找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
6 t) r0 `8 R3 a) H4 W<TBODY>; a# \. U7 |7 h' ^0 f
<TR>
1 y; a0 n1 _# j2 }<TD><PRE>Method 01
7 f$ W) d/ K; J9 T=========/ A4 S: V& Y9 N' O
7 }. o5 l( C3 S  D
This method of detection of SoftICE (as well as the following one) is
( i: ~$ T6 i- D+ F7 Z0 Y2 @used by the majority of packers/encryptors found on Internet.
4 ~% N3 m/ s) a  F! PIt seeks the signature of BoundsChecker in SoftICE
4 r& E& Q3 m' Z, p+ D3 i8 e" e0 c/ _( z$ o6 _' F( |
    mov     ebp, 04243484Bh        ; 'BCHK'
& b2 Y0 Y2 P& N& B' t    mov     ax, 04h
0 p! h! C; `7 k* `, ^  Q    int     3       & {5 _; U! Q  c3 H4 n* C& r
    cmp     al,46 X& e, v* d3 K7 I4 R' X
    jnz     SoftICE_Detected4 c7 C# B4 a, o5 b- f% J

5 o1 Z4 y9 k% C___________________________________________________________________________/ f/ ]7 s  {2 n' i, L" q3 _
. d* n9 v1 D+ t- |  g/ F8 p. M
Method 02% ^" j- |9 }$ S' m; E) S
=========, ^6 j/ I" t& V# L. T

* w& b3 e( o1 C7 ~Still a method very much used (perhaps the most frequent one).  It is used& I  B. D6 ^% f
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,* l( t% Q3 ?' v  W: ^9 o
or execute SoftICE commands...5 q& [( [1 h" d
It is also used to crash SoftICE and to force it to execute any commands7 q- F: `- _, s8 ?6 g9 w
(HBOOT...) :-((  5 I+ Q* P2 X" l) r# G7 W8 F

$ m8 Q3 _1 u  R' b9 Z' {0 l$ EHere is a quick description:9 J& B6 R0 \* @+ @; f1 L! @0 q
-AX = 0910h   (Display string in SIce windows)
" I, }- O$ U& o-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
, ^. j. y1 ]+ q3 W. M-AX = 0912h   (Get breakpoint infos)
; g' k8 x8 H# c; ]" N% ?-AX = 0913h   (Set Sice breakpoints)6 G0 A# K) V+ Y; E" I" p, T
-AX = 0914h   (Remove SIce breakoints)
: g: y) r. ?' U
/ u# X! @4 h& x* ZEach time you'll meet this trick, you'll see:& S2 U/ y0 V+ y) O) [1 h
-SI = 4647h2 `  B. K/ i! b% c9 T
-DI = 4A4Dh
! P6 j8 Y) P* B% xWhich are the 'magic values' used by SoftIce.
$ G8 P8 E( f6 y4 K# _$ OFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
' M6 x  b' F' e  t
& t5 x5 _# N# _/ w* e  c- j) I% jHere is one example from the file "Haspinst.exe" which is the dongle HASP) o' c2 S$ P6 I% ?! {0 J
Envelope utility use to protect DOS applications:
( C# x, ?, S. Y- B7 D
  {7 n/ z3 j* {' @8 I7 t% U
( M' \1 o6 g2 J* C5 ~6 l4C19:0095   MOV    AX,0911  ; execute command.% T7 n- f2 @1 u4 v, x
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
1 p' \9 K5 z- D  [: v+ _2 J" ?( z) G4C19:009A   MOV    SI,4647  ; 1st magic value.
# r2 Z6 z3 Q3 r6 `# r9 Q$ l8 l" `4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
, H/ e: I7 `& ]) `7 Z4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
7 ?/ u$ g; S" d' z  `4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute# ^- L8 q& G4 L
4C19:00A4   INC    CX" {6 Z# w$ J  l' k4 y! j- q
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute; |; Y, `0 ^0 ^* Q
4C19:00A8   JB     0095     ; 6 different commands.
7 E: J* x0 k8 f3 f4C19:00AA   JMP    0002     ; Bad_Guy jmp back." q5 @& Q' q* a# a- K% Z) P' n
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
- O( o) s: B8 e0 r' J" a" J) b: ]% v+ F! n7 b! N4 P8 y" M
The program will execute 6 different SIce commands located at ds:dx, which; v/ y1 p$ o1 ~0 X) |( t: J
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
1 z  K0 d( G/ D: S# r# g5 @0 ], c
8 t4 X  c) d4 `1 D: V* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
' M( X2 B' J" @2 W* O4 f___________________________________________________________________________4 j9 {5 R! m6 L2 B! }! C

