找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
! |) {% v/ D, @; D, l<TBODY>
$ e5 P; q/ N6 Z<TR>
1 \6 R# U7 n! \4 }  e/ G+ z<TD><PRE>Method 01 * e5 Y/ j- q/ W. M% h$ a
=========
$ t" E$ L+ t( w9 k. n
& @" r- V: v6 p4 y, D7 }This method of detection of SoftICE (as well as the following one) is
# W% i8 z% Q' s' u$ rused by the majority of packers/encryptors found on Internet.' j4 z+ b# k& o: L  w
It seeks the signature of BoundsChecker in SoftICE; z. p6 W( M7 P
5 w/ ?) s& n, i! K$ R+ z* ?
    mov     ebp, 04243484Bh        ; 'BCHK'
; S! P1 V/ E& ~8 w9 v! y3 i1 }7 t- u    mov     ax, 04h( N/ O5 E; p; N6 x  x
    int     3      
( n# i+ J: ~& N  Q. O3 p    cmp     al,4/ f/ O" ~4 {' I0 L
    jnz     SoftICE_Detected; W2 |+ u% i  b2 T  L& n+ l

) _% V$ c2 ^; g  G___________________________________________________________________________
/ ^5 N( k' f; k5 f: P5 s& o9 D5 Y/ Y6 ]
Method 02
8 W% {& n  E$ F=========# s: W! h% T! K
3 J. ]* G0 A8 \+ y
Still a method very much used (perhaps the most frequent one).  It is used* P+ E* n: S7 X8 a+ A
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,7 h# Q; W. T3 D* W: B
or execute SoftICE commands.../ F. `; h2 t: b5 c9 M
It is also used to crash SoftICE and to force it to execute any commands0 H4 k! i& r6 E5 U# b
(HBOOT...) :-((  + ?1 k$ z  f3 [# ^1 e

( w# G8 U' v0 r4 f1 bHere is a quick description:
1 ?3 Q  V: m4 I-AX = 0910h   (Display string in SIce windows)6 a* T  b+ X: w1 ^9 O- Q# D
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)7 c4 J% ~( J0 S3 ~0 p9 t
-AX = 0912h   (Get breakpoint infos): @% O+ R, s  }7 P& U7 _
-AX = 0913h   (Set Sice breakpoints)
: ]$ l  P0 L1 B% _3 a/ s3 c$ ?-AX = 0914h   (Remove SIce breakoints)
* x6 d5 q9 M. _0 O1 d* G7 E" x+ c* c4 O5 I" l' w5 d8 h
Each time you'll meet this trick, you'll see:4 a8 y- A$ U3 V) ~. q9 C
-SI = 4647h
9 [: ^8 p1 N0 d0 S-DI = 4A4Dh
- {( [% q) s! m/ e* G" }# kWhich are the 'magic values' used by SoftIce.( w& f6 m# o$ }9 m4 G
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.) [; J; N; s- ^4 o1 A0 F& f) K

2 r4 u1 y, _* a1 D4 W; u+ hHere is one example from the file "Haspinst.exe" which is the dongle HASP3 k7 q, }' s! u! R0 r% ]% m
Envelope utility use to protect DOS applications:
9 g( h4 H' r4 H  @9 z0 e
8 f9 I9 d- z* {4 Q% x: z4 x: C2 X% w& g& G4 p" v
4C19:0095   MOV    AX,0911  ; execute command.
' O) ^0 @" @! Y6 d/ Q4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
, s# S# n2 F2 e  V6 G# o4C19:009A   MOV    SI,4647  ; 1st magic value.
) c$ p9 {: q$ C# T8 Q4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
2 g% |1 R3 W/ ^+ A( U* U4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)3 M& {4 J2 Y5 M3 B9 A& j* M
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute$ G  L" [( p% s9 e
4C19:00A4   INC    CX) d) l  W/ n6 L
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute4 ]; }/ i4 R+ j% `, h: ]: T& E
4C19:00A8   JB     0095     ; 6 different commands.$ Q) K7 u' ^3 R- H
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.3 C5 k8 D4 e1 Y* F' D9 a' {
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)* d& l& n$ T7 T) g9 a1 l7 s$ y& b- @
9 H1 X' `* O# [6 E0 h4 _
The program will execute 6 different SIce commands located at ds:dx, which
: R+ K2 B- W: Care: LDT, IDT, GDT, TSS, RS, and ...HBOOT./ }& n, h$ m0 e2 n, X- l/ e

