About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
3 t/ e. N1 u; J8 C9 J5 P- j6 T+ I+ p<TBODY>4 V: E. u8 h! t' u* T
<TR>) D4 V: F0 z$ ?% ]5 f- _' G5 u
<TD><PRE>Method 01
5 k- T' R% |1 T* x=========8 I/ }, P" m: `! W

4 d# n% s) N: Q' _& ?) Y5 U  nThis method of detection of SoftICE (as well as the following one) is- S/ n9 b, s' ~' _8 }
used by the majority of packers/encryptors found on Internet.& `5 j9 }5 j4 {3 c8 a# X
It seeks the signature of BoundsChecker in SoftICE
0 U, R& u: K0 k- _2 ~+ O" G. P$ I; e- ]: L9 J4 A# B+ _
    mov     ebp, 04243484Bh        ; 'BCHK'
- B' x2 p/ U' e7 B4 t    mov     ax, 04h
2 i1 W2 M0 k9 r$ `3 V2 Q; v9 M    int     3       9 ~9 h" q  s3 [8 K; R  R/ ]- r, B
    cmp     al,43 r$ G$ Q4 n! ~9 D. F7 F
    jnz     SoftICE_Detected3 d) G: f3 \9 _) D; B
+ b4 [/ i) u5 T
___________________________________________________________________________2 D3 B: O* l% h

: y* ?, m- l; U$ X5 T' h: K* t( k( jMethod 027 T) A7 G4 t- K/ O5 o6 I) T
=========
! v) H5 H1 C6 g) S1 z2 F3 X6 t. U$ d1 q1 d# J
Still a method very much used (perhaps the most frequent one).  It is used$ i, S( k# Y+ U( l! @
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
( X9 B- I( W: ~or execute SoftICE commands...
9 v4 @  d% j/ x0 |' V% oIt is also used to crash SoftICE and to force it to execute any commands
) o% w# `5 f" s9 a2 ]  `9 o(HBOOT...) :-((  
3 A) v7 M) K& Q' y
9 {- w. l5 e$ U4 J; a  b8 K2 PHere is a quick description:
3 r& y4 I" O3 C$ E* ~, W-AX = 0910h   (Display string in SIce windows)
+ ]# M' d6 {, `7 ?-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)" u4 C( k+ Z% Y6 q8 {+ C% d3 s' Q2 I! B
-AX = 0912h   (Get breakpoint infos)
4 n3 I, u2 o' w' l( t: B-AX = 0913h   (Set Sice breakpoints)1 ~. f' a; b' r8 ?( G" o2 B% \% V
-AX = 0914h   (Remove SIce breakoints)1 s% T; B7 \3 M3 E/ m
( Z( M# r5 |5 |3 B, S3 R4 ^: q1 g
Each time you'll meet this trick, you'll see:
, x1 q0 c4 I6 A9 T* v-SI = 4647h: k* @' x5 X" x/ O" \
-DI = 4A4Dh' Z7 `3 [; U7 t5 b/ [9 j) ~# @4 T% U
Which are the 'magic values' used by SoftIce.
& X- ~, s& j) R# e1 F: QFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
+ b" Q' H0 X6 {1 r
1 ~5 Q. G8 S+ U* ~Here is one example from the file "Haspinst.exe" which is the dongle HASP
) \- q, ^  m! F1 ]" pEnvelope utility use to protect DOS applications:
0 ^3 }" Y( P- k" N, V# p  W+ Q- B

