找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>5 d! p4 C  p3 [/ w
<TBODY>
9 _% t3 A5 K; w: l1 F4 J) G, E<TR>
# }: I8 R4 ^$ U7 J<TD><PRE>Method 01 1 [! _! m1 ]# E# O( _6 F1 V
=========
. p5 O5 T3 h0 P: z! h: A4 N# I4 H8 r  @' f' M
This method of detection of SoftICE (as well as the following one) is
) M9 G" G' ]0 ]" v3 g7 o, s4 Hused by the majority of packers/encryptors found on Internet.
2 B. r5 |- Y8 P3 {2 i" g4 ^9 Y' OIt seeks the signature of BoundsChecker in SoftICE9 ^4 l  K" |' s" s" t
1 L, w( C( E% }- S. [
    mov     ebp, 04243484Bh        ; 'BCHK'' V: J! a4 K0 Q+ e$ F; S3 P" x
    mov     ax, 04h
  |# o7 q- p! u" u) |    int     3      
3 ~- n% l5 a& D- a. w    cmp     al,49 ]3 ?+ W8 i, d! R& f
    jnz     SoftICE_Detected0 r+ D; r& D0 G* Q
* r1 o  b, O0 S# A  \# f, U* z
___________________________________________________________________________# b# v4 o" }: V5 ^( A" W
3 A; Y2 [% Y- `! N1 E4 }9 l
Method 02# _  ]+ H& l0 f1 K- p
=========- a- h; V+ x( i0 T( L( Q( ]% W

6 c3 o5 b% T5 ]/ w$ J  [Still a method very much used (perhaps the most frequent one).  It is used
5 P8 X! V/ f) @5 Y  `+ `% D2 ~to get SoftICE 'Back Door commands' which gives infos on Breakpoints,% r) v' @. y7 I; u$ H
or execute SoftICE commands...
; X" Q( _+ K; H2 l9 O  M' tIt is also used to crash SoftICE and to force it to execute any commands
$ G( F- }0 A+ y! D# e; v/ G6 B(HBOOT...) :-((  
, i# `6 f7 F' R; O3 ~' g) X  T  s4 u; D, `9 W8 h: I
Here is a quick description:
; l7 @' Q, W9 ]$ Z, t4 U9 y-AX = 0910h   (Display string in SIce windows)
3 N% Z+ c' Y5 }% d- v) e-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
3 T6 H/ |/ ]# I, ?/ F% |0 _2 k-AX = 0912h   (Get breakpoint infos)
- C5 O7 c7 b8 s  A% [' l' l" s-AX = 0913h   (Set Sice breakpoints)
# O( a. L6 s+ G. Y1 G. }7 h-AX = 0914h   (Remove SIce breakoints)
+ O" v# t- T' D0 n" A% n/ h& a# G6 H: N" l6 q
Each time you'll meet this trick, you'll see:
1 k$ Z8 H/ c$ ?& e+ p-SI = 4647h" }% }0 N3 d) J5 V( H. X2 ~1 k0 ?
-DI = 4A4Dh5 D3 U0 i' @- U/ L( h! ^
Which are the 'magic values' used by SoftIce.2 p  [3 @* r. v1 \& A8 M
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.! R/ H$ m- [+ y! j9 i3 Y

) I* g7 ~5 X9 C0 w, r; OHere is one example from the file "Haspinst.exe" which is the dongle HASP
  T& w. v3 o1 j. FEnvelope utility use to protect DOS applications:
' e8 J5 V% U4 i. _) @  \) D% s8 Q: n! J$ F* F

" k3 o- r$ r$ I4C19:0095   MOV    AX,0911  ; execute command.4 H( t% b6 D% F, u2 G) v' g( H
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
7 G4 W; y8 S1 D7 X& W4C19:009A   MOV    SI,4647  ; 1st magic value.' D& I( Z- G1 h* [; U' E
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.# c. V4 p/ z  N! o
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*), e# x# U5 n! T# X/ v% ?- T
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute7 Y" T% d7 l8 t& s& F; T, W  I
4C19:00A4   INC    CX
& ?+ ?+ n/ F1 B4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute  e5 ~7 u4 F0 F8 r6 h7 m
4C19:00A8   JB     0095     ; 6 different commands.
7 R% \* y! D$ ~; B7 r) t- h2 b% k4C19:00AA   JMP    0002     ; Bad_Guy jmp back.; \, k& o# Q# \
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
" X" O* B6 b1 p+ P$ h7 M# Z" A9 H- h8 }7 K2 ~
The program will execute 6 different SIce commands located at ds:dx, which0 v  G! A* h% o  j+ ^1 Y
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.  m& b7 h4 e" S3 \% p% C

