I
/ ?2 d6 L: l( d+ k5 E: F: n9 f7 l    xor     di,di
( o, _6 t- B) n: U5 o# R3 r5 Z    mov     es,di+ p' N5 Q1 @7 h- A* {
    mov     ax, 1684h      
2 y7 P) }8 I0 N( N7 K" F& K& K    mov     bx, 0202h       ; VxD ID of winice
* c' \3 _6 W. B    int     2Fh
5 B2 q+ i+ E3 L9 r' e6 N7 p    mov     ax, es          ; ES:DI -&gt; VxD API entry point( [+ K# g) H5 `- ^  @
    add     ax, di
9 Z' M. S0 R- V' m    test    ax,ax
. R; A6 `0 u+ `& \$ G$ o    jnz     SoftICE_Detected# x3 o) }2 C/ {( T( q
' @4 u! C& a" i# c8 s$ {
___________________________________________________________________________; W6 r$ t' k+ M7 x& t

7 |1 a3 M( O3 PMethod 04# ?* m& @% _" I
=========
+ _( r4 S* f- _
! f( V. Q7 u- l9 {2 m: K+ Y8 OMethod identical to the preceding one except that it seeks the ID of SoftICE5 a2 U) I( u) b  X+ e
GFX VxD.' D- F4 @  ~0 C6 b. i
" c6 L4 y  d# N9 x. ]$ r  i+ y
    xor     di,di. L2 @) k* g; N% h( U+ ^
    mov     es,di
; |- }1 o" v0 h  ~. J, q; X    mov     ax, 1684h       6 X/ x% Y8 O1 ~+ T
    mov     bx, 7a5Fh       ; VxD ID of SIWVID
$ Z: E' r) }/ t$ ?: U! k7 i    int     2fh
2 o) L" Z1 a2 T2 a1 h( l2 R    mov     ax, es          ; ES:DI -&gt; VxD API entry point
! E2 G, _1 Q! w  t- |    add     ax, di0 Z3 K8 k' |! V7 b9 e" ~
    test    ax,ax" L( h( i  `4 z0 S
    jnz     SoftICE_Detected. M/ o2 M2 }) Q( Z) I! H

# \1 l' e- L; w__________________________________________________________________________
6 x& F. e* d6 M" g2 I- {3 n7 W* K; `) s, b9 n
3 A6 a4 X# }! ^- [
Method 05
& y8 {! U4 w6 Q5 r=========3 r# S2 N$ F3 ^
# @# F9 _/ Q+ x3 ]1 e: z0 S5 g) L
Method seeking the 'magic number' 0F386h returned (in ax) by all system* z( q7 ?. |. B6 `" L# ^: j& A% a
debugger. It calls the int 41h, function 4Fh./ C5 ^9 G0 T! a3 {
There are several alternatives.  
- V. s7 V9 f; h3 p; x" o$ y7 r3 ~# o. }2 {/ T# c
The following one is the simplest:3 Z& X4 ^  {6 J) c5 H
; `0 z5 x! x  }4 }$ ^% s5 C
    mov     ax,4fh
' ^3 Z3 T2 r1 z( ~# l" D8 V    int     41h
2 A9 n  f( t8 Q6 O    cmp     ax, 0F386
3 n# I8 g+ U+ O  V. H    jz      SoftICE_detected
& D: c* \# p: E0 r1 A* b; S0 w; _6 H9 p2 N7 H6 V
( m- P" L  Q. [9 U
Next method as well as the following one are 2 examples from Stone's , n% u4 L* X+ p/ G. e4 D+ l
"stn-wid.zip" (www.cracking.net):. Z. a9 {% ]) Q. b1 g4 u  N

