找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>* l* L- N* S2 d5 @, R
<TBODY># M: g) T0 l% `7 P/ X
<TR>
8 H7 J9 v2 b' b/ e' Y( p  i3 w<TD><PRE>Method 01 * a- L  O( ~5 Y
=========2 ^( Z( k) r' q

3 h- c5 `) r% \4 O/ i2 e# @This method of detection of SoftICE (as well as the following one) is
; i4 f  F0 D! m6 [6 eused by the majority of packers/encryptors found on Internet.1 x  b, {8 v; b% _" E( C$ u4 P- S
It seeks the signature of BoundsChecker in SoftICE! `" }% b% @8 D7 ?$ L9 A9 h: x
6 d# w' O3 B+ ~1 m) T# z
    mov     ebp, 04243484Bh        ; 'BCHK'
& W" U6 a2 E; F. }2 D6 a! i8 w    mov     ax, 04h/ O5 y/ b( Z, r( A
    int     3      
: Y2 y$ S- }" U    cmp     al,4
7 A7 ]2 r3 t. H    jnz     SoftICE_Detected; |7 g' }/ q9 U# l1 g  F
- f9 i' U( [6 V! l% O
___________________________________________________________________________4 o' ~5 ~9 ^) F3 M! T" Y8 t
$ O: X3 N9 F3 D1 c8 d# {
Method 02/ ~% {2 c, f' S! B4 P* |! u
=========
9 N8 X4 I) f1 b0 H1 X8 M+ h
  h: `# N6 g5 G) s8 ^Still a method very much used (perhaps the most frequent one).  It is used
6 o) M9 o) u  m1 H4 \; Bto get SoftICE 'Back Door commands' which gives infos on Breakpoints,# ~6 x) G3 i0 X4 g( h
or execute SoftICE commands..." l- l" p. {8 n% r$ p9 O
It is also used to crash SoftICE and to force it to execute any commands. b$ \$ d2 Q4 J  o7 i
(HBOOT...) :-((  / U/ E/ p; x- {4 }1 R  W

# G0 J6 p' E" MHere is a quick description:
5 }6 z6 }' C- s. a$ B. d-AX = 0910h   (Display string in SIce windows)" A8 u; j! `- I- C0 v
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)0 t0 m% n) {  F4 y# {
-AX = 0912h   (Get breakpoint infos), `: O1 L7 @6 U7 d1 `
-AX = 0913h   (Set Sice breakpoints)1 |" g# h  c# Q' ~
-AX = 0914h   (Remove SIce breakoints)  a6 D- V2 T  z! y5 N

1 D! G1 L  `5 }Each time you'll meet this trick, you'll see:
  h- {& {# h  m- M- [; L  j5 H8 z-SI = 4647h+ g, Z# D; M# c$ c( T! X( W5 @8 P
-DI = 4A4Dh/ Z7 L6 E  p- f& b
Which are the 'magic values' used by SoftIce.
  O" i; d8 [) ?7 [4 {For more informations, see "Ralf Brown Interrupt list" chapter int 03h.& A7 n/ e5 z0 [/ r+ o

' K7 R( \! C' i. ?Here is one example from the file "Haspinst.exe" which is the dongle HASP
1 l6 g9 v: _: n* }) `- jEnvelope utility use to protect DOS applications:
, w2 g, o5 f4 a2 t4 X6 p  C; l$ ~2 C4 ~3 q

