找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
2 J$ j& E& H: X# D0 _<TBODY>; A' u4 }" B2 {. N
<TR>* ]  c" [$ n+ d( G- I4 o7 ]% f
<TD><PRE>Method 01
# Q( ]1 R! U7 R% t=========
8 _/ s. M3 W- C" }9 t' `
& ^: X( t6 F* [# bThis method of detection of SoftICE (as well as the following one) is
4 A' T7 k1 l+ ^; \) c8 G( m& iused by the majority of packers/encryptors found on Internet.
7 }$ S% W6 U! d2 KIt seeks the signature of BoundsChecker in SoftICE+ M8 K8 v; v% V3 Q+ I
3 l3 z* P  V, P# P7 O8 g+ K
    mov     ebp, 04243484Bh        ; 'BCHK'
# h. V. s5 i! f. t. d    mov     ax, 04h
+ ~. l- U$ M7 C; o8 d3 A/ ~    int     3       ) G5 r; L! [: h3 M
    cmp     al,4
" F0 ?  N' V& A2 M    jnz     SoftICE_Detected
" s  U! |  T" w3 e. Z  i2 v5 p& ^3 d" v8 D& j
___________________________________________________________________________
: J4 H4 k* t6 p" Y
- |8 x  r* W6 @+ A7 \Method 02
) L9 u7 M1 B* s=========
3 m# R( ~( f0 M3 w! @' M5 p
8 Z# X5 Y+ E" K! K& SStill a method very much used (perhaps the most frequent one).  It is used
2 W) ^1 ]' \0 Q0 k" Wto get SoftICE 'Back Door commands' which gives infos on Breakpoints,! {$ i0 I' I) d# o' ^! g) H
or execute SoftICE commands...
& S) n$ U7 t' A( D. h+ OIt is also used to crash SoftICE and to force it to execute any commands- E1 F6 b# E9 C
(HBOOT...) :-((    Z' j: Z  B; ^9 x

- V8 M7 u: V% q+ \' kHere is a quick description:
. W, ~: n7 |# K) N7 U-AX = 0910h   (Display string in SIce windows)& m9 _+ _  L9 x7 l5 b
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)" Z' F! M6 L) s& z# @" {* P
-AX = 0912h   (Get breakpoint infos)
$ v: N/ L. O0 q6 w8 ~5 u( f-AX = 0913h   (Set Sice breakpoints)+ K/ V# q9 s( B3 F% L8 i! a' i3 P
-AX = 0914h   (Remove SIce breakoints)
% G- x5 W6 Z8 a# W& A. a  `' d* C- Y5 G- T/ E1 R3 y) T( L. R% L
Each time you'll meet this trick, you'll see:
0 W5 L  O3 z/ Z-SI = 4647h
8 ~5 @. R( [) s% R: L-DI = 4A4Dh
& d7 l, t# [4 S2 b6 V. s! ?6 sWhich are the 'magic values' used by SoftIce.
8 ]  T. m1 |- t" \8 q1 _) iFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.  |+ a7 d! w/ W

0 t7 d) i2 ^- }5 K4 Y$ H5 P4 qHere is one example from the file "Haspinst.exe" which is the dongle HASP) `1 `* N0 B/ C! ?2 x, T/ Y' A
Envelope utility use to protect DOS applications:
  Y: f. q: k7 o8 U% b
6 J+ H7 Q% P+ n# D3 C$ h: U
/ Q' f) D) e" l7 ~5 k/ C$ w4C19:0095   MOV    AX,0911  ; execute command.! F7 p. |& C. a# X
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).7 Z$ z) x' D7 e6 _, D9 _
4C19:009A   MOV    SI,4647  ; 1st magic value.+ V. g3 S9 T7 i
4C19:009D   MOV    DI,4A4D  ; 2nd magic value." S$ C3 z9 o# Q) S5 N* x: ?
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)2 o2 v  D& \+ `5 @, D
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
% E, Y1 M4 w% H4C19:00A4   INC    CX
  j1 G' c. C9 ^, V: v4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute3 E( ^7 u5 C3 V) ?! W# k7 c
4C19:00A8   JB     0095     ; 6 different commands.( A/ ]; ~2 {! T
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
+ `3 w. l) S% c4 q5 e4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)% Q, f" G( ]- Q  W& y& J" T4 k9 b

