About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
' V4 h# d6 K/ Q$ O. {) S<TBODY>  K* R9 S- x2 e+ O& l. L2 z
<TR>' u# `3 {) `- B3 H
<TD><PRE>Method 01
$ d. P8 I9 @% T1 l0 x" y=========
& G# e2 j) R! Z. W" k0 M: T& d
$ N5 V3 ]6 n' W* U* y( t, {This method of detection of SoftICE (as well as the following one) is
- s8 l& q# b* eused by the majority of packers/encryptors found on Internet.: s# t$ c+ X3 H4 |; H9 w. r5 b
It seeks the signature of BoundsChecker in SoftICE
5 [- ^1 T% n  W3 U: H9 O' _; h# W# m8 L) v. M- H8 l
    mov     ebp, 04243484Bh        ; 'BCHK'
5 M, y8 o2 F  t; r# s) q! I0 Y1 r$ I. i    mov     ax, 04h
, R1 k. H. w; a. M, m    int     3      
9 [  N9 ^/ {( _( v+ T& I! b    cmp     al,4
! C( K1 K# g6 l1 f# ]5 D* I1 E  o    jnz     SoftICE_Detected
2 y- H" I: f/ S- Q9 n9 l. }6 v( b5 J7 H$ T
___________________________________________________________________________' R0 J& a) X) E% A# j. N

( i* o1 e1 ^2 z( D2 JMethod 02
$ j8 l4 ?( C1 n7 S. v5 H, E=========
. y5 \# U# y. x% _; d7 O- v, r$ d6 v  T$ \: V
Still a method very much used (perhaps the most frequent one).  It is used
9 ^: c- P2 M- t7 ?to get SoftICE 'Back Door commands' which gives infos on Breakpoints,/ s' Y/ `% K) u! B
or execute SoftICE commands...
% D( X9 G8 `: {% |; pIt is also used to crash SoftICE and to force it to execute any commands0 q1 ^/ y2 n* S+ k
(HBOOT...) :-((  5 @) O# \7 z3 I, `; t7 l9 J, V

1 F" ]- H% ~" P: D3 HHere is a quick description:, v! d8 L# G* [; Q* T& |0 h2 V
-AX = 0910h   (Display string in SIce windows)
& L3 n/ \3 v7 G- Q% H. A9 x-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx); J  {$ K  Q. {% J7 K: T3 d
-AX = 0912h   (Get breakpoint infos)
1 s$ o; ?1 l8 b3 U. I% Z( n-AX = 0913h   (Set Sice breakpoints)6 v6 ~: p4 \: V% v- t4 M9 i
-AX = 0914h   (Remove SIce breakoints)
& A+ f) x8 B$ ~# z6 |. A0 C6 T, ]5 h
Each time you'll meet this trick, you'll see:9 J5 j5 r7 b* x" E
-SI = 4647h
/ T0 t  E& b% H! N) Y* C+ q-DI = 4A4Dh- ^* o! o  L' O  y; s# p7 L7 t
Which are the 'magic values' used by SoftIce.
. e" V  P. ?  Q- l# k  wFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.* e5 x5 F; }( f/ P+ Q) S" i

* K+ _% w7 m$ f+ x  x) _' ?: [Here is one example from the file "Haspinst.exe" which is the dongle HASP9 ~! B* N( h- ]0 O# ^6 |+ e& ?
Envelope utility use to protect DOS applications:
; R7 V' w$ q, i, o, p% e/ F2 H# f! f* l' w# S+ [. h1 i
' B7 Q( A8 r  d' C- |) W( r) c
4C19:0095   MOV    AX,0911  ; execute command.; [2 r# n3 w4 c( b2 L% c/ K8 M; {
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).: s1 T0 A+ L' f  a4 d  Z
4C19:009A   MOV    SI,4647  ; 1st magic value.% \! ]7 \8 n/ _! i+ r
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
. d" d7 @, @) K4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)1 e* D1 T0 a8 B. P
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute$ {7 D* y2 S$ _  {
4C19:00A4   INC    CX; g; ]; Z$ F* J
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute) s# j9 F0 T; U
4C19:00A8   JB     0095     ; 6 different commands.( M# N2 s+ e! P8 I8 }3 S4 Z, u
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.& K$ T( H" w& h& \1 Q
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)$ j; c- {5 I- ^
8 M1 t3 q& d$ E$ E
The program will execute 6 different SIce commands located at ds:dx, which
8 F7 Y% d! q/ {- d5 Jare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
' R1 v/ r. M* L1 }$ c) C* t
7 E* C& q( ?, a" S$ D* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.( N- L- L/ r# @
___________________________________________________________________________
+ c7 y+ t/ c' w" x# \$ `. L8 r& ~3 C+ {) y, ^

