找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
+ m. M4 n5 U0 G) i8 y0 |) A# M3 D<TBODY>
' A$ W1 y5 f3 ~$ m<TR>8 G% T4 {1 ^' i
<TD><PRE>Method 01
3 }7 A) {; h$ P( N8 w=========
6 \. G( D' U2 {8 I8 i! |9 e1 V! D+ E3 Q2 u, ~7 X& T! e# n
This method of detection of SoftICE (as well as the following one) is& f1 s# {! {6 N6 Q' ^7 W% U; ]/ e
used by the majority of packers/encryptors found on Internet.
: V4 h; H& D5 p, G' m& D+ J0 v) FIt seeks the signature of BoundsChecker in SoftICE" {0 {9 |, z* f3 W
/ ]- D) f# f. c/ I! K
    mov     ebp, 04243484Bh        ; 'BCHK'' W6 p; |+ j. I/ i4 b' f6 ]& K
    mov     ax, 04h/ v2 x( J) ]9 e: u. o5 R
    int     3      
) ~0 l. j* D3 H# }5 Q, m. R% b    cmp     al,4; d$ S+ N9 {8 m) I0 }
    jnz     SoftICE_Detected: i' l/ Y; N) Y. E, m" j8 V, B1 ?
# G- l& d# O$ D. @* E& p
___________________________________________________________________________
+ R) ?- {" [! Y+ ^# K2 H- I$ E$ w' ~
1 z4 {" _7 b- [. D& F* NMethod 024 `3 v; g' T0 O( t2 N# I9 a
=========
" G+ G. m, m4 y& _, m5 M
. G; K3 X( D3 Y1 W/ U/ \Still a method very much used (perhaps the most frequent one).  It is used0 r& J3 c7 Y$ c5 G( ~) J
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,$ x$ W7 }# V1 O: r* o8 Z
or execute SoftICE commands...
( W. ~4 ?" \  Y+ b  Y2 xIt is also used to crash SoftICE and to force it to execute any commands
. r- K" i+ ^: M+ r0 K- l4 \(HBOOT...) :-((  
& [- N2 p  S( f! T8 L0 q$ c( e; M) A& y0 B* M$ D+ X
Here is a quick description:6 Y7 x8 H3 z& I0 s( i' L
-AX = 0910h   (Display string in SIce windows)
' ]' m. W4 `! z8 R-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
% e0 L- o3 d0 n0 F* r-AX = 0912h   (Get breakpoint infos)5 S+ E3 }) @( T9 `' E, x/ m, L$ O
-AX = 0913h   (Set Sice breakpoints)
2 Z& ], l$ V6 i; T. i' F( F# J-AX = 0914h   (Remove SIce breakoints), p! L. G2 L+ z* z2 g8 ]) I7 |6 g% n
5 \& D- d- r9 M6 ~- q" b
Each time you'll meet this trick, you'll see:# N1 ?' {8 d# e, H3 h' P
-SI = 4647h
  l4 U2 {3 h3 \& _- R-DI = 4A4Dh  `0 h( q0 x2 |. f3 |
Which are the 'magic values' used by SoftIce.
4 @0 E2 S- u6 F) S% q% pFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
- l, D! }+ z0 s8 }# v$ r5 g& `' _% T1 [) V2 N
Here is one example from the file "Haspinst.exe" which is the dongle HASP% b  t5 X$ _2 e
Envelope utility use to protect DOS applications:; F; r8 D' x' X
6 u' ~! ~5 J" I- V: I8 i! F

8 `, c! }7 z5 @. x+ I. i; g; F' D4C19:0095   MOV    AX,0911  ; execute command.
. h8 K5 T, ]' ^. I$ J" ?4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below)., O& _/ u. C5 Q0 [
4C19:009A   MOV    SI,4647  ; 1st magic value.
: W9 Z. {% F8 }! q" P1 K4C19:009D   MOV    DI,4A4D  ; 2nd magic value.! p! V' H/ M& I6 {' g/ k9 B
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)& U. V( S4 Y7 a) \& y' @
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute; ]+ C* j5 w6 r& V" M6 Y
4C19:00A4   INC    CX1 {; T- f+ V$ _7 l+ s+ a1 r2 `% N
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute. w# t2 S# \4 r9 V% E# B- W+ W
4C19:00A8   JB     0095     ; 6 different commands.
9 i! K. a0 W, `5 M4C19:00AA   JMP    0002     ; Bad_Guy jmp back.; \  x; H- @/ N% H5 l3 H1 w
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)6 i! k1 t, U7 V0 N