4 `6 e% K/ m6 g+ I4C19:0095   MOV    AX,0911  ; execute command.$ c6 S. X# L9 i) w$ [
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
, K# u0 o+ m$ `8 I- D- ^4C19:009A   MOV    SI,4647  ; 1st magic value.0 F2 d# G$ F2 u
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
4 j0 K! t+ c2 G# j1 _4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)" s8 o/ ?5 y% I0 y3 B* y
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
: R# P. O2 }9 l7 k9 g% F! A( D4C19:00A4   INC    CX
. Z6 U, G. A/ v/ k" _* \4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
4 \( H, E- p6 h4C19:00A8   JB     0095     ; 6 different commands.9 k6 v: R9 @: ]) T' N
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
3 u9 k* S' t: n" v4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
9 m( G6 W# Q2 O; ~  |
) U& x$ U9 u, E: F" O. JThe program will execute 6 different SIce commands located at ds:dx, which6 f; f) z! W/ O$ s+ [
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
! q. }. o; \% D; x1 C4 ^: K# p; ?/ t" S. I: F1 \
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.1 H, S; u/ B: b' J  M
___________________________________________________________________________
# C' ]" {% B2 w9 d' l- M: F+ z) D4 j, }# {5 `6 ^8 F. w
% K% O1 b  T# w9 Y
Method 03% n* ]0 x' y) |6 c* K8 a
=========
1 ~* F. H' k9 H  \, j
6 M5 J4 g# y4 O9 `6 s. @2 h9 i7 jLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
" f) y5 M5 z  y$ B# I; P0 e(API Get entry point)8 `  F- B9 E: f7 y) y+ y
        
/ S* \+ W  }& U6 d6 U) N# [- ]9 a" P6 Z
    xor     di,di
( W( i8 P" ~8 o/ j! z7 ^1 ]    mov     es,di7 x( `# R" U4 _) Y! k
    mov     ax, 1684h      
7 E7 t: k8 W5 |& z; k+ ~    mov     bx, 0202h       ; VxD ID of winice0 e8 J4 o2 `0 p' j' d) w( w( f
    int     2Fh7 Y, h9 O0 ]- X0 B" S
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
* E# t; G9 e* g) R1 B& {5 i    add     ax, di8 C* ^* s# V$ a( v7 R! G& Z8 X
    test    ax,ax: q$ N3 ?* L0 [" k. N7 y
    jnz     SoftICE_Detected2 ?( C4 M9 U* I. ]( n
# {8 q2 @7 q& O2 c0 e
___________________________________________________________________________0 V) ?- x: F( D9 M, k

, |6 u: S6 T- }Method 04
8 ]1 C# R( }2 b=========
& L% s* i6 F* f' H# p9 f5 m1 C  q( f' S' d& B
Method identical to the preceding one except that it seeks the ID of SoftICE& I; [& Z, H! R3 G. k. u
GFX VxD.3 a& @3 _  o( E2 D6 X

: n  h3 T3 Z$ p4 L$ ~2 Y    xor     di,di/ h! _" i- a5 }2 L& o9 a! M
    mov     es,di
8 A* {: {, J2 Z    mov     ax, 1684h       3 K- u/ H  [7 v7 z1 L2 w5 Q1 a% q; j
    mov     bx, 7a5Fh       ; VxD ID of SIWVID% n8 {3 R( W) L/ e
    int     2fh
. r6 j) R5 Q7 s    mov     ax, es          ; ES:DI -&gt; VxD API entry point) ?$ K# I$ O0 M) C/ p  \
    add     ax, di) R# D6 k) y0 u# A
    test    ax,ax0 L& T  _- |0 p( z6 t
    jnz     SoftICE_Detected
+ W! p' E8 K; p$ E/ I) {
/ k  M! t. C2 |# D2 o( g) s) B__________________________________________________________________________
) n. i0 Y+ H7 c1 Q9 e% O' B, g' E% |3 W/ G

! L. G; s5 S* ?# gMethod 05
" A9 w/ \! E( {: @0 G" m=========: ?- S. G6 ?( m2 _6 @& q

  n' S4 U( P4 X" ^Method seeking the 'magic number' 0F386h returned (in ax) by all system
7 r4 P1 E6 I  g; p/ a0 H& X! Edebugger. It calls the int 41h, function 4Fh.) S0 {! q3 J2 T3 z  N! Z
There are several alternatives.  % }' \# @: O) f( X( h' ~
2 |5 N8 n0 @: j* H
The following one is the simplest:" l; ^' H/ j# z7 j, W& m
; s5 T, p# m/ U  P- \6 u
    mov     ax,4fh2 V% B% m9 c/ b; p5 j# a
    int     41h
" n4 X' ?+ v9 L" o' f% T4 a    cmp     ax, 0F3862 X; b: v; O7 C3 _9 a! @
    jz      SoftICE_detected
9 C) z6 }$ F% K2 u3 F" Z9 A  F) N- z+ b