( K5 U( S9 w$ C0 D2 r- hMethod 03. \' \) x9 _+ i/ n0 Z( J
=========4 B7 s. q3 s7 _& B; e

& q* V5 e4 p2 \. j, lLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
; w0 }" F0 E& ~; g+ @+ \(API Get entry point)
* K& x( E9 g% E- D( m        
+ p. U1 k( i9 {4 A
. Z1 H2 m, ~0 `0 B* r0 H    xor     di,di5 i9 l2 i5 j9 J) |
    mov     es,di( c9 S8 `0 M8 \. G' n
    mov     ax, 1684h      
8 ]! U5 [& w* a5 Q2 j    mov     bx, 0202h       ; VxD ID of winice
! o( f8 g' N% k; \- ]- d    int     2Fh6 E8 L2 O. X8 q" E4 _3 L2 `4 q
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
6 W  {: |  k( G    add     ax, di5 ]# t, x2 z5 a" C, v' }
    test    ax,ax
  H- ~" Y+ |5 B& m, Z    jnz     SoftICE_Detected3 a1 C0 P- e; _2 M6 ~) r

% @7 g1 M6 \& D# _' Q4 [$ _" c- {1 {___________________________________________________________________________
1 J$ F) c) z; Q* U# E/ z  }& e+ \+ t7 x$ V$ C, y8 \4 ?) v, d( j
Method 04" O: ]8 }0 e" b  ^* q
=========
% j: v" H& D- R6 g
& ]: r  @( G) M4 E3 oMethod identical to the preceding one except that it seeks the ID of SoftICE
+ C1 B# E4 T4 V6 h. v6 W* nGFX VxD.: A4 ]! n9 c! |. v/ a" P" x) g
$ l3 b2 Y) U, M. V: c- v4 Z
    xor     di,di
% G8 C5 S  i" p* _1 c# }7 b1 m7 u. c    mov     es,di
' n6 H1 f. |) h3 t# X    mov     ax, 1684h      
7 r, L: M4 T$ B$ _2 a1 H$ R    mov     bx, 7a5Fh       ; VxD ID of SIWVID
) U7 V4 v3 W4 j& Z    int     2fh
+ X5 Z0 W$ }- o- y    mov     ax, es          ; ES:DI -&gt; VxD API entry point
0 z3 l5 o: l7 M) I    add     ax, di, i0 a7 E/ r' g8 T
    test    ax,ax
" y8 X0 M) j- E; |1 m    jnz     SoftICE_Detected
( J# E# t# z: Q' |: R% @* v6 k$ z
__________________________________________________________________________
$ z8 b+ ]' ]) \0 E2 L, d8 z3 m1 J; ]/ l6 N
0 U( O. ]4 Q9 y, {/ \
Method 05
- I% y8 @5 y  B=========
, s* G! c! c  f6 A" j
# l' r% N9 V* t& y: {  n) K/ E( xMethod seeking the 'magic number' 0F386h returned (in ax) by all system3 g, K1 |# a; H5 j. C( Y7 V
debugger. It calls the int 41h, function 4Fh.
1 `+ k1 G3 O& |9 i: kThere are several alternatives.  4 K7 ]3 I& v: x
* R  v1 {" E: Z& R
The following one is the simplest:
0 ?# I' e" Q4 n+ M* ^3 d& c) t: h  n) y, r
    mov     ax,4fh' Y6 u) W# {( N/ ~/ y6 ?( x6 x
    int     41h4 Y6 }. |2 O; i2 V2 ~) f; ^% g
    cmp     ax, 0F386
& e: j- L) H! S    jz      SoftICE_detected
$ {. c- c/ }, a6 D5 c2 l
6 L5 O$ V# l1 X- i& D1 l9 {9 f$ l' Z) Z$ Y! N% ~  q4 C
Next method as well as the following one are 2 examples from Stone's
5 J# {2 @7 B1 C) w! v"stn-wid.zip" (www.cracking.net):
+ I* q! C' Q1 S, E" g
* Z3 e' l3 q8 i5 }    mov     bx, cs
3 C" ~  d4 A9 t  D# O    lea     dx, int41handler2
, j% i% g1 p5 X% z. R    xchg    dx, es:[41h*4]  S& i$ R& W. B6 I, t9 [
    xchg    bx, es:[41h*4+2]
& o5 e; `, S' a" ?) R" O8 y% ?    mov     ax,4fh
& m7 ^5 S+ w+ N- ^0 p. g& L    int     41h
+ x& Y: I* l! K6 V3 Q2 a    xchg    dx, es:[41h*4]8 x( t9 B# W/ A" G3 z9 W
    xchg    bx, es:[41h*4+2]6 d% b! g+ {+ x% u  t' `0 C
    cmp     ax, 0f386h5 ~, o% s  \" \+ L5 k) c  E
    jz      SoftICE_detected  g$ b! I7 o. b, h

