About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>" C/ B7 l7 \8 Y8 p
<TBODY>7 X9 M6 V# n: h! ^
<TR>
$ u3 g2 A* P. x8 }" \# R" S; y. G; J<TD><PRE>Method 01
! r: i0 ~; v, i) ?8 E0 R2 L! T4 U=========
2 u. W9 f- M3 l: H, i$ y9 c, d4 t
This method of detection of SoftICE (as well as the following one) is. U+ W1 F; k* A  t
used by the majority of packers/encryptors found on Internet.
. X/ A  F9 m/ k$ C  x+ D) Y- O+ E* eIt seeks the signature of BoundsChecker in SoftICE& ?( g/ ~7 ]0 z) L) L
% P7 b% |) T) \! \
    mov     ebp, 04243484Bh        ; 'BCHK') S( C3 p0 b" y
    mov     ax, 04h
) D0 |' C0 m5 |, e    int     3       . u" F! J- u3 J
    cmp     al,4  f1 l# M% Z4 V& I' I
    jnz     SoftICE_Detected/ L, @- w4 N. _" [5 p8 j

  {% g/ X! K* V+ a! r___________________________________________________________________________
( x3 }; ?6 V, A) J% i# @8 Q0 J1 u* R5 q' V) Q8 g
Method 02  ?3 e' `$ W; w) f0 V
=========
2 m/ @; a6 m9 C; ?8 B
! {- w3 ?5 C7 E6 E. I" F" [6 }Still a method very much used (perhaps the most frequent one).  It is used
* X/ T+ z, {* A  {' Bto get SoftICE 'Back Door commands' which gives infos on Breakpoints,: I; e) \; t( ?( V" G" S  o) W
or execute SoftICE commands...1 r1 E: m1 v3 T/ E: J2 P5 J
It is also used to crash SoftICE and to force it to execute any commands
" P, u( e/ {# w7 ~# c! ](HBOOT...) :-((  & q! j' r/ d: w: n' B8 m+ K7 `1 y
0 ]4 ]4 w0 t4 }! |3 S9 P+ |5 y8 g
Here is a quick description:
% `  T( N4 {0 }" H' V) E: s-AX = 0910h   (Display string in SIce windows)/ ~* e" `8 g. T% L
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)# Z0 C. _- t$ i3 _$ H
-AX = 0912h   (Get breakpoint infos)" _5 T7 Y9 z6 E" T8 }4 Q: K
-AX = 0913h   (Set Sice breakpoints)
$ A& h6 o9 U6 w+ Q# {2 q-AX = 0914h   (Remove SIce breakoints)
: G  n5 P: F3 g( I/ w9 x8 I2 Y9 r; t! o% d7 ?
Each time you'll meet this trick, you'll see:
* `3 O- x( |9 d; @2 N-SI = 4647h/ F# r9 d( r1 F+ M0 q8 e
-DI = 4A4Dh
& S: ]+ u/ Z8 ^6 ~1 g' p; AWhich are the 'magic values' used by SoftIce.) p6 g) p  N6 `% h+ @% R
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
4 j  }. V/ y: J( i' |. J3 P5 t, n+ h7 V7 A* t- v
Here is one example from the file "Haspinst.exe" which is the dongle HASP
5 r9 F; w3 q1 @& ]$ lEnvelope utility use to protect DOS applications:
+ R; ?; R: m0 D: L  M0 M+ ?2 E, W# C6 ]" N
' ^' R" t" }# T5 ^/ t
4C19:0095   MOV    AX,0911  ; execute command.
& y% u, g# g5 g5 h6 }  W4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
- n- \/ F. C3 {& s8 c4C19:009A   MOV    SI,4647  ; 1st magic value.
! }* ~. R7 v. k7 l+ D+ h, w% v4C19:009D   MOV    DI,4A4D  ; 2nd magic value./ P$ H; v( x5 E, d+ r1 c
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
; {& e& [5 c7 Y6 d. g4 n6 S& d4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
& d- G& X  @* [; n% I1 y$ D. a4C19:00A4   INC    CX
# [4 w3 z: |9 `/ O4 L( |4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute7 X0 V! e7 t4 c9 B- }
4C19:00A8   JB     0095     ; 6 different commands.
( d( e% N- v$ W# q& ]4C19:00AA   JMP    0002     ; Bad_Guy jmp back.- G4 N# Y/ A( F0 g+ }2 V$ V6 V
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
: n" y( s6 K' C* @& j$ K! z& ^8 ?0 l1 a) t+ s9 S7 M4 c" f- ?+ }
The program will execute 6 different SIce commands located at ds:dx, which
# g' ]) h3 t2 O; |& ?# Hare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
+ i) d  }2 \- @! ?4 q9 k. Y6 @0 g- g% o% L% e" C
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
) Y5 b7 j  B# z8 u& j, ]! c( x___________________________________________________________________________' r. ?1 C( Q& [+ `
* ~' N$ |7 T) y) n* k! X
, r" R* f' ^" R( b& i4 y/ x
Method 037 R. _/ P6 a/ v; o
=========' t( v8 k" y7 A1 M) G. M4 C

