About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>8 y' g! V+ a4 h( i' c- }
<TBODY>! ^' S3 Q2 C9 @! ?0 P* s
<TR>- h3 a3 O2 h& [) u: j9 l
<TD><PRE>Method 01 ; {& s! i: K% E" k$ n  Q
=========
/ o8 k( f/ T/ _6 y. \3 }/ w- }
' v* y% d' n: }9 }/ dThis method of detection of SoftICE (as well as the following one) is
+ j8 f: A! t  _: w7 R" u. m2 V, Fused by the majority of packers/encryptors found on Internet.
& d9 [) V1 G& [It seeks the signature of BoundsChecker in SoftICE
& L, R8 e2 [# |4 P. t" a( T* p% E& c: W1 o  i% w+ r2 Q
    mov     ebp, 04243484Bh        ; 'BCHK'6 Z) x2 x2 u1 w) o: j
    mov     ax, 04h
+ ?6 O, b* y7 J4 v    int     3       " A2 `: \7 Q8 y" U) F9 c. u
    cmp     al,4
0 ~( `$ n7 K, }1 N  b- D% e# p3 S    jnz     SoftICE_Detected
& O6 z' a3 c2 w3 u5 V6 p
9 t# I# o7 D- t# |; g___________________________________________________________________________! R' ?6 w) Q  r, D* b7 ]8 Y) ^4 v

3 U/ u2 ^1 f+ N$ \+ eMethod 02  \& q0 A' {$ e% [* M" _' ]
=========& ~% I( L9 c) B; s* K) N
2 ^3 w: ?: S$ q% y$ t* y
Still a method very much used (perhaps the most frequent one).  It is used
: C4 [% z+ N! c  @4 rto get SoftICE 'Back Door commands' which gives infos on Breakpoints,! X' a% R" o* y$ c* b3 {( r: y- E! u
or execute SoftICE commands...0 y; |, g" S  _% w) ?3 t
It is also used to crash SoftICE and to force it to execute any commands
8 m% c8 y5 T# r" Z' W' \: G(HBOOT...) :-((  9 Y* o6 _/ W: |" K6 S

, h/ \5 B. p0 j) ZHere is a quick description:/ r! `# J% f# }( O+ X
-AX = 0910h   (Display string in SIce windows)5 {% b) A( ?* ~: n
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)8 b- m. X9 [( U7 v7 y1 @
-AX = 0912h   (Get breakpoint infos)5 S; P2 Q' n# Z) d: _  I
-AX = 0913h   (Set Sice breakpoints)5 G: v' v9 _( H/ c" ~1 b+ D/ t* m
-AX = 0914h   (Remove SIce breakoints)8 T& d" ]. U. F4 a; ~3 F4 r" T- p

1 Y2 P* g4 N5 ~: E& VEach time you'll meet this trick, you'll see:' N' k  ?$ E& M0 Q
-SI = 4647h( \* O, {- ~4 F
-DI = 4A4Dh
- E1 P* o# F; G' ?4 jWhich are the 'magic values' used by SoftIce.9 Z9 Q9 m2 U, g9 Q+ b+ m+ P
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.7 ^: r+ ?" U0 D6 T

; w. N, F* N: s, d! HHere is one example from the file "Haspinst.exe" which is the dongle HASP
' ~- L0 j; j+ l" w0 m% X6 q$ eEnvelope utility use to protect DOS applications:
! O# S- {1 B2 f9 a4 P# V2 g. s8 U+ o$ a4 y

