找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>$ b( G6 ]* u1 p) C: w/ i
<TBODY>
% e, z; T/ _" t) Z<TR>- D& A! |* v8 m( j% S! x
<TD><PRE>Method 01
4 G/ a" K+ l4 O5 K6 M, z( P9 K( f=========* H) {- J% A4 s4 L+ x3 f

3 y/ S- M7 h3 v" F  fThis method of detection of SoftICE (as well as the following one) is) c3 c: A$ c) Q4 s" u" y
used by the majority of packers/encryptors found on Internet.. R% v) l* @" i
It seeks the signature of BoundsChecker in SoftICE
! a( v' h7 ?. R: L) p
/ J- o2 `* v9 Z$ }8 G4 q# S  g    mov     ebp, 04243484Bh        ; 'BCHK', H* e* k, F$ S* ]2 s- w
    mov     ax, 04h  ~" U- l' O; I: }
    int     3      
- W6 ?9 l8 W! e. B    cmp     al,48 G+ t. ]6 `2 {" [
    jnz     SoftICE_Detected0 e3 `9 W; _% E! K
  G+ X! n9 [) ~. V0 v
___________________________________________________________________________( T1 B- |0 M2 H9 \! G* @& W6 T
0 \# O2 a7 q7 Q( k- ^
Method 02
/ b0 j  }2 R: O$ [=========% m4 y( u1 s6 y4 V+ A

  ]3 P# a5 d+ i# Q8 I. E, EStill a method very much used (perhaps the most frequent one).  It is used
% j3 o4 L( t# I) A( g( L6 gto get SoftICE 'Back Door commands' which gives infos on Breakpoints,. }$ M0 T' c' U5 t. m3 Y
or execute SoftICE commands...
! C' C/ U1 l0 @# FIt is also used to crash SoftICE and to force it to execute any commands3 c& n% h9 G, c
(HBOOT...) :-((  " a+ _- R/ ]  Z: G2 H

; c, Y- w5 l+ N% THere is a quick description:! [0 M- F+ X! }8 y; q" _! E+ u/ u* Q
-AX = 0910h   (Display string in SIce windows): z. R6 E; G. e+ \' F
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)" @' S% |6 |$ `+ Y6 f: G- P. n
-AX = 0912h   (Get breakpoint infos)0 \3 t8 o' N4 [
-AX = 0913h   (Set Sice breakpoints). ~' i" Y" h0 i* J/ N. e) \$ Z
-AX = 0914h   (Remove SIce breakoints)) f* ~0 C4 P, _! h9 z5 ^9 z' I
1 _3 e; `) {6 a+ t8 E; i
Each time you'll meet this trick, you'll see:
. D/ C5 a6 B  i8 b' O-SI = 4647h
* l- A  S- B& m$ [; n# L-DI = 4A4Dh- l% e2 l5 x) g. e& r0 @0 s
Which are the 'magic values' used by SoftIce.+ ]: V5 R1 P4 v5 E% z) ^) ?
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.& q% n" e7 {, V; p7 V
6 L3 ^2 O, z3 h8 v4 O0 s
Here is one example from the file "Haspinst.exe" which is the dongle HASP
& b3 X1 L; E' ?: H$ H4 c" G2 ?Envelope utility use to protect DOS applications:+ V" I3 N6 ^9 X1 [9 N' d9 C
, p5 r9 \5 s4 i: L# S5 H

9 A2 {( b. h' \6 C1 F/ i4C19:0095   MOV    AX,0911  ; execute command.
4 s$ @/ M8 R* |- Y6 x4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).* g9 D: n1 Q( F6 A' j4 J8 t
4C19:009A   MOV    SI,4647  ; 1st magic value., m! p2 g7 a$ Q2 Z) L2 b  A; Q
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
4 V4 a, S; D. s  y0 n% }4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
$ w# P0 ?4 m/ d: q. Z0 l. H4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute: I; [4 t4 Y4 R; ]* q
4C19:00A4   INC    CX! M2 C- G. V4 O$ _& S/ y$ `! ^. a
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
0 A2 E6 J4 W  }% O$ C4C19:00A8   JB     0095     ; 6 different commands.7 m) P- d$ Z  q. U& \5 }. j: t# U( a
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
  t3 Q3 q3 l5 Q  o8 ~* b9 n4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
! u% K) ~: H  g% X9 A1 g% B0 W* n5 k! R) F$ W, E% T" M
The program will execute 6 different SIce commands located at ds:dx, which
- j. L1 G2 w7 [5 B0 P' eare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.% X  X) q; l3 B; d% Q  O
" j/ A1 [% |: s3 Z
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
, @, W3 X+ A( k% ?___________________________________________________________________________, z2 A% H! |0 s
$ `- G5 r8 [6 H+ D3 n1 a

