找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
% d* T8 S9 l- `- i% N; I<TBODY>* D  ^  x# j; W! ]. M
<TR>
" ^8 `& [4 _( A- r% G. N8 `  U5 s<TD><PRE>Method 01 + W9 a  J& w0 g; i
=========+ Q. M# w% Z6 B1 {: y
' D) p4 {, L8 I
This method of detection of SoftICE (as well as the following one) is
! H3 M) @3 K2 k+ A& hused by the majority of packers/encryptors found on Internet." k! i; C, ~$ J" y) d
It seeks the signature of BoundsChecker in SoftICE7 Y$ P' W4 @( L* Z- P2 m
' S( s* v) h! ?6 p" {
    mov     ebp, 04243484Bh        ; 'BCHK'
- T' [" l3 G5 ~0 i4 x4 x- x    mov     ax, 04h6 c- @+ J2 Q9 M( e6 f3 W" ]( F
    int     3      
1 e- Z% a) v2 r' U. N, D. X    cmp     al,4
, R0 h; R) Z7 G% T0 F    jnz     SoftICE_Detected
) z" |: Z7 p" w! y
* k' R3 u2 |% D: {* p& V___________________________________________________________________________
+ z6 u) D2 |, E& v: D. Q% w. P" p2 }3 W' B1 h6 O$ L8 C
Method 02
& H: I4 ^- M3 B=========. f' \/ R& o" ]+ P) F& Q" E

4 C8 w+ {8 ]* y$ [$ vStill a method very much used (perhaps the most frequent one).  It is used
  P1 F# j; t1 w5 T9 Uto get SoftICE 'Back Door commands' which gives infos on Breakpoints,) }  r/ n! S) O2 e; {
or execute SoftICE commands...
3 S  Y  }5 z+ Z& P4 W! u" VIt is also used to crash SoftICE and to force it to execute any commands: V+ V7 W4 Y1 o+ ]; Q- e
(HBOOT...) :-((  
5 I5 i$ D9 P0 _+ N+ B- w: L$ g9 W
Here is a quick description:
0 y, F: N  r2 m-AX = 0910h   (Display string in SIce windows)
* y* N& y2 |3 ]-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)  h" p6 y; p0 M4 ~
-AX = 0912h   (Get breakpoint infos)
8 [) f6 t. r7 p/ R; }  i. S-AX = 0913h   (Set Sice breakpoints)
# ]4 e4 W! N" s0 n, @( \7 l-AX = 0914h   (Remove SIce breakoints)1 i" P, V+ h; l  H& R. i
0 M6 ?0 u, ?( x
Each time you'll meet this trick, you'll see:
$ r  G# X0 I: t+ D' C-SI = 4647h+ V1 K8 S* @. z* a
-DI = 4A4Dh
* [7 o( `0 E7 H. hWhich are the 'magic values' used by SoftIce.
( l4 S8 r( h6 W1 g8 O2 g5 eFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
7 ^+ w0 {& K/ b( S, }4 \
2 k% H) ?& @; W2 W' V) l# R1 AHere is one example from the file "Haspinst.exe" which is the dongle HASP: V) _/ b6 [! l5 }( ~& ]3 a9 _
Envelope utility use to protect DOS applications:
2 E* w4 m# j0 i& f  e
2 N4 A8 s  o8 o4 `. F# M  ~2 B0 _: M$ e/ K5 o9 P! }7 V3 N/ l. S
4C19:0095   MOV    AX,0911  ; execute command.
8 j2 Z2 _# Z# n" V: T& S( e2 T4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below)./ s# p9 ?( k/ q$ M  v( B$ H
4C19:009A   MOV    SI,4647  ; 1st magic value.+ P) W# U. I& r
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
1 v8 L7 q/ o' k$ b9 ?, R6 J4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
- o' F+ N( }6 k  z( Y( A- i& l/ M4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute* z$ q1 r" B5 J' h- X0 |
4C19:00A4   INC    CX
+ H) h7 p! I, I+ i1 e2 W8 L4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
& M+ m) A4 l9 W/ `7 ]4C19:00A8   JB     0095     ; 6 different commands.
9 D! \. F) r- t3 Y, h/ z8 Y4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
8 @7 V* c% H+ |9 q, _4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
5 }; T5 O3 e$ ^3 Q0 n' \+ _# [- ]6 T. T+ W3 Y4 S
The program will execute 6 different SIce commands located at ds:dx, which
) M$ Q5 }( V  \) E9 s/ X  S) Q. Gare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.1 s& ~1 Y! F' s

