About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
  O) H8 W/ N$ q6 K<TBODY>
4 T" Q1 [$ [: p- z7 J! c) F<TR>
" Z9 U0 ]) k+ }! y9 Z/ F$ L2 Y<TD><PRE>Method 01 5 q$ y( z0 D% y
=========: d6 \/ p& V& }6 R4 `

! U0 s$ B! O# d! \+ cThis method of detection of SoftICE (as well as the following one) is$ T, n- R, ?& H# }+ S( m9 M
used by the majority of packers/encryptors found on Internet.0 K( @$ s4 W$ w/ A2 x+ M+ [! V
It seeks the signature of BoundsChecker in SoftICE# L( R; R1 _5 _7 H" @0 o
( u! d" U" }6 ~5 Q( _
    mov     ebp, 04243484Bh        ; 'BCHK'5 T1 M9 H# F  }; z
    mov     ax, 04h
- d* J4 @" d+ |( q" Z6 e6 K3 N    int     3       5 C2 f- R5 b9 y. N6 s- {7 _! H( m& v
    cmp     al,4
. M. F: W  U% h  D# I6 i7 H1 }4 Q    jnz     SoftICE_Detected
7 Z7 x- {: s* O
+ B% r$ H4 N" s0 g___________________________________________________________________________% @7 `, N4 Z6 K& @

: h& y/ b6 M- }Method 02: k) }2 v* n, ~) ?
=========
. O5 o' z2 |$ e3 J3 Y$ ?; n0 a1 x: \% U4 I
Still a method very much used (perhaps the most frequent one).  It is used
! W* P6 }2 z: [+ m% V5 _# sto get SoftICE 'Back Door commands' which gives infos on Breakpoints,3 k' j: }2 U" x7 C+ S: g+ D4 l2 @
or execute SoftICE commands...
( k1 T3 ^! C6 C& T8 `* {- D& A0 [- AIt is also used to crash SoftICE and to force it to execute any commands& V8 W" K" i& \8 ]$ h
(HBOOT...) :-((  " w7 C% B6 C0 _- ]

0 s6 h" F5 v8 g5 j; KHere is a quick description:
- F! ?3 u  t! \" Q/ M/ s% @-AX = 0910h   (Display string in SIce windows)( B9 G9 }4 v8 w6 A& f
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
  ~, w( e( Z) M7 c1 ?-AX = 0912h   (Get breakpoint infos)' r6 q5 }3 A/ _; x
-AX = 0913h   (Set Sice breakpoints)
$ }8 C5 u* y5 R+ ~* Q8 f-AX = 0914h   (Remove SIce breakoints)
  v8 D4 U: E! r$ X6 }" t4 }, d" Y, O7 |5 Z4 y
Each time you'll meet this trick, you'll see:
: E+ o" z: G8 J1 e6 c: ?$ c-SI = 4647h$ S+ {" P+ Z' Z% h# x8 A
-DI = 4A4Dh$ \2 ~" ~& W$ a4 G
Which are the 'magic values' used by SoftIce.# C9 S9 L6 c# f, p/ `
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.2 [: N* \3 Z' n

& J9 o. o( t& j6 M$ DHere is one example from the file "Haspinst.exe" which is the dongle HASP4 B" I% `0 e. L# a* k4 ^: d
Envelope utility use to protect DOS applications:, _7 Z1 x- \; l( P4 N- |8 X

1 F8 P6 J+ [4 O! X3 u0 c$ G% p$ r" ?" D: v3 l
4C19:0095   MOV    AX,0911  ; execute command.* @3 g- r# V0 w4 }' d* y
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).% e5 s* S9 F0 {: P
4C19:009A   MOV    SI,4647  ; 1st magic value.
! [! K4 P& _1 _/ k3 ]+ [4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
& V6 X* V5 [4 s! r4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)6 Q* J4 m, g* |8 H' H
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute5 l7 s$ i) b1 a  G4 v! m. J  Q9 c
4C19:00A4   INC    CX* A& L) [; W8 A4 J
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
% [0 n( v/ s" H. c; a+ ]9 c4C19:00A8   JB     0095     ; 6 different commands.& v# m4 p4 l- K6 h
4C19:00AA   JMP    0002     ; Bad_Guy jmp back./ }5 f/ b6 m  n2 C
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)( C/ Y3 z; i! e( G  S% {

