About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>) [" l: D1 Y" Y/ X
<TBODY>
. _. _& X$ n( D3 S) T<TR>
8 X* [3 g9 J0 m8 K<TD><PRE>Method 01 ) u: ^  @/ ]$ C' B. S* L4 [: V' o
=========
/ V/ G8 \; `( V: L# t7 v' t* \- @8 ^  y
This method of detection of SoftICE (as well as the following one) is& O# G. D7 ]. k/ `/ J" k
used by the majority of packers/encryptors found on Internet.
0 t) j9 \1 ^% B- r% nIt seeks the signature of BoundsChecker in SoftICE
5 X1 A- g& O2 c; {/ i) I8 }# ~0 @  ~2 y7 ~  V
    mov     ebp, 04243484Bh        ; 'BCHK'
6 j" T9 u+ f/ A$ X2 w    mov     ax, 04h
! G3 {  [8 R* L8 Y1 [# ?    int     3       - E' `1 o' b1 F/ \0 ^
    cmp     al,4
$ n& c2 z7 Z; @% Z6 x7 j9 W" g0 F% X    jnz     SoftICE_Detected* [6 {3 d( f4 q& n. m
. H' k3 a2 k3 l" B
___________________________________________________________________________
$ s7 }5 r5 V8 c* `3 X, b7 x' L7 P
0 M" V% P. h, n+ F8 Y, NMethod 02
( u' E% v. N! L$ I) A) O+ F=========
; @' Q( y  F' |. [8 h, U3 r
" H0 v; w3 U7 v0 y" ]  L" zStill a method very much used (perhaps the most frequent one).  It is used+ C- h! P. ?8 a" A+ N. ~, S5 `+ y
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
% j; y0 ^  c6 k( U/ Kor execute SoftICE commands...
* E2 r* C2 `/ X1 eIt is also used to crash SoftICE and to force it to execute any commands
& [  [+ ^& x$ @1 ], ?(HBOOT...) :-((  
8 v- `6 Q+ \. D9 W. r7 @* V2 x" g( Q1 S6 L& u9 _. B4 A, \; l$ t7 T
Here is a quick description:- c' g3 }3 B. k& e
-AX = 0910h   (Display string in SIce windows)
! M- }7 a2 h$ W& N9 u-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)5 ?/ Q" U& i7 r6 R; X! g* S& Q9 \
-AX = 0912h   (Get breakpoint infos)0 [, v  |7 t/ H3 b' p
-AX = 0913h   (Set Sice breakpoints)
* W1 O' [3 U  n$ |-AX = 0914h   (Remove SIce breakoints)
" [7 U0 B7 X+ g: l) _" P0 j
% N! C# i1 k) X( ^( M8 l7 @1 I7 XEach time you'll meet this trick, you'll see:
0 P3 u4 u) }. w8 }: i-SI = 4647h, `5 K& ]! c. ]3 M' Z2 l( v, l
-DI = 4A4Dh2 J: H7 ]  X+ T! l- B
Which are the 'magic values' used by SoftIce.6 a4 U) J( v$ |" r5 n
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
; \1 f& X0 X8 @4 E7 u! |4 C2 X5 I, Y6 X. i- a5 d1 e8 ~: y$ X5 X
Here is one example from the file "Haspinst.exe" which is the dongle HASP; b7 N9 h! ?; \, n* C
Envelope utility use to protect DOS applications:
& v$ X: S* p' \8 H" H" m
" h8 _4 F. H0 E) z, x/ \7 V1 X. S: \5 k6 a2 I+ F' p5 ?
4C19:0095   MOV    AX,0911  ; execute command.
3 u/ B  k  F0 K0 ~* q4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).( y& m6 H0 m+ h0 f, w
4C19:009A   MOV    SI,4647  ; 1st magic value./ W6 B; ?2 Z+ v1 r$ {
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.$ h* o7 |0 [( A/ o: ^7 _: M- A
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
( C9 [3 }* o4 b4 p4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute/ i: {5 ^5 N  [, w/ A
4C19:00A4   INC    CX! p1 y# g% Y( U; D1 T
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute3 e6 V* F" k: R5 k# U$ |6 a3 g
4C19:00A8   JB     0095     ; 6 different commands.
' k6 O, M1 j0 G4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
+ E& O' Q" [/ o$ |2 E: {4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
, r  H* q' }% x1 U0 d" j
: z( y% i2 i/ w/ l5 ^6 DThe program will execute 6 different SIce commands located at ds:dx, which
4 J9 M" X* C" y( S8 v' \# E( `4 Iare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.. A) y4 l% g- V" Z- o4 O% j

