About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
7 g6 ?, q+ t0 s% m+ p5 u<TBODY>6 v$ f' I' ]4 A. L5 N4 I
<TR>
. N5 I! U: h! R$ V) V' K<TD><PRE>Method 01
3 p9 X" u! W+ f- J=========: \4 x1 [2 R6 S; R
; G% _3 y8 X; {+ K6 Z0 o) z2 H
This method of detection of SoftICE (as well as the following one) is& E4 `& `0 N7 C) ]
used by the majority of packers/encryptors found on Internet.! Y& B$ P. E) l! S
It seeks the signature of BoundsChecker in SoftICE
3 A# w: {* r4 N7 t* b, D2 v6 c/ S* t$ A9 Z
    mov     ebp, 04243484Bh        ; 'BCHK'" p0 g% L4 h. O
    mov     ax, 04h
% _: b* G, H3 Y- g8 V- C. f. s/ C$ l/ N    int     3      
/ M! e2 Z3 k: K; Y1 E7 C    cmp     al,45 M4 C9 n5 ]9 M* j  {/ \4 s
    jnz     SoftICE_Detected
6 M% [) L( S9 s" D1 M5 G# T6 y! X: ]# M: U2 p7 S
___________________________________________________________________________
$ b5 m' x, f. m
, c5 l9 ?6 [: l, C$ IMethod 02
( v' g' Z% X9 }4 \# _=========
7 X; Y" l$ @8 L- R9 L3 B
# s) r: j( C$ t, {. h  \Still a method very much used (perhaps the most frequent one).  It is used5 |- m% r! q! a8 B1 q+ Z$ G
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,1 R( D; D+ G* C1 `7 A) ]
or execute SoftICE commands...
5 |4 f9 X3 G$ `- FIt is also used to crash SoftICE and to force it to execute any commands
% T. ?/ P, p# N" `(HBOOT...) :-((  + {% h  d. ~3 B# a  x3 O$ x

- Q8 f1 G  u# _4 s# Y8 [Here is a quick description:
- K1 h  W2 s: p) U-AX = 0910h   (Display string in SIce windows)
. y5 X# w, f* T8 y2 m6 P2 Z-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
" f* j' o7 D) |3 t2 p4 \: p-AX = 0912h   (Get breakpoint infos)! E2 p, l% F: `+ A) D
-AX = 0913h   (Set Sice breakpoints)/ J% j! u' [. k5 m* |8 m' X
-AX = 0914h   (Remove SIce breakoints)
0 S/ U6 b3 g! }3 y  x
! u$ d8 \) L- `# l- cEach time you'll meet this trick, you'll see:
7 I4 j' m+ p/ }-SI = 4647h
0 c0 h# K6 l! F7 |$ ~-DI = 4A4Dh2 J4 P! r5 G* T6 ], s
Which are the 'magic values' used by SoftIce.
' f- _# m0 E- g* g0 C7 \For more informations, see "Ralf Brown Interrupt list" chapter int 03h.3 \4 [8 S& b' u
) X' F  \9 K6 g, a$ l2 o
Here is one example from the file "Haspinst.exe" which is the dongle HASP
7 k) a" S6 Y& n2 M' rEnvelope utility use to protect DOS applications:- n( f' A/ a# i! B: Z% k+ T
/ |' ~5 a4 H1 h, Q

/ X! c9 k# A  t% ?# Y4C19:0095   MOV    AX,0911  ; execute command.
. {0 O) b" O4 R5 B) s1 ]3 A3 r4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).& R& k3 i( e8 D, C
4C19:009A   MOV    SI,4647  ; 1st magic value.0 M7 N. x. H4 J' @6 F
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
* u3 }3 B0 E; Q8 x) V4 J4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)  Z. |6 l. t9 j! ], ?1 m
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute# a7 B5 i. A( P, w0 n1 b
4C19:00A4   INC    CX2 D3 d( I$ U1 O5 X9 i& t' a! C9 O$ Q
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
6 _* i! @  H) J% l4C19:00A8   JB     0095     ; 6 different commands.
& i  C" X8 F3 a1 i# o3 f$ f! K4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
4 h$ q8 w$ X2 |7 c/ f4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
( D% C# c- @2 _9 W1 f' J& n9 {
The program will execute 6 different SIce commands located at ds:dx, which
( H" N. m5 ?* S" Z7 }) _* sare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.0 N3 z0 p6 E# n9 l' s; v2 p

