About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>3 r; c& e; i2 C+ A# v/ n  c( T
<TBODY>
+ \% o  t% R1 i* r# b+ |<TR>7 \4 U, u( D+ l# p
<TD><PRE>Method 01 ) r6 P  y2 O- p' J0 r
=========. g: p9 Y1 b+ a( @% }: o1 B( Z

8 b0 R+ w; Y* X6 _' [( I, Y* [This method of detection of SoftICE (as well as the following one) is
6 x! q4 S# @+ S) bused by the majority of packers/encryptors found on Internet.
* q  n6 e9 [$ T7 [5 o) B! ]# O* WIt seeks the signature of BoundsChecker in SoftICE
6 o9 P" |8 d2 a0 m9 o9 o; O* P* M$ n
7 D7 m3 D- P, g8 ~% D$ e1 j3 |! _8 r    mov     ebp, 04243484Bh        ; 'BCHK'
0 N9 G! @0 j- P    mov     ax, 04h
5 A/ Y$ p7 z/ x& M, t  \1 `6 H) N    int     3      
! @' E' X3 G: O/ s    cmp     al,4
4 _, Q9 s  W6 t; [9 A9 t  z    jnz     SoftICE_Detected- f/ Q. `% Q! R; A7 x
7 o6 P* h+ L+ R: M
___________________________________________________________________________
, J; u5 K! o: b0 b# H6 Z7 P% n0 J
Method 02
2 M( t( R! z1 E( F8 J6 N6 F=========$ c( p7 [% O1 w' u: W9 \

2 \& H* G% ?! j. tStill a method very much used (perhaps the most frequent one).  It is used
' q$ R4 L1 H2 \) R* X5 I: [to get SoftICE 'Back Door commands' which gives infos on Breakpoints,5 t# T$ X9 n! N  D/ z9 N
or execute SoftICE commands...2 @9 }2 Y' f( Q( D6 c
It is also used to crash SoftICE and to force it to execute any commands  O; U8 ]8 h* K; ~' X
(HBOOT...) :-((  
5 L9 G, L5 N1 _: g9 N5 R( b/ i( ~' u- `  b$ X' E1 V
Here is a quick description:$ l' J2 e& p; v* X8 |) I5 b& h
-AX = 0910h   (Display string in SIce windows)1 |1 J: P! k; G; ~; e
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)5 N" ]( Z4 v) ^9 {5 \
-AX = 0912h   (Get breakpoint infos)' r& A6 D, |" e; I/ m( i
-AX = 0913h   (Set Sice breakpoints)
, q- f4 D7 h1 {  B* [-AX = 0914h   (Remove SIce breakoints)9 m1 ~% e/ Q! f6 ]
( n0 D" G; S4 f/ h/ D, d
Each time you'll meet this trick, you'll see:
: a  a1 Y' \+ J6 k) A-SI = 4647h
9 _# L  q! x% |! b: |$ U+ w8 Z  N# t-DI = 4A4Dh0 n2 j" g9 `0 z
Which are the 'magic values' used by SoftIce.# M% s1 q: n: _/ ^
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
7 K) C+ ^# q$ W* d) ]7 _4 a+ m5 U
Here is one example from the file "Haspinst.exe" which is the dongle HASP; M, m- i& E( f6 ?5 I- ^/ V0 D* i3 X
Envelope utility use to protect DOS applications:3 d1 P2 b- m$ h

