找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
! v9 w7 X. g" o/ ~  H<TBODY>
4 [& h! |2 n2 W! @! F) U, P5 R<TR>: [, ]( Y( [: j  b6 m
<TD><PRE>Method 01 7 n# s5 ?/ ?: X& w
=========
: j( p: y: y; R! a
0 K. F7 v) u) `4 a/ A6 o9 oThis method of detection of SoftICE (as well as the following one) is
4 {9 y7 S* A. ]( q% e4 c4 O6 g" F9 O: vused by the majority of packers/encryptors found on Internet., M6 `6 @1 I* ]: E6 z
It seeks the signature of BoundsChecker in SoftICE
; K6 i! `" Q1 y( v6 [
. V3 ~0 `2 m9 s. U* U/ [$ S    mov     ebp, 04243484Bh        ; 'BCHK'+ h, s; w% _. x
    mov     ax, 04h0 h' ~% c. e) h, J. n' G; b
    int     3      
. Q2 ^- a3 x$ [    cmp     al,45 `" z+ l7 g$ B4 g( Z( c3 @
    jnz     SoftICE_Detected( V5 C7 F* X" j8 R7 z

$ A' G% g0 f- v# s; n8 C- C___________________________________________________________________________. u+ G% c2 @1 S* V
7 L  ?0 d0 P5 v3 d
Method 02$ q* G* e& f+ }5 P# {
=========
; D" h5 c. J2 B- h
! j; {. k& ~1 MStill a method very much used (perhaps the most frequent one).  It is used
4 U7 f, \: _% z+ D! I6 fto get SoftICE 'Back Door commands' which gives infos on Breakpoints,3 [5 _/ N% e  `
or execute SoftICE commands...
# H" \, C( y4 n& o' z8 pIt is also used to crash SoftICE and to force it to execute any commands; [. j$ x2 {, U: G4 T
(HBOOT...) :-((  1 h6 Z0 z% B* F% m0 W. _  K" d0 Q( o
8 s) S& x7 {5 P6 Y$ Y- M" `# m6 ~
Here is a quick description:
& ]: R& E$ J0 |- {, `. c% W% G+ h- r-AX = 0910h   (Display string in SIce windows)3 q' b& C' }  {" B1 d
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)7 T9 N! C9 R9 e  [1 b
-AX = 0912h   (Get breakpoint infos)1 `9 z% s) U# V
-AX = 0913h   (Set Sice breakpoints)! d" z( \% {. l" {7 R
-AX = 0914h   (Remove SIce breakoints)
) j) s9 O' \! G, ~8 C& k% |2 E. D8 \8 T6 d. p
Each time you'll meet this trick, you'll see:7 l9 B& G) B  a8 v) ]" F
-SI = 4647h! N+ \" @, d/ w2 N. p
-DI = 4A4Dh7 L- |9 J  u. D- u. y, h" n; v
Which are the 'magic values' used by SoftIce.; U; x5 @, K" f  i" q
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.+ G; f  z0 W/ ~9 ^/ b

, {3 s6 d6 u" s8 U7 WHere is one example from the file "Haspinst.exe" which is the dongle HASP7 S1 C- E1 h* e" e' o& x
Envelope utility use to protect DOS applications:
  T8 }- O' o$ c# L
, V) Z% e  ^, M; D
% T6 K: `: J$ ?- b$ J" {5 m4C19:0095   MOV    AX,0911  ; execute command.
( x; A' }* L* L  M4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).6 |1 \: j& C: j' ?- M
4C19:009A   MOV    SI,4647  ; 1st magic value.( c" B" z1 s, C5 F  @
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.. w  h" P  o) b: C  @& V0 b2 B) Y6 n
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)1 f3 N1 M$ ]6 n3 s2 |
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute' h6 V+ \* q6 h7 Y
4C19:00A4   INC    CX
1 {1 C( E& v* m, E4 f9 Z9 A3 S4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
: n0 A  o+ \  ]& s) {4C19:00A8   JB     0095     ; 6 different commands.
- `1 a! J  Z; }  e3 k! z4C19:00AA   JMP    0002     ; Bad_Guy jmp back.% m8 }2 b  C6 Y# p/ x
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)5 L" k$ A& f4 M" y5 @6 `  k
5 h9 x2 V2 G# Z9 H' }# P. Y
The program will execute 6 different SIce commands located at ds:dx, which5 `2 e  Q4 d+ O
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.( x  I- r/ t1 m) E0 C

