找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
/ W" Q# o- t- O+ V' X& U8 i# D9 ?<TBODY>& b9 i6 ~' g2 h& b
<TR>
% e5 `: S# M5 M3 w5 {" W" M1 P<TD><PRE>Method 01
  w" {: t& q9 W8 f1 A=========
4 Y* Y3 C( K- @- X9 T2 O+ ?
, ]% {8 H7 d1 J( v' h$ b! G1 DThis method of detection of SoftICE (as well as the following one) is  F" F0 L2 X/ ]0 |: P
used by the majority of packers/encryptors found on Internet.# ^! o9 N% S1 {" i/ q
It seeks the signature of BoundsChecker in SoftICE
+ v  D; }' @8 q7 c6 d3 \7 g+ g/ m
( n' }3 c/ `2 O    mov     ebp, 04243484Bh        ; 'BCHK'
. m8 U  `, ^  D# l$ n! U1 F    mov     ax, 04h' d7 L0 v  r6 |3 W" a8 h; r
    int     3      
7 s7 k: Y" I, X. \& r5 {6 j  c    cmp     al,4
' Z3 l4 M0 Y' v, h# p! O( P    jnz     SoftICE_Detected
- ], J' E3 @2 K
, S' D* \2 o# P: S" U7 f___________________________________________________________________________; u3 o6 H& v& M" a+ y. u$ F% X

1 w5 F4 c6 ^% o4 P4 s, YMethod 02
, D: j  Q5 n4 [0 z- D! Z=========7 S/ y) Q) v& W

5 V$ a6 B: l& CStill a method very much used (perhaps the most frequent one).  It is used
- a; u# d' z5 rto get SoftICE 'Back Door commands' which gives infos on Breakpoints,# A" f0 R* @0 ]+ S5 I  N. y8 B
or execute SoftICE commands.... c1 Z& ]3 H' W' R3 i" N+ G/ h
It is also used to crash SoftICE and to force it to execute any commands
: }" a6 C  T, b, ^/ \6 S) N! \1 k  a(HBOOT...) :-((    H5 h1 z* R8 ~/ f

% [3 L6 D8 I% H$ G0 WHere is a quick description:! z" @0 M% {" S, R
-AX = 0910h   (Display string in SIce windows)3 c( g. O# v, H9 T( N
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
/ `# z1 [: m7 L) q-AX = 0912h   (Get breakpoint infos)7 f$ ^5 X" m" k( o. e8 \" S# p
-AX = 0913h   (Set Sice breakpoints)/ f; ]) s) ~* P# H* g" D) M4 ~
-AX = 0914h   (Remove SIce breakoints)
6 S1 s1 z+ l  Y; U' l7 E* X, X
. v4 h. w- R* S- S& o- mEach time you'll meet this trick, you'll see:
0 ^+ ^( f/ i1 `# ?0 \-SI = 4647h
4 c4 T4 V$ ]; \% R, ?; f-DI = 4A4Dh, R7 M. N4 R; `3 I
Which are the 'magic values' used by SoftIce.  g/ y5 R. Q' J0 N
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
( [, ^- P; \) [/ C$ w1 w, ^: U: `# J# E/ q2 R
Here is one example from the file "Haspinst.exe" which is the dongle HASP
# K$ n5 g# H3 u* g  pEnvelope utility use to protect DOS applications:$ X  B) Q! h+ _9 u" a( Y! S
' j7 g1 t  Z( }0 C3 w. C

+ b" D4 V! _0 k4 Y3 B4C19:0095   MOV    AX,0911  ; execute command., `2 t" X4 l1 x( K
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
3 J7 v$ H, ^0 i4C19:009A   MOV    SI,4647  ; 1st magic value.
* V7 j( h- O7 `5 u4C19:009D   MOV    DI,4A4D  ; 2nd magic value.5 U+ q3 f( V4 \6 \) G: {
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)5 Q6 c5 h8 a: C
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute" e3 ^3 ^0 t9 o% ^* U7 {7 F
4C19:00A4   INC    CX: M5 D! p: b& S# r- L& ^+ u
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute. C8 Q: {% ~1 }5 b! H9 R8 S
4C19:00A8   JB     0095     ; 6 different commands.  G- w3 R1 j2 b& Z
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
5 `6 y/ l' u5 u4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
; n" O; Q6 A! \! b/ \
! V5 p) ~$ ~: K7 e5 N& z/ fThe program will execute 6 different SIce commands located at ds:dx, which8 j! Z5 P  q" C) a" X7 t6 t
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.2 b5 M/ w9 j. J3 c. _, W

