About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>; b" _! T- d- h
<TBODY>
. f) t3 {7 I  R6 ]$ @3 [& ?; d<TR>
0 K3 r4 l% ], b7 ~1 X6 s. p<TD><PRE>Method 01
' ~8 O) C1 L- Z" n=========
- [8 P. q  W+ s, m- |9 o6 E8 r. e- d; v5 j
This method of detection of SoftICE (as well as the following one) is
* x4 }( J- u, ?  W0 `* cused by the majority of packers/encryptors found on Internet.
& r& |) P, g) k' f9 V$ RIt seeks the signature of BoundsChecker in SoftICE! J$ s+ C9 M3 |* g+ k5 E: S

6 B8 [6 J6 ^$ x; A    mov     ebp, 04243484Bh        ; 'BCHK'
% p$ S! R$ s; I) m& ^9 E    mov     ax, 04h
3 q0 }& t/ r5 R- I) J& g    int     3      
$ o5 b2 O5 T  E  U    cmp     al,4& z$ f0 ~6 w/ X& q  U7 {
    jnz     SoftICE_Detected
4 v. C4 G4 s& i5 B/ A! e) |+ o& L( ^# F7 g, I( J- F
___________________________________________________________________________  ~: \# x/ R6 h
" o. g& J7 M; `* P" c. P
Method 02& p+ z& a  g7 P9 y
=========
7 ^5 H5 z8 U6 |0 e, A! e( g. m, ?, k7 Q) v% {7 K, X% o, k8 i
Still a method very much used (perhaps the most frequent one).  It is used
! Y* j4 N  G1 S( Gto get SoftICE 'Back Door commands' which gives infos on Breakpoints,. p* h% R2 @: b! \
or execute SoftICE commands...
1 `( \/ G7 U2 N3 T' KIt is also used to crash SoftICE and to force it to execute any commands
0 U/ l% i6 P+ |(HBOOT...) :-((  2 O5 \# k$ ^' N+ I7 Z  M

* s, N6 K. q6 u8 cHere is a quick description:+ `  X+ o, f2 l% |
-AX = 0910h   (Display string in SIce windows)
0 E; x' c5 ~  t3 d+ E-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
: d/ r# v1 G* N% @-AX = 0912h   (Get breakpoint infos)
, O/ \! Q0 ?, U8 \% y-AX = 0913h   (Set Sice breakpoints)) {- {% r9 ~' ]# L) g" r
-AX = 0914h   (Remove SIce breakoints)
/ C! s7 ?% I7 ~; N9 D. j0 s* c# e/ \3 {' F3 C1 p) ~" W
Each time you'll meet this trick, you'll see:
0 u* m9 ]2 j4 q' m! x) q' g-SI = 4647h1 z/ ^$ W" \6 N$ A
-DI = 4A4Dh! E( w! R- N  X
Which are the 'magic values' used by SoftIce.
: G* D- @& O2 l& ?! yFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
4 e' \1 y3 W8 ^+ X* l, l
( x5 P0 [+ k) m5 D) A- T! r6 ?Here is one example from the file "Haspinst.exe" which is the dongle HASP6 ~" F9 H% D1 X
Envelope utility use to protect DOS applications:
) `/ ?8 O+ g3 T& i; x. s6 ~9 B- a) P$ D* R7 v# X3 |. i& {' E
% d# X1 }) y4 p9 D. q" U# B/ v
4C19:0095   MOV    AX,0911  ; execute command.
0 B- R- n$ J8 Q4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
  R- K* }# r- t2 Z' V; ]4C19:009A   MOV    SI,4647  ; 1st magic value.0 M: [9 J4 I  A( I- B
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
  d+ p4 B1 G, `7 Y- h' e/ o! y- W4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
, L5 n( I& v0 ]& t/ Y' n4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
/ W" n, R% u) g7 O1 R" n4C19:00A4   INC    CX' v: i7 J! P5 N- \, E) T8 w
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
. n; z8 k+ ]1 k! S- x# `/ }* \8 h4C19:00A8   JB     0095     ; 6 different commands.9 x- T% @; u# b
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.5 [  L( y2 i0 f) ]3 A
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
, |1 g6 ]0 V& i' ~# F& d
1 y+ `( H! P/ U& g* P% f& vThe program will execute 6 different SIce commands located at ds:dx, which7 U$ p  L) z% u+ M+ e
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.6 b, @6 j# Y& @* f