/ Z5 ?% A( u. c+ h, I2 ^6 ~' u/ e$ e/ A1 d
4C19:0095   MOV    AX,0911  ; execute command.
% n7 p" p7 k0 S! i( w2 J4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).+ t! @) U1 R, b1 C
4C19:009A   MOV    SI,4647  ; 1st magic value.. {5 C+ w8 L4 `/ a8 U6 A
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
: |2 q& H% }5 n' J4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
9 `, w  |* D  K4 u0 j4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
1 Q* \* K) Z% d; s  \, f4C19:00A4   INC    CX
$ m0 L9 U! F, l1 q3 C/ U% s4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute5 W2 L9 T& G; w" l2 r
4C19:00A8   JB     0095     ; 6 different commands.
6 Z  p( `1 G- f$ o9 J+ h4C19:00AA   JMP    0002     ; Bad_Guy jmp back.% Y, P- `! I+ M; a$ Y, r7 M& _
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
7 V# _3 _( q! R0 _( X4 a2 I" j+ f% v" ?4 l4 f: s5 i  @+ W+ p
The program will execute 6 different SIce commands located at ds:dx, which2 F, N& V9 n( L" w# g/ E, c4 s
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
- t4 t1 w) m$ F! O7 W9 i7 U1 z) X2 Q6 G% l0 ~
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.6 R! ~6 g8 i- P
___________________________________________________________________________
( O& F0 l6 Z- y+ M( F$ r5 g  f; j* x5 T) A1 y( G

% a7 T3 T8 k3 IMethod 03( t; N' L7 x& Z- _0 W* P! X( N
=========
: F5 V+ {, Z8 L; G/ x- Y% W
3 _: [8 ^, K9 PLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h+ K2 A9 \0 `* W% J/ ?6 S  ?8 M
(API Get entry point)
5 A+ ^$ _* c" d* p$ t5 `        6 T; Z! S6 |, b8 ~: n
: E2 I  ~2 C  v& f3 k# p
    xor     di,di
1 _  V/ j* u. N3 \. ?/ o" ^+ P1 W1 F    mov     es,di
9 A1 l, d0 G) R- `  t8 S2 d    mov     ax, 1684h       ) t  z! s$ j! I; H6 p# A
    mov     bx, 0202h       ; VxD ID of winice
3 ?8 j: z9 M/ @    int     2Fh- t. G: i4 i" q* A4 V- J- y
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
+ T4 I: B6 ^) y0 {    add     ax, di
: _0 c6 }" r, n: p2 `* X    test    ax,ax
1 z, E, L/ s2 u: h! O- K    jnz     SoftICE_Detected
  \, h' T& h7 ], w0 {9 L- [* s- I* P; G7 o- y7 k9 x2 z
___________________________________________________________________________. w$ y7 W% t0 p# O: @# R
3 w: B+ K, y7 l1 \( x/ _
Method 04
* Y( n; o$ E" M! x0 B3 `/ z. U. b=========
! |, Z* Z8 J! u. N% e
5 u) e3 t$ ^0 h) \Method identical to the preceding one except that it seeks the ID of SoftICE; ^% z, ], T3 D1 E0 n
GFX VxD.
* [) ^4 O9 [4 P/ u# l4 g# b# S& g, G5 Z' u3 P
    xor     di,di
- Z+ J1 e& e( [6 q+ b0 X    mov     es,di9 {( S( k, x3 q# m: f. n
    mov     ax, 1684h      
2 j& Z% H* @) K6 G  W% o4 ^    mov     bx, 7a5Fh       ; VxD ID of SIWVID
% ^  E7 a  K) d4 W    int     2fh6 |) x! m% v$ o) {  c  z3 l5 @
    mov     ax, es          ; ES:DI -&gt; VxD API entry point3 j* v3 p; j' K0 b  C. i
    add     ax, di
% {& h* s( m9 J: D0 v    test    ax,ax
5 J1 G, ?7 g7 {, Q1 V    jnz     SoftICE_Detected
& }" c7 F  w. z% b# O
$ r9 D. t8 q. o3 y__________________________________________________________________________3 k$ n7 O# z9 ?  V
6 q" ^. O6 c9 N+ i8 v. _
! O) U! `/ y; @. ?1 G. A
Method 05
) U, H4 s5 o% e4 t/ }=========$ v: H) d! z; V% N7 @: {
8 G  ]. n. p1 b5 z; P
Method seeking the 'magic number' 0F386h returned (in ax) by all system8 B5 {+ p8 i; E: u! _
debugger. It calls the int 41h, function 4Fh.& M4 L5 s1 a. }# F
There are several alternatives.  
6 j" v# x4 S/ S9 Z$ m( h; S, ?0 b! a3 r
The following one is the simplest:
1 G7 ~  [; A: G5 ]  L/ ?: b& O& a" W5 [  Z) c6 N
    mov     ax,4fh3 G. I0 F9 X+ ^% E8 z
    int     41h3 s1 D- c& a. x3 I, }
    cmp     ax, 0F386
- H) `) s8 p  z0 q; |4 n+ C/ [' b9 [    jz      SoftICE_detected
/ ]0 h+ {$ M9 w. ^7 u: }3 {- \0 e! L2 a
9 |3 J3 x$ W( i. w6 O
Next method as well as the following one are 2 examples from Stone's
! ~. k2 n) ^9 ^8 D8 C0 r  l"stn-wid.zip" (www.cracking.net):- `( N- l- p& R( B& `; H