4 w7 ?* I5 w7 p# B. f  Y" B* W! f- w* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
5 O' o- ~' l4 ?6 E/ w2 G___________________________________________________________________________  W7 f6 i6 h  C& D
/ |" j! {. g6 O$ f. P
; Q* T: |9 ?9 P, @0 w, y
Method 03+ M, c5 j- n$ h
=========$ c. k; _$ ?! H) Z$ B/ w1 t
' ?8 I1 I+ V9 |# M. J- m, _- \
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
& f, P+ {6 p2 [) X7 E3 B- d(API Get entry point)& H4 T$ j" {) z5 P9 S8 q
        
4 Y: ]6 }; [8 w: r; @8 G( o& H7 B7 z" r1 D& c
    xor     di,di
" a- E" @' C; R7 _: }( z5 Y" S    mov     es,di- K7 z, _8 r4 O, |
    mov     ax, 1684h       # w- k. S+ [" i0 g6 i$ Y5 |
    mov     bx, 0202h       ; VxD ID of winice
/ X8 {& ~# d8 f: H- d- T1 m2 }    int     2Fh* E( D! k9 f% }! I  |
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
' w$ W9 e$ @+ i9 K1 d0 I3 k    add     ax, di/ i- g0 W9 I% ^. a" p4 p
    test    ax,ax0 F) M, T$ p7 i0 d; g
    jnz     SoftICE_Detected+ e6 Q* }1 q7 m8 a

' e' L7 V" P# R# L___________________________________________________________________________7 Q; `+ g, Y# {8 E8 ?

, G; Z1 N& U; j; r) _. m" vMethod 04
% z( {& _7 ~% O+ o=========7 _5 S" C' q1 r, B; ^
9 w& [- }2 @% _/ C# n
Method identical to the preceding one except that it seeks the ID of SoftICE
' X) C4 H0 j2 \, U/ l% mGFX VxD.
- ^9 E: G1 O8 D. s  v9 O9 L3 j0 t+ w* T
    xor     di,di3 `. u! ]5 {6 p$ v7 p0 B
    mov     es,di
, _9 R" `3 u, m    mov     ax, 1684h      
! g. E6 P3 k- ?. r    mov     bx, 7a5Fh       ; VxD ID of SIWVID
* n5 k9 a4 D8 y: C: w9 W0 P    int     2fh. d! T; P0 _" u- T$ O
    mov     ax, es          ; ES:DI -&gt; VxD API entry point" M1 ~* W2 Z! t. Z5 N( v
    add     ax, di3 z) c& k3 n5 A' f
    test    ax,ax
7 r2 O1 p% L% j9 E$ s7 I    jnz     SoftICE_Detected' f, E4 C% S) t1 D4 w* z% @

3 V$ M" ?' Y6 \; {. n9 I! R__________________________________________________________________________6 D, G- }# W: u$ ^. g  ?/ V

