About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
8 b2 U3 k" Y3 I* u<TBODY>1 ~$ r) n4 q5 ]2 m& |1 p
<TR>2 U$ `/ M4 n% I+ B$ V
<TD><PRE>Method 01 6 Z. n9 A0 @' U; P
=========
- l8 C2 B7 J- m, Q. ]; S
6 t! U4 E; h  o7 J" bThis method of detection of SoftICE (as well as the following one) is. e2 |" M  H: `1 Q/ X( D* s6 D, H' c
used by the majority of packers/encryptors found on Internet.
; y+ j. M' y2 J3 o; f: QIt seeks the signature of BoundsChecker in SoftICE
# M6 d2 B- b$ z& a. }' d* h& d/ A+ ?3 y6 r6 B
    mov     ebp, 04243484Bh        ; 'BCHK'1 q, O7 l7 v2 z6 ^) P
    mov     ax, 04h& ~* p( h7 P  W; A" g
    int     3       7 c4 Z! H2 G& W6 w  U/ v
    cmp     al,4* X( s7 d7 T) s  A
    jnz     SoftICE_Detected
- X0 ?% g0 l6 J# z/ N9 s% T2 O9 b" `/ o. m) R+ b
___________________________________________________________________________
) b0 r1 j0 m( p5 L* }  s+ R; R2 b$ |5 ^- J. ]
Method 02
! r, N- m$ U! j/ e$ E=========
, z* j7 B& _, e
' I" U( ]4 R7 `& mStill a method very much used (perhaps the most frequent one).  It is used" M: N" X0 `/ W/ [
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
1 B0 T  D5 x4 K/ x1 R. f3 R/ P. nor execute SoftICE commands...
( o- |( J5 l, aIt is also used to crash SoftICE and to force it to execute any commands, p( o: a/ p% p( ~; m9 R6 t1 y, W
(HBOOT...) :-((  
  C  q5 L1 Y6 Q# P; t: y, ]1 S
( [- |0 M- y& n; F; S% v) @+ DHere is a quick description:
5 c  S9 h6 V# ?/ j3 {# @-AX = 0910h   (Display string in SIce windows)
5 D, _2 m7 i% ~, Z7 J4 L3 ~-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)* ^7 {# G& K  S8 z
-AX = 0912h   (Get breakpoint infos)( J. h5 s& M; [1 {7 P+ c4 L# }
-AX = 0913h   (Set Sice breakpoints)
7 c5 ?2 f& R2 ]  t& i7 f-AX = 0914h   (Remove SIce breakoints); j# q6 N0 c0 V- M4 @+ A. V( T2 B
' x; T3 @3 ?4 {+ L
Each time you'll meet this trick, you'll see:. {3 G6 Z' b7 }# L5 P$ L( s- O4 y
-SI = 4647h
/ Q5 L2 y9 f# a# {4 M- w4 @-DI = 4A4Dh- Y' M- g. |% H' G4 y
Which are the 'magic values' used by SoftIce.
, d% o7 q, Z* n( B0 oFor more informations, see "Ralf Brown Interrupt list" chapter int 03h., ?# o4 L2 w' a8 `. X0 |

! t% [: u! ~  ?2 y- T8 A5 y& R6 ]  @Here is one example from the file "Haspinst.exe" which is the dongle HASP  |% S+ m" A: X. [* Y' V
Envelope utility use to protect DOS applications:
% W% m. }, H% m/ E  H$ `" o7 j  o2 f! j" }

