找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>; Q7 C  ~. F2 ^) U
<TBODY>
% }% U; M/ _" ^/ M/ j/ h* J<TR>
6 d- T. k' X, H% A; v<TD><PRE>Method 01
0 ]: {9 g% D  n5 K=========
; o" _% Q. v, K8 W6 @5 n; g* i: g9 v8 x; T
This method of detection of SoftICE (as well as the following one) is
. _4 Z% Y/ {- z2 a* [  P, F  v! fused by the majority of packers/encryptors found on Internet.7 S) j6 K9 Y. [
It seeks the signature of BoundsChecker in SoftICE/ `: Y9 f8 `1 P# T+ W" f4 G

1 {( k' K, I$ I# Y    mov     ebp, 04243484Bh        ; 'BCHK': L- |/ ?* X; O, a, @. J" V
    mov     ax, 04h/ E5 d1 l" Y$ C/ N
    int     3      
7 f8 ~  @+ P$ u7 e$ `    cmp     al,4
$ K" a* u. q1 B9 n  o& y    jnz     SoftICE_Detected
8 B/ ^2 M1 D, H! Y( K
+ y5 u) q9 G8 S  w% |___________________________________________________________________________
* d' }# f' }4 i5 X
0 b" [. b1 r" n/ K7 V! y0 {) E" mMethod 026 H# }# v6 S9 R+ x/ x/ s5 t% i) L1 i
=========8 B1 O5 \% ~; }4 i8 \/ I: z
1 f3 r0 U8 n  s2 O& Z
Still a method very much used (perhaps the most frequent one).  It is used2 C/ L" v- z. x; p
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
* m/ t, i1 B6 _% {3 Y  Sor execute SoftICE commands...8 u  T' |& B0 H. K
It is also used to crash SoftICE and to force it to execute any commands
- y; P7 b3 C; B# W) ^1 Q7 x& V& ](HBOOT...) :-((  
" c0 A. w0 O) V( v+ S9 T/ @' B% N( Z. @2 t! h
Here is a quick description:9 V& v9 T/ F# `5 \+ f3 s
-AX = 0910h   (Display string in SIce windows)
% a: O- a9 @: T: r-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
# \4 N4 C/ l# j3 G- U& l-AX = 0912h   (Get breakpoint infos)
  k2 r! V& Q7 \1 ?' K7 ?-AX = 0913h   (Set Sice breakpoints)# A  t( c0 D; \9 }0 Y' f3 f  j
-AX = 0914h   (Remove SIce breakoints)
# s6 I9 z* C( B0 x
$ i2 w/ f0 ^4 b8 Q2 jEach time you'll meet this trick, you'll see:
0 z& n$ a' ~% j7 P* `-SI = 4647h
, X" @/ W2 |5 n-DI = 4A4Dh
# i8 Q) b; v" @* `  e7 pWhich are the 'magic values' used by SoftIce.
/ O8 }  C, A) e9 Q$ FFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
$ ^" H7 P" q1 X: t; ~/ A& K* c0 |# Q2 Z& T2 {- y8 j0 y6 p; J* q# |
Here is one example from the file "Haspinst.exe" which is the dongle HASP$ h2 m9 c0 q  }' H  w& {! c8 ?
Envelope utility use to protect DOS applications:
. ^/ z5 {4 J; M( m' E
7 ^/ f$ d9 S% {8 ~  S/ x1 E( h$ d2 Q6 Q. i+ E' `4 J3 s
4C19:0095   MOV    AX,0911  ; execute command.
9 ?( N2 q+ t; @. m4 s4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).: {! j0 k3 a3 G8 l
4C19:009A   MOV    SI,4647  ; 1st magic value.3 `* m- J+ a& ]; }: M9 p% a1 a
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
6 `, N+ j* p5 {1 q+ e4 y5 K! d4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)9 x% v1 t% V. e7 `4 L' N
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
) N4 s* y  i6 ^/ r( f. t$ w: s# p4C19:00A4   INC    CX) m9 C" l) u/ ^- Y8 f
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
2 n& l7 H! L! E$ \- y$ w  Q) D4C19:00A8   JB     0095     ; 6 different commands.
8 z7 ]6 ?0 t7 P9 I3 h+ v3 I4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
) }6 F# F: |* Z7 R4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
6 g) c8 e8 z2 h, p6 }$ l& G4 Y! n' J1 X8 J- G
The program will execute 6 different SIce commands located at ds:dx, which
4 H) G9 e7 R( i2 d% Y8 C) g( i- kare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.2 e" m  R" E! V) K' z
, z1 X3 m& J; s7 W
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.+ g- u2 \0 U0 c- w, p
___________________________________________________________________________
( h& G4 |+ B% q! o  X. C) \  l; ^2 N3 U# |. x9 H- T1 x

