找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>  Z8 p7 T# y: z/ ?& g) Z
<TBODY>
- w7 L% H* j9 \) w; O4 j; U4 @<TR>: v  ?' W, `" s) _
<TD><PRE>Method 01   T: Z& ~# u1 E+ a" `' _5 ^
=========' m# e1 W+ r# \9 u3 b8 r

' {) Y  Y" {/ EThis method of detection of SoftICE (as well as the following one) is5 \6 Z, c) ]6 e$ x! E" ]
used by the majority of packers/encryptors found on Internet.
  Y' M2 d% @, R' uIt seeks the signature of BoundsChecker in SoftICE
4 g% ?- d, U4 f
: l+ F* l& P) a  U; y9 E' R    mov     ebp, 04243484Bh        ; 'BCHK'# r; o; g4 I( R( g: y# _; U
    mov     ax, 04h
9 Q  L1 E5 f- W, x, A' H    int     3      
# v% s* V2 ^; }; v    cmp     al,4  ?5 B5 x  M/ A5 H: w6 @! W/ E
    jnz     SoftICE_Detected
% {) ^- }6 }# B1 }, f1 H4 J. Y( l. @) Z% d$ v0 S0 d
___________________________________________________________________________
  h8 v; g  [. `' O5 S! y  n
) S3 e' H& V: B# N+ R- uMethod 02* ?* z* u) g' M1 b
=========: I' h3 D5 m5 M: E# v
( f, F( ^9 K) U  I; r  M
Still a method very much used (perhaps the most frequent one).  It is used
4 Z3 L2 d" H( @. n7 o6 z( Eto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
" ?1 }. d5 [$ N! N! h/ q4 Eor execute SoftICE commands.../ s7 b6 z% a2 e) _
It is also used to crash SoftICE and to force it to execute any commands
! Q5 J" U, b" s! F& P( X3 C(HBOOT...) :-((  $ w/ M( g) t+ U! V( Y: |
; w" g: r" M; e# n& N; D$ X5 w
Here is a quick description:( S4 K. |2 [4 g' P. O1 A2 R! L
-AX = 0910h   (Display string in SIce windows)
% g: b/ G  G2 k-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)3 m/ V. F, d1 i# i5 f) v
-AX = 0912h   (Get breakpoint infos)% g4 H+ \4 N4 D: v
-AX = 0913h   (Set Sice breakpoints)4 l$ l5 N; i$ j$ b  C& g8 {
-AX = 0914h   (Remove SIce breakoints)
; h" |1 C4 w9 O; V: f9 I) a" B; a/ \2 s/ L* a' u5 N
Each time you'll meet this trick, you'll see:% T, r0 g, m# `" i2 z$ g
-SI = 4647h, Z7 @0 m% ^7 U5 p
-DI = 4A4Dh3 W8 ?4 U' y1 P$ U, e
Which are the 'magic values' used by SoftIce.. _  R. A1 ^% }# I
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.0 U- A# f8 M% ^0 T& d* m8 A5 a$ ]* w

1 |' W% A& r% h( I2 s' O# THere is one example from the file "Haspinst.exe" which is the dongle HASP
* M0 q' @% T) g# N& mEnvelope utility use to protect DOS applications:
* i4 F) a, [5 C7 w; f0 j6 f! j6 }( C  R. z" W# r! D! b' y- Y
" F, [$ \! d  P  R, n2 I! ~, d' h, d
4C19:0095   MOV    AX,0911  ; execute command.
( f5 s# r# ^8 ^2 @$ ~4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).9 P# k+ q5 g; N( \# N, P' b
4C19:009A   MOV    SI,4647  ; 1st magic value.; b* i& f/ n3 ~" s' f3 j+ A
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
% v6 t3 c1 g* ?0 k$ m, ^4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)1 w$ Y) c6 d4 g, f+ f
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
- K+ q1 n5 N& v! d2 r# S4C19:00A4   INC    CX! K  t7 t6 t% j! i8 x* b/ w0 o5 p! s
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute3 Q+ D, d9 b3 S6 N9 Z5 H  y5 t
4C19:00A8   JB     0095     ; 6 different commands.
/ c! B/ h% I1 b* k4C19:00AA   JMP    0002     ; Bad_Guy jmp back.9 p! Z+ V6 ?0 Q0 V1 u
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)! A3 L* j9 [. P/ i9 U1 F0 w
# o( b; j# J; {, u
The program will execute 6 different SIce commands located at ds:dx, which
; a3 p# _* W8 o# E, h0 a" L  Uare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.1 b8 [5 M  t( a- q& W; c

