About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>* W' }, V4 L$ T2 u3 d
<TBODY>
7 R) D* }  ?6 J+ d# a. c3 f; e: Y# T5 \<TR>! v- b& w2 h3 @
<TD><PRE>Method 01 5 @) F5 ~: W. D: E& s
=========: X- p$ n* H: D- p$ T( C

  B$ r7 s# s+ I# U- `; E1 n; C" r  oThis method of detection of SoftICE (as well as the following one) is
1 v6 X, }, B; c8 u" Hused by the majority of packers/encryptors found on Internet." ^/ }, Z) `- V. N% c2 A
It seeks the signature of BoundsChecker in SoftICE( U6 U5 Y  v' F8 A* [' [/ v; I
4 W% K/ _: c+ {9 X
    mov     ebp, 04243484Bh        ; 'BCHK'& r! i; K" j# r# e
    mov     ax, 04h
- [! X: O/ {: a; q- B4 @* @6 g* f8 n    int     3      
6 V6 d& s7 `# ]4 U    cmp     al,4, z1 h! W# E- T) J7 D
    jnz     SoftICE_Detected
  h. p" i4 ^/ @
& u4 h% A' ^2 l3 ~9 V3 P, Z0 S___________________________________________________________________________
. a; w7 a' ~2 D9 K+ t- S: D4 t, z7 L5 I
Method 02! n7 H, z* K( t5 [1 [, t
=========" x. x2 Y  _' I6 q) F" z
( p+ q6 _+ I7 m! p9 Y
Still a method very much used (perhaps the most frequent one).  It is used
! l7 o0 Y- {3 L, m3 e4 Jto get SoftICE 'Back Door commands' which gives infos on Breakpoints,' Q8 x/ A9 V. E$ E: B4 u  ~
or execute SoftICE commands...: p; D3 }; s7 D- x; r4 }, E2 b/ n
It is also used to crash SoftICE and to force it to execute any commands4 _+ w8 y3 ~& q
(HBOOT...) :-((  & C. Y: r) f9 i9 F" n
: s3 m' X. f7 d% ^* v" |
Here is a quick description:- l5 l$ l8 n5 _7 S0 w$ y$ ?
-AX = 0910h   (Display string in SIce windows)
* z4 r+ ~" O& Y. i. v+ D7 r-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
+ ~# _6 r, ?1 f. A. C8 ?-AX = 0912h   (Get breakpoint infos)4 ]! H2 F7 v$ ?7 |# ]7 P& q
-AX = 0913h   (Set Sice breakpoints)
9 a7 h; |0 j: ?5 F  T' w-AX = 0914h   (Remove SIce breakoints)* {; z6 {% g) Z% t, }& R7 X0 u

. X6 U) M! ]( J' QEach time you'll meet this trick, you'll see:! G) c1 w/ {5 M/ @. J
-SI = 4647h2 h! h/ N$ ~$ b) y
-DI = 4A4Dh
& ]% h% R* _& D; Y: w3 K4 rWhich are the 'magic values' used by SoftIce.
8 ^6 U+ F' F; B/ ]; N( JFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
% j* {" z* C+ Q1 C6 D+ H" G  M, Y! ~# Y
Here is one example from the file "Haspinst.exe" which is the dongle HASP
, j* Y5 a3 u& b9 `& YEnvelope utility use to protect DOS applications:
+ |$ E4 I- P& Z, w8 D3 e) w
! q5 H7 w, B) u+ C
: O1 {; k5 S) K  Z( U1 y4C19:0095   MOV    AX,0911  ; execute command.
$ x! L* ]: J2 e  l: `4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
3 U( A. h6 x5 k' \! n- l4C19:009A   MOV    SI,4647  ; 1st magic value.2 M' H8 Y1 c8 e  t5 y  u# B
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.- R/ T! B+ k% Z9 r  F8 l
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)0 X2 H4 k6 M; {* D, a  ^) N
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
# g/ d; _3 Q) h% e4C19:00A4   INC    CX' i4 O/ L- S* _% O* |% U. k: E, o
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
3 a% j" y5 E9 S: G# C$ |; C4C19:00A8   JB     0095     ; 6 different commands.7 m8 b+ T& p$ s! G- k
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
% [' u: D4 K" L# ?: C5 E7 S4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)" a1 i* J, R3 K0 E$ `5 p& _& F

