About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>9 _* t2 a8 U) V. q6 l4 W# e
<TBODY>
0 `+ G9 w" o7 W' V4 [<TR>
' \( o) \+ B' W; a2 w$ [<TD><PRE>Method 01
, c* x) w" i, i$ c" L  l9 b=========6 d4 D: u3 u  R

( H3 q3 c: K  {# t8 ]This method of detection of SoftICE (as well as the following one) is
7 z* g3 q. S5 |' w# dused by the majority of packers/encryptors found on Internet.  i8 R8 ]- Z2 B2 D& n
It seeks the signature of BoundsChecker in SoftICE7 A# z. W$ p! P$ o7 _

4 T+ b& \2 M, a! F: p( P    mov     ebp, 04243484Bh        ; 'BCHK'- `) a, p+ @  \5 W+ Y
    mov     ax, 04h
) v! J: P) b5 N5 B7 ]; m    int     3      
4 _- i* [, |7 Q7 T# ^$ u    cmp     al,4
1 k  J  H# G5 [% m" [/ @, R    jnz     SoftICE_Detected
# i2 _& t; b3 L6 P! G
8 j" \# u; v$ y) P( G$ P9 |___________________________________________________________________________7 O, e+ I. x6 W" J4 z( l( t
0 m; P3 {5 R; @  V/ T
Method 029 Y$ u1 J; ~1 m8 ~- b
=========% h) q, r- c9 t1 o1 t: b

4 D; z/ K/ [! Y: ]+ mStill a method very much used (perhaps the most frequent one).  It is used
+ ~# A+ |. {1 wto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
7 l2 L) V3 ^$ _. Ror execute SoftICE commands...
* v' Y3 c. j$ p5 ]It is also used to crash SoftICE and to force it to execute any commands
4 D. @& R6 ]6 R% W$ }  z(HBOOT...) :-((  8 q2 U# F: t2 e0 g0 i, v

- M/ m# u  D& J& D3 T/ [, {Here is a quick description:* D9 i" ~! V4 q7 }3 Y. `6 g
-AX = 0910h   (Display string in SIce windows)
* B' w2 b4 |* p4 y0 c# t6 x-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)4 O& S' H# d) w1 p* z
-AX = 0912h   (Get breakpoint infos)
7 s. Z6 g' b- F# M3 P# i-AX = 0913h   (Set Sice breakpoints)5 x0 c4 Z% u' d
-AX = 0914h   (Remove SIce breakoints)
- ?8 I4 @; G/ G+ s) _7 T8 K
6 X( f& ~2 \6 i" e1 o! H) T8 QEach time you'll meet this trick, you'll see:4 k+ X; i* t* u
-SI = 4647h
" {4 u2 r' [  v) E; x6 j" R: y1 r-DI = 4A4Dh- Z' n7 e" L9 u! j
Which are the 'magic values' used by SoftIce.5 e* Q/ K7 k% n: B  `# F: S4 n
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
8 Y$ \) b7 ^/ Y' G0 G  F3 v# _
4 Y+ y$ H& h7 W5 g( BHere is one example from the file "Haspinst.exe" which is the dongle HASP8 A& X8 P$ {( C
Envelope utility use to protect DOS applications:& f: m" N) z8 v5 }: p+ P/ a) G

( m, Q7 I$ v5 l8 _! X
0 s) n8 x. w6 Y/ c- R9 u4C19:0095   MOV    AX,0911  ; execute command.
) G6 `( _5 A+ S3 f0 k2 }4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
; m, f" e9 \; M4C19:009A   MOV    SI,4647  ; 1st magic value." D6 Q. f$ b+ n* \
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.5 W2 F1 f. r& u6 e# c4 Z
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
7 m$ A4 q3 |6 z5 m4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
+ F- R/ b- f/ B- z6 m4C19:00A4   INC    CX
8 Y+ X8 u5 o& K, E4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute' K# S0 b* j% W2 H5 F: k
4C19:00A8   JB     0095     ; 6 different commands.
; k2 t% p. o- x% L$ o4C19:00AA   JMP    0002     ; Bad_Guy jmp back.2 U: r  I7 U0 Q5 A8 I
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
5 c; x) s  d$ R" f( a) b5 G) ^7 H  e1 C+ c2 \. `
The program will execute 6 different SIce commands located at ds:dx, which
) _; `0 X/ b) O; S$ Mare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.1 p9 J( x' p- ^* A

