About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>. {1 y  J  M4 h- m' a! g3 w
<TBODY>
8 a) ]  O! V$ ~, T8 Z+ v+ c. v0 s6 B( m3 W<TR>6 |1 C: n; J8 X; o$ {; I
<TD><PRE>Method 01 / @1 w1 @% ^6 W* w6 {
=========% Z% w; K( m/ R( {& I

+ M* s; \3 H  Y  A  iThis method of detection of SoftICE (as well as the following one) is
9 X- |* z* s0 cused by the majority of packers/encryptors found on Internet.0 @% s9 |6 r: J3 Y
It seeks the signature of BoundsChecker in SoftICE# B( {- j2 Z; H5 C
7 W  d' f" Y% ]8 f. `+ I! y
    mov     ebp, 04243484Bh        ; 'BCHK'7 b' X1 g7 s: M- ^- [
    mov     ax, 04h5 G" \+ p/ F1 y4 v+ B; f! k
    int     3      
% V7 `/ R) C" y2 [    cmp     al,4
( l, k. E7 l: `3 U9 n    jnz     SoftICE_Detected
. f7 x  f0 w! ^# E1 ~$ k3 m& s
. E- P0 L0 P9 g' f___________________________________________________________________________
4 R/ N& w$ I- j; ^- _8 Z- ^# N2 z, I2 a
Method 02
* E2 ^# A. h5 w=========
" C5 y2 {& ^9 l9 A
3 ~4 T$ t1 @) J3 aStill a method very much used (perhaps the most frequent one).  It is used
; b1 w) b% E. O& E) O: e, A/ R/ I6 Kto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
4 Y3 n9 V& k) i8 i: x( v. Mor execute SoftICE commands..., I  u% u4 {& w' U$ r
It is also used to crash SoftICE and to force it to execute any commands
2 d; P5 b7 S- l(HBOOT...) :-((  " q5 n1 c* l; z1 T( o
$ C7 z& h7 G, m4 @$ S4 q/ w' @' k$ n
Here is a quick description:$ I4 g$ ^3 M5 d1 A5 N* X6 j
-AX = 0910h   (Display string in SIce windows)! U1 d! V1 Q" R5 Q
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)+ M: Y, ^' O- g( f
-AX = 0912h   (Get breakpoint infos)3 I! O7 P( e4 M8 u
-AX = 0913h   (Set Sice breakpoints), ]7 v+ j- r" A( l
-AX = 0914h   (Remove SIce breakoints)+ G& A' a9 f; K7 K" O& x
* w5 t7 ?" g2 \# b7 Y3 Z7 g
Each time you'll meet this trick, you'll see:  d5 f1 f' _1 q
-SI = 4647h" b3 r# B  x& K: J( W6 S, H
-DI = 4A4Dh
4 v/ _1 [, _0 `3 mWhich are the 'magic values' used by SoftIce.
; ^# x: l& h1 j* ~: S. Q3 \* _For more informations, see "Ralf Brown Interrupt list" chapter int 03h." i7 [3 n  d8 a9 t
# ^* j" i4 Y5 O
Here is one example from the file "Haspinst.exe" which is the dongle HASP
+ S+ H/ y; h  H$ fEnvelope utility use to protect DOS applications:
4 ^1 D- k) D- l0 ?( R7 ]! ^# u# N  t" |" I

3 t9 U3 @, S( Z/ H' b4C19:0095   MOV    AX,0911  ; execute command.
5 i- l; R5 s% n* O$ j+ A2 O( e4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
" p. o6 R" B; o) _5 o4C19:009A   MOV    SI,4647  ; 1st magic value./ K5 v% X+ z: H
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.3 Y/ W4 U& T+ X1 p4 h
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
- s$ F+ |$ S+ C- C) ?4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute  T& i) s: d6 f* C" I0 T: l
4C19:00A4   INC    CX
# V/ X9 M+ i& n: Y% F- A1 L4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute; [( f* c* u6 U1 |
4C19:00A8   JB     0095     ; 6 different commands.3 R- W4 `. J% `& v* l
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
4 ]- v# z. x4 u+ H* l1 f1 x4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :). I' D% N, A2 @  x( L. X4 T
; T+ ^" F" l( K4 N, B; U1 L7 K3 r
The program will execute 6 different SIce commands located at ds:dx, which. C* n1 b1 w7 u2 ^9 o& W4 R+ v: u
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.& g0 i8 U: Z+ l8 c

