About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
8 j. y+ m) v# ~" Q4 o' W, P1 D- w+ H<TBODY>; Q# e+ {% q+ Q, m) Y
<TR>
- q7 O+ \# D, V) ]; l! w$ n<TD><PRE>Method 01
% x) j$ G' e1 n=========% D9 E& P5 c/ j8 C( E( W
4 X; b( c. }$ x8 g4 v
This method of detection of SoftICE (as well as the following one) is* B4 @0 i& \6 l( n/ N: {7 T; U2 `0 E& s
used by the majority of packers/encryptors found on Internet.
& T4 S  O: l) @7 x% |1 X( JIt seeks the signature of BoundsChecker in SoftICE
3 |% A) h% m" d8 _& j
* T; ?/ ]9 S( v4 R' q% j8 B* B    mov     ebp, 04243484Bh        ; 'BCHK'
) u! O/ _$ O' f  u% P# C5 @    mov     ax, 04h& s  Q. ~. T7 Q' o$ J+ H
    int     3      
# {: `0 s- R( d3 e    cmp     al,4/ R2 |6 D( k' e+ z! W
    jnz     SoftICE_Detected
! ?; m! f" b8 i! Y$ U- v$ V" D3 o9 ]6 O- t# W$ {& r, m; i
___________________________________________________________________________' T% v+ ^4 L5 m4 z. B  I8 R6 i* x

6 M% g/ {# F: }! KMethod 020 P2 }0 j! m% x/ w/ m
=========' m" L, U3 {3 e1 Q4 l

+ o/ o' O0 _7 ?  E9 P" vStill a method very much used (perhaps the most frequent one).  It is used
" r6 Y( W- k* G3 t+ N4 {1 o  Cto get SoftICE 'Back Door commands' which gives infos on Breakpoints,, P2 A$ Q3 T3 S) A: o( N' p$ V# g1 R. N
or execute SoftICE commands...
3 h$ ?4 J6 z- p6 ?" |) BIt is also used to crash SoftICE and to force it to execute any commands
/ V) i4 M9 b! P8 u/ a(HBOOT...) :-((  5 p, h4 \- i8 v/ k

- N2 }& g1 V; H) R3 D. \Here is a quick description:
8 E; S: P/ T* s-AX = 0910h   (Display string in SIce windows)6 l( F( K3 H. [  a% `
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
3 g3 @; @8 e: \$ \/ I-AX = 0912h   (Get breakpoint infos)
3 |$ k2 h0 l/ g2 C2 E-AX = 0913h   (Set Sice breakpoints)5 f* M, s$ W' w/ j* `+ [7 m& |( k# L" n
-AX = 0914h   (Remove SIce breakoints)/ J( v8 F' q3 ^0 p/ L
" m$ N6 H# j' X1 m
Each time you'll meet this trick, you'll see:/ O1 |- k: {8 `- a& [$ K
-SI = 4647h/ A7 i* q* }* |) e$ d4 b
-DI = 4A4Dh' Q' z' n/ h! i6 O. [9 u6 c/ r- \
Which are the 'magic values' used by SoftIce.
( |# l7 K! h, j" Q& gFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
% n% E" y, T5 b0 O3 J+ G6 ?
" v3 N4 X# X( H/ E6 U* q1 V8 oHere is one example from the file "Haspinst.exe" which is the dongle HASP( \* f& S* W+ Y7 R3 \
Envelope utility use to protect DOS applications:
5 ?, {6 L' f& A2 n2 ?. C' j& Z8 W. A, e# q) c
: T& |* J# O. S1 K3 g. A/ A+ H
4C19:0095   MOV    AX,0911  ; execute command.
4 Z1 z/ s  s/ Z" b6 ~: n4 X4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
. X" Q: A3 D% Q- m& O4C19:009A   MOV    SI,4647  ; 1st magic value.& a, k0 s0 U) z* ?, M; `+ T
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
. |8 e9 ?9 H+ b4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
* S2 \. v* ?& b: b( P$ w4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
4 R9 E/ q9 _7 b4C19:00A4   INC    CX5 V0 R  @3 u. m# H1 Y, R* ]- T
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
, T5 V% |9 E9 x7 L4C19:00A8   JB     0095     ; 6 different commands.
/ `  u1 k+ @$ Y3 L$ `" j4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
) ~1 C6 w% T# H0 r4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
. A, b7 G. `* ^7 `, y; L$ A. v9 f% a
The program will execute 6 different SIce commands located at ds:dx, which5 |4 x9 D3 t$ |4 k0 [* f% @  ~: A
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.5 ]$ f# K) Y" K! ^7 G

