About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>5 t8 A7 Z( m7 ~" G9 I
<TBODY>
" b; j# h& V3 {( I3 y! o+ }<TR>! S2 Z# `* ?$ b6 j( M
<TD><PRE>Method 01
5 v: L" z& B# n=========
8 w% H3 |2 a5 R# j
% p  x3 K# J4 I0 V. d  EThis method of detection of SoftICE (as well as the following one) is
* R8 ~( e/ `1 h& k$ I) eused by the majority of packers/encryptors found on Internet.* \8 e8 v# m3 R
It seeks the signature of BoundsChecker in SoftICE. H' G9 n: @  i! J
- j3 P4 a7 m0 a# J5 z$ v7 X
    mov     ebp, 04243484Bh        ; 'BCHK'4 Q, s3 [2 P8 o% }; U+ i. }! A
    mov     ax, 04h3 I& _( j& `9 ]" O; l8 @$ Z
    int     3       1 T' I: V: [( P. V8 p
    cmp     al,4
+ B- ^( M. }% J/ |8 Z) E: X    jnz     SoftICE_Detected
2 ]5 c" N1 c6 T7 C* ^' X; X& t6 ^2 t- m/ {1 O5 ^
___________________________________________________________________________
, b! _( i6 d$ L+ t- C; q. A  n, Y: E4 @
Method 02% ^$ e9 W) b) t( I: b1 M
=========
. b1 e) h: m2 n5 A, N
' S5 m5 `, C1 K# P; M' t. V; Z5 TStill a method very much used (perhaps the most frequent one).  It is used6 Q4 J# h! e4 q: h0 c6 @) Z, u
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
3 G4 r% [; \. q  q& l9 k, uor execute SoftICE commands...$ q! J1 _) M6 w/ Q% _! U, v$ B
It is also used to crash SoftICE and to force it to execute any commands
$ I' n% g: U3 M8 o' O$ |/ I  f. G(HBOOT...) :-((  
6 M1 _" Z7 U8 A& A/ G/ m: K1 }
9 d' j, K7 o* U  lHere is a quick description:
% z; p7 }% B' Z. J: T-AX = 0910h   (Display string in SIce windows)
, V; x  t' t0 R2 R# b-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
' ]% ]- D2 i2 `; k5 ?, ], S-AX = 0912h   (Get breakpoint infos)* D* [7 c  Z9 Y9 ~
-AX = 0913h   (Set Sice breakpoints)2 B* K+ ]' @2 Y5 j3 s
-AX = 0914h   (Remove SIce breakoints)# ^& m! J* C, x( |% y

0 k3 U; E: I6 h: @Each time you'll meet this trick, you'll see:$ s, u. O1 w% @8 m/ Q
-SI = 4647h3 s2 c  @2 m" X" }4 X  W
-DI = 4A4Dh
. l2 }: E; B' {: a5 pWhich are the 'magic values' used by SoftIce.7 a% [! v) s! @6 e* {
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
" o% \! l# u8 S* v, V. s) c: |% l3 v1 K+ C
Here is one example from the file "Haspinst.exe" which is the dongle HASP
; t7 I( X4 j; z% ~$ t7 C. WEnvelope utility use to protect DOS applications:& M$ L0 p7 H8 y: R

  @& x/ H7 T  \1 P
$ A# ]( v% L3 d% d' k$ M7 y, w5 c4C19:0095   MOV    AX,0911  ; execute command.# B4 l: x( G4 A
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below)." k* k# z* J  G" ?% C* l
4C19:009A   MOV    SI,4647  ; 1st magic value.
- V0 h* c1 v/ X! X: H4C19:009D   MOV    DI,4A4D  ; 2nd magic value.) O, r/ ]! E4 o
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
) M! M* h; ?: N+ m4 x0 Z4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
" t5 b/ u, L& p% h6 {# w% q& T4C19:00A4   INC    CX, M9 c/ u1 |7 c# U" \# F7 g/ j8 `
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
" H* `9 h) L6 i: k( j" M& W4C19:00A8   JB     0095     ; 6 different commands.
# [' s' T7 V9 y- [, R4C19:00AA   JMP    0002     ; Bad_Guy jmp back.$ H8 ]0 q' @# J9 l
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)4 _- I) E. P1 w% B, [

