About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>" ?# K( ]: ?# v: }, d' [
<TBODY>
7 n; }; p' B# e7 W* r9 S<TR>/ w/ S4 z/ i8 e8 \) B% u" U7 u
<TD><PRE>Method 01 4 H0 \+ i( }* h2 Y! c4 X
=========
, r7 D7 x/ h$ @, Z3 g6 D  R- W; J
+ n+ [7 }# D/ b6 G2 TThis method of detection of SoftICE (as well as the following one) is/ G  B1 Y0 r6 h2 O0 W7 x8 R0 D; r/ ^  P
used by the majority of packers/encryptors found on Internet.
4 A# t0 F6 d8 c* \$ V2 G& FIt seeks the signature of BoundsChecker in SoftICE
# m0 }" B6 A7 z
5 }# G+ B$ W8 H% i* \) V0 Y    mov     ebp, 04243484Bh        ; 'BCHK'" ?  M* ]) I" ^0 {+ s
    mov     ax, 04h
" y# N. t' I0 u8 W+ \/ x    int     3       & k3 B9 E* H& ]7 K& I' T4 p" q
    cmp     al,4
' n3 g; l. A" p  ~( [" \  X5 j  o    jnz     SoftICE_Detected
! a3 w( `' K; I$ W5 X- y) i6 x* E( _) ?- u5 Q; r
___________________________________________________________________________
# ~% l' s6 I# g  R, _- L, q/ t( O+ [8 U  _' z" k6 [# t9 H% q
Method 02' J5 x, T. j6 P& Q
=========
, I+ o$ D' d$ L& V; x& l2 [7 _1 o6 p/ I( g3 V
Still a method very much used (perhaps the most frequent one).  It is used( q4 @2 T9 S" |* i& Y
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,1 R% Q6 S' W" c" y
or execute SoftICE commands...: l9 n! b- A; g$ n: o5 K  t- y
It is also used to crash SoftICE and to force it to execute any commands
  N( f7 Z: s, B! v7 G(HBOOT...) :-((  
+ U0 t  E4 {4 ]
; p5 |! G& e  N4 y' W3 vHere is a quick description:
5 ]( u# I8 u9 Y: q-AX = 0910h   (Display string in SIce windows)8 a' u, J: s/ K" O' O/ l& K' S6 A
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
& C* L2 [$ I* @-AX = 0912h   (Get breakpoint infos)0 i/ z. C& y# c7 Z# }8 _
-AX = 0913h   (Set Sice breakpoints)" ^: W3 {* n. V0 {, W5 x" d* x) d8 j
-AX = 0914h   (Remove SIce breakoints); g/ J9 s1 @# |% n( `; T8 Q" T2 C
8 D6 q0 G( j" O7 e: v6 S; {' b
Each time you'll meet this trick, you'll see:
* X9 p+ ]8 P5 r$ {-SI = 4647h5 |( \% Y9 g- k  E" _1 ]
-DI = 4A4Dh
, V  O# p2 F+ CWhich are the 'magic values' used by SoftIce.
$ c3 D& U' N) A7 bFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.% w& U- r- w5 r' C# j4 Z: ^
$ X, L! u  Y: ?" d5 T
Here is one example from the file "Haspinst.exe" which is the dongle HASP6 E$ {. y) q9 i0 Q, V
Envelope utility use to protect DOS applications:1 ^0 _, f* g+ S" J

7 ^6 {6 b- ~  t% ~' q' ~( ~6 J; X- ~9 L/ Y$ ]/ ~) n" F
4C19:0095   MOV    AX,0911  ; execute command.
4 o9 |+ K3 Q$ A6 `5 j) D7 _, Z% I6 Q  c4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).- D. c& _2 y8 N7 H. S/ q
4C19:009A   MOV    SI,4647  ; 1st magic value.
( s* D. h, Z. X4C19:009D   MOV    DI,4A4D  ; 2nd magic value.+ ?) x3 q  c! q0 `- \% B9 D
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*): ~0 e2 m9 s1 y! R' f) t* |+ |" t
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute5 M6 C7 n5 ^) I$ r: w7 {" A9 V" Y
4C19:00A4   INC    CX
0 D& S4 L' P# P/ y: b; o: ~1 ?7 A4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute& E" `- v' w" y' \. t+ S7 @3 e# x
4C19:00A8   JB     0095     ; 6 different commands.
( O: C' \5 W( h8 b2 \% A% x4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
+ u, ], l+ t& w8 O& I4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
0 w. N3 A; L7 Q/ d. B! O3 Y  _
& X+ C: }# v- @The program will execute 6 different SIce commands located at ds:dx, which" h: H4 N0 c6 s7 j
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.3 |" K; Q+ x$ D% n- ^

