找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
0 b* Q4 \7 c: w8 H<TBODY>
: [; c0 A7 L& k/ ]/ Z<TR>/ ?8 ^4 k: F$ j0 K. y, E
<TD><PRE>Method 01 3 w$ N* t0 a$ o
=========/ Z  B! R9 C4 v3 e: ?! n* d

& J$ H1 u! H( ^/ e% _This method of detection of SoftICE (as well as the following one) is
! b/ ?, T$ s2 X# y3 r9 mused by the majority of packers/encryptors found on Internet.3 ]7 s" f2 \" u9 b  Q4 ]' Z/ ^+ M  {% F
It seeks the signature of BoundsChecker in SoftICE
9 D7 ]6 d* e/ r+ ]7 n% T. X  d- Z' I+ m- n
    mov     ebp, 04243484Bh        ; 'BCHK'
9 a3 U& P- U! r. P    mov     ax, 04h- b* \" r' b* Q3 p% Y# s; \2 B8 O
    int     3       - N, {/ k# s6 c6 ~, z1 m
    cmp     al,4
" [. w9 o5 H* I+ j1 ^8 H# X    jnz     SoftICE_Detected
: E* n; B* p; D
5 ~- I0 q& u- D___________________________________________________________________________
8 h) u, _: M7 c8 I+ `: C% o; W& Y
Method 02
! S/ E6 U$ z; b. w9 g. B=========! `) f, U. W( l+ H; {

# ~' H) z. h+ [9 Y5 NStill a method very much used (perhaps the most frequent one).  It is used5 E6 E/ Q" L+ _0 D. `$ D5 N/ e4 N) J
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
) Q! \- ~" ]9 o- Aor execute SoftICE commands...
: p5 B: A$ A7 |/ CIt is also used to crash SoftICE and to force it to execute any commands
4 z, D% J$ L6 W( F& {% v+ d(HBOOT...) :-((  
. V7 t5 d, d4 D4 O( l- H+ M' e/ B6 T) b
Here is a quick description:$ L6 \" v, y2 O# @/ u  K
-AX = 0910h   (Display string in SIce windows)+ E* \5 P" V; h1 P) B+ L
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx). M3 B: b3 X* A3 f9 R
-AX = 0912h   (Get breakpoint infos)! {" c2 e6 j* G+ r. _& c. Z8 H
-AX = 0913h   (Set Sice breakpoints)( I7 _& W7 H) c1 U8 v# e
-AX = 0914h   (Remove SIce breakoints)/ e! Q8 t0 \; Z' B
" {5 B$ f% X5 K3 c
Each time you'll meet this trick, you'll see:  f3 \& c2 e5 G- t5 F
-SI = 4647h5 W3 b) @& B, A4 H) T4 ?
-DI = 4A4Dh
& ^+ U! b& k% [* ^* b# v/ GWhich are the 'magic values' used by SoftIce./ Q0 W* r" V9 c( x7 Y$ T
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
( i2 b  b' {( a. v0 `. U
  O* R% J% ~- WHere is one example from the file "Haspinst.exe" which is the dongle HASP
1 S& r4 [* h( u: u4 TEnvelope utility use to protect DOS applications:
5 \7 g. m8 C3 `7 d
' |/ a6 e2 b9 ]  N; ?: g5 v- X5 u
( `; }/ P0 c* P! K% D4 H4C19:0095   MOV    AX,0911  ; execute command.
/ r# W0 t% G- _9 ^' y. s4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).8 |$ I, `; @! S4 G, l: f' K3 F, K& ]
4C19:009A   MOV    SI,4647  ; 1st magic value.
" B  v$ f) S$ V0 i4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
6 O- n2 t! `4 K0 i5 k9 m4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)+ O8 Y1 E) b( T& _1 s7 S8 `2 Z
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
( n3 m- L, I0 Q0 f/ x4C19:00A4   INC    CX4 `, Z" x& @$ h) H# Q) K7 |! T# r. l
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
9 J+ C& y8 ]+ _) Y9 k8 ^4C19:00A8   JB     0095     ; 6 different commands.
  p* |% o5 D( _4C19:00AA   JMP    0002     ; Bad_Guy jmp back.) ~( r, p5 q. P: \: J$ F4 |
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)& p0 A- @! H5 G

