About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>8 r" ^, k1 b, |, E; M7 {( I0 h3 h
<TBODY>+ V! |( O& M  W0 U, v& i: c
<TR>
1 b4 P- w' ^2 H& ^<TD><PRE>Method 01
9 d; h3 G; V( K. C6 U! n4 N=========
% K/ Y1 h% i2 C) A7 f! o% f1 _5 o
This method of detection of SoftICE (as well as the following one) is
/ V5 t4 }2 M2 L5 R) k* q. U2 vused by the majority of packers/encryptors found on Internet.2 h1 Y$ T; q% a7 w% V' ^
It seeks the signature of BoundsChecker in SoftICE
; X) U0 `% V$ p  h% a! I4 c: i" K6 L5 m4 E$ x% k9 |
    mov     ebp, 04243484Bh        ; 'BCHK'
0 O5 g9 t, i* v7 F( C    mov     ax, 04h! H3 x4 @2 r, d
    int     3      
( O' ?$ o/ x3 r, G; ]- n$ S2 x    cmp     al,46 Z1 j  i/ Y( ^3 Z/ t- S
    jnz     SoftICE_Detected
, |1 j* G  N5 a+ S9 X, h( F# R
2 c; P' @. \# D) Y" f___________________________________________________________________________2 P; a( O2 @9 A- i1 u
7 U+ f& Y. V/ |* Y  U8 ~
Method 02
+ S/ J4 C  I) \; K=========' w$ @3 o/ o. i; J: v8 z

  Y  k6 S  ?  A1 iStill a method very much used (perhaps the most frequent one).  It is used& j7 D) K5 L3 w) J$ Q
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
% @3 W1 i$ z) N; for execute SoftICE commands...- }) z" _6 P! x* B
It is also used to crash SoftICE and to force it to execute any commands" K0 i& R* `5 k9 N
(HBOOT...) :-((  6 z+ B' q, }) {: ?( [; ^; q! T, v% j8 x

1 U1 D; d8 I0 M5 X" cHere is a quick description:
, C; _9 W0 u( N% }- Z-AX = 0910h   (Display string in SIce windows)
- k+ D' n( ?" W) w8 C- ?: s-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
/ H& S' v: ~5 F5 Y. z* V& A-AX = 0912h   (Get breakpoint infos)
8 ]( u; [# B- K1 h& p1 j, x-AX = 0913h   (Set Sice breakpoints)- G8 R; A2 i- \4 e/ F
-AX = 0914h   (Remove SIce breakoints)' \0 ]* U3 }8 q. ?; g

# t3 f$ T+ ?3 Z/ e! ]Each time you'll meet this trick, you'll see:
6 N  K& z( j% S/ x# Y-SI = 4647h; f6 E" [- v! k9 S+ g; u( `8 Y- |
-DI = 4A4Dh, f9 P9 f7 G) B' `) f
Which are the 'magic values' used by SoftIce.
. |0 h* X: Y1 C$ w# lFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.) C# g/ R( w: v# m7 T$ y  ]. a

  n9 [- K2 S, \  B5 p4 oHere is one example from the file "Haspinst.exe" which is the dongle HASP1 _8 @1 K0 e4 _. Q7 N
Envelope utility use to protect DOS applications:
+ }4 e, X$ ^" Z  [& C  y$ x
1 c" B" B% Z, n; R" Z8 e) Y5 t& ]( p0 S/ P" {9 `
4C19:0095   MOV    AX,0911  ; execute command.
; B- u6 y( ~; R& y/ A4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).; y: x, k* V( c  Q) \  W
4C19:009A   MOV    SI,4647  ; 1st magic value.
  w4 K* @( H' b4C19:009D   MOV    DI,4A4D  ; 2nd magic value.& r; \$ {- b7 A' h/ `' _
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
. i; X$ ^1 C2 J4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
* Y8 n7 v- H. W4C19:00A4   INC    CX/ @# m7 P6 ~' M: ~
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
- I. x3 S' @/ R' ]4C19:00A8   JB     0095     ; 6 different commands.( h5 W- W% P: W( a$ H2 i
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.5 F1 V5 O, p8 Q2 l# `. }1 L
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
7 K- M# ?# M' u0 \' j5 ~  H6 F5 I$ t; {  o- F) a
The program will execute 6 different SIce commands located at ds:dx, which
# ]/ v/ b$ k9 B- f$ Y) Bare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.# {3 K4 L9 s. t: r4 Q- v# a% i

