About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>8 Q8 r  r4 ]1 G
<TBODY>6 ]3 b- \* w5 @/ n+ w0 V
<TR>
# F# P9 N. |8 H& W( P<TD><PRE>Method 01
" k7 x2 U6 D  S. G, h8 T4 Z, ]=========# H1 p1 z4 N# U' ]

- x! y( E4 U, MThis method of detection of SoftICE (as well as the following one) is
5 u* V; z9 U; _( |* |! |used by the majority of packers/encryptors found on Internet.4 b4 P+ j4 Q& p
It seeks the signature of BoundsChecker in SoftICE/ K- g" |0 _4 Z9 w

5 A6 W- H) d9 }0 r$ z0 {    mov     ebp, 04243484Bh        ; 'BCHK'
2 V* t4 q8 u8 L6 I: `    mov     ax, 04h: y+ Z% w$ a3 x
    int     3       % E+ a3 l, Z+ ~8 j5 c9 [1 @0 G2 h
    cmp     al,4
: t% [6 R/ ?  k  g( J- l4 C    jnz     SoftICE_Detected
0 a' ], K; K! J5 B' K
( N7 p- y/ h1 r: Y' v; p___________________________________________________________________________
( q. n+ Z" u+ `& b. O, N0 p5 q' G- t- s2 _
Method 02
  x- U% w. z; o5 e0 K=========( F; [$ F- {7 J$ K( X6 Z! {) V

: J7 ~0 K/ [& W$ hStill a method very much used (perhaps the most frequent one).  It is used- v+ q: M( @$ `$ N; P5 }( R2 D+ r
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,' ~8 Q4 W0 v# l* G" p7 \, n6 i6 H1 ]
or execute SoftICE commands...
% e$ E, B' D: _7 s9 n; aIt is also used to crash SoftICE and to force it to execute any commands) Z+ Q. X" U- `) K; U6 t+ p1 ]
(HBOOT...) :-((  * w' `  ?" f7 ?. g. O1 k, G
$ [- m9 A; @+ P2 T0 K" Y* e
Here is a quick description:7 {. X/ }1 C3 i1 \
-AX = 0910h   (Display string in SIce windows)# z4 L  a$ z. g. P: N' c, v
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
. l2 U- }$ }8 s* g, V-AX = 0912h   (Get breakpoint infos), ]7 T. N* N/ x8 |+ C
-AX = 0913h   (Set Sice breakpoints)
7 [. ]& m+ Z/ B; H' A-AX = 0914h   (Remove SIce breakoints)
6 l1 M& X5 B% m% R- l" I
0 @& c- o7 s. |5 ^% rEach time you'll meet this trick, you'll see:
" v/ T8 k- n- y$ `; o; V: Q0 c3 b-SI = 4647h
  [/ e; ]( l# p$ Y3 Z-DI = 4A4Dh
/ H/ S3 T; w9 r: B3 iWhich are the 'magic values' used by SoftIce.1 M% h/ ?8 H2 u
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
* D8 I0 q: P& D; y1 S& \4 A8 Q, M  u4 O* E: [* L
Here is one example from the file "Haspinst.exe" which is the dongle HASP! J* ^4 u! D, ]$ L8 P4 j2 j
Envelope utility use to protect DOS applications:' `8 P* U' \5 x5 r" v& R) m$ s( x
" i9 J$ h, E) D- v5 h) I7 W/ W( y3 u1 t
$ T) [; G5 i# F6 |. b: i
4C19:0095   MOV    AX,0911  ; execute command.* ~& B# K8 g* q3 B6 o# M
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
% w+ x  G2 R& V: k! @" ]" y4C19:009A   MOV    SI,4647  ; 1st magic value.& j3 H: w1 v! {, O  Y# G
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
! c  g; K# z" f" y$ ?4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
# ~0 F1 K$ C; m0 v4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute) T% f5 Z! Q3 d# U  r% @
4C19:00A4   INC    CX2 Y2 K) j% u( ?
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute$ r7 v  T5 u4 h/ \" d
4C19:00A8   JB     0095     ; 6 different commands.' l6 X- X3 z/ R
4C19:00AA   JMP    0002     ; Bad_Guy jmp back." y2 i9 {3 Z/ r& J% \: n
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
! w( x* z1 t( f  H0 [' S6 X0 K/ o, d0 m+ j7 \6 _
The program will execute 6 different SIce commands located at ds:dx, which
+ A& d* O: J. J" o' @. h8 ~, Aare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
/ [- l5 t( a- i6 I( Y3 \8 h. d( V  t' t3 a# f# J0 b7 q
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
1 s- L; x9 z  w6 u___________________________________________________________________________2 f, G3 f2 x6 _/ f% t- B  Q8 F. D* ^
9 T* Y6 }2 b* L% v
6 B1 Z! @* ]" R7 e# M) F
Method 03
/ Q. H( A8 ]7 k0 p3 e* `=========
; E0 u# ~$ L7 \( Q1 i% p9 x: s5 |) O0 w: d& n: t
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
1 ^* Y. ^/ s& f# j(API Get entry point)0 W1 ~6 p* w6 Z% a) k" O
        