( h! p4 f$ _0 T2 v6 ~* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
$ o% p) f$ P2 t$ S$ I) z: {___________________________________________________________________________
  R+ T1 Y+ |. M! i+ w- ~% ?! ^7 |, a% x/ n0 M' G% l5 u
8 ]1 A1 b, j) H; f( Q; C1 M
Method 031 O3 ~7 S3 r3 x8 N& ?( S
=========
( \) f. ?" x" t7 q* C+ f6 ^
) `( A% f2 W" [, DLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
5 N+ |8 ~! W3 v7 v+ J: d# B+ [(API Get entry point)
7 K8 h+ ]" c' w& k3 V4 b& w. T        
$ d# P. C! B" {
; ~7 A8 @+ j$ r& \2 r, A    xor     di,di* j9 v6 b1 J$ u' A. A
    mov     es,di, q) b/ _0 d$ Z7 V
    mov     ax, 1684h       5 m3 T8 G: x8 k, f
    mov     bx, 0202h       ; VxD ID of winice
1 d5 Z8 x5 b* |: ~( Z( v& j    int     2Fh
, ~) V; [9 q7 p    mov     ax, es          ; ES:DI -&gt; VxD API entry point( M1 C2 F- t8 B
    add     ax, di( x% j+ K" M$ Z+ f2 `& o
    test    ax,ax# f- s, H% ~! E; n+ g
    jnz     SoftICE_Detected, D- S3 d, E: S# `1 x( J0 O
7 \3 R/ S0 F2 |1 Y9 r# u
___________________________________________________________________________
( B4 `# A6 j6 G/ G" Y7 }- \& P- i: D1 v
Method 04
9 k: e: a9 h  z9 Q$ ~: \=========( q* y  m+ ?& P
+ T0 m. x. E; j" Q; B9 i1 @
Method identical to the preceding one except that it seeks the ID of SoftICE7 C6 l# [& t- x/ Q' [6 g- ]1 U
GFX VxD.
: _% N0 d- J8 |9 \
# c  X9 U3 Y& |6 O    xor     di,di( L2 X9 S2 g- Q! ^! v
    mov     es,di7 _2 q; g4 p* D6 Q8 s/ @
    mov     ax, 1684h      
- u6 [2 |- a# K    mov     bx, 7a5Fh       ; VxD ID of SIWVID
# V+ p) n: _* {% J1 Q2 Q. o    int     2fh+ ~( i% l) ~2 z  n- ~0 h' M
    mov     ax, es          ; ES:DI -&gt; VxD API entry point! ?& t  K6 o: j
    add     ax, di
0 Y0 Y- ^0 W, `0 k    test    ax,ax
: M6 [& M3 c% z2 D5 h; c    jnz     SoftICE_Detected
2 v4 k/ Z4 |, D' c6 w; P, l) g5 ~
% w' p, p5 F5 x% a__________________________________________________________________________
0 B  A) T6 W0 ]1 s; F- V6 D- \  M3 R
5 K0 w  T0 \8 }2 ~  P1 v
Method 05; A5 R' ~5 c- Q! _
=========! l: z' W2 e$ v- k+ y/ F
$ \8 ]+ Q! Q8 k- ^
Method seeking the 'magic number' 0F386h returned (in ax) by all system9 n5 @2 g* w$ F/ i, y' @
debugger. It calls the int 41h, function 4Fh.
" ^# i+ S9 L4 @There are several alternatives.  - l; M5 u2 ^( s0 d; T' n7 M/ n* A

