找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
0 J; B' V" T# E3 p: N<TBODY>
. |9 S9 H- E$ Z' a# C) G<TR>7 B8 @# u. p8 \3 ?4 f
<TD><PRE>Method 01
+ P, V$ |; W- S6 F! G" q# a=========
! I; [0 x+ e# G  o: |
  h# L$ V' N% C' g7 }This method of detection of SoftICE (as well as the following one) is* }: F: a( S  q5 K9 H* h% {- U/ T
used by the majority of packers/encryptors found on Internet.
2 f7 j; i" [* B+ Z) E% A% nIt seeks the signature of BoundsChecker in SoftICE8 O9 Q6 N% _& H& y2 i. O

' X$ {$ n0 S/ z    mov     ebp, 04243484Bh        ; 'BCHK'
2 L% c( y- S; Z# S. x    mov     ax, 04h
  p0 U8 d6 m1 s9 p2 T5 G) F9 x    int     3       * k: k, C+ Z# W. p9 J
    cmp     al,45 i# ^- c5 |( [4 j/ l. E: h  o; X/ S& f
    jnz     SoftICE_Detected
# J$ c# d3 G4 i. h. [# `( w
/ q$ O! V. r/ _5 r$ l___________________________________________________________________________
5 l  r8 E- ]" f8 |/ I: E
: @! d; H. q: U0 C! dMethod 02
& p/ v" I- }- n2 `% C=========7 _) |9 d; o7 g$ g; x
8 W& J) P% \0 T# x3 L" C  T
Still a method very much used (perhaps the most frequent one).  It is used
) a- P' i+ V  x# h; m4 vto get SoftICE 'Back Door commands' which gives infos on Breakpoints,# L$ @- h/ m5 v! v6 x
or execute SoftICE commands...
9 I2 |! ]2 b' a6 `It is also used to crash SoftICE and to force it to execute any commands
/ i/ N. _, M! r  G(HBOOT...) :-((  3 B. @( q1 z5 w2 i
- p0 Z$ G0 k8 g% u8 m# E" I$ z3 O
Here is a quick description:: p# z* L. F+ \+ M' T
-AX = 0910h   (Display string in SIce windows)" V8 e8 _; v0 k6 D5 Z3 X
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
& B$ l/ V  N6 [4 ^# }+ G( P* s4 }! q-AX = 0912h   (Get breakpoint infos)
+ C9 A$ o" n5 e6 w: V6 C( K-AX = 0913h   (Set Sice breakpoints)
( v6 g/ l+ D0 N' o-AX = 0914h   (Remove SIce breakoints)
0 [9 e2 C5 F* h" |9 D) c- s. V$ u% q- \
Each time you'll meet this trick, you'll see:
- K6 [# q6 V% r3 s; J, S9 V7 c-SI = 4647h3 |, S# D0 g) q7 J6 ^
-DI = 4A4Dh& v" ]& G; _! v0 g- I1 c& t4 u/ s
Which are the 'magic values' used by SoftIce.
" q# `- R6 e& F1 k/ J) |For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
, ]  ?; @* ?9 {, j5 J: T* b' S: o) N& P- t2 K3 [6 ?1 h
Here is one example from the file "Haspinst.exe" which is the dongle HASP
$ K; v1 ~9 \0 ZEnvelope utility use to protect DOS applications:- t+ _' l- _, M/ V9 Z& _) M! \

7 R. A: R8 g1 Y# a3 z5 t5 p- t9 _& e  v( D( X; Q  X
4C19:0095   MOV    AX,0911  ; execute command.4 H/ t) d6 @8 f0 ^) D8 m7 f5 j
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
' I0 P  q# i& o% V+ r4C19:009A   MOV    SI,4647  ; 1st magic value.
# E3 o4 C9 s7 Z2 n: {2 p. p4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
% K. {3 Q0 q  @( H$ ~! m2 I- a* _: J4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
! {5 v7 {% v( Z- B4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
3 i3 T$ D9 H4 O; c( o4 q: ?4C19:00A4   INC    CX6 t' ^$ L" {( [3 a# ^
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute, T( `9 ^1 |4 I. v0 w  T
4C19:00A8   JB     0095     ; 6 different commands.
/ Q  {$ w$ J+ H: Y5 _) `4C19:00AA   JMP    0002     ; Bad_Guy jmp back.) a% l% N5 X3 E6 E5 T
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)( \: |  ]) H, P
0 x; |+ E+ y9 x) h4 ]0 ~
The program will execute 6 different SIce commands located at ds:dx, which
) h8 |! K$ C% \% u1 Iare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
, ?5 T; D6 i7 x  T) U1 D. p( @9 w9 O" G, U
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
  d4 y# @1 Q% M0 c; S/ V___________________________________________________________________________
( E7 W0 X8 i+ Y( I. i9 d( q2 a# _8 q3 g8 b: K" @