; U) n6 V; h9 ^' r3 r: r1 k0 Q. \& L
Method 03& q" s4 G. P& Q8 v9 i% m9 g  P
=========. R7 Z4 n$ t/ x/ U/ d+ a! g4 c
- ^' Y5 C, |& F2 F  [2 e* x
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
/ W/ _6 v& T. b$ U; o% P" O(API Get entry point); S) y) A8 [% I7 k4 z5 R
        
/ T! V  v( ^. f( X$ H! t& A* s: g4 E2 G! E+ _  s/ l8 F( Z) R! C% U
    xor     di,di
6 F& @( I3 h0 a5 w* S    mov     es,di
7 u  y8 ?& O! J! m% Z/ f    mov     ax, 1684h         M+ P, r8 R  Q; h
    mov     bx, 0202h       ; VxD ID of winice
5 Y- }5 c9 W/ M) g) B$ \    int     2Fh
2 |: G- U5 X5 `0 w    mov     ax, es          ; ES:DI -&gt; VxD API entry point! N- b$ T% x! U
    add     ax, di. |# o# L3 M+ m  Z
    test    ax,ax
6 L5 ?6 P/ R) M& P: k5 C    jnz     SoftICE_Detected6 E3 Q" D2 M3 p0 j$ J* M* o

( J) C! O# a; c___________________________________________________________________________8 v! U" M: B7 v- [, ^8 f$ }
& \8 I7 f" F9 o$ r' q( V3 U) G
Method 04
) g/ ?1 b6 V& ^+ Z& I=========- z4 `2 R+ V5 D5 G+ ^
8 o) S3 a* Q4 g- P' ~3 j9 w) `
Method identical to the preceding one except that it seeks the ID of SoftICE0 M0 s& w0 J) w5 h
GFX VxD.
( m- E; z6 R- x# N# N# y
: z7 z/ M% `/ ?$ w" |3 `. o    xor     di,di+ n# x# Z# s2 w& o$ B
    mov     es,di/ q3 y2 n1 n2 o: s' R) b0 I2 X
    mov     ax, 1684h       : e3 S' q0 v9 i
    mov     bx, 7a5Fh       ; VxD ID of SIWVID
* f: |9 |: g  y& p5 c" f% [    int     2fh
, |+ ^9 J: k: @4 I! A    mov     ax, es          ; ES:DI -&gt; VxD API entry point5 J9 @/ k( D! f  v
    add     ax, di
  A9 |6 z, K6 D/ I& H' e    test    ax,ax8 u. C1 K" ^/ Y
    jnz     SoftICE_Detected
4 a9 `4 e! x3 V; s& T2 ~( x. c* E1 Y. X
__________________________________________________________________________5 p) t, c$ z( b2 ?% ^

% G9 H9 S. S) {& ?8 g2 p8 E, S4 e7 Z4 O
Method 05. d4 \2 m. Q0 c; X
=========
( J+ U  a: T' O+ @9 j5 y: h9 i) H$ H- Y% x7 ?5 \& @
Method seeking the 'magic number' 0F386h returned (in ax) by all system
, b  U/ J% k4 i. j! {, _: _" ndebugger. It calls the int 41h, function 4Fh.
, X! t; D! {  \4 O( H0 e' RThere are several alternatives.  
, j, ~* \1 v0 S% @  v% P/ w. }0 s! u3 I: o$ O7 X
The following one is the simplest:9 C! E2 q( Q6 P2 ~4 L0 G

