About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
+ C, Z5 J$ W0 Y2 {<TBODY>
! ?' A: E. G1 ]) P; d* Z! J' P<TR>
8 G% W, Q8 P$ \/ E/ F<TD><PRE>Method 01 1 |- z# W. y; \. I
=========
5 W3 n8 i; w9 b5 N$ r- ]* w% {" G' [9 y
This method of detection of SoftICE (as well as the following one) is1 q3 i+ h( C; C8 [8 r8 M+ G8 X
used by the majority of packers/encryptors found on Internet.5 v% h7 f& y* c' E
It seeks the signature of BoundsChecker in SoftICE, i, o4 B) l4 E. g
* J7 R6 a6 v6 p- i
    mov     ebp, 04243484Bh        ; 'BCHK'' X) c4 _2 |9 {, c, k; k
    mov     ax, 04h6 _, d$ J0 Q8 T6 v/ j
    int     3      
; V# o, M" F* f) ^" j- i, ]    cmp     al,4
# K  D* _2 ~. @, I9 U    jnz     SoftICE_Detected+ w, b7 C  s; p
: U* C9 M5 T/ U/ c  I9 k
___________________________________________________________________________/ H+ x/ D0 D/ O3 F9 |/ _

6 y- [3 W) ?, i, P8 \Method 02
) u3 w" K/ m* H, @; w8 T=========
# T' ^5 c) P* q- Z
( b8 \9 m; X* v/ I& XStill a method very much used (perhaps the most frequent one).  It is used
. q* {2 J; V4 o: {, cto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
( ~! B4 K7 k$ E+ \1 ]' X% Mor execute SoftICE commands...% X. ?) h/ d9 N( b
It is also used to crash SoftICE and to force it to execute any commands0 C1 L7 f- q0 x  F) \
(HBOOT...) :-((  7 C8 }, G/ f4 k) G
5 G: [5 g6 a# ]3 F! X. X' I
Here is a quick description:
; \  p. i7 k. B% m/ u4 J. m-AX = 0910h   (Display string in SIce windows)
% K2 j& E5 T9 }-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)% h" T+ o9 V% N/ H  y0 C
-AX = 0912h   (Get breakpoint infos)
  j! \9 X3 J+ H& D6 w- f7 e-AX = 0913h   (Set Sice breakpoints)" `: [# C1 v8 d# k2 k0 b& `5 x! O, }
-AX = 0914h   (Remove SIce breakoints)
$ J8 K' X1 r) c" P& ~. d4 ?/ T9 g0 t' e9 Y8 J/ ~- g
Each time you'll meet this trick, you'll see:
+ N% `& Z9 i3 `9 Q9 Y. T. c9 W-SI = 4647h+ |( |# a& W  ^
-DI = 4A4Dh% G+ ]0 ]; t5 O0 N8 p% z
Which are the 'magic values' used by SoftIce.
) V3 s" j1 P6 j* p+ AFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
' E/ k5 F6 O2 u/ Y3 d
+ o5 C- b' a0 c. x) K9 eHere is one example from the file "Haspinst.exe" which is the dongle HASP
& {2 |' [) {% |Envelope utility use to protect DOS applications:- ^8 W& H+ M8 o8 K

& g2 B, n6 e' c- q1 [; T
. A. w, K% o9 W- |# Z/ c4C19:0095   MOV    AX,0911  ; execute command.  z* K4 a; e0 Y. n6 e
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).# p. `+ ^2 u9 Q% [1 j( k" g
4C19:009A   MOV    SI,4647  ; 1st magic value.
: Z- `; u/ C% E+ g7 ]4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
9 b- R5 x% D, }4 |4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)/ S# o9 B6 i  S7 `( F
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute& \+ V% f, v' o1 y
4C19:00A4   INC    CX
' }$ z$ A5 p$ E& ]) ?6 C4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
( p4 V  x; v' K4C19:00A8   JB     0095     ; 6 different commands.
+ D- Y" V. W7 A: M2 Q4C19:00AA   JMP    0002     ; Bad_Guy jmp back.8 s2 ^# k: e) c
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)# e6 S7 y+ w. p3 C4 |( J5 R
; ?# X! ]; V: p- l
The program will execute 6 different SIce commands located at ds:dx, which- E+ Z4 V+ Y6 Q8 b1 t2 m
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
; H/ @) T+ A! H
! Z. m: d$ x, O! Z  `9 h* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.9 a3 r5 q* i, ?! @% r
___________________________________________________________________________
! q/ \( \* g9 K/ x
+ s4 f4 R9 x+ I* B; t4 e& E$ Y# p
6 R2 J& I4 R0 U/ k! k: NMethod 03
( o$ q" Q) s+ \, |2 A7 H3 r=========0 K  |- @3 J* i8 H2 s4 J, `  P: F