) T+ v$ N: e2 _1 f7 d* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.7 U# Q4 y4 \, |4 }
___________________________________________________________________________
/ d- L4 K7 `; S: i6 t8 {6 W. {1 |, D. b9 k( e

: @' m: I, |4 @Method 03
2 ~! K% d1 E9 s) k9 ]- ~+ H=========& R0 y) D$ `7 K8 I
* G9 S$ U2 N& n9 z
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h! y9 ?- D- G6 ^5 b! M, N
(API Get entry point)- X: J& _) J' W% [
        
: U8 ?( q) Z: u9 Q3 z5 Q5 W; _- ?8 N$ M+ ]0 r. |2 s0 S
    xor     di,di
# G2 W9 W7 n, `" i; J    mov     es,di
+ n0 V5 H. c' R' m3 F    mov     ax, 1684h       9 I0 W8 Z0 N) {0 v" R. ?# K; |  A' M
    mov     bx, 0202h       ; VxD ID of winice9 m5 w( ^! O* F' n5 d6 R
    int     2Fh8 Z* z. Q5 Y& t1 S- D! {
    mov     ax, es          ; ES:DI -&gt; VxD API entry point+ V9 f; k) A7 C) ]
    add     ax, di% O  r2 v/ d6 K6 Y% t' w5 Z
    test    ax,ax0 l0 V8 g0 s  t
    jnz     SoftICE_Detected
  r$ F8 d  M& i. w! w+ [! r+ }+ B
, ^: Q0 r# V/ j! k+ y___________________________________________________________________________
5 a: A) q) {0 e- C  I/ R1 o) F! k  y! t  ?
Method 04
+ |3 `/ Q% Z6 h1 f=========  U' o) l( G* ~" M, t" Z  O

& O5 o" H2 `8 {Method identical to the preceding one except that it seeks the ID of SoftICE
; N# {; h- V. W+ TGFX VxD.2 V2 d! N8 ]. I. S1 `! c* B" i
8 v* i# a8 {% S1 q6 b
    xor     di,di
+ {, p6 w/ M- N: r    mov     es,di& n; t0 b1 |  F
    mov     ax, 1684h       ! ~. ]7 c/ E0 i% `! \
    mov     bx, 7a5Fh       ; VxD ID of SIWVID
8 q, D) B' V% K    int     2fh
+ w9 B3 Y; o1 a! D    mov     ax, es          ; ES:DI -&gt; VxD API entry point
3 T0 j( q+ R3 y* [$ N    add     ax, di
  d; s) N, c- B, y: W# D* d2 M    test    ax,ax
. z7 |$ o+ T  r; H+ e    jnz     SoftICE_Detected
( t+ }8 S  R0 r( N9 j. {1 f1 }, [# C+ m, ^6 c
__________________________________________________________________________. r1 G# b0 t2 c2 C3 r

/ V- s2 ^, n8 R2 h* c5 ]0 c# V6 ^
Method 050 b& Q0 a1 y2 S+ N6 w. z3 G2 y8 O" J
=========
5 D) c5 A5 ^3 M, N' Q! ]
0 t1 l; U2 t' Y$ jMethod seeking the 'magic number' 0F386h returned (in ax) by all system! z/ D0 }# c' E: N5 _% U' @3 G. o) `
debugger. It calls the int 41h, function 4Fh.
4 C- K6 p; o, @* U# V( X. bThere are several alternatives.  9 ^0 e( ^+ W) D. E5 X: a
! P8 o9 N) f2 ?  \6 M6 K- @
The following one is the simplest:* w, O! r& b* G. i3 o
- c& S( @( }! U9 o
    mov     ax,4fh
( n! W# w. |) T7 u8 S8 i; M    int     41h$ U( Z( [$ z4 m. H8 d% N  f
    cmp     ax, 0F386
+ i9 G; Z0 b# q4 |1 q! F    jz      SoftICE_detected) c" u3 T5 H5 f2 X4 C) t
' m) f* i( i' J