. n0 i# {  Y/ l' y6 n! y( P! K) z0 i* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
2 i) {8 f. D5 b" `1 O1 B; G2 ____________________________________________________________________________+ b" z+ X6 C% u* X4 }- Q' h
. q" b5 Y' D6 {% i# m

' n# M7 l! \. h& }3 W! PMethod 037 Y  R& H$ z3 v7 j
=========% Q6 e, R2 |0 t3 d% z

3 r8 N9 ^2 R2 X# U- eLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h7 }: W) A6 d& ~
(API Get entry point)
( S2 z  b/ v; H        
- T8 x3 [; N. b  ^
: c! q1 h0 Q8 _8 _1 f    xor     di,di& I% L2 i( x% J0 s2 t
    mov     es,di
* u) O, k1 F  r" k$ a8 M    mov     ax, 1684h      
, h2 O; V& m0 G# O' E    mov     bx, 0202h       ; VxD ID of winice- X$ ?# [2 F8 k, c$ O) A3 \
    int     2Fh+ j/ ?0 y9 M0 H# x+ K3 _* H
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
: N  N0 x* ?$ n) R0 |3 m- v    add     ax, di
. j4 ~5 @2 H. P% b# r, J- a5 Y    test    ax,ax
1 S! w. o* q' b4 H    jnz     SoftICE_Detected
; n  \! U% R8 p4 H
! L* W8 _+ h9 i& Z___________________________________________________________________________3 i( G8 O5 n- C3 f
6 ~% H( B9 B5 d4 t
Method 04
# s) f. C# \% v5 w9 G% o=========! t5 |3 K2 e, j' J
; i8 @$ p8 b  n& ]& E& m: w
Method identical to the preceding one except that it seeks the ID of SoftICE
* }% s  b& T8 d7 zGFX VxD., h! q) F  |2 t: F- }

' S/ k* U. H  \    xor     di,di
+ G) X. k, v9 B" Q! j    mov     es,di3 Y3 y' V9 |! j. h. H5 U5 l9 n
    mov     ax, 1684h      
* [; Y( k6 `. o; y6 N6 t    mov     bx, 7a5Fh       ; VxD ID of SIWVID
1 Y- ?0 x# ?9 ]8 }. M8 Q; q    int     2fh! a) Y/ x$ V: g- t7 n, f4 V
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
8 M" B9 O% Z/ f0 |% k- K    add     ax, di: Q8 E* U, R; M; Y) C6 x
    test    ax,ax- L/ V7 V; ^7 P) N" R
    jnz     SoftICE_Detected
  A( u$ g% I3 L1 s7 t6 Z3 t6 ^" o2 F" a3 j7 j/ J' I
__________________________________________________________________________
: H" \$ v  W$ P3 Q3 Z' X6 i! c5 M2 W' n5 N6 z% l

2 p! f6 z4 x( n. }8 g7 K7 OMethod 05
3 g+ ~7 l+ \' g" M# |8 O=========
2 m$ T. r9 W, |! c' e* a& y2 K, {0 Q/ M: m& z( |
Method seeking the 'magic number' 0F386h returned (in ax) by all system. j, u: J) @$ ^: q: [+ Z$ ]
debugger. It calls the int 41h, function 4Fh.
5 J, ~; q! f( H1 k- t' E1 oThere are several alternatives.  
0 |" ]$ s# Q7 i( L. |/ T6 b) b% J+ }1 D/ W- [0 b- c& i* b
The following one is the simplest:
9 G0 l. t- h0 ~( L1 B, j* X% I5 n; Q* M" a
    mov     ax,4fh
+ w. m& V* b0 L( x. U/ x1 D% |9 `    int     41h
9 F% i0 _; Q$ v+ q, ]    cmp     ax, 0F3865 w% L8 M: y$ R6 L# V! j
    jz      SoftICE_detected; _; E5 P4 g- Q7 m) R5 L1 {