9 g' i3 M) {! F4 A& Bint41handler2 PROC2 t% B) i- [& n8 i) W
    iret1 ^* J, C2 t# p! B' O2 Q
int41handler2 ENDP
8 C5 g' u9 u& C! _4 I/ r8 S* S* R/ T1 t, V! ~; x

" C; t+ H$ S7 _' @9 N* A_________________________________________________________________________
9 h0 }( [6 w, C/ q4 J0 l& m$ Q
2 r) s2 c7 s$ O" e, j
+ D3 \* x" U- o6 w1 d( P' uMethod 06
$ t6 x8 V9 q  B& S1 H0 [=========
/ [7 R% u" n) k3 I1 c# l; ~2 E" s, e! x- ^! y/ B: C

8 W" o1 a5 Q3 |% F1 @2nd method similar to the preceding one but more difficult to detect:
! p7 Z  o1 Z: o8 m) v
* c8 E/ w( J6 I3 s
' x. m" B1 K0 b! S" Bint41handler PROC, C6 ]% }* R  P5 ~& C
    mov     cl,al! D( G/ J+ ~: g0 W% V. L4 l
    iret
4 n' y: _$ f4 z+ A1 N$ Q7 c8 Kint41handler ENDP
2 ?/ x* V, U/ J/ F! O
4 F* M* ]0 e! n2 Q+ N+ X# N$ @$ _$ r8 S3 {- |8 _
    xor     ax,ax
6 S( |) t3 r; J! A9 [$ W8 r    mov     es,ax
4 @- h9 n9 ~8 J$ d    mov     bx, cs
% S  G. o% {6 l. G- r3 k1 U    lea     dx, int41handler
5 \1 H( N; H: c% w: G    xchg    dx, es:[41h*4], t" R0 ~8 S, ~0 X* E  {3 u
    xchg    bx, es:[41h*4+2]6 f) G- H7 u9 z4 l
    in      al, 40h7 c, }! T" p9 D2 z' N
    xor     cx,cx
# L: Q6 G# x7 n$ k    int     41h* k# I, S. e/ W5 B! d
    xchg    dx, es:[41h*4]3 I$ L, c. n" m
    xchg    bx, es:[41h*4+2]$ n& o6 o$ j+ u! M+ a; v
    cmp     cl,al* l+ ^& I+ L) {9 o9 j
    jnz     SoftICE_detected
: Y8 z5 Z& w" K
" p* P! d: g# l, I2 f  q" x_________________________________________________________________________0 Z; f0 z" I, O# s
. `3 q" z" {" ^& z0 Z4 L6 m
Method 070 t( \& K, W3 G$ ~% v. j4 S% [0 [
=========
; q; ], ^. E. H% B5 P" {5 }( q. ]  i4 x* T  p
Method of detection of the WinICE handler in the int68h (V86)2 ?2 l1 Q1 D# T! ^
  x. _: @! u  q/ l
    mov     ah,43h
1 a9 ?" ?6 P5 o2 P* P$ q4 d: w. {    int     68h
7 `0 u* L: n1 a, ?* l) j5 s8 t$ c    cmp     ax,0F386h- T$ ^# ^3 s/ x* b+ j# i
    jz      SoftICE_Detected
2 Z/ p+ H7 v3 A
9 ~+ ?: j! n- T) v" U' _' e' R5 ?8 M' u: L8 Z+ x4 m
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit6 Z2 Q7 f! I1 U) n
   app like this:
% u, i* n+ Z. }4 }7 A( J& D: K
( m; e. W2 ^- W" I0 {   BPX exec_int if ax==68
9 N: e/ O; B$ y- U3 Q5 _) Q   (function called is located at byte ptr [ebp+1Dh] and client eip is; r. w3 X7 o/ o, O0 E" |  m2 r
   located at [ebp+48h] for 32Bit apps)
3 a) n4 [# P: T5 C8 D3 D# Z2 I. {' G__________________________________________________________________________& z7 r2 y5 H8 P, ?
' f3 R1 i7 z3 y9 d  \) ^1 A