0 W  D# g6 _3 v/ n* ?6 VNext method as well as the following one are 2 examples from Stone's
: `8 w0 l" Y0 H( x' v: U"stn-wid.zip" (www.cracking.net):
- C9 J# S  |* K+ o# g
  O3 F  E2 ~$ n: M, A    mov     bx, cs8 b; r0 Z1 l' O0 T4 ?3 l' k& a
    lea     dx, int41handler20 N* F/ q/ B8 Q' b$ H
    xchg    dx, es:[41h*4]
8 H* |$ u9 T7 _4 o- z* Z    xchg    bx, es:[41h*4+2]$ c6 l: M4 n# p$ [. b/ S
    mov     ax,4fh0 z: L6 I" ^$ I& B4 @
    int     41h: M# v. J; p& g! |7 D4 I9 L
    xchg    dx, es:[41h*4]' z5 J2 k$ P, Q9 Q
    xchg    bx, es:[41h*4+2]5 g* j8 G5 W& j& I, q( B
    cmp     ax, 0f386h
0 ]) u& B. {" A0 p4 K    jz      SoftICE_detected( y5 S  m. ]* k
5 `7 }  D* X1 R& d, h
int41handler2 PROC0 n; p8 L/ ?  N6 |8 s0 X
    iret
, `  w; K5 f( wint41handler2 ENDP) U  W# `- i' W& z) ^1 O

7 S/ @- E. U' q7 q% P/ J2 }
" c& B% V+ T. T9 m) f6 F_________________________________________________________________________0 E6 y8 m4 x/ U6 E( ~! d5 H( u- g3 P

0 Q* Q" ~2 o+ n. D
" T( |; a  @% t/ |1 i% gMethod 06
' o) u4 s6 C9 [& W9 p, l% ^3 _( Y* ?! I=========
9 L2 K* C$ X! R+ Q0 P+ W
) @- n  Z- i1 u: ?
$ c* k1 A; V1 L$ B: M2nd method similar to the preceding one but more difficult to detect:! A2 G$ g6 `! ]8 c

+ s# b$ |" e) {5 z# r. u2 V/ t- j
int41handler PROC. B6 k+ f; {# @9 \; o0 }+ [
    mov     cl,al4 f4 \3 d& `; T5 h% {
    iret
# p+ R$ \' ~7 \4 K. B6 ^int41handler ENDP; ]; v( u6 E. |

9 c  ]; Y+ N) h% E
/ `7 K' n2 K& S! t    xor     ax,ax6 p7 b; h8 E$ V3 K  K
    mov     es,ax1 H8 ]3 o0 Q- C7 q- u' C
    mov     bx, cs% G) d5 {' `9 ^
    lea     dx, int41handler
4 v9 ]3 D# Z6 V1 W2 U9 Y* l    xchg    dx, es:[41h*4]
" S; z3 s3 I1 ]' {) B; u& E    xchg    bx, es:[41h*4+2]# g. H1 [6 h" y( \
    in      al, 40h. ~/ y; b" y2 w8 _  Y& b
    xor     cx,cx4 L* Q1 J& S# o) ?, s
    int     41h
) a0 D1 F. C  O. |4 s    xchg    dx, es:[41h*4]3 C2 _- n, s! A( T1 n  G; A  c, K, Y
    xchg    bx, es:[41h*4+2]
+ o0 |6 z/ S# e' j7 N+ `( \    cmp     cl,al- h/ y- ^) Q3 w3 q7 `
    jnz     SoftICE_detected
; Z0 S* j8 x2 d
# C9 u* P( J' c: E: g* ]_________________________________________________________________________
8 ~7 V  N7 w+ v- X" y
, m0 a$ F1 l0 ~& \2 U- b$ q$ VMethod 07, D1 l# j8 s2 i- X- l7 J8 N
=========6 ~5 p$ e8 T3 y; k9 |# k: ]

