About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>+ m: z4 f. S9 ~, [
<TBODY>3 |6 Z( \% E. w4 {
<TR>
( O/ \/ O) d7 f0 q4 W: ]+ O4 b<TD><PRE>Method 01
  j  e6 k8 E4 q=========9 {0 h; q9 X0 K" ~, E. ^! j

( ?& a7 j4 b  v( TThis method of detection of SoftICE (as well as the following one) is
! z0 C! W$ c# f$ Mused by the majority of packers/encryptors found on Internet.
/ H; H6 ]; J2 l  V5 X4 uIt seeks the signature of BoundsChecker in SoftICE/ b# ?3 i$ G  Z) ?7 S; U0 {
2 W! b( Z/ s, D2 y: A, L5 `0 n. l) j
    mov     ebp, 04243484Bh        ; 'BCHK'
- m: O' n1 t5 n: Z    mov     ax, 04h- U! N9 e% \% P2 R" n: P  Y
    int     3       " ^9 }9 S2 \; y! \6 ?
    cmp     al,46 p' y0 k0 s( G8 O1 V
    jnz     SoftICE_Detected; d  w8 m! d1 q6 R2 h8 g7 A. u
, L: e" X9 _; T  z1 ?4 H0 R
___________________________________________________________________________  s' v( q$ @, M

% u. n: ~% e. S* K1 ]# `' IMethod 024 Y! x( v7 d0 c+ l0 F: ]
=========% v) I+ v; _) O! j" `

0 q* ?( z* K7 t9 {  U0 T' f1 lStill a method very much used (perhaps the most frequent one).  It is used
8 c4 J- ]) ^! Hto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
. s; O! l7 O3 \* Yor execute SoftICE commands...8 r, F/ F2 V1 f9 {& j. K! x
It is also used to crash SoftICE and to force it to execute any commands2 A. r  Y* p- m) S9 z- C* v5 T
(HBOOT...) :-((  & N" b* [3 A9 Q$ @2 v) j

% k/ R& |# W8 ?Here is a quick description:6 ^  x% E0 T( L( n6 j$ S. x
-AX = 0910h   (Display string in SIce windows)/ s$ H5 ~- m6 Q2 ?/ A- _
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
; I, z: m0 |; a$ b4 a" Y-AX = 0912h   (Get breakpoint infos)
6 W" @, I) l" [9 Y-AX = 0913h   (Set Sice breakpoints)2 K) C  M. a- I
-AX = 0914h   (Remove SIce breakoints)
% z' Q% {" l. {- g/ q. a# K
0 X! X: ]: _9 _2 I: W! fEach time you'll meet this trick, you'll see:
5 ?0 L1 I; G4 @7 a-SI = 4647h6 B  i; o7 A/ g" U, `( Y% H
-DI = 4A4Dh9 R1 z& S5 U; a# w9 i
Which are the 'magic values' used by SoftIce.. \, L6 p; H9 N
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
( c9 |, r# C) s& c! J" g
- ]- I- d- z  I4 c8 AHere is one example from the file "Haspinst.exe" which is the dongle HASP  }5 o  |5 H  ~9 }) Q
Envelope utility use to protect DOS applications:
: Q: c2 Z8 o9 {3 k0 F4 g1 e& ~& i% B
6 d" Z/ h' h/ g9 }" W' m
4C19:0095   MOV    AX,0911  ; execute command.$ Z, c9 k6 U& R" ]7 v
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).$ c% H  }8 J7 e* R% x: d8 s9 @  z: x
4C19:009A   MOV    SI,4647  ; 1st magic value.
* ^: A! D* q2 W/ Q" @- L$ a4C19:009D   MOV    DI,4A4D  ; 2nd magic value.: J: Y5 o* G" }4 ^" d* N9 B
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)  X* v# B5 i: D
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute- |; H) u' K. a% H  M$ S$ p
4C19:00A4   INC    CX
- ]8 }  ~/ O5 v  p, E' ^4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute- U, P  f" ?: s" x& P% i  ~$ r- h
4C19:00A8   JB     0095     ; 6 different commands.$ u9 ~% O0 }, D; [& p
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.0 o! r) n3 D& Y+ _- C
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
1 x+ }: Q* \6 m& X8 e% C9 B3 y6 ?! b# W* e
The program will execute 6 different SIce commands located at ds:dx, which
1 `( X  K' B  {0 `  `2 L; Fare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.9 V, V# o8 o# ^, V
4 Z6 C$ M+ |- ]1 r' d. w
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
0 D, [2 G5 P+ _/ O___________________________________________________________________________% u( r6 K* a/ z+ @" W2 m4 n