9 ^. ~# u/ Y* T& Q* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.# A: q2 g5 o) {& h
___________________________________________________________________________
0 F) B- H8 M! f
& J: `9 F" t+ }3 W; K
5 e0 y1 }/ t, f+ r. HMethod 03
6 k& a. m  B/ H: U3 [=========4 i0 j/ d1 _/ q6 U7 ^! ^

) L5 E# L5 {1 W0 z6 ~& p$ _" {Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
9 q# a/ ~  `3 R% G: ](API Get entry point)7 H* I+ Q# Y- Y6 \7 m  b( |
        
  Y# l8 C) {$ M0 U7 e0 _5 B# k8 P6 ^! o3 q7 S( b
    xor     di,di2 q1 M; X1 v7 Z1 y) z& c% ^
    mov     es,di' @9 B  C$ x6 J3 C& _
    mov     ax, 1684h       ' c0 Q$ S* z7 Q2 r; U7 b- V8 a
    mov     bx, 0202h       ; VxD ID of winice/ c/ }  M0 C$ v) m
    int     2Fh. A. `8 U6 C/ k+ q% L7 X) p) W2 {
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
4 G8 w% s2 u6 a$ C0 _$ v    add     ax, di
( V" L# N% |6 m& y( b5 e, |8 v7 [; d    test    ax,ax, `. V- Q: O2 z/ g0 Z* i  b
    jnz     SoftICE_Detected0 L  f  o. x0 U& p8 o% |6 ]: N
6 a+ Z  K" N/ g7 X* k1 E7 V% w# C
___________________________________________________________________________
7 ^: l5 g+ @; y/ e4 M8 w* K0 e
2 _1 [5 \( l$ E% jMethod 04
& v/ ]4 D0 X" e=========. [( Q9 o/ o( g  z1 P/ q0 }
# p, f/ y5 ]" Q9 j4 m
Method identical to the preceding one except that it seeks the ID of SoftICE% z4 d7 {4 E  z3 C: F; w
GFX VxD.8 v( o% r! q8 N: s: l+ s2 ~
9 A3 i$ d0 x- b* i
    xor     di,di# |; j: ]: ~# Q+ n3 S, k9 C
    mov     es,di1 i8 `. O# k; c5 J$ a2 ~$ P( d- U
    mov     ax, 1684h      
) w  g) O! A; b    mov     bx, 7a5Fh       ; VxD ID of SIWVID
0 g$ ]; H- P5 \3 M    int     2fh+ o1 \1 i( O& a' `
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
* M4 O' L: q- F. {& c& q    add     ax, di
: h' j& d/ c: Q9 q8 m  P    test    ax,ax5 ^! j& ~! T' @, b0 |
    jnz     SoftICE_Detected
; U. K1 k6 ~- X
6 `; s: _# H5 E8 @6 d% Y" l' E__________________________________________________________________________
2 E/ ~9 O( _/ ]8 C4 ^- A3 A; `
1 p: i' _/ a+ \: t3 c! S
0 {5 o. Y  h: `# l- p7 FMethod 05
  [( b. z2 Y+ q9 U=========( ~/ Q9 ?" ]: ?) m7 ^7 D
2 h; l& C9 }) D! u( }% d# I
Method seeking the 'magic number' 0F386h returned (in ax) by all system
6 [% S9 P9 }" P) K- |- Tdebugger. It calls the int 41h, function 4Fh.
% d. o0 {$ u0 A" FThere are several alternatives.  
2 ~3 d0 a6 D8 x' ?: B# p7 L( i# B9 ]1 l3 A- `5 h3 b
The following one is the simplest:
$ A7 w* [& ?3 ^. [( Y, }% h) w
- ?0 n& c+ }/ {2 w/ [    mov     ax,4fh
. q+ O* _' g$ g7 U- L! ]    int     41h
3 h2 k* k0 E, e# X1 K    cmp     ax, 0F386
, G; x) d% O% Q3 t    jz      SoftICE_detected
* @$ Q7 b! O& _# u7 K" e
: C' j; {, m+ J4 `8 Z+ [+ L8 }6 x. a, t; L  P
Next method as well as the following one are 2 examples from Stone's 3 f/ {2 i; |9 F; l5 S
"stn-wid.zip" (www.cracking.net):
& R; m( ^; \6 O" \* E  R8 L) `' c& O; S- t
    mov     bx, cs( f' V3 o2 p5 J5 w
    lea     dx, int41handler21 g" E5 b- V, u2 `3 D' s! C$ K
    xchg    dx, es:[41h*4]( n; t5 Y/ \0 e& _4 r
    xchg    bx, es:[41h*4+2]2 _5 ]$ l2 y: @3 M8 V
    mov     ax,4fh
6 @: q( Y. d$ g$ h6 v    int     41h
, F9 i* Y) J9 c' G1 a1 s) _  y$ Q    xchg    dx, es:[41h*4]9 }. S5 o; C7 j/ ]
    xchg    bx, es:[41h*4+2]: }! ]8 @0 t# t5 |
    cmp     ax, 0f386h
1 T) J8 n, z, i4 j4 T    jz      SoftICE_detected) e" l- r! d# u- N