" B2 \" u! n  c3 A: X- L) B" g" C* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
- q. T% ]3 U4 ^9 R+ ]6 O___________________________________________________________________________
- ?  z# t- ^$ ]3 @: A  S# U0 s4 X! n7 V
+ h% b- D$ X1 ^. a6 w' l  Y3 Z
Method 03; I) T5 P0 f' `2 V+ r) e
=========
! B) ]9 ^) [9 A5 {9 O
. K7 P$ p4 B5 eLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
) u! U/ ?2 S2 T2 @(API Get entry point)
5 T7 Y  y8 P4 L7 l( b        
& h' q7 \" U" |1 r1 v
" M  W& Q4 J, t    xor     di,di
" m% A5 u/ U) x% x    mov     es,di
( |7 e' `( U  P& G" e2 I( T    mov     ax, 1684h      
- m. E' y3 x6 X6 R; j: j    mov     bx, 0202h       ; VxD ID of winice* B; |5 M4 L: Z2 a# @3 ~- P2 m
    int     2Fh
' N" B- H6 m8 T: n3 S6 G    mov     ax, es          ; ES:DI -&gt; VxD API entry point
" u* U: ?3 i4 L1 B) L    add     ax, di
/ V3 R+ ]  \. G) j  i    test    ax,ax, B* Z) J  T) d2 ]$ A
    jnz     SoftICE_Detected" V/ Z$ E. t" \1 W" a

) \" W& W; i" B: V___________________________________________________________________________
) W: s) J; E9 J9 }
* B: P$ v) Q6 y$ C) b  ]Method 04+ t. `9 T+ I3 T' _+ r  f& q
=========+ E% ?  F' J( I1 D' v
2 H* G$ N1 Z$ E
Method identical to the preceding one except that it seeks the ID of SoftICE# I: Y. v. p- Q$ ?& N: V
GFX VxD.9 z# }1 i4 ~# ]# \" |. z! T' L  B

2 I* V% m1 `; v! V+ |, }8 L' h    xor     di,di
4 X7 V" J9 m# H7 }+ ?% _5 M    mov     es,di
- j+ h! M' E3 K% ]3 D% P2 s8 {5 b. w    mov     ax, 1684h      
) q# S4 j4 b* {3 n1 E  H7 D/ u/ c7 q    mov     bx, 7a5Fh       ; VxD ID of SIWVID
' s6 L. u2 \) T+ e    int     2fh
4 \$ T0 z4 A4 e- b    mov     ax, es          ; ES:DI -&gt; VxD API entry point8 i( a# N; e* o3 n3 D% {
    add     ax, di# H9 ?: G4 P$ ~$ Q% o  h6 G$ I
    test    ax,ax
9 E) i4 f0 G! u0 }4 W! k% j    jnz     SoftICE_Detected% q7 n$ F$ Z2 X! _% X7 m/ {

5 D/ d. R0 f: f: L8 u7 o__________________________________________________________________________
3 |) U* r7 m0 I( V3 b
( S; }. [/ ~. W) o/ s& N5 ^5 o) y2 L5 I+ ^6 b$ ~: w/ q( g. U2 n
Method 05! s: c* F$ f- r
=========
5 x2 q# g0 N4 c& M3 h! `% o8 R' v8 `
Method seeking the 'magic number' 0F386h returned (in ax) by all system
% o" [3 e: D  Y% U; Gdebugger. It calls the int 41h, function 4Fh.9 l  @5 c$ @3 l7 i, b) @, V
There are several alternatives.  
( h0 }$ y* I3 h: x7 f3 m7 N% i) w. P5 @- a* x- g/ q
The following one is the simplest:; Q1 O& `4 z; g- A' L* I