! a- N6 @5 \/ e% e9 U6 B" I    mov     bx, cs6 [1 t$ F8 E) R
    lea     dx, int41handler2
1 y! {9 d& h' P8 M4 l0 R    xchg    dx, es:[41h*4]
- Z2 c+ s8 R0 r  A) E3 C    xchg    bx, es:[41h*4+2]7 {: {! R8 J' o& W" P5 {
    mov     ax,4fh1 |9 G: @7 R# h' i: D$ j5 J
    int     41h( a$ l3 v; h: T7 T% q% {
    xchg    dx, es:[41h*4]% a* q. z" x0 D0 Z
    xchg    bx, es:[41h*4+2]
+ ~* C0 w# L. t2 B& Y1 I    cmp     ax, 0f386h8 S9 |3 e- L% j4 J# V
    jz      SoftICE_detected( N" z9 `5 H3 ^! `( A

" M/ ~) O" d; H+ E" X) I1 A: Mint41handler2 PROC; S5 n/ O- T; I. P
    iret
: M# N2 ?  d' i; tint41handler2 ENDP) B7 D4 R2 c( V) F! ~

/ ?  B' B" g% k. a! ~9 p9 o8 a' r5 Z) d( `. L
_________________________________________________________________________
. P3 W1 `: e$ ~) [4 W) }; @& x7 y
" a* T2 B0 g) m  s% `9 U- V
$ c# a$ r+ J% C' ~: i9 XMethod 06
3 \3 T6 f# I' j8 o  T=========$ X$ L$ U  ?/ \

/ p  G0 c% \. y
" l4 y/ F" |$ B1 e2nd method similar to the preceding one but more difficult to detect:
/ H  X: i' J8 J: ^& p; J; `! n9 y5 }6 |6 M- |# D  n' O

/ D& D! c. D7 N2 F/ bint41handler PROC3 E. T; ^/ |% u, j; o0 ~* v
    mov     cl,al
* D& x7 @3 Q5 R    iret
- W/ N; ^& ^5 M+ r, U4 {/ b( Lint41handler ENDP
6 y, _/ g. \& z1 ]2 B% ^& C1 U3 p3 J4 F7 }5 L

4 Z( V$ u0 @) c4 \2 P    xor     ax,ax
9 [$ u! s0 s7 g9 {& s$ c4 i0 s    mov     es,ax
( n& N! y8 s" p- g! d2 }    mov     bx, cs
. v  i$ r9 P" M& x( V    lea     dx, int41handler* c9 B' c: c0 h3 T; c: y
    xchg    dx, es:[41h*4]
3 r% i0 ~5 R; f- ]) t! V    xchg    bx, es:[41h*4+2]0 p+ F$ B4 D; Z/ u$ V
    in      al, 40h
) ^+ W8 x  F' B    xor     cx,cx' d8 k9 Y' w# N4 |% _9 o% }& I- M
    int     41h* G7 K( q, E( a+ E1 ^
    xchg    dx, es:[41h*4]1 q, h9 R4 ^8 e. R7 s( Q& V
    xchg    bx, es:[41h*4+2]% W1 s" U/ _+ d# U+ i: Q8 o4 f
    cmp     cl,al
- m9 R7 \& [$ L- v( H    jnz     SoftICE_detected& B3 o/ q8 C/ ~5 b