3 F" q% K$ a# v* n- g* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.9 w! Q- h  t1 {& T# f+ i5 G
___________________________________________________________________________
+ Z# f7 N( I' s9 X. U+ {0 Q" D9 Y# ]. m" X% c( t8 V% Z2 `
8 M# y) P/ x9 `! I+ W$ n
Method 030 K' |4 }, u0 V1 B
=========4 W& |$ j# ], X. ?
+ t% B4 \) j" Y; p3 s
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h8 K3 k8 \( v( T. ?
(API Get entry point)
. E! ^4 X* c; P        
. P& r/ _& v, Y4 U; B; X# B* d
' y, j. H  J% _: ^. H    xor     di,di9 D% u; G; |$ K  _0 ?( u
    mov     es,di' N7 @9 H" ?( h
    mov     ax, 1684h      
; v/ B; d- j9 ?    mov     bx, 0202h       ; VxD ID of winice/ _5 B! P8 @: C; D! L* h
    int     2Fh
. U- S: C" s3 Z" p    mov     ax, es          ; ES:DI -&gt; VxD API entry point
$ _/ a; G. m; P' |  j' Y    add     ax, di
2 b0 `0 T8 S: @    test    ax,ax
9 z, z8 I' @4 Q  c    jnz     SoftICE_Detected& s5 n; o8 y+ q
' Z- X* }  F) q( J4 t
___________________________________________________________________________5 r& D! a) A: ^, i1 i& i

% w: `5 O$ l9 `2 f0 l6 |& T: @Method 04
9 H7 l# ]5 J8 a& ^6 `" Y9 N=========
2 X) q! [3 @* k( m/ G# z6 v1 t" s6 w# B& M% F, _
Method identical to the preceding one except that it seeks the ID of SoftICE9 a1 C9 o; i6 z- B" K5 t
GFX VxD.
' p1 l6 Q- h4 H9 p& z9 l5 H1 X+ e: H) q3 U" ~; [6 x" \& \- X( B9 A
    xor     di,di
+ E9 j0 ?* J0 b5 u; t, @! d+ G: ~    mov     es,di3 S2 |0 E5 h5 N, H, P
    mov     ax, 1684h      
) H% Y8 ^/ u- d* Y5 R, i    mov     bx, 7a5Fh       ; VxD ID of SIWVID
. n4 S( l# F2 j; z' d# f  U! t, ^    int     2fh5 J* V: K  N. ~1 V
    mov     ax, es          ; ES:DI -&gt; VxD API entry point6 u- L; d, \/ C( h& c, T
    add     ax, di
6 c( u+ ~; g& b! R' k    test    ax,ax, K! u6 d, v# v: B
    jnz     SoftICE_Detected
; ?+ |, I* l" `' A; Z" P) p
8 G- |( d' N, K" E/ t9 l# H+ O__________________________________________________________________________
7 Y- p$ o2 y& `
- G- R/ v6 j, k+ X" ~7 Z/ W( c: A, ^  t% d. b9 f3 u
Method 05! C/ Q8 @0 R3 U
=========
/ R' o1 v+ {: ^% ?: ~' B4 d, ]. `- m- Y; A! h
Method seeking the 'magic number' 0F386h returned (in ax) by all system
3 K' `# x* _8 p1 J2 Ydebugger. It calls the int 41h, function 4Fh.
8 e$ ^& w6 p9 v# H: F! yThere are several alternatives.  ) s; p  |8 a; P( {: ?& k3 ?
0 O6 t. q0 V! y7 ~7 G- [+ [9 ^
The following one is the simplest:
2 H9 @1 {- M) O7 C7 D2 f: G4 q- I) l, I
    mov     ax,4fh
: k1 p- f# L8 R# a; U    int     41h
& ]" P; _+ E+ |" Q1 x5 _4 S* K5 Y    cmp     ax, 0F386' }& r7 ], [. X) i+ j# L* {  d/ {  ~
    jz      SoftICE_detected
% n/ |; ^: _3 T' T1 L/ i% ^
/ ^7 N' ]( o& e% @
- C6 H2 d  U/ o; tNext method as well as the following one are 2 examples from Stone's ( P2 D) G. d0 ^* z' Z
"stn-wid.zip" (www.cracking.net):
0 ]' m8 y. A2 U" V
4 j* ~0 t* P5 w' ^, L! u! N    mov     bx, cs
$ R) B. {# y, o1 c    lea     dx, int41handler2& ~8 P; a$ i" j. M; C4 i) u# J5 g
    xchg    dx, es:[41h*4]
  N: W7 S, `% @# O/ x7 @6 E3 q5 ]- h    xchg    bx, es:[41h*4+2]) C4 ~( G( ]+ G5 Y
    mov     ax,4fh' }3 v& A/ s2 x
    int     41h& \' n4 V$ I2 F! j, L- P4 ^6 ^/ P8 d* m
    xchg    dx, es:[41h*4]
! q- G1 W$ G. K    xchg    bx, es:[41h*4+2]! c" K1 a" ~0 O5 \+ K: d8 O0 B
    cmp     ax, 0f386h3 q" Y; w& x/ b, L
    jz      SoftICE_detected: b) I! F% V6 Z" ?* O
: R; y! ]& ^5 p# s/ B
int41handler2 PROC
2 V/ n# a% {( Q& ~5 D    iret
+ `- U( N2 J5 U; |int41handler2 ENDP9 i+ ?9 J2 c4 K
% S9 F1 _2 i6 [' c4 r
; Y; x( H6 ]4 r4 [
_________________________________________________________________________( l# d! |+ S3 L3 t1 m; A
: r, _+ q( ]% Q5 B+ J

