About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
9 ^7 u5 H2 F6 T3 O7 Z4 {( Q' ~<TBODY>0 [" K- \/ b) [; o4 N
<TR>
# t4 Y* P* T0 C  f; k9 O+ g& M<TD><PRE>Method 01 $ I) _  y2 S5 M$ r' z
=========1 j3 [: m0 m; D8 B( B, v

, u& f  N6 g; f6 j# r; |- G  ]This method of detection of SoftICE (as well as the following one) is
, |& k, e* Z  Q0 cused by the majority of packers/encryptors found on Internet.+ N+ V, q4 m. e, ^- x
It seeks the signature of BoundsChecker in SoftICE
0 _, s+ H+ P) z( r
1 R0 Z, H  t/ y; ?" |& C9 m    mov     ebp, 04243484Bh        ; 'BCHK'
! O& \6 t% Q3 b4 T+ A    mov     ax, 04h
3 s; q( {; z  S' a9 }    int     3      
( M. X' \: {: x5 J  g1 t, \    cmp     al,4
( ~* ~1 P2 a# N! t$ y: a  {. ~  H% d9 t    jnz     SoftICE_Detected1 `; j4 h- V1 n. ?, A

  C  X( D% Q" k  X9 ]___________________________________________________________________________8 l: B+ d2 t- x! U3 _1 W3 c# y0 Z
7 X1 }( F2 e( E$ _# F' E
Method 02! p- R4 v) k- }% q, V
=========
, `+ J9 N( [5 K
/ K2 c8 L. Y& w7 E% O* oStill a method very much used (perhaps the most frequent one).  It is used
" i( Z! p* K& p; j- sto get SoftICE 'Back Door commands' which gives infos on Breakpoints,. B) m1 C9 C2 \1 I4 C
or execute SoftICE commands...9 O$ F2 z& b$ I2 M( ^$ v' J- Q
It is also used to crash SoftICE and to force it to execute any commands
- W& J8 F& r2 u, S' e7 T+ u4 p3 w(HBOOT...) :-((  5 i( N3 e# j, Q$ \# C
- \. y, c. |  s8 ~+ E) c4 w# G
Here is a quick description:9 R5 H* _4 F: g& o; e
-AX = 0910h   (Display string in SIce windows)
- T5 D0 c$ w+ c# X5 D( e: K-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
. F& K2 W$ S5 Z- u1 ^) g-AX = 0912h   (Get breakpoint infos)* l5 u% E( @2 [" V
-AX = 0913h   (Set Sice breakpoints)/ p/ C8 f7 _! s
-AX = 0914h   (Remove SIce breakoints)1 x) s5 n$ A/ }2 y1 Q- k
8 ^8 d3 m  c2 B8 J) U' T: E) k5 z
Each time you'll meet this trick, you'll see:
8 U3 A" Z) p, i4 V" e) t* l-SI = 4647h
9 C0 h0 e# [4 t( v$ V7 |-DI = 4A4Dh
+ h6 h% x$ X: B( VWhich are the 'magic values' used by SoftIce.
) z- I4 G  j  ?For more informations, see "Ralf Brown Interrupt list" chapter int 03h." r* z) V' ~8 h1 a* G1 ]

& V( I: w2 D. ^1 r& L; b" `Here is one example from the file "Haspinst.exe" which is the dongle HASP
3 n. n$ d- J6 o3 H. f% [Envelope utility use to protect DOS applications:8 O+ P! g, v& o. D+ T# P+ b$ X
5 Z; \( j- P) @5 [) r7 C