7 U7 Y' X: z1 b, }" ]' F* SThe program will execute 6 different SIce commands located at ds:dx, which
* A% ^  M  |# _6 `* S6 J2 Ware: LDT, IDT, GDT, TSS, RS, and ...HBOOT.5 ~2 p4 ^! W  g  Q8 ?; G. P

" p& a4 @& K8 N$ T9 {% N* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.! W* o! z# C" D& Y, b
___________________________________________________________________________* |/ n' G8 p+ I
- ?  a  |  j9 H* o

5 a6 [0 R2 o4 n  k( R( s( D: pMethod 03- ]0 A( a5 G2 H& A$ y3 ~
=========
6 L" [3 s  p' G0 g5 G9 r0 o- \; j) X( |+ j  Z% q/ j7 N# B
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h+ ~, ]6 P* y, E4 A9 C7 A. k8 D
(API Get entry point). L7 }: [# [8 `5 Z/ l8 A5 J
        
4 \0 r2 L. U* M  p; X8 r' e( m8 k; b
& G. w/ s# O" r7 ?9 C0 j+ N    xor     di,di1 `/ q/ i. O) b; z+ {  Y" U
    mov     es,di
$ H# F( }8 g& ^( o1 F  Q/ ^  A# c    mov     ax, 1684h      
6 z- r: M% u/ o; k( ~* T( v    mov     bx, 0202h       ; VxD ID of winice
# Y7 ~) E3 y. p- z  X/ h5 U    int     2Fh! Z* o& l' N2 U
    mov     ax, es          ; ES:DI -&gt; VxD API entry point2 R, W1 l  x. }& i
    add     ax, di$ q3 b+ A8 l6 h
    test    ax,ax5 s! W, \% g0 G7 j! F
    jnz     SoftICE_Detected
( b( o2 ^6 `1 v
& w/ U4 r7 m" o1 n0 r___________________________________________________________________________
* A& d6 w; i2 z6 C8 F1 w0 o7 d, q
% k! {' H- D3 }( u( E0 ]0 Z& x2 m% Z. HMethod 04
* u# I9 i7 }7 s2 A=========
' }. L* s+ O* J4 t" N( T8 i2 _, z  `( T% r
Method identical to the preceding one except that it seeks the ID of SoftICE+ f' `  m8 |( n. J$ j+ @% p5 @
GFX VxD.
. q$ n7 V% N2 p# k; }
! j9 m! b6 ?, E1 K" g( a) y    xor     di,di, m6 r4 U1 V+ k
    mov     es,di2 k- J* B( G: l# J( B% ?
    mov     ax, 1684h       % ~% N1 M7 l, z' d
    mov     bx, 7a5Fh       ; VxD ID of SIWVID
! F/ A/ e. H- Y0 S4 q1 y$ j    int     2fh
/ ^4 G& [% e( {0 w5 G! k( x9 S    mov     ax, es          ; ES:DI -&gt; VxD API entry point% U1 G9 Y# b4 ~& |0 R
    add     ax, di
! f& M% X4 X( C; h% h* j7 a    test    ax,ax4 U( A! G, B2 Z$ [* P9 [/ x
    jnz     SoftICE_Detected
1 [6 `* }) U4 m2 z
) e6 k3 O* L' n. `__________________________________________________________________________
# l( p9 H% X- ]3 r
; X5 O# C+ Y4 N6 v3 Z2 o/ B6 v# E, E" v0 p( w2 L/ M
Method 05
3 w' Y7 Z# B4 b=========
2 i( L0 m# b; H8 d$ J% l: t1 q1 Y4 y% Z' L& {* M& c) m; \' K
Method seeking the 'magic number' 0F386h returned (in ax) by all system/ u: ~4 z# m5 D/ ?: Y
debugger. It calls the int 41h, function 4Fh.' S( C& X: B/ b0 F9 l
There are several alternatives.  8 }# ?  e. L1 X- g, |% @- {% S' W2 b# W