5 G0 z- g  ^0 V; aMethod 06" E% B, _3 Z* t7 J; n% Y3 {
=========
6 J; N$ p& _; m" \) T: P) f; d) J1 I. I1 P( A0 @8 [2 N
7 c2 Q1 M/ E2 i
2nd method similar to the preceding one but more difficult to detect:
$ E5 g; ^' p7 r' R0 L( W, w$ @/ M7 k9 V. |# o

9 C' P* {! x1 Rint41handler PROC
$ Q- N' u2 n. m! a9 J2 K# a% n/ `    mov     cl,al
- \2 p9 p/ Z9 W    iret$ R; K. T) U7 [9 ?" t& f! `
int41handler ENDP
% ?! h5 l4 V7 L* Y$ }, R9 k' F0 K" _7 |3 @" S+ F- U
! w: ~+ [, v0 c
    xor     ax,ax
4 ~/ j$ ~+ x7 u& i& Q& ]7 G6 d" U    mov     es,ax( ~3 l7 g* \: T, U' R: j. d: Q
    mov     bx, cs, c2 l( u# m6 G7 c3 z! _
    lea     dx, int41handler
/ S  ^% M: c  H    xchg    dx, es:[41h*4]! e' n8 c; S& {- `
    xchg    bx, es:[41h*4+2]* T7 m  b+ j7 ?$ s' K/ c4 {" M
    in      al, 40h
" n# Y. `6 _9 K9 B* j( _    xor     cx,cx3 Y7 b- l/ e- ?1 f6 _5 c
    int     41h
$ {: i% k6 z5 j  c8 I    xchg    dx, es:[41h*4]; F+ X! R. d! r/ k  N6 q& J
    xchg    bx, es:[41h*4+2]
. i& d, y) I0 t0 j' `    cmp     cl,al5 O4 l: k- m- ?, z6 `4 ]) U
    jnz     SoftICE_detected% e& h- Z" b8 d
$ q8 `, O8 w' e9 `/ y! V& x8 @4 U
_________________________________________________________________________; n0 Q; q1 T' v) l% m8 `
& A' K( ?, _" V4 k, E0 i
Method 070 [+ }0 H. k  e3 i& P* k! C
=========# E2 m+ u! v  d; V
1 h! m9 O& T  C$ m" z7 Y
Method of detection of the WinICE handler in the int68h (V86)
  _, A% P% `9 E$ q8 Y: _6 O+ q. ?
    mov     ah,43h
7 N4 q6 Y4 b% V* W7 x, [    int     68h
$ ~- m$ M% @1 J% Z" F0 t1 I# w# d    cmp     ax,0F386h3 L; h; i' V; r
    jz      SoftICE_Detected
3 ^0 H- z2 F! T4 F
; s% ?% B' n) n; `9 W- g9 o; m- E2 x( j" x" K: x6 z; M% Q
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit) O' }" ]1 r! U: i* m- j
   app like this:
7 Z0 ]+ X$ t* K" G
! r7 d3 b" t% X" {: d- \   BPX exec_int if ax==68
, u( {, P* J  d" K" G' ~   (function called is located at byte ptr [ebp+1Dh] and client eip is
3 S3 b' Y& g5 `+ {; T   located at [ebp+48h] for 32Bit apps)
, t. F1 Z5 H- i__________________________________________________________________________
; V. H) k5 u* h! s1 {* g8 V/ T! ]7 {8 h! @, ^

