About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>- _" M7 [- `- Q0 s
<TBODY>
; ?+ H9 \8 D" x( Y7 b. B<TR>0 ^7 C9 A. X7 r  n
<TD><PRE>Method 01 . f* t. Z* c: |! v
=========
' o! Y) _3 |! Z% V+ z- ^, x' j9 P; w
This method of detection of SoftICE (as well as the following one) is9 |9 h4 @; g8 h0 [8 u! d! T
used by the majority of packers/encryptors found on Internet.7 a2 V7 ^5 B2 Q: O
It seeks the signature of BoundsChecker in SoftICE4 `5 }- \6 \! ?+ ]

2 B* K0 t% b- s# @( H, |# o    mov     ebp, 04243484Bh        ; 'BCHK'
! \* ]8 {( h+ v: ]4 N    mov     ax, 04h
9 V5 G' D+ N8 q) i- r    int     3      
% L$ c3 l/ b3 {. Q; x- ?    cmp     al,4
1 l$ s$ D8 g- u# T    jnz     SoftICE_Detected
; d1 n- c& d5 E( X
4 ]" k1 z0 D# i+ ~7 U! X* y+ p$ P: t___________________________________________________________________________& _; Y+ F5 P' W7 V% o7 f- q
' A9 a, w% Z8 U. `* B
Method 02
& N3 a7 n$ v: }( q=========
* w4 ]/ e: y  E7 Q! y, Q6 L+ \- q9 p
Still a method very much used (perhaps the most frequent one).  It is used
; t- M7 B( k+ Q' Mto get SoftICE 'Back Door commands' which gives infos on Breakpoints,# W2 j8 a# b' [7 G: T& y; K4 |; x$ ?
or execute SoftICE commands...
6 Y, ]2 o& Z* {3 Z0 ]7 I7 O9 h# X( kIt is also used to crash SoftICE and to force it to execute any commands
) U. d* a% X6 v$ I# E7 r3 D- Q(HBOOT...) :-((  
' D/ U# j6 u' M- B3 r, x5 @1 x# h( a  x. E& F( L1 \) l  t0 C
Here is a quick description:
' q4 O! D/ ?/ x& G-AX = 0910h   (Display string in SIce windows)
9 U, d0 X- q2 C) i8 y+ c-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
3 ?5 R1 t; U$ M: y; p$ c-AX = 0912h   (Get breakpoint infos)
9 K% m; B$ ~& D0 k5 O-AX = 0913h   (Set Sice breakpoints)
; w: Q9 U, F8 Y; Z( o-AX = 0914h   (Remove SIce breakoints)
1 G+ Y8 q. Z, U( o/ U- u( B
9 o5 D# A& O, w* X+ S, d1 p% E( `Each time you'll meet this trick, you'll see:2 E; k+ [! r7 J; t
-SI = 4647h
2 K  k$ |. ~# o' _! j-DI = 4A4Dh: M: u0 K: y. [. `8 s9 w
Which are the 'magic values' used by SoftIce.7 W, u: l5 t7 o( M+ k
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
( F3 y: {7 L+ V& h
  s5 d( b0 s, }: P& ZHere is one example from the file "Haspinst.exe" which is the dongle HASP
2 s' z7 Q3 ]' s6 lEnvelope utility use to protect DOS applications:
; c; A0 s1 b9 E7 X( p/ e
" J3 @5 S$ b1 ~5 ^& Q; U% V2 P( g& L) z3 J8 B& }- B, j
4C19:0095   MOV    AX,0911  ; execute command.+ W4 S8 Z. C9 ?/ T! F
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).2 u0 a% j+ j6 H$ T3 i
4C19:009A   MOV    SI,4647  ; 1st magic value.) k- E' C  N, B
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
. o+ @( q$ o; [" ^( ?" j; @" |4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
# K" b$ Q, c' v& N. E4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute9 S2 W. N7 f4 V% Q9 f7 J
4C19:00A4   INC    CX) i  ~% {) @6 c  O6 C  d
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
- s: s! O8 @; W5 v% ]2 e% i7 Y5 @4C19:00A8   JB     0095     ; 6 different commands.! }1 e9 C$ N/ V: H# u7 p
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
4 R: H$ D5 R: G0 @' I2 J4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
" S5 k) w8 X4 S) [# n  N8 y* J; b5 ?: P4 T% l4 l
The program will execute 6 different SIce commands located at ds:dx, which
, k- \( L7 s( E+ Fare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
( I. b+ @! [/ w1 s4 O* ^
5 T1 P& g9 v2 @# \1 M* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.! Z* v- z7 f' u" T8 E
___________________________________________________________________________
3 p. \- |3 t* L9 D2 ?5 c$ P9 b! Z" @
, I9 L1 c% h8 R: l+ k9 y: R1 I
Method 036 q7 {. c: e& k/ M7 A0 f1 k& i
=========. |% W6 ?  p1 w% f: f' r( ^$ ~