# ~# v( z  B" G" ?- f4 J* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.4 M3 ]) V" r( c6 k8 @3 X: c
___________________________________________________________________________7 s% ^4 n5 \5 V/ c* q% G. b3 ^
/ C, c; w6 W# c1 g, f

& a2 |$ _6 q8 G* A5 k7 \% gMethod 03/ x( O+ u6 R/ \+ \4 p
=========# `! s+ r. N( `
" k; S+ ?; e" S* {4 m' E8 ]+ r
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h3 x5 v( |" ?5 a! n' C5 E
(API Get entry point)) M& O. T+ D, C1 `! C- Q8 C
        
  Q1 k* F6 V& |" B% Y4 E; e
/ @" S7 t. p0 S/ Z% v  G    xor     di,di
# C" ]3 Z! O' t# d+ q    mov     es,di
2 f) A( r/ j" J0 M    mov     ax, 1684h      
1 p$ h5 m6 y  J" F/ i. W4 W    mov     bx, 0202h       ; VxD ID of winice- G: B2 V9 h5 L  K0 x$ a4 c
    int     2Fh# |% u# j9 Q& J3 X0 H
    mov     ax, es          ; ES:DI -&gt; VxD API entry point3 h: Z1 k/ q; A6 [
    add     ax, di
6 M* h) B4 n. o) t5 K    test    ax,ax7 b/ n( B" B, i; Y
    jnz     SoftICE_Detected& |, s* r' Z( P
& Z* q, U9 `' N* _
___________________________________________________________________________$ {) O4 ?, W) ]6 s

( {: E+ G: g, a! m/ QMethod 04
& M; A5 p( y! n+ o  u' L=========
) W! V6 K1 D5 b7 }8 _# t$ X% z! _) E* W& \# C4 z2 Q
Method identical to the preceding one except that it seeks the ID of SoftICE/ T1 Q- r7 |& O% f9 O
GFX VxD.
! ~! d6 t1 S1 e/ L2 C& }1 T1 f+ ?! |
    xor     di,di
$ ?2 T" W5 C; J$ Y    mov     es,di; m; [, u3 b5 O' m
    mov     ax, 1684h      
9 P- }5 k. L3 q+ r( G  K5 s    mov     bx, 7a5Fh       ; VxD ID of SIWVID
( Z! P+ {* ]4 S& k) ~! S; G! j6 j    int     2fh
# S/ |( G* o3 ^) m    mov     ax, es          ; ES:DI -&gt; VxD API entry point/ s7 |. B  E- D7 c
    add     ax, di
: g0 p: u, T9 X  L    test    ax,ax4 Z  }2 X1 k' D* u2 W
    jnz     SoftICE_Detected
6 l( j8 u8 g, ^$ Z# Y$ B3 C
" h' Z1 M' v8 A! b/ h__________________________________________________________________________# U  X- N2 g; J' i3 g
0 u+ \8 ~( ]5 V6 o# y: f# E

3 r2 I7 }" @' _  F6 n: u( mMethod 052 D1 i3 \" ~1 f. ^6 s. s! }
=========
' k. Y+ {7 e' u# L
0 P& O) o" |9 r$ N" z4 g- `9 PMethod seeking the 'magic number' 0F386h returned (in ax) by all system# A. i2 W- ?, W& e  p
debugger. It calls the int 41h, function 4Fh.. _5 t/ \1 @) j: A$ X- `. g
There are several alternatives.  
/ ?6 u3 K6 E: `- v
, ?" m$ v) O( sThe following one is the simplest:
- w+ J5 e; v; |2 ^% {+ x; H0 N
! e" f* P7 K/ h, ~- \1 e    mov     ax,4fh0 g1 T, a  B" G/ U8 A" T' T
    int     41h; t2 S; C# K: j
    cmp     ax, 0F386
1 Q# r: P. ]5 b8 C    jz      SoftICE_detected. \5 g* Y- B0 P) j* A" E2 V- i