  R5 W1 i: F& g" n0 P0 Yint41handler2 PROC
* A% W4 p/ `! q3 B8 ]8 y' z    iret
! b' z0 {: n' ~' p6 O% S. Rint41handler2 ENDP" W* t7 n9 V# F5 w/ u( ]
- i9 N* Y9 l2 m% C

' x, }5 u8 @1 u+ v( [( y4 I_________________________________________________________________________
; a/ e. ^: K' b1 _
5 D  |# q$ P) T9 w4 h, n- ?
& w- b) V2 [4 I# lMethod 06
4 Z* {" N6 g$ H+ k3 v: I' R=========" f2 Q' B( a$ o8 V) M

( U' b& X* G+ e7 \- m5 D  D
8 Z% E4 Y4 N1 S: C2nd method similar to the preceding one but more difficult to detect:
: j1 w9 L8 S6 o8 E. T! H5 x2 S4 W' Q# X; F' m2 Q
& ]- Y0 ~6 T- a# U  |1 j) \
int41handler PROC  T+ u$ K8 h% ^: y$ X
    mov     cl,al
: Q* P2 I  i$ u" T- ]0 F% a) Z- v    iret# B  @5 M% N1 B' E- H9 U# S% s
int41handler ENDP
6 m0 B' X7 R6 b. M. c7 Z! _( v, C0 N0 F( {0 P3 x# M* L

1 r* q+ m* ?, q0 u$ A* B    xor     ax,ax- a& x# o3 k/ g# `
    mov     es,ax
- H1 M. N! j! A! x9 ^    mov     bx, cs2 L0 L! O2 t6 r) s
    lea     dx, int41handler; f2 d" N% |' ]
    xchg    dx, es:[41h*4], [0 H( N1 k3 g0 m. C
    xchg    bx, es:[41h*4+2]" U- u" f6 R8 K" O
    in      al, 40h
+ N2 o+ G! @% O5 z    xor     cx,cx3 x; {0 Z1 j7 l3 g$ x- k6 H
    int     41h
) x2 f9 b* P9 k9 T* @( h    xchg    dx, es:[41h*4]
( M; K# G# @2 J    xchg    bx, es:[41h*4+2]4 i2 ~5 b9 L* p
    cmp     cl,al/ f, r- r8 F0 V- g4 J6 c6 J( J
    jnz     SoftICE_detected8 b/ ^% N) x! M: [
1 _. x  K; ~* A6 u; R7 f
_________________________________________________________________________, h; \1 a7 C$ ?) p

