About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>5 R. f4 N  o/ [/ P
<TBODY>; H1 v! j& H) W, Z! D  K) Q- m' s
<TR>) d7 s: Z* [7 F8 t, v0 ~/ A/ t
<TD><PRE>Method 01 # v' l2 o6 Q4 g# i6 [* _" q
=========
9 B/ U1 O) w) {! w/ ]
& `" A# H/ V& X* q# l. SThis method of detection of SoftICE (as well as the following one) is
8 _8 U7 z* t3 y: pused by the majority of packers/encryptors found on Internet.
8 I: B  |% ^, q0 U, o* vIt seeks the signature of BoundsChecker in SoftICE
3 [, Z8 `7 J- J( u( e8 [6 }
0 \/ S/ p& T7 B1 M4 c6 ?& b( d    mov     ebp, 04243484Bh        ; 'BCHK': [% a9 g+ y9 {
    mov     ax, 04h( f5 r; }0 z6 q+ c; N: r
    int     3       9 f  l! l* a# |' a
    cmp     al,4$ X% J, Y/ x, `( S9 f' M
    jnz     SoftICE_Detected5 |  B' H5 R' {4 f% A: g" O8 p
6 p9 G% y. a$ N% `  w4 r
___________________________________________________________________________
( U9 t& x  B$ o# P5 O  b& F" F) U$ e; q( O1 K
Method 027 R2 k1 A8 Y. |. ^5 H# y1 B
=========* B$ A+ b/ b* x7 _3 y
; r9 P- |% C+ U6 \6 Q+ ~. {% S
Still a method very much used (perhaps the most frequent one).  It is used
6 ], s1 e& d) ?6 R) @6 E8 Kto get SoftICE 'Back Door commands' which gives infos on Breakpoints,7 J, V+ y( ?$ j: g
or execute SoftICE commands...
& j$ y* N2 P2 pIt is also used to crash SoftICE and to force it to execute any commands
8 ?& z. y% p0 w5 U* T& Z; }(HBOOT...) :-((  
6 M0 `1 L9 @+ P$ T/ Q: c' o/ _* |6 C3 A
Here is a quick description:1 V2 D" t4 Q( G" S6 D1 a+ [& C
-AX = 0910h   (Display string in SIce windows)5 l3 _3 w( _# `; y- p, y% f: _
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)% b) ~+ v0 s; f% i" H0 ], Q
-AX = 0912h   (Get breakpoint infos)
0 T, n$ W5 M$ e$ X-AX = 0913h   (Set Sice breakpoints)# e# y& ?1 N' ?) O4 k
-AX = 0914h   (Remove SIce breakoints)1 a: \$ u* C3 ~  j! Q) x3 z. T

7 z* P/ ]: n& ]* v% H0 E' wEach time you'll meet this trick, you'll see:* u6 D9 Y* X9 Z
-SI = 4647h
( ~: W! ~$ X9 G% Z8 @8 C2 E-DI = 4A4Dh
  P2 M+ ^/ P2 a) R+ o9 \Which are the 'magic values' used by SoftIce.& t# j' I' x: t) h6 m
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.( d  f2 C+ u" A' V8 W
, n) ]( c& Z+ D2 l9 `* w
Here is one example from the file "Haspinst.exe" which is the dongle HASP
9 V0 }& e9 _- GEnvelope utility use to protect DOS applications:) Q0 N! `$ t& ]# P7 s4 _

- j# L! \7 s  _: ]: R& z& u3 Q8 z$ B
4C19:0095   MOV    AX,0911  ; execute command.- [# b  j1 d% X9 X6 V
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).8 D9 T8 m' Y  r1 z8 u3 D2 L+ ?, m7 m
4C19:009A   MOV    SI,4647  ; 1st magic value.
9 g0 ^1 i  L0 ^! A: F4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
* r- v* M& m5 F" h9 d4 l4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)" F4 A+ a# l: C  a  Z5 X( U% g
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
5 z% g5 s5 E" ?. R( c0 {$ V' u4C19:00A4   INC    CX1 @' q) e! K9 D, Z
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
2 Z0 b( V: }" u4 ?  n4C19:00A8   JB     0095     ; 6 different commands., w$ ]/ N/ k  Y7 R- y' d
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
" P7 c6 S" Y) h4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)% k2 z* R8 M+ f0 J& f+ G