  i1 M! D, |8 }2 g4C19:0095   MOV    AX,0911  ; execute command.3 f1 M7 t8 J6 x; \$ u% y! M4 c
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).; T5 O' z+ V& m% N
4C19:009A   MOV    SI,4647  ; 1st magic value.' y/ P9 b- `% v) J, b* U
4C19:009D   MOV    DI,4A4D  ; 2nd magic value., x8 ^8 K$ p/ M7 V) a* S
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
+ J% a3 V9 y8 [5 h2 k4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
% Q9 f9 g+ h0 F+ B4C19:00A4   INC    CX* F- J5 i$ Q0 P, w& A9 L
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute" F1 a3 |( P- b$ C
4C19:00A8   JB     0095     ; 6 different commands." a! g$ U- |3 Q( Y2 q. S
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
6 w- ]* l1 [1 J3 X8 |4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
% D' O4 |( _5 A( I* |: ^1 k2 n7 V4 K# S% x# E( G- e, S
The program will execute 6 different SIce commands located at ds:dx, which
+ l  ]1 @' y, ware: LDT, IDT, GDT, TSS, RS, and ...HBOOT." d* {- ?9 R& T2 V& I
: j9 x2 J" ^4 ^$ v0 a! }" c
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
1 C3 B6 P2 a) B8 ?, ?9 K___________________________________________________________________________
: L0 f) h, |* b" S; ^/ }( p  M" i  M( i( V

6 m4 J& Q% h1 l  @0 |: q: PMethod 03
; a, ?/ F8 ]8 h/ {  W4 C& p" _=========& X2 \4 d$ p* N6 \

" y( c6 R! j/ V8 `Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h4 z3 x) T3 T2 \* s5 G! `
(API Get entry point)0 a3 T% B  _8 H9 M( Z4 x+ D& F; g
        
0 }- K; q5 R$ R! D( Y& g" j5 N8 k, F  y8 N
    xor     di,di
: r$ p% O/ s# j# r& b4 l& ]    mov     es,di
. i6 Q! M+ I# m" f    mov     ax, 1684h      
3 T" F3 W6 Y& n+ a0 D5 A5 f    mov     bx, 0202h       ; VxD ID of winice
" Z9 \& R* u0 v/ U# ~( W4 R% j    int     2Fh
1 ?- w& v4 g. c1 E4 m    mov     ax, es          ; ES:DI -&gt; VxD API entry point
0 `5 @8 l( n& S8 D$ ^0 K/ @    add     ax, di
5 e/ W+ Q! Z3 ^* F4 P    test    ax,ax
) J& U9 x% @# D    jnz     SoftICE_Detected
% [% X4 |: o$ I5 s" q* \' e+ w4 D
0 W0 a+ y+ ^, B- a5 b5 m' z. |___________________________________________________________________________/ D# l# E% A% B* ~3 H
- }0 r0 n! \- W1 o) F, Y( n
Method 04( n# u: K' U* o: E" V% F* z6 M
=========5 A; E. @8 O9 T! c5 l$ A
3 D2 k7 n8 G8 p0 z; q/ S
Method identical to the preceding one except that it seeks the ID of SoftICE1 ]# z  O# ^' \( K% h' ~0 R
GFX VxD.  N, J4 @7 x2 }( y+ o1 [