% X+ z0 i+ l2 q) K; c" c2 o6 x$ ]6 ]Next method as well as the following one are 2 examples from Stone's " X% n$ ]$ ?( T4 U3 J7 C
"stn-wid.zip" (www.cracking.net):
5 y) E# }9 r" _0 i5 K# u) Q0 Z
. @  o) Q# `1 ^4 h% G: C    mov     bx, cs& T4 U$ t' b2 t" b  V
    lea     dx, int41handler27 Z1 x1 D3 |( j* C9 |5 Q) w
    xchg    dx, es:[41h*4]
6 g7 R2 E# @0 [" C% l; u    xchg    bx, es:[41h*4+2]& M( K3 ~1 X( [: J
    mov     ax,4fh
5 D$ D6 z( U; O$ t  _7 S& W3 f    int     41h
+ G; E6 _& m9 a5 f* @    xchg    dx, es:[41h*4]
  y" p- d! _' G% p1 C    xchg    bx, es:[41h*4+2]) m7 i$ M- @! C+ r, r
    cmp     ax, 0f386h
9 U5 b; m7 w, C7 X. J    jz      SoftICE_detected- V; {% |: e& c* [$ w
/ z% E+ A+ y0 u& {
int41handler2 PROC; M' `! p# G7 S1 ]9 c: S3 I( e
    iret4 K# i9 x2 p" J
int41handler2 ENDP
- ?9 B- j8 z+ D) j
$ _9 Q6 z5 ?/ O& ]. a5 w6 }, e
7 ?1 W- J5 R* q6 b! F_________________________________________________________________________
- z0 |8 K% k: b, o
: d. ]$ C8 q6 w1 T, T) D. m; i1 Q! z9 S5 J
Method 06
. C& B  z9 L% l! O0 R8 R=========" n# |. R, b. \
4 _/ _+ c+ m. p5 e! m
* T8 D' U. E. n  C4 V( w+ |$ X
2nd method similar to the preceding one but more difficult to detect:
9 t) n7 Q' M5 E. ^- X; ^/ t& E! n1 |1 h& W5 N' d4 B

% v: U/ L9 m3 f6 }1 B! |+ \1 Iint41handler PROC9 r3 p$ B. X3 z5 _- ^+ B
    mov     cl,al
; I. x- B( \2 w* V$ z1 V    iret2 ?; x' i# d; F
int41handler ENDP  L5 C9 F* u3 Q. j8 T2 {% X! \% v( a
  s* q0 ~" x: j) w7 o' @! p

2 k; c& {* X4 ?% w/ d( @8 t    xor     ax,ax
7 ^, ]+ N* e/ }* k  ?    mov     es,ax
; V' s# t6 Y8 o1 G# G    mov     bx, cs8 W$ i% @' [& l
    lea     dx, int41handler
# ~% i- ~  p8 H1 \2 B% \    xchg    dx, es:[41h*4]; a1 d  p8 n$ E: O7 x- Y- [
    xchg    bx, es:[41h*4+2]- _) B" k: o( r' t: l# B
    in      al, 40h  [0 c3 Q* o8 ^) K0 F& R
    xor     cx,cx  V7 q: |+ B3 _2 @5 P8 `  [; D
    int     41h
5 u. a4 d. Z1 t    xchg    dx, es:[41h*4]3 E# `7 I6 A! W8 U* t0 v3 ^
    xchg    bx, es:[41h*4+2]; j2 C0 J2 f2 {  Z6 ~. G, L
    cmp     cl,al% D4 Z* O6 U7 a  i
    jnz     SoftICE_detected/ @3 {( w% W8 _) I* f$ }

