找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>2 F9 q+ r+ N8 V+ @. T# X5 O0 R! C' z
<TBODY>  R+ J1 _4 {" @  E( Z
<TR>& o! |4 z9 U9 w4 @9 i' q
<TD><PRE>Method 01
4 ~0 W  d1 r: U; Z/ X9 T=========
, |1 ^2 }( a5 l; s1 m$ v7 ?( ^  n# s( v! M) L. w" m  Y
This method of detection of SoftICE (as well as the following one) is" s1 K/ F& w, a3 }
used by the majority of packers/encryptors found on Internet.
5 _9 ?( F5 ], p/ ?7 T4 OIt seeks the signature of BoundsChecker in SoftICE
' d* }4 y$ B0 j6 K% S& _  l) u
    mov     ebp, 04243484Bh        ; 'BCHK'
4 f- i- H4 ?! i" H$ k% O8 {    mov     ax, 04h
0 z7 i8 H4 w+ B, r+ C    int     3       " M2 U7 i0 T9 A; J
    cmp     al,4: a% b: F7 [, @7 b; K0 ^! r
    jnz     SoftICE_Detected" b4 b8 [* v) a" J+ `% g

1 s( i. }- [6 J+ h___________________________________________________________________________
# I& _# R1 l. o8 n% ~$ `
5 v! t6 z; I- [# O# a* c5 G( YMethod 02+ {# R' M* C" B5 Z5 t. O
=========  ?2 P" D/ ]: R" t) X

& D" Z: G& O3 a2 G/ y1 t; K% yStill a method very much used (perhaps the most frequent one).  It is used
( ^* \6 P& R6 ]. n7 Lto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
6 v$ h9 U- v" u0 I2 O* ~: Uor execute SoftICE commands...
3 `5 v* J4 Y2 D. x/ qIt is also used to crash SoftICE and to force it to execute any commands
( V+ {4 `4 C0 @1 X(HBOOT...) :-((  ! u5 q/ B3 x# A  n
$ R1 J8 }( A5 Q( _5 a- N' H0 A: x
Here is a quick description:9 x1 c7 G: }" z+ p0 K
-AX = 0910h   (Display string in SIce windows)
0 [" Q$ ?- _/ c-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx): y3 g9 R* P  y" ]
-AX = 0912h   (Get breakpoint infos)/ r2 e3 u/ A% S
-AX = 0913h   (Set Sice breakpoints)
$ A7 f! N. J8 p& g6 L-AX = 0914h   (Remove SIce breakoints)! l+ ^0 v% {% B8 }% _
3 o  M" i: B1 U9 d/ w8 a+ ^
Each time you'll meet this trick, you'll see:0 J* R, q( x; A  g8 M8 X1 q, b
-SI = 4647h8 F4 G/ m) z% L$ U: P* A
-DI = 4A4Dh# p3 u7 ?- }/ t' F5 ^  u4 b: S
Which are the 'magic values' used by SoftIce.
/ _# Z. K8 l! N( A1 [# WFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.2 [1 x, x' m2 h& A. y

5 a- j* h8 N/ h0 W4 s# ]0 X- KHere is one example from the file "Haspinst.exe" which is the dongle HASP3 \& g" Y5 I2 U+ d( Z  W" `  {
Envelope utility use to protect DOS applications:
2 a7 s7 R$ g7 l3 p- c$ w8 S+ d: f, }' E$ Z; J7 U5 D% o% u1 H  j4 P- i) s
6 Z1 x3 z+ p' t
4C19:0095   MOV    AX,0911  ; execute command.- T+ W! C" b8 |  v. w- _' o( [
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
1 g) P! P6 X8 I* I4C19:009A   MOV    SI,4647  ; 1st magic value.
  v. o5 \8 }; }1 w1 X; n: t4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
) H/ W- f- ~- y$ i; w4 W3 g4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
! F/ |% u* J: V# |; C. k6 q4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute: k. e1 a8 y) c4 x( m
4C19:00A4   INC    CX
' }' X1 a) l" T4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
8 |! _* N/ s% h9 l4 e( e+ x4C19:00A8   JB     0095     ; 6 different commands.% c5 A' D! ?/ K* s
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.4 }! @* G9 n# o. B  ]! F+ W' x4 h
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :): ~/ y8 h! N5 v" w  O- I4 A

