找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
- X: I" T8 t4 V' N% t<TBODY>
5 T. h+ V9 |" Z( j' D$ a" W<TR>. |! M" W8 q- C8 X! J8 e
<TD><PRE>Method 01 9 [2 x( p: X# d! C/ Q- \
=========" q- }6 g2 c2 c0 d  ^4 ?
% S3 `5 z  r# _0 n% u* ^
This method of detection of SoftICE (as well as the following one) is
! f# u! q5 m& p8 Y5 K2 G( C7 mused by the majority of packers/encryptors found on Internet.7 R6 D. n& a3 b, N$ x2 O  Y
It seeks the signature of BoundsChecker in SoftICE
; p! w+ h+ ^3 b) R0 y" c5 W0 @. ]2 O4 O+ V# O
    mov     ebp, 04243484Bh        ; 'BCHK'& v" _" D" K& w0 S0 J6 `* s) g
    mov     ax, 04h
9 l2 O/ n) }! `4 J$ k0 G7 u( K    int     3      
4 Y1 S! l8 C. `8 U* `% g; E    cmp     al,4
- _+ g. {) u6 L% }  _    jnz     SoftICE_Detected
: B* s' V% f/ L$ n7 v* T9 |$ G) ~2 i5 r
___________________________________________________________________________5 B2 w4 ^! M8 Z0 I. h; _) [
8 f* E% r1 E% W/ {. m
Method 02
, }4 n& ?0 [3 P5 p& C. _# [5 \=========( N/ h: l, q3 H* W9 {% J# k
( O9 G' P  E' ~5 I  e
Still a method very much used (perhaps the most frequent one).  It is used. t2 ~" \) u# r$ O$ Z
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,& J9 T8 v) L) m( k
or execute SoftICE commands...1 E. G( P5 o; a% Y% i+ j
It is also used to crash SoftICE and to force it to execute any commands
% G8 d6 k0 \  s! _" w# I& l(HBOOT...) :-((  2 n( ~/ |& I4 N1 H' v- N
. h9 c" W" {* g7 P
Here is a quick description:
3 b) F4 a  d& r: N" ?-AX = 0910h   (Display string in SIce windows)) o! Z9 n7 \% f$ _! N& h) b% Y+ e
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)3 K) M5 z4 d) o7 r( @
-AX = 0912h   (Get breakpoint infos)( X% z4 ]( {, [- d
-AX = 0913h   (Set Sice breakpoints)
9 g4 |" r2 Z3 f' K) r, V-AX = 0914h   (Remove SIce breakoints), \- M5 ?% O- m
/ P: U* ~- k7 m2 G# v
Each time you'll meet this trick, you'll see:
5 [  t6 R# O% [9 S-SI = 4647h4 `& s5 V. q; o5 x# n
-DI = 4A4Dh4 m& S; ?4 E& ?/ ], P$ V$ R
Which are the 'magic values' used by SoftIce.$ N) i! W7 C1 Z
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
" ~- j* H) S' D/ ^% n0 p- w& n: p2 \! D$ ]* D5 `
Here is one example from the file "Haspinst.exe" which is the dongle HASP
0 a- W9 a: r" I0 c! p$ ~: X* r. PEnvelope utility use to protect DOS applications:
; U7 }4 Z+ q: y6 P
6 U1 Y$ [  ~9 s- S1 g7 u
: T9 X' N+ L6 [% z4 y4C19:0095   MOV    AX,0911  ; execute command.  d0 Z. G; l# h' j2 T3 B
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
  p3 s& Z/ @3 }" @8 T$ y4 _4C19:009A   MOV    SI,4647  ; 1st magic value.
1 w8 I5 _$ f1 o2 O4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
  v/ ]4 ^* S2 \. t( o5 w/ h* p4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)- X2 T5 L" ^, c2 Q$ d' C
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute( G  a" L! o* I9 X2 T
4C19:00A4   INC    CX
( {" C8 u7 G; w$ q/ M5 t% A4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute2 S3 R% O' u" l$ _. }8 ~4 P% a
4C19:00A8   JB     0095     ; 6 different commands.
( _4 S& N$ x4 c& _4C19:00AA   JMP    0002     ; Bad_Guy jmp back.6 c; \" \. W* F
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)% D* ^( K+ q1 H- x