1 T, [- I5 D/ v* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.* ?( j& q) J* a. K6 @$ V  ?$ r
___________________________________________________________________________
- i5 [& W; d8 J3 y% i2 Y# b
6 r1 J9 b& `6 b0 L. j: ?% r) ?9 M, ]
) A7 m! D; ]/ D+ T2 }' z, QMethod 03+ z2 n* ~& b/ Q4 S3 ^
=========) q% ]1 O& b- S1 Y

% l) D; ]- D6 _5 X; M" bLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
7 g. C  P/ l8 u  @$ f' Z(API Get entry point)
+ q6 @& k$ A# f' I- M        * ^1 b" y$ `- x4 K. R7 G# G: `

: b9 k3 y" F  K+ O: {& b    xor     di,di' z: ?" Z8 a. o4 a/ O& @/ ?% k
    mov     es,di5 Z9 V- [4 V9 x0 R" a& M% V
    mov     ax, 1684h      
5 y& F- R# r5 x! p: D( m2 R5 f    mov     bx, 0202h       ; VxD ID of winice0 e9 S$ A: P( |+ K, r' f
    int     2Fh
$ Z. h& _6 s' m' w0 v% i    mov     ax, es          ; ES:DI -&gt; VxD API entry point' p- I5 y" F" P
    add     ax, di
  t$ A6 N# L; [6 f' U6 ^) ?& n* K    test    ax,ax
; P0 V% i: r4 m  P  N8 s$ b) O    jnz     SoftICE_Detected# v' t) f0 C3 b* D* h7 F3 D
9 Y9 R  M0 R- u0 @. x, A, g
___________________________________________________________________________
" P/ f3 i+ d+ m# f) r' u7 U
  C0 J( q) e6 I( c( e' s3 H/ }0 p$ E7 UMethod 04
& J% r7 _# l2 G7 [" T' o=========
7 v, q% f/ n6 C& K$ u6 K" @9 P# F( a# Z3 o
Method identical to the preceding one except that it seeks the ID of SoftICE# L3 d. D4 N2 \7 N8 H7 B
GFX VxD.
& s& A3 M# |: F
0 f" n  z" T0 e1 h- X    xor     di,di9 J& J( d' b% k+ _8 i1 N9 M; J
    mov     es,di2 M# ^* V* C' ?5 M/ ^
    mov     ax, 1684h      
! k2 Q' {2 z! G* r+ I    mov     bx, 7a5Fh       ; VxD ID of SIWVID0 i2 U$ N- _6 ]. U) v: l, M: z2 W
    int     2fh) Z8 O6 a5 L+ ]) x
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
: L1 d" V) m1 y. C) m    add     ax, di
) V3 L* y! b& P: m: W    test    ax,ax0 u! m. e% h$ v- y% U7 I% u
    jnz     SoftICE_Detected
7 R$ T: V8 q( {, f+ ^' p& ~: L' z
. y( t$ E9 x( |; P0 N: J! q__________________________________________________________________________
! D8 ^7 Q/ i( I$ G7 Z2 \7 Q% i* ~0 ~/ t
- e/ f1 M9 j7 g6 O* D+ J
Method 05
; W( @1 i; B! d& U0 y=========) B! V0 w0 t/ S) [$ R6 g
3 d/ r5 H% ]" q/ ]
Method seeking the 'magic number' 0F386h returned (in ax) by all system9 a4 I$ ]- @/ U* ?, Z3 r5 M4 V, e, C
debugger. It calls the int 41h, function 4Fh.
# `( z* C: j! _, b0 `  f- OThere are several alternatives.  
, b- {4 ~; [* ?2 J. G! l# F& E! p- K
The following one is the simplest:
' Z. l( G9 }$ r, b
0 H# V  `9 t, ?0 x    mov     ax,4fh, E/ G& A: [" Z  f, h6 _. B3 x
    int     41h
: @3 ~9 e+ w* B3 h7 V: G4 W    cmp     ax, 0F386
6 i8 p, D5 N# G& z, `' A/ F6 i- C    jz      SoftICE_detected; I- M# x+ i; N4 N7 H/ |; o( j