4 a7 w# Z3 N3 k- p! x- j% q8 K/ aMethod of detection of the WinICE handler in the int68h (V86)" j' Q- e* P+ K' Q! M' l, y
1 U" n3 l7 D1 l0 ^
    mov     ah,43h
8 Z1 q5 u1 A0 w! e    int     68h
: H- r. C. l& b# D2 @3 o/ g! C    cmp     ax,0F386h
8 M( e' R$ t( q    jz      SoftICE_Detected
" ]4 v. H: Q  D- a9 Z) x$ u( G' Q* Z' z4 A6 s" U

% i! G7 ?2 `$ S! ?( k=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
7 @8 Y$ @6 k' ]6 X: ~) h   app like this:$ K4 h7 \' @2 Q) `3 E
5 f0 Z7 q$ F1 V% {8 f7 h' h
   BPX exec_int if ax==685 b+ r8 d* g! j' f4 G2 J) K: Z
   (function called is located at byte ptr [ebp+1Dh] and client eip is/ @: i! ?& z, N; B- c* o  |
   located at [ebp+48h] for 32Bit apps)4 F4 e1 C* U; u- W9 ~, h/ @
__________________________________________________________________________- v$ S. y1 \' O3 v- A

" n4 P7 D9 {- U0 x( A* ~
; J! H! G' R. YMethod 083 X( d$ O) M; O- m# H- ?
=========
2 p+ H& ]3 F+ P7 J; s( r% D3 @1 J; Q: w8 Q. t
It is not a method of detection of SoftICE but a possibility to crash the
0 w! S' B% d( M' k+ E& U! B+ Msystem by intercepting int 01h and int 03h and redirecting them to another7 M' C" o" }3 k' }3 N
routine.# i: w& [6 g; E/ t4 G4 l0 t- @
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points& |! o- l& Q, H7 N# b  n
to the new routine to execute (hangs computer...)
# ]( N& y9 ~" w8 W
3 k, [; t& @! r! p- m- w. r4 \% r    mov     ah, 25h
1 m* G4 S% e- p* j+ b3 Z( x    mov     al, Int_Number (01h or 03h)+ h; U" @  s' Z3 e1 N9 J; I
    mov     dx, offset New_Int_Routine
) w9 u- Q1 i$ u& h    int     21h
; x7 x8 ?8 _( w% G" t+ ?/ \- y, B" x! D" Q, G
__________________________________________________________________________4 w1 g+ j- M8 S2 r) F7 f" S; q

0 s8 `; S, N( O  i, [# s( sMethod 09
' @1 \" H: ?. C& _=========- U) K' V; l2 g9 c6 s/ y
/ M# f2 w, ^8 P( {4 y/ n7 V
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
# Y/ V8 y3 W1 M: q5 y) Eperformed in ring0 (VxD or a ring3 app using the VxdCall).9 X9 _0 \4 V; X% L8 n
The Get_DDB service is used to determine whether or not a VxD is installed
% u  ^3 N0 ?' ~8 \: _4 M' ~for the specified device and returns a Device Description Block (in ecx) for) Y2 U. p2 _; N/ p7 S) b
that device if it is installed.
2 i+ c$ c; f" d% J6 ^. `
2 G- _3 a4 k7 P6 Z* i: u   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID8 ]; D3 a( N% e. o
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)) @* I0 }* [; H* m
   VMMCall Get_DDB/ L9 d' m' K/ U. R) o# {6 p, N
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
) z4 _& L' e- I
% T/ v; A, w8 {9 |Note as well that you can easily detect this method with SoftICE:- w; D% c. s( u) H
   bpx Get_DDB if ax==0202 || ax==7a5fh
  y; s9 U) |: }% Q5 G  W, B- Q( B
, S: p( x+ f; p4 p1 x+ x' T! K+ z__________________________________________________________________________
/ _, e0 \" j# {' I
4 |; M4 A2 ~# G" @1 M  TMethod 10( Z& W- [8 T, k7 i
=========
& Z( A0 Y6 [& u; U+ k  W& F( x% L/ l" J" r. l  L1 N1 ?0 {/ V
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with' Z8 x6 p7 g$ K) n
  SoftICE while the option is enable!!
8 Z6 }1 U& B5 H( H
! S; P( n, [% iThis trick is very efficient:! x' X4 C7 O( M  m0 V2 k" [! O
by checking the Debug Registers, you can detect if SoftICE is loaded3 @3 f5 j  t% J+ E, t1 g5 \
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
3 j) i$ E- \5 ithere are some memory breakpoints set (dr0 to dr3) simply by reading their
5 w. [! O+ u$ t# L9 v* J: Zvalue (in ring0 only). Values can be manipulated and or changed as well: _' w# F, U! H" t1 c* ]
(clearing BPMs for instance)7 R  [- \) }5 ~3 c9 x- e5 e