; w& g: \( e- Y' n& |* B4C19:0095   MOV    AX,0911  ; execute command.
9 k! V  L+ s5 z. t' n0 o4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
4 n: z! F% d- h7 n6 `4C19:009A   MOV    SI,4647  ; 1st magic value.
5 M0 p, j  @/ v8 [5 @4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
" a7 ^. e7 \5 `) q4 F5 M0 }4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
% i! y6 |- |5 p. H4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
$ E' u1 h/ Y; B- W% X4C19:00A4   INC    CX
2 E% m1 ^1 {: `- ~0 |0 P4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
* S  B' z; o9 {$ I+ ^4 A1 v+ {% Y; k- a4C19:00A8   JB     0095     ; 6 different commands.3 w, F' o- Z4 n  J
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.' J2 Z0 E5 w5 p  X8 b
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)9 u) l. ^4 q) ^/ {
$ W' C2 V  H1 t, v+ }; M
The program will execute 6 different SIce commands located at ds:dx, which3 S& C7 c# T3 s# B7 V* u5 ]  V7 n
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.7 Y$ F/ P% M/ }& l7 [4 P
, `; {) ]+ }$ z( \) V  ?7 G
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
& g" e: Z9 z5 g9 x, U. S___________________________________________________________________________% y3 r4 b; w  L

, |0 J3 B8 v6 A; q0 B- I# `- v
Method 035 ?+ Q2 C+ q0 L$ D" t8 X
=========" ]: L" J; ?9 e5 p5 D5 Q
7 g2 v6 v9 V" B5 O5 u9 J) f8 T  N, L
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h" o* J  p( e) G- O' A* P
(API Get entry point)
$ c0 ~9 U. U. ?, Z' A0 E        " a% x0 f+ X3 w6 K: ^

) Z: Z4 T/ Y1 Q% D: }# G) N1 p    xor     di,di
, _7 X3 i7 ]# X4 @9 S9 F% d  v" S" l    mov     es,di% g. P1 m+ ]  n
    mov     ax, 1684h       $ ~$ h2 a* z; z; V$ `
    mov     bx, 0202h       ; VxD ID of winice
- W) Q  q7 t) [! Z8 W* t    int     2Fh5 M4 p6 q1 N5 K! j' m- J
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
$ Y5 `4 ]7 t" E: Q3 W: U: Z    add     ax, di
  n. v8 }8 X) J. B! R( |    test    ax,ax8 R2 J/ W5 y* h% g  K+ T
    jnz     SoftICE_Detected1 i; v0 O4 E4 O/ I: p. N
% H  P$ N$ f" T( b5 d. j5 O% Y
___________________________________________________________________________4 Y( u! E9 E+ Y' o% G

; T1 ~4 p" D5 K, {Method 04
* _( t0 f4 C6 H1 j; N( ?" |=========
0 ^( Q/ V( C" D: b+ V1 I# R$ E$ `
Method identical to the preceding one except that it seeks the ID of SoftICE0 ^4 @$ H: ^- l5 [
GFX VxD.
! u- i2 R" C% A" S1 l
# h6 l& y# |( i5 a* O: E    xor     di,di$ I7 j# y( X6 y+ m5 x) |5 P0 ^
    mov     es,di
+ n1 M! Y2 l; E' t& x0 F    mov     ax, 1684h       9 O! y  E- X/ `" B+ b# ^" h; u8 r
    mov     bx, 7a5Fh       ; VxD ID of SIWVID
" ]7 k6 S/ O5 O1 t. \    int     2fh) d1 g1 f4 w3 y
    mov     ax, es          ; ES:DI -&gt; VxD API entry point+ Q  {6 J% m- }& W, t2 A
    add     ax, di1 `4 h9 u% }: U& i5 S: U8 H
    test    ax,ax
& ~, \% a* U/ H$ A, D! R' u! g2 q    jnz     SoftICE_Detected3 }6 c+ x0 n& W. {& `: H
7 c4 W. t! k2 @$ [/ m8 ^, \2 u# f! e+ ?
__________________________________________________________________________
2 f' q. d- N2 g" k/ g1 B  e  }2 g" v- B$ w0 K* P

) c+ V1 \8 ~. `  W8 ~; gMethod 05* C; G- f7 w" F( Q
=========: Z5 K  C1 S0 X2 G/ o7 l
9 G2 K" X/ R" {$ u3 C% J  C' |0 }
Method seeking the 'magic number' 0F386h returned (in ax) by all system/ L( N: F  ^8 [  e& e! [
debugger. It calls the int 41h, function 4Fh.* B6 n6 a: t, L9 {/ ~
There are several alternatives.  
. |, Z2 R, _7 [% f9 S8 ~
" ^5 f2 n$ F2 M0 z# g6 P" ]9 w  }/ fThe following one is the simplest:. X, y6 x( a; H, ~, A( t, C  d