, {0 ~7 V+ c1 }0 |. e! A# Z_________________________________________________________________________
5 z  u, S; S0 N! y/ Z" N# _+ G9 y( h6 ?( ]. l# s% N
Method 07
: b1 G' g2 [! W=========
, S. \  D- j' E. k3 E
' k$ b. @0 W6 }! Y8 ?; }  y+ A% gMethod of detection of the WinICE handler in the int68h (V86)& _- x( W) f7 W, n$ F9 }# f* H

7 }& T3 d- S' I+ c& m3 U7 {3 @    mov     ah,43h
7 ?3 D) o3 i8 G  c! K- ^    int     68h
+ `# M- k8 F* o- M    cmp     ax,0F386h6 l& v8 y* l4 _8 w/ f) l
    jz      SoftICE_Detected
/ J1 l/ B# K& j  R  H' c1 h9 T/ u$ `2 r% z2 l
9 s7 ]; C- Y( w7 V5 j- Z
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
- C4 D2 s% [6 }$ h8 p   app like this:
; R# {0 m2 q( n# z9 d' C" l6 s& }7 _8 K: F# [. a! x) I, q  w" E1 r
   BPX exec_int if ax==68
! S* ^) R. g* K  P0 e1 m; S   (function called is located at byte ptr [ebp+1Dh] and client eip is
3 X9 [5 V$ q7 J4 C   located at [ebp+48h] for 32Bit apps)
! f3 p" Z; j$ G- K+ T9 V+ Z9 `5 z__________________________________________________________________________) \$ u5 J& j) \- l

& E2 `- b+ Z5 h6 t1 K8 z( u( B4 C# v
* m' C) u8 X: i  }# e5 k/ [/ Q6 nMethod 081 e5 j! a( ~4 n* J, b
=========! p8 \# z/ r$ E3 ]
7 q7 I6 c7 ]) S/ ^6 U. m
It is not a method of detection of SoftICE but a possibility to crash the9 z+ h7 \& l& [& ~
system by intercepting int 01h and int 03h and redirecting them to another
; t. U) I9 i$ ^5 V' Troutine.( |5 I: j6 p* Y6 {* u
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points* f7 }- G- `  d! {+ W6 Q( U
to the new routine to execute (hangs computer...)+ x/ n. F1 J! A$ J

6 [/ O: G/ D3 F& ^0 V+ q$ J+ u! Y  Z+ g    mov     ah, 25h
' t5 b8 Q! N: T# [( C1 q    mov     al, Int_Number (01h or 03h)
4 g/ g$ o& z3 D  E+ \0 I2 I/ P: y6 V    mov     dx, offset New_Int_Routine
6 m8 P( X* R; c" d) R) o8 r( W    int     21h2 [0 l. }: J0 G: l" j% |6 P
3 q6 Y' P& E! c3 b- t
__________________________________________________________________________
# Q2 n! x! Z+ G! K. p% `4 f
* G1 s$ _: {: I) r0 `Method 09
2 Z* |% W& c3 R=========
! M+ g+ v  C8 ~8 |* p% B7 o" Z  \# O
9 x/ V$ G& \- A/ k8 iThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only; R( W. {5 c' X& Q. `( x, q
performed in ring0 (VxD or a ring3 app using the VxdCall).
/ ]$ x5 @. ?$ z. ]The Get_DDB service is used to determine whether or not a VxD is installed
8 T6 m' G- f! c0 ?for the specified device and returns a Device Description Block (in ecx) for3 @9 }( E. `) Q7 y$ P/ z/ P- l
that device if it is installed.
3 ?1 h- y2 e1 ^- R2 }3 D& Z' q1 x+ R
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID4 g+ [& \# g; v' F) X4 x- c
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
9 y  L2 A( ]! z; ?( E. K" r$ J  A$ |   VMMCall Get_DDB7 E/ B- u' g' ~' _, Z
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed$ r0 ~  U+ s- u& e+ j- k, V

