About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
) p/ w4 }5 f3 R4 P<TBODY>. t/ B. u6 [$ H7 I* j& i9 b- P
<TR>
, a. a* q" d' K% O/ |# F, |2 E<TD><PRE>Method 01 ) p2 o. G& ~5 `0 d3 ^4 \% D
=========
' h8 z1 J2 T: L& j3 g! w" S% f: Y& n% w% A
This method of detection of SoftICE (as well as the following one) is) V" z* N% o. r( K% s, W- @
used by the majority of packers/encryptors found on Internet.
6 g. x- q, C: i2 K0 \# Z/ |6 f( TIt seeks the signature of BoundsChecker in SoftICE
* H( U1 u$ z7 g# D0 O+ r" s' e# r2 G/ c4 P9 h
    mov     ebp, 04243484Bh        ; 'BCHK'
: \  K( h3 b& t( |- {! N* |; @    mov     ax, 04h: ^1 t  o* l1 L* E) g0 B/ _; s7 R$ o
    int     3       # ^+ ^1 @; a* b& W. Q
    cmp     al,4- p8 [7 x0 ]( _/ J
    jnz     SoftICE_Detected
1 d8 a# x) Z* S3 b  W6 b0 i
* ?9 N3 L% [, W7 G0 h" N$ a___________________________________________________________________________
. i5 C5 j" T+ `, t7 W  V8 n8 J6 V; u1 W2 U( R0 N5 F
Method 02
% f/ c7 `6 o0 @+ ^=========
1 C' m* l- T6 g4 O+ }
) H$ q/ E9 v7 ~, R2 fStill a method very much used (perhaps the most frequent one).  It is used& u; R' Y) C5 u/ y
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,. t: R6 D& E# K5 z8 H
or execute SoftICE commands...) J. n) j% @. x6 y6 _5 p
It is also used to crash SoftICE and to force it to execute any commands
( i' S& j! c; x$ _( p! R& P& W(HBOOT...) :-((  
9 N, d( ?5 R4 k9 V0 y. F! m1 K- C
Here is a quick description:( L5 G- X% N3 L* C. x' N( \
-AX = 0910h   (Display string in SIce windows)
5 R) K$ P/ D2 {5 v% p6 B-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)- J1 Q% K4 |3 h( m" B" Q9 H
-AX = 0912h   (Get breakpoint infos)
9 J) m- y" F: k-AX = 0913h   (Set Sice breakpoints)( U4 j) }& i; U$ P4 H) _! K
-AX = 0914h   (Remove SIce breakoints)" P$ {9 K' o/ ?8 N- G2 F

/ @" F0 ?6 D  Q( u5 Y$ R" TEach time you'll meet this trick, you'll see:
1 _  l: b9 l' R, U1 W" K* e-SI = 4647h6 d$ ]3 }: L0 f
-DI = 4A4Dh
* m" B& K; o8 Q, R) @' v" WWhich are the 'magic values' used by SoftIce.7 m7 s$ U1 U  `  h6 z" a
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.* o; y3 s) u4 e3 R/ E2 N

* N7 o( e' n- _4 D; s, vHere is one example from the file "Haspinst.exe" which is the dongle HASP
$ H6 Z* Q" r2 G6 V* [3 @. G- `, TEnvelope utility use to protect DOS applications:
* L; u$ Q/ D% W/ A! a- Q1 E$ w  E# N9 [$ {
# `+ M. V  W7 Q  D/ d" |
4C19:0095   MOV    AX,0911  ; execute command.
1 G8 b9 d8 E; w- f( h4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
: @$ o1 ~; v; ~/ ]. O! X4C19:009A   MOV    SI,4647  ; 1st magic value.$ E, R. ]- m9 n! e0 ]* f( v0 S; K
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
/ P' G' [8 i9 _7 d4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
. c3 r+ Q* P2 w" L4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute( h. i4 `7 v. P/ l
4C19:00A4   INC    CX
; }0 v8 d9 v. V4 ?& J4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute# w% I' a1 z/ G2 k; z/ }. W: P9 `
4C19:00A8   JB     0095     ; 6 different commands.
$ d) C1 N. d! v9 ~4 i  N4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
% q; S7 \( {, p8 ~5 m" D4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
( D, J, S; d( J7 s0 P4 z" v2 [. J2 Z* f) Z5 F! i4 H& z/ o
The program will execute 6 different SIce commands located at ds:dx, which# c' ~2 h2 U& y5 w2 f
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
% t: x1 b- r5 A( A0 T: p) L  }' J% \/ G% j5 M! E
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.2 n' f$ j% \; i
___________________________________________________________________________/ ^8 e0 y1 @0 f7 [0 [: ^1 z- B