- \' }, M# B2 n" w- w, `) YThe program will execute 6 different SIce commands located at ds:dx, which
' S; H1 U  r# i9 g- s* Bare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.  a6 z" h( X: Y, q7 {
4 n5 s/ [9 P  ~$ \; D
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.8 b$ @# j9 `1 G/ A) \) r, H
___________________________________________________________________________+ K5 A3 z, C2 k$ l. t& a7 I

' i' v# R* R1 N, H& K. s
  R: Q% G$ R7 e- qMethod 034 F; V6 i! ^3 K- g+ G3 q# F
=========& ^5 {( \0 k  q3 O0 B

! Y3 E7 K7 j, C% V& [Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h* f1 y# O1 r' z1 r8 e
(API Get entry point): q- N0 y3 y" m" a1 N& v  _" C
        
; H6 {% V: o# n% n: ?( B, Y4 r) i; ~0 |! R9 d
    xor     di,di6 W7 {* v$ J5 p& m9 F: j
    mov     es,di& k) P  T7 l. t9 @
    mov     ax, 1684h       7 I; q) L2 z' U! `! M
    mov     bx, 0202h       ; VxD ID of winice. d8 \1 j8 v* G, J* L& U% v
    int     2Fh7 J/ I) j+ Q$ q! c- c
    mov     ax, es          ; ES:DI -&gt; VxD API entry point% t1 E: q7 P4 s2 F4 x6 Y
    add     ax, di  C+ D1 Z$ x. R' o, m* w7 u
    test    ax,ax
/ K, p8 E9 O3 D- s2 u    jnz     SoftICE_Detected, X/ {4 ]4 |4 q5 V' `$ n
# q0 }) `. {. ^0 q3 {1 o: }
___________________________________________________________________________
, Y+ }* d0 ~7 e$ ~+ r( Y' ~; ?5 b6 U1 Y4 D- U
Method 04* T4 S  M# T* I0 P7 R( T
=========
4 K- Y. ]- g# B' [; L+ f5 D. [' `5 ~6 |/ b" l  P8 m/ T
Method identical to the preceding one except that it seeks the ID of SoftICE
: R" G) S) G* LGFX VxD., m5 Z  @  U; B" M( z: e/ w2 G

# I  }* k5 f2 x    xor     di,di; I/ O' f9 {7 J+ N2 u2 h9 e
    mov     es,di
6 s) N' t! I. V; y0 S1 r    mov     ax, 1684h       4 G  Q, z4 \5 ]5 |6 A
    mov     bx, 7a5Fh       ; VxD ID of SIWVID+ @5 ^$ {3 p5 K( E
    int     2fh
$ e0 P- v% ^6 N+ O. g9 Q    mov     ax, es          ; ES:DI -&gt; VxD API entry point
& j, X% A- A; G    add     ax, di
! H4 e3 |# c7 z6 g. F    test    ax,ax
: R/ _( \8 n+ g5 ^    jnz     SoftICE_Detected
, J/ i$ U9 J+ e' X1 t" P7 Q; K
* D. a4 B. t; V% c; Z__________________________________________________________________________
7 _7 v5 l/ t" @1 G3 k$ f! D& [% W- O- r

( I0 ]7 D6 p: p* |7 M+ UMethod 056 Y1 x7 ^7 B& d4 L
=========
* A9 v9 a% O; ^4 |! [" u; G6 P; ~2 u& N
Method seeking the 'magic number' 0F386h returned (in ax) by all system
; o. R+ t, k( o. L4 w' rdebugger. It calls the int 41h, function 4Fh.
1 u& o4 R: g/ S! ]' yThere are several alternatives.  
( s+ }' p# D( A& u+ Z" O" |, h5 `1 ]
The following one is the simplest:5 C& A  L9 k5 ~. t( C