3 ~- L; u5 F8 n* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
. b0 n: ]9 e$ h; z& u- C___________________________________________________________________________
& r7 m5 _9 p8 `* t1 S* m
7 [4 ~) X3 q% l" M. N6 Q6 l, z
3 q7 u/ y, Q5 z# r, F8 Q' BMethod 03
+ r" {) G, M( i=========# s  u  T, k: [  n) @

: S9 H, P: H+ v% e0 rLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h! |) ?, D" u* I6 L: T
(API Get entry point), {: V* p4 F6 V4 O+ E# S
        
# Q/ n# P( }! \! k+ H
" ~- \/ L* ], G, A% p3 q2 O    xor     di,di
0 h8 B$ z) D7 b( ]. t! Y. t8 v7 z    mov     es,di
: ^0 i- U  G" b: @* C1 V: z    mov     ax, 1684h       9 N5 t' Y7 q0 q9 w( X1 ?9 {
    mov     bx, 0202h       ; VxD ID of winice( s! b  s( E( }
    int     2Fh
* K/ X0 y" V. b7 }4 S5 v- T6 g7 q3 H    mov     ax, es          ; ES:DI -&gt; VxD API entry point
. L% n- `8 d6 ]6 c  R    add     ax, di( ~  F* W. F8 h0 x1 {! @
    test    ax,ax# i! T  \" a4 b4 @/ ?9 ^/ t6 l* U9 m
    jnz     SoftICE_Detected
* B7 b0 q$ I. P* f  I( T- U6 y1 |# f1 s! }
___________________________________________________________________________
; L# P0 }  T, d4 W# r/ W4 n% S" i+ Y$ K" O- c
; \+ |3 P' ]# q, z' m3 tMethod 04
" u6 d: N8 [: L: n$ w=========5 }% b; A4 o! C" Z

+ D& J+ H- J) k; j, |6 f+ iMethod identical to the preceding one except that it seeks the ID of SoftICE
5 z/ U0 U8 ]8 MGFX VxD.
/ c+ k6 ?1 s4 H; g- D! D- Q
2 @9 k, Q0 n9 E$ v' m! N+ V( y    xor     di,di
& g! b& y. l' r    mov     es,di
. R- y: G( M& T2 C    mov     ax, 1684h       # `3 ]8 A: \, C4 B
    mov     bx, 7a5Fh       ; VxD ID of SIWVID" \3 P+ e6 D0 p9 B
    int     2fh
! b) y0 @8 K/ b# o8 T    mov     ax, es          ; ES:DI -&gt; VxD API entry point/ ?: V8 I& o7 b3 _& y# y
    add     ax, di
. R. P3 l4 J$ _- I    test    ax,ax9 D+ |% K' {5 G7 N1 j( W/ z
    jnz     SoftICE_Detected3 u& E& f. p/ K. l% ^$ U
4 P7 y7 w( S7 S" m: h/ b
__________________________________________________________________________
" L: T& |/ M# i0 F- o: x8 c8 P4 G. w$ a7 s5 @: ?/ J2 `& B
# i5 |% f6 g8 @, G
Method 05; F) @$ T; a4 E4 H9 z( i; i
=========
5 ]3 D9 |' B4 i- Y
* `* t0 i& m+ ^( e, iMethod seeking the 'magic number' 0F386h returned (in ax) by all system
& V3 {/ ^2 o8 cdebugger. It calls the int 41h, function 4Fh./ V- H" j  [' z4 z: F; i6 W* `
There are several alternatives.  7 y  c9 p3 c# p