6 Y) J' m' c; x) j+ Q4C19:0095   MOV    AX,0911  ; execute command.
( ], ~1 V2 M" P) ]  s! G# v8 d0 [+ N4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
3 ~% w. n$ ]6 m2 V9 Z0 u) K4C19:009A   MOV    SI,4647  ; 1st magic value.
* c+ C2 ~# M. {$ j( u( k% t4 J$ ^4C19:009D   MOV    DI,4A4D  ; 2nd magic value.( i& y3 W3 e) s: n2 U0 ]" ?: q
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
% n9 G2 K: K6 k2 Y' @' i8 N: ]! H4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute5 _% c4 i" Y1 c, A6 F
4C19:00A4   INC    CX
% Z! O, m5 e3 ~& A$ Q* I; x4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute/ e5 {* i* B1 v9 O
4C19:00A8   JB     0095     ; 6 different commands.# [! N; x2 |# w4 X. v
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
. x+ f! A  z1 c# J$ J+ P3 i; b4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)& z; H7 @# z: Y
& p; G/ s1 u4 w3 f
The program will execute 6 different SIce commands located at ds:dx, which4 r: H2 L( n, f6 a! p6 n" H! j
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT./ P4 G8 }% D# ]' |
: M' o6 g  S2 ]+ Y# ^+ [
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
+ l! E9 M. v: H6 F" ]___________________________________________________________________________+ g% E! M0 O, H: s2 f  j7 {0 v* l
. U! f7 Q' J5 l+ G
# @- a: T# H2 _. I: X- ?
Method 03
# }. X6 D* _( T) m1 ^=========
+ B" w3 T2 v# T8 ~8 K' U) a
: \" x4 O! M/ ]0 L/ yLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
% F& T9 D! k& r(API Get entry point)
( f8 V$ z" D( y* J3 `( v9 o* c        . Z! Q, ?2 l  M! [/ z& I7 T0 i
$ D$ x/ O1 e4 V* e; {
    xor     di,di
# F$ ~7 c" Y1 t5 u6 n- C0 _    mov     es,di3 i4 `7 `  z: m6 w5 o1 r# n
    mov     ax, 1684h       + \' X; L. L7 g6 {
    mov     bx, 0202h       ; VxD ID of winice
$ m+ Y+ A% ~1 R- l    int     2Fh. W& ]/ a; S  p' n7 B" t
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
  Z2 B" v0 C9 ~4 Q  W    add     ax, di
# v, q1 |* V! `1 k) T    test    ax,ax) T+ c" u) m7 w( m. Y
    jnz     SoftICE_Detected5 s) J9 l) g; B# j% w+ S

2 x, Y4 @7 M- Z2 ?3 [9 I; v! B+ C/ H! k3 }___________________________________________________________________________3 w; p2 u1 Q) a' w8 a; M: K3 z, V* [
) [/ R, E- @9 i$ d* G5 s; b# B! X9 T
Method 04
4 l* p, Y8 c6 j" `7 \$ K7 p+ Q=========7 [0 }9 y7 ~2 Z

, M' P, i" C9 G( r) _1 X, ]" ]Method identical to the preceding one except that it seeks the ID of SoftICE/ }( Z8 `% y9 Y8 C* {) A( K
GFX VxD.
! I% _4 n4 c4 O8 O
  ]- _0 ]* X8 B* Y2 G    xor     di,di' c, Q, @9 V& J9 i' w
    mov     es,di! n, Y' @' }+ I, s8 r$ w9 ]/ H
    mov     ax, 1684h      
4 B5 a3 R3 B1 M$ o6 M    mov     bx, 7a5Fh       ; VxD ID of SIWVID
  ~4 L; ?1 b0 F1 n# j0 v, ]# Y    int     2fh9 ?3 N2 F2 _0 E
    mov     ax, es          ; ES:DI -&gt; VxD API entry point. t# O, C1 f% j( e; w
    add     ax, di+ G& i7 a0 {: i  _$ c
    test    ax,ax: I# ^- h4 G# K7 K3 [- y- I+ L
    jnz     SoftICE_Detected
) M8 b. O) }1 v  ]/ C+ W1 D
" }* P  O. j" G__________________________________________________________________________: \5 u4 u* M$ ?, G