: M* Y% H. l1 N1 o/ R' S0 Z- }5 [6 a9 K( Y! g$ c
Next method as well as the following one are 2 examples from Stone's 1 Q  z1 J5 H0 E& q
"stn-wid.zip" (www.cracking.net):7 ?0 _0 A( e5 ]& ?2 ~7 K; \9 c" v

' h) b" \5 j+ {' j0 Z    mov     bx, cs
% v. U1 P, {/ ?# z5 i, z1 Z! P$ v    lea     dx, int41handler2! V5 Q' |9 k$ e
    xchg    dx, es:[41h*4]' m  l1 a$ P. ~7 N/ W0 Q( t3 P
    xchg    bx, es:[41h*4+2]
& t& c) X3 Q- m$ B8 X$ R    mov     ax,4fh
7 t; d2 {* ]2 [% Z    int     41h5 U1 ?$ S! N7 z+ y( r/ l
    xchg    dx, es:[41h*4]
. \1 k' S0 O0 G# e, i* S    xchg    bx, es:[41h*4+2]: Q  W* I2 d2 }6 p1 T
    cmp     ax, 0f386h; f2 ?6 B* B7 i0 q  z" C* F, i
    jz      SoftICE_detected/ x5 O2 M4 t8 B" N

' |- t( \( L9 ~/ |6 Uint41handler2 PROC
# u  W7 R+ v& L* `    iret
) y# ?$ s* \8 \+ uint41handler2 ENDP& Y! @3 M- C1 u5 t7 R

, n4 v% \; |" t7 d4 u8 {( @6 i/ V4 ?5 N( H( U
_________________________________________________________________________
( J  k0 P8 F& i; _; V5 U* I8 C5 B' R) @0 w) l; Z) L( X

4 ]! g' g% X5 e4 B2 HMethod 06" i: ]9 V1 L% Y1 Q( @$ e
=========! R, I* r; Z4 }0 r0 `

/ x% B' V0 t% S  n5 H- m
! q6 t( Q' @1 x# W1 n7 e2nd method similar to the preceding one but more difficult to detect:
7 v0 n/ A9 ?" O) i: U$ f* O6 X: s7 P, m
$ J: W* F3 o- d. N# Y- M" A  p& a4 M- M* R" s
int41handler PROC2 e5 y+ i% s4 f0 F3 ]
    mov     cl,al$ b- w9 }- ^/ I, U4 L
    iret# |; m1 U& W* r
int41handler ENDP, J! G7 f) k  u' l* l: b  u8 ]

5 j: A) Z+ d, P+ i& j% u: B9 N3 R3 a2 z( r, A) y) g# U! a/ c' M7 Q
    xor     ax,ax3 C/ f$ F  U! i) C! m1 s
    mov     es,ax
7 O' r8 q. X  g2 n; p. g    mov     bx, cs( j! v3 T" {+ i: u" _4 l& Y
    lea     dx, int41handler
# i& z3 y6 l# U; V5 W2 k/ t, u    xchg    dx, es:[41h*4]! w- T! z; W8 s
    xchg    bx, es:[41h*4+2]
8 H& Z' L# ?6 |& H5 m, w8 h& S    in      al, 40h
& X4 p! u1 ^9 j- b    xor     cx,cx4 o( h) h- c% e, C) q5 H% _5 @6 Y
    int     41h$ e; L* T# @$ i. Z0 Y7 b( m
    xchg    dx, es:[41h*4]
4 w# g3 M/ W2 `    xchg    bx, es:[41h*4+2]: @. G& }- A# ]$ }
    cmp     cl,al
# \+ b$ Q# u; [0 M    jnz     SoftICE_detected
3 k2 y1 Q( S% ?- |5 y. m' e  a! H) m& R% }' j) [
_________________________________________________________________________( P9 [# \1 e! C4 P( `0 j6 y! |! }: c