, g2 V  u+ n* o" G& aMethod 07
1 P$ F8 p  Y1 ^6 [# k" `=========
! @3 n4 f+ \8 T! ]
4 B7 }$ e$ d) A& ?! OMethod of detection of the WinICE handler in the int68h (V86)% c7 n& ]3 a/ g0 A$ z) }7 {2 I
4 o' n: V2 W( K% a
    mov     ah,43h% P2 {$ u& q+ g# I% i
    int     68h
. E$ |. o" g7 u# F1 B    cmp     ax,0F386h% E% Y/ n9 r2 T. `( o" E1 q
    jz      SoftICE_Detected
, M9 @% j) U" g. ~6 g# y! w7 ?& H# s( r1 M: f
2 `" @1 U. e! b4 a6 ]1 J  H( l5 }
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
: @4 H: e7 ^. u   app like this:$ b( Q7 Q4 O; Y' @5 L& q

! ?0 }3 v4 Z, c, X- n' ?   BPX exec_int if ax==68
0 t) |5 P, q6 D! ]3 w2 b   (function called is located at byte ptr [ebp+1Dh] and client eip is
8 Z# i$ `7 {4 u! ~+ O1 P   located at [ebp+48h] for 32Bit apps)
  f0 {  E3 g6 M- @3 b__________________________________________________________________________- C3 X) g1 i/ o. ?$ b

' \- k+ E! |! M- B# U6 _4 t
5 h7 z; N1 O2 hMethod 08& C; U2 }7 H9 P2 T! _. `- D9 n
=========0 l) z8 l: U3 B1 n9 t6 X/ @% h, `
* j. L# H) _* \- Y
It is not a method of detection of SoftICE but a possibility to crash the. b7 t. P4 \, W8 R
system by intercepting int 01h and int 03h and redirecting them to another
2 T. H" [  G" j1 Groutine.
- L! U* u8 \3 S" t- FIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
! b& u, b1 t$ |# z7 X% u% c2 C$ P4 Hto the new routine to execute (hangs computer...)
  |4 r8 M1 z/ y; O# y$ G) ~7 N3 I. G1 ^  E9 m! p4 |  f
    mov     ah, 25h& V# J9 R5 F: |3 ^$ v
    mov     al, Int_Number (01h or 03h)9 j' o' K0 F( Q& d: t
    mov     dx, offset New_Int_Routine
, C, W# _$ f6 D) M# f    int     21h
6 Q5 x9 U! ]+ |' T2 j( C9 U- K% o& N5 k: ^
__________________________________________________________________________
( H3 E; j. z& ]( R& t
1 Y) r1 S: C0 d  }( J0 tMethod 09
+ U6 B. p$ S% c& y- V=========# U# o5 r2 n7 s) n; R! r; @

% b6 a' E8 q+ k7 J7 C8 |* yThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only' _' I8 `: b% H' t
performed in ring0 (VxD or a ring3 app using the VxdCall).# ~& J" H, e, c* q& U
The Get_DDB service is used to determine whether or not a VxD is installed) v4 V; N& q3 N. k
for the specified device and returns a Device Description Block (in ecx) for
0 M) g/ ?" v; D' C* A; N! |0 D, Ythat device if it is installed./ A0 t7 J# p, c. I
+ K, z: h" k/ m5 z  F
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
# _* u+ X9 F8 @9 d   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)- j3 v5 k( }( ]) i' x: j
   VMMCall Get_DDB
: ~0 E/ N6 z& i  u   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
$ n! T# k6 Z  c) m
9 D% k  \! }' A6 H# e4 MNote as well that you can easily detect this method with SoftICE:
  a  C* g" d- }3 X$ D5 {+ d   bpx Get_DDB if ax==0202 || ax==7a5fh
+ N/ q6 [, l- C# A8 t! x0 \' J5 a( t/ N, @. a* v, [+ W
__________________________________________________________________________+ ~( P$ e" y* Z' q