$ P& {0 m$ C  g# F$ |4 D% h* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
! a3 p3 s2 p. \  {. S  B% W___________________________________________________________________________
  t' w$ {8 S- V. i0 |! Q4 Q" p9 X6 v6 T% b  K+ k5 M: u6 G* y. F
( _; ]$ N8 v# V) K5 ^/ d) W( V
Method 034 c( F: \1 F4 i  [8 `
=========
$ v9 h! i6 r) ]; H& ^) {4 i6 }  |, }5 C. a
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
  F0 v$ j' D2 G$ ~- q8 r(API Get entry point)
' t: k* M, K0 i: b0 ^        
, L* g- t. S, {9 Z" E( J7 W3 m  w
$ A" Z8 ~! }! X% M8 G/ P' @& v# d) o    xor     di,di2 J+ k$ k2 u  _
    mov     es,di; v, [- B2 [. z  ~. @) q
    mov     ax, 1684h       8 w! a' x2 ^; W: W- k* l
    mov     bx, 0202h       ; VxD ID of winice
5 L5 S  y" N/ x    int     2Fh# b6 V' ]1 U' P- c
    mov     ax, es          ; ES:DI -&gt; VxD API entry point% N$ _1 b) ^- x: E! N
    add     ax, di% V& C8 _+ z" @1 _- x" @
    test    ax,ax
2 J# j6 A6 Y$ R1 o6 d    jnz     SoftICE_Detected
4 L' ~1 m1 P, N& k7 @
) M; x* |" g( I* g0 F- b2 g___________________________________________________________________________+ ]% u: D9 @! K  I* Q/ J

: M/ B! u2 Y: q, J8 I* C3 IMethod 04
3 o: @" \4 z) |( H/ B( p/ L' [=========: \1 Z( p" A* ?8 F& l# i
3 o8 I! n; G( D: i) a9 k
Method identical to the preceding one except that it seeks the ID of SoftICE8 U3 X; x  ?( j. ?, [3 d! y, V1 T9 E
GFX VxD.
/ N  t  ^4 F% |. f" M1 N) h$ f# X- B( D
    xor     di,di8 C* W( S' |* P* `8 C" |
    mov     es,di
" A3 Z( T4 p: Y3 u    mov     ax, 1684h       3 f; i$ b/ `" R, L+ Y
    mov     bx, 7a5Fh       ; VxD ID of SIWVID
2 i1 T. }) Q" \. L- W& R9 A- w9 F% `* B    int     2fh1 P0 U, Y0 H% j& |; W  |% e
    mov     ax, es          ; ES:DI -&gt; VxD API entry point$ \$ }  I' U& n' j7 y3 M
    add     ax, di
& K" ?" L  T* ?, n, f* t( Q    test    ax,ax
4 ~; `& b6 ~% _& s2 m0 b    jnz     SoftICE_Detected
4 }6 m$ A6 m6 K& i6 f; d3 A5 t8 j3 y- Q# u7 ]
__________________________________________________________________________
7 D0 V# P7 D3 i% z3 c, R% z9 z. q
( }* {; b/ x) E4 Q0 @
% t8 H  L4 l! K' x0 B7 Y+ P; VMethod 058 {" d0 m- ?. q
=========
4 a8 k: ~3 n0 R  K5 J; o: I% a' U* Z+ L9 z, ^
Method seeking the 'magic number' 0F386h returned (in ax) by all system
2 T& z+ t! j5 w# o4 U( Ydebugger. It calls the int 41h, function 4Fh.
6 m+ `* |/ h+ K% ~9 ]4 t+ @2 W. CThere are several alternatives.  , F8 n1 X% |4 x
% E  w- U0 A9 ~0 A5 _1 K5 P5 u4 k
The following one is the simplest:  e9 C6 o/ K0 O5 x  d
* s. R+ u/ A6 W! Z/ `! }
    mov     ax,4fh. v" c4 \, F7 h9 K
    int     41h
# _* H8 D, n( @$ k3 K  e3 Y3 ]$ c1 m    cmp     ax, 0F386
2 w! b2 i' {% i+ U) w+ ~& k1 u    jz      SoftICE_detected
$ x0 `& _2 S" p5 I- A2 W# @+ Y! M* F- j6 y# O9 e: h0 d