& b% d. I" y& [; d! [6 A# [0 Y/ ~9 k/ u5 Z
Method 03$ ^3 ]3 G0 }9 F+ @' e  w0 v
=========
! @- Z% Z6 W) y8 M5 e' S5 P1 f' k7 ^' c5 f) z6 c% b) P
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
+ ?. f. e) l6 {6 E/ N/ V(API Get entry point)8 G* F' F: U- h6 i) Q
        8 Z  v4 T9 L' I5 C9 a

9 O* h% j5 a6 t    xor     di,di3 a' i* L. I  P) |3 ]  w
    mov     es,di5 W' O' h3 L) M& w9 Q: N
    mov     ax, 1684h       0 ?' `+ l2 L" D3 O( W0 a1 W
    mov     bx, 0202h       ; VxD ID of winice" N4 Q4 f4 W: n* v2 N1 o
    int     2Fh
# L% v; o- x: A" K4 T2 K' b    mov     ax, es          ; ES:DI -&gt; VxD API entry point
& O- p$ |- J/ b& t; ]" W  \    add     ax, di
; K: o# a  s) v: {" e    test    ax,ax! M# T+ B  ~0 M9 l6 X( J
    jnz     SoftICE_Detected
0 `& E7 a! D( @1 V6 C
2 H( {( R$ ^2 I% v3 [! h___________________________________________________________________________
6 M2 q( c: J# u6 s  w
+ M2 A4 a+ v+ ~0 L$ p- L1 MMethod 04& d6 F' K! O: d* ^; [3 m
=========
: q9 |, u  [3 s/ M' e- }) }; y( V
' @# d9 |9 K+ W$ r, p& }Method identical to the preceding one except that it seeks the ID of SoftICE' P3 w1 H$ h0 a/ ?& x1 p
GFX VxD.' B1 \; o: E: E% u* H/ A

: J& a. n9 O7 N  s+ x. c& [) {    xor     di,di' G: T, G! O! [4 C9 L+ K( l
    mov     es,di
5 w: ~  O" k9 v. |% e% `    mov     ax, 1684h      
6 H! Z, W& c9 g; ~2 ~2 f1 X    mov     bx, 7a5Fh       ; VxD ID of SIWVID" v! g% _* u# _0 R( ?
    int     2fh  i9 Q/ @; t5 q- g
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
+ Z4 m" i4 D1 C5 @1 O/ W  ^    add     ax, di5 y" f5 {( A1 ^+ Q; ]: X
    test    ax,ax
, M# O2 L2 ]" w6 [! g    jnz     SoftICE_Detected
  ]. v4 L$ p) y$ N
1 I. Y0 ~4 c" r0 U- v__________________________________________________________________________
4 X6 w& a* B6 x1 w' m7 H8 |9 l. |4 M" N

7 Z( `5 j6 a: w, Z  u, q3 Z, F) qMethod 051 C; h6 [" ?7 L
=========0 S2 m& N5 @. S) s
3 l6 M# F; r( Z7 z3 O" m( B
Method seeking the 'magic number' 0F386h returned (in ax) by all system" ?! J) q& X# L: Q
debugger. It calls the int 41h, function 4Fh.4 }: ^: C. q$ J! }8 [2 ]$ m: w& n
There are several alternatives.  ) Q4 J0 r. K5 a9 w6 L
, b( n1 l; D) `& J, h! Q1 k
The following one is the simplest:
1 T% d: E  A1 ]) ]/ V0 b9 x7 X7 e5 Y1 h% ^# Q1 z, o: f* I0 Q  U
    mov     ax,4fh4 ]# k) P. z+ J' ~
    int     41h
: v) V5 u9 ]  @+ {# I6 d% M    cmp     ax, 0F386
  Z' ]# x& f: }* \# O9 _  ?    jz      SoftICE_detected* A7 u! f. A2 x