( ?4 C4 d8 s2 M5 f& K5 o# {5 |5 g3 @/ C9 K1 u0 z0 K; Q3 D
Method 05
0 D/ ?9 }! y0 i6 s( G  N=========
+ U8 O& L/ i/ {  i% f
7 c0 U/ O1 |$ l8 \6 l2 I1 nMethod seeking the 'magic number' 0F386h returned (in ax) by all system
( Z0 d' T, _9 Cdebugger. It calls the int 41h, function 4Fh.3 z5 d# n; z* z2 O+ l
There are several alternatives.  7 k8 o4 P7 `; R
* w' |& v3 ?( b! n& m: I
The following one is the simplest:2 |% B1 p& W7 B% Z# U2 q' v# F
# @8 c% l0 [% E, s# m9 A
    mov     ax,4fh
  W/ Y% g- d) S) B. A    int     41h( u1 t7 |% }! j$ q
    cmp     ax, 0F386
8 S9 y5 B! B! x" M4 U" \6 |& |    jz      SoftICE_detected
6 c% f9 A* O4 l- ?" Q7 J
; x6 T2 \$ {" d( z' D/ F0 `& R3 \+ P1 b. v: P, S
Next method as well as the following one are 2 examples from Stone's 7 x3 N- {0 W3 E
"stn-wid.zip" (www.cracking.net):
0 Q; M( e$ Y/ I4 o9 k' n8 @! _- K- q4 p  L
    mov     bx, cs
4 t# L, S1 k  X$ |1 U5 h- B    lea     dx, int41handler2
7 t0 k9 }. E5 x: d5 z) n    xchg    dx, es:[41h*4]
! N; Q) g3 N) h$ u    xchg    bx, es:[41h*4+2]
  K- m8 q) K2 R& K; f4 m* J/ U5 H    mov     ax,4fh
! N# \) ]7 E6 A4 f6 e    int     41h
+ C; k. P# x4 W4 u/ p; A    xchg    dx, es:[41h*4]
8 o6 }! d8 ^% g) X$ k    xchg    bx, es:[41h*4+2]/ O1 [$ G3 V! @8 O
    cmp     ax, 0f386h- L4 ]) e8 J2 Q' [: b% K$ f
    jz      SoftICE_detected
! K1 }3 f4 Y5 \' w' Z) w& p
. Z3 z9 X. D! ?% a* Mint41handler2 PROC
0 l8 i: u1 v" [! Q6 t! Y9 P    iret
, M! h4 y% ~6 s* T! zint41handler2 ENDP! }$ Q8 I) H7 N' M) K* t: u

5 y; y7 g& A; e2 y* h# w
# a$ r$ ^  P" V( n. ?_________________________________________________________________________
6 u3 ~: I. D' a: n% Z, S1 E8 D' \, C8 Q( j. t. ?, k/ a

* E9 i/ W6 Z/ q/ a( c& U: uMethod 06
% z/ P' Z* `+ Y7 Z, Z7 Q& T=========
+ z! G2 t; h' ?& o
* |# P8 B0 C1 x( O, N$ R$ j
$ R  M3 h# ~) s& b9 K* w/ ]4 {2nd method similar to the preceding one but more difficult to detect:
) `+ t* ?& D% s# |0 R6 d' l
! w' w/ U( R& @. J# o" ]- {% x! j" a2 l% _
int41handler PROC
1 A; e) o, o2 J* Y" E    mov     cl,al, J  Y2 l5 w& v" @+ N
    iret, r, B( ^; @7 x3 k! w4 X
int41handler ENDP( W& X4 m4 n5 n- J3 f. [# k* c3 H
. f* O$ W! `/ \5 ~3 \/ \  w
+ W/ `' j3 ~7 t2 T& ^3 v/ h) Y
    xor     ax,ax
2 H! D$ w# I  J8 @8 }! ~: p    mov     es,ax: q* |  I/ e3 _# S# k
    mov     bx, cs
: n) |$ x6 m/ B) s% e9 a    lea     dx, int41handler' J% S. w$ S  q$ a; `' N8 h+ x4 V' R
    xchg    dx, es:[41h*4]
( o+ `1 z& p6 c( @. m/ \3 v. h+ Y    xchg    bx, es:[41h*4+2]
2 }" ?. ]: k( P+ z1 n7 E: _# N: g    in      al, 40h
# `& U& v. q4 [# J+ H5 R    xor     cx,cx
# q" O  q, }' F6 b7 B$ q    int     41h
" _8 h  Q) J3 T) Y    xchg    dx, es:[41h*4]
  P8 L! O5 a. v7 {1 r# k( N4 g- `, ?    xchg    bx, es:[41h*4+2]
0 g6 E; C6 U. a/ r; |$ W9 p    cmp     cl,al
4 x( p( p) [8 O$ t. |    jnz     SoftICE_detected
* q$ a. o7 f! W( e6 @: w% |7 a3 m$ F/ n# ~3 m% P( x
_________________________________________________________________________( ~6 O- h1 y7 v  s+ ~
  Z/ j2 A3 u: N5 q# {
Method 07
. ]) D( Q7 J( G/ z/ n=========' j# X+ P+ Z' b
0 o4 a" x) G3 ~0 A! V
Method of detection of the WinICE handler in the int68h (V86)
" Y% K" E* f1 U- W/ z! W' d' y4 ^6 ~8 F- u, B8 w: E
    mov     ah,43h, y2 V3 P' t6 z6 [5 |
    int     68h
3 j: k$ }. z  _2 o8 U) x    cmp     ax,0F386h
0 n2 X4 i/ \; `: b) E    jz      SoftICE_Detected5 p+ I5 ]9 y3 }# @$ m9 G

