About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
7 z  u) v) ?/ U; X% i<TBODY>  o  Q! p3 J( v
<TR>& H: T6 N+ ~' F
<TD><PRE>Method 01
$ G. c! E3 {& y2 T5 O' t=========
( y4 m7 F2 r* V$ v1 S7 X( n# f3 V0 ^: ^
This method of detection of SoftICE (as well as the following one) is) L$ u% W0 X! |' e4 u/ G. R: _. j
used by the majority of packers/encryptors found on Internet.
9 D4 i2 J+ F. A, E% GIt seeks the signature of BoundsChecker in SoftICE
/ b6 i" E. ^! D+ ?' r: Y2 o& h
# [& r6 R0 H# ?9 H* b/ t    mov     ebp, 04243484Bh        ; 'BCHK'
- H4 |* @! A5 \    mov     ax, 04h8 B! z8 a: t+ ?2 E2 b9 h0 C
    int     3       & C; v* [# P' G2 s9 }
    cmp     al,4: [, B* h: @( _6 G8 D: R
    jnz     SoftICE_Detected) g' W8 }2 W( k% {! `

: r* M2 I* i, }% W3 n) f/ b___________________________________________________________________________
: d, U& h* j$ z" ]/ _* \! ^; g; F3 s' B2 a
Method 02
9 T5 M6 ~! {- K=========, e& ?' ?, h6 H' K

, X7 G* T5 G# QStill a method very much used (perhaps the most frequent one).  It is used
$ U. j- i; E  h' S6 Fto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
$ y: y" S  M* k# y. ]  ^or execute SoftICE commands.... d: D- y) n. r0 Y4 U
It is also used to crash SoftICE and to force it to execute any commands
5 O/ k, V& \3 y! B7 K9 a- v(HBOOT...) :-((  
, E+ ]; C) a0 r! ~8 b7 P5 ]: t
& y9 h* L# U" s1 p% ~1 `, h$ ZHere is a quick description:0 h: s8 R6 X5 @' T/ ]+ n; }9 Z
-AX = 0910h   (Display string in SIce windows)
- _; g6 z9 n" X& [0 h5 r-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
. R- w, _* {) _. G; r5 u3 [-AX = 0912h   (Get breakpoint infos). Z0 m2 q  e3 T( g2 ]9 ]
-AX = 0913h   (Set Sice breakpoints)9 u3 L' O' w, K2 q/ L% j
-AX = 0914h   (Remove SIce breakoints)
; {% M' j/ [4 _1 c0 Z
1 L5 N1 Q1 r4 h$ b" b' b6 REach time you'll meet this trick, you'll see:
4 Z( P0 Y8 @+ u+ w' u9 P( X-SI = 4647h
* [: j7 H: G1 x7 Q* c# ]-DI = 4A4Dh  X6 `  {& U; H/ u
Which are the 'magic values' used by SoftIce.
9 t8 \7 W" Z3 u3 c, G& l2 u- |: yFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
" h2 X1 Z" |1 w7 B' R8 f1 E- [/ D9 Z( O; _6 j
Here is one example from the file "Haspinst.exe" which is the dongle HASP6 n* a* S6 y5 D2 Y$ H% G
Envelope utility use to protect DOS applications:
' K/ B' x4 F8 n  l2 k
) {9 b$ Y& H: ^) ^% Z3 i
( I! P& K0 [4 d+ S( h! f4C19:0095   MOV    AX,0911  ; execute command.5 g% D2 z& [6 I2 c- l. E1 @# y
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
& X, z; z6 q) v! u8 J4C19:009A   MOV    SI,4647  ; 1st magic value.
5 C  @7 J1 c+ H  M+ \6 G4C19:009D   MOV    DI,4A4D  ; 2nd magic value., u, ?( Y+ H7 q# \
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
* `* z; G3 F8 y. E0 C2 s0 A. k; u4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute" a+ y6 m: l8 ?2 Y9 j; N) c
4C19:00A4   INC    CX
' w5 Q6 X+ @- N& D& d* {4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
7 f& q& ~1 P' L# O. {" u% ~- K  l: p9 ^4C19:00A8   JB     0095     ; 6 different commands.
- d4 j- w) n  M5 q4C19:00AA   JMP    0002     ; Bad_Guy jmp back.; ~1 [: p$ O2 n% d
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
( L0 M- a3 M# S% ~7 p% B$ L5 t
7 V; Y& C4 C4 e' d0 `9 t- z+ R: b5 `+ U4 _The program will execute 6 different SIce commands located at ds:dx, which  V5 ?) a& z% @1 y, @
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.  }' S4 t0 A+ }+ D' k# H1 c