& K- a! o5 ]3 T: u5 j( {' s( C4 j$ xMethod 08
+ @5 {/ H$ o8 _# f% `=========
2 R+ m) r. i6 M5 `0 L( v3 Z- h# {! U6 c7 d
It is not a method of detection of SoftICE but a possibility to crash the7 S: t7 h  Y2 ~! x5 i- l
system by intercepting int 01h and int 03h and redirecting them to another
/ P6 {' f' [: f- Q# k0 Jroutine.
5 i5 t, i# a6 k+ HIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
8 A  y3 {7 h$ m' f0 qto the new routine to execute (hangs computer...)
$ @- j8 {9 L# R# n/ d
& S: W% _+ h0 {, {9 g. Q$ Q: h. v    mov     ah, 25h4 a2 a2 D& u9 D/ u. i; L( {, E
    mov     al, Int_Number (01h or 03h)
- q: z7 |2 Z8 @, S% K    mov     dx, offset New_Int_Routine% z  K/ s  C. |
    int     21h
# r& n; s- v. Y$ F% F% s% @+ t& \' G$ m+ b4 U  S" I" P
__________________________________________________________________________+ X0 Y% t7 U  [: i  J* v
) J: b0 R5 Y" U4 B- u
Method 094 }8 z" _9 Y; w' m+ K9 g/ r; ?
=========) o5 u2 ^  K  P  l2 T
% J" M$ p- _) E0 w) }' r  A
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only8 k, i" W/ e$ i5 h0 ?+ H# K
performed in ring0 (VxD or a ring3 app using the VxdCall).. g/ W1 b5 J. G! k/ E
The Get_DDB service is used to determine whether or not a VxD is installed" O1 g  S9 t0 t9 b; O0 b: ]% e
for the specified device and returns a Device Description Block (in ecx) for$ W# K) j- s* ^4 u; z" ]
that device if it is installed.% c6 s2 l+ u9 G
) |& |' r5 q4 `# {
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID  M) L9 M, C6 U9 g( B# A. ^' v
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)  P  y3 m% j! R5 D2 }) H
   VMMCall Get_DDB
9 j: y) L$ g' o! b* T( l. p   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
3 R) n1 V' X; \; W* I% S- W9 n
4 n$ H! P8 w1 ]7 ONote as well that you can easily detect this method with SoftICE:' r+ M6 w- M  J0 I2 `/ K
   bpx Get_DDB if ax==0202 || ax==7a5fh
. L! j0 @) ]% N/ o
# i" Z8 \- v! k# c. `* H: K__________________________________________________________________________- V* d' X4 }2 d5 J