7 x: `6 X) z- I; u! z; t. Z$ O! y! ?The program will execute 6 different SIce commands located at ds:dx, which5 F5 P# e# F, `5 [6 Q* O4 N' x1 a
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.( n: m% s' j$ u  H% T: Z

5 k5 e& U. r' W* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
6 z, J1 k0 a  S___________________________________________________________________________
" i8 r  |9 d4 G- s0 I7 {/ L; Q1 b$ `: t2 f) _0 g
' L4 }: U7 _. j" @* s! B
Method 03# `) A$ e& |( w. @2 e$ {
=========
3 i& I0 t& t$ }2 D# W* C2 {  |7 @' D, I. ]" c
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
& O3 @; Q/ ]% G3 m(API Get entry point)3 @9 {0 I" ]$ S2 o+ T4 x, P
        
1 y) n  \4 F1 X: e+ v( d2 N& z( V; V& U# R% U9 @
    xor     di,di6 L$ [# g4 h. q: g8 T: }
    mov     es,di4 W# W# t8 [' a' ]$ M. q5 G
    mov     ax, 1684h      
9 j2 s5 D- `- i    mov     bx, 0202h       ; VxD ID of winice$ e+ V! F8 F2 ]
    int     2Fh1 |. \3 |9 ]+ _7 F
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
* S6 a+ s( U. \& V    add     ax, di
4 a( v- L' }+ M; s    test    ax,ax
2 X- s, Y( e. @! C9 X* a7 h7 h9 D    jnz     SoftICE_Detected% A' y& _# D6 z* H+ K

# B  Q9 R* O9 }( b4 G+ _2 P___________________________________________________________________________
, g6 ^" j/ `$ b9 E8 I8 M0 V4 Y
8 k4 H3 z9 _3 NMethod 042 s7 {+ M' ~  c0 N' B  V: P/ P
=========
: Y3 d+ c* J) [5 I3 R  l0 H$ I0 q: @# z1 c, G
Method identical to the preceding one except that it seeks the ID of SoftICE
' d# L6 m; T5 R. ~" D$ {* q" PGFX VxD.
" q6 ]3 e: w: M) D0 y/ Q! d
$ E: D" U8 j% Z4 t9 L    xor     di,di
7 Z7 q( F/ k" ?' v( Z    mov     es,di* }5 w+ Q+ F2 |; I1 z/ U& e
    mov     ax, 1684h       % _/ ^) \" F4 D3 p, X. @
    mov     bx, 7a5Fh       ; VxD ID of SIWVID4 R2 S$ p7 B5 H
    int     2fh. t5 d4 H& Z* v  ~
    mov     ax, es          ; ES:DI -&gt; VxD API entry point' H2 u2 }; Z* U
    add     ax, di
; K2 L0 y; \, ]    test    ax,ax) z. Q0 `7 `6 z8 e
    jnz     SoftICE_Detected4 T7 c5 ]: U8 ~8 Z
* ]$ ^: x% ~7 }
__________________________________________________________________________
' W* j% }9 v6 Y' k4 h" U- ^1 Z( \2 X9 t  j. V3 V

" G* B* ~# s& l2 Z( ]* ]* y: jMethod 050 H0 q5 v- V! A: u# D
=========9 k4 ?7 f0 w7 _. p# ~
5 r- h9 I3 D% d3 R
Method seeking the 'magic number' 0F386h returned (in ax) by all system. a' j4 z+ q4 m% v& N
debugger. It calls the int 41h, function 4Fh.
* U' _' q% ?% S  IThere are several alternatives.  
7 X- v1 @/ |, `5 G" d
; ~5 m9 j) R2 E% f& _2 tThe following one is the simplest:
7 B4 _; Q0 D! I( s6 b. s! F' V
1 t1 m  ]/ b( f3 e% u    mov     ax,4fh# G0 G9 t% \# [1 o- e
    int     41h
  l' E% f$ |! K1 F/ S    cmp     ax, 0F386
9 N! S/ ^+ A, C: s) |    jz      SoftICE_detected
9 Y+ o- Q/ R2 @6 E% H" z& t! G" c- E! L" J3 a