/ F0 \) m0 B# W% g  v# D4C19:0095   MOV    AX,0911  ; execute command." j! Q% J- ~2 ]6 e+ V5 K
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).& O0 Z2 d# {" q- z( T
4C19:009A   MOV    SI,4647  ; 1st magic value.
& K5 r  _: Z3 l6 O4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
" I! }6 k! K5 l; R$ T0 w4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
" a) D2 W# _6 F  l8 |4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
- ^9 L4 G4 M- k) H0 [7 B+ W2 u4C19:00A4   INC    CX/ G6 |/ V/ J" N3 u
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute2 a* K% Z% J5 [7 ^9 o7 m) c7 X
4C19:00A8   JB     0095     ; 6 different commands.
- N8 K% @8 {  |3 M$ _/ \# h4C19:00AA   JMP    0002     ; Bad_Guy jmp back.9 x, A- ?. z6 k1 ]$ H
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
* x% e! `3 }& ~; Z0 [0 P' \. _
# r3 _0 v4 @( L  j  v) pThe program will execute 6 different SIce commands located at ds:dx, which8 F6 U+ e+ \4 _  i4 b$ P
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
) L. O) }( j8 @' a7 f5 n# [, \9 s# D" l! o( I! J
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.4 `; U$ U: n( a
___________________________________________________________________________
. X  c' d2 h: d8 O2 k" T5 ?0 E  ~( x6 _: u) {2 i
& ?. T6 W& p2 w  @% f
Method 03( W) n  q& p2 M9 T0 H) q
=========# B( t+ U0 }6 N

- f: J7 K/ b0 H4 M. ULess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
5 H; p) a4 l3 T; z- t(API Get entry point)
& t- G6 Q0 q) [: P! u, `) b& m4 O        
1 l. z# p- m. \6 C& A0 Q) n# y% b% E4 N4 t8 e, a* h
    xor     di,di
1 C7 p3 t% L7 H. ?    mov     es,di/ M% M. X4 ^/ X( A& e* W
    mov     ax, 1684h       : s0 y6 I! Z- T' Q
    mov     bx, 0202h       ; VxD ID of winice
5 z9 k5 ?' z2 p! F* p    int     2Fh
" v% ?9 L/ z3 Q& L1 @" ]& k( M1 t    mov     ax, es          ; ES:DI -&gt; VxD API entry point
8 x% X1 O9 l% f" \# x    add     ax, di
! j+ l7 o  T$ h- P8 |! t/ }* r    test    ax,ax" s. P% B2 `( e4 K% U' i
    jnz     SoftICE_Detected" j- j& O4 ]; O0 r: E
# H5 l5 r1 W% p& E* S
___________________________________________________________________________; M+ ]/ O9 O3 P8 H8 @! @
# J% N: q1 c6 B; s% O
Method 04
  ]+ T+ ^5 d! [=========
) I. n) f+ P8 D4 ]& [
$ y0 ?2 S# j; Q1 g6 o1 FMethod identical to the preceding one except that it seeks the ID of SoftICE+ m  |+ e: g! s$ D2 z/ C
GFX VxD.+ i; q& \+ b" O9 N( l" w
0 m& N' P: n! p) y' Q6 F7 e
    xor     di,di
; F# w$ F$ P! Q; o4 V4 F    mov     es,di
7 Z6 _/ X! [) l' b    mov     ax, 1684h       * d" e1 H) H, G- j5 B
    mov     bx, 7a5Fh       ; VxD ID of SIWVID
7 r0 i& K/ G5 N5 H1 p5 ~5 C! {    int     2fh4 F9 G. r. G1 e/ U% q+ A
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
; \7 D& y1 }8 M, x. E( V% L    add     ax, di
7 l; X( A" s/ W" x- I& i    test    ax,ax' E4 a9 g& {" I' L3 d+ G% S
    jnz     SoftICE_Detected
( ]  X) Z) f3 D5 _. l6 M, \( n1 P$ E, N+ k3 K4 l
__________________________________________________________________________
& m8 P  H" e$ L- p, K4 y! M
, J( c+ X7 m: f, c! E1 }. |5 M6 Z3 p( T
Method 057 ]5 j+ n6 r" h
=========
, l$ P$ k$ X( A, ]9 y" O) T$ D" }6 L) ~! j4 j
Method seeking the 'magic number' 0F386h returned (in ax) by all system1 A5 O) N( B; ]2 H
debugger. It calls the int 41h, function 4Fh.
/ D/ S/ o9 Z2 [There are several alternatives.  0 v4 c( n" y0 B
% X* |+ }5 o0 L) q0 V- u6 K- Q7 {
The following one is the simplest:3 j/ L: N/ y, H) X