) [( [8 c5 q: f4 B: Q* Y0 U& lThe program will execute 6 different SIce commands located at ds:dx, which' x  Q% }; _; V- @$ `+ u! E
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.( e0 t8 w3 J- @- g. l
! u0 o- C, a5 L) ]
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
: W7 Y! B+ s+ c! p% ]) ?1 B___________________________________________________________________________
) \4 U7 h* X. H6 j) i- B8 H
7 A: D) A- N! n. n3 x9 u( g& C! R- b$ Y) v3 K! {
Method 03* l* Q1 A! `( T; x$ b, [8 l% V
=========/ {4 f6 c: L" D4 {+ B  R: H

1 s! E* l. O& c* i# w& T8 ALess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h- ^5 U  G+ L7 `- N$ q
(API Get entry point)
0 _: C7 O5 f. @1 F' G% u0 T        1 ?/ ~7 \5 h5 j3 V9 A
* V9 f0 E% Y  a& n" M: i& |
    xor     di,di
. b' f7 O8 ^  i; W; l    mov     es,di
6 w" w5 w/ A5 q' P$ s    mov     ax, 1684h      
5 y  ?/ Z& t& C6 U8 l    mov     bx, 0202h       ; VxD ID of winice& Y. T9 s: W" R
    int     2Fh0 F6 b$ T, A3 m( B) x: G
    mov     ax, es          ; ES:DI -&gt; VxD API entry point; \% T- T# A! E! f( R/ S
    add     ax, di
2 \- \! o( D7 O8 H+ v  @    test    ax,ax: p, J" x2 x' N9 }5 L& z  y$ W0 J
    jnz     SoftICE_Detected
5 v- d; K6 V  D: N
% h$ p( j3 W4 e5 ~  K___________________________________________________________________________
$ j  l/ n, A! M% q
0 }; l. T* Q! {# G; qMethod 04
( |% A8 q$ E" G; k9 C5 |# M" v=========. {: |9 }% p: i! e
, s! y+ M& c; l: t0 {
Method identical to the preceding one except that it seeks the ID of SoftICE4 c# s0 n. U% K6 Y* n$ G
GFX VxD.
: i" {/ O: O: }# _& G: w+ J9 ?5 @! |# A) r# ]" H- E' q
    xor     di,di
3 \' j4 ^/ ]) M) K7 F    mov     es,di
' y+ u* a( C1 ]' f1 a8 B/ |( ]    mov     ax, 1684h      
5 c) O) U& O- c  l) A    mov     bx, 7a5Fh       ; VxD ID of SIWVID3 y2 f2 X6 ?' b/ ~5 S" s5 _
    int     2fh0 C" B8 W7 ], V# U
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
6 S, F0 z0 P/ k6 U5 ~    add     ax, di
1 a6 v8 A& Z9 X9 F    test    ax,ax) `) h8 n' ?+ d( T* v
    jnz     SoftICE_Detected
- M! a; m% ~0 q" I2 f. t0 c0 _9 C" j4 X! E" r
__________________________________________________________________________, i) F2 |: K; I* D: I& k

