About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
, r6 K2 u& N" K. Y" d<TBODY>
) h4 w# p' |! s9 z<TR>
1 A! |! _5 x4 `9 ?. s<TD><PRE>Method 01 , C% ]* R/ C- @$ e. K7 x
=========' N( l0 c9 I; {& K/ {6 [1 v; V
+ G& ^5 y. @! p! ~
This method of detection of SoftICE (as well as the following one) is5 ^5 t( m& C6 c8 w
used by the majority of packers/encryptors found on Internet./ t. c5 S+ p  H+ a+ U- p
It seeks the signature of BoundsChecker in SoftICE
4 l! X# h6 P8 J1 [( G0 a4 ]0 N7 A  [3 t+ V9 O" k! w
    mov     ebp, 04243484Bh        ; 'BCHK'
' O( [8 S8 B0 j5 {    mov     ax, 04h3 v% Z5 j1 L+ n0 I
    int     3      
2 r; ^7 ~/ z0 d5 \" |9 O# B    cmp     al,43 N4 W* C3 G+ m/ _/ ]2 O
    jnz     SoftICE_Detected  ~2 p% L2 _% v% g! ~$ M: o

/ P6 V* I3 ~* g% G' `___________________________________________________________________________
4 [0 u8 `# I# U" x
% n# E( e& j9 E. sMethod 02; d+ a( I2 Z- `0 \+ S
=========. ~( e- H! ?- ]7 [$ \

7 W3 q# `! H+ @* L% rStill a method very much used (perhaps the most frequent one).  It is used
4 W( l% `# Q5 W% _1 jto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
* `& |% h/ J5 E, X! e+ Bor execute SoftICE commands...
  W  R# z% k- K  ?% }It is also used to crash SoftICE and to force it to execute any commands& W% X, W9 i( S8 @6 Z# l& }4 j0 o% d
(HBOOT...) :-((  , A5 E- ?6 V5 F4 |
+ r; ~/ m& J9 N3 C
Here is a quick description:
; g2 b3 x4 C* ^- F-AX = 0910h   (Display string in SIce windows)
6 m$ h3 u, }( H; t0 T& a$ E-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
  r6 \8 n" n+ E1 y-AX = 0912h   (Get breakpoint infos)* o7 {5 ]: A  p1 |3 z) i
-AX = 0913h   (Set Sice breakpoints)
! ]5 b+ V- b0 p-AX = 0914h   (Remove SIce breakoints)# A0 l& |. [' n8 Q* B2 U" q$ x

  N& l& a# b  g2 \  T! D, r' gEach time you'll meet this trick, you'll see:
+ w6 B, x) y0 n* T( D1 ]-SI = 4647h: k4 c+ ^( V/ F
-DI = 4A4Dh5 B& q# `, T& @" d# T
Which are the 'magic values' used by SoftIce.1 C: ~0 P& t' }% w  b
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
3 ^. F( c4 S& h0 t" h* E7 e+ r% e
, N+ X6 @3 b- [# K# U6 ^; M# GHere is one example from the file "Haspinst.exe" which is the dongle HASP
* f$ J" L1 T7 |; KEnvelope utility use to protect DOS applications:
; g! ^; S2 {! {0 _5 Q6 u# P# D) A) @. \! J. o8 ^. w3 o
  z8 g0 A# y4 z1 [
4C19:0095   MOV    AX,0911  ; execute command.- _: ~9 a0 v! D% b+ W, y; V" y
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
1 ^: j/ w3 e4 }7 O0 ]% ^: Q4C19:009A   MOV    SI,4647  ; 1st magic value.
/ `4 h4 f1 `! `; J6 d! _: q4C19:009D   MOV    DI,4A4D  ; 2nd magic value.+ N; Y' P( \* X( X6 {
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)# Y; \3 p3 v$ ^. j# K- i$ \" K
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute, n- j/ \$ ~9 e# d7 Y$ A
4C19:00A4   INC    CX
: g& i) V# q/ |. a7 y4 {) }4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute  D8 a% _' ?( e( V/ F( j& z. X
4C19:00A8   JB     0095     ; 6 different commands.
& h" b: G) W) J& t4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
+ x2 `2 ?7 `, D/ K4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)  i0 s/ b$ z2 u8 G# y/ j
0 u* S/ S$ h4 a* A8 \
The program will execute 6 different SIce commands located at ds:dx, which
: m0 ~  s% Z; x3 g9 ~2 m  g/ dare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
, [5 y4 z, n# e
6 P% T0 E: D1 L# [" T7 c3 o* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.( ^: Y/ y0 {4 @% H7 I. `) l
___________________________________________________________________________1 ?& t$ L8 l: h" a
( V2 Y, G- R  T: E$ [- b+ m