; Q' h# \& \( G! ~2 H) _The program will execute 6 different SIce commands located at ds:dx, which
7 t% D$ _2 t9 N" eare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
; |5 y# y0 ?" w% t1 D/ ~* I
. J" f+ H* y5 v$ R* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
1 e4 [* u* C0 \. s; x& V. w: n___________________________________________________________________________$ N4 A& b$ t4 Y' W5 w- R- M, h$ H
$ |3 p; q2 e+ }) C5 t
6 {+ ?9 }* G/ I$ v
Method 03% P. }& I8 W6 J8 i6 m% T" a
=========
/ {, [" S/ z! P( ~
4 `) H) x" P' x  g2 M" L4 n  i4 ]Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
( p" P5 |! p! t; [(API Get entry point)
, o" S8 y5 N6 O' l        
! m4 F5 B" g, S0 K# c5 G, x+ T7 N5 V  S" q; m) Q
    xor     di,di
/ p! T5 c* \$ H, m' B/ {' l    mov     es,di
2 y+ j* n8 u% e/ T0 u8 E2 ]8 E( j    mov     ax, 1684h      
( n. A' l# D7 I    mov     bx, 0202h       ; VxD ID of winice
8 U; z" [0 [9 E0 S. q; Y    int     2Fh
! d& F% J( V: r) `    mov     ax, es          ; ES:DI -&gt; VxD API entry point+ U' F0 o9 p' r+ B, |+ i, @
    add     ax, di
- F8 ?; ^$ L+ G4 _$ |' i1 r% }    test    ax,ax% n% J5 c" n) l+ x* T0 k/ N
    jnz     SoftICE_Detected' S1 W7 l7 q' R4 L! E6 E
# |8 L# ], Y& W6 O
___________________________________________________________________________
" q! }/ u& ?) r+ b" }" ]5 ]' _: n) w" f+ A, b* y
Method 04/ Z: M. c( G2 \
=========+ {. y+ J. C( j& ?3 f

2 O& ~2 v+ ^6 D7 zMethod identical to the preceding one except that it seeks the ID of SoftICE3 r5 t: ~* f6 A# s9 H
GFX VxD.9 k. y& G: [" A+ F* c* K
* _2 e- @- B) ~0 L: G2 l# o' s2 X
    xor     di,di
: U5 Y$ s# i2 u, d, s/ N+ k    mov     es,di2 z$ Y, Y1 u  k+ `0 f3 J3 J
    mov     ax, 1684h       : ?$ O" L8 z) p3 g' t
    mov     bx, 7a5Fh       ; VxD ID of SIWVID
0 G+ \% i7 f) B. _/ h$ h    int     2fh+ A' @- C( I* [: l, z& d
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
9 @  h3 ?1 J7 h+ w3 i    add     ax, di
& |9 P+ [6 V. v; Y* Q9 R    test    ax,ax: W# \# ]. T9 R3 B% f) K
    jnz     SoftICE_Detected
1 P, d6 q1 k" H5 h: B) t' m! d4 {+ f; @$ r
__________________________________________________________________________$ H+ u6 o0 O9 Z$ ]' M/ p- X. b  D
$ H# g- |0 n4 k) n
0 J" n: c# R1 r! v9 e1 X" H. Z7 M  F
Method 059 }2 n* J# ^- ?2 V" {/ {
=========
7 R7 Q4 `2 P% N0 {% k0 d+ T8 Y. @4 V  K; Z; ?, m- e' w
Method seeking the 'magic number' 0F386h returned (in ax) by all system% k, N+ Q) g$ u& @: [5 J$ m
debugger. It calls the int 41h, function 4Fh.! M. C0 R: u9 y9 ]- G( y  Y4 P7 @1 O
There are several alternatives.  
8 G; ?$ ~( }. F2 ?3 D2 ~& j* ]+ E: O, f' K; u3 t& E% p
The following one is the simplest:
+ d7 {' j. {! K0 @9 z: B- T1 H3 \* C" ?4 E5 F2 Z
    mov     ax,4fh
+ ^+ @, `8 v7 j; ]: i9 ^    int     41h
" N( E6 {( w0 {8 `    cmp     ax, 0F386# {: R+ E! A  s1 M. H% I
    jz      SoftICE_detected
1 V: b! \/ k  a( M- t, l. h1 k- M1 i% i% N
# h" f- t% b9 d- M5 T( E6 J
Next method as well as the following one are 2 examples from Stone's 4 U8 D  n6 |# d) c
"stn-wid.zip" (www.cracking.net):% Z* E- `# U' a( X

