找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
7 _0 x; J% A; O8 `<TBODY>
0 L6 w  p* o" c1 M/ }3 @9 f<TR>1 L% o/ N2 d( u0 w+ U6 i
<TD><PRE>Method 01
5 X  c2 X5 K) Y" {7 F: N* N=========
/ @5 r* r* H2 Y9 d+ C3 B/ `& y. {( f4 I/ A; C5 _: Y* H
This method of detection of SoftICE (as well as the following one) is5 i- q: j; y: X( J/ r
used by the majority of packers/encryptors found on Internet.$ q4 `) ?$ d% a/ Z5 F+ T! G
It seeks the signature of BoundsChecker in SoftICE- V1 V+ `- M# m4 M1 E

7 q; T; R' P& I7 I7 E+ c    mov     ebp, 04243484Bh        ; 'BCHK'
9 r! G0 C/ n, Q6 ]% l3 W, B    mov     ax, 04h
9 Y! l! r; Z6 s3 a/ u) D    int     3      
) ?! [! @, `7 K& v5 Y    cmp     al,4* u) |4 d& z! y
    jnz     SoftICE_Detected  z4 Y* O1 b( C8 B; }0 i# `, k6 [

1 w/ C  `* o: i; R. a___________________________________________________________________________
& T% j7 i) ~/ b# u9 ]0 c! ^) S9 R. H9 E7 p' ~
Method 025 g: E- A" B. Q, c2 d9 d3 S' E
=========1 H+ D) M1 ~% Q* U& G

" |$ U& k' G1 b1 d; ?2 bStill a method very much used (perhaps the most frequent one).  It is used
) R. i! W! m6 Z( h0 i# Qto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
  M- x3 F% ^% g3 ?+ R$ [* s2 Sor execute SoftICE commands...
! f1 f- B$ x% J- TIt is also used to crash SoftICE and to force it to execute any commands
8 `+ _) ~- q1 N/ z(HBOOT...) :-((  
' V$ H- o) i( W3 [0 _9 |5 ~" g) g; {/ e
Here is a quick description:
, ]+ M: }) h2 e-AX = 0910h   (Display string in SIce windows)
( E/ `: H+ G, M+ W  D9 j-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
8 a6 F/ ]5 V) @3 U2 ]& l4 v8 u- R-AX = 0912h   (Get breakpoint infos)
+ M6 F1 F" V0 h6 E; c-AX = 0913h   (Set Sice breakpoints)+ a' X1 G' D0 w$ h: B/ U
-AX = 0914h   (Remove SIce breakoints)& x6 S5 x- d# Y2 M8 B
* Z- ]% h( \. v( z! `
Each time you'll meet this trick, you'll see:, q6 U9 E2 y; T/ V
-SI = 4647h
; R& b' Z: U6 b-DI = 4A4Dh5 X8 W$ E* D7 [- \9 l  f8 r& Z4 x
Which are the 'magic values' used by SoftIce.* l3 x: h7 s- h+ P
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
% [6 \; S% k: h# F3 D; M& H; o+ u8 w0 P& k; t6 w& `$ o
Here is one example from the file "Haspinst.exe" which is the dongle HASP4 ?0 W" J1 I; o. o& e
Envelope utility use to protect DOS applications:
2 k# {4 [$ @0 j% Z( K% l$ V
+ V( e+ m2 h6 P) o8 _( |& Q! Y0 Z9 {; T
4C19:0095   MOV    AX,0911  ; execute command.2 l; U3 O7 ~% r  e! c
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
* g: f5 t) B1 m9 F" A4 U4C19:009A   MOV    SI,4647  ; 1st magic value.
. V8 j( v( h# f! i4 ?$ }+ Z4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
9 |. E0 A" p$ |8 P; W! L4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*). F5 {& R1 h  K" V8 S/ F
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
9 k3 d# V6 i8 l3 w: y/ i4C19:00A4   INC    CX
* ]5 ?& B. o* N4 j- s+ {4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
' Z3 u( D& V1 N. n6 p- S: W5 E  Y4C19:00A8   JB     0095     ; 6 different commands.
$ V$ C9 E8 j' _2 w4C19:00AA   JMP    0002     ; Bad_Guy jmp back.' O0 _2 j: V9 ^6 I$ ]
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)) c. A& j! P) k* K; R: \; n
; G2 `# J, C  k5 W& S/ O4 I
The program will execute 6 different SIce commands located at ds:dx, which
! B0 @: M% }( l# F" {are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.  d  E! w& g$ @# U  J& e" j* `

