About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>2 M, Q! h# k4 Q! _
<TBODY>
3 ~. M3 D1 Z0 y! X  y<TR># w6 ?. m, C9 J! V
<TD><PRE>Method 01
& H. P* R! z' f( w=========( L! G6 K- b* ?5 r
$ v5 V6 S$ y$ [3 y. P  O) Y
This method of detection of SoftICE (as well as the following one) is1 V6 P3 h9 y  a; n% k
used by the majority of packers/encryptors found on Internet.& Q" o; o# T4 o
It seeks the signature of BoundsChecker in SoftICE
3 N6 ^" f1 C3 l1 q* d; t+ m$ ^) S5 I* V' i
    mov     ebp, 04243484Bh        ; 'BCHK'# Z8 n" K, d1 E( U  @
    mov     ax, 04h% o5 X' r5 c+ m8 y
    int     3      
, [" Q* }0 v8 ]( `# z: V    cmp     al,4
" e" E: G% a0 d9 N2 F    jnz     SoftICE_Detected
# x# n* r8 H$ i2 c' c$ x3 V+ o; M: L7 h' J+ z" g
___________________________________________________________________________
4 \5 _0 ^+ b8 v& U$ J' s1 s5 Z: ?
3 B4 ]' ^6 w- u- _Method 02
" r* B1 X! z5 X& N=========% S$ `9 K" [0 K; {! S/ X- P( `
4 l0 n$ X# z$ l7 i' N1 w4 E
Still a method very much used (perhaps the most frequent one).  It is used
; Q- b% o+ {. u6 g% B' |to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
. w5 n" l0 q% T5 t$ `. For execute SoftICE commands...; ^' K* B" \* S' j2 i1 ]0 w, G+ E
It is also used to crash SoftICE and to force it to execute any commands
7 k' }! r/ n1 N+ ](HBOOT...) :-((  ; W8 W% h4 ~9 ?+ c$ e9 S

: |2 f2 e, F! zHere is a quick description:) h, v- P& b( E- i' p
-AX = 0910h   (Display string in SIce windows)
. A8 `3 h, ?' N' J" g8 F7 `4 V; c-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)) q; Y/ P' x7 Y, r2 Z% }3 I! S5 F. R
-AX = 0912h   (Get breakpoint infos)
, S7 i5 A4 V7 n! y-AX = 0913h   (Set Sice breakpoints)% B( A, O( I# {" t. Y0 U/ o
-AX = 0914h   (Remove SIce breakoints)' L4 U" U# K; x6 n" Y# A
5 u4 e8 y% N7 k. e! R
Each time you'll meet this trick, you'll see:
2 c2 k7 {; ~2 x% c0 j-SI = 4647h$ Q+ N+ l. G4 H7 @9 P7 S( J% H
-DI = 4A4Dh! K9 k, E0 e) U1 y9 {
Which are the 'magic values' used by SoftIce.
/ m! K: s" d) A7 L$ cFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
( p8 v: R; h9 H5 U( ^2 N$ B$ `' m
. k& \8 f/ M* e' q  m5 z+ P+ fHere is one example from the file "Haspinst.exe" which is the dongle HASP
# ~9 [+ S  b" w3 G  t) d' b- ~. yEnvelope utility use to protect DOS applications:
" F9 r9 x" u+ P. V' E7 N! {/ y, F- _3 S