& E/ ^4 c+ t0 n/ A2 jNext method as well as the following one are 2 examples from Stone's 6 S9 v$ }" i& f& ^5 T  P
"stn-wid.zip" (www.cracking.net):* Q+ O6 g8 Q' t1 S6 y

" q7 m3 W5 s5 N# I% l: U    mov     bx, cs- l4 {* X& x1 F4 E% ^* F+ {4 s# j
    lea     dx, int41handler2
7 K& _- {# s/ `- P' Y    xchg    dx, es:[41h*4]
; `' A3 K) T( o3 C, a- Z$ z9 _    xchg    bx, es:[41h*4+2]" I8 j. V4 n" y; m/ u/ a
    mov     ax,4fh
$ a  f; h5 @& I: p    int     41h
% J; i7 a6 S& ?# S9 v' E    xchg    dx, es:[41h*4]
, ]  Y2 k% \, O/ @    xchg    bx, es:[41h*4+2]
  ^5 h- z4 V7 \& p    cmp     ax, 0f386h. K5 `1 i% a+ e$ p3 r: u. j
    jz      SoftICE_detected
- U9 u, B' G  g9 o1 X( J" Z2 H2 Y/ m/ @8 A8 v7 [& e$ x
int41handler2 PROC
( H1 ^5 C" x; K/ E" Q% _    iret
  o! _3 `, _7 K5 [. b; \5 p! \int41handler2 ENDP/ I6 W9 D7 o- D! s. I0 @7 }
4 ~) j9 ~& _" n! v4 Z. M+ q

' I8 L) ^3 b3 n- ?. ~: P_________________________________________________________________________3 G5 \- i% i; X9 x

- N" M5 @0 B: v) Y) }$ k4 E4 y' w' @9 P- H- H* r; _5 ^5 [8 c
Method 06
% \4 p! [& i; n. s/ q# `, E5 R=========
: ^/ c" o: @7 t& ~& n2 \* q# @* y! q- c+ V

, M. ]6 J& ~9 }& a. M4 f- k$ r; u2nd method similar to the preceding one but more difficult to detect:
8 l) A- I& G/ k: r9 O% k) |0 _
6 g  @, P" P+ R! {$ K& a  Q/ o5 f: e4 c- t  Q5 S5 q, w/ {
int41handler PROC
- \- _- R" w0 R: c9 y7 t    mov     cl,al
' b. L9 o+ j' k6 ]  K4 ^# D  K    iret
/ x7 l$ K0 ^5 T8 Xint41handler ENDP
2 Z2 g+ g* v2 c# i4 [$ W9 W, h9 T" ^+ c4 n% y7 T
+ c" P. w* I! t9 v( X# {
    xor     ax,ax
7 R% b5 @& o* c- L! o1 o/ f    mov     es,ax
) M, N  S. G- D( ]* c    mov     bx, cs* s+ R" L( t& b. n9 \- x3 Z
    lea     dx, int41handler% k& Y! ^; H5 F( l
    xchg    dx, es:[41h*4]
0 m5 l; v' z, ?% ]( J    xchg    bx, es:[41h*4+2]6 E2 H3 q' i  {
    in      al, 40h
' F- `: v9 M0 z& _  h  S+ A    xor     cx,cx
. C& g' Z+ x4 h% U    int     41h- r/ a  Q8 f7 F
    xchg    dx, es:[41h*4]
/ k0 q; i  q8 q: q  b    xchg    bx, es:[41h*4+2]) A. w8 K% s5 A2 F
    cmp     cl,al
7 X4 g5 A+ e& a* G& s- c; R    jnz     SoftICE_detected
5 [# G5 j4 ~+ f' y! s8 e* c
! D1 A+ c2 n6 |5 A: g_________________________________________________________________________
0 j5 a( x% x* J- i5 E+ Q& E- _9 s' J
; _: ^% U& S' `Method 07
9 e3 R* W; m6 g9 t9 {. q0 {/ H=========
3 q# F: @3 h3 A5 o4 S$ A( X* X/ i& \# _' W% O; i
Method of detection of the WinICE handler in the int68h (V86)
& o  M- S  ^+ D1 h4 c7 r
+ A0 E$ S8 T: u9 N    mov     ah,43h% U; M! _" R2 \7 |. j1 r3 ~
    int     68h
" u- F$ k! B3 [+ L3 Z3 a    cmp     ax,0F386h
7 {$ X" O, a8 B: T! H, `% X* T    jz      SoftICE_Detected
/ I% j; w! {* X/ |! {5 E! r( y- i/ x* b& [, S