( z; I  R. B! m& [; I/ Z* Y
  @9 _+ q% N* G+ B: M/ D=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit5 p2 }2 \0 Z' L8 L/ u. d- B2 s+ X
   app like this:6 `$ |: w3 U$ C/ K* Y
/ T! ~0 Y" E% G  F  A/ @0 J
   BPX exec_int if ax==68
/ H+ n, u# {7 A. u   (function called is located at byte ptr [ebp+1Dh] and client eip is% L* ?" G* L3 ]. a; H) x
   located at [ebp+48h] for 32Bit apps)
3 t4 f2 P/ b) `__________________________________________________________________________
* e3 @! @5 x/ G7 g) Z( D& Z- l) H0 u$ s3 U

7 Y% Y7 F  F( ~! GMethod 083 O* \" s& U# F6 [! N( v
=========& \9 c* b9 H' u5 K

! [7 K3 ~* V; T6 o" T0 aIt is not a method of detection of SoftICE but a possibility to crash the5 s0 @  A+ v+ R, f  H* j6 E
system by intercepting int 01h and int 03h and redirecting them to another$ w1 b% N* ?: j, }2 y
routine./ a! C: u% M3 j: y$ C4 @
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points6 P( [5 G9 P. s
to the new routine to execute (hangs computer...); x) |1 ~2 f" e  s9 |0 `

+ _% }* m4 A' A9 z: Z    mov     ah, 25h0 @, i* l3 o8 q: o: O5 y3 V
    mov     al, Int_Number (01h or 03h)# o0 f' H7 t" a6 }4 Y9 h$ a
    mov     dx, offset New_Int_Routine1 W( b" U0 g% M  o$ ~  p4 {
    int     21h
* ~2 j, ~, e1 H* i( R! _0 C! Y! Y; {4 [( i( G- A. n+ J" w
__________________________________________________________________________
! [/ s; z: T/ d8 ^
- n+ N8 n8 ]" uMethod 09
4 S+ s) I3 l) V+ j=========; J4 v' q  M# z* g
# r1 k- G" p: m  [& U8 U7 z
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
/ f; \& b( m1 }) K' j& p0 B: i! Wperformed in ring0 (VxD or a ring3 app using the VxdCall).
* `  M# k* f4 |$ oThe Get_DDB service is used to determine whether or not a VxD is installed
* O! b9 c2 }& V; P+ vfor the specified device and returns a Device Description Block (in ecx) for! ~: S' T7 o% s+ j; u7 l
that device if it is installed.. `' N$ ?/ o4 M7 ^8 N- A3 n

0 z/ v5 H1 h5 A# `   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID' J4 @/ z3 A# ]; u4 G- h5 V
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)  e! X% q6 H  @7 }
   VMMCall Get_DDB/ R8 Q& ~6 y7 y0 R
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
- j/ P, V3 A; K5 M% `. D+ I
+ ?2 M" ^1 a7 pNote as well that you can easily detect this method with SoftICE:6 \# J$ q& S6 t' ]
   bpx Get_DDB if ax==0202 || ax==7a5fh
8 ^& d; S7 L) v) K" M% E- m- G& B3 n" K0 Z
8 {% F" Y; {5 F' Q7 K, e0 ~__________________________________________________________________________6 v" t8 H7 g1 G