$ G# g5 |1 L+ ^5 ]    mov     bx, cs$ r$ l) c; [; q" f; {
    lea     dx, int41handler2
, \. t; c) O4 ~# G3 q  l4 M    xchg    dx, es:[41h*4]
$ m. u' s7 |3 N2 C! [    xchg    bx, es:[41h*4+2]
: _. ]2 e/ C2 J7 T    mov     ax,4fh8 K  z' h, c/ I& _6 o
    int     41h
- B, \3 D4 n5 T  p    xchg    dx, es:[41h*4]7 ~) o% i* ^3 D) R
    xchg    bx, es:[41h*4+2]
: D' [3 G( O, f7 \    cmp     ax, 0f386h
, ]7 D) o: M* J( Z8 ]0 K2 s" Y    jz      SoftICE_detected
( B: z$ }5 x$ D: S( [
5 c5 ^! `) o4 O, p) s# ^. b7 u- Fint41handler2 PROC
  o$ S; S3 ^0 a8 z$ R6 u0 T; X& W    iret
6 o" p5 I% [* y  ^; w) v' E' J* y0 bint41handler2 ENDP
  w7 E' O; \8 W* X$ q" |5 f- N" k: h& ^* ^

8 Q, s; m! |( t" __________________________________________________________________________3 C  s6 @5 Q" U0 |8 d! l

- W1 d$ n7 M- s3 \9 S! s5 P* m& q* ?8 v
Method 06
/ A/ @. S$ Z" d7 l  \=========& n3 I) }! c* b' i; ?9 `/ U
3 y( t2 p& B! c7 H, c% y! c
, f4 J. q! u) ?7 X
2nd method similar to the preceding one but more difficult to detect:8 t# _1 q9 r2 Z- m1 I- n

: @% a8 x- s  W" s1 e$ C: S
2 q* C; E& b( i$ T5 M" }int41handler PROC2 f( F* R  V" K$ y
    mov     cl,al( C& z. Z/ ~+ v
    iret1 [5 W5 [6 d2 S% {! l, r
int41handler ENDP
2 S# x9 @' \' g) [7 X9 z5 a) }% I* G8 K3 ?6 g8 I" \" T+ u. |5 j6 y8 e
& x0 n# y" {! ?# r& }/ U3 V# @' u
    xor     ax,ax; [2 g. l" F. W+ ~. P, d
    mov     es,ax
% E7 ]% ?% ~- k" ?1 A    mov     bx, cs
' i! H. A2 l' x  s1 x: o    lea     dx, int41handler$ @9 V6 W: M0 V9 c# O7 X
    xchg    dx, es:[41h*4]
" E1 w5 \( ^1 F+ L. M4 u9 D  a    xchg    bx, es:[41h*4+2]: g6 f6 X; R' [1 A. U/ E' @& t% V  m
    in      al, 40h1 W) D( Z, ^$ S
    xor     cx,cx
1 J) n3 S' f; O9 j    int     41h
- n- j, B4 t  n    xchg    dx, es:[41h*4]2 {0 l0 Y0 {/ F- Q& j
    xchg    bx, es:[41h*4+2]/ r+ P" z2 v5 C* A2 Q, w- b2 q' f
    cmp     cl,al
- |6 F) s& {! f+ w) K6 c& ?1 z    jnz     SoftICE_detected  I: g8 }# e3 T5 f
1 e- r% s  B3 a7 }; l+ I
_________________________________________________________________________
1 g! d6 U* {* t( k& F9 }# h% ^4 q9 }4 Y# d0 i! V
Method 07
1 v6 L+ ^0 @+ ]/ ^: L  A=========8 n7 V) [* U" _; n1 `) y
0 N, ?) F: P9 g) Z( t% U+ i
Method of detection of the WinICE handler in the int68h (V86)! }' N+ L8 e4 ^9 o- b