4 B3 O: [! O; z  \5 jThe following one is the simplest:
% V" j( c: x, a  C, c  G! p- E
0 n+ R( {( M4 c    mov     ax,4fh. u, o$ h5 m2 O! ~3 W& `9 y
    int     41h
0 T7 z" a* L! W  N% E    cmp     ax, 0F386  Q+ M# h6 }) f7 a/ M
    jz      SoftICE_detected- B# l3 T/ i' I2 H

7 O5 b3 L5 Z8 t' Q  O0 [9 y; R! J& A. N7 P
Next method as well as the following one are 2 examples from Stone's 1 J+ R/ t' Q! C' _8 t4 K
"stn-wid.zip" (www.cracking.net):
% G5 d2 O% R% K! X. P+ ~* f3 x' t  s4 O, H) V7 B# L
    mov     bx, cs0 M$ ~0 t: @+ F
    lea     dx, int41handler2
) Z, S  o. G( F& W! C    xchg    dx, es:[41h*4]
! |' B4 v% A/ A2 G1 y    xchg    bx, es:[41h*4+2]# `' S) }4 o3 s9 J
    mov     ax,4fh
7 X! M' {; b, L4 f+ J" `    int     41h
/ T( O( h/ \/ U  y) a0 A    xchg    dx, es:[41h*4]2 {& u; I, n( U- o  B6 }6 H1 F
    xchg    bx, es:[41h*4+2]$ j1 b; H( I' l& j
    cmp     ax, 0f386h) z7 F: X$ ~4 s* X: l
    jz      SoftICE_detected2 l, Z& ]; R; v8 U: i$ c

7 ?4 K! N: p. E# Zint41handler2 PROC
2 {1 j& w& h  J( R  X( c    iret
5 s7 ^0 {, Q9 k- r0 u9 O) k+ Oint41handler2 ENDP0 B/ w- U3 I) _
! R# |; M9 O/ b- @9 x

" e( W4 n9 f5 ]& t7 T' k_________________________________________________________________________
, C  U0 g* W$ K( g
/ b- k" P# G1 I. Y- y& `0 j7 q  t: J) k, w
Method 060 p3 A  u4 J9 V# g5 g0 H5 g3 l1 x' i
=========
& }8 }0 I9 p. f
3 \/ v. X, `" `2 u( x" g+ n: k! G! e5 O8 @  l, n) y5 ^
2nd method similar to the preceding one but more difficult to detect:6 T8 |/ H# m! _; {5 m$ ~- g9 I

. p; z" u; s, G- G$ s3 ~- I( x9 t: Z9 N9 L+ V
int41handler PROC! J) u$ p, `. ]8 [: T" u! [
    mov     cl,al1 H0 _5 W( E9 H# _
    iret
4 y9 ^% ?" k+ ?: Yint41handler ENDP
( v1 k  o5 ^' D- y) m% X9 I+ F9 _
: i' Q6 E, Y  N6 D; [7 h; m3 r8 a; S* d* d2 x& D0 e: K
    xor     ax,ax
* g; D) L0 T# n$ Q& x/ `" M/ v; Y  O    mov     es,ax
/ {# B0 m# l# o: U2 N. e    mov     bx, cs/ P8 A0 `" U: _8 c; q% J
    lea     dx, int41handler
8 f' x: ~$ n0 k+ ?- k- o    xchg    dx, es:[41h*4]
$ V- d. m! F. Q$ R% y( E( n: V    xchg    bx, es:[41h*4+2]7 Z) x1 x4 Q" v0 O2 T
    in      al, 40h
7 p& a+ g/ B% J/ i% G    xor     cx,cx
7 C+ V# A# S/ ]& m' _$ @7 u    int     41h5 u0 j5 W' V, \8 \0 E$ M+ w
    xchg    dx, es:[41h*4]- K0 E9 c' b8 G& O
    xchg    bx, es:[41h*4+2]
9 {, ?( y# d% a; H9 Z* B/ ^    cmp     cl,al5 }1 ^6 |# G1 ]8 a2 p: n1 A) T
    jnz     SoftICE_detected
0 d( r/ S1 ?4 q. y4 {' w; ]+ h9 a! Q+ r& b, j/ F/ G
_________________________________________________________________________- ~& h' `9 e( }+ d$ R