+ J5 o3 r0 T6 p7 V7 i2 i  Q/ x* B% @6 }- N: ^( A: C! }
Method 03
5 R/ ^' P8 G& L- |# `1 |=========% e7 X3 [& ]6 u4 ^% V
* u7 c2 t+ N9 z- f
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h% p. |3 Q/ D$ Y' c7 j
(API Get entry point)2 P. E+ r1 }; R
        
. z  B) Z' ?% ~1 e; D* ^+ p0 s' I! r
    xor     di,di
0 [- w; Y1 Q7 \# d6 V. r2 o" i    mov     es,di4 b/ b# ?: ^+ F( W$ ^; {
    mov     ax, 1684h       $ V0 a' Y/ U1 s6 Y7 g
    mov     bx, 0202h       ; VxD ID of winice
: A0 m6 C2 E" c* @    int     2Fh
6 K9 [" p5 F& c: J3 d7 i    mov     ax, es          ; ES:DI -&gt; VxD API entry point
& z) R9 D8 l8 f' S3 o' v$ `& l    add     ax, di7 ?* T8 s$ w6 C, K
    test    ax,ax; r0 R2 b/ a) E  ^$ j5 B& D
    jnz     SoftICE_Detected8 t' O5 A4 u0 r1 C% ]- W+ B

! g0 v! ]+ N" g2 N0 R9 u___________________________________________________________________________
/ e; s, x8 B1 p; X' }
, s1 f- K( m5 U& cMethod 04: b  M2 \# W  K- d8 ?+ o
=========6 B& j5 k# v& i  o4 w" Y
* ~, U# y0 R% W! G
Method identical to the preceding one except that it seeks the ID of SoftICE
5 F& B, \' }' {& ^# M# @5 T6 M4 X/ Z# SGFX VxD.
& V5 n. k# W: M% L! ^7 u. m' V0 [" y1 O0 R( }6 g* T' ?) L
    xor     di,di
5 T& E! ]& r7 F6 H% [  U2 f    mov     es,di
4 A7 P/ B& }6 v6 ~- ~/ v; |    mov     ax, 1684h       5 F6 _3 x. Z+ x$ t. E2 ?9 h
    mov     bx, 7a5Fh       ; VxD ID of SIWVID
- ^: o/ B4 l( L! Z; l3 h/ S3 b/ L    int     2fh
; x) w3 E5 J; J1 C: P    mov     ax, es          ; ES:DI -&gt; VxD API entry point# W  f' h/ F6 q$ ]' Y
    add     ax, di) Q7 c8 u! x0 M, O
    test    ax,ax
, N9 @9 `+ e( W7 i# G( p6 @    jnz     SoftICE_Detected
! t% h$ T2 E) m: ~+ @: l! P+ z
: Z6 m/ o, u1 _1 j$ ^__________________________________________________________________________
. ~0 M# L1 ~( R4 _
$ j1 z1 }, Y" I. D/ j, U: S4 T5 F. a& J, b- T: f9 W" y" b3 S
Method 05# W$ l* x2 l! f1 ~2 L0 f4 }
=========
, j! J. @! Z7 p1 j* _2 k+ ?) K+ T; z
4 Q4 k! B$ h' H# ZMethod seeking the 'magic number' 0F386h returned (in ax) by all system
0 j& v$ O) p2 y8 Ldebugger. It calls the int 41h, function 4Fh.
1 O2 Z& c2 t9 PThere are several alternatives.  
9 Q, ]9 {' U# B9 x
0 m0 i! {7 O: I* P6 CThe following one is the simplest:8 R- |2 k+ @7 ~+ e- ^