  R+ I/ G- \5 i- |0 C' q' z- C/ u/ G2 F; F' [! m( q" O1 [
Method 050 n5 F% R5 r( F  P7 j
=========
& p& S$ j, x" C* |  [7 r9 [7 A- M# d. Q. X  ~
Method seeking the 'magic number' 0F386h returned (in ax) by all system
+ L" |4 t. C# D' Mdebugger. It calls the int 41h, function 4Fh.
$ Z. N4 T. T) L7 ^There are several alternatives.  $ U. e8 U  C( c3 O# v: Z, H" c
* V4 I2 [. N3 v- D
The following one is the simplest:
# r0 ^  h( Q/ l" L- c
; [( F. H' V# @1 }    mov     ax,4fh: G% s8 Z: _( O; }
    int     41h
$ S4 {8 J0 j# i. [% q    cmp     ax, 0F386( V. \( T( [0 ^2 X
    jz      SoftICE_detected/ d% ?1 s; w, I& L9 }1 q$ u
/ `. L9 R0 F4 U1 K5 y3 v
& n7 v/ |9 L7 R: F9 A
Next method as well as the following one are 2 examples from Stone's
# N: `' [" l9 ]- }9 z) Y( |( P0 @"stn-wid.zip" (www.cracking.net):0 i' x: P9 S( u

& O' e) z/ G% d; [8 ]; N( U    mov     bx, cs
0 x3 M1 h3 D% C    lea     dx, int41handler2/ R- o  m9 }6 T4 k1 G1 W
    xchg    dx, es:[41h*4]; W: _* O9 t( Z$ J7 S5 ^
    xchg    bx, es:[41h*4+2]! y6 [4 X+ J: l# F8 \4 }, d
    mov     ax,4fh: j3 i0 c1 L/ j' m" W2 T- i* }0 `
    int     41h
6 [/ ]0 z  n' D5 r6 {) s    xchg    dx, es:[41h*4]0 O  |. R/ i" R% @, @5 g7 e+ l( S2 Y# r
    xchg    bx, es:[41h*4+2]9 ?, F$ k3 M$ I3 K% P
    cmp     ax, 0f386h0 P4 m# j+ T9 s' [5 M# V8 N
    jz      SoftICE_detected9 E6 y& x& d! F5 d" S0 B* A% U3 ~& y

* r* U) F9 o* W- K& l) yint41handler2 PROC: J) I: N+ n6 N* M6 j9 R5 i9 N& _
    iret0 V( N& m- `4 z! x& J8 g
int41handler2 ENDP
  C. ]$ B" V; g' G- Z- r1 R6 d9 k

: k1 F5 ?# N8 ]6 R5 B_________________________________________________________________________
& M! B& F: g2 x' J" m  \! ?- L
) o# K0 h9 n& R1 _  ~$ ]# l4 G1 s! r% Z* O
Method 06
' y- J  f+ B5 {" h) ^$ T. @: E=========6 k& s5 H! C0 ^$ ]% K, b
( Z. V* X+ V, Y( h$ f" Z& t

; b/ M, G- a; i) w& b% P2nd method similar to the preceding one but more difficult to detect:$ t& @0 C  H6 q# C: s4 v7 T( l; l
* ?) X4 l1 ]; N
$ j6 L& w) Q' B7 [) X
int41handler PROC, Z+ O- h) L" u* \' e! |" y
    mov     cl,al
% E% M( S& s) ]# D' z6 N, u9 y    iret
7 w" N9 i, ^7 T/ p- b; W, z) iint41handler ENDP
1 o0 J: ~% S/ f5 g3 F4 l) d; p5 O( M$ T

& l3 Q, a% ~  e! [3 y* L3 t    xor     ax,ax
! q. l/ q) n: r+ m8 @0 g2 y" s    mov     es,ax
- K( i( U  \! Q, E    mov     bx, cs3 Y. E7 B9 h: F: k9 o& W
    lea     dx, int41handler1 X' e' X# t3 J; M; m+ R
    xchg    dx, es:[41h*4]2 P0 t/ |; k5 y# ^. f, X
    xchg    bx, es:[41h*4+2]
8 m" |! R- S3 H9 o/ ~    in      al, 40h# o: E/ b/ {+ K
    xor     cx,cx
* |% |; u, v. V  n    int     41h2 `0 Q) }- h5 t* _1 E$ x
    xchg    dx, es:[41h*4]
) L. o" s6 J! Y2 }8 z    xchg    bx, es:[41h*4+2]
$ @9 R! I! \( K  R9 R. T/ D) P( ]    cmp     cl,al
7 o$ O+ e5 k% _# X6 ~    jnz     SoftICE_detected
% l& W  f; A0 T6 M* E+ K; Q
' }  |& p; x: C( @" ~_________________________________________________________________________7 w8 t- E2 [2 k2 |3 c
0 v+ ~+ O  y3 e( o
Method 078 z/ `) B: Q: e# `7 `9 }/ l6 Z
=========% b8 S: V5 @1 I# P- R0 o0 |