: q- X1 b/ k, |* i4 CLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h( \+ T/ K9 t! X" P
(API Get entry point)# p+ u+ v- J, o: N
        " N% I) I" h: \, I  Q9 c

* U! |# `7 H# S: h, ]    xor     di,di1 `9 G4 g3 u. S8 a7 T. C! `  U9 J
    mov     es,di& p: v" ]8 k* F
    mov     ax, 1684h      
% x6 x. @8 J+ F, D. e3 h& q, @( w1 V8 [    mov     bx, 0202h       ; VxD ID of winice
9 {. R+ ]" L5 p    int     2Fh
1 P' ~0 t, }; s& }: s    mov     ax, es          ; ES:DI -&gt; VxD API entry point
$ B; Y# o. J/ H    add     ax, di  Y  O3 X5 Y' n) K6 n% F
    test    ax,ax* F  f: g; [; }$ k5 D- z7 P7 G
    jnz     SoftICE_Detected
2 @) b* t/ ]3 b  a
$ l: A1 w) j! w- p3 [: z( N5 `___________________________________________________________________________& L* x6 f  ^& c7 F4 i& c( U
6 c. _, @& a5 [" H
Method 04
2 s' n; E4 Z- P- |5 x2 i=========0 e+ E* ^, \- r$ T

# d, @5 u4 I+ F+ L5 _0 Y. `. h  |Method identical to the preceding one except that it seeks the ID of SoftICE
9 m# R: \* @- p6 ?& [# ~& tGFX VxD.4 r5 o# B5 j3 ?1 D3 [* B

* v, y. ?1 a) C! _/ E; I/ s/ K    xor     di,di
8 }8 C0 V+ `' h& R2 Q    mov     es,di
3 q: X/ m: R3 m    mov     ax, 1684h      
3 e( ]1 M* i# O5 Q9 ^    mov     bx, 7a5Fh       ; VxD ID of SIWVID
# i' n3 C. r, w8 Y    int     2fh
  A( q4 A+ P/ V( a8 m    mov     ax, es          ; ES:DI -&gt; VxD API entry point
/ a/ a& T5 U, M8 {! z' C& X7 n    add     ax, di
7 \0 B$ R. B! x# b3 U1 @6 l2 q    test    ax,ax
9 L0 v: T' M3 K' h    jnz     SoftICE_Detected
9 K7 m$ v" O' B* {1 i$ J& z+ @
# f& Y; S2 ~( w# O__________________________________________________________________________
' D8 s) {: D- s+ F+ }+ C2 h) _: ^% [) f0 m

: d' h$ Z- @5 ^6 C* a2 l/ OMethod 05. K7 Y6 v7 P- S) z4 @
=========
5 Y1 I6 l0 z' p) Q% t, w; n: J$ c
/ b/ Y* D) @+ c0 D# }; KMethod seeking the 'magic number' 0F386h returned (in ax) by all system# a0 ?2 _0 m* k2 r2 n. H
debugger. It calls the int 41h, function 4Fh.
5 o2 M8 R/ {0 H  dThere are several alternatives.  6 ^. W/ b- Y0 C  o2 R4 k

