About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
( K5 v; c7 S; D$ {, _<TBODY>/ ~# p) p) V* c
<TR>
2 Y9 x3 }2 {* v6 L/ ?7 a<TD><PRE>Method 01 % o: |7 \' a& b( @
=========
$ r, e1 E+ t6 W& l& x; j
8 P; P. F" P: J. qThis method of detection of SoftICE (as well as the following one) is" C9 p3 I" d- f
used by the majority of packers/encryptors found on Internet., Q" u8 X+ _0 X4 W, ?( ^6 N
It seeks the signature of BoundsChecker in SoftICE
: _- ^- s+ ^' @& G- H1 }+ S, A/ s  j
    mov     ebp, 04243484Bh        ; 'BCHK'
% g, m! T5 Y7 o: o$ `  E8 r& d6 K% D    mov     ax, 04h
7 J1 i1 M$ K4 [$ h) n) ?2 H5 d: R    int     3       ! K; G. Y& E% n
    cmp     al,4
0 t. F' P) M& X! ^; C9 G    jnz     SoftICE_Detected* u( C- Q/ _* _. G+ K' S
, R0 F( P* \% ]" C/ c. \  [
___________________________________________________________________________* b" a* L! A4 E  y
6 c8 I8 g! f9 u- M% E7 ?
Method 02
8 i8 T* q' s$ P$ Q=========) ]2 R' i6 k+ l, P8 |0 ~
' |. K) w8 [5 j( U
Still a method very much used (perhaps the most frequent one).  It is used
. _. s! `0 j+ L2 rto get SoftICE 'Back Door commands' which gives infos on Breakpoints,! s6 X, R! K% b# I. y3 i
or execute SoftICE commands.... Y( D% t1 S' `' j# a% e
It is also used to crash SoftICE and to force it to execute any commands
& u6 v# h, ]4 H(HBOOT...) :-((  " ]/ ]1 _. \1 T1 c+ n3 m
4 _' V1 A) Z3 k
Here is a quick description:: r7 Y; x& x5 j. R9 j
-AX = 0910h   (Display string in SIce windows)
: ^: E. V1 {1 f+ f" h-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)9 s! D! G* P, M3 j/ N/ A2 D
-AX = 0912h   (Get breakpoint infos)2 F. O6 W! z# {  {6 `5 a
-AX = 0913h   (Set Sice breakpoints)
5 `0 b) Q1 s6 V5 ^' b# Z-AX = 0914h   (Remove SIce breakoints)4 H7 z5 s2 C5 y6 n0 d$ p+ T

' d: f- ]6 c: i  Y8 j4 uEach time you'll meet this trick, you'll see:
- S3 a; T. L( Z( J" W' Z/ l. {$ I-SI = 4647h( x- B/ r. j0 P5 e
-DI = 4A4Dh
4 x# Z- j( Q, F( i! @- d, fWhich are the 'magic values' used by SoftIce.
- t$ n6 a5 d2 J4 ^For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
1 }3 x5 D) t% s7 D2 n: x5 F1 w& n6 M( }9 e& b7 ?% [4 ?
Here is one example from the file "Haspinst.exe" which is the dongle HASP$ Z: W# x  F2 T$ i2 Q
Envelope utility use to protect DOS applications:2 f# [3 F# n/ l7 r
- K( o1 T- r" L

& {( s  ?. j. |7 ?  ?4C19:0095   MOV    AX,0911  ; execute command.
1 K' `: ~! b9 b5 t! I6 ^: }8 y4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).- V- D, ^6 I  l' |' Q8 T$ {# i/ H4 Z
4C19:009A   MOV    SI,4647  ; 1st magic value.
  |' i, F0 `' E* Y( X2 k4C19:009D   MOV    DI,4A4D  ; 2nd magic value.* E+ B3 v" i( d. e; K6 ]: k( P
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)/ r' ?: j  ^- M0 J; b
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute1 @1 p6 N% ]1 ~- k" b; I( ?
4C19:00A4   INC    CX# Q1 \9 h6 ]1 L4 S% J- z
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
4 q, t2 b1 p+ I$ j* v; B2 ?4C19:00A8   JB     0095     ; 6 different commands.8 y6 u, ]% G2 D! i3 C* ^
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
+ b% t( G9 P- N0 B$ _4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
& B3 G3 r9 X. E+ _' W7 B" H7 f% W4 r) V! y8 u: v. l" C1 @
The program will execute 6 different SIce commands located at ds:dx, which5 h3 x. g6 c7 _/ [% J2 M
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT." ^8 N2 o7 [$ f! W! |& a# T/ W2 Q% Y