, V' X' F6 E$ @% Y/ `6 g- s* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
+ f# ~0 c8 f! O9 ~6 }/ ~" Y___________________________________________________________________________+ m9 \0 p* z. m

. f$ p* y( {4 j. ?8 M8 @* R+ \5 u+ `8 Y+ \) a+ @& N0 u
Method 03
3 p. `  ]& E5 r* ?: [9 e: [=========/ b) U" s1 B' e7 Q

& q& x( f7 N& G4 ~$ W7 j. D8 CLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
( o, `5 y/ ?8 J$ F% t(API Get entry point)
9 D3 n5 {" r+ ]; j4 x        ) z/ \( c/ x" n3 e

4 p+ Q4 @9 f0 d7 V9 l! _    xor     di,di- @( h6 l& f) S/ g/ ~* s
    mov     es,di( x, y! {( A7 w4 C2 P6 O& p
    mov     ax, 1684h      
9 @) n; Y* L4 S    mov     bx, 0202h       ; VxD ID of winice: F' a9 r# G& @, y7 M
    int     2Fh
$ d) J! F+ p, M- C! e1 B% [    mov     ax, es          ; ES:DI -&gt; VxD API entry point5 Z9 j( W9 u8 _) o( v' d
    add     ax, di
* H, s3 g1 Y) @    test    ax,ax- n9 t2 h5 s/ d0 l
    jnz     SoftICE_Detected
& J! A/ \7 L, J1 H( |3 o2 f: i' q, F3 i6 ]8 ^( S% ^- ^
___________________________________________________________________________* q2 X$ u; |* z" B( e; ~+ ~; {

0 e1 d! h' c7 `0 R6 u, CMethod 04
9 v# z' K( N% j( O7 I=========
' p, `9 b. ^4 W, ~8 D, ?- c6 C; n6 M5 \) C1 C: v: ~
Method identical to the preceding one except that it seeks the ID of SoftICE# ^9 h: q0 n( K7 Q6 `# g2 p: S/ L
GFX VxD.& ^; k* A- n1 }

/ |; Z5 U0 v* I% W/ t    xor     di,di4 G1 y# O2 U. _& N; s
    mov     es,di* Z" T) b) ]! L/ o8 ^$ Y3 g& Q
    mov     ax, 1684h      
$ k5 ?0 t3 g( {1 G/ q% y    mov     bx, 7a5Fh       ; VxD ID of SIWVID
; W1 Y! h& J" g& W- l7 Q& L    int     2fh
8 a* n8 ^6 V2 F0 F% N# a    mov     ax, es          ; ES:DI -&gt; VxD API entry point
0 M2 j9 ?# H* A3 m8 ~    add     ax, di0 Y- H7 a  F7 X0 s0 L( i+ c- h
    test    ax,ax  j8 |) Q: F8 n4 k+ U8 v
    jnz     SoftICE_Detected
$ p9 o  A, }: p: v) K' H, }
: Q( Y( e, q" o$ s__________________________________________________________________________; F  ?0 _: d2 F! ^+ g6 w% q

, t# b* Z% z' e# l" y" j: s; U* ]
Method 05
/ Z+ y6 f. ~- y0 n: M* u=========" `/ w( Y2 Y( C& t

; y0 c4 X7 |" I$ y3 RMethod seeking the 'magic number' 0F386h returned (in ax) by all system
& t7 O* u/ P9 ?' H4 ldebugger. It calls the int 41h, function 4Fh.5 r3 _& m  d) _! D; F8 Q* U
There are several alternatives.  
' c8 K9 H( o4 B' G* V) D# X2 Q/ n5 ?2 Y# q, c$ I
The following one is the simplest:1 Q3 F: `& C8 T% y2 }