7 L; |. K$ u! G3 Y' {% q    mov     ax,4fh- b3 [: L/ I" s! r; i
    int     41h
6 O3 U% e1 T$ x- q    cmp     ax, 0F386- H" I. T- i, K9 o
    jz      SoftICE_detected7 M* A, W4 |6 S
; u- A2 f5 f* H& W, S( ^4 K9 B

# F' m0 @# d  H8 MNext method as well as the following one are 2 examples from Stone's
' Z: q/ ]6 N8 s! t! n"stn-wid.zip" (www.cracking.net):) }& h" C# c5 j1 g7 f3 ~

" l4 X, q% ~5 f( b5 ?. {4 O: c    mov     bx, cs' W, x( X* e6 h' l8 p
    lea     dx, int41handler2
7 C/ Z& Q  x8 ]. l6 i: e$ s    xchg    dx, es:[41h*4]& Y4 J; m# o* T9 S) w
    xchg    bx, es:[41h*4+2]" f% T: E; \. }' u9 O
    mov     ax,4fh
, c/ J8 {% p. \, H    int     41h
+ @( l+ _0 a- o# ^" Y    xchg    dx, es:[41h*4]4 o. f, G) o* ?
    xchg    bx, es:[41h*4+2]1 O6 w+ O: o& L  z$ I! F
    cmp     ax, 0f386h+ a7 n9 X. X# c6 e( t' F, B* F
    jz      SoftICE_detected& [: o( c/ ~/ @2 L

2 J  C. L% W5 ?! X" g. Q: _int41handler2 PROC
# `! Z( p3 X8 T0 ?- i  S& V    iret) ]  y2 M: x5 {# O' f8 ~
int41handler2 ENDP
( y9 X7 G# M  e8 c- c! Y. ^5 V) h0 e
# [, i) |3 Y0 C/ l$ q
_________________________________________________________________________2 z1 o$ z7 y9 d

, T5 C/ t& C& c; z' l
- u" Z' W  A8 w2 f4 Q# W' ~Method 06) j  G" ^) p2 @* X; H) v2 Q
=========3 Z. G) l% }' }3 |+ T  K2 D
1 o  S) D# |5 q
! T* a& \3 m% q8 S9 ?8 F$ {  W
2nd method similar to the preceding one but more difficult to detect:
, k- j& k$ `0 \: X/ i4 e
/ _; g' i" D7 J: F5 U6 M( f) K( R& ]' R( z
int41handler PROC! O$ s2 \. Z2 {6 L: N  h( Z" C
    mov     cl,al# D0 `( M9 R1 g! d2 z  E
    iret  T+ T6 n1 n* A
int41handler ENDP" b% T) ~) ]6 O# [7 }1 B6 i

& X* T7 w& Z& K1 n. b- v8 A* V4 J4 W6 s% e, i" e' X, Q3 S1 h* x
    xor     ax,ax: t8 e  d6 `  D. w' c
    mov     es,ax9 O. Z. p$ e1 O
    mov     bx, cs( \3 m8 _* `: N! M" H8 a: S1 z
    lea     dx, int41handler/ z" `7 h! V  j  D
    xchg    dx, es:[41h*4]
/ k8 E. U) s: \7 C6 L8 i. R    xchg    bx, es:[41h*4+2]6 j( J9 M' I# I! u$ Q
    in      al, 40h* N# [4 |" r: r! j
    xor     cx,cx
3 S* m! [3 S% C% t* g/ o3 c# l    int     41h
. c$ S* t. }1 ?/ h' ^    xchg    dx, es:[41h*4]. i8 m) q! A' q; l4 Y" b) x
    xchg    bx, es:[41h*4+2]1 n8 Q' L8 M% q( h. Q; u& C
    cmp     cl,al# ?* z" l8 S9 |6 p+ }3 l
    jnz     SoftICE_detected' {) G; @% z% {% w! j
! p/ S! d8 A- B- W% J7 G
_________________________________________________________________________( W* i+ @/ _7 m( g' Q3 L! e# H! |, ?1 J
5 c6 ^. Z5 J8 d8 y9 K
Method 07& Z$ P  v$ e* o1 X1 d
=========
' j; b# k+ s- f# d* D
$ L) T. P3 U- B8 l0 N2 p! QMethod of detection of the WinICE handler in the int68h (V86)1 E- [% Y& J: ~# D7 V& b4 g
% M9 |! j1 p0 B9 P1 o0 i
    mov     ah,43h
- |( U4 d( |& L7 o    int     68h( l8 ]4 ?, ^) _
    cmp     ax,0F386h* H4 Z7 M1 h5 G
    jz      SoftICE_Detected
" i' z: @2 I$ g" G2 u  H* l) |: x; ]# G; ]