0 |$ V" C3 Z" a, Z1 ~7 s7 ?4 q, PMethod 033 H! j/ ~  P. D" u" V% b% V( z
=========/ }! U* D7 i& L9 E% }

- a  e+ Q0 \" v; s( }' [8 [* _3 yLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
% O- {: G& D* i  q. ]6 Z8 {(API Get entry point)
( w3 `3 ?% W! V% G; I        
5 M# H2 [* x  M# j# k$ A( P. g! _, K# f. t% h
    xor     di,di
1 Z+ W' m" A  @: Z3 f; t* c    mov     es,di
" o2 G) }: A: Z6 q    mov     ax, 1684h      
9 I  S, x' u( I; Y4 @    mov     bx, 0202h       ; VxD ID of winice1 I; {' L4 h5 x: d+ `! f
    int     2Fh
" A! v- F' H# b6 F/ d$ d9 l    mov     ax, es          ; ES:DI -&gt; VxD API entry point) L  m: X( \8 z2 V" x( c1 P* C
    add     ax, di- }  _2 J9 `. J* _, N) m
    test    ax,ax( v% F8 A" |1 V+ {; E: Y0 q  @) S% u
    jnz     SoftICE_Detected8 t2 D+ j6 n+ p( s
. V1 D# w5 ~1 c
___________________________________________________________________________
, }% I2 D6 i4 k* m9 L% I  V% f+ w& _5 `3 d
Method 04
8 s- d: {0 A" `& a# r3 Z=========2 m3 R) I" y' ^4 h! Q7 a6 I
% C! B" d# ]8 T, E, z8 M8 {& [
Method identical to the preceding one except that it seeks the ID of SoftICE2 c9 b- X  Q- ]  q3 ?
GFX VxD." J2 N  q& e. J4 x$ M5 R
7 {* ?% c6 ?; E9 K1 f
    xor     di,di# D/ T8 Q! h0 f( x4 e0 I$ }
    mov     es,di
3 ^& C. B, B7 V6 O3 J" [4 T    mov     ax, 1684h       + {) P8 W$ w8 }/ v2 K4 y1 X) R& u9 A  z; k
    mov     bx, 7a5Fh       ; VxD ID of SIWVID
5 {8 ?- a7 q2 N* E( z. k& p: p: Y; O    int     2fh
6 ?5 R$ u) _) ~    mov     ax, es          ; ES:DI -&gt; VxD API entry point% Z- j3 D6 P- r6 t' P
    add     ax, di& q- q0 O. n2 r+ U
    test    ax,ax
# y+ G" U4 H; ?+ L# @    jnz     SoftICE_Detected
, [) y* \3 C" t1 Y9 E3 t% j/ _7 K- V; e: y+ {. @: d5 A
__________________________________________________________________________2 d5 z; l( a; i( E7 J
: ^0 U. {7 m' X5 E3 f6 F1 k( ^

3 o# K3 k: ]! k1 F1 DMethod 053 Z- J% ]  s# w& }
=========8 S3 z% p6 q. O: ~: F8 C8 g
- r' n) _* e* h9 U
Method seeking the 'magic number' 0F386h returned (in ax) by all system
3 ]1 M* U, s6 H: g8 p/ O6 qdebugger. It calls the int 41h, function 4Fh." p' _9 z+ D. }2 }7 d! u" ^
There are several alternatives.  % p6 ?3 K4 a6 D2 L5 D- z; y