4 k4 F' }& y" `* Q$ B$ S6 m$ E) _" g2 L2 x4 {: ?. c6 r( u
Next method as well as the following one are 2 examples from Stone's
  N. `, q4 P$ Y8 q9 H" e( N4 x; ["stn-wid.zip" (www.cracking.net):4 T; M- q7 A& @7 g) W

* @0 W: y7 R' l( P    mov     bx, cs
- D2 o, @& z1 j& `" `1 `7 y- p    lea     dx, int41handler2
8 U( E4 T. d4 P: `) Z; h. ?3 x  V    xchg    dx, es:[41h*4]
& X$ J: {2 |' a& Z+ [    xchg    bx, es:[41h*4+2]
! A  H' p9 E# q" H    mov     ax,4fh
) K/ `& L8 M7 p" O8 l* L    int     41h% ~9 x; j* e  c: J
    xchg    dx, es:[41h*4]0 E6 e& f' A, A& v8 L1 L4 t8 s
    xchg    bx, es:[41h*4+2]5 U* L! A/ P8 z$ A) T
    cmp     ax, 0f386h
7 L) E, U/ @8 b4 o* ]. y    jz      SoftICE_detected9 c$ `8 O/ L1 i. I

& R* x& E* n5 d* R7 Dint41handler2 PROC" P! Q4 Q! @/ B1 T6 R
    iret
" n2 h- h! R) A- X4 q8 Aint41handler2 ENDP6 b0 l9 z5 u/ X" _/ G$ G: ]0 |' z
: h7 K& E1 Z! E. f$ a) G

! ^; l/ ^! [' j2 n' n4 {3 U_________________________________________________________________________
7 p3 c" L! O5 m- {5 e8 K9 B
1 I. E1 s" E( J6 t, p. X
1 f4 Q! u" [9 F2 xMethod 06
6 Z: |4 g/ k0 L' W. }8 ]=========
' ?0 f# p2 j! B/ M. |. E2 \
% r  ]. l$ r2 q' ?8 ?: {) M* Y& E. W" p& s9 O1 I
2nd method similar to the preceding one but more difficult to detect:& L1 m2 Q2 `# k( i9 ]3 c

. m9 n$ X+ R' w& `& e5 t9 i, Q7 i
int41handler PROC
! _* O% f! ?. J0 K    mov     cl,al( Z% `! [3 U3 G5 k
    iret8 G5 }! _, c2 j& Q" `  Y, I0 F
int41handler ENDP
6 C; e" p% }: q" q: V+ `! g) w' p0 m# ~/ v1 ]
. C& L' ~- i- d4 U
    xor     ax,ax9 x& Q% D6 l( {
    mov     es,ax
. p) f, M! R6 `7 @' @7 h: y) I    mov     bx, cs4 Z; ~* Z; f8 o1 F6 n
    lea     dx, int41handler8 L6 C7 t$ d. Q' ^' h9 x2 s
    xchg    dx, es:[41h*4]% w9 I# }6 s% Q$ H8 P) f
    xchg    bx, es:[41h*4+2]
& D/ Z5 w) l; I    in      al, 40h
0 I+ i/ N" _/ w! B4 ~; L0 x& V    xor     cx,cx
: [: `7 R! H8 N1 H: r    int     41h: {* I! _: W/ p3 s: B6 I
    xchg    dx, es:[41h*4]' X" F9 q/ D. P0 ?8 H
    xchg    bx, es:[41h*4+2]
" U2 Y. s) ?$ X# v- b    cmp     cl,al
8 K- e' Y5 s- v% y, v9 n1 }    jnz     SoftICE_detected" N. c% I4 U5 r" C
7 u# |5 s9 k' X# z. v/ v
_________________________________________________________________________, L5 D- N$ q6 ?8 g. l& G( o$ F) |1 W