3 A4 k+ m6 f: GMethod 03+ L2 z. K. _6 c
=========) q! W, M) s% u! k3 A
) e( S, g& ~, q
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
, N+ v5 f# A0 x( {, N- `4 \(API Get entry point)
. w$ D1 B% e) b7 i6 S          B  _& }4 a1 X
$ p# v1 z% U  X: \3 z) z5 o
    xor     di,di3 x; i) J* F4 v0 u$ Q/ w
    mov     es,di- l1 \6 R9 G- V- u
    mov     ax, 1684h      
2 s2 I, @# {( Z  t# N7 K  Z    mov     bx, 0202h       ; VxD ID of winice6 p5 K2 S% F9 T8 o( I6 X* s
    int     2Fh
% l5 E$ w2 W/ R; u- O8 a    mov     ax, es          ; ES:DI -&gt; VxD API entry point8 d; y$ i) G+ g& l  C; @, r# {6 C- b
    add     ax, di, U; k, v6 A& _6 v
    test    ax,ax' ^3 ~( k7 P/ v. q" c1 ]* i" h4 L' j
    jnz     SoftICE_Detected
( l* x. h; d+ f/ @
3 V8 r  }; M8 c___________________________________________________________________________
) c$ M# G  J' i5 j
+ i2 X9 Y6 v/ j9 j9 z% hMethod 04. Z' a- X) Z" M: c/ a* t& o) x% `8 l( {
=========# V: v) i4 v+ ]1 H# C; i" E, H. w

4 j; D* ~' S7 q/ n! O% f) Y4 ~+ HMethod identical to the preceding one except that it seeks the ID of SoftICE2 [% O& ?% Q3 H
GFX VxD.
; r( z0 [9 ~3 i8 p, T
/ W5 B6 o, u2 B    xor     di,di* m' r1 h  V) _  g
    mov     es,di
' U4 @2 m9 [" B$ s; w    mov     ax, 1684h       : Q3 _5 ~) }6 m/ i; t  x8 B/ w
    mov     bx, 7a5Fh       ; VxD ID of SIWVID7 F! N- F* S; U! ^, d
    int     2fh; n, d3 Z9 a; u- F- h
    mov     ax, es          ; ES:DI -&gt; VxD API entry point" w& \" z) N7 M. l' L! C) P2 u4 s% d
    add     ax, di
. |: }8 n* Z% P: H6 d% o8 t, ]    test    ax,ax
1 D& H2 c( k; U: Z    jnz     SoftICE_Detected
! h. q3 |; ]4 e4 V+ R/ L
; [# o+ _( F. ___________________________________________________________________________
$ s1 `/ m6 l7 S5 g
) q! Y0 N4 B: ]/ K2 Q0 F! \
3 a( S6 w( h7 ?& F. {0 YMethod 05
1 i- F% @7 J3 l3 Q5 K' ]: q8 g=========
9 r$ F. u" c, N6 N) w7 V5 P
0 B2 o! [* B3 _; }% wMethod seeking the 'magic number' 0F386h returned (in ax) by all system
3 E2 B$ d# B/ L( e  ^4 adebugger. It calls the int 41h, function 4Fh.
5 M" d6 C6 }( l0 yThere are several alternatives.  
( u4 j: h" |2 Y; E; x1 t$ u8 Z4 Y; Q4 P- H! p: _
The following one is the simplest:5 j" v0 J, Y5 I7 `# n
; R, B; L9 _# L% o9 x3 B' i/ N6 N
    mov     ax,4fh+ _+ ]9 h! @- z# t
    int     41h
: ?; b6 v9 Q. d2 I8 V* \6 X% s5 a0 \  k    cmp     ax, 0F386( l" Q8 L. Y; L0 ]; G! r
    jz      SoftICE_detected/ q  }. B: T- B5 ^) F$ j( o