0 e  P4 r; z, ^* S
9 @3 l" o% V; l$ l- TNext method as well as the following one are 2 examples from Stone's 9 _  W( a9 p5 A: |* }* j
"stn-wid.zip" (www.cracking.net):6 M! [% o, V& L0 w
& o. V+ m& N1 I7 N
    mov     bx, cs4 |! g1 E8 U' q5 d
    lea     dx, int41handler2% M2 u3 r3 J4 V7 {
    xchg    dx, es:[41h*4]
2 v0 X/ K5 q7 _5 M- D. e    xchg    bx, es:[41h*4+2]
$ v) a. p* A# F5 ]' K' f8 F& q    mov     ax,4fh- \6 k5 {$ ]0 |% H1 s
    int     41h
' ^) F! ]% p6 q% i2 v6 P8 p    xchg    dx, es:[41h*4]& Y) ]7 l9 e1 C% f! Z5 f0 G
    xchg    bx, es:[41h*4+2]
$ j/ d  U3 N/ r    cmp     ax, 0f386h
- K. a8 `. W0 l' i( P5 e& c( U    jz      SoftICE_detected
+ g! j6 ~* L% H, \7 r  c
( z* K) t! a! f, x# X. G! Vint41handler2 PROC( g. z" j3 e- O
    iret. ?2 T5 `+ h2 u* V5 ^  @) L
int41handler2 ENDP
  y6 T5 H# V+ h9 F5 X4 a3 n: p/ q8 h# K2 J

: ?8 z" U$ G# t5 o( m3 u( c! N: v7 s_________________________________________________________________________8 Y! s4 X3 ^4 b

" h" |" r" I9 T* l
" e  h: l/ N8 Q3 ?; jMethod 06
4 L6 ^, X4 Z7 M( B=========; w3 A2 C' @% P! F2 A

8 l0 S- H2 n. L7 H% ]" g) R$ y/ u5 H; F9 C! d
2nd method similar to the preceding one but more difficult to detect:6 ]# [: R# D6 I; k( P3 C0 v& d

! p* ~. c" h& C2 O3 z
& s, u" @( E9 n! R4 v" t' A0 iint41handler PROC
8 |) S& R' C- P: U" a    mov     cl,al
# z1 k3 v$ }' ?- l- F+ X1 m    iret, J4 k8 b* f$ K0 @7 |
int41handler ENDP3 v, _5 G$ Y+ }' R
. L- n; O0 y( j, K/ x

- F# x5 N) b; m8 \. _  y. t    xor     ax,ax
: }  J8 n: u4 e% @9 `) p; Y    mov     es,ax$ |0 R9 o! h- e7 j' ?+ h  p
    mov     bx, cs; U. u3 Z; j( Q3 d
    lea     dx, int41handler
* _: ^: g: Q2 G6 T. x    xchg    dx, es:[41h*4]
1 e" U2 I9 U' `3 e    xchg    bx, es:[41h*4+2]2 r6 r& X- f9 m) W4 ]" d0 d5 c
    in      al, 40h7 j! N$ O, `$ J4 W$ a2 T$ L* J
    xor     cx,cx& X. t& Z0 u( s* N# M2 w
    int     41h
; q: E, P; U8 `" x9 ^    xchg    dx, es:[41h*4]
1 M$ ~1 q0 b. L. U, i    xchg    bx, es:[41h*4+2]: v7 e$ i/ x' O: o7 q# B- @- A
    cmp     cl,al
9 b6 B+ S4 n# F0 s/ V" m4 _& N    jnz     SoftICE_detected/ H; a1 r' m3 ~9 X8 I