' }& u2 F; _* A( R_________________________________________________________________________
$ S' b! f4 E0 t0 \- p% J& W4 t. ?  C" z* H" o
Method 07
" T# k- ]" k/ D3 f3 m=========
2 _" \9 m: x3 v! a5 e) J9 W% g! {6 D% b) b& _
Method of detection of the WinICE handler in the int68h (V86)
; ^% x2 `3 x* p  }# L4 J4 o
5 L4 L6 S2 Q% P& {3 b- h    mov     ah,43h* D( ?3 N  {- V
    int     68h
/ a0 b1 `+ H" C" |! w! |0 {    cmp     ax,0F386h
6 i5 x! k5 r- I: p# b, G    jz      SoftICE_Detected$ L9 I: r2 V4 h: i
( A6 A! Z1 k* D. Y8 C) M) G0 s8 h% C
  a' o, h/ E6 X9 t# U
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit) j' ~0 @  b5 Q* S) N
   app like this:
! h- S6 o+ m1 r# x- S  l% ~  J0 y9 H! d. s0 T& _
   BPX exec_int if ax==68% B1 _$ a; w2 w& }
   (function called is located at byte ptr [ebp+1Dh] and client eip is3 a8 H$ q; a; ]1 L4 j) E
   located at [ebp+48h] for 32Bit apps)
- x) j% ~/ e0 Y7 v( d  ]$ q% |__________________________________________________________________________
; }  L5 y1 l8 F6 g; B' q* E' @8 e$ {# \
0 s7 K9 T( M: v/ G8 n  r
Method 08" w" q7 Z! |8 U/ |5 x) H
=========/ I" q6 T. g7 W

' E* `0 O/ |) h  t: Z7 N' IIt is not a method of detection of SoftICE but a possibility to crash the8 y( I* Y7 Y- X7 o
system by intercepting int 01h and int 03h and redirecting them to another! y( r, L# ]0 U( n/ V
routine.* W' A5 r/ V( A( |
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points& I2 U: f9 d3 Z- x* h8 O$ w
to the new routine to execute (hangs computer...)
/ i5 ]/ B1 H1 j5 a* o% k6 O8 ^4 M
& y  Y( W1 h2 ]" D; @. v# r7 }    mov     ah, 25h
" N9 Y6 K2 J' C1 O. l    mov     al, Int_Number (01h or 03h)
$ Z! A7 R) p: P, ~$ Q; a4 u$ m    mov     dx, offset New_Int_Routine
7 e. Y0 _3 Q7 {6 R    int     21h# Q; a+ w1 C# [4 H
- T# v  g+ H& Z0 Q
__________________________________________________________________________
! a6 b( D2 f, T# f6 l+ ]  l
/ V3 A7 }. A+ WMethod 091 r- i$ U7 ?' x
=========
4 B. g6 P  `' b, _7 L1 ^& d# s4 |  A3 `
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only% Y  X/ `; N8 q3 F
performed in ring0 (VxD or a ring3 app using the VxdCall).# K$ B. ?% M  i5 E  T
The Get_DDB service is used to determine whether or not a VxD is installed2 U& @, r* Q0 {/ m, w& i
for the specified device and returns a Device Description Block (in ecx) for
5 `" |& B- e6 U4 pthat device if it is installed.0 ^4 ~" D7 E) c" A' R2 v
4 g# M9 w" h  q6 Z7 Z
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
; ]7 a0 b& g, y9 G1 }   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
  k5 A. F3 j% S& B2 p& D   VMMCall Get_DDB
: I7 g* U0 X1 Z/ H2 L7 }5 }   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
. w, |  N$ s9 M0 D7 O
2 o+ a( m5 {1 jNote as well that you can easily detect this method with SoftICE:% z( i6 s( Y% a( q. v9 H2 G
   bpx Get_DDB if ax==0202 || ax==7a5fh
8 E  v- C9 z  n1 M/ r
$ M4 f. F* v  z4 u2 q: N: J8 j__________________________________________________________________________* [& Q/ R: j& ~' ^! i2 f
' I2 _9 @/ W& C* ]8 W; |$ ~
Method 10
8 D1 V8 `. T( X* s=========
, J% j& e" o! M6 M
1 G. l, E4 b/ ^0 O1 D" t=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with! A! k% V9 W/ i/ F( a, b5 w/ K
  SoftICE while the option is enable!!, ?# @( ^" {; o' {3 ?