# _7 {9 f3 e1 V& k, o" W/ O; HMethod 10
7 e& N2 Y! W1 |3 r2 W/ F2 e0 H=========- g( `& x7 ?! e8 s

% ?1 A% T" c) z" J# x& K=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
' |/ Q, Y, _3 n7 l  SoftICE while the option is enable!!
4 p7 s" j7 V) f2 L1 X7 _! |1 l) }) c. Y' |1 b  I- i3 B, P! R
This trick is very efficient:
5 @$ |7 d$ G4 U/ N( @by checking the Debug Registers, you can detect if SoftICE is loaded% i# d, {$ H) D: |
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
3 n& g! x' P, K. q) z+ K7 dthere are some memory breakpoints set (dr0 to dr3) simply by reading their/ R2 L, I, n5 O6 M2 L- P0 ^
value (in ring0 only). Values can be manipulated and or changed as well& Z& M9 J- J' M; f: L+ o
(clearing BPMs for instance)) Z( |! [, S2 Q4 o( T
5 ^2 E8 Y6 C; z. V6 }
__________________________________________________________________________
1 Q6 w/ @. H1 X5 O, i+ v
8 n/ c) M3 J. r2 NMethod 11
* x6 g- x+ d. e1 l=========: w" q- g6 U; B: y4 ~

. y1 a9 i4 C9 W  A; J/ G% n3 o- uThis method is most known as 'MeltICE' because it has been freely distributed
" ~2 u: \# J, `( c% }via www.winfiles.com. However it was first used by NuMega people to allow( v$ v& |, E7 i# {. ?# J
Symbol Loader to check if SoftICE was active or not (the code is located9 k% O: v( u1 c7 L9 H9 e
inside nmtrans.dll).$ ~$ i$ Z' |: {2 g8 [
9 g: ?, x% z$ \# R* o% s5 ]5 b
The way it works is very simple:3 a- y4 {1 a! B
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
6 b; T2 y+ N' W% u6 z  I5 T7 FWinNT) with the CreateFileA API.
& z) d- ?- Q  S1 b* f
/ w- r: F9 a% j& H0 W5 ^Here is a sample (checking for 'SICE'):# z& N$ ^: d: n7 ?8 \2 F
1 }0 n% w, v/ ?4 z
BOOL IsSoftIce95Loaded()
2 u$ X! g# X6 @5 Y+ t{% G( d3 D8 T% \. h: E0 L
   HANDLE hFile;  
, @" M9 J" W( h  _* \2 C   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,* R+ d9 @+ H' W: {
                      FILE_SHARE_READ | FILE_SHARE_WRITE,& w' R1 w+ o6 u: m9 I' [
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);/ g/ V7 B1 K0 o: L6 I  `
   if( hFile != INVALID_HANDLE_VALUE )
& H2 a5 M% s  U6 k   {
& u+ J6 w$ u& S5 d      CloseHandle(hFile);4 X$ R* e- C+ K1 k2 \8 L/ T5 b
      return TRUE;" ]  W5 ?' j  h  D4 y
   }
6 I4 b  n8 f$ h8 I4 f2 ]8 E* L   return FALSE;- W3 W0 e) C* @
}
9 f, B8 s0 F/ s  `# b6 M" ^# t) X) P
Although this trick calls the CreateFileA function, don't even expect to be! L& E+ e1 R9 l; ?- u
able to intercept it by installing a IFS hook: it will not work, no way!
5 p. ]) e3 a2 Y7 a& V& t3 RIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
$ R& A+ d4 m2 C& P& Uservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
$ o1 f# N  R, p; Wand then browse the DDB list until it find the VxD and its DDB_Control_Proc: P2 L, `7 s. y1 `; J0 L
field.
9 c' Q9 m, A& y8 VIn fact, its purpose is not to load/unload VxDs but only to send a ! M3 N2 C2 A( x9 x/ N* @
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)  F" R6 {! j' z% k" E8 e( V2 |
to the VxD Control_Dispatch proc (how the hell a shareware soft could try3 m+ J7 S$ v% s2 _0 _$ \
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
3 m& X; H4 f7 C% V* FIf the VxD is loaded, it will always clear eax and the Carry flag to allow
+ ~: H& m5 k* n% D- q" M! F+ M( W3 C% Jits handle to be opened and then, will be detected.
  P) R; e2 |; d" nYou can check that simply by hooking Winice.exe control proc entry point( M$ X" h' v2 e/ V( R2 {( e% k; ~
while running MeltICE.: b! e) N9 V5 }5 r2 _6 ~
$ ~% t' B( Y( {3 C4 i4 B

