About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
  v/ p) U8 A& o! {# _% Q<TBODY>6 K9 B; x  n& v: r$ y3 J" v
<TR>/ r; D" ]: Z. t) o) \) c
<TD><PRE>Method 01 $ |" U9 d9 |9 N* H
=========
) b) T- Y' }# I- `; ^5 V& A  |
% v% X/ Y1 ~9 jThis method of detection of SoftICE (as well as the following one) is8 w/ f; A  A4 c* Q
used by the majority of packers/encryptors found on Internet.% E5 ?3 y0 w# D  Z
It seeks the signature of BoundsChecker in SoftICE
% d) n( D# m% ]2 W" m+ z) Z: ?& t
% i9 G! K/ [% A    mov     ebp, 04243484Bh        ; 'BCHK'
6 o4 U- o! X, s2 {: V: p) s    mov     ax, 04h
7 S1 a$ h! o) x3 ~1 C3 w$ |6 u    int     3      
/ y, E3 [+ O, D8 J; q    cmp     al,4) p/ p# f( W) D# Q4 s
    jnz     SoftICE_Detected
: w" m" H  L8 i! `2 }; i, Q
4 t" ?; K$ D/ o8 f8 w___________________________________________________________________________8 l4 X* F. q0 q+ c3 [
9 u/ o( @5 s# g. u2 Z
Method 024 x4 ~( j& J+ }3 ^9 Y6 r
=========$ }$ r/ @% }4 P5 g5 y& L

% u1 T; u0 T* q3 m6 JStill a method very much used (perhaps the most frequent one).  It is used7 _; j9 ^  b9 L7 Y7 Q6 U$ m3 }1 V
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,, i0 j$ [+ @/ d7 v. ~
or execute SoftICE commands...0 X" H7 M) Z+ @
It is also used to crash SoftICE and to force it to execute any commands
# h( Q9 r' `  k. m8 B  m% t) v(HBOOT...) :-((  ) U- _- }5 B- D2 {' r  N
7 o1 R; o2 B* `- I; s
Here is a quick description:4 `3 y/ B0 {0 U2 c5 Y- {  L  O
-AX = 0910h   (Display string in SIce windows)
1 T1 t+ U, [5 q1 `* J1 B-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
3 O0 p( A  u+ h( l-AX = 0912h   (Get breakpoint infos)5 H; p! \9 N8 m5 K  N; K$ M- I
-AX = 0913h   (Set Sice breakpoints)
7 J3 i+ F$ ?" |5 o$ x& D8 \-AX = 0914h   (Remove SIce breakoints)
( Q  l$ J6 |$ i% U2 V1 U) e9 D6 B! o% ]7 S% F
Each time you'll meet this trick, you'll see:. u& W& w) P" O
-SI = 4647h9 ~6 ^, x% Q6 {# _
-DI = 4A4Dh- W# D2 s2 c' _  M  V
Which are the 'magic values' used by SoftIce./ K3 f) B" V/ u/ d6 d. M
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
. a7 d2 y' J7 u% m+ L( `  i. S
; _: H; Z5 F9 z8 X( k* ?8 k8 }Here is one example from the file "Haspinst.exe" which is the dongle HASP
8 H6 @/ m2 }; B1 XEnvelope utility use to protect DOS applications:2 w8 V" r6 c- Z- N7 f2 E! W

3 K0 }! g; q! T1 L. N& ~
9 a9 ?# j8 p6 \& `4 z+ u4C19:0095   MOV    AX,0911  ; execute command.& Y- M! Y% W0 U! q0 _; Q
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
0 W7 @3 z  H7 d, j' l$ A4C19:009A   MOV    SI,4647  ; 1st magic value.9 X/ J, R, G5 I% i' Z7 N, K
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
) F9 [5 J8 m( _4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
$ O! X/ [) p- I3 ]4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
$ C: I# i) ~0 B! a6 c# Q( R$ }4C19:00A4   INC    CX
& |' M  s7 X3 B- l0 \+ e4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute+ A7 v7 o; B/ @% Q
4C19:00A8   JB     0095     ; 6 different commands.) h$ A/ s4 j2 E# U/ _5 g
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
0 z/ B" n2 J- @/ g7 Z5 \7 T4 W9 S/ ^4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
& A# Y' k6 h. H
) c1 ]* Z6 ]* {The program will execute 6 different SIce commands located at ds:dx, which: @" E% l: G$ D  I% s5 w3 K
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.* E: w3 S, p* p8 v# T8 R. d8 k