: d$ Z2 d+ F8 ]2 D5 ]. Y3 o6 L* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
+ S3 `0 |. [4 s- M# j+ z___________________________________________________________________________, A. ^, f3 p2 C' Q! @( A+ F- O
1 o3 J2 P$ I' ?6 F& _
1 @4 g. C7 \! l( `$ H: `; d
Method 034 y; A- K; ]6 o1 T. g
=========& i, N! {8 h7 W8 F: X! Y

5 g9 {- B1 ~' l+ V2 rLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
2 C+ r/ y: A0 i7 g' n4 W9 A(API Get entry point)
8 ~. W" Q& H9 I        % M1 U  V! g8 G3 D7 i
3 l* f1 H( K2 P5 a
    xor     di,di
8 E  T0 |& j/ G' K4 F# H    mov     es,di
- k' S2 p6 |( _4 q) J  A  W    mov     ax, 1684h      
- J  `8 x1 f  ^$ D    mov     bx, 0202h       ; VxD ID of winice
* W8 k* C: d8 @, a9 ]4 q) c; R6 u    int     2Fh
* }+ O4 r: }9 l' f+ x0 }    mov     ax, es          ; ES:DI -&gt; VxD API entry point/ H9 }2 g3 f6 g( {5 |3 ]& g8 x
    add     ax, di3 L( |. e  I6 _1 M' t
    test    ax,ax
, `- M( K8 n- B8 C' {    jnz     SoftICE_Detected- t; S& N( `) t7 y2 j7 _# R
* P, d( M4 V" z
___________________________________________________________________________
# Y# Y/ [4 a7 [8 R7 w* r  g. q5 P! z" O7 l' `
Method 04( F/ {* Y# u4 d" ?) _$ v& a$ D  L- `
=========" E! o8 o+ S8 `3 _% @! G7 ]

/ k. o; [2 i% P7 xMethod identical to the preceding one except that it seeks the ID of SoftICE0 `( t5 @/ `! A4 x# B# @
GFX VxD.
# y4 o9 D2 M7 V  ]
  y4 K$ U  v  T" m$ ~5 _$ ?1 V. v    xor     di,di4 B# S" K, _7 ]% `5 H) |
    mov     es,di
/ L/ `1 v' Z4 A" n- x1 Z    mov     ax, 1684h      
# `: U/ k$ Y! N, n8 V    mov     bx, 7a5Fh       ; VxD ID of SIWVID& [# U% Z9 [, [, g; ^; Z& a
    int     2fh
& W1 w  b. T! t% i$ r( G    mov     ax, es          ; ES:DI -&gt; VxD API entry point
  y5 U; d+ n8 R& h    add     ax, di
- L$ V: }- I2 g( n$ {! c    test    ax,ax
+ t8 E" q1 k$ P6 }5 s" _    jnz     SoftICE_Detected7 U0 ^/ N, s' g. E" f4 r: Q$ t
* q3 b, T9 o% y. g
__________________________________________________________________________
  w, P0 k$ d. V# |7 m
- ?( X" w4 ]+ Z; F9 L2 ]6 [
2 J. U* y7 `6 {: GMethod 05
' x6 z, M, [+ C0 Z& u% T+ J=========" P2 L' P& [- P" C3 f