0 R0 x: u' r1 p+ R& C/ K* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.! u6 |5 `% r0 Y/ h& v4 w$ n
___________________________________________________________________________
. i: _! v& w+ f
2 G2 E0 B3 |0 B- f# _* x. ]! f) o3 x4 j- l* g* g: A: L
Method 036 T8 _4 A1 S) k
=========
' J% n8 @+ q/ b+ Z
( b) Q/ m7 k2 U$ G5 g0 G, hLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
" P! B& O$ [: I4 q* U8 k, Z0 d" w(API Get entry point)' M9 j; B* w- R1 E/ N1 z: H
        
! ~9 [3 _9 {0 U, \: |+ M4 L4 F
) v# y$ ~* f7 e: n( p: {: O8 ~: B    xor     di,di4 T- Z: w% @# Q7 R( _- h
    mov     es,di0 p, E; X' ?, X- T" Y1 ~
    mov     ax, 1684h      
+ \: @+ L& ^/ z$ w; H7 O; B* E& E    mov     bx, 0202h       ; VxD ID of winice
+ v) o8 ^3 u* N! u1 d" m7 u    int     2Fh& S% R8 g. ^1 \, y3 \* g
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
0 y6 w7 T7 @  x    add     ax, di
4 m- N+ h) B1 N: S( B    test    ax,ax
. f0 h1 p5 M; j4 S  Y" ^    jnz     SoftICE_Detected- I+ @2 r: F  X% q/ D7 h; t

% @  C3 X  p$ {2 m% G9 F1 i___________________________________________________________________________, g' K4 i$ {: U

. E- Q. \2 n3 Z$ `8 @4 @- Q) y+ MMethod 04
( F- g$ U8 G% N: \1 O7 l$ `) j=========# J+ c. y1 e6 X7 b  Z, }6 C

8 ~% x- z- e1 ]0 F- K6 s' WMethod identical to the preceding one except that it seeks the ID of SoftICE3 x0 {8 ?0 B: r( G- h8 @
GFX VxD.: l! y$ r3 T7 Y9 |# |. [4 x$ k
6 t/ E' c- h4 J- ^6 Q% d& W
    xor     di,di
: C9 J$ n: J3 \' a- A/ G, H    mov     es,di
4 h1 X6 o! A6 T. K' u/ _    mov     ax, 1684h      
' F/ l" `5 @3 s( a$ Q    mov     bx, 7a5Fh       ; VxD ID of SIWVID
. T  w4 Q% u' e( ?6 J1 P    int     2fh* m" r$ @7 V" ?+ h* m6 a
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
, c3 r7 j: m4 A& t, S/ T' A% v    add     ax, di  e0 ]" I1 M( ~) A* g/ O
    test    ax,ax( P& Y# |1 ]1 D6 M- i% Z
    jnz     SoftICE_Detected
3 Z0 @3 G# F' A# G2 f) x1 K9 o- i1 r2 f. t8 O
__________________________________________________________________________6 [+ U, _6 L, C% v: P" h0 c
, M6 u' F8 m  f$ F

" v) w/ |8 a7 T1 H& KMethod 05
. L! A. R7 {8 ], f# K=========
$ o1 H' @& U: a$ W1 ?' b# J3 D! ~8 a# g  ?0 f# a/ N7 F
Method seeking the 'magic number' 0F386h returned (in ax) by all system5 A/ J* z" d. L' K$ F/ j' [5 S8 v: L
debugger. It calls the int 41h, function 4Fh., o* I* m* z) i/ R. o
There are several alternatives.  
9 V  a5 J9 d6 Y$ z
* ~& Q$ J) s2 cThe following one is the simplest:$ g, i* _, r; F  y6 j: o2 V

