About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
, t, B* V2 ?: P1 f/ x" W$ Q<TBODY>
3 n* X& I& `6 j, O+ V<TR>9 {) e8 X8 `. n
<TD><PRE>Method 01
: ^* W) n' B; G( s; `; k2 H=========! f3 C4 m% R, ~& J0 J( k9 r
2 i/ U; q  U. V1 f# B4 i9 K
This method of detection of SoftICE (as well as the following one) is& q% T( ?7 r+ G3 ]1 _
used by the majority of packers/encryptors found on Internet.5 T! \5 y' G- ]8 O  K  M/ m! f
It seeks the signature of BoundsChecker in SoftICE; P3 K5 N6 G" O: Q4 V" W
: W: P% i" S' w) l% h: E+ O: m
    mov     ebp, 04243484Bh        ; 'BCHK'/ b4 k' A: R8 l- J) s7 C* M: j4 |
    mov     ax, 04h
3 O4 C1 b+ P( s    int     3       ! W- ~6 ?- ~- ?( s9 s- f8 [3 W
    cmp     al,4
* W# W3 H, i8 g* G0 ]    jnz     SoftICE_Detected
  d) C5 C0 B7 _- }8 X+ |# `1 a
+ N0 `- W/ t1 v0 ^___________________________________________________________________________
( N/ P3 K7 g/ x: U& ~1 \2 O
: r0 j. f3 ^- U5 w1 DMethod 02
4 P) ~" \% E% p5 K=========
9 `1 I4 a9 h0 T) i7 m+ _0 m0 L( J- I; m
Still a method very much used (perhaps the most frequent one).  It is used( Y  K1 \; V6 B: ?4 Q
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
/ W3 ~# x  c3 }3 W; r7 hor execute SoftICE commands.... ~0 E$ S# u' [! D2 n8 C: D$ B
It is also used to crash SoftICE and to force it to execute any commands
3 h+ O  U: I" [+ M(HBOOT...) :-((  
/ M. c* h  `6 c) W; L5 c
$ G- O& K( j) m1 j* ^, WHere is a quick description:5 B1 X' U3 Y: J* D8 {- D' m
-AX = 0910h   (Display string in SIce windows)9 Q4 @7 O; v) [8 P" A: I: F
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
4 k% A- Y8 Q9 m: j6 J7 {-AX = 0912h   (Get breakpoint infos)/ }7 @' v2 P( ~
-AX = 0913h   (Set Sice breakpoints)
* [6 E8 C! ~2 U- G& {* U1 p8 K' {-AX = 0914h   (Remove SIce breakoints)
: F7 s1 \# `0 a# B7 c  m
9 n3 n" P  a" C' ]- _5 ?; V( oEach time you'll meet this trick, you'll see:
1 Y4 |) K9 K) W- ?. E/ Y7 D-SI = 4647h1 r  j% F' t3 i* B. [
-DI = 4A4Dh
7 L' x$ ]1 G. C0 T2 @Which are the 'magic values' used by SoftIce.4 \& K  s  ?1 R' _7 `) g% Q7 _8 `" k' r
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
7 ]% f8 c8 b9 z% I# b4 x! V& L. b9 h, s
Here is one example from the file "Haspinst.exe" which is the dongle HASP
/ B0 b- R1 H" p+ ]Envelope utility use to protect DOS applications:
( L: q: A' r2 w/ q; u4 s; U4 Z/ K- h( K3 {
4 y+ T+ H0 Y, g) |2 R. c
4C19:0095   MOV    AX,0911  ; execute command.2 e/ T! C5 A! k5 w4 }
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).0 p0 o6 n( T) `
4C19:009A   MOV    SI,4647  ; 1st magic value.
$ `/ n1 S6 Z/ M0 u! d9 ~. F4C19:009D   MOV    DI,4A4D  ; 2nd magic value.8 G% j$ h7 R; C  j( i$ ^
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
* x/ A# F# g2 ?- b  t% @/ {4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute7 C' ?3 r" m7 u. s% p
4C19:00A4   INC    CX: R: T6 X( T* i
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute% d3 j3 n5 D# L+ K$ H: [
4C19:00A8   JB     0095     ; 6 different commands.7 {1 A! ?0 M1 [" U6 e4 y' z
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.& Y/ ?' F1 h  r/ k0 _
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)( \: ~7 L5 I4 o, i. r. G
" R0 l/ E' K- ^% ?5 k7 [
The program will execute 6 different SIce commands located at ds:dx, which
; x0 f2 O$ o' ]* `& z7 \3 Nare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.4 Z" |, K% _( d/ d