% x9 b- b4 l" f; Q* }Method 03/ @* [1 K9 \0 R9 `3 w, u
=========
/ X* k" @- {* e7 c, ]# @- M4 r( U/ |8 Q
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
& N3 ~9 {0 n$ {(API Get entry point)
. J: R' l* _6 m: P# _; Z        + P/ o; g6 _6 N4 a

7 g+ H# Y3 T* `+ |3 R    xor     di,di( i3 d7 _  R. }$ h+ x2 N8 Q6 T
    mov     es,di
: B% L" |8 |' o! W4 R/ g    mov     ax, 1684h      
' E8 m' s! R3 c# F2 V$ K    mov     bx, 0202h       ; VxD ID of winice! `% O# t! `6 g  S
    int     2Fh
" P+ N0 ^6 N2 u6 s7 I    mov     ax, es          ; ES:DI -&gt; VxD API entry point7 R/ g8 K- k2 u6 y* @/ Q
    add     ax, di
  R( e; ^; _  R1 N    test    ax,ax. R% B" J+ h4 u- d2 ~) A
    jnz     SoftICE_Detected
0 Y" [. q% N1 \3 P2 w, `0 D& A7 s  I: Q8 {8 M4 t, B. b6 N
___________________________________________________________________________& O# J; [) @0 {+ R+ m
; X# C( D* {- L; I
Method 04
. E+ ^* g- s4 [% h=========
& M* q% r0 G5 k- o, A6 ~
) L" y3 E+ r( sMethod identical to the preceding one except that it seeks the ID of SoftICE
1 _& A. ~3 `0 {$ h' _% wGFX VxD.  W0 D; `  G/ z- b6 c
5 k' v, L3 d4 u/ E# Y( m% q# r2 H1 C
    xor     di,di* n+ o6 j9 |/ y. _" X% _
    mov     es,di
0 L0 [! c& U# D7 l# |! g' e; l    mov     ax, 1684h       " K7 a) U6 a" J& k
    mov     bx, 7a5Fh       ; VxD ID of SIWVID
. [: [& @" G5 S* r/ r5 R6 q    int     2fh4 U: ~$ `) Z. l5 y
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
3 L7 C* E: r( p  k! Q  v- s    add     ax, di. U9 n7 a  ]* x$ {
    test    ax,ax0 v/ V9 G/ V5 i0 x
    jnz     SoftICE_Detected4 P9 H: r6 n" {8 j  ^5 v1 q' P

6 q, p9 q' w0 `  l4 D/ M__________________________________________________________________________3 {1 g7 j0 S4 n

3 Q& r  G% x5 T) E: O7 ]- E/ }; ^1 `/ m1 e+ E1 v4 x+ n
Method 05
) }) b! \+ Y8 N$ z* g=========
" q% ^- j0 h- y; }$ C
' r8 s( p/ ?' j) x4 g  N' u* o5 JMethod seeking the 'magic number' 0F386h returned (in ax) by all system
& j( q% Q( [) Y  pdebugger. It calls the int 41h, function 4Fh.- X; t$ m. ?2 Q; v9 x8 o7 M
There are several alternatives.  
9 C$ b. k2 g5 p, M' X5 {
# o# C, X5 u5 h2 E) i5 \* QThe following one is the simplest:
" O4 P: j5 P" u3 _. O0 L$ h
+ |- f+ R2 i# Q) ]1 J    mov     ax,4fh
1 ?. ]5 F! x7 O    int     41h
0 R9 Z; i& O1 h$ ~% j    cmp     ax, 0F3867 `- D0 R/ w$ n, w$ |/ r: @( J: h* I
    jz      SoftICE_detected; R; t5 Z' G7 J
" L0 u8 R; \7 w" V5 ]  c- C
& O& E( u2 T$ r0 K; q/ C& ^
Next method as well as the following one are 2 examples from Stone's # A- c) r1 Z9 x+ E: p5 ^; A) `$ [
"stn-wid.zip" (www.cracking.net):" o5 t; ^* J7 [, G7 c

