找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
3 s) \0 u/ O4 \, g<TBODY>
' U$ G4 o2 v( H8 |, ?<TR>& U/ }/ D/ J9 `
<TD><PRE>Method 01 8 H- g6 K( r: x4 t, x9 l, C
=========$ Z) s( Y$ S( g! N1 q2 y
. q" d1 I) j+ y/ W  v5 a2 J, ^
This method of detection of SoftICE (as well as the following one) is) a; s8 D3 F; I# E
used by the majority of packers/encryptors found on Internet.
" r, \9 |) ]1 l; M6 xIt seeks the signature of BoundsChecker in SoftICE
3 M1 X, p! H9 w: J
9 o9 m8 d+ I; q2 C' k/ e    mov     ebp, 04243484Bh        ; 'BCHK'; p; C" s6 a( R6 I: ?+ r! S4 z
    mov     ax, 04h
( @: |6 X7 N, ]3 w! {# U9 g) `    int     3      
* y, m" d, z; ~& t    cmp     al,4
- d8 s6 {1 o# m2 O% w& S1 Q    jnz     SoftICE_Detected$ V0 @( a2 N2 C5 ~! H" G2 E6 ~

, |! M9 @% A  G1 _) B' R___________________________________________________________________________. B. f  {2 ~( Z3 b: q. s
3 ^$ ?3 O* a/ }- c* I
Method 023 q! Y" Q1 L) [1 Q- R. ^: k, l
=========# c# [# ^; j4 |+ h* v

) f5 e- F# ^0 \  p7 eStill a method very much used (perhaps the most frequent one).  It is used% t4 R/ H: W5 v+ L+ D! q2 I8 s
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
, p0 _' O8 |, c0 C5 nor execute SoftICE commands...
! n! C- D3 x# r  Z6 G. H4 ^It is also used to crash SoftICE and to force it to execute any commands. {/ A. o" p4 g; k6 y# f
(HBOOT...) :-((  3 g6 U: w8 U, n8 F* @
/ t) {+ t! @. R
Here is a quick description:
* ^! K" H% f/ F6 D( E-AX = 0910h   (Display string in SIce windows)6 H0 ]! h, q: f4 X
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
# p; \9 q8 F& F- ]4 K-AX = 0912h   (Get breakpoint infos). E- p( p' @' H$ [. Q8 n$ ?
-AX = 0913h   (Set Sice breakpoints)8 a* E" o$ d2 m
-AX = 0914h   (Remove SIce breakoints)# [" O# J* R, r& L

: p! ~& r4 h: l1 w9 k! ~Each time you'll meet this trick, you'll see:. T* N* w; W; N9 ~1 M  G
-SI = 4647h
- [, \9 [, }5 l: V, k-DI = 4A4Dh! w6 y  r0 T9 ~
Which are the 'magic values' used by SoftIce.. J9 P2 t) Q* ?) L7 Z/ Q* }6 [
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.4 g5 _5 |+ _0 _3 P( `# m
% i1 X4 J4 |. C7 H9 J  d
Here is one example from the file "Haspinst.exe" which is the dongle HASP
, b4 B3 u6 s6 k/ {+ m5 I: Y0 hEnvelope utility use to protect DOS applications:
- U' f9 r" X6 l# |9 C$ C6 l/ @4 e3 Y3 Y  o6 ]$ \
  N9 y# A7 I' N  b" @
4C19:0095   MOV    AX,0911  ; execute command.
" i& }  N$ ]3 d4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
! K+ E$ I' [" F) f/ N$ q" P# F4C19:009A   MOV    SI,4647  ; 1st magic value.
. ^& x0 s' t- Z4C19:009D   MOV    DI,4A4D  ; 2nd magic value.% U! I4 w' {; C: k7 h3 ]' M9 ]
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)0 l( \, y6 e! O! U% x: t
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute) R# C, y, X8 R$ L
4C19:00A4   INC    CX
+ Y5 m( q# G4 M& b2 f4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute. t0 @8 O& z* l  E
4C19:00A8   JB     0095     ; 6 different commands.
# e  c9 Z7 C) s) B: E4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
& D9 ]$ x- `1 L- g4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
- K2 h$ |  p6 \3 \$ X8 U. M7 p: K
0 h, x* P$ {6 m; e; s7 H/ w, OThe program will execute 6 different SIce commands located at ds:dx, which
% o6 h2 n( o9 u# h) \2 `are: LDT, IDT, GDT, TSS, RS, and ...HBOOT." O1 u6 Q9 S; F6 h3 Y
+ L+ [: z& \' w! d4 z) ^4 Z
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.3 Z3 a5 P9 F' I9 B4 o* n8 ~4 \
___________________________________________________________________________
4 O9 u! R3 h& j% O+ g8 S8 H3 b" t0 A$ _5 |4 c: H7 K; `+ L