- u$ X; a) J$ P2 F6 p# Z1 F, f! G1 A0 v6 ^3 f3 ?
Next method as well as the following one are 2 examples from Stone's
, I/ @* k+ O' k4 R* Y"stn-wid.zip" (www.cracking.net):, O" l$ b; o4 K! ~6 _2 ^$ w

( T$ o& W; V' `, M) \8 F    mov     bx, cs
# \! [3 w+ |* M  S' U    lea     dx, int41handler26 Y. n! G, i6 b) C. W+ X
    xchg    dx, es:[41h*4]) |; Y, z  p- e! \' |$ y. ?: p
    xchg    bx, es:[41h*4+2]
* a1 P  a/ f# @+ E    mov     ax,4fh
, V1 a) d) M. _/ z, |" J1 p1 K* a    int     41h
. w- ?8 V+ o0 x5 w. d    xchg    dx, es:[41h*4]# F% T! k7 v- `; q  {
    xchg    bx, es:[41h*4+2]
7 b$ J! Z! O. I    cmp     ax, 0f386h) n% V8 N5 T" X4 x0 x
    jz      SoftICE_detected' A, r3 }: u' Q2 Q
7 M/ O1 K% S/ v7 Y
int41handler2 PROC3 ?6 I9 m, s7 C* q
    iret
2 Z5 l* b- G) H% q" _int41handler2 ENDP
3 j" `! H% t) {' A2 f' X2 I% U& n( K  M* t

9 l, f0 f# d( v' H_________________________________________________________________________/ g, d2 H, @9 o9 _% ]$ V! _. q
) f9 z4 d$ \) G. t/ I# n$ b0 f
, E' C8 D# j. r' C% A! F
Method 06
$ o) c% }* w+ N5 J=========
/ ]2 Z/ @% O% \0 h  K9 K1 N9 H# K) Z; `" I/ J

2 V& o3 G; |. {5 }* m, d2 B( P2nd method similar to the preceding one but more difficult to detect:7 x; ]4 _: c, H+ t3 i
0 u) h( I5 m; L: J" e. n

1 u$ M9 {* I4 t# Sint41handler PROC, h! S- r+ n5 [" W1 C
    mov     cl,al! s( D5 }0 X5 n. \6 D5 M
    iret
1 O' l& U& x+ \: Iint41handler ENDP: [. U, y1 \3 W7 i6 W
3 @4 x0 O4 e* u' \" S
* {8 d7 `0 s: T# H( i# U5 I: A: k
    xor     ax,ax4 N8 r- W2 o$ a; F& {+ Q! y
    mov     es,ax1 D+ |4 f% R5 h2 T+ U! d- x" j
    mov     bx, cs% Y) V# x( e* g+ ]7 x, V- e  M$ A8 l
    lea     dx, int41handler8 x5 F  Q) q, G: y" J' ^+ A% P
    xchg    dx, es:[41h*4]7 @* a8 Q) K9 V, d* J+ S
    xchg    bx, es:[41h*4+2]) [( l8 [/ [2 }
    in      al, 40h
% h* z- h$ {/ w' R1 b. f# r    xor     cx,cx
+ |/ M7 [; g- {9 o! _# u( l    int     41h1 F3 f5 P; M; A$ U( ]; n+ n
    xchg    dx, es:[41h*4]  b4 p* r) d, q5 T" L
    xchg    bx, es:[41h*4+2]
+ I1 w/ `4 ^2 j# W) [0 K    cmp     cl,al% w' \! A( U8 G
    jnz     SoftICE_detected
0 l0 s. w; @! ]$ a# [! o8 [  B3 s2 u6 r: i. b. f" n1 }
_________________________________________________________________________9 R3 C  J5 }& M& B$ @. d