% z0 X/ d. q4 d  A" J" v__________________________________________________________________________
2 [+ ^) h. T" I' e4 P& m8 R) p# m$ J! d3 Z; z6 z; L
Method 11
7 z# k. z8 I3 U8 P=========
* {3 W" p6 f- u. \! V  {; }0 ^8 x. {+ p9 r
This method is most known as 'MeltICE' because it has been freely distributed9 K2 q7 u+ w' A( E0 s! ?; K
via www.winfiles.com. However it was first used by NuMega people to allow
. U; C2 q4 V6 Z4 R; T( QSymbol Loader to check if SoftICE was active or not (the code is located+ `2 s' \: ~2 j8 M6 z' W
inside nmtrans.dll).3 q6 G; E6 N4 b5 ~

. F0 Y; k$ X$ q; `The way it works is very simple:
% A) E$ l' N# h, h, N6 j* wIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for/ j* l# R( s& `  c
WinNT) with the CreateFileA API./ `: ?1 g: `8 d( `
2 Q; G# c+ p$ X+ |$ K
Here is a sample (checking for 'SICE'):7 I5 A* y; R& U! T- L: B/ |
5 i' i0 F; {3 z* r, E( [
BOOL IsSoftIce95Loaded()
- }- Q+ h+ \# y* z  |4 z{
8 A- v1 E- T4 x( M   HANDLE hFile;  
* P: `+ J% L) e9 @  c4 {   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
/ [2 j6 o4 T. `4 B( [" T& \                      FILE_SHARE_READ | FILE_SHARE_WRITE,
( o2 I) T1 U/ J7 ?0 K                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
1 J) L: v, c/ O6 O$ a% y   if( hFile != INVALID_HANDLE_VALUE )
; B! P3 H# z. y" f8 u   {
' B, T2 O+ i4 q7 J+ k$ D      CloseHandle(hFile);- z0 g9 p7 E( V$ B' X  k# D! `$ R6 W0 I+ Z
      return TRUE;% g1 `& n4 S; m3 D! J" X7 a
   }: _6 z, D$ t/ K) q
   return FALSE;9 X8 G$ K- B( [5 |' H. _1 o5 D
}; z6 ^9 F9 T' c# |2 q  `1 }
6 K0 U- j  @/ A0 \  R3 T
Although this trick calls the CreateFileA function, don't even expect to be& c/ D) s' W3 T& `9 n* O
able to intercept it by installing a IFS hook: it will not work, no way!
. L, Z: {5 `9 W8 S7 KIn fact, after the call to CreateFileA it will get through VWIN32 0x001F0 W. H3 {. `  T3 j+ g- O
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)/ O4 k' k$ G+ E0 U5 A5 N
and then browse the DDB list until it find the VxD and its DDB_Control_Proc/ D8 x1 K& ?' Q; \3 Q& C( ]  a  b/ F
field.
0 p0 Q. O! i5 A1 B8 \: b6 b$ xIn fact, its purpose is not to load/unload VxDs but only to send a : g' [2 ^! ^% {% M: z  p6 k! q
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
& A* R/ [! T6 I. |" W# J0 c9 p& tto the VxD Control_Dispatch proc (how the hell a shareware soft could try
- \& r& A8 Q3 X: @to load/unload a non-dynamically loadable driver such as SoftICE ;-).2 T% E; u& H( Z9 c. @; `5 A
If the VxD is loaded, it will always clear eax and the Carry flag to allow
. d( Y' \8 H* E3 _its handle to be opened and then, will be detected.6 K+ N6 g+ f8 W9 V4 M& A# e( D
You can check that simply by hooking Winice.exe control proc entry point
, g- ^4 A4 c7 b) gwhile running MeltICE.0 L. ^  T* ^6 f