% U  O: q3 O) V    mov     bx, cs
" J: T: y1 W7 c5 q    lea     dx, int41handler2
# S5 ?$ a* ]7 s$ k0 E. m8 q    xchg    dx, es:[41h*4]$ ~' G# g/ P$ b* @- |
    xchg    bx, es:[41h*4+2]
' z5 u. R  d" W! c: `! |    mov     ax,4fh5 W& X! z, `2 T1 Q' y+ ^; g" t
    int     41h
' Z; Y$ K1 a* O0 f: }* k! A* }0 X    xchg    dx, es:[41h*4]
3 ^  `5 }3 b3 r- h: K$ ]$ |    xchg    bx, es:[41h*4+2]9 o% N/ h/ ]% W7 @( s' z/ V
    cmp     ax, 0f386h# c8 p1 n6 h2 r; T
    jz      SoftICE_detected
6 U+ w' ^1 }; Y2 X
$ y% x( e1 A1 y( e9 Lint41handler2 PROC
3 ~7 J; A9 J* a0 T( a5 y    iret# M- j7 U0 \- f. Y$ S" u
int41handler2 ENDP
+ q# Y( |* S! a' n4 }# d
) ?% @4 l( k2 s% E6 J" y2 [6 Q) a- V! W
_________________________________________________________________________7 z' r: }2 N7 m

4 S/ D- g$ g% W0 C% ?" G* \# {# Q: z! o/ P* a. k5 l) C
Method 061 H6 n& U; {1 b7 N
=========9 I* N0 \6 |: D5 b4 k1 K
1 `% F0 z+ m* I0 b9 J/ b3 d

# r3 y0 z# n2 h* _% E" ?5 N2 `2nd method similar to the preceding one but more difficult to detect:
% N$ @' S) c$ Y. d3 N
$ ^6 |- C3 W, t( S/ F
5 t, C0 @9 d6 j1 T; V0 h/ Uint41handler PROC
5 N( B* t/ U2 K" o! l) R: C    mov     cl,al$ B8 I9 _4 a8 v( \1 h
    iret
) U! P' \/ w- l$ Z$ O  |$ b* a% Lint41handler ENDP
" T( w1 U1 Y/ D. h5 G) w" ?- h, a! R9 O' I% t' M0 S
0 v  ?1 i+ \0 ~* t4 H. O$ D6 G
    xor     ax,ax
9 o4 c; B9 |  h1 b  [    mov     es,ax- |, g8 t- {  ?( l2 F2 P. R  a6 {
    mov     bx, cs5 r( s+ N# Q: E+ A$ t3 q2 D
    lea     dx, int41handler
4 c# |; N7 @% F2 {, {3 W    xchg    dx, es:[41h*4]
8 E! l; F) r" H7 _; x    xchg    bx, es:[41h*4+2]! c1 {& ?% O7 j7 R
    in      al, 40h" S( Y& K( }! b8 s
    xor     cx,cx, o6 H# c8 O; v
    int     41h
; ?' h2 ~6 d9 I/ q    xchg    dx, es:[41h*4]4 ?* J1 Y9 f3 F5 ?0 {2 t( k
    xchg    bx, es:[41h*4+2]
; q: y: M% z7 g2 j0 D# t    cmp     cl,al) `; K. F5 S3 C& ^7 `, V" x
    jnz     SoftICE_detected6 z. H6 ?4 M) a
7 Y0 A# R9 ?+ _- \. j& K/ w
_________________________________________________________________________
4 }2 I2 ~" O- V  d! x) M5 I
. V3 [  d% C3 ]" PMethod 07
& x0 n: J. f0 b( @=========) i; u+ B( Z( ?0 w