! o7 T, j8 b; P8 N5 N( P1 @! f  w4C19:0095   MOV    AX,0911  ; execute command.
; X8 o9 Z/ L' Q& s) E4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).1 {& h+ A# U9 r5 u( j+ j2 r, E  j
4C19:009A   MOV    SI,4647  ; 1st magic value.7 \1 D7 U$ D0 J1 j
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
! X, y. s* E& N& Y* D6 y4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
9 l# B# H& l3 f- M4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute( t7 T1 r) E% C7 D
4C19:00A4   INC    CX
1 L7 L. @0 G2 M+ ]4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute  w% s  I1 P/ ?5 P
4C19:00A8   JB     0095     ; 6 different commands.
1 Z3 J% I! V+ s6 C: p" K4C19:00AA   JMP    0002     ; Bad_Guy jmp back.+ ?4 @4 r; ?. Y3 L4 Z6 H0 x) Y
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
  \  T4 b9 A8 z( U) ~$ p. i) P/ m$ X% f! ?  g
The program will execute 6 different SIce commands located at ds:dx, which
! z# T$ \' N& ~# ?! r* a& t, eare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
+ \2 |: q9 f/ ]" Z' T
: L* t# Q# H" v! F* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded." ?# }( k' c1 x/ ^- `3 f# w8 M2 I
___________________________________________________________________________
& t' |2 d+ ]( t0 g
1 x% ^, |( L# {  N( _- O
) Y, U! U. ~. f% pMethod 03: i0 O7 l' p8 Y
=========& |$ j- l, Q0 ~  A
! e6 ]+ M8 }$ I) C" e1 G- {
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
/ `# i. {% X9 x4 O! o/ R6 c4 h(API Get entry point)7 s* j* r+ ]) Q5 j( _% T
        4 I, `+ A; [9 G' w. n; Q8 [* P4 d

3 }* q7 H! x  B: T8 R. g    xor     di,di
3 c( a" [) D  T5 w4 b    mov     es,di% E) e* u3 Z! g2 w* C1 o
    mov     ax, 1684h       $ H+ {% M3 k9 z. Z
    mov     bx, 0202h       ; VxD ID of winice% a2 O# C$ W0 I8 [% z
    int     2Fh
: w! w  |1 r6 A2 h( C0 E0 k    mov     ax, es          ; ES:DI -&gt; VxD API entry point# F6 n& x9 L/ I9 y( w. O6 ?
    add     ax, di
' l: _+ N* {7 c    test    ax,ax7 R8 I/ o' y) P- g# {( v
    jnz     SoftICE_Detected
( f' [+ F* Q7 w" V! X
1 Y; S9 H5 m. P( m5 Z3 d___________________________________________________________________________" H4 \/ U+ y# {6 U1 y* D1 |

9 ?: O  e% y. A6 }$ P3 E6 b# tMethod 04
: P; _8 N# E) u=========
1 K6 c) Z* f7 }0 H& ~
% F  s) `2 m0 d  l# F: D* zMethod identical to the preceding one except that it seeks the ID of SoftICE
! U. H5 K. U3 f9 |8 n! [GFX VxD.9 c3 f, k6 m) i

: X9 e& U2 Z' {& o8 j    xor     di,di
& m: M- d+ y& N1 f% y4 s    mov     es,di8 X  k. ?9 X2 F7 V7 d: h
    mov     ax, 1684h      
: |" t% p6 q8 B& ^+ _    mov     bx, 7a5Fh       ; VxD ID of SIWVID1 d4 D( z9 K* ^7 y- Y' j% h) n' T
    int     2fh) m8 k  N) U" P5 D& x; p
    mov     ax, es          ; ES:DI -&gt; VxD API entry point# ?2 d  N$ N: b1 ~& h( f
    add     ax, di" ~+ l$ r/ Q9 S  d! {, m( W0 o
    test    ax,ax
0 m$ ^1 P& z2 [) h# u& I    jnz     SoftICE_Detected+ G+ o+ \6 T2 z; |# j$ B
& L8 z% O2 I9 k
__________________________________________________________________________" ~$ A" C: j: M, z
+ W! U0 E5 C% Z" a
! x/ P- U! Z* D: c; e9 g3 L6 G
Method 05+ C, K9 c2 I& S& ~7 I  o9 `
=========8 r8 `8 b* f& \' S2 G; A

6 f( y* k9 l; sMethod seeking the 'magic number' 0F386h returned (in ax) by all system
6 K- p8 E4 C( s& C! L6 Wdebugger. It calls the int 41h, function 4Fh.
8 j7 k5 e3 N/ ]6 f, GThere are several alternatives.  ( K/ P8 z( `* W* ]2 q7 w, k
( m: Q# x& w+ u; D- h$ P! p5 k6 o8 p
The following one is the simplest:
9 {. J- @$ Q5 z+ p) ]
" z3 S* g3 N4 e. s% p    mov     ax,4fh
* q# Y4 b, Z; x    int     41h
. g: {3 f- v; p8 Y' |$ Y; ?% b    cmp     ax, 0F386% i5 G* W! j5 ~
    jz      SoftICE_detected5 k: O: P/ V3 ?  ~: ^