9 N- q4 {  c  i' iMethod 07
/ v9 f- g$ F  j2 Z  k' U  w0 v=========
; a0 C' W$ j: i+ {8 W2 [9 w, B$ U6 {- \; z8 e( A
Method of detection of the WinICE handler in the int68h (V86)
6 i9 u5 @2 f+ Q3 @
/ c' }1 R7 T( K0 E: w    mov     ah,43h% h1 l8 }; z: R0 H3 W4 k+ T
    int     68h+ I( I$ y8 c, w6 V$ J4 Z) H2 x! X6 [
    cmp     ax,0F386h% X6 y+ l1 L' M# X' h4 w
    jz      SoftICE_Detected
  D% i6 T5 L9 F9 [7 `
! o- U" d' t0 b* d1 f# ?: G1 ?
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
* N# F& ]7 [- Q/ p$ E/ o3 y5 Q   app like this:, a% Y& p# l+ \, s1 G
% D  N! R+ |. v" o) j
   BPX exec_int if ax==68! l, q2 o; n! x- k0 Z/ A
   (function called is located at byte ptr [ebp+1Dh] and client eip is
" ]* {, \8 m0 O  K' h8 r   located at [ebp+48h] for 32Bit apps)8 J  _2 p; I" O5 J) T7 h
__________________________________________________________________________( P/ `0 v3 Q2 J) ]* R, k
& T+ q1 l& ?" y2 X& R3 ~- x

, [5 Z9 e8 ]4 q1 |& {) y0 pMethod 087 i0 k( t6 e# |
=========
0 n9 o4 ]5 S% t$ P
) ]9 \* K2 p  e+ v3 H7 RIt is not a method of detection of SoftICE but a possibility to crash the* F7 X0 E3 d* w4 o
system by intercepting int 01h and int 03h and redirecting them to another
* `# C' }; d+ b/ y% L2 l8 n! u2 S$ uroutine.
7 `0 Z0 _$ G; C, q0 ?. TIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
3 Z2 O9 @! N3 N8 k$ C+ B* {" X0 Kto the new routine to execute (hangs computer...)
, e& A' Y) d0 a4 u2 V2 v- r
, c; L& m, @" Z- J5 i    mov     ah, 25h. @2 Q* t. g+ `+ U3 O* I6 \
    mov     al, Int_Number (01h or 03h)( [& X! ]2 _8 k. f( |' t
    mov     dx, offset New_Int_Routine3 O. ]0 A* F9 X5 x
    int     21h3 ~+ W5 D' ^( `* ]8 V

2 u. j' \0 d2 G  W( c" F! z) G' C__________________________________________________________________________
# G) ]1 z1 k4 H' ~+ N
9 g; h& U6 y6 ~& @Method 09$ U; H0 D1 C. w- K7 `: j
=========
/ p5 [, B2 e% W# ^0 |- G& o1 @0 B: D- \* n3 ~" M! T1 @9 S
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
& k! x" g  z  cperformed in ring0 (VxD or a ring3 app using the VxdCall).
. N  G; g2 v4 n1 BThe Get_DDB service is used to determine whether or not a VxD is installed7 M$ M; u6 T# b2 T* f; S6 [/ ]! j3 @
for the specified device and returns a Device Description Block (in ecx) for5 t! F7 a/ a, |# c. t( o4 X
that device if it is installed.
. l1 g& G: |# w6 H6 L( D7 h- T& O! O; P. l( z$ M
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
$ e. f( G1 t& _6 B5 P4 a   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)1 H; F5 d( B% E" T. A2 h- N
   VMMCall Get_DDB
& h# F1 J* S7 L7 K; ]   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed/ ?" ?6 N; @8 v; A8 s* V) x8 R% P
$ Z' a" p1 M+ W( G
Note as well that you can easily detect this method with SoftICE:
" |3 E; @2 l- s' \: T8 i* Y   bpx Get_DDB if ax==0202 || ax==7a5fh
) Z, L3 o1 h: [# s  q  }$ f+ c& k3 F/ x7 ?; M* L
__________________________________________________________________________2 P3 u& b( a  z) {" S" @
9 ~( ?; k5 o6 Q/ z1 i
Method 10
& C3 X( k  A  x$ `' ~0 `! {  U& S=========( Z+ G/ h6 R, e3 k( N' r! s
6 D0 @, _+ Z: l7 e8 N9 s3 \
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with/ r+ h, R1 n* f& c" V
  SoftICE while the option is enable!!
& X* K# j! K$ w9 ?" z' w7 ]* [9 }5 Z# \3 o  o# }& t6 y# E
This trick is very efficient:
: \0 |# J; _4 ~% u. H$ T4 uby checking the Debug Registers, you can detect if SoftICE is loaded
; v( m$ ?% T) p" b3 P, [(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if2 J: o5 \# ?; U  _
there are some memory breakpoints set (dr0 to dr3) simply by reading their& J7 C1 `) H; o" w7 X) e. P
value (in ring0 only). Values can be manipulated and or changed as well
5 M- W$ o6 [% c(clearing BPMs for instance)& W% R& i/ b7 _1 N- ~$ @
( l6 E( K: F% k. ~; [
__________________________________________________________________________0 q; K+ m, z0 u/ B
7 ^$ @5 _9 _1 W2 \
Method 11
" o0 J+ m+ x$ E2 c* v: L=========
0 o3 i9 H7 p- A9 _/ [. M& `  ^. n0 x9 w# c3 ?
This method is most known as 'MeltICE' because it has been freely distributed7 I0 e: s8 I) m2 k  w7 p
via www.winfiles.com. However it was first used by NuMega people to allow" A+ D1 p; g' F- P* O# o
Symbol Loader to check if SoftICE was active or not (the code is located6 w0 p7 R0 w  a3 ?7 l- W
inside nmtrans.dll).( q' M& N2 Y0 S7 X2 P  B2 [4 d

