找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>1 N) Y7 V' L. J0 `( x, U7 p- o( d8 s: |
<TBODY>
: i0 A3 p% _1 n3 X; a<TR>
  \. K6 T; H8 {1 h<TD><PRE>Method 01
+ t4 l% A/ N1 i" W=========
. A2 c& y) ?1 L& f; l! y. T$ S0 ]! v2 O. I5 t5 v& s2 l
This method of detection of SoftICE (as well as the following one) is8 x  Z  V9 p2 y
used by the majority of packers/encryptors found on Internet.
% `; b( N1 i; nIt seeks the signature of BoundsChecker in SoftICE$ G' g& v+ v  ^" {' E8 W. s& U
# \' E2 P& Y; f) U( r' n0 W6 w6 }
    mov     ebp, 04243484Bh        ; 'BCHK'
* ~+ `8 S8 Q1 z5 C$ B$ \: W' ?    mov     ax, 04h: C& [4 p5 r1 j5 J- [: m
    int     3       , ?) J  w7 b. l, w" {
    cmp     al,4
, ~( C0 u8 O# r/ f, }    jnz     SoftICE_Detected! L4 G" W1 r9 {
/ G8 g3 t- G5 v3 `# P8 X& P4 S3 `
___________________________________________________________________________1 ^! Z, l: n$ q
1 E$ K  w; o* v
Method 025 |$ y) _5 i) _  d4 T% }6 f
=========
8 D$ D7 y2 K7 a1 z  B; G6 e8 m8 q7 B
Still a method very much used (perhaps the most frequent one).  It is used
$ |/ P- X& q8 j* Y7 I$ kto get SoftICE 'Back Door commands' which gives infos on Breakpoints,3 i. ]6 b$ F6 ?2 g+ N
or execute SoftICE commands...
* t  q! q- p# O( \% h# z3 |" KIt is also used to crash SoftICE and to force it to execute any commands
% G! Y) l- n! x(HBOOT...) :-((  
/ ^* d2 k/ ]9 G. E3 Y$ X
1 p5 r3 p% b5 L8 s) ?, A  THere is a quick description:
7 ?2 I6 W! W3 k& u2 |% m5 ^-AX = 0910h   (Display string in SIce windows)
/ L6 R' \. ]5 B% H-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)# [( z4 R8 J7 P; {
-AX = 0912h   (Get breakpoint infos)
8 I8 n8 Z2 _7 H% c3 u5 S0 M-AX = 0913h   (Set Sice breakpoints)
* G0 y$ n* \; y-AX = 0914h   (Remove SIce breakoints)$ l  D# R/ P: C! k: o+ x6 V0 \
" R- ~0 y5 l1 m( ~4 j8 F
Each time you'll meet this trick, you'll see:
5 T4 W& Z. r! h" S; h9 J-SI = 4647h* C$ ~, }5 r/ G7 g( X
-DI = 4A4Dh, o) A2 i# b; X5 e
Which are the 'magic values' used by SoftIce.1 [6 v- d5 i" ^2 u: Z2 B, m: g
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
2 y( G7 T; R8 z* B3 w2 \7 m4 \; }+ u; B( Q' [' ^0 m) i
Here is one example from the file "Haspinst.exe" which is the dongle HASP$ K9 O2 M4 m0 R* p6 ]
Envelope utility use to protect DOS applications:
9 G" V/ F2 n6 @! H; H( M
' t0 w9 y0 ^. y: H$ @; m/ N3 L; z  X  G
4C19:0095   MOV    AX,0911  ; execute command.
' h* M% D& t2 s0 e4 K( z% T4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).  x: V5 h  X1 J( Z
4C19:009A   MOV    SI,4647  ; 1st magic value.
3 Z: ]4 n5 @% M! v$ A  G4C19:009D   MOV    DI,4A4D  ; 2nd magic value.7 x7 o  g/ F( J  l6 ]; I
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*). |8 g. }* U0 {1 w
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
4 D4 W9 s9 d, y1 @* M) T4C19:00A4   INC    CX$ w+ Q* [4 ~5 v" h! Y; \
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute+ P) l; ~% L6 j) w: W. A# D% y
4C19:00A8   JB     0095     ; 6 different commands.9 l/ i9 K% z8 m8 b: v2 p8 ?6 |
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
& V6 o; v. ?. I" p4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
9 {3 a: {% U) S: H3 F7 f8 B3 F  a: D, u; w5 S+ A
The program will execute 6 different SIce commands located at ds:dx, which
- _# P8 T3 S) }8 A& sare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.3 g* R$ y) y0 a+ [# N