& D9 Y& z+ \# @* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
4 {& X/ b9 T8 G$ a___________________________________________________________________________
" A6 ]8 |: I3 T7 E
+ C- U6 u8 Y8 u/ r. u; V. r. p' ^; z
Method 031 e! [9 O( W2 ]* s5 z6 e0 f. w$ @
=========- L6 ?( ?) X( O9 b3 r4 n
5 E% q! W$ g2 @/ E
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h# d, T* O  H$ K' c3 i: ~4 s9 A
(API Get entry point)  y0 l! S" q( f3 H$ j% Z3 h
        : [$ T6 \1 h! U, C% M) V
6 J0 R1 a4 @3 |7 [! o2 P6 G
    xor     di,di" Z# n, p3 D) {) f+ d9 h0 U6 n
    mov     es,di; E$ T, p: `# t, @8 ?0 Z
    mov     ax, 1684h       + p8 l( b: o% L; j
    mov     bx, 0202h       ; VxD ID of winice% \: e& D8 I) J% r2 l5 q& @+ t4 w
    int     2Fh
3 K! H& S& K8 G; f    mov     ax, es          ; ES:DI -&gt; VxD API entry point
* u9 ^. `/ d- l7 p    add     ax, di
& r* N- \, ]1 `& j  J& v) j    test    ax,ax1 |% }( D. D& f: D7 D) s  {( |1 }. E  h! C
    jnz     SoftICE_Detected- z. d2 x% m" i- ~% \3 b

  P5 \' v+ {: m/ r4 U7 p( S3 [___________________________________________________________________________
1 K3 ?# f1 ~- j$ Q$ t7 F! w- x$ k  v2 r( w  z
Method 04
. j; J  n' t: s1 p* X1 I* s=========( T8 P, R! C7 ~+ z  C9 _
- }0 c( {2 a, H4 v0 k, F
Method identical to the preceding one except that it seeks the ID of SoftICE
' o  l0 X( L7 t) ^$ bGFX VxD.
8 N; _6 A6 y0 k! J+ ~$ h* |) {+ Q
    xor     di,di
4 c* Z% [8 U! y* L$ @! r& j3 k    mov     es,di
( n5 q7 `5 z1 N  s2 F/ S1 C5 m, w    mov     ax, 1684h       . N4 R) V. G4 J& t
    mov     bx, 7a5Fh       ; VxD ID of SIWVID
6 W8 N( [; W. h* ^& ?' N    int     2fh
- C3 e4 R7 q' v, B3 s; e6 U4 S    mov     ax, es          ; ES:DI -&gt; VxD API entry point2 I1 n* W, T7 T( N' W8 `  O7 Q
    add     ax, di
$ b& t5 _! S, L    test    ax,ax* ]% H0 A; u( v7 v3 ]1 L) u- ]
    jnz     SoftICE_Detected
/ j! k2 i7 \# _
9 O9 n# Y# \8 I" E! T__________________________________________________________________________
9 q. ^6 f+ y, V3 p
* T; N0 n# x3 Z0 j: K# L; b9 n5 V* x( D) B
Method 05
( N) X* a5 b; R1 I7 M=========: r& h& A0 s5 s  x& H) ~0 B
0 v( {. m; x1 w6 Q- ]
Method seeking the 'magic number' 0F386h returned (in ax) by all system$ T8 j, B5 T/ e! [: h
debugger. It calls the int 41h, function 4Fh.
8 E6 r. ?. [* Z- |There are several alternatives.  7 C" Q5 p: A, Y: {; h! w) d
6 ^5 b# L" o9 x' W, T
The following one is the simplest:
; s5 c8 K: C: j) |
* h. ~/ I8 u0 B# q5 x, K    mov     ax,4fh
3 b2 G/ [, h: v; T    int     41h
1 z% G0 n) ^1 L& C3 t! T9 z/ x    cmp     ax, 0F386
$ z$ f' f0 q9 U( D6 L6 k    jz      SoftICE_detected
7 @/ p5 E8 v8 R2 l0 }
. U+ Z' }/ G. H% t) h# f6 e
2 A! G+ l3 [; M2 m5 ]2 J3 HNext method as well as the following one are 2 examples from Stone's
) Q  w, K- L9 @8 _, u' ?"stn-wid.zip" (www.cracking.net):, J6 J& u% |$ u+ Y. w; H* B
- k, D0 N, G0 [% D# w( I
    mov     bx, cs( G9 |/ \. a& ]5 O- ^
    lea     dx, int41handler2
/ Y) \/ l  A5 Q& J7 |. T    xchg    dx, es:[41h*4]! c7 \: L) T1 P
    xchg    bx, es:[41h*4+2]
4 s/ V9 E; ?/ z6 m: ~( M" I    mov     ax,4fh
- I. g* G$ d7 j% S7 V    int     41h1 ]# }4 P& L; [7 Y
    xchg    dx, es:[41h*4]4 ^; I5 H/ {6 Y
    xchg    bx, es:[41h*4+2]  a. U: c& g: g: M  G, e: B; S2 T
    cmp     ax, 0f386h
- B) B+ B: j" P* m# T, o; m' e    jz      SoftICE_detected; E2 Q2 I% t9 l  ^$ E+ P% J( s. a