5 H: k9 X8 o6 j2 m7 K& D# }The way it works is very simple:
1 @6 m, r+ a7 x) E( U1 hIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
. u& R) j- s& d. t  g: Q1 }6 q2 ]WinNT) with the CreateFileA API.- m% i3 {" [" S! }: n
/ B! Q5 [8 L6 A4 S2 h; I
Here is a sample (checking for 'SICE'):
  a3 l" w& y, n% n' ~
+ h: s" U6 f. Q6 XBOOL IsSoftIce95Loaded()
  m% @, Z/ H+ y5 I/ y/ g  B( N{
/ r1 y# y& y& W# k  p% w: {   HANDLE hFile;  
" `+ u" s/ F' ^, j8 {   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,8 S+ j4 k$ \, a, q5 w
                      FILE_SHARE_READ | FILE_SHARE_WRITE,
( s; {' `. ?) m. l; v" D; U                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
* Q! m1 }7 v, y   if( hFile != INVALID_HANDLE_VALUE )
/ P) a, E% S' z( v% O% j1 r   {
' e3 T+ ?7 i. F/ h& c( ?- M+ J# k2 h      CloseHandle(hFile);
5 q6 Z3 L. g4 \, m      return TRUE;
) b) A) s& I3 d- _0 x9 D+ J   }
4 ]' M- a, C5 Q) V$ `   return FALSE;6 X5 ]% q4 L% T8 [. L
}
) a/ M: d9 g3 I0 j1 s5 S7 n8 R0 o$ u
Although this trick calls the CreateFileA function, don't even expect to be! t$ G1 l+ T  F/ c  o
able to intercept it by installing a IFS hook: it will not work, no way!
+ g7 y" a' ~8 s( r7 f; FIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
& r8 t5 s% D4 ^5 |% `! c, M1 V- lservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
2 i  X! u  K9 rand then browse the DDB list until it find the VxD and its DDB_Control_Proc5 I( X6 `6 y8 A  |% @+ u0 y2 W
field.
: W" T9 C1 q8 U, B+ fIn fact, its purpose is not to load/unload VxDs but only to send a 0 _) A9 D7 }0 x4 D. R# J1 m
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)6 T' K% L# N7 \, ^9 Y* D2 Z
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
4 {& D9 x; H1 b! R! W& X2 P( {; x% O. Kto load/unload a non-dynamically loadable driver such as SoftICE ;-).6 o4 ?9 ~0 i2 ]* ~+ ^! [% O* Q
If the VxD is loaded, it will always clear eax and the Carry flag to allow7 ?' Y0 `7 _9 v# m# [
its handle to be opened and then, will be detected.
# `5 C- ~! g- c! a+ B- T+ \+ r$ r( ~You can check that simply by hooking Winice.exe control proc entry point
9 g: J' ^8 M! x( _* o+ {) Zwhile running MeltICE.7 f' g! Y4 [2 B$ o) q* z: T
  M; y; S6 v( k5 m