2 [5 H& O: C( w! D' x( @    mov     ax,4fh4 j4 U. H" ^2 @6 H+ {1 g, D0 Y
    int     41h
8 O( H6 W2 s4 F0 k    cmp     ax, 0F3864 O* z9 b* g+ l' l8 X0 ?
    jz      SoftICE_detected
( ]  Q6 a! X: |$ s+ v3 x# P9 I
; S5 H5 M7 b' i2 e* f" `
, p: ]- Q7 q/ e5 eNext method as well as the following one are 2 examples from Stone's ' o$ P: P5 R. z6 n  }4 l
"stn-wid.zip" (www.cracking.net):  d3 H, s" i% C* P9 `8 B

9 C' K* P2 o  x/ M" }    mov     bx, cs' n) X: n4 ?6 c3 Y  P# L
    lea     dx, int41handler2) o9 \) ?2 Z: B9 w$ h' m) V# `( T1 y
    xchg    dx, es:[41h*4]: C1 W, n1 v, D- c+ _7 p
    xchg    bx, es:[41h*4+2]6 ?' x1 L7 d- A5 p. b
    mov     ax,4fh
( z: M! V" q% h4 A    int     41h0 q( Q' ?/ q' Z4 Q5 q, ~0 O+ ?
    xchg    dx, es:[41h*4]
2 |7 o2 o) q, B! `    xchg    bx, es:[41h*4+2]1 c) g! N; n- |
    cmp     ax, 0f386h
' g7 a4 b, s6 {& C. r* k/ S    jz      SoftICE_detected/ [( n6 {5 k% k$ {9 X9 s
. H2 y1 t6 i" }5 p8 M) K5 e5 X
int41handler2 PROC
5 s9 |8 U( }0 \2 j; u# b: P    iret
) }& l5 p; v/ {* [$ u  }, oint41handler2 ENDP
) c3 Q3 i8 U' M# Z3 C- w: B: X3 @
+ j, ~9 `( n4 i8 j* w+ q1 T6 D5 W' J; _
_________________________________________________________________________
+ Z6 D8 h7 N  f+ h" u# y4 w3 N
  `% q( c+ C  K0 u! d: H
6 X0 X9 U: Q& o# V, Z+ iMethod 06
9 x3 \; Q; j) w; d. ^/ W1 c- X=========3 H  L0 T. h* ]  Y: }  M( t/ U
# a& X, K7 m6 P

% d; V  H: A( [- k6 s3 e6 I9 J1 B+ F# ~2nd method similar to the preceding one but more difficult to detect:
) j9 ~( k2 Q2 E; s, [" J3 _0 Y4 N8 l" s! f0 d
7 q6 {/ f( V1 e; W5 i
int41handler PROC- d3 v* G4 p& Z
    mov     cl,al) @( U/ ~9 K, w0 s2 C
    iret. {& X& V$ M4 d) {8 ]
int41handler ENDP
# e( u$ E) X$ {) t- G$ A$ w8 d/ h( I* U" ?6 U& }

6 ?( x. K6 E! y- H" e    xor     ax,ax
3 p" G: P4 c& u  I3 w6 d    mov     es,ax
; g7 W" B+ l4 X7 d6 ^. x- d0 H7 M    mov     bx, cs3 ^( ]. D, U3 f: H3 c  r
    lea     dx, int41handler
( n6 y+ ~. S3 O- {3 A3 o    xchg    dx, es:[41h*4]
& @" ?- v  }6 i6 s2 R+ z6 N    xchg    bx, es:[41h*4+2]& ^" i" B' k- {: a
    in      al, 40h6 u; ^1 x3 p8 f* p8 r3 \
    xor     cx,cx
* W. N  _" R0 e  C    int     41h- Z5 {4 y2 T  y0 g3 y
    xchg    dx, es:[41h*4]2 W6 _) B3 k$ n6 l- N7 m. Q
    xchg    bx, es:[41h*4+2]
6 q8 u: a. [' d    cmp     cl,al
" s; `+ j1 Z( i3 ?# y    jnz     SoftICE_detected
- Z( z4 |/ v. L6 }7 B$ S8 P' I9 J# K0 s8 H
_________________________________________________________________________
( [  z7 r# c  L: I! @: {1 w
* S: u0 |7 p; n0 PMethod 07
% q4 z5 g% R* d0 L=========
7 m1 s4 U; S9 P
1 }; P# |4 I5 G3 _: QMethod of detection of the WinICE handler in the int68h (V86)) P7 P* B: ^3 e8 [/ F
/ Y# B* y6 |8 B% \+ d$ ^- r2 p% A
    mov     ah,43h, ?! p2 y. [8 ]$ P9 B/ w7 L
    int     68h" `* L4 {: }, _1 n/ @% [' E
    cmp     ax,0F386h; A. Y: E8 z7 D/ G0 m
    jz      SoftICE_Detected
6 A+ B0 C5 i& l, a: I" z: W- [1 W& ], A& N