1 O5 f& C; ]) L- TNext method as well as the following one are 2 examples from Stone's
5 Q5 [6 L4 w% g& y; p" a! L; A% E+ n) x"stn-wid.zip" (www.cracking.net):, _- i) _) s( e5 K) F3 p; @
* [: g+ d$ P* _0 t/ M! q0 g
    mov     bx, cs
% n9 c- a* t" \    lea     dx, int41handler2
& a# I$ m5 u- S. s, \    xchg    dx, es:[41h*4]# p" y" V% R; l9 s2 l7 `3 ]
    xchg    bx, es:[41h*4+2]8 j% ?5 z5 h" K* y
    mov     ax,4fh6 G2 ]7 }7 b9 [
    int     41h
0 m" C* D( Q$ z9 r: _4 q    xchg    dx, es:[41h*4]
$ E5 n' h$ a6 t% ~$ I) Z    xchg    bx, es:[41h*4+2]1 R2 v8 R; X; b9 z2 g) L/ }9 Y
    cmp     ax, 0f386h
, f$ |( }! i& f0 E    jz      SoftICE_detected
5 f1 r8 Y& J1 R( H- N$ a
: E) s% z: y3 c6 zint41handler2 PROC& z9 W. l5 M& N5 p
    iret: S7 U* q. O9 A  j+ T" k
int41handler2 ENDP
" x) F( u8 ^9 V2 F' `9 X0 f
& w4 l: N: V+ `8 z
3 l6 g$ g) i" q; G3 J* [7 __________________________________________________________________________
2 p  G+ W% ~* A
9 s! u3 [# z! P5 J0 b7 p! ^! p! a3 A# U6 Q( b/ L( L! ]4 |
Method 060 ~/ s8 m5 l0 f, z2 e
=========  O) z1 V5 d2 I' y7 ]9 K4 _

2 v: v1 l2 q8 E% W$ G7 `$ R$ Z& m5 N. h! A3 j- m  y
2nd method similar to the preceding one but more difficult to detect:
1 f! J  d' p& }6 I1 T2 y: W0 g) _8 k* g

4 u" G# e: t% f2 Cint41handler PROC5 N- {, q$ V! s7 J# z
    mov     cl,al
) |$ B9 D$ K8 u    iret8 o3 t- d! i+ ~! A
int41handler ENDP
( d$ U6 T: ?) B* ^
- {0 c( ^9 _! B4 y/ w4 v  H
2 M. E0 I( f3 [3 H# ~    xor     ax,ax
2 U! ?$ ~7 l6 B# H! K9 H3 S    mov     es,ax
; M7 q' c. F0 r  ~1 Y" A: |4 l    mov     bx, cs
# c+ U2 B* y4 V    lea     dx, int41handler$ Z6 A" ~8 i! }3 i
    xchg    dx, es:[41h*4]
4 I0 A1 H( ^3 \    xchg    bx, es:[41h*4+2]
$ j/ s1 q- W3 X4 B. ?    in      al, 40h7 a% q1 A8 l& x# }) M! W0 H
    xor     cx,cx
9 K5 O/ ^0 z( |# r" Y7 y! g    int     41h  w. |* ^5 |, m/ B
    xchg    dx, es:[41h*4]* |8 @5 b" ^4 [2 e* r
    xchg    bx, es:[41h*4+2]
4 [4 M# V; c9 R3 H& ?) O; l    cmp     cl,al
/ i3 f2 l, X! R8 W" [% h% _; w    jnz     SoftICE_detected( `! u6 ?7 v& b# I1 D! V