2 A2 Q  L  E6 b* K1 C+ O5 ?0 v/ D7 o" S9 O; [! M
Method 05
) q/ e0 ~2 ?6 H& d' ^1 x=========
9 ~3 N! o' d! Q2 u+ N
# `5 ?4 U9 M5 l$ s" [& }% I% j2 YMethod seeking the 'magic number' 0F386h returned (in ax) by all system
! L3 D6 C0 r: U4 S4 V* Udebugger. It calls the int 41h, function 4Fh.
' T1 V; `4 [4 m$ Y- SThere are several alternatives.  
3 X- x- b8 x8 S0 o( U: m9 R" @1 V5 _/ m9 [" R# m9 b3 i
The following one is the simplest:
" S! J3 e9 w; C4 X2 o% K8 `# I: _6 G% L4 _3 o
    mov     ax,4fh5 I. O/ P) @/ y) W+ o( ]
    int     41h% |: J% S+ P- i, `! Q, u# ?
    cmp     ax, 0F386
+ ?, E! N, b+ e, I    jz      SoftICE_detected
  J4 R- i  @' I1 D$ L
) U9 t; m+ Y6 u- h- j; Q
. B4 o( R6 ~. t- V5 G9 {3 A0 GNext method as well as the following one are 2 examples from Stone's " d/ w% y. E) B8 v/ _( Q
"stn-wid.zip" (www.cracking.net):
2 Y: ^8 ^; Q+ S& K$ J* B  G* k: s" \3 z* p3 n
    mov     bx, cs, {& O- ~5 O8 x+ B# o
    lea     dx, int41handler2; m* [8 A% Z* {$ y$ q6 }" }
    xchg    dx, es:[41h*4]
9 a' a- g" F7 }& U    xchg    bx, es:[41h*4+2]
  u, `$ ~+ t* R" f0 {    mov     ax,4fh
( |. W: K/ S+ W+ z4 k    int     41h
1 \- B' l1 w! |    xchg    dx, es:[41h*4]
1 [3 ]% A$ |4 Z7 Z5 U    xchg    bx, es:[41h*4+2]
/ h. @5 S3 r" F$ C    cmp     ax, 0f386h% i6 ^% B' l: J
    jz      SoftICE_detected8 _$ S* o8 r% y( i5 [/ p
  P! g& M6 x6 O
int41handler2 PROC
& X" }6 S7 {( ?    iret. x* }4 q$ r+ X# k2 b
int41handler2 ENDP" t' R6 C$ U4 K) Z/ x8 ^
" D3 _* C7 q2 a  k! I

3 O8 |# E5 ], R9 O1 o_________________________________________________________________________  l9 ^' |/ m" [2 h% K

. Z, t6 }: n/ n2 C, K
. z9 H/ S; b% _1 v( _Method 06) A4 f& U  p  R/ u' p5 Z
=========) n8 R9 a& X  ?9 ]. X$ E1 v9 G7 k5 i
' I; t4 R9 o7 ?$ }/ I0 K  w7 p, L

5 X) Z+ y. X. A. @) V2nd method similar to the preceding one but more difficult to detect:) r9 J) v6 Z0 x, x* v0 q% A9 v

2 f/ B3 r! I$ a& |$ V7 j  w2 C+ G  \) T) S6 g# Y( p1 l
int41handler PROC
8 t$ g: O2 W% q# N% y) U    mov     cl,al
2 Z- J3 g: J7 o: l5 A8 r    iret* V+ J+ V- M( H+ I; N
int41handler ENDP6 S. e5 y( c8 N6 \/ c  C

& q  u5 u) D8 G* {, d9 z) [
9 }* ]) F& v6 V$ d    xor     ax,ax& V2 S5 W7 ?* g8 F. d5 l
    mov     es,ax
: a6 n/ @- r6 r' r0 X- |3 e$ Q    mov     bx, cs
! v# H: W# c& `' a3 f" s    lea     dx, int41handler7 Z+ N0 G; w5 u
    xchg    dx, es:[41h*4]
# y; r( Q2 A+ B. L    xchg    bx, es:[41h*4+2]
$ t- C: s4 n+ L6 ~: P5 x    in      al, 40h. p  V* J. u3 x  i! h) Y
    xor     cx,cx3 }2 a/ a; ^- X7 o4 E% b
    int     41h
+ X7 |* z1 c/ x& c5 v/ O9 ]    xchg    dx, es:[41h*4]
2 R% L6 }8 ^0 W    xchg    bx, es:[41h*4+2]: I) [/ s6 g9 v+ s. `9 j
    cmp     cl,al0 J' H! }: M  Z% B' H+ i9 m- Q
    jnz     SoftICE_detected
! l0 b! h. C7 i# t0 a9 }& [/ u3 N5 z" w1 `: U: I+ p1 h) v7 e
_________________________________________________________________________/ |4 Y+ u) ]. ^& k0 u