9 |/ w$ s( w3 X: v8 |6 _4 s5 P* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.: T! t7 _1 b" f6 T! O0 U
___________________________________________________________________________9 j; u/ g) i5 X0 B+ X2 _
; C$ U* g  A* ?0 r( N

7 j1 h- v7 C1 o7 E+ }Method 03+ }; ~( j6 W3 G2 |  d; c. G
=========3 ?# q  T& Y' C) \+ N; `
" x( V: N8 s5 {. d) p: a
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h- S0 t) B. v! D1 o1 A6 ~7 O
(API Get entry point)4 T7 p$ a2 g" I) Q7 R: L
        
. ^" A7 r5 |( ~2 V$ f  A
# x; D- W+ B9 K    xor     di,di
6 L$ x! }9 o( m0 n  `    mov     es,di
/ i; d6 ^, P8 p% e" }" e( v    mov     ax, 1684h      
( N, C* ^  C& D0 j, s$ H" A    mov     bx, 0202h       ; VxD ID of winice
7 j6 j; P3 r2 ?    int     2Fh
4 e2 h" {5 \$ C4 F$ v5 G    mov     ax, es          ; ES:DI -&gt; VxD API entry point
, ]" m1 @1 m3 J& ^    add     ax, di# g6 X4 p% i4 s$ j' k+ k
    test    ax,ax' t% t  W! @& `+ ^& F
    jnz     SoftICE_Detected7 o) O4 U5 B1 F  P* z* o% V' v2 S

' J5 L, r/ k& `# i% w___________________________________________________________________________3 X  e) m9 [5 ^4 ?- ]

5 p; i4 H  i' O, l2 ~" E5 RMethod 04! q3 N4 f% T3 ~) x2 Y% z
=========
2 j! c' [( [5 I! h) M  b: m8 q& V) t6 V7 t
Method identical to the preceding one except that it seeks the ID of SoftICE) R( c/ V6 K0 U7 K* {, a
GFX VxD.% k& `) N5 m# f. b- K
' a: a7 v! @/ d0 f( E3 ^
    xor     di,di; ^% G- u5 V) Z# }: u6 w* m- O" s
    mov     es,di
# b: c' p6 Y0 x  H) Z    mov     ax, 1684h       ) s) |6 L2 S1 I2 C! j# B
    mov     bx, 7a5Fh       ; VxD ID of SIWVID1 _- c* @% P" b# ]3 I
    int     2fh4 V, b/ J9 t9 ~7 y" V/ l4 t
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
2 t: r5 |+ s$ z    add     ax, di! N/ y' I, X5 I) |: n1 x
    test    ax,ax! [+ Y6 v3 E* }$ }# K
    jnz     SoftICE_Detected. Q3 U! s+ `- `6 f  j$ Q+ F! s

2 I8 s+ M0 S$ _" V, d__________________________________________________________________________
1 b  a  P$ [4 X- Z  Q7 C+ {. W+ @% A' H4 l

% ~/ D* R- f+ C; l/ aMethod 052 s7 M5 [) ]& o: r1 A3 Y
=========
# t# V+ \' {1 P! N
! Y3 C2 E/ ?8 B: ~4 v8 _/ u- EMethod seeking the 'magic number' 0F386h returned (in ax) by all system
' N* a- t* P% J- Edebugger. It calls the int 41h, function 4Fh.- Z9 ^2 @% E5 Y/ j$ l
There are several alternatives.  : y4 n* D2 M. y% j% [; m

+ H5 ~  k- B2 r* i) c1 oThe following one is the simplest:' ?& g* K6 d. |' u/ C9 a