, r! u6 l; ^% r: p  O% x' [+ t3 Z=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
; }8 ~9 t* r; i9 F2 O   app like this:9 O8 a4 ]. b; i/ p  t

4 z' V# S9 U( E5 K   BPX exec_int if ax==68
* v' H5 V1 r2 w   (function called is located at byte ptr [ebp+1Dh] and client eip is
2 L1 h+ u' D' y8 V, }# p   located at [ebp+48h] for 32Bit apps)' _" b; @% A* H0 m9 [8 I  f
__________________________________________________________________________3 J, }9 L3 Q: u6 _& \/ m5 P; p! @6 N

5 x) b1 q% e  r0 G! z/ a0 K5 v8 B: }! }6 Z( U% X$ F) N
Method 08! o! f" x0 r+ S5 n* j6 F0 C
=========! Y  j" s/ z8 T8 D+ S1 R% K! X

5 g1 N6 _# m! _# S4 V- y9 VIt is not a method of detection of SoftICE but a possibility to crash the, B2 E4 q* S$ O4 ^) {
system by intercepting int 01h and int 03h and redirecting them to another
+ n2 n& f% u8 v, h: J7 droutine.
  i- L" s8 U1 k: q2 `/ OIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
+ c! Q  |2 ]* X# ^2 |to the new routine to execute (hangs computer...)! {! s1 W* P& `$ ]: [: T6 |
" W3 w, X# h/ H& G4 Q9 F- ~5 N
    mov     ah, 25h
! A( C* g& y, K6 s! [  }    mov     al, Int_Number (01h or 03h): A+ M. E$ ?% n" a5 c& v0 Q1 ^
    mov     dx, offset New_Int_Routine
5 R' q* a; h8 j! k, y+ B    int     21h
) w, I3 m: l! G# J0 i% g/ J0 N7 m" Q% S
. U) N; b: X7 w& o  I3 z( |__________________________________________________________________________
5 K& B* w; P4 t1 J
4 n* K; Y) P0 V9 D' n: B  k7 g1 @, c0 _Method 09" |3 I3 ~2 V: _
=========
! d9 l+ `$ X9 t+ G2 m! G$ D
6 ?& X. V( ]2 f1 g2 ~9 t5 KThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
1 o+ m' q3 x$ ^" U8 H: ^1 Operformed in ring0 (VxD or a ring3 app using the VxdCall).
4 e0 @' h) x( z8 _! A9 X9 ~The Get_DDB service is used to determine whether or not a VxD is installed8 C8 |. p" K" R9 |1 d
for the specified device and returns a Device Description Block (in ecx) for$ ?+ Y# A7 D* Q0 q: N9 I  Z
that device if it is installed." `5 x. I$ X- b- u: `

6 B* u. d1 x5 t8 `4 C   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
: Y! m$ @1 x9 _7 q. p" f6 v   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)% h* t& F/ b# N" k
   VMMCall Get_DDB, b; v9 l( L( G6 _! F. @" F! l
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
2 ~9 p+ ^) z2 L+ t# b
9 c+ B, |& e. a+ h! }4 vNote as well that you can easily detect this method with SoftICE:
5 k& t! W5 P: L, K! z: a   bpx Get_DDB if ax==0202 || ax==7a5fh
3 v6 }+ m2 k0 v  n5 _7 f; b9 X
: N2 ~5 Z9 T, i1 b$ P, T( x& q) e- \__________________________________________________________________________  t7 {( K7 u: D1 x6 I' ?9 g$ l