' q; A; E$ w9 V# O! lMethod 10. l  L. J; p( k$ |+ L0 z
=========1 H6 p! P: H& z' t2 u4 \- L: q) N
/ H: {% d$ c, {" I: B
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with8 n% Q, j9 c7 F8 b  z1 U
  SoftICE while the option is enable!!
) b( N" }. S2 ~" H! E. D9 |2 T& J' j5 v( a* r  I& _$ j
This trick is very efficient:! C' z5 {' W- c; Z" n
by checking the Debug Registers, you can detect if SoftICE is loaded$ `0 G) d: y% Z) y* D4 }$ o
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if! ^/ t/ ~; [3 n$ A
there are some memory breakpoints set (dr0 to dr3) simply by reading their
9 p) U; n+ e: b- ivalue (in ring0 only). Values can be manipulated and or changed as well& u' e! v8 P+ w5 L6 h% c/ f. D7 m
(clearing BPMs for instance)7 n6 z) ?, G7 ]
! k. ?' s, a$ Y6 ^* L" J
__________________________________________________________________________' _  L9 h0 [4 U) s+ x) n" O
# g# W; _3 P5 e7 B& n) K. y
Method 11
) q( e! K4 p4 I$ X2 l7 M. X! I=========
: U8 }& D* {7 \. P' b) X$ _4 _1 b) m/ T, k3 W$ j0 W' x8 X6 L
This method is most known as 'MeltICE' because it has been freely distributed) T' n0 h7 K" o) h) b! k
via www.winfiles.com. However it was first used by NuMega people to allow9 R  \9 J9 G2 S) T
Symbol Loader to check if SoftICE was active or not (the code is located# j3 q$ ]$ I9 o, ]# o; ^( B- J
inside nmtrans.dll).
; W4 `- s8 x% @+ A/ H0 R9 `1 @& [
7 I. f& t8 z: G4 [# d9 EThe way it works is very simple:% }' I: }2 M4 |  N% ?; t( ~1 e
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for/ k. h: t/ i2 |- C1 Y
WinNT) with the CreateFileA API.% Q9 D, D+ C9 z3 v4 X

' |4 P" {5 G# s/ EHere is a sample (checking for 'SICE'):
" O4 ?* Q) _) _& m. H9 ]0 A, d; v/ ~. l) v! R( b
BOOL IsSoftIce95Loaded()0 l6 b7 V4 A0 N/ n9 K+ ]! r
{
1 O) ]: G% q; Q3 J# C- ?5 h   HANDLE hFile;  ' j% q1 n) k3 L
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
) a" X2 f4 N3 y+ W7 h% e                      FILE_SHARE_READ | FILE_SHARE_WRITE,
; Q. z  D& W' \                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
$ s( U  I6 B0 W+ T   if( hFile != INVALID_HANDLE_VALUE )
! K3 @9 _$ N/ [9 s   {
& ^* q/ T4 X7 A3 P! j+ k1 v      CloseHandle(hFile);
9 T' D6 |0 Z4 t7 H/ o6 T      return TRUE;
$ q! h. J( S' l( p& v   }
6 R# T' W' [4 x3 Y  h   return FALSE;) q3 ]( t5 X9 t6 s$ j
}1 T# c* Z) o  n+ {6 x0 b! n, j

- D  N3 I  X1 t8 sAlthough this trick calls the CreateFileA function, don't even expect to be: q2 j* _9 ~6 y
able to intercept it by installing a IFS hook: it will not work, no way!5 F: P# _3 A) x1 s5 S! O5 z
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
, V* v2 m& p' E+ @, s6 Uservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function): ^- P. a" a& t' M7 @2 E8 r" i% z
and then browse the DDB list until it find the VxD and its DDB_Control_Proc- [7 a% m" R' M! c
field.1 i2 q. z0 _2 R
In fact, its purpose is not to load/unload VxDs but only to send a % C; l& K# P8 x6 g6 P
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
9 G8 o4 y" r$ d. dto the VxD Control_Dispatch proc (how the hell a shareware soft could try/ P3 c# d( x" F* `* R* }; ?
to load/unload a non-dynamically loadable driver such as SoftICE ;-).- \4 W4 a! g2 {3 l) R  N7 s
If the VxD is loaded, it will always clear eax and the Carry flag to allow
$ R0 e" r$ r# P" V$ M- ~, W" ^its handle to be opened and then, will be detected.  K; M* t4 M8 q& ?- g' ~
You can check that simply by hooking Winice.exe control proc entry point; R3 i  S3 U* ]- E( \
while running MeltICE., n" v/ \7 w9 l. r$ N7 h7 c