/ l# I2 ], p# e' w1 G=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
! _! W8 s0 c) p( V   app like this:& P0 ~1 j# L1 F) ~# j

/ f: Z& ?! c: G2 b  v/ E8 g/ u   BPX exec_int if ax==68" G, S( a8 H6 }" ^5 U% T, t; q, G
   (function called is located at byte ptr [ebp+1Dh] and client eip is
2 [: \; R+ y& F   located at [ebp+48h] for 32Bit apps)
% s+ [. |) r5 B+ G  h' j__________________________________________________________________________
4 c. Q1 M) G3 h7 K8 \. p
' j- u6 O& u3 h0 |$ l, P& v0 Q/ T$ F7 L9 D2 }
Method 08
$ w# z7 H, J$ a2 |. L! r=========* F* ^* E0 p. v

# H7 ?: D7 Q  b: T' z1 d7 K7 f  CIt is not a method of detection of SoftICE but a possibility to crash the
/ q6 E: C% e0 E0 H2 M, g1 r2 xsystem by intercepting int 01h and int 03h and redirecting them to another4 g* M# F9 v- Z- F1 i
routine.
8 r: A+ L  J/ `- pIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
1 {! N5 K5 j' d' B" k% l$ r4 Mto the new routine to execute (hangs computer...)
& G/ I2 r% ^$ ?$ W7 y5 i' m# a$ x, L7 \) s4 K
    mov     ah, 25h
6 i  s& e/ [- |2 x    mov     al, Int_Number (01h or 03h)
; w- i5 p5 [1 k2 ]6 v8 t. R    mov     dx, offset New_Int_Routine" S7 q- K7 j+ r6 H& u
    int     21h! i( O+ B" A# n3 y

4 u: J( ]- K. K__________________________________________________________________________
/ j5 t$ v, b# [8 z4 p- x1 M2 A' [: f/ f- V
Method 09
% p# J, n% A1 T$ W=========
1 d. d4 x! H8 u* q* Q1 d' L& c3 U. p
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
) W! h* F1 y0 ]) F6 w6 o9 Mperformed in ring0 (VxD or a ring3 app using the VxdCall).
* |! l8 _  j( {7 O% J' xThe Get_DDB service is used to determine whether or not a VxD is installed; \% W# x8 V% ]5 E3 S; h
for the specified device and returns a Device Description Block (in ecx) for; j) S2 ?& K. B; X8 r1 k) ?
that device if it is installed.
8 U& Q  y7 [+ f" w5 @: Z/ N
8 ^  @! R0 h1 u5 ?$ P+ x0 x+ a   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID( ?/ i8 W( v- g3 ~6 r8 R, ?3 u. n" v% K( S
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-): }7 O! T8 _1 k. r
   VMMCall Get_DDB; [+ Q) Y: S+ Z
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
  y7 z- C; l( w- o& d+ r1 m  b4 e) V) T
Note as well that you can easily detect this method with SoftICE:
) L* v" n# {% C2 R   bpx Get_DDB if ax==0202 || ax==7a5fh
% B# r" ]8 l/ H" g, J8 d' d8 G8 F' |% K1 Q; N" _2 z( C* O* H
__________________________________________________________________________) E& z6 a" L+ c2 l' G2 x
, X( i4 F! f5 P7 M; y$ f
Method 101 M. P# z( @+ J3 r! |" w8 X8 \3 u
=========
0 l+ N' V/ i* v# h" P& V- W, r9 U
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with; K, ^$ E& D& {; A! R. q
  SoftICE while the option is enable!!' e: T' O0 x4 z, p