# h5 P  B4 g* c* K' EMethod of detection of the WinICE handler in the int68h (V86)
# Y" _' a0 A; z6 {0 k+ n. ?* w9 X! v" Q9 ?) K. L
    mov     ah,43h
0 ~' D2 }8 m* }& Y$ r    int     68h
( j! x) j. I! P3 Z    cmp     ax,0F386h
+ N' G8 ]) D! H    jz      SoftICE_Detected" m4 u6 w" C3 k: N
& ?6 D( D: h8 [0 ^7 G+ ?
- D. ^$ e8 S% ~) S8 t
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit" t% p  |! c, n# ~
   app like this:
: t! G* k$ Q8 K; B' ]7 o. Y3 r0 t2 m1 S3 J
   BPX exec_int if ax==686 t9 t3 U! b! o; G1 W
   (function called is located at byte ptr [ebp+1Dh] and client eip is+ l8 O7 e7 T0 @7 ~# R
   located at [ebp+48h] for 32Bit apps)
- Q) v8 p# Q6 r, }( b) x3 R7 d+ Y1 {__________________________________________________________________________3 V  Y# J! h  d3 S# c2 E$ P

2 P( ~) d2 n6 z$ }
& o% A: T/ p! \/ bMethod 08
- k# e0 L1 w% u8 _; h6 P- T=========
; `8 ^9 w3 R8 h* f( ?
9 ]7 e& A- k6 {6 k  ZIt is not a method of detection of SoftICE but a possibility to crash the3 P1 {) j4 V& I% W0 `
system by intercepting int 01h and int 03h and redirecting them to another# B) S: q- W+ R( n3 E: l
routine." ?( h3 I7 U9 {
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
" m" m$ g9 A6 q3 yto the new routine to execute (hangs computer...)5 N$ c& W7 Y% u. Y" Y1 k1 m
1 H; h4 `& z$ F8 W! L) ^
    mov     ah, 25h
: Q9 ]5 I% S. N) y' k    mov     al, Int_Number (01h or 03h)( A1 U: ^' E3 [) b; z6 Q6 ]
    mov     dx, offset New_Int_Routine
: C2 h4 W2 e2 S- c/ t0 N    int     21h
8 {/ r7 N( m6 H& E1 v$ L7 i# i& z2 a% Z# `& e: k, y' r1 g; x. `
__________________________________________________________________________
. t9 }8 q0 t( w" C0 w4 b/ T- `. ?, b/ Z5 ]: m
Method 09
/ g5 r  y$ J6 B=========: d: q5 H  g  k% i" d

5 y- O" C! |( m8 |$ Z, nThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only& t; ]! j% A$ \& u6 U' Z7 Z
performed in ring0 (VxD or a ring3 app using the VxdCall).
. s, e& w, K% t0 T: X* }0 EThe Get_DDB service is used to determine whether or not a VxD is installed6 L" X) G, |2 ?! \$ v9 ?6 |
for the specified device and returns a Device Description Block (in ecx) for! |* S/ p( W8 h) h! n
that device if it is installed.
% K" z8 m; x2 m5 h" }- l) H$ l) R$ L9 x2 `+ S
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
9 |1 v( V" Z8 I# L) S% j8 @   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)$ x6 a; F* \2 V& ~5 _) p) ]
   VMMCall Get_DDB: f2 B5 |0 g5 p) H7 Y7 t
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed) X  E4 j: {0 y# n6 \

! u' a4 B- c% s, N; Y, j6 hNote as well that you can easily detect this method with SoftICE:1 f' r/ q5 k1 a6 H$ v
   bpx Get_DDB if ax==0202 || ax==7a5fh! j7 s1 i0 S2 u2 \  T9 ?6 V  d6 \
, q, @: o7 g' A2 Q8 D/ R
__________________________________________________________________________4 }) n; b6 v0 w+ c. l6 j6 {2 K

* [1 y4 r" N; t% C$ z% g" j: u5 HMethod 10
, N* H8 Z* }1 k=========6 |/ {9 r$ C4 U1 X; p7 U

1 g" q4 d3 [+ s* R  e=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with2 p+ A. ~; t4 J
  SoftICE while the option is enable!!8 B8 Z+ M) n+ J4 i0 t* `