9 {8 P3 K: R) V' x* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
8 m& s1 U) A" j" W, x9 X# B___________________________________________________________________________
5 V: A! C1 p5 j0 v
0 g" P% H0 j; K4 n3 S* Z: y) `' n( s; w
Method 03
+ X+ h6 f/ y# T/ \0 z=========4 r4 z" p) i7 l9 Z' [# K

8 z, ]8 }. j$ J5 V2 ^) tLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
9 O# j4 f( B( @, B) ~(API Get entry point)
- I) x. E$ G0 u( Q, Q        
2 g6 s  p$ O1 c2 J5 k1 _1 g
9 R/ B6 O7 w% {( t) g    xor     di,di
8 P! o1 T* m7 `% r1 p; R) d7 h    mov     es,di$ G% @8 Q# M7 q# e: E& D3 I
    mov     ax, 1684h      
" C, I& c) v4 e. B4 Q- D    mov     bx, 0202h       ; VxD ID of winice
. U4 O8 y1 {) @% m) \+ A    int     2Fh
3 C3 n& i5 c# ^, I1 A( Y    mov     ax, es          ; ES:DI -&gt; VxD API entry point
' p: b- p% Q/ F    add     ax, di
" z, q# d- m4 R. V% r6 E    test    ax,ax
1 ^3 C- O. N, N4 R$ F) k    jnz     SoftICE_Detected
" E4 o, k; c' K: i5 S
  }. V4 l4 ~& i7 [7 W) j  b4 ^. ____________________________________________________________________________& H0 R! z! G) R/ z1 O9 q
0 S; [( D( h6 y0 C, ?$ @0 U0 D
Method 04
* }; K1 F3 v# t$ j=========
/ B1 `3 L$ J5 p- m* s7 q
* \2 ~6 {2 m; sMethod identical to the preceding one except that it seeks the ID of SoftICE( n+ r0 v  ?+ o5 n5 ?, G
GFX VxD.+ I) N: t- F; H2 I$ N) P2 r* `: {+ i

2 _' Q( h9 B  C9 B  a    xor     di,di8 F. l8 [& S0 P8 C0 E
    mov     es,di
6 z/ A5 n" I: v" H6 v# C  J    mov     ax, 1684h      
& o  N4 ^# [- r2 @8 N6 u8 x    mov     bx, 7a5Fh       ; VxD ID of SIWVID
5 ?' {  K- A6 f5 W    int     2fh
. i' w& x5 D6 {( r& x: t    mov     ax, es          ; ES:DI -&gt; VxD API entry point* n' w  s# D3 c( F0 `( ]6 V
    add     ax, di' Q( Y2 @& D8 `- \& x9 o( r
    test    ax,ax. ~1 K, i. `/ X  t0 m
    jnz     SoftICE_Detected
5 ^0 m! x0 }# w  M5 k5 P
- f( W: i# N$ c& J/ J# ^__________________________________________________________________________
: d" p0 t4 k6 r1 K+ z, ~4 i% u' H) u* i  R5 k9 ]
& u% f1 s3 z  R7 D
Method 05
; z7 i$ e4 z. i7 Z=========/ q) R+ x) \  e