; B7 I: q: l* [7 N: e  00401067:  push      00402025    ; \\.\SICE
$ ^' [' @  @( a4 j% w' @- K  0040106C:  call      CreateFileA
8 H; i! u4 B& {9 L2 v( s4 j" p  00401071:  cmp       eax,-001
' }' X* B1 A+ U$ D+ Q1 w  00401074:  je        00401091; S9 U" q9 g( Y8 v: f% a( y3 b. e
; c6 G7 K1 c1 B  P' |7 c

7 C" f1 [$ a$ T0 K- ~1 |There could be hundreds of BPX you could use to detect this trick.
& P' V! V, o/ u1 J, A-The most classical one is:- V- n+ o+ S6 k$ F+ {( p0 a1 {
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
+ k3 r7 G% m5 A, v# w    *(esp-&gt;4+4)=='NTIC'
0 N) X% q' K+ q7 e. D6 q- Z$ ?; J" I8 e2 m0 j
-The most exotic ones (could be very slooooow :-(
# r8 S/ w" d+ L# Y% y' ^   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  , U) t; [$ u, [4 c1 {0 `7 N
     ;will break 3 times :-(9 u: Z) p. j# M( Y! H" }' J

! s" _  H! l% w' ?  S  i5 V+ K-or (a bit) faster: ; m  E8 h& f& u
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')+ l- k5 Z! I. w7 f5 w( B1 W* K

7 ]# g& z1 Z' `; C) i/ X3 x, u   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  2 d8 c! ]! L: y9 W8 @* g
     ;will break 3 times :-(# N& R. x6 q6 S
5 F% K8 ~( O4 Y% O
-Much faster:+ d. f. a" X8 h6 J0 Z
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'; H0 U3 b# z% X5 T! v% W

& ^" K5 ?: C% p* t( S2 y7 q9 hNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
- U3 `% u; Y% Cfunction to do the same job:7 l$ Z% g: A  i) S7 z) T

8 p$ e+ O# G) m! _   push    00                        ; OF_READ7 J9 z' U. a% L7 w* T) l
   mov     eax,[00656634]            ; '\\.\SICE',0
2 }! i: D* H/ N  I/ x   push    eax# ?/ y- Z) S, ~; {. a; m# n
   call    KERNEL32!_lopen
& z' c' g$ o& K; d1 U   inc     eax
- S( y# ?4 y- K6 j, \5 T) |; a  b   jnz     00650589                  ; detected
# ~3 H0 A# @1 D) G7 p! k   push    00                        ; OF_READ
/ S, z0 i9 k2 k3 z5 N9 g( \   mov     eax,[00656638]            ; '\\.\SICE'
9 M" S+ [# \3 a! x0 K: Z   push    eax
/ D2 Z6 ~$ \; U$ a. h   call    KERNEL32!_lopen: k8 W) H9 R: M/ N' \: x9 L+ t4 x- M
   inc     eax7 H& Y) {. N9 d+ G$ A
   jz      006505ae                  ; not detected& j! ]% c; y' {* ?7 I' L