& }% O6 q: j6 G  m    mov     ax,4fh) Q4 c7 ^! `, c# @+ [. c. p
    int     41h
- {% y/ t0 K, o+ E; ]    cmp     ax, 0F386
# f* l* m- r1 \8 @2 t    jz      SoftICE_detected
6 z1 |% \% W( T/ o# Y8 G2 N
% c5 l: B- b. j/ P/ O- c
" z- e0 o) ?& v4 V, cNext method as well as the following one are 2 examples from Stone's , _0 I( t8 \" u) r' B; _9 X& y
"stn-wid.zip" (www.cracking.net):
8 c# \% B5 j2 I
7 o& `) {0 P* X  p" w! a2 b7 J    mov     bx, cs4 Z6 F! P% ~) _/ h
    lea     dx, int41handler2
& @- v' R1 k/ J& W    xchg    dx, es:[41h*4]% r! V2 G& F: P4 G0 P
    xchg    bx, es:[41h*4+2]
/ a# \0 H7 Z/ ?5 k8 H    mov     ax,4fh
/ J: ]9 z# h3 h/ A' o+ R# S    int     41h! {4 J3 `& d0 Q# V0 ?0 L3 o) N
    xchg    dx, es:[41h*4]& d, g9 ]( a+ R$ t3 W
    xchg    bx, es:[41h*4+2]- s5 L! k1 u. V
    cmp     ax, 0f386h
2 r5 p) a" T, f; D/ u% X4 T; C    jz      SoftICE_detected
. ^" t) f' B. ]% S
9 w  j5 X6 w4 K! Qint41handler2 PROC
' U, ?, j/ Y3 i6 p& m4 ~/ ]    iret
0 J% _; k& [- {+ }7 Qint41handler2 ENDP5 Z' E' N. H& W; M6 ?
9 _: O& O" }3 P  Y9 L, ^* n, O5 z# C1 v5 C
! w9 J: F: e7 r, i1 t3 h9 E
_________________________________________________________________________! @4 N) r  B7 _- ?4 j; J

" g( P" V* @& E# O/ L% x! N" @3 a* B# o9 ~; q- S# R1 }) x
Method 06
7 l7 H; ^6 [+ q# A  b2 w=========
* l5 M# G+ P& e* {7 m
9 Q& m; }; c; k1 q9 _
; u( E0 ?) k( {2nd method similar to the preceding one but more difficult to detect:
  f( Z, y) h# X+ u: r4 M7 g/ O3 E- y  @. |; J2 ]
7 J! o; r4 x! ]' Q, U
int41handler PROC
  G9 o# |' d8 q& i2 q    mov     cl,al
$ ^( p5 V+ @5 \. H    iret
3 D) Z' B8 P' o: B8 x  e0 _int41handler ENDP
+ x( w) S: c( l) P' d" W" l! y# Z
. B, `0 w0 J7 }- d( q8 d' j' o3 T6 E' o0 o5 z* F: ]
    xor     ax,ax0 }$ M, U; j1 T) s
    mov     es,ax  ~3 I% r8 t% n' R- ]
    mov     bx, cs$ F1 J  e: i) x; `  m  d
    lea     dx, int41handler7 W' ]) c0 i" O1 c. Q5 e9 j
    xchg    dx, es:[41h*4]
1 f; Q8 `$ [# y, F! S/ s, I    xchg    bx, es:[41h*4+2]
0 l7 v% C- f$ a) x' I5 `% s    in      al, 40h
6 ^: n  |; i, `9 M    xor     cx,cx
; r4 q! U2 l8 x8 h1 g: K8 W    int     41h  w& N, A0 U; @7 Z+ @0 T. X" D
    xchg    dx, es:[41h*4]. W1 h" G/ N" T- a+ `+ L
    xchg    bx, es:[41h*4+2]
2 m7 P: u( O0 U5 e0 d) T" {" Q    cmp     cl,al
* g% W4 A* y6 G/ I5 Z  s3 Z    jnz     SoftICE_detected, z8 U" `; @3 G. @" v: l