! f) f$ \# y- B0 p    mov     ah,43h
5 @4 C- y9 ~" b* v    int     68h  F& T( C) h1 ?: `- L7 I
    cmp     ax,0F386h
3 r8 v# a/ z8 n4 \+ g    jz      SoftICE_Detected
1 X* q. y3 ?5 V- r1 f" z# X/ g( z

" v+ ?* x8 ]1 W( u& s=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
* U$ J6 r( @" m) V   app like this:
% o" O$ w( Z; V" ]( Z9 s
# f# x2 K6 p- R   BPX exec_int if ax==68
0 a$ m* m) P1 E3 ^' Z: g' ]" S9 u   (function called is located at byte ptr [ebp+1Dh] and client eip is
5 f9 l! s' z/ \   located at [ebp+48h] for 32Bit apps)
( C+ R" \3 O( ?" r8 ]__________________________________________________________________________/ l0 _0 Y  K" u

" A4 t5 P* c* b/ S3 M0 l+ o# R2 W0 U7 j3 }0 u8 i% Z# t$ K
Method 08
8 |% E2 R: ]" @. ]=========
: X5 p- t% m) E; C  G' o; B) ~0 g; B2 g4 S0 q9 E& r
It is not a method of detection of SoftICE but a possibility to crash the
/ g3 T+ y; D' v* u9 H8 |0 csystem by intercepting int 01h and int 03h and redirecting them to another  z' X/ k7 `' t) p( Q  e
routine.
& R7 Z! }" T9 y7 O) L; D6 D) L" a3 YIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points0 f/ W) b0 }9 T0 ]
to the new routine to execute (hangs computer...)2 \& `4 P$ R6 F+ v. `, F9 C; k

4 ?0 G. C1 H& @1 s% m! D    mov     ah, 25h5 ~& B, y/ J6 f$ o
    mov     al, Int_Number (01h or 03h)  ^# |& u3 N+ y  i
    mov     dx, offset New_Int_Routine
2 K8 `" B8 J7 }1 a( u    int     21h$ x5 e! s2 }6 i( n( B

' Z: D( p) ]' C# m% N__________________________________________________________________________6 j  V/ J. X: f
5 L! r+ m7 O8 F
Method 09
+ d4 I2 w% y( f$ I=========
, h- w; D- L5 F6 w! U- _# n* h* r! ~$ M& R% e, s8 [$ G+ G3 e' j
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only2 z4 m: m7 a; m
performed in ring0 (VxD or a ring3 app using the VxdCall)." n; X* _- A5 c& g! l/ E9 @
The Get_DDB service is used to determine whether or not a VxD is installed
% w. D# A0 @( N0 Ifor the specified device and returns a Device Description Block (in ecx) for
7 ^5 I" f: V4 Xthat device if it is installed.
( ]/ G. ~8 ?4 R7 x& m6 a
7 w6 ^( l: k$ m% }: y) Z: R) q   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID6 |& X( u4 s2 i# U
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
# Q8 n# W7 `2 ~# ~4 J   VMMCall Get_DDB
! P9 |, A  K# f0 s$ [2 ]   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
: o$ Z8 k3 R1 b  T5 b
' {2 z! [8 t% X, \4 ?$ ^Note as well that you can easily detect this method with SoftICE:7 O$ F) x- M! B+ n. N: v
   bpx Get_DDB if ax==0202 || ax==7a5fh" Z$ u1 y8 t' R2 ?
5 w" W  g. z. S. X0 G9 ~
__________________________________________________________________________
' X, x, f$ a2 F. A
2 \2 F# N. D8 B: AMethod 10  M; v1 y! z! [2 ]$ b+ L! |9 a
=========
' c3 g# f9 t! O& D; h2 K  j
' o- q3 H' p3 X=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with. b% N' N& F" P
  SoftICE while the option is enable!!
/ a1 j- o1 Y4 ?5 D3 Z5 \  |8 h/ Q3 \+ T" N5 c
This trick is very efficient:8 C1 ^2 H, T& ~) L9 T8 ?0 ~9 P
by checking the Debug Registers, you can detect if SoftICE is loaded
5 |7 l5 ?4 \: ^9 n) R+ s. i& u4 Q(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
0 r) R* t4 D( \+ C6 w; vthere are some memory breakpoints set (dr0 to dr3) simply by reading their
0 q8 G9 B0 a8 }value (in ring0 only). Values can be manipulated and or changed as well. R# a3 D' e/ g- L3 |) [  B  N$ o# y
(clearing BPMs for instance)
" g& y0 e: r% h; q2 L- Q6 t8 J, `! V8 f' Y: S1 x
__________________________________________________________________________+ Q9 o( p5 `0 R$ \4 n9 S