3 P$ H( J7 G+ ^0 F0 ~+ d& I    mov     ax,4fh% D2 W" e0 @; H' o9 V2 o
    int     41h+ h8 h, j4 n7 \4 z& n
    cmp     ax, 0F386, \% `1 I& X; U% h
    jz      SoftICE_detected
) c# k* Q2 W4 i. p+ L9 C7 V% Z. ~+ S1 @3 `+ d7 K4 X! t! z( E) j

9 s5 N+ H( m7 s! RNext method as well as the following one are 2 examples from Stone's / e# W  H; ~2 {8 c$ _0 x7 W4 |
"stn-wid.zip" (www.cracking.net):
" a/ R  ^3 e1 F! v
: R3 a7 e/ u! Q& q( j. W3 j% C    mov     bx, cs$ Y2 a2 h0 b% W2 G$ A: n' Z
    lea     dx, int41handler22 U" \1 N( w& M; B9 ]0 s% s6 c! R- ?
    xchg    dx, es:[41h*4]
+ x* I2 v) b6 {, i    xchg    bx, es:[41h*4+2]* M3 v2 a2 h5 K+ y% K5 b. e2 e
    mov     ax,4fh
% o0 a( g* E9 c( C    int     41h& q1 G# N5 C$ G$ H5 T( Z5 H9 [1 B
    xchg    dx, es:[41h*4]
  h- f6 p+ ]2 L2 D. n    xchg    bx, es:[41h*4+2]4 A* [3 e5 r2 h5 w! }
    cmp     ax, 0f386h2 k; a  p! N+ @! u* B  |& ^
    jz      SoftICE_detected# ^3 A! k& }/ |# b, }: S% e& h

" ^; t0 `0 y! q4 nint41handler2 PROC; A- \' L$ a$ g$ Y. D+ Z" G1 _
    iret- o3 A( k3 Y* k5 e3 _' w* c1 e
int41handler2 ENDP
2 R: Q! x7 h. P7 x/ M3 E
8 Y+ M6 l2 [  x4 B
  V9 n" i- R  @( P( m_________________________________________________________________________
7 V# l2 V9 G" w# F
1 i) r4 q6 J' u+ k- I& r3 N  G" N. i0 R
Method 06( z) g  x) \$ u, j
=========
: B3 L, `9 }# N$ P5 D: L! a9 @% F) u, l' m
! D! `9 o& Y9 B" a7 d  ^* r
2nd method similar to the preceding one but more difficult to detect:
* a' |/ C9 s) J: v0 z  Z5 Y' d
$ C. g( r. F2 |" C. a) J
( V% Y1 g6 v1 Y: }) Fint41handler PROC
8 N# J+ t  a; D  `4 [; O    mov     cl,al
( O1 i( U3 _+ D! @/ |5 G/ D' @* i/ E    iret
  {9 x% U4 y3 _6 l+ @8 W. dint41handler ENDP  C; ~: l1 }2 o3 j! M

9 N* v' q$ A% b; B! Q7 l
! Y8 G8 D* ]$ K, Z    xor     ax,ax! X7 o; ]3 R2 |6 a1 n) t
    mov     es,ax& P: u+ |4 E+ y+ \  y
    mov     bx, cs! t% A  L; i8 ^# c* ?
    lea     dx, int41handler9 m$ n7 ]6 I" G5 c9 U: \# h0 @
    xchg    dx, es:[41h*4]( V3 @$ o, r9 ?4 l& ^; ?5 R% V4 \
    xchg    bx, es:[41h*4+2]
5 _( `. p" W) p2 t; B4 D6 Z    in      al, 40h) q* D# |% f% C- ]! i1 f) c
    xor     cx,cx
+ n, ]* v. y) X, p; {    int     41h5 U- k' N# u- a5 X: V. D1 _
    xchg    dx, es:[41h*4]& t+ z9 ]  e7 s/ E: O* B
    xchg    bx, es:[41h*4+2]
% ]1 O* H$ o3 k0 C) @6 ?: Y8 ?* f    cmp     cl,al4 w+ a, [% E; h0 q' K  W$ y/ k
    jnz     SoftICE_detected' ~$ N$ R# x( r