: y) z; {( P: G5 Q& x_________________________________________________________________________
; o, D8 B7 G2 |; c" z* F5 q3 X
" z6 E6 M% D) K) @  xMethod 07
6 v# R5 H2 k4 n" i4 q( z( x=========
) b" l& g# y3 G  O- U- \' z8 W
- @# }3 X9 l) P3 c2 A+ ]Method of detection of the WinICE handler in the int68h (V86)
; V$ b* y; Q4 N$ b  ?6 F2 M; B
) b7 \' H2 B) z9 \3 G# V    mov     ah,43h) Y4 h; U  |+ y, V
    int     68h
  U7 c" R: _( w    cmp     ax,0F386h: a% _) V. ~* B- N- w8 M
    jz      SoftICE_Detected
1 n( \( [7 A' g$ Y6 o. ^4 S  F  ?

- N- I- |8 }% V1 }$ m$ {5 n=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit6 i' d+ V: ^7 P- |% V: A  Q, V
   app like this:
2 X2 n' s; ]2 h- ]1 _! ^
9 z. n: |2 I! B: f: e   BPX exec_int if ax==687 R; p; B5 \4 S" J# R5 W3 E. `4 r
   (function called is located at byte ptr [ebp+1Dh] and client eip is- V( q' ?7 J  |1 z. Z- M& ~
   located at [ebp+48h] for 32Bit apps)
! S+ {3 `* P5 p/ v" H- z& f( C) a__________________________________________________________________________0 S  V" t: Q# E& `
2 T* W) }" e5 x" d, W: \3 p0 d9 j
9 h  T  p. I) ?: m$ n) i* ]; u
Method 080 O+ i3 I6 i- ~" e
=========
. V; e; f# W% k2 ~% F' k
7 v, P, h- K) O7 n9 ZIt is not a method of detection of SoftICE but a possibility to crash the
& y8 W7 R# _5 F( h) j; isystem by intercepting int 01h and int 03h and redirecting them to another2 i1 M' T! {% u4 ]7 _2 G
routine.
0 k5 l4 N2 R6 X& D% S! T- F% i; |It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
  b, v2 \" j* uto the new routine to execute (hangs computer...)# F  M& H7 o3 _

- O6 m& M6 @6 m* ?    mov     ah, 25h5 T! y' s* |( A# M0 o1 e* ]# G
    mov     al, Int_Number (01h or 03h)$ }3 h2 N6 X  J! ?% G
    mov     dx, offset New_Int_Routine
0 [/ }/ ?" A. n    int     21h7 P& g* `4 d7 y2 }4 N: J: s  x

. v2 F8 v9 A+ n: I1 O__________________________________________________________________________7 x/ _/ Z7 [3 R; e1 J3 J
% n9 S, x( @9 j' q
Method 09
  V( I, o: S. q7 \, U: b=========& Q: ~3 M6 V6 {' w# p
: a0 G# Q- p2 `0 v
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only; o1 E& Z' `7 P: B0 y5 b8 y
performed in ring0 (VxD or a ring3 app using the VxdCall).& K6 k  F+ E6 _; ^
The Get_DDB service is used to determine whether or not a VxD is installed; l4 ^% o4 y% j
for the specified device and returns a Device Description Block (in ecx) for) x+ M; u/ P: D9 H
that device if it is installed.
8 [) W8 A, l2 k  _; }2 s$ B+ m, g3 o9 E- |
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
% Z6 q0 I% A+ k. i& @3 w   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
" K* C/ S" @# y; i   VMMCall Get_DDB
4 L" s  N5 g# y: l$ M6 M   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed+ C3 n. s/ H( ^; m& _" `