8 A; h6 b1 u2 _  H$ w
( K* P3 P! i# RNext method as well as the following one are 2 examples from Stone's
" `& f* r- [! U  m"stn-wid.zip" (www.cracking.net):
& U& s8 S( Y1 s% |4 j# c
8 X1 ]. e7 d. F: ~* h    mov     bx, cs0 p0 A' F1 O; I3 O3 A) W1 A! t
    lea     dx, int41handler25 `7 r" T/ d( R7 y0 R
    xchg    dx, es:[41h*4]! @& P& H, ]* n) z
    xchg    bx, es:[41h*4+2]) o1 f. i# N* v! `: G$ S- T
    mov     ax,4fh' d1 o4 f9 h6 A6 H9 ]0 E
    int     41h# h: G4 s. N) n* @2 \) N, X( [
    xchg    dx, es:[41h*4]5 i, ?, ?# O7 c+ E( b9 Y3 X
    xchg    bx, es:[41h*4+2]2 K. f( C3 y9 G% {/ o1 _' r, o7 w
    cmp     ax, 0f386h
3 [0 L- i9 |. a$ D! f    jz      SoftICE_detected  X4 q" n% ^  g2 z) A4 b: ?

& \5 D/ o/ `0 {; K; ?3 ^/ \int41handler2 PROC+ X0 E" l  q' L+ n) t  Y! Y& n
    iret; _$ G/ h8 F& H) H
int41handler2 ENDP( ~1 q/ X) \! b* K3 G2 q& ?& S

- f8 Y5 i) S* K1 }1 W: F7 {  {( ]
_________________________________________________________________________
) `' B8 V# X* D8 |1 L8 r7 @" }! ]7 O$ T! Y3 H' A

0 t! V1 T* ?6 h2 `: y0 vMethod 06. q: W% Q: ~$ y
=========
+ X. P5 i3 ^0 S2 @, a3 a/ y% w% \" p$ `; [' i# S: j/ X$ k

+ t! O7 [5 g4 q! q, n. T8 p% C2nd method similar to the preceding one but more difficult to detect:
6 V9 J8 U" ?6 N  B; h: p, Q
0 ?; r  k0 W( G' ~& {
1 \0 W* f3 d* T  [  hint41handler PROC0 d. U4 H+ X0 m  B' h
    mov     cl,al
) \9 }! s, `8 y& h% U    iret
( ~' ~3 T- w  x  W# |' Dint41handler ENDP4 G- M9 [( @4 O  H( a7 H8 _
. w& s1 G4 N0 C7 N

# D( c6 l3 q1 q: O    xor     ax,ax
! C2 {$ `' z. Z6 W) a    mov     es,ax
; [+ n3 o. V" N( O; K    mov     bx, cs- ^! a' j& e/ W% c+ D$ K0 e
    lea     dx, int41handler* J5 D/ S1 D  x0 k7 ?
    xchg    dx, es:[41h*4]( y+ G/ V* c8 d- B5 y
    xchg    bx, es:[41h*4+2]
# k7 h' o3 y# h% C8 M6 @2 E0 m" s    in      al, 40h# v- @1 A$ ^2 g) K! y
    xor     cx,cx  D9 ^  M- @6 ~7 a' c
    int     41h2 r) F  ~1 L. L: ]: n7 f' x
    xchg    dx, es:[41h*4], q, u) I! E9 W. q
    xchg    bx, es:[41h*4+2]
  L2 h; W: f1 O: k4 g5 Y    cmp     cl,al' I, ]6 R  c+ x  ^) l6 ?* W
    jnz     SoftICE_detected
  H' r: |8 Z5 C; Z. ~1 j) F% q& @1 Z) \
_________________________________________________________________________3 m1 h$ }) V9 Q; q9 b9 \& p( v: v
9 w4 Q: z& a! u7 F; l
Method 07
5 B. X; `# ?6 S=========
( A( j' f, `# W, b
6 k4 Y8 O" o. Y/ I* l5 NMethod of detection of the WinICE handler in the int68h (V86)
4 ^& o) h( b4 _6 g# d7 ]* t& C  R  m6 ^% ?
    mov     ah,43h
3 J/ {$ _+ p# v0 x% T4 b* }    int     68h
* n7 m8 o- D* W" U' d3 f  _4 t4 Y    cmp     ax,0F386h; C1 i. J$ R5 b2 F2 g# V% W
    jz      SoftICE_Detected
, M7 u5 O7 ~& \1 q
' v: j* C2 N3 R! T) s
- O; H/ Q. j1 t+ V( ^  Q=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
  z+ K4 v: D: _% ]" r   app like this:3 s4 h' T% c+ `+ k( B* o, r% e