# @& |- I# }$ ~3 G- G3 O    mov     ax,4fh  r7 K) s8 U  ]1 A0 c
    int     41h, {/ R  T8 N; @3 h: L" z9 O
    cmp     ax, 0F386" W5 C9 w9 D. u$ R! x( c" Z4 e+ b
    jz      SoftICE_detected
: o6 I, W5 T7 \4 B; U: k. D; y$ ^' w* z  f
' p3 E+ Q3 b3 s: i5 L( y
Next method as well as the following one are 2 examples from Stone's
5 {$ \7 V/ {. |( A1 S, p"stn-wid.zip" (www.cracking.net):! t: W. l0 v# F" w0 U. q+ ^
) ?  {) [4 k5 S4 s3 s% ]/ a+ f
    mov     bx, cs
9 I' Y5 p3 S: O; ^4 J' h2 Z+ V    lea     dx, int41handler2! p2 `9 i+ b* e
    xchg    dx, es:[41h*4]! ^" I, s  z: H5 E, c: g
    xchg    bx, es:[41h*4+2]7 G* R4 t$ h/ W9 J- h
    mov     ax,4fh2 j/ O% I1 L0 F$ L6 p* |: H( l! Y( m
    int     41h2 P: S; [0 `0 z* D4 D+ q5 v- H% h
    xchg    dx, es:[41h*4]
2 _) {, V5 j8 x: ]& [- T8 @6 e% o    xchg    bx, es:[41h*4+2]
4 l3 Y. v0 m1 j; j. Q- f. X  ?    cmp     ax, 0f386h
# ]4 }% A7 b- E    jz      SoftICE_detected
- D. P5 y4 I5 n/ V. ]8 Q
0 ]/ g+ A  {" X6 n3 P' Dint41handler2 PROC. o6 {) Q4 q( q9 F9 w7 a; G
    iret; a1 |* |& K4 a' e# |3 j; |
int41handler2 ENDP
* L/ P% e+ t% ^" R7 {8 x0 s. C7 t) @0 v9 ^: h0 Z4 b
" B0 [. k  ^7 _
_________________________________________________________________________
# w* F/ f3 i( t& P
7 v0 _) G5 I1 p# e7 o* v; @9 V+ \- v# I0 D" u  ]4 v
Method 06
. z1 z1 ~3 ]3 W/ }% b=========6 B" }$ [0 r: O/ p5 f
. q3 q8 v3 S: x- \3 Y% r, w

2 c. K% o. w# c9 p! z* Q0 S2nd method similar to the preceding one but more difficult to detect:& q8 j8 Z; `% f0 V  U2 l
, q; z8 _; I' [/ [; u$ p

2 Y8 G, D! S5 G# A! I  I3 M. ^5 }int41handler PROC
+ [( d+ H- R5 ^% |- J- e    mov     cl,al
% r, m" C& l8 h. n' q! }- h    iret
/ F- W% S0 P8 r+ H- Cint41handler ENDP
: k6 A- E% a  _  f. R  S. s% Z, i& H* {; F+ ~0 ]% S) w( i' L
- D; Y9 E% E3 P5 b3 {3 q" ^# y. t; l
    xor     ax,ax4 G6 |. }% N" g& I
    mov     es,ax
" A0 ?# {, T2 R    mov     bx, cs0 t" J4 m2 q, @- z1 A4 i, E
    lea     dx, int41handler4 w3 r, x/ {1 y- t5 A, I
    xchg    dx, es:[41h*4]" k+ X9 S$ O7 m) @/ J
    xchg    bx, es:[41h*4+2]
: \  c' S" G! w4 ?' U6 j5 v5 x    in      al, 40h: [0 P1 C1 B9 K1 g
    xor     cx,cx4 F) x% G8 g& y1 o) c; |$ R$ T
    int     41h; W) s% }) A% n
    xchg    dx, es:[41h*4]
* g0 c, Z$ B/ n! c1 e    xchg    bx, es:[41h*4+2]( \$ O" B( J1 O+ B7 v2 n
    cmp     cl,al! d% G9 |5 G( d8 o; W  @
    jnz     SoftICE_detected
) B8 I2 w6 X# D$ f; @) U, C0 e+ ?
9 ]0 r! D1 t4 d_________________________________________________________________________2 n$ ]( Z( N' }$ J$ \' \& Z5 @4 q
# a/ s0 t# [, H4 c
Method 07$ b, @3 p# d/ `) Q5 Z
=========
( h' r1 Q3 v* k$ {8 Q% N5 i; K* B! e3 M: o9 v
Method of detection of the WinICE handler in the int68h (V86)
4 l5 m- _3 P1 n5 Y
; x, T$ G2 n* g  m: e( r    mov     ah,43h# Y7 I: t; p! Z& P) P. N. F; L
    int     68h
- ^% m( `- h7 X) u4 e6 M* y    cmp     ax,0F386h
" L. D4 k' ^7 h, A  D    jz      SoftICE_Detected  t2 y& i( ?" J" ~' y0 D