7 q+ M4 g; O4 g1 ?8 a- |, ELess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h$ P# j( x# j% h
(API Get entry point)
. n9 t- _7 u/ _7 e        ( A/ |9 ?3 {9 R7 j' l2 b

; r7 l2 E' L7 A4 `' o) T" W/ O# {! ~    xor     di,di
' M0 x; t' v& P8 |: |% t& l1 g; Z    mov     es,di
3 t/ H. s0 T/ S# A- o5 I    mov     ax, 1684h         K5 D7 n% u/ T" k) T
    mov     bx, 0202h       ; VxD ID of winice* x) B: \! R; @# A( R
    int     2Fh
, G6 [" J& F# x* D: A& P- _& Z    mov     ax, es          ; ES:DI -&gt; VxD API entry point
6 h/ P7 R' g" }/ j; D+ z- I) I9 X    add     ax, di& M8 W1 W4 F2 d: o; l. v
    test    ax,ax. j. q5 ]% v+ P1 z; s
    jnz     SoftICE_Detected
) q2 A/ ]/ r- Y. c) s! h- W4 |8 w  e
___________________________________________________________________________
' h  D2 t# d, \+ x$ C* L8 G4 \) e
( ?  g8 O7 }4 ^% ?2 Q1 v5 C6 Z7 _5 ~Method 041 K# F8 M# r( @! R5 u/ w/ F
=========
: b) J) [3 J$ c5 R, H/ ]0 g: G- m+ ~4 C% e& ?# k4 U7 Q3 n
Method identical to the preceding one except that it seeks the ID of SoftICE
! A7 ~+ {7 c: X4 U6 q% f: x$ J2 nGFX VxD.& }) g& v- A/ A/ b2 Z

9 c( ]  {  S6 J3 ~' u7 T0 G% ]& A" z    xor     di,di- H( o: G6 f- B
    mov     es,di5 n/ u. g2 b$ x$ s$ f  Z
    mov     ax, 1684h      
  u; G3 N1 ~( ~/ E7 p8 P' n' c" P    mov     bx, 7a5Fh       ; VxD ID of SIWVID: j* n; F: s& n' `/ A7 r
    int     2fh
& o  s% ~" f2 f+ N- r8 g8 _    mov     ax, es          ; ES:DI -&gt; VxD API entry point
) |. D0 `2 R  M3 a* ?    add     ax, di
0 p0 D7 {9 u' E% \6 N. x; ~. ^    test    ax,ax/ Q, X: Q$ _" {' C; Q
    jnz     SoftICE_Detected
; V& n5 k5 N$ [4 T# n8 v& k! l( i
__________________________________________________________________________
! }% S: d/ b9 Z' c5 C/ V0 t  Y" I5 G: r" d% ]; d