) h: }4 R; V1 r+ }6 m- m$ V    mov     ax,4fh, o4 V* w( N, W% w
    int     41h# x$ R, o6 z; P' w4 G
    cmp     ax, 0F386  C7 [' x; t& {
    jz      SoftICE_detected
6 S' c" a- z9 e! k- c% K
. Z9 l2 {8 ]; z, m* Y9 `" [7 F- X  [" A0 N* y
Next method as well as the following one are 2 examples from Stone's 9 q* x) S. v. |9 m+ S& T3 ]
"stn-wid.zip" (www.cracking.net):
6 O/ C6 A7 ~5 m  H$ o' v. N: z; X) a8 y; y. G3 H3 T
    mov     bx, cs
' }, T7 A2 |; S) G& I# l    lea     dx, int41handler2
+ z9 b1 Y  I. t6 |( V! G- {# i    xchg    dx, es:[41h*4]+ c! R( k% ]7 l) _3 t
    xchg    bx, es:[41h*4+2]4 }2 T+ g! ^5 ?  N
    mov     ax,4fh" p6 U2 n0 N1 X
    int     41h
' X: J% J4 k" g2 E6 \& q7 |7 L, l% c    xchg    dx, es:[41h*4]
8 x2 e$ O, g+ ?9 _    xchg    bx, es:[41h*4+2]
0 Y0 m+ ~6 d1 p& o    cmp     ax, 0f386h
: o5 }, @" N6 A* P% b# d( `    jz      SoftICE_detected  ^& v$ V2 T: _7 U; ]- I

  Y, K  _+ P/ r5 n, _1 o; Gint41handler2 PROC5 F! E6 g* f. G  O: r, ~
    iret' O7 }  X  I7 M+ E
int41handler2 ENDP. C; H- {- I0 P3 ]+ p  F; e& P/ b

5 i' P4 v6 [8 L8 [' r' N
: E% ?% q# C9 @( @2 h_________________________________________________________________________, v8 G: T5 s' L: P7 E

1 e" @1 F0 P' M$ Y- D* x% J' a
! V9 k& |8 L& I2 xMethod 06" t& T6 m+ ~! B6 Z4 n( G  C
=========
; ^8 m5 z3 k7 U$ n
, G; f  V. z: ^4 ]5 ?' ^6 B$ F( {; t
/ h9 P3 W3 k4 ?! D) s0 l2nd method similar to the preceding one but more difficult to detect:; o; B2 O1 I( i# @' [" D" e

. V% y$ u2 O5 a% Q; h1 r- Q0 G" r" r0 U( C. u0 z- }
int41handler PROC* \: \, o" a6 R0 K5 G9 l
    mov     cl,al2 M! b8 ^9 ]0 t7 t# l
    iret
. K8 _; |& P1 b1 Q3 q: Y  sint41handler ENDP8 Y6 U+ {0 d2 d& z( W: \% J
! _" h6 M0 R. @2 z
& w/ r& D2 ?8 d7 j0 t8 K$ U7 e
    xor     ax,ax" H3 x' d7 b" T  z" N  }
    mov     es,ax
+ P. l& o5 O% z/ W! k    mov     bx, cs
3 _! ]4 z; q, ?# V* D# I( V; _; Q0 K5 q    lea     dx, int41handler
7 E0 k6 {( L! l: K3 \8 g# C7 a6 J    xchg    dx, es:[41h*4]$ }2 q# |* l8 w4 z5 q1 d
    xchg    bx, es:[41h*4+2]
& ^! @/ w# E. k( R' t    in      al, 40h
- S; v2 i2 C0 `8 G9 ?: J    xor     cx,cx. r2 }) P4 K& R3 b' P
    int     41h8 K5 p+ W# R. p) B; T& }; P
    xchg    dx, es:[41h*4]
. h7 v  |+ j5 S& o- \    xchg    bx, es:[41h*4+2]
2 v  X* C8 D' r$ m    cmp     cl,al
5 i$ q6 o; Z5 b4 Z+ ?    jnz     SoftICE_detected
. `9 x0 L. ~. |! F9 t9 O$ [7 ~" r* V$ n, ?1 t. S! S
_________________________________________________________________________
) x  a3 c3 C6 h6 `$ Y- p2 `2 u4 h9 b) S6 C  p
Method 07
' u9 Z/ a- N% t=========, w8 H' |9 L& }3 w; c! D- l0 K
7 j2 t$ O% O' v0 b
Method of detection of the WinICE handler in the int68h (V86)
% ]. a8 A* o! f+ G3 Y5 V1 C2 r) w
  q8 S1 C; y% O; D# \) h    mov     ah,43h* s4 [5 y) A2 @' |- j" {
    int     68h3 L4 P( p, O! N& E8 {" h
    cmp     ax,0F386h% U' D* u( R; T! d  p4 a  ?" |% N
    jz      SoftICE_Detected
% x6 t5 H) f) I
# M: w# h% e1 D+ ]3 {" h0 b
, A2 J) m* D* I4 v7 M=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
# |( F0 ?; N$ C8 ]/ j- I8 A4 |   app like this:
& U5 Y+ A& o6 ]8 C6 q2 [; d
/ \( t- I4 n( D: s   BPX exec_int if ax==68
+ C& G# p7 r/ |$ t# C' |/ g5 O   (function called is located at byte ptr [ebp+1Dh] and client eip is
4 }5 Y# L, e( ~9 }* ~3 S( T   located at [ebp+48h] for 32Bit apps)9 q; u' z% D7 l+ P, O( M4 A# {
__________________________________________________________________________. Y2 ?- b7 J! j; ^$ O
6 m+ L$ U& s+ n: U