+ L! F2 Z7 q9 Q) _7 C/ [8 fThe program will execute 6 different SIce commands located at ds:dx, which  D+ k1 Y7 [" B+ `; v: q/ B
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
7 W% o( N8 c2 _
- Y6 `* a( g8 S* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.3 k* b+ i$ h' N" X1 [
___________________________________________________________________________
! w# C/ i1 k* Z6 y+ S% L$ F( C+ E4 z& p0 Z

8 z2 q) [# U. X; ?8 {8 e( z  FMethod 03
* R! g3 q- J+ s- C3 X# ~=========
$ G3 e& |$ `. \$ K& v) L& n/ u. g6 s' x  R- c# ?$ N) v4 V- F
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h) D9 i4 C% `$ p0 G( _
(API Get entry point)2 G- x3 S2 T7 t$ ^6 D+ L0 ]4 b! b) j0 t
        
, t4 ^. n$ S5 u* Y; X4 w6 D, p. h' J5 w
    xor     di,di, z: w. @- q7 T% T+ N, }6 v* ~
    mov     es,di
7 ]1 b2 E. H) G% E7 H    mov     ax, 1684h      
0 @  L% `! E( l    mov     bx, 0202h       ; VxD ID of winice
0 _$ r3 @# n7 ~! S# d    int     2Fh
0 g# G7 g! |& P# U; C    mov     ax, es          ; ES:DI -&gt; VxD API entry point
1 K9 b+ q- h0 y    add     ax, di
4 }: x( i# T2 ~( ]    test    ax,ax+ }3 j" G: r: V9 B
    jnz     SoftICE_Detected
1 h4 X9 \) f* f- i/ k' O3 s+ r8 `4 L' R* m3 l; t8 e
___________________________________________________________________________
# t2 G5 d0 C; |5 L* t: I2 \5 p7 V0 H( ^; E8 a
Method 04
( Z5 X% d, a; X3 c=========- P6 R4 F& G+ x# U

" Y! A, T" f! I; k+ n0 ~% X# ^Method identical to the preceding one except that it seeks the ID of SoftICE6 }; \) H' b( t) M  I
GFX VxD., x  @5 z1 O; ?7 V4 Q

3 `. h, o; `; ~  Y) a+ a    xor     di,di0 a! i3 v0 c6 q( h+ C) C
    mov     es,di
8 J/ [  H0 K0 u2 M* i    mov     ax, 1684h      
- ~8 _/ N% S; ^    mov     bx, 7a5Fh       ; VxD ID of SIWVID9 {9 B8 c' x  _+ z2 D
    int     2fh: J- m  O* P* h! M
    mov     ax, es          ; ES:DI -&gt; VxD API entry point+ B) [7 W7 g! ^" B# M5 K" [
    add     ax, di8 |0 z" s, X, h5 I
    test    ax,ax
3 n3 B0 c: `3 n# z3 Q  Y0 l* y6 q    jnz     SoftICE_Detected& a4 T2 G; I: Z( J. M; l  A
, A! `  ^( @9 y* e( ]4 I
__________________________________________________________________________
/ I* X/ b# d) C5 Y+ c6 l! r' Y; L: c  P6 {) M/ q
( t5 c. f8 Z; N5 c  |/ G; q5 n6 _/ O
Method 05
$ G; g  G: g! f. }=========! X  ]1 c8 w  }) A; N
5 N1 y$ U8 S% P+ E# i
Method seeking the 'magic number' 0F386h returned (in ax) by all system
( K( t; Q) T* N4 @7 Zdebugger. It calls the int 41h, function 4Fh.2 h, N7 A( S, V2 I3 f1 C" Q
There are several alternatives.  
  o6 B5 i' D$ F1 d3 \- J7 ^8 M+ m, I4 t' f* }( ^
The following one is the simplest:5 j  e- Z' o$ d( c0 S/ Q
8 X  S0 P0 T2 t4 K. E+ L; H) e( g
    mov     ax,4fh
. u" ?/ [0 F( Y; {0 G    int     41h. A1 V6 y7 z( F  R
    cmp     ax, 0F386
/ w" J3 p) {) a! V  `    jz      SoftICE_detected
" A/ R5 c' }* n8 f; p6 [& S9 Y; Q9 c0 s