! v- ?% ]/ o% Q( h- b2 t* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.; d7 r5 Z. U  M3 h& r
___________________________________________________________________________
2 t6 X% l' D7 g: v, `& R4 F6 u
- [0 K' v% y8 k, O* t; D; e
. J: `& c) M, E0 P" G( H  x' xMethod 03
4 |$ j; N; r5 k( Z* \% [, F4 ]& i. N=========
1 M5 @1 s, w3 a/ p0 X  }2 x, i4 A. F
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
; x. _/ K7 J0 i! A. M* P(API Get entry point)0 U) F0 W6 g3 R! u3 d
        * N8 _8 ~5 {# h1 b& u
2 b% Q( m+ g7 q7 l, b5 n" p
    xor     di,di; w# }( F* }+ @" B/ O
    mov     es,di
) h! w4 d6 u6 U    mov     ax, 1684h       ; B6 w& B  I# A4 M! n
    mov     bx, 0202h       ; VxD ID of winice5 |5 j8 O' r. t# A
    int     2Fh
0 l: N5 J- O& U5 w4 m2 T5 B, E( b3 G# q% c    mov     ax, es          ; ES:DI -&gt; VxD API entry point5 k6 I. E8 ~2 k9 |  }6 q7 A, z
    add     ax, di* g" ^( s  o" Q' m( K5 [4 Y
    test    ax,ax
0 v2 [( x4 G  [: i* ?+ |9 G& O8 ]- L" k# z    jnz     SoftICE_Detected" H0 g3 X& y& v* u: l

; W- }5 `9 Y! M0 C7 N' P___________________________________________________________________________
* j" _. X% a. W3 r3 j7 B, d  |! h2 {8 z8 r; H. |+ r5 d5 T; x
Method 04
" l$ m# |5 T0 Z=========/ `3 @" y1 K- w, D
. Y0 E$ ]7 B& v& n+ ^: F2 f
Method identical to the preceding one except that it seeks the ID of SoftICE/ a' W5 X. S& k5 j/ o& O2 `
GFX VxD.; M( W& O4 l) o# u% n

$ |) E  u  N" x3 U7 R+ [" b) J+ ]    xor     di,di6 E: u! d! u7 n
    mov     es,di
: @' h* e! @& Z  |& S% P    mov     ax, 1684h      
/ N, p; c9 I, y6 P0 X5 H6 X, P0 I- q    mov     bx, 7a5Fh       ; VxD ID of SIWVID* S" v1 Y3 I- J; t6 {/ @# j
    int     2fh4 ?' M- I/ l' w! W0 v
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
/ D5 T% I/ }* R    add     ax, di
0 c4 C+ s0 Z! @    test    ax,ax
' z$ ~) S3 x$ Q( c    jnz     SoftICE_Detected
8 A1 y! m- m) [+ E$ J( X1 K1 l) W2 k0 V! v
__________________________________________________________________________
3 y0 }' {' @8 i9 u: b- Q3 D( }. r' _8 W& R: Q* @

7 M2 A! j0 J& fMethod 05; E. |# z- g2 Z8 f$ y" F. N' j* f
=========/ {2 l5 [* h/ ~2 X" b  m
) ^/ d2 U: a9 z+ j6 ?4 E8 L( V1 F
Method seeking the 'magic number' 0F386h returned (in ax) by all system  M: ?1 q& K: Y+ Y" X7 y" ?' N# q
debugger. It calls the int 41h, function 4Fh.
8 }4 \- H7 p- [# sThere are several alternatives.  
2 y0 V9 t8 Y% O- p' d* F% t8 k) D' h" ]
The following one is the simplest:
; w/ k% L8 h/ t$ y0 @7 `
0 }- J' s1 z$ Z3 t' U* o% x    mov     ax,4fh* K# W- f  w4 }( S2 ?) q# p
    int     41h
4 h( F% ^8 A4 {  O; \, m    cmp     ax, 0F386, H. ]/ Y6 r! s' x% Q9 y1 r! t! ]" E3 W
    jz      SoftICE_detected# N1 J/ b# {) r" M, g" Q
- g" G( g9 I% M# ?8 Z