; K+ ?; t, M  D; ~7 g. g5 }3 v_________________________________________________________________________% H/ k1 D1 z' E$ j) e' Z6 a9 X
' n0 k2 Y! W. n1 z! t' I" B1 y
Method 07
$ F6 J$ o1 J1 t. L* o$ h=========8 m8 f/ [* y* M, F
% a' e( u# j; X) R8 M+ d+ u  e  w7 c
Method of detection of the WinICE handler in the int68h (V86)
& N  v8 }% Z  b  t  q
0 J7 ?8 J7 f9 G) F8 y/ E, i% E    mov     ah,43h5 U9 N4 c3 j8 E/ I. I' ^4 ]0 u& z
    int     68h
; w8 Z) f+ ?# W- d    cmp     ax,0F386h( e+ a( V+ S) o/ H
    jz      SoftICE_Detected: y+ u5 w- ~2 l/ O' W8 t% |; u9 L0 ~

/ f3 p+ Y8 R, h1 P8 h% l0 j
5 S# ?, a9 H6 J=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
: x* V. q* [1 X   app like this:& r; M, P# L- }3 S& s+ Y. o) @4 C" w+ B. @8 i
. q2 A0 k& j, [& Y6 |; z$ G( _
   BPX exec_int if ax==68' X0 d: r4 @9 I) a& S( C& N) H
   (function called is located at byte ptr [ebp+1Dh] and client eip is
/ B$ j' N  S+ {8 U$ r: o# g7 |   located at [ebp+48h] for 32Bit apps)4 J$ p, E; U8 k* b# f' |1 q
__________________________________________________________________________
7 {8 o  ?! s( F" f2 B+ c! U6 A' ^0 [1 I' B; @
0 t5 X. d/ B4 j% j( H1 T. u- X1 P' L
Method 08
" m1 ]8 Q) y$ s; u=========- h. Q- G8 w" W$ c& d

, m- q6 U, f# q- c; |; BIt is not a method of detection of SoftICE but a possibility to crash the, L$ R' Y3 l7 p: J3 X, L3 C& E( q  W
system by intercepting int 01h and int 03h and redirecting them to another6 ^  h+ @% D- Y% L5 @, l" m
routine.
6 E3 ~$ c& I* mIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points# b4 x) }2 Y/ ]- M; K
to the new routine to execute (hangs computer...)
, Z3 x( d0 \* w" d# n
6 p4 J/ i+ H% c( L# u    mov     ah, 25h3 [. B5 a, z3 d
    mov     al, Int_Number (01h or 03h)* E/ G0 x$ }. h+ J
    mov     dx, offset New_Int_Routine  x2 Y* Q: Z& J7 Q3 X
    int     21h  n1 O7 @' x/ ]* O3 p: E
1 `8 K) L, q; L. V) s1 k
__________________________________________________________________________
  B& W4 G% R2 E4 x/ l+ L1 @& Q/ T
Method 09  s0 u1 D( j1 G
=========
. `- S: C. F( V1 B
9 |# D+ f9 `8 E8 ]' SThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
" C, l- ]* j& D" k5 Z+ a4 kperformed in ring0 (VxD or a ring3 app using the VxdCall).
( \$ h  w' L* a& `! m: q: \1 i9 ~The Get_DDB service is used to determine whether or not a VxD is installed
3 e! E/ o5 k5 i3 J8 W' Dfor the specified device and returns a Device Description Block (in ecx) for+ n% ~- C2 ]: }8 j; P+ P# I
that device if it is installed.3 V6 b' w$ l; N9 }" c; t
3 [# i+ B  K/ R. [3 i& N/ k
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID: w: L5 j8 W9 W/ r- o8 Z
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)0 ]* G7 G  T; z9 o% C0 y5 P3 A% t
   VMMCall Get_DDB1 T; [' M4 |# T& ]; ?# G% |
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
/ B6 K$ l& P+ o3 ^% K7 x! \1 B- t: s8 |- ]5 r3 q5 [5 _
Note as well that you can easily detect this method with SoftICE:$ [8 i+ ]$ ~! N' j! m2 W
   bpx Get_DDB if ax==0202 || ax==7a5fh" Q4 ?& g7 _! I; M8 v+ @$ S

' Z6 ~7 c1 l- e4 ^) E__________________________________________________________________________' i7 {: c+ x& K, u) P( d% P