) O) s7 ?& N. AThe program will execute 6 different SIce commands located at ds:dx, which
1 ^9 ?) W2 I1 X. b7 d9 Hare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.6 q6 h1 E, \8 }  ]1 Y

6 v  D) N$ q1 y* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.8 e' B# g+ ?$ f+ P
___________________________________________________________________________
; \! `7 ^6 m4 K& D. W& d" }/ @+ U  t, y: U! [

/ ~. x( i6 K4 \. C' `Method 03; [$ R9 }* P, G  n6 T$ V* }" u
=========+ T0 X; w8 |9 q5 L

& T1 e0 I* G  \6 Z* j5 lLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
* \2 S2 o& i/ \: f3 D: @(API Get entry point)5 {! |  f& e' w
        
/ G- D, g9 b/ C: S/ s) ]2 k
5 ?: i6 w1 r. x    xor     di,di- ?: F6 a3 v; U* M! o
    mov     es,di
4 J2 T; f. H) a9 Z0 L    mov     ax, 1684h      
1 e2 B  O0 o1 f    mov     bx, 0202h       ; VxD ID of winice% o" b' F6 ~0 Z
    int     2Fh
# v  c" h0 H4 o% p4 k    mov     ax, es          ; ES:DI -&gt; VxD API entry point/ r: K/ Q6 {! c9 r
    add     ax, di
6 |& c+ p& b; O  w! x5 J    test    ax,ax  D$ ~# Y& k- h( @. E
    jnz     SoftICE_Detected
8 k) P8 }  a' Q' k: K4 }! z0 |  |; @# I8 N: ^
___________________________________________________________________________
6 k" ]+ [1 x4 v0 e' c( C: A
* U* b- F% a7 q5 m9 k% QMethod 04" r; k9 ~4 L7 S* ]6 [* G/ H& a
=========( {& m# V" \( d% x
: |! f; `. h( B0 A: _3 K) r) E
Method identical to the preceding one except that it seeks the ID of SoftICE
8 h2 N5 p0 F- A8 VGFX VxD.
* |7 v7 v, K9 O7 M: s) h% O) b
3 l. G# X$ z0 u2 S! k/ C    xor     di,di
: \7 u( P2 b) F0 C& S    mov     es,di
& @1 T" c+ ^, Z4 b& [) m+ }+ U& W    mov     ax, 1684h       " |5 M9 |& V9 Y! t
    mov     bx, 7a5Fh       ; VxD ID of SIWVID
/ f3 q. o, N! Q: G% s( `    int     2fh4 _$ c2 ?/ V& I4 m, o
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
) B3 Y0 u' m7 Z8 v    add     ax, di. f% o$ [1 @5 w( H/ E
    test    ax,ax
  b4 j8 C+ r( M. N& }    jnz     SoftICE_Detected6 |  T& q0 o5 X! z. O# D' g

& B# s( a8 I) s0 _) [+ K__________________________________________________________________________
3 E# I: j- J: p" x$ @  z2 r' c3 ~3 b. o. J6 _9 J: j: Z" M
! H1 b+ k8 }" F+ A
Method 054 W! ~8 Z+ h% g! _: |
=========$ A, L# G- @1 z9 }/ o$ H# Y

