About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>; j; n' n3 E7 H" b
<TBODY>  d- v6 q; ]) Q6 Q1 ]2 F7 V
<TR>
5 L, u6 l% O* E. f3 R3 ]<TD><PRE>Method 01 % ]3 a; W! Q( c" J/ H# `
=========: N! ?0 F3 e2 h5 E, v/ n

& q4 m# D  f3 E/ V/ V% ?* l% ?9 fThis method of detection of SoftICE (as well as the following one) is' ]" r' Q0 ~/ M& T  |
used by the majority of packers/encryptors found on Internet.- j5 @3 W0 e9 j! _. x0 s& E
It seeks the signature of BoundsChecker in SoftICE
6 P' D) y* Y: D8 S6 N0 T0 o9 p" K
& C; l8 i! A9 _* P8 u    mov     ebp, 04243484Bh        ; 'BCHK'  p" a9 P) ^! d9 \' Z- N! [
    mov     ax, 04h' i% k2 b9 y, U, \/ w4 v
    int     3      
: {7 R8 k% J$ B) G( x    cmp     al,4# G4 X7 `9 S; p% r
    jnz     SoftICE_Detected
/ j/ c3 s7 a. R; t9 Q
! a+ `6 \, S! g/ r8 Z' }___________________________________________________________________________! U* }$ o( o. \( ?6 \/ P& U

; p+ g" y* q8 f5 |# lMethod 02
3 f' k( p5 y7 [7 x7 ]* n$ y=========
# @2 Y( t( t4 v4 ~0 N, `! |% L1 V" l$ f9 H: h9 b
Still a method very much used (perhaps the most frequent one).  It is used/ `- M, N+ ]" B  {8 |; l
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,2 ^% e2 R* }0 G4 G) ^: W9 z
or execute SoftICE commands...
; F* I) D- T0 vIt is also used to crash SoftICE and to force it to execute any commands! W6 g3 k# D1 ]3 k" j
(HBOOT...) :-((  
/ K4 L' i+ X$ e9 l# M. }' E7 l+ D7 Z, Q5 _
Here is a quick description:
) t7 l/ g0 z8 e: Y" L-AX = 0910h   (Display string in SIce windows)
2 E7 [4 E- M2 w. r-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx): b3 o0 A- h9 B, u8 f/ r
-AX = 0912h   (Get breakpoint infos)4 a- |& B% y$ N& E3 m
-AX = 0913h   (Set Sice breakpoints)
7 M* d  \4 D2 C-AX = 0914h   (Remove SIce breakoints)
5 Y8 `; e( G8 h, D8 C& N6 x; b2 w- E' J1 W1 o  g& T: n5 N- P5 j3 X
Each time you'll meet this trick, you'll see:6 }" s' i4 K& y8 X" e; p& n0 m$ H
-SI = 4647h6 u$ o* m" j4 B! _
-DI = 4A4Dh
3 s( V& z7 [0 q1 c0 ZWhich are the 'magic values' used by SoftIce.
% Y& J  a3 F1 V3 G7 OFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
2 {0 U$ ^6 F$ o/ u5 i+ T) G  `# j" r# @: b5 R* o# P0 ~& g, Z
Here is one example from the file "Haspinst.exe" which is the dongle HASP8 U2 ~0 R9 O5 d3 F$ v  C, q2 c
Envelope utility use to protect DOS applications:
4 }- x; q9 X; g7 A2 r) p8 Q! i+ F( X8 t" B! u6 q