$ @/ }* j7 ^3 L) G7 |; Q; m    mov     ax,4fh9 M2 T, a$ P$ k
    int     41h
- \* r: I3 Z7 H6 [! f6 J8 k& y4 s    cmp     ax, 0F386" I" k* c5 y' ~: K+ D6 m
    jz      SoftICE_detected3 h& c: Y7 Y! H6 ?
" }) m  @; K% H" \

; D2 z, h% u. \+ `1 C( bNext method as well as the following one are 2 examples from Stone's 8 [* y2 w! n7 Z/ x9 `; c9 o
"stn-wid.zip" (www.cracking.net):' _" Q6 a3 O4 W2 `% W4 M# U1 m
) n% s% x# \2 U. R' Q
    mov     bx, cs8 g! N; [! p1 W1 X' p9 |% r
    lea     dx, int41handler2
% T/ a$ t  U/ p    xchg    dx, es:[41h*4]
+ s7 @1 X6 C7 _6 k6 o/ \    xchg    bx, es:[41h*4+2], d1 r. s; g) g8 Y0 K
    mov     ax,4fh4 h. u' C1 Z  j1 ]; M
    int     41h
3 E) V" ^4 w$ j. V+ t5 b$ \    xchg    dx, es:[41h*4]# _* N0 @; m! J9 V6 W' r$ w0 J
    xchg    bx, es:[41h*4+2]9 |0 ]/ E2 X9 E
    cmp     ax, 0f386h0 ]- ^6 b  ]: C! s& l7 f. e
    jz      SoftICE_detected3 n7 T6 n$ q) d( U
8 R- @1 N5 G3 M; B! g
int41handler2 PROC
5 k+ b8 z, x  o& Y0 \# R6 E5 k    iret+ Y: Z+ ?! i9 F: P) r9 ]
int41handler2 ENDP
) `" g% G, ^3 d3 @; ], f
: W. r7 F! a: ]1 q8 S2 A2 @
  L) r( M* ~" a) P) U. }. P  F# M) u! r; P_________________________________________________________________________( V2 @8 ~/ a/ u* C0 X- _/ d' s, `( v
& c: d- J* o, A& w' H
* r9 o  V6 n8 X9 n! C9 }1 Z
Method 06! A8 M& r* ?7 ]9 _5 X7 X
=========
% {! c/ j7 J2 C3 u: d/ T: F# d" f) }; b2 |
- y, \0 ?& S( S5 @3 w
2nd method similar to the preceding one but more difficult to detect:
- d& q: U/ ~1 l3 w/ U1 K2 u$ o! Y/ A5 V! e) {8 q0 Y3 ?

2 A. L) W: ]% @% Sint41handler PROC. J8 y! Z. y& a& f3 c9 }
    mov     cl,al
: ~& d/ V- Q' V, g3 v) j0 F    iret
# R8 l- R' N# {' c+ K" T& p; Qint41handler ENDP
+ _+ l. N8 R3 E& E8 }1 ]: c' @& T/ O- H) @
2 x# s  z2 E1 t: @/ ]
    xor     ax,ax
+ U; H& J# C  q. _0 c    mov     es,ax
* g. O/ m+ O4 |# k+ o    mov     bx, cs
2 l" Y* _! f* m$ z    lea     dx, int41handler; x) f2 z' O! H# V$ c" [' a
    xchg    dx, es:[41h*4]% t6 V8 T* H7 K" G0 W# I; y+ _  }
    xchg    bx, es:[41h*4+2]
+ ~; \! g' ]" l9 R5 \% }( j8 W    in      al, 40h
8 r" |4 R6 S- b! g6 Y9 O    xor     cx,cx( a# ~, }2 U" r/ I6 |, |
    int     41h
* H' P4 z0 ~( |9 W0 G" U& \( x    xchg    dx, es:[41h*4]
- U' K/ a' ~$ b# k4 g    xchg    bx, es:[41h*4+2]
/ G! p3 E0 j) i+ g  O& k$ _" b    cmp     cl,al
- u; h4 X, O' S. h    jnz     SoftICE_detected
- q3 R& o! {4 x4 W) o( C/ P7 r9 ?8 b! H; l
_________________________________________________________________________2 t* E# A! B! e8 T5 i6 g
! {* r& B: U! U: F! v
Method 076 M2 i4 k2 h1 _) L+ n0 ]4 O
=========
9 S) Z9 m5 {% V4 y4 S  @
+ l  `+ L+ i. UMethod of detection of the WinICE handler in the int68h (V86). N2 D/ ~) |& V