$ _  C; ?% J4 q4 x
$ p3 ^+ ]7 @* i) C1 ^2 p    xor     di,di
: u0 u% o$ G  n* [6 g5 p* v    mov     es,di% w; ^- J5 T9 g) n4 u
    mov     ax, 1684h      
! Q6 B& N+ b8 w- b& ^) J' r0 \4 A+ f: q    mov     bx, 0202h       ; VxD ID of winice
+ l* u: B7 L' T. j6 Y  H    int     2Fh8 {8 N  x0 v4 c9 ~5 n. \/ M
    mov     ax, es          ; ES:DI -&gt; VxD API entry point) z5 V2 }6 n! L
    add     ax, di) q! f. I3 }1 t5 A' `4 D
    test    ax,ax- I  a4 F- z5 q: K8 q9 q- Q/ O
    jnz     SoftICE_Detected2 z' X- _# o5 M/ J

0 ?/ [( F* i, r5 j  p! b___________________________________________________________________________! C4 _& Y' p0 r$ J

7 A1 P0 x+ }( s0 CMethod 04
- {4 ?1 q$ k/ m7 H=========7 z  X0 C( c! M: _! ?
8 \; n" \/ r$ L1 N# f7 T
Method identical to the preceding one except that it seeks the ID of SoftICE
/ X2 N7 D4 s0 ]1 U6 }$ JGFX VxD.
) K- f& S2 S" l. W! t
3 `) v% Z1 U2 S, F% P9 [    xor     di,di
. f# ^0 @/ P. \! [* V' A" e) O    mov     es,di
$ H! y, C' M; ~9 l) ]    mov     ax, 1684h      
; G& [4 w# ~+ V; M: G    mov     bx, 7a5Fh       ; VxD ID of SIWVID
: G* X& o! z7 w3 \: T& y    int     2fh- P! M) q0 F4 H6 S  K. O
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
* Q0 F6 `  d! L' x0 e    add     ax, di
: _1 z2 U0 i% Z9 K6 y    test    ax,ax
3 ~/ O$ W, P: D- h/ o6 l% N2 y    jnz     SoftICE_Detected
) `; C6 J+ J& z( V8 h
1 f2 D; k5 e2 [! Q__________________________________________________________________________" x- @) g7 d5 U8 |1 w* r8 u- x' {$ u

9 \  [% s1 @/ k9 \
. |: k+ Z6 R4 M; P. A! \7 D6 PMethod 05
- T7 T3 p0 Y% I3 v=========
1 U5 f( c. V- U1 C0 R! F5 |, H7 `# e+ V! ^5 u% @: Y$ G
Method seeking the 'magic number' 0F386h returned (in ax) by all system! E" ~) t! Y, J; h; S+ \  U$ Z9 W
debugger. It calls the int 41h, function 4Fh.
6 I& p) c: Q3 [: e) OThere are several alternatives.  
5 N2 S2 T% P$ n& j
# T2 }" I  A: E( s& lThe following one is the simplest:5 q& j( d' Y; _' l0 i