" L) v) w) E/ a6 Y    mov     ax,4fh
: v0 \% {  U6 j# E8 x; o5 ?    int     41h
! Y$ h% Y+ h6 j+ h( g) z    cmp     ax, 0F386# G& ?+ @  p# y; l
    jz      SoftICE_detected# V0 g. M3 y  S1 ^

( x- n$ g! Q- D5 e5 D. l7 R' [/ G. C# h8 H* I$ X6 t: w* F7 K0 R
Next method as well as the following one are 2 examples from Stone's
" r: J; h- L. ~3 ~/ I"stn-wid.zip" (www.cracking.net):/ U& p7 ^1 f5 ?6 D3 M9 C% Y
1 {0 G$ H8 u) x1 e+ G1 q' {6 m
    mov     bx, cs2 n# b7 G' l0 Y/ _5 l
    lea     dx, int41handler2
! e; k0 e1 n6 z/ ?! ]8 d0 p    xchg    dx, es:[41h*4]8 H7 y+ E% `2 G5 V
    xchg    bx, es:[41h*4+2]8 d. R4 ~2 j: _4 K# L- J" `$ u
    mov     ax,4fh  u5 {/ ]& P7 Y8 c8 I
    int     41h
% Q; Y) s5 l+ D  Y    xchg    dx, es:[41h*4]* B: B! g/ W( f+ S$ }# L. }
    xchg    bx, es:[41h*4+2]
' \+ q) C+ p+ r$ Q2 f# p    cmp     ax, 0f386h1 U: w) O6 B  _, P# e3 J
    jz      SoftICE_detected) M7 E4 V) B1 D/ E) _- j% S7 J

3 _7 V7 Q7 @1 Oint41handler2 PROC
. X) }4 ~: q; n/ _- t" ]    iret
0 ]9 u! {+ B& _! V7 d6 G) ~int41handler2 ENDP
4 K4 P0 L8 a/ J# W( W( `6 P
( u9 B  H; r1 q% h! x
5 ~. z; X& `- d& N5 d5 ~: Q6 Y* G: Q& k_________________________________________________________________________+ E3 M3 g- n# a
, P: d0 g4 i- m7 c# M( ]2 N2 ^) L

4 o+ a- Y$ o  I6 aMethod 064 y# s) z0 G5 d. E
=========" s# ?2 D. @$ v' V% {! p/ T7 O
9 I- _" \" u7 ]3 O

! t. _/ F  u5 Q) i2nd method similar to the preceding one but more difficult to detect:! g% n, T: B2 C- s+ y

: I: I  m, u0 i% E# }  R
- W3 }9 A# n7 m. vint41handler PROC
/ @1 @2 e, X# `5 m5 ?7 `6 ]0 g    mov     cl,al+ w% H, W- g4 T. Q( R
    iret
; n, w/ `5 }5 U: U9 jint41handler ENDP' L$ T2 r3 J' I6 G- {- i
, l% O. E. D5 c$ W5 V! D5 f2 a# u5 H
  I" K$ p. n2 f0 t2 W8 o$ K8 v
    xor     ax,ax1 z" g- x% _7 s6 C- `$ |
    mov     es,ax8 ?- U' d" B/ g! Z' ?
    mov     bx, cs
/ u% m8 W% `5 p3 i6 t2 N6 a/ l    lea     dx, int41handler( z7 o4 p8 d8 t
    xchg    dx, es:[41h*4]0 z1 i9 K9 E! Y, g: H2 x. @
    xchg    bx, es:[41h*4+2]/ g3 a1 h( Z6 _/ i4 p% i9 e3 M
    in      al, 40h$ I$ H$ @( W/ z4 I
    xor     cx,cx& Q' d& f3 q" J5 p. s* o5 c
    int     41h
2 n: R$ V/ [1 [$ h) r& T5 j3 y    xchg    dx, es:[41h*4]: V" B7 H( i1 A' x" R
    xchg    bx, es:[41h*4+2]
: g" ]. Z3 b5 C% M7 F: d; {    cmp     cl,al, F) C* G% D0 f
    jnz     SoftICE_detected
0 v4 w% T8 v! ?% C2 F) F! o) z
% q; [1 H/ a/ M( T6 g$ Z0 X1 D  V2 K_________________________________________________________________________) B5 Q1 R! g6 n
! z7 X) ?  w3 B: y+ R  E# i1 ~
Method 07
9 S, E  d# |# {+ o( E8 |=========1 c' B! C- U4 f6 H- U9 a. R0 @
4 P0 k# [" G2 F) z3 P6 \
Method of detection of the WinICE handler in the int68h (V86)
1 ^1 j' i  n9 M4 t7 q3 q- C8 }$ ?' u6 }: D$ m
    mov     ah,43h
" h% W# U5 T& y' Z- o  }( X4 E    int     68h
. S! `6 g$ R# @) r( ^    cmp     ax,0F386h5 C( s* U' f4 |; M1 a1 g7 `. `4 L
    jz      SoftICE_Detected' Y  X1 U# Y5 Y
6 c, e# J  y8 j; C* I3 t