8 v: P, |' p" N+ e2 ?" r0 Y0 qMethod 08
1 l7 ^; \' j& V  j=========. Y/ m1 d) `! v0 e# F' e+ T

& l( }3 A) F/ W! O) J6 l0 YIt is not a method of detection of SoftICE but a possibility to crash the4 p) z( U, ?  W8 x* T
system by intercepting int 01h and int 03h and redirecting them to another
/ z0 ]+ J! B- ?2 A6 r: o9 b; Y9 xroutine./ Z/ g+ A: q/ ~: k7 D8 I
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points( I2 ]$ i. i* @' o
to the new routine to execute (hangs computer...)
6 I! \9 F" i, ]/ j; X1 `$ C* t
% c9 G2 F# f6 `* N    mov     ah, 25h
, ^* Z1 g, L4 O( g% b% g    mov     al, Int_Number (01h or 03h)! [8 N3 W: n+ U5 R0 ?" g; |$ @$ F
    mov     dx, offset New_Int_Routine* k# x/ R0 e! C; g7 |" w- }. X
    int     21h8 Y( U6 T9 P3 s+ ?
. Y* k4 Z3 w( t( q, L1 u- W8 F
__________________________________________________________________________
& f: h& H/ Y% D* p$ c$ y
  v5 Q) y* H  ~1 G2 Q- rMethod 09
- E4 L3 w4 V  a, [8 M=========
* b; t) J: |, H- @4 K3 ^& ?
! H3 p' g  I5 `1 X5 b; B8 fThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only, B* }% d5 h% r! X
performed in ring0 (VxD or a ring3 app using the VxdCall).
* r$ E8 n: c8 ~0 G' K+ \2 JThe Get_DDB service is used to determine whether or not a VxD is installed
0 {( ^' j5 d1 Dfor the specified device and returns a Device Description Block (in ecx) for
  ]1 v. U/ r1 _8 f; Lthat device if it is installed.0 q5 Q/ k/ p( D, u4 I  V' c0 z

