About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>& ^* d& E) Q- n" ]" ~
<TBODY>
; ^1 v# Y' @% O# d( f; p/ M$ k<TR>
; K+ j! [+ _' H: P# E; T/ c. K<TD><PRE>Method 01
" |9 O" [7 q8 N- w8 n=========0 K5 f+ B+ A0 T8 h8 t- c
- @9 A, z7 I4 \. W) q% \
This method of detection of SoftICE (as well as the following one) is$ l  h! K4 f/ y; B: O
used by the majority of packers/encryptors found on Internet.
+ g% Q6 g' K: f6 `3 a4 BIt seeks the signature of BoundsChecker in SoftICE2 r# D! L6 ~# y2 m4 s3 d+ q3 B) Y6 c
4 E2 Z4 n/ m& [6 T0 R, z! V
    mov     ebp, 04243484Bh        ; 'BCHK'
' I5 Z; k) H7 |) ~. \. K0 W4 l+ B    mov     ax, 04h8 A2 V3 i2 P- {- o
    int     3      
- d8 a" a0 G& @3 w    cmp     al,4
& J$ j' n$ _" M    jnz     SoftICE_Detected
* @+ ~; P' ]; X( e( i2 h  i' ^3 X# M& ~4 @
___________________________________________________________________________
8 D$ r' X8 S+ o, E, m; R$ U
. \$ V0 C* ]& gMethod 02& _1 e& `* B8 O6 b( |0 n2 l
=========
* h$ i. q8 `5 d% |7 U- L" k  ~3 y
Still a method very much used (perhaps the most frequent one).  It is used
5 _: E0 v& R% k% I  x6 g: v% u! Rto get SoftICE 'Back Door commands' which gives infos on Breakpoints,$ T, _- Q$ H( O, s
or execute SoftICE commands...) [' C- a- W$ {8 u' z( z3 d
It is also used to crash SoftICE and to force it to execute any commands8 v2 j' ^7 L! L& S3 l# A+ C! \
(HBOOT...) :-((  7 x, r; i3 T4 X# \0 s/ h) }
4 B3 J% M/ T2 Z5 k
Here is a quick description:0 B2 `/ B# q- v, e# Q+ G! s
-AX = 0910h   (Display string in SIce windows)4 b3 D7 d3 L# T( ]- R
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)' y/ [, _9 ^8 U6 e1 g" |9 j
-AX = 0912h   (Get breakpoint infos)
2 z- H% A4 h4 r' o  A$ W# g-AX = 0913h   (Set Sice breakpoints)5 N, P: [' |  h+ a" {: y! R
-AX = 0914h   (Remove SIce breakoints)
4 T( J% P2 u) e# @- V& r2 q( ~
$ |4 Q, `$ i" WEach time you'll meet this trick, you'll see:5 {7 D, ], [6 n1 J& A
-SI = 4647h$ o  k+ c; z0 `9 ?5 r! J$ Q
-DI = 4A4Dh% R* A4 O2 x5 c* A* B# S/ Z
Which are the 'magic values' used by SoftIce.
3 t+ b( F$ s# p2 }$ _1 zFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
8 N6 I' F! o* f: c0 q! H# r
7 \/ ?, p4 W7 QHere is one example from the file "Haspinst.exe" which is the dongle HASP
1 C7 g6 T4 }2 ?$ l; @Envelope utility use to protect DOS applications:
* v" U1 B! O! y7 s4 D0 v! H! }' o+ e
/ ?* I& g9 Y) S1 f/ g3 b2 ^) ?' `# A
$ q" q! |* F. D1 i- _4C19:0095   MOV    AX,0911  ; execute command.
' Y9 g, b  m( x4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).7 W/ w# F- ?& \( F
4C19:009A   MOV    SI,4647  ; 1st magic value.
- O" w7 B5 H' u7 _4C19:009D   MOV    DI,4A4D  ; 2nd magic value.7 O2 D+ D6 c9 f+ z* H1 J
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)& K4 j- D4 V/ J0 q( z4 S
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
1 h& d9 P! z# u9 E. S' G6 m4C19:00A4   INC    CX, |8 X( b2 z+ L
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
% B. j) A( X/ L" S% h' N0 E4C19:00A8   JB     0095     ; 6 different commands.
2 H- b: \" ]; ]4C19:00AA   JMP    0002     ; Bad_Guy jmp back.7 U1 W/ b% ~5 L, u4 F! C( c+ F4 G
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)( U- {0 B; p1 Y4 o5 f% S
% C7 W8 Z  ^9 v* t' I- s2 W
The program will execute 6 different SIce commands located at ds:dx, which( o# u9 m8 f( e' J
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
7 n. H$ h% K# B. r0 v# \1 ]- V6 I6 g
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.  G9 M6 O1 G- r8 G( V
___________________________________________________________________________, R6 n2 \8 G  n! X% H