6 U# A9 k+ b! D* k) z8 Y: AThe following one is the simplest:
) \! g  Q+ A  ^) e& |8 \8 r+ z, {9 B) ^
    mov     ax,4fh; e0 v$ r# e2 W3 B+ P
    int     41h
# t0 N4 g; E) N2 Q8 ]0 c4 H    cmp     ax, 0F386
! b) F% q5 W& I2 A    jz      SoftICE_detected2 n% J% F' v- z  E

, B- i: j  T- Z" s# g" j2 N
3 S/ d2 o* ?0 Y; E  j% y5 GNext method as well as the following one are 2 examples from Stone's . L1 E: B) P. g: V# B* P& o
"stn-wid.zip" (www.cracking.net):
( J5 M- z6 u+ S" g+ a. R( F
1 }/ ?7 i$ t1 ^( {1 @    mov     bx, cs
  ]2 S) x; T2 f) I) n2 J    lea     dx, int41handler2
" X) v* y& P( M0 `3 p$ b4 n4 h    xchg    dx, es:[41h*4]  A( x" [/ Y  C- [" D
    xchg    bx, es:[41h*4+2]
; n6 M3 c1 e4 R    mov     ax,4fh
3 y2 j* S* n( s/ i. e5 J3 }# }) c7 W    int     41h
2 p1 @- v& v3 y9 M: t    xchg    dx, es:[41h*4]
! T* k" [* @% \$ J  w5 n    xchg    bx, es:[41h*4+2]
. b" u. @& N. B8 s/ m$ i    cmp     ax, 0f386h
6 e, h) q" i$ x8 h    jz      SoftICE_detected3 \& q  Q4 a6 m! g1 P6 F; U9 L/ r
1 v8 j& Z# m8 D& ~5 e4 ?0 \
int41handler2 PROC
! _. _7 `& E# @$ _7 K    iret$ c7 F8 U. O: L! V7 d* O- S
int41handler2 ENDP
8 ~( g5 U) R2 L$ B/ Y' [1 e0 e0 O# e* I
4 u7 Q9 ]7 |% n% T# M
_________________________________________________________________________, E* f0 ~  T# I$ C; R* s
4 ~' Q! U: Q8 y5 b% G
3 I7 H, o! K$ D  U1 f+ ^
Method 062 Z& K' v2 H- @( N4 h/ h; N% k$ `3 {
=========
& Q$ }: Y6 g5 c# j2 [+ W2 c/ a# A  f+ u! b* G: t3 w* G
8 g" A3 ?4 I' U9 j
2nd method similar to the preceding one but more difficult to detect:% L0 G1 ]: f8 p
7 ?* O# e4 n: P7 [2 V
2 n+ a. L5 V/ E. P( G: d' i
int41handler PROC9 a& [$ U/ t: q) Y" H8 @1 t
    mov     cl,al; e) N+ }; V) S) o0 L  l3 X+ v
    iret0 q7 K# e" K. H* N5 s* U8 t
int41handler ENDP/ q0 i0 s: H" W; {" l/ G7 F2 l

$ h+ e+ k2 n$ q8 _
! x7 T! r2 u! v! w* L8 L    xor     ax,ax
1 H# Z! E$ v7 b: R2 ^2 H    mov     es,ax7 \& d6 `3 N" W8 u* [/ X
    mov     bx, cs% m( y- S2 K, A$ n" e: k
    lea     dx, int41handler$ \1 w% K3 v0 s
    xchg    dx, es:[41h*4]. j) M9 c6 }6 }  k; c9 }% T5 F
    xchg    bx, es:[41h*4+2]' T, k5 D1 P' S/ N0 F
    in      al, 40h  A- _  ]( g7 `3 f% {8 u% c
    xor     cx,cx
/ O1 ?; G9 y4 _+ c3 a    int     41h* [, o" \+ r9 A( y( h/ b
    xchg    dx, es:[41h*4]
$ w$ l$ a. Z; v% Q2 |7 g2 L    xchg    bx, es:[41h*4+2]
, r( H; p$ d/ w3 Z+ v% f    cmp     cl,al
; e7 y3 \& B) x) O) m, y    jnz     SoftICE_detected9 J  @3 a0 W9 S; l6 A& w
: G6 y, D5 X* ?1 N: y  K
_________________________________________________________________________
& C% L$ x$ Y% u' K0 u% S% ?1 _- }! ^; `4 X' c! d, ~
Method 07- W7 J% M  w1 ^9 F
=========
% w6 e( ?# h5 I6 q: Q: ^4 F7 O* a( x6 k2 c% }2 G
Method of detection of the WinICE handler in the int68h (V86)8 ]3 [: I/ k" C' P' A, L