' E0 s& s3 n) i* G8 F7 FNext method as well as the following one are 2 examples from Stone's
) h& h1 D2 C1 ]" J! F9 r"stn-wid.zip" (www.cracking.net):
" M- z6 p4 Q6 E
: f  o/ j8 r( X: q9 X4 r! a    mov     bx, cs. y) G) r1 K# [: A: C% Q7 t6 V
    lea     dx, int41handler2' h/ Q, v% m/ ?% s* C4 j1 T/ h4 G8 c
    xchg    dx, es:[41h*4]7 W: N" j5 \9 e
    xchg    bx, es:[41h*4+2]
* H  w+ q1 l4 p0 B: Y    mov     ax,4fh
. w3 s  L7 L* p5 f    int     41h
- |, X: K/ `* o" c    xchg    dx, es:[41h*4]$ w  s! S; L+ X8 E- X
    xchg    bx, es:[41h*4+2]7 h/ M( o$ C# U' `7 U1 R: O
    cmp     ax, 0f386h
# m4 [  O& ?' i1 y    jz      SoftICE_detected, I' k% b( L) O' B3 R
' d* D" Y2 R7 B- C( s( j
int41handler2 PROC4 p( }9 K% d- {: k) {  r
    iret8 C9 _6 V& a7 X! e
int41handler2 ENDP
. z  R, i: r2 L
3 f8 O! T/ @. a
: h+ F: y) u# p& O* o3 S8 E; T$ |_________________________________________________________________________
! q, p7 q0 n4 o
7 E8 s+ }1 S% Q4 m, Z2 b6 ^* p! F
" f: \& p+ g6 O/ s8 iMethod 06
9 v) ~. G- T8 M# _" d& C* U& C( q=========
, p2 H6 {" S3 X, ?# `# ?4 d
& H' f' O& [2 R5 z
7 w- C8 l( u. V0 n# W' G2nd method similar to the preceding one but more difficult to detect:
* r0 g3 _6 K1 \0 g7 h4 F% M3 `7 p& ]5 e- _1 \& h

8 Z  W! {# c2 q/ Sint41handler PROC5 `  n% l: S- N$ T2 K. V' [
    mov     cl,al
& R; D# h4 h: C2 D" z    iret
6 ^# d1 Z% T1 M9 rint41handler ENDP8 T, J# Z  p3 P% b% v! \

: w" q3 J3 b2 J6 i+ A0 _* k
  T, d# _& ]1 n1 ]4 f9 p  S, d    xor     ax,ax
# G  V' \" @/ M( X, }& v5 `4 c9 s$ |% o    mov     es,ax
$ W2 K- ]( C8 L; [    mov     bx, cs
1 @) W, V9 a% W; C    lea     dx, int41handler# M6 A8 r- h: g( U
    xchg    dx, es:[41h*4]3 d! d. C2 t$ ?
    xchg    bx, es:[41h*4+2]1 Y& t% K( L+ K" @& l
    in      al, 40h
! p, G1 O" ]% I3 d5 h- c0 S3 a    xor     cx,cx
7 N/ P8 W- W+ _: J* v- x* U    int     41h
- h  U" V. |0 w# |+ N8 @    xchg    dx, es:[41h*4]
# o8 H9 l+ P1 ^# a( ?  h$ u    xchg    bx, es:[41h*4+2]4 Y* Q% A( |% P
    cmp     cl,al
' X6 ?' X; ^" i" x/ S    jnz     SoftICE_detected
! J- H! Y9 I8 q9 X$ r" R  O* z6 y+ q6 l  A
_________________________________________________________________________4 i  c! Q' O& H) }" q, C6 E% b
: P) O& `8 d0 H; K5 [9 F: U
Method 07
. s: P  |5 |2 g2 ~=========; z+ h) Z" Z- J) i- L/ O