- b& j; w, w% l" ]. J9 g0 FThe program will execute 6 different SIce commands located at ds:dx, which
, y" C, ~; B9 I! H, x" Nare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
0 y( h& m% L4 A3 \! r% Y6 W
1 b# P1 t4 y7 c9 c* O* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.2 Q# Q8 n6 z4 i. l6 f' P
___________________________________________________________________________" [# V% l5 F7 }. K% X* U3 I& ^$ d

4 ]! Q. p. v  b$ n4 O  E; f" u( `
7 z& I5 u9 c* @6 l' ~$ j+ z! ^Method 036 Z4 ~3 ]* b3 K, G* {
=========5 ^9 ~$ i; a+ w4 `

7 [" ~7 l' K% Q8 W9 i8 CLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h* N2 l! c) t. b+ n% b
(API Get entry point)! O; q  Z8 S3 q4 K7 t; {$ l
        1 w1 Y) {. n# ^2 J& f9 M

5 z4 ^+ t: [2 |. E& M. D* G9 \4 A4 K) w    xor     di,di
  A( U! ]8 I, N4 r  ^1 g+ M% k( ~: [: b    mov     es,di
5 \: Z( P; _( G$ g# M    mov     ax, 1684h      
1 J$ ^( F* M% s. J0 p. G    mov     bx, 0202h       ; VxD ID of winice
& n, }2 y' H+ M) v0 i* H) V3 |    int     2Fh
( C; \' l2 D: e/ a0 }0 R7 H    mov     ax, es          ; ES:DI -&gt; VxD API entry point( C' O+ p: e+ M5 [1 L
    add     ax, di) W1 d2 v9 B9 J- H
    test    ax,ax9 D! L7 c& {$ p) S4 W' w& {6 O( h
    jnz     SoftICE_Detected
  Q* I; D* m0 s# y
( M$ J/ F1 f* g7 ^& W___________________________________________________________________________
0 y8 }5 ]; s# e' @; r% T7 Z3 ]: x) X; ~, j
Method 04* m4 m' b# b# \1 y: I3 d1 t* }
=========
3 J# \9 X" S+ R1 M; E1 Z) p* E4 h/ l, w, b
Method identical to the preceding one except that it seeks the ID of SoftICE
/ p  P0 b6 v+ {% h/ z8 eGFX VxD.) }/ Y' m3 {! s6 q; C
3 n- I9 m6 ]. X) v5 U1 a* F
    xor     di,di0 y8 ]- @5 u$ c% x. W% G
    mov     es,di
2 k5 G4 o% d, s7 D    mov     ax, 1684h       " f% r7 N4 r& Z, N
    mov     bx, 7a5Fh       ; VxD ID of SIWVID
/ C4 B* d  Y. X' M% j  Y3 O    int     2fh  b6 z! e8 z3 g* }
    mov     ax, es          ; ES:DI -&gt; VxD API entry point, D* B1 ^# W" g  e
    add     ax, di) r, R1 h: A: r. J6 T
    test    ax,ax
8 h" }6 m2 ^$ V( Z" J; a    jnz     SoftICE_Detected
/ B) t7 k$ r8 G4 v4 @" p: ^. Y8 x) }- U6 l% m2 |# ^3 m/ ^+ Q
__________________________________________________________________________6 N7 J! _8 F8 h  O" [# {2 p2 n6 O

2 l8 g  \& i' |7 H; W% K- h+ _' t6 e  F+ v
Method 05
$ Q) V( f1 j/ T% `6 f) O1 F# ]=========/ _% k. z+ }3 I0 t! x

  k! N) y) t0 v; ~1 QMethod seeking the 'magic number' 0F386h returned (in ax) by all system% Y1 D/ B, }9 |1 P1 ~4 S
debugger. It calls the int 41h, function 4Fh.
8 v% K  A+ {$ I  X& ~8 r- [There are several alternatives.  
4 c+ I1 U( P) p) i. J: m, ?7 x5 d. U# e; D7 W! |, v+ N
The following one is the simplest:
( S- @; U: \1 A6 v
% V! P" ]* Q  m% G" C8 {5 @    mov     ax,4fh5 G$ l% q" @8 O
    int     41h
. }/ B; n& K; f. m: @4 D    cmp     ax, 0F386* s4 n* C2 y0 w' P' L, N0 |% u
    jz      SoftICE_detected" c$ }4 y! d! ]$ I" a