: ~7 E# o8 V* s# YLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
% `, ^7 }7 m( _+ u6 T(API Get entry point)
/ i" }  }1 r9 p. m" @6 P! J& _        
0 a4 T1 G0 m5 P0 v% i
2 G6 x& [" E4 G" C: h    xor     di,di3 `, K" D3 [0 d2 N8 v: X( {
    mov     es,di
+ L; \9 {* E% [. c  u5 F& V  L# d    mov     ax, 1684h       # t5 B5 d) F) d
    mov     bx, 0202h       ; VxD ID of winice
, N+ S; h; u: j& u7 `; A4 V, `, k2 F    int     2Fh
9 C3 h0 H) Q- r' j+ f% s! R" _    mov     ax, es          ; ES:DI -&gt; VxD API entry point7 l) H. p. a  L5 g* I9 i2 Q9 P$ p
    add     ax, di2 e5 Y- Z2 A  P7 k
    test    ax,ax
* O7 |3 o; k5 Z) r" h4 n    jnz     SoftICE_Detected
5 Q1 `2 A5 Z+ h0 Y9 w
. f+ b' H$ o; f. K! j% F0 ~___________________________________________________________________________
8 F# P; k  g! C  A& g& r5 ^# ^( z" H9 I8 I  v! _5 s0 r% k
Method 04
3 p* O! v& y9 j4 D6 H# B  I- N=========
% i" G; o- m" H5 Q* P4 i4 z7 j$ {# m  Y3 R
Method identical to the preceding one except that it seeks the ID of SoftICE4 |; m/ Y1 ?4 y" f5 u
GFX VxD.
; t/ }" V2 f8 P  L
1 x- R1 @/ T) X4 G1 O% o1 C' T- N    xor     di,di
" O+ l* X: [+ j5 F- p1 Q" z    mov     es,di! |1 o/ O) _0 c
    mov     ax, 1684h       / a# S& G1 t8 w" f0 s9 p) R% g
    mov     bx, 7a5Fh       ; VxD ID of SIWVID" C: f7 Z! l  [9 c2 y
    int     2fh
/ C5 ?. ^  L$ N; V+ d* y: d! k    mov     ax, es          ; ES:DI -&gt; VxD API entry point
/ i5 h; ?% y% y0 u2 f6 K, Z  x( Q( }    add     ax, di9 X3 e" F$ }- L& {  }
    test    ax,ax
$ \( X' @' Q0 v, _) |8 S+ b    jnz     SoftICE_Detected% E0 C% P( m, A" m# r! P