* f/ G4 E2 f7 s" ^3 a  _+ Q! @: gMethod 05" V( L# I" N0 p' y6 N
=========
) R3 u3 q: g7 t+ O  K+ G
$ L( o1 k. K0 P! ^. ^' T- MMethod seeking the 'magic number' 0F386h returned (in ax) by all system
- o: U/ ?5 k7 w3 \% ^7 V& |* Y( `debugger. It calls the int 41h, function 4Fh.
7 ?2 P& m% Z' w$ [% fThere are several alternatives.  
" e+ S+ p" _3 O4 F+ _
' z) y$ _7 Q6 F0 U* c1 OThe following one is the simplest:
" q3 D, k( S2 s% b% R
  r. U& f. ~$ C( J2 K    mov     ax,4fh
( ?% H/ c; `$ U6 D8 L    int     41h- z: G% r' u" R2 L  G  _+ r
    cmp     ax, 0F386
, V: u, Y6 T* ~+ @    jz      SoftICE_detected
6 [2 S% u1 a+ o6 ?) p; O
% _$ A  c& ?* T% G. j8 e
  K1 j) f8 {0 V/ C7 w# nNext method as well as the following one are 2 examples from Stone's
6 g+ f9 o6 e; H' k2 b9 V* ^6 o"stn-wid.zip" (www.cracking.net):
1 f( ]6 p1 P7 @* B& \: w7 t# U* o1 T' \0 B
    mov     bx, cs
1 |2 m1 I( ~' J0 S# u: A    lea     dx, int41handler2$ m* `$ y7 Q( \) l6 U: s
    xchg    dx, es:[41h*4]
/ L! t# f% e& _2 O% F    xchg    bx, es:[41h*4+2]6 ?4 v2 Z* c6 }# U; B# n" B
    mov     ax,4fh
* ]. ]9 {7 T* A( Z% }8 H1 ]    int     41h
& t) ?1 v/ @  \, r3 }8 `4 F    xchg    dx, es:[41h*4]4 j! m9 C: c- R1 K' V* K! ]- ^
    xchg    bx, es:[41h*4+2]# ~0 e( _! N" T1 S" m$ Z* P: k# a
    cmp     ax, 0f386h( o. F- `% [& u3 _! `# h( M1 q* c
    jz      SoftICE_detected
& P+ l3 x9 }% N! d# K) w7 j5 Y! A' c9 Y
! B% U/ N9 O( G* O3 U  |3 Z3 |( Dint41handler2 PROC, Y# m& D) k& _# }- H
    iret+ M& f2 a- Z4 v# U) `& Q
int41handler2 ENDP
  t; ]- x8 H+ q/ z: I
# R" Z  x" d2 Q4 v! H* Y! F' _# z9 i' |3 C
_________________________________________________________________________, V0 q  _" A7 z) j/ ~2 _

* F% O6 e- R3 `: t4 {) m8 C5 r) l8 L- F
. _  {% ?1 r/ n& j! V  U  yMethod 06! N( g6 `! U3 E4 Q( y1 O& A( r1 Y
=========1 ~: J. o  S7 o- T, [* `! Y+ g' S
7 U  j' y( F( R. i/ ^

: F  A0 P; V: l2 t4 }2nd method similar to the preceding one but more difficult to detect:
" k9 N! P" {( W* D7 a4 P8 a" _& z* f1 f7 `* _6 ?5 G
" r, W8 M8 K; Q& i- b8 x$ N7 l
int41handler PROC
( ]4 ?6 M# u, h9 w# S' a- {    mov     cl,al
7 \  |8 R" H% N6 P    iret
" A5 E  M1 O/ i' T# u8 Y8 fint41handler ENDP
6 m+ A/ d1 z) T+ n! Z6 U& u# p5 m# l& k
; H0 B8 Q6 N, I% n- q+ ?8 N' h$ v' v1 R  d6 a' \7 e6 x
    xor     ax,ax; g. L( f/ K, ?1 R% S5 l4 t$ B
    mov     es,ax
1 c1 k( G8 W1 s/ F    mov     bx, cs- A, S( i! \; [6 Z$ S
    lea     dx, int41handler
1 Y! m5 F9 G( Q# v& E; V    xchg    dx, es:[41h*4]
7 [; i( |" Q  T    xchg    bx, es:[41h*4+2]- N: `1 l; v1 g" u
    in      al, 40h
' i, \$ |" g* U6 H" K% Q3 q( ~    xor     cx,cx
! w3 @; T' x% f6 M    int     41h
, K5 D. l' Y+ s6 t    xchg    dx, es:[41h*4]
. n7 ~7 d9 ^' S# O! h5 G    xchg    bx, es:[41h*4+2]
. k2 d" w  c# w% k% g# x    cmp     cl,al
3 ~( q( d0 }$ q    jnz     SoftICE_detected
' i/ p4 ~3 \; `! p, _: f  o+ G" g6 }0 ?
_________________________________________________________________________
! s2 v- A3 E! y0 F9 n' n! S! ^
2 G! @% y8 \/ Q. [1 S+ k& C) [) t- zMethod 07, U& w) F5 `8 V( O2 D  B! }' U, w
=========, \+ {& ^' z. D  w! ^5 L: h