, i' t/ a0 W. Q$ ^9 X    mov     bx, cs& j2 e9 X" W7 d4 g# a1 @
    lea     dx, int41handler2% e! x0 f1 ^3 Y9 j# v+ J$ B' I
    xchg    dx, es:[41h*4]
1 n2 }% F! o3 `/ l    xchg    bx, es:[41h*4+2]
; p8 E# \3 ~3 k    mov     ax,4fh8 y6 M) C. O. ]0 W3 W5 E! Q
    int     41h! Y6 A) `; C' C  V1 n% b9 J
    xchg    dx, es:[41h*4]! l0 ^/ e! i9 s
    xchg    bx, es:[41h*4+2]
0 _+ I! \; O" r- H# e" T. Y    cmp     ax, 0f386h
2 ?/ e0 n$ f" C6 y    jz      SoftICE_detected
4 V2 t* k, D+ ~- u, C# S# \
# t+ O) T  d* J, F7 z# I. d, f/ oint41handler2 PROC$ }( J! l) J- v2 ?& Q- S
    iret/ d; ]; q- ?0 a  i1 O" f
int41handler2 ENDP
% |" e1 A- Y( X9 r* m( Q
4 C; X8 Y& Q5 u& b2 G  |4 F1 R" j; l, n; ^
_________________________________________________________________________8 u, Q/ Y, ]. K& B* c
# y; ^7 V- ~) C8 i( t" V) D
/ Z: T) u4 G- ?, ^. r+ O; Y
Method 06( T2 w% M3 W  T" ^* n) Y9 O
=========
# I! F3 n0 Y' ]4 d/ q* Q
( m' `" Y# r. M9 K8 Z9 L2 Z* c# T3 f. a* B
2nd method similar to the preceding one but more difficult to detect:- O( z2 H% D/ _/ Y8 i' E, \

1 `( A8 H& a7 S$ P3 B0 Y$ V! o  Q0 h. R" }. r$ [
int41handler PROC: c1 E+ @/ a- ?+ ~- P. |( ]
    mov     cl,al- W. B0 ]* u6 `. F/ L
    iret
2 R7 A1 \3 k, Q. jint41handler ENDP
/ a2 K. Q7 J& d( ~5 ^  n; e1 f+ s0 g7 Y7 N

0 ?( E7 v7 D6 H+ N( x+ B- U7 \8 R, m    xor     ax,ax6 W: L" x' m3 L$ o' t' E
    mov     es,ax" w8 Y( `0 E6 \! [: n; T+ ]+ ^% C
    mov     bx, cs
$ j0 u3 l2 e6 {, R7 ?# D+ D    lea     dx, int41handler
) u& Y7 ]' v1 j7 o! O, j# s    xchg    dx, es:[41h*4]* [8 L+ M' ~! o. [0 j5 Q- o9 @
    xchg    bx, es:[41h*4+2]2 t: `# y  d3 I8 q& f. S( ?$ [" k8 l
    in      al, 40h
( |( h& f( S: H/ s/ B4 _1 l    xor     cx,cx9 `2 `/ g' Q" C
    int     41h3 M' Y3 `) _- L3 a, Z
    xchg    dx, es:[41h*4]: y% t; l$ e( F( e, f
    xchg    bx, es:[41h*4+2]
# M$ H! ]9 R* n6 y- C" }3 S& l    cmp     cl,al
) R$ \& |/ h5 z2 E* E2 e+ y    jnz     SoftICE_detected( d" S) \& d: S( ]. e/ S