( V. g, x$ c; i* u+ \Method 07  D1 u. j! J7 @# }4 m$ u
=========
$ D; M4 f* W- O& ^# J+ U1 o3 F% N% P$ p1 [
Method of detection of the WinICE handler in the int68h (V86)* ]6 M+ l* ^' f" S: k& x2 r. q

: G" H' }5 v+ _- G" H8 c* s6 K    mov     ah,43h
  W: s( u; U8 B; E    int     68h2 n1 {: z  J% M1 L4 k& u0 j: j0 |6 i
    cmp     ax,0F386h( [9 L: q5 Q9 K- O  J/ U% }0 v
    jz      SoftICE_Detected4 f0 z) B: ?) U( A

; @" e( ^3 ]$ {+ x, Y! H
6 s( v; y, Q, ?$ D" j! G$ ?=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
0 T) v4 U3 m9 m  T- d7 k   app like this:
& B5 L( r7 |+ }, n, ?9 G& d' l% u2 n/ ?) r$ S
   BPX exec_int if ax==68
: Z$ V9 W  x" @3 [   (function called is located at byte ptr [ebp+1Dh] and client eip is
/ c+ S0 G, j, p+ `$ e2 N   located at [ebp+48h] for 32Bit apps)
$ A: A: b* E7 a: t1 I__________________________________________________________________________( U5 D1 Q& e% U" f, g. M
4 B" j2 i$ R. ^- x
+ Z% W6 ?9 A- R) x. q- \! w+ D: \
Method 088 s& u! |4 _; F, [# E3 A3 ]3 Y: [, j
=========
  v3 n- M* R4 D1 |  o+ T) Z
" y5 I$ W5 J* k8 D' x7 e1 eIt is not a method of detection of SoftICE but a possibility to crash the! A: S) e0 i& L* f
system by intercepting int 01h and int 03h and redirecting them to another( E  S0 w5 s+ D  q
routine.- e: s% {' Y( x- }
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
, f" M- b/ A' {5 ^$ G* r9 cto the new routine to execute (hangs computer...)
& J! {" {# E: J) S
3 `8 X5 Z7 L0 g* n' _    mov     ah, 25h
$ a; J% S. Z: j# C8 c  g8 y/ {4 B% B    mov     al, Int_Number (01h or 03h)6 Y+ Y$ {, B, N: ^, V* w
    mov     dx, offset New_Int_Routine
) D1 g/ C8 V) U/ [( t  M    int     21h
" ]' ?; g! Y4 B& U8 a
& c2 h/ K$ R. z& W7 \" O__________________________________________________________________________
9 u2 z0 y' I; D& }& I
7 G: N1 H% L  `- M3 n! jMethod 09
5 M6 Z8 ~# G6 o: }=========
  {) m8 x; E: I) _1 {+ W" Z7 b1 {; i' H  ?
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
. _, F/ Y3 P1 Z7 E" D) xperformed in ring0 (VxD or a ring3 app using the VxdCall).
& y+ D1 e9 F) DThe Get_DDB service is used to determine whether or not a VxD is installed4 d6 F3 m; ~5 Q4 K
for the specified device and returns a Device Description Block (in ecx) for
" o7 g/ J9 B3 u  \) nthat device if it is installed.
( A7 O1 D4 R+ \8 C4 R% Z5 N8 D' C; U4 c: C% z& Q) H
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
0 ?8 F2 d) k# O6 E) t1 N8 i4 t   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
, [. _  k: Y; C" A. y5 k   VMMCall Get_DDB
, Z  L9 v" D7 b8 Z4 o   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed2 z. {# A. }& W  k