) ]) t/ @, d! n/ YThe following one is the simplest:
# s5 R2 Z8 p+ |4 Q
, Z1 A: d( o" ?& n+ K/ y1 [, g1 x    mov     ax,4fh
; R$ s2 J: [7 `8 Q    int     41h/ Y( K9 ]8 k# O" U% m
    cmp     ax, 0F3862 B/ k" y: Z, I. H
    jz      SoftICE_detected
' d  l, L# F, [) e9 n4 j5 A8 r$ h" U* `! O( k% C
' |2 u7 c4 k( G, H) B# l# _
Next method as well as the following one are 2 examples from Stone's 7 e8 ^9 d; P1 {! L. B' m7 x; K
"stn-wid.zip" (www.cracking.net):
8 I  ]# [; T6 J& s) N  i
+ k% {  H/ P2 m0 v) I9 \+ m. Y  ?    mov     bx, cs4 p2 Q( O5 k2 g) [
    lea     dx, int41handler2
& S8 d$ v  X* l: X    xchg    dx, es:[41h*4]
' y" t5 M$ R$ K6 K0 n! A    xchg    bx, es:[41h*4+2]
' n1 i( L% ~! Q% p& \, u. V7 J    mov     ax,4fh. `( T, }9 {0 L/ ?- y
    int     41h' _0 H- P7 D) H- i/ U/ x) A
    xchg    dx, es:[41h*4]0 ]8 Z2 J2 D) u9 t3 X0 ~$ u- {, x
    xchg    bx, es:[41h*4+2]
6 Z' C' o8 F9 S. }7 O  Z0 \    cmp     ax, 0f386h' v3 R9 P; `) ^$ y, Z5 ]
    jz      SoftICE_detected, v! g" [* Y  W( v4 |! C" Y

1 @; h$ w4 l8 O: [# }- G. {int41handler2 PROC- C. @3 {& r6 t( I" a/ A& Y
    iret2 S6 m5 o  d8 j+ a) d' p7 \7 [- d
int41handler2 ENDP
) _: O2 n9 S2 z' H1 M" R8 t+ t: l1 ?( z- {
3 N# p0 u6 ^7 N! H4 f
_________________________________________________________________________2 ~  w) y6 Y6 ?7 z2 h, E5 [4 W7 E
# X5 _, B$ d6 o
/ @+ T: Y) D8 E7 j8 D5 v
Method 06  d1 e2 y) I- s! I
=========
6 O1 e2 N. U% |# a
2 J/ k  [' n7 q2 X, f- n  c# H/ d9 ^/ a2 \- Q
2nd method similar to the preceding one but more difficult to detect:
* A) I, N0 A+ {$ u2 u/ p% T2 R' R, I1 [, }

1 @+ {+ z! {  W  R* K  l6 K4 `1 bint41handler PROC; @4 D; ~( O$ H6 X
    mov     cl,al  U$ F0 N8 V$ g- Z
    iret
; i7 x; G; N; Sint41handler ENDP
# e3 d+ l2 v% F+ P5 b. _- Y" Y! B
! Q+ Z( R# l' `" q2 U& e' w3 P/ Z
( ^% c' ]1 k2 E$ y    xor     ax,ax; f8 W" m! i8 `9 @
    mov     es,ax* q0 z4 l7 `3 j) ?% v3 A! ~
    mov     bx, cs# b+ \) a* Z5 l1 \6 @$ ^
    lea     dx, int41handler9 f' y) H, N: D1 k+ R
    xchg    dx, es:[41h*4]6 x" j4 e) F2 _3 s1 _
    xchg    bx, es:[41h*4+2]
8 t' u# J  {3 c# c1 U    in      al, 40h* U/ T! Z; ?% d8 i! u# B/ @2 L
    xor     cx,cx
. s& d5 T- A6 {' ]    int     41h
9 a. b3 ]. ^! G% A/ N    xchg    dx, es:[41h*4]4 B! b  p7 W  g, ~% ?
    xchg    bx, es:[41h*4+2]
; w9 m, P  d5 T    cmp     cl,al. }; _( j. @) R# w
    jnz     SoftICE_detected
' B2 B( q5 z( X3 {: }8 g
6 Y  Z! p2 [) O! e! G( F_________________________________________________________________________0 x; @  @3 i1 n7 i  K" _) Q
) n& C1 }4 b* Q" A- ]
Method 075 l  i! u( I! |# Q
=========
; A; \# A: s/ f. ?) F7 k$ ^, a( V  E4 i2 M' d
Method of detection of the WinICE handler in the int68h (V86); d* w7 Z9 {4 Q+ L
( U. q) {$ g" @/ \2 {
    mov     ah,43h- N* j1 {" ?, S* s  o
    int     68h
! @9 Z% r! G( L* U" ~- z0 t# S: o/ k    cmp     ax,0F386h2 ?7 v4 c+ i4 C9 ?! R: g0 D7 P/ Q
    jz      SoftICE_Detected
& K6 |6 P! z, b/ ^
; ^- {1 F- Z  G1 T/ i) d
- j7 u( o# B# B* \: c=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit) y* U/ B+ t/ h' X% P
   app like this:
) j' N- g7 L7 f1 ?8 r! y( c" G' l0 t; [+ A6 L
   BPX exec_int if ax==684 ?) I& D3 r3 e2 W' S0 D
   (function called is located at byte ptr [ebp+1Dh] and client eip is
9 L/ f0 C* t- L! W& t   located at [ebp+48h] for 32Bit apps)
1 s+ K% @; H2 K3 E* P& l__________________________________________________________________________9 C3 L" y& f3 y% q$ ^