& z0 g, ]+ F  v, f8 A6 S. I# [/ w8 M' q1 t$ t! A1 F& F
  00401067:  push      00402025    ; \\.\SICE. y# B1 A* B$ g/ k% L8 i0 c
  0040106C:  call      CreateFileA
; {: x- a* ^& v. i3 b  00401071:  cmp       eax,-001' [7 P# |3 a; J
  00401074:  je        00401091
. X2 ]# C' U, Z. h6 y" l
  {( Y6 N' |. T, q* _( K8 R7 J8 U5 Y( r
There could be hundreds of BPX you could use to detect this trick.
9 K* _2 g5 w3 Q) [0 d-The most classical one is:. W: B& L' R# [6 Q; _1 V
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
/ R; D8 @* m( f- }- F1 ]4 p! F    *(esp-&gt;4+4)=='NTIC'
! {9 l' `. ]- O  s) h* F
' i% I' W+ [& p7 c. @-The most exotic ones (could be very slooooow :-(# K$ |+ r7 C% o9 u. f, P/ [
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
- B$ }( ]+ w" P- ], i1 A5 q     ;will break 3 times :-(
/ A8 |9 m; ~, B9 t1 e! G# I; [2 |0 G( |
-or (a bit) faster:
: e3 _' `+ h+ u* J% \# H   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')( O1 c* W# Z* p6 ?0 `9 D. F- f
. x1 B6 N- F- D2 L& J
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
1 X* R- g0 X- p) E2 z' B# H     ;will break 3 times :-(
0 x2 W# q* |% N9 j3 k1 A( y+ K) r7 A. k. ^. W
-Much faster:1 k; \( C6 I5 L% a" z
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
. y  y: `; C/ t4 g6 b% s# m+ S% _4 H4 \/ }! B1 ?
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen' w% V& v4 u( v6 q
function to do the same job:
+ a1 F/ j8 @5 s. m2 ]. S
$ f. P. w  T+ z   push    00                        ; OF_READ
. F- y* v/ k- r* x   mov     eax,[00656634]            ; '\\.\SICE',07 t( Z3 [& T0 f- e
   push    eax2 T2 I' q$ O' a0 K3 e$ O# w4 e
   call    KERNEL32!_lopen
, f  ~7 h1 f, y: o9 M7 M# p. U   inc     eax0 e9 Y5 z/ ]0 U1 a. \4 u8 M: @
   jnz     00650589                  ; detected
) l6 g( U9 G' ?/ E& Q   push    00                        ; OF_READ* z- i2 q# `9 k' }: u  Z
   mov     eax,[00656638]            ; '\\.\SICE'
8 G$ a$ z( A7 B2 `7 a$ M   push    eax* ~9 a. N7 K! c% ]3 B
   call    KERNEL32!_lopen
( [" t3 V8 z2 ~1 U/ ^# v+ j( [9 R   inc     eax' A+ _$ A7 w# o/ y1 @" \
   jz      006505ae                  ; not detected
1 y3 {, x5 d. X( y0 J* X" y
( }! C( A8 w2 @: ~* L  i) ?
; _! d9 a7 X1 R$ f$ @0 e6 c8 m__________________________________________________________________________
* S1 d7 D. F  r5 ^& n0 [
2 d) ^; n1 m5 V" r2 U( D% vMethod 12# J1 Z1 b2 a' V# H
=========5 q0 X9 F  a3 m4 x9 Y" ?0 E
" K4 \$ y, [! Z3 b
This trick is similar to int41h/4fh Debugger installation check (code 05
0 }( O- a; o" z; |&amp; 06) but very limited because it's only available for Win95/98 (not NT)0 s: q* I& I2 Q6 [# P
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
  ^. j! u5 o! f. ]3 M3 a$ o* D( f/ O! y* p% Y7 w  h2 V" G. b
   push  0000004fh         ; function 4fh. y$ _! ]7 z6 ]+ X; {. C( P
   push  002a002ah         ; high word specifies which VxD (VWIN32)- a+ k, g& E$ S6 h+ [
                           ; low word specifies which service
2 C1 D9 B2 ?' d' r                             (VWIN32_Int41Dispatch)
9 o" G+ _  H% O) M) s, N   call  Kernel32!ORD_001  ; VxdCall
, A+ r7 r$ S$ s9 \' A+ b   cmp   ax, 0f386h        ; magic number returned by system debuggers
% O' r3 ~/ X/ \/ @2 }$ p& Z+ S- _   jz    SoftICE_detected1 v+ h4 w; J* Y; x
$ g0 K. k+ z$ o0 v
Here again, several ways to detect it:
, Q6 x1 O- n* W5 k' v2 h
! E2 }3 Q  Y1 x$ K    BPINT 41 if ax==4f5 J, I7 f# a# u5 s  Z# z! t
7 v/ e( d& Q  d+ U4 c
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
$ b, B4 {2 c& |. h. T/ e9 L& p7 R5 N) x; a. j( z
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
6 [4 Y' M& H$ V
' I! w! |. M0 C) n: l( r6 `    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!, i$ `1 J" V5 Z) C7 F