5 Y1 a, ~  z8 D+ [) r: ANote as well that you can easily detect this method with SoftICE:/ Q. n+ C& j# t* }
   bpx Get_DDB if ax==0202 || ax==7a5fh
" ?7 S8 T& J+ H$ p- n4 Y; k5 j2 m/ M9 ?( P4 ~7 I& f3 J3 O
__________________________________________________________________________
3 M2 b$ P( A' s& H7 s( W4 \2 `8 h
" t. n# U9 h" p) Z5 AMethod 10
& o* J' n- p' @9 F=========5 V) I; h, G- w* u
) h2 E& H6 ~  R7 S, [$ n- k8 L9 ]
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
+ R- B6 J- x) c: |4 h1 ~  SoftICE while the option is enable!!
- ?$ R, H8 _9 I" F5 m1 j+ `- u; R+ |, \" m7 V/ f2 ~7 |, x
This trick is very efficient:/ x: k! ^( T% [( f5 A! h
by checking the Debug Registers, you can detect if SoftICE is loaded, e! G6 j$ v" R+ H0 V& Z+ R
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
7 O8 q( Y) f4 r) {there are some memory breakpoints set (dr0 to dr3) simply by reading their7 I7 p5 I' w7 H6 [) Z
value (in ring0 only). Values can be manipulated and or changed as well
7 c! F, n# k# _2 F+ w(clearing BPMs for instance)
2 u: M0 j( I' t1 f
0 m5 N: g+ c9 V$ [0 h$ k__________________________________________________________________________
# n  e7 {2 b5 r' @( T+ }& G0 G* p" [4 s$ X) b% M0 |' B+ C$ b
Method 11
/ J' J; E1 O9 w3 Z  w8 m=========3 q7 L; ^4 |0 f; t+ w4 u5 n: e$ W( g
; H/ e) ?- @/ O2 o- E2 [
This method is most known as 'MeltICE' because it has been freely distributed
* C: f" X# ^2 |  _  \via www.winfiles.com. However it was first used by NuMega people to allow
( F, m: F& P( _# V" B0 l8 kSymbol Loader to check if SoftICE was active or not (the code is located' z# ]4 y5 |9 S# I; H
inside nmtrans.dll).
7 E( l  V) t8 A8 r, D9 X
( M- j4 A4 r) `( KThe way it works is very simple:
) P, C6 x7 E8 ^  P( P0 h) vIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
+ E1 U5 [4 n- bWinNT) with the CreateFileA API.
/ ~4 r$ v! }- N, s: d0 _' q: O2 E4 a. ]" r! S7 j3 A$ f0 \
Here is a sample (checking for 'SICE'):
+ D/ ]( P3 b" d0 j& }" H; {$ C; t% t
BOOL IsSoftIce95Loaded()6 |# k) Z3 t/ @( [; d7 i
{' A7 B! F& t7 K4 T: l
   HANDLE hFile;  7 v% B' J# D, Z5 u
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,, b/ e; u' U5 l' j( }
                      FILE_SHARE_READ | FILE_SHARE_WRITE,
+ B: s! ?* g6 ~/ R. u                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
8 L8 C$ Z( G; ~5 O5 y2 }   if( hFile != INVALID_HANDLE_VALUE )
, D4 a! S. L! g. t/ R4 ?7 |   {
$ R; l6 I6 l" o* x      CloseHandle(hFile);
6 N0 \9 m- y% h' u      return TRUE;
) l; c% H2 G7 R) q   }1 C; X- A( c- g& k% \8 S1 V9 |8 P$ ]
   return FALSE;
7 z4 c6 d' b0 P- s9 y}" G7 R4 Z6 d4 c6 @( \
3 p5 U; f" f9 J* Y# F/ Z
Although this trick calls the CreateFileA function, don't even expect to be
2 F' P* ?: Q# l: Y( Eable to intercept it by installing a IFS hook: it will not work, no way!
, u- j. f) V, V( m0 I; J+ p/ U0 JIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
# B& l& D6 \/ S: K) gservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
8 P8 h" ^0 S* t  f7 n+ r, q& Cand then browse the DDB list until it find the VxD and its DDB_Control_Proc
% E$ \+ L) Z8 i9 R# C. W) wfield.
" W' J; Q7 g- C5 I5 t' l, |9 i6 rIn fact, its purpose is not to load/unload VxDs but only to send a ! O9 \' w2 k3 j5 l' i
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
0 a4 ^, X1 E. t8 O" e( hto the VxD Control_Dispatch proc (how the hell a shareware soft could try0 Q: R3 }2 Z3 @% w+ A9 P+ r' H4 T
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
' u/ w' q9 @) u* ?If the VxD is loaded, it will always clear eax and the Carry flag to allow1 U; a3 t* f: ?3 L
its handle to be opened and then, will be detected.
  B* z: }: o: g" T6 K+ cYou can check that simply by hooking Winice.exe control proc entry point
  d0 N! O5 l# |  Pwhile running MeltICE.
' M( f: p* \! g' r, @4 e( l; T' i) Z7 s
1 o2 K$ V: d$ @* s9 v7 b
  00401067:  push      00402025    ; \\.\SICE
5 Y- ~7 R5 B3 z7 C  0040106C:  call      CreateFileA
5 V+ a" s; t# _: \  00401071:  cmp       eax,-0019 w) E- f. U9 S
  00401074:  je        00401091
: q! q$ ~7 q' ?  g% o1 X; F5 `' k. f$ v# T5 j/ L/ r