6 H! ]) w3 x3 w7 J0 n% i' e: ^Method seeking the 'magic number' 0F386h returned (in ax) by all system
9 ?7 [7 U) Q( z1 m* Bdebugger. It calls the int 41h, function 4Fh.$ f! T9 [$ ]6 |, a
There are several alternatives.  
5 ?' a: C; Q7 i2 t+ e
; x1 h# Q: }" @The following one is the simplest:
$ Y9 {7 k& y9 @3 ?" R$ }' c/ F
, B, a$ p4 q/ ]  K    mov     ax,4fh- _" _0 f' ?7 b# _1 |: {
    int     41h: T3 L% M( }3 h0 b/ q
    cmp     ax, 0F386
$ z7 }" O8 H7 Z* m; J    jz      SoftICE_detected
" u4 `3 ?% N: A# `- k/ F  \. F
% ]7 b( s* l" T+ Y
, p+ M: F9 o/ }0 q) Q9 \8 PNext method as well as the following one are 2 examples from Stone's ( Y; ?2 v# V2 V* A1 q/ D
"stn-wid.zip" (www.cracking.net):
1 W: k: b9 |7 v5 Y. L3 e
6 r7 D  k% G* C    mov     bx, cs
* R: p5 }- W, E' r( k; k    lea     dx, int41handler2; |5 ], y. c3 K) z6 v5 R
    xchg    dx, es:[41h*4]
$ `9 u  @/ z% T9 u% o% Q# n9 j( b2 L    xchg    bx, es:[41h*4+2]0 L; E  B  E  t1 f+ ^2 U% H; c: A8 {
    mov     ax,4fh
/ b; I  e% W1 i- F. B% }0 W; G0 ~2 J    int     41h7 T6 U, }7 \& q4 B5 o( R8 N$ m/ C
    xchg    dx, es:[41h*4]
# G) }  d* I$ v    xchg    bx, es:[41h*4+2]7 \  L+ u) d* s. V
    cmp     ax, 0f386h
) Q# A3 j+ l+ s! P  N: I4 D: g    jz      SoftICE_detected
, p2 s" ^* O; w. o% D  u9 f
# i# b! r7 f) L6 c# N( Vint41handler2 PROC
$ o5 i( T4 B4 R( s- h: B    iret
! U5 x6 j% z' p& Wint41handler2 ENDP1 b% u! b# @, w( x) K5 k7 Y4 l, m
1 Q& \6 l& J) k. ]" A0 ?
; h  R. ~# x0 r: k
_________________________________________________________________________* F# k! L  k- Y4 L& G8 w9 W9 i

. ^+ L2 Z) A) y: w) q1 H8 ^
9 i- H! H+ U- F5 B( N5 B- g" s# xMethod 06
( l# h. S  o+ n=========
  ?0 a# z* a( @3 O
: {% F& T" ]8 ?- P0 b  f( u6 ?, c, W; v# k- H2 {; g4 ?
2nd method similar to the preceding one but more difficult to detect:/ f; r$ N0 L* l) ~: E

" x: s- J# J' i% j! y
# _9 b( L) _$ D1 o$ [  ]$ f$ rint41handler PROC% ]6 k$ y  F( k1 Z! y
    mov     cl,al1 ?" ~$ ?" S3 q, H
    iret
* c3 w. a0 \* j" l0 G! e9 Sint41handler ENDP* B, w; }- a: U. c; p9 S5 c
" ~* o& Y$ l8 X
! Q! k' C" F1 k) o4 h3 P- _
    xor     ax,ax
" ^/ f4 i4 \( ^) M) y    mov     es,ax
7 z% @3 r" o9 @" ]    mov     bx, cs3 a! Y+ }+ J' K5 t
    lea     dx, int41handler2 B" S; X1 h  c0 J/ e/ @
    xchg    dx, es:[41h*4]2 ?5 V% v* _6 K: u' j# _& L: W
    xchg    bx, es:[41h*4+2]) s! Y7 R  K) W- o
    in      al, 40h
) p6 Q: p" W7 i2 t3 S5 Q5 f, M    xor     cx,cx7 U! i( z/ J0 ~5 k( w9 f+ o
    int     41h, a1 T' ^1 X% e+ Z$ Y1 S" c
    xchg    dx, es:[41h*4]
  u4 v5 N/ h' i    xchg    bx, es:[41h*4+2]
! i# B& |$ ^, `3 B    cmp     cl,al
# ]* b( j7 L6 X; j/ Q    jnz     SoftICE_detected
; I: `& L) m1 j& t2 r, \
8 x" J, z3 Z, M9 |( M# t0 M_________________________________________________________________________9 i6 k1 x+ ~& j* Z) g! z+ L$ Z