6 Q8 j% U) U& v$ TNote as well that you can easily detect this method with SoftICE:% B1 H1 q; Z. d$ d
   bpx Get_DDB if ax==0202 || ax==7a5fh
- f2 P7 F- D" Y% c5 R# o
1 O8 ]0 w% K0 ?% r9 C9 |' c__________________________________________________________________________
$ h4 h$ U  g- K) d$ `1 x4 K% g! f/ R! [+ \
Method 10
8 |. G3 Q' O! P=========+ h0 y. t2 t! c+ {) ]4 E
2 L- }" ^- Y8 R6 D" F
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
' }8 \+ X0 h* @& E7 i3 u2 T4 I" [  SoftICE while the option is enable!!
- m. r+ d; ?3 h% \+ A- L) a7 y4 t# G, M9 l; o7 e
This trick is very efficient:+ U0 X' k$ F5 W! ]. n$ ?
by checking the Debug Registers, you can detect if SoftICE is loaded
/ |8 A( k3 {8 {2 u2 S(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
  }/ N8 ], z+ |, m3 [3 P" Pthere are some memory breakpoints set (dr0 to dr3) simply by reading their7 x2 m0 I' I3 V) `& G
value (in ring0 only). Values can be manipulated and or changed as well
  [4 S* x" T& J; f(clearing BPMs for instance)* y# L( N; R' c" `  H
6 b9 O% U* }% N; y* Y
__________________________________________________________________________9 G' F  D+ s. c$ A+ e" q9 i9 S
: Y; K) Z+ E/ n! i+ T
Method 11+ o5 M" A* a& e6 h" Z7 f# u* _% ~
=========
) i) f( k: k& W
$ z$ U8 [% g' S- H# FThis method is most known as 'MeltICE' because it has been freely distributed
. ~  z1 P. `9 v) h' U0 Lvia www.winfiles.com. However it was first used by NuMega people to allow
, j  c# r$ A& x% sSymbol Loader to check if SoftICE was active or not (the code is located3 W7 a2 D1 B: U6 k$ \& H
inside nmtrans.dll).
4 f  g  ]/ _# r1 {7 U$ b& `  m9 Q2 ^$ C# S4 I  z
The way it works is very simple:
  ]/ p8 Q5 d0 t$ k1 T; aIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
# f, S2 d, D' t3 |+ d' [WinNT) with the CreateFileA API.% m* g6 x$ c9 G2 s+ f" [7 P/ _

6 [$ @& ~1 z% m. h. s# Z, THere is a sample (checking for 'SICE'):
9 l7 z# z1 H) ~4 e
9 i. p( `" L, J. N9 J. ]6 WBOOL IsSoftIce95Loaded()% u. t9 J# e% [
{0 R! K; o  @- C7 n, Q
   HANDLE hFile;  ' S& ^7 j# J) x$ G" Z
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
# K# x/ _( r6 W- a; }8 H( t7 v* O                      FILE_SHARE_READ | FILE_SHARE_WRITE,
) e; x2 t0 S- C& J8 M                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
7 U$ ]5 G+ @2 U/ K, q' H   if( hFile != INVALID_HANDLE_VALUE )
5 d' ], D" ^$ w  G. v9 m' U   {
, Q: Z  ?7 p) W/ M' M( g      CloseHandle(hFile);3 w. e: O5 ?) N' Q; f
      return TRUE;
9 M7 K  h5 O" L7 m   }& F, ~% B( s0 m& d7 B
   return FALSE;
0 l# S% K' s( W9 E8 _+ d}6 Q% @) Q8 }% F5 i6 }' I
( {* u: }" O, b2 H! X
Although this trick calls the CreateFileA function, don't even expect to be
( w7 X1 P5 n/ I( ~4 Cable to intercept it by installing a IFS hook: it will not work, no way!& S% I& I1 H9 U$ t* C( F
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
2 f) j' f% ?1 `: aservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)' X3 C, R- {5 P* {5 u3 F6 Z6 N
and then browse the DDB list until it find the VxD and its DDB_Control_Proc& @: F5 y2 z9 m& i2 B' h, ^3 W
field.
; v1 z, |  T, Z1 y6 S1 r' HIn fact, its purpose is not to load/unload VxDs but only to send a
. W, b* ]% b# m# N9 q) {# zW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
; Y) Q2 J4 ~& l7 X. ^. g9 ^/ Wto the VxD Control_Dispatch proc (how the hell a shareware soft could try
* V) V9 {! I" |/ y$ p; A' zto load/unload a non-dynamically loadable driver such as SoftICE ;-).
. `( U* \/ P3 b% pIf the VxD is loaded, it will always clear eax and the Carry flag to allow$ b8 v0 O4 D/ |& q$ p
its handle to be opened and then, will be detected.
4 H8 ]  H, |% H) [! v! \You can check that simply by hooking Winice.exe control proc entry point) ]/ m$ v+ w& @" n( Y+ R1 n/ J. u
while running MeltICE.
/ i& W  }4 k/ ]* [- C& L- \/ O# ^% e  v* B+ h) ?2 z1 N+ n& e
; P4 A% f' n1 K  @1 d) N$ T& o
  00401067:  push      00402025    ; \\.\SICE, I5 W( l0 j# s6 Y1 S
  0040106C:  call      CreateFileA# B3 ?/ ?  x6 A& L
  00401071:  cmp       eax,-001
9 u* u& S, z% B7 B: k9 }  00401074:  je        00401091
+ X" `( ^6 A' c4 _" H/ l; G& S, q7 L4 ]* q3 S- T2 _" [5 Y) |; ~