) W* Y1 A, u7 ?. Y2 KNote as well that you can easily detect this method with SoftICE:
" Y7 _, ?" T; |6 z  Z0 S   bpx Get_DDB if ax==0202 || ax==7a5fh
8 r) [3 w8 U+ R  j9 \/ i% s+ c8 b. o1 ?7 A" [0 X8 ]
__________________________________________________________________________6 r9 j6 \8 k8 l
$ y/ q! I2 L4 W/ m
Method 10; X! Z) `" F( Y0 A2 K) [& _6 O
=========
5 V; G3 l, j2 G
3 e# V- o0 S% o=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with: q2 A/ Q) Y. M' ?. w& G$ d
  SoftICE while the option is enable!!
& `# A: ?4 i+ V* D4 Q4 B" y0 r1 n' Q9 W8 X, N
This trick is very efficient:2 q  D8 T( q9 K: g8 w1 {
by checking the Debug Registers, you can detect if SoftICE is loaded
) o/ Z% J  l1 _8 e( W(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if# W1 _) _+ A# ]  v- Q4 L
there are some memory breakpoints set (dr0 to dr3) simply by reading their6 V! v& i8 ?9 A. {( J6 z# ~$ W
value (in ring0 only). Values can be manipulated and or changed as well/ }4 H5 ~8 e5 |+ \/ w, X( x
(clearing BPMs for instance)# S% w. h( A# g; c8 t4 e
8 P! C6 G% F3 J
__________________________________________________________________________  L! b* G" Q! J
0 j7 m  N5 h, x. I
Method 11
6 M9 q9 A  T# x. M- C/ _; ]% Q+ M=========
* x3 F# A9 g1 W; H
1 ~" i9 {& `% y3 ~This method is most known as 'MeltICE' because it has been freely distributed
! ]5 m( ?1 n" @0 H* }; l  nvia www.winfiles.com. However it was first used by NuMega people to allow  M+ k- {2 h, r* i8 f( V
Symbol Loader to check if SoftICE was active or not (the code is located5 S" Y. z) L( |* `& b
inside nmtrans.dll).0 d! [& u2 I8 |) Q. u/ z6 M

3 y. J& k' B4 K& ]% k! @The way it works is very simple:- O& L/ {( r0 F
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for% s. s9 O( A5 E9 b
WinNT) with the CreateFileA API.( f( L8 ~/ O& b: G3 v: u

8 Q0 u1 d+ S. THere is a sample (checking for 'SICE'):
0 z9 \2 u# ?$ N+ d9 q3 @8 i( E3 C+ ]' w5 a
BOOL IsSoftIce95Loaded()' k( Q% `: z  J
{
$ h7 e7 v$ Q/ U) E, }: I   HANDLE hFile;  ( q5 s2 H2 Q4 E: d
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
2 C% Z7 e# U% _! p                      FILE_SHARE_READ | FILE_SHARE_WRITE,) _! V6 ~: H5 v7 `  v1 H2 o0 w* X+ S
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);. H. F: G/ Y- D
   if( hFile != INVALID_HANDLE_VALUE )
4 J: a8 A$ o+ f" _, I! v8 H4 ?5 ^& _& Z   {
5 J2 U, D) ?; u8 a0 Q& d) _      CloseHandle(hFile);7 u0 a( v: `# |; Y
      return TRUE;
2 n6 A# g' M- E8 ~9 `; n   }4 c: ?5 A. w7 E: T0 g. o
   return FALSE;9 q: f2 Z8 I3 Q! k
}* a$ j- X4 @; X1 q5 t

+ p2 q( C9 K- J% v6 r0 ^2 CAlthough this trick calls the CreateFileA function, don't even expect to be: l0 x$ Y* X% M1 j. i
able to intercept it by installing a IFS hook: it will not work, no way!; M4 o/ h, T4 x) p% q; k
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
4 w* A/ Z# b/ [6 S5 ~3 r7 gservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
. G2 J9 u6 l! a  }- [& Hand then browse the DDB list until it find the VxD and its DDB_Control_Proc3 t6 u( e+ D5 b  g
field.: D6 E) q3 t: f+ v8 i5 c
In fact, its purpose is not to load/unload VxDs but only to send a
/ k. ]" P) w) eW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)8 r5 `3 x" j/ _0 {- |, y( P
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
& a5 B7 [. l% X/ g$ oto load/unload a non-dynamically loadable driver such as SoftICE ;-).
& c, Q5 W5 c4 L, m6 lIf the VxD is loaded, it will always clear eax and the Carry flag to allow
0 o- S- s2 h+ [2 }3 bits handle to be opened and then, will be detected.: l! c8 ~' b/ ^' H
You can check that simply by hooking Winice.exe control proc entry point
3 B' s, f4 U( |& G5 Vwhile running MeltICE.
  s8 w- i! q2 A) X) D0 a0 O/ f5 J6 i/ X: b4 z8 B2 T+ E2 A( x: y