# m" I/ M$ H7 l6 K3 T, o7 f: t; l& T   BPX exec_int if ax==68- K" w8 W$ o$ u* x
   (function called is located at byte ptr [ebp+1Dh] and client eip is: e5 m! ^  L$ t( E2 M
   located at [ebp+48h] for 32Bit apps)
$ e3 p0 X& x' Q- S! y# w__________________________________________________________________________
' E' `& m; o, V6 X8 Y4 w0 V. ~+ k# C0 J2 M+ h
) U; B3 O. V: f" Q
Method 08
3 g9 v: v/ y8 F+ J1 ~=========
/ ]0 |$ Q. K! Y3 @+ I
8 ]9 ?% ~$ y' ~3 d0 X6 G; n5 RIt is not a method of detection of SoftICE but a possibility to crash the6 T/ W% v. \( Q; u2 D
system by intercepting int 01h and int 03h and redirecting them to another
7 U0 [0 o3 d, ?4 T) u+ rroutine.; o. j* k9 r1 P% H: W7 k4 ~
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points- Q2 P! ^! ?( h; Q
to the new routine to execute (hangs computer...)( \. D" o9 h6 @4 [; p
8 T  ^' b/ ~5 J' h1 b9 \3 D0 `6 `
    mov     ah, 25h
0 f( F) N/ h5 a: Z/ a    mov     al, Int_Number (01h or 03h)
( Y' \0 h  {4 W- E    mov     dx, offset New_Int_Routine
; L: u  j) S3 ?6 P0 S$ O& |    int     21h. v' \4 W1 [% a2 u
$ O. ~1 v. D9 h4 U
__________________________________________________________________________! U7 Z" Y7 E% H1 u- e$ @$ S

! A4 \+ c% V) T% a7 _& L( X6 ^Method 095 u) l) k- ^+ A) j+ `, o
=========
5 w% [% @( ?2 W" y
4 b) h% `8 |1 c/ _. gThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only8 v& D7 B$ h0 C: p) `8 R9 P
performed in ring0 (VxD or a ring3 app using the VxdCall).
: D1 m. t5 H* @0 ZThe Get_DDB service is used to determine whether or not a VxD is installed1 p8 |7 K# t8 h! Z
for the specified device and returns a Device Description Block (in ecx) for
+ S1 P' @8 |, athat device if it is installed./ J! K" X. t# |% T. d4 N* Q, |# @

; L# f1 f4 s- p% J* ~  m& [6 l   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID/ R1 y& `; k) |; O: m
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)3 l" R3 m0 C- U6 q; e2 {
   VMMCall Get_DDB
7 `; E, d+ v( }8 u+ n* x: \   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed5 g9 U' g  y" E/ M. j9 m