- `+ z) a% j9 ^
# e6 o6 F& ]4 n& N" m! |  00401067:  push      00402025    ; \\.\SICE2 p3 n- w$ g/ X! v7 C% j
  0040106C:  call      CreateFileA* O2 ]5 S: y9 x0 |# p' o
  00401071:  cmp       eax,-001
7 s* v5 `6 Z4 \+ U: ^3 h2 k1 [  q  00401074:  je        00401091+ t, A, C$ g, b0 g, D
  r5 a6 j! C5 E- c; L
% W! ?& l" `& R* O
There could be hundreds of BPX you could use to detect this trick.
) h: L6 a" G, A6 K' Z2 T-The most classical one is:( y& ]  i! E+ h
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
2 v. R) u1 {- X8 W3 E    *(esp-&gt;4+4)=='NTIC'
; K: j( g* T  s  h; Z# E& P8 d/ Y
* ]3 j8 r8 H$ Q. d-The most exotic ones (could be very slooooow :-(
2 ~+ S# ^4 b$ L0 N. X4 X   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  0 q3 _. S, L, z0 C
     ;will break 3 times :-(
/ G/ K' ^0 V9 t' @5 ^
( X* \* J1 {) [' P2 K' u. S0 B-or (a bit) faster:
, x3 |7 v9 f" U7 v2 @; T" ^* I   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')+ z# |  v+ c; E5 \1 {! |- M7 t

( B  ?$ c9 W; q. w   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
3 `4 v" F6 N; @9 p. |3 Y     ;will break 3 times :-(6 X3 T3 Z! A1 L7 k- s
3 I$ A! c  r0 A: n9 U" \/ i" b+ W
-Much faster:5 X! j, _) A8 M
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'% C& P$ a' N3 Z8 I8 h/ v

% }5 @2 [( V5 N- z1 B0 uNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
$ h) f* X; k, r$ X% o& \( dfunction to do the same job:" {$ ^* p. g, I+ c1 J9 v6 o
% e, ]* x/ ]( z
   push    00                        ; OF_READ& P  r$ C" {/ Z, F
   mov     eax,[00656634]            ; '\\.\SICE',0
5 X8 y4 D7 m6 V0 S   push    eax% G8 Y7 j) B5 V& q5 d1 X
   call    KERNEL32!_lopen6 c; ~8 g/ p+ a% k+ e  ~  E; f9 ?. \
   inc     eax
) H; Y: I0 u( ?: v- T   jnz     00650589                  ; detected& X$ C' {  ?+ Z
   push    00                        ; OF_READ
7 A: C  f! t4 y/ s   mov     eax,[00656638]            ; '\\.\SICE'/ D& s/ E/ P8 u! G* ?
   push    eax- X1 U+ M8 X3 \$ y7 U; J& _. ?
   call    KERNEL32!_lopen/ g4 P7 p2 `5 V* e
   inc     eax
4 M+ m; v3 g9 m: K3 g) H   jz      006505ae                  ; not detected; @' H' d" R2 n; W8 c6 R5 w

( j6 y; I5 b8 I  B( ^* J
0 e! _1 R# [  I$ u9 }8 Z__________________________________________________________________________4 w4 l6 O* V" v- i3 z( E4 Z

# T; H. s7 \! S8 \$ M0 Q4 GMethod 12; S8 K+ I+ z4 O6 b0 J( f; C
=========/ `+ j' l  L# D* Q

/ {, }' A! F" j7 g9 Q1 _: ~3 dThis trick is similar to int41h/4fh Debugger installation check (code 05
, k# q4 _, D+ J4 k- K&amp; 06) but very limited because it's only available for Win95/98 (not NT)2 q) c8 }3 s! [+ n4 M
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.; `- P/ B; S' X5 {1 H