# J$ k% H) ?2 z$ YMethod 11
4 [+ a0 F6 ^6 r8 b. w=========# l+ S, U* P2 I( d
) _; ^" }" t! r/ R( j
This method is most known as 'MeltICE' because it has been freely distributed) b( o- I. b- c1 b* c2 r- R
via www.winfiles.com. However it was first used by NuMega people to allow' `7 [2 m, \7 P, \0 ]$ q- o7 i
Symbol Loader to check if SoftICE was active or not (the code is located
' V" y# t1 v) ^. ~) z1 y' E1 ninside nmtrans.dll).' }0 {0 C0 v* u7 E8 O( P
$ Z* P) e& M1 e7 G. v
The way it works is very simple:: ~1 l# B3 ~/ X: t7 Q3 c( ^! J( X9 c
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
& a6 |& ^) Q' ]% w+ E: @) @# ?WinNT) with the CreateFileA API.! m7 S8 `9 K( V8 S: K

3 V6 W; ]( W$ p7 E7 B: OHere is a sample (checking for 'SICE'):. D) c; U. H( v" O- s4 A
2 U; p/ E& f4 ]3 [0 V
BOOL IsSoftIce95Loaded()3 j! l( {' `# F: S% i4 p
{
) U3 A$ d+ j4 q3 G2 _   HANDLE hFile;  + d" j" K; l: l8 n4 M: P
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,9 i$ q+ [/ c" D% E
                      FILE_SHARE_READ | FILE_SHARE_WRITE,
8 ~- E# `9 t1 d7 k' q% P                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
1 R0 |$ d9 r# i: l0 ^   if( hFile != INVALID_HANDLE_VALUE )* D, P! q( r7 k! i' u- [1 W
   {
9 A) \/ D% n) x- J2 @2 N& b      CloseHandle(hFile);
* v- ]$ c; W/ I; H) E' E( T      return TRUE;
# ^9 P9 C4 g( F+ d3 J   }- a8 o" g! w2 f) n
   return FALSE;9 s1 s; V% F7 ^0 A( b7 V  Y4 }( s
}
7 N- T+ V5 \& X) K" W; z# \2 J8 m
Although this trick calls the CreateFileA function, don't even expect to be1 A/ j2 n. o; h0 e% X7 W
able to intercept it by installing a IFS hook: it will not work, no way!8 r/ A7 C$ b) O! o/ U4 Z( P
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
6 X  O1 s+ V/ D$ G. [3 h) zservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)5 }: C; A& K! U& R: E
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
/ ^: W4 l6 Z; g9 _, _0 Bfield.% C8 A" n& P/ Z: U. x2 a
In fact, its purpose is not to load/unload VxDs but only to send a
3 W2 T: V( Y5 F! }% D- oW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)9 B; T2 F" Q* c/ ~3 ?" N
to the VxD Control_Dispatch proc (how the hell a shareware soft could try! _5 s* d. e" d2 Z. U! P
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
9 D6 l. {5 G# Z, B* X; d; ]If the VxD is loaded, it will always clear eax and the Carry flag to allow7 g$ I. \' u0 P
its handle to be opened and then, will be detected.9 a% I5 U2 \$ _* ]4 I
You can check that simply by hooking Winice.exe control proc entry point
" |% a% Z/ ~% l+ nwhile running MeltICE.
6 I' s" {/ r/ h5 f
4 Z7 J, {7 [# z3 o/ I) q3 f& z* ~% x1 Z
  00401067:  push      00402025    ; \\.\SICE
' n. F( ~6 z2 Q+ J1 a  0040106C:  call      CreateFileA
+ n3 ?* @$ F, S- o! b4 @  00401071:  cmp       eax,-001
5 ?6 f4 U# w0 @3 X5 a, f  00401074:  je        00401091
7 a& W: F9 R8 G2 G; f# g& y, ~" d4 P1 d+ D* |# l% x. `- c