( R- w, u, r: B2 vThe following one is the simplest:3 N3 ]1 b0 |& B3 z+ e

; ?# s% `8 B- I+ Q! o/ P    mov     ax,4fh; j: \$ E" A% ?3 x( Y( o- g
    int     41h
5 t: k3 X% I3 Z$ e  q) F" w# s    cmp     ax, 0F386  b+ Z1 N7 d1 h; e
    jz      SoftICE_detected3 I' M- C( Q0 _% Y. ^' ~% e; c7 I
8 U6 ?- c7 Z" y1 ]: G3 N& t! e( u& z2 M
+ C' h8 ~: U0 A
Next method as well as the following one are 2 examples from Stone's
" b' B' g: X- v" s0 a; p. t"stn-wid.zip" (www.cracking.net):
! Z/ ^  C8 u# n0 C- f; u  {/ }! `
; _# t9 ^0 u' X. N) q9 {    mov     bx, cs# E# y8 ]: ]* T2 c+ F7 l
    lea     dx, int41handler2
  [2 X9 m& W! ^7 C  A) Y9 }! {$ b    xchg    dx, es:[41h*4]
4 Q" l' @( K, Q$ P    xchg    bx, es:[41h*4+2]
2 O  F% E0 }; A+ R7 j5 G7 C    mov     ax,4fh7 Z+ q# {; K( f/ g
    int     41h
2 ?' {+ i' F! w4 R( Z    xchg    dx, es:[41h*4]
! A9 q& ~: y( B. G$ _$ b" @, C    xchg    bx, es:[41h*4+2]
- @3 n+ w8 }, s0 ^4 I) c( R    cmp     ax, 0f386h0 w; _" ]& H4 X2 p: A6 L6 N
    jz      SoftICE_detected
: s! Q# Q; T% I& H( K! f" }. [2 e$ {$ g0 E1 }6 ^. j
int41handler2 PROC* |9 o7 ?. u0 k9 @/ N) ]
    iret
) k# C; e9 }$ tint41handler2 ENDP/ c1 W! D3 a/ E
+ T9 [1 g0 M3 Q% ]) ~% N
* [% A$ i- b9 n( C' J/ \, g8 r
_________________________________________________________________________, y3 \7 p4 f- }

$ {4 ]- k' _. ]) I7 m: v
  f7 V3 y* S9 P% g, N2 @9 G7 RMethod 062 X/ F# x$ R. _4 H; V& _9 W! U
=========  i5 X2 Y  b/ i+ ^' _+ @* {

. G  v8 m" l- f' k8 i: S& T' {2 {, u3 z& e6 F
2nd method similar to the preceding one but more difficult to detect:
+ P$ L# n+ Y  v# e  l( M  c5 g5 k1 G# B2 Q

$ j' O$ ]/ u& s! P- q3 D. K* @# X. xint41handler PROC
2 c( v! q9 P/ I1 D, h    mov     cl,al
9 d$ Q# ], w. T- H    iret
: g; g4 M; t1 }- Dint41handler ENDP
" E  |0 J, V1 r3 T/ n
9 ^; A! @  [6 U* g
7 f6 e$ X5 O& c    xor     ax,ax- C+ O. S" E* U
    mov     es,ax  x! K) q% [* C' U5 _
    mov     bx, cs
1 U( ~! g& \0 d5 ]    lea     dx, int41handler
9 Z% y- ~2 q) ^( c    xchg    dx, es:[41h*4]
4 U6 [5 S  W8 _# A& m6 V    xchg    bx, es:[41h*4+2]. H. J& X5 l2 M2 u8 e
    in      al, 40h
& \  ]% ~& z, v( e( h8 k6 o+ I    xor     cx,cx
" L# @* t) ^% |, ]. |6 f; _4 ~; u    int     41h
3 V. O& W* y7 E4 z7 T. i% L9 U- i    xchg    dx, es:[41h*4]5 h% A; o0 u# ^  G8 e5 ?) \
    xchg    bx, es:[41h*4+2]0 U1 A' f" }. l8 r# _
    cmp     cl,al6 E+ h3 J% {' E, o
    jnz     SoftICE_detected
2 j$ j6 e- s: a9 w& i
( v  ?) {8 W8 N& U0 i! W+ F_________________________________________________________________________" e( D: b+ N4 _) s3 t) ]