2 w# k8 _% x4 M" E1 A1 i& qMethod of detection of the WinICE handler in the int68h (V86)' }1 ^9 x& @( L4 l1 m

" X- X6 J- i% d    mov     ah,43h
/ V: N- \5 i; Z- C& r9 o3 k    int     68h
# ^9 H5 e0 |( ]! n2 @) U    cmp     ax,0F386h
9 U- W6 G4 ], {    jz      SoftICE_Detected
  O' g. v8 C+ [( \! h" E& w, X$ Z# I
  G* {  O) L  @! ?& L" N) L- R+ d! V8 O4 y# n+ W6 r
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
/ x" C# Q8 I  d4 z$ X0 @9 N   app like this:
( ~: }0 a( H; s9 u5 {$ C
3 C- i4 i* n% |   BPX exec_int if ax==68
0 O: |, r$ I8 o& W7 o. `   (function called is located at byte ptr [ebp+1Dh] and client eip is  h# n, Q0 i, `; O) O7 g4 D) G
   located at [ebp+48h] for 32Bit apps)/ U8 U8 O% d7 |' l$ b& N
__________________________________________________________________________; q& s- l: q$ f6 T# X& x0 G

* T( g! {% ?% G5 D9 D5 Z- b* t# @
4 Z1 l6 F4 H" t# Z* w: |Method 08# m1 k+ c4 y0 B/ e$ a8 N5 B" S
=========
% ^* f# t% I: u1 @2 Z" V+ G6 Q
3 ]3 Q6 D  G' o+ L8 j5 {8 D/ A4 oIt is not a method of detection of SoftICE but a possibility to crash the8 o0 K( {7 o: A3 e' N2 T
system by intercepting int 01h and int 03h and redirecting them to another
0 i% d3 J, d) q' M- |7 I% Z/ Wroutine.
9 S, r7 r+ s: s) I# }  ^It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
7 b7 [3 G5 i9 O6 F) _% N9 pto the new routine to execute (hangs computer...): P5 t+ B% y% X" x
4 ]* i( N9 n7 w# K( s! b8 F
    mov     ah, 25h
5 o* D* c. @) K# P% M! v. D& p    mov     al, Int_Number (01h or 03h)
7 [% v3 C2 n* s. _    mov     dx, offset New_Int_Routine
. n; N$ v, |0 X$ F- R$ l& [: F    int     21h+ n* ~7 w9 C( t! t( E" A" U
) Z1 A3 t" h5 u3 X$ U: O) h5 m8 `( y! C
__________________________________________________________________________
0 e1 P& x* p9 `1 E" |+ E6 w3 T+ y0 Y* k
Method 090 N9 P7 a2 }( j/ J2 `1 A# p) ]( g
=========
% v* d: n, n& @
0 s* b0 @$ v* ^) j0 v) b4 T# }8 UThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only1 P# Y# X# J5 O2 @7 z
performed in ring0 (VxD or a ring3 app using the VxdCall).1 L6 V7 Z. W% z- ~* Z' T- S, m  V
The Get_DDB service is used to determine whether or not a VxD is installed
  u$ m0 D/ o  z' H$ Mfor the specified device and returns a Device Description Block (in ecx) for
* a6 V; Z/ v; n$ r6 u/ ^  {that device if it is installed.  Q. V2 \# Z5 [

9 g" e# _1 M, V, \3 u   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID3 H6 ^# Y. G7 ~2 `7 p" p* ^8 T$ I6 s
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)- X/ ]* z: _7 _' T- z
   VMMCall Get_DDB7 v& |# Y( X7 P3 p9 N7 B; }
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed, K8 Q. j4 m, f& l9 s, q2 D. f