0 Y; `6 T5 \. }6 x) i% ~& TMethod 03
, V, W+ _+ P* I' C* i( m" y, N=========
/ b" j1 @3 Y4 M8 L8 ^" S$ U
+ F" x, _! N9 _/ u, ^Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h- O# b$ p; m8 f
(API Get entry point)
6 N) j! e# e  d( J0 `        
& t5 d9 _/ Q# l* ]. F# D" V. _, I& m8 ?: U4 o, G  {
    xor     di,di$ u) _9 \) K. \; i; B: U9 ~3 B
    mov     es,di
! u; s( W7 F2 S8 M! u5 c5 R    mov     ax, 1684h      
- y4 ]* |" t$ `. a    mov     bx, 0202h       ; VxD ID of winice
5 k$ ]/ I4 L+ d* P! u! P    int     2Fh
  I5 t; N& M# f, Q, R% ~    mov     ax, es          ; ES:DI -&gt; VxD API entry point% ^* B! o' V2 R! j
    add     ax, di0 H5 b  M: I, H. x5 O
    test    ax,ax0 P. o* B% v4 ~' R( p
    jnz     SoftICE_Detected
" b( i6 ~7 k! m+ R$ S0 ]2 F$ P0 q: q0 w( p
___________________________________________________________________________7 n0 u: p: {8 |* j

( ^9 T/ m  h7 n. S# sMethod 04
4 N7 \6 O: @' |  k# m8 w=========5 L+ {$ \2 @) U+ r* Y

: u2 S  }8 u8 d1 Z" x5 y+ g. ^Method identical to the preceding one except that it seeks the ID of SoftICE/ j* t% Y- f. L9 C# `* k- _
GFX VxD.
: k: j; h5 V9 ^. |! p! l: [5 S! X4 ^
    xor     di,di
1 q7 `) I+ l0 t( K9 m# ~9 Y3 F2 M    mov     es,di
! b& s0 T. {0 c6 f9 F5 ~( U    mov     ax, 1684h       & Q% V( s+ E7 b9 I9 k2 _
    mov     bx, 7a5Fh       ; VxD ID of SIWVID
$ \* z( Y1 U$ w( b    int     2fh
1 p* {2 e& s, U! [  z    mov     ax, es          ; ES:DI -&gt; VxD API entry point& `* y$ K% A0 N* d  ]
    add     ax, di* t% ~1 P7 H* W8 R$ v3 n* K
    test    ax,ax( w2 B3 w. X9 C" t/ w9 Q
    jnz     SoftICE_Detected
  h/ [( G. X3 b, E! n
) k( k! ^2 w& e" Y& T__________________________________________________________________________! h4 K3 H: ^( t5 t2 s

) Y0 E3 }( O1 x
; `9 o; D0 }: l) pMethod 05
8 f9 Y; l  o9 ]# U5 `=========$ o& E0 L9 a1 T( S

3 c3 B& J% ~* I2 _. t' KMethod seeking the 'magic number' 0F386h returned (in ax) by all system
% P" _: j  n1 X  Y6 n: l, |debugger. It calls the int 41h, function 4Fh.
' X$ ?- k3 I$ ]6 O( KThere are several alternatives.  " R; L. L" x8 ?. j
* v$ |0 d) ?. N+ p3 q% Y9 L* x( p
The following one is the simplest:6 K- ]% e1 H3 ~) Q4 \; c