0 t% L3 ^7 y! S* V! H_________________________________________________________________________3 |/ e9 Q. v5 H9 S
6 B9 y6 D' G& J; _! h6 I& F
Method 07+ j; w$ Z$ G3 c+ Z( x: F* R) g
=========
- u4 [3 O  P1 A$ k6 z3 e* `
( l/ q5 p) k3 rMethod of detection of the WinICE handler in the int68h (V86)
8 ]* l' f: `9 ], p+ y  p4 ?- d1 N' {, ~5 ^1 K2 a3 C3 J
    mov     ah,43h
0 n0 F/ C7 I# _3 j    int     68h
. r2 C# e$ S: ?: B    cmp     ax,0F386h
! J+ D! R7 k! ]) m* R* v* D4 ?    jz      SoftICE_Detected
, M7 Q, y) t! d
! @0 N# F+ y( y5 W
( D. v/ q* x1 f$ E=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit5 p! X+ H% N7 v
   app like this:
1 Z' i9 v& ^! C) i- b' t6 [# S1 {, w
   BPX exec_int if ax==68- B, L& h! d# d2 k) C
   (function called is located at byte ptr [ebp+1Dh] and client eip is
' p! N  y$ m/ I0 z   located at [ebp+48h] for 32Bit apps)7 H# Y6 E3 }0 R. v6 ?+ S0 b1 N
__________________________________________________________________________; K' o. a+ U# x% V! `3 K( I
" n" m4 `' r' T9 s$ o

* G- l1 H0 Y; r* q) dMethod 081 q4 K; S) Z4 {6 ?8 L: `
=========4 C- d% L  Z+ @3 c

& \  }( \& K9 aIt is not a method of detection of SoftICE but a possibility to crash the9 w) K: @/ u  k! Q" h2 e
system by intercepting int 01h and int 03h and redirecting them to another
) q" K% T4 `& P( d7 w' Wroutine.
+ F, @8 K  k0 dIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points+ f# j" n+ o/ D' l
to the new routine to execute (hangs computer...)
# C+ L# t* \5 w% O6 z& B* X
6 c+ P8 p  P8 i1 W1 [    mov     ah, 25h
! o9 H/ B  G: Z4 t% P# H1 _) w% v    mov     al, Int_Number (01h or 03h)
, u+ f: z: |5 \+ s) L, M    mov     dx, offset New_Int_Routine9 K0 h. g. i! O4 a6 |7 q. b! f
    int     21h
  ]4 S3 y" p* k; v+ h; z, ]$ @) E( @( S# g3 d* X
__________________________________________________________________________3 [% a' d' E, E7 s% i# J0 v

" p) E  y: t0 {+ L* H8 I) PMethod 09
6 J; Q: b6 ]" s=========. ?+ [  Q* `# |7 u: K# \4 |

% x, u5 w8 F: ^" l9 }( m2 K1 @: I& _( UThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
& r8 K4 h( d! m5 z) g. Kperformed in ring0 (VxD or a ring3 app using the VxdCall)., F6 ?" m4 D2 s9 ?9 j: r: A! }
The Get_DDB service is used to determine whether or not a VxD is installed: J0 T/ j4 h7 ]& [. I( v
for the specified device and returns a Device Description Block (in ecx) for- j- W! d+ p$ o* [& y; o
that device if it is installed.3 O6 C6 D8 }2 D, u  `

/ B) P$ ~/ N- v. A   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID3 w6 U# W, ~/ C7 V+ c) u9 \
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
! ^8 h3 W  A5 x# ?+ Y9 k   VMMCall Get_DDB
0 N7 ^( G2 z- n3 z% ?   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed& X0 ]6 ^; S( A, O% f  f. E$ b2 {
7 x1 \4 r" }4 R
Note as well that you can easily detect this method with SoftICE:. k9 h- Q- M% D/ f# T
   bpx Get_DDB if ax==0202 || ax==7a5fh0 r9 H8 l. t0 i! ]) p