3 \5 P3 _* U% G  p& U0 m2 {Method 074 M& g) W. @  E! f6 Y& u
=========- N+ u% \/ ]8 t9 }( r

- B, k' @5 j1 F" D0 CMethod of detection of the WinICE handler in the int68h (V86)
! E! m5 c. [6 n/ i7 M( I' n5 v
( E/ M) k+ i/ [' S, l* y: m    mov     ah,43h- U: L( ]6 Q5 [4 J& v, m
    int     68h# q' m0 f5 n% O1 Z
    cmp     ax,0F386h% w: \9 s7 ~( _' j& A" W
    jz      SoftICE_Detected' B  L0 B" S  p& q* |( i" ]7 q

% e% u1 A9 y* n, p0 g
' l$ e) N& l1 n; R& ^' N, z3 c=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
9 L/ d. [! j8 [% f3 L' f  B   app like this:
! x+ e- ~# i0 _) l
" l5 r8 ?+ |' p- B* o, [% O6 Q   BPX exec_int if ax==68
! T' O4 `' L3 B- B   (function called is located at byte ptr [ebp+1Dh] and client eip is" I6 z6 o, O9 k: }1 B( }6 \9 U: G4 i
   located at [ebp+48h] for 32Bit apps)4 {+ Q1 l# p# y3 u* e
__________________________________________________________________________+ `# b# h- H* m4 N9 K5 w
* z0 u9 }6 \7 x4 u; C
3 m) t. Y% H# J% M0 y- P! q; |. h: [
Method 08
; l" W- O$ C/ V/ q' V' C=========' P# [" K3 w  X. Z

+ k. h2 M9 H4 u7 @It is not a method of detection of SoftICE but a possibility to crash the/ \) ?' b# k; Z/ c
system by intercepting int 01h and int 03h and redirecting them to another
0 ^& B) x  h, n9 g7 Q9 vroutine.5 O, G% g" r" J) K
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
0 ~4 H- e/ M9 r2 K5 B+ `9 U4 bto the new routine to execute (hangs computer...)4 M8 c" I: O; ~% i9 u
; h/ o, H: I" q' Z
    mov     ah, 25h$ ?, a* o. ?; L$ t! U+ o2 `" S
    mov     al, Int_Number (01h or 03h): h: W" s" ~9 D/ w! K% ]1 t* U
    mov     dx, offset New_Int_Routine
/ |$ S. d: _' }2 E" n$ o, T6 f0 h    int     21h
* j3 c& N2 X) P% Q; t
. v  ~& S5 z, c7 x# y7 y__________________________________________________________________________
$ c3 C$ a  H: [/ F
! E" i9 U( x& P9 D! H# b* {Method 09
. s8 O6 ]( F1 g& k  S$ h/ a=========) \3 _* k) K6 a, w; g
0 O( j9 M% X) Q  o8 D' M. ^
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
7 n) }% s4 o$ g6 @) V7 _* E2 gperformed in ring0 (VxD or a ring3 app using the VxdCall).0 f/ J% g3 _/ v0 H
The Get_DDB service is used to determine whether or not a VxD is installed0 u( g6 o7 g6 y+ ?- o5 w
for the specified device and returns a Device Description Block (in ecx) for" k: b4 S; {; z. F, j' m- P# a
that device if it is installed.
. w* D% m) q! Y: y
# R( ]0 x5 q: P1 {" h! {3 C4 l   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
  z! [, }/ E! k& O- N- \) m4 s   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)' a3 C- u; a3 J  u, W' J( s
   VMMCall Get_DDB
# z, W; w$ [1 G! `* I   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
. j. M9 h' R! j7 ^; z6 n7 s4 g4 ]  J( ~
Note as well that you can easily detect this method with SoftICE:' F! u5 G4 }8 e/ g- l
   bpx Get_DDB if ax==0202 || ax==7a5fh% F5 x3 N1 @- `0 n6 U* j% t6 N( S/ |