4 b5 r& l$ @8 W; U; U( ?8 }int41handler2 PROC
& G5 T; b9 v6 A: }; E    iret! M* |, h' i* b
int41handler2 ENDP
' o! H. z) L" a& {0 t( ~0 C
/ N; Z5 S+ ^  T' a! I8 [$ K, S0 E
3 G9 x2 G$ d6 F* Y' }" y_________________________________________________________________________
! O0 X) Y6 R1 h0 L, W+ l  d% S$ `# y1 p1 G) n8 ^5 P  t

, k6 S2 B' y1 u6 X. j% MMethod 069 v4 ~  [5 @! m$ [: m* S6 N& U
=========! C6 u6 i( O* v, @) m$ V
' K, b# b+ v( Z0 M6 _) ?
9 t5 k- g6 m" u" _# R, G) \
2nd method similar to the preceding one but more difficult to detect:  f2 v: q; S0 X: X

( S$ C( x/ z' Q7 q& Q
' I0 \: y0 k5 ^+ a; a% s$ [* \( }int41handler PROC
" _# A- M, P8 o2 u2 h1 V! N    mov     cl,al
7 d/ N# j3 I$ V3 g    iret
/ K) O# p2 M# c* H8 H& A' c( Hint41handler ENDP2 P# p: J9 q5 h: q  P0 D

1 }& i% o/ c  L- _
. K9 m) w3 W; H5 v* [9 {! ]. c    xor     ax,ax" c- Z6 T2 l8 P' k+ O' g8 \+ C# V
    mov     es,ax0 o; W4 d& O8 K# z" E4 J
    mov     bx, cs5 Q% m! @( @) n# S2 J! e
    lea     dx, int41handler/ I' _' s1 b% f* ]$ g- S! v
    xchg    dx, es:[41h*4]! T7 m1 E/ K+ t9 ^' N' |
    xchg    bx, es:[41h*4+2]
0 n  ?6 Y: m9 T: X) V    in      al, 40h5 I3 ?* P5 B9 H  [
    xor     cx,cx
- n7 d8 L) P7 Z) X    int     41h
# {+ H- d8 J3 M    xchg    dx, es:[41h*4]
3 S4 e5 S7 n5 a) N0 m! Z1 i    xchg    bx, es:[41h*4+2]0 e2 w) T8 a' `2 U
    cmp     cl,al
( ]1 J7 ~) x( H  p& M    jnz     SoftICE_detected8 y$ ^' e" u9 ~8 N0 s: b1 P/ r& ^: h