3 [- D* I5 V0 z' e+ ?  PMethod 03
/ V  w, o4 ?& R) w( _( E/ l  H=========. Z  x& C' T) q
, Q  Z8 n* s. V. K0 H6 C2 I5 z
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
; W, C1 G! x) _(API Get entry point)% n' J: l+ C, K$ v4 z7 z# J0 L* ]
        
) `; Z1 Z9 ?0 ^7 [& F+ W& x/ V' c5 G7 W4 W. @9 x" y; v
    xor     di,di
5 w# P( N& F( q5 E6 e    mov     es,di9 @8 t+ t! X8 L, k* M
    mov     ax, 1684h       ; |4 @6 T3 l* A* Z
    mov     bx, 0202h       ; VxD ID of winice1 Z" R& F, r; j% s/ C7 S
    int     2Fh. R) t! t! ~7 I# V9 c
    mov     ax, es          ; ES:DI -&gt; VxD API entry point$ G8 W. ~$ |: I
    add     ax, di
' y, r" P, J1 b( c* y0 m    test    ax,ax
# T5 o  n: ~1 c1 @" P) @) h7 }    jnz     SoftICE_Detected
& P: F7 V4 `% P  d0 d8 D3 C  w' y. a$ T
___________________________________________________________________________0 f6 ~& u/ N5 ^/ Z8 I$ B* I

, s0 D5 `- {6 H2 |4 T2 K/ y: ^! oMethod 04/ U; }  [* T  ~& h9 E
=========$ K5 I5 a# ]8 a6 S1 l8 J" n% B) p
! ]2 q% ]% g% D) O* U" M' q
Method identical to the preceding one except that it seeks the ID of SoftICE$ V( b$ N8 d3 c" E% r. H4 s! O
GFX VxD.: I6 n0 v3 j* m: |0 X4 ?1 M) W7 H
5 \! i7 f; N8 K5 P- W; M; Y
    xor     di,di
1 A. n. i4 T& t! P    mov     es,di4 I" @, d- N5 J1 c8 t
    mov     ax, 1684h       - c, y7 h# @; U* b+ e8 Y' m  F: y
    mov     bx, 7a5Fh       ; VxD ID of SIWVID
# ]% N4 m, G) D' }$ U: X( v& e    int     2fh
; n! G4 y% ?8 {& v$ a1 \( X0 J) P    mov     ax, es          ; ES:DI -&gt; VxD API entry point% \% [) M  L* X' Y( l& v' r/ z
    add     ax, di5 H* u! g& N* ^* p
    test    ax,ax
8 k. c" [$ Z% m/ h2 Y& e    jnz     SoftICE_Detected) T5 a- K8 `9 J

6 m- S. Z% X  z/ d; D5 ~__________________________________________________________________________
- K7 z, x& {* r0 [# v" r
, ]' O3 a, z& R2 E. A
6 h* u) B9 @3 a% g. M- dMethod 05; t7 l* `7 f5 }# a2 p
=========9 ]) ?+ u3 K4 h, `/ z9 v
4 {5 J1 {9 F3 p* @) j" B) M
Method seeking the 'magic number' 0F386h returned (in ax) by all system
. \/ \( U# \& Z# V  sdebugger. It calls the int 41h, function 4Fh." v+ f/ v: B; @  B
There are several alternatives.  - P' M: ?! X9 c9 x, x