+ a% |. @% y! _% H6 W" ^) zMethod seeking the 'magic number' 0F386h returned (in ax) by all system4 d9 c& T% q  A! Y! j- m8 S' P
debugger. It calls the int 41h, function 4Fh.
; N& [* F! w' ~7 I' bThere are several alternatives.  
$ |7 b( N2 @* V( [; L4 e$ a; H- L1 ?' a+ _" }) J) m  }) p& X
The following one is the simplest:7 D* w- Z( w, w( \5 j! B1 F
& E9 t$ `: W1 d; E2 g8 `0 V0 o
    mov     ax,4fh
9 ^5 X' `. g+ y( N' m3 R1 Q    int     41h9 T/ G- h# z) J- K* V
    cmp     ax, 0F386" Z) Y0 Z, w5 k& w+ S7 x+ M
    jz      SoftICE_detected: s3 \, ~' P" V$ p* n& r; S; T
' Q1 `' X$ R6 X3 Z- U0 G5 _0 {
( ]/ D# X1 o5 L8 _) L7 g) P
Next method as well as the following one are 2 examples from Stone's 3 @3 ?2 _( q6 m/ B8 \4 {
"stn-wid.zip" (www.cracking.net):7 t" M8 Q" r- T' n! O! V1 L- f/ }

" q3 q2 W9 q$ |* x+ u. {1 s    mov     bx, cs
0 G2 y; }0 t4 {  B! Y% t; {% \    lea     dx, int41handler2
4 X+ h" g' b9 s3 j; u    xchg    dx, es:[41h*4]
2 n; `3 |$ }8 U: R# U* W    xchg    bx, es:[41h*4+2]
6 D& K9 s6 K  T& c4 F; Y' D    mov     ax,4fh4 g4 C& E. n, l4 B1 T
    int     41h& j0 ?$ v' l6 l( N
    xchg    dx, es:[41h*4]& c  K: L/ @0 e6 N& r' n4 ^
    xchg    bx, es:[41h*4+2]
. W: U; p8 E0 ~2 s4 v# {9 u    cmp     ax, 0f386h7 ], C6 [# h' L  p
    jz      SoftICE_detected0 [4 G) j, V2 [; a/ n; I
* T: ]5 z7 n6 |# q7 }9 c' S" b% n
int41handler2 PROC8 U; Q& E/ w  X% l$ K
    iret/ o: E% j# b4 D
int41handler2 ENDP1 S. z6 [  O9 K' b
. \, L) h# U  s# S+ L! J$ T

# q% I, U3 U9 q1 x. F3 j_________________________________________________________________________0 P, p* E- A! f+ G0 ~+ K; W* D* B, f
( S6 b" e$ X% w2 ]( A
( k/ R! R% d3 M: P0 I! L
Method 06" d8 K% ~! Z4 i' p
=========
0 V5 A/ N* g8 B8 `0 f" Y1 ?2 T& I
# K1 U; g( C6 K1 a) `; H  }
" i* H8 n. V. s" Y. i" k' g/ m2nd method similar to the preceding one but more difficult to detect:0 C  x6 a4 B% `. |  p! n6 j+ {1 z
. I9 M! f3 x' w6 I3 I+ I8 e
$ v; N4 p! }! g+ N: L
int41handler PROC1 m% w$ d, N7 h9 N2 g
    mov     cl,al
9 |  T$ u/ [; {6 m, \4 `5 Y    iret
. U4 g9 t  q# `) {" [4 S2 qint41handler ENDP
; K3 A- @0 S( d+ W+ O5 j, r4 N, r4 O* y7 T0 n9 E3 Z
. g4 t6 h! P3 k( `, g
    xor     ax,ax9 N' _6 v* N. [5 q" D& X6 R
    mov     es,ax
! v6 b' b. w3 l! X    mov     bx, cs
8 P* [" V: Y2 v% r    lea     dx, int41handler" C4 n; d" q' j, q7 R8 z
    xchg    dx, es:[41h*4]
  J$ c- k: b: @: F( c8 b' w    xchg    bx, es:[41h*4+2]
9 w! B% e: `$ `    in      al, 40h5 _  k* b; ]2 C( l
    xor     cx,cx
" E# j" o: n2 |7 M1 q! A    int     41h
6 K/ F# a, r2 P' |* L* I5 ]    xchg    dx, es:[41h*4]
, B% A4 q+ R9 `6 \) f6 C    xchg    bx, es:[41h*4+2]8 q9 [$ `! C9 I, l- L4 c; ~" G2 D
    cmp     cl,al
8 b& U: J7 f! [' B  X7 \    jnz     SoftICE_detected
. P' R1 {& s" X& b; U
9 c8 s, d2 s; y- ?) n# r' d  B_________________________________________________________________________# u6 M* z' G# f5 O