4 m! J, m4 u. [Note as well that you can easily detect this method with SoftICE:# s/ r9 a- I) ?- h) F  [( _6 A
   bpx Get_DDB if ax==0202 || ax==7a5fh
. z. Y/ J( \$ _  y" `# T# K/ O. z. t, ^- d, N
__________________________________________________________________________  l& k5 G# F0 g& s
2 |2 V7 V$ U. w& N, j8 T
Method 109 U/ P1 U2 h; V
=========
. V$ n6 M5 }* O8 o. s0 i$ @
5 r3 c7 s% b% E: z+ {/ Z=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
+ `3 e6 V% U  R) @/ ?* T  SoftICE while the option is enable!!
/ F. O1 |7 I' D
# p7 E0 |/ k- u. X% gThis trick is very efficient:1 F+ @9 Y7 Z% d# ]' R! u
by checking the Debug Registers, you can detect if SoftICE is loaded
9 w$ u" M8 X* _  |9 x! O' S) s& Z(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if( }0 s; Y- U. k6 J# U1 W
there are some memory breakpoints set (dr0 to dr3) simply by reading their# [8 ]3 H1 X0 y, C1 ^+ C
value (in ring0 only). Values can be manipulated and or changed as well: L" ~; u) w4 Y( `& o
(clearing BPMs for instance)7 g: w2 R! `) K% h

( d5 k8 i% G7 F% J# j__________________________________________________________________________+ \+ Q/ G3 @7 Q7 X1 g5 D, d

& t% K# U0 E: U6 {+ {' mMethod 11
7 @  X7 M1 x0 `/ t# \- o=========3 H" r8 c5 c$ [

" y' }1 a. ~, X# H% ZThis method is most known as 'MeltICE' because it has been freely distributed* b" H2 D8 \5 B8 _
via www.winfiles.com. However it was first used by NuMega people to allow; _+ I, K7 R& P) X. o
Symbol Loader to check if SoftICE was active or not (the code is located2 ]4 F: h0 z) J9 \
inside nmtrans.dll).
% e2 {: M1 t0 |. s' P
4 k# a! M. J, @! W) V  |) SThe way it works is very simple:8 H0 J( _% s/ Z6 v( ]
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
  \% ?7 Q) o. R9 S6 H3 E& \2 mWinNT) with the CreateFileA API.) O/ f0 a, f$ s( F  _

# X( z' x$ {* K! h+ A. Q9 a, y0 X( KHere is a sample (checking for 'SICE'):
6 I' a3 w3 {8 R
1 b9 j3 Q/ }& {7 P# E# z/ MBOOL IsSoftIce95Loaded()& N: @4 K0 Z; e( _2 L1 B4 R: l) E
{
5 D" v- A  ?9 ^; O$ c# }/ n   HANDLE hFile;  " U% q, `3 q' A3 R$ p
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
7 G1 L7 O$ H9 I- Q/ i                      FILE_SHARE_READ | FILE_SHARE_WRITE,7 w& ~/ G; ?3 H9 j# E
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);  N! ~$ J% u- l$ ~" ]6 q5 o  Y+ k/ i
   if( hFile != INVALID_HANDLE_VALUE )# e/ X8 c: |; M
   {
3 y! r, X/ ], V! c) F0 O      CloseHandle(hFile);
- I5 W. \- z1 ]4 c2 c      return TRUE;3 g) K5 m$ x+ v
   }
$ C# F; R" k1 y   return FALSE;
% q/ H7 c/ f. i  M9 T+ c}
- Y! @( J0 l+ @' o
  x5 H  C. s; F' |  L; aAlthough this trick calls the CreateFileA function, don't even expect to be; a  L% X: l. f
able to intercept it by installing a IFS hook: it will not work, no way!
/ n) p) ~6 @' |- X- o! e3 MIn fact, after the call to CreateFileA it will get through VWIN32 0x001F( P1 Y/ K4 _& F, \0 B; j+ o
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)2 v9 H7 y4 X. W% ^- n: C7 a$ D
and then browse the DDB list until it find the VxD and its DDB_Control_Proc% h  _/ z. O5 M' p: R
field.
: |- w/ T8 @; ~& _  N4 pIn fact, its purpose is not to load/unload VxDs but only to send a
, B( {) Q/ |% l1 E. ]: ]/ wW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE). o% A+ V+ P" `3 l
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
6 Q7 |6 L3 e6 y$ J- u% Gto load/unload a non-dynamically loadable driver such as SoftICE ;-).  j4 O, e1 ~7 c( x
If the VxD is loaded, it will always clear eax and the Carry flag to allow7 ^' j4 {" z' @# m. S6 [
its handle to be opened and then, will be detected.4 ]3 o( y$ B5 g5 V6 N4 Q' n# _
You can check that simply by hooking Winice.exe control proc entry point) N" }9 x% ], O% U
while running MeltICE./ X/ q3 u8 `: u" |; ]: h