/ A7 u9 e+ t+ f% p- g/ ]/ K3 t% f0 b4 x  sThe program will execute 6 different SIce commands located at ds:dx, which
/ j; z! S* U5 N" [' o7 }are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.# Y* J7 D! J! u! b

( ?1 m8 b1 J& U8 M" [% X* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
2 a# V* W- F- }  c- P$ o* N___________________________________________________________________________* a' B7 g8 X! R  a6 f9 _
4 i2 Z" s* V6 D

0 i) C" d& ^- W' e6 }& X: f% qMethod 03
8 f, z! Q& e! ?; w=========
0 R% o' _5 F9 s* ^% V
. @  R& I. h/ D0 W0 ~+ {$ w# OLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
2 Q2 z7 P5 W; X. W, D$ O" {* u(API Get entry point)7 `& n" Z2 Q! n1 @6 C1 h
        
! }: P/ h1 G% C1 n$ _
0 f# o3 t$ {6 s# w    xor     di,di" V; ^& X& p% ~
    mov     es,di. g; I& P* f& `7 |  F' J! a$ M
    mov     ax, 1684h      
# g* H* Z) q$ c/ D# k    mov     bx, 0202h       ; VxD ID of winice8 \9 t' Y7 k3 i9 c1 q5 U+ C
    int     2Fh0 k9 D9 q; C0 |
    mov     ax, es          ; ES:DI -&gt; VxD API entry point* U# C4 P- K; I; N% V' T
    add     ax, di1 [$ @% [" W4 x. s8 r$ K; F. V9 e
    test    ax,ax" m' {( N2 s- M" L
    jnz     SoftICE_Detected
# r" |; Y& O1 R! C4 [: t# l! O
5 u3 u" |; _4 K8 [" E___________________________________________________________________________4 I, z- B; _- P+ k9 T+ Y/ l! \/ |
6 G6 S9 R; O; Q4 [, q0 E5 R
Method 04  X6 B( i. C7 R$ Z# O! p
=========
/ O- Y& A7 l% _$ V. j. e- ^% {
. S/ I' v5 a& I" e: `# ?Method identical to the preceding one except that it seeks the ID of SoftICE
  J# `4 t" A, j% m; W5 IGFX VxD.
; Y5 ^, N5 ?( @2 M- M1 i
0 H) [- P% L) m( q4 Q7 _    xor     di,di# l; |% d6 X' f9 {1 Z
    mov     es,di
6 ?$ h) ]/ F2 @# J. ]2 o2 n% r: P6 d    mov     ax, 1684h       . r+ b6 ^# }( T! L
    mov     bx, 7a5Fh       ; VxD ID of SIWVID
; A% R  l7 E! i; T1 I' _$ C* Z! I    int     2fh
4 ~1 v" U, \; d9 A    mov     ax, es          ; ES:DI -&gt; VxD API entry point
: u0 k: f9 g0 x    add     ax, di
% n! K/ z# J5 E, U; i5 c+ b/ i    test    ax,ax
0 ]- w# [* J& s" ^( Y4 l; X- N    jnz     SoftICE_Detected  [" b( ?  H9 f( `/ P& g
( [& x' Z' w! Z
__________________________________________________________________________
! X% _0 b! u! X1 v$ t, W' H1 t$ ]& d3 D4 c& S4 h+ m

6 O" w# q0 j9 h0 k$ IMethod 05
+ j" f4 N6 r- S, y1 i- X  V=========1 r" z2 U( k% {4 K
4 o  Z) w$ S5 ?4 l" p
Method seeking the 'magic number' 0F386h returned (in ax) by all system5 _1 o( o( H$ Q( L. P% u" E
debugger. It calls the int 41h, function 4Fh.& u; Y, x" T) H. V6 n5 L* y% H0 g
There are several alternatives.  
2 R# g0 N* }0 C. q* m3 L4 c. F( C0 `* k& E! M; t
The following one is the simplest:6 Q3 E8 _8 t- b1 V