* G, C! O2 F' v1 P9 AThere could be hundreds of BPX you could use to detect this trick.% u: l8 g; g) q$ X0 y" T3 J% I
-The most classical one is:  S, R  F; ~+ K/ u( b
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
3 G* R# [8 r* X) B6 N    *(esp-&gt;4+4)=='NTIC'
1 B9 B5 w/ Z- \. v, r3 D0 C0 j( V9 Z$ n; p) ^6 a. W
-The most exotic ones (could be very slooooow :-(, a( f% @/ D) t2 Z! C+ U
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
& @; \+ C3 K0 X& ^     ;will break 3 times :-(
+ l/ I0 D& z! m( b: _  j8 B  i5 t  S6 i
-or (a bit) faster:
/ w8 S) W0 U' t; i2 t$ j7 ~   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
) r3 ^0 R8 M6 {" y& J0 U9 J3 y+ `+ |3 z" z( |2 n) n$ n9 @; O
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  ! Y7 K  \# a5 p. H. C6 }
     ;will break 3 times :-(
8 T7 m. G; i2 W! {5 C& y1 m9 C, O
( |# X( l  q3 G* o+ z, a% h-Much faster:( q% `. i' n0 q: `* a
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
8 ?/ \7 h; y" g
/ T+ n1 @! ^8 u$ _Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
: y& ]# r: ~1 k( }  a0 L- B7 Zfunction to do the same job:
2 x& J/ c/ Q+ t: L# Q0 d; `$ F4 w7 L. b9 F: ~& N  `  u5 `! a
   push    00                        ; OF_READ0 T: U1 B- P5 @6 h* x- q
   mov     eax,[00656634]            ; '\\.\SICE',0
; |3 O! B  k2 l- E   push    eax/ D2 m$ }7 F8 [  \
   call    KERNEL32!_lopen
1 a0 n) _, Z% r  i: a5 h  {   inc     eax
' Q' x0 u1 `% h3 E% |$ i   jnz     00650589                  ; detected
+ u$ y5 o* T: f! Y7 }$ A/ M& b# z+ P" E   push    00                        ; OF_READ
* v- U# S; F, J" b6 }8 h   mov     eax,[00656638]            ; '\\.\SICE'
. |9 `2 L9 W5 g& S   push    eax& |* E8 G7 f9 ^4 C" a# b
   call    KERNEL32!_lopen2 R7 |- g7 ^3 S, n. X; E
   inc     eax
* Q; L0 c" x& K& g" N# I   jz      006505ae                  ; not detected
' S$ S: z2 i2 Z1 D
8 n3 D8 k) P% ]4 ~& M& t  K
, }& t0 r# w8 \' x* ]__________________________________________________________________________. S- ?; Z. I% P+ J
' q  ]+ `  X" i# G/ e
Method 125 l& i1 u/ J* y- l5 N
=========
$ C1 g( Z( ?, `8 y
! l* r  y2 B! S- f7 D: @This trick is similar to int41h/4fh Debugger installation check (code 05
" B* B& B& S% `3 ^0 l9 _( |&amp; 06) but very limited because it's only available for Win95/98 (not NT), L  |! Q3 b; |8 u" h% a
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.) C; B( J& e' c0 @. e  @3 K
. [1 \% P1 |; W* M$ y7 W
   push  0000004fh         ; function 4fh" e7 ~, S- n4 N
   push  002a002ah         ; high word specifies which VxD (VWIN32)
0 Y* C/ V. k& G                           ; low word specifies which service
, U# W- C- I6 \1 _1 S                             (VWIN32_Int41Dispatch)# c2 J$ x) d6 a1 t+ }
   call  Kernel32!ORD_001  ; VxdCall
% T* g" C# B: l   cmp   ax, 0f386h        ; magic number returned by system debuggers
; T/ g5 o3 L% A7 _4 a   jz    SoftICE_detected% ~: C6 C! H- i2 c9 A
6 S+ J/ m( v0 Z) t
Here again, several ways to detect it:
) O% @/ u7 L( }0 ^
5 X- }4 Q7 ]/ O" ^+ F1 W4 O# t    BPINT 41 if ax==4f
; }. h6 q2 }0 R+ B; ]% c  H4 p; K
, ^6 ]$ c2 A2 D+ s  z8 }0 {    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one* m; x+ ?6 G& j. E2 \
. K, h3 ^" T2 V
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A" z: G/ @1 x" y# E