8 B( K4 j2 M2 l6 N0 O. ^4C19:0095   MOV    AX,0911  ; execute command.
  d+ N4 w6 L  i& M4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).8 ?5 v6 ?! y8 i, K; y- s& B' q. q
4C19:009A   MOV    SI,4647  ; 1st magic value.
4 |# u0 u) y! Z& n  U. z) y4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
9 P0 ~+ i9 c" r8 u; j' ^: v4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
# m  [7 Q  H) u* v4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
# _5 F8 e2 m. ^! t5 M4C19:00A4   INC    CX9 W! p% O/ ]7 U2 y9 N
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
; G1 r: b# J4 H$ T# ?4C19:00A8   JB     0095     ; 6 different commands.
. B: x- F8 g" q7 P# F5 H4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
1 U# q  i, v' ?* ?  _: z2 X4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)& {. I* c5 C* G3 H8 R& |2 F
9 s/ {: a) F  \+ E2 _
The program will execute 6 different SIce commands located at ds:dx, which
# H& u7 _2 @3 Y' X3 y8 s+ D0 [5 fare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.! D; V& Z  L5 i. w, @/ i
  w  _- \0 B+ E* I9 ]' F* d
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.0 s7 Q( p# J% Q
___________________________________________________________________________
. h& n8 v- s# f# k8 u) b& @# I7 l, G: R5 Y4 c# g& O4 e

' k6 e; J& T$ gMethod 03
- }3 q! |9 J1 S: H  \- M=========
- c' |7 M2 h' j* C5 k& m, p! |/ j+ |9 l& w0 n7 U
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h9 [: l5 c% y9 a, j; i
(API Get entry point)
$ ~' }- c* b& Y( F3 g        " o0 l+ e0 F# ~- y; W
: q/ F/ L- c4 K. I; _
    xor     di,di
# X& j6 P6 l  c; o$ B1 c( Z* F1 S0 A    mov     es,di
+ k& j2 j0 _; V' q6 N    mov     ax, 1684h      
: I; t( ^0 t4 f- V    mov     bx, 0202h       ; VxD ID of winice/ l( N% F' j2 ?3 Y( w3 V8 v: d
    int     2Fh
( d, c* k$ q; T$ |( D; C    mov     ax, es          ; ES:DI -&gt; VxD API entry point. K& i% S3 D2 A  F) T: y2 w. {
    add     ax, di
! t- d0 `8 {' t! v2 l7 S    test    ax,ax
$ n. d; Q2 V- V) ?$ z  x' D$ x    jnz     SoftICE_Detected7 Z2 B7 q! |: G/ E) g8 v
( U- n0 {( j. q
___________________________________________________________________________
1 f2 y: u) E0 O8 ?# n: c
, m3 ?7 R! A' ^; k, kMethod 04
& g; i& P: i! I9 }% n0 i$ A. K) e=========- M% f2 s7 S7 V7 ^, i' \
& y2 ?0 M5 w8 F4 j8 ^9 Z* C( R& W
Method identical to the preceding one except that it seeks the ID of SoftICE
% @# D" w/ Y8 ?& \2 [7 Y5 e& `& cGFX VxD.
/ H- @  Y9 s3 k( Q0 E( d8 ~4 a9 x! M7 K5 l8 j) K: U
    xor     di,di/ U& R$ ~) M  k$ o2 ^& t& w* w9 `
    mov     es,di
( f- o& G& l) f$ R* g- h* B! ]    mov     ax, 1684h      
4 A7 n. h  m& y1 s. j$ |    mov     bx, 7a5Fh       ; VxD ID of SIWVID
9 Q1 i& {) S% x2 f0 S. I0 s1 L# v6 G    int     2fh) M) T( d9 h7 H& a
    mov     ax, es          ; ES:DI -&gt; VxD API entry point, L5 A9 H. U7 A# W! `2 m
    add     ax, di
1 g5 p+ z3 C( U; ]7 |+ i* ?    test    ax,ax
/ x* z3 C7 }& c! |    jnz     SoftICE_Detected
+ {# X: i5 N" y$ h) ]6 w/ |" ~. {: x' k* `/ Y
__________________________________________________________________________
7 p& K7 T) c1 T' z9 Y: r
' p- ^; f" ~0 n- z( e/ @0 S" p- _+ k
! S$ S: k6 B+ z3 r- f+ U% G$ tMethod 05
) e8 M- y9 L  l. X- D4 k1 W* J=========( k, q1 `) n/ p' X; O
: ~& G. m8 y+ b% k( @7 a. k
Method seeking the 'magic number' 0F386h returned (in ax) by all system
, s: A9 l$ N7 j. K) Odebugger. It calls the int 41h, function 4Fh.3 h" @3 v, R; m- S0 a
There are several alternatives.  ! E# U) h- i* }' l2 |& j
. k% h3 a% |' u1 U
The following one is the simplest:, w% y0 W6 K3 P