3 Q6 c6 U7 B; RThis trick is very efficient:
5 m  U7 |+ c2 a1 ?7 {, Wby checking the Debug Registers, you can detect if SoftICE is loaded
$ z0 _* L8 T2 ]5 H(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if, N+ j. u! G/ Y( t' u8 N
there are some memory breakpoints set (dr0 to dr3) simply by reading their
* U# V8 K9 H3 y) w4 n- `* ]value (in ring0 only). Values can be manipulated and or changed as well3 h$ T- D: u% Z/ ]
(clearing BPMs for instance)
2 r: A, s- ?! E% [  g1 M( U* i" b
  C8 L/ ~: T; _8 E  l# d  V8 W__________________________________________________________________________" _$ P3 P( N( Q6 [
# z! C' W6 E" t
Method 11
- L8 H, {8 R+ e! ?0 X: k' z=========3 M+ N7 P1 c! y2 b
) a# D# \' t; k' q, T5 o
This method is most known as 'MeltICE' because it has been freely distributed- J8 B9 L8 `; h  q
via www.winfiles.com. However it was first used by NuMega people to allow
( V4 X$ Y/ I5 q: t! }$ dSymbol Loader to check if SoftICE was active or not (the code is located) v8 H* }  k1 `
inside nmtrans.dll).
) F0 H2 B( B: a9 Q$ V# C: k& {
: s$ o) f: E! f: G8 |/ fThe way it works is very simple:& K: o' ^- E- [7 o' s: D4 i' {
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
, D- Z: g/ g& b: B1 [1 R' l8 nWinNT) with the CreateFileA API.+ ]5 c2 X! ?9 d( w( h. h( y9 {
3 V! y  W4 O$ C9 _
Here is a sample (checking for 'SICE'):
& P3 K  N7 y' Q2 W# r1 U; n: e. z0 ^" b* N1 Z
BOOL IsSoftIce95Loaded()( I4 b, Q; U& W1 G5 C
{! @% s& ?3 s) R, `
   HANDLE hFile;  7 S5 F2 y. n* p6 f) i$ g. o
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
1 t. f0 {0 w1 O" {                      FILE_SHARE_READ | FILE_SHARE_WRITE,
$ o9 }& s5 [0 R8 ~! h9 s- ?                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);  ~, p4 \: j+ N$ {4 k3 C+ r
   if( hFile != INVALID_HANDLE_VALUE )* v- J7 g" @; y8 E
   {
$ H$ r' m3 b% K+ w0 n5 P& K      CloseHandle(hFile);
$ o6 v. u7 [4 X, J! b6 X0 o  a& x      return TRUE;
& r' f; l( d* h8 ^5 @& G   }, B" A& v7 V- |5 |0 Q& S
   return FALSE;3 }. x( x2 ]1 I
}, C+ Q- ]0 c. p1 M* G
  l& Z5 f5 A4 {. d
Although this trick calls the CreateFileA function, don't even expect to be7 n7 d( s, q& S$ [, N# X2 V
able to intercept it by installing a IFS hook: it will not work, no way!
& k1 a( [; ~2 b1 S" u0 WIn fact, after the call to CreateFileA it will get through VWIN32 0x001F; |! ~6 Q" y1 m0 {$ o% i  z6 Q- |& Z
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)- t1 Q" N- p( Q+ `  c* Q8 ~
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
3 U/ v- L+ L: j# F/ g! Ofield.' t' W6 i: N& N- |" x2 w, p& p
In fact, its purpose is not to load/unload VxDs but only to send a
/ J7 }0 O7 {9 }% ~! _W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)5 p- O# l: g( Q: C- |' T' o2 D
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
7 w3 i+ r& |6 qto load/unload a non-dynamically loadable driver such as SoftICE ;-).3 R1 d6 h, r, c
If the VxD is loaded, it will always clear eax and the Carry flag to allow
2 v, a" b8 X4 A7 f$ W+ Sits handle to be opened and then, will be detected.9 h/ l: \/ a; v4 D) l5 T
You can check that simply by hooking Winice.exe control proc entry point
1 a! f+ n" \! X+ h) Kwhile running MeltICE.; \0 O1 ^3 j" B4 r. O
0 d3 O4 d/ y) K) h& j) [
) S  a1 u& d3 |6 H( E
  00401067:  push      00402025    ; \\.\SICE6 G8 n4 |: N" C9 X: q6 s: j0 k9 U
  0040106C:  call      CreateFileA( W/ [0 `0 T3 W/ z4 R, v" C
  00401071:  cmp       eax,-001+ P* p- \; u$ W  C1 V) D3 c- r+ v$ K
  00401074:  je        00401091; E. m9 L! q+ p6 P