2 M. ^' M. M* f. y& ANext method as well as the following one are 2 examples from Stone's
$ X' J2 A2 E/ v6 W. w8 j0 D"stn-wid.zip" (www.cracking.net):1 Q: i2 x3 V1 c9 |% K

. u7 B3 k- g+ ?2 d- E    mov     bx, cs
1 C1 n3 R3 A+ S$ C* o' `    lea     dx, int41handler2
$ j, Y2 D' Z/ F: C- U    xchg    dx, es:[41h*4]
/ U/ I( c; l2 f    xchg    bx, es:[41h*4+2]
4 {7 A% m+ K# d2 }; O) b% h    mov     ax,4fh
. T" p0 W( Y0 o3 N. ?, B    int     41h
- B+ [. E/ o2 ^$ M- M( ]    xchg    dx, es:[41h*4]
  r7 A* R' I( u5 T3 t/ S    xchg    bx, es:[41h*4+2]& E% z) [: C6 j  B1 Y# m3 i  E
    cmp     ax, 0f386h0 F. U  ~& `; w
    jz      SoftICE_detected
- n$ c( u# Q) C+ `' X: a# h
$ Q" Z, m6 \  \2 c  Z8 a! R: _4 uint41handler2 PROC
. A" n* P; O! a+ r/ i8 B    iret4 E4 G5 L3 }9 F" g9 K: \- U
int41handler2 ENDP
1 B# U6 s6 P6 a+ J0 B& g$ o
$ c" F% V3 a' F5 R1 J* q7 V& n) u- S! \$ S6 U
_________________________________________________________________________
7 p  s: b0 p0 q7 ?' y% X; W) x/ h6 _$ ?$ v# R( K4 Q" [
" h1 E* R2 P" t+ a7 {6 ]- I. o3 T  d
Method 063 \2 r7 o0 n- @0 f- Q' J* ~3 Y9 _
=========
* l7 t8 c" p, f2 D, M/ _- B  P- z
2 n! k3 P  l: t" i, K5 W
" Y, ?9 `  x. W4 K2nd method similar to the preceding one but more difficult to detect:
+ s3 f8 S$ `. H% ^/ d
3 o* x. G/ F: k6 ]7 f, r6 e: K
- W2 J: u! e0 t( m3 C& A* G3 [int41handler PROC$ \) n! L+ ]; A" d1 J
    mov     cl,al) J# R( g" W2 s' E! n
    iret
/ s1 K' h/ T1 R* K* e" ]. Dint41handler ENDP
+ F9 M4 Y/ M3 Y5 ?# @% b1 p" b
+ @* C9 t; F% f% j; p$ ?6 l. d/ F) K2 o' [6 F
    xor     ax,ax
: ]% Y) K0 S5 w* U/ X2 Z; B: M$ a8 P    mov     es,ax4 U, ?$ J. b& l# d$ P- K
    mov     bx, cs% C8 K! a$ P. {' E% g) L
    lea     dx, int41handler
* B7 ~. v8 C& d+ E  V! {, C    xchg    dx, es:[41h*4]
, A( t  x* i1 p; [% C2 l    xchg    bx, es:[41h*4+2]
2 k1 C! e4 L  ^6 H, I$ `- Q    in      al, 40h1 B" M; ^" u# p* q2 R/ a  s" g/ W
    xor     cx,cx5 ^' x# r# r. |7 \7 {- m, [
    int     41h
) V  G" Z- u% [    xchg    dx, es:[41h*4]
9 K, c3 p9 M( Y; j5 L2 z: Z    xchg    bx, es:[41h*4+2]
3 T, a5 r: |8 ^8 P$ C+ Q' p    cmp     cl,al
& ?' L! i" M8 D# [    jnz     SoftICE_detected
$ ~$ b" l4 \  @1 P0 F7 K9 k7 X3 D* b( y* K# }2 ?/ c
_________________________________________________________________________
+ h8 h& D# U# D# e4 M! H
3 A$ u3 u: j! v" UMethod 07( l* o- e- g# m- t  |6 M
=========1 w7 u' i5 {7 M/ J' n  h
$ D/ M3 E" e3 p0 x2 a+ }6 R) O6 |
Method of detection of the WinICE handler in the int68h (V86)
! g& Z) H1 S/ |9 e3 Z
. ~/ s) a- }5 ~! z    mov     ah,43h
( }2 L9 M" U( G4 {' H6 c    int     68h( x$ ?$ y* d* y5 C# V- u& z
    cmp     ax,0F386h
& A9 v$ l6 a8 `    jz      SoftICE_Detected
7 e  D/ f+ a$ K! V2 i- y5 G
, F) y" f8 A! G$ y+ M5 w, Y
6 A& s5 S6 F% ?7 F+ [; k=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit8 W+ R6 L  [" Y: j
   app like this:# D+ ?+ l9 f" C0 \