1 S. u. ?% ^! t/ k- j=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit5 G4 g5 A# L4 s6 S  z- d" _
   app like this:4 _% v0 G$ _" j5 v: S$ }8 e
, c4 |  `8 c0 e3 F# C
   BPX exec_int if ax==68# @; C6 E  _8 S% h) H/ b- ?
   (function called is located at byte ptr [ebp+1Dh] and client eip is3 q/ o0 U8 s' s: w0 r
   located at [ebp+48h] for 32Bit apps)
7 @0 A& I* N. q__________________________________________________________________________+ T8 O) N- O! h5 a6 o

* T; O$ r& q7 l5 M4 |0 k
4 k  O( R9 q2 D7 W4 q% H6 GMethod 08
3 Z( M, Z3 R/ ^. h6 d: l=========
3 q4 z- \* H2 E2 t7 Z. f8 k7 @) s1 T) ^' i& Z, Z; W0 \  C
It is not a method of detection of SoftICE but a possibility to crash the0 _6 Y/ t; Y* k  M7 R  f  z; G
system by intercepting int 01h and int 03h and redirecting them to another
: B- D& ~& @; }, e  ~+ V& E$ r0 uroutine.
1 O  k- ^& D2 f$ u' r5 n2 n9 Z* g+ [It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points$ j# H* l0 e2 ^  ~$ O
to the new routine to execute (hangs computer...)( p1 ^) w/ s* \! b' I

% U" q+ s/ z: h4 p2 `; M' K    mov     ah, 25h
7 S" ]& V, o$ v( n    mov     al, Int_Number (01h or 03h)  _; X5 j& s  N, c% l# y6 H& C, I& q/ _/ l
    mov     dx, offset New_Int_Routine
0 b- w# Z" k1 K! `8 V    int     21h3 l6 e( X% U  R5 D  O( v) E% u
# J" H- q- J5 |! {% e$ h% B
__________________________________________________________________________5 Z8 X: R. y1 H( v! A2 i. u( U# M
% [6 S: E6 u8 y7 Z" n6 S% t/ I4 f
Method 09! u, C1 C: C4 V
=========( G: _8 N8 |7 @/ U

' l' }* B8 y0 OThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
/ y% j. E7 }3 w/ B2 F7 G% p9 {7 nperformed in ring0 (VxD or a ring3 app using the VxdCall).
/ ]& m: f! ^5 n: g& B/ p! z; SThe Get_DDB service is used to determine whether or not a VxD is installed
+ A9 _; d4 k# M+ x/ \) rfor the specified device and returns a Device Description Block (in ecx) for
& |, w9 i* {& @& T/ x+ D/ |% ^that device if it is installed.
' p7 K' O( n* u7 ^, S6 L
+ S1 m" |  V4 J8 }- j   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID' R, {* A2 c8 P! g
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
7 N( K' u# w) e   VMMCall Get_DDB* j* W& `* w6 j* a: M
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
5 D) |2 }" c: t3 z  u; |: G! S8 @  m0 f2 k0 h
Note as well that you can easily detect this method with SoftICE:) X! t6 T; E) k8 f# Z
   bpx Get_DDB if ax==0202 || ax==7a5fh
- z4 h. \+ N7 K# v5 N+ y% w4 k; g5 @, a1 S" J
__________________________________________________________________________8 F$ ^2 p$ G( ~& x" T: ~0 z1 F