; [. |  q7 W# w/ r: D; v; Q2 d. Y. i! F% V% ?% o7 Z
Method 03
- a) |' v# H; P6 W- }" G=========
; f+ R$ x' U/ U/ ?& {4 e8 Y$ B
: u5 j0 v: I9 h9 h9 j7 QLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h- @7 z9 X$ N- F5 l" X5 q
(API Get entry point)
2 b5 |: I; ?9 S$ k: G; y& e        
0 _1 `1 B0 ~, M: `8 y6 c" {3 k
) Q+ u+ C$ L5 S: `    xor     di,di
! a9 f' m* b. n8 o" D# x    mov     es,di
4 i2 r, Z! M, o: @" J) w- I: E    mov     ax, 1684h      
; b4 x- e0 X/ H( r- v    mov     bx, 0202h       ; VxD ID of winice
. }  q! Y% M) f2 h, t/ G% v7 J& v7 V    int     2Fh
+ E9 Q5 n9 }/ |! H8 S* m    mov     ax, es          ; ES:DI -&gt; VxD API entry point
- g2 ^( [. f0 D    add     ax, di3 P0 J! g! y* g4 e: ~8 ~/ @/ B* d
    test    ax,ax
6 y; A" B3 _4 ~# o' |+ v; M    jnz     SoftICE_Detected* s5 H5 B/ Q  E2 V* c- g* _
. n3 N6 Z% J! `: z, z& n" [, E
___________________________________________________________________________0 p, d" b0 a: F

2 m' h$ z3 F' `8 t4 j/ S5 N5 HMethod 04
3 E: b( n5 t6 I+ @( ]=========8 |- C* D; D$ B$ o8 f( C
2 B+ P6 @3 M/ K" J4 b) ?% L4 a4 r1 r
Method identical to the preceding one except that it seeks the ID of SoftICE
/ u- H0 r0 F( O/ w0 G0 ?1 o. BGFX VxD.
, t" X) o/ {# n: \; @- A6 d  q
8 m' Y2 L% z* E9 u    xor     di,di8 ]1 T% p% F7 `/ C# J
    mov     es,di
' v6 W& J- M8 e  i5 S    mov     ax, 1684h      
# {. ~0 J4 z/ K" e4 v8 @3 g1 P    mov     bx, 7a5Fh       ; VxD ID of SIWVID' X4 s2 ^1 m+ W: s
    int     2fh9 v# `  }9 ?% `* ^' N2 h
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
- A9 y- t% Y0 p/ j/ _% s    add     ax, di
# D" z& P3 K9 y! w    test    ax,ax
0 D' k: c' X# _$ A3 y    jnz     SoftICE_Detected, j3 H1 U3 z: j

5 [( e4 ~7 P* X( v1 U__________________________________________________________________________
: H4 f6 ^" b) J+ S, Y; j
1 p. Z) J3 f/ Q* O* P; v( T6 e. }
Method 057 S  ^7 c! Q' \2 u# C
=========! M& N2 X* W, f, Q
" s( Y' I, A# Z& O# [( M
Method seeking the 'magic number' 0F386h returned (in ax) by all system7 u' {% k6 F# v. g
debugger. It calls the int 41h, function 4Fh.
, D) s4 M- ?1 O) ~There are several alternatives.  
- \* G5 X7 h* G" l/ h
( ?$ G$ w: I5 H% a+ F# g9 |The following one is the simplest:8 H) o, ]0 ]8 ~
6 Z8 _) o# l+ h7 ?( U3 Z1 z* p
    mov     ax,4fh2 ~/ e2 j  L. o. c, n' G$ L2 H
    int     41h
( r" g3 q- V% o8 L5 F    cmp     ax, 0F386
( \' _2 }( Q/ \    jz      SoftICE_detected
: C* {8 F( Y. r# ^) {' I: Z! E* [% |8 N6 `; k6 {; q: ^