/ n3 i. ~( n) I( H% j; M3 j2 r: K_________________________________________________________________________' E" E9 Y' q  D
9 X4 C. o3 _7 {$ j
Method 07$ a* K8 p7 U  u3 D
=========8 @! }0 E+ d& h0 W' r' [

8 z2 S3 E6 O3 f$ ^1 e8 Z+ nMethod of detection of the WinICE handler in the int68h (V86)! p* G/ |2 \2 Y. h" \: @4 {" _9 U% R" c

, p& C- w! a! B2 D    mov     ah,43h7 k/ u3 W! f4 c# A1 |
    int     68h
1 s8 _" C( u' s* W/ U    cmp     ax,0F386h
& m4 H  F, n, a! |- X. [: v    jz      SoftICE_Detected
) D" D$ A) C. R+ O+ p% w7 O
3 s% d3 n( V* M7 i" r% n5 V$ Q$ c
4 B6 @8 E: H7 \3 x% Y5 G6 v=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit% j* K5 e6 @) u' j9 Z( ]  M
   app like this:
. T& R; E9 v7 N+ j' u- @; _3 K: Y8 T
   BPX exec_int if ax==68& ?2 m6 g' \, Z9 D" W# F
   (function called is located at byte ptr [ebp+1Dh] and client eip is/ G1 V# R& ]7 k7 W! o6 m" F
   located at [ebp+48h] for 32Bit apps)+ t5 X4 K& x- M, }; {6 X$ G; q5 J
__________________________________________________________________________
4 j# e2 w& F' y" ?% A4 W. Q7 Z& d
: w  c5 |1 w$ }% S. L
Method 08
. W$ L" q7 y0 @) d7 r- \2 c=========
# s. G  }  Y% v8 G7 H4 I2 d8 l+ H; Q
It is not a method of detection of SoftICE but a possibility to crash the7 N5 O. P( H- Q9 A: I0 w" a
system by intercepting int 01h and int 03h and redirecting them to another
3 p3 q* Y* G0 ^' z9 zroutine.
3 W3 Q+ K+ M; d- F" q4 fIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
$ h# `% C6 R. @( X. A% ]3 B7 Bto the new routine to execute (hangs computer...)0 B1 U& B; E2 B% u0 c
" M' v9 a( }, D3 F2 E$ [
    mov     ah, 25h
" l+ A2 _- }/ Z    mov     al, Int_Number (01h or 03h)
7 d" P; @0 F$ l    mov     dx, offset New_Int_Routine7 ?" _- m& Y2 P1 q5 |
    int     21h
4 r5 O5 \) y$ L) a$ K8 z+ f# Q! M8 P. F3 E: y1 ?, `/ }
__________________________________________________________________________: }4 W: G5 s: {. P8 X" ^3 [. @/ S5 ?
0 ^+ s" R  ~+ g
Method 09
6 Y2 D- O! s; F; }: q=========7 p- _6 b6 {- z8 J( i1 b' z