- L$ c" k) R& i; DMethod 07" G; v( F+ `- A/ R
=========
# @# p% |* i: Y! L7 I( L* M6 _& P9 k
Method of detection of the WinICE handler in the int68h (V86)
6 H. `  l! |- \2 y% H7 W. K9 q% _% c3 |* K' a3 n7 a6 a
    mov     ah,43h
. ^" a- T* J& ~! K# H: t7 f1 x* x    int     68h" g4 Q+ T" i: h4 Y
    cmp     ax,0F386h
# p4 S) w" E; {4 h    jz      SoftICE_Detected8 m" D% v% P' v
; J1 ]# f3 e4 E4 A7 X4 I

. h8 E" X0 U' y! |: A5 G+ |=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit) {5 Z4 s1 `9 |; q% {
   app like this:
6 y! ]5 L3 L" k6 ^5 L1 A* S; a, o/ ~0 T9 H
   BPX exec_int if ax==682 p  s1 E( G7 `9 b: C8 s2 K7 G
   (function called is located at byte ptr [ebp+1Dh] and client eip is/ A; a% {' }7 w3 ~) S" U. m
   located at [ebp+48h] for 32Bit apps)
4 c- c0 A, L/ c__________________________________________________________________________
# D8 w( H' S5 \" v6 g$ f" J# ^( [
) i2 Z  `  H9 G2 M/ I8 y! l8 I6 {0 p. @# n
Method 08
& o- E6 n# T: P=========" L7 J+ t' ?; z3 K# Z9 U

! R) H, y. J# cIt is not a method of detection of SoftICE but a possibility to crash the
, A6 y* r% X4 g5 h4 m; lsystem by intercepting int 01h and int 03h and redirecting them to another7 Y/ i4 c! c5 _- l
routine.7 {# t" t: S5 U! ]
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points: x& B0 r4 q; s; |3 |$ d7 C
to the new routine to execute (hangs computer...)
+ q1 Z+ E: t1 @7 f" R3 d
' x4 @! Q: R4 ~4 a    mov     ah, 25h
- y9 Z2 }& e) |/ S. R    mov     al, Int_Number (01h or 03h)" Z' c7 b1 @! \5 Z3 x4 n
    mov     dx, offset New_Int_Routine% H" {. a' `/ x' d. z4 e
    int     21h# F( ^/ B! _( V1 r5 ^: h6 a

0 q, t/ e) i8 ]: K( n8 N6 X__________________________________________________________________________# L* [  H, Y5 T8 B5 {6 U

2 x6 a5 h- z1 i0 u& R5 ^) Q* l( g; TMethod 09
8 q# }5 r  C% o( s% [. A/ x, d# C=========- q& {! h, r% r7 d" |8 c

  m% `* {# p& _2 Q; Z3 H& D- yThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only. j! S7 c7 ^/ m! f% D0 L
performed in ring0 (VxD or a ring3 app using the VxdCall).
7 K3 I# k8 m/ x# J6 Q- Y0 [/ @The Get_DDB service is used to determine whether or not a VxD is installed
1 x- `( W3 G( N. w1 r$ rfor the specified device and returns a Device Description Block (in ecx) for
1 v! ^3 J! u$ a. h% ~/ nthat device if it is installed.
$ J5 w4 I, \$ [* q7 S! m" [+ H# e7 |' V) B/ B6 b4 K
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
2 X3 a  M7 b2 `# `   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)6 z; }' G+ B( L3 q( ?: B
   VMMCall Get_DDB
9 n% Q8 f+ t5 Y( b: W   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed+ e9 @5 X7 [5 ]
! _: x) ~8 E! [
Note as well that you can easily detect this method with SoftICE:
; a- R) R1 p; j* _$ u   bpx Get_DDB if ax==0202 || ax==7a5fh# C" ^2 {- m- U. m  ~* H