& I# Q' r8 ~% A& u8 p" jNote as well that you can easily detect this method with SoftICE:' P: h1 _7 F- Z( m8 e4 P
   bpx Get_DDB if ax==0202 || ax==7a5fh
/ s  _: ?' G, l$ o) V" x$ C% w; n5 z0 ^5 I! ~  O* ?+ j
__________________________________________________________________________
" P1 F- F7 t5 x4 `4 `! |, n8 G" e* X! ^* T
Method 103 x- v: S; k/ d2 f, C! `
=========
4 X8 g0 V! p# x
. G( H2 z2 J6 O0 z# e=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
( Q! \6 q" K- M9 l0 i5 T. m  SoftICE while the option is enable!!
" }1 Z* w' r2 u1 c( R, @" s$ d+ S8 i7 q7 `
This trick is very efficient:( u+ f$ c* ^/ `! [, S8 v
by checking the Debug Registers, you can detect if SoftICE is loaded9 m# C8 G4 m  h* @
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if5 t) M/ ?9 L- Z& e, g* o
there are some memory breakpoints set (dr0 to dr3) simply by reading their! F3 a5 J2 c& \. y: M" G- L
value (in ring0 only). Values can be manipulated and or changed as well
" t& X: R* g+ I  }(clearing BPMs for instance)
- N+ T( K# a) m* n, r! G1 E: M: e. F3 u9 Y- Z* Z9 t# p9 c
__________________________________________________________________________6 A  G  ^- ]( w/ V- u

1 L& j+ ~! |: k6 p! [7 ?Method 11" F1 `7 e. b0 B6 R" w! r( ?
=========$ [% t0 @: a0 X" W( ]: a

% s4 l6 z) m$ e! ?$ @* T3 `; LThis method is most known as 'MeltICE' because it has been freely distributed( Q. l! ~" L& c. k8 C
via www.winfiles.com. However it was first used by NuMega people to allow5 N& }* i" p0 f- v( X9 r8 a2 F4 I% f+ n
Symbol Loader to check if SoftICE was active or not (the code is located9 x5 L1 @, J- [
inside nmtrans.dll).& o+ k, G4 s* N+ X
7 f( E  l7 ~+ O) ^
The way it works is very simple:
; j- m$ e+ z- z: c. d# h# E4 gIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
8 k% O7 {9 f) C+ |WinNT) with the CreateFileA API.
2 \  k1 {3 w: G9 @' p  i5 q5 C' V
$ _9 }% N0 g5 R6 K& z7 iHere is a sample (checking for 'SICE'):
3 {; o& ]2 c( t4 h- e4 n; Z/ @( N$ K; V+ P8 C5 {5 |; w
BOOL IsSoftIce95Loaded()
1 }3 S$ _; y4 @: Q{( u; W. I6 x, d; [/ O; P+ N" q
   HANDLE hFile;  ! w! i  \/ F7 J! R0 k
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,; R' B+ r* R2 Q
                      FILE_SHARE_READ | FILE_SHARE_WRITE,7 g% o. C6 h, F) `+ t3 B
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
8 k8 L" `" t, I+ N0 l; L   if( hFile != INVALID_HANDLE_VALUE )
* [/ ^3 q* [7 {/ f5 D   {
# E: a! o+ t1 i6 V0 T8 b, K      CloseHandle(hFile);
2 ^6 `% i- q- E" b: C      return TRUE;; A6 i; Q5 ~& z3 B' V2 Y# F! f
   }$ X2 @- ~8 V+ \6 D& S/ I
   return FALSE;5 t9 v& t2 E1 @5 B8 y+ t
}5 n3 o6 ~6 h# M. W# f