; S( [' @( D4 c1 W+ `% AMethod 10, V0 ^! F! r! n) _
=========3 `1 |" I0 d# ?, Y  T
" t% F  ?" P$ |! O
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with+ ?/ H, G+ I) p2 M( X$ X* R* @" f( ^
  SoftICE while the option is enable!!& C2 Y* r0 q# x
" u% P; R' u) i
This trick is very efficient:  E. o9 i1 g# `9 C
by checking the Debug Registers, you can detect if SoftICE is loaded7 s+ i4 @2 n9 L2 a4 S
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
* f1 E: X+ k9 U. f" G: [0 gthere are some memory breakpoints set (dr0 to dr3) simply by reading their
8 z& g9 G# U- ~0 k! c7 s. tvalue (in ring0 only). Values can be manipulated and or changed as well
' n* {8 B& u; G(clearing BPMs for instance)$ |. n( {; H, I# b
) e+ r$ v& l( ]+ y  w; r9 E
__________________________________________________________________________
9 b$ O% U' d5 j9 {' ^, V! V
- G+ r' ^. Q- [/ ]Method 11
, _( A6 t" {/ q% @5 u& e3 m( k=========' o7 `- n& y! F! R$ G( R

1 k& ]$ T" V. {% G: z$ QThis method is most known as 'MeltICE' because it has been freely distributed0 L& ?: {2 u4 \3 p% @
via www.winfiles.com. However it was first used by NuMega people to allow
: A& K, ^) K# e( o+ Z* n! ESymbol Loader to check if SoftICE was active or not (the code is located! u$ [4 Z0 f/ ?
inside nmtrans.dll).7 t6 a5 ?0 M0 w. O0 \

# M5 f% M, M- }, QThe way it works is very simple:
. o9 Q9 x* I$ s0 }5 o  B! |It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
) i9 I2 ~3 ]- g. S) rWinNT) with the CreateFileA API.
6 }, y$ Y( ]9 I  l. ~: {
* z3 A+ f1 h8 ~+ W$ C  f1 [: V% fHere is a sample (checking for 'SICE'):
  D7 X1 b2 X1 N5 O# a3 n& N" r% I( h
BOOL IsSoftIce95Loaded()* P5 W6 k* G) Z7 \$ }- l& B  |* S" `
{
! h8 ~, ?2 I( V4 l& q" T$ q3 t   HANDLE hFile;  
* N3 m! W1 F* W1 z   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,( K4 _: L* u* ^. E
                      FILE_SHARE_READ | FILE_SHARE_WRITE,3 \" `) C. `; j  Z! |
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
3 u8 K8 k* P9 j   if( hFile != INVALID_HANDLE_VALUE )
0 z5 P2 c% B) \2 H; U   {( s# _5 P5 m6 ], C9 D
      CloseHandle(hFile);
* P: d* E4 E, G% w% @( ?7 O      return TRUE;
7 c" j) S( ?7 T3 E, @" r/ F   }
8 [+ Q' X9 X& `7 t% o   return FALSE;
# a& b- [* V" k! z& ?3 i}7 `- _- z& r4 ^  ?, |
) |6 ~( O2 o# Q+ y" C. r. U' A# r
Although this trick calls the CreateFileA function, don't even expect to be
+ f& L/ I4 L- d7 A) q4 vable to intercept it by installing a IFS hook: it will not work, no way!; M9 P6 a) Y! I, H" E6 Y& H
In fact, after the call to CreateFileA it will get through VWIN32 0x001F/ S& M" y- |) X- w
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
) D$ T; ?7 C) o0 land then browse the DDB list until it find the VxD and its DDB_Control_Proc
. B* I9 B5 i8 o* _) \8 Vfield.
# e+ F1 T1 Q* [# `  J0 _) Z  U. _In fact, its purpose is not to load/unload VxDs but only to send a
' Z5 O9 X/ m- }6 ]! ?; M1 h* LW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
7 R4 x0 t* I6 o3 P/ L3 Pto the VxD Control_Dispatch proc (how the hell a shareware soft could try+ V! ]: u- o- @0 d) _7 |" Y
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
" {4 q+ s8 |6 X+ b, KIf the VxD is loaded, it will always clear eax and the Carry flag to allow
& U' i3 o* k% S7 ^- Nits handle to be opened and then, will be detected.6 i5 w; c; n8 O# j7 x! q
You can check that simply by hooking Winice.exe control proc entry point9 t, V- y% U) C
while running MeltICE.
' H: O* f- ^4 Z) Z; t
5 S  h/ S; g- H, ~0 h
, M7 ^- r. q! {  00401067:  push      00402025    ; \\.\SICE
8 M, |/ {& B4 I/ M; e$ b  0040106C:  call      CreateFileA+ E: }* i" [% u' f) u7 z5 S) j
  00401071:  cmp       eax,-001
# W: _4 M! ]0 Y) g. O# [! `  00401074:  je        00401091
: N$ B; Y8 J" y9 J7 k6 M% c' r2 L1 e8 U: K; e, }5 w