& `' N- ?5 Z( o2 e2 G8 I1 \6 l' t2 [9 q6 Z7 v
Next method as well as the following one are 2 examples from Stone's % M3 _$ q4 k: G  E- ]  B0 f/ e) W" i
"stn-wid.zip" (www.cracking.net):
! y: U" S4 y2 ~7 i: H/ u2 }2 ?" O. \& y, J9 B* m6 j( g9 o
    mov     bx, cs% K! R/ R% y( B2 t
    lea     dx, int41handler2
! A4 J+ N; E7 ?  b6 q    xchg    dx, es:[41h*4]- m& X5 D' k0 P
    xchg    bx, es:[41h*4+2]
: g; e& a7 G6 I6 t    mov     ax,4fh9 @; k8 c# p5 ]+ A2 s" R/ T/ V
    int     41h
2 y: y* L& L* E/ f# W    xchg    dx, es:[41h*4]
% n: c+ G, q2 m: D" q/ K/ j    xchg    bx, es:[41h*4+2]0 ^! o' Y& ]* y  s/ w4 b3 z
    cmp     ax, 0f386h$ s1 T2 q8 r+ J0 S2 u2 f5 v/ R* }
    jz      SoftICE_detected
) K; E" b( [. s  k2 L
/ l4 [* w8 O& P. S  W. H, wint41handler2 PROC% C! D1 m  t; K0 B3 Q
    iret) g% v1 f; p" H# V: H" h+ b
int41handler2 ENDP3 ^* t# |$ k# G, V, D& S( g
" P5 e5 T% S7 r; @  r& x
: \' K+ _" N  H9 A$ L
_________________________________________________________________________# {# x. q2 j; r- J) g
# w4 u% D8 k+ J8 ]
$ v* c" q, X9 N
Method 06
0 e% D$ w. b  e( R: e$ M1 q2 F=========
- U( }, x0 L: t! M" d7 Q# F; f/ m5 o' ~, t/ q
) c, n1 ^/ [, S2 D3 x; B8 {$ s
2nd method similar to the preceding one but more difficult to detect:
; I. t  I) m3 E' z
1 `5 x9 r8 u6 \, v3 \" n
3 B& I. a% `3 v; H" C1 C) d4 B' Pint41handler PROC
3 C$ [: b! A+ b) M6 }% G, T5 Q    mov     cl,al: l: W' Y9 b! X
    iret
7 x# a8 S3 z' Y# [7 |& V# R: Uint41handler ENDP
9 D: i( U. ~5 `# r
& ?! ?3 u$ o, j8 W9 H# A) C. c& @- O9 c5 e: `8 p( e
    xor     ax,ax6 y6 C, E0 }0 N
    mov     es,ax( z# d. y1 p3 y
    mov     bx, cs
9 H/ b+ m$ {& D3 }    lea     dx, int41handler5 _2 t# s8 k7 ~# I. P4 _8 l
    xchg    dx, es:[41h*4]' I. t. w0 h: M/ b/ L0 `7 ~
    xchg    bx, es:[41h*4+2]
% |! {& E. @0 T. l" W" s    in      al, 40h
; Y2 I/ v& T8 c. d( V    xor     cx,cx
; w% T$ i: a# R+ `, x" `2 {    int     41h2 F; [5 S2 B! ?5 o1 w1 ~
    xchg    dx, es:[41h*4]
8 m8 o* Y' q5 M# Y    xchg    bx, es:[41h*4+2]
" N: k" S% a" F! k  z    cmp     cl,al
" y* X9 c6 |/ a# @# W: }    jnz     SoftICE_detected
. [- r- Q' w" {3 O3 u7 u0 R5 n
+ E; S: d4 Q; c3 X_________________________________________________________________________
! i& G, c: K$ q  K" Y
3 p1 \' N. a* V" \5 ZMethod 07( d$ o8 g& \4 ~2 w. N
=========2 X* m0 }; w4 B5 e