, r5 A9 e4 q+ uMethod 10
5 r9 c5 K. N% w2 y: i, W; E=========  L: K0 C/ K2 J4 d9 G9 `" }7 E

) R# P: y) I0 C$ t8 y=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
: P) k/ r+ {6 d5 L( \) F  SoftICE while the option is enable!!" s; u! g; \3 q

  S$ ]! `: |/ h# `! j$ l+ IThis trick is very efficient:
& Z& ?. A: E( M1 R2 w# Oby checking the Debug Registers, you can detect if SoftICE is loaded! B$ X# `& J% I3 a" G- D
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
  x9 ^# \0 w2 k% X7 }  q  Kthere are some memory breakpoints set (dr0 to dr3) simply by reading their
! d+ B; e4 A' ~: Ivalue (in ring0 only). Values can be manipulated and or changed as well1 |" C& {! D# _2 Z
(clearing BPMs for instance)
. h* y+ X2 q/ z* A. I( e' _9 Q: f# ^6 p" V  t
__________________________________________________________________________# {! h9 l% [% Q+ @
# b# V" g8 a$ W* I% P2 ?( X7 \" k
Method 11
0 r/ s) c( t# J0 Z5 y$ O) w$ G=========
9 |) G- o- m! ]4 u6 o# \- `' L
$ v5 b4 }. @9 U4 x; T" X+ UThis method is most known as 'MeltICE' because it has been freely distributed3 \: m8 }$ `- w! f% F" `
via www.winfiles.com. However it was first used by NuMega people to allow* ]  i1 T3 {  Q% J  h5 {7 Q- F. r7 t
Symbol Loader to check if SoftICE was active or not (the code is located
* S$ s* Y" b% }0 k0 ^" Oinside nmtrans.dll).& t. V7 a8 ~0 C+ }$ S
5 ]1 z9 `: E. N6 Q; w3 Y
The way it works is very simple:! n0 h, P- g2 s1 X) a6 [5 }
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
7 ~2 v" B' N% _WinNT) with the CreateFileA API.- O, x: O" X6 O) ]& @- h3 c# X
5 p8 I6 G" k) h$ x# d
Here is a sample (checking for 'SICE'):
4 o' z+ ^8 [$ s& R, Y8 s0 j- }) {6 X) q. v( b/ L- k
BOOL IsSoftIce95Loaded()! m% S- r! \2 r
{! T' \1 Q/ w( X; m* ~5 l
   HANDLE hFile;  & v) e& y  H- W- y: S1 a2 V9 {
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
+ U6 Q) ~6 D3 M) i+ ~                      FILE_SHARE_READ | FILE_SHARE_WRITE,7 x5 I$ ]/ \+ V3 _! o" }; v
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
+ a* x6 u1 g/ `0 u! F- h& g- x   if( hFile != INVALID_HANDLE_VALUE )
( g$ ]4 \$ H1 H' v6 Z8 ^0 h" _   {, @3 A& _" C; g, o% B* L& S
      CloseHandle(hFile);/ N2 f0 F+ j* f: l- a
      return TRUE;
% M% g8 a( O  b. Y5 N   }
7 h2 a- _8 p1 G7 R6 @2 t   return FALSE;' v& m! r1 l, K: j$ s
}
$ V( f6 b; _; P( ^
) Z3 c6 k$ l# S% p2 \) q4 D; |+ R. AAlthough this trick calls the CreateFileA function, don't even expect to be9 V8 S: i4 O- c4 E
able to intercept it by installing a IFS hook: it will not work, no way!
* o: `, w- ?  j( x' ^! ^9 uIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
, s1 q* X1 q& \. mservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
( o6 ?) s% u* ?$ Z/ V$ N: n8 yand then browse the DDB list until it find the VxD and its DDB_Control_Proc
' v, J& u7 q, _/ w0 u- \, |field.4 u9 f% l  V6 A8 k, D9 [4 n
In fact, its purpose is not to load/unload VxDs but only to send a % f; K/ l7 r* w' Q2 |
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)1 d/ Z& O" O8 O' R+ s8 W$ U
to the VxD Control_Dispatch proc (how the hell a shareware soft could try. M* a8 \) j$ V0 Y9 g8 {
to load/unload a non-dynamically loadable driver such as SoftICE ;-).4 @$ u3 I- e# s% h( D, m
If the VxD is loaded, it will always clear eax and the Carry flag to allow
; Z( R' B! X( x. v' @its handle to be opened and then, will be detected.
- f9 X' @! z# _2 C+ y  _4 v6 l; bYou can check that simply by hooking Winice.exe control proc entry point2 I1 A5 B0 O, t  h
while running MeltICE.
0 F6 P) x  Y0 H0 h1 X: l- r  ?$ ~% K8 K2 z1 Y+ X+ t# P
( k- w: u  {4 i3 H+ f# w
  00401067:  push      00402025    ; \\.\SICE6 M6 z6 Z- L3 e' a
  0040106C:  call      CreateFileA
' L" p4 w; L+ ]  00401071:  cmp       eax,-0014 d' ~; z% ]! u
  00401074:  je        00401091
1 |+ B4 V: P- C8 I9 a% a. u+ k& W* G2 [* Y9 T: r6 {