9 Q& ~9 `8 x4 @$ B" H3 A4 H( [+ p_________________________________________________________________________( b0 D; b, A2 t) Q3 G3 A
, r% G! i! a7 R& e0 n& b) ^
Method 07
: [. a! a7 W/ n$ s# V0 d1 x=========8 D4 Y: Y4 n. w  U- A4 n; a
+ s2 O- W& e0 g6 H# r: Q
Method of detection of the WinICE handler in the int68h (V86)2 d4 r) B& K0 {( g" W5 |

8 E' T% w+ L3 {, b7 p$ T, `    mov     ah,43h
6 ^- Y( G# Z3 e7 c8 Y! D3 s" P    int     68h
/ B9 l* _4 i7 U4 Y) \    cmp     ax,0F386h
& @# f/ x- I2 \: q; h5 K    jz      SoftICE_Detected
2 C; s) f' L) |* t: D
1 T1 m& ]1 T4 T. }- [# V: ~) D9 E( }0 o' x, a
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
# w4 j, b; }; s5 n/ _$ |5 S1 n   app like this:1 J) W5 z$ O+ @5 @  z/ S

* T  H3 ]* Y; w. ?# }   BPX exec_int if ax==68/ l- y" A7 @! S" ]/ Y( ~- b
   (function called is located at byte ptr [ebp+1Dh] and client eip is
6 m: N# ^; N, O" H# |   located at [ebp+48h] for 32Bit apps). A9 @0 N# l  t& J5 T! I/ O& J1 C
__________________________________________________________________________( {9 N$ x! s9 u

6 e" m0 n- L$ c$ P4 O
$ N. B- }. x! {& L1 JMethod 082 X* u& O, q: b! F9 x
=========$ Z8 ?( g+ k' n

% |7 c$ K2 ]- l5 P; mIt is not a method of detection of SoftICE but a possibility to crash the4 ~7 q- \. I: j6 d' C
system by intercepting int 01h and int 03h and redirecting them to another
* g2 v7 V5 N( ^: ^9 x% `( ]routine.
1 ?9 i6 E& e5 ?$ L( e$ g4 yIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
5 d/ N$ j6 b/ q  qto the new routine to execute (hangs computer...)
% S9 D" [. M/ C+ K6 H
( n; \' r" P" _* T. ~    mov     ah, 25h" m6 f7 m3 i2 `7 u4 a8 p7 ~
    mov     al, Int_Number (01h or 03h)
, W, x1 L" h! y; o9 ~; @    mov     dx, offset New_Int_Routine
. V6 t% z3 Q+ L5 b( f% T    int     21h. P! x  A  T; P9 {4 m

* ^# y( {+ D) y: Y__________________________________________________________________________
: H! j% K+ s" Y* f( \5 E5 p4 y: Y" z+ S/ i, g
Method 092 H7 c9 V; f7 Q- u
=========) t6 W) z5 P- k

/ p' n7 w: ?, iThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
9 [- y7 ?9 U# I! [  n0 E9 @: V9 vperformed in ring0 (VxD or a ring3 app using the VxdCall).
- H! E+ Q; V# N1 X3 u9 tThe Get_DDB service is used to determine whether or not a VxD is installed( p& E  i  y3 a4 B" E9 S1 F
for the specified device and returns a Device Description Block (in ecx) for+ W* _, {$ W, l. ^4 n" c
that device if it is installed.3 L9 ]4 A" z. P# i

/ D' |9 p% ]/ |   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
9 s1 k" ^8 F$ y. M, D# y   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-): u! `1 l8 A* }
   VMMCall Get_DDB+ W. N" `7 n9 D9 ~) C
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed/ m  |3 A& k; F8 d
! _: w6 x/ A# T+ r, u
Note as well that you can easily detect this method with SoftICE:% {" K7 H. K, q/ P: i) ]
   bpx Get_DDB if ax==0202 || ax==7a5fh
! X; c1 m* ~9 |9 ~
) w1 l$ H( V  a1 H3 j__________________________________________________________________________
8 W1 b$ R, \" U' i; {
7 B  h, v& G- q$ i: bMethod 10
9 X  Q8 M0 o; j4 C- W/ U& ^=========
6 f  Q# M5 y9 n- B! @. T- z/ W: f% f5 n
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with- ^9 R4 U8 k+ [( i. ~! \
  SoftICE while the option is enable!!. y. ^6 ]1 g3 L8 ~( B' e