+ Z2 G' G6 `! r_________________________________________________________________________3 ]% a$ I# C) ]$ Y) v
: w+ ?: K$ s2 t  A- O' j& ]
Method 070 Z8 S5 t2 {% ]8 T: ]' o& R
=========
* l1 w0 c; d  n- P3 B- }
) z- Y# e$ I9 u: C6 S7 i* Z, GMethod of detection of the WinICE handler in the int68h (V86)7 T8 Q3 f9 _% ]8 L" ^. a
' ?" L3 G+ b, g, y$ v/ D
    mov     ah,43h
; |; g- F7 A% T  X    int     68h! q, |4 T0 J9 K; \7 J; k
    cmp     ax,0F386h
# w5 Q& v% a- t) V6 G    jz      SoftICE_Detected, t7 \& ~+ L# I8 F) j& W

* a2 }' h9 F* `6 @' _$ T4 J8 B1 U
: W% R% M( g+ j; t: d=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
# i( _5 q3 j8 ]" z   app like this:1 T: o+ d* d$ X- ^

9 \2 @9 R8 v7 F. u) g2 F   BPX exec_int if ax==68
3 n, y0 D" Q7 |7 }   (function called is located at byte ptr [ebp+1Dh] and client eip is/ j+ E: F, L3 @$ V7 r+ q9 ?
   located at [ebp+48h] for 32Bit apps)% d& V- _) K, D, c8 {, [0 a
__________________________________________________________________________& D' s5 `; |  Y9 u

% ~5 _( V. U( N  \7 g9 F0 C( G4 x! [2 c) V
Method 088 ?' }0 e0 ^8 w/ ^  [
=========
2 r6 \4 m( ?, |+ w- B  K
7 g0 m9 V6 m- A3 N8 c" aIt is not a method of detection of SoftICE but a possibility to crash the
+ C: J$ G" c9 u( Q8 S1 O" z) Lsystem by intercepting int 01h and int 03h and redirecting them to another- Z6 d) F; v" M) F+ M
routine.
5 o5 @. D+ y  |It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points5 V- k* o' f! G5 s% G7 z
to the new routine to execute (hangs computer...)
1 m: F7 t' d; t4 o: j
: i, E1 o, Q3 o/ n" \. P8 K, c, Y    mov     ah, 25h
7 l! g" W7 D* ^    mov     al, Int_Number (01h or 03h)
+ L% C! f' Z" F" ^$ X: F" I2 c    mov     dx, offset New_Int_Routine
9 E1 h  x' [5 O) s4 N    int     21h
. L" d8 o+ u- e+ T% S# ~$ e/ l
: M# I* c5 H* t6 ]7 S2 e__________________________________________________________________________
* q( {3 t* Y9 ]6 N5 |/ W, J0 h% o! f4 |  R
Method 091 W! B! g( S: N0 z2 W% @
=========2 E" Q; S8 Z# F; e% J" z# ?0 k
0 {+ \2 i+ t" [$ `8 G% e
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
7 }8 B" V3 Z: G* T2 X% S3 J# D3 qperformed in ring0 (VxD or a ring3 app using the VxdCall).
. f- `1 Y: \' y1 Q: T2 [9 c! uThe Get_DDB service is used to determine whether or not a VxD is installed
! m# c: `$ |# c( b! X, h* cfor the specified device and returns a Device Description Block (in ecx) for  Q1 X! h, p& j3 v, o# d$ I
that device if it is installed.
4 p: j% w4 r, V5 |' h/ B- S1 C$ M( S* E& x
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
6 l9 Z. ?6 g% o, N: p. W9 q   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)' }: I- K. u' O/ ]0 I
   VMMCall Get_DDB8 f- Z7 o5 L" `3 E  t
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed1 E6 l- s# R5 w) _1 e2 i' b! k: ^

. L7 ]* O' B" P, jNote as well that you can easily detect this method with SoftICE:6 ~8 L4 N( ?4 D, \; R2 R- |
   bpx Get_DDB if ax==0202 || ax==7a5fh
- `' ~; H/ H1 G5 B7 a( D* q7 @& J2 }9 h
__________________________________________________________________________6 H8 ~1 x' W: P) s/ X: @