/ t+ C+ D9 w, ~/ ]1 u* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
/ o  b/ @* j$ u5 |4 K  e___________________________________________________________________________
- Y) z3 J  x; H; n. r' H& t8 p8 |+ q. N

  {2 g* S- O; i1 d; QMethod 037 R" u+ ]3 `/ z; L
=========9 A$ Y' G3 a5 J; w! ^
! n# e  p: \8 X
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
9 G  S' L# P$ K  }& j# Q  f- d(API Get entry point)% N+ L, w- V4 n3 H6 O( W( G
        
/ @6 L$ I+ L% n. s5 ~: q# ^4 G$ u3 J+ u
    xor     di,di
! {. q4 }( Z$ B; d) z    mov     es,di
1 c9 F5 A' m. v& j; t- l    mov     ax, 1684h       + v2 O2 w* b$ q0 ~, E
    mov     bx, 0202h       ; VxD ID of winice( n( L  P$ h# P+ |& ]
    int     2Fh
4 w# ]7 O0 z4 O/ ~3 p    mov     ax, es          ; ES:DI -&gt; VxD API entry point' h* a4 S& h% v4 y6 P( Z
    add     ax, di
0 ^* t/ t% B' |# I4 R  A, a: Y2 ]1 B    test    ax,ax9 x( p: T) e- ^7 k- w  a+ Q. T1 }
    jnz     SoftICE_Detected
) [# E- A$ g2 D. E6 a
! R& X- F. @" P! Q2 g6 {5 o___________________________________________________________________________
+ E9 k, s/ x6 |: x- F, g# ]; |0 Q/ K  U) O1 {7 }& }" W% J6 T+ W
Method 04/ P0 g8 P+ q9 R
=========
4 ]# G- P6 h0 c/ C! \/ |! Q
2 D" P! i* V: }# UMethod identical to the preceding one except that it seeks the ID of SoftICE8 d7 G1 J) w  y6 S5 z( g& ?
GFX VxD.
! `8 k- V/ S; K! J' [4 c
7 ?" K4 i+ f- S9 \- _4 l    xor     di,di
& V7 |0 B% R( |# F7 M% |9 L  Y  |    mov     es,di
5 p2 ]. w$ y) b. X! ~; q+ B6 z    mov     ax, 1684h      
' [( e. M# G6 T8 E+ h: ~4 m  k4 d8 w    mov     bx, 7a5Fh       ; VxD ID of SIWVID
! }' R( ?. }# t2 g8 b, L) X! K    int     2fh
! v4 d/ l- O! V' O" s    mov     ax, es          ; ES:DI -&gt; VxD API entry point, H% l9 y. \2 l4 V
    add     ax, di  [: r7 x. O$ P9 u" a
    test    ax,ax
  d7 }7 F! |# \% C    jnz     SoftICE_Detected
0 w7 @0 B8 l9 O  Q" M( R3 g9 r! y: e3 ]9 l
__________________________________________________________________________
; K6 ^: j  |6 |. _) ^4 b6 \- s) m( j# b- S
( ~. n! p" |' R& ^5 x
Method 05( e0 H" q8 Q- f; I
=========* X2 y- r( m6 o/ F# h+ b

1 s  p; ?. I( c  ^' l& eMethod seeking the 'magic number' 0F386h returned (in ax) by all system
. G. D& Z  {! {$ `7 M( Z+ z) x- i1 g2 Udebugger. It calls the int 41h, function 4Fh.+ q9 Q- o" j# h  n0 V2 ]) E
There are several alternatives.  5 h( m+ A4 K! Q& r& e