& e/ u+ t6 X9 _# R5 C; XThere could be hundreds of BPX you could use to detect this trick.) K. g. y* N- ?" h4 `
-The most classical one is:
3 K! w: o2 ^) w  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||- H$ ]- k! @+ ]1 }0 B+ o" K
    *(esp-&gt;4+4)=='NTIC'& v& K  J+ w/ }* x
% J$ W% D9 n2 l7 e+ E( n9 @0 c
-The most exotic ones (could be very slooooow :-(9 U* m0 N! R$ H9 I
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
- l  S$ J% F) [' q: W! G     ;will break 3 times :-(
+ g' J! E# R% Q6 L( Y, S3 s0 g- F; ?8 n# V5 H" x+ J& N: t6 b
-or (a bit) faster:
* I  f  L, [1 v& |   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
! c$ e/ S+ c+ ^2 @
% D' Y' Y9 M5 F" w& L' X   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  ) V8 O. r* N' Z  [9 n% Y/ l8 s
     ;will break 3 times :-(: u5 E6 p4 _. k! {2 ]  Y6 f8 x
) ]1 g3 h# A. j+ D/ o
-Much faster:
" y1 R6 e0 g( X" o7 q0 V   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'0 I1 u5 s  I+ h

' \) r5 x+ {+ V  b$ ^8 e8 r! DNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
! I  E' ^. @! a$ y. W( n9 hfunction to do the same job:
8 q4 A" v- u6 Z; n; p* x
. N, I+ i8 h) \. d   push    00                        ; OF_READ6 O& O4 y: L& b: P3 n
   mov     eax,[00656634]            ; '\\.\SICE',04 F* J  N% a/ H& b! Y$ ?, w! h
   push    eax  f3 F% V' {. W/ @, _/ J2 {7 C5 ]( A
   call    KERNEL32!_lopen
6 e# Q5 L* w' d9 H0 ^  Y   inc     eax: e/ C$ Z5 }' ?) g$ I( r
   jnz     00650589                  ; detected
: ^6 L) T3 t2 `   push    00                        ; OF_READ
7 e7 a/ q+ _# X) ?" w5 h   mov     eax,[00656638]            ; '\\.\SICE'6 f' @$ z1 U) l! H0 Z5 M% j
   push    eax
- U/ V2 Y# I. n   call    KERNEL32!_lopen* M0 _; z; m# j( w: q' ]* i. E
   inc     eax' o2 J) K2 Y9 z3 p5 w! k5 v; }% ?
   jz      006505ae                  ; not detected+ {% X- T2 o4 Q. v
' E; M! K0 n* O6 C! y. Q& z

8 Q" y7 y! G, i" v" u2 s" ]__________________________________________________________________________8 A# [, t4 P/ X9 Q3 E