) b0 M, I; f# C' {# o" w& nThe following one is the simplest:: g6 g; W8 g. S" I

2 i* i# ^. ?$ P. q0 w0 p  }# ?    mov     ax,4fh
9 G+ v! ?. i( Q* g) e    int     41h
9 D' `- x6 y7 P4 F: u# z* [- A    cmp     ax, 0F386
  W4 ~1 C% h/ H$ z8 T    jz      SoftICE_detected. v& H9 v# e3 }. f% m
* \$ b9 b; t& u# O3 `: m$ r: e$ k

( x! ]5 G' l  FNext method as well as the following one are 2 examples from Stone's
8 K" c2 w5 y$ }7 ^, x2 d# c"stn-wid.zip" (www.cracking.net):
; |4 ^; h* k( O7 G: n( u
5 m- x0 g2 s& M: l; U    mov     bx, cs
+ r$ s" ^% [" B: X0 _$ b. v    lea     dx, int41handler2
) c. b8 y$ `7 ?3 o, D' I" n    xchg    dx, es:[41h*4], }5 a9 }2 `5 j6 g0 l$ G9 R+ f
    xchg    bx, es:[41h*4+2]
) j- W+ n5 u& N& ^" A* L    mov     ax,4fh! p" Q; Y$ _8 D. ]
    int     41h
/ L0 B9 S1 v# b* l7 z    xchg    dx, es:[41h*4]
# {9 I) B4 _! Z9 c1 a4 g    xchg    bx, es:[41h*4+2]
0 U/ m1 ^+ s2 {6 a( ]% ~2 I0 ~" W    cmp     ax, 0f386h
) h# U! j) A! K& `( P    jz      SoftICE_detected
8 C( |6 `) M; n2 P7 O
( q; J, I  a  Mint41handler2 PROC
& }; c) K' @  v" R$ @, \+ ?, M    iret/ }2 i9 ?( j. ^' n, _. Y' d
int41handler2 ENDP$ K/ @7 u+ b$ p; f3 Z: V& i( L" k  h

+ y+ K: f! L. i& B' E7 \$ B0 U- r7 C4 c& R# l9 H5 P: Q
_________________________________________________________________________
* u( t/ a. k6 n1 H. \! f6 L# Z2 j1 i+ K5 ?; ?# N0 B) Y: ]

7 L* U# b; x, p) OMethod 06
- w2 V) a! @3 S1 |+ e* Q" u=========3 M- z8 e( i6 \

& x1 ^8 D" W  i' |9 H" Y) j# k, t& h# j" s# `5 @5 O( u
2nd method similar to the preceding one but more difficult to detect:5 F$ O- L  J' X, A, g
8 y5 k- l. l& ^4 a
+ \; c% b3 c; x
int41handler PROC
- g+ o* C7 M8 f- w/ {6 F2 J, U    mov     cl,al
- Y' o: z) ]1 k% g* t' d" C    iret
7 G. i! J* Y3 ?( H; R* j- a- aint41handler ENDP6 k0 a- `" ?: G1 d
: e0 W8 J9 {. p% M, @

! ?- y5 V: ~* U# ?- t2 q, }    xor     ax,ax* t3 m: o9 Z. E, y, W2 `% a
    mov     es,ax
  z% z0 ?! |, l    mov     bx, cs5 v1 L0 _7 a5 }6 }3 p7 G
    lea     dx, int41handler5 W" z* N- r+ a, S9 J  C
    xchg    dx, es:[41h*4]# l. ~# ~& r( }% h+ E/ @* [
    xchg    bx, es:[41h*4+2]; p$ P6 Z( ~1 i4 n
    in      al, 40h2 x; a1 H3 ?* s
    xor     cx,cx" }! x5 K2 e: n! E/ O4 `# X% M6 [
    int     41h$ X. Y( {  R- ~* ]8 m9 t
    xchg    dx, es:[41h*4]
+ R% d! h8 V4 @- o! _$ G    xchg    bx, es:[41h*4+2]# m; _; r$ O! k6 Z
    cmp     cl,al
* r- {3 z6 j( X4 O    jnz     SoftICE_detected
, r* S& S, h1 G, e
9 R' D. q4 A8 H9 m_________________________________________________________________________
$ I0 `& m2 H- a# [, i+ g
. X" F+ l# G  aMethod 073 j# p2 L- l0 U. p; E0 C% {, P7 l
=========
$ k4 x: G! ^6 B# C! u8 N- p9 U6 c  n' d# V
Method of detection of the WinICE handler in the int68h (V86)
& Y- P+ ?  y& F- r7 V) D7 r- m; c! |& K7 a+ _3 d
    mov     ah,43h
. M5 P$ h: Y- `3 |  J. |( f1 o    int     68h; u8 n" m# s6 Z- s& {1 d
    cmp     ax,0F386h
/ V$ F+ E- V7 ^; T; I    jz      SoftICE_Detected; S+ I3 d- g' j) F3 U( D