0 g8 c( t2 E% }; d4 O, q4 c- b__________________________________________________________________________
: G- r  F: B; a: u) r" |  Y4 d0 M5 ~  |; y/ `" d; `$ b
Method 10! ?0 }+ S4 O) Z4 G
=========  r& a- P% k, w8 X

8 r' m8 ^: z" b7 f=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with( \) i# V+ t9 N/ e3 s
  SoftICE while the option is enable!!
7 i, o) T$ g1 e) s
4 `9 ]/ s' l" [2 X& |This trick is very efficient:5 x9 Q, P3 Y% h/ j) J
by checking the Debug Registers, you can detect if SoftICE is loaded
  i. |2 j3 i: C(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if8 B/ l" @8 J& }- N2 I" [( a% I! Q
there are some memory breakpoints set (dr0 to dr3) simply by reading their
% q, c* b2 y2 K2 r" lvalue (in ring0 only). Values can be manipulated and or changed as well
2 X. @# T9 o5 B# Q4 g) s  l(clearing BPMs for instance)8 H: \5 X- C5 T
4 y' e4 G3 k' Q- _9 h/ T: ]
__________________________________________________________________________
8 B: K3 ^6 G& u+ Q7 X! J# Z  ]& x! |7 b
) E, V8 B$ ^. LMethod 11/ g0 |# q; T0 u) o
=========8 F: E: ?; c, {. B7 \: p) z

, H2 D3 V! c5 NThis method is most known as 'MeltICE' because it has been freely distributed
' l# L0 k$ J! Z; n& W) I" ]- Cvia www.winfiles.com. However it was first used by NuMega people to allow; S1 L' d" Y  i
Symbol Loader to check if SoftICE was active or not (the code is located
! e; I7 @( {/ K) k: Q: g* h* H& cinside nmtrans.dll).
/ X) S, K, r$ M2 `7 u7 d7 o* O/ N
The way it works is very simple:- G1 z9 p2 t5 U1 ?# X/ l
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for. K& z% |4 n& C
WinNT) with the CreateFileA API.' |' n) w+ ?5 i8 d' I$ ]" J
7 N9 n- G% Q- r, J- T, Z
Here is a sample (checking for 'SICE'):+ j% `4 t6 F$ A% ~' i5 n

9 v, Y% \9 J4 M$ K, n1 c- B9 rBOOL IsSoftIce95Loaded()" `9 y  @3 D9 @) c+ u
{- m( a# ^2 ]* J+ n
   HANDLE hFile;  
. m* J0 k6 y' u2 C* S   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
% k6 r0 f: q- J; X! _" L3 {* [                      FILE_SHARE_READ | FILE_SHARE_WRITE,
4 W, D% O  q  p  T% h: \' b                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);1 N* s2 Y) N' \- D$ G
   if( hFile != INVALID_HANDLE_VALUE )" A* V* x: Y: g' ~4 [. f( z: ~
   {
: {' ~3 j. n5 U( S# k, l1 I& o' ^      CloseHandle(hFile);- t( V. p' o1 ]* f8 i3 B  P6 ~
      return TRUE;  q7 X; Z8 v. T. o: T
   }
6 M+ W! e4 q& u$ E# a4 |2 R/ l   return FALSE;1 n: b: D4 o- P- d) B
}
* I" L" I6 j1 p% ^/ Y- t9 F$ E  k
' x3 [6 T/ k+ [" E! o0 w& g# wAlthough this trick calls the CreateFileA function, don't even expect to be( U2 F7 P" m2 M- S+ |4 h
able to intercept it by installing a IFS hook: it will not work, no way!
5 d" i4 I' c& Y; p4 v, J, I6 WIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
4 F2 ^/ A, T; D8 D6 l6 Z8 Lservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
1 {! ^5 T# v/ ?! \) band then browse the DDB list until it find the VxD and its DDB_Control_Proc
0 X! [! f" T, ~* Q2 F% xfield.
; e9 h7 G8 d# F; \1 z: [, FIn fact, its purpose is not to load/unload VxDs but only to send a
$ v" r# ~! s# c4 vW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)( |0 K: _9 F7 [' n
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
* l7 r  U: s$ b2 ato load/unload a non-dynamically loadable driver such as SoftICE ;-).
3 V6 D1 O& ]* S3 jIf the VxD is loaded, it will always clear eax and the Carry flag to allow- W4 R7 v; P( @3 `, H2 g
its handle to be opened and then, will be detected.
$ z% |% P$ T1 o2 C7 KYou can check that simply by hooking Winice.exe control proc entry point
. B, V- ]" V& `0 S  E5 _while running MeltICE.; G7 H2 Y* E* F9 @% a& T7 p