# u6 D  F+ Z- b" ?    mov     ax,4fh5 V9 P: n; I9 Q6 _
    int     41h; T( h5 M) R* [  `2 P. c' @  H
    cmp     ax, 0F386
3 v& e6 l, P  P8 Z5 T    jz      SoftICE_detected; |7 b: p1 ^: v  X

9 w5 _0 |5 M, Z, p  ]; B9 e, {: T3 y7 u" T" y- F3 ~# q
Next method as well as the following one are 2 examples from Stone's 5 [; p, c; _0 [7 C, r
"stn-wid.zip" (www.cracking.net):& @1 R+ T5 U4 N' c5 H  F/ \5 F

. w8 K4 L, o9 Q* w& @. A! k/ T    mov     bx, cs
) K! `8 O$ ^* c! b; Q; L% n5 @    lea     dx, int41handler2" M( ?% C/ T4 e
    xchg    dx, es:[41h*4]% m9 V" q  p2 q1 i
    xchg    bx, es:[41h*4+2]
$ N' c, b$ Y! b# Z9 M3 Z% \6 g    mov     ax,4fh
! E7 X! Z" J1 V. }- G    int     41h! b, c( J, |; L  U2 B( p$ H
    xchg    dx, es:[41h*4]  Y7 x8 Z% Q! X3 V
    xchg    bx, es:[41h*4+2]
/ j1 i* x. h; u  i$ I    cmp     ax, 0f386h
( z8 j; q; U* m. @3 D4 k    jz      SoftICE_detected
: D6 w  r" r0 f. O5 `3 T% F9 A4 m. |
4 W+ @* G) q& {) vint41handler2 PROC, I4 E# W% ~+ B+ e9 z1 D
    iret
3 x# f5 U( W; I3 Y" Fint41handler2 ENDP
2 C6 F: u0 U/ N  V# R: n) i1 L" U1 B3 H& B: V, f

% M  T: L2 C5 Z) Y! R, V( w_________________________________________________________________________. G0 a9 |, u7 h
7 d7 \2 U% e: n6 B1 P
7 G+ X. N' O3 a5 C/ I/ e  Z
Method 06
- G1 \' n6 w6 ?=========1 h5 x4 |9 d9 P$ H

8 j; _3 |' J- S" W
1 M" _) P; i- Y2nd method similar to the preceding one but more difficult to detect:
! o. [7 k" Q# K0 k! T' X7 t! b! _4 m1 A8 W0 _& g9 s  t# s

6 j( U! z) p+ U4 wint41handler PROC( F/ ^1 N1 Y* C5 d8 S) G& o. T
    mov     cl,al
* ]2 L, Y$ g  X6 p" Y7 s$ ?    iret
3 x4 ]  s/ o& K1 sint41handler ENDP: y" f  L' J8 H( T8 R0 J  X, M6 P

6 ]7 V$ H6 @2 k3 B$ W- t6 q, L/ I6 u  W: R. G8 A% \
    xor     ax,ax
% y5 e! Q3 ]+ f    mov     es,ax
9 }8 y1 S, v- c$ J" R) o7 q: x2 I    mov     bx, cs
" i* g7 K8 M& G    lea     dx, int41handler
, y, a7 r' j( U4 @: }7 T2 ~    xchg    dx, es:[41h*4]) A3 T8 w; u7 J; t+ D
    xchg    bx, es:[41h*4+2]2 \; {4 |2 @* P' I/ M) d
    in      al, 40h
- ], v" }0 y/ W$ X7 A- L; H9 A    xor     cx,cx
$ O3 H$ j- ~9 r( J8 d, a) t1 u    int     41h
3 F% O9 I* c/ N. [( Q: I6 Q. X    xchg    dx, es:[41h*4]/ N7 h( m/ E' M
    xchg    bx, es:[41h*4+2]
% q' m& V1 O; g5 X3 A    cmp     cl,al
" L: j  e1 {" F    jnz     SoftICE_detected
4 k/ S7 u4 ~# A4 B9 X3 T/ T7 A
- j+ z- i/ m$ z0 ~_________________________________________________________________________
7 {  m5 Z, e: U8 w2 r% I% f% N' C9 H3 Y: w
Method 07
# ^0 O+ }5 @3 b" O=========
. o3 j7 S& G) Z; R3 u, f
) a& S% Q; [8 Z3 ^Method of detection of the WinICE handler in the int68h (V86)7 m$ T( |9 ?# U) {. F