$ k+ q+ S0 T2 M) bMethod seeking the 'magic number' 0F386h returned (in ax) by all system
7 i" x( K/ y$ J: W7 j* o* Zdebugger. It calls the int 41h, function 4Fh.
5 z; l' u: G* b; [" IThere are several alternatives.  
" [" ]  [6 Q7 C1 K" T( p0 H
+ u+ w) ~4 C8 ?1 o5 v' c7 l8 e( wThe following one is the simplest:: I) \+ m# B! ]9 T
* r* W6 o6 m0 D5 m( ~- z( _
    mov     ax,4fh
0 K2 w! z) L3 \5 C. _9 ~5 J    int     41h. {/ H# w  V7 A% |2 L; a
    cmp     ax, 0F386, R  J. R, R- E1 D0 A! |
    jz      SoftICE_detected# X9 L* d" C" L$ {9 Y- b: A
2 I& e7 p7 o+ d7 g$ G2 F

9 d) Y, C7 ?0 P6 _Next method as well as the following one are 2 examples from Stone's
  s- R$ d. N( f"stn-wid.zip" (www.cracking.net):
. C: Q2 P2 u3 N8 S  @! I
8 N& |0 N3 o1 R6 i    mov     bx, cs
6 v, S$ J' ?, h' y3 J- W    lea     dx, int41handler2) {% C) u  w/ i  h$ n
    xchg    dx, es:[41h*4]
* c# u( o$ j# A9 i( @: Y$ {4 ]    xchg    bx, es:[41h*4+2]
0 _% G' F. [: z) }7 ~9 Q1 X! G    mov     ax,4fh
3 u9 r- \9 W& T7 D! j    int     41h6 _* k) L- x3 t3 A; j
    xchg    dx, es:[41h*4]
0 T4 Z, m: Q3 w6 e, G; u    xchg    bx, es:[41h*4+2]
5 [* J! H5 G6 h- ~; B' }% q    cmp     ax, 0f386h9 f3 n, Z0 o" F( S( G- k( {
    jz      SoftICE_detected& ]5 X3 x4 m7 [

4 S5 a% Y6 r/ c: [0 j- |" [int41handler2 PROC7 p+ ~5 F( y' D2 x
    iret, n# a2 v: D7 `6 Z
int41handler2 ENDP* G4 L* |4 y' O. P3 J1 A2 U

% }8 J, ?  j' \) W- U7 K7 ]) e* y0 q- B
_________________________________________________________________________
7 L  q) M1 ^7 X  o$ {- t. A( d: N
+ |# N% B+ L6 S  V3 v# G
Method 06
5 o2 l1 w) V9 J=========8 s1 R2 [, w2 i$ i( N0 w
" b/ b+ Z7 _% i! a8 P
) w0 r" P/ [4 K7 U- S3 [  v& f
2nd method similar to the preceding one but more difficult to detect:6 V3 j. C2 ?' z, ?
5 Y/ }0 ]( O  [- @7 o) `2 d8 s& C
2 t- l& K9 N# v; D' v$ ]  ~' m
int41handler PROC
+ U( _. x! I- U* z2 E    mov     cl,al
) N* K1 T% o  G( u    iret
0 d- V6 i" ]' {% }) ^% yint41handler ENDP
1 R6 {6 r2 ?2 P" j" P* b6 r3 C* Q6 G4 _# H) q/ k2 n3 K' ?
( c! c2 R, m* Q
    xor     ax,ax$ H' O% |+ W5 x' S/ |: D, {0 B
    mov     es,ax' m8 }- }9 I3 Y6 k0 [2 {% X* H
    mov     bx, cs" ?+ V" ?& e, S; L9 v6 X9 e" Y, q
    lea     dx, int41handler6 |/ x! o  X5 Q5 b9 U8 H
    xchg    dx, es:[41h*4]9 B5 j( Z8 U: Z4 n/ F
    xchg    bx, es:[41h*4+2]1 `1 _( d9 y5 C/ j% k/ a
    in      al, 40h
6 d% v6 @6 X5 u' [    xor     cx,cx2 d6 P  F+ ]) ^% |
    int     41h$ P9 R5 V9 b9 F- D; f
    xchg    dx, es:[41h*4]7 b- y+ i& d" c/ L' r  z
    xchg    bx, es:[41h*4+2]. W& q, ^3 L) R! m" q; e
    cmp     cl,al
% f7 H9 l4 N7 v! |) S6 H5 B& d5 R    jnz     SoftICE_detected
" W" M: u/ i8 b' X" k, }' w: B6 t6 y$ J: |  B) G: E8 P
_________________________________________________________________________
! ]5 _$ r- x2 [) Y6 p" g* x
" w" r* `. W7 a3 r7 B4 lMethod 07" L$ I) t/ K3 T( }# X
=========* d5 m$ B! l2 R8 [