+ r# w5 f9 V" K   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
9 B! ~3 t  C; n  X   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
. b% ]1 Q  ]( A1 |; s/ t3 y   VMMCall Get_DDB+ M6 j$ K* |7 u
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
5 n( I( K$ }( l' @9 p" F
/ ^5 c0 f. M: J8 bNote as well that you can easily detect this method with SoftICE:
3 C5 S$ z. d; B   bpx Get_DDB if ax==0202 || ax==7a5fh
& F) N2 z( ?  d9 E9 H) J- c" }, f9 U& w* B
__________________________________________________________________________
1 U: D$ @! K2 a; m! L5 a+ o" \" j9 k9 H( N* O
Method 104 t& E+ t: P6 H5 h
=========
% X* \$ z* x7 b2 G# C: F& s1 C
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
3 C- P9 J" `) ^& P  SoftICE while the option is enable!!
- \, G6 Z) M* S& i* h6 }# B; X4 o
2 K+ k, R) L$ T: PThis trick is very efficient:
% a! e6 ?. D" r/ S6 Sby checking the Debug Registers, you can detect if SoftICE is loaded
; Z- a& Q/ P4 w! X(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if. a% G  P5 E" {: ^% |! s
there are some memory breakpoints set (dr0 to dr3) simply by reading their
2 R+ c7 G6 B3 {# |value (in ring0 only). Values can be manipulated and or changed as well
2 o6 j; _5 K, ^% @$ K(clearing BPMs for instance)6 ^/ r' M8 O! h" |) P2 o) p* g2 U
% C  I: F  e, b$ H/ @
__________________________________________________________________________  ~8 t0 o$ t; i; {. Z7 t  V  f
8 l3 e  V! V4 j. x9 h0 \
Method 11
; M+ b2 f3 Z1 E: Q- [8 P=========2 A8 Y; l3 k  q' l

% c% R7 D$ E( Q1 dThis method is most known as 'MeltICE' because it has been freely distributed, O! a7 z8 b# D4 |
via www.winfiles.com. However it was first used by NuMega people to allow
/ Z0 l, A( J$ y' q8 T) F5 B" Z' aSymbol Loader to check if SoftICE was active or not (the code is located
. C8 w! z, @% F5 g  a/ m* |inside nmtrans.dll).
# f0 j7 K/ {/ `% f
! G+ d  K4 n1 ]$ [' OThe way it works is very simple:
$ c& }' T, T1 K  z) W& }% w1 GIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for5 K* R) A* N$ F/ |0 I
WinNT) with the CreateFileA API.
/ D" m, G! H; [
6 h! m# A' s& B, _Here is a sample (checking for 'SICE'):
9 N3 k: P" q8 ^1 E0 u( t' ?  F; d- d5 F
BOOL IsSoftIce95Loaded()
6 C$ t  N- b) G{* S; z3 L* x/ M7 t, r
   HANDLE hFile;  . a! [: [( u0 t" \4 Q  f2 y+ W
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,$ R2 q# V6 l6 [- ?) x7 x; Y, R1 V
                      FILE_SHARE_READ | FILE_SHARE_WRITE,
! b! u- Y0 ]9 _" H" V' h                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);( @7 d1 o3 R0 n7 P
   if( hFile != INVALID_HANDLE_VALUE )- K- {' P* g4 x! g# h
   {
  L4 A- C9 q: Z% B: i  q( q      CloseHandle(hFile);4 o0 i. z. V0 I1 ^/ q) T
      return TRUE;# Z2 `+ T, y$ Z0 [- @( b; A! v, ^
   }
, _" j7 i7 m- ~. F   return FALSE;
, Y8 n$ P) `7 f2 Y0 N( N' [}0 R0 s8 ?6 x6 J0 n- L( _) K
: u* U' t# @5 r6 F1 ~
Although this trick calls the CreateFileA function, don't even expect to be
0 Q3 w( B2 x6 ?/ e; {" D; E1 c# Z. |able to intercept it by installing a IFS hook: it will not work, no way!
" L" R+ A2 U  L( g8 D* h4 l2 CIn fact, after the call to CreateFileA it will get through VWIN32 0x001F0 j5 j1 d8 \5 W- H* A. D) r" `3 ]/ |
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)0 V8 s/ w  |$ f7 T1 w
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
* n+ Q  t% c6 ^field.
  B# ?% l' O$ K2 {: }' g) {- sIn fact, its purpose is not to load/unload VxDs but only to send a
0 P7 R+ w) ?. E/ _W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)3 F/ Q4 n2 x2 x/ m
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
8 Z8 r7 H# c, Q8 sto load/unload a non-dynamically loadable driver such as SoftICE ;-).
  g/ W5 ^# Q) P8 KIf the VxD is loaded, it will always clear eax and the Carry flag to allow7 V! B' P2 t  I4 k2 f
its handle to be opened and then, will be detected.
% k% G" o. Z% u5 ]8 y0 ?$ f2 Z: OYou can check that simply by hooking Winice.exe control proc entry point0 g! A- m. H9 q; d+ @/ F
while running MeltICE.& m7 o3 }; y2 M; ~
* j! |6 e$ ?2 F% {