; X6 T$ J' Z$ y! [__________________________________________________________________________
2 u6 [. D- y1 d5 L5 F
1 Z+ E/ d1 \/ r8 z! TMethod 10
! {& }! N+ d  q/ W3 [6 H. w=========! m3 N3 S  ]" Y3 J
: S" b  I0 a8 Z1 C3 C
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with0 y, j. W3 ^- n" Z$ \) w
  SoftICE while the option is enable!!
3 G, k* H( g0 Q/ o5 Y% b" g  K5 V! L7 G2 X
This trick is very efficient:
0 X) r/ K( V8 `by checking the Debug Registers, you can detect if SoftICE is loaded
% q& q% n+ k, O) K, _- [1 ?& H) z& U(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if. l) `, C3 K) g2 l6 z
there are some memory breakpoints set (dr0 to dr3) simply by reading their! l6 D+ b, c+ Z) F* W9 B$ H
value (in ring0 only). Values can be manipulated and or changed as well
" Y0 c# B( H. g0 V  w- m(clearing BPMs for instance)
; N3 h  E  F( b8 p1 K% e" e3 _
! `& w. X: _7 V% v5 a/ Q__________________________________________________________________________, y! G3 `, A0 F; Q9 x
# @9 k% k: F7 a! }& U+ s7 F
Method 116 [' L9 M/ c3 Q6 Z* N3 A
=========
8 Y/ P& Q/ r' v. k
3 Z  a% Y4 }; E2 Q0 K2 p/ AThis method is most known as 'MeltICE' because it has been freely distributed
# }" L. o% W) R5 P+ N* x4 |3 \via www.winfiles.com. However it was first used by NuMega people to allow5 b6 Z* H- q/ P, x) ]
Symbol Loader to check if SoftICE was active or not (the code is located
. Z0 n8 ~- Q9 B5 B1 r+ A4 oinside nmtrans.dll).6 S" q6 t& {# B) Y" R/ O8 V( |; \

0 Y" c  B# p- ?. y6 i$ xThe way it works is very simple:3 V+ d+ N( Y' P$ d- G0 J
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
$ J$ N3 |7 d9 Z+ B$ C7 j( gWinNT) with the CreateFileA API./ k/ i6 V5 p% C  n  J  {

  ~7 A3 n& B2 M2 `) G* }" K) BHere is a sample (checking for 'SICE'):0 H$ i$ m! E9 z2 H4 T/ g

( R$ D3 o+ P, l$ p+ t9 MBOOL IsSoftIce95Loaded()
6 B+ c3 I, Y9 l, K2 G{+ u# g( d3 G7 ~& z
   HANDLE hFile;  & k9 j/ n/ x4 C
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,. [8 x( b& m+ y4 m
                      FILE_SHARE_READ | FILE_SHARE_WRITE,/ \. n% u* j! t0 g5 b
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);. H  G* l* }/ [5 Z5 p
   if( hFile != INVALID_HANDLE_VALUE ); ^: [; T# O; b: Q2 a
   {
+ @" v+ e3 f' `# O$ O8 [" l# W      CloseHandle(hFile);
" v0 b, H* }3 o/ t/ s0 G      return TRUE;
, }. [7 q8 V9 T6 q, ]! H9 b   }% M2 K; T% ^$ Z% R* {- }6 [
   return FALSE;" ]4 T2 _+ Y  m7 n
}4 `. g* ?5 @% i" u; K
: h% H8 c) b9 e- b0 L
Although this trick calls the CreateFileA function, don't even expect to be9 i0 H- E( w5 M, H9 N$ {* i
able to intercept it by installing a IFS hook: it will not work, no way!
5 z& `3 Z) o: ]: ]& I7 }" [In fact, after the call to CreateFileA it will get through VWIN32 0x001F
& l" d2 Z! a) L# b, kservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
) b) E5 [  o2 ]  D5 ^and then browse the DDB list until it find the VxD and its DDB_Control_Proc$ E8 [- A+ ~  m: W
field.0 t: X, ^4 Y; Z) Q4 x- p
In fact, its purpose is not to load/unload VxDs but only to send a 3 p4 A; ^- R) v' e
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
6 H* e' s0 z8 x$ N1 l) z0 f/ ito the VxD Control_Dispatch proc (how the hell a shareware soft could try
4 S2 R( W+ o/ m% t" j4 _  Dto load/unload a non-dynamically loadable driver such as SoftICE ;-).% d+ \3 }4 `2 a6 P- a7 S6 i
If the VxD is loaded, it will always clear eax and the Carry flag to allow
, Z4 y& H* g3 |6 Y; k' x4 m% Hits handle to be opened and then, will be detected.6 k7 p; I: A3 M5 z+ D# P% w
You can check that simply by hooking Winice.exe control proc entry point. e; H7 o, `' \
while running MeltICE.
7 J  t5 D( E. i
; r6 }" Q. }2 I" Z* C4 q/ Y" X& P, _9 ^9 L$ `0 U  \  e  c% T
  00401067:  push      00402025    ; \\.\SICE1 C5 q8 F: M1 _' h5 b2 K
  0040106C:  call      CreateFileA9 @4 g0 e* s* u% U3 J' T" |; ?8 n1 A8 o
  00401071:  cmp       eax,-001
5 i: v$ W: s& x/ l  00401074:  je        00401091
( [, @: I$ v3 B; o, G. O& K+ L6 f# q* i( P