! r% w  u: T6 m" ?5 [0 c5 n  eMethod of detection of the WinICE handler in the int68h (V86)6 C7 E0 ]% o2 ]3 ]! ^. S  a

/ V% I4 p* |7 a7 h! @, q0 F    mov     ah,43h( S. {1 J7 W: L
    int     68h
/ C" I* b% n3 @) A$ K    cmp     ax,0F386h% A* K3 g" A- v$ c3 d5 U
    jz      SoftICE_Detected
2 Q2 f0 q' b  b% X- T9 G$ x  [  C" v8 h" m1 D: i. E5 q  H- q

& t1 m% o& j! K  G) o3 w$ h=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
5 q! x, A% W- Y) C- T   app like this:% G6 D3 V4 D, T4 ]- e# u

8 G" q; k: N* ?4 p1 x: y   BPX exec_int if ax==68
: m) T6 U0 P$ v3 J  D5 T   (function called is located at byte ptr [ebp+1Dh] and client eip is
. [/ j. {6 w# d- h: r- F   located at [ebp+48h] for 32Bit apps)
. m5 j1 v6 h& N& T( K0 U4 K/ U__________________________________________________________________________7 u2 e9 W" n/ E/ W% [! `1 |4 \

3 F, \8 E: {* d) H$ V
% E7 c# f2 ?; L1 P$ dMethod 08
; _0 g) ^  x. y2 A=========
7 ?  g4 h  E( U( `6 _# r
; D0 x  G/ J1 |. u5 wIt is not a method of detection of SoftICE but a possibility to crash the
2 y9 e1 X- z3 I: l! V3 E: s( v( _. [system by intercepting int 01h and int 03h and redirecting them to another
2 h- A: U: X. F6 ]. r, Droutine.) a; ^; [* }0 q$ T$ ~, B
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
+ j9 s5 Q3 Q" P" r8 F& z( ^% sto the new routine to execute (hangs computer...)0 @# x- ]$ S  w. m/ c0 m6 k/ [* Y

2 @  F, f. _' W0 r: d; G    mov     ah, 25h# r: X4 [- a3 f) e; S
    mov     al, Int_Number (01h or 03h)6 k; O0 d9 B" I$ l  v
    mov     dx, offset New_Int_Routine# m8 Q8 A* u' L& M
    int     21h
7 w9 ~# H% o* u$ \4 z0 O6 T. F
) R9 T( C2 \! ]/ x2 L__________________________________________________________________________. ?" T8 o- U0 {# b; u  h, j* P4 J

& {; E7 Z. c" t6 Y% U7 \Method 09
$ U3 j: u, f* w7 N( U=========* Z. o1 e% y5 S' P) x# ]