$ v; K& O8 |  F, P  WMethod of detection of the WinICE handler in the int68h (V86), I9 O* ?' U  A# [. k8 C' g
2 p9 ?. K' k2 Z# u  u. W( z
    mov     ah,43h( V' X8 j/ U# q$ O. d" y/ d
    int     68h
: J. q: s% L. U4 M# c  }* h    cmp     ax,0F386h9 F  |3 D# T/ u. e) G( U
    jz      SoftICE_Detected
( J8 x: q8 [9 g$ m# y( U, ~, j/ r/ o8 m. Y( v

5 x  t& A( `9 r. e=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit& |: A& O7 M4 m, _
   app like this:: [5 \1 N( O. \; J5 P
! R8 h1 m/ h4 l) _/ |% p& y
   BPX exec_int if ax==68
( \7 u; u$ y% l* ~   (function called is located at byte ptr [ebp+1Dh] and client eip is
- u: n" R+ d. v3 _   located at [ebp+48h] for 32Bit apps)1 a; y  U% @8 P% Y- ~2 U
__________________________________________________________________________* ]% D9 \, ~; \! N# R
* {8 S3 g0 ?2 j0 W8 x$ v. q
# @3 C5 M, k' f+ O9 D5 m( E2 z( [
Method 08
9 ^# _% W6 ?- S=========
1 L. q" S) ~) {1 _
% j! _- h+ Q: ^  Z  v. i, W- ]3 cIt is not a method of detection of SoftICE but a possibility to crash the
7 l2 V- y% U$ A7 X  psystem by intercepting int 01h and int 03h and redirecting them to another" c# K: Z* S5 u9 E
routine., g/ M+ j! C. k1 n$ n; u+ w1 z
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points# }. R5 x0 [/ a, y) E$ V
to the new routine to execute (hangs computer...)
, V6 d( k% Y/ t1 n- c. I' e% ]# Y" T) q/ {
    mov     ah, 25h
7 J% x0 f/ S3 O$ e    mov     al, Int_Number (01h or 03h)
, A7 M5 }. I: w0 l% G* N    mov     dx, offset New_Int_Routine8 Z7 z6 O) o6 j2 x
    int     21h. @1 M! G" U6 H# }4 u
. B* D0 O9 I$ X( n) e
__________________________________________________________________________
. @- D2 X0 V8 Q8 p/ Z. S$ e1 z. ]( Z; Z: u' k1 D/ L( ?
Method 09
( @: a0 n1 d5 Y2 N# l=========
5 C9 ]' h- @5 h5 f3 {) C+ s" F4 N8 X# E8 S& u: i
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only% T: u8 H0 R: s+ w: |& D
performed in ring0 (VxD or a ring3 app using the VxdCall).
% c! J; R6 L7 U8 r. u  G: }! z5 RThe Get_DDB service is used to determine whether or not a VxD is installed1 d% @' q9 o9 P, E* l" Y" R3 j- j* K
for the specified device and returns a Device Description Block (in ecx) for& E, H/ V, b2 z) J( \: T
that device if it is installed.7 \9 B  q; }9 D: Z/ t; k  d