) N( I2 M9 S! z) I, X! N5 ]& @; C2 T" X; Y7 h/ e
  00401067:  push      00402025    ; \\.\SICE
" K0 P6 c3 U# I' L( C4 e" X" |  0040106C:  call      CreateFileA
& j+ }' G0 g( j. _: E$ h# _  00401071:  cmp       eax,-0010 r" a  h9 y* X" y0 w$ Q
  00401074:  je        00401091: t2 `% D( M% `; d  w" }* U1 f

$ j8 p( U* C  e9 S# d1 A  G! F% A5 ?1 K7 a) X! F
There could be hundreds of BPX you could use to detect this trick.) U* y3 M! U) k8 o
-The most classical one is:
+ h1 n+ j: U. A( _: X1 h$ ^  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
1 J$ z5 b& W8 o2 O- g9 c8 j    *(esp-&gt;4+4)=='NTIC'
1 W; h0 u' b3 W. w6 V  ^! r" u1 o8 [) m6 J6 D
-The most exotic ones (could be very slooooow :-(& d# B( A) ^4 M/ o
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  * B, L( H4 `) A" V0 E* A9 z4 }* D5 S$ n
     ;will break 3 times :-(
( a" p9 l+ ~+ c  }0 _' i) k" I% w8 J, p& D: p3 [
-or (a bit) faster:
0 P/ i9 m2 q% C5 d7 T3 v4 {   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')* `2 j$ [) G6 z( _7 B

" f1 M% q0 y6 w1 G$ L   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
/ Z9 v8 [/ S3 s  k( A$ u     ;will break 3 times :-(1 i2 w5 ?) }$ f$ u0 _

$ h! d9 T$ n, w, _3 l-Much faster:
% f4 D3 S0 j+ j, s   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
  a. z4 U0 \3 m+ |! f9 X+ \/ o0 v; j' P& g
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
' T6 B& k$ Q5 `4 ?8 ]/ rfunction to do the same job:) o9 m- G( t4 B! z7 b( ]- R

; F: F  g, H; }8 Y7 I4 _! L1 w   push    00                        ; OF_READ
2 d- {3 C) m9 Q& B0 C* C  J! j   mov     eax,[00656634]            ; '\\.\SICE',0
9 H8 [7 Q2 O. [   push    eax* F' }! k/ f: t8 Q0 y3 k: K+ I
   call    KERNEL32!_lopen
! X, L$ F8 b9 a, {. B) S" P' i  a   inc     eax' {3 [6 ^  d9 e4 }. K9 `
   jnz     00650589                  ; detected8 W4 Y  E* J0 G. V8 [- U! A
   push    00                        ; OF_READ6 H' b/ k$ M. ]1 B4 _. }$ C# O
   mov     eax,[00656638]            ; '\\.\SICE'* E6 ~; Y( Q, i0 z
   push    eax
1 a0 ]& z) b8 w# N+ @/ f   call    KERNEL32!_lopen0 d5 p' C. Q) P* k. y- o
   inc     eax
' h8 C0 K0 v+ B, D6 q   jz      006505ae                  ; not detected4 a6 M$ G1 }! b% c' }, r7 s
9 @5 R2 q! e2 ]+ j