, T; b; i, i1 H+ T) h$ X
: `+ f- J1 u  S& ~+ H+ ^Next method as well as the following one are 2 examples from Stone's ' ?, F0 j3 G0 ^  {3 g
"stn-wid.zip" (www.cracking.net):
/ X1 X) L9 X- F& A0 ~
; ]# i. X% N/ p! ?, _    mov     bx, cs, k5 k) S2 B6 o4 R- \8 a
    lea     dx, int41handler2! M1 R  m+ M' E8 I1 ~$ O3 z
    xchg    dx, es:[41h*4]
/ p+ k0 p* z, \) z' b# L+ r" B    xchg    bx, es:[41h*4+2]# T1 p& \4 `0 q) O. R9 k% J
    mov     ax,4fh
8 i$ _! e* [+ @5 }" ~, `3 f    int     41h
7 u( j; v2 o% a    xchg    dx, es:[41h*4]
5 e% S" s2 o' b2 [/ C4 I    xchg    bx, es:[41h*4+2]
+ }; L/ u& G# `6 c3 D: Y    cmp     ax, 0f386h2 V, T" P5 ~- v$ u: n% c) b
    jz      SoftICE_detected& y, U: l6 W7 @
, b# w) ^: p, Q! z1 L" N
int41handler2 PROC( p& p( z0 v2 o
    iret8 @& ]7 c& I3 t- D" H$ |
int41handler2 ENDP8 O6 r4 H/ i  R  u

' g# Q1 X6 F+ q: h2 h: E- h- i1 M& Y9 t
_________________________________________________________________________
: H6 @! M9 m# s4 r5 I) Y
5 }3 m8 g7 P# ^! [1 t
9 k& {8 d6 H5 D# K5 f3 GMethod 06
; r4 c+ l( v. ]1 S, a/ M=========! U* v8 [4 R1 q0 M) A2 g* g
' {4 N2 }1 N- J, t; ]- F
: v, F. h% U7 \! p; a2 e  q
2nd method similar to the preceding one but more difficult to detect:& Y# a' x- c" z+ ^( _9 u9 c
& e$ f, ]$ J# P/ z" O

$ |* Z; M- q1 W4 Wint41handler PROC1 t2 Q7 S- X3 ?! _) h
    mov     cl,al+ y9 Q. |) m+ U# j2 M8 u+ z& {
    iret/ Z! b4 K$ r6 @, @" k+ _" A' C
int41handler ENDP' y3 }' f. R* ~2 F- a# ~$ _3 c1 H* X' u

9 F: R3 N$ N5 M( Q; A- G7 W) c, E2 D+ x- u
    xor     ax,ax
8 D: ~+ f. g3 L, {' ^5 A$ f    mov     es,ax" m/ v" f. y3 i  |* a9 m
    mov     bx, cs4 _! \2 f- c% c! R& N1 d
    lea     dx, int41handler
6 B' z1 T3 d- V    xchg    dx, es:[41h*4]. m1 O: |. w/ ~& r" ~
    xchg    bx, es:[41h*4+2]  O  h: O8 n0 U
    in      al, 40h. p8 s6 Z6 B$ K4 j* z1 g, [
    xor     cx,cx
6 ]# l& i3 V, b9 [& @    int     41h
! k# ?: ~) q1 l# [! y    xchg    dx, es:[41h*4]# u- Z9 S; S8 G# [- _
    xchg    bx, es:[41h*4+2]% r4 x8 V0 X6 ?. X* c3 T2 B# p
    cmp     cl,al
$ o! d. h' w# a% G    jnz     SoftICE_detected0 h  `+ ~1 M/ C: p* w: Z' {  j