! N* g$ t6 V, w6 [# c; vMethod of detection of the WinICE handler in the int68h (V86)
6 z% `6 H$ p$ ?8 J$ ?  ~
# k& w- l% E2 e! H8 Z    mov     ah,43h
! ?3 x3 W" c( D: i    int     68h
- S; [0 ^6 _$ ]. q; |- U3 s    cmp     ax,0F386h) F/ w- j7 \+ u3 h0 h9 U* G( U6 R
    jz      SoftICE_Detected
5 N/ M  _. a3 O5 {" q8 {& O3 s" L' o  G' ^7 d: p+ H
3 H* S5 ~' w8 T& X9 @3 I; K* W
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
$ C0 L2 Z# l  t; T. Z3 |/ Q  F   app like this:
1 O$ ]0 x  p! }. S( _1 h- o# @! ~" m2 n0 M2 e
   BPX exec_int if ax==68
% v- C. j0 `5 C1 W  `" ^& H   (function called is located at byte ptr [ebp+1Dh] and client eip is
7 l% S' U( r7 W& Q; d   located at [ebp+48h] for 32Bit apps)& q0 A/ C* c. T& ~* I' M
__________________________________________________________________________
3 O: X: a9 K" m( r. L$ n* ~  K& Z, ?. h0 d* z3 j" K
5 Y1 I: G7 N4 p8 L8 B7 x8 {
Method 08- {/ M5 T5 ~8 B3 R6 R  O) A5 q) _+ E
=========+ G& {( Z/ |7 X& g) U$ _
2 {# C$ c3 J7 J% n
It is not a method of detection of SoftICE but a possibility to crash the
% h8 V* N9 P- q& C. g3 lsystem by intercepting int 01h and int 03h and redirecting them to another
7 H; Y2 M/ Z2 l( sroutine.
4 j" ?( h# k$ H  [- a. W$ oIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points5 l' N3 x3 J. ^! R/ y5 G0 |
to the new routine to execute (hangs computer...)
! t$ ?0 J+ j$ H. n" F/ X, l, F# J( H/ K* y8 ]$ t% w
    mov     ah, 25h
5 `5 N, t1 b2 _" T6 ~    mov     al, Int_Number (01h or 03h)- Z( J8 B# h1 f# F% Z7 ~  E& r1 ~
    mov     dx, offset New_Int_Routine0 k+ ^) X. E. y9 B- j& L' I" [3 |
    int     21h9 p/ N& b1 D3 I# |( T1 }
5 a) U! x; S6 {! U; f5 j
__________________________________________________________________________
) p$ z$ m' U. `1 ^$ |
, Z+ x8 k  P0 ?) s& u$ {Method 09
' Q* K2 D  V2 `; m: D=========
. G: o: G! w4 s. R3 j2 n1 H7 }5 I$ Y' O& {
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only, `7 C0 }7 l4 P+ X
performed in ring0 (VxD or a ring3 app using the VxdCall).
) j8 u7 L) I, E/ _4 f. ]. B* rThe Get_DDB service is used to determine whether or not a VxD is installed
6 Y( o3 _; y! p" w5 }for the specified device and returns a Device Description Block (in ecx) for, q4 g4 B" o6 p
that device if it is installed.
& P7 s0 i: M$ L* \8 t2 X+ W1 v+ m) B5 T/ f; A" ?4 y- [  B
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID8 H2 N3 p! K& {1 L0 Q
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)% T! J1 P6 j- V/ {
   VMMCall Get_DDB: U* m7 C3 s( h1 ]
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
5 x- c3 F# v  `' x7 a& A' I4 O4 G  \1 o( J" ?/ }9 C; g
Note as well that you can easily detect this method with SoftICE:
4 k( A8 ^8 ?' M* K1 `6 k: n   bpx Get_DDB if ax==0202 || ax==7a5fh6 }# {! {5 K& ?/ D/ U
0 m' w7 R. L% R
__________________________________________________________________________
, E# w1 {& j" ~/ z0 P6 j, s; `
% L7 P. X' r+ S! ?) Q7 dMethod 10
& P( {7 t5 o8 l1 S$ _0 E=========" |  G7 E7 r# ^1 b