. o$ Z+ W% b  }- L4 ^. _$ G9 ZMethod 102 X  r1 w, D) I8 z8 E4 C
=========- F  u' O, F: T0 z2 k- r. l

: D" A, C( X6 H, g: g9 j1 a: j=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with$ t  l% [6 Q, z  h3 M$ ?
  SoftICE while the option is enable!!6 M: B5 v7 u" m, C1 m1 W  l
8 p6 h, g! X* }
This trick is very efficient:0 Q2 T5 v8 X) Q
by checking the Debug Registers, you can detect if SoftICE is loaded/ x& j6 K# T6 }) w/ T
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if; P/ P, g$ c, t- a, u% [2 U/ I
there are some memory breakpoints set (dr0 to dr3) simply by reading their% P2 T: t/ v0 T3 w. f7 E+ U
value (in ring0 only). Values can be manipulated and or changed as well
& g8 J$ E+ b9 X, f8 A3 O; X0 c(clearing BPMs for instance)+ R  J) W+ ^0 {! ^+ B) S$ U, I
0 h4 Z$ ]! A8 h3 |6 a
__________________________________________________________________________5 [+ r- |0 {7 u: t& r+ S
5 T3 Q# c2 |/ |( a$ R
Method 11
. y/ `/ O, f( p: H3 n4 J6 M=========
& ?; T! M+ Q; t- y. H' t1 ~1 E+ _+ }/ v* O  R6 o4 U$ M+ O9 h
This method is most known as 'MeltICE' because it has been freely distributed
- `7 V2 ~8 {% U( [0 I( r* m2 Gvia www.winfiles.com. However it was first used by NuMega people to allow
; s5 ]; t5 v3 s: f/ C# I5 CSymbol Loader to check if SoftICE was active or not (the code is located; H/ ^& W; K( P0 O3 G
inside nmtrans.dll).
% V# U9 l! R2 I9 c& d1 P1 K$ G; v5 v: E
The way it works is very simple:1 e% |( O2 t' m1 q. y, |! |5 V
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for# P  l  U: K8 M6 U2 M0 W
WinNT) with the CreateFileA API.
1 w5 Y" E4 s7 W; s2 O' O. r$ Z, {" L* P* I
Here is a sample (checking for 'SICE'):
! [) }# c* i3 b( F3 z" h- }0 t1 z; a3 l. S
BOOL IsSoftIce95Loaded()$ q! q9 _1 c, c  Q( j7 c
{& ~$ G# a2 g) ?1 ?& Y6 S
   HANDLE hFile;  ' D) s6 x+ s8 ]% U% S; N! _+ i1 R
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
  I$ ^/ N( O2 Q6 s+ M; E                      FILE_SHARE_READ | FILE_SHARE_WRITE,
( d2 Z( _; a- ]                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);8 b; _6 [: Q9 P  C6 P
   if( hFile != INVALID_HANDLE_VALUE )3 H* M, A$ C5 M7 O
   {- o2 r) p' e1 d& L0 N
      CloseHandle(hFile);
- J- r1 W! m- O7 L1 m, B      return TRUE;! }3 |6 I: n/ `) `* M
   }5 @$ O! g. S+ D  D; e
   return FALSE;3 c4 y6 }5 b3 ^1 n! I5 n
}
7 p+ p- |4 o6 h* y2 s4 y! v* {  |: G* Y. I1 S" Z
Although this trick calls the CreateFileA function, don't even expect to be' E% V& C/ j( l' x% ?- M1 a* n
able to intercept it by installing a IFS hook: it will not work, no way!
6 U& \* P* c9 t4 Q6 D0 {$ YIn fact, after the call to CreateFileA it will get through VWIN32 0x001F; I/ I$ e2 Y# Z' p& @  X0 T
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)9 u! a' V! D% h5 n/ E! ?0 x
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
" n6 G* l! k4 |field.
* g5 V; H6 z6 r. V! V) yIn fact, its purpose is not to load/unload VxDs but only to send a
. i9 X5 l* g6 V( ^# n) g) PW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE). `- e* V' _* J$ @% q, t" b
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
9 b2 _8 {8 o' w! O  C- g5 Pto load/unload a non-dynamically loadable driver such as SoftICE ;-).
! m1 N+ W( k4 ?  o5 m) t/ ~# c  ]If the VxD is loaded, it will always clear eax and the Carry flag to allow
2 ^+ i0 p5 ~* L2 l  V8 }! @, h4 Wits handle to be opened and then, will be detected.
; h6 b5 D* ]. F' K: H2 l, Z$ {You can check that simply by hooking Winice.exe control proc entry point; H/ Q# M7 a8 _8 u. j& X3 i3 C) k
while running MeltICE.
4 T0 p2 d1 m, p5 T& l; d  g. Q) |  ^% S- |! v. b5 r
/ l) v) W5 E2 O- u1 G& t; I+ r  f5 ~
  00401067:  push      00402025    ; \\.\SICE
) p* m& P9 Z5 Y( M4 T, F  0040106C:  call      CreateFileA
% a6 `, F7 p( X, Y' w  00401071:  cmp       eax,-001& U, `( y; C& }
  00401074:  je        00401091
- n/ v4 Q) i" J: k6 g- {- a2 `6 [
  }7 R" v9 E4 \& ]' n0 ~
There could be hundreds of BPX you could use to detect this trick.3 z$ t5 h/ S2 h0 I. m
-The most classical one is:# n  ^5 M* e6 X% f
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
& H! G% G7 k4 J. n9 P; ]( ]" N    *(esp-&gt;4+4)=='NTIC'
% }3 J! K6 W! I$ X/ Q' g3 h7 \# Z, v
: e8 s. M7 m& p4 X3 c-The most exotic ones (could be very slooooow :-(7 q+ z  v: o& C+ x+ _
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  ' H9 m, G7 J* o) D+ A& L; i2 _
     ;will break 3 times :-(
/ Q. Y8 {3 Y5 e% @  D  w% F6 `# M& v+ D6 A" _
-or (a bit) faster:
1 m; [1 m1 a" k8 F7 \$ L% U3 R   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
6 I4 \/ p3 ]1 t8 [4 m/ f2 {( ~  U3 [! F; l
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  - C5 S, g& X" _9 Q/ ^/ q8 T# T
     ;will break 3 times :-(  L6 ]  j8 U6 @3 R  o, E
& U- f+ j! `* h# ], t; A% C
-Much faster:: A3 o9 y8 j: V, W
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
  q( E2 Q0 V8 _  m% c' k; E/ A% ]% g$ M+ F+ S
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen: ?( q9 _! h* Y- K/ ^- \
function to do the same job:4 m9 d  I3 y1 M! a" v