" l* b9 q: H: M5 z  w=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit1 e8 X7 u, {3 O" ?( I( w
   app like this:
: B/ C* }+ t7 H
4 ?+ n; i  M8 L! ^$ y/ F2 |   BPX exec_int if ax==68
- x+ M. j; b, l: f2 k1 k   (function called is located at byte ptr [ebp+1Dh] and client eip is! m# l9 e$ }% i6 l! X6 m
   located at [ebp+48h] for 32Bit apps)4 k: G& [& L+ l2 f/ V
__________________________________________________________________________
  A  H) J) o5 h* L: S' v; `! b) x+ f2 p6 x! O& k
( d2 e5 R4 T. s7 J2 }& j5 |
Method 089 \- z' H, }0 A3 h6 t5 t
=========
7 W# s0 S# \  H5 u) U, y6 e7 }, g4 `* W, A9 D, r- _
It is not a method of detection of SoftICE but a possibility to crash the/ l  a$ ^. I! N0 x
system by intercepting int 01h and int 03h and redirecting them to another
! |: I* ?9 [# Iroutine.9 P' F+ ?6 O( u, q. h5 c
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points* H* f* g9 i  ]( X$ s" m) B
to the new routine to execute (hangs computer...)
' g0 p& w8 _! G* M/ {8 @% P3 W. P1 ^! G: j3 c. }
    mov     ah, 25h3 t) q( S- l. a2 f3 y/ H
    mov     al, Int_Number (01h or 03h)
( f6 V. k$ q* [# i' Q# i    mov     dx, offset New_Int_Routine5 m, M: m) Y6 T1 k! E, }% l
    int     21h5 O4 D3 K1 P, v
% J8 G7 C3 `: d. ^' P9 s8 h
__________________________________________________________________________
- u5 v! A$ \+ G6 d' A2 N7 }- v% l$ o- M0 y7 T
Method 099 ]1 w+ T2 t# y& d$ ?
=========
. {9 }7 u6 \1 {  R6 n, j$ b" f4 q* Y- J
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
% {% k* i/ M* b7 g' V: Pperformed in ring0 (VxD or a ring3 app using the VxdCall).
4 ~( ~2 r" y( R8 q+ n6 m4 ^0 Y3 n2 ]The Get_DDB service is used to determine whether or not a VxD is installed
- _: j9 n& U) Y: Kfor the specified device and returns a Device Description Block (in ecx) for
+ B  ]% U3 S( ?% ?& y. vthat device if it is installed." T9 l3 A" `% G, K1 n# G! X5 E

) e8 B! l7 a( \9 [% L( L8 w+ ^0 X1 Z2 C   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID5 i; T  ]9 T1 c* G/ C
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
! N7 `, c& S2 z( d" \, \. ^1 M   VMMCall Get_DDB, y" P. m) t8 D% ?
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
1 v/ v6 a$ i% Q1 _
4 v5 W8 `  F: sNote as well that you can easily detect this method with SoftICE:
/ ~3 v1 B- u0 p   bpx Get_DDB if ax==0202 || ax==7a5fh
2 f" W# ]* D8 v& H5 u9 b
& E5 }" [5 I  l, z__________________________________________________________________________
7 @" r9 E* o0 H5 T5 l
' ~5 D- Q+ A; u- T4 t8 X+ |: BMethod 107 ?" m3 e6 J* W, q0 x- e; _
=========
6 ]- u+ _7 F8 w/ ?% f0 L# j' u  `+ }6 l7 L6 {! T
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
" G0 U' d- [8 c- x7 w! D  SoftICE while the option is enable!!) F8 b5 X6 w& s. s2 s