- c" N- _# _3 A$ w& Q, S# b    mov     ax,4fh! ]1 F; u7 N7 |; N! Y7 s; F" ?/ m
    int     41h
6 [1 [# ~" G$ D) @% Y( l8 m    cmp     ax, 0F386! E: h0 S) z$ D$ Q
    jz      SoftICE_detected
7 _+ o) S; D" A% H3 s. w1 {/ i1 ?7 T  K
3 g* {' K; D6 Z/ F6 k+ `# ~
Next method as well as the following one are 2 examples from Stone's : [  M  \1 m; }4 V4 G) i" ^% g- \
"stn-wid.zip" (www.cracking.net):
# D! ?8 m# A7 f1 B
0 d& q  L3 k: r' K& F) k  T6 p0 y    mov     bx, cs
0 H  Y" ?2 o  U8 v3 ]6 u: M    lea     dx, int41handler2
0 g+ X* D2 E/ }9 f* i3 [    xchg    dx, es:[41h*4]
, V: q9 g0 p! l    xchg    bx, es:[41h*4+2]* U/ K# ^$ _9 h! k1 w
    mov     ax,4fh3 o4 [; ~, y: t) ^1 a
    int     41h
. z" T5 u7 X( Q3 O. L    xchg    dx, es:[41h*4]
, B4 B: c# s, F0 A: n% @    xchg    bx, es:[41h*4+2]
, i- w: r4 g/ Q( ]& C4 }& g    cmp     ax, 0f386h
" t8 [; c) u8 z: O2 c$ N    jz      SoftICE_detected2 W: P& F, W" `6 `" m4 j
) {. p% s" f! {1 `+ ]7 M
int41handler2 PROC! a* Z7 G; J$ t4 c' L9 A
    iret
3 i0 l) L. \8 F0 qint41handler2 ENDP
4 ~) M  M+ C" A5 C$ ~# v2 Q: [; K$ s* C; X+ X5 u
( x1 q7 L% Z: X9 c
_________________________________________________________________________, D# w$ m3 U4 ]) `5 G+ A% b4 C

4 Q8 A7 n. c7 c) }, ^
6 o) M5 D" \6 k! F  b- @9 EMethod 06
3 A/ z* m7 H* a( \  I; P: C! A& d=========  @* C5 `) p& M  Y  z" H5 J

7 O) t' x/ J* y' C2 }9 A  b( p1 l- Y
* n4 Y% w1 d& E6 E5 t! [) v2nd method similar to the preceding one but more difficult to detect:
8 b+ g9 U7 I+ y6 j& L/ x3 H, i8 l* {: R
1 f4 ?/ a; b; \3 @8 }
int41handler PROC" K4 ^# D  [2 W4 f5 V
    mov     cl,al
5 f+ ?' I! A& J    iret
3 _/ J" }$ p" V3 }: S) T. U4 yint41handler ENDP, E5 g8 O; F) f0 t$ v
8 _% b- r* |$ P/ A

' I1 T+ E5 M& Q- F    xor     ax,ax0 w0 S* N3 A( j( q, U: I  b2 _% [
    mov     es,ax
; \& W+ J& d, }8 x% A" z7 _    mov     bx, cs
" t2 `  u: T) C" |, R$ @0 t    lea     dx, int41handler
5 `' f( P( U  i2 }/ r/ T# u  _    xchg    dx, es:[41h*4]5 ]+ a+ i" [- f/ P( o: C- N( [
    xchg    bx, es:[41h*4+2]* b9 ~- d/ N7 Q1 ~7 B0 F7 K8 t! l2 M
    in      al, 40h1 _% Y. |, R& G5 j
    xor     cx,cx
$ B5 s& L9 H; N    int     41h/ Q8 ^% K* b! g# K! M% P
    xchg    dx, es:[41h*4]
, a2 N9 c0 P: G0 @( |( t/ s9 }    xchg    bx, es:[41h*4+2]
! ?! j% J. b: N3 Z. F, S  C    cmp     cl,al0 L- V2 d5 D- J* }7 q6 a1 S6 B/ Y
    jnz     SoftICE_detected! G7 `. ^9 h( B' Q, p