3 V: I+ R7 |" K& d& tMethod 07
5 I& X, k! j- V( }=========9 t9 V  v" v/ l0 y2 ?
! n2 {1 S2 ?$ J5 e8 l& Y, d
Method of detection of the WinICE handler in the int68h (V86)- T/ F& u- X5 q  U8 A
0 X  a3 w' i! V! h8 }
    mov     ah,43h
4 i: V' C* J+ ^) V8 N% |! n    int     68h
1 H( y0 {% D1 J+ l8 K1 l/ C3 b    cmp     ax,0F386h" K5 A, ]% I, ^; V# `0 ]
    jz      SoftICE_Detected
3 c+ F) s" j. J( y
+ g+ X& N0 D. X! t- T: w8 a+ }0 [8 M9 z& `0 `% W
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit& ?" y, @, o) p
   app like this:
3 ^! [/ X! o. ]# _5 o6 T( x; Q; Z" T: ]$ J1 T$ Y, ^
   BPX exec_int if ax==68
0 o  u# u* N- [: c# w   (function called is located at byte ptr [ebp+1Dh] and client eip is
/ Q6 C+ Q4 P$ {3 Z8 Q* o3 O  u   located at [ebp+48h] for 32Bit apps)
0 F! W- r& m# Q$ c' R( |2 C: ~' z__________________________________________________________________________( t: {6 v, e* c3 J5 H6 P( e

/ a( P# C6 T: b, I- N% t0 O, D
) {; o# s$ v0 `1 CMethod 089 p% F6 _+ N* a+ e) `+ r: ~
=========
4 K! t( J( n/ S9 a& V8 v" F) c
It is not a method of detection of SoftICE but a possibility to crash the/ p/ ]% ^. g4 k4 E) v
system by intercepting int 01h and int 03h and redirecting them to another/ U9 J% s: K  M
routine.6 L8 N0 @" b2 |" J
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points4 k* h! y$ p' J8 u+ h) b! b
to the new routine to execute (hangs computer...)) I$ v6 c1 n4 _' ~
* ~6 l/ x  G) f5 {
    mov     ah, 25h
* P6 {% c3 r5 B: q5 n. s- H    mov     al, Int_Number (01h or 03h)- T8 W# `) X  Y( u$ r0 Z: Z
    mov     dx, offset New_Int_Routine$ Z- Z! m6 w- V) X0 H
    int     21h! a+ X( @, o& E" j
+ X5 R2 I3 o% Z# i5 ?; }0 @
__________________________________________________________________________' Z. e: G% I6 \, M/ c. V1 {6 c
2 G" p% u$ ]$ u; ]
Method 09  i5 d* z# p/ W1 z+ E
=========
, D% g& m. Z- l  h' e, R8 y4 Z1 z5 }; F: _  I8 A, ~/ r" U) g
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only5 C9 L2 N3 c/ |
performed in ring0 (VxD or a ring3 app using the VxdCall)., S8 {- ~! s' }4 S, t' ?0 J) Y
The Get_DDB service is used to determine whether or not a VxD is installed
" R' X6 s- i4 d9 Q7 j, ofor the specified device and returns a Device Description Block (in ecx) for8 \" w' i* Y5 j- m4 H
that device if it is installed.
5 \+ e$ J: h: q+ `1 ^, P
( X  s6 s, e8 u7 L; L   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
# r1 \2 \" N/ q3 G: v   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)) v* {2 R2 b% A) A8 i2 l
   VMMCall Get_DDB
$ v- l$ A. S  w/ a9 y0 e& S   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed! K# ~/ w8 x, L8 ~) Z' T