/ T4 s- C: P% B: d1 oThere could be hundreds of BPX you could use to detect this trick.
; X& a- f# K5 S) s& c6 n; [-The most classical one is:
$ L8 }" H$ H3 M7 ^  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||% G1 a' y: M( L, P3 q# k
    *(esp-&gt;4+4)=='NTIC'
6 c! H" y9 e$ k9 j9 C3 l$ T  t! c9 s
-The most exotic ones (could be very slooooow :-(" L5 a, }2 Y$ q* f0 q; x& S1 j
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
6 d7 W/ g' M7 n2 _5 S     ;will break 3 times :-(
9 G/ K( u1 [- S. x% P) S1 t! t4 r; ]: m7 \2 T
-or (a bit) faster: * U! K+ Z: k3 I" {# S
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
5 ]3 R% V5 j: Q2 w- X; o- r+ m7 [
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
5 m' A; w3 |9 X2 G2 f: e     ;will break 3 times :-(
) ~. Z- Y; |4 ]( l( |
9 H0 s5 @5 ^* E6 t# }8 d. R-Much faster:
9 V/ |" ~4 A) O( z- F   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'0 z! Z7 J2 H$ o; u6 Y" M! W
- r- m3 J; c# t$ t( @: ]: c) m* p
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
' D+ k1 M* n* T, m8 e: dfunction to do the same job:' D1 c" X' J( B
' F! @+ z# R9 C& |
   push    00                        ; OF_READ
$ G' ]/ {) F0 z1 R5 o5 \. F* z# H' C   mov     eax,[00656634]            ; '\\.\SICE',0! [: c- r3 X; r0 e
   push    eax
4 S! d  N9 P" e   call    KERNEL32!_lopen
& P2 q! b  h2 h' u0 a6 q7 ]   inc     eax
$ f* J# x) ?1 W- x   jnz     00650589                  ; detected3 c, S& p8 G2 r# ?5 Q
   push    00                        ; OF_READ
6 G( b) ]2 W1 u   mov     eax,[00656638]            ; '\\.\SICE'
% d1 U, V7 K+ ~$ c. {3 F; y   push    eax  B& u4 ^8 d8 x5 ]
   call    KERNEL32!_lopen4 [8 a8 W, b6 d. A9 W) v9 T
   inc     eax
, }7 x' h6 w4 Y* b6 \   jz      006505ae                  ; not detected
1 W' C7 _3 p8 l, @4 Z, d! Y1 [. ^& `7 T' S8 M
. W! d& Y7 I1 {  s% r! \: o' Z+ M- \
__________________________________________________________________________$ j& e3 b* A/ I6 d
- `5 x$ f$ ?, t$ |
Method 12
# `5 A2 V3 ^- w3 @+ z5 T- m# K+ W=========+ P# D7 r0 v9 ~6 P
3 H5 [# O1 n- J$ g8 T4 {
This trick is similar to int41h/4fh Debugger installation check (code 05
" p- m8 ~3 O7 m0 p( ~7 N5 V" q&amp; 06) but very limited because it's only available for Win95/98 (not NT)
; Y) U2 J/ P9 e0 X, O9 a1 N0 Uas it uses the VxDCall backdoor. This detection was found in Bleem Demo.
' g* W8 |& s' M0 J
) N7 Z# W  W+ m) C6 r2 C; y5 W   push  0000004fh         ; function 4fh
2 Z0 Z7 |- S8 N1 u( g; C4 Z7 P   push  002a002ah         ; high word specifies which VxD (VWIN32)
* ~& \8 G+ ]0 g3 o' x$ f7 _9 M                           ; low word specifies which service" i, u5 D9 l2 g3 f" [' g( U0 X+ |
                             (VWIN32_Int41Dispatch)
# \  H6 o2 i/ \5 r# A2 I3 f   call  Kernel32!ORD_001  ; VxdCall
+ j7 C& J5 z. G8 @0 X9 G* o, l   cmp   ax, 0f386h        ; magic number returned by system debuggers
6 q' `) J" y1 y, |/ W2 @   jz    SoftICE_detected
. L5 i7 r8 J1 Y# a/ ?" b2 K8 ^2 ?; i9 H3 z- H
Here again, several ways to detect it:
$ x4 I# y( n8 ~7 e: g$ X; S& @# b+ c( S  p! D  N
    BPINT 41 if ax==4f
5 U/ l$ E6 j/ _5 O; A6 q  t4 a/ t$ _) f
5 J$ l' F$ y; c. p    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
" G/ r! D/ s- E% r8 D/ F$ @9 \& [0 S$ u& I7 i* h$ Q: N1 Y7 Z) s
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A+ D2 o7 C0 q+ n# f
8 Y; M$ e7 E. ]: w' c+ s
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
8 X9 [. E# P7 n' S
& a* Y$ _9 y$ ]& R$ L& j6 q8 X__________________________________________________________________________
" C/ `8 Y7 @& I" v9 X/ ?  y1 w  N5 O( Q# l. M
Method 13- ?. O% R) ~) p$ ]8 n
=========% S) S2 |* ]: B6 g8 k