" |; g9 T9 J- ?; u9 r    mov     ah,43h& W! _( ]8 ^  P( Q% Q
    int     68h, r: E& ^/ h4 c4 l" C! K
    cmp     ax,0F386h
7 s) V* Q. E: B( b5 `: K- m    jz      SoftICE_Detected$ G. p7 r, x& i. [, Q

1 C' Y) `# t, L; I5 l# U6 p! o: L" ?1 Q  u
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
% w! E& K# y! p: K; o   app like this:
( z, F: ~  k9 c8 ]' k7 S- Z8 A
9 g9 g& K" _  s" b: S7 t6 n   BPX exec_int if ax==68, Q+ i+ n6 H$ q# H8 K( d
   (function called is located at byte ptr [ebp+1Dh] and client eip is# C  u4 n' K$ ^7 n6 t3 A+ I
   located at [ebp+48h] for 32Bit apps)
* @5 H! R' E, k/ n! j  V__________________________________________________________________________
, e; `! F0 J( }0 o# W6 I8 D7 i! Y1 A- A

# B3 n. p% ]8 N' j! xMethod 08
. a2 L3 }/ s# ~$ u$ L8 w, U  T=========
0 ?' v# u" \1 n  I6 _1 O. u6 g2 f& J
It is not a method of detection of SoftICE but a possibility to crash the) R' }( @4 l+ `: w. l+ D
system by intercepting int 01h and int 03h and redirecting them to another  j/ W, ]! M2 T
routine.
% \4 b/ Q: ?" r; q& R) WIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
& u: f) u, d/ Z2 d# l) w8 H* m& wto the new routine to execute (hangs computer...)8 J9 I9 f: o9 ]2 k' p: f/ r
# n* d2 J1 p8 X' S) [
    mov     ah, 25h
$ W+ r& i9 S  s$ t! t, Q    mov     al, Int_Number (01h or 03h)1 F4 `5 b4 r+ J0 G6 v) \
    mov     dx, offset New_Int_Routine
% L& P0 I3 {  Z    int     21h
& e. h2 i& l& j: y8 u/ U
, \. E: Z) D3 g5 Y__________________________________________________________________________4 \5 I; V: i- `

, ?0 D3 c" b8 K+ ?2 H) gMethod 09
3 a% e# V/ f( S. M; r5 o2 J4 o=========
/ z- A1 D, D9 }; D: ~7 ?1 Q/ z  D; r$ S2 l- h' t6 l" ~. Y2 `
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
8 |$ q* G2 d0 O, ^8 F6 _, @performed in ring0 (VxD or a ring3 app using the VxdCall).
1 S# ^$ i$ Y# E/ hThe Get_DDB service is used to determine whether or not a VxD is installed. Z: y8 m/ j, }( q8 L1 q7 w
for the specified device and returns a Device Description Block (in ecx) for4 @& S) _) a2 Y* P# L7 r
that device if it is installed., b  ^9 e4 W3 H( u
9 C( G4 A8 @9 C, j
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
2 ?8 {  @7 c& d( T# k9 [   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)& A5 Q& ~& H. G2 ~2 P
   VMMCall Get_DDB" \* J3 h4 e2 w
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed% j: ^* I3 Q( k6 Y8 s6 _& l