7 ]% D  u: [- R/ I0 M3 |This trick is very efficient:  i8 y1 S3 Y( M" p" U$ }
by checking the Debug Registers, you can detect if SoftICE is loaded7 ^( w, v; t; Y3 e
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
0 A' n7 B! N0 x$ m9 p8 q, {there are some memory breakpoints set (dr0 to dr3) simply by reading their/ Y& d& d9 p. g! I4 s
value (in ring0 only). Values can be manipulated and or changed as well# a6 E; K& o& Y' }
(clearing BPMs for instance)8 F+ _/ F- D7 [3 G

7 s  f$ J0 W; l3 n+ W' K__________________________________________________________________________+ h) e  S( E, g/ A$ j" L
9 }$ Z; k! f  z, C
Method 11
' {, ~) }6 v4 Z) h* u6 s+ |=========' ]/ a7 b6 |% f1 k+ K* H# G

5 q- N2 v7 P8 s  l; ?+ MThis method is most known as 'MeltICE' because it has been freely distributed' I2 b  D; f3 E2 l
via www.winfiles.com. However it was first used by NuMega people to allow5 v7 N. Q! q3 {6 v: q1 ?
Symbol Loader to check if SoftICE was active or not (the code is located1 q) ]5 P2 M3 h# f1 b- F# a
inside nmtrans.dll).9 n4 G$ Q2 F. o/ {2 Z. _: g

- K/ b/ ~: T& @The way it works is very simple:
$ h, A" U* i  a9 C: nIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for& k3 H* N& p+ s2 A# K3 b3 K% R9 M% \8 J: j
WinNT) with the CreateFileA API.0 s2 v8 X9 T6 i" G/ }

, {" ^  X6 w2 [6 oHere is a sample (checking for 'SICE'):
6 ~# i" u; U1 R, a) P% G; r
4 W, |9 h- t9 t" e& Q  {BOOL IsSoftIce95Loaded()
2 y, l* Y* ?1 g* D4 V8 q+ ~9 F. O{
, [' Q2 u# Y% w5 h1 k   HANDLE hFile;  ) o5 _4 [; x1 C' d3 B
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,* Z( p) G" h( j! _8 |6 X# `
                      FILE_SHARE_READ | FILE_SHARE_WRITE,
8 |0 J! s3 V$ V! T1 n! K# G" t                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);5 E0 I% u5 W  E* X
   if( hFile != INVALID_HANDLE_VALUE )1 O# d9 k/ o( [. Q
   {
7 y2 X' P  r6 t. z6 L- v      CloseHandle(hFile);- i1 ~* C0 H+ @1 E: f- n7 O4 U$ o
      return TRUE;
) X: h7 @# }. F6 \$ ~9 M  k   }& A9 {4 h$ ?' W1 u- I8 \! d6 P& H
   return FALSE;' J! ~0 V- j  r2 o
}, u6 D5 d6 \! _6 r# b
7 O. u+ u' N* Z
Although this trick calls the CreateFileA function, don't even expect to be
5 H3 Y7 v) p. U4 ^) W2 Jable to intercept it by installing a IFS hook: it will not work, no way!( W" U1 p5 c# \8 J/ Q
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
- z3 l8 z* L5 K: I  b2 mservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
3 T- A0 B" J4 [' h! Hand then browse the DDB list until it find the VxD and its DDB_Control_Proc  L6 a* q6 F' r6 T5 Y9 Z7 f2 n
field.- [  u; M+ X" o1 U2 a5 W
In fact, its purpose is not to load/unload VxDs but only to send a
; m* \( p$ K' E4 OW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
, P. a% h1 M2 q6 D1 C/ V, ]- ]$ @; mto the VxD Control_Dispatch proc (how the hell a shareware soft could try
- e9 G  L" [* d" q* Z/ c' }9 L7 yto load/unload a non-dynamically loadable driver such as SoftICE ;-).
7 P8 {' y: K$ @/ Y7 nIf the VxD is loaded, it will always clear eax and the Carry flag to allow1 [, a2 K: \7 t3 U3 u3 {8 T! p
its handle to be opened and then, will be detected., e0 S0 }5 j6 |: M  o  C' L2 y+ K
You can check that simply by hooking Winice.exe control proc entry point& b* S- h+ Y  r! B% x5 O
while running MeltICE.
5 V+ y! X. V  o
. e; P3 T3 j& \
" u; R6 ^+ U, P, `. G# I# v: k# ~  00401067:  push      00402025    ; \\.\SICE
( `/ ?5 ?- u4 p  0040106C:  call      CreateFileA
! e$ h$ I/ j9 N  00401071:  cmp       eax,-001
  ^6 a4 q6 X( k1 y3 G  00401074:  je        00401091
, B6 l) s, y! M  l2 A& n7 ?. F; A; v7 t" y
# F' P  o7 H  c/ `3 L- e
There could be hundreds of BPX you could use to detect this trick.! a1 H! m2 t: N4 @
-The most classical one is:
: @( }8 [# x; F3 S' `* e! K5 ?  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||5 H' V6 d5 Y6 u# O3 Z3 n
    *(esp-&gt;4+4)=='NTIC'
- @" A, D& [. A" R( d
, F" ]  T2 A& z: E2 M-The most exotic ones (could be very slooooow :-(
0 F5 q% E: b8 B9 ]9 a+ \, U   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  9 y9 r7 ?7 p; A. x; r( m0 T4 R
     ;will break 3 times :-(
) r: Y; ^4 o3 O- }" M9 K  p
& s; I& O  d% R6 `2 Q: ?8 g2 Z( I5 I-or (a bit) faster: 3 d& v) q* R* q" w" A, D7 f# z2 U8 x& C
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')7 h# `1 b( ?* S% E