* b/ Y1 D: X5 O4 q% \
9 g+ j& f  E% i9 @/ M2 W7 t) j4 ?Method 085 C3 c. O! H1 c9 C  L
=========4 Q& Z8 T* z# @/ e4 m

+ A! }4 z* m" |' s6 K( PIt is not a method of detection of SoftICE but a possibility to crash the% c. |$ i1 V* s& ~) r+ W' A
system by intercepting int 01h and int 03h and redirecting them to another
! `  {! ~. w, H8 t% I) froutine.
) W. E. I, v* J" p; hIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points% n6 s/ G9 K! q/ A  @  M$ d
to the new routine to execute (hangs computer...)
8 [' |5 O. m0 E) I7 |' x: v: U& e$ A2 L2 t0 U
    mov     ah, 25h6 k. U, a5 @1 `; n) W, Y8 n$ L
    mov     al, Int_Number (01h or 03h)
( F( F; c" H2 S* @  H/ c    mov     dx, offset New_Int_Routine
9 k( t( p6 X% H9 b+ m    int     21h
: A3 F: o- j/ {7 T7 Z+ y6 i" n5 }5 i% I) @: [
__________________________________________________________________________% f9 y6 [$ `; o5 i/ N3 |
2 C' M' P6 ?2 O$ }3 k- h
Method 09
! X/ m" z0 W, G# r7 N2 m$ L=========: `% X, \. q# P$ d

" l! K' W# @, {9 OThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
# z2 k6 P5 h, [" ?performed in ring0 (VxD or a ring3 app using the VxdCall).: T9 U* |! X5 k# m6 L( d
The Get_DDB service is used to determine whether or not a VxD is installed
  P  G: X5 c+ |) ~. Vfor the specified device and returns a Device Description Block (in ecx) for
: c7 T; K8 D' H8 n- T8 Qthat device if it is installed." [( Z; G  ]4 [! s' f* l# Z

0 T! {: E1 P( n1 H! U! |; G   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
- p& `. w5 U; [. Z   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
% _! i, I: N/ X/ _/ h3 `' m   VMMCall Get_DDB
8 E; x& |1 E& s& M6 z   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
! ]. l  I1 ~  K$ `$ K) N6 Z: V0 W
Note as well that you can easily detect this method with SoftICE:
, _2 M9 {7 v* z1 e' e9 n+ s   bpx Get_DDB if ax==0202 || ax==7a5fh$ J; I% P6 f3 i# l7 U

/ h# M9 D& J; b. E7 F__________________________________________________________________________) k2 {' B1 J0 i( H8 z

" J" [( ]8 {" C. Y" n9 D3 xMethod 108 w5 p& ^4 d# O" ~0 Y  ?4 o
=========6 I0 U+ I: r" A

! D# p5 X7 u" u% K% w: p- @0 p3 d- I=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
! H& x( G8 I9 G* Q; S  SoftICE while the option is enable!!  |6 R; N2 X4 f4 e8 c* U( V' U