% P  E& T. }$ I$ n+ nThis trick is very efficient:
& |2 ~9 V, x# ~  nby checking the Debug Registers, you can detect if SoftICE is loaded3 O  ^* @6 }. ]! E: a; n
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
: O4 R: ^4 [4 n, y. G2 U. N) |9 |there are some memory breakpoints set (dr0 to dr3) simply by reading their
' k: {3 ?- @8 A2 g9 }) rvalue (in ring0 only). Values can be manipulated and or changed as well
) I3 ~% s' R( F; E+ b% q  l(clearing BPMs for instance)) u' F. I, C( `" o4 s  X4 ]' J
* @! h# k9 E  D. S
__________________________________________________________________________- ]1 U5 a5 Z- J2 \' B8 G2 U

' N  O& w# }+ ^7 u# }: q  }Method 112 I1 E4 v5 z, ^2 X, Y' M  M
=========
% f$ |8 I8 Z$ m
1 P9 w$ S; s2 p- X1 }% BThis method is most known as 'MeltICE' because it has been freely distributed
# Q/ V+ j+ P4 D5 A8 wvia www.winfiles.com. However it was first used by NuMega people to allow8 ^( E/ n. w/ |8 \* K/ l
Symbol Loader to check if SoftICE was active or not (the code is located
( M6 d8 i3 q0 pinside nmtrans.dll).4 s  g( @, C6 f! [! C1 J
2 ~! M- `- O4 H$ |, [, _
The way it works is very simple:- f$ g3 R) v' Q
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
8 @( b# k! p7 s( i% y) EWinNT) with the CreateFileA API.
. @" O: N7 d$ Z) G6 d' T0 }2 _
Here is a sample (checking for 'SICE'):! k+ _% H3 @; W
8 G& r  k4 ?. ?" n& p; B; c
BOOL IsSoftIce95Loaded()
" X9 L* p: a+ V1 |{
6 w1 C4 [8 F3 m   HANDLE hFile;  
% j' e! `4 |9 c1 N+ y2 z; [) h* x   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,6 @- C" v+ L+ u2 h
                      FILE_SHARE_READ | FILE_SHARE_WRITE,# q  Y) m$ [+ P3 s5 ?' G
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
3 Q! Y/ v# z1 P- E" l  d# r5 O   if( hFile != INVALID_HANDLE_VALUE )4 c% T" K7 p7 }( R8 y) ^
   {/ v' N+ b2 q- Y( e# ?0 p. i8 {" P
      CloseHandle(hFile);
" j3 m9 `! ]/ ^" s0 B$ D      return TRUE;
2 ]' g4 p2 I3 _   }
+ @3 R$ }# U$ O   return FALSE;
+ Q: O: J* P; v0 E) R}
: T1 U5 P# E0 V( g% G" W3 U! n0 Y5 l( Q6 {
Although this trick calls the CreateFileA function, don't even expect to be
; x. F! z- Y' [: a# k) o8 iable to intercept it by installing a IFS hook: it will not work, no way!
+ W3 O. j: C, [In fact, after the call to CreateFileA it will get through VWIN32 0x001F
# H! v( R/ L, K3 sservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
  r8 x" K- V5 ~. x. p- c! dand then browse the DDB list until it find the VxD and its DDB_Control_Proc: j* Y: h9 c4 Y, m+ r- [) [0 z# x* L+ ~
field.
* D% S7 L+ R1 ^, k4 w# S+ t2 uIn fact, its purpose is not to load/unload VxDs but only to send a
! U3 w/ o( B( c" V1 rW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)9 T' y# Q: G7 E- ]/ Z, Y0 L
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
  M$ N% I) k) u0 l- Y  o4 ]9 xto load/unload a non-dynamically loadable driver such as SoftICE ;-).0 d. @7 j4 ~: L
If the VxD is loaded, it will always clear eax and the Carry flag to allow7 m$ A! Y* ~0 U6 P+ c
its handle to be opened and then, will be detected.. M& Y" M- O, K
You can check that simply by hooking Winice.exe control proc entry point' L4 T" R8 D/ {0 w5 r6 r, [* b# H
while running MeltICE.% @( c& o5 k" }% x' r