+ o; v! L. n6 t) yThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
6 o% Q" t4 s; `! c$ O* zperformed in ring0 (VxD or a ring3 app using the VxdCall).
1 ~9 z6 ]2 g; S: ]9 E1 kThe Get_DDB service is used to determine whether or not a VxD is installed1 ?, p7 N0 C& t$ o
for the specified device and returns a Device Description Block (in ecx) for
# S+ i$ K. n3 h7 D# ?0 [( Kthat device if it is installed.5 `3 K) |- Z/ a9 L1 R4 r. _
, t4 S, Z1 x/ O7 C8 Y6 }8 o+ }
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
+ {% S$ z9 E. P/ ?   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)6 G& L/ i, b4 v  w0 u, T+ P/ r
   VMMCall Get_DDB$ Q8 e( _6 b) p4 o
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
. k) q) \6 J1 V$ Z' G
/ b1 d/ q: d8 _% X! x0 rNote as well that you can easily detect this method with SoftICE:
* A/ `0 C0 j- l. ~5 ~0 O; [# W) l   bpx Get_DDB if ax==0202 || ax==7a5fh: }! q3 D4 x3 p: K
" f& l2 B1 E4 }. H
__________________________________________________________________________
, f* U; X( W) P% F# U* X% l8 }1 V( ?3 N1 I" R/ M2 Z
Method 10
; U9 y$ L$ k/ x# Q" [4 Z3 `  X  q=========8 _- j9 ]. y. o+ ]$ ?+ ~8 b
; M9 |) y0 t6 s/ W' b' E7 j) l
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with( a- N3 w) j8 r; w. h1 e. |/ `! y
  SoftICE while the option is enable!!
$ Z) L4 V" w+ q$ z% b: M. a3 e3 u: \/ [
This trick is very efficient:
7 S: j" _1 s$ n+ y9 [7 _by checking the Debug Registers, you can detect if SoftICE is loaded4 l! ~! l6 |- x- w5 N
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
: S/ }$ B3 `: Y3 ~' mthere are some memory breakpoints set (dr0 to dr3) simply by reading their
: T, i( G  {. C* h: s  qvalue (in ring0 only). Values can be manipulated and or changed as well3 ?, D7 B' H' Y( {5 W! m5 W
(clearing BPMs for instance)( ~8 z4 t  k3 ^5 i+ V4 H
2 G! f  p, B, T1 V: i
__________________________________________________________________________, b6 h& I4 ~, m: n
" }! Y9 x( e4 L& K% `
Method 11* X% N1 S/ H/ ^- y( y' L
=========
5 g* @% P7 _8 q  B
) ^5 E. _; U% lThis method is most known as 'MeltICE' because it has been freely distributed
5 ^  C; |; c  W5 `% ~: d; J! _via www.winfiles.com. However it was first used by NuMega people to allow" o  E1 j" Z. {
Symbol Loader to check if SoftICE was active or not (the code is located9 g6 p' {2 w+ I8 c/ O4 L  ~5 K9 E
inside nmtrans.dll).
+ h7 K2 u" Q6 J+ W6 p
# s5 b" G( ]5 @The way it works is very simple:  n) m0 w; @  R4 f
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for7 ^3 e0 s* A' R3 Y7 s( X+ ?4 q
WinNT) with the CreateFileA API.( c$ }9 {0 n9 I7 ?1 m& {4 u. q

1 G% I0 ^) t3 |7 N! SHere is a sample (checking for 'SICE'):+ e) R5 V% ]% ?6 ?

; ?+ J" D& I% N9 S& L  oBOOL IsSoftIce95Loaded()
. z# o, ], I& i1 N- s. J& S{; F0 c9 c% {9 x' ^
   HANDLE hFile;  - g6 g; Y  m! i* n4 M: ?& e, b* B; m
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
6 z. a: G/ T. G' K                      FILE_SHARE_READ | FILE_SHARE_WRITE,
1 C+ I" D' x4 }  _: O                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
; D3 Y* D: ]; g$ M8 q: n3 P7 y9 k4 N   if( hFile != INVALID_HANDLE_VALUE )* g' _9 R; y4 K1 ^+ v3 Y+ x
   {
' e2 |, u6 G4 n% B6 ?$ V      CloseHandle(hFile);
& `% Z4 |/ L: O) R. V8 H9 b" ?7 E% ?      return TRUE;
) D. w1 V2 @2 E  K# B1 P   }+ S0 `* p. |+ ?$ i/ `1 z( t
   return FALSE;
/ [) O4 N. c& {- y4 o/ W}; n# n# _- |3 b& Z1 w/ A0 J3 |