( J5 J1 ?: Y5 [* S! q6 u3 z9 }( P    mov     ah,43h
/ Z, K/ h8 Y0 Q5 S% }    int     68h
; g; c: r- E, X; a3 T    cmp     ax,0F386h8 O/ m& z( X. L" H( z
    jz      SoftICE_Detected, Y9 I  h% |$ D! J

- x; W2 G3 `5 Q6 @  Y. F3 U9 Z2 J! U) g! C& q" o3 o
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit, w: \; S+ H  V1 v% r( A
   app like this:
0 S7 r) o' A1 `" {% \) V6 I3 F5 r4 c
   BPX exec_int if ax==68* g' b7 D5 L' `
   (function called is located at byte ptr [ebp+1Dh] and client eip is
$ W4 v6 ?4 r5 S: U% ^   located at [ebp+48h] for 32Bit apps)
9 x7 L' J9 Q# [3 Q/ y$ A- g__________________________________________________________________________: _# {$ m; l1 K. |4 t6 z9 P3 |
* }; X4 U9 X( v# W1 V- f# O! `

2 a* N1 E# b# Z9 w( g' }Method 08
; V/ i8 ^  N# w+ h! ^=========$ P, _# a: L2 z& p$ R9 B* i
3 z) R( b- @5 \
It is not a method of detection of SoftICE but a possibility to crash the
) t; g% S7 P' ]' t) a( J# rsystem by intercepting int 01h and int 03h and redirecting them to another
8 |& U/ }* A! v' [routine.
+ G3 m6 K- j+ Y; BIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
; D; a: D! y  p* E  R* y* z  v  J  ^to the new routine to execute (hangs computer...)6 l& ?& ]2 E9 n6 E
  D. A8 x! V4 u8 t( S
    mov     ah, 25h4 }; K( c* H+ [$ J
    mov     al, Int_Number (01h or 03h)( }. G' b4 U+ E9 w8 p
    mov     dx, offset New_Int_Routine
4 p/ J1 D3 g6 j9 c) N    int     21h+ g2 q$ s8 ~0 w! `  w
, r" R/ U8 Q, s7 `! b3 V" l6 o
__________________________________________________________________________
, q* O+ S* O% W: I0 h; R- N* ^& |$ Q# L+ ]$ N+ ?+ E
Method 09
3 c7 O5 x( t3 N% ^' g& B; h7 V=========% y6 s! T) A$ u( }1 o- `' ^- B

4 r1 Z9 u2 ]; c" p6 ZThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
6 R# ?- W& [7 |; }* f/ E* q& cperformed in ring0 (VxD or a ring3 app using the VxdCall).
- H8 ~% ]2 @: KThe Get_DDB service is used to determine whether or not a VxD is installed2 e( h# w- D: \1 [+ S
for the specified device and returns a Device Description Block (in ecx) for
4 p, `/ d2 @: W: N( b; Kthat device if it is installed.
/ V  ]) Q6 N' J. b* a' Q( g- g4 {9 S9 i2 y
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID6 z, f) d7 w, i) f" Z
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
$ [9 [! Z: V- R" y0 o3 |   VMMCall Get_DDB
  w9 J- m% A0 b3 S+ |, E& H/ i6 ^   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed  g9 d3 W, N3 Y# M* B% Q/ k! c
2 v1 N+ y2 A" M$ n
Note as well that you can easily detect this method with SoftICE:
+ x/ l5 i+ Y4 \$ @   bpx Get_DDB if ax==0202 || ax==7a5fh# c3 \1 _' T3 ^2 O/ v
0 O* ]) g% S* {- `9 l5 K( B9 A
__________________________________________________________________________
9 y4 z. N# @9 l. }8 y# j# s( D2 q+ b/ Z3 s
Method 10: d4 N" z) e  n" n( E/ ^7 v
=========  u+ I$ P( _- P+ f0 |1 C9 v, n
& a( H- d& Q# P! ^% q
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with; s! j) V; F2 ]# h. w% {  J
  SoftICE while the option is enable!!
: i$ |  }; r  D: o# a9 _3 X( g% J9 G/ C3 X
This trick is very efficient:
) N- V$ O$ A+ r8 ?5 I, Y5 Hby checking the Debug Registers, you can detect if SoftICE is loaded
& f9 v6 ?5 k6 r3 U6 u( H7 b+ t6 u; g(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
5 p; r8 ]- d" ?6 A, {$ qthere are some memory breakpoints set (dr0 to dr3) simply by reading their
5 d. t* t' ~' n% U" }# Q- h" R) H- Kvalue (in ring0 only). Values can be manipulated and or changed as well( F, V9 Y4 J& T9 F! Q# j& n
(clearing BPMs for instance)# p' b% ?9 E6 |7 s. \) @4 W! ~, ~% `