! b) y( I- A) t: |& z7 P2 DMethod 08
  o, z2 m2 Z, [=========6 ?: z, _1 I" u) ~

4 m9 C$ U+ t  @" l" r6 h+ x( }0 zIt is not a method of detection of SoftICE but a possibility to crash the
( `$ F/ i( j" N( p, `3 Bsystem by intercepting int 01h and int 03h and redirecting them to another
5 S6 w1 L4 {7 ]& }routine.
; E8 ^! @' r0 n: P# IIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points, |: v6 Q, T8 a7 @
to the new routine to execute (hangs computer...)
$ i$ h. m! A3 u* Y3 ^) `: z; l, i
    mov     ah, 25h8 U- m' b! Y6 L/ K0 W
    mov     al, Int_Number (01h or 03h)
! T- f! L+ g2 Q( e8 _7 ?    mov     dx, offset New_Int_Routine: m  t2 D7 I, l& D/ e3 k) O, D# h
    int     21h
4 k; R8 I# S; t9 y- ~3 i, W0 q" n  g' ]! O& W0 {% g9 F4 m$ Q* B6 a6 U: P
__________________________________________________________________________
' [* _/ E# F0 S5 \) K. l! d9 p, A
3 i/ k# H) K  k$ a( ?$ A, f& [Method 09+ M, j+ b+ A( G) k' M; q# r
=========
1 a. q( m# B) P& B
& @; W7 c, u' w4 |; ~5 [, AThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
1 x9 ]; T) J0 v, eperformed in ring0 (VxD or a ring3 app using the VxdCall).  [: s, q$ A0 L4 q8 J
The Get_DDB service is used to determine whether or not a VxD is installed; n* `, r: q& `4 {3 n% }1 B) m: V
for the specified device and returns a Device Description Block (in ecx) for
2 ^) ?* a* i: J1 q1 J; sthat device if it is installed.: d* ^3 p. e  B0 b8 L
- C0 f2 j  \/ z1 \
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
/ d! ?$ L3 C1 ~9 J   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)( x" F' {$ [5 a7 {
   VMMCall Get_DDB
1 t! J6 S& |& d$ K   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed1 ?) e  s" ]& n+ z. [