& `7 I5 p! q" u; z' eMethod 07; Y1 b& d5 v3 I2 X' J* W9 m$ X
=========
; F6 E* f7 R, N0 y) d! i- p0 x; i! q; E8 a; |1 l; n  A8 f& z
Method of detection of the WinICE handler in the int68h (V86)7 C7 }( F, [; c7 q& `( N. ~% {# `
" s4 q5 J4 s/ D- H2 ?1 n
    mov     ah,43h
  B3 |" P3 Q& S; q- [    int     68h
0 V) h" v& f! b3 P9 T2 `    cmp     ax,0F386h
( Q2 ^* C0 X9 k4 o4 P5 Y    jz      SoftICE_Detected0 `9 d! p7 `. m8 }% o3 q+ N

. s7 }8 b7 `" t! k, n/ X) B- C* Y4 o$ N4 q3 t" Y5 n
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
1 f5 z& V$ f4 l  w( e   app like this:
( e5 x4 V1 ~% I# c2 W  Y/ a
6 `+ @0 c5 {9 r! W# y/ ?   BPX exec_int if ax==68
9 d2 n& |  S& P) R0 T9 l   (function called is located at byte ptr [ebp+1Dh] and client eip is1 w; w1 `9 D  z" F3 N/ e
   located at [ebp+48h] for 32Bit apps)
; S+ T4 n; _# o. ?5 C9 P__________________________________________________________________________
) A# {5 t! j# E$ u& i: U' H( e6 G. B$ X7 @& ^' q$ \% s6 Y2 _, v

0 C3 b1 n; v- A3 K7 {& K  ~Method 085 o2 z# ]. B  U2 k
=========
+ u( W8 _0 h; \9 Y. a/ |" }2 w0 p% [$ \3 ^. L
It is not a method of detection of SoftICE but a possibility to crash the- b- }, m" q! X3 B( I
system by intercepting int 01h and int 03h and redirecting them to another# k; z/ |( j) Q- B8 Q1 c# L* Z: n
routine.
8 F! w& i  ?$ GIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points2 Q( q" e+ D6 @& u
to the new routine to execute (hangs computer...)
$ U0 ~3 }. u9 @5 d% a- ]. |; L- b  I& X4 E8 d' G$ D/ b) j
    mov     ah, 25h
8 r5 g3 Q- r9 Y    mov     al, Int_Number (01h or 03h)
1 x! A# d! w# Q* [* a9 g    mov     dx, offset New_Int_Routine* C% M$ ^0 \* w4 a6 q
    int     21h
7 Z4 }+ N( ~$ u6 |( l' E+ d  ~, d3 L( i& P; w
__________________________________________________________________________
0 T0 H, v4 U& b* i8 T
0 r& |7 J) F) r! y# zMethod 09  c7 i# j2 u4 ?1 _) D' l
=========
. D1 p3 [8 w5 v/ W2 v# w0 Q8 B$ a" p; K1 w- B0 d7 A) r8 p, P6 q8 C
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only, w/ Q9 a# C; B; G
performed in ring0 (VxD or a ring3 app using the VxdCall).
: m! s7 ^9 B, K3 ~The Get_DDB service is used to determine whether or not a VxD is installed. b. ~4 x* P% k
for the specified device and returns a Device Description Block (in ecx) for! x4 D& ?- }# i+ _2 T
that device if it is installed.
( @4 t5 h5 m6 e* {: U2 o
' E! b3 F7 r3 F* ]' r& a   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID, y& @8 a. X" G2 J1 _  K
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
( ]1 U& m7 Y$ }( V, y   VMMCall Get_DDB/ x& [/ X6 m. H, N
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed  h$ p2 M) c- x
; t/ l7 T: M( l
Note as well that you can easily detect this method with SoftICE:% r4 U8 i+ o% D1 n" Q& N
   bpx Get_DDB if ax==0202 || ax==7a5fh. b' i) g0 z2 y9 j