% _9 l/ P. Z" A: x4 Y: O    mov     ah,43h- z7 v) z) i' _0 y* L$ ]
    int     68h
, |4 u& I! B* \! {    cmp     ax,0F386h2 p% r1 a/ Y; s; @7 w8 v
    jz      SoftICE_Detected! F- G) r. Q  ~8 V# k3 p
3 z2 m* {$ z0 i3 Z1 z- C

  A( V" j  n9 f=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit( {4 {2 I1 g$ m8 o# t$ t
   app like this:
% r# G8 g7 {+ |7 l$ l% A. F
/ F* Q; Z- }6 }   BPX exec_int if ax==685 ?; V& a: M# L' p
   (function called is located at byte ptr [ebp+1Dh] and client eip is
+ q. X2 r. a3 x" B2 H* \  f7 V' |   located at [ebp+48h] for 32Bit apps)9 Q3 ]& ^) C+ [" Q
__________________________________________________________________________
9 D" m/ q3 M: m* T
; o( ]0 q6 T3 O9 k8 R3 d. P) _3 r% i4 ?
Method 08/ [, R  W: I! x8 t$ O/ s7 c
=========5 y2 N; \3 t% k- y

3 L  q9 E) j* k+ b5 h( ]( x# rIt is not a method of detection of SoftICE but a possibility to crash the9 a: s* E6 F; \& ]8 Z, q
system by intercepting int 01h and int 03h and redirecting them to another0 T6 z+ h* m1 C: f
routine.
# \7 ?" d' S( g0 cIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
* q. C% s6 M6 t% A) yto the new routine to execute (hangs computer...)3 X- @7 z+ M3 _, [* k
: J2 @; H1 Q( ~5 i
    mov     ah, 25h
! L7 W6 @+ J" @( \1 R2 U4 P    mov     al, Int_Number (01h or 03h)
& g# M% V- T9 s& n' ]. G    mov     dx, offset New_Int_Routine
1 W* o$ M/ n/ X6 c    int     21h
8 [* ~: s( o. u" s: d, I/ Q1 \/ a6 r# k9 H3 X0 Q
__________________________________________________________________________
8 a; ]0 m. r3 t7 d. e5 L9 H7 M' v0 K: F& z( X- B) U
Method 09
8 \; F5 N1 P) I- I9 d=========2 T. I, l& {7 Z# l9 a" b! x% ~

$ v% ^' ]6 K. S/ rThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
2 e+ X/ N7 H- `! bperformed in ring0 (VxD or a ring3 app using the VxdCall).* _% v6 a+ M" w' U
The Get_DDB service is used to determine whether or not a VxD is installed- S0 C9 v" f3 O
for the specified device and returns a Device Description Block (in ecx) for
2 g: A* {/ S/ B1 ^1 Z+ J  h  t8 Rthat device if it is installed.6 G; S8 E" i7 d6 ]6 z. [" U4 f* ~