$ v% x; O6 f: q0 C1 M* q7 Z__________________________________________________________________________
( k& e7 z6 y$ e: M! ^( B+ m" a
' b8 D, g3 g0 A. l/ S2 m2 O" QMethod 12" I; C/ Y$ n" {: z* {
=========
) g  q6 M! u) `6 E" d6 W, f6 }' a0 ~  q5 E& D$ Q
This trick is similar to int41h/4fh Debugger installation check (code 05
; w5 k+ C! w! J. Q3 L& x$ ?&amp; 06) but very limited because it's only available for Win95/98 (not NT)' `: k% b/ F7 y- L  U
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
1 M) ?) d( i7 u: t' A9 T  b$ G2 n6 ]& f0 Q! C# `4 D2 {
   push  0000004fh         ; function 4fh
. z# S+ m5 u7 U* E& k   push  002a002ah         ; high word specifies which VxD (VWIN32)
- [1 q& ~) u: B                           ; low word specifies which service
* d) K' L6 A6 W0 L! o' M                             (VWIN32_Int41Dispatch)/ m% c5 C5 v* o' `; Q* K5 E$ @
   call  Kernel32!ORD_001  ; VxdCall% w' H3 _) p6 y1 u
   cmp   ax, 0f386h        ; magic number returned by system debuggers4 D/ v2 e2 F8 ]+ k
   jz    SoftICE_detected
6 Q  d0 D' P  {/ X! P8 G9 l/ l& G/ t  X4 q
Here again, several ways to detect it:
7 o8 o0 {/ T$ E) B' v+ n* J  A5 U' V: Y' s! i7 K3 G7 A8 `+ z, L& _) d
    BPINT 41 if ax==4f
7 U8 R. g: P; d2 R# }1 O& k4 `1 c$ n$ {+ W. h  B! F
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one. ?# j, n$ I$ S" X4 V* H! p
) G9 d( Y; r  T  ?. \
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A  R( |+ C3 g4 c% r% a
0 P- P: r7 A# U+ C) y% y
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
$ J8 i) O% H& C/ a% z
6 w( B" F$ @) p! C4 ?__________________________________________________________________________% S$ }1 M& O6 |: x/ Z
, i% n2 e5 M, f. h- l+ X1 R8 ?$ o
Method 13% q4 V" \/ L$ v6 d
=========
! F* C* ?( m9 a3 I1 A% p% r8 w: K
  E. H+ J0 u5 u9 E8 PNot a real method of detection, but a good way to know if SoftICE is
0 V  Q6 z' n4 Winstalled on a computer and to locate its installation directory.6 b; `2 t* M& ]( \) Y. p0 Y
It is used by few softs which access the following registry keys (usually #2) :
# a, S0 D( t( j  h1 q2 t3 ^2 G7 d) v" E
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion2 a) _1 |* \) V
\Uninstall\SoftICE- X) P2 B. Y" E- Y/ ~! \
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
+ y6 ]* p  D' `6 y3 e" l-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
3 j4 \. n: d* }  ]\App Paths\Loader32.Exe
: D& L8 b  u$ I6 N, x
1 r$ h9 J, C- Y3 p, U2 j8 v9 E
8 L9 a) Q  u2 I, W- x# H3 Y9 JNote that some nasty apps could then erase all files from SoftICE directory' [/ P/ E& u6 K& I6 X( y4 ^
(I faced that once :-(
% s/ M; W' u# f6 p/ i/ E# K. Y' j5 r# f3 ^* L
Useful breakpoint to detect it:
' N% f- q' j1 ]
& p3 p* S2 f. v( L; I% c     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'3 Q6 ^5 q9 C* |* f3 v

9 H* y4 s+ \8 A__________________________________________________________________________8 o/ v$ g1 y6 E; h# O  N
4 Q5 z+ n, @8 Q0 d
# d7 {: `7 {- \9 s* e" @; \
Method 14
8 c4 D; [% J* F7 J8 E+ k+ G=========% }+ x2 q7 ~  L7 |* J0 ?, M/ L/ r1 R

3 V5 ~2 ^: Y$ J* ~$ ^4 s8 D! FA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose3 B6 @1 H$ l+ E3 P
is to determines whether a debugger is running on your system (ring0 only).
+ R4 v5 y' W* ?3 h- ?6 V; d6 ~6 l# J3 I: w3 O
   VMMCall Test_Debug_Installed! u" q  Q9 u8 k
   je      not_installed1 @& m' r' g0 s' _1 J; `' W6 x! ]
; E% M) b/ z+ ?" W* j, n
This service just checks a flag.7 V4 T3 r1 m6 N& N
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部