+ w0 M6 k; S/ a- o3 f9 o7 k_________________________________________________________________________6 C$ `  F' d' u9 J$ {! q$ _! w

9 ?3 Z9 @& D9 }+ MMethod 07
7 L4 q. R9 }" A3 |( A) h# Z=========
: R% X! a  |  U
$ A  X" v  v0 IMethod of detection of the WinICE handler in the int68h (V86)* t& ]9 c' l5 g: s0 A
* |% e) G8 @' z/ y* ?
    mov     ah,43h1 w# _. `% Z' ?/ l8 o$ \/ `. U4 e4 p/ M
    int     68h
2 w- M4 M9 ?; k  O, C, f    cmp     ax,0F386h
1 I+ Q3 \7 w7 Q) w2 |    jz      SoftICE_Detected
0 A" [; X( ]0 T! l- @' p, y3 q* |+ y% ]4 X* `4 t: g6 H/ `$ Z

) K+ o8 r9 o$ Q5 k( o=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
5 I+ D( m8 O- |; ?   app like this:) T2 `, n. T, X% {9 g. ?
- Z5 |* V# D6 D" \
   BPX exec_int if ax==68
) ^' X6 ~* E. ~+ o% e, H6 J3 h   (function called is located at byte ptr [ebp+1Dh] and client eip is- h: s1 ~$ P" ]5 o- j- M# {
   located at [ebp+48h] for 32Bit apps)
1 T. H0 z1 c$ `! H" W__________________________________________________________________________
  J6 Z% _: f7 \( P* P6 O* @6 m

# e0 w7 b& P- I# N* KMethod 08" [* P/ \( A7 H/ V. Y
=========
0 \0 F! q8 k' T5 \( k$ Q6 m! i
2 P3 ~4 B# v8 K7 _. E8 ]+ ?It is not a method of detection of SoftICE but a possibility to crash the2 v5 t6 ~; Z  }4 W# R; t2 `. _& Z
system by intercepting int 01h and int 03h and redirecting them to another# y0 P* z% k  ^2 G! n
routine.
6 M* y3 t8 V/ p& RIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points* ]1 @. y" \- l8 m0 X/ C, K3 M8 l
to the new routine to execute (hangs computer...)
$ ?. G0 c; l* ]2 z& Y% g
' v# j" Q& c$ n& W0 r    mov     ah, 25h
0 d. A5 o% Y- n" i  Y" \/ x    mov     al, Int_Number (01h or 03h)
5 H& ]+ Z. a. l    mov     dx, offset New_Int_Routine& F. R. E& h7 N% A; o" V
    int     21h
7 m/ t/ t8 I, n) V: \7 i+ ^1 a0 K' _" ^# K" T/ J, A
__________________________________________________________________________* a3 `, y; U- @1 ?4 j

) S' P3 c; ^3 P/ a) v, d: ~. RMethod 09
- z2 x2 B% M0 R- I1 I  Q/ T/ I8 W$ u=========
/ X5 N4 `% [4 o8 ]- l
/ N  Y0 q9 H* ^8 u3 p% }This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only. u% F5 D; O) X( W9 l8 u
performed in ring0 (VxD or a ring3 app using the VxdCall).5 x, @0 Y( d$ h- N+ x
The Get_DDB service is used to determine whether or not a VxD is installed/ D) K) G' L7 F: s
for the specified device and returns a Device Description Block (in ecx) for
4 `1 Y/ f! j# E0 U  B/ ethat device if it is installed.# b  f! ]1 x; Y& c5 H6 g; w

$ U& r+ _" {6 J/ t   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
) w" K- z) G* n# v   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)( j+ C& Z, e* Z$ v4 c$ j
   VMMCall Get_DDB
0 g2 s- `3 M/ v* |; H   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed3 ~1 ]+ B+ l7 `' c7 v3 m