3 X- c3 X( ], E$ J2 G% U1 B& OMethod 10+ N+ M: d, j, c( w$ s2 ^/ ^
=========
% f+ R: C) A5 Y" h: l
8 U4 c( U5 R7 X# m4 r6 a, k: G' |=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with6 G9 ?* b+ e3 n$ _( H1 i
  SoftICE while the option is enable!!
4 T+ q% {8 J( p7 `! v
& _0 D  l( U$ L; e3 D& |This trick is very efficient:6 q, ?( ]4 p: s, U1 r- h; Q) @- C
by checking the Debug Registers, you can detect if SoftICE is loaded
/ m5 }3 X/ e5 A2 s. t$ Z5 _(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if; E1 F2 K* ]4 X: E! b2 Y6 I
there are some memory breakpoints set (dr0 to dr3) simply by reading their
2 D  {$ p$ j* {6 i6 C" k# ^value (in ring0 only). Values can be manipulated and or changed as well
1 |! M# p- i% _: P2 \1 {- A$ e(clearing BPMs for instance)
: `! R: U$ p; i: l% ?! V' ?4 F( Q. z# X3 p! u) f' @
__________________________________________________________________________+ c" K. e5 X' G3 y: F
2 E8 ]9 \. o; z
Method 11
; d7 u6 y* {1 q; a# b7 ^2 u3 K=========. U2 n. R  H& w9 {

( V1 M) ?2 g2 u& JThis method is most known as 'MeltICE' because it has been freely distributed& g) t1 K" ^( u* c; |# }" C
via www.winfiles.com. However it was first used by NuMega people to allow: N- g  |# O) P9 V5 C! Z, j
Symbol Loader to check if SoftICE was active or not (the code is located. i4 J) q! S1 J) t& _. l. Y
inside nmtrans.dll).' }8 h5 n1 g9 |$ F9 [
. i. N3 A3 l$ B! \
The way it works is very simple:( b6 j0 Y3 c( w; X% ~0 f, h2 a
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
+ {8 @0 C2 j  o' {. Y8 bWinNT) with the CreateFileA API.
& k  }! F" v' Y; N7 s. {
8 ~& \: s$ Q$ G& B4 \Here is a sample (checking for 'SICE'):
- k4 y" }1 ]/ n
  j- l: ^. F, v( u4 ?BOOL IsSoftIce95Loaded(), O2 G8 q, W/ `0 N4 D# w
{
% N! ^' U/ ~* w4 z  s   HANDLE hFile;    }9 G6 y7 |" e& o
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
  Q7 r7 G* k8 P. u) r6 J) r. q                      FILE_SHARE_READ | FILE_SHARE_WRITE,
6 C; A( u. p8 I: y( @8 T1 ~/ m                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
5 a: C  X  `" g$ @9 [   if( hFile != INVALID_HANDLE_VALUE ); J7 b+ T) v7 v9 o% w& C3 k
   {( R0 y- ]) X9 m, h8 ~8 b
      CloseHandle(hFile);
# @! D1 s1 V/ v* O      return TRUE;  O: k' ?& \# i) X* K5 m
   }
6 u8 E5 J# N' p0 q2 c6 C' u   return FALSE;! A9 p: A0 g6 t( ^
}
3 _8 r6 Q; K& B8 O' q- R! p3 s3 R! E& I: _2 ?
Although this trick calls the CreateFileA function, don't even expect to be6 ^! z. O. T. A8 l, {4 \3 g
able to intercept it by installing a IFS hook: it will not work, no way!/ d: G, h6 f' t& e8 v
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
5 _  s3 ?9 h4 G7 L" k! Jservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)3 u  M' |, h6 @
and then browse the DDB list until it find the VxD and its DDB_Control_Proc7 I6 Y2 o" [( \" F" f
field.
  F) _4 ]! T2 y: g, QIn fact, its purpose is not to load/unload VxDs but only to send a : z% F7 f7 n9 V+ o: e1 |  V! |( y
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
) ~5 R) G" h) \! mto the VxD Control_Dispatch proc (how the hell a shareware soft could try
) @) |2 f# m% [$ k; d7 ~to load/unload a non-dynamically loadable driver such as SoftICE ;-).3 L; [8 e( t# p) d+ q
If the VxD is loaded, it will always clear eax and the Carry flag to allow
! Y% N$ R3 j1 v) t7 W/ _its handle to be opened and then, will be detected.1 a6 J0 `% _; {! \3 P! ]3 a& s, m
You can check that simply by hooking Winice.exe control proc entry point# s4 }$ V  M+ P
while running MeltICE.
( _1 X6 X) o5 D# L6 L4 @5 q4 }/ o$ d  S