3 [% n/ {0 b6 B' B1 A  y4 M$ g1 H& J& U  W3 J3 ~$ T/ I
  00401067:  push      00402025    ; \\.\SICE: U  |& B. f0 ~$ P" u
  0040106C:  call      CreateFileA
% a2 q* D+ F- d$ D& G" V# I  r  00401071:  cmp       eax,-001& O4 P# g9 B1 W9 N4 m$ Y
  00401074:  je        00401091
, V% O9 D9 C: I' Z5 m9 R
% c7 x! f, I. Y, @* p1 }" F
1 M2 X) L% H$ d+ N8 n. xThere could be hundreds of BPX you could use to detect this trick.
8 E2 @# K2 w; _- w# n7 H-The most classical one is:# ]3 ], K, z1 d% h: Y& r
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||) e1 n6 q) |  b2 n) G5 y
    *(esp-&gt;4+4)=='NTIC'* g' o9 V$ ?' E: M2 k7 Z  p
+ Y7 }! _- E/ b/ |
-The most exotic ones (could be very slooooow :-(% N, O, y- _: f6 \$ {
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  " z7 R4 c: S9 ]3 \8 j
     ;will break 3 times :-(- f5 y5 C$ c# V
$ W) P' p% @7 Q# l; L5 @* K+ ~+ J( s
-or (a bit) faster: ; l/ |) v% `0 l1 o/ O# |; Q
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
* e; x! w6 @- p5 [" `) z' }9 S
/ B. x! \. n0 T/ w% G! a3 o$ b  F   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
; E8 W+ A) b$ Z( C) Y* Q     ;will break 3 times :-(
* X( U, }9 }. E0 V
8 u. e+ Y/ v8 |-Much faster:+ x0 L5 Z7 N0 f* ]& q/ Y# O) _5 a
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'4 i& g6 [0 r% t6 ~
# @* I7 j! J* T2 C- h' ~1 F
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen8 l- }, J; Q/ }# U4 Y/ L% S, ]
function to do the same job:
- ?; v% ^  b/ c& x, }% {, k3 I. J/ V# O! a- d( x+ H* i
   push    00                        ; OF_READ
* l# Z% \+ i5 G6 P" z4 y/ \4 v   mov     eax,[00656634]            ; '\\.\SICE',0* Y2 x+ }/ P# U! l
   push    eax% L% G/ Y$ [( r. @# x
   call    KERNEL32!_lopen8 [! Y5 T) `* d" b; Y8 O1 Z' ^
   inc     eax# y/ i2 ~8 \$ i" o- _
   jnz     00650589                  ; detected( J: t5 W  c8 r7 V2 F# t# F# f
   push    00                        ; OF_READ$ n) c; \' W( F: H: \4 Y! ~1 Y
   mov     eax,[00656638]            ; '\\.\SICE'
  T! I/ a% ?* r* U& `0 M   push    eax0 N, x# {3 J) p! |# Q
   call    KERNEL32!_lopen7 D' B0 H* ^+ m) N4 V
   inc     eax
2 {! b7 l  {$ ~/ t, l* F4 _   jz      006505ae                  ; not detected% Y* j! t3 x- s5 h- D
( h) `/ k1 x: d

# y7 ~) G, `# a3 z: S3 `__________________________________________________________________________
1 N' O; B" [) A- J
2 W3 x1 f# k3 \" x* lMethod 12
; D( B0 Q4 L9 p1 h' l( C( l=========$ g1 T5 \/ d+ J& k# y* s0 p4 O