# r9 U# S# x/ o2 _" D   push    00                        ; OF_READ( S: ]2 y$ w, ~6 X3 P) }  B  W
   mov     eax,[00656634]            ; '\\.\SICE',0
8 G6 J* j$ ]' Q% e$ r   push    eax; Y* q& E% m* F2 O5 i$ u
   call    KERNEL32!_lopen/ b4 z' |6 z: ]0 _) e. P7 M
   inc     eax
$ Z3 W7 `7 Y8 r1 F% h, X( W7 _1 N+ Q   jnz     00650589                  ; detected- D- ~8 F9 l  K3 \( T" i
   push    00                        ; OF_READ
% {' I( s5 a* Q6 _) ^   mov     eax,[00656638]            ; '\\.\SICE'
* {% d8 W( ^# m' a" V   push    eax$ A: z6 r$ E  z( A
   call    KERNEL32!_lopen
5 ~* S! _& V* F' o8 R' G' O" V" N5 `   inc     eax
0 F+ O& t1 v8 @- w5 Z# J3 X# l   jz      006505ae                  ; not detected/ E8 W+ Z# i2 W- ]* \

( @8 e2 M7 F- p' ~( o( L8 Y
! O* y* V, }4 d8 F__________________________________________________________________________
; u4 o5 @9 F/ V  L
8 i/ j% o4 s3 }+ @  v: PMethod 12
, r6 O& M3 a" `% K, I. u+ W6 j8 A=========
3 l; q% m4 L; \6 y9 s/ E' J
- S. y1 y5 l. }, m2 _8 GThis trick is similar to int41h/4fh Debugger installation check (code 05  Q  H9 _4 ~0 Y, A
&amp; 06) but very limited because it's only available for Win95/98 (not NT): [1 S/ u* @7 c) b) T8 |
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.9 u4 h& S4 y6 ~