$ Z+ X) `+ ~* Y: V2 b" W: m    mov     ax,4fh
" ^6 x; `2 W! Y  y2 y7 [2 ~8 E; {    int     41h+ @9 g7 ?! O. a
    cmp     ax, 0F3864 t4 W$ U- G$ h5 ?- p
    jz      SoftICE_detected4 q- k  l4 c5 j# a

7 r4 s3 A7 D& w+ `7 l2 O
- h9 X' [) ~, J" l" M5 \Next method as well as the following one are 2 examples from Stone's & B2 R2 G: K3 N9 w, O( ~
"stn-wid.zip" (www.cracking.net):
) q6 L. g' Y% X8 ?5 C9 [2 d- C( T. Y+ Q% r
    mov     bx, cs
0 B' A  M5 V4 b    lea     dx, int41handler2
4 b- [. K, k  S$ c1 W9 o5 I    xchg    dx, es:[41h*4]
% `( X) W) l2 R/ |, X; |  f    xchg    bx, es:[41h*4+2]* F2 C6 [  B/ a; ^( M( H3 m- ~. M
    mov     ax,4fh
) h6 w& O0 B- E$ I3 L2 b    int     41h
, m/ m/ b! ]5 z$ N) [7 ?6 {    xchg    dx, es:[41h*4]
( M+ R4 ?" G; T; B; x    xchg    bx, es:[41h*4+2]* U3 }. Z& V6 z1 U0 [; u
    cmp     ax, 0f386h
: E- E0 o1 p+ {+ [! J5 j: M- ]    jz      SoftICE_detected/ _$ i4 f) ^* h- b
+ P) r) F) h. X8 Z( c
int41handler2 PROC
" q5 i( P5 a- T' q2 ?    iret
9 J! m9 z7 C- A& O! yint41handler2 ENDP
8 ]1 X4 G$ T3 a/ J5 C! Q
# P0 F$ g! R+ v# V. w; M+ j9 X* q7 B
( D: B) D, ]9 V! {# \% J_________________________________________________________________________
% Y6 Z4 q" s: s; J3 @# U3 ^( t$ M, X) q1 {' S* i
5 c0 ~9 {* Z) ?$ H  B
Method 064 ?9 n$ `. A. d! `3 D
=========5 A& ]+ i- s( V7 J
7 R# G: W! Y" @5 g4 n0 g

5 e+ g6 E1 r- c" M5 E" R5 w+ |, \- G2nd method similar to the preceding one but more difficult to detect:+ |: n3 t+ `; K9 h5 O

! b4 L0 P' g6 j( e' c+ Z* a) s: D. Z  f/ o3 a" f
int41handler PROC6 u' \( T6 A1 T
    mov     cl,al
3 n! E& L, f) G- i' z! o, K    iret
$ p" u: E+ v: f3 N( n. n- V1 ^  yint41handler ENDP
7 T) m) ^' V- r3 ?+ r2 j& j. I6 Y1 ?# h$ ~& W
2 Q* d( o7 H) q* y2 M
    xor     ax,ax
7 n7 x# T+ |' b% X    mov     es,ax5 m; u; v1 Q) f& ^( v. s0 g1 }7 z" ^8 x
    mov     bx, cs
3 f' d9 g1 P! i+ l    lea     dx, int41handler
; B  b2 k4 \$ v9 V" Y# ?6 [5 }    xchg    dx, es:[41h*4]4 f& ~9 d5 }, @2 L1 d
    xchg    bx, es:[41h*4+2]
* ], L& J) A1 t" s3 G    in      al, 40h% i2 x7 h! [! w( p; y' M/ w
    xor     cx,cx+ O" V" O- W! `+ G. t9 J9 C
    int     41h
; q/ c5 w8 H1 t4 U" P    xchg    dx, es:[41h*4]. c- h- J: N/ D1 W2 |1 E' A% \" F
    xchg    bx, es:[41h*4+2]6 E$ i  s6 p  A- V  E; _& K! @( r
    cmp     cl,al2 U% c8 k. U% |+ x) K6 [
    jnz     SoftICE_detected
  e* `. L: o, G. P8 J5 M+ }  d7 t% a, Y& U4 b' u* g& k- {/ ~* ]2 z
_________________________________________________________________________& j% P* V; e/ U4 @4 |5 o# g