# T$ @) R5 K& G' }5 ?8 A' _The following one is the simplest:
, j$ B9 T- T5 Q" t
" z6 c) f& n6 M% f4 H$ q    mov     ax,4fh( Y5 I, C2 G2 n1 w9 m/ u
    int     41h4 S- a% \& q. L' T8 Z, D. M3 k5 R
    cmp     ax, 0F386
5 j: V0 j  t/ R8 ^" p. g) O/ Q3 Y    jz      SoftICE_detected  B; `6 m& ^' Z8 p6 R

5 x( n1 `: I" q4 k) [  z, v4 o
% N+ T: U9 t; j+ q: L, ^Next method as well as the following one are 2 examples from Stone's - r  \+ L1 f( Q# d1 c6 ?( ?0 r
"stn-wid.zip" (www.cracking.net):
% ]. n* |# G4 l4 Q6 O8 o; K5 b$ m$ z/ d6 M2 h1 C
    mov     bx, cs
' n7 G/ n# i7 c, ]    lea     dx, int41handler21 T% F$ D+ ^" u5 D: y' s
    xchg    dx, es:[41h*4]$ Z$ Q  R: o( m* o. n
    xchg    bx, es:[41h*4+2]
* q' C9 ^/ [2 Y  l& ?    mov     ax,4fh
( F* H& D+ B/ Q2 P4 a% j    int     41h3 G! H5 K0 j3 K2 a% d6 A8 B
    xchg    dx, es:[41h*4]
. j' P5 G6 H3 M" Z  ^) r% j    xchg    bx, es:[41h*4+2]. L9 U6 N6 q6 R& x9 [
    cmp     ax, 0f386h
2 b% [; G* I* U. h( e; [) C    jz      SoftICE_detected8 H4 ?  B) q+ j: |

& j$ p/ J$ E. a" R/ k& ~% dint41handler2 PROC3 H8 t0 Y: h. r1 C/ J. H8 w) f
    iret
& K( n; ~1 U+ cint41handler2 ENDP( d0 `/ M2 m; b9 z1 x3 B7 E
1 a1 _  W6 f! G6 v

) }- }9 ~  w& ?2 ?# s_________________________________________________________________________
8 T3 f1 H2 m9 Y( V. H
: N) d, L1 q' q1 H: {: F7 k
# m3 p  x# k) i+ W" iMethod 06: X+ @6 Z2 h3 j; v# P) U
=========
5 p& i* d) ~4 o/ \  |& U4 V0 H+ z% B2 \4 O/ S* F5 z
4 O) T  S! Y. d  w' i( L
2nd method similar to the preceding one but more difficult to detect:" r) L6 x* P' ]8 c" {2 r- J  S

1 w% _" g( Z- }, c( ^6 l, N! Q; i# S9 K! |0 \
int41handler PROC0 Q) l" q$ y1 B* P; G2 k, Y7 G/ L& C  z
    mov     cl,al/ f5 f& J2 A/ e1 ]' s& `8 u
    iret
/ r6 i4 A  l5 w3 x+ u# L7 v0 q5 wint41handler ENDP
; G- V9 t/ y% F# T5 d. ]+ m' x) v% ]5 m/ P5 v) G' ~' _- F

( [$ p- j$ g8 h# X2 S' S& {    xor     ax,ax
: h1 n& k2 j1 R$ I7 ~    mov     es,ax5 T! ^3 T3 z: o+ i2 X
    mov     bx, cs
# t6 T, [/ }8 r* v: w% ~- }0 |6 g    lea     dx, int41handler' S- ?5 j% b/ l: Y. P& k
    xchg    dx, es:[41h*4]
3 O6 w2 e7 q7 X( q' d7 e6 _: N    xchg    bx, es:[41h*4+2]! ]% W, h1 r( _. ?. z
    in      al, 40h. k( p! }$ T& A$ }
    xor     cx,cx
+ ?  S- t+ V% q3 s& Y1 G6 j% l    int     41h
, G: _8 q0 o  O% U7 c* a! p, b' N    xchg    dx, es:[41h*4]1 M( u5 H4 t' \! x" b5 ~6 m* j
    xchg    bx, es:[41h*4+2]
) p( f# U; Q* n7 J1 U    cmp     cl,al) F$ P0 D4 ^3 {
    jnz     SoftICE_detected
% q/ w  Q6 r: D5 X0 p/ T# I; p
& G6 h5 D  r% B. H1 q8 Q' d: y  __________________________________________________________________________' h% a" ]6 t2 R  t