0 O+ z* f6 W: V+ w& jThere could be hundreds of BPX you could use to detect this trick.
& \) W9 b7 D+ |; X0 K  \- ^+ g0 U-The most classical one is:
3 _. h/ |9 a+ F. k  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||5 a+ T: `& O. e' W6 c; V
    *(esp-&gt;4+4)=='NTIC'
! Z- f0 T' l& O2 H* ^
1 I7 x" ^* P: ]: E( k" G( \-The most exotic ones (could be very slooooow :-(, F: ?& ~- Z7 b: z" N* k
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  ( V0 @2 j) Y8 m7 S9 ^- V
     ;will break 3 times :-(
5 W/ l' W: f- H4 c& ?
- B" ~- T, L8 _0 Q9 c-or (a bit) faster: 7 U# F& b7 Y7 k  ?6 k: |: e, y$ Q
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
+ K& E! @9 F* I! D; g2 W5 |/ n: f
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  ( P3 j, k$ N9 B8 I, r
     ;will break 3 times :-(
/ B3 ?; f3 C: A3 k0 A# _% c2 [2 o. d" s* C0 p# C" Z+ Q
-Much faster:
/ o9 Y( |% G+ Y) F   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
6 V, r0 ]' H. |3 g. Z
/ V$ y- L! o: ]3 t" j* Q+ uNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
3 w3 J) S0 o" n5 }/ Ffunction to do the same job:# y( P, g( {+ |4 z
1 p& f4 K3 Y5 W6 i5 \- j
   push    00                        ; OF_READ  N5 q( A' v1 V, N* Z! m
   mov     eax,[00656634]            ; '\\.\SICE',0
7 A$ N5 C" Q( G   push    eax7 G  b$ l, {0 Q2 c5 Z6 [
   call    KERNEL32!_lopen  D+ i8 s: N" J. ~
   inc     eax$ _. }5 ^3 n( O' O6 ?5 I
   jnz     00650589                  ; detected
* W9 k9 D: Q0 T4 l, w   push    00                        ; OF_READ3 b" @9 U% f% S
   mov     eax,[00656638]            ; '\\.\SICE'# k( T2 P7 R7 A" {' [" |# l4 q( w( R
   push    eax
9 X% H- Q9 z$ K   call    KERNEL32!_lopen
( W& O$ ~( X" m" h; N" @: B   inc     eax- r+ t7 x* Q) c) S& f3 d9 h. x
   jz      006505ae                  ; not detected/ R% o! `9 e8 O5 d, e$ u7 q1 S
( [+ ^* o' F  }9 Q