6 p7 A$ o/ S" E3 K. u$ M* s# Z   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID0 P2 x0 R2 X4 p5 |1 Z
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)- j8 {  @( J/ N; a
   VMMCall Get_DDB. N, l+ O; T3 d1 \
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed' ~6 R8 J" G" V) X- n
- E+ x! f1 e) s) }8 a: j
Note as well that you can easily detect this method with SoftICE:1 ^* M5 o. a! x& G% a
   bpx Get_DDB if ax==0202 || ax==7a5fh
1 z8 C6 D7 K+ [1 E" T' L& w/ }% D: `$ n1 L: o' x
__________________________________________________________________________
9 H8 q6 T; y$ P0 |7 Y2 y* n3 j" _( v5 F3 n5 _7 M
Method 10
& ~/ c) Y8 d9 m$ E  S# }+ L. _6 P" e=========
6 Y" }+ @. T) X$ }. E& P& C4 |9 h' c
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with3 [2 B' j3 F! ~
  SoftICE while the option is enable!!
0 D6 h- U2 c% W6 N- q
* I( c+ L8 S0 {! P3 Y7 b7 yThis trick is very efficient:2 s7 ^+ z3 w: r9 L
by checking the Debug Registers, you can detect if SoftICE is loaded9 P' {! ?2 U# O
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
+ D4 R8 B9 g! }6 y! y' `- Y% fthere are some memory breakpoints set (dr0 to dr3) simply by reading their/ @5 i/ \5 n: V6 G2 \1 ?
value (in ring0 only). Values can be manipulated and or changed as well
. I7 X/ W: n3 I  K% S; R& ^(clearing BPMs for instance)
; U5 a& v2 K0 D: l5 b! S! B) ?& O! L/ a4 e2 q* e
__________________________________________________________________________
" O  w* C* \  U2 Y! c8 j5 A5 m2 J$ }; l. T6 A2 B! j5 R
Method 115 j1 T1 {  G& B- v5 x1 a6 V
=========: P7 G( E# ^* l$ _
0 r" {* L8 {* m% ~- h2 Y4 K
This method is most known as 'MeltICE' because it has been freely distributed
# ], t: d. f3 `9 F; }via www.winfiles.com. However it was first used by NuMega people to allow
- U0 X; ^5 m3 u  F: B/ ]- WSymbol Loader to check if SoftICE was active or not (the code is located
) y- J: v' T: s) ]3 Binside nmtrans.dll).2 u; n9 M* O: L: p5 ~) |  ^, H
( @$ I% z6 m- M  B7 `' c
The way it works is very simple:
7 y, K; {2 e8 |3 GIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for2 L  H) P$ _1 j8 U. N6 u$ O! a
WinNT) with the CreateFileA API.& X# G) @8 @/ ^+ T9 B( B% v: [$ m
' v  k4 W" O  ^0 r; }0 T* F, j. e
Here is a sample (checking for 'SICE'):
; N) \5 b' F4 S- |7 F6 i
7 d$ i( @6 K$ r( Q1 @' ~$ I. IBOOL IsSoftIce95Loaded()2 a, J+ c1 T  |+ ~1 c
{5 L+ L% A" D; K+ d& E$ q
   HANDLE hFile;  / h) e3 M' c3 ~+ O
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
: @# |$ Q7 j0 z3 D6 e$ U7 p; b                      FILE_SHARE_READ | FILE_SHARE_WRITE,, W$ s7 u3 |2 c$ B2 u8 I
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
7 t+ O9 m1 H) \8 _2 l   if( hFile != INVALID_HANDLE_VALUE )
9 H* U& E0 m; {# S" o. t   {& E2 D' U$ Z7 ~( h! F8 q& E
      CloseHandle(hFile);
- d2 j5 K: A# s& J  J( c: E" q      return TRUE;4 c; M' S8 M' ~
   }) o5 W0 M$ P6 N' n' l, i7 y
   return FALSE;! O+ {; p  q8 R+ N! A) Q0 M
}
4 v; n) y- y8 k( L+ ?9 W) ^
  g9 _% Y- W4 u( j; e) {Although this trick calls the CreateFileA function, don't even expect to be
' [8 u  p2 T2 m- k4 m( |6 _5 \8 ?able to intercept it by installing a IFS hook: it will not work, no way!
  K- @) `' S) n3 B0 PIn fact, after the call to CreateFileA it will get through VWIN32 0x001F# y- A8 W2 }. I: z
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)- P/ p7 S# [& M! ?8 y0 g' N; w
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
9 G+ K" H9 U( ]3 r7 y. }6 Vfield.. M4 l+ ~1 J; ^( [0 e, i; p
In fact, its purpose is not to load/unload VxDs but only to send a
0 g/ _; `( }. a% o: Y, [6 kW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
1 d2 r; l7 A0 O; k* H* ?& pto the VxD Control_Dispatch proc (how the hell a shareware soft could try0 S7 ~# S+ b# T/ G
to load/unload a non-dynamically loadable driver such as SoftICE ;-).6 q) `( }7 s- L' D. i, P* [" y
If the VxD is loaded, it will always clear eax and the Carry flag to allow
' Q2 x' N% v1 f1 t1 _its handle to be opened and then, will be detected.
: i0 W* X( g/ l  \$ ]You can check that simply by hooking Winice.exe control proc entry point
) n) n" y- k. s' i1 P! Twhile running MeltICE.
4 s. m  |! m/ Q" H$ A! Z5 s) l2 V# E; Q/ ?! M6 k1 j1 m' N+ L  k
2 h- [6 f2 H6 P7 a- V$ Z
  00401067:  push      00402025    ; \\.\SICE! m. u: }0 U5 q% K" t* [
  0040106C:  call      CreateFileA
" n3 i0 y+ e& y! i  T0 [  00401071:  cmp       eax,-001
4 u: W2 t1 O4 [0 _  00401074:  je        00401091
$ S5 }" K7 t3 h. y( F1 a% F# \& f" @4 h8 h8 L: F: W# u
5 I& }/ b, Q" D/ }5 ]* q4 f
There could be hundreds of BPX you could use to detect this trick.
" S0 i& v) D5 g- ]6 Q-The most classical one is:) W) I1 X6 N+ u) E
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||8 X1 m, x% [/ D4 K
    *(esp-&gt;4+4)=='NTIC'" E  ^4 i1 w6 k) H