/ ]% K* a  I- `Method 07" u7 H; U' I. k& p+ s4 Y5 V2 K) Q
=========! A5 V: s# f8 h4 G, @6 N8 ?5 D

  b5 F/ G% X2 q/ {7 a9 _Method of detection of the WinICE handler in the int68h (V86)2 D2 M& y% N0 c! R# v

7 d" [9 M1 j* _! o# E. @! ]4 Z    mov     ah,43h
( G2 r% H1 p0 z, X" O- z$ V    int     68h' r2 H% w2 s3 p$ G$ n3 f( N$ i
    cmp     ax,0F386h
& L( w0 X" ?. Y& e: L& j- \    jz      SoftICE_Detected
& _5 _' q: B$ t) \& q8 S' w0 ^+ H6 |

5 Q; J8 K+ W  i. V7 ~=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit$ F+ L$ ]5 e! w, Q1 P% V
   app like this:1 ~$ e5 d; w5 t# G7 g' R8 z& n

% L0 [( d1 x; ]; C8 y5 W   BPX exec_int if ax==684 h+ k9 r* t$ F2 [% R/ A( P! p
   (function called is located at byte ptr [ebp+1Dh] and client eip is
8 M6 \) H5 ?! y/ q! Y, @2 r- n0 \   located at [ebp+48h] for 32Bit apps)
- ~; {3 ]" k+ G( w7 T! L$ o__________________________________________________________________________
) w8 W" M! t4 U. z9 j5 d* g8 h
" m' c' u+ O9 S5 Q  h2 e
Method 08, G# G6 T2 |" B) P- {$ D
=========2 k/ L& X. F% D! ]! {

" O$ ]1 G" J# }6 r( J9 w3 nIt is not a method of detection of SoftICE but a possibility to crash the# p' i, X4 l9 u( j: r, X# s- h0 }
system by intercepting int 01h and int 03h and redirecting them to another
2 \- E" p) |' A( v$ croutine.( C" z9 g4 d# {1 q" T9 ^
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
; F$ Z% a) u$ C2 F5 P2 _to the new routine to execute (hangs computer...)
% w" c6 Y& Q7 p
/ ^% Q; I5 ]5 H# a$ F    mov     ah, 25h3 _2 x0 I1 p# K) T& s
    mov     al, Int_Number (01h or 03h)( F# R& u# l1 V; V" }+ D
    mov     dx, offset New_Int_Routine( k2 G. S% p9 N7 y
    int     21h
2 V/ r" P. i8 D+ `! a
8 X# L/ k; l: ?$ W$ L4 U. Q4 K__________________________________________________________________________
' a' g$ e& \2 c4 S9 C3 a
6 l4 H2 h8 X2 c& a8 k0 ~Method 090 S& ?- H' Y! X. K& E; o
=========3 z) \7 R* O6 B$ o
- G' d6 f" i2 C7 U. S6 F
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only. H7 Q" l6 S2 j, Z  W! b8 [1 d3 t
performed in ring0 (VxD or a ring3 app using the VxdCall).
# z7 n* c5 X, W9 aThe Get_DDB service is used to determine whether or not a VxD is installed
# z: \) }# q$ m, R/ @/ K# Sfor the specified device and returns a Device Description Block (in ecx) for
+ f* B6 D" c* j: p! }that device if it is installed.
; {: J* B+ X3 F8 b% J! {5 `9 {9 F9 d) ^
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID$ }( H: k) T+ [
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
+ `# V" Z8 M. f4 v   VMMCall Get_DDB4 O# w6 A6 _1 X2 w
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
, P* a& H; ]* f5 \' i% t: ^
7 h: v5 X4 ?$ SNote as well that you can easily detect this method with SoftICE:
3 x* C. T4 N; |% m- D   bpx Get_DDB if ax==0202 || ax==7a5fh4 x* Z% f2 i" e! w
9 q9 M/ E! r# F: ]
__________________________________________________________________________; k6 A: |  r  [& n