2 b$ Z# b, Z$ h5 \' V/ F9 O  WNote as well that you can easily detect this method with SoftICE:
- \- h: }! N, E) r- B2 F   bpx Get_DDB if ax==0202 || ax==7a5fh
* c# I$ Z2 q% Z% z* u
% I! P1 G+ W. O* v9 }8 m6 V__________________________________________________________________________
: f0 q8 {$ Y& J/ P5 o  B: b& r) J# t6 y
Method 10
9 j# t  ?2 w# T* I, ?& O=========# [8 c* M% S* _( {
/ H" S6 Y! x& K4 T5 N! F
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
# f4 t$ N1 O' y2 \9 P1 v  SoftICE while the option is enable!!
+ L! N, s! d- v
# I5 g& \3 I/ s3 D( V% z8 mThis trick is very efficient:. U. a' X6 n! E& [0 S0 _8 B
by checking the Debug Registers, you can detect if SoftICE is loaded) o3 S% m* `. z' |2 U
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if, q* Q( p' ^( x7 p+ h+ `' r
there are some memory breakpoints set (dr0 to dr3) simply by reading their5 C) Z9 o! f* X3 J3 G. s
value (in ring0 only). Values can be manipulated and or changed as well4 G6 D& E$ p, t
(clearing BPMs for instance)% B9 J) x: Z: r6 I. i
' i/ K0 F7 z3 X$ R2 A
__________________________________________________________________________- z* p; V' G3 N* w/ s  O2 @+ ~

+ b( N: {6 K, o1 I8 t6 PMethod 11. J* }% w1 y9 r+ Z' a
=========
" Q8 w# x+ ]9 ~, o5 i4 A* h
* k1 L9 J- V6 ?3 |* W6 SThis method is most known as 'MeltICE' because it has been freely distributed) d, _8 @; r, e( `: F7 @
via www.winfiles.com. However it was first used by NuMega people to allow
: E( a- D5 R7 |4 o% C8 eSymbol Loader to check if SoftICE was active or not (the code is located3 P5 V4 ^5 [5 ~/ u. w
inside nmtrans.dll).
' W' E$ _) o' {5 t2 ^
( a0 m! z' E* h( [& |0 {, J: q& Z+ _The way it works is very simple:
  v! l3 A# E7 y1 fIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for2 N. l6 }9 a1 N
WinNT) with the CreateFileA API.
( \( [  b& M' g
" a" H( z' [( ~Here is a sample (checking for 'SICE'):& I! N3 y8 u  ]% U! @

: @7 I1 a* Z. MBOOL IsSoftIce95Loaded()4 ^9 C3 ]/ g: F: Y, D3 \  a4 X
{3 N" P: e2 I) G
   HANDLE hFile;  
2 T: D& q9 f, Y) ~  h   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE," l, L+ @  C* u+ R+ a
                      FILE_SHARE_READ | FILE_SHARE_WRITE,
% t. Z  Z% M+ m# J3 L3 T9 T                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
* h. Q' k+ \" |- ]: W   if( hFile != INVALID_HANDLE_VALUE )
" f( F1 |  l' @$ p9 d  m. y! w# L   {
: Q9 z4 v3 U, U( ?      CloseHandle(hFile);# b7 [- _( W5 c& }% \4 t% s
      return TRUE;# S8 z3 _9 x* H8 L5 I
   }
2 Q- U$ ^* K3 \; R" Y, a   return FALSE;
+ x( `! d6 I& Y" H7 [}+ o+ {6 T! c# Q! _5 y5 B) R

5 \0 G" r* Y$ g5 q9 p- ^% pAlthough this trick calls the CreateFileA function, don't even expect to be+ R$ a: C1 s) H: C
able to intercept it by installing a IFS hook: it will not work, no way!
& |5 `# q& ~- i- h; T# OIn fact, after the call to CreateFileA it will get through VWIN32 0x001F& R# q' [* D3 Y/ A5 `* ~# Q
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
+ v$ H* E; p4 dand then browse the DDB list until it find the VxD and its DDB_Control_Proc
5 \/ d9 n- [7 X9 c3 g3 ^field.
; t8 `8 m2 n& |* l4 z/ xIn fact, its purpose is not to load/unload VxDs but only to send a
$ D+ k/ i" @& c' \1 aW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
2 f+ T* i8 J! C. q, Jto the VxD Control_Dispatch proc (how the hell a shareware soft could try
3 O4 Y$ [4 Z! t- c3 B% Oto load/unload a non-dynamically loadable driver such as SoftICE ;-).
: I1 Y, ?+ _  nIf the VxD is loaded, it will always clear eax and the Carry flag to allow/ a; C) P  X4 T8 o2 j9 W% R
its handle to be opened and then, will be detected.
8 V0 t5 I1 S$ ]' ]You can check that simply by hooking Winice.exe control proc entry point2 D5 Z8 @9 n5 \
while running MeltICE./ A" ]; }( V3 `