' ]4 s) V: Y- J5 z* m( f% Y& [* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.* p! ~9 q5 i/ e  a. A5 b
___________________________________________________________________________
, w5 H" N9 w" C$ K2 v% X
$ P3 R  V/ k( q+ Q. j
& |; h+ t1 k- Y% P, RMethod 03& f' d# B3 A( G( V! b; R
=========
7 i) R% {8 H5 e6 `+ ]9 H. l& `4 Z. I( l
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
, r) B/ V& r% T4 v/ d(API Get entry point)% l5 t1 d/ n  k9 u% c
        ( r9 z- u% K% `& G
4 N* v& Y, Q$ W1 B% t5 d) S
    xor     di,di
9 A! E) u* e. w) G    mov     es,di
# J2 P" E8 S/ t( D0 H% _  B% O    mov     ax, 1684h       2 S( C5 ]) A$ e; ?7 r
    mov     bx, 0202h       ; VxD ID of winice& y' b- m0 k8 ~1 x4 [
    int     2Fh* E( |! o; L1 g6 J7 u
    mov     ax, es          ; ES:DI -&gt; VxD API entry point: A9 J! S% W+ D
    add     ax, di
) O8 G1 b) A1 N: M* n" L* S3 K) M    test    ax,ax7 j0 S/ ?  Z! x+ q/ V
    jnz     SoftICE_Detected$ h0 _0 C5 k+ y

9 f( [) B9 B* ?, A6 F0 G  h___________________________________________________________________________
) o) C5 r# W3 t( d0 |5 n+ Y- |
! m1 v( K+ p$ sMethod 04/ z! [, M+ N8 }8 D' C) @/ v! u
=========
7 |+ z# n" W+ ~2 I8 c, Z2 q0 W8 Y0 {1 o! m) x% K8 {
Method identical to the preceding one except that it seeks the ID of SoftICE) g/ b* X) [. s: h
GFX VxD.
5 S) i$ d. F9 U6 e+ ]# X
" _1 O! s% ], G3 K    xor     di,di  l9 t& L3 H4 @2 D; x
    mov     es,di
5 Y1 T  i1 {. q) J; ]    mov     ax, 1684h       4 H4 F- ^+ F3 ^
    mov     bx, 7a5Fh       ; VxD ID of SIWVID9 M8 [4 s5 r) {) G
    int     2fh
6 l# H- Z) H0 E    mov     ax, es          ; ES:DI -&gt; VxD API entry point
$ }2 B7 C( a' k' @! H. V2 N    add     ax, di
: z+ K3 n7 h2 t    test    ax,ax
" j7 T! @; `( a' ]7 F  [$ Y- N3 I% x    jnz     SoftICE_Detected
1 B% T. E6 e2 _& f: F/ d" G8 d, Q3 q" c2 T/ p
__________________________________________________________________________% J6 Z5 K: X3 _( z6 I# C+ L" U& R

8 q- {1 _. E" }" H, h/ h9 b% l5 u% x( \2 [; {4 J5 z
Method 059 I% |4 f) Y, }( d4 ~4 ]: n
=========: d- P! x% `$ ^3 Z& Q

6 s/ h" \- {6 w& x  eMethod seeking the 'magic number' 0F386h returned (in ax) by all system  Q( @0 j/ }' n: F0 x0 K
debugger. It calls the int 41h, function 4Fh.0 p3 l. |% f2 s/ z, E$ C4 P8 `' V
There are several alternatives.  - F. V4 q6 C) a) d
4 W- n/ Y. B% d' o9 j
The following one is the simplest:$ x4 c6 b! |+ V. B( \