) Y9 J, [8 p- `0 J. E% v* A7 r_________________________________________________________________________& |8 E- Y; U8 ]8 B2 H* e2 b8 S
" S( {  x0 ^: b7 w4 J: I
Method 07+ V% H9 h9 i# L9 F6 \% S2 a" r! y
=========
) {& r1 `! G+ b( P& P0 c' V' y4 m* I
Method of detection of the WinICE handler in the int68h (V86)
( p5 s$ G7 U6 h3 z6 j( E3 ^3 O& p6 r" c
    mov     ah,43h
4 g: U$ t7 \5 H& u, p6 l9 U    int     68h
) q/ `# p- V. }5 u5 E    cmp     ax,0F386h0 d5 Z4 E7 y/ n+ f+ l5 R  d
    jz      SoftICE_Detected
1 Q2 S6 V8 \) M; a/ p: f, f- l5 m& w* z2 I
* e  q8 j* N) b; u& |0 o% n
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit% @- _7 k5 ^$ [$ }  J
   app like this:; Y; Q  z+ z% J) }% ]* n6 c2 H
) l1 x, C9 J, [! i: V" I1 O# [
   BPX exec_int if ax==68
0 K6 i9 s% N& X- i9 G   (function called is located at byte ptr [ebp+1Dh] and client eip is) [% `& A2 k2 d# ?: q* o% g
   located at [ebp+48h] for 32Bit apps)
  v$ i9 ]1 W8 Y- G1 d. {4 f__________________________________________________________________________
1 _2 K3 M9 V" g& |6 ^
5 S; s( C; \+ z/ X3 V# g+ k4 H
$ P* F, J9 N% w% U2 E# SMethod 082 e5 L( G/ z, T3 |$ m% o4 k
=========% U1 Y7 X2 V9 X" v

- Y3 ^* d0 D6 F7 v/ P# Y( EIt is not a method of detection of SoftICE but a possibility to crash the
: w! s8 t% ^8 I5 I) O3 _3 msystem by intercepting int 01h and int 03h and redirecting them to another
- |& U# z; w# Y& M- Proutine.2 z3 V9 m* S9 g
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
2 H# @% J7 R! ^! \% _  M7 L8 kto the new routine to execute (hangs computer...); l" N) G+ E# y' c6 x6 T" z5 j, `: x

4 _& G$ u8 T: Q5 y6 N0 M( {    mov     ah, 25h
+ `4 W# x9 c- ]. K    mov     al, Int_Number (01h or 03h)& {- `( ~) D( l2 p, ?$ o8 _, r
    mov     dx, offset New_Int_Routine& Y; F; M0 ?1 \- f
    int     21h: a! ?2 f: g1 m& W% V' m8 A
5 g8 H: o2 |; W7 B& T& ~
__________________________________________________________________________0 N# ]: a4 ?0 Y" ^2 K
. W3 U" G/ I7 C6 E7 n
Method 09
6 x  z# Q8 b- z=========8 N' }' b7 R4 s) F: Z0 Y4 h$ V
$ b, G: I1 ^1 D7 h
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only" ~, ~, {# P* }; Q( x, z: t
performed in ring0 (VxD or a ring3 app using the VxdCall)." A6 k" O- S9 s, ]
The Get_DDB service is used to determine whether or not a VxD is installed6 F( D9 Z' Z: u
for the specified device and returns a Device Description Block (in ecx) for; @: R' y6 g9 |3 u
that device if it is installed.4 s* v" R1 q1 Q+ T* p3 {

1 T: `* r6 y/ j7 Y2 Y   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID9 w( W1 C0 t' o* T; Q; a) ^+ _* k
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)! \' Q2 k$ ^, c5 v+ i
   VMMCall Get_DDB0 R+ J) [) _9 \% e
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
% f3 n+ S! s- m* L
$ g+ w: O! H" E7 `" ]/ w7 XNote as well that you can easily detect this method with SoftICE:0 f7 M% }9 t9 z. e# B: H
   bpx Get_DDB if ax==0202 || ax==7a5fh5 v# m/ ~& e" |2 S3 G! U& E, M# g