; [7 z; v! a! e0 d$ ^There could be hundreds of BPX you could use to detect this trick.
/ a# ?# e3 a& x7 i) M: [, z-The most classical one is:
# z3 Y8 x! y+ @& h+ T  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||: }- C5 A" i5 ]5 v. u+ N8 D
    *(esp-&gt;4+4)=='NTIC'
% H1 j9 ], W  x/ z+ V) i
- U' h6 @- H- G4 g-The most exotic ones (could be very slooooow :-(% {9 A+ d8 K* A6 _; |% \- B
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  % h- p/ J* l  ]# f* m
     ;will break 3 times :-(
- q. l8 g' J( M, f) A$ t2 w) B: V# D3 W) D0 g: r
-or (a bit) faster: * L3 {; K3 M) N9 h5 A( n$ N
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
7 u/ U$ x9 ~. f) J  y9 b
( M% n2 O$ b7 m: }$ M   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
4 s. p9 q# ^* j' E2 u- B. s     ;will break 3 times :-($ o0 F) D+ a- H! p5 I) }1 S" o

: ~  U0 N5 i3 [: m5 a-Much faster:  V# V- ]" V- B  V
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'0 \6 W9 F/ Q( J7 X5 L
% I- Q4 B: j4 f6 p2 D, `- q
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
  W* c6 ^! B8 nfunction to do the same job:
4 ^2 V6 `1 J9 o( }2 h+ G
, q" o# r/ s( F7 }3 k   push    00                        ; OF_READ: X! p/ [8 F2 h  U5 d
   mov     eax,[00656634]            ; '\\.\SICE',0
" f9 t4 J0 _0 O; X   push    eax
7 A4 s3 f, E7 y5 M+ d! ~   call    KERNEL32!_lopen
" d, h/ I9 o+ Y8 g: L' q   inc     eax" V( X4 F; ~7 q8 }
   jnz     00650589                  ; detected
) h  h) p$ l7 |8 b' Y2 j( k   push    00                        ; OF_READ
$ {4 L* s' ^( c1 }9 D+ d/ s. }/ F   mov     eax,[00656638]            ; '\\.\SICE'
6 x3 Y+ m" `) g8 X: a+ f   push    eax7 U  h  a3 _- x
   call    KERNEL32!_lopen
  X# F! S0 c9 ~) n' S% Q- n  `   inc     eax# d( K+ j+ K, U1 q- H
   jz      006505ae                  ; not detected, g. {" ~0 u& U+ `* o6 V