+ G* h  L; l) w0 n    mov     ax,4fh& m' v( Z) l" A0 s
    int     41h
/ g6 b( c. W4 P  n# B1 \1 S    cmp     ax, 0F3869 Z# p1 Z+ k- ]' p
    jz      SoftICE_detected. Z3 e- t. o5 \" F) C% z1 v! b
/ P& n' N: [( s6 C9 Q: W% }

9 j+ x- Q3 M' j5 K) g& X# n( y+ SNext method as well as the following one are 2 examples from Stone's
" @: s8 x7 j& B, l, @"stn-wid.zip" (www.cracking.net):
) N' e, Y1 P2 y  ^: k( A6 P0 |; ~; n- D2 R  ~& X# k8 z
    mov     bx, cs
# Z; k" W6 T" G& s  D1 f    lea     dx, int41handler2
& |$ J# M2 e- R( ]5 r) _! k0 _    xchg    dx, es:[41h*4]% i1 W8 [2 z9 O/ R- E1 o0 v
    xchg    bx, es:[41h*4+2]1 F0 D- P1 f* M2 Z" x, J' R
    mov     ax,4fh
3 T6 Y- E  u  T1 L3 U    int     41h) L0 D7 p- A4 [; n4 m
    xchg    dx, es:[41h*4]
' r9 e8 {; g& W" i0 y/ }4 V    xchg    bx, es:[41h*4+2]
2 x3 m( T6 x; F* h' ]    cmp     ax, 0f386h
* u& I; i. M# y4 W0 s/ t    jz      SoftICE_detected) S' r. E8 z. _4 N7 M& j8 K( c
  M; w7 _! K3 S' E7 Q' K
int41handler2 PROC
9 [3 n* J' V2 ?) N# I2 f    iret
3 X! L1 v* \, W7 R! u  z+ fint41handler2 ENDP
7 }3 E# n) X% i
1 a6 f: h/ @8 |$ x! e5 I& b& o5 V& W* R3 [  ?7 [0 c. e( g
_________________________________________________________________________
1 Y: S' Y, p3 v$ s5 Z  v5 x6 I/ l# e! |" o

$ K$ g* c+ V0 L$ z) o# cMethod 06( Z8 i5 G" m4 Z  S* T. R+ @' ?+ g
=========; e9 s& |# A# S  p! a& U

" [) ~- ?& ^! w- B# N/ j0 I- L2 q& h* u. W% `) M4 W
2nd method similar to the preceding one but more difficult to detect:
8 q8 z% y+ u: l+ q; H( I0 }2 O! E& h# x* N/ R

  Q( @3 H$ @& b! }& A2 kint41handler PROC
" y5 S/ X- S9 ]7 c    mov     cl,al3 o$ C% [$ {  e
    iret
- {( ~$ {8 [" b, `4 x; H' yint41handler ENDP
; a" l" C' z: o  ^0 m+ t$ X) _! l4 w/ f7 ]* q2 N, K5 [& U9 [

. }/ c  ^) L3 v    xor     ax,ax, Y2 ^9 o! [% Y& n# _+ u7 T; n
    mov     es,ax
: z7 e9 l! Y$ P3 D1 v) G& e    mov     bx, cs
( N! f9 G+ T/ j8 u2 X6 m/ X. j    lea     dx, int41handler7 D4 Y+ O; \! }6 ^% G3 F% G
    xchg    dx, es:[41h*4]
" D: N* A) E7 z% R: j5 z2 h    xchg    bx, es:[41h*4+2]
. N" M9 y0 Z! C3 E. U, L! `% \    in      al, 40h+ f, _" p- |6 t" v
    xor     cx,cx* F! C/ g. a3 R" z/ L; U' P% z, T
    int     41h
7 Y3 Y0 A( F; _. ^9 ^" R8 q    xchg    dx, es:[41h*4]1 K3 ?5 L! x. c
    xchg    bx, es:[41h*4+2]4 j# G) l: c& X) e. p
    cmp     cl,al7 ^' a9 |" {! P/ n' L
    jnz     SoftICE_detected
9 E1 d: i- z, ], y
9 D$ R3 z! ~8 r1 l_________________________________________________________________________
2 }' a0 Z* t3 p1 i% r! O8 ~2 ?& v1 S/ _, f( R5 l: O
Method 07- u/ O1 Z" U5 E1 Y- s
=========
) G( E) x9 e6 [9 W7 D" |2 R! v/ Y% h; q
  q0 n3 r, C: Z* s  a# QMethod of detection of the WinICE handler in the int68h (V86)
- M. t; R$ l: [- W! B$ T; W' x" y8 T. _' p
    mov     ah,43h
# M6 R# c/ E5 |: K- j5 E2 s    int     68h% [% `$ L* ?  d+ s* |$ _  H" p
    cmp     ax,0F386h) j. y( H& L5 m& m
    jz      SoftICE_Detected
& ~1 D, ~# A/ ]. N- i. P2 ^5 x) K& L; Q( h. h