/ w* k! O4 @& `. m) u, U6 z
# i3 s+ j- X' g; e8 `+ Z' k2 T=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit7 o- w1 T5 G. c+ i/ G: p9 c* g/ V; s
   app like this:
: K8 I4 b5 }8 X6 \) A1 [! a/ o7 W0 i0 u& j
   BPX exec_int if ax==68. u" W6 _, A. p
   (function called is located at byte ptr [ebp+1Dh] and client eip is0 z0 c9 L% ]/ W2 ~% A" k8 |
   located at [ebp+48h] for 32Bit apps)6 A3 w7 ]1 x! l: m
__________________________________________________________________________. n- h8 k; R+ [! b0 L$ ^

3 _6 P7 W: O" U: ]
/ S; W9 K% V  G  V" |. LMethod 087 p$ e3 n/ F* J4 @' ~- ^5 f
=========3 P" [, q; O5 X+ i+ |- W4 A

0 [4 ~" C1 K2 F. QIt is not a method of detection of SoftICE but a possibility to crash the+ |) ~  j+ a/ Y2 K9 a
system by intercepting int 01h and int 03h and redirecting them to another% ]( @0 @2 ?8 J0 B
routine.
+ O7 H5 L6 A/ y& r# S! XIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points: H! M% y0 C2 k" Z4 a" m( X
to the new routine to execute (hangs computer...), n, C' K5 o- ^( T* S# d  e

5 e& Y- g5 p/ i+ y  E: {5 ^    mov     ah, 25h- Y7 ~9 g" {1 s; b6 r) N9 Z
    mov     al, Int_Number (01h or 03h): u. Q" ^8 i, U2 R4 r, k* z; C
    mov     dx, offset New_Int_Routine
" _' Y  `7 ^0 s: M    int     21h
9 ?4 j8 L* Q/ g) T  {. |7 L" I- |' t5 J8 B* D" N8 {
__________________________________________________________________________
) R5 B- H  w7 o7 }, C3 _/ b) K/ {# x
Method 09! _" W+ j6 ]3 Q( T0 W& x, K* A
=========& \9 r/ C" Z1 ~3 j! Z- m
8 ~7 A# t+ k  w) |8 W
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
8 m8 p+ r) t. Q# {2 aperformed in ring0 (VxD or a ring3 app using the VxdCall).5 Q7 q' ?# Q- S" e: c
The Get_DDB service is used to determine whether or not a VxD is installed! \# e3 N2 F" g# K' O: B( |
for the specified device and returns a Device Description Block (in ecx) for
8 @; ~3 v4 _% V4 y% Xthat device if it is installed.* e& _5 K. n! n8 @5 F6 L9 p5 _0 q  S

8 U  T+ [9 H! H- E; g   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID7 h& S- `5 C" C* T
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
6 L) O& G3 r1 |+ U% D" E7 S   VMMCall Get_DDB
  w0 h5 h& B$ x/ P3 X  @0 @4 S- K   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
5 b5 S+ q& {- H0 Q4 \6 J2 W
3 h( H# o4 ~1 s7 lNote as well that you can easily detect this method with SoftICE:
3 w9 T* i" I5 ~   bpx Get_DDB if ax==0202 || ax==7a5fh
* @, d$ N8 o( P# S- f# A5 e4 V' _
& H2 o2 P: ]& y) l- _) x. g__________________________________________________________________________" N+ k  N" g! _3 m9 ]