* C$ K* u, _+ |+ ^; Y. w
5 f: Y3 }2 ?# _5 s__________________________________________________________________________
) L3 ~) B5 ^. B% f0 m
& e- H5 `" r1 S% v# VMethod 12; ]7 Q$ m  K/ D& M- K7 x$ G2 J
=========1 X# z# W( m% P8 Q
6 L5 w. {+ j9 }1 |+ }
This trick is similar to int41h/4fh Debugger installation check (code 05
( \4 E, f4 q- k&amp; 06) but very limited because it's only available for Win95/98 (not NT)6 P) e: P2 ?# X9 N1 \. e% v
as it uses the VxDCall backdoor. This detection was found in Bleem Demo., [% x' ^) l- Y& {0 p  \
2 `' b7 s% W! @# x8 I" h. M0 k1 O# Y
   push  0000004fh         ; function 4fh1 L. ^9 H* S3 N5 y; ?9 h
   push  002a002ah         ; high word specifies which VxD (VWIN32); s3 L+ Z2 h1 y4 d& a$ `
                           ; low word specifies which service; |9 m5 s8 c3 _3 f( Z* O1 s
                             (VWIN32_Int41Dispatch)
+ S: R$ J( D8 j# d# e; r0 n   call  Kernel32!ORD_001  ; VxdCall
, b$ t, ^, A$ B$ l3 p   cmp   ax, 0f386h        ; magic number returned by system debuggers
3 a6 g7 O8 {2 b7 a/ n0 [9 Z! Y6 X& J! x( @/ }   jz    SoftICE_detected
+ l1 t$ x6 T% V2 S) a( p5 b5 c
/ M$ `6 O+ N7 {% n6 Z9 |: C" cHere again, several ways to detect it:
! v2 m8 J/ {; Q$ w3 z! f
- r; k' Z% A7 A! |3 K    BPINT 41 if ax==4f3 x% D6 ~; V2 C2 i4 b6 b
9 u% H6 o$ W! I- Q7 l! \# A
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
  O# A' q' t+ J4 b: I8 _! U/ J1 k& }7 J4 x: m0 h
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
* _+ e5 g6 V; D+ Z
: o* K/ `: a& [* X2 r+ ~    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!; G1 z3 m3 ~0 m  P. [

9 `' K" g5 c) `- _9 a/ h  J__________________________________________________________________________8 ^6 D) f1 z& q( o# I7 |2 h

: T; N+ y% g" c7 NMethod 13
1 y6 e) S: H: H8 J; y& U" K7 K. i' H: ^=========0 K+ O, i: v1 d5 [4 w( W# z
( F' G2 p: V% |# J9 G
Not a real method of detection, but a good way to know if SoftICE is
' }: H1 v7 ~* binstalled on a computer and to locate its installation directory.# B/ i, w4 f' b: g' i' j
It is used by few softs which access the following registry keys (usually #2) :
7 v! l; x6 \+ n9 a
* P, k9 Z" ]0 ^  \% k3 v4 i-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
9 B( P, F3 C, j- i1 n. Z, [\Uninstall\SoftICE
2 V, B5 h6 C. d) C, Q5 p-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
( T/ Q, m3 m( g; s* G-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion* e6 |3 {7 M* Q3 G' z& e
\App Paths\Loader32.Exe
( U! f9 h6 h+ R4 h3 R6 J" j/ ]
# X) Y: }7 k" G9 s
4 w) D0 \5 c, x1 o3 eNote that some nasty apps could then erase all files from SoftICE directory
; }$ A2 @5 X5 T5 M& r  H3 [$ k(I faced that once :-(
: ?, v( u" e" ~7 {8 P( |
5 t! T/ X0 z# \! M, wUseful breakpoint to detect it:, N* k# U( q5 Y# `/ A

: p+ S* @1 j. P* O! q& q     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'9 O3 U; J2 L, u0 E  `" f& R% W

5 O5 o' |; Z  ?0 R  p. j9 O' z$ N: O8 j__________________________________________________________________________
0 C+ b1 W& {* I: A6 w  S1 {2 }( }2 C
7 K: K5 S% R+ }
Method 14 % D! L+ `) P, d, Z
=========
) R: W, w) V- y5 X( a  g! k% I' G. k: }7 X  Y
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
. Q6 n  d1 }1 B, I* |3 o- Zis to determines whether a debugger is running on your system (ring0 only).
( n" |/ M% F8 d5 c$ I9 q& W
1 a9 `/ d* t% `) L7 }+ ^5 D/ f6 K   VMMCall Test_Debug_Installed" m* K. S9 b; t' T5 C, ~
   je      not_installed0 u0 ]9 b- r5 [- b+ \
2 x# d; r, n( N, P+ `% [' J
This service just checks a flag.$ p- y$ C8 w& X1 h; K4 A2 t
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-8-18 02:15

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表