! h3 ~/ M0 s* D1 S" ~! Y9 t- ?    mov     ax,4fh6 }+ C1 [% I# I5 @; L9 V) [
    int     41h1 f7 ~  n; t/ h$ e9 t  a6 F
    cmp     ax, 0F386
% i8 n& ^4 Q% J7 _. d$ ]1 Y    jz      SoftICE_detected8 s: V5 P+ w: F$ f
2 N% @- W# D8 e8 C1 z0 q$ D5 W( w$ [: K

8 D2 p* @' Q" }- i( U' d3 jNext method as well as the following one are 2 examples from Stone's
% T# @6 u/ s2 E. `"stn-wid.zip" (www.cracking.net):: F2 h7 O% ]+ A" `9 m, @$ u0 v
% b7 V0 [# T, X* e: [
    mov     bx, cs" `' s' m: B. m+ E( F+ }5 l  r
    lea     dx, int41handler2# K. F( G3 G: K* X
    xchg    dx, es:[41h*4]
! N! t0 T6 I/ L& L    xchg    bx, es:[41h*4+2]: n% u! }  c. a$ E( Q  s
    mov     ax,4fh
$ H; w! [+ s( C% R    int     41h/ A' w9 X; G8 q! r$ n# Y9 y" ]
    xchg    dx, es:[41h*4]( G4 p  x2 V0 Y) R; ^
    xchg    bx, es:[41h*4+2]; I) e* ]$ \8 \" O
    cmp     ax, 0f386h
; ~3 [3 O2 E6 Y4 G    jz      SoftICE_detected2 R" z* b" R6 n' E# k. r- L
$ q6 e- S1 R% h6 l$ B8 a) P% t! |
int41handler2 PROC
* O% H- l+ Z& S" E    iret
* r( R4 c+ x  @' n% V7 G9 Cint41handler2 ENDP7 y( U/ c6 s+ _  h2 V6 Q" m

& Q/ V' q' M) H9 z* z$ `/ q0 H/ Q
_________________________________________________________________________
' r, J& w8 \- h) P5 i. d, _% G0 m+ }, U' l

2 m( ?1 I# G& q: g- m6 OMethod 064 W* [! o3 z! v$ |( j* M( E8 k
=========1 ]4 V2 l  r" E' ^4 L( p; d% C, P
/ p2 ?8 q: t" k! J3 l
, a5 B4 S4 P0 _# X1 Y: {
2nd method similar to the preceding one but more difficult to detect:
; u/ H' c4 l8 [$ L& o; `& h. o. H; y- N, s

, \5 G: z- \1 o: R2 H7 K' Uint41handler PROC/ v% B3 ]3 t" {3 p
    mov     cl,al" k/ E$ I2 @: t# y# P
    iret8 ?& |' F* b+ h5 _+ v
int41handler ENDP
+ k# \6 n* F# Z! E' @% @8 E) k' \$ J. Z  F9 t- i" L* O( b* X
* }5 F! w2 G+ t2 }3 x$ N
    xor     ax,ax; f9 Z, {$ }' e: Z  p) B
    mov     es,ax6 _7 v, y; ^/ @+ y* |: D
    mov     bx, cs
+ r4 N- F4 E2 X6 D6 L5 l& H    lea     dx, int41handler
- P0 x  U9 Z, i- v  R# ?    xchg    dx, es:[41h*4]
6 @0 l$ W0 Q- X4 W* W  ~5 {    xchg    bx, es:[41h*4+2]
  Z: d+ O5 u0 o& h( s- D    in      al, 40h
' N0 q! G; i  G- e* x4 M  w  Z    xor     cx,cx4 E* M1 K; G1 k# S8 B
    int     41h
2 J) G/ i) h8 g( B/ c# l; L6 J    xchg    dx, es:[41h*4]4 T3 U# D" ?, C1 |
    xchg    bx, es:[41h*4+2]
% P& O; M7 `* R% J0 C    cmp     cl,al$ j; j, ~7 ?" W8 m
    jnz     SoftICE_detected+ L- s% N3 D. M  t0 N3 H' M* o
8 O. d. B/ a4 h- V. i( K+ j
_________________________________________________________________________% i4 H+ h* r0 k) z! O; G5 q0 D