) l# O# I! Y  s" V2 |__________________________________________________________________________
, M3 {9 D) c: D  d3 S! c5 f) ]& S* V" _8 D5 I
Method 12
- {. \0 L' Y" `" T- u1 m' h" y4 `=========
4 u7 r7 Q  T. r. r4 W9 e- W
8 E1 ?- l3 m* @# \5 c/ [4 NThis trick is similar to int41h/4fh Debugger installation check (code 05
$ U$ D+ u9 P3 u; l! R0 P- q; s( m  [3 z&amp; 06) but very limited because it's only available for Win95/98 (not NT). P$ x2 H% U3 G" i/ H
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
* V& j7 V5 ^6 C* E% a! n3 U+ W! S( \' y. M. ^% x. T8 M5 t/ I
   push  0000004fh         ; function 4fh
7 s! U9 Q/ e( Y3 X: G   push  002a002ah         ; high word specifies which VxD (VWIN32)
9 v% B' a( g* G9 e; t/ F$ x! e2 C                           ; low word specifies which service; `, v" y$ z- B. h8 ~
                             (VWIN32_Int41Dispatch)0 g' ]3 Z0 y; {& \) W4 t6 \  k
   call  Kernel32!ORD_001  ; VxdCall
* R6 M, J& D7 H2 u+ f) V   cmp   ax, 0f386h        ; magic number returned by system debuggers6 ], j/ K4 ?7 g& ?8 k
   jz    SoftICE_detected
) T0 y6 F8 V; E+ p
# u1 L4 D* N/ K& g3 u) @) _Here again, several ways to detect it:# K# \, `+ O% s* w& |

/ {3 o& a2 [/ F* b' e4 _    BPINT 41 if ax==4f9 M8 @! }" ~3 R- d& |
9 a9 A2 q' T) T8 p
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
8 @9 Q5 Z8 Q, W7 X& e4 w5 v8 v6 a# ]6 M0 K" ^
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
$ `, Q: q: l; k  P! ]2 n
4 V& Z: G3 G9 E7 |/ w3 |! }- B) [: n4 k    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
) x. S) W( p1 o
# G7 |! O, [# |, Q5 E, H6 _8 _' [__________________________________________________________________________
  a2 s3 y2 D: ~. x! ?7 D/ p3 y8 [1 C. q, `
Method 13! u- V* g5 j7 \8 q/ s4 P
=========, b, ~) M& Y: J2 O% t& s
1 u; l  R+ I$ j3 }2 Z9 E
Not a real method of detection, but a good way to know if SoftICE is* ]( y" A1 f) }. `$ `
installed on a computer and to locate its installation directory.% e- X2 Y/ W# e6 u% Q
It is used by few softs which access the following registry keys (usually #2) :
; z: ?; @  ]6 L  N' ~* {3 p/ b
( d! Z! p( j3 @  v" j8 I$ |) c-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion  _" S- ]0 @+ W+ q
\Uninstall\SoftICE
1 Q1 ~& e0 q' e! F-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE( I$ L( `) h- H  e
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
6 o2 L# C. Q1 p2 J\App Paths\Loader32.Exe6 F0 H0 k2 c- F! m! S7 m9 J( S
$ ^9 p. }, ?4 \! o& @
/ h6 r! _6 }& d+ T/ p& S* v
Note that some nasty apps could then erase all files from SoftICE directory
0 M- I3 M7 Q- Y+ @0 b& |) r(I faced that once :-(
) ~9 J" c1 a6 b
% F9 C* ]7 {) r8 q1 S1 _- RUseful breakpoint to detect it:
; @0 D) `, U. @" ?0 C& M$ U& N# a7 h4 m8 P( \/ m
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'9 v2 u/ P6 @$ {2 T" p' E7 b

3 r4 F7 B& O1 t" w  l__________________________________________________________________________2 L1 H( m  g6 _

4 G# C+ A, w* D6 {3 R; {9 B! R8 Q) @3 u
Method 14 , l/ P- q# @$ A- S
=========
( O9 ]/ T5 A6 ~% n7 t' i5 d) _: z9 I6 ?3 r6 w
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
$ q3 P( k/ e, ?3 H3 r) _6 K4 [is to determines whether a debugger is running on your system (ring0 only).
: I8 c. V, l$ A/ E8 S) J2 u9 D6 ^# [' R% y% P6 O6 v3 [
   VMMCall Test_Debug_Installed
6 x2 c7 [3 i2 g; L1 m/ h' u   je      not_installed
- W9 Y* v) U1 g" V
7 O1 l. l) m/ l- D8 \8 _4 {9 \. Z% yThis service just checks a flag.
* j) {( b3 \5 W  S6 R. \</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-8-18 15:06

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表