% Q$ V( B( O& m7 [' u( `4 @Note as well that you can easily detect this method with SoftICE:  n+ [5 `# U2 R: Z6 @7 M
   bpx Get_DDB if ax==0202 || ax==7a5fh
5 c2 W* V; p' Z
& w" ]7 \+ b, f, i" ~' A__________________________________________________________________________
. J! \' F" R) I& a8 u8 C( \: _! `2 {0 l4 m; s
Method 10
7 P) B7 h1 [, A9 q' M4 W5 D=========
& B7 U" f# T7 i5 d* e
2 }5 o1 s9 u' }/ |( A=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
6 a) S" |4 X. i7 a, Y  SoftICE while the option is enable!!
$ D! d. @5 \+ }; x, ~9 p: a  Y9 ]+ D: h( L4 B& `' {2 H
This trick is very efficient:. r, J; X6 m, K
by checking the Debug Registers, you can detect if SoftICE is loaded/ M/ b* `2 K5 Q! a/ `; I
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
$ C8 s- g2 n% o6 E, @  o: ?there are some memory breakpoints set (dr0 to dr3) simply by reading their. N( F. G1 T0 P; l5 z! t
value (in ring0 only). Values can be manipulated and or changed as well
5 r; F. e6 D) J$ R0 g$ j! W) X8 h. K(clearing BPMs for instance)
4 M  s7 H; B7 }+ x$ d, b! g9 B  S( A. X
__________________________________________________________________________
  Q: G* b! n5 Y9 ^' D# l* C) G7 X$ w" p4 \
Method 11- i/ N+ W) n( Y+ U1 s3 j
=========
% N% f2 G7 D5 a7 t' T) A, K; I# `/ U; p% |6 m. [  P( G1 m
This method is most known as 'MeltICE' because it has been freely distributed* f+ |& f$ F4 C! B* ~' \
via www.winfiles.com. However it was first used by NuMega people to allow  R! }$ e$ t! w( O' T6 a5 v
Symbol Loader to check if SoftICE was active or not (the code is located$ J* F* O  U4 A- |
inside nmtrans.dll).
3 G4 C3 w7 b3 a. B6 `# ^5 A" `% a) Y' }6 m. b/ D: e
The way it works is very simple:* Y! O& q9 d8 C9 l2 d
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
# H' _$ Q7 S; T% AWinNT) with the CreateFileA API.9 ~, R& Q- h( a: H% O8 F
* E: ?; O( Q4 x: }: i% l
Here is a sample (checking for 'SICE'):
! P4 d. T+ u+ y- K& i6 g2 f7 }& w9 U) d. u
BOOL IsSoftIce95Loaded()
7 f0 o  R. g( w/ O3 ~! o{+ U% {. J0 |6 [( k' h/ ?+ g3 V3 Q
   HANDLE hFile;  
/ w( O4 i5 r! d) K# x: {   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
* z+ Q0 V1 N* l+ T- _5 i                      FILE_SHARE_READ | FILE_SHARE_WRITE,& _8 A4 ?0 O  @
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);& Z$ {: y9 Z2 u+ c5 O# O
   if( hFile != INVALID_HANDLE_VALUE )
5 t5 s+ r  W/ c   {/ F5 ~! F- F& s
      CloseHandle(hFile);
8 D' t$ L  r  P" Q0 h- g6 j1 }      return TRUE;4 R& G- B6 A- f- a1 [$ u
   }
! p  U: k( X$ `3 W   return FALSE;& }9 F" U3 Y# t
}
. U: P+ M) a0 M9 D& f* p: o! x6 d7 s& x$ ~' _
Although this trick calls the CreateFileA function, don't even expect to be
+ l6 z, v+ W: ?+ p: U$ A" rable to intercept it by installing a IFS hook: it will not work, no way!
: @# L" f" ?( m( l- H6 m" V& LIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
# C' N: t& q. h! i6 eservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
1 S% W, j4 e2 S$ r5 xand then browse the DDB list until it find the VxD and its DDB_Control_Proc; V( H, p! [: g, j
field.
7 x9 P* ~& I' LIn fact, its purpose is not to load/unload VxDs but only to send a
; \' f% @5 L: sW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE): F! q6 N* k" H+ y+ o, I% u
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
5 h" r  ?; W3 @+ }  T% p2 `to load/unload a non-dynamically loadable driver such as SoftICE ;-).! g' \' S" X* T
If the VxD is loaded, it will always clear eax and the Carry flag to allow
. u2 x2 h, W8 E$ `: m1 [its handle to be opened and then, will be detected.
0 p3 ^2 O3 k/ E6 g& [# \8 U4 nYou can check that simply by hooking Winice.exe control proc entry point
2 F3 j! Y8 @) Uwhile running MeltICE.
* g/ V+ y+ |* Z' l" h
6 s) G! f/ b" B# t* L* `3 D/ a* G" m9 ?6 Z; n
  00401067:  push      00402025    ; \\.\SICE( l% Y  P" F- Z  y$ c) W
  0040106C:  call      CreateFileA
- B+ [! s, R- `3 w  00401071:  cmp       eax,-001' B; S+ o  [- d/ ]
  00401074:  je        00401091
3 j3 D3 g- |0 I2 \- n  {8 \# X/ E" ~  ]+ |$ Z/ d- u
0 ?: {! e$ A' G0 s- O4 k
There could be hundreds of BPX you could use to detect this trick.* l" w' A) e, g0 S: K5 G6 T7 S
-The most classical one is:
0 |7 s+ ?* {0 x  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
) g3 m# E- p, j- B2 r    *(esp-&gt;4+4)=='NTIC'
* C3 d% Z& e+ N) Y. V9 _: \# F# D
-The most exotic ones (could be very slooooow :-(9 |4 @3 ]* K1 X) k  o
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  % B$ ^* j& N* l
     ;will break 3 times :-() }) h" ?, y7 c2 ^* ~# X9 B" V: @
0 g! n; x; F" J( K
-or (a bit) faster:
; h( K6 m- j/ j) O( |, a   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
8 W9 z& t2 `6 ^! x1 Y- k. m4 T8 j  n! X" S% f. F
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
$ k% K' Q" D' b     ;will break 3 times :-(
9 S  e1 X! v% t8 T/ ^/ u
: h* D, k2 P0 ~) A% o/ h' m-Much faster:2 ^) f! h6 W# I3 ?4 }# }1 L
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'; n* O$ `" x' M" z