# `9 U6 T' q  g& a0 P- Q__________________________________________________________________________
4 w# t/ M: x/ P  F' v$ V  t) d4 [: }. A2 E9 }7 m
Method 10
3 t* r3 u7 s& L! e=========" K% [# u7 O9 ~9 |  v/ \0 s
% P' J/ ~' [) m: \4 p. v
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with1 ^' A" h5 h& c/ c5 w3 _7 @: Q. h
  SoftICE while the option is enable!!% m) i' V1 E7 @) Z; V; q. W

+ F# `  B; Y1 ^7 a* f% `This trick is very efficient:
! Y. |, L+ _6 H3 I) @by checking the Debug Registers, you can detect if SoftICE is loaded
2 [$ _! T, O$ i; {/ h; p(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if. C' y/ ^, d" M4 g
there are some memory breakpoints set (dr0 to dr3) simply by reading their
  @7 g* c* d$ O$ {4 |# b' s8 zvalue (in ring0 only). Values can be manipulated and or changed as well1 L" e! Y0 m5 I% f
(clearing BPMs for instance)
6 P- Y: k# l' Y5 B) {; g# _0 Q- Y3 O  m+ C- N% N' c$ \
__________________________________________________________________________
! Z* h# M4 S: r# p
7 V, _- T3 y3 h( u* }Method 11
4 O1 o8 }- l$ n8 A  T$ e2 }=========2 W/ {9 u7 ?6 A/ I1 c' v& b# K
! ^1 @; }" _9 J# A) V; s8 t
This method is most known as 'MeltICE' because it has been freely distributed8 q4 I% L' S+ F' ?. c/ }# L
via www.winfiles.com. However it was first used by NuMega people to allow
+ g' {  j, J. a# b7 jSymbol Loader to check if SoftICE was active or not (the code is located
3 [' M- o2 B' x! ~' }: Binside nmtrans.dll).
$ o: B2 [( u& K; k, r# B; p0 a: |; K1 i
The way it works is very simple:: `% a" P/ a1 G3 R" {  e$ O9 L
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
; P/ E( n& n* ?8 ~WinNT) with the CreateFileA API.
2 r9 ^; H0 r0 K' S1 ~5 s
$ Y1 U2 d: W2 r; G; ~Here is a sample (checking for 'SICE'):& p7 X3 S5 ^1 @

2 ]& j) k3 c* c  Q+ cBOOL IsSoftIce95Loaded()* u+ {) i# d+ J6 B' j& ]4 v9 I- d
{4 p0 y, h( Q6 W; D- u( g$ G
   HANDLE hFile;  
$ r4 p# u3 }, s   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
) A! K& F! H. b# D1 I% p7 p                      FILE_SHARE_READ | FILE_SHARE_WRITE,
$ U4 v' ]8 R$ g# \                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
- d) j, I; k( J, y   if( hFile != INVALID_HANDLE_VALUE ), n  V  R! N: c, Q
   {% z, i+ J* e- M" r0 h" e
      CloseHandle(hFile);( i1 ?9 M, S. x$ s
      return TRUE;
8 ]- K7 x  p, N   }
6 e5 s5 C5 d' @   return FALSE;
; O) `. Q$ l9 O+ A) N+ u; x}$ `6 Z9 x4 J' W; o- n

. Y/ R' {& C* zAlthough this trick calls the CreateFileA function, don't even expect to be. t) q! p' ]' q2 x) S
able to intercept it by installing a IFS hook: it will not work, no way!
8 t; y6 }( z! cIn fact, after the call to CreateFileA it will get through VWIN32 0x001F! j  `3 y) s* ?4 G( E
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)- Q3 l4 n6 }! p5 o$ C
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
( z# |* c9 p# p5 \field.3 w; Q+ Z6 J4 |9 H  P
In fact, its purpose is not to load/unload VxDs but only to send a % l: z$ C+ }" C: P) }$ h3 C
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)& A# v& P+ X' ]
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
2 M1 p2 v$ L: h* d' Y: Yto load/unload a non-dynamically loadable driver such as SoftICE ;-).  O& I* H; x& e7 b7 @, G
If the VxD is loaded, it will always clear eax and the Carry flag to allow% t! h0 q+ m1 K7 H; U  Z5 P
its handle to be opened and then, will be detected.
! e" E8 i# O; \  q+ C& ?4 j6 rYou can check that simply by hooking Winice.exe control proc entry point
; n: N1 U; i% i0 H% _# ]5 Cwhile running MeltICE.
6 S8 z; a5 I6 G5 s7 Q; ~4 Z( n6 ]8 ?$ D+ R4 h6 e( l7 s7 i5 Z% s6 H