1 t% p! C/ Y( }# v% gMethod 10, K# L6 F3 n0 Z! C% E' o
=========! s8 S$ Y( r7 C
8 j/ l+ c+ `1 f) a0 P
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with  Q9 p, B% u3 `
  SoftICE while the option is enable!!% t1 n( S' a8 O5 Y# ~  i4 y. |. F
2 V9 `# @; `- |" U5 X
This trick is very efficient:
% w" O8 q! L) l5 Bby checking the Debug Registers, you can detect if SoftICE is loaded. j1 ?0 L7 m7 Y# i
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if) b  q; j# A0 O8 B& T$ m0 T
there are some memory breakpoints set (dr0 to dr3) simply by reading their) C1 C3 O2 g0 H) Q( u& @
value (in ring0 only). Values can be manipulated and or changed as well' F, U: u$ S" V) {/ _6 }! A
(clearing BPMs for instance)# u, ^, Z7 Z; f& E
6 `$ I& ~5 q  Z3 o2 b/ n  N
__________________________________________________________________________9 j: C& b& m, `$ p+ Q
; C) b! ^6 A6 |0 ]1 z2 M8 G% ^$ c
Method 11* \/ N/ ?2 f) i+ [0 d
=========- u, z$ ?# W  r+ ^5 `
9 e# E$ V7 ?9 a: K8 e. q
This method is most known as 'MeltICE' because it has been freely distributed
- F( s/ J' b8 ^" N0 Rvia www.winfiles.com. However it was first used by NuMega people to allow0 d2 y( f1 }, g# P- F0 D
Symbol Loader to check if SoftICE was active or not (the code is located
* V; p3 P4 x# C. s3 i+ zinside nmtrans.dll)./ d3 H- `9 _8 z
) a; M0 a' S9 H
The way it works is very simple:" G+ _7 U$ j2 H9 ]0 }
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for3 C) K, }7 t; c! h
WinNT) with the CreateFileA API.( z- Y) T& }+ @' o+ z. q

$ q$ J4 m  v' YHere is a sample (checking for 'SICE'):: O* T5 n' z1 ?# Z6 P

# Y/ r; L0 Q' c6 V( SBOOL IsSoftIce95Loaded()* m6 O; O* _7 l7 e
{7 z9 Y8 p* d( d( m& I% C' i: `
   HANDLE hFile;  0 \  Q0 J6 {6 Q# f5 x
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,1 e# O- |' u# @$ X# s
                      FILE_SHARE_READ | FILE_SHARE_WRITE,
* N# `6 M& ?) ^4 ~# K  M                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);. {) y, _: \7 e' z: f! d
   if( hFile != INVALID_HANDLE_VALUE )
# C, L( c- u5 }9 f   {
7 q/ o$ S' A* q* c4 m      CloseHandle(hFile);
7 H1 K8 k2 H, m8 M      return TRUE;3 }& J6 ^+ Q( ^
   }- W# X* q4 _# b) e
   return FALSE;
  r/ k& |8 F; @- t  J, u) c( L: i}
$ a, C! d  @$ h4 N1 ^) f( K
. y4 v5 d3 [/ O0 J" AAlthough this trick calls the CreateFileA function, don't even expect to be
# r" {0 X9 X% |# q5 Jable to intercept it by installing a IFS hook: it will not work, no way!
9 W6 ]7 k2 C$ t& b5 \: L1 \! |In fact, after the call to CreateFileA it will get through VWIN32 0x001F% Z. }6 j' ]" ~7 g1 b
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)* S4 ?& j# F3 ^: ^: `8 n9 A
and then browse the DDB list until it find the VxD and its DDB_Control_Proc5 |! e4 }; w: A$ L! C
field.
3 I- D1 y7 ?( l' rIn fact, its purpose is not to load/unload VxDs but only to send a
$ s4 B2 ~' X- d: ]W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
8 h" ~- k$ N; S2 {+ u0 m2 x5 t. fto the VxD Control_Dispatch proc (how the hell a shareware soft could try( P# u) `# [1 J( ]" u
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
" j) l6 H1 i2 ]9 FIf the VxD is loaded, it will always clear eax and the Carry flag to allow
0 c1 i! o$ o# z: ^# Y; L: \its handle to be opened and then, will be detected.# |' K: S( g- H4 n2 g
You can check that simply by hooking Winice.exe control proc entry point( ^0 L7 P& c: U# o/ B  F
while running MeltICE." h7 D+ k& Y* [6 P, r: Z
7 x1 Y4 ^3 m- M- R) @
4 {0 J/ t6 }; U
  00401067:  push      00402025    ; \\.\SICE
& G# |6 O  y( R- R  0040106C:  call      CreateFileA
0 M) P3 [( T: s4 G6 ?5 ?' ~- [  00401071:  cmp       eax,-001
, }- Q! @5 I( J5 s1 M  [  00401074:  je        00401091" {" W8 z  G+ R6 n6 C6 g- D