; m3 o# Y" s7 p* i. D' T__________________________________________________________________________
; d$ y0 `& ]- p9 ?2 `$ W( a# h3 z, D2 f0 I5 D/ A
. m8 \3 d) e4 d: G
Method 055 E  T2 K8 z" i& ?$ E6 M2 |" I$ F
=========
; Y7 O; T% ?: ?+ L
) p& c' {7 {5 h# zMethod seeking the 'magic number' 0F386h returned (in ax) by all system
  k- W9 }5 r3 l  Q7 d7 {debugger. It calls the int 41h, function 4Fh.
* P1 S7 G: q: \" f" ~% H" v) C3 j- iThere are several alternatives.  
! |2 |- ?* L+ N* d) I3 E- Z8 I! G9 O# F" K9 S! ]
The following one is the simplest:
) h2 W/ j8 A7 }
6 S$ `9 b$ w6 u$ Q0 Y9 {7 d, L    mov     ax,4fh6 w; }( u: i0 |8 o: Q9 |- S
    int     41h+ c) q+ l: ~6 e! \" P
    cmp     ax, 0F386
  L- i. d4 w) S; h! |6 U    jz      SoftICE_detected
9 [7 v" g) V+ v! M( U% d/ i+ I* ^4 R; W8 g6 M8 j

. A6 |4 c, b- \1 d$ eNext method as well as the following one are 2 examples from Stone's 2 n5 f4 a  y- K
"stn-wid.zip" (www.cracking.net):
& I+ T# o8 ?9 A+ E, _6 n3 k3 p/ E" I+ n# ]* j. u! W& I
    mov     bx, cs
3 V6 n: f) q5 |. w$ |5 t    lea     dx, int41handler2
% `0 |9 o( c7 z+ W7 T+ ^- x    xchg    dx, es:[41h*4]$ m* K  ~/ f, c
    xchg    bx, es:[41h*4+2]5 N; Q/ B; y7 B7 d7 u
    mov     ax,4fh
& \7 ~3 f" M% C0 O. T: C% e    int     41h) R0 ]0 f, X, {& f% B# K7 Y
    xchg    dx, es:[41h*4]
: A: ]/ n$ ?( k# {- w" ]  }8 {    xchg    bx, es:[41h*4+2]+ O4 \, G- J  O
    cmp     ax, 0f386h, V5 s6 I/ l* C5 t) ^/ U* r0 x" l
    jz      SoftICE_detected5 ?7 B* w, g: T8 T7 p$ E

! U. G7 {, U% h1 ^) |/ u8 nint41handler2 PROC
) j$ p7 a3 f# ~& A" P3 ~9 U( D    iret
5 G4 O6 s1 B4 i0 c7 a9 P$ P. m" lint41handler2 ENDP: {5 B- e! @# V: ^

8 q* p7 V0 a7 u/ x5 a2 C/ r( Q& _, d5 R( {# \
_________________________________________________________________________
* ~7 G4 N5 d' W1 e. u# f" [5 q0 q2 |) z; p8 T* L/ O0 K

% J/ {& ?% |5 R( FMethod 06
6 K% Z7 N2 S4 c. j$ D$ T=========# U8 o! G. e" I* u/ J2 V
  f, X7 {6 L1 I9 G# J' `
& |- m. u7 W* O8 S
2nd method similar to the preceding one but more difficult to detect:
0 M  E3 [7 J. s7 B9 T/ P. m8 }% Z9 o% H0 h
; G% `8 A, k0 a+ T2 j) x
int41handler PROC$ D, e0 d& X2 Q) V+ c$ k
    mov     cl,al5 O9 N8 N8 {* d8 i/ |& O
    iret3 \: o  A* a  {6 ?$ L4 z1 J
int41handler ENDP6 Z5 `3 ^  H& Z' b
5 B- X5 Y# @! `! I4 m% b5 `

7 D, c/ ~  q) w* J$ K+ z% H0 o' y    xor     ax,ax
* C0 W8 K: O% G2 J8 r    mov     es,ax' F- o& z. V3 j; \
    mov     bx, cs& a: ]9 M0 \2 ~/ r9 P( l0 v+ ^
    lea     dx, int41handler" Q& m4 ~! S9 ]1 X" v9 J
    xchg    dx, es:[41h*4]1 w9 U0 k* Y8 a& s- C
    xchg    bx, es:[41h*4+2]) ^  p  S; e0 W! d( S4 S$ S
    in      al, 40h
9 _" N0 b/ Y# l. j8 P0 H* M    xor     cx,cx
6 m" }# _3 r1 ]- M    int     41h/ x" ?1 h; ], d7 n
    xchg    dx, es:[41h*4]+ M# B. T8 L& ^6 t; V4 u
    xchg    bx, es:[41h*4+2]# o4 {0 `3 c; p3 _; n3 U! E) K0 R1 W
    cmp     cl,al
0 n/ v6 a! Q+ s- Q& U! x. \    jnz     SoftICE_detected6 z/ i5 L$ A6 `1 o/ B
. j( M" B, u9 z( y2 H( Y2 O" Q
_________________________________________________________________________! \  O1 D7 G6 \: A5 Z/ @

5 j- \7 r! g& J' _2 f& hMethod 07) r+ W0 |: @7 Q3 ?( n% E0 n
=========# u) K" w1 I! f. e& ?