- M1 {) t% X& p/ |+ H6 w3 g- x( N% a* C6 Z. U
__________________________________________________________________________
3 |1 t0 ~/ h* S  b, W% O2 V/ [, }" d& B
Method 125 U( G6 m) ?2 X( B0 y0 q
=========
0 ?( A6 @! P6 l# Z) |& m  f9 e3 c* e8 y& V
This trick is similar to int41h/4fh Debugger installation check (code 05- ~* S4 w  h' K( Y5 B- K
&amp; 06) but very limited because it's only available for Win95/98 (not NT)
% m! p* r8 A* ^as it uses the VxDCall backdoor. This detection was found in Bleem Demo.% |# L% V8 Z, ]' x* T
6 L  x. s' r# l9 B. g' B  w
   push  0000004fh         ; function 4fh' b' p/ P. g6 @( I' F8 V2 o
   push  002a002ah         ; high word specifies which VxD (VWIN32)
9 l9 j$ k; {2 u* L- b2 n% D                           ; low word specifies which service
+ p# g+ F# l/ w* v3 w( k9 k                             (VWIN32_Int41Dispatch)
- S, I5 _4 w! b. a  K! o6 z   call  Kernel32!ORD_001  ; VxdCall) @5 @4 t: Z4 P
   cmp   ax, 0f386h        ; magic number returned by system debuggers" t0 T2 }( U$ r' x5 C9 q" W
   jz    SoftICE_detected1 {2 q) a  Y' `8 z9 M( ^4 Z9 ]

8 {, }2 d7 K$ `7 W9 d& M8 UHere again, several ways to detect it:
* K3 U3 D1 {2 c+ L. T$ |4 x* L8 m1 h+ y5 i
    BPINT 41 if ax==4f
+ V1 q3 b* F7 u9 v) m/ `! l6 b# G' B
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one4 G8 C7 m: b, @. z$ i
7 v* L# X8 f# _3 z: V
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A8 p! e, p! }  U# @2 f

. ]( ~* i: b0 \    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
' k! _  Y9 u4 m* S1 m) k! O6 J8 C/ y% c% Y
__________________________________________________________________________* w: t7 _, z. k1 T2 R6 E
4 [! Y* U7 m/ J0 @
Method 13, _7 L; m, E7 w; @/ w# b
=========+ D+ J! U2 W4 c% W! I# [5 |& X* k
+ s( l8 d( l! h$ H! @8 }
Not a real method of detection, but a good way to know if SoftICE is
7 L; B* \6 Z6 W/ Cinstalled on a computer and to locate its installation directory.( Y% a$ g/ d: c! P
It is used by few softs which access the following registry keys (usually #2) :2 I6 q& t/ y+ F' o- t

  D  u9 V7 z7 e) h8 v$ h' W) k) M8 z-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
. a5 `0 L8 }# T' |\Uninstall\SoftICE
+ X+ q" }: [, {6 n7 m-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE$ e0 \! q9 J  k7 K7 G5 b7 u
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion- t. L2 K) x  K4 X( ?6 m. Y
\App Paths\Loader32.Exe
- J1 a4 }  z  i. J; J" _; T, [4 T. i+ D+ D( G! R; L' G
1 A" W" Q: A4 m$ X3 w7 |6 j
Note that some nasty apps could then erase all files from SoftICE directory
8 |$ r1 d5 b  R8 X, t% i8 G0 L+ F(I faced that once :-(4 U, f5 J  o3 B* P8 W4 r1 ]; b

! Y, D, @, O* _, uUseful breakpoint to detect it:3 `! {5 c# k# u: f+ @' I7 K. r
( k) R; j& f- t0 K+ B
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
. B: R% K4 e4 Y# P, ?2 g1 K. K; D7 C! I' k2 @5 z
__________________________________________________________________________! h; ]4 N# X. [0 M6 s! h7 S' b/ t
) P" s6 G" z& ?9 F- t

! R# c" U6 U* G% j* j& {8 H1 K8 dMethod 14
5 @2 S2 \% b/ K=========
* F, W4 ]( m9 c3 o  h9 m* @& I3 z1 p0 |. \, _# m; a
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
/ U: z! j8 A# f, X7 Tis to determines whether a debugger is running on your system (ring0 only).6 o0 u- Q( m2 M

0 g$ o( |, Z  y   VMMCall Test_Debug_Installed- s, R+ C& t0 S# ?7 n
   je      not_installed% o' b; X& o% R9 X! x

) _; h& E7 E  Q+ y2 d3 u. qThis service just checks a flag.
& z( T# z5 u( d  w" ?</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部