, g; m% i7 q2 s: I6 V__________________________________________________________________________
( c% o- e5 M  o2 \6 J. v
% E& q' f% L6 ?3 W' a% i- TMethod 11
% o* N! G; }4 S6 j. K=========
9 m5 Y: h: E* D) G7 N! [7 v% I7 d' W0 c; F4 k* I
This method is most known as 'MeltICE' because it has been freely distributed
$ D0 I& u& D6 S, S, l3 kvia www.winfiles.com. However it was first used by NuMega people to allow
% r) p( |5 }( a" ~- cSymbol Loader to check if SoftICE was active or not (the code is located/ Z# r6 Z& b' Q
inside nmtrans.dll).0 O# x' E! j, G( Z- p
5 w2 n/ Z1 C' z0 v$ s! v1 _$ ~: J
The way it works is very simple:
* Q1 e$ e2 k* S: H) xIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
, [7 M) [: B' Y! |& M/ f1 Y6 SWinNT) with the CreateFileA API.7 u! m( `( d; J. z! ~1 ?6 g( Y

5 y/ j( \6 K6 N( ]7 F+ B8 b' MHere is a sample (checking for 'SICE'):
2 D3 a7 S  K7 f# h6 K! ?9 t, m2 f* R' L( C
BOOL IsSoftIce95Loaded()3 |4 e1 t7 v5 c2 ?/ _6 \
{6 j3 R' |# [/ ?" f8 f
   HANDLE hFile;  
& d) i* ?1 M6 B" Q   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
. b* V6 J% L4 O2 D: a/ x                      FILE_SHARE_READ | FILE_SHARE_WRITE," p" A7 G3 z. E
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);( Q5 m9 D# e9 e  x) ~6 }* {
   if( hFile != INVALID_HANDLE_VALUE )! F- ~( s# e; q+ t: `8 @
   {3 q0 w) s: r7 Z: P4 d
      CloseHandle(hFile);
8 M7 T3 I- l$ q& ?      return TRUE;8 ~2 G0 q  [& s
   }% ^) K# Y# k, U) J+ f8 q6 G% d8 s) ?
   return FALSE;* M9 ]4 ]- V) p3 N# q  V, H
}
2 G% Z+ ~/ ^- B. d/ W5 T8 O: i9 b
3 M' \/ Z: y- }8 t, a# c; rAlthough this trick calls the CreateFileA function, don't even expect to be
. j$ x. ^9 _6 G' d: r# fable to intercept it by installing a IFS hook: it will not work, no way!6 }2 E9 ?. B) g  U5 P$ p
In fact, after the call to CreateFileA it will get through VWIN32 0x001F+ Q( S/ j; Y9 H5 b
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)7 B9 Q2 Q% {! A* H& d2 e
and then browse the DDB list until it find the VxD and its DDB_Control_Proc5 T( c, P1 G) ]! \. L( ^: n
field.2 A9 S3 K$ \) R% Z  X
In fact, its purpose is not to load/unload VxDs but only to send a
; Z  d8 d* Q; Z2 t. }7 fW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
5 G7 ^! ]0 t9 G" z8 d( i. F& W8 ito the VxD Control_Dispatch proc (how the hell a shareware soft could try
6 `8 ]# D+ J/ @4 C8 a* J4 t4 wto load/unload a non-dynamically loadable driver such as SoftICE ;-).
( l/ e* n8 d4 E- R! ^6 rIf the VxD is loaded, it will always clear eax and the Carry flag to allow( R9 P' P. L/ z, a
its handle to be opened and then, will be detected.
6 t( _9 K+ s- I% W1 j7 i! R4 `You can check that simply by hooking Winice.exe control proc entry point
' e9 I1 a6 U4 fwhile running MeltICE.
; P+ y; N7 J% L+ `. Z- z9 z; W0 d% a( `1 o+ |- A. P: U