: q, x( s8 G6 r. \Although this trick calls the CreateFileA function, don't even expect to be
8 h- G! F! Y7 S3 F$ p( d+ Q" @able to intercept it by installing a IFS hook: it will not work, no way!
) o/ B5 h! w3 f' R9 O4 ?In fact, after the call to CreateFileA it will get through VWIN32 0x001F
. {, i; I# u" u2 I3 I, @0 qservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function), [% p& ?6 c) @- O4 n
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
: g* k* R. _7 t! e) `2 F9 Cfield.- }9 d8 ~6 I9 \$ T* p- u
In fact, its purpose is not to load/unload VxDs but only to send a
" {2 h/ N1 N/ n7 yW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)1 U1 `" b/ K8 G  z1 T0 }
to the VxD Control_Dispatch proc (how the hell a shareware soft could try* x5 U! Z) P# w3 d, N" H% \
to load/unload a non-dynamically loadable driver such as SoftICE ;-).1 N* ]* y; z3 i- t& L
If the VxD is loaded, it will always clear eax and the Carry flag to allow& C1 Y9 |5 |) v; S% f2 l4 m, U6 M
its handle to be opened and then, will be detected.
( r8 K! F5 F, p' }You can check that simply by hooking Winice.exe control proc entry point, ?) a8 [0 P1 k* u' B) M
while running MeltICE.
) T+ \2 [6 R# O, F# e5 r6 Y5 w0 D$ V: A. N! p
, _7 h: Z7 Y( m* J8 |/ C8 ^
  00401067:  push      00402025    ; \\.\SICE; j9 O. Z+ _/ K& R# @* ?
  0040106C:  call      CreateFileA
6 T6 S- d; p- i& [: E% p; u& C6 g  00401071:  cmp       eax,-001
" l7 m, l+ f3 x  00401074:  je        00401091
) N8 w2 z; n9 k
. F) d6 X6 U$ m8 ~% ^5 S6 D5 M) t# f# o8 O* M0 \% {9 m# f- R
There could be hundreds of BPX you could use to detect this trick.
8 K/ ], U" M6 E4 V! {" f/ y-The most classical one is:, |4 ^5 L$ ^$ \
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
/ y  h9 e& B7 l9 C; x, V    *(esp-&gt;4+4)=='NTIC'
, ~0 q0 ?. a, C/ K8 Z* }2 y! `
$ n, i5 ?" W" j-The most exotic ones (could be very slooooow :-(
3 R" `+ P( M# u; A   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  & G% e8 s0 h( [+ {  t0 v
     ;will break 3 times :-(; `# d7 S9 e4 h5 {% Y( A

( Q% x4 y% ~0 |3 p* k2 i-or (a bit) faster: 7 [  N2 N4 D5 z9 A
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')6 ?) M# }* B0 i
. S- u7 t. R" `2 k3 M
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
5 ]. j5 A  h: ^7 @     ;will break 3 times :-(
" y: G9 |5 z2 a8 M! a; h% x: A: P+ ^+ H- o
-Much faster:1 l& T4 Y! Q& _3 a
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
  o( n, [% n5 p9 S- ^( x4 e( g3 m- ^. R
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
( h  W5 s4 q, _function to do the same job:( u: B. P! T2 U/ A) [

0 g* q& G! m% g: `! p3 K6 m   push    00                        ; OF_READ
- e  `4 P6 V: w  ]: y   mov     eax,[00656634]            ; '\\.\SICE',03 J5 L6 I$ z) U  u1 ~
   push    eax% ]- G3 O0 d$ B2 U8 c3 S
   call    KERNEL32!_lopen
) m$ g' B( g: w9 D$ B. u   inc     eax5 A0 U  R" m/ c- r6 q
   jnz     00650589                  ; detected2 B% R# J5 \1 q6 c
   push    00                        ; OF_READ9 f1 `; F1 D2 r) E6 C9 ^
   mov     eax,[00656638]            ; '\\.\SICE'
" D, K* X& f1 o& A& c! C   push    eax
' Y5 R  a8 \/ |: k/ A, I6 \9 s   call    KERNEL32!_lopen$ G+ n; s1 O2 b* N' g1 c
   inc     eax0 L  h+ Z# b6 a  U6 z, f
   jz      006505ae                  ; not detected
* y; f0 s% S& M/ {
0 A" q$ T1 ~3 Z
* m1 ~" C, j& B4 g+ j* p__________________________________________________________________________) ~; `8 ?3 z" h& G6 }