5 O- o  j  V4 ?- T$ r  YThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
1 x3 u  m# o% s% ?' b, u8 Jperformed in ring0 (VxD or a ring3 app using the VxdCall).; I* f( U& I; U- p% D# Q
The Get_DDB service is used to determine whether or not a VxD is installed$ {0 x# E. c) _
for the specified device and returns a Device Description Block (in ecx) for% i5 l" p; V! H6 {- c* S: {
that device if it is installed.
) F3 o3 H; R$ K) T7 O# y  M* t, B' C! c! x) E  X
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
" N8 v* K5 p# _$ M   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)9 Y+ ]7 S; ^1 m! P
   VMMCall Get_DDB
5 M# Q! `$ ^' T1 j   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
4 L- D) s( \1 c. `+ D- {  `5 p8 |/ b. P6 M/ J( P9 `: R
Note as well that you can easily detect this method with SoftICE:
$ a6 G8 c9 w1 g, n   bpx Get_DDB if ax==0202 || ax==7a5fh
5 \1 r5 g3 s; L) X2 _+ k2 A" D; \% z' o/ E+ C, |9 ], f
__________________________________________________________________________
0 v& A) R; ~! C# |+ Z* s+ I2 O, C, z) ?# E
Method 10% Y1 j; C! ~$ K0 D$ x) }" m
=========
3 Z/ G* `  q  Q  |" B2 P2 Q1 u- p0 [6 R+ Q
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
" o' t' _; y: J& W+ d, S; D+ Q  SoftICE while the option is enable!!
/ {  ~9 Y- r( C( I# A( H8 Z" ?( \- J) m) Y' @
This trick is very efficient:4 e) A" k& U* W
by checking the Debug Registers, you can detect if SoftICE is loaded
$ ?9 C% C" U( D" Z7 y$ h(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if* r1 q. M8 w3 P  p2 A9 b" k
there are some memory breakpoints set (dr0 to dr3) simply by reading their
0 ?- a: Y- M4 J& Ovalue (in ring0 only). Values can be manipulated and or changed as well
" n" R; x6 ~' R2 L* c2 _% E( X(clearing BPMs for instance)
6 H! ^, t2 A( U! l( t4 E2 T  T: R0 U
__________________________________________________________________________% n" H& p/ P, F, E

4 b1 b: _& r$ r/ u& m! E5 DMethod 11
; O: y6 }2 `4 K=========% e$ p7 j7 ]6 Q) P7 v: `6 K/ f
  b" e6 d9 y7 A) d
This method is most known as 'MeltICE' because it has been freely distributed% k, r9 T4 U5 c) s+ t( i) X
via www.winfiles.com. However it was first used by NuMega people to allow
1 @$ l5 Y# u" B) J9 b8 g: FSymbol Loader to check if SoftICE was active or not (the code is located
( a* p/ B: \  j* [% H3 vinside nmtrans.dll).7 t% B5 |# p& q* |, W# _7 a

7 ]" o3 a; o; QThe way it works is very simple:
  G, D! B7 f$ T# K* w8 sIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for7 l$ r3 X1 R* h3 B( l2 f
WinNT) with the CreateFileA API.% b# q3 b$ A# H5 O% R

5 |( e. l( G3 U% G* aHere is a sample (checking for 'SICE'):
4 i6 T/ L7 L0 n0 {% j5 Z. h" t
( z9 h9 C! j9 |0 gBOOL IsSoftIce95Loaded()" }& q( [/ }+ F3 r" i3 A* a
{
( W* ?, g6 y; V' h- g   HANDLE hFile;  
. }8 u4 |1 p- g  o0 U   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,) e# [: B! g, i* ?8 @6 o- t. u9 y
                      FILE_SHARE_READ | FILE_SHARE_WRITE,
- w! p& q" e* w, Z                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);- k0 w& o2 b6 ^% C" U
   if( hFile != INVALID_HANDLE_VALUE )
8 ?+ r6 O4 G) F; s   {
: H) F9 S* h  k. r7 M      CloseHandle(hFile);
1 P/ K/ T9 S4 g5 q      return TRUE;* T# q/ A" E2 R$ U  h( U7 B% j
   }/ v, y% h4 p: C0 @
   return FALSE;
* S( P3 z1 K# [& f}
; L' e1 X2 ^: c2 a! {6 {
( m' \0 o( u0 D. O) N  X9 PAlthough this trick calls the CreateFileA function, don't even expect to be
2 ?  j2 \5 h/ jable to intercept it by installing a IFS hook: it will not work, no way!
2 q5 M# a2 Z) ?% q* H" G7 aIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
3 k5 ~( S9 A, e- E! Pservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)6 d7 Z9 O+ b5 z* g! k1 ]
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
" r+ v, {) f  Lfield.! c! e* ]  C' U9 Q! q& ]" H# q$ D% z
In fact, its purpose is not to load/unload VxDs but only to send a ! m# e$ X+ `* U' B# _
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)' c' f( h" |, w
to the VxD Control_Dispatch proc (how the hell a shareware soft could try' b1 o7 C) C% t$ G" K
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
# a, j$ _) P0 d8 g9 _% |6 }  SIf the VxD is loaded, it will always clear eax and the Carry flag to allow
: m, z. Q: r7 @8 Iits handle to be opened and then, will be detected.* y/ Q" w! `9 _6 A' S
You can check that simply by hooking Winice.exe control proc entry point' T: `5 N/ z4 F+ T& s
while running MeltICE.
7 r, t) W) h4 M& M6 A) z: n2 n6 D
( M+ N2 H. }$ r& {) G
; u4 k0 u. s% b( |  M1 |  k7 A  00401067:  push      00402025    ; \\.\SICE' L+ s$ c4 ]& e, ~9 n% N2 I$ H0 B
  0040106C:  call      CreateFileA
2 r9 e2 v( C* L6 E  00401071:  cmp       eax,-001
3 {, u. a5 j5 h  {3 C4 P  00401074:  je        00401091
- I4 D$ g) I  g5 _2 \
, ?5 m# A: a+ F; y7 ^6 X" n3 p3 }9 ~4 C' E$ v* g, j: Y, ?
There could be hundreds of BPX you could use to detect this trick.
% B  K  J  q& p- {3 o1 s-The most classical one is:
9 B: U! r* j! n$ x  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||/ c: Q/ @; E4 d7 w0 `1 {
    *(esp-&gt;4+4)=='NTIC'
) E! L( M# @' c1 K/ v7 B- H/ _
+ `. Z# d" i2 v8 r-The most exotic ones (could be very slooooow :-(2 w3 E  S& R' K( v3 S- ]
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  ; x( v0 l& J9 `- ]2 N- c( U1 Q2 e
     ;will break 3 times :-(8 h- }( r+ f0 U) o3 o* i