7 r& O. S3 W6 x8 K  @  W4 s   BPX exec_int if ax==68
( L2 Z! ?: S3 j; L% |; K" `# D. a   (function called is located at byte ptr [ebp+1Dh] and client eip is1 z5 a9 {+ E: y  i
   located at [ebp+48h] for 32Bit apps)# v2 L& b, I# Y
__________________________________________________________________________) I  A  [4 p7 @9 p2 o
8 O9 O6 m$ t! ]  P6 l

3 Z( k; u: w" C7 Q" PMethod 08
! S: F5 o9 T* ?/ R=========* S+ a8 Y4 K. U, m5 D# m
' n6 k" q7 U. r0 Q( l
It is not a method of detection of SoftICE but a possibility to crash the
. n6 W+ H( _* ksystem by intercepting int 01h and int 03h and redirecting them to another
  \$ d  G$ q6 L, aroutine.
$ X3 I$ T( |, Z$ G/ h8 Z8 ?; nIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points  x2 p' v& D2 o) L  j
to the new routine to execute (hangs computer...)# R# ~( ]2 T( l* H( P( F& p) I& K

: C$ @* L% H$ T" ^& J7 A5 V    mov     ah, 25h: \2 F0 [4 Y9 i5 T/ Z. s
    mov     al, Int_Number (01h or 03h)
3 z& ?5 R' i; I9 t5 O' H2 Z# p    mov     dx, offset New_Int_Routine! q- ?8 [0 T! q- m: m$ _
    int     21h
' N+ F6 o+ L) p" N- l, K) D' R% F+ k) ?% @$ e( ]9 B3 l
__________________________________________________________________________$ y7 C$ Y2 r+ `
7 x" T. a/ Z6 p: a$ E$ Q! K( {+ f0 J
Method 09
2 |+ P$ Z/ z5 W( J1 ~- {" Y=========
2 A4 O9 a. q) D! `5 j8 }9 h, r
: I) z! `% U' GThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
# t  D8 W% Q- v( nperformed in ring0 (VxD or a ring3 app using the VxdCall)./ u0 G$ n/ E3 H5 o. k
The Get_DDB service is used to determine whether or not a VxD is installed) I. I" D+ Z+ f  {
for the specified device and returns a Device Description Block (in ecx) for/ ?$ f  j# y8 r# M; ]
that device if it is installed.
* y$ C8 j2 s4 h
' Z% j7 E8 T. _4 A+ M. J   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID" y* Z# g' G3 x1 A  m$ a( q
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
' K  x+ k% L: @' ]   VMMCall Get_DDB3 u# ?; D+ p, o7 `
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
7 n; w6 Y& m5 Q- ?
$ T7 u) _5 X3 `. a9 }' lNote as well that you can easily detect this method with SoftICE:7 Z1 ?; b( {  q& k& d( Z
   bpx Get_DDB if ax==0202 || ax==7a5fh
( y( q4 }- P; L* s6 R% \6 _/ g
4 L4 N5 n" b4 f' c$ f8 I__________________________________________________________________________
( z* o/ @8 [8 W8 o* S
# t+ {6 |. z8 \$ B  u( O, BMethod 10
" E2 G& p$ C. n* A3 x1 U=========# h: V5 M8 d, D+ _