! ]3 q( h; D* H2 D, ?( RThis trick is similar to int41h/4fh Debugger installation check (code 05
5 @7 ], U) Q# n$ I&amp; 06) but very limited because it's only available for Win95/98 (not NT)' h6 }! K. F( R( I1 V! ?  x
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.# K3 @0 ]4 l" _7 d5 H5 G, E
0 e7 S1 Y  ^. \! s
   push  0000004fh         ; function 4fh0 f! J; d: Z6 t) c2 _
   push  002a002ah         ; high word specifies which VxD (VWIN32)+ A6 _9 |: P1 u9 x. i4 i
                           ; low word specifies which service
: v, J# x4 f9 ^$ X: y                             (VWIN32_Int41Dispatch)
2 a1 I2 b9 ?1 j; l7 _* Z9 a   call  Kernel32!ORD_001  ; VxdCall
! h' r3 _, _8 {   cmp   ax, 0f386h        ; magic number returned by system debuggers
. W% g- j7 i- r  P9 F5 o  c   jz    SoftICE_detected
. d6 ^; n& E! ~& D
" \( c4 P, `2 n0 vHere again, several ways to detect it:2 U0 J5 e  ^* R* l% l

1 h+ ]) L; h( ]- K9 R# f% D& O$ @- C0 G    BPINT 41 if ax==4f
* \0 C( L- i7 H2 ^3 i6 A6 `" z5 S% r) n  t/ |
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one% @3 {% ?- Z" z7 u3 U0 h! |, p
% q3 q7 m5 J: Q5 D
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A$ s5 l6 L0 v' ?( @( _

% P1 S$ ]/ {- m3 U' b$ S! K) }4 H    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!/ t9 Q& |9 G. s8 {$ V4 W
' T0 @8 s( m0 n- V! o/ ~
__________________________________________________________________________
: [, u4 \6 W- i" r7 z5 Y$ p8 c' U7 K( H6 U" x
Method 13
6 O! I9 ~' N, D- I=========+ i9 D9 P4 q5 W  H2 R2 G+ E5 `' ^

) I! q$ K/ \) TNot a real method of detection, but a good way to know if SoftICE is$ s8 K; a% M6 v2 S: g+ ~8 |
installed on a computer and to locate its installation directory.# j( J  y3 [4 E
It is used by few softs which access the following registry keys (usually #2) :3 m# U* ?! D  l+ m  }

) l  U; t/ U; _% ~-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion# B0 {- w9 @$ t3 u3 i
\Uninstall\SoftICE" d5 r  \6 A/ f) _
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE; a' e7 C& z$ j% x/ A4 |" `
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion- \9 K$ h+ g5 `2 ^2 Y
\App Paths\Loader32.Exe
  z) Z. D7 A  |* G3 O  v: E
! w* I2 N5 A1 a7 |- h
$ ?& c$ @! ?! f' L) ~( b" RNote that some nasty apps could then erase all files from SoftICE directory
+ v1 ~/ n. F9 N, Q# x( ](I faced that once :-(, t/ C  a% h0 ?' R

3 `+ P6 [9 Q) O+ ~9 E, KUseful breakpoint to detect it:
4 U, |+ |, C, t: V
3 [: |' s$ H; b) @, g( P( `, J     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
! t: D2 ^8 m9 ^% b% r3 T$ O, N
7 ?) ]& {" p! Q) E* |__________________________________________________________________________2 `+ X$ c- i2 `2 d
5 e% }6 w0 ^' b; l- j
+ b# O4 V5 S+ ]7 K
Method 14
* z  U' P- [  k# _1 W. i=========: M# _% C$ v, W
) g+ d* |; c1 V
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose$ T4 _9 }( N0 f. q% W7 K$ r
is to determines whether a debugger is running on your system (ring0 only).
& }% F) ]7 [( c0 R6 f# B! ~2 E/ M4 r" P
   VMMCall Test_Debug_Installed
, q3 y- T. z7 x/ H   je      not_installed" u8 |3 E; \1 v( n

5 Y6 L8 V1 C4 E$ hThis service just checks a flag.
. u7 a5 z1 B& q</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-7-25 07:26

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表