% K5 `+ p6 Z% [# h# C5 |  00401067:  push      00402025    ; \\.\SICE, b9 U% |) |- p* E
  0040106C:  call      CreateFileA
. s# K' E7 K# l$ M  00401071:  cmp       eax,-001
1 O( A, e/ p/ b) F7 v0 S8 T3 _  00401074:  je        00401091
- n7 C2 r8 ]: \1 A0 \6 V1 ]% g6 ^! t: Y- Y$ P6 E6 s0 o3 P' f' d
3 Z$ ^! i  K& @# H$ X- N# j
There could be hundreds of BPX you could use to detect this trick.
- x, [1 B6 T# ^  D/ T-The most classical one is:
' R* y  D$ F  M8 P0 c) M* N  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||) k  O' n  r# ^# P7 i" Z, D
    *(esp-&gt;4+4)=='NTIC'
0 G- U' `1 l. ?+ ]. c. V
3 m# H! ]( v% t/ X$ I-The most exotic ones (could be very slooooow :-(
: M; P* ?; w; _' o   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  , S5 {1 c3 o) @: V! r
     ;will break 3 times :-(
; x/ i: ^/ j' p% x
* n8 r0 B% c$ n  T  t* h0 x-or (a bit) faster:
. V5 k; {3 _/ P+ b6 Y   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
& l) A9 Q3 o# M0 {9 c
1 P7 _2 y1 F$ p+ g   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  - i  `1 c3 P6 l) S- X" |% `
     ;will break 3 times :-(
4 d$ o, W+ a! j5 R' g
/ L: _$ p4 A! K) h- z7 H-Much faster:$ |! a3 H; u2 A
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'/ @/ B1 k0 F! M% T( ^/ Y