1 K  q. w" b7 m( oMethod 10
8 k, |: J6 }' t  f: s$ u=========' Q" A; X/ f" V7 l- w# ^6 Y: I
! N1 Z- O7 l( [1 [, U  U
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
7 U: e7 I3 t) m7 }, D8 Q9 a9 t" Z, L  SoftICE while the option is enable!!0 m3 n. d& e- m% J0 c% a4 t# J
( F  ~. s$ J1 B7 [. K$ Y% j9 a3 B& `/ g
This trick is very efficient:
4 H* I& B# s8 B% uby checking the Debug Registers, you can detect if SoftICE is loaded7 H6 B+ i! r" ~& g
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if4 H: ]- X2 `5 f1 c
there are some memory breakpoints set (dr0 to dr3) simply by reading their4 S0 z* N% X# L2 z; Q2 o; E2 b
value (in ring0 only). Values can be manipulated and or changed as well
" E; q1 l7 l2 j- v- i( ~(clearing BPMs for instance)2 i$ {' J7 @: F. ^' m* {

" }5 X6 H! G3 B; ~* u__________________________________________________________________________
3 ?8 G- e4 T8 i# U; ?
( i5 H; Z/ Y8 C6 `. m; ]Method 11
7 W2 B7 h6 F: T- B/ _=========7 l8 z, m5 p$ j# u2 s7 t
) T( h8 Q* D) q. l3 C& i
This method is most known as 'MeltICE' because it has been freely distributed0 ^$ U8 Z8 H1 Q% I% N( L6 L6 A2 h) t
via www.winfiles.com. However it was first used by NuMega people to allow
+ }6 X+ E. ]0 U1 Q% w9 X, DSymbol Loader to check if SoftICE was active or not (the code is located) O) `! I! |6 A
inside nmtrans.dll).& B/ h! j2 B, v
7 }) X' s3 z# i, ]5 e' _- j
The way it works is very simple:! Q. u: g  u" W* K  S
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for5 a/ L2 g; X6 H# d6 t) z7 f  h' j
WinNT) with the CreateFileA API.# L9 o2 k/ q9 B0 o2 D4 f/ S4 r

6 @+ ^( f5 R& O! Q8 U) [Here is a sample (checking for 'SICE'):
+ {( f  y% f! B3 q. ~
0 s, C  n+ R4 |1 z6 v3 y7 n5 r+ q" ZBOOL IsSoftIce95Loaded()! f1 `% G" ]. k4 l( y" q. s0 x6 ^0 H& r
{! W' V# e  ^8 w/ w  ]2 E) U
   HANDLE hFile;  
$ R* u" z* c! J: u( u* g   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,/ m/ [5 T. U: _2 L3 ]- k; ]& [* S
                      FILE_SHARE_READ | FILE_SHARE_WRITE,
* t" H- ~8 Q5 N                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
! x4 |! T+ M- s% I$ {5 O   if( hFile != INVALID_HANDLE_VALUE )- o" u! q* n* M0 F
   {
3 N' P: j4 j: G3 G3 _      CloseHandle(hFile);
. ]2 B# [% R/ {/ I      return TRUE;5 e. x4 W- d: q. M
   }5 B0 x5 v: x0 X% B9 y
   return FALSE;
3 Z7 a% q0 B( y}0 a" r/ ]4 h4 u3 k0 {' T+ y5 I* o# D( y
* G) T0 ?( D; i  g
Although this trick calls the CreateFileA function, don't even expect to be+ P, w7 T" V8 _. H
able to intercept it by installing a IFS hook: it will not work, no way!
& Y! {/ f; `. Y  m6 o, H" {  fIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
. j1 s/ h) Q* [1 u. yservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)9 v+ w) L7 K& H* \; H2 I: d  |
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
2 A8 I: z8 e6 t0 i7 sfield.4 A0 H& U- I1 R+ x, m8 {: Q0 w: h7 l
In fact, its purpose is not to load/unload VxDs but only to send a
0 Z0 l; R4 C# V7 U1 HW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
7 e2 m- w) o3 j3 ito the VxD Control_Dispatch proc (how the hell a shareware soft could try
/ M: q' E, A. I& _9 wto load/unload a non-dynamically loadable driver such as SoftICE ;-).
/ z6 Z. E: i$ ?& S5 {If the VxD is loaded, it will always clear eax and the Carry flag to allow
! ^  d+ ]/ p' T  U: [) [its handle to be opened and then, will be detected.. W) a+ f% n/ }0 m, y  B# r# D3 }9 ?
You can check that simply by hooking Winice.exe control proc entry point
  {) i, O) c6 O0 U( n' uwhile running MeltICE.8 Q$ }8 }8 C# ?; y6 j
+ }, \% D4 ]; u