, k  @8 @- F# p; n# C    xor     di,di
4 v" j4 m9 E7 g  U3 M* Y& o    mov     es,di
) A) C- a6 {4 _5 q$ J  f    mov     ax, 1684h       . J$ C+ \+ _# z0 c, E1 }
    mov     bx, 7a5Fh       ; VxD ID of SIWVID
. N$ b7 R, {% I. D8 U    int     2fh% m$ ]; {. X8 A/ {9 |
    mov     ax, es          ; ES:DI -&gt; VxD API entry point. D( _( e  ^5 E9 ^" h! _
    add     ax, di& |1 R6 ?& ^6 [" V* |2 L& L
    test    ax,ax/ Y& ]: _4 d7 W3 b
    jnz     SoftICE_Detected
/ K; \9 x% q) ~$ J8 C* \9 @+ a/ g$ z3 m* c
__________________________________________________________________________
1 ]% H8 ?1 G% G/ y
+ ^$ r" Y5 @) `2 M, n
( ]- F3 @; B' v7 v# H% C' @. oMethod 05+ k) k# D- T3 W& X) N# w
=========4 D  J' s& m* q( \8 L( c
. f9 l& U, h; P- g
Method seeking the 'magic number' 0F386h returned (in ax) by all system
8 E! z  x" z! g) }! ~% rdebugger. It calls the int 41h, function 4Fh.
5 @2 u7 x8 x4 [) z5 nThere are several alternatives.  
* j$ G" f- c* }, B& N
" G0 `5 A2 [4 B+ nThe following one is the simplest:  w1 ?5 M( J% Y( M
5 Z! V7 p# A( V1 u
    mov     ax,4fh( O. V6 a( h# h- M. Q$ Y0 S0 E7 ^5 L
    int     41h
- w# z# }2 y* `3 P7 t    cmp     ax, 0F386
- `) z  `+ d3 Q+ @    jz      SoftICE_detected: {* {: e: u, u& c3 z! g! M5 r0 O
1 ?8 q" A9 l% ?: z! W" f  @" g
! I2 s0 h2 e9 U/ y  K6 D1 T
Next method as well as the following one are 2 examples from Stone's & a2 s- n& ?, ~0 @" P* [- N/ C) x
"stn-wid.zip" (www.cracking.net):, Y( r6 o6 X' o* k9 k% M5 U
- S. g6 N# P! i9 j$ ?  t/ ^( X2 I
    mov     bx, cs+ H# J+ g% s8 X- U6 f+ V
    lea     dx, int41handler2/ f+ S# @( Z+ G! r0 U# R( ]
    xchg    dx, es:[41h*4]
8 e. W- F" J% d6 A) I1 r    xchg    bx, es:[41h*4+2]
( P6 |; t) t4 n$ s    mov     ax,4fh
0 S3 N+ |. w$ S% _    int     41h) D' J) R& N8 ]  u/ t7 u4 u
    xchg    dx, es:[41h*4]0 F+ j5 Q1 U4 V/ I/ s4 V  s# P
    xchg    bx, es:[41h*4+2]- f/ ?5 x7 k% Z+ P% J  K1 d
    cmp     ax, 0f386h
. G3 H+ H, o3 b9 g8 O    jz      SoftICE_detected
- g7 y3 L; L# t6 Z
& N! h: W9 y% g( aint41handler2 PROC. W4 y$ r& V3 d9 Y8 {) j6 P$ n) X# Y
    iret
3 p4 y& c0 G! P3 B7 l' S9 uint41handler2 ENDP& @; g* j9 D! N% S( ~
# y* c3 T4 A# a$ J* H3 v
, U% Q- ~8 K6 b# U0 q
_________________________________________________________________________' q8 s' P) R6 i6 n: M: p; @

8 @5 h, Z+ A% T! Z) x4 I5 f
9 G4 w$ I5 c; z4 b$ r8 mMethod 06
1 d. w. T; w9 }+ C( {; K6 O1 x& G9 o=========1 @/ h+ n. h  x# l$ }

4 }7 b4 I  t0 n# l
0 c; B: X" g7 {" L5 B* D2nd method similar to the preceding one but more difficult to detect:. R/ C# w' d: m- x* v( N

0 ?# _- J1 B9 }. o& m+ S( c, l  U3 M: Q- d+ K4 O) U
int41handler PROC2 Z, R& b1 [1 H; M
    mov     cl,al2 i" A/ A; G2 y3 W8 h# @
    iret
5 l7 d2 \- o. n$ S' {( xint41handler ENDP
. v# r. ]) g' H2 l1 A+ \9 n- w( Z, }) s1 G9 U  ~
% t9 ], \4 `1 d' Z, v: S
    xor     ax,ax
# F- F9 {6 L- b7 D* |: J    mov     es,ax
3 @+ D7 ^6 y, e% C    mov     bx, cs
/ z: O( |$ A% l: G0 j$ ^2 h    lea     dx, int41handler+ S1 Z$ I: ]9 P9 }+ m
    xchg    dx, es:[41h*4]
' ?$ U& a& A" m1 T. Q/ `    xchg    bx, es:[41h*4+2]
' o2 R9 _" _) X/ d, P5 [9 L    in      al, 40h3 Q# V/ p/ v  f3 O1 T2 I( y
    xor     cx,cx. K$ G7 @' ^% I: ?! S9 n
    int     41h
  K# O) }, i* J6 G1 v; l& E# Z3 l    xchg    dx, es:[41h*4]& m% O4 K: `5 L
    xchg    bx, es:[41h*4+2]0 M/ a# V8 e8 a  ~
    cmp     cl,al
/ C. e7 v# O: j: T6 k    jnz     SoftICE_detected% ~# x8 O5 ^  r6 m9 N! h0 `