! W- x) ?! c/ e: K' E4 ~-The most exotic ones (could be very slooooow :-(
/ b, Z6 q, ^5 Q! x& m   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
7 f* l$ d# M6 [     ;will break 3 times :-(% G1 e& J( h' n: J0 v8 t' f
7 D& @% F. o% M/ J' K9 M# M
-or (a bit) faster:
. R$ ~% _2 N& z   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
) f$ s! N" S8 g$ T7 Q# f' Z( d5 K1 ~- @9 W
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  3 n5 I' v; N* x# _% }3 u
     ;will break 3 times :-(
$ t$ Z% M7 v1 Q# Y" g, A+ Y7 u1 H( o7 o3 H
-Much faster:
+ {/ H+ s1 r5 o  L$ A' c/ u4 P9 v1 U. `   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
$ ]; G/ C" `# ]1 u1 j5 \! }) v$ _6 J, ~1 V, Q
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen- l" ^8 K# u: Y
function to do the same job:3 b- R4 z2 \. I0 S5 Q4 T+ x/ f

6 ?5 \0 q8 d( U! Y5 ~% v9 q   push    00                        ; OF_READ
" k; [& ~! G% b* P   mov     eax,[00656634]            ; '\\.\SICE',0
& O  u4 z! L7 X% P8 x9 a   push    eax
( E. Q7 k) X( Z/ L   call    KERNEL32!_lopen' [- z- z) z% m3 z7 n, }3 T  ^
   inc     eax
, o0 e: d: v" @3 o   jnz     00650589                  ; detected+ K! Q+ l3 y" [" ~, U) G
   push    00                        ; OF_READ
' w7 |2 t/ R# C" M7 U, R, Z: f+ q   mov     eax,[00656638]            ; '\\.\SICE'
2 `9 E: ?  d4 G   push    eax5 a) d8 f) Y' t9 p. F
   call    KERNEL32!_lopen
& B6 y/ q* Y2 U4 p   inc     eax
5 A0 S9 p! R9 s5 i* D) q" Z   jz      006505ae                  ; not detected
! `/ u( }$ b) {! R% ^! b: [3 w/ E
5 v; l2 r* e& c6 s1 ?' x* g1 A8 q
__________________________________________________________________________. S1 W+ P5 O2 k8 x3 f
" {3 E" p/ ], l2 ~
Method 125 W$ s5 ?  d3 b( P% u
=========
& r4 v2 D9 z8 E! d! s: a  R$ j0 ^! H" M" i/ w9 [
This trick is similar to int41h/4fh Debugger installation check (code 056 C) G# |) Q' R& `9 y
&amp; 06) but very limited because it's only available for Win95/98 (not NT)
2 D/ w3 ~- U% z+ _: ias it uses the VxDCall backdoor. This detection was found in Bleem Demo.5 {8 w3 B0 n6 P5 B% I! W