9 s6 U) V" Z$ y7 J4 a=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
* D, n% I2 E, e% O8 C) V   app like this:  `# u0 \6 }& u' `' V( S: x

' j- p9 A+ f, n1 G) t   BPX exec_int if ax==68
- N$ A6 _! R& |* w4 F( w   (function called is located at byte ptr [ebp+1Dh] and client eip is
% ~' c% J2 f4 M  ]   located at [ebp+48h] for 32Bit apps)5 ~, e2 |3 |2 S+ u% ^% V6 W
__________________________________________________________________________3 N, u" h1 O0 h

7 ]% T% j+ ~' u1 c& h+ d! ]+ B' D7 h  x* R
Method 08
/ l  n, S8 }) ?7 z=========
5 K( Y3 d# k! `/ V- D, p! \* I- j7 X; E# L. ?* j) a  l* ^
It is not a method of detection of SoftICE but a possibility to crash the% ~  z) m9 C8 P
system by intercepting int 01h and int 03h and redirecting them to another
" t6 T8 X/ Y' t6 Eroutine.6 q) l6 L* b) n# i! J. m
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points! d" ]6 g9 ?2 q+ b& ?5 \# k
to the new routine to execute (hangs computer...)
! v/ J* ?( x$ l' V6 f3 g+ z4 ]/ z% t* _' X) n+ n8 A
    mov     ah, 25h
* u. Q; V8 j$ @. @* R) r    mov     al, Int_Number (01h or 03h)% J, T+ o3 K8 m/ P
    mov     dx, offset New_Int_Routine* d" F+ b5 @6 Q' ~( J  G
    int     21h
% ^- s8 n2 S4 W! V; |- O; s+ y2 A( M) a  V- I( u
__________________________________________________________________________. D: B9 H0 q5 m+ p& L1 H& ]8 h

6 n7 a* m( r% P5 |. b6 m- y& K% H+ ~Method 09" i( Z  Y/ q7 d( A4 e  C
=========0 A+ M; C& v7 D, [
8 x, O# o$ i1 A  Z: [) A0 H
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only% ]* Y" I* @( @  m
performed in ring0 (VxD or a ring3 app using the VxdCall).. Z' O% n1 r" u5 @+ o" N- C- b: }
The Get_DDB service is used to determine whether or not a VxD is installed( O% }/ _8 m1 C1 t5 H# @
for the specified device and returns a Device Description Block (in ecx) for
9 a" o( {& e. Z8 wthat device if it is installed.3 z# P/ |8 I6 S( e: v- D