* O$ N( M& y7 b* I4 iNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
7 \; o# ]9 c# T+ W8 }, V$ x4 |function to do the same job:, r; ~4 ~0 j4 ]$ m

& K& U0 c; G+ `   push    00                        ; OF_READ9 @& x- z" S0 _8 q2 u/ B& \1 B! [4 `0 V
   mov     eax,[00656634]            ; '\\.\SICE',0' ^. c9 u+ t& t
   push    eax' @) h- l! e2 M" Y
   call    KERNEL32!_lopen
3 D* Q3 E/ P: I8 ~2 ]3 z# f   inc     eax. S; [! F8 J, Y/ _+ u  c1 t7 m2 ~9 I
   jnz     00650589                  ; detected
5 ]- y7 q# y% @/ P% t# d   push    00                        ; OF_READ" ]6 B. n( y: \- M
   mov     eax,[00656638]            ; '\\.\SICE'% q. _; s5 [% X4 o6 G, ^, u
   push    eax/ F9 l  f# p+ Y- O
   call    KERNEL32!_lopen% H3 b4 \) G+ H* V5 T* `
   inc     eax
8 M/ H: p% D0 r. Z# G   jz      006505ae                  ; not detected
4 T- t, D$ ^5 N' M
# q% z/ f$ \/ M
  C8 `6 j8 x% O* Q' l__________________________________________________________________________4 s! i0 l* }5 k" }