' ?) |8 ~3 q" K9 EMethod of detection of the WinICE handler in the int68h (V86)
" c$ Y- p) _6 g8 B# v2 i9 W' H# P" X0 V* D$ W0 d5 y
    mov     ah,43h/ [( q2 r* N& E3 h2 m" N; r3 q
    int     68h2 ?7 H( m7 \/ [
    cmp     ax,0F386h" \& N. m; W3 A; D+ w/ \
    jz      SoftICE_Detected
  H  ~) G3 D- u; b+ o0 G9 h' ]- }$ L9 Y' Z: P% ~  Q

( q0 v8 j4 |% M$ J=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
: ?( R- X. b* t& U2 N" U  v( v   app like this:
6 Y3 I1 ~( Q  B9 N2 M0 r( a' Z; N' }9 O& |+ ^5 i
   BPX exec_int if ax==68
( I! N, g0 c4 g: A   (function called is located at byte ptr [ebp+1Dh] and client eip is, C' N/ A* \9 l9 t& N
   located at [ebp+48h] for 32Bit apps)
$ J" g9 ~1 V$ n0 [__________________________________________________________________________7 k' f) l& O- L' D* X4 d9 v7 P9 {
  `- p" ^. U; d4 [9 H( D  {

, _% \7 }- V$ t- zMethod 08
- z' L* j% c0 z! W=========2 ~# s* [# H  n" E
2 B; y0 @  i3 Q8 r' K$ o$ O
It is not a method of detection of SoftICE but a possibility to crash the
( y2 D0 r1 i2 ]8 `3 asystem by intercepting int 01h and int 03h and redirecting them to another: {1 K% s0 b3 \
routine.
1 z2 i/ P4 \: w6 tIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points9 E4 d, j. V2 T+ o" d0 r* a$ x3 }
to the new routine to execute (hangs computer...)" I1 j& v: I3 z4 F. P0 f

& h" c: y  E; O% ~8 H) c) r+ |7 v  ^    mov     ah, 25h1 O" T, \6 x* a7 _4 j" k* K* S0 B
    mov     al, Int_Number (01h or 03h)
: ?$ X& o1 N  {( a5 t1 R    mov     dx, offset New_Int_Routine! Y) B; d# H% o  P, O8 z( _
    int     21h$ O% L% I- g- Y6 Q% t
* K  r  c1 ~0 z: J
__________________________________________________________________________
1 o# s& n1 u, Y& u) p% z0 U; ], Y, \
Method 09
% Y' B3 G$ j' _" S=========
5 Y! W6 b# f$ Y: q5 I5 W7 f
3 F! v0 E# o0 u/ K4 @. DThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only% Z8 U) N( f6 b
performed in ring0 (VxD or a ring3 app using the VxdCall).3 z8 ~& w6 H9 m% F
The Get_DDB service is used to determine whether or not a VxD is installed! y0 Z. T" f) t5 J. g
for the specified device and returns a Device Description Block (in ecx) for
0 T6 J* J% F; o2 [4 \4 Nthat device if it is installed.
- p  |: B+ X4 X* S0 y: r, `2 P3 M( Y
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
1 r3 T! M) e8 j. p   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)! e5 J) t1 H/ C4 c; }
   VMMCall Get_DDB
4 F, N( |, c/ K: p# H% E6 z1 S% z   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed% m9 s1 b9 h5 I; a
; B. F- O/ Y) C
Note as well that you can easily detect this method with SoftICE:
( }0 D+ [! ~. {6 C, m8 I; L' L   bpx Get_DDB if ax==0202 || ax==7a5fh
$ V. F/ E1 J3 T/ m$ Y5 f; A5 z3 ?2 P  W- a' s
__________________________________________________________________________& [8 k6 k! a! [, b6 x+ N