* Z2 ]- e# g0 b. ~# P' M  M    mov     ax,4fh/ C: F: K$ G* d& G: Y: e! S
    int     41h1 ~" _- c' z/ e6 w
    cmp     ax, 0F386- l% p5 L% X/ u
    jz      SoftICE_detected- H+ `' G5 e2 X
0 ^, k' c- v: y$ s0 e* }! W

/ n' k5 C/ W# M0 g" H5 UNext method as well as the following one are 2 examples from Stone's 2 P8 K6 j/ b  k
"stn-wid.zip" (www.cracking.net):6 W' F; z1 n! w0 d% t

7 Y9 D" F% X: n8 X5 `4 K    mov     bx, cs1 }8 i4 w( O' k5 \9 s
    lea     dx, int41handler23 @! S" w0 V, w+ f$ w
    xchg    dx, es:[41h*4]( q9 D, t+ C" i# k6 R1 G
    xchg    bx, es:[41h*4+2]$ q- j, ~5 E8 j' q" u
    mov     ax,4fh
1 t# u% `5 C; Z# X- y6 I    int     41h( Y% E- y2 Y! e, Q, G# D
    xchg    dx, es:[41h*4]" w3 c: L5 u, h( N
    xchg    bx, es:[41h*4+2]# ~  M) p+ P. y  _
    cmp     ax, 0f386h
8 {- g( n" s% d1 h+ d( y    jz      SoftICE_detected
; _. }* q) ]" f+ M& Y+ I( {
$ ]% k' u+ |* e* A( F5 Oint41handler2 PROC
7 Q) \( n3 v" M9 g* ^6 c- R% s    iret/ |  e' ^0 d7 i8 ~( M: k; c1 ^
int41handler2 ENDP3 h1 l2 P4 U& Q) t+ @
: Q' U4 _- C% K, N5 c

9 O1 w- n; U) e% T7 O1 x6 h4 @/ I_________________________________________________________________________- e( l! M4 C4 _* {- b9 t1 c
) e  e; y8 O2 O' x& m
: ^) j# w% I, `6 }0 Z& F
Method 06
# p7 `, r6 E5 R2 n8 T=========
% k. f# c, Y* j- w6 A; j$ w1 \# T% V4 e7 L& j, l  f
) k; i3 X) P1 }8 B
2nd method similar to the preceding one but more difficult to detect:
: G+ ~8 k2 T7 F# X8 h
2 N0 g4 M4 m5 |/ F+ s  f7 E+ v3 L: g7 G, X
int41handler PROC, w. X5 w( y, i+ Q' N8 C
    mov     cl,al
$ C% g3 k0 h3 P9 m' D2 g    iret  ?; T# T, X/ ]
int41handler ENDP7 w3 i9 Q6 \% d9 K) e: C( [
, {" J, C& g! b4 X2 Q5 ?2 m- ]! V3 h

4 a8 d6 o8 j' _    xor     ax,ax
" P6 T$ c! ]7 K4 i    mov     es,ax
! ]+ e0 U4 I3 O8 j9 B- |    mov     bx, cs
4 d0 S0 E7 e7 P    lea     dx, int41handler6 j& Y8 R- X$ q2 u, Y
    xchg    dx, es:[41h*4]4 _3 n. N) s$ |( h
    xchg    bx, es:[41h*4+2]
: \8 z( E" b3 B8 v' {4 }    in      al, 40h5 C. e! [( V+ G( _. z
    xor     cx,cx
$ r+ O! t6 s7 ]: p    int     41h
% k; h  H5 Y1 E' N4 t- Y    xchg    dx, es:[41h*4]
3 h( u, }. h9 n3 K, Z8 [0 j' I    xchg    bx, es:[41h*4+2]
$ D7 E, _+ ]; e5 r7 N. H9 x5 L; P    cmp     cl,al
, h+ m. N; \) H+ _" Q6 \    jnz     SoftICE_detected, o2 g; }" l  H- i
- n  Z( s' ]( z0 \- J5 r5 O
_________________________________________________________________________- p; j7 T  \1 ~