6 s9 {* q' M8 k/ i+ X__________________________________________________________________________
. x. C' U, ]1 j" g+ V9 {4 h$ ?) @' F3 _4 @
Method 10
  k4 p" N- Q4 s: E$ a; [=========
- L1 J2 X6 ~  j, Z) q2 s6 G( E! P$ h: @2 m# T  \
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
( l3 k) H, z$ V4 G5 i0 k  SoftICE while the option is enable!!( v1 q! Z! W& h* w& k$ s3 n' t

+ e% ^9 p. E6 U2 Y) ~( p- }This trick is very efficient:
8 K7 g3 `& D$ R! [/ M0 _. b) H% cby checking the Debug Registers, you can detect if SoftICE is loaded5 v0 T# \$ G5 G" Q) l& K0 L
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if" H- M( l. o6 n+ ^- J
there are some memory breakpoints set (dr0 to dr3) simply by reading their6 w5 L" w2 W  S$ v5 j
value (in ring0 only). Values can be manipulated and or changed as well$ i7 s% }6 r- v% m3 \" L2 L
(clearing BPMs for instance)
5 y8 r9 P! S4 G$ n. ~: n  ?3 A" k2 v) v7 Y
__________________________________________________________________________7 q% P0 T4 m3 z$ N4 f

( W5 t5 X/ q3 L1 T4 EMethod 11. y3 n! n  B  s3 s
=========+ S: z7 [- b2 n- z5 _
1 o/ H# I0 g1 ?2 f
This method is most known as 'MeltICE' because it has been freely distributed
, v& P* F1 ~! n2 X2 N: D. zvia www.winfiles.com. However it was first used by NuMega people to allow/ i; ?: C; r9 M" \
Symbol Loader to check if SoftICE was active or not (the code is located
. i4 j4 @4 N3 Y3 {2 j2 pinside nmtrans.dll).$ b& }0 K3 Q. a3 w% y) I9 @# \
- m* G" `8 G$ l. X
The way it works is very simple:
  i* {3 a) E4 Q  i# R" OIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
& T% h5 Z: y2 ]# U  D4 f" `WinNT) with the CreateFileA API.7 C/ I* b% H, H6 [4 b6 [. b
0 J3 o7 V8 f+ r: C3 r
Here is a sample (checking for 'SICE'):
4 l* j1 u% ^2 l  x& F' \& o
8 B* A, N8 M, Q3 kBOOL IsSoftIce95Loaded()
! G( h% x: w, j( d! h{
; L8 X- H' S* C2 G9 @   HANDLE hFile;  9 ?2 g+ t. V( Z2 b
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
) s& I6 Q' c2 b, t4 z; E                      FILE_SHARE_READ | FILE_SHARE_WRITE,
2 w8 n" u) q3 [                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);: S8 [  U/ }8 |9 t9 l
   if( hFile != INVALID_HANDLE_VALUE )
. e  S$ m9 s1 Z" m5 B- p5 r   {" h! }0 o" k# B9 x9 k) ~
      CloseHandle(hFile);( Y5 E0 ?. Z% ~3 ?" Q$ S" G
      return TRUE;# I  w/ x5 u& w
   }! n7 ~9 c5 Y/ N( x' O- i
   return FALSE;/ s2 R1 O* u  A9 A
}+ t6 @2 |2 b* Z2 u2 c' P