# v, c  Y- y8 I_________________________________________________________________________3 H6 O$ ~  U% G4 i* _9 G* g  `+ S

4 i; D1 M6 l8 o# u6 a# M+ O' SMethod 07
1 P# |5 x$ L; M8 x7 H$ w=========0 a3 \$ y; `$ O8 ~
' Y3 L$ g1 H8 v" f4 w
Method of detection of the WinICE handler in the int68h (V86)4 N( S3 I. u% k7 A9 {6 c- x
, e, H' q  l) N' K; d6 L) e' r& m
    mov     ah,43h
. c; W2 C0 C% j$ J2 c5 D  ^4 A    int     68h6 B% }% E* }5 }5 ^$ v
    cmp     ax,0F386h
4 p3 V) d$ c- F9 k2 }7 l    jz      SoftICE_Detected
8 f- e! q) t* T/ Y
# g. ]& P2 |( Y; V! c( j& L: ]
" U0 O$ d3 `+ H& x=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit0 U6 }$ C$ f: K3 _0 d& |  Y
   app like this:! y4 R" A2 [8 |8 [

  k# T7 D/ S9 x' s5 m8 u   BPX exec_int if ax==68" s- q- \0 D! R! }6 o6 z
   (function called is located at byte ptr [ebp+1Dh] and client eip is! Q9 o, \1 F% S% C9 j
   located at [ebp+48h] for 32Bit apps)2 n6 x8 A0 }5 Q
__________________________________________________________________________
* I% S; v5 a0 R* m9 V% L( m# X) r" Y% l( w4 s

6 [1 v) J% T! ]+ A$ C2 P7 AMethod 08* S* j& R1 U+ ~: e+ O8 i
=========
* r6 ]0 S. W) ]- Y% @1 g0 x0 s4 B3 q! ^1 W; i/ `
It is not a method of detection of SoftICE but a possibility to crash the
9 }; A% v  v! S% N& Rsystem by intercepting int 01h and int 03h and redirecting them to another
3 n( Q. U; M3 w) G6 z6 Vroutine.
, n6 O0 ~% E% u1 lIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points, ?# W: [& c# @
to the new routine to execute (hangs computer...)2 o5 T# L. h" T5 M" S% I+ x+ p

# o& ^# z8 h. C3 C4 m" j    mov     ah, 25h# U) f! @6 G: h
    mov     al, Int_Number (01h or 03h)
) f) o0 [# H  z! @- i0 l    mov     dx, offset New_Int_Routine# u0 `# B( l1 w" p1 t
    int     21h% ~# p2 y4 x+ K/ l! ~, t; a

% F2 k: P0 h' o9 o+ F1 p* y__________________________________________________________________________6 i: {( f- P! i: N' i

$ b2 ~3 z2 w6 z5 I' PMethod 09
, K0 J' u4 G3 y=========
1 {3 [! t4 N" A) }" Q- O
$ P9 p6 v. o% S$ y$ [- eThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only$ }0 _7 H. @' L" M2 v! o' h3 Y
performed in ring0 (VxD or a ring3 app using the VxdCall).! X9 |' F8 |4 v- t8 _
The Get_DDB service is used to determine whether or not a VxD is installed
: [2 h$ Z) a' F4 j$ ], Hfor the specified device and returns a Device Description Block (in ecx) for
, \: P7 p: y2 v4 X' [, k( _that device if it is installed.
2 C0 z4 H/ }3 |" ]6 Q
+ {% k7 X! ]7 B8 E   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
6 Z: U" Z, j- d( D/ y- N   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
  m, g$ W/ z/ \   VMMCall Get_DDB
% H* f3 E( u7 c, A# s   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
: c# ?( H1 T9 L3 d+ ]. H0 _' J4 `* S5 Q0 P
Note as well that you can easily detect this method with SoftICE:
" Q% ^7 k. P& L   bpx Get_DDB if ax==0202 || ax==7a5fh. o; Q* _4 Z7 S* d, F% g/ u# ~