  T2 \; @% X% w__________________________________________________________________________" l: ]& o3 y) A, C. W* R+ x' F

$ H! O; x6 f' s9 ZMethod 102 t" X5 V0 s1 H0 \& s0 a
=========6 p( g1 G  x3 c& Z  Q, h* t" ]

. j9 q0 z; X  ?1 o) o=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with- y7 n" N( L# v$ `5 L
  SoftICE while the option is enable!!1 G5 U" q6 B/ z2 o$ [

8 H& U; ~9 F" f/ }( sThis trick is very efficient:
8 j1 r' V/ r- X' X9 d, kby checking the Debug Registers, you can detect if SoftICE is loaded4 G7 Q' C& h3 ]1 p
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
! q- M( `) ~+ L6 uthere are some memory breakpoints set (dr0 to dr3) simply by reading their
6 k1 E& n/ U$ G% @. s! m4 |value (in ring0 only). Values can be manipulated and or changed as well
7 F6 f7 d9 ?+ l: d( _+ H: Z% H+ L/ ~(clearing BPMs for instance)' v# A3 M, H; w
- O2 {1 @" b- `' R
__________________________________________________________________________- X; C+ P% ^' H

5 Q+ J' Z3 `4 V2 w& tMethod 11
) J! c2 C! A. M$ \( c=========% w1 i7 _- N" \) Q/ t, L+ N' `! M
) L# {4 l9 S& h6 z9 r+ }
This method is most known as 'MeltICE' because it has been freely distributed3 v! @$ \4 b$ p. ~9 ]% {# T& C
via www.winfiles.com. However it was first used by NuMega people to allow$ ]. ~# T7 T$ \6 B
Symbol Loader to check if SoftICE was active or not (the code is located
- l4 X7 ~2 z5 B4 H8 k' C. I5 jinside nmtrans.dll).
' T  K1 V6 |8 `1 Z; T$ M
& Y, l6 V/ B+ O/ _, a3 W3 vThe way it works is very simple:
$ }) C- X" x6 u2 n9 M: CIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
5 `: }7 T* Z# N' vWinNT) with the CreateFileA API.
& q, F4 y( z% `! s% L0 @0 F$ N) p- M1 ?+ ~
Here is a sample (checking for 'SICE'):% S) ?  Z( L6 Z# z% G' D8 C
1 r2 L) c9 W0 Y, C( v
BOOL IsSoftIce95Loaded()
) \/ Z) j: c. i{& h! [' N: T9 {; o3 ^% ?; e: U
   HANDLE hFile;    n/ L1 {4 W; O& }
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
( o4 i$ z2 ?6 x. V                      FILE_SHARE_READ | FILE_SHARE_WRITE,
# z+ A# d& L1 d, G                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);& T8 y' Y, H" c- _
   if( hFile != INVALID_HANDLE_VALUE )2 |; O4 L0 F! p2 y7 j  e2 B
   {
& A6 N- c( q) f1 I) o, }4 X      CloseHandle(hFile);7 I- I1 I' t0 a0 r$ `" y1 G
      return TRUE;# h# R+ S3 V' W$ j2 {
   }0 d/ n# c5 G! u6 |2 [
   return FALSE;
" p; b3 g9 y7 O5 v5 y5 X" @}
7 z, Q$ ?2 s& l& F) D+ d! v/ y  ~/ k; S! j0 T
Although this trick calls the CreateFileA function, don't even expect to be$ y, |( c# T8 h5 ~$ y0 {% ^
able to intercept it by installing a IFS hook: it will not work, no way!
* H7 v+ J8 ^4 g, oIn fact, after the call to CreateFileA it will get through VWIN32 0x001F6 Z- A/ [, ~( p) ]6 b$ B, G5 v' G
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function), X* {' }- S8 [
and then browse the DDB list until it find the VxD and its DDB_Control_Proc8 n4 `5 Q( Y, ?) ~. T
field.
8 Y; w) a2 I2 F% p: H* p4 F+ OIn fact, its purpose is not to load/unload VxDs but only to send a ) A. e, }% N, D, u* O) y% n" j
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)$ l' q6 D) G# q: `! `
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
) e  r! s& G# O) }( q3 ito load/unload a non-dynamically loadable driver such as SoftICE ;-).
, N- `6 A, N  j/ _) }) _' t; w1 d# MIf the VxD is loaded, it will always clear eax and the Carry flag to allow
$ V* a$ B$ ?! c0 e  t7 nits handle to be opened and then, will be detected.  |; g0 U/ l$ t. U
You can check that simply by hooking Winice.exe control proc entry point
# u" a% x2 O- o$ D! twhile running MeltICE.
: r6 W* ~! i( z4 P, z' X* i
3 n/ p( k- U3 m" m; {1 f
$ I) I: R9 u; c5 e0 t  00401067:  push      00402025    ; \\.\SICE) H2 k; l; ~6 X( x
  0040106C:  call      CreateFileA$ |' W  {/ C1 O( k' o
  00401071:  cmp       eax,-001
5 Q! b/ B- O2 R, p. H+ q' J  00401074:  je        00401091& m1 e- P1 i( _& q+ w2 I# F* {2 g