- Z7 h9 u% @- Q) kMethod 12
2 R. E8 l1 K; A4 m=========
+ Z7 F! i; O, h* O1 G* v  p* o- x9 `0 L( j( ~
This trick is similar to int41h/4fh Debugger installation check (code 05
! m+ M) O" r( r7 \& |3 F' {. W&amp; 06) but very limited because it's only available for Win95/98 (not NT)
: ^  s5 r. i0 R+ J: _+ J; A3 Nas it uses the VxDCall backdoor. This detection was found in Bleem Demo.8 T) x7 f  }/ D5 h" \. `9 m
6 u) O" A2 v9 H
   push  0000004fh         ; function 4fh
7 I" r' D: j3 u; p! j   push  002a002ah         ; high word specifies which VxD (VWIN32)7 X' c. `9 y" Q8 s
                           ; low word specifies which service
/ `% p" q+ E" ?7 d- l/ L                             (VWIN32_Int41Dispatch)
2 r) J  m4 s; P5 a$ a1 H8 e! }   call  Kernel32!ORD_001  ; VxdCall
( \" z0 D/ M& a9 F   cmp   ax, 0f386h        ; magic number returned by system debuggers
* D" U' r0 p0 y4 Z   jz    SoftICE_detected
7 y: t/ [9 c* e2 E" s* j6 H& \; ~# n5 r/ b0 F# e$ C& y
Here again, several ways to detect it:
4 W( `* S- Q- E4 @. [$ A0 W' _1 ^7 w" |6 |/ R/ V
    BPINT 41 if ax==4f
# h- q1 c: T3 N$ z4 U
) T" P/ }* L( ^9 E    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
4 D- X1 T- {& d4 S$ Y) J) a6 T. f( B: g: T$ F/ v( C
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A' K# S0 R4 G- X7 y. b) E
! |6 f5 J$ S( S9 m
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
  ]% \* O- g* l6 u* F3 G3 y% a/ H, a) @  }1 O$ a7 W: ]; }
__________________________________________________________________________$ {1 O8 |& i: W2 s4 x$ X
( K9 U( \+ z6 A( c
Method 13
. W  ^" h6 E: {7 I; o=========
5 l, _$ I  [  K  O; a# H/ F- M- f* L+ J1 i5 P
Not a real method of detection, but a good way to know if SoftICE is
/ H4 u+ C9 j, ~installed on a computer and to locate its installation directory.
3 K3 z: q, C' N3 K% EIt is used by few softs which access the following registry keys (usually #2) :5 R& |! y# F# p' ^

! y& b3 t8 h- w# L-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
( E) l3 n% V4 G- ^. f\Uninstall\SoftICE
5 @5 a; ]" e) Y3 x; X* Q2 _+ a-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE' }+ L* [; R3 F/ `: w/ h0 W
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion# Y; D0 M4 w  C! U
\App Paths\Loader32.Exe
. v* \' |$ K9 J' }; y0 K
: }' F% s' V" b! n2 {
) h2 a' V3 m1 U" ?3 jNote that some nasty apps could then erase all files from SoftICE directory
% k+ ^* u8 n. S  G! f(I faced that once :-($ T* J$ X4 [: X/ M5 m  F
4 K5 l/ E& R/ V: X) \) Z1 ~, O
Useful breakpoint to detect it:
; b2 M. |2 X) E2 u5 A6 L- \
# q2 O2 B8 W/ m* t0 f- P     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
7 n5 Z% c5 I/ L) A/ ~4 l
. v# O7 K3 [6 ^9 |$ [  c__________________________________________________________________________4 f' J( b. G! |" N+ u) \+ x1 u3 c

+ x7 @+ u2 u: m) }& ]- }& f5 M9 d' ?4 J7 g- ^, Q) N6 E" O
Method 14 4 {) }5 ^* V, Q( M* l* Q
=========5 _( b9 x6 |1 A. C" N
  Q& L2 K$ }% B# r& \# A
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose3 z% y2 j4 \% f- k; }) m8 {
is to determines whether a debugger is running on your system (ring0 only).
" J* e8 G8 r0 \1 d- p, E% J9 j( j: [7 m" g- R3 O% Z7 w
   VMMCall Test_Debug_Installed
1 y; E1 D* N" \% `0 l3 X0 b# l  M   je      not_installed6 [8 z' V9 l  _! T. J; ]4 A

+ k# f* ?% U& Y( ?This service just checks a flag.! O2 r7 n" z/ n* m8 \/ G% h
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部