4 [3 _) P/ o4 xNote as well that you can easily detect this method with SoftICE:
  Q1 f6 t. b3 s% d6 d1 g' L5 F( {   bpx Get_DDB if ax==0202 || ax==7a5fh
" n' o: U. X9 f# C
" C7 K7 c3 k7 k: ^9 O/ T__________________________________________________________________________
7 H" l+ h2 n2 I5 B( o( O
5 u+ H- M: g# Z3 {Method 10
+ |* S9 p2 ]. i! W# y7 V=========
# d! u# c. u( U/ i! X: _/ }- R' A3 `( b: V& j6 ~
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
9 @# {: n6 V! f' L6 a  SoftICE while the option is enable!!& F6 J5 C5 |4 o, j% ?
: I: u% `, a1 e9 y. H- e8 R( P
This trick is very efficient:
, N# U! t- A4 J7 ]1 R( E. o, Nby checking the Debug Registers, you can detect if SoftICE is loaded8 E0 |/ w+ F' k3 i# \
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
% O5 j' ]  k8 uthere are some memory breakpoints set (dr0 to dr3) simply by reading their! }" V; u! l- {0 `
value (in ring0 only). Values can be manipulated and or changed as well
  c5 F0 m1 L$ j4 ]8 H& w; G) @(clearing BPMs for instance)
( w& `& E+ ]/ u7 J. \
9 m- G  N9 X5 z6 _9 p* f__________________________________________________________________________7 I4 R5 K4 ~5 v+ ~

: S/ K) _8 X  ?% KMethod 11
6 q) d. |/ b! L5 @% K=========
3 W6 J- B8 {) R8 x) [4 d, G" M8 z- q; b! A! K& J3 X# w3 r9 E
This method is most known as 'MeltICE' because it has been freely distributed
/ B4 Z0 ?* c2 W6 ]) Evia www.winfiles.com. However it was first used by NuMega people to allow
  R) L. r8 s$ `" ~9 ~Symbol Loader to check if SoftICE was active or not (the code is located( Q& g: d5 m4 j& R2 H7 d, }% p0 \
inside nmtrans.dll).
! R* w/ e' J3 q+ n  I6 v% k: z+ d5 T
! O7 b- d; B' Y& e0 j! ]& a7 ]The way it works is very simple:
' d; E0 g6 C7 {/ m) }5 }3 lIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for! o! J0 x0 C. H+ o+ |2 m
WinNT) with the CreateFileA API.
! N' o1 y" ^% Z! \! ~  r
& A( L" {5 S% n* `Here is a sample (checking for 'SICE'):" e* l; H( o6 Z  F. r. @4 w. c" A
5 U8 {- Y5 c& r  b9 m# h( ~* A) a
BOOL IsSoftIce95Loaded()0 ~8 y8 i* n% p; O
{' O4 ~# Z. V, ~+ h; P. m
   HANDLE hFile;    F6 W& k* S3 [6 R" c3 C
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,6 L. T- t- U) j! {2 O
                      FILE_SHARE_READ | FILE_SHARE_WRITE,
9 ]+ d: i  }) W# n! @& d0 }                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
) m: c: U# p$ b' J' r5 ?0 ]* X4 S3 g   if( hFile != INVALID_HANDLE_VALUE )
, G- a3 |6 i( o+ T3 [3 u) h) k0 f   {
& i7 @3 W: a; \/ x8 i& e/ P      CloseHandle(hFile);) c/ O- E: O! ?3 t/ ~
      return TRUE;
: f! D5 d' a( @   }
) g9 w1 N. p' c. y/ m4 K" Q   return FALSE;, G. p1 P; K( w. m; N
}
  _! E" k) _! f- E. W0 Y2 m; p. @' ]; q: E) H4 G* [
Although this trick calls the CreateFileA function, don't even expect to be
( p9 o! L2 T3 L0 d3 K! L# Bable to intercept it by installing a IFS hook: it will not work, no way!
  a* [) J0 {! s! p( c) YIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
3 a% A# B! H4 j" s9 ^0 u" _+ Vservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
* L6 r' V) ?: T$ Cand then browse the DDB list until it find the VxD and its DDB_Control_Proc
4 B$ ?/ J; i; e$ Zfield.
0 @0 S" c: z" c. {( o! WIn fact, its purpose is not to load/unload VxDs but only to send a
, Z$ R7 o. P/ G) b1 \: `; TW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
( o; v$ }4 |* D8 V7 `) @& f( Q6 lto the VxD Control_Dispatch proc (how the hell a shareware soft could try- W5 v& J! e- C+ m% z) j
to load/unload a non-dynamically loadable driver such as SoftICE ;-).9 ?5 h. m9 g4 i- v0 w+ V0 Q) H
If the VxD is loaded, it will always clear eax and the Carry flag to allow
( A5 S3 Y) h, Q! R0 I  a, _its handle to be opened and then, will be detected.- P# N6 e  {+ `9 K2 V) c
You can check that simply by hooking Winice.exe control proc entry point6 A5 v1 V# g5 a' _- I
while running MeltICE.9 h0 W9 l3 V1 O; A+ I/ Q
& A/ q) B7 j. w3 m1 W0 y
2 R9 n+ e% ?1 q
  00401067:  push      00402025    ; \\.\SICE
) I' {: ]. X$ T  ~- g  0040106C:  call      CreateFileA
; ]- ~7 N1 M; V) ^  00401071:  cmp       eax,-001
3 d+ G% T; c$ D1 o  00401074:  je        00401091. _. |5 I$ b: K2 j