/ l! `/ J: s1 O# J: W! eThe following one is the simplest:( Q9 p  j' z+ d7 O

, k6 m9 j/ U2 f" Y    mov     ax,4fh- d1 c- _$ F- K! ?% }" G+ b
    int     41h8 }* d" G& c1 e& O1 B' B
    cmp     ax, 0F386
3 L+ w* p- {3 K. L9 j    jz      SoftICE_detected
$ S/ `2 `) q5 ?% T, F$ ]
' b! y4 N( F- z
* A: b6 }# C/ C* cNext method as well as the following one are 2 examples from Stone's . x+ `. f( {8 e! W: s. I  n
"stn-wid.zip" (www.cracking.net):2 ^  ^! W! I, X& h. W- O
) H6 W0 u, P- T
    mov     bx, cs
- a  j% J7 i0 u    lea     dx, int41handler25 M9 j) p! n$ O+ \) r( n* T
    xchg    dx, es:[41h*4]
1 P: M2 Y. t& y. ?    xchg    bx, es:[41h*4+2]
* y0 Y7 I4 w3 g    mov     ax,4fh
, j& Z% d% |0 h$ S4 s2 U6 Q7 B    int     41h0 H! O1 P9 U6 ~3 h
    xchg    dx, es:[41h*4]
+ b  J8 e, f, X6 ?# B    xchg    bx, es:[41h*4+2]7 Q: O& i& a; M; h! R: o
    cmp     ax, 0f386h" V, X. [" B. P
    jz      SoftICE_detected+ a# z2 Y8 p$ e( u* J) `1 b

" ]& k! e( g, [" ~int41handler2 PROC
& b2 |3 n" j7 f( o; W3 F2 R; u( Q    iret
6 C6 q) y" L' U9 K2 iint41handler2 ENDP
, l8 B: X* U" V3 y: @
8 h) D2 a0 V. V4 [) }9 A& N
$ Z8 E. }8 E$ U/ E, X( y* P_________________________________________________________________________. x5 V* I% H  Z8 ]8 S9 ~

) y& r2 r# R% F* L8 U$ z% a6 r# J# O
* o+ Y( V/ F4 ]4 _* @0 H* RMethod 06
# h! t* {% Q9 X) B=========  S; F- I5 V. n! I. s1 a

2 m& [6 L; W% n9 l$ |$ }* h: z$ L. m' q# c
2nd method similar to the preceding one but more difficult to detect:
. ^( E# T$ O+ a, C) \% f- @0 i. y( y

+ D, a+ L: E, ]& Hint41handler PROC1 B6 V" \9 l1 K, B& d
    mov     cl,al
5 ^! K9 {( S7 I7 o7 O( ~. ~! l    iret
7 o. I8 ?: J% ?' Pint41handler ENDP
8 C1 q2 I0 U: \2 `( \0 L+ l! O. Z' O1 k, Q# L+ Y5 V
1 H& _' ~0 u* c! ^9 k
    xor     ax,ax0 E1 e. c) `2 o0 w6 j, i( J
    mov     es,ax
  r8 U  {- T. y    mov     bx, cs
, j& V/ [! t* Q! M# a5 G7 b- I    lea     dx, int41handler
0 w! U; E  j0 [" B( W' `    xchg    dx, es:[41h*4]& v# ]9 g- ]/ I+ e1 I" W& Z6 S9 U
    xchg    bx, es:[41h*4+2]: K# ~. d8 c; ~
    in      al, 40h
. I, R) O, X2 u# C5 p    xor     cx,cx
# ]' D- @( z( v) b! b* i/ P8 h    int     41h
8 i8 h  S( N, A1 C! j, {* U    xchg    dx, es:[41h*4]
: A- U' E8 |( F, Y, B7 h! n) I    xchg    bx, es:[41h*4+2]2 Z/ Z5 p5 S( }+ X+ K
    cmp     cl,al
; P/ e1 l7 c0 V+ |' u    jnz     SoftICE_detected( @% a# e% M' U% A$ Q