8 s0 Z. d0 K7 _( f1 W8 N; ?=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with7 m! b* m! V, H
  SoftICE while the option is enable!!
: [7 ?; U: y3 n6 ?/ U% z9 I3 d4 R/ i) ^9 ^7 o
This trick is very efficient:
2 Q& j" j7 [  L) uby checking the Debug Registers, you can detect if SoftICE is loaded; I4 q. o$ m) A6 y- z- f; C' ]1 T
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if- H/ y/ G3 u! }3 }* T
there are some memory breakpoints set (dr0 to dr3) simply by reading their1 E3 N: p  A0 |: \  v
value (in ring0 only). Values can be manipulated and or changed as well8 k$ ~9 G4 V2 Z
(clearing BPMs for instance)
6 l: x* `! y5 y; Q9 \
% s( f- `3 D4 P% E4 [, }__________________________________________________________________________: l- e( j& F! @- r. E5 O
7 o, B2 \4 p$ K# x
Method 11
; B% N2 H' ~2 `, M' p: g& X' Z=========& F' o( Z& K2 i3 Q- [

2 @. t$ x! Z  w# _$ M: {: {) W1 @6 o% aThis method is most known as 'MeltICE' because it has been freely distributed& A. f" M# A) j5 }
via www.winfiles.com. However it was first used by NuMega people to allow: ]/ i" |( w3 x7 o; f
Symbol Loader to check if SoftICE was active or not (the code is located
1 ]% }, V+ l1 c2 ~) o/ Q! k- s3 u+ t' Ninside nmtrans.dll).
1 I1 b* ]" E! [8 @. g/ t6 m8 I1 r: C3 K% ~# O6 y+ [5 U) S
The way it works is very simple:
/ |: y2 R$ `- [. c1 [2 @It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
: D- _' Y: ^1 X, K* {, r  ^WinNT) with the CreateFileA API.; j' `/ @% z- h  k
1 q) P) ?. [* X. ^
Here is a sample (checking for 'SICE'):
4 f6 I; f' O: F5 {8 A( O1 q3 Y( l
BOOL IsSoftIce95Loaded()* a6 L- y* e7 f
{
  O. r, }, M6 g; W9 U. Q   HANDLE hFile;  
( e5 i8 Z) A& y* W: W   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
9 d) B( T# V) ]* |                      FILE_SHARE_READ | FILE_SHARE_WRITE,
* d, F9 C1 z- u0 F4 o0 t                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);  m" N% G2 |& f! j0 e% r6 l" {
   if( hFile != INVALID_HANDLE_VALUE )
2 }5 X; @. x+ H  H; s   {
# n6 o0 l: a. d5 R6 l      CloseHandle(hFile);! i: X. n, j9 ]8 S; Y
      return TRUE;
) U& m/ p9 l$ ]2 i   }
9 ~5 u5 V5 v+ W. D   return FALSE;; E( \. ]6 B$ z+ r; F; E( Q. O
}9 h4 M% v0 m) x, w
+ e* V0 Y8 P# h" q$ g2 @
Although this trick calls the CreateFileA function, don't even expect to be
! n  B5 a/ X5 [/ D( Hable to intercept it by installing a IFS hook: it will not work, no way!
0 Y! D3 r7 S) F0 a4 }" UIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
# b4 A- O( ]0 ]9 u) Iservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function). c. ?/ P# W: U4 m1 {
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
+ _6 x& @1 }1 W! X( Pfield.
5 x/ q& }, r8 \- T- IIn fact, its purpose is not to load/unload VxDs but only to send a
1 a$ _. H5 e4 d, l' KW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)& p- n1 o9 D$ _2 h' D
to the VxD Control_Dispatch proc (how the hell a shareware soft could try: J6 v" h  ?4 v# `: E. N; U% c
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
5 T% |2 F4 ], L$ H: ?! qIf the VxD is loaded, it will always clear eax and the Carry flag to allow8 Q6 y% d& |  _! e+ i6 c/ w8 k
its handle to be opened and then, will be detected.1 q4 Z; ]& l% Z8 S
You can check that simply by hooking Winice.exe control proc entry point  q/ U: Q0 d/ U) T1 r. D8 e
while running MeltICE.9 v' a& z1 X5 N. S
4 N8 u3 e# @( B- f