/ L- ]3 m/ A- qThis trick is very efficient:4 R& J) q# S0 o  y$ n2 Q
by checking the Debug Registers, you can detect if SoftICE is loaded' B: D7 |4 a9 N) V& i8 V
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if# p, ^( a# x5 O
there are some memory breakpoints set (dr0 to dr3) simply by reading their
) ?, k9 F) ]$ e0 s- ~6 c& z# N( H. uvalue (in ring0 only). Values can be manipulated and or changed as well, D. D8 }# }4 e( H4 a# c, m. Z  _1 s
(clearing BPMs for instance)" Z- J, t5 l% U+ Z7 V
9 i7 @1 z! [' N" D
__________________________________________________________________________
8 P5 ^+ Y7 t. q9 o# |% _1 a
) ~1 j$ Q5 [$ J1 Q, F- mMethod 11+ j5 K3 d  t0 E( P' ?
=========
; R; x: A3 ]" T# x* k
! h' I( q0 O6 n  oThis method is most known as 'MeltICE' because it has been freely distributed0 O5 U( K4 l0 w  Y" b
via www.winfiles.com. However it was first used by NuMega people to allow
# v/ g* ^) K7 `8 Q+ O& tSymbol Loader to check if SoftICE was active or not (the code is located
! `& a: o  |: X, K4 Minside nmtrans.dll).
5 N1 U% z! _( P0 u+ g- A' R4 k& `, ?8 l1 o/ x  e( y
The way it works is very simple:
- l" ?$ h  a& x! LIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for3 e( M  I9 f6 f) y( G8 X* C1 f( v
WinNT) with the CreateFileA API.2 T8 R3 q- I: a* I  F; A+ {
0 H" j& a) g$ q1 R6 B2 p
Here is a sample (checking for 'SICE'):
1 D$ `9 j, H. `7 |$ b; R0 c, I" r/ \$ K8 Y* B- V# K  ?
BOOL IsSoftIce95Loaded()# f* i- \; T$ C( [: N1 z+ U& }) H
{8 ^1 B; h& c, o
   HANDLE hFile;  
2 p; m5 Q. w8 }1 o% j   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,& c9 O( {% k& ]/ ]- H- }5 M
                      FILE_SHARE_READ | FILE_SHARE_WRITE,
/ M# v$ q( E' b8 ^$ n                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);2 O1 S1 z1 m0 ?" W' v2 a3 o# ]
   if( hFile != INVALID_HANDLE_VALUE )  k+ }- F$ f( @( o* b
   {& E' d% Z! `: m* Z
      CloseHandle(hFile);7 z1 Y6 s( Y2 d9 M9 A' y
      return TRUE;
! `9 d( B" d- p   }
2 M# M& q3 u6 l   return FALSE;1 K: ]4 A: e- P& c
}
9 I4 U! A( I6 e- |) T5 y) j- C0 G( c, v' ]1 Q0 m
Although this trick calls the CreateFileA function, don't even expect to be# L6 g) {& G5 c  g2 i0 [8 C
able to intercept it by installing a IFS hook: it will not work, no way!( u" }' I/ n. }" @) |! R
In fact, after the call to CreateFileA it will get through VWIN32 0x001F4 ~9 F4 K! }3 v: Y+ y
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
) Q6 K6 H  ]( D6 c# D' j6 f- a; gand then browse the DDB list until it find the VxD and its DDB_Control_Proc
4 U# o. L# N( E2 X& j& m/ P4 I$ _field./ X4 u. \6 Q$ F
In fact, its purpose is not to load/unload VxDs but only to send a
" ?( |% V( x2 r: B+ b' ~# i6 o! ~0 y2 CW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
4 |3 C4 n% ?" H" k3 i' ]! Ito the VxD Control_Dispatch proc (how the hell a shareware soft could try6 S. D. @2 s; S) N7 w9 n, S
to load/unload a non-dynamically loadable driver such as SoftICE ;-).: O5 M) n1 R) K, @  I. o* C3 j5 \
If the VxD is loaded, it will always clear eax and the Carry flag to allow  S5 N7 `1 A0 ]. k/ |9 S
its handle to be opened and then, will be detected.
* V/ S! x5 U1 i8 O. BYou can check that simply by hooking Winice.exe control proc entry point0 c! T7 |$ F: ?* P0 P# R0 p) M
while running MeltICE.
- @( N# Q5 }/ j  q0 z& K7 V7 D/ A" r6 d# A' q4 W