' S) c9 ~/ f+ [$ g__________________________________________________________________________
/ g- p( S& c( g; a$ Z7 ~; U& a+ b0 F+ g: m
Method 102 H0 k3 b7 W1 O7 k: i( k  X
=========
. z+ _0 O/ I8 ]" B
4 y6 R( m( f7 ~5 m% V8 {: _=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with4 |6 s% K' r6 A/ O: }
  SoftICE while the option is enable!!  J" |& Y) q* H
# U2 Y2 k& u# o$ f% g
This trick is very efficient:
( ]* {5 O% [. y6 v& Rby checking the Debug Registers, you can detect if SoftICE is loaded
" s% l2 A  I! S$ {8 V/ [  j(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if: \5 t, B; Y# N; W& P9 w
there are some memory breakpoints set (dr0 to dr3) simply by reading their! r+ |# o2 m2 _+ C$ G0 t: x& c
value (in ring0 only). Values can be manipulated and or changed as well
& u* B$ l( U, X; r( @8 q3 o- L% Q(clearing BPMs for instance)  h4 t- m8 V2 y$ x4 K7 U( c9 n

* N/ K. Y) r5 d! ^+ f# g% l! `, `0 u__________________________________________________________________________0 G& E# G4 X' J" \6 I. _

; |4 _: X$ R3 w6 A0 ZMethod 11
6 S$ x+ _" l+ k; \) F% Y=========/ f% O5 L8 v; a/ p2 J
  O2 m, L: n7 h! K
This method is most known as 'MeltICE' because it has been freely distributed! X, [3 x0 K) i1 P4 d7 K6 I
via www.winfiles.com. However it was first used by NuMega people to allow
/ ^- G- P6 }; D) G9 cSymbol Loader to check if SoftICE was active or not (the code is located) s, B* o% F; C% F1 w
inside nmtrans.dll).; A$ j& p5 |% S  M& w$ o8 b- j

1 B: V9 u1 g% y$ I9 I; E3 @The way it works is very simple:) e6 m$ {( c: ~0 C
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for+ @/ K* q& t  v
WinNT) with the CreateFileA API.6 T( V% D* ?4 n4 F* {( y
. p0 D7 f) y  e& D5 [
Here is a sample (checking for 'SICE'):: d# b3 y5 b- k/ p% v: [8 l

7 }: f$ h+ U$ w8 R$ J4 A- bBOOL IsSoftIce95Loaded()
1 M1 [" o. X; f1 F2 V3 m5 C3 M{
( s7 _1 E- G$ a. W1 G* f8 b& j   HANDLE hFile;  
! u3 L) g. P1 j% A$ \) \. c   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
! X# s* t: n! n+ |$ y, R                      FILE_SHARE_READ | FILE_SHARE_WRITE,* C) M& [3 b& @3 c! N
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);$ W5 C2 {0 b4 Y' Q; Q
   if( hFile != INVALID_HANDLE_VALUE )
  ]$ o# v. T% v7 F( z   {) v: \& A- {" ]; A! F
      CloseHandle(hFile);; O6 n1 H1 e" b* d' [0 a- B/ k
      return TRUE;2 T. S; B( C8 Z# @4 m2 }2 f( D- h
   }
9 p- J7 z- w( `/ S* J   return FALSE;
- k' ]2 u' Q  c, s}
4 f: P0 @  c1 |) H" G, J6 d9 h3 m. o  ~$ @( R
Although this trick calls the CreateFileA function, don't even expect to be
  r  i! {0 k  I1 K6 Vable to intercept it by installing a IFS hook: it will not work, no way!
1 |4 q4 I* L$ y" |In fact, after the call to CreateFileA it will get through VWIN32 0x001F" t9 A7 I7 }! |% I( z0 C
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function); K1 h% M: ^0 w$ |
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
; _# |1 K0 i2 r0 Vfield.0 t9 g6 K' T# \0 k2 ^% L  [
In fact, its purpose is not to load/unload VxDs but only to send a 2 n3 A) O" y" G3 M0 r
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
) A- D. N+ C" O* F# t# N# Sto the VxD Control_Dispatch proc (how the hell a shareware soft could try6 k( r% A. j" d( S( N/ R7 p& {
to load/unload a non-dynamically loadable driver such as SoftICE ;-).6 \/ F0 m% r  N1 H+ Z( j
If the VxD is loaded, it will always clear eax and the Carry flag to allow. T: f' B) I- Z: h* n' `8 R; C
its handle to be opened and then, will be detected.0 B1 Y% [. P: \6 X  f
You can check that simply by hooking Winice.exe control proc entry point
2 A  w0 Q8 E/ V0 j% \while running MeltICE.
+ L2 v3 V( S& W+ N# L( w" m/ v  E7 @+ O) L: c3 |6 p" V3 |/ U