4 `. V9 B& V- H6 V8 b8 r" R
) t2 T6 o, Q9 JThere could be hundreds of BPX you could use to detect this trick.1 s6 c( H7 \* F2 I; ^
-The most classical one is:& K: D% A( u- O$ N% L1 f+ [  j
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
* H/ z$ V/ p* B    *(esp-&gt;4+4)=='NTIC'6 ~7 ~, A" X. O5 [. }4 e

. e& O- s" a( y- J4 M" h-The most exotic ones (could be very slooooow :-(
" b. E( P  L2 x, D; L; W   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
  Y0 j9 M' ^) o6 |4 G5 j     ;will break 3 times :-(; X" d5 @, T, x& f1 V- P6 B
- t: }! `4 \* m* R6 b' c
-or (a bit) faster:
6 q+ e9 ~0 c5 J- |  n: L   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')- \: ]# W+ G3 o

- \" a1 v+ j* \& f4 k5 j! S   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  * \3 F( }+ A. D$ x
     ;will break 3 times :-(% X/ b7 r& S3 ]" X

. A  j2 R/ P! W8 z% ^4 _. a  |' b-Much faster:9 s6 g/ g( Y# R% v1 v
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'$ _0 a7 \: w' [" `+ |: m

1 \  T( ~$ R5 I0 _7 VNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
0 ~0 u- d7 l1 P$ Sfunction to do the same job:
3 q1 i6 ^8 n9 c% J6 V
4 L. h# n- s! D8 {5 q, a. F   push    00                        ; OF_READ
" s4 c, @& z' z8 i* Q   mov     eax,[00656634]            ; '\\.\SICE',0
6 U2 i0 ]" a& B! C3 P   push    eax
* m( f* ~7 U6 X8 ^   call    KERNEL32!_lopen) @' |" v, O. E; l6 X. Z* F- y, L
   inc     eax
2 U) K( A) n; w- h   jnz     00650589                  ; detected- @/ n, q! U- [3 v) b% X! M
   push    00                        ; OF_READ
8 J# e' @  W' ~, J( Q% H4 E   mov     eax,[00656638]            ; '\\.\SICE'
; L  b! D: S) M9 d+ E' z3 m   push    eax
: ?, x) k! d- N. p3 _9 a, p   call    KERNEL32!_lopen6 j- \9 D" d8 l" p
   inc     eax
$ Y* v& H$ [. Z   jz      006505ae                  ; not detected
) u. B3 R% F1 C$ E. g: K% T) u) j2 s' H7 T