: S4 K# K* m% Q. }9 \( {2 e. o( Z: U  00401067:  push      00402025    ; \\.\SICE
, z0 d& d2 l- [* b) `  0040106C:  call      CreateFileA5 @# p1 ]( x2 Q+ k3 \( o- m* T
  00401071:  cmp       eax,-001
! X4 p  h/ j, R$ H% Q/ J; e* e/ ]  00401074:  je        00401091- x- C. j2 l# ]

4 \- v% z' G! A/ E- n* }7 X- F  i- Z( X7 r# V
There could be hundreds of BPX you could use to detect this trick.  L4 F* J0 c8 u  z5 Z$ y
-The most classical one is:3 @+ ]& m) v! x& X1 V! ?# a* I0 v
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
' \. }* n5 b: `4 o3 G) {    *(esp-&gt;4+4)=='NTIC'
% J3 L) Z5 l  d9 ^4 r+ \7 R* |7 S, l. C& h0 D8 m
-The most exotic ones (could be very slooooow :-(+ B; H. R! l2 U) k; `) R
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
1 l& ]& Z( D2 b0 w5 I* I7 Q) U. f     ;will break 3 times :-(
# D( i/ }3 g' N) U3 q3 B0 ]- K. I5 @  y' W# D7 X# [0 b( L+ U) _
-or (a bit) faster: 3 M" S0 E2 Z0 D+ U9 ^' `
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')3 a) Z% Q0 H0 \* I: g- w* E
. }4 c' `$ K* Z0 b$ u" A/ k
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  $ J  r- V( L$ |# ?1 c" i. x% D1 L
     ;will break 3 times :-(. e% Y& G$ t: C

0 S. O6 ?* g; U$ S3 o8 d* L( M0 c! x) d-Much faster:6 |) O1 T. c9 b6 {, J
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
( L( ]; j( N0 J$ X% H- o$ |' a
) s- S# l0 n0 P2 o9 mNote also that some programs (like AZPR3.00) use de old 16-bit _lopen9 p- V' \" v9 R0 H3 j
function to do the same job:. j- T6 x: t) F$ y: x( A% m

" Q4 x2 P6 J9 z* @8 e) I" K   push    00                        ; OF_READ
7 w: l3 N! {9 ~) D2 f2 z: B   mov     eax,[00656634]            ; '\\.\SICE',0% F, p9 D, _; I8 _1 e' L
   push    eax  j" p1 K5 f! T8 x, x8 _
   call    KERNEL32!_lopen% ]: ^+ `& l; K! z$ Y- n
   inc     eax$ k5 D( z& h9 }( l& h
   jnz     00650589                  ; detected
4 x9 M+ o6 |+ U! b- a   push    00                        ; OF_READ% k" E6 D0 {2 u. M" I0 M
   mov     eax,[00656638]            ; '\\.\SICE'
8 g( Z3 u% e5 m8 Q* V# V' Q4 U  ?   push    eax& f3 I8 ?) ^' }7 [' o% @
   call    KERNEL32!_lopen' ~0 V2 `7 Z: f0 o
   inc     eax" ]$ j- |" k! @% R
   jz      006505ae                  ; not detected
+ y. B7 e6 Z$ ~0 U1 i$ G
* B0 H7 w1 V4 a0 n/ u& x, h, y! V: w  R/ }- K2 m4 N
__________________________________________________________________________
# S, P% j2 K9 S+ h/ Z/ x
7 S1 l5 A% ^/ YMethod 12
0 t. Y' D: x& _+ e! i# U=========
& U* Q) x! x' d# \& t1 g8 x( ]- z; {. v, K) Q9 t$ ]; u7 Y
This trick is similar to int41h/4fh Debugger installation check (code 05
. ~/ C4 `( F3 x' F, m&amp; 06) but very limited because it's only available for Win95/98 (not NT)$ U% ~( G' l. t; l/ }0 ?# w
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
4 A& ^- [9 m7 c# ^) M. e
! J1 e8 ^/ w! R6 F   push  0000004fh         ; function 4fh
. G$ m5 [, f+ P% s8 |3 V! N  z   push  002a002ah         ; high word specifies which VxD (VWIN32)4 _4 N& x( x" f: b3 n
                           ; low word specifies which service, @# r* s' n) t, B8 Y6 w8 U7 b
                             (VWIN32_Int41Dispatch)3 }, L; Z' H7 R$ J4 G1 i5 A
   call  Kernel32!ORD_001  ; VxdCall
0 S/ h+ E5 T, s/ h2 k$ Q   cmp   ax, 0f386h        ; magic number returned by system debuggers
2 A* n$ D% e6 [- ^( C9 |   jz    SoftICE_detected
! i3 J( \$ }4 {7 }0 k! {! M2 |: p: u  l7 k  y
Here again, several ways to detect it:! q! ]- H" r- S! `- n+ a: b* O" W' J& p
9 I) |! N5 D! m0 |
    BPINT 41 if ax==4f2 @1 U- p4 s) K7 x