+ i7 n% d' J" g9 \6 q1 {2 AThis trick is very efficient:8 L6 G( n! ^8 y+ j& q* O
by checking the Debug Registers, you can detect if SoftICE is loaded6 W6 b6 N, M2 r1 ^
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
0 |( ?) y+ S. c/ V  h  r- u) d9 athere are some memory breakpoints set (dr0 to dr3) simply by reading their
) x) M2 B- q  Hvalue (in ring0 only). Values can be manipulated and or changed as well
3 r3 s5 V# Q) D4 u7 k7 H6 O& R(clearing BPMs for instance)- U  Q, l- Q/ t% i" b5 N6 p

% J% Q( W% d) d& v! R4 E8 s__________________________________________________________________________8 Z/ R* C# n0 i, i
: H  `$ t7 M/ V' d& g
Method 11' V2 u4 B' w/ _0 u$ @
=========$ T( ?$ l3 G" H6 q' Z6 ^9 M1 T

+ U  T; W' d; Q1 FThis method is most known as 'MeltICE' because it has been freely distributed) Z* O5 H, `# B6 |  J8 X& a
via www.winfiles.com. However it was first used by NuMega people to allow2 ^8 g, g( G6 ]7 `7 A5 Q
Symbol Loader to check if SoftICE was active or not (the code is located
9 Z" Z# B) w8 e* ]7 q3 Rinside nmtrans.dll).$ [9 e. D# A& f" ^
( Z& T: Y; ^$ R! F' P
The way it works is very simple:& \# ~: x7 L6 A0 _/ a+ O6 \
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
( t% Y. \) V* n- _  ?+ EWinNT) with the CreateFileA API., _5 R3 y& q3 z# i# m4 d4 |' c
; f( h  p6 F# B
Here is a sample (checking for 'SICE'):  A0 K4 y0 k& O! n; O5 E; E

2 n: o/ J0 {* t3 K3 S; pBOOL IsSoftIce95Loaded()
! g  @' Z" H/ {( C, g{" b) G. a0 w! ~6 M
   HANDLE hFile;  ( M3 F6 x, ^; v1 T5 Z3 N& O
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,  B) A4 Q" G% X/ a8 \
                      FILE_SHARE_READ | FILE_SHARE_WRITE,, S/ o0 A% ^$ I6 W
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);5 J  L# }6 h9 u+ O" M; R1 Z
   if( hFile != INVALID_HANDLE_VALUE )- m2 X9 O: K. S3 d% G2 T
   {
* v- L* d, n' ~' b3 f% w      CloseHandle(hFile);+ \. q1 `: U& ?9 z$ U1 V5 b
      return TRUE;
/ k% @9 I* t3 E/ Y% i4 G   }
" C- U% u2 Z# w$ E5 B: p   return FALSE;
" j8 v% M8 D" ]1 `0 L* x* S% `( r}
7 k2 H8 ]/ U* X- ^' a
5 }$ |9 J$ L( E/ P% F- kAlthough this trick calls the CreateFileA function, don't even expect to be1 ]6 P! t2 M, [
able to intercept it by installing a IFS hook: it will not work, no way!
/ J/ K# B" g+ p! D- S. vIn fact, after the call to CreateFileA it will get through VWIN32 0x001F! x. {' k$ U- w% E. v2 m& s
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)( G& t  q" c, o* Q+ j5 U
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
, T$ U# \/ z' Hfield.& N/ `% l7 j4 j1 k, u
In fact, its purpose is not to load/unload VxDs but only to send a
& C$ N4 Q: Z3 P1 M' y; }W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE): ]% R/ y1 b4 N
to the VxD Control_Dispatch proc (how the hell a shareware soft could try: c( w/ N7 W8 x" {
to load/unload a non-dynamically loadable driver such as SoftICE ;-).# Q1 S0 r* T( {) A/ R
If the VxD is loaded, it will always clear eax and the Carry flag to allow1 d- u( Y2 y+ n) j6 P  P
its handle to be opened and then, will be detected.# j3 d" H' Z2 V# U' b2 T
You can check that simply by hooking Winice.exe control proc entry point6 Q" ~2 Z4 Z0 K8 S
while running MeltICE.! C' u5 O% E: M, k- q
4 _  t8 m) ]. l! W0 Q# b
) r' |1 x0 |3 T3 h7 R) {" V' z
  00401067:  push      00402025    ; \\.\SICE# X* Q% E* R* J9 q
  0040106C:  call      CreateFileA
$ W5 Z. ^  K( x8 c' z9 Z  00401071:  cmp       eax,-0017 W( q2 {% {' |3 R8 b* I4 F
  00401074:  je        004010917 D  ^% a! A7 g" V  `- ~/ ~