# e$ d( n$ E( |* k0 @5 kMethod 07' u: Z1 T# T% v) V- |7 B
=========5 J" `+ k7 m2 N( m( w: W9 v
0 }4 O. a# D, O/ l: B" Q6 j7 ^( w  A
Method of detection of the WinICE handler in the int68h (V86)& T- j, V& P+ k: f! L4 _2 x$ [
. I, X. M. o0 x; i2 v* E) a/ E' N
    mov     ah,43h
, e4 K7 a( F8 X$ e. D1 W    int     68h' S9 s$ P5 Q1 I3 |, _, R8 G* k
    cmp     ax,0F386h
! g* D# I) T% D( f, s    jz      SoftICE_Detected8 o6 c: a( X: N- }# `' _. D3 A5 n

+ I7 f9 F, n6 i  v, N
9 A9 |* w$ D0 P( k: J=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
  \4 K+ Q( D1 v# ^% \   app like this:
+ b. M- _8 l8 ^0 T& S9 Z2 B9 y8 W3 P6 g3 |" A( X, ^: n. v
   BPX exec_int if ax==68
8 M, j( }6 Y% O% T3 g! L& C4 j( d   (function called is located at byte ptr [ebp+1Dh] and client eip is2 t9 G5 h" Z7 S) P. l  m( E& X# P
   located at [ebp+48h] for 32Bit apps)
+ T  C( n! F6 t- i9 O' O* ?% l__________________________________________________________________________/ A& l& _0 p( W9 C, g

6 H! }; \4 X6 N: Q4 T
( T5 N9 k) e2 r1 ?) QMethod 08
  s, g  W9 X" Q: v- T! E=========6 v1 n- a4 L) L
$ g0 d% z0 K5 U
It is not a method of detection of SoftICE but a possibility to crash the6 z& y9 G0 m, M: @
system by intercepting int 01h and int 03h and redirecting them to another
: v2 \  }% q6 j3 f, Z9 M2 A9 Kroutine.
2 ]1 B% \- w/ l# i! S. ?It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points, v9 b  ]( N1 n5 c" x2 u$ |
to the new routine to execute (hangs computer...)
; I& ^+ t" L8 e$ E
: k. m2 @) I$ m6 Z. F! O; }4 `8 Y    mov     ah, 25h- I% S. u0 ?3 _1 q1 q! @7 }
    mov     al, Int_Number (01h or 03h)! z0 U( |) w  L; n
    mov     dx, offset New_Int_Routine
% V& v$ F6 \, T& ^    int     21h
8 B$ G  I  E" |1 z$ v' E9 E/ A# g( P8 s1 h1 X, e3 C# O
__________________________________________________________________________& e8 T/ S* ]# U: u; e
/ b5 \# p# I% l9 K
Method 09
7 f0 G) Y) n3 y# C=========9 M" A6 s% {+ ~5 M2 u) m' v1 y

, t. x  \9 X/ @7 ?+ Z6 A7 l: N+ ?8 OThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
! w5 u' Q0 @7 `# O$ t, m; cperformed in ring0 (VxD or a ring3 app using the VxdCall).
7 L* K8 u. l0 R; C& dThe Get_DDB service is used to determine whether or not a VxD is installed6 M, _4 [7 K: y& T  G! _
for the specified device and returns a Device Description Block (in ecx) for
4 f. w% D& O; A" P2 C6 K. othat device if it is installed.  R- A9 j7 H4 `) J! y$ A
! U" I5 r) n# l+ U2 I
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
% S. O/ k9 E" h% s* y, k   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)1 K+ B( r6 f- g) M9 D8 r
   VMMCall Get_DDB( v  z1 }& `" E
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed' [( T  i8 T- t. W

8 @0 P$ ?2 E7 Y( H+ qNote as well that you can easily detect this method with SoftICE:
' }; W, V5 M9 P- x# P   bpx Get_DDB if ax==0202 || ax==7a5fh' i& h, N, \/ `) i! u) f  U

. F- f. S; i* p' i2 c__________________________________________________________________________  O7 [2 ]* L% n- ?1 [9 ]* U. X0 @