0 D( M3 A) M# ]$ j* sMethod 07
- {9 g( q6 e+ K=========. z) F' X3 K- t$ V# n6 B" U
' n( D' O1 Z: F8 w: q% v* M4 m% g- w
Method of detection of the WinICE handler in the int68h (V86)
0 U0 f# G5 J. t, w+ q; K4 l4 ]
; f& A. m* h( f8 [0 Y) X    mov     ah,43h& {' u. ]2 |6 {0 ]
    int     68h
  O  P# S1 f5 t! O    cmp     ax,0F386h
  t- T* W& ?# ?" u- D1 H    jz      SoftICE_Detected. q' r2 Y/ C6 O! {
5 j$ h+ y& s2 l' u: `7 x
7 a/ W2 N) k' Q* Q
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
5 f* p( p" |# p" o& P) Q   app like this:- p6 ~* r9 x% q1 F0 F+ t

! P. x3 \) X# d4 l   BPX exec_int if ax==685 a) V  x8 Y% x5 K
   (function called is located at byte ptr [ebp+1Dh] and client eip is
' \4 }/ Y( _0 D' K, w6 @   located at [ebp+48h] for 32Bit apps)8 ?4 |* Q3 c4 h( n6 s( y5 g! k2 }
__________________________________________________________________________
. L2 w! h6 ?* `/ i
2 V; a7 t# Q0 P. Z
4 q$ [$ A! F1 F! Z; a; W% u  i$ JMethod 08: k9 U8 M0 _! e! E: \) B
=========
$ H* n7 W5 r$ U7 I/ V, H
* ^, y) X/ v: A5 {+ _4 C+ uIt is not a method of detection of SoftICE but a possibility to crash the
( y; h( d) p, j! C. G( g0 m1 Hsystem by intercepting int 01h and int 03h and redirecting them to another
! A) R' w# y6 p( X8 u+ o+ O! froutine.0 x# u! ~0 J6 w( m8 j
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
( l  [( Y" m; K: `- `to the new routine to execute (hangs computer...)
$ e# `0 S+ N" }( C. l3 j5 D
! V1 E- S& k  h# W    mov     ah, 25h
" H( e6 g3 q6 D! p    mov     al, Int_Number (01h or 03h)  c6 n( j. s7 I
    mov     dx, offset New_Int_Routine
% H- P3 D7 X) O0 d! o/ K    int     21h+ l/ Y* K# w+ {8 ?4 [
+ v+ }  \& g3 ^
__________________________________________________________________________
& \' ]' o5 K. \
1 e9 B! `4 S( R! f& J# p# s! b8 WMethod 09
# B8 p0 y2 U& |9 [' W$ m=========& L# }8 [" c4 X7 E- W2 C

& x  l/ @3 ~& G1 e" W# R! vThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
  \+ J/ f$ \2 Zperformed in ring0 (VxD or a ring3 app using the VxdCall).$ {3 @2 H0 G  y/ n
The Get_DDB service is used to determine whether or not a VxD is installed0 _# F0 a8 h0 u" K) W* @% M1 C
for the specified device and returns a Device Description Block (in ecx) for
0 q" K7 h* v! a3 U" i8 hthat device if it is installed.5 A  m! Z2 M# Q3 a) _$ ~
4 K4 a# \" m* i# w7 }$ |- a4 |3 M
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID; j, I+ ]+ ~8 |# o2 P& A: G& b* ?. n
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
  g  s  u- N, W7 f   VMMCall Get_DDB
! j( ?0 J( t4 D( U1 X! k   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
4 j$ _. f7 x9 n4 F' L( i5 a5 X" W3 @7 o
Note as well that you can easily detect this method with SoftICE:
& \) Z9 x& A4 C! E. r6 q" j" E   bpx Get_DDB if ax==0202 || ax==7a5fh
$ V8 P2 M+ z- ^* M9 r  B- E7 x! s& S! ?
__________________________________________________________________________' L4 z  y( S& ]1 u