5 k) u1 m% \+ \8 }3 O$ H# }8 ^% t! @0 Y) n
There could be hundreds of BPX you could use to detect this trick.+ w3 X# ?  `5 u( R
-The most classical one is:& n- W1 |  {4 @' S; X4 Q
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
/ R2 ^  O. R& I    *(esp-&gt;4+4)=='NTIC'
3 ]5 v- N& E  b2 `; Q2 i$ I( H% p  j1 p, e  g. y% ]
-The most exotic ones (could be very slooooow :-(+ u8 S! W# Y3 l; P3 D3 A
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  + [# E4 z( W" M3 d: N4 `
     ;will break 3 times :-(
5 {2 Q8 t' O* j2 m) ~! l8 B( g/ h9 F
-or (a bit) faster:
/ E. g+ f, A( a7 N( K   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')5 d' _0 H+ ?/ ?5 d6 P+ L7 A) m
& h9 C- `5 F- m2 X1 g
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
5 Y, V* C4 V& E& s: R) S     ;will break 3 times :-(
% N3 Z: c4 n* ?$ q' P" U. J0 E, |- E( G) Q+ O) j5 W# e
-Much faster:
, ?7 e5 S) l4 x. v( V  o4 A   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'5 m$ z5 \; {! |; l
6 z& l/ S3 a7 t* g7 G
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen; X- M6 Q& N0 ^/ i
function to do the same job:+ \8 I1 @6 g: b* p* x4 D% V7 m4 J
, ?  _3 V. ?3 d$ \' s
   push    00                        ; OF_READ
. h1 k' ?' x5 c5 b$ k- b/ ~, p4 P   mov     eax,[00656634]            ; '\\.\SICE',0
0 r9 v5 e" u+ }/ \8 h5 S; f   push    eax- [4 n! Y5 j& @8 ?# [' z8 G! I% }' q
   call    KERNEL32!_lopen. e& D2 t+ e/ Y3 N0 e2 o. n: \3 U
   inc     eax& K# m( D1 e" `
   jnz     00650589                  ; detected" F, I  W6 x, A9 B: P
   push    00                        ; OF_READ
, L' X1 {' R1 }% u2 m   mov     eax,[00656638]            ; '\\.\SICE'- b  F/ o4 B+ }% |. p+ F8 H
   push    eax1 R- B' L* Z9 h7 ~% n1 N/ p
   call    KERNEL32!_lopen
- |9 M7 @& I5 w1 J5 S; c2 A   inc     eax
4 K3 ~/ x6 f/ h6 R: n: N6 d   jz      006505ae                  ; not detected
9 j1 u* y& k8 _, k: a, L4 r3 E4 m3 d) x" k6 t" e3 M, a! `+ R
. P2 H; S' x& }: r) s
__________________________________________________________________________
3 M" w9 I. h1 x6 M9 v2 m
9 L/ b/ ~: e5 P% wMethod 12/ Z' ?5 I. B; w8 u
=========
- J; M+ R+ ]/ @, }  L5 |7 E- }8 |
. @' C3 F9 U' g! G8 W( SThis trick is similar to int41h/4fh Debugger installation check (code 05
4 F! Z8 f$ d' `3 V8 |&amp; 06) but very limited because it's only available for Win95/98 (not NT)
+ Y7 N6 w2 R3 n$ x9 X" [( Xas it uses the VxDCall backdoor. This detection was found in Bleem Demo.& {) m* j& h! g" E