- G- q% w" j- v; r  RMethod of detection of the WinICE handler in the int68h (V86)
6 c% K) H, |$ u- S9 E/ C% E* K3 R6 }% C3 ?! P% F
    mov     ah,43h- e1 O/ q# {0 K* i
    int     68h
& s2 h( t2 w/ n5 ]4 I& E    cmp     ax,0F386h
3 `' c; @' e( k/ c; ~    jz      SoftICE_Detected( {& u% M, f# ]" P! ]
. y/ Q. N5 n  q! G" V6 a8 B. g9 v
! e5 D: o. P. n3 s; E0 v. h
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
0 b9 p: T( a9 k9 `8 k6 Q+ _   app like this:
- ]1 n: f4 A! k1 v* t7 i; G2 v8 m1 Z) w0 ~- g3 z7 `( q0 k
   BPX exec_int if ax==68
* J8 }: K2 j0 H   (function called is located at byte ptr [ebp+1Dh] and client eip is- Z( v$ v" {, {3 X
   located at [ebp+48h] for 32Bit apps)5 `- s% X7 a9 T/ g9 q. {
__________________________________________________________________________
+ i2 }7 y& v& S6 i2 P: N* f, s" g& z3 K

3 T+ Q. V; v( b) X: N1 o8 X) bMethod 08& X  p; B7 J/ {5 \4 ^; K. h+ u
=========
4 B1 ]. e9 z) o5 h
4 y9 ]2 T5 S( p4 r6 [' |( M; ZIt is not a method of detection of SoftICE but a possibility to crash the
1 e4 z  t. I4 k/ T2 V% ^system by intercepting int 01h and int 03h and redirecting them to another6 |/ {- j8 s; A
routine.( j7 @9 U" u% r. n! n
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
/ k7 q. }7 ^" R' P* Q: [to the new routine to execute (hangs computer...)7 T0 |1 b9 r9 g" G1 m& ]% x- o& q) Z
. x  y8 \( }, J) t4 i, S$ |. x
    mov     ah, 25h
9 h6 q: V3 `# K: O3 B* ?    mov     al, Int_Number (01h or 03h)
. Z9 ?  }+ d/ Y/ [. h0 s( |    mov     dx, offset New_Int_Routine
) ]7 ]& _3 A. R0 j    int     21h
+ U' K0 v: M+ e: \# a# F5 l% v6 Q5 g
__________________________________________________________________________
- Z% d% ~$ R& Y& h+ Z7 E: g& B9 A( N2 }  b
Method 09
% h% Z- X( h# F5 A2 p1 U" c& w=========2 l8 W6 F( ^2 [9 M/ o  q) G5 c) a
, \8 A* [, ]! T' y! A" M9 E
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
$ L# m$ j. g7 ^+ f% fperformed in ring0 (VxD or a ring3 app using the VxdCall).
7 r/ h# d+ [$ g% h: F1 A- u4 ^The Get_DDB service is used to determine whether or not a VxD is installed" d, K4 a" U; m  J' [: D
for the specified device and returns a Device Description Block (in ecx) for
2 _$ A6 H1 L; R- D7 m. othat device if it is installed.
7 @8 K  \1 p' N# C
1 y8 L/ `/ c/ r/ r   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
2 [( p$ p- G" d; r6 f' h* D   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)& Y& i5 F# j1 {% q: d
   VMMCall Get_DDB1 K# k+ u* ]$ k. k$ v5 D' \8 w
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
6 F; B+ D! W  A9 i$ L) o4 }$ _$ s
) n1 `/ Y% E- M* o0 _; gNote as well that you can easily detect this method with SoftICE:
: M2 w3 s- z' ]- j# D" A5 @   bpx Get_DDB if ax==0202 || ax==7a5fh
* s# C; L- ?4 k
! A. K: z) H$ B8 t0 `5 Q: r__________________________________________________________________________0 W& C. w- Y/ E" o1 w