7 ^) S1 F5 R" l$ y( UMethod 10
' V; A/ I/ j1 c6 o& a2 O: u7 o! }=========" f  h* k1 w  y& f4 |2 b0 K
9 r# F' [4 a* S# u
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with' [4 b4 @7 s" F! J% l
  SoftICE while the option is enable!!
8 y4 V7 Z. K* O, p$ `) t' a
1 x  {) [+ |: B( M$ ]7 X8 ^1 t4 y. X: MThis trick is very efficient:
7 {# l: y2 Q3 q& H, S- Bby checking the Debug Registers, you can detect if SoftICE is loaded
" S4 U2 W* v9 m; |1 ?. x! K( a(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
" D+ b& M. S5 C, r. O9 Fthere are some memory breakpoints set (dr0 to dr3) simply by reading their, R6 H* I2 ?* X" w2 r2 P
value (in ring0 only). Values can be manipulated and or changed as well8 i3 a( {: [+ s. a9 K
(clearing BPMs for instance)' X' \! @8 g+ R6 {8 _. ?

- M. T' J" h0 O% T1 B1 H__________________________________________________________________________) y1 S' W1 j+ s" w6 Y" j0 d# k

. i2 p: \7 A5 \. u) fMethod 11. r% ?, L9 {5 Z1 v) ]
=========/ U. q1 K7 u( [& N5 ]% b. l4 c0 Q
0 z8 B& Z& C6 q" e) I. n, _, t5 m
This method is most known as 'MeltICE' because it has been freely distributed) x8 q$ \! W5 \3 [. T
via www.winfiles.com. However it was first used by NuMega people to allow
4 j" N6 ?" ?: MSymbol Loader to check if SoftICE was active or not (the code is located
8 M6 N. V% _- O6 N" i$ C! e0 Binside nmtrans.dll).' W* C; Q, B& H5 |
& L, j4 K8 c  E( x4 n* a
The way it works is very simple:
5 K% c$ W- z9 A, HIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
; ^& B+ }( U& s, Z6 @* |WinNT) with the CreateFileA API.4 e2 n6 ?& Z. m& l; X7 [

$ j, L8 |  N9 ~) X$ S! M& @; ]$ \Here is a sample (checking for 'SICE'):
& B/ y1 \: `9 K  L6 ?) a5 A- K: B. n
BOOL IsSoftIce95Loaded()
! M& @$ ?7 R) Y) h{; z; N  o! J- v3 Z6 Q0 o- s
   HANDLE hFile;  
- B  I7 Q9 I8 R# D  O7 G   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,3 A, G* R4 S0 R* H7 \
                      FILE_SHARE_READ | FILE_SHARE_WRITE,$ y  v; w) E+ x
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
% R3 w$ t" i' v  l! ?- U   if( hFile != INVALID_HANDLE_VALUE )' d) u- g1 p+ A0 z0 _/ U/ `7 _, Y8 ^
   {9 U8 {  W- G8 o- g. p
      CloseHandle(hFile);4 l" v: m2 Q$ E/ N1 F
      return TRUE;
  {  _+ R  n% ~0 V3 ]( y   }4 Y- i* H- Z3 g, \$ f- F+ F
   return FALSE;
' G6 p! w! r1 k( y0 U7 r}5 @/ E  i- C1 {  i8 H
! l% y- j9 A7 I. ]
Although this trick calls the CreateFileA function, don't even expect to be
; b! b/ E& N. J- @  Vable to intercept it by installing a IFS hook: it will not work, no way!
% P3 ?+ I! F, t: M+ l. LIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
# Z3 Z% @* b! j2 wservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
" }: v0 \5 L# T' K: |6 Qand then browse the DDB list until it find the VxD and its DDB_Control_Proc
' {# M7 E6 C1 C: B4 R# Qfield.$ N7 Q# G  X. V7 |$ j& z8 T: Z. z) r
In fact, its purpose is not to load/unload VxDs but only to send a ) H9 [+ H; s6 L$ ~- H# J
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
0 r" t) ^6 c) J' Y" G; Jto the VxD Control_Dispatch proc (how the hell a shareware soft could try/ g9 E$ n8 X0 V; q9 g
to load/unload a non-dynamically loadable driver such as SoftICE ;-).# W: L7 }4 ]- |
If the VxD is loaded, it will always clear eax and the Carry flag to allow; K& S# ]1 B+ e* }6 j, I
its handle to be opened and then, will be detected.
9 I% _3 K, q/ f! ], z9 ~) xYou can check that simply by hooking Winice.exe control proc entry point
, [2 ~# f: T, Nwhile running MeltICE.
* u/ b& X* H& |1 p3 y' Y7 H# h