% v: e! _4 y1 |9 k6 K2 T( N6 LMethod 10
- r# L0 Y( B( i  |# ?; L0 F=========
! N; K) ~, S; d
9 W0 u, n9 c# `; G=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with1 A* I( U5 q8 R; p) A
  SoftICE while the option is enable!!% g4 [1 r- b, w& A# T; B

; J8 g2 }$ s& P9 n3 ]+ Z, C2 NThis trick is very efficient:$ y; F4 V- M- `! p  Z4 o
by checking the Debug Registers, you can detect if SoftICE is loaded
) V6 p9 D# K0 g(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
# b# G# }* X$ o+ E% ?6 nthere are some memory breakpoints set (dr0 to dr3) simply by reading their
9 G" C. v8 s3 ?' r7 j" ?$ N) C$ Zvalue (in ring0 only). Values can be manipulated and or changed as well
2 M/ {" d9 v* `3 a, g(clearing BPMs for instance)! E$ L, q  B, c* j7 l4 V
4 r6 ]  v5 k) @( \3 w1 C
__________________________________________________________________________
7 i2 c+ M4 {8 K& I
5 g/ C; e/ C) DMethod 11
( ]" ~* ?, u. q5 }=========
6 e) Q; u! ^9 l  H1 z# f& r
( ~" P8 _" G- c2 F3 U6 YThis method is most known as 'MeltICE' because it has been freely distributed
  j9 Q5 k7 |) w% s! Bvia www.winfiles.com. However it was first used by NuMega people to allow
5 H2 U3 _3 ?/ _9 z2 y% ]Symbol Loader to check if SoftICE was active or not (the code is located; t, Y6 Y7 ^' [1 H( L+ `
inside nmtrans.dll).) D2 k- V! X6 H* d2 p

6 @- N$ w: d  z. VThe way it works is very simple:
: i2 c& ]2 Y$ S$ bIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
# J( G6 x5 j+ f& b4 t0 |WinNT) with the CreateFileA API.1 |8 q% O7 r9 A4 _' X& U& L$ n

4 o' D9 g. q- y8 p1 W1 c8 q& Y6 HHere is a sample (checking for 'SICE'):  y+ W9 h  e8 H0 {+ K
6 Y6 c; y) k! Q% K3 w  c; ]
BOOL IsSoftIce95Loaded()
0 a8 `" C4 m7 h! P& V{
- Y' Y# T8 l1 C   HANDLE hFile;  
6 {5 D. Q* K# a' s   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
3 E3 W' [9 |9 U- ~                      FILE_SHARE_READ | FILE_SHARE_WRITE,8 U& N  R" m/ R) a6 n+ A
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);. y; R" q! c9 m2 L
   if( hFile != INVALID_HANDLE_VALUE )
8 I3 F  s: ?# d+ x& L. w- R* r   {
9 D$ D2 s, ?1 x( s      CloseHandle(hFile);6 u- W( m7 L1 i  Q$ o$ f2 K
      return TRUE;
# \+ J5 A$ {7 J# ^- R+ ?" l. V   }0 r  d0 ?! S; }% {; ]0 P
   return FALSE;8 A, F  U8 W( S* \
}
8 D  Z" _  V. h& ]3 J; ^+ k4 M# ?% ^$ J% o, V
Although this trick calls the CreateFileA function, don't even expect to be
0 S1 e  q& d) X+ @8 d# V5 qable to intercept it by installing a IFS hook: it will not work, no way!; o- g) B8 o, p$ E+ {, y  F5 t  A
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
6 U. r) {/ ^" J* _service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
3 m0 \! s% Y: M* }; @) B. B4 wand then browse the DDB list until it find the VxD and its DDB_Control_Proc
5 i' f" P+ Q5 z6 Hfield.) X& l! E; l1 {; |
In fact, its purpose is not to load/unload VxDs but only to send a
' x, U' W" K5 R6 c5 N# t( nW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
. f5 O/ p" o+ v$ V! x, n& D: `2 gto the VxD Control_Dispatch proc (how the hell a shareware soft could try5 I0 {$ G, H& e9 ]( w* p5 [- C* k
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
0 |5 ^- l7 J' M- eIf the VxD is loaded, it will always clear eax and the Carry flag to allow
4 w: R* E7 ^+ X2 c/ cits handle to be opened and then, will be detected.
% r% G' ?& H2 C* T% D7 pYou can check that simply by hooking Winice.exe control proc entry point
* \3 d! B% [1 pwhile running MeltICE.! e5 L( ^2 p, u/ P3 f8 q5 R1 y  F. W
! R# v% ~8 J! B2 @# J  N0 H7 e$ y1 |