5 |5 ?* |: N+ b/ d* e_________________________________________________________________________
7 b  t! J/ d2 ^: r$ K1 Z  r0 w: r- ]6 G, {/ I0 v
Method 07
- E4 n" B' T# ~7 L& N0 O1 D=========
4 F+ k8 b3 O: h. S. \7 M0 c1 D; T# W5 c
5 Q2 W& _1 ]) R: oMethod of detection of the WinICE handler in the int68h (V86)
$ J" G3 S% H- n+ G3 V* Z" x# }5 U' G, S( t* C
    mov     ah,43h& {2 |# j# x: {
    int     68h
- v' k; U% l5 _& [/ G) l6 w5 \    cmp     ax,0F386h
4 n  Q+ t( q& n5 F6 r* C+ m" z    jz      SoftICE_Detected3 s  @' d6 {# A& y
& i- G  ~) z- F; K# h

  b+ _( U! I( G! I- }' e8 i=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
2 m9 B4 Y. k9 N2 Z  M- D   app like this:
( d; \, i" W/ m- e: t9 v( \; O0 z) c, o9 F! K1 b
   BPX exec_int if ax==68$ P& c# _6 X  q. x2 h+ [, i! z8 y
   (function called is located at byte ptr [ebp+1Dh] and client eip is
; R9 Q! V6 H2 ^. d   located at [ebp+48h] for 32Bit apps)0 Q+ M- S! b. A' ?. |' ?4 O; L7 t
__________________________________________________________________________
/ j( Y6 D8 C/ I  G: T  B; K6 K6 j
/ r& Y, p5 Z: ]8 m0 \2 Z1 a( i" t* Z: D
Method 08. T, W1 L% n0 B' \) H- L
=========
6 b- H* M1 T" ^& y. v; Y8 H0 ]. h6 X0 z* z+ H. |
It is not a method of detection of SoftICE but a possibility to crash the
0 W. y5 X0 @1 \5 \system by intercepting int 01h and int 03h and redirecting them to another
# u# H! _1 i' A- X( |9 hroutine.% ^: G7 v, y1 p8 m6 D$ m! m, u
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points1 l" y% F2 I' ^: j% d, v: N
to the new routine to execute (hangs computer...)4 Y, ^) E% t# \

: z$ f* ?: y5 w" Q* m" U6 s! U    mov     ah, 25h3 z3 s# g$ N# U4 C- E
    mov     al, Int_Number (01h or 03h)
7 v+ o# s& `7 c, Z1 C3 `    mov     dx, offset New_Int_Routine- H2 ~# c+ \* ^9 t
    int     21h$ i% K5 u; a- ~( n' |8 M# x

: k4 \4 A* V- J7 T8 x9 q- Z__________________________________________________________________________& R* q" G0 Y! D

; E) d& @* b7 e" DMethod 09
  q( m. c" {1 t1 Z4 Z8 F7 v/ E=========9 m' }' j' U+ B: K