; }* I; [3 A) D% @) kMethod 07
- ?' `6 Z5 P2 ?/ X=========
7 d& F2 `4 B: P! D! o& q$ `8 T+ [# A3 A' E. W. k
Method of detection of the WinICE handler in the int68h (V86)( ^  J; w) N8 x3 U, g7 q( n

/ r# C* c( ?. q7 G  U    mov     ah,43h
6 q% Y6 v* L) [& k    int     68h
# j+ s; O8 ?; @1 I5 b! Y0 R& _* f    cmp     ax,0F386h3 D4 Z) q' s$ {$ i2 S7 T
    jz      SoftICE_Detected
# f2 @7 M2 _% l8 r& o4 {. i$ B$ J8 Y: W5 _

0 s7 N5 x: R# q  E1 S& ^# A* C) n=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
* o! I; _: k2 Y1 x   app like this:  q2 s- q# n; U% X/ E9 d& J$ ~. j
9 L- n# U+ q& ]. d5 k
   BPX exec_int if ax==68! d' L6 x: G' P1 r
   (function called is located at byte ptr [ebp+1Dh] and client eip is, x/ Y0 z8 {: N, @# R5 x
   located at [ebp+48h] for 32Bit apps), I& A6 f8 b4 ~) k0 M7 I. c
__________________________________________________________________________2 }0 {$ V. e( S! O0 T# L6 L
* U6 Z% l& n5 `# N1 ?; B/ D  c% Y
; x, s* C4 E) b* J
Method 08
( E) D  s2 I' H3 ]5 x=========0 Q* q- i5 c( |6 d

7 r: C9 P" O4 @$ YIt is not a method of detection of SoftICE but a possibility to crash the
9 D$ J& `. ~0 S* N5 T% }9 Csystem by intercepting int 01h and int 03h and redirecting them to another
: o) g6 X6 N! q! [9 `( Yroutine.7 X2 @' |$ x4 v" r2 h' {( T0 l& A
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points. F/ J5 a) i% C0 R) P, I
to the new routine to execute (hangs computer...)# n, X* q. v! _0 S7 h" a7 y- |& m
5 G2 f9 k% c' a! e( T" y
    mov     ah, 25h% G$ p( p4 |+ W* k0 e! G; W. Z9 _9 M
    mov     al, Int_Number (01h or 03h)# h' C4 }$ M( \- c
    mov     dx, offset New_Int_Routine
3 K$ r3 N' S- I2 E- B    int     21h7 i% C1 b6 Q6 o) N" ?1 V& H

: h& f9 K* }& j7 M; P; ?0 G* K__________________________________________________________________________
" p) X3 u* k5 _% O+ x: y
2 Y% Z0 U+ @$ ?5 q# KMethod 09+ d. @' r: S( F6 X9 g
=========
7 I/ Z, D( A' E1 c) a6 F+ \% [& B0 a% z
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
! y# C2 A! @; r0 b' E, F* r, P1 W% xperformed in ring0 (VxD or a ring3 app using the VxdCall).; i! k) j9 v$ V+ h1 b% _2 H
The Get_DDB service is used to determine whether or not a VxD is installed, a, f: T/ [0 a3 b* @- P
for the specified device and returns a Device Description Block (in ecx) for. R. `$ m/ P: h+ f7 @
that device if it is installed.& d) `* W9 T' b" @& c
! \) v( A: w( k, w; r; u6 G: J$ d
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID. Q2 ]2 V9 Q, [) j( z
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)7 N* p1 L" Y% {6 \
   VMMCall Get_DDB
! X& H3 `$ _2 p) H2 e: E   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
4 D/ O  P& i$ X1 C( _' v
7 O# k$ U: \& A3 W* M+ bNote as well that you can easily detect this method with SoftICE:3 j' J6 _0 c! p
   bpx Get_DDB if ax==0202 || ax==7a5fh
4 R' V; I  c9 b, G7 H& m4 r* |7 k  W) p- O2 y4 a- N" z
__________________________________________________________________________4 A$ e0 b/ {0 D& I8 g9 ~0 ^