3 }2 ]* U) `2 b+ z, W  P, Z-or (a bit) faster:
1 C( k$ I7 B. s8 s   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
  @1 ~9 Q1 e5 N9 k) L4 L0 @5 W6 v
- [- {" l4 w; A% _0 U% r   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
9 W% Q+ b2 R/ f1 q' d7 \/ O/ F     ;will break 3 times :-(
: Q: y8 I6 j1 S) H; B9 X! I
) K8 \: p$ N8 B, Z; Q) f; {-Much faster:! ?% T$ u7 _; f' L$ L% z, X# _
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
* a8 Y7 U% U% @! }# h* M' ]% v. r+ G5 r( c
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
1 x3 `+ R! l! @' Z  b$ \function to do the same job:" c( b' ]- b0 ?. s- y$ C
- a; W) I+ u( q' v
   push    00                        ; OF_READ1 D" R/ x+ i! |2 `& \
   mov     eax,[00656634]            ; '\\.\SICE',0
/ A( P) s- y  }! a; ~2 n; s  M   push    eax) U# X' }+ b8 m1 b1 i
   call    KERNEL32!_lopen
' B* r  w, ]/ D   inc     eax
3 e: v2 a, y1 r' J+ U/ s, B, j   jnz     00650589                  ; detected1 ?- b8 P  b3 [; ]3 s7 Q
   push    00                        ; OF_READ% n- b  W+ x7 G6 [' y3 W3 J  R
   mov     eax,[00656638]            ; '\\.\SICE'# T" x5 _  B) j9 E2 ]2 T: |
   push    eax  [  {4 H7 _! z9 z
   call    KERNEL32!_lopen
& z9 o4 @2 S/ @4 L) s   inc     eax/ r. p5 k1 o/ m7 S( `' m/ c
   jz      006505ae                  ; not detected% Y% X! |# _! ?( P. Q$ S0 H& O
) P! R8 _+ {8 A8 R
$ W8 d( p/ f) o9 I( J# m. j
__________________________________________________________________________
9 o* m- @* p' U$ F& f9 c6 w% [1 q* `: B' ]6 f9 V) j" Y$ ~
Method 12% H& Y9 e/ ?) }8 v0 p
=========
, x/ l2 {9 ?7 M4 E8 U1 d+ C: z. N3 s* T9 S% a
This trick is similar to int41h/4fh Debugger installation check (code 052 Z6 l7 Q1 u6 G9 i4 b- j% w
&amp; 06) but very limited because it's only available for Win95/98 (not NT)4 \2 g- {% y: _$ q) V$ A
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.; a& k9 o+ T+ y/ H7 B+ K
% J# \) Q$ ~4 v- U
   push  0000004fh         ; function 4fh
' P" V! G1 o# U/ h   push  002a002ah         ; high word specifies which VxD (VWIN32)$ c0 L) `7 a2 d; H" h
                           ; low word specifies which service
( ]" W! c* W$ H- Q                             (VWIN32_Int41Dispatch)
# Y  }3 `  }6 W5 J( e1 F/ Y  {: T   call  Kernel32!ORD_001  ; VxdCall
( y, W% @2 }$ e; D/ Y' F3 [% ]   cmp   ax, 0f386h        ; magic number returned by system debuggers
# G" Q. e; P! e  R" X   jz    SoftICE_detected
1 c( u! Y8 y: |" r5 k
7 M# v9 w( S( l8 w, v+ PHere again, several ways to detect it:# d, O' U0 M4 n. b+ r! ?! j
) e3 N$ {9 e+ C4 [3 S9 o' Z" @
    BPINT 41 if ax==4f
. l: N6 h9 y. l& T0 P% A. V) i0 p( C; j6 u* Y
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one! h$ G9 V, V9 w/ u) C7 x) b