" G9 H) L0 U" H# \/ L- A   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  4 u  `( s& i0 _- @
     ;will break 3 times :-(
  B; Y' Y* U  o# E) H& x2 j+ O( ?/ w
" j8 h9 |5 n& B. Y  }$ p-Much faster:
" |, R$ `, V" G3 S# E" k   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'" \, b- [! Y% w1 g

7 c: l6 p: I* _$ xNote also that some programs (like AZPR3.00) use de old 16-bit _lopen9 B7 D7 r1 Y" V) A2 V2 ]
function to do the same job:
5 c7 m* A( i+ L5 `" D. I2 U
! }1 X* g. x3 e$ c1 d  _   push    00                        ; OF_READ
+ ~7 l! N1 e8 n3 p+ J3 m! u  [7 I   mov     eax,[00656634]            ; '\\.\SICE',00 X, o7 j! i7 a6 g4 Y+ M
   push    eax3 K' j. q+ t# c0 d5 W
   call    KERNEL32!_lopen+ w7 B) X$ B; ^9 G9 l: G; L' p
   inc     eax% J) x8 F2 ~' ^# b1 i, E; n
   jnz     00650589                  ; detected
7 p1 N! Y& q5 X   push    00                        ; OF_READ
. y$ |7 l4 C6 ?2 R1 d   mov     eax,[00656638]            ; '\\.\SICE'$ q- V. ?9 j4 W7 t8 r9 y
   push    eax: {# |8 A8 V: k/ B3 F
   call    KERNEL32!_lopen! V9 o( K4 M& H+ R6 B/ I/ o! ]
   inc     eax
7 r: |# ?& ~5 q  N* T   jz      006505ae                  ; not detected5 X0 x- `+ ^: n6 S
: \6 S' @0 W$ r+ J2 V0 f