$ }" v$ d  T& U6 T   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID' j3 z7 g! ~9 o, k# y
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
3 w4 ]& `  F, |   VMMCall Get_DDB; v: m# Y& a3 O7 a* y  K
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
0 X- y% @7 F9 D! Z5 q$ d* d
) B. j' x9 {& y3 R* _5 |  p$ z/ @Note as well that you can easily detect this method with SoftICE:
5 @" V4 R- k$ O* i" c3 c- {   bpx Get_DDB if ax==0202 || ax==7a5fh% K' s+ d- v# x3 ]) l8 T  C1 C
+ N. y: D! z1 S
__________________________________________________________________________
5 A% ]6 E3 I+ s+ c: {
5 [" _9 e* ^8 @8 v  V- _9 N, MMethod 10
( \9 i) ], `' u" D% f=========
  }  |% {. G' ?: a2 A+ `, {, u1 f6 A! j6 N
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
( E% u1 ?/ B; u6 o$ }& _8 n  SoftICE while the option is enable!!+ p& Q& k9 y0 U- X. S
% _- D7 z9 w! M7 x7 i
This trick is very efficient:8 S% u2 ?' P' o) G( c1 v$ s) r. u: d
by checking the Debug Registers, you can detect if SoftICE is loaded
; h' M% |3 i  h& w(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
$ }0 J; O5 u' F* @0 fthere are some memory breakpoints set (dr0 to dr3) simply by reading their' ^( s& B) l0 q
value (in ring0 only). Values can be manipulated and or changed as well
* _: p* D5 z8 a(clearing BPMs for instance)
' w; P6 a& M& |
. R  [0 p7 W! O" \, ?  W: R* w__________________________________________________________________________
& O) a" g5 Q  W6 n! R& T: `$ r3 K: q/ X7 j- i3 p7 R
Method 11: a% r! c, U7 |% _1 Z
=========, o6 s/ ?- I/ |; x  V
6 @4 w5 [7 S0 ^% T
This method is most known as 'MeltICE' because it has been freely distributed! O% K8 N, Y; S- u; D. ~' w# S
via www.winfiles.com. However it was first used by NuMega people to allow
+ a6 f, {0 U! J9 e" r' u6 g+ q" _Symbol Loader to check if SoftICE was active or not (the code is located3 o" ^7 l. Q7 _9 b! I& Q
inside nmtrans.dll)., m+ d- \- c/ q  {( i+ Q
/ u/ p9 V' M4 a2 ^2 Z0 x- ~: c
The way it works is very simple:
2 ?* q  B7 T. O. dIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
! u. G' K; [. c/ }- R# iWinNT) with the CreateFileA API.( \# `6 M! ~( D) C* P
' J! \- A) P' R
Here is a sample (checking for 'SICE'):" v. i0 Y% C4 o

. E' U( A+ g  Y6 u4 n+ MBOOL IsSoftIce95Loaded()' ~+ i7 m) e  Z% D* R" g4 i; H
{7 M4 v/ }- v2 U9 S) Z
   HANDLE hFile;  
* A2 {' M9 r  S2 s" `3 J! j   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,5 z; ~8 l) j) g. m. k+ w
                      FILE_SHARE_READ | FILE_SHARE_WRITE,( d7 u$ @6 {( X6 J! F# _
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);3 t# Y' `5 V, ]# f  n
   if( hFile != INVALID_HANDLE_VALUE )
2 f( {! o% K6 t. {, \% C$ k# c   {
) R& w, O8 q4 ^' [      CloseHandle(hFile);
. B. U" b1 t- o4 ~5 b- c" X9 ~( s      return TRUE;) B, t0 T7 |; ]+ S8 Q' V4 f
   }
# ?  n9 }$ @# ?$ X" ~   return FALSE;
8 `& L+ N8 J( k4 h/ |7 l}" X# N9 ]8 n  M. \& K$ \2 V& Q$ G& e

8 B7 k5 H3 v4 Z% lAlthough this trick calls the CreateFileA function, don't even expect to be$ J( D+ b+ {9 |1 g  N. M# g1 h
able to intercept it by installing a IFS hook: it will not work, no way!
3 z, p8 K- p8 S% v- t8 cIn fact, after the call to CreateFileA it will get through VWIN32 0x001F) ?3 d; ~6 n- j! D! M0 G* n
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
5 R+ a0 ?. @+ E& w+ S  Zand then browse the DDB list until it find the VxD and its DDB_Control_Proc* ?7 i5 f6 C( L0 b
field.
' m1 _) m* J9 {: [3 Y4 uIn fact, its purpose is not to load/unload VxDs but only to send a
8 v3 m: p/ v2 dW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
6 m/ Y9 h% F' w- p) x0 e4 ?9 Xto the VxD Control_Dispatch proc (how the hell a shareware soft could try0 ~* D1 Q: R2 @$ o% P
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
$ k( B# s( ~4 J7 w3 H0 \% |If the VxD is loaded, it will always clear eax and the Carry flag to allow
3 d% E- L1 s4 N/ t! i2 zits handle to be opened and then, will be detected.4 i/ B4 A# k5 `" W: A8 Y
You can check that simply by hooking Winice.exe control proc entry point
# T: K8 {. H$ s% _while running MeltICE.% s+ O" P" ~: X" F; T! J