' |7 Y6 C$ r7 ^# nMethod 12
: p  {1 m% e* c" L; l- ]0 ~( _" G=========
. ]* S. _8 ]( S$ T: l: ]0 Y% u4 O0 o. }
This trick is similar to int41h/4fh Debugger installation check (code 05
2 d, B5 N2 e6 V8 V3 s/ \/ X&amp; 06) but very limited because it's only available for Win95/98 (not NT)
( ?4 B3 l/ ]& b% xas it uses the VxDCall backdoor. This detection was found in Bleem Demo.9 _5 r% I" q( G3 p; E
1 E1 [, g0 r$ f6 I' O* d$ v( u
   push  0000004fh         ; function 4fh
' x8 a# `. r4 v, h- [   push  002a002ah         ; high word specifies which VxD (VWIN32)
% S. N) v( R$ N1 _% ^3 N$ L                           ; low word specifies which service3 r$ t# e# K0 ^( E* H+ K
                             (VWIN32_Int41Dispatch). b" R  {" j7 v# R5 X' f& v- A3 ~* m9 H
   call  Kernel32!ORD_001  ; VxdCall, E/ T) V- u; F$ y: M
   cmp   ax, 0f386h        ; magic number returned by system debuggers
& K- I) {; o/ J- k  J0 ]7 A   jz    SoftICE_detected
$ {6 }9 a! K  @% a/ B$ q6 w, u7 f5 R: a. W% p. D
Here again, several ways to detect it:
: D3 ?$ r" h; X& ?/ m  q! s# x. W* u
    BPINT 41 if ax==4f/ y& G- R( U, X% s

0 y# L# e1 Q. X% T    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one5 X; S( w9 Y8 W! ?  ^6 a

  T- p5 d7 ~( y    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
- o1 ?. @3 Z- ~" [" d" d+ y( x+ ~# _5 M+ {0 z+ v- H5 T8 V  K
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!( e. V" m. [! X$ g; x9 v; ?

& S( a/ H8 k  y& s/ p__________________________________________________________________________+ ~6 ~+ S  Q' `# C1 t& h% u

# r; G( u! k& _2 RMethod 13
# y1 b+ b# g0 |  i/ l! |) X4 j! O=========
, @6 A9 E: Z4 c/ U- i$ @6 B: l) d6 t; u
Not a real method of detection, but a good way to know if SoftICE is3 l/ L, e, T: V6 e
installed on a computer and to locate its installation directory.
0 }6 Y* K) {6 O% \  H4 m2 o; j4 ^& ]It is used by few softs which access the following registry keys (usually #2) :' g6 f% j$ A" ?3 Q: C" I

* a- Q8 r3 |+ N9 q-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion* K5 C# C6 G" l5 t7 d
\Uninstall\SoftICE' d2 G$ O5 N% r- ]
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
' W1 Z! l7 q" M4 K( E" S-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion& a7 V% w+ C& l/ h. G2 B
\App Paths\Loader32.Exe' W* m& l5 b6 A, t2 a
2 i6 i: ?  V8 `0 ~$ w% t

. c6 N2 j! D5 K- n/ o1 b+ CNote that some nasty apps could then erase all files from SoftICE directory
4 \+ f. M* A( a9 A. {(I faced that once :-(
/ w1 j: E6 J6 l6 r! K
+ s: k% @$ q; d0 z! [" B2 EUseful breakpoint to detect it:
" j! b% g+ P+ ^( I9 z( g7 q  A) V; |# _" ~. L* \3 e$ |& Y- V; t
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
! G; ~: n+ K) U, u1 a! }
& D5 C% ~: v& o% ^3 g  o( k, O6 u  m__________________________________________________________________________1 ]) X) t) s) G' |

# \. A9 J" Z4 u0 k5 V6 z! w" \- v% D$ A" r
Method 14 . g1 q! g$ C9 h3 Z
=========3 g3 K* B+ u# I
- U& Q5 H' k, m: k; D$ j3 I
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose8 K! X* g3 N* o! E
is to determines whether a debugger is running on your system (ring0 only).
0 B6 ~* ~; {' C
+ z. d" h$ h* G( g* p( l" r, x   VMMCall Test_Debug_Installed
$ n' s+ }0 @! [   je      not_installed
& R: w8 K+ L1 {3 T# r3 z3 Y& }4 S
This service just checks a flag.
3 Q' g: q' {6 y# `; n</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-7-31 17:58

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表