+ d; S9 `; v- r  S* A- Z- y7 ]1 N7 s. j3 Z8 a) X  a. ]# G. {1 ~' A
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit& F9 I$ ?; }- a" y, L% \
   app like this:
* z5 ?* L+ l+ T7 }' E5 R' C+ Y
8 O7 {. X( v6 H- ]3 f   BPX exec_int if ax==686 C1 ]/ \" S( s7 j1 G) [
   (function called is located at byte ptr [ebp+1Dh] and client eip is6 p0 G# z% Z* n
   located at [ebp+48h] for 32Bit apps)) \, \& K5 M  m
__________________________________________________________________________* ~0 w. M. j1 Y/ B) \

6 ~) E8 m/ y3 {0 b+ @( V6 s+ ^- Z! ^3 ^9 v
Method 08
$ w1 F) l% ?2 ~) q6 m8 n9 x$ [=========
$ K& w4 d/ ?) |' W) E2 C
. b! S. a" P- ]" mIt is not a method of detection of SoftICE but a possibility to crash the0 X% {2 A' S" B# v- X# W
system by intercepting int 01h and int 03h and redirecting them to another
; b* ^6 G2 }& u8 t4 G( P( w0 zroutine.: b) X- i" ]. o6 ?* O
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
  p% o3 y  q" \% yto the new routine to execute (hangs computer...)7 n3 b1 y, p7 u1 ~- I
  d& n/ P  E, s3 t" y$ P- U
    mov     ah, 25h* y6 z: s" z. Y8 k2 J2 F' `# |
    mov     al, Int_Number (01h or 03h)
" c' P2 g& Z5 @* ~' \9 L# e* B    mov     dx, offset New_Int_Routine
( g) H; ^: f8 j% a- S" X' z    int     21h' U, e+ p! f& {
4 J7 B6 s9 P' w8 K9 v: q
__________________________________________________________________________, Y. |, {2 r; e, l8 S4 \$ u
( I( s1 G$ l6 ^7 k- B7 a2 g
Method 09
- T# `6 m# H9 Y) m+ c+ b+ s=========! h7 `  I" E. U; v+ l1 `: L$ M
# E; I) Y6 K9 `; \
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
  G1 s. T% \  \" eperformed in ring0 (VxD or a ring3 app using the VxdCall).
: S' G7 H" j; Z, }The Get_DDB service is used to determine whether or not a VxD is installed+ p( J& O& M1 V# U/ \. d! t
for the specified device and returns a Device Description Block (in ecx) for: S# r% m6 ~$ b- D1 J3 \
that device if it is installed.7 F. g" k7 Z6 _0 S. J
$ `( T6 x/ h# N8 r8 X2 \& ~0 w
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID5 u" m0 t" Q  _4 V& p5 Q! `5 O
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)8 o: K, k. r3 ^2 I$ u; J% i+ i
   VMMCall Get_DDB  m, }( m( y4 R) }! Z7 w1 \
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed, |+ z" ]9 R" ^! N* \/ v. t
. j( p8 I5 [  W# n( G, u
Note as well that you can easily detect this method with SoftICE:
6 V9 |( p. R- }/ k7 I0 l   bpx Get_DDB if ax==0202 || ax==7a5fh
; c5 e9 J( e1 A* p5 x0 J5 O* ]
$ \! X) W/ O6 L# k1 F$ ~+ B& X__________________________________________________________________________
4 Z: q5 x- \5 L6 Z3 {" G- T% k2 f; k. m! q
Method 10
# v- f( b9 L  q$ v+ Q" G; E=========
( W2 i. Y8 `% I/ }9 X
4 a$ q+ C5 m3 g2 @=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
& m* e" a: O9 m9 o' A  SoftICE while the option is enable!!
( d# V' O: }' `) R0 F5 S7 k+ u
( g3 a1 @# J. c0 r& [This trick is very efficient:! w" D( {/ R9 X. T
by checking the Debug Registers, you can detect if SoftICE is loaded
6 L$ b/ B) v* x0 {, i& l& }(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if4 D4 {# F& c6 I
there are some memory breakpoints set (dr0 to dr3) simply by reading their* e4 X( ^( v4 z" [. G( k
value (in ring0 only). Values can be manipulated and or changed as well+ w7 x0 M+ R6 n9 d& j! S6 Y
(clearing BPMs for instance)
. e6 c, J; G$ D+ a( `
# p3 f$ W5 e$ w4 Z3 @__________________________________________________________________________
  a. d5 f$ d  ~