$ Q; {3 r6 Z( \7 s( o' t3 n  00401067:  push      00402025    ; \\.\SICE  `' W  y* k/ [" ^
  0040106C:  call      CreateFileA
& \) q' P0 i9 ^2 {+ ]: J' Q$ K3 u  00401071:  cmp       eax,-0018 T2 j4 n, _' i/ l
  00401074:  je        00401091
. {% P" x) B: V: m
- A6 q5 g* Z, {4 R6 d) x5 m* [) M6 i& V* b8 i
There could be hundreds of BPX you could use to detect this trick.
# A1 i2 H- v- F) w3 f/ I" k-The most classical one is:
( `* Y& q' J1 P+ C% d  X  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||& y' s' x' }8 \
    *(esp-&gt;4+4)=='NTIC'9 ^# O! ]9 a7 g

/ n7 G1 `  x# C$ ?  |5 b-The most exotic ones (could be very slooooow :-(
+ @- F* K" K. _   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
* e- p( ?0 R/ A6 E* L6 N     ;will break 3 times :-(
4 O; w3 ~- v7 ~9 p% _; c- F
) O2 k( K# B$ _-or (a bit) faster: 7 N1 g0 L( E7 r& x" w
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
# {0 M" S' ]+ Z$ w/ D: B
; K; i$ k2 {) w$ Q8 [1 i% ?$ a   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
1 T- Q% J+ [+ E' f- ?9 c8 S     ;will break 3 times :-(
" j; k9 C; p+ N) l. x
+ O8 ^4 e) O3 K. i-Much faster:6 {  n* q7 _/ l/ u8 e- D
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
1 i% K' ?7 p9 ^9 B3 u) ?6 {
9 A3 Z) {6 q! U, D! S' T1 H. PNote also that some programs (like AZPR3.00) use de old 16-bit _lopen' K+ W% X1 v6 k9 c: r% N% p6 b1 b
function to do the same job:
/ O" x. B, ~+ F( k% i
) b" r- h. n- L# t8 l   push    00                        ; OF_READ4 q7 G( Y! w; I* ]1 m4 j6 Q
   mov     eax,[00656634]            ; '\\.\SICE',0/ p8 A* |# V! T3 s  k; ]: }( e  @
   push    eax
' {9 j: K7 s  ~& `6 @( u) k   call    KERNEL32!_lopen
' D! h  D( ~3 ~/ V& L   inc     eax
! F- r& D# D+ X% S! l& K   jnz     00650589                  ; detected9 \& }- j% L1 m
   push    00                        ; OF_READ
% j9 n! d/ A' b9 @  z   mov     eax,[00656638]            ; '\\.\SICE'
1 I! b4 K& G: Z" b+ X   push    eax
3 U$ |/ _' |/ b  a+ p6 d   call    KERNEL32!_lopen
0 Q: U& R9 D; q   inc     eax
0 X2 I7 \/ ^) }( D5 R   jz      006505ae                  ; not detected
1 o8 O' Y3 ]% n7 l* P; W( f7 m+ _7 T: o8 a* [

; ]' n9 f- ]0 A  v# v__________________________________________________________________________. i6 O4 @' W9 z  G. z
6 X' D8 L9 @& b* g# Q
Method 12
1 t: W: o: O% o=========9 o3 u6 `/ E- {