5 r9 E. h# C  I9 y, ~3 K5 mMethod 07# v1 r' Z" J2 C2 C5 C
=========
- K: V' U# C, ]. o
$ B8 ~  {9 t1 L% l) v; s* ?7 JMethod of detection of the WinICE handler in the int68h (V86)  S- a) e1 Z: w' x

* I$ ]7 Y( U7 E. c" Z    mov     ah,43h2 u& n% e& a/ k# k
    int     68h9 O/ Z% q+ C- Z( p/ h
    cmp     ax,0F386h
/ B# \% o& ^0 F# t    jz      SoftICE_Detected5 K: x5 k. s7 _* K

3 {2 G6 a% \! H9 b
: X7 ~9 c7 L7 S1 V; S=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
( i$ d, x& d$ `' T   app like this:- ?# ^" Q. O0 ~' n9 I- @: L4 u6 m6 V
/ y% j  B. m* C4 I4 U
   BPX exec_int if ax==68
' |: T9 y1 y& J0 k6 l% ^3 T; a   (function called is located at byte ptr [ebp+1Dh] and client eip is
* s. X# _3 ?1 g* w$ S' q" t4 X& |- ^   located at [ebp+48h] for 32Bit apps)
  t7 ?  O# j: w/ ___________________________________________________________________________* ^! |: L8 N& c
  R) \  H: I4 Z! ?8 K

2 h5 v; R1 A8 G, v4 K# v6 NMethod 08; ]" l  Q6 [& a% t, \% K1 i
=========" u1 @/ G3 f6 Y1 u+ x% g

# G: O9 |7 u' Q5 c4 A% KIt is not a method of detection of SoftICE but a possibility to crash the. j5 Z! V6 k8 r* g, T- T7 j
system by intercepting int 01h and int 03h and redirecting them to another! w1 o/ b+ W) v
routine., E1 T# H* A, N  l6 h% d& i: ?; g
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points# s- B! X: ?( A9 d9 ]9 O& _1 i
to the new routine to execute (hangs computer...)1 I% h5 _8 f! e& T: F% t

; q& o7 u2 K: _' H! A    mov     ah, 25h
! p0 b& c9 S& d; I    mov     al, Int_Number (01h or 03h)7 a- o/ K. s4 e2 X% E+ J6 a
    mov     dx, offset New_Int_Routine  ?0 u% u# |7 f3 o5 x
    int     21h. t0 x1 Z- F( {7 H& A
6 h( S  a1 Z7 p- G4 W0 x; i" V& W
__________________________________________________________________________
* f  B# W- e5 B$ Z$ c' d. t* Y8 [8 Z
Method 09
! f1 q% m& f7 ?0 Y# r( |=========
  t8 b* i' E- g) R# W6 z- d& M1 B' j1 P5 E( u6 |
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
1 G$ @, v( m) E  K! |3 v2 @% E% W) Nperformed in ring0 (VxD or a ring3 app using the VxdCall).# J3 J" m/ s  o- z4 ?4 V
The Get_DDB service is used to determine whether or not a VxD is installed
+ V, \9 I. G4 r) vfor the specified device and returns a Device Description Block (in ecx) for' G+ R8 ?2 O, u: ~1 ]& z
that device if it is installed.
& b6 Q3 f% O3 `& R- A1 n9 g  W
  {" O' ]/ ^6 b, M5 i+ l4 O   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
# b1 P$ c  T* Z  w   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
; e2 K* m  x+ f   VMMCall Get_DDB
8 P5 g/ g! }6 y! A' F! i1 A8 m- {   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
+ e* ~( ]8 ^2 C' P+ y5 `6 T
0 {% ]. ^! S1 v- `. A! j/ ~Note as well that you can easily detect this method with SoftICE:
7 X/ G0 l/ H( y" q8 e) g   bpx Get_DDB if ax==0202 || ax==7a5fh" m# |) i, ~8 C* n' Y, x% r6 a
1 w+ ^  W3 Q2 X( b, k. D
__________________________________________________________________________- m# I/ i0 M( e6 Y' O+ ~8 l