* g: [! g: W) g=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
' Q( y  y/ m% p# ^& V( y) r% i  SoftICE while the option is enable!!1 O2 w5 a$ @& G+ U

! ]4 O3 ^; N/ j, R! UThis trick is very efficient:
$ ?+ t4 i9 z5 e! n* K1 b: [/ w7 uby checking the Debug Registers, you can detect if SoftICE is loaded& s% u" Q+ ?5 d! V
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
4 T( ~4 Y  f4 S! e& X7 Vthere are some memory breakpoints set (dr0 to dr3) simply by reading their
; S7 t! v  o+ l6 T5 N: evalue (in ring0 only). Values can be manipulated and or changed as well
, x; G7 L. }6 g; s(clearing BPMs for instance)
7 w8 C( k2 X& {
1 A2 Z1 n/ `& k: v2 w/ m__________________________________________________________________________
$ l: x7 J( `% `( X7 l; _& f
$ l7 J0 M+ p- @- l' l' LMethod 11" h6 o% D0 e; b& u* q
=========
* k9 m) _" ^' t$ J% f5 J; q' D
0 O3 B9 B' \9 x* r- ]This method is most known as 'MeltICE' because it has been freely distributed
4 F- |: N( b9 i% j6 @via www.winfiles.com. However it was first used by NuMega people to allow
8 g5 C% O: J9 [2 G' l5 a- mSymbol Loader to check if SoftICE was active or not (the code is located
0 i* _: n! \  F! n. S' Ninside nmtrans.dll).
9 B2 l% x) N" C: D7 k7 [2 B, D* y5 D) j+ T
The way it works is very simple:
0 A1 R5 ?- B, }& x+ v3 x% aIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for7 i* ]/ i4 n  A* |3 J; v0 ]
WinNT) with the CreateFileA API.. |) S! I4 ?( D1 c1 V
# K" B% |+ h) z  w2 _
Here is a sample (checking for 'SICE'):
* `7 t+ q7 T. h  A" x4 [  W' ^. V6 D5 Z5 @
BOOL IsSoftIce95Loaded()% D4 H$ f1 M$ g! j$ F- I
{
" e$ [9 ?6 k# O1 f! m# z% R' z* R   HANDLE hFile;  & ?8 t3 ~4 H5 j% B& U# F' ^) @+ D
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,. `6 n: ]" I9 N; Q1 w% W. p
                      FILE_SHARE_READ | FILE_SHARE_WRITE,( V9 r& z" i3 T& C2 R
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
3 u( h: \- X2 W   if( hFile != INVALID_HANDLE_VALUE )
; X& a: k+ @7 C' b% {, S0 f   {' O  z% |0 D: s
      CloseHandle(hFile);
$ Y; A) X# Q" W8 \8 r      return TRUE;: z  Z7 Q$ Z" t; b7 o$ Z0 t
   }1 O8 X9 ~- F5 a$ W
   return FALSE;. p2 E8 b9 d- v  v5 {
}$ i, b/ l# _5 x1 [