) j5 F+ f- ~  D* d! n0 k3 k   push  0000004fh         ; function 4fh  ]' d4 W& f8 j* z
   push  002a002ah         ; high word specifies which VxD (VWIN32)
' a+ R' V' k; h- ]0 L4 B* n                           ; low word specifies which service# G3 d* ]. ~- g: F1 ]4 N( V
                             (VWIN32_Int41Dispatch)& }9 k" f* V% d* `* Y
   call  Kernel32!ORD_001  ; VxdCall
4 X9 J5 |7 V$ V6 O$ ^; Z( u' |   cmp   ax, 0f386h        ; magic number returned by system debuggers
! n1 W& {0 O& t% h& `   jz    SoftICE_detected
3 J* n. r: z' T& v: T3 `) \; o
1 Z3 P9 {2 r. Q8 a; mHere again, several ways to detect it:4 ~! d/ v; \& o9 J
  q7 \- l; f* b+ c8 _
    BPINT 41 if ax==4f
2 h' p8 w6 B9 q/ ~
( s5 Y" V. ]9 L. Z# E2 j7 K8 r    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one+ M/ R! b4 f  c& M
) X) C3 c' V: G- O& o
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
6 V9 v( D4 d* Q# q9 t; G8 z# u4 ?9 T' S3 h( h
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
$ u$ W9 F% R& V3 e
6 j8 w. p# D# w* X: v8 c6 i__________________________________________________________________________5 b; e, L+ ]# l8 a4 I7 E* V

8 A9 O- J. ]+ aMethod 13
: b% o+ D' \7 n0 y# ~- v=========  X9 J8 j0 t3 G* C, [

" e+ e# u: i) F' Y% G: ~Not a real method of detection, but a good way to know if SoftICE is" t+ h# V( z! q2 M! B. y
installed on a computer and to locate its installation directory.
, X) q. Y" e4 M! g! T0 V! \It is used by few softs which access the following registry keys (usually #2) :; I& p. t/ L% \! b" \& @1 t

; e" M9 f: @0 r( F" |% z-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
' e$ [: \# \8 R  C\Uninstall\SoftICE
& t% G  Y. N$ P0 o6 r" n-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
3 K* `( m4 [, V# Y$ z-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
/ F9 N6 X: L1 J. U\App Paths\Loader32.Exe! U" e, C1 C5 t4 R" H3 q
, f! h. _# X- q

& u1 S9 ~9 j- h* ~0 M$ BNote that some nasty apps could then erase all files from SoftICE directory
" g! T# \4 Y" @  U(I faced that once :-(
+ D7 o& ~' z6 g0 R2 F' v6 C
  ^1 c$ I0 z1 A* tUseful breakpoint to detect it:, u, s2 N9 z  @& Q6 D
% I0 C3 e& t, N: L. [& ~
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'. @% G9 T: z7 r9 C$ z8 r7 [
" h4 R+ V7 S$ S  `4 H2 V+ s
__________________________________________________________________________+ H7 l9 i) a7 Y9 D1 r

* T: N* b& N4 K% R: A0 m) w
, ]/ [0 Q3 }6 {! M$ s, c4 z2 V. ]Method 14 7 b7 l2 B4 q& c/ e* x4 h
=========
8 C/ P1 Z' w- u7 Q1 A: M
3 L5 r+ u: b( A) g! b. w% wA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
( z4 _& a& I) ^, g' vis to determines whether a debugger is running on your system (ring0 only).
- v. n, H$ r1 z# |
7 Y* q$ Y! h5 Q0 x5 K7 U7 ]. }   VMMCall Test_Debug_Installed# f. k6 s5 g* Q! v
   je      not_installed- S7 S+ i7 Q& _2 h

. T$ P1 Z4 W& K. sThis service just checks a flag.+ f9 S1 F' ~3 S
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-8-19 00:41

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表