  w( j0 P7 y$ n1 s   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
! B  v! J* E$ v" D6 l$ F   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
: L* [* W* ]3 D& W" K+ J2 V7 M   VMMCall Get_DDB
. a! R  M; z* @) S/ k9 q# W   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
' G" X6 w1 s4 b' s, r9 v2 h' C4 n5 j) ]& g* A; \
Note as well that you can easily detect this method with SoftICE:
9 v# C, O5 O4 J2 a- e/ X   bpx Get_DDB if ax==0202 || ax==7a5fh
1 G) q2 `/ K* E8 k& B0 Z
, `3 i2 _+ n  Z) j__________________________________________________________________________( f% C+ F* o/ |9 ?$ V
7 T6 R) h7 ~9 b& R! _
Method 10
7 S( a- m: A! f8 `' c=========. D* }2 M5 }) Z8 p$ \5 L" S
# {* [& h3 W) B" I
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
8 Q. c* f# a* j/ J1 n: D5 h6 n  SoftICE while the option is enable!!
7 q) y" A; V! u5 _1 C5 @
& s9 h0 @6 A5 ~  q4 |" sThis trick is very efficient:
' N6 T# V. \9 P* Aby checking the Debug Registers, you can detect if SoftICE is loaded
' ]% q6 l* Z2 i) J. j* f(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if# Q" @+ p0 S  g4 R4 P
there are some memory breakpoints set (dr0 to dr3) simply by reading their
. i& b! y9 e- ?. [2 tvalue (in ring0 only). Values can be manipulated and or changed as well4 m3 r$ V, l4 T7 |4 r7 F. t
(clearing BPMs for instance)" R  e6 Z# O( C0 Q/ ~! l1 l
. D) Y: z4 T. b6 N/ v
__________________________________________________________________________6 w. B  v: ?  v. s& [
) Z- I" c. \9 u7 b+ c2 k
Method 11
# R; {# n: k; s* m9 X+ Q4 i=========
6 {3 P3 S7 F8 |( b  F
+ c; T% i+ S% j# r" OThis method is most known as 'MeltICE' because it has been freely distributed
1 o7 r, a; t# d- c& evia www.winfiles.com. However it was first used by NuMega people to allow
) z; S0 M3 Y( \; b- ^% nSymbol Loader to check if SoftICE was active or not (the code is located" k3 O% E) R+ W) W5 w- P
inside nmtrans.dll).
3 i% r! w; T. e* `+ Q- v# C, F4 I+ u/ n. ]( T8 }) ?9 R. t
The way it works is very simple:# G) R) w5 n% b7 f1 t6 t0 X
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
/ w' k  k) {$ d4 }8 O, z- _1 V4 u/ o1 yWinNT) with the CreateFileA API.. m3 Y( R- T9 C* R& `/ O  q
) J) D1 |- Y# h2 X9 D
Here is a sample (checking for 'SICE'):" o1 Q9 E# U3 k' w; p* {& M7 X$ L* v

# O0 \: M. Q, b5 v  P+ [5 b* mBOOL IsSoftIce95Loaded()" |3 r( k/ ~8 j! j6 r( d
{
( n0 q1 j; T* w2 _   HANDLE hFile;  
2 m" y, w! ~! @   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
/ G* [2 i& }' s) Q                      FILE_SHARE_READ | FILE_SHARE_WRITE,: d3 L/ V9 S7 Z+ S& S
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);# M& ]$ {8 V  I
   if( hFile != INVALID_HANDLE_VALUE )9 a" X$ q4 s' R$ T
   {
; z% g! V6 q9 a2 ?4 e* Y4 `      CloseHandle(hFile);
2 g# F; ~; u$ h( I0 n      return TRUE;. e8 W3 @2 h( J# {/ z
   }
3 _- K( x9 J) g' S   return FALSE;" |& `( o$ U/ W" [
}
) d1 Y# c) Y9 p& a. _
% G+ x- m$ C( b' nAlthough this trick calls the CreateFileA function, don't even expect to be
+ _, S4 |# o, l& k8 j. iable to intercept it by installing a IFS hook: it will not work, no way!, C8 N, a7 N& s9 K# w5 I
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
& Y  b" e% I1 n. z. M% r5 O; C4 _7 Zservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
6 h- o: N2 }. s- K, D( Dand then browse the DDB list until it find the VxD and its DDB_Control_Proc
) I# b, ?# Z" A0 u, tfield.) T: H# W" w' d9 s3 A) O' _
In fact, its purpose is not to load/unload VxDs but only to send a
! @; \5 N6 G2 BW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
5 {1 g2 J7 a; d9 j/ K* V' |3 tto the VxD Control_Dispatch proc (how the hell a shareware soft could try8 @& M( ~+ ?5 d: E& B, G0 b0 C
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
) n% a4 Q( @: w' u* @  l7 _If the VxD is loaded, it will always clear eax and the Carry flag to allow) y; z. t) f: O; p2 z1 ~
its handle to be opened and then, will be detected.8 r6 E: }7 F' v! ~! b2 T9 {
You can check that simply by hooking Winice.exe control proc entry point
1 F, q8 [, a8 d1 o5 \' \+ F1 Qwhile running MeltICE.
9 ~& A: a2 i1 V8 C5 G" F  |9 [7 d
9 x6 [  S) e; o6 l
& X- m* |  o6 p6 h$ p  00401067:  push      00402025    ; \\.\SICE
+ t( \( p; V- ]1 A% [  0040106C:  call      CreateFileA
3 E1 S$ ]3 G; S$ f  00401071:  cmp       eax,-001
0 \1 b6 ^) g0 F3 |# h  00401074:  je        004010919 ~3 w( v& i5 Z* _1 l1 }
. T) j- g" P3 s' G/ V# K7 d
/ [9 A8 i. J- \/ P$ H
There could be hundreds of BPX you could use to detect this trick.
$ ?$ _" j5 B$ u* L  u) O) q-The most classical one is:
) F) @3 ^7 v. z2 y1 l6 x7 q! Q  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
# p+ t  e/ @6 S+ G8 K% [" p    *(esp-&gt;4+4)=='NTIC'$ D" ^9 Z% ^( t* v2 d