- T7 Q2 I5 z8 m% @4 o" O' oThis trick is very efficient:8 u0 n+ K+ n+ Y1 J2 X" L/ q
by checking the Debug Registers, you can detect if SoftICE is loaded
8 o" R' `! ^/ x+ c(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
& E# Y3 n9 ~* o; }  ^$ @8 vthere are some memory breakpoints set (dr0 to dr3) simply by reading their2 S+ i/ q3 r! x! t+ O. K
value (in ring0 only). Values can be manipulated and or changed as well$ ^7 [! \) o" Z* R# i* X) l  B8 M
(clearing BPMs for instance)
0 ]1 d% q$ U/ e! D+ U3 m- p
* d' ~9 S1 f2 ~5 x: q/ z__________________________________________________________________________
/ p2 S% G  p4 g  W  q# l
4 Y6 D. z5 f0 A6 b0 p% [Method 113 c1 W/ q: C3 J( q5 A: C
=========: C* v! h7 a* C8 m& E0 x3 E0 e
& {. x& R, _) T5 [& G
This method is most known as 'MeltICE' because it has been freely distributed
; B. V, |8 M  m7 J. \( T) }via www.winfiles.com. However it was first used by NuMega people to allow- F* D0 O% ]/ S% c) D6 m3 C
Symbol Loader to check if SoftICE was active or not (the code is located
8 ~2 ~: u: ]+ P4 x. H7 Zinside nmtrans.dll).
8 z. w5 a/ P9 W+ C( X+ M6 [& v
) u, ^% ~6 B" A# d) m, B% P! X, m. LThe way it works is very simple:" `8 {$ M, g+ H9 ?$ E5 l: i: Y, j! y
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
) N* ?3 X' X3 q8 G1 h" f. X. rWinNT) with the CreateFileA API.) T  ]7 E. T6 B) S6 M8 d: ~

/ p+ X9 M: q/ a  O% SHere is a sample (checking for 'SICE'):
/ o! w2 H0 h7 x! h' Y5 Z
$ t, O+ E7 _0 g# z$ @4 q* uBOOL IsSoftIce95Loaded()6 y% M% l6 t- g& P( q
{
" g! m. m5 I8 c0 z8 j   HANDLE hFile;  3 h- D* h2 n$ i9 f" T
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
6 I" g/ f' r& L* d, X$ x                      FILE_SHARE_READ | FILE_SHARE_WRITE,  `1 v) h7 A  ~  X; F  ~/ L3 P
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);, A  V$ |. |# `/ ^
   if( hFile != INVALID_HANDLE_VALUE )% \" q* f; y! B  @; Z% _
   {
4 C7 n7 f7 o4 f1 n  j- E      CloseHandle(hFile);
) ]( Z' x$ v" I7 S% F* V2 A      return TRUE;6 `% t; O' o; o- l4 a# w( {
   }
# v7 ?! f/ p5 p- ?- H5 x" U) w0 v$ x5 V( `   return FALSE;0 f! A0 @  D; b0 m6 \- i! m
}
( M5 I. s5 h  Q' s! M$ x5 F
$ @7 O  P" v$ O8 o: L& kAlthough this trick calls the CreateFileA function, don't even expect to be/ X, b% Y* Z. v
able to intercept it by installing a IFS hook: it will not work, no way!* u" B6 E4 X7 g* f! U5 J% y+ N
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
% U7 V1 p) O7 C' l# U8 W' mservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
3 ?. x: y! u( D8 i/ v3 ^and then browse the DDB list until it find the VxD and its DDB_Control_Proc
+ I# s1 h; P7 ~7 {+ b0 ufield.
7 G  A. K4 j/ R) tIn fact, its purpose is not to load/unload VxDs but only to send a
' m  d* l" t7 m3 P5 DW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)8 B. I' Y, {9 o( I) q5 T
to the VxD Control_Dispatch proc (how the hell a shareware soft could try# Y) u) o# P/ x6 y- ^4 C# i3 z
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
: [& f4 `. T. d7 VIf the VxD is loaded, it will always clear eax and the Carry flag to allow, n) M  T0 b' D
its handle to be opened and then, will be detected.
4 W, X& T8 }; ^4 P) s. n5 o! ?; L: s/ D: OYou can check that simply by hooking Winice.exe control proc entry point5 U; ^/ P$ m! A% T$ W! ?+ C
while running MeltICE.
2 x2 L/ a* l+ V6 N0 j. b8 ?
2 h; N: ?- C0 C/ d/ c0 K# l
/ }) i+ F  L$ N( @+ Z  00401067:  push      00402025    ; \\.\SICE3 c- {' w. X' N# u; Y  ~
  0040106C:  call      CreateFileA
. a: j) v8 ?9 p8 @* E6 |; K  00401071:  cmp       eax,-0014 }; i8 \! a. Z
  00401074:  je        00401091) q4 O" `4 }1 ^& E$ O( {