) i6 ~! r' f# h1 e% o& B; p: D% h
' g! R, v) B- O2 ^1 ~# HThere could be hundreds of BPX you could use to detect this trick.( E0 }( M+ J% d* {
-The most classical one is:3 N; U: d3 L) v; }
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
$ j8 h+ v( D3 ?) ]8 A) T6 `    *(esp-&gt;4+4)=='NTIC'5 Q/ |' F" g2 n7 E8 z1 f
; I& B  w" O  @, ~) f5 x
-The most exotic ones (could be very slooooow :-(2 c  I8 E( T$ M2 V* H
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  , |1 w, x/ m0 I
     ;will break 3 times :-(8 K& M( \& @8 }$ e2 J. ?
7 Z& ?2 {* }" c( X& {
-or (a bit) faster: ) N* F; W! R5 u( \
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')9 t4 ], u4 ^9 ]' F7 w5 ~6 n+ ]
0 ~1 N, Z+ V+ X  ]9 g8 m3 W. w4 f
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
' Y! `4 }/ e6 m7 p     ;will break 3 times :-(
  J+ _. M0 N1 h' w. @
$ u+ N# T. N6 i8 ^6 x-Much faster:& r$ j" m9 p5 o
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'" H1 w0 n. X! h; F0 G+ _% l  C

2 p! Q* W6 x6 r$ b: R9 PNote also that some programs (like AZPR3.00) use de old 16-bit _lopen" T; c) c! ]4 L4 y5 F
function to do the same job:' ?- M  `9 E8 W2 {' t8 {
0 g# ?! Y; e3 i! f% L
   push    00                        ; OF_READ
- N& b7 I, y4 r# w+ [4 j" b% n: z   mov     eax,[00656634]            ; '\\.\SICE',0. Z* }: r* a$ ]
   push    eax+ h3 g# D0 }2 N3 {( T
   call    KERNEL32!_lopen
7 b; ~8 O1 F+ x$ o" b   inc     eax( H; R$ p0 w- w$ w/ t) Y
   jnz     00650589                  ; detected
* M5 k/ i# T- I   push    00                        ; OF_READ
0 I1 J- p3 l$ O+ u2 v  ?   mov     eax,[00656638]            ; '\\.\SICE'3 |) o7 u( {2 @
   push    eax
7 C# b' @5 w) ]5 A$ A   call    KERNEL32!_lopen
# A2 _2 r- \9 m2 `0 A! }5 o. F( j   inc     eax
& R& P9 B6 \, K6 ?4 @3 F   jz      006505ae                  ; not detected$ `8 K1 I% M+ o! Q2 l
- F( v: ^) s2 J4 V
' _. ?) _/ _( U: _+ u+ n
__________________________________________________________________________+ F* Q  x# t. Y) ?5 ^: O4 m4 _
/ r* K8 h" v. m2 K/ g1 R  f
Method 12
! q- z" l) v/ ]5 }9 P+ g9 J: h=========
3 X0 `7 m: d8 `, V; n* P. |8 T/ }9 m4 o6 H$ K  S6 A
This trick is similar to int41h/4fh Debugger installation check (code 05& I+ i: y) |) X% T
&amp; 06) but very limited because it's only available for Win95/98 (not NT)
! j& v, n1 d* N4 M5 @9 was it uses the VxDCall backdoor. This detection was found in Bleem Demo.
, c# ~$ I& w, i/ V8 i: E; `* J( F4 a8 b* T6 o+ b* G# a
   push  0000004fh         ; function 4fh
; f3 N1 @/ y. y% v   push  002a002ah         ; high word specifies which VxD (VWIN32), v" i, R1 }" A
                           ; low word specifies which service
  v& N: J, Y8 ?) A0 `- ~) G: ~                             (VWIN32_Int41Dispatch)
$ t7 b0 v* D& L: }" L   call  Kernel32!ORD_001  ; VxdCall
" V% O; O& V7 e/ c7 J* c1 f. |   cmp   ax, 0f386h        ; magic number returned by system debuggers2 ]* [3 D* n) R# ]8 v- J
   jz    SoftICE_detected5 h; P& E9 R* s9 B! Q
6 A% \- }0 c3 H. R3 q$ p0 s- W
Here again, several ways to detect it:2 o/ n- ~1 j* E" t) e9 S