8 W, ?( k; ~8 O. nMethod 10, @6 u0 t9 C6 V! ~% G0 x5 j' A
=========
; p& ^0 V2 u' d7 o6 M
6 ]  D0 G( z! I) B/ V! ?: m=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with( D' ~, U+ `+ `, g) U9 o
  SoftICE while the option is enable!!
7 E5 D8 D) o# d& e
% Y5 p; |9 L- v+ f4 z! V, IThis trick is very efficient:
3 ?+ h: U$ G; [/ tby checking the Debug Registers, you can detect if SoftICE is loaded
$ ~# T  `- t! E: }(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if9 _: t4 z: {# X$ f$ _
there are some memory breakpoints set (dr0 to dr3) simply by reading their
! b- Q  [. k8 I1 z  ^value (in ring0 only). Values can be manipulated and or changed as well
$ R/ s* g8 |7 A9 N0 m$ E(clearing BPMs for instance)1 l8 \8 y* M; v" f4 J- A& n

. h; c0 a1 a) ]8 C! {# y* H9 t( r__________________________________________________________________________% C* C' V+ e: u4 L

' T2 ]. O$ Z$ AMethod 11
0 [) x( l9 |% B( {# [=========
0 K& r5 O2 h) o0 H7 [- `- q7 a
/ ]- q3 O6 [  ^2 {! z1 ZThis method is most known as 'MeltICE' because it has been freely distributed3 Y+ T# E. _2 l
via www.winfiles.com. However it was first used by NuMega people to allow
0 \+ a% c! W7 @$ a) {Symbol Loader to check if SoftICE was active or not (the code is located
6 h" ?4 L) e" |inside nmtrans.dll).
: H9 N' C9 Z. X7 ]0 P/ ~: w0 |1 I  L6 V& D
The way it works is very simple:9 R" _* X/ \+ x/ w8 P7 r
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for4 C( f* d0 V  I$ _4 l# U
WinNT) with the CreateFileA API.
& {. w) t$ n7 F/ V$ z2 K0 `$ R+ d+ u$ ^; }( S0 A  B  R0 o
Here is a sample (checking for 'SICE'):
7 C' V9 G4 l; Z# ]9 U( w
- S. T& @+ T9 p+ F5 sBOOL IsSoftIce95Loaded(), g2 m/ K# x% d/ O8 u/ v
{8 R. ^, g  J: t2 C0 V
   HANDLE hFile;  : w/ p& P( C) A% Q
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,5 u' s* _; [8 h3 j: w; ]& Z8 I0 `5 _1 H
                      FILE_SHARE_READ | FILE_SHARE_WRITE,
& Q) r8 z3 l1 _0 m- C                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
1 Z4 R! ]& x! F0 w# K2 v: ^' X. n- k   if( hFile != INVALID_HANDLE_VALUE )
, Y' L; ~- I; u% Q( i# C6 R5 ?& {- o' O   {, I1 g. s: z9 {  Z
      CloseHandle(hFile);& @5 B* L- h2 J" X  ?, b& x$ B$ O
      return TRUE;
% E' I/ `( |/ t" Y$ |2 O5 \   }" V) E+ h# B3 S' F) X4 u
   return FALSE;
8 d) ~- c+ g. X6 Z: z$ G}
5 g6 t6 O* C. k4 }  J9 S+ f4 Q" }3 h, j( y3 h; B6 g& @$ K/ X
Although this trick calls the CreateFileA function, don't even expect to be
' n5 K! I4 J( Z! `6 G( |3 ~4 qable to intercept it by installing a IFS hook: it will not work, no way!( f* h, _7 v0 _- g
In fact, after the call to CreateFileA it will get through VWIN32 0x001F# T3 p/ v& P, M1 C& h, m
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
* I" F- p( U1 Qand then browse the DDB list until it find the VxD and its DDB_Control_Proc1 R6 r9 H* F1 z  M- X
field.- p* V% x8 V; \8 g
In fact, its purpose is not to load/unload VxDs but only to send a 2 \) k( s1 e% ?% O1 S! ~7 C$ q
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)% f2 t" r  l' t
to the VxD Control_Dispatch proc (how the hell a shareware soft could try- i; |3 O- u4 }( h2 R# i
to load/unload a non-dynamically loadable driver such as SoftICE ;-).% T/ j, Z; `  u
If the VxD is loaded, it will always clear eax and the Carry flag to allow$ F2 c( m3 X4 y, O6 a
its handle to be opened and then, will be detected.+ W/ Q6 i; \# _. B3 m8 j" e
You can check that simply by hooking Winice.exe control proc entry point
) i5 U- p; p9 N# }6 t9 N: S0 z# Ewhile running MeltICE.4 n" I4 |' G" r6 n; n  n