: \* E( Z. i% |/ X: LAlthough this trick calls the CreateFileA function, don't even expect to be5 y5 x/ s8 v0 x  F5 Z; i
able to intercept it by installing a IFS hook: it will not work, no way!
/ Y; D+ u& k/ e$ JIn fact, after the call to CreateFileA it will get through VWIN32 0x001F/ Z* ^) o* r. d& V& s7 R
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
( g" ^0 s- N/ [/ n& D4 Y5 ~and then browse the DDB list until it find the VxD and its DDB_Control_Proc" `# m( X# g" N; B$ S
field.
1 @* R9 \: z. d; G1 v$ N6 d6 mIn fact, its purpose is not to load/unload VxDs but only to send a
- v' G& `. v; i9 u' h: A; G3 CW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)6 X: @3 E5 ^7 B4 b& ?
to the VxD Control_Dispatch proc (how the hell a shareware soft could try0 Z7 V; B. n2 _: K3 |9 i- a# L
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
! r* z' k0 O7 kIf the VxD is loaded, it will always clear eax and the Carry flag to allow
$ I- Q/ X/ i" `; X1 G  W! Jits handle to be opened and then, will be detected." y4 e" x$ i% L! v; }" l
You can check that simply by hooking Winice.exe control proc entry point
9 x$ N; ^9 f7 i) {+ vwhile running MeltICE.
. f# A6 J5 S! _; o9 E0 x: U
" \. j7 d  @1 k* e$ h! M; I. c) G. v
- z1 h# |+ B. D) ~( h* e- [5 P7 g  00401067:  push      00402025    ; \\.\SICE& d1 j, M% E. @1 U
  0040106C:  call      CreateFileA( _& o+ C0 S3 R# Q/ Q4 F: U2 V
  00401071:  cmp       eax,-001, V) C0 B8 k- p! `$ q) a
  00401074:  je        004010919 }& \( T2 `9 [" o# X; t  b

& G+ `" k* |5 c, u, C) q# t3 ?8 F& S6 D2 g
There could be hundreds of BPX you could use to detect this trick.
" ^' p8 ]/ [: [-The most classical one is:) h% B# G8 g3 p8 N+ {
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||9 A3 j2 B9 l6 q; h" F  D. m
    *(esp-&gt;4+4)=='NTIC'
' @: g7 O$ {/ z/ X3 U4 R+ R# z' p+ R3 H4 t0 `( h) j
-The most exotic ones (could be very slooooow :-(
3 c- A& k7 R( j' ^9 u   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  3 |! s9 \2 a! @" G: K- R  L* Y
     ;will break 3 times :-(% ]7 Q- s6 ~8 M. a* e

6 O% e# M, L) W2 B4 _, M-or (a bit) faster: / g9 P" E/ [, R& w% ^
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')2 r# o7 c) e5 {+ s/ [* b

% s, r+ i+ E+ l7 A0 |/ D  e& `   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  & Z6 _# ^* T7 p; X; N
     ;will break 3 times :-(
" e6 J/ z9 H2 J; x3 B; |
* L6 I7 ^1 X0 g+ i- F" ^5 C-Much faster:
8 o9 i  \( l+ @6 w: a2 A1 t$ I   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
! U) w3 {! y8 B0 g, u$ \1 t" p- b' L9 X
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
' c( Z- U( G: I# n! |9 ]& ?function to do the same job:
  P* @/ c% Y9 g2 f; {3 `# Z
0 f/ y3 Q% t  b# g3 }0 I6 I) H8 `# a* @0 S   push    00                        ; OF_READ' I' E$ {% t# z. b0 ~
   mov     eax,[00656634]            ; '\\.\SICE',0
* D, X1 p! z/ a$ T( Y6 W   push    eax
; B2 C2 x8 A( l: }# x1 b/ V$ U' G% Y   call    KERNEL32!_lopen& g  Q, i1 D: w  n& L
   inc     eax% Z' M9 I8 L$ {
   jnz     00650589                  ; detected
) d$ B2 Z1 Y; X  k4 f. H4 G5 ^   push    00                        ; OF_READ
3 `; C9 d5 G# n9 L. L   mov     eax,[00656638]            ; '\\.\SICE'
3 q) v7 @; V, @# A( C! |$ e   push    eax; j' H& \% ?9 j7 F' w% p/ N
   call    KERNEL32!_lopen
2 s3 a/ {- C. p& a   inc     eax
' N' W, c+ b! Y! v' A% N7 h, B7 P   jz      006505ae                  ; not detected( ~9 S0 ]. S; E

# @0 k1 g3 @5 M# ^8 v; S6 w+ T5 k7 M1 c
__________________________________________________________________________7 z# z& V/ N, k& _
* \- m8 J. X+ D9 g
Method 12
! n2 C& F7 L6 {$ I  k8 h=========
- R. m1 P3 G6 D3 Z/ W
2 ?! _2 h1 {" `* ?/ p* jThis trick is similar to int41h/4fh Debugger installation check (code 05  n, ~8 k7 K1 s
&amp; 06) but very limited because it's only available for Win95/98 (not NT)/ ~1 e! w9 K5 T7 d
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.; c  a. H# T  S