% O: y6 V& @% Y! M7 B7 k; C5 C9 NThere could be hundreds of BPX you could use to detect this trick.
0 r9 {( B9 y  J+ x4 Y. A-The most classical one is:( n5 M, g' E  |! o  Q6 g
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
0 S3 V. {: W6 m+ g% v) ]0 `; p    *(esp-&gt;4+4)=='NTIC'
# f! i( e6 t/ v7 f( E0 ]# d. Q3 k2 ~# S; F
-The most exotic ones (could be very slooooow :-(
; ]; c% }/ j6 k$ Y) u, T   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
4 S# ]( q7 X9 J2 ~     ;will break 3 times :-(/ S- U; i7 @( m+ l) x8 b( f

& R4 O8 B0 S6 P0 G7 `9 B-or (a bit) faster:
% y2 M# i& u0 f' i7 Z   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
% k6 w6 e4 l3 Y2 x' ^
7 A0 D$ m3 Q$ }0 I7 D   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
! o: z; w2 x! {1 _     ;will break 3 times :-(
0 b6 F/ j% {- D0 [6 Q3 I! ^6 L
+ w3 N# u) m4 ~7 d; x0 f  S* t& |-Much faster:
# L0 l8 Y+ M: G; D/ i   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'/ q6 q/ A5 W% r: w& o, _/ C
, y  i& @8 v1 I1 w+ y
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen0 m' a  C* V6 r9 f0 `9 t$ e
function to do the same job:
4 E. C) u" A9 ?6 R3 {, d, Y4 }. t% p' B; [- @" k# ^1 H
   push    00                        ; OF_READ) Y% y# u- N7 e% C
   mov     eax,[00656634]            ; '\\.\SICE',0+ i. C/ ^' |, h7 |% ]* O& j
   push    eax
# U5 S5 E# ?' `+ B% i( k% G   call    KERNEL32!_lopen  ]2 d% Q5 Q" s9 F
   inc     eax) n, w: u% X) K, h; P
   jnz     00650589                  ; detected
$ O: o: N4 g) ~" N6 {3 v0 f   push    00                        ; OF_READ
, D# ^. H- ^( x! }   mov     eax,[00656638]            ; '\\.\SICE'0 e& S6 F* \: n& C
   push    eax" ?' p# w, l' A( |
   call    KERNEL32!_lopen/ M) S* Y5 P, s# H" D  |' n
   inc     eax
1 h! Q! h0 ?' _+ Z9 J5 v   jz      006505ae                  ; not detected
& z6 x# \- t. C. ^( ^: W4 p1 F- u8 M0 d4 c& t