$ c8 G8 w+ P" t  00401067:  push      00402025    ; \\.\SICE7 d+ C  J* T) c& ~1 D/ ~* k
  0040106C:  call      CreateFileA
. d0 y0 [/ {/ j1 [  d; |, a* o  00401071:  cmp       eax,-001' c8 D& b# f2 H/ S+ b2 f+ B# z4 z7 f
  00401074:  je        00401091: Z6 d7 B, Z( a

$ ?8 c1 Z8 p$ V6 N, m2 D- i  a6 _4 q/ s. l" }' W" F
There could be hundreds of BPX you could use to detect this trick.' i7 z$ |1 F0 _7 V4 i
-The most classical one is:
. R4 l' }  I3 P7 m  i7 a' s* E2 [  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
/ \6 l  s$ Z% V5 t2 F. A+ ~$ V, L) @    *(esp-&gt;4+4)=='NTIC'
  o; @/ l, O1 c/ v/ X5 m% ]
4 X: _& N# @% G  _! u2 s: f-The most exotic ones (could be very slooooow :-(; i0 i# x/ i5 J3 M; g0 i% O* _
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
" e) i3 [% q: D( n' s     ;will break 3 times :-(
# P! b  I) F% P# _% M( Q' F5 A9 e$ C  g/ e; ^  I5 w- a
-or (a bit) faster: + V7 l8 ?0 I. p
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV'): I; w3 z' O2 v- x" y, h# z! J" S
# n7 f7 V% z6 Y8 j
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  : K0 T* C/ o5 o. |( L; n$ E
     ;will break 3 times :-(
8 q! q0 g  D  U( u5 @! S5 D  I0 g0 U, N9 W" Y
-Much faster:  ?+ ^+ b$ X- n
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'3 X, m- d, a+ }7 t' U
& w! h/ C. v& Q9 X6 A, f7 U* Y
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
: W* q$ y. o9 _function to do the same job:  U5 o; H. J. B2 ^6 i8 `6 K

" @: x: J7 x' m- {, R- Y$ c   push    00                        ; OF_READ
6 a' C8 _2 f1 P) T/ d   mov     eax,[00656634]            ; '\\.\SICE',0
! r* R- x6 Z! q& m9 F   push    eax$ E3 L3 @/ e* b3 o/ L
   call    KERNEL32!_lopen
$ ^# v/ U( X! ^) Y, k0 f! I& h   inc     eax9 g3 J' O8 I: t( Y& u- i
   jnz     00650589                  ; detected
$ k; Z2 R% a7 ?: p; P& {   push    00                        ; OF_READ
$ s, f' {4 u4 Q( M   mov     eax,[00656638]            ; '\\.\SICE': Z. v. Q# u* E/ y. V, q7 m
   push    eax3 v+ U, v2 R0 c5 r
   call    KERNEL32!_lopen  s7 |1 R. |) ^
   inc     eax
' _! W3 J/ \8 {- n1 N$ T2 z   jz      006505ae                  ; not detected' Q# L3 K! f: S) a* D