( P7 i% g" @5 e# O/ `' G' J! `   push  0000004fh         ; function 4fh
9 `/ ?! Z* C4 o% k/ n5 ~9 o   push  002a002ah         ; high word specifies which VxD (VWIN32); b* u0 k& ^/ i7 F8 e, A
                           ; low word specifies which service
/ g4 y. A- Q7 E# Q9 O+ ]                             (VWIN32_Int41Dispatch); X7 C) x/ A) E* a) t: Y
   call  Kernel32!ORD_001  ; VxdCall
8 v  f% Y' c  r9 T, d. |  P   cmp   ax, 0f386h        ; magic number returned by system debuggers% C' M+ H9 V5 {% ]- r' U" H
   jz    SoftICE_detected
& t8 s! x9 l, o: Y" z* D- |0 b1 c9 S5 N9 J
Here again, several ways to detect it:
$ K( _% Q5 i6 d9 X
" j( o; h, p+ d5 ?) b! [8 s    BPINT 41 if ax==4f3 [7 t" l4 _) n3 D% M. N, P4 F6 s
- H9 g6 X5 E* B! T& E
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one* [9 f0 ^# \. O1 p8 d/ Z; m: \
% }( l9 t9 n) I
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
% }% o. R7 m+ @
4 w: M9 ^/ D) c$ G    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
6 z- a$ H6 Z$ {+ U9 [, I
3 _8 ^5 X/ B; w__________________________________________________________________________* s9 i) C  |* F! c7 R

2 m1 S: h7 ^- K8 S& _* @6 VMethod 137 I& s; h+ F! o/ ^+ a
=========
) z  @  f2 c2 B& K( Q1 ]* ^+ h
* Y, g% r& z+ t, ZNot a real method of detection, but a good way to know if SoftICE is5 W; D4 Y; C# C) n  H4 k
installed on a computer and to locate its installation directory.' ]) {0 ^+ Z/ x( E) l4 ~- j
It is used by few softs which access the following registry keys (usually #2) :
  X! t0 c, A4 L8 q+ n, z$ M: b  s7 O( K* J5 h' i0 e
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
& t' k0 V( w$ B/ u+ T0 Z\Uninstall\SoftICE- O: `4 _( e8 j/ w5 e4 g+ q
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
, i6 K" w- E. L  Y0 ?2 |-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
9 u5 V5 R) k& ?; n\App Paths\Loader32.Exe. Y* E# ]0 E2 G- t

8 \0 I) Y2 o. Z% Q* c9 n* w, Z# ~) }4 `# i0 W2 I; {& d8 X
Note that some nasty apps could then erase all files from SoftICE directory
, H+ |1 e. J" B  R& H! @  E9 ](I faced that once :-(- H5 W0 Z' D. S; F- c0 |1 T+ W
$ _% x% l0 R0 M6 c9 I, s: A5 C
Useful breakpoint to detect it:6 c( u9 z. n/ Y! P

* R+ f1 J0 y6 ]9 ?" a4 f# Y     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
# [  W( T! O' t. f" a$ f& \+ C& |/ F, r( @7 e" Y/ J
__________________________________________________________________________
1 t8 R% M4 p8 ^7 A& J2 }/ Z, V4 i, r$ |: u  @% n1 d, a0 J5 F  m0 Y1 a
5 Q  L/ f) x8 Y  o
Method 14 ! o0 \9 b7 _3 h
=========
; _5 }3 V% f9 Z" Y( ?
( Y! Q- W% b6 R& f# MA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose1 M+ |0 C8 C. r( \' K- Q, j6 u
is to determines whether a debugger is running on your system (ring0 only).- T& I( I; {& O% j7 Z; m/ O
6 C/ K: S! Q3 E# r5 [5 \2 [0 e* X
   VMMCall Test_Debug_Installed
  A: c: v6 ^1 E/ ?  h: h   je      not_installed2 \) `0 j% f, G" @
: r1 G& u; l9 H  y
This service just checks a flag.; w- \- f6 x6 ~0 f
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-8-9 21:08

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表