3 ?- L7 k  C0 z1 u- C; V1 o! @# C  00401067:  push      00402025    ; \\.\SICE
9 a7 E. Y; E+ K9 Y8 r" w+ ?& n  0040106C:  call      CreateFileA. W6 y  f. r/ q- k
  00401071:  cmp       eax,-001
1 N6 ~* G9 j3 Y5 ?3 \  ~0 O' U1 Y  00401074:  je        00401091
, o4 n& q# L* J9 m: q* e6 d# N" X. t+ `0 {: _
2 X/ E- P8 i* X1 J' g5 K
There could be hundreds of BPX you could use to detect this trick.( ^, Z/ M$ y" O8 z- K
-The most classical one is:" T: S( G6 p7 |* X. n
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||  N, ~# H$ E1 W" l
    *(esp-&gt;4+4)=='NTIC'8 j2 H0 b% p* j1 a* n, ^/ B

2 D2 d# T$ r$ _5 K2 j-The most exotic ones (could be very slooooow :-(7 g! G. G' z- f8 I
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
/ w' S# n. f) G# U  {* H     ;will break 3 times :-(! _& H7 W# q% w5 e

1 s$ W8 H0 v1 e  P-or (a bit) faster: 6 W. `. {" ^( ]9 Q2 @# k" `
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')! }" P6 @8 I0 p6 M

) V* ~4 @  j! E8 }7 `- s   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  ! P+ C* p0 `2 w4 G
     ;will break 3 times :-(- }9 t5 v) Q' e& L/ X" @+ d

7 X% L# O: ~  c- C9 q7 M-Much faster:
) K( V4 E/ g3 @% _& g6 r) T' n   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV') u$ k6 m7 i1 r$ e
6 f( |6 u% C7 E% ?
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
2 V. o, ]/ `# W* S0 i- G) Nfunction to do the same job:3 _+ m' G. L5 ?5 f- I

7 x+ f% h' p9 G# _- J, H0 K8 W- T   push    00                        ; OF_READ% N0 O0 O( ~' w# J9 m3 _1 [& B
   mov     eax,[00656634]            ; '\\.\SICE',0
7 t1 l- r" S- V& x   push    eax! e# o: i9 M3 N4 [: [0 X+ P/ P# h
   call    KERNEL32!_lopen
2 m% K* B# y! B6 u# K: i4 i0 P   inc     eax
' h" w2 Q, N) W; v% O3 A, [: ~   jnz     00650589                  ; detected
/ ~# B$ K1 l6 _4 i% z' G   push    00                        ; OF_READ$ @' `1 H. G2 D
   mov     eax,[00656638]            ; '\\.\SICE'
2 |" w+ |9 s& D9 P/ w   push    eax
. N* v( X9 V  G0 O% N- k   call    KERNEL32!_lopen# T  w/ _# s& x$ W1 s3 {1 f$ J# \
   inc     eax
; ^. F8 e5 A1 P* T2 h& b+ Q* |) U- Z2 Q   jz      006505ae                  ; not detected
# V" G$ A3 C4 F# e3 _" ?9 v
/ q, _! B' r$ }5 V+ H, W6 S+ ]9 i8 l5 H9 Q& I( `- A5 H8 I+ k
__________________________________________________________________________
5 w- u7 R" Y( g
: C' i3 f. g" A- n4 T9 g, J4 aMethod 12$ f% x4 O2 Z2 l
=========6 K4 O) f: d+ i