& X1 f/ O( Z% J/ [# }7 |    BPINT 41 if ax==4f
- [, u, G$ P% _# h' n
4 f; {7 q% H- U  H6 ~/ y    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one* f& v. f; `  O8 q0 `  k

5 T1 Q4 h5 G% K6 k    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A7 t) t' z; B2 ^5 L% R
5 [/ D! c  ^2 e# p, ?$ x$ R
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
2 L4 [- Y7 [- P/ W! }5 |
0 a8 d( t: t3 r0 z0 g& h6 U7 R__________________________________________________________________________$ H, s. ]: y% \' T' ]3 h3 l' S
' b2 G2 u; v9 V4 T; O0 l
Method 136 O/ b+ l0 A; r9 I1 ?, k
=========
7 k# I- j* v! [0 _- z0 F. U
" p2 \6 W5 P) r6 V) r% H, rNot a real method of detection, but a good way to know if SoftICE is  p4 h) {4 b" |0 c; L
installed on a computer and to locate its installation directory.+ z. H7 ]9 o; B2 R7 W
It is used by few softs which access the following registry keys (usually #2) :( m% X4 q0 p) _3 O

, L) V4 U4 m, U: @# N3 A-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
0 T. f, f0 G7 O  F\Uninstall\SoftICE
9 R0 N! ~* `4 Q. ^-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE6 Y% f9 A) @- ?. O/ u1 g
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
5 C; d2 p) F+ C% j, q* E3 l7 k3 W\App Paths\Loader32.Exe
; }! H) T* H, j4 i( g' R# l6 f; Y, ?

! j6 C( K6 h2 Q3 e8 b, hNote that some nasty apps could then erase all files from SoftICE directory
& a, n# o# K* W) z! D8 y$ C(I faced that once :-(
, j; E3 a' z) u8 T* Y: I
0 L7 p; G( h/ _1 j) ZUseful breakpoint to detect it:4 I7 a( n6 r, }: X

( ?; N) j1 s3 ~8 g7 H     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'4 S+ U7 y1 I$ i& C

# W6 Q" `$ k) }  P7 S3 `__________________________________________________________________________
& y% c* e' }1 h, E* L8 e8 R4 G/ q
3 V0 @, F) a* J
4 d/ q2 e; j3 Q0 r$ SMethod 14 1 b% |! W) N3 g0 {' J
=========
# [( X' J- F5 T& e9 {& r. ?8 a7 C5 U, g) O: M6 a
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose9 q  V/ u0 U( c* l
is to determines whether a debugger is running on your system (ring0 only).6 ?: ?+ c2 t7 }: v8 r

+ v5 G( b$ L$ j3 o. M. g   VMMCall Test_Debug_Installed/ N9 w( J8 b4 _: j7 |- j; L
   je      not_installed2 G& I+ Y2 P# {" z

+ t  V# K+ J1 ]- j4 U; wThis service just checks a flag.
  m% z7 U5 d& ^, ?. [, I</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部