3 \8 c8 l' n; f1 v5 v# R  00401067:  push      00402025    ; \\.\SICE$ k) G- K/ o1 |0 E, \3 H% O! @
  0040106C:  call      CreateFileA# }# h( T$ j5 w, G' C9 k
  00401071:  cmp       eax,-0013 `$ N9 X! k/ G% q- N- p6 t; ?# w  O
  00401074:  je        00401091
3 C/ \9 m2 w3 j, @2 \$ U' J  m. [, S9 }. x  w5 G
+ A: t8 ~# `6 E3 w
There could be hundreds of BPX you could use to detect this trick.
5 |3 D& O! u  g; b; R/ G+ r-The most classical one is:) a/ @1 k4 F: @4 E& G5 e9 n
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
" K! c7 ?$ `" f/ f4 D    *(esp-&gt;4+4)=='NTIC'  [- v% W* O( e+ U2 N
- \, K0 _# g" A5 k. I* I; V5 {
-The most exotic ones (could be very slooooow :-(; K+ U# F" ]/ K0 X; M$ A6 m
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  " H' b! @# Z; Y% S6 j8 |3 y
     ;will break 3 times :-(  d" \8 S% |. {9 P

# r2 ]8 ^7 A* S-or (a bit) faster:   x. H1 W/ }( H
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
8 ?& s( D! {4 d0 Q5 F4 p4 Y3 |
( J9 r3 H9 s% D1 s   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
+ j, U, e1 f7 d     ;will break 3 times :-(
" O" j' E/ Y; J) }; j  T, z8 ~. G- r3 a9 N
-Much faster:
/ |. T0 i. i* v/ k/ h% O9 L   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
5 x8 i# j+ c6 x/ @- v$ q7 r9 u! Q- z$ K0 t& Z" ^& V
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen% i9 U+ J4 M* B, X; H$ a, C2 Z
function to do the same job:
9 e+ [: {  ]* b+ G$ d, O3 [  e) v5 e$ f2 X# E! m* _% i4 e
   push    00                        ; OF_READ
: Q" f1 u; o$ @0 P% X% M   mov     eax,[00656634]            ; '\\.\SICE',0
- f4 D  q8 ~7 J) S3 a# ^   push    eax
( o) z& ]$ n! Q! P7 g5 i) S   call    KERNEL32!_lopen
5 [: U1 F5 a  L# L   inc     eax
3 `- f: |: r, N' E, a. L5 p) g# u   jnz     00650589                  ; detected$ ]& a9 F$ q; Z7 }
   push    00                        ; OF_READ
  P4 T4 x+ E7 P% k   mov     eax,[00656638]            ; '\\.\SICE'( F( [5 p2 b. o' t5 J
   push    eax9 c6 _* g8 r2 E' Y2 P3 R/ i( B
   call    KERNEL32!_lopen
! y3 @" ]( Q7 K7 [1 E: B0 V$ `   inc     eax; t1 J1 }" P% ^
   jz      006505ae                  ; not detected
9 B4 H* _5 `; k) o, B, `4 ~6 Z. A2 Y
% H" Q' l, R) h1 t+ k2 {( c, q2 N& e" O, N. n. u
__________________________________________________________________________: G( P3 H& ~$ g5 z. O2 y
% }: V# G3 k/ s3 E4 [
Method 125 J! }; \6 q$ z. {, k' N
=========0 G& x2 @; p5 p& C/ _
4 U6 E2 M$ m9 P( `8 J1 D- M7 G7 T' @
This trick is similar to int41h/4fh Debugger installation check (code 05! j" I( B- i' [' G5 r
&amp; 06) but very limited because it's only available for Win95/98 (not NT)  p  F& _% i, Q' Q# `4 }; g
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
" Y) p" i% ]( G/ v3 Q# P) y4 z7 P+ z6 {( n. [8 ], g
   push  0000004fh         ; function 4fh
7 u; I, U) Q$ j7 X   push  002a002ah         ; high word specifies which VxD (VWIN32)
0 K4 p6 |; F9 L                           ; low word specifies which service
( t6 o- c$ p7 M8 ?3 m5 {                             (VWIN32_Int41Dispatch)) n$ r- z% Q+ j, P. h/ O7 o
   call  Kernel32!ORD_001  ; VxdCall6 @6 _+ A8 ?0 c( Q: e- k
   cmp   ax, 0f386h        ; magic number returned by system debuggers
9 W% u) w4 D& M) Z7 Z) g   jz    SoftICE_detected" ?3 ]$ m: p) o* Z; p4 E) v  U