' A0 }' g1 s. J. ?
1 J( n7 E# C. w0 [" i; {! v: o% PThere could be hundreds of BPX you could use to detect this trick.
! H( g1 s- k* {; I( e3 e-The most classical one is:
4 e/ y! F/ ~- m+ R% N- h, m  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||$ Q  P: f% ^: q5 U' ]8 v$ T
    *(esp-&gt;4+4)=='NTIC'
, s' Q: Q5 D0 q! R
; T% p: p* Q0 B& @$ G+ {-The most exotic ones (could be very slooooow :-(/ g1 L. o! R# u. N7 x) D/ c0 F9 C
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  2 T- b- U3 k' ]- \' s
     ;will break 3 times :-(3 e8 j$ V4 e# O  K! N1 s

1 x1 B" m* `8 F4 ^) }-or (a bit) faster:
6 w; ?3 l2 n) t. I& e) M; R' c   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')7 n$ Q! w0 q+ v0 t, }: _
7 y+ J: y5 h* c' r
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
9 r. J8 a( ~- {3 n1 R5 \0 r( A     ;will break 3 times :-(' Y# _6 E& j: N  ]& ]
$ |# V. v4 q: s% F( a
-Much faster:
/ {2 n$ G) H: p2 `9 d   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'% g* u1 x1 a7 Y: m
4 n8 b6 y( F( C' b& J/ b3 G; Y- p
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen( L$ o4 u, e8 l* k/ R
function to do the same job:+ g/ p- r& j- Z/ i0 X! U8 I
5 V/ y; N% u3 U* X. S! c4 [8 \8 b
   push    00                        ; OF_READ
1 X' d4 @2 {5 b' Y# H( r) [   mov     eax,[00656634]            ; '\\.\SICE',0# L5 R9 N3 ]/ Q0 A. x% i/ Q
   push    eax5 v0 L1 p) {& o6 ^
   call    KERNEL32!_lopen6 Z0 c9 r3 t$ k! h: A- z
   inc     eax
# |, r! P' A# R  l$ L   jnz     00650589                  ; detected0 L% x3 Q; L. @/ h& i
   push    00                        ; OF_READ
/ p( _: A0 Y8 D' s   mov     eax,[00656638]            ; '\\.\SICE'
4 e5 F# H$ o! \9 i/ g   push    eax
1 H, O5 }+ t* b   call    KERNEL32!_lopen
/ a% _/ [- C; @+ W8 m   inc     eax
; P, b2 ~/ O. y+ p& T% v$ N   jz      006505ae                  ; not detected
4 t! N7 d: M! x$ M8 ~. \. d+ z, l( o9 t8 z$ z( _! o  v3 T

# }: c2 a! |. m4 q5 Q: M__________________________________________________________________________
/ [' a# @4 M/ S& f) |) X% z6 l! o/ _5 i2 }2 e; `% f+ B( N) g
Method 12
  |1 g# a4 @8 f" [=========
8 }0 u, W2 k; L4 E
$ c. G* F- @. a! g8 z% N+ R, EThis trick is similar to int41h/4fh Debugger installation check (code 05
  q5 P8 ]" m  [! {/ u( g. ]7 l( Z&amp; 06) but very limited because it's only available for Win95/98 (not NT)/ W7 _- g, e& x1 g; R" _# X
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.4 n) R' @& [3 n5 s% z