1 K% y3 O2 h+ O) E. wNote as well that you can easily detect this method with SoftICE:
% A- `" ]" U5 b   bpx Get_DDB if ax==0202 || ax==7a5fh
. ~( S! }' J! E5 H% q+ a( @: i3 a- [$ b' R& w# @
__________________________________________________________________________' M. l/ H* U2 S7 U
+ l% T7 i' r2 s& k, N( u
Method 10
! o1 h9 s/ |* \, p! |) S=========; g2 B6 L0 L7 i+ x: [: v" @. E
2 r/ X1 d3 t' m# O) f; g" e
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with- _7 m4 O# j1 U7 o9 V4 H/ A
  SoftICE while the option is enable!!1 w& }9 x9 m- e3 |8 K  x

* D3 Z1 Q0 L+ _0 y6 I8 T4 VThis trick is very efficient:" z# A3 s4 ?; d) W6 O, v8 N
by checking the Debug Registers, you can detect if SoftICE is loaded
! U$ F% |9 P3 R- j- B(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
9 i% {3 z" f. i, w2 K. ]' B& Rthere are some memory breakpoints set (dr0 to dr3) simply by reading their2 [5 \7 ]0 F, Q
value (in ring0 only). Values can be manipulated and or changed as well
0 D6 e, {6 \. T; s2 e(clearing BPMs for instance)* B7 F) V: l# p3 M$ F

/ }" K. V  e& r! ]__________________________________________________________________________4 s2 E1 S9 V8 Q7 G+ p" v" u" R
6 A. x0 i1 f; G$ r0 C. Z6 I
Method 11: Z5 S4 c+ e4 t! a7 z  T
=========
+ F/ U4 \' P. R2 z$ w/ ~, k7 l" x' i; G- q/ ~( Z7 e/ d
This method is most known as 'MeltICE' because it has been freely distributed! N, q$ J, b. @* z5 k
via www.winfiles.com. However it was first used by NuMega people to allow
0 x& `) ?% D9 v5 y$ R8 `# H9 ySymbol Loader to check if SoftICE was active or not (the code is located+ n, Z6 h8 P" {& K; B- o5 g8 ?
inside nmtrans.dll).( j- S# z; w8 F0 v
0 K. N2 [6 E7 F' G
The way it works is very simple:! R5 ?, F0 A+ `* b# [. U9 s( R
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
. ]+ w" g& V) \WinNT) with the CreateFileA API.
4 Z& l1 _0 R' H( |% }. g) I8 v7 L7 \5 ?( \- ^7 ^/ D8 E, d
Here is a sample (checking for 'SICE'):
( s! Z/ H) r8 o
& d3 A4 ?/ l4 `) f8 N5 ZBOOL IsSoftIce95Loaded()
$ I3 @: S1 F! _; m! @, `{$ N; g0 D1 c1 G' L0 ]1 h- b. ^
   HANDLE hFile;  
1 `7 @) }" {- y" L6 ]% M% n' F   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
- `# r/ h5 E, q; n8 _: }( c" ^# j                      FILE_SHARE_READ | FILE_SHARE_WRITE,
) M0 k5 T# x* ~. Q2 u7 _                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
) `2 ?  ~$ N; C- |: [   if( hFile != INVALID_HANDLE_VALUE ). S* Q# ]0 I# }, L9 i2 `5 o& H- l
   {
# s! Z3 _- s7 r- i: l/ }3 G      CloseHandle(hFile);
6 A- x! _2 |1 y, U& n2 ?      return TRUE;
) u3 F& p) C- ]/ h: ^3 x( s7 i2 s   }
: r7 x  X# g7 ]  @5 V' q3 T2 V; i8 ^: M   return FALSE;
. P( U! O# b9 B}
1 n; R+ A6 D9 Z2 l, @% [. t  d3 `8 ]5 Z
Although this trick calls the CreateFileA function, don't even expect to be
6 x" W( G2 f& \& ^able to intercept it by installing a IFS hook: it will not work, no way!6 |2 O* ^( G+ C% J* v  w2 d1 B
In fact, after the call to CreateFileA it will get through VWIN32 0x001F! ]. {7 O5 n; u0 r) T* t
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)0 ^- `- D9 s' ~7 p
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
! }6 Y- |5 y$ z- sfield.: D4 S& g; C! o7 \
In fact, its purpose is not to load/unload VxDs but only to send a
+ i7 r! B' b+ g0 eW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
2 f, N7 B! R1 K$ Pto the VxD Control_Dispatch proc (how the hell a shareware soft could try
; `8 f7 U( x8 K5 c3 P8 dto load/unload a non-dynamically loadable driver such as SoftICE ;-).
0 F' x5 E; G- q' e/ xIf the VxD is loaded, it will always clear eax and the Carry flag to allow
) `4 I7 o4 i7 }1 j* K3 g5 T" }its handle to be opened and then, will be detected.; d" e7 T2 F7 P
You can check that simply by hooking Winice.exe control proc entry point
* A' Q$ U7 N1 F" I( W' ?while running MeltICE.; O8 F+ e7 F' Z- u9 k( h0 ^