! Z3 o* y" V; OThis trick is similar to int41h/4fh Debugger installation check (code 05' @9 b% U' [9 ]- k( L
&amp; 06) but very limited because it's only available for Win95/98 (not NT)" Y+ d: S# l( o, |
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.  P/ k+ O& H* u2 P6 n% x: G
8 p. ?& ]: P! x& j
   push  0000004fh         ; function 4fh$ u' E& H2 i0 q. `' Z8 q2 w' I
   push  002a002ah         ; high word specifies which VxD (VWIN32)( D. ^2 O" N0 B1 m) L+ h6 g! i
                           ; low word specifies which service4 G/ h" o. K# I7 f7 R. J& i) {
                             (VWIN32_Int41Dispatch)0 ]+ |0 z5 M# }0 O
   call  Kernel32!ORD_001  ; VxdCall
' m& d9 G+ F; b# n3 w; h0 p. }5 n   cmp   ax, 0f386h        ; magic number returned by system debuggers
5 ?6 {5 c" t- h2 L$ ]/ g3 Z9 ~8 w   jz    SoftICE_detected
4 u/ w" Q) y7 ]) x' b
2 ^( @( r& t; YHere again, several ways to detect it:
  @# ~4 r% G. _0 z$ i; j: q) R
( t4 `  g# Q' e* t  }; i    BPINT 41 if ax==4f
# ?. [) o( s: _7 k4 l  h9 ?- p0 \
' u! u2 h/ Z) T8 q% B; |: K    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
* L- L8 n5 r( V- w3 ]
) `: N% U& i1 K1 N6 H/ X7 Q    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A/ Q5 O/ |' ]5 u5 {% {* ?
5 `% e$ w1 M/ O! ~
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!" B4 ~9 U' ]! V- _2 O  u

7 T9 E9 C# \2 g4 t2 ]' A# A0 P__________________________________________________________________________
( X' }. Y. U# z- z* c% j* V/ E  n( u2 s. x
Method 13; e9 E( E) }1 h; d: ]
=========
* {+ U+ f: w( z
+ q/ m% H' k# b. N' oNot a real method of detection, but a good way to know if SoftICE is
# C5 {0 \! N9 i  Zinstalled on a computer and to locate its installation directory.
' t; _0 \( Z! y& oIt is used by few softs which access the following registry keys (usually #2) :
9 M7 u* l# y- c$ N4 N1 B2 j5 b% `* g. R; D6 t: ~
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
. c6 u2 a3 Z+ {3 E\Uninstall\SoftICE
# @) V: \1 e! h, I-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE1 }9 w7 `/ a! c6 s! V/ M
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
' b* O% Z# X- n: f% a: Z& s! t: K\App Paths\Loader32.Exe& B/ d" G" b4 W$ G6 F" [6 k' A

) B0 U' X& x8 t1 B4 g" Y9 h6 P4 A+ X4 l$ f% f+ _  A/ L- n
Note that some nasty apps could then erase all files from SoftICE directory
8 w3 I; v2 ], u1 }5 j* U(I faced that once :-(! g4 a$ F3 I  a9 x

$ L4 A: i+ O3 L& w" t# K/ zUseful breakpoint to detect it:
& ~+ Z4 B: y1 {0 u8 J% D/ ]/ C; L+ e
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
" ?0 @' D* X  I( I# E) l) J: F: X' n8 q/ B+ M
__________________________________________________________________________
9 ?& z) P/ ~4 D1 e' o  H% L( y
5 D* f9 Z; `& d- N7 k4 g0 v1 M7 j
& A2 Q# e% r  [5 G$ |5 IMethod 14 6 W. u% Q+ P5 l# N) S! i: Q0 ]
=========
; W' D1 ]7 O: @
1 m) I6 V5 K2 k/ L8 X3 h  zA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
, ~/ X7 e7 V# M% i1 w# ^; {* yis to determines whether a debugger is running on your system (ring0 only).4 c. E# p3 B1 n+ s4 b

+ z% L' ^( \, L, H9 j   VMMCall Test_Debug_Installed
9 @& Z0 i  o; K   je      not_installed% q6 O0 H# M5 Y3 K# y% v
* m. R; l: h" K, V2 S% ~# L
This service just checks a flag./ V- _" D/ F* m6 [6 r
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部