5 @% a! N: L8 F4 f8 B   push  0000004fh         ; function 4fh& T$ O6 Z- z3 p. ]3 z
   push  002a002ah         ; high word specifies which VxD (VWIN32). t! p/ J, y) T- I) f) i- k$ Y7 ?
                           ; low word specifies which service% v" s9 s& ?/ B) X' q
                             (VWIN32_Int41Dispatch)9 e+ ]0 f, U3 y* I
   call  Kernel32!ORD_001  ; VxdCall4 I- S4 G0 t7 Z* h2 ]! }
   cmp   ax, 0f386h        ; magic number returned by system debuggers% Q7 i, D9 ?5 [$ M; m
   jz    SoftICE_detected
4 `" j& u' e0 W3 W* m! B: e. p4 A" i5 r. i* M0 o
Here again, several ways to detect it:8 i1 ~2 {1 W/ o$ z' a5 _' @6 M

' ]7 h: Z0 |& l0 V3 c    BPINT 41 if ax==4f
3 \% ?! L( i1 n+ O# h/ s
0 K5 S6 A$ s2 x    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one; b( c' t7 ]' Y% @
" t  m5 Y& X  C0 t: R
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A+ Z- y& E4 a6 e

, G) O$ N* Q6 X: ]1 U. O2 V- R    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!2 S0 e& E  P9 r( \1 L( n0 J* o& `

0 X% F9 _  O- j: `__________________________________________________________________________
- M4 S: C. m3 _6 [7 p7 Q# W4 A. Y. v0 B3 A
Method 13* V: j: Q  O7 Z6 Z' g$ }
=========- r8 e5 ~3 f1 g$ a
) z  G& t& E2 {$ D4 t) D8 ~# E1 d
Not a real method of detection, but a good way to know if SoftICE is
0 V! [# K4 D8 {, d7 D* z. V0 Hinstalled on a computer and to locate its installation directory.$ `) g$ y6 j7 P+ b8 ?2 Y% V
It is used by few softs which access the following registry keys (usually #2) :8 g/ y# d' h" |' w
0 d( H* }- \' H$ l" a4 x
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
, `2 O" J& m& J4 c\Uninstall\SoftICE
5 ], i3 _! `8 u( ]- H8 K) k' o-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
# D9 i# Q/ G2 }' e" l-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
2 G% F5 Q3 Z9 k\App Paths\Loader32.Exe! a- a! y4 U" J
& P0 W* \9 A& B: W4 F* w
$ t( o8 w: `9 g, Q/ ^
Note that some nasty apps could then erase all files from SoftICE directory5 V/ D% n1 q/ h% p( }2 Y" I; F2 R
(I faced that once :-(8 r$ E+ t. m: |( O

' ]" A, n1 f6 c: `Useful breakpoint to detect it:
! h% X: F. v) A2 ]) h
( H2 `1 g$ h1 u     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'1 F5 U! Q% i9 B6 l' w

9 _. ]. V' c8 O1 a__________________________________________________________________________) B7 w! f. H9 U9 c! Z- Q

  |* `% J% J% ]. Z5 ]" j, l9 s# V6 E/ M* t9 g3 R0 @+ v9 m
Method 14 # M" @( X4 k$ [3 o$ v5 z( z5 {
=========3 u% K0 q' t( V/ z7 n/ z
& p- O. W  ]: D1 N- S
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose7 _! ?. H" b3 P& ?, r, h
is to determines whether a debugger is running on your system (ring0 only).& [1 M9 ]. ~% Y

: ?, m; }4 I+ S) a   VMMCall Test_Debug_Installed
. f7 c+ p# ~' q' {/ V   je      not_installed
1 K; }  X  g/ U2 r
9 i% w- w5 B  [( Y3 o0 @This service just checks a flag.1 V! H7 O; Y% i" B3 Q! U" ?0 v$ N
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-7-30 00:41

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表