9 z( {* Q0 S2 U+ s5 I4 {9 Y2 K0 h( B8 x. e4 s/ c; n
  00401067:  push      00402025    ; \\.\SICE
6 B- N5 X4 z8 t6 V. N" }7 N  0040106C:  call      CreateFileA' c9 V7 r% i/ O% f1 B$ x5 `
  00401071:  cmp       eax,-001, q0 W6 S1 p& f& h6 k
  00401074:  je        00401091
* l5 Z. s/ e9 j5 ^) l9 v9 t! {$ B8 s, _* ^9 k; V7 v

* ~; K+ f7 s7 M( t% xThere could be hundreds of BPX you could use to detect this trick.* r% |9 G# @# \9 h2 `
-The most classical one is:
; o3 r6 m+ S) @" T# h4 _  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
) V* C4 R9 S; F) ?    *(esp-&gt;4+4)=='NTIC'6 s( z4 ?& H; ?( `+ c0 h( W! E

* v4 z/ Q& w( v  i-The most exotic ones (could be very slooooow :-(
* t  O* [$ `2 {  I2 @  \   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')    G9 q  v, I8 [+ U9 F
     ;will break 3 times :-(- {- z7 M- h) @+ P$ y/ B8 f! ^
& o, ?" T3 `: k1 a; b( U
-or (a bit) faster: / m& y; u+ p  n3 l3 p- ^. r
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
/ e# n8 \4 M3 r7 W8 B) |" V  v" C% A9 Z  P
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  & j( I( g1 r. }0 M' W* w& @- `
     ;will break 3 times :-(7 s. o. D( q! ~/ v) j
8 G: M- H7 {" _5 b# d
-Much faster:; e1 D+ J! R% J  m+ @! P5 v: Z
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
, M% O  c5 X9 o2 e( ?8 Y6 B
0 ^6 v+ T7 q. r& ZNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
, i: v+ H) b( G# t, k' x% Ifunction to do the same job:" {7 P6 `& K8 V) i+ Z- b- ^+ D
! V0 e+ r; Z: `1 @8 P
   push    00                        ; OF_READ
$ U% \- O! l* x( k7 C, y   mov     eax,[00656634]            ; '\\.\SICE',0
& n6 t. |2 ~: I! u' ]) K9 h9 u   push    eax
- i/ l; ]; F2 P   call    KERNEL32!_lopen
# y( k* m& B6 i9 Z( i# K# ^8 M- a   inc     eax
& G  C. s* d# t+ S   jnz     00650589                  ; detected/ w; @1 P8 R7 W& `
   push    00                        ; OF_READ. r, z2 m, h7 _9 |8 ?
   mov     eax,[00656638]            ; '\\.\SICE'
& K) g8 {% V$ _   push    eax
8 e+ }  F: Z7 G: h   call    KERNEL32!_lopen
; S! X5 U; n, ]5 e   inc     eax% @$ A; C% z' {3 t) k4 g, k
   jz      006505ae                  ; not detected. t4 ^% @/ h" C1 s. J, ^. B* c

3 B2 K  g* H. H. ]2 r, g1 w
! Z) \' |) ], Y% q__________________________________________________________________________
" N8 {8 e8 l: @& N6 r2 w+ m1 C
6 U6 I& n% D& ~, JMethod 12  D7 u/ y' v8 X# V
=========" r% `) W% i" C: G' Y

; ^; ^+ |9 \$ sThis trick is similar to int41h/4fh Debugger installation check (code 05! T# v) w* W. M/ E
&amp; 06) but very limited because it's only available for Win95/98 (not NT)  u8 F0 E+ ^2 \) J9 c$ B$ T
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.; F4 A; @8 n; B; C3 S