# b: E; w: y- z+ \6 U2 O8 n-The most exotic ones (could be very slooooow :-() Q: ?. ~8 ]* K3 t" r* p2 G) M
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
$ [0 |- S7 r0 L6 U, \, M     ;will break 3 times :-(
2 c! M- k9 M3 Q1 k1 D& |2 \* ~; ?9 n/ q; \! ^( a# T. e  }1 S" {8 Y
-or (a bit) faster: - |2 C0 l9 H: a6 i9 A( r
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
6 q. h% Z2 d1 \; T# K1 J( v& B5 ~2 ]' K. K6 K' b7 b' g5 P
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  5 E" W( O" j& ^: v) p
     ;will break 3 times :-(
) ?( R3 Y) R1 s
' {. _$ b. W/ b; D-Much faster:' D9 U, A6 {! q; W+ w) s
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
/ t5 G. S2 M- m0 I4 a" }8 K8 [% }
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
1 E4 ^5 r+ d/ b; E8 X$ |function to do the same job:
) ^" [7 h+ o. N+ f8 ]3 h
) x5 R) [8 w! d& ~+ ]   push    00                        ; OF_READ7 Q9 }' m  \- s  K7 Q' M: C, P
   mov     eax,[00656634]            ; '\\.\SICE',0
  P2 r5 f, ^- z9 V( j" w' `4 l   push    eax) q- q5 M1 u0 p/ ?
   call    KERNEL32!_lopen' p& ~! I$ p5 w& q
   inc     eax" l4 T, t( V/ r8 s- {
   jnz     00650589                  ; detected
0 _, M/ q( n( q9 v$ Z" a) J) L% [   push    00                        ; OF_READ+ x$ a7 y; ?1 D$ @0 v7 {6 f: C
   mov     eax,[00656638]            ; '\\.\SICE'
( o& Y+ D) [, F0 c! g) F7 P8 q5 [: U   push    eax( Z$ }' L; ]1 J7 N1 @  J' }% q
   call    KERNEL32!_lopen
: I7 d6 H  j% J% K4 k/ d$ Z1 V   inc     eax2 U3 B8 U$ E7 I' w. E+ ^7 H
   jz      006505ae                  ; not detected  M. V2 A; f( ^' d+ }' i