! T1 o* b1 Y" v4 a1 P8 W$ yMethod 10
7 V) Z/ H8 Y0 V6 _$ q' W=========
& \% ?9 n7 ~# e5 w
% d7 M: R+ i5 y3 C+ Y=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
1 {/ l- G" \3 M  SoftICE while the option is enable!!3 l6 y; w% T3 r5 T
  z# ]( u! Y% y$ @
This trick is very efficient:
' j( M+ j: P4 n2 t) @by checking the Debug Registers, you can detect if SoftICE is loaded
) Y0 K6 S0 [+ r, |3 k$ X4 ]* K(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
/ Q7 _. X# Z4 H7 d9 T' A. ^* Ythere are some memory breakpoints set (dr0 to dr3) simply by reading their1 g. S& n* l: q+ v7 U2 l
value (in ring0 only). Values can be manipulated and or changed as well  P8 [% F5 E' ?8 r
(clearing BPMs for instance); W' }7 x! `* l6 |) U3 j. L
+ P; G5 G) N0 `- q
__________________________________________________________________________
. V: b1 H  @- U
* R% |, g- N; I6 w+ I2 i/ b; cMethod 11
5 R% |6 }/ G9 i=========4 J4 p! @8 b( C, n; B
$ ]: Z+ [+ I3 {7 S6 ?
This method is most known as 'MeltICE' because it has been freely distributed
, q7 x7 M, d4 M9 I! v- dvia www.winfiles.com. However it was first used by NuMega people to allow' H& L6 U. t# l" W
Symbol Loader to check if SoftICE was active or not (the code is located8 `# U1 }2 c& D# V( B* q! |
inside nmtrans.dll).
* s, I% ^( r7 v+ @: j) ]6 e  ]4 ?/ o5 R6 }
The way it works is very simple:
8 @9 s# Q4 X1 D" E! `1 x7 wIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for& m: m" w; c9 K2 m  i, J, v8 z4 a
WinNT) with the CreateFileA API.
+ i: A! @1 Y( D' R9 P% [
( z7 K  ~( h$ r  u9 D- l4 `Here is a sample (checking for 'SICE'):
5 j: p7 o1 ], V9 _# N# D
* v  g2 d, Z8 C: t! j1 uBOOL IsSoftIce95Loaded()
% U! @# l$ w; ~{: P0 ~* M# f+ i; y+ G1 w& h
   HANDLE hFile;  
, a9 y( D, T4 q! N8 g4 H' W( d   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,4 b1 f$ ]- ~# t+ G8 M; O( g1 G2 \
                      FILE_SHARE_READ | FILE_SHARE_WRITE,6 @* N( E6 t$ c" f
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);1 B7 \" U) q# ~
   if( hFile != INVALID_HANDLE_VALUE )
( W  L* b4 ^- N0 U   {* K# M: _4 l" O7 \
      CloseHandle(hFile);
( Z( C. w/ S+ U' d& {- d9 X8 `      return TRUE;6 P1 t, B$ N' \9 t
   }
8 Z" V# Y, n3 @- @5 ?7 d   return FALSE;
3 L7 @, G8 H7 A3 z}
3 ]6 v6 C/ n4 O9 S) b, d% ~- N+ V
# a  p' W4 F) S3 Y* \7 z& P) E7 zAlthough this trick calls the CreateFileA function, don't even expect to be6 I) l# M+ R& x, k) x
able to intercept it by installing a IFS hook: it will not work, no way!
/ k1 j7 [) U: d# r( pIn fact, after the call to CreateFileA it will get through VWIN32 0x001F" n& D' R( Z% e0 J) _- p. h
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)% b9 q! s, M$ a, S
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
6 x% r$ t3 t7 P7 |$ N: f0 mfield.
& k# |3 \9 ~* L$ N* \4 c- bIn fact, its purpose is not to load/unload VxDs but only to send a
/ @& [# b1 m2 lW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)9 L( T! V4 M) T+ H
to the VxD Control_Dispatch proc (how the hell a shareware soft could try0 B0 u1 w. d# B- C4 @1 C
to load/unload a non-dynamically loadable driver such as SoftICE ;-).  w5 Y. Z1 r) g/ l: g9 [- W
If the VxD is loaded, it will always clear eax and the Carry flag to allow
# d4 l' N8 N6 [5 Oits handle to be opened and then, will be detected.
& ~6 w1 A3 ^3 a3 o' `  t! p+ V' O5 d" dYou can check that simply by hooking Winice.exe control proc entry point: E' k0 }% f$ m
while running MeltICE.3 c. n1 v" P2 _8 r
; R- U6 c1 w: m* e
0 Q9 X5 r$ m$ _' Z4 [: @+ U
  00401067:  push      00402025    ; \\.\SICE
- z+ C) `. P. l) K4 z  0040106C:  call      CreateFileA6 j, n1 w# B( A$ P6 o$ U/ q
  00401071:  cmp       eax,-001$ v0 H: ]3 M. e% L
  00401074:  je        00401091
% R' J3 b) T& K: W$ x4 ]( h* J4 m
2 ?7 m. o- y) K- X
$ F- i; _# o# |1 Y$ f, k% O4 d# _There could be hundreds of BPX you could use to detect this trick.
1 N5 l# i8 ^) I7 s6 Z7 F-The most classical one is:
7 G( v% W' C" J# n$ b( M  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||9 o1 i  i; R- u8 `% K4 L
    *(esp-&gt;4+4)=='NTIC'4 D3 n4 [" P" X% B! M