' G( R5 q6 |) o- L' a9 l) f7 C- H: G! E7 R- m- M5 N! ^
  00401067:  push      00402025    ; \\.\SICE
( S1 c0 J4 C' o9 Y2 n2 f* O/ \6 o  0040106C:  call      CreateFileA
$ f. I/ n" a4 F' D: v- f  }  00401071:  cmp       eax,-001
+ x7 h9 O7 V, u5 t/ V9 Y, h  00401074:  je        00401091
9 \; @4 r1 T- J- J0 G& h% T9 l2 l
5 A( i& z+ B5 u! ^% W" ^  |4 A5 a' r& N: T
There could be hundreds of BPX you could use to detect this trick.
) m4 V1 G6 {' m' y$ A9 y-The most classical one is:& J3 z' k9 z0 p9 A* x
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||# h7 D. C$ v$ d2 A# Z& V6 ?7 {
    *(esp-&gt;4+4)=='NTIC'
8 b4 q6 Q! ?6 N5 @' S+ C
3 k6 `0 ?: v( G% D2 I; V( @9 _-The most exotic ones (could be very slooooow :-(
+ |- ?, m! z6 c# a2 F. q   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  0 k% F+ {9 T4 Q! p+ f2 I  t% Q" e  g2 U
     ;will break 3 times :-(
$ D# v! R" u& S. z; r0 E1 g+ O. ~- y3 L: `" S' d( _: |
-or (a bit) faster: , I0 e& z# A: K4 r$ o6 ?* P/ Z
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
& {! M/ x: _+ e. k) g* a- L9 M1 H  p5 A; V& T
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  8 ]3 e& ?8 D5 G- i( g  C! x9 [
     ;will break 3 times :-(
3 {7 Q! P2 u9 O; G  ~7 v# G0 U* c8 W
-Much faster:
9 P, o) F/ N3 B; {& U   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'" l2 |! E4 ~& D$ z* R  O/ a  Z

0 v: T6 ^/ i( i; d0 ^& HNote also that some programs (like AZPR3.00) use de old 16-bit _lopen  ^/ |; Q- z& @
function to do the same job:) s0 G* h; I1 g" ?; D' W) v2 `

$ q- J6 A% \1 B: ?( G0 S: f   push    00                        ; OF_READ0 v2 t/ u8 B: i- d+ H
   mov     eax,[00656634]            ; '\\.\SICE',0
0 r5 }( t( m# K# B$ x   push    eax
6 Q: j! q* y4 _) V1 {2 i   call    KERNEL32!_lopen5 Z; t0 ~9 X4 i' g  [
   inc     eax' A5 h# }4 M4 {# v7 ~! I3 R/ W
   jnz     00650589                  ; detected
0 a5 x7 S( L/ g: w+ _% Q   push    00                        ; OF_READ6 Y0 O" g+ T% e
   mov     eax,[00656638]            ; '\\.\SICE'
/ Z% E% P6 c6 e+ A9 r, ]   push    eax0 M) f2 A/ v! I, }7 i
   call    KERNEL32!_lopen
+ o0 C+ e: y1 d   inc     eax; g- p" J! O. o7 R0 J
   jz      006505ae                  ; not detected
/ s" P& x. X& I0 ~) S. j
- G  \4 G9 i* `
# M. o3 e: a- p& V$ ]__________________________________________________________________________! k$ k/ \5 R/ _: t! Y
- _6 N( }0 E) D- k- k- P  n& a3 u- b
Method 128 _6 `$ u7 M+ h* ~4 A  ?) L
=========( f9 Y" X2 I; o# N