6 n9 W" J# |% v7 h  S0 w- a9 M  x) wMethod 10
6 s7 O, ?: Y2 l8 K  i( c" W=========
" h! I( Z4 u8 v. m. l8 d( ^0 `, v7 W' T$ _0 N
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
! K9 _# T6 C: h  SoftICE while the option is enable!!
: z& b; S* M. ^# i: J9 a; [& X: d  s4 C' f% N1 L. c2 r& ~
This trick is very efficient:+ \5 ^) |; h$ B6 [4 m
by checking the Debug Registers, you can detect if SoftICE is loaded3 ]! x/ }% U: G! a# l/ w
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
- G! b/ P) v+ u; Fthere are some memory breakpoints set (dr0 to dr3) simply by reading their
+ \2 L1 J' H" H1 z" B6 @value (in ring0 only). Values can be manipulated and or changed as well
  z: P4 X* S( {) z(clearing BPMs for instance)
: g6 J2 p& A" q4 p& I- Q* O# F$ P7 [) w
__________________________________________________________________________
$ b& g" U8 \2 ~& O( [
' G3 D: p- K/ Y" n3 O9 ?; P9 i" GMethod 11/ Z# |+ `( W1 J6 k9 S
=========/ z' T) }% T3 _; r- C6 i

) [. ^  {: {0 @7 k2 Q7 {This method is most known as 'MeltICE' because it has been freely distributed
2 U" D# |# g( c4 uvia www.winfiles.com. However it was first used by NuMega people to allow
4 Y7 v! J' ^1 OSymbol Loader to check if SoftICE was active or not (the code is located) _/ e4 Y- r4 g  H6 g1 d
inside nmtrans.dll).
9 s' k- D. d4 `/ _* L: q
: S/ z7 F2 w8 {3 I, L8 S' YThe way it works is very simple:  Y/ ^! K1 t& O  L
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for" A9 F) K" n4 v  u* e
WinNT) with the CreateFileA API.3 A" c9 ?% e6 I, l# p  X
- q# z# \! O8 h' f4 z0 G5 v
Here is a sample (checking for 'SICE'):
$ B5 r: Y5 k# O$ {: A. E; ^( M: n7 ?. _) I
BOOL IsSoftIce95Loaded()
# d' r$ S# [- }& }% h$ H{1 z3 w. |; u1 x( Y6 l* a
   HANDLE hFile;  
: `0 |8 G" V5 d# R4 o$ c% f1 `   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,; a$ E- |$ J' [% o6 K, X
                      FILE_SHARE_READ | FILE_SHARE_WRITE,
1 x, |% O6 I1 `# h* f                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);- M' d/ M: e; M# p& ]5 U7 N: |
   if( hFile != INVALID_HANDLE_VALUE )
& i- N' ?4 M4 Z( Y   {, w& d; E% |, x: }1 j; P1 Q6 W
      CloseHandle(hFile);5 o3 ?1 s6 z* c$ {4 ?! y
      return TRUE;9 @: p3 [" o/ P4 x4 }6 {) _
   }
. @9 I4 z: O3 I   return FALSE;
- J3 S; _& t( C% P' {}. B  U* g- G0 U; C$ F0 h