/ l6 X  x" T6 g& N1 s+ ]  00401067:  push      00402025    ; \\.\SICE
: [3 @$ ]4 k8 p8 b% @  0040106C:  call      CreateFileA
- a7 }5 F5 i2 k5 \  00401071:  cmp       eax,-001& h; ~0 y7 Z3 x' i1 [
  00401074:  je        00401091' t8 {5 a3 {+ K& C
( k' ]$ z% H2 L& P, X* s
+ {( A2 x# L# x' @
There could be hundreds of BPX you could use to detect this trick.
( P* J& \" X, h-The most classical one is:. R+ q# A. c3 ~2 O, q/ W
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
+ j" M- M# h. S5 Y+ e0 S    *(esp-&gt;4+4)=='NTIC'* p& j0 e4 B* l" q% O& M: f1 I) f
; n! ^7 X2 {$ Z7 d- C: y
-The most exotic ones (could be very slooooow :-(
1 w* ?8 Z& v6 @" i  u# x7 P   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  % A9 j7 @; B7 a% S! G: X
     ;will break 3 times :-(% S- l- Z4 X4 B- p1 u; t0 z
$ ?( H/ r/ n4 [2 l' z. P. N3 g
-or (a bit) faster:
; [: G4 y$ s# k0 C, S   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
3 O# D+ ?( i" x  B  u( d& l) D4 A' K3 g2 Y& K& q; S" T
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
3 ~! n, f8 m" j3 D8 N7 p     ;will break 3 times :-(
- T! _. w' W5 Z- O7 ]+ U5 r) Y  c; z' t( ]7 F
-Much faster:. r/ U( p! o) j; f! I$ N2 ?( G
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
' X: O$ z1 d& D; v2 s' T8 B8 E" S6 q+ q) j% K
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen$ |, ^$ j8 \; c( g" Y: N
function to do the same job:; m! d0 ?  ]& F) f: H' T
# c3 Y! @# R/ m$ f# {% P, s
   push    00                        ; OF_READ# M+ r: A0 ?& r# q% @
   mov     eax,[00656634]            ; '\\.\SICE',0! {% U% p$ T! I6 s; v
   push    eax# t: l2 Q( r4 v, H3 ^/ }- R/ K
   call    KERNEL32!_lopen
, H4 {( J! p2 T' [$ @% l5 I   inc     eax
/ c: ^: I% V  U& }* w   jnz     00650589                  ; detected* d, q( O3 d/ `8 b+ t8 I7 B7 O
   push    00                        ; OF_READ
- V# T+ o8 ~& S$ ~7 \5 ~+ A4 [  s   mov     eax,[00656638]            ; '\\.\SICE'
5 H8 @! n! ]; Q   push    eax: Q0 ?: |, x8 y; h0 U' o0 q
   call    KERNEL32!_lopen) Y3 }5 ]' E: h+ `7 P5 U% E2 {  M
   inc     eax
; S3 }" Z* _  l, u* O/ n   jz      006505ae                  ; not detected: a7 c& Q) }# }) z8 G9 }3 `
4 e, n/ U9 i; O( Y/ K+ {