1 H6 e: E- k! x* gMethod 079 Y7 E8 H. Z# l+ d3 d# n* U
=========
4 f+ _# V  [7 e7 i, b( W( Q2 Z+ l: G/ F$ a
Method of detection of the WinICE handler in the int68h (V86)
7 a' Q6 k/ S5 }8 F& {+ G
7 p0 W! x" ]: r8 J! k* n    mov     ah,43h) K% M. r* R# C5 [
    int     68h! Y0 Z/ K9 P5 R/ M! X4 l. T( O8 A
    cmp     ax,0F386h
/ |4 M6 B% h3 b% x( v% P) ^    jz      SoftICE_Detected% N4 a* R+ Z; `0 ]; J" }0 j: U

9 d7 O, g" X5 t5 \+ t) t
0 B6 Y: f5 O4 V, R" M! ^=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit& f$ c4 f& S6 q1 @. D- D2 d
   app like this:+ X) m1 v6 K* q

6 _( i) E$ y/ }   BPX exec_int if ax==68
+ I/ p6 q! [8 c   (function called is located at byte ptr [ebp+1Dh] and client eip is4 o# z& R; l# U1 r7 d0 c5 c
   located at [ebp+48h] for 32Bit apps)
% Y1 K6 }( H1 T! |! s1 Z__________________________________________________________________________, |; _8 ^- q5 g( R
+ W4 k' D& D! Q  c  L7 g
  B" [& a6 K, m3 q5 \6 @
Method 08
+ B; L  e+ j. m* I9 S' f! {* P=========9 }# n6 }9 a3 p  Z
! H5 I, d/ A7 t# v8 V' E* I! W
It is not a method of detection of SoftICE but a possibility to crash the: R1 E& g3 e8 a) u2 f# J) C, d
system by intercepting int 01h and int 03h and redirecting them to another
3 q9 ]* {4 p: d7 {# ^- Q: Troutine.
" ~1 Z3 B- c  m3 z. o, J0 AIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
. [( ?8 ]! T9 o; ^to the new routine to execute (hangs computer...)( c0 Q  Y8 t: _8 @& b* M

0 b) B- L: X: ]; C+ o    mov     ah, 25h
: \1 g8 `  o7 Q: ~    mov     al, Int_Number (01h or 03h)1 C3 j$ h! e7 S  h6 Z4 V- p& {4 R
    mov     dx, offset New_Int_Routine
/ i' v2 A0 d" g; v7 ?4 n$ U) D    int     21h  Y! {  w$ a7 F3 p% a
* H+ a# l" Z% e& Y' `) R% m/ Y
__________________________________________________________________________
$ |* n  b( ?, C' \7 n; l  }  C5 d6 _* U$ L5 C
Method 09
4 x8 t% t: _8 ]& g=========
# l7 m: Q- w7 t' v' r* h8 l9 L. A0 k3 C6 E
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only  k) I- U0 b+ k4 m" l# z
performed in ring0 (VxD or a ring3 app using the VxdCall).- t5 f9 {( B' ?5 ]* V
The Get_DDB service is used to determine whether or not a VxD is installed
& \( T3 s3 x& B) @for the specified device and returns a Device Description Block (in ecx) for0 P9 J) ^' @& \) r# m/ H
that device if it is installed.
( J& b, ^# {4 E; Z3 a
' C6 b) g& i: N+ T% R# [9 {$ S6 X: m( }   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
! N& a5 L2 d, z6 G8 R6 L   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)' l4 j. `% T& K/ k5 M$ L9 C* q
   VMMCall Get_DDB
& s. w& v5 s  F" U) ]% m   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed2 I4 o$ I5 f' H3 M4 ^( c) \

  T& `) r; t& nNote as well that you can easily detect this method with SoftICE:) H9 J; ^! t8 \, z# ]
   bpx Get_DDB if ax==0202 || ax==7a5fh' T2 v" n. I. x1 Z, x- h6 F: x

( n% n& _5 _  y* y0 V__________________________________________________________________________6 m" A9 Y. u4 P$ Z4 `

6 o+ k  Q2 H( A2 ^/ ?Method 10) [% A. ], c  k  m2 O
=========- }+ m" g  X( s( z0 P9 l) \, v