' _/ q& s2 p! g1 K5 L4 v4 [/ T" q$ S1 s: l
  00401067:  push      00402025    ; \\.\SICE
( ~8 O0 b! ~1 E5 t2 K  0040106C:  call      CreateFileA
( M0 I& x+ q7 u/ o! i. P  00401071:  cmp       eax,-001
" _" \, }! ]7 {% Z: C- W( B& h/ P' k  00401074:  je        004010915 B/ u7 r6 l6 o" E  H

: T  Q% c0 h, G, G1 n3 L+ v) O/ q& h
* \( ]5 h$ ]/ q4 P1 F4 {* D6 V  {There could be hundreds of BPX you could use to detect this trick., [6 N  O1 S$ M, |/ }6 R  e
-The most classical one is:
( c$ a, Z" L% S  b0 I7 i  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
; x. _6 s0 i5 `, r    *(esp-&gt;4+4)=='NTIC'
( C- |4 ?; _8 p1 x  f6 k5 x! N  h; Y) z6 ^9 R
-The most exotic ones (could be very slooooow :-(
2 X0 j" A* n) U! |/ h   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  " [. t& X! h& B
     ;will break 3 times :-(3 X0 g* ?0 _" V2 c8 g9 Q0 G4 y

* o! |/ u2 b5 R: i' d; v-or (a bit) faster:
+ _4 F, |) r* t, `7 L   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')& k# \( f& T* `

" U; \1 f3 ^8 c+ t1 `   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
5 B$ d+ L' W9 W! h( e; K     ;will break 3 times :-(6 R9 Z9 ]. d3 B5 u, d) i8 b7 P( J

* o) ?9 l$ w* P5 |+ F-Much faster:# R4 L! L% p8 M9 M2 Y3 v
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
" }5 R( e- J# ]4 t8 ^6 w: j$ ?8 F% M5 v" @) b
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen# A3 j2 f% S. G( I
function to do the same job:
$ g9 ^4 E4 [7 i4 T1 R& W0 U6 Q- V4 g- v' G
   push    00                        ; OF_READ
) D. A0 S& U& ^( v' U8 r* w   mov     eax,[00656634]            ; '\\.\SICE',0  i  Y+ u+ u$ T0 j/ l+ G
   push    eax
& p: [# }2 C' ?- Z( I   call    KERNEL32!_lopen  F6 q, e: j- z  M8 b' Q
   inc     eax
# H/ i8 y' w+ _6 L; `+ g6 D   jnz     00650589                  ; detected* D* Z  o. D3 o: H3 a
   push    00                        ; OF_READ, C; e/ u' f0 F; {( L  x, M
   mov     eax,[00656638]            ; '\\.\SICE'
. g, q/ V# r; _; l, B9 s0 n, O   push    eax
: o3 i* m& O; c( j0 G   call    KERNEL32!_lopen  ]% \  c* O# z4 F' T
   inc     eax
- d% c! y8 k: T   jz      006505ae                  ; not detected
" C* _& ]5 d7 F+ H, C% |0 s7 `/ r: a! |1 p0 [4 g7 x

* ?% M5 t" d' I% K__________________________________________________________________________# |+ @2 K' [. ~/ T$ X