6 K) j7 N5 J3 p# j   push  0000004fh         ; function 4fh
  Y+ A" ]$ Q3 f, W' r   push  002a002ah         ; high word specifies which VxD (VWIN32)  v* w% Q+ O+ ^5 C$ T7 o7 _6 }) A; N
                           ; low word specifies which service0 S9 \1 V0 U# x. H
                             (VWIN32_Int41Dispatch)  }8 s" ]3 ?* k# \1 S0 M
   call  Kernel32!ORD_001  ; VxdCall
, `4 n* A. y. b0 n0 o& j* d. M' K   cmp   ax, 0f386h        ; magic number returned by system debuggers- m% _$ L/ @* N2 T' t
   jz    SoftICE_detected" m. w7 R! Z8 }8 u5 A7 k8 x& j7 @' n
, \2 D, \, y$ b8 p+ f: B/ z: a# v/ I
Here again, several ways to detect it:: G+ ]/ S, f* o/ E; S1 T
8 z3 Z& L2 O  y9 F! s
    BPINT 41 if ax==4f
0 E+ r* O3 `, `7 B9 W" P
9 I/ ?/ P5 q% g$ O! O& x4 f( G    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one4 _% Y2 U4 w, |: B
2 W( p8 ]1 e6 a6 @
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
( e$ W- ?* z8 |, ~3 N: `( R7 F+ ^% C8 Y5 L
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
( G1 l. w5 D. K: p+ o) a1 v7 N$ N" a
__________________________________________________________________________. Y  X6 ?! N3 E$ T( l9 j! B3 b

5 n; O! Y! M+ H5 gMethod 13
6 `+ J# t1 B3 z=========
. P1 \" o/ H; z) E4 [- l) W0 T5 D- U/ V) d- r6 ?. D
Not a real method of detection, but a good way to know if SoftICE is% b7 {& o: B7 s4 ~/ l
installed on a computer and to locate its installation directory.: A6 \! U" m  g1 J  @" ^
It is used by few softs which access the following registry keys (usually #2) :
; Q3 ^1 K: @! y7 u
. C" t( }: ]7 m( ~-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion$ K( ~; E4 \) F* D3 U- h5 i- T' O
\Uninstall\SoftICE) }3 H8 ~0 K/ ?5 _! {. z+ x
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE: @( v. R( j" `" e. N9 l
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion) g8 z2 ?: }0 T9 o* V, M5 u
\App Paths\Loader32.Exe
* b( [6 E8 T& P1 M5 o! @$ n! {, v# ]  p. x3 T/ |
, H/ _4 I7 ?0 q  K8 n
Note that some nasty apps could then erase all files from SoftICE directory
/ \  r6 j: F- X( t1 W4 h- u% \(I faced that once :-(" X4 t, A+ {; `$ ]1 z7 O
0 ~. P4 L2 h, a0 z1 I9 O
Useful breakpoint to detect it:2 t6 H0 f* V( Y3 \7 L

2 D0 ?# Y* L+ d  [0 A1 ?0 ?     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'3 [$ B, Z; E. d

6 U; t1 J/ Q: E$ ~8 x$ V__________________________________________________________________________
0 A/ z4 }( E8 w- r; x) r$ o( L3 M/ R% b0 Q+ _3 Y  B) o
+ e9 k6 _! Y5 G  M. ]" ^: s
Method 14 1 }. \, n2 f, j: w0 b
=========
# o" s) X, t9 v0 G
+ }8 S2 G& n" v, P- }7 Z. Y! F8 FA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
! Y% `1 Y; q; g0 E/ bis to determines whether a debugger is running on your system (ring0 only).
; j; q  x/ K) \2 C# b0 j% r; q3 y0 ^
   VMMCall Test_Debug_Installed* C; ~9 f1 X7 R6 A5 i
   je      not_installed
; n: O8 b2 w# F
& {. d' N$ W( Q: p1 Z! WThis service just checks a flag.5 Z8 C. s, X" j! R7 [. `# {
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-7-24 19:22

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表