# T- X2 |7 g$ K' f=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
; ?: ?9 r9 Y4 z1 e6 q, y+ P  SoftICE while the option is enable!!
; s0 \% X/ Z7 C4 u
5 b" F! a7 ^: N$ h( u5 yThis trick is very efficient:! y8 w5 r" J" _0 z" J* h" ]3 h
by checking the Debug Registers, you can detect if SoftICE is loaded" y6 C# W+ H. K  u3 Y1 I
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if2 O$ D8 \: t2 k" ^% t
there are some memory breakpoints set (dr0 to dr3) simply by reading their& _  Q, T0 O, V  J! g) P* W
value (in ring0 only). Values can be manipulated and or changed as well
* @0 I2 U$ j& Q9 Y(clearing BPMs for instance)' a/ j6 h$ _2 B" t$ E* k: f# o

5 ]+ ?/ t8 h, j. `$ u) D1 G__________________________________________________________________________6 F( R1 J6 W- X& J8 ^

5 [: Y1 A) [$ w: _Method 11
, t% V7 q4 b( J: j. b! V=========% {3 S8 i1 r+ k% `
& w" Q$ \/ f; n" k
This method is most known as 'MeltICE' because it has been freely distributed2 ?8 \. h4 X/ A7 ~* ^6 f1 d+ _3 a
via www.winfiles.com. However it was first used by NuMega people to allow
0 \5 X4 k1 B+ P, ~' _* \# rSymbol Loader to check if SoftICE was active or not (the code is located3 t# W! G# t# A  P0 m
inside nmtrans.dll).
1 h3 ^( m5 g- Z. e4 }& ]+ t% d7 h
* o' \% Y: i# n3 C2 `( E( M4 wThe way it works is very simple:
8 \8 J( L) V" k* O$ EIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
, F: w3 W7 Y" Q8 ^1 x: Z9 KWinNT) with the CreateFileA API.2 C1 g- d! `8 J& z3 @  W" G
0 s- U" t  @3 m% n1 V% E3 R. O
Here is a sample (checking for 'SICE'):: Q5 Q: m6 g# j. Y" t- w5 Y
- w! k9 t- n# N3 h9 d$ r
BOOL IsSoftIce95Loaded()" Y# l6 s7 \4 w) l$ i
{2 @. a9 |# ~2 a# K7 U
   HANDLE hFile;  
* h6 ^  E2 o7 ]   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
' j5 n# F5 h" u3 f" o                      FILE_SHARE_READ | FILE_SHARE_WRITE,- m7 i, Q  L  j" e9 R
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);' K6 B7 Z. Q/ ]8 T
   if( hFile != INVALID_HANDLE_VALUE )9 k+ F2 @( B) k. ^  H
   {
* A# ^: t$ j1 I* f$ F      CloseHandle(hFile);
& G4 [  ~& z+ z- ]& H      return TRUE;$ p3 g! a7 ~$ v: g
   }
2 v8 C! {# X0 I   return FALSE;
% j0 k" M6 r0 t+ J6 o7 X}
+ }. N  D9 P* {# }  d6 n
" k; `6 {7 f$ R, F- d0 w0 wAlthough this trick calls the CreateFileA function, don't even expect to be
4 P7 R# i: b7 D8 D4 Table to intercept it by installing a IFS hook: it will not work, no way!* U" c; t3 g6 e9 j& f8 X" v; O
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
) A; j, C  k$ [2 `, L7 r5 ^service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function); q$ ]+ o0 Q. v# a3 b, V
and then browse the DDB list until it find the VxD and its DDB_Control_Proc- M9 d* [, j6 i
field.8 v6 L- V* \3 R; A1 u
In fact, its purpose is not to load/unload VxDs but only to send a 5 T+ g6 w. P9 C4 E
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
; ^9 i- q2 x: }& P# i4 Q3 _to the VxD Control_Dispatch proc (how the hell a shareware soft could try+ k2 {% e- V$ l3 H. e# [
to load/unload a non-dynamically loadable driver such as SoftICE ;-).+ A/ y9 L4 Y& e+ P* D3 r
If the VxD is loaded, it will always clear eax and the Carry flag to allow
& @% y! c' ~7 G  g. ~) Fits handle to be opened and then, will be detected.
3 D3 q' x6 C/ T9 aYou can check that simply by hooking Winice.exe control proc entry point9 U5 t/ F4 `& z7 Q) d
while running MeltICE.: J0 j9 z; W: D0 i
) W& b4 t0 n& D  l! p5 L