" f* C* I% Q8 O6 a! z: u  pThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only) s" [6 @/ G/ L+ P( _
performed in ring0 (VxD or a ring3 app using the VxdCall).& e9 `/ S$ V: j5 a! h
The Get_DDB service is used to determine whether or not a VxD is installed
9 y" g$ C+ Z( F. Nfor the specified device and returns a Device Description Block (in ecx) for& w/ _- |% R" s  Q3 S# ?) B/ k4 ~
that device if it is installed.
" Q$ _) p- @- ~$ k4 m+ d" J
& m- M( Z' S1 j   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID) \; ?5 b: a0 b! k1 l: W0 q
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
$ ^( s. n) x& Z; |; G, d+ C   VMMCall Get_DDB
6 A( \! p" R+ X   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
9 j, i3 J+ T" G( l5 _# f
! a# C; l0 s- \5 \/ S% eNote as well that you can easily detect this method with SoftICE:+ y5 e. `. T$ U1 z( @$ E1 u. \
   bpx Get_DDB if ax==0202 || ax==7a5fh
& L2 m" J1 x0 a' J+ E+ c, I* L1 j7 M! t' D- [# @/ U
__________________________________________________________________________
4 x9 v/ t- }( t, E# E
0 [1 ?" I. X$ K- o' C' nMethod 106 {6 ~/ r7 n4 H4 R- g
=========
" L. [* f$ _7 P( f4 _/ R0 K; P) S
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with' T! k8 |& i( r) q
  SoftICE while the option is enable!!
" N! ?0 Z% `6 p$ d5 f7 @
) t% K" J6 v+ r7 p8 {( tThis trick is very efficient:
5 K: |6 g% M! k; u9 w4 w% }1 rby checking the Debug Registers, you can detect if SoftICE is loaded9 o2 b- h/ U) P) U+ y% l
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
& ?6 L8 i! C( k$ z" f( @6 cthere are some memory breakpoints set (dr0 to dr3) simply by reading their
. _  z2 a) P+ q2 b/ Lvalue (in ring0 only). Values can be manipulated and or changed as well
: Z& T$ `6 h& f. T8 K- N(clearing BPMs for instance)  w* C7 [7 r: ?# B5 |: a3 @
% Z/ h% S5 h9 V' H# c5 z5 f
__________________________________________________________________________
1 z- N1 o$ V( Q& V% m; N
3 B3 m+ k: @0 CMethod 11% I* l/ s+ ~3 c; I
=========
4 U* D+ [* Y) |# P9 t
7 ^- l9 [: B1 v$ j8 bThis method is most known as 'MeltICE' because it has been freely distributed
+ ?) d4 B! r* `* C, p% @# I: `$ Jvia www.winfiles.com. However it was first used by NuMega people to allow
5 q4 B5 ]! D3 rSymbol Loader to check if SoftICE was active or not (the code is located
* ^" T; M9 b# d* h  D3 D: Cinside nmtrans.dll).
+ p3 c6 f( @* @8 R4 {5 R, }
  X& u( q) Z5 [, `5 v9 ?8 JThe way it works is very simple:
2 Y  a" A# \# T2 F) LIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
( z! j6 X4 E# P" r# JWinNT) with the CreateFileA API., R4 g9 k" p4 {1 @2 r* V7 w
+ B- V1 E8 h& j3 w3 p* _" J
Here is a sample (checking for 'SICE'):
$ L# `: i" d& V: F1 _) c% Y. K& G* h: m$ _& ]% j& T' C, |/ K+ b: ~
BOOL IsSoftIce95Loaded()/ J; j" O) C1 W$ N! [
{; G' W. N" g' [( {
   HANDLE hFile;  
8 u8 Y# _" }% C0 G8 |0 Q- Q   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
+ I* O2 v; H' Q8 j, V                      FILE_SHARE_READ | FILE_SHARE_WRITE,
. ~9 A& ?3 |( {3 w3 E7 e% T( h# E                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
# n7 n9 `* q, f6 \+ X+ E, j5 S   if( hFile != INVALID_HANDLE_VALUE )
0 n6 g5 e. S2 w1 G   {
7 d2 M; }, x$ `: R. z      CloseHandle(hFile);
3 x- z; x) E; h      return TRUE;
) W; J- e( C' |4 p1 [, ?* [   }9 j* b( F+ l! i5 r
   return FALSE;/ g; \* h2 _% D( H. G# |0 V* \
}
% A" H3 _! U& @. }
/ s7 x9 A! |5 D8 p5 sAlthough this trick calls the CreateFileA function, don't even expect to be
, V) O; j* y, v# [' R. ]able to intercept it by installing a IFS hook: it will not work, no way!1 t- W* I( {$ H: k4 i# v5 h3 ~
In fact, after the call to CreateFileA it will get through VWIN32 0x001F# S3 l1 G1 X, U2 Z% K) ^0 J
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function), q: k4 \" G& u+ E
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
! E) a7 V7 _! cfield.
& R0 c7 \( Y. h# s8 \' cIn fact, its purpose is not to load/unload VxDs but only to send a ' J- x' Q0 v5 w& [! c; \
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
$ }, r  O+ G1 z4 Ito the VxD Control_Dispatch proc (how the hell a shareware soft could try
9 g; s1 {/ T- @4 L7 w8 S3 z. r4 ato load/unload a non-dynamically loadable driver such as SoftICE ;-).
' }  c- n3 A5 ]3 d8 Z4 o0 D0 @If the VxD is loaded, it will always clear eax and the Carry flag to allow
* V5 J: }) @" B: K/ dits handle to be opened and then, will be detected.
' n7 h3 _4 z" o' e- oYou can check that simply by hooking Winice.exe control proc entry point
5 i( `$ k& t. [while running MeltICE.
! V. w3 [" |3 W! d  p4 _5 ]$ b* E5 w" |# I( G! a  [
) M4 y5 _' Q/ o+ }
  00401067:  push      00402025    ; \\.\SICE2 u/ z0 G$ O$ u: X, t
  0040106C:  call      CreateFileA$ C( ?3 I2 I: k% W7 c# P% C! p- e$ D
  00401071:  cmp       eax,-001# k' H: J. a" I1 [( L
  00401074:  je        00401091
9 O! z+ d7 _) h$ b% t0 }4 o% O5 l6 j3 ]( e3 P