$ F5 z6 I' x, ]4 a. W3 y8 y/ |9 s: k
There could be hundreds of BPX you could use to detect this trick.6 a8 a# A7 o# g( B0 `7 t
-The most classical one is:
0 z3 U' x( B  D6 j& j% U$ V! v  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||4 ?# B% f" m2 `( W
    *(esp-&gt;4+4)=='NTIC'8 F! d- h# M2 p. S" j
! }6 J  M, s3 o% x3 F- n. a% k5 h
-The most exotic ones (could be very slooooow :-(& i. i$ w' @2 b" r9 Q' Z( i2 h8 G0 Y$ |
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  : c# r- v& p5 v& D& G8 t2 H
     ;will break 3 times :-(2 J6 u% |2 s* B, X$ V/ Z
) _$ V, N$ e& D' G
-or (a bit) faster: 5 m$ `0 m3 E9 |/ \) R
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
; I' `' v/ a( Q* B4 G* Q; K4 r" s8 p
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
/ f5 ~& j2 A# F8 Y0 |& J$ G: {- i, T& ]     ;will break 3 times :-(! A' a. X6 K2 n6 R

7 J( e6 F5 f. Q- \$ ?5 L-Much faster:
+ F" c1 p: m( b7 M0 \   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV', O3 L5 N. r# T. Z, v# ?+ P

% ^5 n5 l* }6 V6 ]Note also that some programs (like AZPR3.00) use de old 16-bit _lopen! i1 @, o# F* g% C# e$ l
function to do the same job:
0 J* G, _" `7 M. i& R
3 P+ G2 b+ X" t   push    00                        ; OF_READ/ d3 t, t: t1 x7 U
   mov     eax,[00656634]            ; '\\.\SICE',0
0 X) o3 i8 r- x0 L4 ?7 `   push    eax7 D" @7 c( {$ R7 u
   call    KERNEL32!_lopen
6 M0 ]+ k& Y- q, E! b   inc     eax4 h9 q# p: ~: t& u$ k. S( _
   jnz     00650589                  ; detected9 E( E( e# ~! c2 ]+ K' j6 L1 c! S& }% H
   push    00                        ; OF_READ" J& R+ ~+ C+ P
   mov     eax,[00656638]            ; '\\.\SICE'/ i5 }  H- B, Q
   push    eax' X0 y. V( o/ X1 |$ X/ h
   call    KERNEL32!_lopen7 Q9 {0 d0 g1 R" x8 q
   inc     eax! q  D$ e5 l* G+ p& Y$ g
   jz      006505ae                  ; not detected" j2 a& F4 b& G# e1 `. c. @