$ ]8 P4 c0 k+ I0 Y+ S' C: |Although this trick calls the CreateFileA function, don't even expect to be2 y4 ^2 ]3 W# L. I( K
able to intercept it by installing a IFS hook: it will not work, no way!
9 @# [* G. V  @; j* k4 z7 xIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
, a( ^9 h9 l; U1 Y' L: C" hservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
5 V" N# [! A4 Cand then browse the DDB list until it find the VxD and its DDB_Control_Proc
- U. L4 |9 v+ M* o  p$ Dfield.$ t' k& n- x( y8 [4 y' z# V
In fact, its purpose is not to load/unload VxDs but only to send a
6 _; {& f6 ]+ KW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
& M7 g+ J- Q: @( p0 S& y" Zto the VxD Control_Dispatch proc (how the hell a shareware soft could try/ {; `6 h) T& o" o' d# F6 n( _
to load/unload a non-dynamically loadable driver such as SoftICE ;-).  y& Q* ~! f2 _2 A2 ?
If the VxD is loaded, it will always clear eax and the Carry flag to allow# R6 E8 Z( y: [2 k
its handle to be opened and then, will be detected./ Z* O' Q  J" ?0 M
You can check that simply by hooking Winice.exe control proc entry point
- I: l% Z( S9 W% w# C+ fwhile running MeltICE.
7 Y; X  X% Y6 ?5 ~2 z, @$ u
: E* Y7 q3 y/ _; ^1 i
8 b& b) `2 z) f4 s" }  00401067:  push      00402025    ; \\.\SICE
! |2 {9 F- B" ^4 O5 U( V8 L/ s  0040106C:  call      CreateFileA
4 f* [9 o- V( Y8 x  00401071:  cmp       eax,-001  g4 {& i. R& Z
  00401074:  je        00401091
( M, n' ]$ h" c1 L# [1 @* T9 k5 w% i2 n; c6 ?8 W6 Z
/ Z! E* c# r- A( R
There could be hundreds of BPX you could use to detect this trick.
8 r0 ?5 z9 [$ L  ?0 R6 l2 x-The most classical one is:
, j3 P7 A8 ?6 c2 x7 a+ g  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||' K4 z$ [- m: g8 h. b
    *(esp-&gt;4+4)=='NTIC'% V+ b/ k6 Z2 V; T; \9 N4 s' ~
6 U& }6 I: D, b: ]4 j5 i- [
-The most exotic ones (could be very slooooow :-(2 s' v  o' h+ g7 g% [
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
1 R" M/ D" z! v" x" S     ;will break 3 times :-(' a; j$ z8 ~- ~+ p4 R+ u
+ |, J* q- L# x3 w* j' T4 I
-or (a bit) faster:
! W/ K, b, v9 M0 A4 L( `   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
3 R2 Z1 J; B; O" B
5 K" l% S  J! S   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
( U8 u4 r5 {6 D( E) d     ;will break 3 times :-(
2 |8 s" Y& X' I2 k, j, @- `% T
6 Q. P( C' l- ~( `-Much faster:
" x' y$ F- f7 K) ~5 }+ E( P   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV': k" {. p/ }$ q& {
# J9 V) P  Q) B
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
% g( A6 R- d9 m0 _$ N% A; ~function to do the same job:
! o: v0 z+ q  H" N$ Y  `; K2 u6 q' }4 W$ ~6 X- b# F9 M
   push    00                        ; OF_READ% X. u( ]1 e# @( ~6 Q! S% m
   mov     eax,[00656634]            ; '\\.\SICE',0: W2 Z2 T9 r" M/ K) S" u8 H
   push    eax; q1 m3 c0 Q+ `- H
   call    KERNEL32!_lopen% U- e# k- {$ T. W
   inc     eax
8 c2 S( S$ h' C% Q$ r   jnz     00650589                  ; detected
$ ]5 s# T9 x: p  g8 _: D+ g   push    00                        ; OF_READ
4 c4 L- w  l) F2 u   mov     eax,[00656638]            ; '\\.\SICE'
# z/ R% n. K$ N6 Y   push    eax. [  B  N( y9 Q% x/ h
   call    KERNEL32!_lopen5 u+ Y+ n0 |( A- U
   inc     eax
' O1 {) Q% M* l   jz      006505ae                  ; not detected' F6 c$ Z7 ?0 `6 U9 h4 Z