. ?9 s  {. |' f& [; [4 q) Y  00401067:  push      00402025    ; \\.\SICE( g7 z2 g8 H* _
  0040106C:  call      CreateFileA# L; @, Y8 X' v. \  V
  00401071:  cmp       eax,-001& B. N2 _$ p6 B0 Y, F# i/ W$ O
  00401074:  je        004010910 j, v9 {( ^7 \- o' X9 G- r/ R
: m5 l, O- @* \: w, [9 E/ f9 L
4 r% F) T1 }" V5 l' ]8 l  a
There could be hundreds of BPX you could use to detect this trick.
- L; ]/ U% B$ O  o% I-The most classical one is:3 V/ [( Q1 F' K1 H9 C4 z
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
- R6 }2 j, U- L  g; y2 }& S    *(esp-&gt;4+4)=='NTIC'4 `9 Q; B5 T+ f6 K3 e

0 C) W, L( ~& p-The most exotic ones (could be very slooooow :-(6 y, L2 H3 R% A7 X; A! X3 p
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
2 U9 r1 O' b! c5 c     ;will break 3 times :-(
3 [* a* T) t' q8 i& z; A" b4 [( I' N( ]7 }
-or (a bit) faster: # j1 U: E; n$ V( G
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')$ w( c5 p5 h) l2 O6 C' f7 s9 u% J
6 F% O" g' A' ^8 S7 u& B
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  ; l) }3 W2 R( ]% f1 V4 y
     ;will break 3 times :-(6 P$ [8 J7 `# |

0 H  F6 f8 C: E2 W0 b8 ^3 M-Much faster:
' [) V/ h& v( w   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
# p- j: u) q1 V7 @& ]3 Z( }
3 P4 A9 y* v# f' F3 e8 m$ ?- BNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
- n: ?! {8 @$ I# b7 kfunction to do the same job:
- n& ^( x7 |, J- H8 N
; y  J4 T1 O, ~   push    00                        ; OF_READ3 _& L) D3 R( o! d% B/ ]
   mov     eax,[00656634]            ; '\\.\SICE',0
; C* z0 u- q2 R; p2 h' d3 }   push    eax; u( I( ~; Z  E1 e5 h
   call    KERNEL32!_lopen1 }+ v) W! u7 S7 g3 S+ @
   inc     eax
& m* y6 T9 A. q7 z5 U   jnz     00650589                  ; detected7 d# b& Z. M; _. C" }
   push    00                        ; OF_READ: t/ a( n/ m# a6 B; \# i, Z. w
   mov     eax,[00656638]            ; '\\.\SICE'( t& I6 A7 Y# T
   push    eax
3 \3 z0 z$ ?3 J- y! Y8 S; V   call    KERNEL32!_lopen
4 \# a* h" l! x   inc     eax
1 X: ^4 O3 u6 r+ z; Q* O   jz      006505ae                  ; not detected
% U$ ?! D: x* c  n5 j
3 a8 h$ k8 S& d. Q& I2 k, x/ w8 C+ B; L" Q, _) X! Y
__________________________________________________________________________) N" u6 p% H( ]' }4 P/ j