# E" e1 f8 X& v5 e7 YHere again, several ways to detect it:" j5 i5 Q7 e  [# m/ q
. {8 f1 [+ b1 `. n4 P# f+ j5 N6 @
    BPINT 41 if ax==4f
9 V; s! j2 z1 k* c1 H5 ?$ Q
9 E& v$ N# ^- Y( c) ?    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one8 [: Y; P/ r% |$ ^, i
8 T/ m1 F# |" M( A% E2 D: `
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A, o! v' v# n4 h6 S  G1 ~1 v' m
) r6 i. z" A3 d5 V5 o9 t
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
# {$ d3 _( O8 |9 u/ D0 B* X, Z! J. N# ]. U+ D: a% S
__________________________________________________________________________
7 y6 v: A) W+ h  Y& o$ P% }2 N: u
" t# X# z; c- ]" a) sMethod 139 X" b9 Y3 q5 P2 H) Z, k7 v
=========5 o+ ]: P$ g  |
. e' r1 o% v! A" W* |! M! y  e
Not a real method of detection, but a good way to know if SoftICE is
: J1 D# d* T! h! f; Y, C6 R4 I% Cinstalled on a computer and to locate its installation directory.
$ Q1 x$ S8 G$ \- jIt is used by few softs which access the following registry keys (usually #2) :
/ O$ @, d" b7 I9 R4 V3 C/ r1 M' w. P: B  _& y
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion' B  x7 p; d1 V0 F* t' x1 \! y1 b
\Uninstall\SoftICE7 @. [  s0 l3 y$ J7 f8 v: h4 h
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE4 t9 D4 M8 q! p* ]: b# O
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
. u& E! V) a  \" v  t\App Paths\Loader32.Exe
$ J+ K6 P1 C/ @9 h* ~* D' U
6 a' x% s5 D+ s" ]  x
) x& r4 V8 |( P& yNote that some nasty apps could then erase all files from SoftICE directory' t- t2 F, @9 f8 Z
(I faced that once :-(6 _* t) y, D8 i+ E

% r* a6 Y" p! i. p( oUseful breakpoint to detect it:/ I2 w8 P! l) C( Z4 k- A8 v
6 z7 b. @9 D3 s+ V8 E2 h0 ]
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
( h! c% G5 O* c* Y0 ~* j  `) K! F8 q& @1 w: F" s1 F
__________________________________________________________________________8 Q) w4 V5 F- M; E' r0 K  F+ `
% M% _+ X5 q1 @& y! T- B

$ V* S8 X) a  _4 U- o/ G, AMethod 14
- B* Z5 }* @8 T4 H$ Q=========
: P# s7 a$ R: i) w3 n; Q/ n) a8 Y( Z6 g
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
& O) J0 m" o4 ^is to determines whether a debugger is running on your system (ring0 only).
( ~8 |3 y! G$ c6 @) s9 @( `) [, Z4 ?
   VMMCall Test_Debug_Installed
. @9 j: v% h7 U   je      not_installed3 @/ f* ]# a, S" Z

/ U& {; s6 G1 Q+ _This service just checks a flag.# R, U& K4 l8 r0 ]5 @% {/ z; d
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部