; ?3 D4 C! H2 q8 v& Y, i1 j6 f6 b& I6 _) X- @8 I, f5 ?
__________________________________________________________________________
1 k% U& F: k) @; ~% W5 A# {9 _5 r. v7 r# x* n; f" h5 f
Method 122 u' u* e% R  i0 G/ y: l
=========
) O$ r8 q' Q' T1 X' ~$ Y
9 m" e) f4 X. oThis trick is similar to int41h/4fh Debugger installation check (code 05; J, ^' J- W1 m
&amp; 06) but very limited because it's only available for Win95/98 (not NT)
9 O+ Z9 t4 a+ k  o7 O! `  Bas it uses the VxDCall backdoor. This detection was found in Bleem Demo.& _, Z, {- ~5 N
1 N6 u" v. Y- x7 M
   push  0000004fh         ; function 4fh
+ ?) Q0 h! O3 \$ F3 I7 Q   push  002a002ah         ; high word specifies which VxD (VWIN32)" x  m' B+ L  {
                           ; low word specifies which service
1 P' d1 a, a' q9 R  a+ b: u                             (VWIN32_Int41Dispatch)6 U! x- g8 [/ s3 I
   call  Kernel32!ORD_001  ; VxdCall
  C0 Q3 |) r) w3 b# k, p+ l   cmp   ax, 0f386h        ; magic number returned by system debuggers
0 j0 a  K* R) i' E7 |   jz    SoftICE_detected, Q% ?6 e" J5 M

, B8 v, S  p: lHere again, several ways to detect it:
" P3 \2 a3 Q3 {, a! C7 C. s7 U4 h( t8 g
    BPINT 41 if ax==4f
- s( A2 }5 I# g) h/ L. D( U4 \: \
. @0 S; g( o. r$ l% p    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
4 r3 ~1 p! ?. f7 l) m
# B; p% E3 G; z1 `  T% p& ]! Z    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
: p/ {9 S$ R  b4 o9 t
! j9 s6 X' b! c2 L8 t7 G    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!8 D! b/ t$ \7 K2 M6 j! c  y

/ c% I- a; a# C__________________________________________________________________________
! H9 P: `  [+ h( c5 u( c) i
/ d% S2 {* q6 j( p/ `& nMethod 13
3 Z* R* C( j4 @1 W=========
; Y3 o3 {: ~% W& U, [* c1 ^( j, ?" W) _4 z
Not a real method of detection, but a good way to know if SoftICE is
% ?  F' {! X, l- j* y$ ~( ginstalled on a computer and to locate its installation directory.
; e' P+ X0 B6 jIt is used by few softs which access the following registry keys (usually #2) :0 d7 c# h2 L0 W3 D  W$ Q+ M, B

  Y, v7 x, I6 Z- U$ @9 T-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
) x: G2 @+ N4 l+ l1 p# y\Uninstall\SoftICE
4 N6 d( p- c1 c. O2 N) j9 G-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
7 N  l8 }6 \8 M( I5 a+ C-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
1 r4 w, O* s- L& w% `; U/ K/ ?\App Paths\Loader32.Exe  H. X) m& n. d; g5 o

/ N9 J; e/ `+ ?) ?7 _1 j7 q5 {' ^3 x0 x) @
9 t7 F' _1 W) S  g: NNote that some nasty apps could then erase all files from SoftICE directory
+ N9 L+ K, D3 M0 c5 y7 N1 ?(I faced that once :-(
8 e5 `/ v1 K) d$ W) I: S0 t& t, X) |1 }% X5 R
Useful breakpoint to detect it:
% t& y( v& ]8 O5 m2 h! n
' L' h/ ]  d2 p# b- Y1 |     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
; e0 S' x& l' m
, n( F9 |9 h6 b__________________________________________________________________________% V: F! Q% A  V) q9 Y

  [: @; q# j/ p+ h7 Y2 l4 l* j; U! h8 a& A/ D0 v$ ~
Method 14 $ ?' U8 h. R! y& T! B9 \# T
=========: a+ H5 a" \/ e1 f2 ^2 ^
' ], b1 J: A0 ^" ^$ P. K! R
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose  e1 p! v, |- s, ^
is to determines whether a debugger is running on your system (ring0 only).- m2 w5 |$ ~7 j" Z/ z

; G; J; X- r& V/ k8 r4 Z/ G   VMMCall Test_Debug_Installed) _' {1 P8 |* X) O( x  [
   je      not_installed+ V7 c# F) M! F' f- a5 i) v
8 @% @2 S$ C6 c7 K
This service just checks a flag.! B0 S1 D0 c7 n( I  T' q
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-7-22 01:33

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表