! V, R1 c  @* {5 i  c# ]8 P% p0 l; n
__________________________________________________________________________
/ t6 ]; Z' Q& L8 w3 ]& K
3 h1 `% W4 u5 Z. o& z+ wMethod 12
; D, t* K  [! F  k. T. m+ `: ?! f=========
, m; D. C8 I! k
* d3 ~( R2 d' a/ f( h7 iThis trick is similar to int41h/4fh Debugger installation check (code 05
9 o  X  }' s, e% o& T" P  A# g&amp; 06) but very limited because it's only available for Win95/98 (not NT)- M7 g% T: ?% X/ I& b6 e" L5 n
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
" t2 R9 d! r! `5 u7 _" _! o4 i
+ Z' {% z9 e: g! ?$ s   push  0000004fh         ; function 4fh. p; n) |# Y! u" w7 d
   push  002a002ah         ; high word specifies which VxD (VWIN32)/ i% h  R$ o9 V  N4 |& P
                           ; low word specifies which service
/ K# }) K& O1 D: H# d+ L& N. z                             (VWIN32_Int41Dispatch)1 E, n& \4 k3 h1 e1 O" ~
   call  Kernel32!ORD_001  ; VxdCall
2 B; \. |  `6 l, F) r) \6 N   cmp   ax, 0f386h        ; magic number returned by system debuggers
# O  {2 I' x& ~" q4 j$ J3 X   jz    SoftICE_detected; Y* q' l7 {5 t+ c

1 L: F! e0 r0 dHere again, several ways to detect it:3 ]/ x" G' v6 D8 X0 w0 v( N$ P9 k& }

- M( e$ A' t! A& J+ X7 w1 H    BPINT 41 if ax==4f% r4 ?! M" e' w8 `7 w5 t
6 Q* U# J, |+ G. ]9 F) h& m) I
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one! h8 }, S; x7 j1 ]  y$ O

8 T, @0 s5 d! e$ N( m" J    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A* t6 n0 Y! ?3 S5 l0 n3 g

! A+ m& t, C8 v6 O" x    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
; ]8 w+ {9 \& E) @0 z' _
( c; ]2 I" N4 s1 v7 v" A; u2 W__________________________________________________________________________! N- ^/ x- Q8 O  z7 {. E$ e* j+ D
( i# O* S! `4 N& w; G
Method 13( }0 k5 |% x  {, X, A  }
=========
$ @, n" [1 }4 r0 e9 y. V. ^
, J" Z+ Q6 A+ NNot a real method of detection, but a good way to know if SoftICE is: `4 J5 H3 \1 f- Q) R
installed on a computer and to locate its installation directory.5 |- u- @, q$ q* o& m: d
It is used by few softs which access the following registry keys (usually #2) :
5 w4 Z" l: A9 x8 l; x7 ~& H7 G  t9 D
# k) ~) L. z$ D8 j-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion7 I  Q/ y* \( V
\Uninstall\SoftICE9 n8 o" w6 R) W* ?+ {4 o4 w
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
$ |' u& h+ h+ g  ]0 S8 V! |- h-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion! i/ ~1 z: Y& I/ K4 U
\App Paths\Loader32.Exe3 M, l3 |! F6 o& K- O
/ I1 b/ q, w# x
$ [1 c6 K# K' G( X* N
Note that some nasty apps could then erase all files from SoftICE directory! G4 p/ k7 A+ x+ ]0 I7 k9 q
(I faced that once :-(8 g. j/ J( _, [: Q
8 p% r, Y: u5 Q7 X: p6 w
Useful breakpoint to detect it:+ `. a6 W3 ^) |

9 `1 }, P  p4 ]$ O+ B     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
2 W* B/ C& B% k+ [2 @5 n/ k: V3 \7 x$ Z; S  G- X) J
__________________________________________________________________________7 j4 i2 {* g6 \( Y& V; N; M% K7 G

( D, P7 f/ m  ~' P" O, Z' E! w$ R8 e: x9 a  A
Method 14
* L5 _8 O% x2 y=========
, W* ]6 w1 w' p" z0 y7 L* Y4 ]+ F; w" ~' [/ w1 u
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
, `% o+ s- t8 `* a; S9 r' Q$ Vis to determines whether a debugger is running on your system (ring0 only).
  ~: z8 f7 `% o+ S& U0 b4 d
3 o5 }7 _5 k4 h) A+ i% J6 c   VMMCall Test_Debug_Installed7 x5 ~6 O" n. I0 Z- z
   je      not_installed( q# t3 q5 B% c& q1 A; G$ V
$ {4 `4 H! P. w' b" _8 m; \: V
This service just checks a flag.$ D- P" N; a  ?- [! a
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部