( a5 E/ M- A9 D' j! O6 K; A; @' G& j, D
  00401067:  push      00402025    ; \\.\SICE
; w# H3 F1 D. P9 u& i$ [/ d4 L1 U- j  0040106C:  call      CreateFileA
5 S& h# k4 J8 d. X4 [: x  00401071:  cmp       eax,-001
' A7 t1 p+ U5 I7 O  00401074:  je        00401091
3 m, E8 [0 Z" R! H6 ]# l
1 O7 l  T( ^5 [/ g) o; I0 y9 Y6 r/ X, d1 n" m5 ]5 Q
There could be hundreds of BPX you could use to detect this trick.
* r3 Y! _- R5 `-The most classical one is:. s: y2 [! B9 j9 U. H+ p9 R5 y
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||0 R+ d" d7 a3 x+ }. s# Y: _* B. [
    *(esp-&gt;4+4)=='NTIC'
0 q7 V+ J% P6 A& N
. W- C# B% n5 s, l-The most exotic ones (could be very slooooow :-(
  ^6 _0 T* F" s* a2 [6 B0 f   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
7 P, b8 g2 V& A( @/ O: E     ;will break 3 times :-(
8 a( S& Z4 C. A2 \; U# V% U3 J. W! c  _, z* x2 _2 U
-or (a bit) faster:
4 |2 w+ ^  `* l: N0 y9 x   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')0 R# G; B0 a0 t' G$ ^# C* I
3 k9 d6 G6 j& x
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
8 n  w2 r$ T5 b/ u) O: l- |     ;will break 3 times :-(" d1 g! V9 }( F1 p/ T* f/ `. i* S
' [8 R% F) F" r0 @
-Much faster:) a6 f" _4 d3 t5 c8 K  g# U$ d
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'& f6 W0 O( {  |8 s' P

4 {* n% @* O, N* ^* ^, [6 O8 aNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
; h* \+ D/ ^( T( T" x- b; lfunction to do the same job:
8 Z: A. v) Z. k4 {+ r% T2 A& L4 O; X0 @: ]/ v  I
   push    00                        ; OF_READ: }  b! |9 h$ W# P9 d
   mov     eax,[00656634]            ; '\\.\SICE',0
# v, S- i2 t8 _' ^   push    eax
/ Y5 E3 o9 [1 m2 J& y0 f   call    KERNEL32!_lopen& j! n* F& }2 `( I
   inc     eax
: W5 @) T" j8 `& t* V2 \6 |( g   jnz     00650589                  ; detected7 P# Q6 J: O" q* _5 ^  ^% X
   push    00                        ; OF_READ
& r$ M3 h$ V" K   mov     eax,[00656638]            ; '\\.\SICE'
$ X  r0 G& z: S* U6 G" N2 w   push    eax
+ Y* j9 `! }  J   call    KERNEL32!_lopen
1 w  ?7 x) X7 {4 ^   inc     eax8 f! R# h: e8 h! F. X
   jz      006505ae                  ; not detected3 k" W! d# w2 ]2 u  f