* e8 v" m# N$ [* s- [5 U, I    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
9 h! u0 N! ~, {; t
3 q; z; }7 m* m" _' G__________________________________________________________________________' L5 ?# K) q# Z6 F/ C' j4 H
; t2 M4 ^* Z& u: R+ G" k
Method 13
5 ~- G. i' z1 }- F=========
4 o+ X  G, C( f2 I) M! g
  E* ^, `( U' S! o& vNot a real method of detection, but a good way to know if SoftICE is. g6 ^* l" j( Z0 S0 i4 ^6 r
installed on a computer and to locate its installation directory.. d2 W! `$ g) v* f: Y4 A
It is used by few softs which access the following registry keys (usually #2) :$ v8 t) j. X# y3 t+ M+ v# p

3 y$ ?' k9 ]  G' x-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion$ s8 h9 I& D: X* t; A& R! Z  s
\Uninstall\SoftICE0 ~% f" p9 c( d' t  \3 ?
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE* f3 K: Y! H' {+ N2 z$ C- X
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
; B/ r8 _! E; p% \2 F% U) u\App Paths\Loader32.Exe
( \% U( D- h& [0 F' a- ^( }6 S6 J6 C& Q1 w4 _1 o

. b5 Z/ p% @. E: d$ k& F3 R9 jNote that some nasty apps could then erase all files from SoftICE directory
% i. i0 i) X% R3 V/ {- h(I faced that once :-(6 E. p3 D+ m" i3 m; L
# H5 o# W& q. ^! @
Useful breakpoint to detect it:3 g  o9 _! `/ n5 E
0 U& Q8 d2 Z. F  t3 u5 z. P+ I
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'3 D/ b3 m) ]2 |6 P
! a0 H% U( E9 t& g
__________________________________________________________________________
) e' }$ L. L; b# {5 R$ p0 O" F7 U7 O
& ~- M! h9 O, }' W: H3 x
Method 14 ) w# @7 ]) o& C1 X
=========# g' p% ^4 e5 M8 y

9 l/ d2 P1 [4 K, {, aA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
" }& U% J$ R$ I1 X' _. u' R) yis to determines whether a debugger is running on your system (ring0 only).
  i! N) x; H. ^" c. Z8 w* U3 C) o5 x' j
   VMMCall Test_Debug_Installed0 w, b, ~% x% ~9 @5 p# Z- z
   je      not_installed/ T# T. S. E/ w  q

7 h7 l0 J0 u. U7 ?# p; {This service just checks a flag.
" F, @8 H8 D. b( W</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部