8 L+ Q- B& w$ m! j- j    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
- B- [5 f2 l1 ~8 J( I% p/ D: e% B1 t3 e: i% E4 v+ _& I
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
+ j! R( |7 T& ]1 V' t/ ?8 y6 e5 Y# c* b% a9 Z1 p
__________________________________________________________________________: I6 I  U# U9 q8 F7 {% S% f

) N) v. F" e1 t) H& C* O" c- dMethod 137 M! c  P# W, _$ A; O" c
=========
8 P6 d9 Q+ T0 l1 P% E) o
3 W  |* X, M2 S- T6 ^Not a real method of detection, but a good way to know if SoftICE is
4 s6 [8 p" Z! \installed on a computer and to locate its installation directory.- @0 d4 k. g4 j/ q2 X% h
It is used by few softs which access the following registry keys (usually #2) :
# o* r& t+ W5 I
& O9 ^# D" L5 {0 |-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
0 U* D: A/ s/ m\Uninstall\SoftICE
" P& w/ l; Y$ f( [$ N-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE; t3 M# H. i9 @* o0 U6 i! [
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion% y9 T3 A; h: |1 V, n* T
\App Paths\Loader32.Exe
; i; h% F; @! H" {6 C! A
8 q0 i, m" g/ S+ }; E. F/ T! D, c% F% g" ]" \
Note that some nasty apps could then erase all files from SoftICE directory
" i0 g) ~2 T8 h" {(I faced that once :-(
0 T) P9 Y- l) L6 X, h  Z
" J8 B; M9 [- X; \) s) K+ \: g, _Useful breakpoint to detect it:. N( M: L/ U0 J* g+ }1 S
; Y& }( m* n4 [, i( b
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE') ]5 n/ z% y) G' }* ~# y! O2 z
' |. Z/ v6 l4 p! c9 S" S
__________________________________________________________________________
: ?' ]$ {4 W# k2 O) h
( M$ X% A" }/ @* r5 n0 {
; z8 _$ Y9 X5 f& M' k8 P9 M: k! xMethod 14
2 f4 x9 [" p! i1 \=========
# L9 g/ b4 }3 p) G1 o+ A: `+ q% D  C2 X7 Q5 Y, h! W
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose) Y0 q+ I2 K. W# i, C
is to determines whether a debugger is running on your system (ring0 only).
$ f4 y( S& n4 ]6 @: x( u, q: A
8 Q# w/ B4 A0 f   VMMCall Test_Debug_Installed
0 q; w& E( o* L/ d% g% N   je      not_installed
% K. c7 C. t' H8 Q# x+ q6 v6 ^; G) B2 E* T. `
This service just checks a flag.. h/ L7 w& @3 u, n6 b7 u, y7 `3 _
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-8-9 14:17

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表