9 m( ~6 K3 t8 w, B5 [. p5 L-The most exotic ones (could be very slooooow :-(
! p7 q% E# B- B- \   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
7 g1 _% X+ V6 ?8 W; U     ;will break 3 times :-(
/ G. ~$ P( z& S  y( m' u, m% N7 \- x" B( {
-or (a bit) faster:
0 k, w& ]2 k/ a; p: _$ C3 t   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
, P) N: x- k* f; r% F* j* P4 v9 z1 j
! C) Y1 }# D5 w% T" n0 l8 C   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  2 T, v' t! h6 s7 x. _7 c
     ;will break 3 times :-(3 B8 N, |' A" E/ K9 C
" R' g' B, Z0 p9 j
-Much faster:
" J2 X5 V$ s! T; @! r' Z  X, ?7 Z   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
& K8 y3 y. m/ N+ @8 x0 U: {" u9 \3 Y+ v$ b; y
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen/ R" }/ K, y' E* e' z* N- ~* r
function to do the same job:
, Y1 k& k5 R( y* b2 d: \$ D% |
6 d/ |7 F( b8 M( O   push    00                        ; OF_READ
9 h( I+ ~6 L8 W/ V# X- D5 b5 v) O9 s8 Q   mov     eax,[00656634]            ; '\\.\SICE',0
' l' Y1 V" n/ x7 B. @   push    eax
( b: W; h5 H/ ?4 j   call    KERNEL32!_lopen
8 R+ k7 G0 o. C6 n5 i5 @5 g   inc     eax2 a2 W+ {1 Q9 l" m' J
   jnz     00650589                  ; detected
6 R# v+ f- Y" _5 p) Y& v   push    00                        ; OF_READ
3 ~% s# c( E/ o0 i4 j   mov     eax,[00656638]            ; '\\.\SICE'! M% P7 n/ o7 q2 s/ j- p% U! V) o6 x
   push    eax
/ N4 K' @8 j0 n* d/ }   call    KERNEL32!_lopen
; W6 @5 Q6 Z1 z' @& _' N( C% ]   inc     eax6 w4 T1 M% D1 I* F
   jz      006505ae                  ; not detected& G8 D; p) |, S* r, C- j