' e9 j7 A, y! S, G. E: VMethod 102 P/ k4 n$ ~. g2 K% {" H; U
=========. ~8 q7 V  u( N5 l" _4 ?
! F. c. O0 g$ ]9 Y# M
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
0 V+ _" m. h' D9 v& F  SoftICE while the option is enable!!$ V$ z5 S3 w# a' u
# `5 W* [& [0 F8 P+ x* S$ K: X6 C
This trick is very efficient:9 O5 O% t$ Z7 R( b
by checking the Debug Registers, you can detect if SoftICE is loaded
3 O# Q, c$ Y; D: @# w' F: {(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if: Q+ Q% J* M! k- {
there are some memory breakpoints set (dr0 to dr3) simply by reading their
2 j1 N* L9 j8 f" J# Qvalue (in ring0 only). Values can be manipulated and or changed as well
6 E2 T" @5 _& G" u) A0 m( [1 f(clearing BPMs for instance)2 a/ r+ a* ^2 C
0 P+ H7 x/ K# X: E9 C
__________________________________________________________________________
/ i- R6 \0 N/ k4 ~0 B7 ?+ h
+ @) u1 f) m' j. f& N) z/ E  ^& f8 oMethod 117 [# Y" d, T7 s. q+ J0 y
=========0 o5 D% F$ n0 O! }8 R

* s1 M, i9 v4 YThis method is most known as 'MeltICE' because it has been freely distributed
" P) P! b6 W" e4 Y9 i4 avia www.winfiles.com. However it was first used by NuMega people to allow
" l7 F7 O: n2 p; k1 `, `Symbol Loader to check if SoftICE was active or not (the code is located
3 {# Z7 a- [, E1 V' vinside nmtrans.dll).
( C& g3 {7 u- }) \( l$ a7 ~: H4 t) z/ M% h/ }  y8 N* l. {
The way it works is very simple:
7 [! b) l  [5 TIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for9 ^- [+ q  _' e2 U2 m2 L+ q
WinNT) with the CreateFileA API.
  q1 i1 c- b" X: P+ M1 z* @/ i, i( k) z4 }0 m4 g
Here is a sample (checking for 'SICE'):- L: |4 h) ?- q
) n5 ?0 ]3 n" o. a  ~
BOOL IsSoftIce95Loaded()
5 B  Q. s" ^5 v5 S& W{
% ?/ B9 M6 o# A/ m9 b" K# @   HANDLE hFile;  4 `. C( ^, A' g4 o: _
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE," v6 Z' i# l* ^0 M' b7 W! ~$ d- E
                      FILE_SHARE_READ | FILE_SHARE_WRITE,
/ ~+ W* i* ~, R                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);9 F. o1 ?, R. B* I
   if( hFile != INVALID_HANDLE_VALUE )
+ u6 X6 `& N/ b$ [' x   {/ t$ G& ?6 c( G5 d
      CloseHandle(hFile);
' l# }3 y6 v/ a+ Y* w      return TRUE;
# ^, S# Y- d$ g, i3 d   }) P2 h2 q4 W; N# G$ i* G8 D" V; ^
   return FALSE;
& f- g, `9 n+ `) l}
! j3 t8 J1 @: H0 j& ?2 g' i. m7 s- @1 t8 j" I$ ^% n6 k3 s/ u! K$ v9 ]
Although this trick calls the CreateFileA function, don't even expect to be1 R2 R4 j2 y6 I( g+ n4 x, V
able to intercept it by installing a IFS hook: it will not work, no way!' F+ n% ?" b: _. }
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
8 m) [7 J9 c# S2 P$ Tservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)% U/ n3 v) ^3 p7 Q1 k9 W
and then browse the DDB list until it find the VxD and its DDB_Control_Proc" L4 F7 h* z6 Z8 |2 T9 p
field.
1 U6 n% O; }  aIn fact, its purpose is not to load/unload VxDs but only to send a 4 z) ?( j9 j5 M7 W" m
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)0 X6 x, f$ C2 U# m+ G
to the VxD Control_Dispatch proc (how the hell a shareware soft could try. U  |& k1 m  t" h( ?
to load/unload a non-dynamically loadable driver such as SoftICE ;-).8 |; v, p6 X$ O' a( h# z0 {5 B
If the VxD is loaded, it will always clear eax and the Carry flag to allow$ a) B( o' Z% ?: o5 }8 D
its handle to be opened and then, will be detected.
7 M+ t/ ?) r# e: j8 @You can check that simply by hooking Winice.exe control proc entry point9 u2 z3 U9 e! E. l; k$ R3 e# l; }
while running MeltICE." G) d" p  w5 K' i% v/ k0 H0 w