0 W7 D5 A# U+ X* m$ P* D  F
! b% y  s$ _2 i# i  eThere could be hundreds of BPX you could use to detect this trick.
; ?. }( c( P; g. m5 F* x+ N, Q-The most classical one is:
& ^3 I+ A, {; m$ v. a0 ^+ ?  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||0 f7 E  g/ Z$ _, v* {/ h
    *(esp-&gt;4+4)=='NTIC'
  q  R% [; ~3 h/ @; }; z' y/ t/ K8 l% |: m; q
-The most exotic ones (could be very slooooow :-(3 W3 ~- i% n! Q- \3 K
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  3 l8 ~4 }5 F. p, n2 o
     ;will break 3 times :-(
5 Z7 I7 |8 P2 X( U+ r$ e2 h  ?8 R" X* R
-or (a bit) faster:
6 p  ?8 u9 k$ `   BPINT 30 if (*edi=='SICE' || *edi=='SIWV'); r; w" f% {& M# ]; w$ {/ n
% [5 ~1 d  V# b# s7 W
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  2 O) I4 U5 D. O% E; t1 {- e
     ;will break 3 times :-(
% x/ }, q- G/ ]2 V* B, Q
( ]% ?+ z* D- @, b& m) L0 a-Much faster:
& P1 P' `$ m" l, D   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
: k5 e2 W- ?( V, Q2 L" R6 w1 n# ^( c4 r4 ?5 y
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
% P$ s& y" _. T: _* H9 ~8 Jfunction to do the same job:6 J& z  w# L6 n3 g2 r) d

* v* A  c( c1 O0 \6 A7 o   push    00                        ; OF_READ* _2 D2 x% D- ~) h4 f8 {
   mov     eax,[00656634]            ; '\\.\SICE',0( q& }" p& H1 ?: F/ `
   push    eax8 N) ^8 t. [/ G; {* L3 c4 E6 L
   call    KERNEL32!_lopen
/ z- g) S6 Z0 N/ k) D   inc     eax# J6 ~2 v& q/ [3 @: P' l( c; y' l
   jnz     00650589                  ; detected: T7 b' K, F" t! y2 v/ q9 C
   push    00                        ; OF_READ
. f4 ?: K2 L& C2 u   mov     eax,[00656638]            ; '\\.\SICE'8 \2 Q, ~, P# r3 ?. I5 p  R) O
   push    eax
9 u5 A- _1 a& O  \9 ?   call    KERNEL32!_lopen
4 O6 K# [% W/ t/ \/ x   inc     eax6 G1 j( k+ F2 K3 {5 b/ V* v
   jz      006505ae                  ; not detected9 Q$ i8 d* s$ Z) k

$ Q7 n! G9 @0 J
- g) b. d& M5 i__________________________________________________________________________+ ^% |% V: n' e5 [! V9 b5 I
6 j: r( d  ^! K( R/ ?; x
Method 12! }0 ], R; r' B3 A3 Y7 `4 k( Q
=========
9 M% T8 V4 h9 L7 |6 ?& u0 B. |$ V2 C! x  E4 S) |2 E# J, j  I
This trick is similar to int41h/4fh Debugger installation check (code 05
  j( a9 e& }( I9 R/ c9 \4 {&amp; 06) but very limited because it's only available for Win95/98 (not NT)
6 c* N8 c' l! M, h( Tas it uses the VxDCall backdoor. This detection was found in Bleem Demo.9 B4 ?- {% D6 `- y2 p