+ M6 \8 x' L# i9 kMethod 12
5 R* Y, R' t" V( S. H) H=========
5 l0 H5 h/ ]5 k3 X& i& }6 c" u' t) o& w& l- {, e2 b6 f. R
This trick is similar to int41h/4fh Debugger installation check (code 05
& n# O  X* z& n5 s* ]; y9 j&amp; 06) but very limited because it's only available for Win95/98 (not NT)
; D* R. g+ G  V$ T3 T, b$ |& Q& Zas it uses the VxDCall backdoor. This detection was found in Bleem Demo.
3 I8 f: J# {5 ~# A
5 B9 y0 ?2 p6 M. Y$ ~( |   push  0000004fh         ; function 4fh) C+ Y/ \5 T  {* Z/ ?
   push  002a002ah         ; high word specifies which VxD (VWIN32)' u! S# T: }, Z- ]7 n) g. O
                           ; low word specifies which service
. J$ {6 i" i: `1 C# G5 ~# C                             (VWIN32_Int41Dispatch)/ Q. d% b& q$ s: y' B* \) z& X
   call  Kernel32!ORD_001  ; VxdCall
; j4 U  N( o+ @  O8 b2 {8 |   cmp   ax, 0f386h        ; magic number returned by system debuggers" T/ M) s% [; b, G/ ]6 H, Z% |
   jz    SoftICE_detected/ p: v& A7 Y; k0 {, n3 \

% F) J; U, O% m* k; j: }1 aHere again, several ways to detect it:
4 Q+ t4 S4 N* X& m( b1 p8 d. Q: |8 b) u$ M
    BPINT 41 if ax==4f: S+ g! ~9 f2 I* b6 x
" G( B0 ?5 D4 p; g( @$ E# ^
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one, P7 r- D3 H5 _. ^; B5 [

% M0 M4 ~+ W# I6 W; Y: ~4 C/ }    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
9 ~2 {9 R( u: s' l& q; ?" V  z9 {4 A' b, G, ?
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!4 s/ u/ B+ b$ S0 `$ e. C6 y

( T% J4 m& w+ c3 [9 u__________________________________________________________________________6 l/ |" h4 z" a/ o4 ]/ D! q9 m
. [% e9 F2 H  m; [. B/ Q
Method 13
9 D9 D2 G( T/ I=========3 I, z  I8 i/ o. N3 c( b
4 H2 \+ e& P/ p7 @! w9 V- T
Not a real method of detection, but a good way to know if SoftICE is  |) x" T% A, k8 B( l- o: D  Q. }
installed on a computer and to locate its installation directory.
/ [% L. l. n( @0 SIt is used by few softs which access the following registry keys (usually #2) :
7 D' N$ {! i6 z/ c9 g- t5 ?7 y3 U) P8 ^5 y# d8 g- e1 ^/ Y- P2 o$ j# ~
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion$ Y: \" u/ ]* |& n1 C: c/ ?
\Uninstall\SoftICE5 `# L# z/ |3 l4 H5 O, l
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE: @+ c8 Z0 ]4 O, d
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
: s+ E# v& f! V: u5 K\App Paths\Loader32.Exe
% \# C  h& p: @7 `) ^$ {% ?9 x% r( |# z6 o3 w8 d/ X2 L3 f
( P3 n1 f7 P9 s2 J
Note that some nasty apps could then erase all files from SoftICE directory
1 T+ p7 G7 e7 W(I faced that once :-(! _/ P! \+ B% Y* m
. u7 U( k1 n) G9 x  t4 X* E& s
Useful breakpoint to detect it:- T$ k% Z( G1 T+ I9 ~
( h1 ?8 s/ T4 b/ b
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'. @1 G; W3 ?' o: {
0 Q0 h# }/ `- ?% z$ F( ]" ~
__________________________________________________________________________2 E% o! P, J3 g! l/ s2 A: w- A
' O3 i# H" i, b$ Y
+ i0 I8 |2 S9 m- m. g, K5 s3 M
Method 14 7 m4 l+ I! V& f1 \  y* L/ Y! g6 @
=========$ l+ i+ T# e! |. r% J9 x

4 C& b2 Z" D( n0 z" I; P  a5 \$ KA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
1 a0 N/ N3 R. @9 F* R# tis to determines whether a debugger is running on your system (ring0 only).
; `4 j! Y: w/ S; v3 a' V& P" F( I. @! a
   VMMCall Test_Debug_Installed
- M! E3 d5 l$ [' M   je      not_installed
" c  |' ^' Q" n/ K' h
1 v2 V, c6 |- y' |This service just checks a flag.
1 _7 V( F7 T' X</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-7-29 17:19

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表