1 j  x7 ~& h; Y) I* `/ e; F$ KAlthough this trick calls the CreateFileA function, don't even expect to be
- A6 D1 a8 b# Y* |  Cable to intercept it by installing a IFS hook: it will not work, no way!
% A& y& l+ G9 I" Q7 ?8 XIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
: m: K, M4 K* `service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
0 k  c& ~/ P2 A! h6 tand then browse the DDB list until it find the VxD and its DDB_Control_Proc
8 g# ~% `7 z3 K+ }- W( dfield.  N0 c& m" n5 T+ x* Y! n
In fact, its purpose is not to load/unload VxDs but only to send a " ]+ z# S7 H6 @9 C) x! B* f
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE); ?; @' U: V: z7 s9 @" E8 a( h8 O8 R
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
# X& j" f: w9 o5 S2 H5 m0 U0 b, _to load/unload a non-dynamically loadable driver such as SoftICE ;-).7 y' d% J# ?! h) y, ^5 `1 n5 X
If the VxD is loaded, it will always clear eax and the Carry flag to allow! f. F) n1 I  @8 S
its handle to be opened and then, will be detected.$ w4 |% Z* E2 u2 F+ |' W3 B1 E
You can check that simply by hooking Winice.exe control proc entry point/ B0 G$ {8 s* g$ D9 O2 \7 J
while running MeltICE.5 O% @) r$ W8 I9 k; ?8 w/ s: }
' I3 V3 U0 \6 f; w" E
5 W% V; a3 q1 Y. F0 c9 j; G
  00401067:  push      00402025    ; \\.\SICE
- `  G+ h' J: E  \& ^  0040106C:  call      CreateFileA2 W! F8 o. X2 ~  f0 |
  00401071:  cmp       eax,-001
: o) s4 K1 ~& g: ]8 U) T" g  00401074:  je        00401091. y: \- Q) I+ p
3 i& t$ N- q& G4 X
5 X% m. c/ e/ f
There could be hundreds of BPX you could use to detect this trick.# Y7 j& \3 i! e7 |' n
-The most classical one is:: V1 Z5 Y. }6 E# o! j4 X1 `
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||: s% h: ]0 b! e3 W) Q' [; \1 E& W5 P' N
    *(esp-&gt;4+4)=='NTIC'6 X$ i. L; c, R% j! [, _3 i
# M) @& R6 M$ I
-The most exotic ones (could be very slooooow :-(* ^, j& n) M& O6 G" D2 k! ^
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  9 D* V( g2 s: g' _) t. _( O
     ;will break 3 times :-($ n6 ^' y- |; Z. z5 o1 ^& W3 z* g

) H! D" {# p4 v-or (a bit) faster: 9 H6 ^7 E3 l, a# u
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')# ~2 L1 n. F+ C+ T% F
; v$ @6 g; a$ X, Q$ T  ]
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
' A  X# W- k3 n2 G' ^7 W# p     ;will break 3 times :-(# e/ O2 m' h2 w: x

4 W9 B) z. r, H# W% {-Much faster:
5 j) g  v3 \# u   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
* L: B% G! x2 v. a( p7 V- p, Z- y; V% ?3 `
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
7 Q+ g# [# d5 b# @. Kfunction to do the same job:
" z) _) B) c4 F* ]2 |* i# K" p) Y, F& ~$ L
   push    00                        ; OF_READ5 p1 ~( z2 g* p/ Z* l
   mov     eax,[00656634]            ; '\\.\SICE',0
; K& f& p) J7 s   push    eax
$ L9 P- t( z1 k6 y   call    KERNEL32!_lopen
) B$ }% |$ x& ?: ^   inc     eax3 R  h- p+ c3 f/ H- O
   jnz     00650589                  ; detected
4 E. f5 T- T  {5 b- j   push    00                        ; OF_READ
. N* p% B/ y2 R" K" C3 d5 I9 c   mov     eax,[00656638]            ; '\\.\SICE'
, Q8 X5 a& I% C' h  [   push    eax" |( u3 m1 i+ O+ A8 f9 E
   call    KERNEL32!_lopen: a8 y3 S. T+ V5 N' \% t
   inc     eax
- ?: k6 t) \: ?* I2 p   jz      006505ae                  ; not detected
; v5 k/ T7 ?" Z3 b" b9 h- \+ Y. x: r/ h
) J8 n7 }0 W2 q( \* _
__________________________________________________________________________+ R/ b& v' q  N
: F) P" O4 Y- B' i1 e
Method 12+ g- {, O& ?# g/ c2 V; B* f  e
=========0 L8 x# l* m- q& \& b
: m, w5 `# I/ c: t4 i( C
This trick is similar to int41h/4fh Debugger installation check (code 051 [! b# v1 v' g$ [; T7 Z
&amp; 06) but very limited because it's only available for Win95/98 (not NT)
- |) M6 `+ D' Y% y2 Ias it uses the VxDCall backdoor. This detection was found in Bleem Demo.
' [4 X7 n! D. B+ w1 N: F
/ O! Y/ D$ n4 o0 O4 {! K   push  0000004fh         ; function 4fh
, g: {) q* _/ g% I% q3 x" V$ s( }   push  002a002ah         ; high word specifies which VxD (VWIN32)" w! r* k: k3 C  k. R
                           ; low word specifies which service0 r2 d5 T  ?7 x& L1 S0 G
                             (VWIN32_Int41Dispatch); q$ D' C* I4 ?+ X3 _5 ~, X1 P" B
   call  Kernel32!ORD_001  ; VxdCall
0 V3 W0 m* p* ^# o   cmp   ax, 0f386h        ; magic number returned by system debuggers+ a4 _7 `  x" z$ v
   jz    SoftICE_detected$ y, @. O' M& ]
9 |! I9 E7 A0 r$ s  H  M
Here again, several ways to detect it:
) E1 X3 m. h  W
* ?! d, V& V& i+ b& M, L    BPINT 41 if ax==4f
. ^4 u% i6 M% k& O! n$ L
6 A; B. c8 B5 L0 X4 T/ V' b    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
) K8 L  o6 m; N5 S5 l2 S' R& g) X! W1 \) A( l
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A3 k1 ?$ D* t. w6 M