/ B& h9 \+ U5 N5 V# cMethod 10- u/ }% R: \  F9 P# S0 `: O# H: v+ N) j
=========
. k! _6 X5 J7 _5 {- n
7 V7 B/ Q. u3 ^3 r, H, }=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
7 ^8 }6 f0 j' m/ W) f  SoftICE while the option is enable!!
- A8 m1 U. }+ X! J- E% f$ c; w! g! o- G: [
This trick is very efficient:
8 Z$ |3 j/ ^% e3 q6 I/ U$ @5 Wby checking the Debug Registers, you can detect if SoftICE is loaded0 |' b8 x# q8 `# _
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
- _6 ?, {  g4 j- kthere are some memory breakpoints set (dr0 to dr3) simply by reading their
7 n7 I' U6 t, s  n' d  \value (in ring0 only). Values can be manipulated and or changed as well0 J2 e- h& V5 b2 f4 c1 U
(clearing BPMs for instance)
/ H' t: y4 h- ?) L: \- R
. Y4 z1 [! S- m# ?__________________________________________________________________________3 F& C: ~6 r- S$ B' e

& ?( u, R$ D: ^2 q# ^1 @: K, s; SMethod 11
; O! p! g5 z9 t% V* C; T: P=========
" ]; W0 d3 k5 n
% Z, \) e/ C/ g! q* `  ]This method is most known as 'MeltICE' because it has been freely distributed
" A# A: J# a: F$ @. @& D. uvia www.winfiles.com. However it was first used by NuMega people to allow
* r: j/ Q( C7 ]Symbol Loader to check if SoftICE was active or not (the code is located- ]7 H0 N1 W; q' R9 D
inside nmtrans.dll).
( o( `2 s  C5 `) r4 E
% |6 W1 t  @6 X" {6 _9 ~The way it works is very simple:' a) f0 \' F" R, p, A5 C: z& @
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
! ?0 A4 c/ U& S, `WinNT) with the CreateFileA API.
& q1 l, g: f; q
1 j* J6 V; [% f) X4 r$ ZHere is a sample (checking for 'SICE'):; f) W. [1 K9 r8 y/ k, S
2 A  U  \+ v: }, j+ J6 g- ?
BOOL IsSoftIce95Loaded()+ j! T6 G$ w- W* V# N7 L
{9 o8 r9 V. V3 \# B* o  l
   HANDLE hFile;  
# q; o  e, M+ T- Q& m   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,2 X" y$ j3 Z, w2 G+ s/ {+ v8 o( M" Q
                      FILE_SHARE_READ | FILE_SHARE_WRITE,* F& A; a0 G/ g& u9 y3 J
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);+ e( g5 @- C, i4 t* d, S4 e1 r
   if( hFile != INVALID_HANDLE_VALUE )% o) L' O. p' S$ s
   {
: z4 O) `$ t$ z: g+ Q! d4 ~1 q      CloseHandle(hFile);
, v8 |7 d. Z6 z: \: n1 \      return TRUE;3 {6 r* }8 s" C' l5 {% W
   }! F  v  `2 T$ Q
   return FALSE;, Y7 \4 T. u3 H; }) `8 |
}
/ d- ?, Y3 c8 Q8 Y; F; _) V
$ |; @7 [: g* D7 J1 B  X: QAlthough this trick calls the CreateFileA function, don't even expect to be0 I0 k  N' R6 \. ]5 U0 C
able to intercept it by installing a IFS hook: it will not work, no way!
: v+ Q# q$ X0 n% M9 ?9 _' I$ ^- mIn fact, after the call to CreateFileA it will get through VWIN32 0x001F6 U! K! n5 Z- H# W5 E
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)7 z" g; y- A! \  q/ B# d
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
$ {0 T7 W( v- j4 _2 b/ Kfield.
- f1 G- X1 d4 L2 ]2 F- hIn fact, its purpose is not to load/unload VxDs but only to send a
6 j# ^8 B& S6 C& ~/ dW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)% k8 c- J7 J3 ^2 [8 T
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
$ L+ x/ O9 j8 e* \to load/unload a non-dynamically loadable driver such as SoftICE ;-).
6 G; |) F2 G( _0 z! qIf the VxD is loaded, it will always clear eax and the Carry flag to allow+ B- i& F- n" s5 n# S" e
its handle to be opened and then, will be detected.; l: n6 q# t) x# x3 l% o) Y
You can check that simply by hooking Winice.exe control proc entry point* g1 }" f. y) H, G- H+ s
while running MeltICE.2 L: f, N5 E+ B! f  W( N# `% \
% W& L* {8 m! \2 {; X