, n; M$ Z! ~" O; x6 v__________________________________________________________________________
0 k+ |- i: p0 ?9 ~, j- T! }. I3 n. C
7 I* s3 Z; I0 h7 r0 K4 YMethod 12: b2 U1 G9 B& N2 k2 A, O/ L
=========
& Z2 V; x+ A$ ]& Q
9 D1 y3 ?/ y$ M/ MThis trick is similar to int41h/4fh Debugger installation check (code 055 Q$ _: Z& Z& ?$ z
&amp; 06) but very limited because it's only available for Win95/98 (not NT)
  x3 R. O+ o" Eas it uses the VxDCall backdoor. This detection was found in Bleem Demo.
$ W( h1 e9 k/ n: U' h% L5 K) G" m, D
   push  0000004fh         ; function 4fh
! {$ w  h4 _, f- c1 |$ c   push  002a002ah         ; high word specifies which VxD (VWIN32)* ?) y" e0 s2 ?4 {/ V$ ^. ]# ^
                           ; low word specifies which service
% S4 U; s: R9 X                             (VWIN32_Int41Dispatch)
6 N. \) l$ D8 H; k7 i8 Z( w   call  Kernel32!ORD_001  ; VxdCall! Q3 L) g& a) s
   cmp   ax, 0f386h        ; magic number returned by system debuggers
2 _& x0 c  {. W   jz    SoftICE_detected
9 W) T- w& p) ]& H  a
, X9 |7 X( {' ^" S' PHere again, several ways to detect it:
; |+ \0 F# ?8 Z* k3 w5 s9 k0 t1 r( m$ \% e# ~7 F1 o
    BPINT 41 if ax==4f
0 N5 Z! K6 K% [3 b- |( [
3 c4 R/ {+ V. j0 n% R7 x    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
& `, |* R) g0 O$ U. e& D$ m' A
3 w, c: T# K8 C( T0 b) K    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
8 K, S# D/ Q4 K8 j* ?
  ~% P# r/ m1 h/ Q' t+ D    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!1 D) o; I8 \( _

: ~' {+ d7 P  b; h__________________________________________________________________________7 c! K! e( T% Y0 V$ h; x

7 q" a: J3 e2 B; ZMethod 13/ Q+ F, A- b# }' d0 m6 @
=========* t9 d- n* y; r
7 j0 @- D! a& S' [
Not a real method of detection, but a good way to know if SoftICE is
, n2 c, W$ z' O  |installed on a computer and to locate its installation directory.
4 `% Z, S/ G, JIt is used by few softs which access the following registry keys (usually #2) :
" [* D$ O, q0 K& b) K) }  ]2 |& q* r  u( V/ \
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
% ]7 t* s0 D: U4 S; q" k" o\Uninstall\SoftICE
: c6 k. D5 ?; F+ y* L. ]-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE( c# `( J$ C; }" |: j
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
7 c& A5 R, F5 j4 ~. K\App Paths\Loader32.Exe- p2 w, b/ w6 Q9 Y0 V
9 Y" W! A- i# L( p) G1 S
( C# j  [' w) B: C0 P* o1 k: O
Note that some nasty apps could then erase all files from SoftICE directory! Y' e/ b2 m8 \$ h' F' F: V' y! O
(I faced that once :-(* r% J& p! B8 u7 L. b0 M6 x

! \1 p, u- ]1 V, y# vUseful breakpoint to detect it:
8 I9 m% D0 G9 W( C4 v
% z  A) |" V: X& ^     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'- f: g5 V6 ]  }' H9 u" A- S* e5 ~$ a
' d" J6 F0 \: N' D
__________________________________________________________________________4 c  X0 J9 a7 {& Y2 k. s' ]' P  u4 M
1 v( f, Q  ]9 y! N. S

, R& e+ k3 {- {2 U% r# }Method 14
2 r( S6 a/ _3 W, U1 x: M=========
7 ?9 i% ~/ a( W$ Q4 Q$ d
, q& ?$ y. f/ }! V% R& p3 kA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
% A! ?& P$ y0 p, y! Ais to determines whether a debugger is running on your system (ring0 only).5 J3 ]3 O, R1 a! R7 u1 }* V4 h. O

. b( X, _0 y8 k4 j) v% H! O+ Y   VMMCall Test_Debug_Installed* ~0 m% F7 ?2 D, X  |
   je      not_installed# H& }# N- r' q7 g- g# T
: O8 ?, g5 |6 i, H) E. j
This service just checks a flag.
9 R# X, h% M& S1 L$ z$ I& N4 `</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部