* B  g$ J# l$ a# h3 @  00401067:  push      00402025    ; \\.\SICE, ~) h( K) F% }
  0040106C:  call      CreateFileA& p8 t" y0 o% x* A
  00401071:  cmp       eax,-001
. @! k1 X6 l1 K+ r1 l1 l  00401074:  je        00401091/ f, G" Z$ }# K1 W, X

! u: j; e8 u1 }! i& p* R$ b9 B6 l+ w7 m9 P+ T8 W
There could be hundreds of BPX you could use to detect this trick.- Z  E; J" u) T! J. J. c* i0 V
-The most classical one is:, N1 D* b0 W3 {* D
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||% s7 [0 L$ S6 Z6 m3 G
    *(esp-&gt;4+4)=='NTIC'
' _$ I4 c# }4 O1 [: A  _# C5 u8 B
% J& k* [7 B: j2 P-The most exotic ones (could be very slooooow :-(9 y* h# p. x/ A, b! @  a
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
2 l1 Q- q# o1 T  b$ O. D4 e$ S     ;will break 3 times :-(0 L2 p$ A2 j! w3 l. F) J
5 g" B# ?8 i: E. s
-or (a bit) faster: 0 p" u4 ^4 D6 K# _- J7 V- q& t
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')& ~, E* ^  j( s+ U3 H$ g, Z! L

4 p" _- y: Q' @* N, [   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
$ D& d3 {6 p' {2 r  u( N. I# C( T     ;will break 3 times :-(! k1 ~1 l$ C/ G& g; Q( ]- b
# z# v$ m  u* @) x9 l/ }
-Much faster:
( |) b4 H- d/ w* b8 D, d# r   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
2 `' y# m2 v: b& L7 ]) D3 m5 f, l* h  K; ^* j
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
9 F: J- _0 q  R0 o; U1 ~2 [: rfunction to do the same job:
! g5 m+ Q8 R3 F( k. y! G* Y7 x5 f- u7 {. Q& _# r: Z
   push    00                        ; OF_READ9 H( z% U; b' `* u$ t" e
   mov     eax,[00656634]            ; '\\.\SICE',02 R1 @+ B3 v7 F$ ?
   push    eax
5 `- A) N# o, l# C   call    KERNEL32!_lopen
8 ~( q% P9 r9 q- f3 Y- d, Z, R: w/ [% c   inc     eax  a% ~3 x$ [  @7 O8 q
   jnz     00650589                  ; detected
" {9 e5 J: Y$ P6 M   push    00                        ; OF_READ# x# ~# k+ C6 y$ n
   mov     eax,[00656638]            ; '\\.\SICE'; R% q) R" g5 u# d
   push    eax+ Q" `, r0 r% n$ K+ m' E$ r  j
   call    KERNEL32!_lopen' \+ h3 J8 O/ t2 N4 V% d
   inc     eax0 x1 u! V. M- l9 L, w
   jz      006505ae                  ; not detected- j' m$ u3 z4 f! \

; {3 D) z- v+ F5 _8 j' O6 C0 [, u
+ y+ Z+ c* \: O6 o4 e__________________________________________________________________________( n4 v% O" [8 j' T. t1 R/ u