1 ^0 L! z$ Q( A; O/ R. ?$ n  00401067:  push      00402025    ; \\.\SICE
8 B( w. v5 @7 k$ E0 ~  0040106C:  call      CreateFileA
: l3 I! w9 H# p8 H* S  00401071:  cmp       eax,-001* B' Y! }: {$ l% n! C
  00401074:  je        004010911 ]7 k  S/ N6 ]- @/ V; M. p

; e! n, L- u3 B! N; z" W
5 D$ \& \8 [, e2 {0 ~3 \There could be hundreds of BPX you could use to detect this trick.
( u. b! W6 e, }6 e-The most classical one is:; ]5 s8 w5 V) _' w2 R! ?
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
6 U9 |0 u9 A/ S9 Q: R% w  n    *(esp-&gt;4+4)=='NTIC'
8 |( W. h' q* o5 @% K: w2 w: l
5 t  l8 H4 l; K) L% B4 @2 ^-The most exotic ones (could be very slooooow :-(% Z' n+ p+ f' Y, S* I
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  - M. O* X- Y" R2 f  I3 C
     ;will break 3 times :-(/ Y9 c- `4 @& I; O9 J

5 c7 S0 q. J) N4 b/ j# @-or (a bit) faster: # F0 x* {* \% J" e/ R
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
/ J3 {" p, ^/ u0 A1 X5 r0 C& Z& b/ X/ h/ m
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
. q& \8 [: Z2 V9 Z     ;will break 3 times :-(" E$ T( E" ~' _* R
( W7 e( M4 w3 m& D7 Q. L' w
-Much faster:% @' J" E$ S- y) m# w9 w! S+ ?- D% l/ k
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
& _' L# a9 L3 ]3 ^+ j. J* n, V% J8 J/ _( i
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
$ m8 Z2 ^: R7 p2 I6 Cfunction to do the same job:/ |8 m4 C- n+ }7 R+ K/ p
8 c. |" I/ b2 f  d- p4 x
   push    00                        ; OF_READ' Y+ @" w, b: f
   mov     eax,[00656634]            ; '\\.\SICE',0
+ m- g0 w2 @4 @  x3 m   push    eax
- s1 u2 a2 q  A6 g- i   call    KERNEL32!_lopen% }: }0 F) V( {) \6 M9 g2 N% ~
   inc     eax
( n/ h% e9 a* i' x4 I$ G- G   jnz     00650589                  ; detected
. u5 U7 h" ]; n9 `9 u2 q7 r* D   push    00                        ; OF_READ  D& l$ b, P+ Y, A
   mov     eax,[00656638]            ; '\\.\SICE'
# i% l6 M( G0 }3 \' ~   push    eax
3 q2 Y1 Q" x5 C! i0 r% O9 T   call    KERNEL32!_lopen
( P# X0 k. Y) ]! p+ e+ E: k   inc     eax& d# q) K8 B) G0 e, C0 X
   jz      006505ae                  ; not detected
6 b9 }' s7 c5 P! i
3 J2 G2 b3 f. e) o9 N3 H% {+ |% l" B7 \
__________________________________________________________________________# q- h( j; f7 ^6 K3 J* I
: n0 w1 u% Z( j7 _; l7 g% `
Method 12( Y! `) x1 Y# |& T& l
=========
, X+ W% C, K; Y2 n3 l, t7 `. t9 R7 r. G! ?
This trick is similar to int41h/4fh Debugger installation check (code 05" R# R, |8 p1 f0 ~% t% Y  q; ]  h
&amp; 06) but very limited because it's only available for Win95/98 (not NT), k2 L* o% y% P/ q
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.: n; U) m5 k8 g
! A3 v5 }4 `# l! y! W7 H; L
   push  0000004fh         ; function 4fh
9 M2 y) w0 N7 E  S" ]5 u   push  002a002ah         ; high word specifies which VxD (VWIN32)* A% H2 Z0 d- |7 M, h( ?" \1 Q
                           ; low word specifies which service' D( x! A; @9 l, H
                             (VWIN32_Int41Dispatch)2 l6 d  e$ [. Z3 C; S1 ^
   call  Kernel32!ORD_001  ; VxdCall
3 X( n# g) P+ U6 A0 n7 N  |4 T   cmp   ax, 0f386h        ; magic number returned by system debuggers7 _; B8 |8 l! y  f; p* G, G
   jz    SoftICE_detected
. G. T6 ^" O, n& }9 F7 \- a, T0 p) Y% f; @
Here again, several ways to detect it:( ?3 {* c8 |  h$ i/ @$ D9 {