4 O/ E$ l: K' O, l  00401067:  push      00402025    ; \\.\SICE
, n6 J/ d3 L% Q( T, R8 Q5 R: m  0040106C:  call      CreateFileA
- ]% I  Y6 G6 U% ]; ^/ E  00401071:  cmp       eax,-0018 T3 q4 R- G/ I; ?  u9 @; v' x* E' K
  00401074:  je        00401091
, w: Z( H: [. V: v2 D* z) L% U# u2 V2 d0 R* w& Y% f$ ~. n9 G

" K& M  c. s' q0 A9 F( Y4 H$ sThere could be hundreds of BPX you could use to detect this trick.( I2 ]( U( Z' H: k
-The most classical one is:- z4 N6 }3 h% a3 @; {
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||4 B# j" B5 C* A, h* V" F, @" @
    *(esp-&gt;4+4)=='NTIC'! e; r6 L" ]9 b' O0 ~4 `
  f' e0 X, H+ |2 B% t3 H9 f/ t1 j, N
-The most exotic ones (could be very slooooow :-(
  [$ [" s7 V8 M8 _8 }) @: T   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
. R) `: F$ c  e+ {     ;will break 3 times :-(, k: k3 j8 Y: s. l  \" t
* e- |( c& \8 H' T/ Q3 a
-or (a bit) faster:
6 ?- z' A7 W9 j; E   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
' w2 e( A" {/ D, G) k
7 ^* s- v3 o1 R4 b  o3 Q# v' E, t9 m   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
, \4 J) ~' E7 v" a; j     ;will break 3 times :-(
3 d: W3 f: ~& Q4 w/ }! t0 X1 r" t3 Z( u4 M5 f* z
-Much faster:
. F  t( |+ s0 w* X! H8 o9 x7 {   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
/ G9 W, \& p6 d% W8 B9 Y+ |6 h
& Y% |# \& J9 Y. h6 z, vNote also that some programs (like AZPR3.00) use de old 16-bit _lopen, U% Y; X( F, U. m, W5 ~* S
function to do the same job:* b' ~8 q+ e. e/ w
0 U& P$ P) f3 A2 P( z  G: }
   push    00                        ; OF_READ
$ i2 H7 Z4 r8 q3 o7 O   mov     eax,[00656634]            ; '\\.\SICE',0* n: Z4 I. ]; H5 a
   push    eax
7 R: a& K; M: L; e4 Q) D) J3 A   call    KERNEL32!_lopen1 J+ ^4 M3 l$ E# M" ^2 ?
   inc     eax
- |) y+ F$ P, g7 c2 \: z   jnz     00650589                  ; detected
. N$ K% S  G/ c6 B+ C4 n# z: e   push    00                        ; OF_READ
. r# O. X: m6 T0 n- B9 X7 k$ v   mov     eax,[00656638]            ; '\\.\SICE') y) a+ ^/ }' k- T$ G% n/ j& A
   push    eax' e# G  f) @2 [/ K) |$ K1 q
   call    KERNEL32!_lopen8 |# E: T' L: e: |1 u9 b
   inc     eax
/ z7 ?: D6 B8 }$ k3 ~   jz      006505ae                  ; not detected
2 @5 u' E% K# \: z3 s8 w, t; D/ f, u# d4 T