* i$ Y1 ^7 ~+ I7 ]. {  00401067:  push      00402025    ; \\.\SICE
, k: }. d5 l% K4 x! N5 g  0040106C:  call      CreateFileA
6 y: T" g0 V3 v! ]' c. c  00401071:  cmp       eax,-001. f- P1 O0 J0 i5 d4 Y
  00401074:  je        00401091
: h. Q" P; U" S7 T/ K
- h* `% l  \4 C
/ T6 H" h+ h( _+ qThere could be hundreds of BPX you could use to detect this trick./ h6 h& v3 c+ Q* L2 B! O
-The most classical one is:
1 m" ]/ x( G3 e: _  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||1 z1 u9 Y! p! F
    *(esp-&gt;4+4)=='NTIC'  [! C( @" x& Y3 Q

: l! G' Y7 b& Z6 n-The most exotic ones (could be very slooooow :-(  ^/ k# W% c5 s0 i" d6 `
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  , F- l) n3 I5 _2 A0 t& c8 N
     ;will break 3 times :-(
! D. \$ a& p" l& X. ?
0 d: |2 o7 z& L-or (a bit) faster: , S) d! `* Y( x4 t+ N
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
8 f" ~; b# \& z9 `- ]6 S9 y! f
! @/ w2 a2 Y" f   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
7 y5 j$ R% q/ M( F- ^     ;will break 3 times :-(
: |1 D; S/ _9 N. r3 N0 J; o
  P9 x( A- t, F3 K6 G% k+ _-Much faster:6 C8 i3 n& U- O7 F* D
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'! e/ x" q7 a1 L: R0 B% I& I

) [# A( R9 q9 p0 Y# uNote also that some programs (like AZPR3.00) use de old 16-bit _lopen/ y, r1 Y4 n' Q: @$ r6 W
function to do the same job:
% [  s9 h1 {8 N4 o6 Z- |0 s" g
# ^0 {- X7 e( f* P+ Y   push    00                        ; OF_READ: j' {) G$ n# M& H: r' Q, H  t* ]
   mov     eax,[00656634]            ; '\\.\SICE',0! u9 Z  c+ D1 }+ S
   push    eax
" o0 I4 R, o  {. [$ r% E& q1 J   call    KERNEL32!_lopen
- o0 q9 f- a1 k   inc     eax
' ^6 p; V! O; k6 y   jnz     00650589                  ; detected* e# u" n7 d+ Z# M
   push    00                        ; OF_READ5 N% z& R) l) g" c2 W% ^
   mov     eax,[00656638]            ; '\\.\SICE'
6 L. [5 A) ~0 \! U# V' B   push    eax
$ j/ ^$ h# f) e8 i+ q- `   call    KERNEL32!_lopen
/ Y5 |' R8 P, D# C- E& e' R; o   inc     eax8 z. c, F4 d6 o9 o2 C
   jz      006505ae                  ; not detected
5 Z! V3 i, o2 ^& J+ M3 U
; l/ x- N9 F9 b+ K3 E5 ?5 z! Z! C) Y8 J& ^" v
__________________________________________________________________________- s9 a0 H& R3 u6 R- l