! B. r! \9 B/ H* HThis trick is similar to int41h/4fh Debugger installation check (code 05% v# O% b+ K( T
&amp; 06) but very limited because it's only available for Win95/98 (not NT)
  j- ]4 Y: ?" @4 W$ n& @2 \as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
$ e4 Z& ~( [& Q# n6 ]) k
1 t0 w  B, R7 k. ^% f1 n   push  0000004fh         ; function 4fh
/ w1 z- O% j# G! f# _% J& }   push  002a002ah         ; high word specifies which VxD (VWIN32)
3 V: h2 ^- i5 S$ l5 |/ G7 n& Q( f2 O                           ; low word specifies which service
$ ]( J4 _$ W  S: B2 H- O* V                             (VWIN32_Int41Dispatch)5 N9 @3 Y$ x7 E: I" _9 P
   call  Kernel32!ORD_001  ; VxdCall
# i2 M1 l: h" V   cmp   ax, 0f386h        ; magic number returned by system debuggers
+ b) r3 F) U2 R  k* o( R   jz    SoftICE_detected
3 X+ Y1 }, {, F* A0 M1 J/ `% ?8 x! @; S0 g
Here again, several ways to detect it:
" C% x! `2 Q( }9 T' J
" I( ^& t; w# v3 C    BPINT 41 if ax==4f
% T. t4 \2 M! |6 g4 s; Y% D. [2 t8 @, ]* I
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
6 Z# U" A$ K9 f1 v$ P9 V3 ^6 ?, B; n$ _# D* D4 W6 S
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
+ A1 Y( s' A2 t8 ]0 H" v0 y( Z3 D5 R4 X) J% x
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!4 c3 W! d! Y/ l- d2 C6 Z, h
! n) y1 a6 \. O9 Q% J) g" _( K
__________________________________________________________________________5 X3 a- _5 P# e- I

) |$ _! `) H  w; \7 f4 c9 ZMethod 13
0 z$ r# o1 V3 }& Q/ R7 m7 H=========! E; Q0 ^$ B$ O+ N9 U

7 w$ n+ B5 F: v' a7 @; ~Not a real method of detection, but a good way to know if SoftICE is
% a. S( j0 [! A" Rinstalled on a computer and to locate its installation directory.
. q9 A5 d  g; X  K3 kIt is used by few softs which access the following registry keys (usually #2) :
0 n* L- f) |2 Q0 y. o. t( P# L9 }3 l/ q7 ^* {2 r6 F5 Q0 t
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion& C2 h% A( h6 `+ ~- E4 N
\Uninstall\SoftICE
. a8 W& J: E  z0 w# j6 ~( @1 t-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE* U0 {" [: I0 C5 d* s
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
  s9 R: `6 Q3 a# E& Q) ~7 E& ~0 t\App Paths\Loader32.Exe% l) v) O; l, m" q

& |) ^0 S$ E7 D  Q4 t1 C9 U1 Y) \6 y) t8 u: P! W
Note that some nasty apps could then erase all files from SoftICE directory  t5 H* s- U/ T3 H" k
(I faced that once :-(6 ]1 g+ c: ~( C* U8 N0 I

9 w1 s( G# X3 O* n( \7 ~Useful breakpoint to detect it:  ~5 }7 ^( ~& U

2 b% h7 b5 B0 b     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'" W* I- q3 J. z& K3 Y" g

+ z: x/ e4 c0 k$ r__________________________________________________________________________, A  g5 z& |* U- t) w: H
. {8 O' h! a8 A5 H, R) O
, i% q5 `5 v5 L. W, t
Method 14
% B4 l: \$ l; p! p) R=========# o5 a: m9 S( a% W6 ?+ O
+ E5 J: X/ a6 ]2 B: V
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose' F+ i  @* o) M
is to determines whether a debugger is running on your system (ring0 only).$ E3 q. f- d( P

3 f, q0 E1 q% ~   VMMCall Test_Debug_Installed, e. _( n7 P* }% x+ {
   je      not_installed* N9 W7 `; j' Q. P6 t( L
) G/ Z  P' n% Q- r( e6 K
This service just checks a flag.
& h  N) V+ h" G  R' j0 Q</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部