1 z3 j9 T! w3 I& p) T
' E' j) n3 K1 I$ B5 v: k+ A  00401067:  push      00402025    ; \\.\SICE
4 _9 u4 `5 a, h  0040106C:  call      CreateFileA
7 {# J/ D* X2 `/ E; G- }. Q  00401071:  cmp       eax,-001
4 e. ?5 \) F4 M  00401074:  je        004010917 d* _* P8 ~2 D  C9 C8 b& `- q
) F  P  _, [; ^  Q, ^

! d( ^3 c3 G, v' `There could be hundreds of BPX you could use to detect this trick.
2 n2 j6 p9 I( T5 l-The most classical one is:+ P; t& b2 b# s$ h. R
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||% {6 E# `4 [: c; ?& D
    *(esp-&gt;4+4)=='NTIC'
. n& \  L' w4 |# n1 Y
. {% B% {7 s' H- f-The most exotic ones (could be very slooooow :-(/ O  V! a* J" W
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
6 m' c) i: k6 T3 {     ;will break 3 times :-(9 E% T* U3 }" |& Y
4 G  Q' V3 a- {3 T
-or (a bit) faster:
; F$ Q% ~. ?- \  Y# T   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
1 s& ~0 a0 `. a$ R; s: c: r; @- Z- o& @6 z
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
" ~( R. S) ]2 z, @, ?1 r     ;will break 3 times :-(% O6 v2 Q2 Y3 h+ p* \
! {! V0 S% E' r; x' s
-Much faster:
9 W6 g+ Y) p# ]  i' k+ Q1 Z   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
! h* p6 m4 X- ^8 V
. T, v& f& [" X2 bNote also that some programs (like AZPR3.00) use de old 16-bit _lopen  h- g: o+ z6 u/ |- k! W  G
function to do the same job:' d. W1 r. C. ?& l# s( x

3 H* i# v6 e+ j0 I   push    00                        ; OF_READ; |' d3 @9 i' A, w+ ]. e
   mov     eax,[00656634]            ; '\\.\SICE',0: i% O# C3 i9 @- J/ C) J7 ~+ J
   push    eax
! D+ r( g( u8 z; k- X& [   call    KERNEL32!_lopen7 n$ W6 W7 {" G0 f0 ~1 N- X+ G
   inc     eax4 c" `# |' B# c( ?
   jnz     00650589                  ; detected) [" r$ o' M, p
   push    00                        ; OF_READ
  G  {' a8 y; ?8 l+ y( q* |1 A( g   mov     eax,[00656638]            ; '\\.\SICE') |# f/ `1 U6 C7 `4 L. Z4 r9 |: E
   push    eax  K. T0 u9 U$ L
   call    KERNEL32!_lopen
3 j! W( R9 y# s9 g1 B   inc     eax' P! t- T2 r2 x1 S
   jz      006505ae                  ; not detected
8 T8 ^: |3 w, n' }4 |
/ C5 g- O4 v. z4 b2 _. V5 e- i* A9 r
__________________________________________________________________________1 \9 {( x& K6 N
( l& }& D0 s- H- \6 n
Method 12% G/ j+ {1 z- z
=========# T$ ^4 M. \1 I3 s6 t7 u4 w+ _: V
* R3 B7 p, H$ X( N
This trick is similar to int41h/4fh Debugger installation check (code 050 T, d, i; d0 u& _* S7 K* s
&amp; 06) but very limited because it's only available for Win95/98 (not NT)
7 y& O5 ~8 |1 @$ E' v& s6 `7 {1 Zas it uses the VxDCall backdoor. This detection was found in Bleem Demo.
, D( i% T7 Z  k2 M! x2 g1 P& e2 w8 Z, ]) A" p! M- w2 P
   push  0000004fh         ; function 4fh
; E" @. a% F0 b   push  002a002ah         ; high word specifies which VxD (VWIN32)  b9 W$ c: w0 n' S! A, v/ {; y7 {6 x
                           ; low word specifies which service
# ]0 F0 I: |! c" @. A6 O5 I                             (VWIN32_Int41Dispatch)- z# ^1 S) E/ R1 r! ~5 l8 i9 E
   call  Kernel32!ORD_001  ; VxdCall6 V8 c. E2 @' Z) q, f$ {
   cmp   ax, 0f386h        ; magic number returned by system debuggers
4 C* @- j) ~6 \2 H, d5 e  `   jz    SoftICE_detected7 E: I  x+ [5 P2 c( e* P$ s& I
" o/ `% L% V4 b) J6 M
Here again, several ways to detect it:0 |! V; e, w, M5 p. M
$ b; y, y8 W5 u) C( y6 x
    BPINT 41 if ax==4f
5 U2 F! ?) C1 B' o; B8 q$ W$ b  \+ l& z1 e% R7 E1 w
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one5 b9 D- b7 f- N  {7 l+ v! p