9 s# H4 A1 K9 z! Z2 J( |# Y   push  0000004fh         ; function 4fh( g  l+ K/ c. `6 Y  x
   push  002a002ah         ; high word specifies which VxD (VWIN32)
  G) B0 y2 Q2 j4 _, }% h0 N                           ; low word specifies which service3 a0 q( `+ _$ G/ d
                             (VWIN32_Int41Dispatch)
4 d- j$ Y9 H  Z3 a- @, e   call  Kernel32!ORD_001  ; VxdCall
0 Y2 a( g9 a: i3 A7 v# K   cmp   ax, 0f386h        ; magic number returned by system debuggers
% M' g. Q$ B& q4 f: X& i   jz    SoftICE_detected
3 j& _2 b. R; S7 Z( k3 Q
4 \( J! m8 E; _6 W! Z9 @Here again, several ways to detect it:0 g: b% V6 \! A( c5 e- T  t

- R9 b0 t+ {" d: {$ f0 M& s0 ~    BPINT 41 if ax==4f- J  j% g4 U% c  D( b6 |
' c! X4 Z+ U, P
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
7 j2 l  Y/ G* r. l5 v/ @; J' g& h3 [- q! i$ x: Z9 S2 p' u
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
) B# c& ?7 m& G' k, P3 Q7 v4 n; S  j4 v0 d# L
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
6 O7 Q# F; ~; \$ N1 u; A. s4 x# ?- O+ d( p( \, q  ?" t! }" g
__________________________________________________________________________
: j7 ^  E& l# \3 N, n! L7 W: D. h) j
Method 13
- y- i* Y  L( E3 O+ S=========: a+ q8 v6 @' B+ C  {7 @& d. Q) t

  H. l9 g( l+ ~. W- ~. K6 rNot a real method of detection, but a good way to know if SoftICE is1 x0 }" _; e0 S" K$ V1 H
installed on a computer and to locate its installation directory.
7 t7 ?: C& H; Q7 [It is used by few softs which access the following registry keys (usually #2) :7 E# f5 {3 b# e5 M; Y

7 E( i* O& J' C! @-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
6 j; v' O! y, D) W3 W; z4 \( [" S- Q\Uninstall\SoftICE& z' W+ B5 N1 {1 q' I! H
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE2 X9 w6 e- a9 t: f0 W
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
( {) G4 \- n* ]  I! M% H" L1 ~\App Paths\Loader32.Exe
2 K; h2 s1 |: w6 W' V# i
) v# J+ E0 g- C5 F) X! k2 A
) ?9 U4 j3 K' g1 l; ^Note that some nasty apps could then erase all files from SoftICE directory
6 G. ^' t- G8 t# ^* e(I faced that once :-(& U; n0 A. ?9 }

0 X/ d5 ]" d; H4 k/ ZUseful breakpoint to detect it:
$ h( u& ]. U. d& d, W6 _
5 d. I2 _' |+ h* V     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
8 d" i* ^6 I6 J, ?, l- m+ V9 j4 X+ }: m! i. q/ j1 g7 l! S: {
__________________________________________________________________________( p9 l; m0 B* S9 w: s: e) X

; F/ \! ]# C; X; {; M3 ?7 ]3 u$ X( L  k: G6 M* a4 w
Method 14 - ~. K& @4 \( ~- {
=========* q- F; e4 J2 t) q# e9 k/ {9 V
5 L/ o- j7 u0 W- k+ T
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
! H) y- {; p/ X5 k5 fis to determines whether a debugger is running on your system (ring0 only).
; v1 v( C- \  d7 L- a( O; b$ a' D( R% J* V0 r! V- M
   VMMCall Test_Debug_Installed
. @+ w9 ?5 ^' B. i3 O' k   je      not_installed4 R  g7 X4 c0 H2 V- o6 v" a; v

  R) l: V5 ?& U% r2 v/ }* FThis service just checks a flag.8 j# [# q) `7 u9 H' t
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部