* _! g3 P3 l% f7 [" i% LAlthough this trick calls the CreateFileA function, don't even expect to be
: p8 b% t! @2 o: V& Rable to intercept it by installing a IFS hook: it will not work, no way!
3 @: w  x/ I7 z& r/ K* t: y9 GIn fact, after the call to CreateFileA it will get through VWIN32 0x001F- Q6 ^- S. v  U2 M/ C
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
) z* S& z# k. u) O- @' m1 W8 i' j7 _( Kand then browse the DDB list until it find the VxD and its DDB_Control_Proc
, g' o, f' c. A8 g; zfield.
- O3 m4 G4 T8 G% {# E1 f) ^5 W" JIn fact, its purpose is not to load/unload VxDs but only to send a * [% O$ ^( {/ I  l, c
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)0 z+ @) S  \+ G, h: {
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
! N" J! N6 Z) @( Wto load/unload a non-dynamically loadable driver such as SoftICE ;-).
8 l7 J- p  F! J+ _+ x( OIf the VxD is loaded, it will always clear eax and the Carry flag to allow
1 s) K( V7 T0 Q, O+ f5 t5 Zits handle to be opened and then, will be detected.0 P  |) |$ R5 e
You can check that simply by hooking Winice.exe control proc entry point
$ ~- J  V1 U, S$ U' G" j' vwhile running MeltICE.
+ H% {2 A: F" E3 i/ J+ T# P
) M  c8 f; q3 K7 h# @
9 R" P9 B: S; t* \9 H$ k% J  H  00401067:  push      00402025    ; \\.\SICE8 n2 g  B6 h- \" D
  0040106C:  call      CreateFileA& h$ }: E# v# ^+ h& i8 Z/ v3 R
  00401071:  cmp       eax,-001
' t' C. n, \: Y  00401074:  je        00401091' T* G' S) k4 o! n- T

% }' R2 A# m. J- s# N4 @$ H# h! `
1 z6 O2 K' i# ^+ E5 f2 _: e, ^There could be hundreds of BPX you could use to detect this trick.# X  f3 `' s4 o; K
-The most classical one is:# Q- A0 s4 V4 I- t
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||5 [5 \* C& B# E% ?1 q8 E
    *(esp-&gt;4+4)=='NTIC'
2 c5 \! V( p6 ~4 C
! d) a7 X. _- W/ y-The most exotic ones (could be very slooooow :-(
5 }2 a. ?$ G0 U7 h" N   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  9 D2 m5 N! k' Y  i) V
     ;will break 3 times :-(
2 I' h+ a# ?/ N5 s& X6 R/ l/ g+ p
-or (a bit) faster:
, \" v, s% ]6 ?% V   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
8 V9 P! {9 [, t0 O# F( O9 \; L; S! k' B9 |
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
3 S7 a& I9 U! ^& E  L" U     ;will break 3 times :-(
9 H2 m( }, }, O& Q1 I& `3 ^( A  n/ J! p; d5 L& G
-Much faster:; M! |* H2 y: E0 E) K% V( W  f
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'* [* R2 ]! y) z$ v8 j

/ R  B* f0 r. l/ M) P1 zNote also that some programs (like AZPR3.00) use de old 16-bit _lopen) F) V7 \; ]3 z: r3 \1 l
function to do the same job:8 L1 p) q# C7 y( D
4 [& B0 ~' f* i) P; ?7 i( J
   push    00                        ; OF_READ
$ B  X7 C* ~9 Q   mov     eax,[00656634]            ; '\\.\SICE',09 Z" \- A& M+ n: W% B/ C1 c0 D
   push    eax
* q. b  n" H( u+ n! t* g  E- b3 t- J   call    KERNEL32!_lopen
3 O3 m. v+ ?2 C# j; \$ A# n   inc     eax
; n- g" U& V6 M& O: u   jnz     00650589                  ; detected3 W7 q/ U4 }& P2 x
   push    00                        ; OF_READ
" s, M8 x4 x2 I) h   mov     eax,[00656638]            ; '\\.\SICE'
4 |) _9 D# J3 k7 C2 a! `! W6 t7 N   push    eax( |7 w/ N; j7 I  N: u3 a
   call    KERNEL32!_lopen0 x3 _; r7 C: H' y
   inc     eax
0 b. g, }2 U& w; B5 i, y8 A% n5 F% v& d   jz      006505ae                  ; not detected# e" r) v4 C; J% Z& o- g
( b( u" M3 K0 T2 E
3 |0 \% C1 |7 P
__________________________________________________________________________
8 M. o8 A+ b2 M" T4 W6 m  P7 K
5 k. C' M7 o; D7 H9 IMethod 12
( n2 k  }! H$ O  Q, L$ Z+ [8 m=========. I: G! Z: `3 c  M- a1 j: ]