# ?3 U* z2 b' ?6 i: e  00401067:  push      00402025    ; \\.\SICE2 g0 c/ |, E1 f- u  d
  0040106C:  call      CreateFileA
- F  I: R: C+ _- N0 Q+ P  00401071:  cmp       eax,-001; G0 ~" a8 f" X7 Z. C4 _% T7 t- |
  00401074:  je        004010917 k' e+ w/ T2 w, L6 V2 E0 _0 d

* l$ z) l1 ^8 {8 W8 N+ y
9 H1 g: E+ D( k: g6 k0 C1 j" ~0 DThere could be hundreds of BPX you could use to detect this trick.
  {+ ?) n; {& h/ d: X" C' v  p-The most classical one is:3 n# a0 R0 e) O- t3 @( Z
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
# i3 E  C2 l9 W, J6 [    *(esp-&gt;4+4)=='NTIC'& s8 v  i: ^7 p' c
  M1 O, `) z6 D+ D
-The most exotic ones (could be very slooooow :-(. E$ |# S& A7 W+ ]0 N
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  + I1 d8 [; T6 E/ W
     ;will break 3 times :-(
! X0 B6 X7 _- s/ ~2 t. D" H
% v: j; K$ A  i0 ]-or (a bit) faster: $ W; _; f5 T! K8 S$ U' H
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
: E% g1 Y$ U2 o+ O' z! z* x3 Z5 P) q) J; i
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  9 _, q% u- C  z; {# E# k
     ;will break 3 times :-(
: Z! @. w6 _% S
+ M5 t% }" r2 A! K-Much faster:
5 M+ Z4 a" N1 ^6 T% ^   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
4 U/ \1 x  g" l! `' M: f8 |5 R( @; n5 I+ B) p0 y. F& z( S+ D
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
3 N6 ]* ~8 a( J7 B5 Efunction to do the same job:
' J- p' H; k( \, l: F  t+ T0 H( L, r; a, z
   push    00                        ; OF_READ: M8 \& t5 P4 H7 p
   mov     eax,[00656634]            ; '\\.\SICE',0
  X. P3 H5 Y6 h$ N1 c% X+ g   push    eax( ^: J9 q2 e3 ]* G: y* c
   call    KERNEL32!_lopen, N$ V$ N+ `$ d7 l7 I" C  L2 g
   inc     eax3 g+ _3 J- i! \- o2 ?! Z# P, g$ O
   jnz     00650589                  ; detected
* \& h9 t3 C! D- a7 E5 v+ j   push    00                        ; OF_READ) v; t" V- D8 Z& l* j7 \9 o& I
   mov     eax,[00656638]            ; '\\.\SICE'+ m3 J* H4 V' f) H5 U9 ?
   push    eax5 v4 n" v: n2 d% \; v% h. X% A
   call    KERNEL32!_lopen1 S1 i7 J" M" B0 T
   inc     eax1 m6 v! `0 g" t- B2 p1 @* S! E, D
   jz      006505ae                  ; not detected% ~& s* ]" O) x+ _+ W- w
  D4 _% z4 D5 S( `& i& u" t