) u$ ~" k/ B" r, [! a: yMethod 12! T% Q: R- E  V/ X1 v
=========
) u/ l; v" F* f
) D1 ]; r5 e! Z! ]This trick is similar to int41h/4fh Debugger installation check (code 05
) ]1 R& P# `+ C' U8 \- g3 M&amp; 06) but very limited because it's only available for Win95/98 (not NT)
2 h9 f1 }' p3 h' Cas it uses the VxDCall backdoor. This detection was found in Bleem Demo.
+ \" z! X$ j/ K8 x; \; o& I0 a
( @; T+ J# |8 G   push  0000004fh         ; function 4fh. Z9 F4 |; y/ c7 M0 [0 ]
   push  002a002ah         ; high word specifies which VxD (VWIN32)% T; A0 v5 f5 j: O
                           ; low word specifies which service
/ ~  n9 A2 M2 m8 I/ F" l% i! `                             (VWIN32_Int41Dispatch)
' `0 Y* f2 q0 k5 L   call  Kernel32!ORD_001  ; VxdCall
9 ~5 l7 Z9 L; J' f7 u6 `   cmp   ax, 0f386h        ; magic number returned by system debuggers
* i& k$ c$ i% C, a( C1 n+ e7 G$ n8 E" d   jz    SoftICE_detected8 C1 C6 a# A, u0 c) i
' v* F6 S: U' Z5 e5 k1 [, Y
Here again, several ways to detect it:
, l% A* l) U/ |& E
5 F$ p$ s! w0 [7 u* ~2 i; T    BPINT 41 if ax==4f
4 I5 r$ F2 L1 _* ?+ j+ k( h: o/ T$ Y8 a2 M3 I" N5 h
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
' a* F9 x- r& j; z, `
0 }3 K7 ?$ e( m% S# l    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A! @% z( |& S( Q5 I, X* w
1 a! w* k0 _# ~# Z7 B* ]
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
- u4 y9 d% o/ F4 V- c# J5 p. {( y2 x$ d4 v* u
__________________________________________________________________________
: J- [/ l' i7 {! Q8 W$ G+ B
; p7 s% ?* `" X8 u% H4 eMethod 13) L# s* P: `, U
=========: {3 k. w  B3 w# G* m7 u% l' u

5 D) O- M' g  B0 eNot a real method of detection, but a good way to know if SoftICE is
- {7 F  x7 j- l/ o, Yinstalled on a computer and to locate its installation directory.
' |2 u5 r3 M) d# |It is used by few softs which access the following registry keys (usually #2) :) ~6 H5 H0 `) S0 _: e) f+ o5 L

( R: X$ v" d' P! N-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
; e8 s1 D) C* S+ R0 o\Uninstall\SoftICE
  g$ \  ~; J8 s% C% c/ O2 i-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE! J* F8 j8 ?& h6 }
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion" C, Q* C: ^# Z& C9 A# w9 T: q
\App Paths\Loader32.Exe9 o% _& I, \. e* w+ j

& v1 K: z+ h+ A( A. o: R: F) b) |/ q2 T( Y5 n
Note that some nasty apps could then erase all files from SoftICE directory
& G1 Z( R5 M) M2 e(I faced that once :-(
( i$ j) v( q: Q6 j, a4 e2 M5 M; i2 y, d* g6 T
Useful breakpoint to detect it:
% @. K; R  A% y4 [1 a! s+ M- P9 h. y8 _3 ~
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'% _/ \+ R6 g2 o

/ ~. i4 j8 Q# R+ {' K2 [/ `8 y__________________________________________________________________________8 r0 p' t7 [  `( U+ z
$ f" L) I+ g4 S5 E/ X& l  ~$ J

" T( k" y  `' E1 e2 `" K, B& x5 hMethod 14
; M0 [0 Q; D  p=========) W7 p; Q+ H! c, `( a% Y4 t
$ f! V3 A4 m; L: z
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
1 i% g8 _3 u' D" @is to determines whether a debugger is running on your system (ring0 only).
9 [$ F$ l, X9 I- Y; {5 V7 J" M1 M- P& P. Z# E0 _
   VMMCall Test_Debug_Installed
( l. t/ @( m5 o" }   je      not_installed
' C+ x6 f9 Y& y4 Q, p' ?- v
3 V+ w4 A: q3 S& @! J5 gThis service just checks a flag.
/ t* O% D) j  y/ A$ k. V2 _</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部