, ?+ ~" `3 S% Q/ BNot a real method of detection, but a good way to know if SoftICE is
1 m" }% E7 d0 M$ s: f  i! n& \installed on a computer and to locate its installation directory.
; D4 `9 N. E9 g3 d9 n- cIt is used by few softs which access the following registry keys (usually #2) :
- \- M* u6 O- ?" L4 o4 R( U, L% l) i; @, k
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion- _7 R  J1 l+ A5 e3 a# v
\Uninstall\SoftICE% o) _; n6 s& d# J3 q+ {) l
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE9 n# D/ F- M3 k! J
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
- E+ W! m! a- U* T\App Paths\Loader32.Exe5 y- Y8 h. u% X- ^) g$ p, y: C3 g

6 |+ f* X1 c& W9 _6 Y  u$ s  |- r% D- A3 ~+ y. V/ a/ x
Note that some nasty apps could then erase all files from SoftICE directory
* F* B  h* Q: L(I faced that once :-(
- ]' g! H; j5 k" G# n9 n( l
( ?' y& E& f( g6 X, |$ oUseful breakpoint to detect it:
6 [9 x8 T3 ]8 ]+ g! n' e+ q: D! I# t4 |0 ^! N9 y. S
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
5 E% g( ]+ K$ y$ Z2 ?* K6 o: c
6 N+ ?9 h  ~, o( M__________________________________________________________________________7 e3 @$ m: r) @5 r0 m5 l

9 P4 [; E+ k( r0 m, R
' Y, }) L/ ]; {Method 14
# a  }5 S. _( G* ~8 |0 D3 T# M9 P=========' t6 q+ e" j5 V+ s

4 e. D, M4 f; R# I# E( K( x8 yA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
( e( H4 O! v6 I1 e( r' Gis to determines whether a debugger is running on your system (ring0 only).
8 B1 Z% s4 s2 G5 h8 L% W8 R8 S( w
/ F; u' C( ^( G& i' y5 y2 f9 v% j   VMMCall Test_Debug_Installed
9 f  v/ ~4 U& v1 [   je      not_installed
/ {4 q9 [% j9 ^& o1 ^( T  `, ?- B( l& m5 D
This service just checks a flag.4 B/ \; m! K0 D( \! i3 L  R0 N
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部