8 z* `" d; f# E3 `; m! J    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!) _- F. u0 a" f) }; W
% X5 s8 z# S3 V7 L
__________________________________________________________________________6 O8 v* j$ E1 c) W% y. h
* r3 ?: x' J8 s2 N
Method 13& u+ O2 O( x, i0 ~
=========
; N3 W  M6 |/ Z- i
$ p0 Z% E& a( h2 z% t1 q' [' PNot a real method of detection, but a good way to know if SoftICE is
; M- Z- c( N/ [% M: _  ~! [3 Tinstalled on a computer and to locate its installation directory.
7 Y; V2 o" m) _- Y( d) IIt is used by few softs which access the following registry keys (usually #2) :
: z3 B$ a$ [" Z+ g( I% b7 i+ x* z% e- F  f) z8 m
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
& [' i/ Y4 d7 M- C\Uninstall\SoftICE5 h6 H& b; a& T; {1 v
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE; M6 e# k+ w& k5 G4 M
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
; R; C& y( p' I* D8 ]# q\App Paths\Loader32.Exe
2 a& V  z6 j5 c) ^9 m; J( P7 B5 e/ e, g9 t

; D  F% t5 y9 ~4 T" l  F) {Note that some nasty apps could then erase all files from SoftICE directory" V* \* f6 J6 P) ^( X" s
(I faced that once :-(9 G3 f  z. X# E6 M
5 }  z! i# o2 i. h! ~( w( z
Useful breakpoint to detect it:, K0 l* F: F5 ?
3 ]4 W* H1 t5 v( {; F* ]
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
7 }  @: x0 y' b- _
* `0 o  s' [1 [, @) i2 B( Z__________________________________________________________________________4 B5 R+ \7 z3 R: }; r7 J& b# H/ Q

+ ?6 A7 Z( Z! h8 R/ \' ]0 c) Q. r* v  {! X# ~
Method 14 # |* ~* C7 O" I/ C- @# N* X
=========
. z3 [: g* z# c5 D/ ]1 [$ W) p6 y* f, k5 m0 x  e
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose$ g6 v8 p7 u/ d/ s5 Y
is to determines whether a debugger is running on your system (ring0 only).
7 T- f2 j4 c2 X0 N9 ?- l; u( X
  c8 J6 i; D5 i. l' m8 ]   VMMCall Test_Debug_Installed
' b. P* u# M# _   je      not_installed8 @) A" U1 S; S- E( ^

- j1 O7 y! M6 q' x( SThis service just checks a flag.
( z( ~* X2 ?  P2 G1 D</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部