9 x: ~5 l7 l# B/ w  00401067:  push      00402025    ; \\.\SICE0 G3 j# a! E# H" s* w
  0040106C:  call      CreateFileA* g1 E0 C6 c5 h7 S9 B, z; E
  00401071:  cmp       eax,-0016 j4 f( F% t/ Z3 Z8 Z# ~0 X
  00401074:  je        00401091
! k  Z/ Q  I5 ^, u  @2 |9 B+ I3 Y, U' P1 Z4 E% z
- A: t! b& {$ g- X4 l+ T6 O
There could be hundreds of BPX you could use to detect this trick." o9 M, n/ }3 T/ x! p, p& A
-The most classical one is:# L6 T/ f7 b2 @8 B' ?
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
, \6 m# @' n$ W' g2 d4 S. Y' e3 W    *(esp-&gt;4+4)=='NTIC'
0 F+ C: Z7 q+ E; i! s4 U
6 ^) @$ q2 |4 Y0 N-The most exotic ones (could be very slooooow :-($ Z) L) c' ?) P: y1 F
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')    ?. \( i' g' b$ k% U& i
     ;will break 3 times :-(  W9 p3 s7 }# N8 p' P: R

1 ]& z2 u, \& J-or (a bit) faster: - c$ T& }! r2 C' x7 M
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')' x8 x- e  q- f' T. j

9 Z: @4 q" D; F   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  1 d2 k1 e# |( ~% S+ [( e7 T" h
     ;will break 3 times :-(
+ \  }/ R4 i, T
  H( k/ k" r. c$ U9 C  X-Much faster:
; M6 C3 n! I1 s& h   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
" S# P8 U' {* Z7 a4 r
5 `% h8 u% u: iNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
+ x* X. a5 k5 F6 Z, [8 \function to do the same job:
5 K2 [( }2 K' A/ C  i* e+ V' `" J" C$ z# H: ^" ~
   push    00                        ; OF_READ6 V8 K& x7 e) c2 t% a" f/ j
   mov     eax,[00656634]            ; '\\.\SICE',0
1 Y, E7 M' ?3 N( @+ `  b# E" ^   push    eax1 J. O) H) g1 G; ^* O
   call    KERNEL32!_lopen
6 M* Y: V% _0 K   inc     eax5 h) C( G3 `- ^) y! A) I, z4 S6 C
   jnz     00650589                  ; detected* f+ l4 Y  J( L0 A7 |' |' {
   push    00                        ; OF_READ/ b1 e& E/ h  S  f2 X4 ^5 v9 ?
   mov     eax,[00656638]            ; '\\.\SICE'
+ H* t4 g) p% y+ _9 m   push    eax
* q) u7 h  y8 F% J  d8 }8 A. m: M) c1 S   call    KERNEL32!_lopen
& _# g- V4 k- b: _   inc     eax
, `5 O" C7 z, z' c  z$ f   jz      006505ae                  ; not detected& O, S: }! s. L% I. @

! W! |2 X( X9 J! i7 N% \5 o3 u3 }8 ~
__________________________________________________________________________
1 w- \8 x9 W) U6 j1 ~. A: h9 y3 b& \! H& ]0 S6 x  I
Method 12
2 I$ A6 W& h8 M7 W" s5 M. \7 B=========
8 z+ t. \) H4 c3 o' T
! r4 k4 E1 p7 U$ z0 O: s" gThis trick is similar to int41h/4fh Debugger installation check (code 05/ t# ~! W: X7 A1 j! U
&amp; 06) but very limited because it's only available for Win95/98 (not NT)6 v/ Y. n  S' f! s4 ]& X2 j
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.3 j9 x0 L( }6 o; @/ p8 g  z  o