, m2 G) N$ j% E. m/ v  i& l7 j" g  o__________________________________________________________________________
; h- b! ?- Q+ N$ M) ?* j. Q
+ z$ @. h/ u% i$ OMethod 120 j3 o5 B: h3 e! J$ T5 @$ u6 l' g+ l
=========
6 Y* _1 Y8 z: X( H% B& O, j; ?2 u. v0 M  y; ~, u; Q
This trick is similar to int41h/4fh Debugger installation check (code 05: ^# ^5 q- p3 \1 @1 O
&amp; 06) but very limited because it's only available for Win95/98 (not NT)) l: U% y, F( r4 ^" T  Q
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
  d% Z' p! t6 H3 I- N( i" X. I: g" x
0 C0 J9 @& ?- ^) m- k/ p   push  0000004fh         ; function 4fh
$ ?* R7 @, \5 T6 U' W/ @, m5 }- m! f   push  002a002ah         ; high word specifies which VxD (VWIN32)9 _8 m! T$ K+ [+ m% x! x9 n8 S
                           ; low word specifies which service- G2 y% v2 c' W
                             (VWIN32_Int41Dispatch)# `: _. w: T) C
   call  Kernel32!ORD_001  ; VxdCall' v0 F- b5 V6 v0 o: n( ~( n) j
   cmp   ax, 0f386h        ; magic number returned by system debuggers
( Y' W7 T0 b  i  P# a   jz    SoftICE_detected7 `, ^# G- P+ g8 M$ B
; V/ o. A- v  ]8 O, o
Here again, several ways to detect it:. @" c+ T% u) n+ L% X( n# s

* \8 v2 ]+ y& s    BPINT 41 if ax==4f
) _2 N4 k2 r" u% L* ~. }
1 L4 ~2 [) X. m    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one- i- T& I: n! y! H
2 \. C' v6 G1 y4 F  g
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
2 l& [: T6 e5 ^4 v/ c# i( A5 Y2 J. c5 i, b# Q4 r: \6 F
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!% e/ k0 {; Z6 J8 x

: [. `* V( G' R- F( ~0 B; K__________________________________________________________________________4 u% D8 J7 f$ }* e7 J
4 a0 I3 l% _* {, N
Method 13/ R  o6 T1 W% O+ {& l
=========" w8 |5 D# B: @- |

7 L  \( B5 K  e3 @% P3 Q0 BNot a real method of detection, but a good way to know if SoftICE is
) j% f' @+ d* L- S/ hinstalled on a computer and to locate its installation directory.: I+ \0 i/ }4 X# C
It is used by few softs which access the following registry keys (usually #2) :
: B- ^6 o; n  b% H5 [& v5 a- U$ q0 f+ \
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion9 v/ F& X' H; O) v
\Uninstall\SoftICE: Q; p, I& _: F+ e; X) N. C$ i7 A
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE! g2 H; T( d0 Z' L& C
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion4 Z$ p; J: p% l' q/ o- V
\App Paths\Loader32.Exe- y7 e( }. G/ ]1 R9 l
1 K2 a; Q  b, ^. e
  k# N  d/ B! g+ S, a* {7 {5 C% {0 a
Note that some nasty apps could then erase all files from SoftICE directory# v  O' _8 v: ?. q8 _9 b+ R6 \
(I faced that once :-(
1 x1 y4 n" }9 x$ |0 n% ]+ W0 R/ N/ r& h' i4 j6 ~
Useful breakpoint to detect it:# ^4 U+ |4 P3 ?1 Q6 Z

9 v5 R2 |4 E+ k5 h& U     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'* I. G+ ~$ P' q$ a1 g
$ d. z# D* P' I  a6 `
__________________________________________________________________________  l% {0 a0 ]1 T6 I0 ]

% D$ g' D! j) G: M
1 I" q7 d2 y; {8 Y6 e1 e1 ]4 iMethod 14 . D2 k! O; [8 X: U1 F7 x/ a
=========! D7 _, l) C3 C0 y6 ^7 S
2 k6 a! F: @# ?
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose! h. Q5 N5 q. U
is to determines whether a debugger is running on your system (ring0 only).
1 \6 E* D2 a5 [. f& Q" e! Z$ m# f1 A+ i6 J! ?
   VMMCall Test_Debug_Installed
7 s+ w3 m  B" z6 A: j8 ]8 z* u   je      not_installed
/ ^8 J5 f2 E! q% R3 o$ \8 v
: j, C& n* p% C" B5 sThis service just checks a flag.
9 b$ q( N) y6 f# [</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-8-10 04:38

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表