, c& Q5 y6 e' Q# F) w   push  0000004fh         ; function 4fh
& n/ C" U8 v/ g# p7 t3 r   push  002a002ah         ; high word specifies which VxD (VWIN32)
4 \# }# j; e# H& V& n5 ~                           ; low word specifies which service' p9 u! j  `6 i3 N$ v0 l
                             (VWIN32_Int41Dispatch); l5 q: u6 e/ \# t% T
   call  Kernel32!ORD_001  ; VxdCall
" n1 n* P0 C! l   cmp   ax, 0f386h        ; magic number returned by system debuggers
( b* g' N, g# x+ h- i   jz    SoftICE_detected
! [- J7 @8 F/ D" t$ ]/ \2 x. C& U
% v- R; ]/ {8 p* Y/ i2 x! mHere again, several ways to detect it:5 ^" S1 a" _* [5 a# K

+ u; @5 g4 Z8 U, N    BPINT 41 if ax==4f/ `: {1 o; u) x/ \

5 q2 @0 J' v$ K% D% k$ r: R    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
  m, j/ Q9 _0 x  |2 j8 h2 N9 ^
# m) m, r+ e( Z) l, g0 n# u    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
5 O; D8 F" U9 L! s! H! i) a( X; {, f  }2 `
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
2 ^6 B# x# {; \( ], Y6 x2 D: v. n* X, r0 X  I6 \/ ^! u
__________________________________________________________________________
) h, `3 B; r/ g; Z/ N. W$ D8 P! K& @" H; l' r2 Z
Method 13
1 k+ l: Q* k3 v. i. Y+ x; p# W=========. ~+ ~  }. u. M/ I" m3 H# l
$ n8 |. o" {% S/ \
Not a real method of detection, but a good way to know if SoftICE is
4 r% q# u& U. ~1 d( ~installed on a computer and to locate its installation directory.4 b: U. O4 c/ L: L* g3 L1 N
It is used by few softs which access the following registry keys (usually #2) :9 B2 }% n$ R/ ]" l- Z

( e5 \) g5 F: s% ?3 I. D5 M-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion& s0 l  O5 Y# E  o8 i' _
\Uninstall\SoftICE
: v; J% q2 Z% w& ]# \7 ~' ]' a4 k-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
" |0 h, s2 d7 O) e1 g# \8 j-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
; o" k6 d( E, M: r' D\App Paths\Loader32.Exe: F: o5 n6 U# J% Z* [* D" F
5 X* e3 [! C2 N4 ~7 u# H* K

3 K. n4 c% E- c4 jNote that some nasty apps could then erase all files from SoftICE directory* u% ]+ k4 Y% H4 t
(I faced that once :-(" f4 D/ ~6 N' i& |! r
  ^+ E" H7 H# h' ?! s8 [- U* b
Useful breakpoint to detect it:
$ \4 s. v, O9 |( a5 n+ Y6 y! W) f+ B6 f2 m
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE', S8 }! }$ L3 q  u* x$ O6 V4 z
) r7 p4 O' Y/ ~. L
__________________________________________________________________________' P0 [3 g6 P5 |- n
( Y6 ?  S( v9 w" \3 c

6 y' |7 K# ?6 gMethod 14 3 [# W* V% W$ A# H
=========
  |$ U3 n  `! Z* j4 C+ P: J
9 k' k) W( O: Y1 G8 q9 L2 r7 ~" d' OA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
' M4 j7 g; n0 T/ V# T" Iis to determines whether a debugger is running on your system (ring0 only).$ ?0 J0 a+ o. p" P% q

: v' ?& `% N8 H# O/ K3 u$ I4 \; |% Q   VMMCall Test_Debug_Installed
* U0 Q% }. L0 m6 P# d   je      not_installed& ^) J1 d9 k4 Z0 v
3 `: ~; ]9 V; f3 x8 [- x' J
This service just checks a flag.! ^. m" ^& y" G$ W0 ]
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部