/ Y$ n3 b8 h# t
# F; n$ c. R8 r3 f$ ]__________________________________________________________________________
% r2 N6 W9 }* ?3 N, i5 Q+ C+ E' k
Method 12* i! Q2 Y) B# ^- Z! L( P
=========) q5 C: o8 p! y6 G+ C3 L1 f, H$ U

  s: V! u# A( c$ ]% cThis trick is similar to int41h/4fh Debugger installation check (code 05
8 `8 J# T# @: P: r6 M3 }9 F&amp; 06) but very limited because it's only available for Win95/98 (not NT); c/ Q  W  ^3 ^3 n- t0 [7 n, A6 p
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
0 x: u$ c2 z/ v* H" ^3 W# ~" G) w3 ^" c- s+ g: E1 @) j, [8 e
   push  0000004fh         ; function 4fh
5 ?5 s! U. Z1 \" I4 j5 P2 n   push  002a002ah         ; high word specifies which VxD (VWIN32)
, v0 ^: D  A8 d+ L  u% K) N. K                           ; low word specifies which service, L8 B/ c; }9 ?
                             (VWIN32_Int41Dispatch)
$ i# }4 s' `, p: ^/ g. }   call  Kernel32!ORD_001  ; VxdCall/ V4 i* \% R" n+ m* q9 H& D) M
   cmp   ax, 0f386h        ; magic number returned by system debuggers! Q6 H; m4 L/ }- o& }- ~+ K
   jz    SoftICE_detected8 @6 ]% }) m6 z

# j. s* M; F# N7 C* d- SHere again, several ways to detect it:$ g1 P4 ]" R" Q9 z+ d0 T
# c/ N7 Z# m. I# ^
    BPINT 41 if ax==4f
1 C0 c7 q. B! ?9 ]
: P2 d1 r" C8 F7 b2 }' _2 ~: q2 M    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one! Y8 g4 d$ L( |' P8 u6 o

' b3 \9 X' r5 K    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
# p2 K1 U" K' ~4 j( Y* |( M. T- h# `- \" R  c1 F& E9 b
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
* u5 e; C# I. W$ V) ~4 {. v% ]$ k" }' W6 h& |
__________________________________________________________________________4 G$ g; \; r! t) t8 U, R
/ R* A% ?3 n* S: T6 L% w
Method 13: f0 g& O/ }9 g$ T2 T
=========
: y6 R: g& `  v" \: j) w
/ v: M( _% f" fNot a real method of detection, but a good way to know if SoftICE is
7 a3 I3 ~3 n3 [6 g' ~installed on a computer and to locate its installation directory.  K4 @# R. W* r1 H1 o
It is used by few softs which access the following registry keys (usually #2) :
# f  n+ F* ]* w$ t, N8 \' M* O
0 j9 P3 ^6 f, r6 H5 n$ Y-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion& K  T7 U2 O* r0 F8 s, z
\Uninstall\SoftICE
0 D/ ]" f/ S# O-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
2 G* N! g. n! {3 @7 s-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion, u1 e. s% k% H% Z1 t
\App Paths\Loader32.Exe
1 J: L. F% \' J5 o7 \! i$ L1 N* z  x1 V
: E  G$ A, I* z
Note that some nasty apps could then erase all files from SoftICE directory
: }: y, q" V, w( w(I faced that once :-(! j' T4 ?4 y  X/ I

/ O- l2 w! }6 ~4 R& pUseful breakpoint to detect it:
: T' S2 k$ [2 p2 a' f" C7 z' x, g9 s, Q
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'# ~: B0 Q4 a4 m1 W" x7 d' x- V

- l! T' {2 V' ?9 W__________________________________________________________________________6 g7 \6 h) b# _4 ^9 E# w

$ a% ^3 g+ q7 S! a; p$ P
% L  P* J( j& X7 {7 |; RMethod 14 3 X% Y$ p$ o! _' Y
=========
3 C# t  |! M  b! D& E. g/ ~. P
5 m. p- e  ?4 f, m2 J. i1 d  w  t% `A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose4 a4 Z9 `* @1 N4 m8 ~
is to determines whether a debugger is running on your system (ring0 only).8 m5 w3 _! o' ^% |
7 b$ l) ?0 a3 g) o/ ?
   VMMCall Test_Debug_Installed+ K# V: ]0 U  C0 M9 C5 `* E
   je      not_installed$ l5 N$ \7 @/ n
8 e: `, a2 ~& k% e- r/ Z9 p
This service just checks a flag.
- P6 P) f. \9 i, D</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-7-28 07:45

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表