: `, N! }0 o1 I% E. G5 |5 G
/ `; _* ~$ U+ W% C5 Y__________________________________________________________________________: R2 @: W6 c/ C. ~* c8 ?
) U' p) K8 E) c" ^
Method 12
1 z  \7 j, W* q, g" _1 r=========
$ F7 K+ ^  Z: j
5 P1 Z* V& e" v: o6 e! tThis trick is similar to int41h/4fh Debugger installation check (code 05
3 \0 d; ^) R$ [6 m" [&amp; 06) but very limited because it's only available for Win95/98 (not NT)# Z. x4 _/ Z& ~, L
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.$ N1 e- r. c- N0 ?; N6 E
& y% e. h3 b" c& c/ p6 w: @
   push  0000004fh         ; function 4fh7 E3 R- ?4 X( p
   push  002a002ah         ; high word specifies which VxD (VWIN32)
3 ]+ Q% `" Y0 C. P. f5 W3 I                           ; low word specifies which service/ Q& `0 s3 q, C3 w3 `6 h
                             (VWIN32_Int41Dispatch)9 S3 r3 ^+ U- T! f6 Z0 `
   call  Kernel32!ORD_001  ; VxdCall
. l: P5 r2 `: J* r   cmp   ax, 0f386h        ; magic number returned by system debuggers
! P" ^) C: i* x8 b* |   jz    SoftICE_detected
2 t; G! Z4 R( _# `3 n$ c
1 `9 V. ]. j$ A% V5 \5 n& V4 u  ~9 UHere again, several ways to detect it:
# j3 ^, d6 P9 m  g, ^
5 q4 C' n& C! _    BPINT 41 if ax==4f# ~' x( L6 ~, n  J3 C& r! I
0 O0 i% y9 D. S0 T9 v5 f
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
0 K% G) s# j* W2 b6 n2 b7 w) ]+ q& |( e9 f
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A1 v" u/ P  k* d4 e

4 M) U4 ~( {, R1 E4 Y    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
5 }6 h4 Y' t& L% H# u% @7 M- A+ r; l0 _, r
__________________________________________________________________________+ ]* N+ ^8 U% w
3 o; O) b) o: m9 \
Method 13* `: }: d' S: z5 ~, u) X
=========5 @* L7 G" s/ f' r3 \6 v7 C# E$ Y

$ n$ m5 U" F- M$ u- jNot a real method of detection, but a good way to know if SoftICE is* a5 ^  m5 V, n* A" e
installed on a computer and to locate its installation directory.1 c, t! U' m  t/ |. X4 T5 o1 x
It is used by few softs which access the following registry keys (usually #2) :1 B( O5 Z2 T1 Q- L1 {% m
* Z5 u7 q& A) ?8 O6 K
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion5 e' C0 |2 e+ s$ C2 O% j2 c2 |0 E6 f& Z
\Uninstall\SoftICE
: A& q: [; a7 j6 w: v-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
  \' {# c. B+ ~0 t* \6 S3 i* B6 S, q5 }-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
; M8 b. R: d5 E1 H2 \' J\App Paths\Loader32.Exe
+ S4 g: I, r3 a% d4 {  E
$ r8 G% v1 k  ]4 w9 S/ B0 ^8 h0 F' Q. M* R
Note that some nasty apps could then erase all files from SoftICE directory
: C2 L. @' y* U% u5 y! E(I faced that once :-(0 K4 |+ j% }) N  p+ v# c1 T% m

9 [- ]9 w3 X  X0 OUseful breakpoint to detect it:
5 F2 d, s4 B& U7 H- |* z* f% v# F
; a0 n, E  A- U2 j9 j     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
: j+ N8 \+ P% \& L
1 B3 L5 O2 W: `, m8 w# x$ I__________________________________________________________________________) r' y/ m& Z9 I# ?; ^3 X( F6 E

* V7 F$ V; v2 F( i) x4 {, H. G
3 H$ @, ?+ f) `0 R5 k; bMethod 14 ( E) R' C5 i, T! J5 b' }
=========" y# x5 T4 X9 C. q

0 l5 c4 u2 X1 [" q1 _" WA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
3 L3 i4 }, \0 D6 J' Z" J" [is to determines whether a debugger is running on your system (ring0 only).
; s) |7 V6 M5 Z: P4 q
! V8 ~( W/ }" b4 {   VMMCall Test_Debug_Installed
6 m3 g# }% _( M8 @4 |$ H   je      not_installed! D( T" I5 w3 C5 T; D5 _3 h
0 ]7 ?$ X. D% D- G: q
This service just checks a flag.
4 `9 l, Z& @/ \, X</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-8-2 10:58

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表