+ q2 }2 S/ I. N1 }( IMethod 11* E% N$ D* \' |6 C' E. c3 J" A
=========
" H5 v7 D8 @% }; t  }. T$ }8 w: I$ ?( @& m7 O1 c
This method is most known as 'MeltICE' because it has been freely distributed
0 \. ]( Z9 s1 d$ pvia www.winfiles.com. However it was first used by NuMega people to allow
3 U: t2 [8 V, j+ \- L2 w  x, nSymbol Loader to check if SoftICE was active or not (the code is located
3 D( Z9 F2 {$ g% Yinside nmtrans.dll).$ u8 [6 ?6 M, M1 C6 H
0 X, a9 |- ]9 X1 h
The way it works is very simple:+ T/ h: p( Y/ L1 g, n
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
% {6 k2 Q* Z) M  @6 YWinNT) with the CreateFileA API.
  s4 S# a2 o; W+ m# I4 Q$ ]
8 H/ r4 K# ^, I& SHere is a sample (checking for 'SICE'):
) `; s4 p& n* o/ e$ S* ?* A
) k8 H  m1 S3 }& f9 J" l& {/ d8 ~BOOL IsSoftIce95Loaded()0 x6 h2 ?! C3 b6 G  Z8 z0 r
{1 ?6 U7 j/ E$ T" e0 k
   HANDLE hFile;  3 {$ {2 M1 a* u9 s( e9 I9 X
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
+ X' p# _, y7 g4 `4 X6 ~                      FILE_SHARE_READ | FILE_SHARE_WRITE,# x' q& N) P" a: f- o% e
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
8 M2 `! {) @$ [4 V. N2 g( ?8 g   if( hFile != INVALID_HANDLE_VALUE )
) r+ K* b0 E! g6 m% Q  g   {
6 p2 o6 f% w! U4 e. v2 C+ M. O      CloseHandle(hFile);6 \" t; {" y) f, t: M$ v. @5 C
      return TRUE;
0 t% u0 k* R4 w( C$ u2 ?* `" C   }
3 @- [8 D: M( a3 c   return FALSE;
! F# [* A5 t( C( q3 T( q. i}
; Y& E# T; O" Y" Q  x- g# y$ H. n2 K5 L5 s, Y
Although this trick calls the CreateFileA function, don't even expect to be
( X. r) ?% I. E% S+ c3 ^able to intercept it by installing a IFS hook: it will not work, no way!: w  a1 b# ~4 f- o
In fact, after the call to CreateFileA it will get through VWIN32 0x001F# K& m/ v$ ]4 z) d- s
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)4 J; M1 \. R$ B) O7 m
and then browse the DDB list until it find the VxD and its DDB_Control_Proc  ]9 a+ |2 L7 g) M
field.$ N( u4 Z4 x( t/ O0 X6 ?- Y- d1 M7 u
In fact, its purpose is not to load/unload VxDs but only to send a
! i; E& f7 ^, [! E' [5 fW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
1 k: _) u, A) yto the VxD Control_Dispatch proc (how the hell a shareware soft could try
& @0 D2 D. \4 l, N1 d: U/ xto load/unload a non-dynamically loadable driver such as SoftICE ;-).7 y6 t+ Y& B( E3 q
If the VxD is loaded, it will always clear eax and the Carry flag to allow
5 {& M% d. h* [' R- lits handle to be opened and then, will be detected.
8 @4 j- K0 {: I: v% T6 |3 @+ V; M+ IYou can check that simply by hooking Winice.exe control proc entry point7 X8 x8 M5 ^9 e6 z
while running MeltICE.
4 ]0 |. a1 l/ B& n: e
0 ?+ f6 g: V* o; j- N" @- F  B& }* o
6 L1 ~5 R0 r4 V- b  00401067:  push      00402025    ; \\.\SICE
4 V- B8 Z+ T( W% {: ~  0040106C:  call      CreateFileA- e/ Y% T, \4 p( I. |2 t
  00401071:  cmp       eax,-001
: {2 {) q( \8 q  \  00401074:  je        00401091
3 N3 C# M6 d& X4 I+ M8 Z6 c* ?1 J
8 B4 D" C. n: A6 O: w$ x& `4 `" t( Z! m) }1 `, F
There could be hundreds of BPX you could use to detect this trick.
. W7 i9 D" q1 `  A; v+ D, T: |-The most classical one is:& w, F/ z4 |% Q8 @* b! {1 h8 d2 M
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||: N" i3 l3 _1 r0 O* d; h) S# {
    *(esp-&gt;4+4)=='NTIC'
3 e( I9 _: U, P- r" _, `5 z5 G# I+ I- {0 J
-The most exotic ones (could be very slooooow :-(
1 d. K/ c  p$ ]9 Z; N   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