6 K, I9 G' N6 Z- Z" \" j+ [Note also that some programs (like AZPR3.00) use de old 16-bit _lopen! J1 `+ r6 @5 v% ?
function to do the same job:
( c, C7 }% [  e1 @( p9 {+ F7 j
- b/ H7 ?" R; [# E5 ?   push    00                        ; OF_READ5 B* D8 T% t5 a6 u* O9 g5 r/ D5 M5 ~: R) g
   mov     eax,[00656634]            ; '\\.\SICE',0
  X8 ^  I* M/ W1 Z9 A   push    eax
1 }" t  @8 |) Z0 B; o: d9 ^   call    KERNEL32!_lopen8 p3 h6 }4 L; \' G' T& ?
   inc     eax( e. u( r0 v0 I+ `" v
   jnz     00650589                  ; detected3 C. {* S, I3 t$ x! `& [
   push    00                        ; OF_READ
# N. W& q4 _7 W) L  g" Q, h   mov     eax,[00656638]            ; '\\.\SICE'
; A' F$ c* T) N5 M4 ^8 p' c3 S& @   push    eax; X3 \; ?( f7 o# p& h0 ~% J8 g
   call    KERNEL32!_lopen0 n1 w* G1 |$ \! E$ e* q. {( K; F
   inc     eax
; d" j& Z) d5 S2 f   jz      006505ae                  ; not detected
6 J( ?% M  a/ Q
  O/ v6 I$ w1 ?& f+ `$ `
( o6 N& N7 r+ a2 V( o. z__________________________________________________________________________
1 X3 |0 J# r. y8 t" d5 B) r: |/ k$ k" X4 @) f' x! ]
Method 12
7 b( v  E! D  N) H( s0 V# `=========
+ Y, p8 Q9 K4 V0 ^& B5 R
! k# L8 }0 z9 P8 C3 t, cThis trick is similar to int41h/4fh Debugger installation check (code 05' Y& V) ]0 j5 p
&amp; 06) but very limited because it's only available for Win95/98 (not NT)7 P8 B/ w" }. G4 }4 e+ `! B- ^
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
6 J: j) F/ I) o4 B* J2 d. b3 p0 H2 f/ k' y6 D+ ]4 q3 D
   push  0000004fh         ; function 4fh! {' m6 }* {  K
   push  002a002ah         ; high word specifies which VxD (VWIN32)2 W! J, \# z$ P. x+ s
                           ; low word specifies which service3 v8 d6 O7 o: a+ e8 s  s$ b
                             (VWIN32_Int41Dispatch)
, h" G( d: a. J3 e* u7 f   call  Kernel32!ORD_001  ; VxdCall
+ f: @+ _/ M1 \0 E% D7 L   cmp   ax, 0f386h        ; magic number returned by system debuggers
" Q5 L- I$ _8 D   jz    SoftICE_detected0 A1 ?2 M/ j5 K- B
2 b1 ~$ Y3 S. `/ g
Here again, several ways to detect it:
6 F5 \' W* `. p2 H& u
2 Y. q; P$ P7 F( f* F7 ~    BPINT 41 if ax==4f
1 p, X  F2 V9 y1 e) u) [% J
& E- c4 [, S/ k' a: E    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
: J+ H2 l+ ?6 U) g' T$ {+ ^# x, P7 ^! G; j* P9 v2 \$ \9 P% Y" B5 a! N& i
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A) a  r; M- g4 V1 Q1 F5 g* _
' ]4 ]1 Q$ l+ v* ?
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
* x2 E; I- u  M8 w1 r2 q8 F4 g0 o4 }' x4 o
__________________________________________________________________________
  ?5 ]- W$ k$ X+ l( c1 p, W6 y' l( X7 ~# m; G- z2 O9 s
Method 13
6 I- b) p+ B% b6 A0 A0 {5 {=========
& o+ k. e  F# v, }; ]: R
3 ]# ?- `0 E3 V4 l/ R8 m- yNot a real method of detection, but a good way to know if SoftICE is
6 A( N1 y8 F4 E& finstalled on a computer and to locate its installation directory." Z* ~2 n, w. C: \/ g
It is used by few softs which access the following registry keys (usually #2) :
( n2 O: ?& @" T8 Y* _2 i) }; t2 }5 T/ k& K: q& a" ~
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion7 ^% L# ?! Z# Y5 m9 q
\Uninstall\SoftICE% E, Y! E- F' Z
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE) U: ?% t1 t( v! `
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
3 _& E" K3 V4 |/ |\App Paths\Loader32.Exe
- b: z( @! l' A
% x" u  F9 _; B5 l0 ~0 p% K' w* G, d. Z% [0 @
Note that some nasty apps could then erase all files from SoftICE directory2 O6 n! Q- R- N; {& ]
(I faced that once :-(: R3 t7 T) N. i2 ?1 q
% B, C& G, x: K) Y' ]
Useful breakpoint to detect it:9 g9 D( A2 ]( V/ g4 H! a( Q

0 A) x  @' h% d. P" s     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'7 f" a- ?- l+ d! ~7 G4 K1 Y
7 q+ G$ i2 d6 |' B6 z
__________________________________________________________________________  V# q) }: E1 E6 V0 A5 o

- w* R* r2 X; V+ z, ]1 ^1 ^
: J& A& E7 r! TMethod 14 , h0 Z0 {* m' ~# Q& C
=========) V0 d" i: {1 t- @- e2 j. I. B. m

+ Z7 j4 [. D  \+ KA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose7 ~; K2 `9 @! t: i
is to determines whether a debugger is running on your system (ring0 only).* X5 d. g( `- C$ ]7 n" y; i

* v( r$ ?% L7 W( V& v& J   VMMCall Test_Debug_Installed: {4 \5 G% _/ C5 b- G
   je      not_installed: `- [; O1 B2 K' V" {

, `3 ~) h- S3 {8 J# i4 s7 j" dThis service just checks a flag.% ^' E! H1 D6 H) c; n
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部