6 c4 h7 @% m8 Q8 k__________________________________________________________________________
! O/ X) U' ]0 Z5 e. \
6 b& ~- d9 N7 m/ bMethod 13
8 b( j  Y1 K5 S; f9 c' e8 [6 K/ J: z=========4 M, |3 @/ e0 Z, |" n
+ c' B1 U: I8 V; A4 U
Not a real method of detection, but a good way to know if SoftICE is
& [- U, }, _/ V( y" l- g9 _6 rinstalled on a computer and to locate its installation directory.0 G( M4 r% r$ e& F2 s/ V. W+ p7 f; Z
It is used by few softs which access the following registry keys (usually #2) :
. u' Z: y3 k& z1 _# m6 A9 u9 O1 o+ J8 A' p# K% W0 C
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
, z8 f: i- M  Z: r- j! q$ X" f9 z\Uninstall\SoftICE- r4 @- W, |9 U# K6 b2 s9 g1 e
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE5 c! r1 U: J5 i- {  R9 s$ h
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion, {9 O' ]9 z1 V& P; k
\App Paths\Loader32.Exe% r, C* |6 V+ B% }1 x
: T1 v0 h: m" ?( Z; H. ?
9 a% l( D4 L  I4 h6 A/ t: P
Note that some nasty apps could then erase all files from SoftICE directory: s4 P9 g0 g* ^6 }" m* j
(I faced that once :-(/ d7 K# x# f$ s. d8 V+ ?

: e6 e3 E4 x0 K' w" }Useful breakpoint to detect it:
) w5 p$ V  |+ Q
8 ^# j4 I+ V# u$ _* Z; y     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
1 I% F3 y' Y* Q& k1 S+ d" ?- T1 }5 R+ k7 D' Q/ Z; `6 b
__________________________________________________________________________
% `+ _! b- f$ f- t% u0 Y: t5 s9 z
% x% d9 C/ D9 q1 F/ g
Method 14
  }& Z- j7 C# B=========, O) A7 H; H) N* \1 F, ]: w
  r& i( B$ Q5 [6 W0 I4 u5 Q
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose2 i. l5 c9 U( m  r/ z
is to determines whether a debugger is running on your system (ring0 only).
, l: t) l% w" A2 P
' R" x+ W( z1 p5 U+ i   VMMCall Test_Debug_Installed
) a/ \3 P- M" d7 I   je      not_installed
2 V& [: d) B  b+ A4 p; S" k# f2 ?. [7 Z
This service just checks a flag., A! g0 r- [) d
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部