4 s5 i  i2 @( z, t/ G% l1 W+ D% x7 q" W  [- C: H- m, L
  00401067:  push      00402025    ; \\.\SICE
3 y- @2 ?) {4 B  0040106C:  call      CreateFileA
# |3 \6 H3 S6 e$ W  00401071:  cmp       eax,-001
9 v) \, q. O& M8 r# o  00401074:  je        004010910 u" U; N* C7 E8 s2 b# b0 A
; Q8 a" x. k: c9 ?- x* k2 D! I

4 G4 {6 i7 V' ?- K. {There could be hundreds of BPX you could use to detect this trick.
- y. g2 i# F2 Q$ Y' d) b; f-The most classical one is:" g9 d1 a% m8 \  T/ j7 w6 |3 ^7 B
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||  s3 q  J/ ^& ~3 f% ^
    *(esp-&gt;4+4)=='NTIC'/ L% G7 o( P1 G2 R* j
1 \* M) g0 W& E: q5 c/ c
-The most exotic ones (could be very slooooow :-(
8 S: T" j! S2 O   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  ! ?6 ~* f0 }5 R' \) k
     ;will break 3 times :-(6 G5 d0 U1 p& e
1 q0 R6 b* o: I( p6 d' y, q0 \( d( k
-or (a bit) faster:
# D" X5 j  B; Z1 K9 U1 ]   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')3 o5 `8 {: D% F
9 ?4 i( Y! ~5 G$ Z6 u6 R4 L
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
. }! x+ U  i) T" l     ;will break 3 times :-() [9 T% V2 ^: M, \  K6 c* C1 \

* p, \& T+ R, c' Z-Much faster:
# ?' W( {- Y$ r1 Q, `   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
; t4 n$ F( w/ w5 P- e  ^! w' g0 g( h: K! V5 p7 y+ X
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen4 ]8 W3 ?" v% }' s, j5 V" X0 G$ t
function to do the same job:
) v  w& |6 q7 O' U0 r. R) e+ ?7 v3 e; D8 y
   push    00                        ; OF_READ" @2 c0 S2 A  O6 O- M: V& W0 w
   mov     eax,[00656634]            ; '\\.\SICE',0
7 T3 G: [" c) y. M) C9 k) I: i( C5 O6 I   push    eax
3 P/ b% }+ G3 R9 Z+ l/ }4 ^7 M/ `   call    KERNEL32!_lopen1 I6 j+ I$ ^* r9 Q( p$ L( [. }0 B
   inc     eax
& f- F; Z! d: ?   jnz     00650589                  ; detected5 x& a9 |5 j1 x# Z
   push    00                        ; OF_READ
. }: j) o( J/ }   mov     eax,[00656638]            ; '\\.\SICE'' Y! ?' D1 T$ Z/ v4 @
   push    eax
# |/ V+ f4 u) n! K4 o& I   call    KERNEL32!_lopen$ _# _0 n7 T3 b0 U7 W- n2 i& N
   inc     eax) n$ W% `7 i  k* U1 E, K+ V
   jz      006505ae                  ; not detected2 w+ I: T' o: ?* j
; w& U6 n2 `4 k# p; n# q
' i" T- ?& L2 @3 R, {* y7 A$ \4 ^
__________________________________________________________________________  u: @2 G2 x0 U
  z# A! ^7 h& [! x% F
Method 12
9 k  E! J# C2 ~2 q$ b+ f=========" c( x* @6 S6 a9 Y: B  i5 F1 S" v  Z