6 ]7 Z9 e9 X" Q8 ?There could be hundreds of BPX you could use to detect this trick.! N1 I6 k" A! y
-The most classical one is:, `4 x6 o+ k9 @5 }$ p/ ]
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
$ E; y* a; G3 r* }    *(esp-&gt;4+4)=='NTIC'% h: z- k2 L% }; y2 K( p$ Y0 i
- y/ D5 f( d: T9 v( \; K4 W
-The most exotic ones (could be very slooooow :-(
; F0 Q8 c( D+ f) D1 E; r   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  3 Q3 h1 }6 @1 F
     ;will break 3 times :-(& D) S# P* C. K5 l/ z) @

% r! ?  a- M4 C-or (a bit) faster: 4 n1 N8 r: I5 ~& ?6 Q/ z
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
$ U1 s0 W+ ?' t. E$ j0 c9 c* ?( p
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
" E  W# C. C6 ]7 w* g3 e; A4 _     ;will break 3 times :-(
8 `6 F6 W) Q# N) M5 I% f( B
# J6 d7 ?! z! e! D2 b! ]6 n" l) o-Much faster:, Y3 f7 l" {6 L4 D0 G+ [# ?9 ~
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
+ K, B8 A7 l$ p6 o1 |( }% g; W/ @, B$ S& p% }+ B
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen9 r& r2 E0 X9 y3 I6 C( E1 E
function to do the same job:
5 G4 ~4 q) @+ P. e3 m% L
, d% N% h+ o9 F   push    00                        ; OF_READ% J0 w. {6 _& q0 T( {
   mov     eax,[00656634]            ; '\\.\SICE',0
6 C+ R. S& f" I   push    eax0 o; C( ~# _1 i2 T
   call    KERNEL32!_lopen$ M. Y) w: T0 R& ]+ U
   inc     eax/ a4 p( @; ^. W0 b4 W& }1 b3 b
   jnz     00650589                  ; detected
+ f1 l4 H8 p5 Z$ g5 x# G: ^   push    00                        ; OF_READ% k' C. l& v( x1 I
   mov     eax,[00656638]            ; '\\.\SICE'
! k4 D; C' G# q. z   push    eax( K6 ]4 v6 {* W0 ^9 ^
   call    KERNEL32!_lopen
$ x5 v7 G& I1 M8 _   inc     eax3 c0 R6 U: Z3 S" E' F& u! ]
   jz      006505ae                  ; not detected
% T5 ~9 c0 X- \- \4 |( }* Y' i- N5 }9 t0 T, g  f, ~+ v
" p* p% K$ H/ x! ?+ n4 P- i
__________________________________________________________________________' \) |! b# W/ m+ p: h3 v+ f
8 p7 S$ Y# e$ Z7 @, k0 _
Method 12
- U3 B' L1 q2 j" i4 H) `; Y- D& C9 J=========
1 d* T, o2 [# J" v6 \$ x3 n+ E! C" k6 ?7 @3 m6 g: u
This trick is similar to int41h/4fh Debugger installation check (code 05
$ ^$ y5 h9 w' S# ?3 X. X) s&amp; 06) but very limited because it's only available for Win95/98 (not NT): ^$ i4 [6 [* e5 t
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.% a" O. O! F; R. ?