7 ^  x0 o8 T7 c: b7 A__________________________________________________________________________) _9 k' t& \  N  O& r/ _- S0 j
& W+ O4 X0 r' j8 @
Method 12% j: k3 }/ l; c7 x
=========& |9 D, e7 b0 R  E$ {4 j" e; |* c& k
: m' M" r4 h5 k
This trick is similar to int41h/4fh Debugger installation check (code 050 [7 J. {$ S' L. k
&amp; 06) but very limited because it's only available for Win95/98 (not NT)
7 R4 q% J* A% D$ I/ P/ ~as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
& ?, n3 k/ W- r2 S1 p" A7 z7 O2 P0 _( ?4 f+ H
   push  0000004fh         ; function 4fh
5 Z) D, _6 f( u4 R5 q/ @& k   push  002a002ah         ; high word specifies which VxD (VWIN32)' X5 Q$ s4 t; }  V$ S
                           ; low word specifies which service
$ D5 Q; T- b  I7 C# X( p9 F+ e                             (VWIN32_Int41Dispatch)
9 J, j7 c3 o4 a  @   call  Kernel32!ORD_001  ; VxdCall9 o( F# x8 ~( d1 K& ~& ]
   cmp   ax, 0f386h        ; magic number returned by system debuggers2 Q/ h2 ]! C0 z; P- ^
   jz    SoftICE_detected5 A  K# I$ B- F, I7 n

. F) j- b, C  B. K9 e5 _Here again, several ways to detect it:/ E: f4 K, _* |( l. `3 C* B8 E: x' B
/ E/ Q& T" R( F" e+ r7 X
    BPINT 41 if ax==4f
( N. \2 v2 }$ v( O5 d
& K8 E- z) ]4 m! {7 a+ p; k$ _    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
* @0 U% L% X* ?6 ~/ _2 Y6 B, o1 i2 P: _6 R* S( m
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
1 U3 Q' d( m# G' b& S7 @
$ N1 O, T2 {9 S! I! X    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
, d# t) B7 Y/ j4 f6 P9 ?# M% k0 m2 F" x1 x
__________________________________________________________________________
! w1 {6 R( D: J; w! X, ?
$ [( _7 `0 q5 s; F& ?1 WMethod 13  x$ w6 P" L5 t% D8 _9 k; T! j6 d
=========4 H( `' R; f2 n! }, P
; ], I: i$ u" s
Not a real method of detection, but a good way to know if SoftICE is- g, q0 p1 d- ]$ F7 [
installed on a computer and to locate its installation directory.1 f& b7 [6 T7 j; P+ c4 N
It is used by few softs which access the following registry keys (usually #2) :4 `% w' G; b0 i

# D( l7 J1 ]9 t-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion) Q. V1 G% W( K+ b1 D
\Uninstall\SoftICE
  \( c) j2 W3 N  h9 g$ v- z6 C-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
, ~( e/ o+ a3 W-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion$ ^2 m( f1 Y7 e$ }0 P/ f  T3 B
\App Paths\Loader32.Exe
, K) Z, H; f" E4 s, f
: L' k) i1 i$ @. i- S. m6 ^. a. b3 p
( r; {9 u- k; CNote that some nasty apps could then erase all files from SoftICE directory
/ W  ?; M. N' `  V% O9 }8 g(I faced that once :-(
1 N! E5 s6 d0 i: m. T+ F7 M9 Q0 Z! }3 @0 u
Useful breakpoint to detect it:; T* \2 E6 H1 p; @

4 H* w& Q: k: ^/ W& G! d/ b2 U( J     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
! c7 p& p2 c  g" }% E7 z% b) C0 f* r$ w5 V  n
__________________________________________________________________________( R/ u* R* S: p, l- F5 @

4 ]" H8 x% K- a) X3 t4 U- `% }% h7 p% K& G/ e6 k
Method 14
8 O) G" E" r+ [" t: p5 F=========
9 ]) t+ g. ]8 d4 h$ s) w; Q$ v# i- z3 E! s- [( G: ^, J
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
. F- N7 s- [" K: t' Kis to determines whether a debugger is running on your system (ring0 only).
. h* w! m1 ^5 |% T; C9 o+ {5 A. S; n! u8 c2 W
   VMMCall Test_Debug_Installed
; x* `2 q& T, m5 T   je      not_installed+ _. k6 G+ T7 ]

1 v2 `& u, \: V# q3 `# _This service just checks a flag.' P% d% p8 B/ T' Q( _" ~
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部