9 v+ u2 O# B- r- h0 H__________________________________________________________________________
" _% A3 d7 F9 @6 a
. P* z6 T: ]# r8 `' bMethod 12: `* @; J- [( w- ~! r$ J
=========
' T6 K% K2 M. ]- `9 y) G4 }% I. Y  G: M' l! S
This trick is similar to int41h/4fh Debugger installation check (code 05# ~, n/ A3 |7 t$ n" ]# M
&amp; 06) but very limited because it's only available for Win95/98 (not NT)$ R( U& J4 C0 F8 L: F' d& [1 T3 w
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.5 ?$ c/ n  Y# b6 H, V4 i. h
" |/ I9 N3 E, \
   push  0000004fh         ; function 4fh6 D) v) K" _0 V5 h0 |" ?
   push  002a002ah         ; high word specifies which VxD (VWIN32)+ q3 W- `9 Z# H2 [, v* i
                           ; low word specifies which service( m0 m" _* y2 G# b
                             (VWIN32_Int41Dispatch)
' b+ ~4 K$ W" P8 p( |$ S6 [8 ^, s! b   call  Kernel32!ORD_001  ; VxdCall( z- m" t0 I/ t" b
   cmp   ax, 0f386h        ; magic number returned by system debuggers- _( r5 g  a6 z$ D6 M
   jz    SoftICE_detected! t0 A- [" i. z! t. i

/ y3 t" U- I# |4 K0 xHere again, several ways to detect it:% G# s6 k; Q5 T
* ^) ?6 c6 _- S+ }! p3 _
    BPINT 41 if ax==4f' H' X# ^) u5 |" L# F
+ N: M7 b2 ~( i3 k( C
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one; c4 u4 X% }& k- N. X7 X

( _4 b5 q" _. B! |; c8 T3 {    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
+ D) t: t4 h/ m' U& [
" g  q- C9 G& j% a5 O$ x    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
8 Z2 p8 r8 X7 H  t1 |7 r
* t- m4 N' P2 _  K$ p__________________________________________________________________________
# V- O- M6 I2 w& h' O' i1 @
6 S* N$ Y) p4 G9 G+ W7 \9 wMethod 13! i2 q1 v: A: l0 c; a9 r
=========2 O# c* ~0 w* [& H/ ]9 `

7 F0 b0 u$ b; E1 M4 ANot a real method of detection, but a good way to know if SoftICE is4 j9 z7 W2 G3 q! J+ d# `
installed on a computer and to locate its installation directory.
3 S; @5 a% g/ _! Q  p4 b4 VIt is used by few softs which access the following registry keys (usually #2) :
, R$ D; d& h  C$ f0 |/ _8 }
3 T, n8 ^) Y4 e) b* q+ z( k2 `-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion. T5 |% K; X& J2 ^% E; s
\Uninstall\SoftICE7 o& p1 x3 m& U& n$ k5 L
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
3 r# j" E- }1 S7 h  R-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion5 g' |* u1 X3 b2 f6 }; S: v
\App Paths\Loader32.Exe
# [. h2 J8 R3 {( Y
" F2 T' \% E. G+ G  _" o. }% R& A/ l8 i6 u# J! p4 }
Note that some nasty apps could then erase all files from SoftICE directory
7 t' W& l" \. A; f" ~(I faced that once :-(* {" o- J2 J! f; l8 J; g
4 T: v  |( S5 l; A. @$ D
Useful breakpoint to detect it:
3 x7 n9 K+ M( v& z3 {  |$ d
/ e; d6 P. n6 m/ Q/ J     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
. O* J; B8 d1 E8 h6 H
, _- O3 c, C4 I- g! {2 D9 H, q6 ]__________________________________________________________________________% i# k) u8 c( x3 m" x! v  l
& d+ ~' ?5 L3 g* b7 y, @" Z* e# H6 f" t# Y
! U4 A% Z7 Z/ \  L5 |* w
Method 14 ) O5 `8 @7 H6 M7 ?$ z7 {) J3 Y
=========
* y2 E8 r: i( f) c0 J; F
' A3 A' a1 h5 Q$ o# ^' Z# {A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose- y1 G- u/ v; P
is to determines whether a debugger is running on your system (ring0 only).! L+ L2 O0 L' x8 z) T
( {4 p2 p; G: E: u) w3 _2 e3 o
   VMMCall Test_Debug_Installed
* u% M( X, _/ D% e( e& J9 d   je      not_installed6 o2 h) q9 D8 i
3 s& h- |7 m& o2 E8 A" S% P) Z
This service just checks a flag.
9 T9 V) F6 o: Z5 m- G</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-7-25 19:19

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表