% G. j3 ?0 P1 m8 Z( k  F& A    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one( c: H* Z+ y8 P3 R5 i2 q4 W3 I
$ V, b1 Y. M* m  [
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
, `8 h" s3 b6 V& I0 N4 T- N1 N" E* m: Y. C! l, h/ [+ p5 l- U$ @+ U, C& ^
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
( o5 d, v+ C9 ^, B) D4 K- W
; X4 E# h2 X, D3 R  b4 U& e& t__________________________________________________________________________
0 J! D' F3 E8 i( `& W9 r6 G. Q# ?( L
Method 13
3 P3 J/ s/ E. a6 L* g2 O* }=========" }) P5 m) G4 m, F: W0 L/ k

9 E2 h! D* S" T' I8 M; XNot a real method of detection, but a good way to know if SoftICE is
6 m' q; Q1 I, [" I& K7 sinstalled on a computer and to locate its installation directory.5 [+ a1 J7 u3 w; t" c
It is used by few softs which access the following registry keys (usually #2) :# y* ~: m3 U" x7 c5 h& E$ B

2 m  j& ]8 T4 L/ `3 V1 V& l! _-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
1 \" {3 P2 }( E4 u1 n\Uninstall\SoftICE
* |1 z) h0 E0 z9 `, ^# [- k7 u4 O-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE/ l* a8 T4 e0 h5 v" z" B. e6 ^$ F
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion# }( T' w) f8 K
\App Paths\Loader32.Exe& G  m" ^" Y7 ^$ I
/ V) u  {4 j: {* J- O
2 j) a+ W3 F: K1 }' r7 b3 q
Note that some nasty apps could then erase all files from SoftICE directory
- n8 u8 _: _' W( B9 a! n(I faced that once :-(
. K% n/ g% p$ X" X. W; r5 v% M  W
Useful breakpoint to detect it:
6 n# Z- V& k* ~6 l6 x  Y3 p# S! w0 }% t) L! p
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE') S$ X. `. C7 [* x( O0 o3 a0 |

  T% e2 v' M# Q4 U+ {, l__________________________________________________________________________  i9 k. a0 p0 J9 i5 ~$ T, h2 K8 P
. C% A4 Q' F/ n) t& g
3 W6 [: a1 a8 D7 [& Z9 Z
Method 14 1 l/ Q* w" x8 `: ]/ B+ z* ?
=========
2 f6 g5 o* I  _  b2 r
5 E, c* A  U1 v5 w2 _A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose% X6 j& O2 Y4 o6 l6 Q3 y4 ]
is to determines whether a debugger is running on your system (ring0 only).
. N- m  r5 e/ l4 E: U7 y" o& T4 z1 D0 |# b% x) h. a$ O( @
   VMMCall Test_Debug_Installed
) f4 v8 V4 \7 _4 L7 p$ O   je      not_installed
! `. Z* w- T% j( N9 |/ S" w8 t0 p' m) E
This service just checks a flag.
& A( A0 r  y. |6 V$ E</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部