( U4 `& \% A  j+ Y) m. iThis trick is similar to int41h/4fh Debugger installation check (code 05# E* V1 _/ k/ k/ V
&amp; 06) but very limited because it's only available for Win95/98 (not NT)
% w' C- \* d: ]as it uses the VxDCall backdoor. This detection was found in Bleem Demo.+ s& r7 K% m3 q2 b, P: j: W: c4 B  J
  c$ K+ ]; g" M, O( J0 B
   push  0000004fh         ; function 4fh, l- l- r+ |0 b9 S# ~! ?
   push  002a002ah         ; high word specifies which VxD (VWIN32)
+ r) e5 l' _0 W                           ; low word specifies which service
3 r# m8 }! O( Q9 C! F3 `: ^6 t0 w                             (VWIN32_Int41Dispatch)
; [! j/ Q" O5 ?7 x5 H   call  Kernel32!ORD_001  ; VxdCall5 n6 S- d$ j& R" e8 m/ [* O' a4 y
   cmp   ax, 0f386h        ; magic number returned by system debuggers
# Z/ i5 O. O5 e9 ]) C4 A   jz    SoftICE_detected
: ]6 V" }; Z$ v  E/ e5 U
% }3 {: {) B( a  H5 |9 hHere again, several ways to detect it:& z3 Z) w0 p' Q6 Z% M

' b. X9 M6 O$ H# B& k0 `    BPINT 41 if ax==4f6 u8 l& C, }8 s4 Y9 M

% H' c7 H& ]) Z/ q  Y) y+ a8 w    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
7 R6 L  w/ i) g% w6 V
+ n7 I3 r* G9 U  e5 N    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A6 J* ~3 y$ [' h4 C
: M  @& ~1 x* v. x) E. V: l$ T
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!( Y  b9 S, }% s4 f/ a

! z" U' F( ~$ J! `__________________________________________________________________________( `0 A2 c1 Z$ ~0 S: `% o4 h, y

$ G/ @. Q, z( D. a) E: ^Method 13' h2 e( o3 ^6 ?' R
=========
  p8 ^& [5 j( X
: K4 x0 D: _3 c2 X2 ]Not a real method of detection, but a good way to know if SoftICE is
  I" `: M% R0 v8 `7 ainstalled on a computer and to locate its installation directory.. W! h- n+ I4 T3 T
It is used by few softs which access the following registry keys (usually #2) :! w) u8 x) a/ m9 X- G2 M5 o
' }; s: L5 S8 [1 W
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion( H" p6 u' ~* d% W
\Uninstall\SoftICE& \5 U7 R0 b  J+ }6 V% u1 ~2 ^
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE$ d: ~9 r- g* [3 s9 q/ q
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion6 Q& x3 I* @6 i1 d! |- r) z0 B
\App Paths\Loader32.Exe
& T) w" k& V+ d4 u4 d, s$ F% F" X. M) |" D( T* h; D8 G2 V
% T5 Y( R( d, b5 }! h' l8 C
Note that some nasty apps could then erase all files from SoftICE directory" z1 e0 y& l5 _) K+ g" c+ y# c. l
(I faced that once :-(! o5 G8 A5 j- I: h0 w+ d$ v# v* F

* P6 L1 G+ j8 z+ q1 y8 Q/ IUseful breakpoint to detect it:* A& x" o: i5 G5 n) l

4 ^+ x4 ]! c$ f     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'0 d2 |. \" j# f# E, b$ [; f

3 I: m& y* ]5 G! O8 v6 h__________________________________________________________________________$ Y6 A. B* C5 F

+ F) L0 P5 b' o' y5 B# E( x/ ~6 o, O' l5 G- a9 U
Method 14
$ B0 x, d+ ~3 m6 D. o=========
& o( X6 V% S* l! l$ B: k
- a, A7 L# d  I8 PA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose8 z- t# @/ N9 u4 S/ m, r
is to determines whether a debugger is running on your system (ring0 only).
; B: ~. D5 J% Q; `; P! H+ Z
4 {4 g$ P, C5 w& t0 N  D3 E   VMMCall Test_Debug_Installed" i+ w$ B2 r# N5 Y
   je      not_installed0 B0 d4 b. X' o5 G/ {  R
; p/ s, g6 L- Z
This service just checks a flag.
, K/ I1 N! e, D8 w: {3 G( B</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-8-3 07:11

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表