4 F5 j" }# i! S) |+ d  [; uMethod 12% b. S8 D, m. Z/ @1 t' Q
=========
. M. B. B. h% T$ s  [& P& {
5 T0 `3 R' `& b( y" V) {* Y+ \6 h+ t+ oThis trick is similar to int41h/4fh Debugger installation check (code 05
1 u1 g! W, ^1 a% w&amp; 06) but very limited because it's only available for Win95/98 (not NT)% u- l; p+ b4 {8 T( M2 ?2 P
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
$ F4 A  `6 L8 |1 a) ~) J% A( v0 D9 s+ s' I: a
   push  0000004fh         ; function 4fh
& u: j% G" `- t" ~+ W   push  002a002ah         ; high word specifies which VxD (VWIN32)4 a2 s9 {* D% A+ M5 v1 p
                           ; low word specifies which service
' P  l& l) A! P& b, m  C) O& {; g                             (VWIN32_Int41Dispatch)# Z! K* ?; ~5 S" P
   call  Kernel32!ORD_001  ; VxdCall
, Q1 F, E+ E8 H: z0 ^/ f8 C   cmp   ax, 0f386h        ; magic number returned by system debuggers
! i8 \) O1 y4 z; k% p9 t   jz    SoftICE_detected8 X0 _  g* X, L5 w' j

- a6 [* p6 p; P  P3 ^- G1 OHere again, several ways to detect it:
! N! F8 t9 a4 r& N' J/ a& S& m* v) B. ~' V/ V1 P8 _; L9 r
    BPINT 41 if ax==4f% k9 p& y+ d  W2 o9 Q) X4 B

3 f6 y5 x9 C# [3 B. h4 g  W    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
# X5 D. k3 v, N# \% r! c# j. Y9 d7 R
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A1 Z# n9 S! m# ~' ]

: z" N# X7 F$ |) s/ j    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!( s# G, K+ N5 Z9 q1 x
5 \# C0 h) J- M# Y$ h2 g) ]' ?7 `
__________________________________________________________________________
1 r& K4 {: M% v
# F+ F: v# [) G  C2 t# N% KMethod 131 Z" c9 Z+ L* X  d8 `
=========
( Y& \8 A* t7 u& t
4 k3 ~7 \$ c2 gNot a real method of detection, but a good way to know if SoftICE is
% S" o3 P4 ?# s, n3 Jinstalled on a computer and to locate its installation directory.
) A3 C) A8 r8 [' }, `& l0 AIt is used by few softs which access the following registry keys (usually #2) :# d0 I% f( a3 V# h* S& O$ j+ U

: a/ p/ N  p7 y9 j; U- l2 h-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
& y3 G- g9 g0 e* \8 l5 B2 K6 P\Uninstall\SoftICE4 i; x* s$ L+ n# I
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE4 d7 I* H3 ?4 v& F  C9 f, O- E3 m0 `
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion. G$ r2 ~7 G; ^! D2 ?5 D
\App Paths\Loader32.Exe
0 \9 i6 p+ ]2 Z& `4 ]
3 R9 ^1 W  Q! h7 w. g$ g  R, D) z8 J- ?0 ?
Note that some nasty apps could then erase all files from SoftICE directory
3 A$ x( p( P: E& {- h( O(I faced that once :-(
5 w& U1 l! N) u: v! Z- X
1 k* t5 R0 `0 _: T' s/ lUseful breakpoint to detect it:
1 G& M+ u* z7 ^0 X7 a5 R* }) \* }7 e* E- q3 `
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'! }2 g8 _9 a, h& W! a

( l  K+ j2 l% H0 V* A( ^__________________________________________________________________________
/ l* `& @$ S( T3 [5 u( [
3 n: k$ m( @0 l4 q% o
) O2 w! M8 ?( {9 C4 s: M/ iMethod 14 0 e; }4 C, |! O8 p8 g2 _6 P
=========
( Y. N; n7 z& k) b$ ^2 Z! V" t; W" \) q5 ?& o0 q% ]+ _3 k
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose( G" Z" {$ `5 C( ?" {( x
is to determines whether a debugger is running on your system (ring0 only).
8 D; v/ \0 X8 I  y' P
& \% ?! l5 r) `& A4 M   VMMCall Test_Debug_Installed8 U3 a7 f: _. {6 W0 ?2 K2 R
   je      not_installed
: ?* \8 u1 ]2 i
9 S/ B: r  Y% d+ K' a- p' MThis service just checks a flag.- h' W% `' N" F, [, F
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-8-8 04:41

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表