5 n, q: B7 |2 n$ R, E  d__________________________________________________________________________
8 H# w  L7 P) y. R
1 C) q3 s* z( K* a. R9 G% Q# WMethod 12
, {0 `" q0 Q1 K$ }9 m=========
; e5 ~. H: j5 Z. n- n7 d8 x) X- I$ O0 ~) A! M3 V8 ]
This trick is similar to int41h/4fh Debugger installation check (code 05" x2 x; u& K0 T' f
&amp; 06) but very limited because it's only available for Win95/98 (not NT)
8 \- ]$ A+ }* ^4 D- has it uses the VxDCall backdoor. This detection was found in Bleem Demo.
; b, E2 m4 i! c/ r: H$ a. C6 t6 ?+ e1 c" t
   push  0000004fh         ; function 4fh  S4 ]# c8 t: ]1 o' `- u# v
   push  002a002ah         ; high word specifies which VxD (VWIN32)
0 X9 ^4 h0 ?' a- s3 z                           ; low word specifies which service" a- X& T+ a& g7 U% k5 I
                             (VWIN32_Int41Dispatch)6 [" i- U+ S8 Y# T4 Q
   call  Kernel32!ORD_001  ; VxdCall& A1 m$ j; g& Y- i- N8 ?# U3 K) i
   cmp   ax, 0f386h        ; magic number returned by system debuggers
9 r% y; U' T  s   jz    SoftICE_detected
0 T, o5 Z2 c. S1 C- a. g8 C
5 D/ M& i# P  B7 v" d8 i! pHere again, several ways to detect it:0 J+ T3 i% n9 r, F9 I

. y2 [, ~9 e! o6 j7 w' k0 k/ i/ g" Q* m    BPINT 41 if ax==4f
& D$ R% g( B. Z8 d. v2 t4 Z+ F9 M3 V' e9 G& c% b
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
1 Q% `; s5 x  g0 a5 @8 p3 I7 E
) F) u2 Z( s1 S, A4 x+ k    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
, h/ j; V- m! `$ w( X7 G- L! v* Z! ~
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!9 R/ X4 `1 J: Z7 Z$ p9 a
, L$ n3 Y! @) `5 r# i& v- e
__________________________________________________________________________# r! ]5 P  Z; k. Q% i% R- X" h5 U
8 y+ g3 t1 y' F  Z7 j2 l
Method 13
+ ~7 @0 r" c2 g( b2 L=========: q% `  g" F5 p, o5 N" a) M
+ l2 J% U. k- C
Not a real method of detection, but a good way to know if SoftICE is4 L0 `7 F! n4 R2 B
installed on a computer and to locate its installation directory.
2 M1 |- {* h& I, J, t2 d/ P/ vIt is used by few softs which access the following registry keys (usually #2) :( B3 f7 S* J6 E! k9 B# a) a, b4 s
1 o! g" Z! I4 h% G4 a2 l
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion) D2 o" t" {4 z
\Uninstall\SoftICE
! q$ k! c/ ?9 K  F-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
6 D: X* A5 {! o-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion% k; M; K" H* E$ X4 B& o
\App Paths\Loader32.Exe
1 P! W# m6 f# E$ u  M, a5 d; l& A: c3 H2 _, [6 x

; l1 k4 ]9 m' q# l3 `Note that some nasty apps could then erase all files from SoftICE directory
7 G3 I6 n+ N) S# J' _(I faced that once :-(
; S5 `  w  u- P1 H0 x$ x0 h) [& B& M. E! {
Useful breakpoint to detect it:
% ^& @9 b: M* ?7 c9 K, u* |, r' [5 ~+ f
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE': S" x9 z% }" T8 Q

9 O4 |6 }' g( j' }7 y, U! R5 _: K__________________________________________________________________________, I! U; ]+ E  Q5 l- V8 R! E2 t
; V& l3 ~0 m( h' ~# ?" }4 v
& i! ~& R0 q0 A7 @- {; J0 K
Method 14 $ y  _- `; R$ c. b. `8 x' v' B
=========
& S  f& H9 \, r9 A2 y% I# z' {8 K" w! s) i# U& j5 x# R* {; a: c
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
+ k/ I4 \  s& J; H( a& ~is to determines whether a debugger is running on your system (ring0 only).2 s4 K" }0 P7 d6 L4 V9 A
2 O# ?4 u! j' m2 O' p7 h1 u, w
   VMMCall Test_Debug_Installed& F# |# ]+ K* \' d4 }: x: j+ l
   je      not_installed0 m5 e8 w2 H  B& w. `, y
; G4 e7 L1 N2 G  O" m5 `
This service just checks a flag.
5 J- G# ~' K2 W& A, D' l; N$ z</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部