! |" t# r! K$ l* Q$ L/ l   push  0000004fh         ; function 4fh+ K: W: e4 Y: A4 k
   push  002a002ah         ; high word specifies which VxD (VWIN32)& b( v- u% r1 w8 W
                           ; low word specifies which service7 }5 V2 K. @( N4 I4 y
                             (VWIN32_Int41Dispatch)/ t4 |! G3 K+ Q% B
   call  Kernel32!ORD_001  ; VxdCall# t/ ?6 r+ X! [
   cmp   ax, 0f386h        ; magic number returned by system debuggers
+ f# e9 h4 |3 U6 ^" E" \; z   jz    SoftICE_detected' |9 R. O  S6 n& v2 q

( U3 b4 |$ \' p1 JHere again, several ways to detect it:
6 y+ A& {% s  `% d' f; {/ |& a6 `& {& f
    BPINT 41 if ax==4f3 M8 R$ h, S8 I- e& o' J5 h# O# R
6 Q* W9 x" L. d) O5 f) N3 U
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one' S3 x6 E) {) X% b: V9 B7 Y) ^. S; g
6 [$ y* w4 q  ^9 o" {3 P
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
3 Y8 ]+ y+ w' b  _# E: G- b) G: i, T& _! M; _2 Q# h& [" Z
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!' h2 y" P! U! \: I
/ M. @6 l0 N. O0 b% b# `* M
__________________________________________________________________________
: Q5 c0 t. ^' J" B
/ h  m  n5 Q' [# k5 |' e9 ?- H% vMethod 136 R6 b/ u6 P0 z' c
=========
+ O$ T! W8 U3 V
- v0 h1 Y) F1 q* C  ]Not a real method of detection, but a good way to know if SoftICE is
0 r& E  ^/ b; \installed on a computer and to locate its installation directory.
5 E* j9 c8 p1 h0 lIt is used by few softs which access the following registry keys (usually #2) :$ C: V9 q) e1 v6 m0 o
$ t# o6 w8 k2 O% j! x# j
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion$ j' T! r; \( r0 d* j
\Uninstall\SoftICE: |$ D: z9 d; @, g
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
" T7 A* G7 c6 f) |" y$ o-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
/ U1 _! }5 q0 _* n( u  |: @1 B- V\App Paths\Loader32.Exe) I. \: U! `, v+ ]+ G9 E

5 c* |$ B! m. x' X( h" y1 J+ a# E( m* [/ }+ y" L3 h
Note that some nasty apps could then erase all files from SoftICE directory6 ~, d: o1 d7 O; }
(I faced that once :-(9 T+ _$ V( B$ h% Y2 z. s

( A5 x* \2 I; x- h* T( \Useful breakpoint to detect it:4 n0 J$ V# J* l- r( b5 ^! p. {
2 J+ e: o7 Q5 ]7 R
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
# h( T, o2 E$ V  ~& k' N3 d6 w+ T8 G4 Q' |
__________________________________________________________________________# k. v; ^  w* s' p  X& r6 ^% D
  j4 ^! q7 [: A( d# N
( ^1 L; w8 p: H, d
Method 14 6 B2 H8 i  q1 b# z
=========$ a% M) f) y0 k8 o* G

( w2 B" u# i+ I# IA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
( T5 m1 X8 ?( f& g* Kis to determines whether a debugger is running on your system (ring0 only).- X; d  O7 t& A/ Q1 W
! f+ ^' C( ]3 B4 c! [
   VMMCall Test_Debug_Installed' Y5 [5 T5 ]3 E: N4 K. U5 @
   je      not_installed
/ R5 ?9 t( f, q! T& ^" }3 A0 A% D+ u0 H# `) J" v8 N; T
This service just checks a flag.
" i" Q$ A' W5 {4 ]. L5 ^& h' _</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部