3 G- @7 {; W% G& @* h1 ^4 m   push  0000004fh         ; function 4fh/ E" v8 S6 @* F# b8 n& g
   push  002a002ah         ; high word specifies which VxD (VWIN32)8 ^3 Q: {! f1 x1 C" T* N
                           ; low word specifies which service
7 A# f- l  G: J& u& B                             (VWIN32_Int41Dispatch)
% e& p* U( ~0 R8 ?: p3 d8 q   call  Kernel32!ORD_001  ; VxdCall
$ N2 x/ X( k" R2 k% B   cmp   ax, 0f386h        ; magic number returned by system debuggers
8 B7 S% B( Q3 ^; Y2 f   jz    SoftICE_detected/ X5 ~  Q! H. [6 s- Z7 {

- F4 S: B4 @' Y3 EHere again, several ways to detect it:
# k9 k, N# V2 H3 Q# p
& H! R: w0 {  C7 w1 i    BPINT 41 if ax==4f
2 `% q, w/ d/ C0 ^8 A- f! V! L' E2 B( ?1 R1 V
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one1 T  M5 a5 P* ^4 y
5 A8 a9 K% h5 x: f% h
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
! F) C( q. p  L
# \8 x. @9 R' A* ]' T/ W. j7 O    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
( p7 e9 L( d0 p. N* |' G) C% A
__________________________________________________________________________
' ]0 ]8 E3 }5 m( Z) R9 [4 Y8 I
1 Y; S# ?3 C( T8 X* K4 g- A& lMethod 132 d' [3 O: \+ `4 Z% {
=========
, }+ ]3 @/ b% ]0 J' n" i$ h7 z. q; M8 q3 R9 R3 |4 e
Not a real method of detection, but a good way to know if SoftICE is
; a; l: W6 v4 x4 N2 l) Vinstalled on a computer and to locate its installation directory.' P9 n' A+ ?6 D! P
It is used by few softs which access the following registry keys (usually #2) :, F/ s1 Y# q* O3 M

" D6 x) m' D$ g* Z6 g' h-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
  r+ i7 w" z9 l\Uninstall\SoftICE
* {5 L) A5 V1 @$ E9 |- B-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE2 K* j! Z' Q$ r4 h1 ^+ k
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion% w) d: J, U2 x" ?
\App Paths\Loader32.Exe9 ?/ j% l# y; O
- S4 j: j! F/ e" E/ m; M) E1 r

0 l- K8 A7 V, C3 R* nNote that some nasty apps could then erase all files from SoftICE directory% n+ G2 q; {( s4 K2 ?4 r
(I faced that once :-(
# }, e/ b  T& }4 c9 K: T
; ~1 c' S* W9 J. p; }! kUseful breakpoint to detect it:
  O2 d. b) D' L+ V$ D
/ [! G, @) ]3 }     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
  r1 k' w+ w- F
, x( F+ n7 i2 A__________________________________________________________________________* @$ s6 f  \4 m/ c8 D
1 L" e1 [5 ?* c% ?% Y0 n9 ]# X# C

8 o9 Q% v8 m7 d& E; @Method 14
  r1 _7 O) v; M=========
# I7 y0 v) e6 n+ d1 A5 I1 p& V4 M1 D2 g" k0 h6 S
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
9 U& d9 a1 _. p) xis to determines whether a debugger is running on your system (ring0 only).
: w- m3 M( `+ ~- `2 [# u# g* t& W' {; I$ `  d3 H" A) ~
   VMMCall Test_Debug_Installed
4 l7 N, i, u, K6 H0 x   je      not_installed4 l# y/ N1 M5 e+ z+ k

1 x: l, i4 H4 ?This service just checks a flag.2 H. i, B  ~6 q) y6 K& p3 ]- a( e
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部