8 F# c, F7 S. A$ eThis trick is similar to int41h/4fh Debugger installation check (code 05
# |+ ]) B2 y4 M7 ^% S& T&amp; 06) but very limited because it's only available for Win95/98 (not NT)
& y. F5 `' P! U6 V8 r+ n+ x; qas it uses the VxDCall backdoor. This detection was found in Bleem Demo.4 s8 v; X2 n0 g

- _0 T' x( t4 O( r   push  0000004fh         ; function 4fh
$ G  T- I1 a! ?   push  002a002ah         ; high word specifies which VxD (VWIN32)
3 m8 U: _8 W7 G3 i: m                           ; low word specifies which service2 U# [. A2 @& d7 K) m  P" f
                             (VWIN32_Int41Dispatch)! x& a& A8 c: S( I
   call  Kernel32!ORD_001  ; VxdCall
9 B$ k+ h, d" R! N5 u1 M   cmp   ax, 0f386h        ; magic number returned by system debuggers2 b; T+ F/ `. w+ H: G  W/ m( Q
   jz    SoftICE_detected
8 d) j6 Z: t0 Y" m" B8 W, t, A. W  ]8 l* r
Here again, several ways to detect it:
- u+ L3 R: o5 i( o/ }! ?- m% H1 u) o! O. U  b8 h7 C$ R% i
    BPINT 41 if ax==4f
- b. c, _1 d5 E+ x( G, v( S5 L
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
7 N8 Q1 R. r( n+ L
8 ?/ t; |) N) Z) u( L* C6 Q    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A6 a& `5 Q- q  A3 H% X

- I9 z8 h8 {/ F" M% T6 q    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
: z* N: }+ y0 l) e; _
8 W1 |% v( m0 N3 `__________________________________________________________________________" Y$ I, g+ H# b4 I3 \

  @- N1 w' ^) u- _- ?) f2 V. FMethod 131 K: ]$ G) N- g! D
=========. k/ X3 }" Y1 C" p+ w# r
. u4 v0 V! B, F8 }# ^1 N
Not a real method of detection, but a good way to know if SoftICE is
$ E0 ~9 S1 D8 t1 f& Ginstalled on a computer and to locate its installation directory.
6 Z" J1 K6 @2 q/ e! M0 a+ D$ @It is used by few softs which access the following registry keys (usually #2) :
5 D: Z$ D- }6 D3 j# Q( x. p1 z  h) C  Y5 p+ ~$ F# r
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
5 C1 p/ {) ^; p5 K, Y\Uninstall\SoftICE7 p9 P6 h, J2 F
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE- F) K/ ?9 \! |; a) w: x; @
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion7 Q7 i& m! M# G5 t  M$ p
\App Paths\Loader32.Exe
: @6 b( Q: U. r; V3 K0 N) l4 T" d, o. @6 c7 i/ p+ `

! h: g* }/ T9 f* Y0 ?1 nNote that some nasty apps could then erase all files from SoftICE directory1 q& o( S7 T, W* L- ]* e
(I faced that once :-(9 U6 i9 U" K& C
& R8 n# D% ?; \* Z% J  {  f3 c
Useful breakpoint to detect it:
/ G* O# M6 t4 ^
) `, h# I& }" L1 n/ ]& }7 ~# k     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE', X/ `9 S$ z: T6 }
1 Q9 C) B3 R' O) Z2 ^- l
__________________________________________________________________________  R( ?' \! w4 \" @7 w4 w7 {, H2 D; K
2 P) S# ?4 I0 L8 R$ v- }
& n% d1 U, F) l1 }) o9 Y" \$ d9 c; G
Method 14 - f) X" U* o! R
=========6 h8 D, b- U  ]% c* U8 _

8 }  g$ Z' F2 o* ^$ K1 ]A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
! f9 @7 i8 j5 e! q0 t' Iis to determines whether a debugger is running on your system (ring0 only).
6 p6 c* ]) s% {, J$ ^* U# t6 X2 ^2 o9 i& A$ a
   VMMCall Test_Debug_Installed( q6 V+ L3 r/ }, J5 S
   je      not_installed# L8 d) @/ L0 ^0 y8 J& ]

% K- i- D# |/ f4 M$ A) D1 wThis service just checks a flag.: F+ z; F  `& n) R$ c& k
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部