% Z# Q1 c' E( aMethod 12+ J! p' E+ S' E$ D; k5 c. M% G9 w
=========* ]4 R2 d7 O0 I, `  p( _! S- k
2 O5 q( ?$ `/ D5 M* F9 ?8 o
This trick is similar to int41h/4fh Debugger installation check (code 050 o) l, i' O! h4 d  U
&amp; 06) but very limited because it's only available for Win95/98 (not NT)6 \/ h9 M% N5 T* R- B  z) G
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
$ o; j; u) ^  W( b* B4 I
4 p1 s+ C8 P( l* o9 n   push  0000004fh         ; function 4fh
; V% E- @; r& A3 s   push  002a002ah         ; high word specifies which VxD (VWIN32)
# T6 I' J- Y0 P$ i                           ; low word specifies which service
: S$ R+ d6 V$ b$ y3 ~2 G: B                             (VWIN32_Int41Dispatch), c" h& G5 F  g2 P0 e
   call  Kernel32!ORD_001  ; VxdCall5 O+ [! n3 c& X$ c& d
   cmp   ax, 0f386h        ; magic number returned by system debuggers3 \+ [" Y! X* W& o
   jz    SoftICE_detected& j$ e3 F8 h/ F. B

) ]- d1 ~: ^7 q5 iHere again, several ways to detect it:( d6 V4 `) W/ {  A, r; n

6 @4 S! v& _* X) {( Y6 F6 b2 k    BPINT 41 if ax==4f" N4 ^1 l' |2 W4 |3 _4 t" q" C

+ {2 |1 ?) B$ q- |0 @    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one- h/ \) d2 B; T% q  A5 U$ y* s

6 U/ \/ H3 k) U+ E6 j" k    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A9 D- w) }" K# u

+ l2 w% s  z  G9 H& A4 r7 Z7 h    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
0 t0 v! ^5 a' v6 a4 V$ E
! q1 t1 S3 R3 m) S' E4 f__________________________________________________________________________6 x5 R9 l+ Z% p, g' H* X
9 s" L7 m" _+ k8 a! z- m/ d
Method 13+ R  Y! F4 @' h9 R; ^$ Z
=========3 D  M4 |% r+ i
8 \" B" s! O3 R& h
Not a real method of detection, but a good way to know if SoftICE is" x9 Q- o% k# ~& R3 N& S
installed on a computer and to locate its installation directory.
1 _$ q  W" P6 P  i* iIt is used by few softs which access the following registry keys (usually #2) :
; D4 B( q. o" H) V- b
8 @) i% T! I" ^; E-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion$ o1 B& g! N0 _. _6 w
\Uninstall\SoftICE
, Y: Y& O( Q* B4 T' C# `' o6 _) P-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
. b- j% d4 B/ V$ Q/ A: K-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion2 M1 ~6 u6 X, Q
\App Paths\Loader32.Exe
0 e. w: }$ W2 A, B- M: e$ R
% n& q' R7 h& ~% e  `$ u5 Z# P  c$ x8 y3 W# t
Note that some nasty apps could then erase all files from SoftICE directory
/ B% g6 R' G& j8 D(I faced that once :-(
6 C8 _- [* S3 K" `0 U$ C: X0 c/ Q, g2 a( v! Y' ?; m
Useful breakpoint to detect it:0 r8 U) O, x! h0 }6 j

* s/ p. ?( ^2 h8 S2 I     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'- V. e  F1 a$ L* K
, b; ^0 Y- Q- P- a
__________________________________________________________________________' ^3 c! E- ]6 r* u
3 K2 r7 ^9 h1 {

& q3 e: ]) U# c/ a- S, |Method 14
6 f: M) p; ]. ^( d8 M1 [  A* S( J=========
  z8 q: G/ U, K* ]! _4 i
5 @5 v; H, v* a# l/ _5 q5 Y6 \3 aA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose9 s/ a! ^+ N  a3 |
is to determines whether a debugger is running on your system (ring0 only).5 [0 R8 P. J) [# M

  M7 c' d9 E& B( i7 v2 I+ b   VMMCall Test_Debug_Installed
: P$ Q' j, G- [) ^. M( @) M8 b   je      not_installed, g' `: c$ Q5 T" J
' B: ?' q+ x7 y8 n; ]
This service just checks a flag.
: X7 r; N# }" n; p</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部