6 X! l+ f' E. I2 X" ZThis trick is similar to int41h/4fh Debugger installation check (code 05  d8 g! X$ h* `0 N% i1 a- q
&amp; 06) but very limited because it's only available for Win95/98 (not NT)4 {2 }# ~" [& D  c  R; z
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.3 I8 }' J# H6 R& ^# W

! G6 v; n9 Q) y5 Y) m   push  0000004fh         ; function 4fh
2 @9 Z6 L8 Y4 W   push  002a002ah         ; high word specifies which VxD (VWIN32)) X. e; D1 m3 H. C
                           ; low word specifies which service
) m1 n$ z0 \$ i1 ?- }6 F5 ]- l& e                             (VWIN32_Int41Dispatch): W5 x. g* e0 D* C. D0 n
   call  Kernel32!ORD_001  ; VxdCall
/ ^% {# l9 |4 A1 [) U   cmp   ax, 0f386h        ; magic number returned by system debuggers2 _0 H* L/ N5 J( k6 s
   jz    SoftICE_detected
3 V# P  v9 q  Y0 v9 K" g" b: l1 c7 ]: c/ ^2 [. a
Here again, several ways to detect it:: z- m! n# {4 C
' k3 Z# @. I9 ?0 ?' e* S1 [9 B
    BPINT 41 if ax==4f
7 T% _+ C9 `! s2 r! T  |" Y# Y5 S/ x3 z1 R) N" `
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
9 @; K/ `; C. a( u- J( r, f& l& ~. B$ z% e
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A- q& O$ V$ v+ p0 c! G( `" s$ B

0 ^; U, L" U/ U- X- J- I    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
/ R- \6 h& P$ h& j
4 L' p& z7 ~5 W__________________________________________________________________________
8 {* S/ P& E  {' X% i; @5 [3 ]
0 q; f0 @4 x$ T: w% s3 CMethod 130 y; V& a/ D- U7 P6 a3 j# I
=========' Z* o$ {2 t- _+ W2 B& k

7 a  v" g7 w* z5 y6 A! @% V% b+ LNot a real method of detection, but a good way to know if SoftICE is7 a  f& G0 D9 i: L! i4 h) T
installed on a computer and to locate its installation directory.6 d; f% p8 T( t+ U( u4 z, P; x
It is used by few softs which access the following registry keys (usually #2) :
; N" h0 p4 h: e0 }) y: v, J0 _1 K5 m' z0 q0 e% G
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
, C- {: M' M' D' \! U\Uninstall\SoftICE
( ^) l% C5 [. Z# R-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
' i* ~2 z4 v/ o& A/ V- B0 s-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion( E6 w5 n3 _/ i2 e/ H9 c: v8 }
\App Paths\Loader32.Exe
6 V/ m, U- J) h* x* y
4 _" }7 L. H$ g) L# d8 s9 U- |$ P5 n5 @" y$ J) A
Note that some nasty apps could then erase all files from SoftICE directory
9 N8 M2 s! R9 x, E" F(I faced that once :-(: H4 [& @+ t( ^( F3 [4 w* s
+ [% y% O) V/ _" H& H7 W
Useful breakpoint to detect it:
1 H. ]4 f0 a; U% t; D
6 h' p, }8 ^: r) ]3 a4 P     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
+ x, z& ^" R$ }/ N2 \, z0 Q; {: B. |- t9 I$ k# {
__________________________________________________________________________
0 o. w" f' S9 u6 @9 q. V" }/ U4 ~& r+ l3 J0 u( R! e$ [7 S

% v+ a1 G0 ~0 P  F! c) G1 d8 AMethod 14 % b1 g! \# m% }% o" [! H
=========/ q6 O4 {$ t! X. j  p" A
- H$ |2 h/ U' J" {& {  U
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose) C; t+ o& y( {. e' y4 q" A: G
is to determines whether a debugger is running on your system (ring0 only).+ Q  i4 s8 y9 `) C9 p  w& Q5 }

* G; x$ X3 ^# q   VMMCall Test_Debug_Installed  |' j% w9 O" B. v
   je      not_installed8 g! P  {& I( I% ~
9 }! l" W8 _2 p/ N
This service just checks a flag.$ e2 ~7 d* a- p6 _8 m
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部