1 X" |) p& S0 ~3 c- p__________________________________________________________________________: X; u9 D" a3 y4 T. u; }
- L$ W! H! Q3 a
Method 12
% Z* w0 O* c7 D# F7 L6 a=========9 d+ v0 {5 C' l% `4 k
7 ~( U, B  ?7 ^8 @& U
This trick is similar to int41h/4fh Debugger installation check (code 054 s3 U9 O8 z* I1 Z5 o
&amp; 06) but very limited because it's only available for Win95/98 (not NT)0 M2 G. B* v7 _& C
as it uses the VxDCall backdoor. This detection was found in Bleem Demo., U- K. l7 ~2 K  N- I
9 o3 Q' d8 {' V+ t' [0 V
   push  0000004fh         ; function 4fh
# t7 L! B2 n. M; K# ^4 ^4 V   push  002a002ah         ; high word specifies which VxD (VWIN32)
& [0 P- g4 f4 p) n8 V4 b& k                           ; low word specifies which service
! s  c1 v+ w) {, g& r, b                             (VWIN32_Int41Dispatch)8 {7 c0 H# Q+ |: h1 ?
   call  Kernel32!ORD_001  ; VxdCall: |5 h. H3 D! R7 p" P; E
   cmp   ax, 0f386h        ; magic number returned by system debuggers
" M. \( B3 k# U3 ?0 q   jz    SoftICE_detected8 i& W+ T% u$ S0 g% J
) G; m. R" m9 ^% n- ?
Here again, several ways to detect it:
0 j: c# h( l( l7 x! e) ~( R2 K
+ h* m" F. @# S, V* M6 |) @    BPINT 41 if ax==4f6 k+ Z5 T) d, T
; i8 M9 w8 L& _; x5 r
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one6 @- ?) X: I% A+ I% b

; v- b+ S) O! z. S* j7 x+ q* @    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
, D  M+ t! ]* `7 w" X/ v. e- t
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
2 b6 N( U0 X# f
8 c/ x. u: j1 V__________________________________________________________________________
4 U5 A5 w) a7 S0 W* I3 d; f
# o$ M0 V& x0 S( b1 i2 ~Method 13
" s6 F- O4 V" `, m2 p=========
' j1 Y, T0 S" n8 F( h1 R0 x8 x$ p  R" m! v$ m( A
Not a real method of detection, but a good way to know if SoftICE is
. \$ Q- S5 I, linstalled on a computer and to locate its installation directory.+ d4 U9 D% r; F0 w: |
It is used by few softs which access the following registry keys (usually #2) :
1 _4 {9 m8 C& p" U  Y  @9 S2 K2 v( x" s7 u* }& z
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion3 J% _6 W, N, B2 B
\Uninstall\SoftICE4 H& g$ V+ H7 i7 q% }: l# n
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
0 I* n. R& k/ }' V% m-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
! V' I$ H  q# \6 A8 O\App Paths\Loader32.Exe
8 _' A  |( ^- M; x" E# S9 D0 e! c/ N* u% s
9 _# ~* M2 Z% |9 ~7 n/ ^2 ~+ z8 T! a4 O+ `
Note that some nasty apps could then erase all files from SoftICE directory
+ G  F( H3 K3 `) n+ \' c( a9 I(I faced that once :-(
2 W% L$ k9 A0 x  _2 U3 l# B, R+ q" ~# U5 b
* A  M+ z# |1 v, ?5 ZUseful breakpoint to detect it:
. C9 p$ M$ H* {) d5 H4 V5 D3 n) O. a& A) N4 M' r
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
% }9 P2 a0 `/ A# P$ [% t
) j0 Q/ k; [9 _4 U: j( o6 h8 V__________________________________________________________________________
/ E4 c' h* W. T, }0 f
0 H% m$ t+ `1 r, K3 h' y( k: k  e2 u1 ]/ B
Method 14
5 O2 j+ X* ^) P  k5 k. r' W=========
7 F3 p7 s. I9 G3 ~
1 u, j4 X4 k5 w2 J) B+ _$ w' lA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose7 t* T' J) R3 D3 ~8 w  W; V
is to determines whether a debugger is running on your system (ring0 only).# M/ R. c0 C1 R0 M

- K3 p; F% J3 j2 t! n0 @' n. O, I   VMMCall Test_Debug_Installed. \5 g" W& X1 Y2 f
   je      not_installed/ c2 O$ ~  C* R; r# v; K0 r
+ i' n: V' h* p
This service just checks a flag.
; r6 |( x& v/ g8 q</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部