$ z! X& U. D8 d5 c9 z   push  0000004fh         ; function 4fh
. ~5 ]. j; D5 i3 X. b6 b+ g, T- b0 b- V   push  002a002ah         ; high word specifies which VxD (VWIN32)
# X$ O1 U! G. v5 S$ @+ x                           ; low word specifies which service4 }( Q0 L- a+ O& J  L1 c; A
                             (VWIN32_Int41Dispatch)
3 c! ^9 a" o7 J   call  Kernel32!ORD_001  ; VxdCall
$ u& V1 Y6 m9 e: C3 t$ R4 m   cmp   ax, 0f386h        ; magic number returned by system debuggers
; ^: f: p% G5 A' b   jz    SoftICE_detected
$ y5 ~: e! P& e7 r$ }  F+ G+ d# p+ V! U6 f9 h/ g
Here again, several ways to detect it:
; b2 Y( E& u) U% H! m& o
6 R1 k) G, I7 K/ l9 z    BPINT 41 if ax==4f% d) Y! h+ b6 v2 X) n

0 x, G4 ?" S/ k4 f. ?( s" p    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
- F2 `/ z9 Q( e5 [
7 i3 K5 @- K# a. V. E; H: I    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
% T" w- P1 v+ b2 u; f3 _1 @
3 M% C; K+ z4 a! @/ Y1 S    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!- i5 q  r1 C, R, H3 }+ |$ Z

; i5 ^7 e+ M4 V* m2 ], {0 R# B7 D__________________________________________________________________________9 n& l" [' C, l5 U
4 h1 o/ {5 D! X% W
Method 13; H; J" ^* q' k$ C$ g
=========
: ~8 K6 }% m* n: M
. g6 x9 b( T' p) a  lNot a real method of detection, but a good way to know if SoftICE is; A( A9 l$ O" k* v5 J) v- {
installed on a computer and to locate its installation directory.
! g0 g: T! `9 `4 Y3 F5 FIt is used by few softs which access the following registry keys (usually #2) :% ^3 H% j  e9 c' S; v# ^5 W$ H: o2 n
7 G! R; p) X2 J  o! m# ^
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion  P$ [0 a! Y& |0 ?; z. N+ j
\Uninstall\SoftICE
( H$ l" _* |6 j. H-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
7 A- |6 N) a% V7 e& K-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
' {# J. {( o$ j\App Paths\Loader32.Exe
- }, g$ z3 z6 o6 K% h
! G. c9 |# B" ?# v) P6 F( V5 }0 _, d8 n5 Q8 K6 b# B$ p
Note that some nasty apps could then erase all files from SoftICE directory
. b" r& L2 D% @* `0 t0 _/ T  l(I faced that once :-(
  v# C6 W3 V8 c1 \& e/ F8 f4 a' N
  Z  o! @+ |* H4 q+ S) r! S' C* YUseful breakpoint to detect it:
. _( V- V& h% ~+ M0 e
3 z. s- `. d/ g4 U$ k+ |8 S     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE') [+ c& F: H! W2 Z

7 n. ~  V% F* H' C  b, y1 E__________________________________________________________________________( L- S1 k7 q7 S! S! `+ f0 f. l

4 H- L" k: |) n5 M. f$ x4 i8 Q
' A7 p0 P5 r6 _. ]Method 14
- M  ~$ J2 P& [7 D3 a$ g3 _=========
7 T2 C9 ~) U1 ]1 p( F
8 @2 i2 `" A, O8 [" ?1 LA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose2 L/ h( w3 ?+ u
is to determines whether a debugger is running on your system (ring0 only).
! t6 E' m" G4 ]' o' T! J$ c  `* |& o8 o' q( b( A: M) _
   VMMCall Test_Debug_Installed
/ p" E9 \5 a  ?! F' k   je      not_installed" D% j5 R* A- I9 Y+ z

& {8 M: I/ O9 ~* O0 K3 qThis service just checks a flag.; S' k2 R% A& F  Z! A
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-8-17 20:03

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表