7 j5 R9 z+ K7 x) ~. n# v! ^4 |- L" Z+ a6 `9 Y/ a' t1 U# m
__________________________________________________________________________
; P6 {- H+ _6 p0 Y
" F: H: D: p- z; g3 h/ c$ DMethod 12
# r# S7 q! F- D9 [8 A=========
4 J% z5 l/ h) t9 i/ F+ Q% D. o! _- l6 ?. V7 ]! \
This trick is similar to int41h/4fh Debugger installation check (code 05
; Y# _, c2 C+ A6 V6 W&amp; 06) but very limited because it's only available for Win95/98 (not NT)3 ^: Z/ a5 }$ L( ?$ k
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
9 S: _$ \2 T8 j* H, q# r4 u- p" \7 @5 _' L2 L1 i5 r
   push  0000004fh         ; function 4fh
& a" H& l$ [8 h1 A8 [1 F   push  002a002ah         ; high word specifies which VxD (VWIN32)
- O( j1 f6 ^( d. ?3 b$ t                           ; low word specifies which service
; e6 A/ \( m5 y                             (VWIN32_Int41Dispatch)# n- @: \. C$ d3 j4 c! K
   call  Kernel32!ORD_001  ; VxdCall" o5 g: j. G( H$ d. X9 y) k
   cmp   ax, 0f386h        ; magic number returned by system debuggers! @4 i/ Y( |! `5 z/ S$ L5 l
   jz    SoftICE_detected
: n% s1 ?1 [2 ]) C1 `- k: ]. O: x( g# E# i( z! {
Here again, several ways to detect it:- i2 X& @+ R' \0 s6 M

+ C: A5 T. O4 S& k) M    BPINT 41 if ax==4f& N3 m8 _) y3 z3 ^8 {" D% h
+ l" S3 q/ i( P4 m
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one8 \+ T. {* |( \+ s9 G7 A
6 H/ T2 l2 w  d! T& Y
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
+ d! o9 K: Q+ p) z7 l0 V. I" {
3 r" r* K! F) A7 e    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
/ ~0 d. A# v7 v* \* L0 P! E7 X  B) W' s0 I$ t3 o  q) }$ [& {2 S' E
__________________________________________________________________________$ i4 ?. t2 k# K

$ J9 ~3 {8 t( p4 \- K- PMethod 131 z8 _$ M0 I% M/ @' ]/ ?3 _
=========
# p( _. \8 Q) R% [! h0 I8 L1 D7 c& n0 [. l* D8 j/ m- Y- J7 ^% W0 o
Not a real method of detection, but a good way to know if SoftICE is; z+ O: K$ E5 b! N8 U! @9 a
installed on a computer and to locate its installation directory.7 G( n( ~8 W2 \( \- z
It is used by few softs which access the following registry keys (usually #2) :; X0 `( `# L0 W
$ D. g, c: b0 y4 L5 P8 ]
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
# E  V0 m' w: ~, s\Uninstall\SoftICE# S( w; R" T. p( D
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE& _5 k0 I& L7 J! F- B  O: q- S  u
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
% i. m2 {0 k" A' B0 L. m\App Paths\Loader32.Exe
1 u( ?5 ]1 h8 \" a# q; U: H& R; ^" z3 S
! `. c1 J+ g+ f" j  W  w
Note that some nasty apps could then erase all files from SoftICE directory
% f! O8 B* c4 X9 T* E(I faced that once :-(
% i# P0 l! b/ J, ^+ K, K, C- w1 [% F' J) d% w5 u- k4 r- e! q% W  m
Useful breakpoint to detect it:( l4 k, `( Z7 ~: ]/ R
/ p' Q  [, t! n0 B
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
+ R# n5 j, m! }& Y$ k8 c( ?/ X; D9 H) t' L6 K
__________________________________________________________________________
$ r0 r3 g, \9 i  C, L# ^2 a! L: Y3 R- B8 g

/ l; K2 |( q5 c$ H- B6 ^6 ~7 xMethod 14 6 x5 c* R# P. W$ S5 v  b, r% K
=========* H! |  W4 _% J8 |

* F: v3 e3 {- x3 }$ r9 BA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose8 [$ r$ y- L+ Z7 n' K# u
is to determines whether a debugger is running on your system (ring0 only).6 ~4 g; I1 @3 n2 i8 [  r4 {2 y
0 a0 d4 K+ r# d! I" E
   VMMCall Test_Debug_Installed2 e3 A" o+ s! X: V) v
   je      not_installed
/ V% Y) d3 r0 X2 s8 U& P4 u4 j/ ~- R. T; O; b' F
This service just checks a flag.
/ A5 S$ x& a6 h; o( X) I2 g</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部