' e/ p8 T+ a  \  a    BPINT 41 if ax==4f
5 @! E5 M4 O0 L! U, K; N8 o6 U& o' y0 _6 {0 M* R+ c& e
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
5 }) b; {+ k3 v. i3 d# Z( i9 K% B% H' l: f
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A# u/ B5 f& Z/ L) Z0 F9 _3 Q) F
, g0 r' ~* F% V
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!$ l# g: G& M+ J7 r1 D5 z; T
+ q- n2 l* O% P$ T: |
__________________________________________________________________________
2 f  `+ k4 c# O7 X, B" Y  r
  G$ p  w" r+ zMethod 13
3 i, d" e( z) F=========/ b/ \7 F/ G$ R$ {; I: u7 H
3 L! H5 v& c9 U5 a( b/ i+ P* M
Not a real method of detection, but a good way to know if SoftICE is, _; p. `  ^! K+ [, v: r! Z
installed on a computer and to locate its installation directory.4 _8 z6 N% S) @  N/ c
It is used by few softs which access the following registry keys (usually #2) :& W  M  M; p6 l1 q

* S. M$ m" w0 @6 ~9 T-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
/ A, z0 F4 y0 s# `+ M9 n4 i\Uninstall\SoftICE; X7 L9 x7 N% p6 _. ]/ B: ]
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
1 B9 o. R$ G6 @' M/ C, |-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion! E- @$ I5 R" I* N% Z+ @# x
\App Paths\Loader32.Exe7 _$ H: O& b% {, k
+ V# j8 b4 j' t4 \7 y/ i

3 z* K. _+ m' Q0 g8 n) xNote that some nasty apps could then erase all files from SoftICE directory. X+ R$ G, C0 u7 J
(I faced that once :-(# @$ e" e+ C1 \# k
  w! U% l- `2 V: M: b$ i' X
Useful breakpoint to detect it:
! b2 X( m/ E- ^1 s" P5 u; N* n( g* x/ y1 g, @% g, e, V% A
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
1 I8 q/ Q& i3 y$ |+ o+ e
, Y8 H" t8 d$ r- h5 E. L3 v4 C* U__________________________________________________________________________, v7 M! f2 a6 W* ], s8 G

$ t4 C- R$ t% k) N7 X% T7 @3 r" N% [; j  r, I+ N
Method 14 : x2 K+ W6 O6 d0 f) O
=========
& b& e7 W' O! J- E& Y0 Z4 J9 r/ u1 F) t, \( h2 W
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose1 }& T  E8 S3 x' H4 X" H% E! [
is to determines whether a debugger is running on your system (ring0 only).
" Y( a+ w" l; h  P' e/ K
/ S" r" I3 \2 ?- t$ p6 q   VMMCall Test_Debug_Installed# V, P7 c/ m7 H) G8 D3 |/ o  x' B
   je      not_installed
" ?1 W# S7 [: b
! L7 t" p: z9 T8 e. X5 JThis service just checks a flag.0 s4 i4 \( Q$ r
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部