5 O9 _: m* Z& t" v; j; s     ;will break 3 times :-(
- w% I! N0 ]1 k1 J5 X5 o1 U: Z2 P8 f
6 @) D: ~% R$ z$ }7 b1 K-or (a bit) faster:
/ M! j) W" H% O% x* ?6 ?" E$ ?   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')7 O5 S6 l" F' H( G( K
+ w0 y5 P. ~& @% I5 g9 [
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
) c" B4 z3 Y9 `# ^     ;will break 3 times :-(0 I4 o. O/ O3 t& d% ^; a4 y8 v
8 d9 k! l! Z$ D0 U2 N7 O5 [: [
-Much faster:5 o, _6 b2 A8 n4 e4 h
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
8 b1 }8 w4 d9 U0 d# q3 w# @$ j
- ^1 i: N* N; ]+ rNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
" ^3 U- v' c6 G: Mfunction to do the same job:
; S6 T& J3 A3 o1 l# ^4 @0 Y7 `2 M& Y
   push    00                        ; OF_READ
) d) R# P6 A# ?9 d5 w$ J- r   mov     eax,[00656634]            ; '\\.\SICE',0
! u" G. c1 ^, I/ f0 ^. |& x$ \8 q   push    eax
6 |6 [& c/ ~- h4 b) o0 f; ^   call    KERNEL32!_lopen- B6 V5 y# r. f6 t
   inc     eax- a* \, T6 C  h" ?. |1 U
   jnz     00650589                  ; detected
/ a, O4 B" C8 ]1 K1 m6 A- ]: E2 m   push    00                        ; OF_READ
' ~) @* s  d8 G* h4 `1 q   mov     eax,[00656638]            ; '\\.\SICE'
  r3 q0 J1 E  Z; V/ I   push    eax
  @, M1 J/ @- v3 c+ O   call    KERNEL32!_lopen! {' ]! [9 L# d+ |2 f3 E
   inc     eax
6 X. p; V; {8 j   jz      006505ae                  ; not detected
  x, T& h1 s8 c+ S
3 R. D9 X; _1 U4 O, S
% [; O; ]9 e$ N6 d__________________________________________________________________________
1 W' U7 r! Y" x: |  _5 r- Z; M0 l3 {
Method 12& y* K* I/ \  D5 S) [* f
=========' g1 i* u+ g# {! p# I  \  ~
- d( ]) `% E9 p8 e& C' \/ X
This trick is similar to int41h/4fh Debugger installation check (code 05
1 a/ E3 @2 h! d2 u) A&amp; 06) but very limited because it's only available for Win95/98 (not NT)$ q" N# P3 U- }7 E8 Z
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
' C% M& L2 ^& T. L" B2 Y+ Z3 m) A% I4 M) {  D! S
   push  0000004fh         ; function 4fh
- G6 Z. s5 j% ^. o) Q1 C   push  002a002ah         ; high word specifies which VxD (VWIN32)
7 X6 \$ b* b9 E% `) B* w                           ; low word specifies which service' `% H; H& }5 t2 r: u* G2 o
                             (VWIN32_Int41Dispatch)
- d  |3 G/ U& X+ ]  z   call  Kernel32!ORD_001  ; VxdCall9 E# e1 m/ f- `) I) h7 t. s1 h
   cmp   ax, 0f386h        ; magic number returned by system debuggers( Z; E- m% `. b; ~% ~
   jz    SoftICE_detected
1 Y' Y4 L2 s  ?+ L/ o
: @& X2 a; e, N. ?0 h% f0 \) o8 VHere again, several ways to detect it:
' D' a1 H' [  }6 e
  t+ h1 o8 V0 @    BPINT 41 if ax==4f
: v6 ]3 j* g9 a
& K3 @: z( }4 I    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
$ @5 t. y4 C. M. n! }
2 l% Y9 a9 V! `2 e3 ~    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
( y( b% k/ S3 N# x" R
( m. X# e6 z+ r* w4 N/ q3 A, H" X    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
: p  O4 }0 O' L2 E! v7 y0 s: X- f' N) |- B5 `0 B
__________________________________________________________________________
) X, v' v: i: D  y* P$ N8 ^; Q$ I& _$ Z8 l+ K
Method 13% T- s0 E2 Y1 p- s
=========
7 S$ _# a8 W2 e+ ?4 ~5 G1 E% q- t: ^- u7 r) W8 u  ~" p
Not a real method of detection, but a good way to know if SoftICE is
# m4 N% p) x6 K0 Rinstalled on a computer and to locate its installation directory.3 r6 A) e. L' K2 w
It is used by few softs which access the following registry keys (usually #2) :% |# Q  U+ s  M( f- h4 d