4 i& D( B5 r& Y& ?    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A$ h$ k9 G+ R7 O- H1 \

- c% C; p" f" O$ Q  w; d$ i    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
3 p) @3 i& k; g/ J$ a' t7 D$ Z% Z: A/ O# x( _) u  b6 I
__________________________________________________________________________
* b5 x- r2 u1 d0 |. J. P3 O6 H: m8 s+ X) Q
Method 13
% l' X. ^- |4 z- C=========
, S5 F8 `0 J" _7 y3 E: C# k+ Y
+ H4 k0 a" ^. p7 f' h, F. l* |Not a real method of detection, but a good way to know if SoftICE is* ?) z8 K) G8 d: ]4 l& Y
installed on a computer and to locate its installation directory.1 ?7 }$ ^2 b' B8 T! ^
It is used by few softs which access the following registry keys (usually #2) :- I4 `7 O9 K* J
  ?1 z  c/ U' H* k' \
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion2 \  s( N* E% M% i* T
\Uninstall\SoftICE
6 c2 |' A+ g. R' a1 W-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE" @; H9 \- ]: r- ~' |
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
$ _: E( v3 l4 L$ [# j: j* r\App Paths\Loader32.Exe: n1 Q- K0 T  z  e

  @+ v9 Y$ e) @; z$ _5 u) o0 B4 T$ Z# g6 s2 U
Note that some nasty apps could then erase all files from SoftICE directory
5 O. Z1 z0 u- P  u(I faced that once :-(
! p% S8 F7 @, N) U* m" J3 C, G! v. K+ {5 }, J
Useful breakpoint to detect it:
! m0 l) G) c2 G) s) f- p9 q3 R* x3 H! T
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
/ Z& B* P) `$ L# _
: r6 H( T6 g+ q( L8 V4 ~! i__________________________________________________________________________
" o, j) w: [' S) X  e/ t' q& O* f6 Y8 ?+ Q+ j' S+ V' a
5 C3 J! z; W8 F6 ?: L) {) w
Method 14 . q8 I& W& p% p
=========' F% ]+ A/ I- i! c
7 i, b8 T# z$ w( U
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose3 Y* w8 ]7 I* a- J# I' U: J" x! d
is to determines whether a debugger is running on your system (ring0 only).
1 v$ o7 S" e, h: X6 ]
6 @9 u/ g. w  _( N- Z! I0 R   VMMCall Test_Debug_Installed" @0 w: @( X& [! m* k9 B
   je      not_installed0 t. C6 W/ K8 t5 o! w' ?
! Q2 w0 T% K9 T% B9 I2 K6 }$ L/ u) M
This service just checks a flag.8 \1 e% e: f7 Q) n  g* m0 ~
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部