% r' e; x2 x) w) m( t, _   push  0000004fh         ; function 4fh. A- H8 c; @, t9 s, A
   push  002a002ah         ; high word specifies which VxD (VWIN32)3 V2 r$ t9 b" L" x2 C. ^5 }8 S2 {
                           ; low word specifies which service" a1 C8 }3 J$ c
                             (VWIN32_Int41Dispatch)
' s; r' o3 t0 g! A2 O. \4 o   call  Kernel32!ORD_001  ; VxdCall
; t7 S6 W" p! X. V; g; E   cmp   ax, 0f386h        ; magic number returned by system debuggers4 J0 k; Y" k. b# Q% a. P/ B
   jz    SoftICE_detected% W. U( D9 A2 |9 }6 A$ k

3 M" j) x7 Z3 J% l2 {8 s) PHere again, several ways to detect it:
% D# x$ f" Z! ]4 B. w" B) ]4 X. b# j5 z. {4 L+ e7 ]
    BPINT 41 if ax==4f8 ^8 U+ a2 M& B  _0 ~4 c0 y
, {% m3 V9 q$ g  a+ {
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
( q' ]9 ^. x: i& f) x2 T1 e2 @0 v6 `( ~9 [
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A, T* H; _0 o# g; G' H
- Y9 i! ]4 i$ N) O# u' N, U
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!  D) L8 R8 M+ c$ S0 k0 Y. x
0 j, W6 i% U1 ?% {1 q
__________________________________________________________________________$ b1 _6 i; n, X: y/ ]& }

+ U1 k  H6 x1 ^# {Method 13
* l& ?4 P- X4 N/ c% U; m1 D=========
5 r" k, M, [$ ]6 ^' m5 h* F
9 [( b% p7 F. N" L+ JNot a real method of detection, but a good way to know if SoftICE is
' H' O$ Y" R) N9 s8 Sinstalled on a computer and to locate its installation directory.
" e; B: h! r: `( I3 R9 {It is used by few softs which access the following registry keys (usually #2) :3 I# t, k& b& U$ Y( W/ ^& X
3 Z  ]. h& ]: \% R; y
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
7 U1 z9 j9 o. g\Uninstall\SoftICE
4 p, ^1 R2 ^: I( i-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE( m6 d  z* v7 ^" Q
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
, l8 \4 J6 E3 \4 [( k: k\App Paths\Loader32.Exe
& B' z1 _2 W$ H1 ~5 i
/ Z0 o) \" F5 v% ]
- q. \& H. a" ]- jNote that some nasty apps could then erase all files from SoftICE directory. b: G* B1 ?# w! i. Q2 H8 p+ k
(I faced that once :-(4 |1 p: B! e% d* g. [, G4 z2 w8 E/ e* [
' G- E( z  C: g) }4 K* v* X, @
Useful breakpoint to detect it:; O' D6 M5 Z8 ]) n# ]

8 C/ N+ R7 ^" E8 Q" F+ f8 J  O     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
8 q7 u& d% r9 V0 e7 Y6 G. c5 L+ ~4 d& \! Q8 Y6 c& w
__________________________________________________________________________3 c+ J/ ?: O- v& [+ N2 E* V

2 u9 ?$ J3 M9 s# o6 M+ X, w) f% \7 G9 p1 r0 Y3 [- r
Method 14 0 ~0 O5 ?9 s( I+ _" [
=========
& l8 s9 W( @5 [' h' [$ f
) A' M! v  P5 ]6 mA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose  i/ G4 \8 F3 f" w
is to determines whether a debugger is running on your system (ring0 only).! t  |  o5 D. j. G) L
; t+ U3 m' c* U3 ^( [. z
   VMMCall Test_Debug_Installed
/ h0 F/ t$ w* H' g4 H5 ^   je      not_installed
* F$ G2 d- Y2 f
' ]$ g2 v' x- Y7 J- }This service just checks a flag.9 `; |6 Y2 e: T6 \5 [. A/ V
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部