+ y) C2 ?. V; H-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
/ ]+ p& f( E4 g# n; h\Uninstall\SoftICE9 H6 h) e& K. x1 |! x  a3 Z3 e8 ~
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE" C2 c  ?, y# }- Z
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
2 o5 x4 n5 ]) p+ z' m3 |\App Paths\Loader32.Exe( P# F1 A7 D: h8 E/ e
, h0 x. _/ e& E' y3 C

, T! v: _" a, e1 Z- {& Q" ]4 u- ]Note that some nasty apps could then erase all files from SoftICE directory
; K: Y, s5 q2 [(I faced that once :-(
" `! ~: O5 X  e- y' u
/ `% a$ {: |, {& S- ]1 G' ZUseful breakpoint to detect it:
* l4 c+ B1 H) Q% A+ `8 q- h# q! o) Q4 ]% x
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
1 p6 _0 N( m7 _
6 F/ ]2 K8 K( z0 B% b8 x__________________________________________________________________________
# t6 n" I- n& U
9 S/ S+ c* m- [' p" T1 k  a$ @2 ]4 ?$ v( I
Method 14 + e( K- h2 X" P4 r7 B
=========
$ [0 y0 X/ k$ ?' ~8 ~' W+ r. p6 A- z" B) ?
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose: z. @0 z7 j, D
is to determines whether a debugger is running on your system (ring0 only).5 L- {0 W$ s% v. c- a

0 [& [0 k/ n: O- z1 n  R* j   VMMCall Test_Debug_Installed8 d. A: {; h, Y+ S2 j/ a
   je      not_installed
" \! D- g- h3 G0 W# e7 m% X4 u( q: t
This service just checks a flag.
0 C( \" R% }0 W+ }; T- x</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-8-17 14:36

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表