$ R# y5 R2 ?0 a5 i1 T" ]
- l$ t6 w7 U/ K% a8 r& }__________________________________________________________________________2 @# H  d8 @9 g8 g% U  W1 d
$ g! Y" ^3 R) L6 s/ z3 N- F
Method 12  V/ r% L: q# `2 z9 q
=========
+ k% @0 p5 a9 h! I# o8 _
8 o5 z' X" H8 ^( D7 y6 xThis trick is similar to int41h/4fh Debugger installation check (code 05
+ q$ r! C+ ]7 K1 S&amp; 06) but very limited because it's only available for Win95/98 (not NT)
" u& `+ i9 \2 P5 i* tas it uses the VxDCall backdoor. This detection was found in Bleem Demo.7 X0 A6 a/ [$ Q) C
4 v( y7 {7 y; y4 Y$ _1 Q5 J& d
   push  0000004fh         ; function 4fh! [7 B+ Z" B: v
   push  002a002ah         ; high word specifies which VxD (VWIN32)% C9 N0 @/ R1 ^) N/ u% d% U
                           ; low word specifies which service
$ F5 d0 w4 |3 b9 a4 T1 c% e* x                             (VWIN32_Int41Dispatch)& D$ l5 l1 l! s$ X/ `' i
   call  Kernel32!ORD_001  ; VxdCall% {5 k2 l* N0 D, o, n' G
   cmp   ax, 0f386h        ; magic number returned by system debuggers
9 Z+ l+ v% n: o- F6 \; Y! K6 P   jz    SoftICE_detected7 ~" Z8 K) |% {' Z; C4 D5 y
! w2 W. r% `+ Y, p
Here again, several ways to detect it:0 ?# ^( v, `3 ~# X) b7 O

8 V" u- O) d3 J    BPINT 41 if ax==4f% `# h. M1 y% }1 r; p+ s+ \5 M
0 s2 W6 D4 x5 M. _5 m
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
' Q! \# v% I8 P# L3 a+ I4 W7 _$ z9 y+ F5 W6 \
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A$ t: t. F0 |7 z# S

1 G# e# O; M+ v; K    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
, F3 z& i1 m5 _3 l+ ]
# e5 P) e( H4 ~__________________________________________________________________________* _, j9 q2 [. C6 g6 s7 G  q
, o7 v" D( h6 [5 Q: u' w
Method 135 f" m* v" |# F7 y/ Z. K3 d
=========8 {3 _+ |3 \0 ?/ i! t

# G5 i! a4 [2 S, o: R) ^' KNot a real method of detection, but a good way to know if SoftICE is
% r! H6 i6 n& f: zinstalled on a computer and to locate its installation directory.
3 J# @0 F" n3 u$ R/ g7 t, [/ yIt is used by few softs which access the following registry keys (usually #2) :
; E0 g- t9 _" t* t# ^0 S
# i7 ~( N% Z9 I8 t) P-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion. \. N, F; B. Z: c! Y
\Uninstall\SoftICE; o) R# W& t2 g) P: w/ c
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
: ]5 X. t$ B4 H2 I( u-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
7 ]( l6 p0 G  f1 W& }8 ~  }, k\App Paths\Loader32.Exe) g0 @0 {* C( D. c. M

$ w1 s  Z8 o7 b( Z) q
  Z/ _* ~/ A7 g* |' O  ]Note that some nasty apps could then erase all files from SoftICE directory
$ w! H: r& U7 r4 V4 u3 J8 f+ L" S3 }(I faced that once :-(
5 i! j) i4 _7 D0 v: f2 V( ]  V6 C
Useful breakpoint to detect it:( j( Q7 V- }% T/ c3 N  I! V4 n7 D
  b4 l$ m  l+ }: N& R. B5 ~
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'5 F3 t3 O/ l3 g1 A4 C0 t: r

$ S; n9 |. n3 i3 u1 W( g__________________________________________________________________________* X9 R4 V" E& {) }( K5 r6 |

( K3 Q$ A# o( C( o& g9 d
( d$ k3 n- q& m% z0 m7 TMethod 14
% a, v+ Y0 I- f1 T=========7 O. y. `1 x; L+ J: y

+ t! N* w* o/ h7 K7 V+ QA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose! h: h5 ?4 c3 `0 j1 ^6 G
is to determines whether a debugger is running on your system (ring0 only).
: F+ F5 q9 u/ [+ b" `3 c6 C8 \5 _2 h4 A7 ^4 W
   VMMCall Test_Debug_Installed. m% n; e4 m; b( ^/ U( M% ~0 o) A
   je      not_installed
. W" O% y* ^1 g. s
, D3 |- F0 V6 U: ?4 l8 d. W, CThis service just checks a flag.. W, M: \5 [  ~  v" D7 x8 G
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-8-4 09:26

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表