$ H/ |, Z- d& b& sMethod 120 o+ Z, S2 L* {( n1 M
=========
- W$ M; ]$ a) y7 U
% R% X: b/ z1 B" Q' c/ lThis trick is similar to int41h/4fh Debugger installation check (code 054 T0 M; c( C3 H. K+ d6 U% D
&amp; 06) but very limited because it's only available for Win95/98 (not NT); r8 O# t! b8 s
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.; |8 p- O2 ?  o; S. @- M! |
6 B1 L; e2 v  j# |, R5 x* B
   push  0000004fh         ; function 4fh! I( M- {+ F% |; Z; s
   push  002a002ah         ; high word specifies which VxD (VWIN32)
: k! e# h& w* \" l4 O9 e3 W- U                           ; low word specifies which service
4 _6 E* m. f: Z9 G: X! q                             (VWIN32_Int41Dispatch)
' L* J8 m$ F2 O4 U( L4 a   call  Kernel32!ORD_001  ; VxdCall
1 t' A$ t5 `. c# P* b) g   cmp   ax, 0f386h        ; magic number returned by system debuggers
) F5 |$ G! p% q   jz    SoftICE_detected5 W6 v; S- k0 ^: K9 P% G+ J% w

7 l/ U$ r* ]5 P- LHere again, several ways to detect it:
0 H- H' ]1 @! b- ~- R5 p
; B0 F0 H3 ~2 w  F    BPINT 41 if ax==4f% h5 `, w8 I1 i2 t; S
; O+ a4 D" P; {( N) B, e
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one* T! @9 [5 D0 R( {! v* O

& L' U, P$ s0 y0 y* ?6 V+ c    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
" t1 h4 B9 w* X1 R
* ?$ ~7 J9 y+ ]1 A+ v$ q    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!' V! T3 `+ H# ~4 k7 g$ J

( v0 s; h% w* A* u% e6 |- L__________________________________________________________________________; |: e) H' k& `8 l: T
7 X4 z2 {) l# W+ _
Method 13% c, o7 ]/ j2 I. C) u
=========
' t' W$ _6 D/ _6 ?' z4 q5 G  M& t8 w* T1 P6 ^' G( r3 b
Not a real method of detection, but a good way to know if SoftICE is
- Q4 ~$ K' [. Xinstalled on a computer and to locate its installation directory.
# O% E9 A) o6 R5 [$ WIt is used by few softs which access the following registry keys (usually #2) :8 U, p! k( {1 B

" J! Z5 X% T/ B# S8 P. W6 A- I/ x-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion) I, w7 M; N9 E- t% ]$ E$ O
\Uninstall\SoftICE; c0 F8 Q9 L2 V/ `4 M
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE5 n+ c3 z6 Z" N
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
+ ]5 Y: P3 ?8 |$ q/ z0 ], B+ r\App Paths\Loader32.Exe3 W2 V/ d% o  U) d9 I0 s
; m; h2 x: f( T% i
) p: L. _4 W* C. u3 R: {
Note that some nasty apps could then erase all files from SoftICE directory% J0 G) {# o3 C4 N6 a9 t% E9 F
(I faced that once :-(
& P/ o: |+ V( J8 q: T+ g1 B4 F$ D/ I
% m3 P& l/ u/ ~4 Z/ u/ mUseful breakpoint to detect it:
/ c+ |  X* @: N7 U3 G$ q; K4 h. z1 ~( v3 F- }+ V
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'- d% H% o- k" M4 I

+ E& V. }/ H8 \__________________________________________________________________________; J% i. g# W( p& r6 D5 d$ v4 }- z

& n9 a( r+ Z" ]# b7 v$ s0 T  m
8 [9 G7 o# m" @8 D2 @Method 14
: j! l% w/ z2 l6 G6 O=========
3 S, z; k+ y: k5 `3 C7 W3 N, W4 l( w& y* D  A9 B) m
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose( d+ b5 }" x# |- H6 d% J& D2 J  a
is to determines whether a debugger is running on your system (ring0 only).2 b" V& @  r3 A
8 |& ~0 g' y; y6 Y- q5 V+ g
   VMMCall Test_Debug_Installed9 ?+ @3 Z8 a$ {
   je      not_installed
- k- @- Y. C0 A# x) Y8 {
& P0 c3 i; L' Z5 s, C3 KThis service just checks a flag.
8 V  G$ [% n9 I- d  ^: [6 }2 Y</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部