5 p2 K; ^) v6 a) G' p! C$ jNext method as well as the following one are 2 examples from Stone's - w6 {. n' f! \! G! b
"stn-wid.zip" (www.cracking.net):  L( P* ]0 u' b% V0 q+ P7 p
  K0 @% q9 M% G6 {: c; L- d
    mov     bx, cs
2 c2 ~; `$ |- I3 ^% ?! x. f    lea     dx, int41handler28 D6 Z# Q  U: L1 O% H8 {
    xchg    dx, es:[41h*4]
$ G" l/ R( Q8 {- G) D! ^    xchg    bx, es:[41h*4+2]3 G, M4 c% C; l5 v) o# n/ ~
    mov     ax,4fh
+ |) x  w7 h1 S4 U, U2 ?, J    int     41h
8 u4 X& `3 F, s2 j- v  O    xchg    dx, es:[41h*4]
  H& D) k7 [* o4 o# A    xchg    bx, es:[41h*4+2]% {4 ~7 t8 N1 t# F. ], ~: K6 B# a
    cmp     ax, 0f386h
- W9 f$ r* B; B. w; K5 v    jz      SoftICE_detected
- R3 r9 H: M8 w, P
7 C# r3 q/ H# N' t+ ^: cint41handler2 PROC, d/ l/ L* f# y, X2 A8 L
    iret7 [# a6 Q. D0 x. L$ s! N! i) I
int41handler2 ENDP
) V1 i4 d. k3 C, i$ E; V& |- q! }) A& o4 S5 b3 j+ `# n# K( u

1 ^+ I' g. D9 B9 o8 s_________________________________________________________________________0 q' b1 \5 {# U0 }6 O

1 M# h, @: {5 \8 B2 V) @$ S5 }
! ^( f0 y3 x& m' {+ t  IMethod 06
# L4 Y1 G% H; E. m, o3 |, E& p: r=========# F% L  Q, T# G: P5 Q/ v0 [
+ \, V4 b: W) d! S' h
, i: Y& c! _& W2 X, g5 r
2nd method similar to the preceding one but more difficult to detect:3 G  q8 J  D3 w. ?

; L' I+ b# _5 `2 R7 }) ^, z9 i, K) d: F
int41handler PROC
, A$ R0 s# G5 N7 k2 d    mov     cl,al
9 X) j: m: T! M* x) u    iret& @) v0 d  v2 s: q3 ^8 |8 V& ^3 I
int41handler ENDP% V9 V3 Z1 k+ W$ a1 W" B

( E" G& f7 ~% c# `0 c* z* L. p
  P1 A; D1 p- {$ f  P/ y5 _; A- h" g    xor     ax,ax
6 |$ w4 q9 P  S% i$ Y    mov     es,ax
. @% e' H8 n: Z+ \+ L5 G3 d  e/ o    mov     bx, cs4 f0 v5 Y. `  h: p9 ]5 t
    lea     dx, int41handler; A7 C/ v: ^" }- P# {+ x
    xchg    dx, es:[41h*4]- o1 q  \- _/ q- a- ~
    xchg    bx, es:[41h*4+2]
/ m; r9 U2 i# _9 `5 D$ c: m    in      al, 40h1 [7 Y5 L) z: n" D" ^5 s; z1 s
    xor     cx,cx1 z. j' @- A  |* u2 P
    int     41h
0 r5 B' V+ N- T* I9 h) `    xchg    dx, es:[41h*4]
4 D4 C3 a, l0 v3 C9 ^4 ^    xchg    bx, es:[41h*4+2]0 Z1 X4 [2 x* P  x& O: g0 a
    cmp     cl,al
4 z& }2 f9 G& y3 z    jnz     SoftICE_detected7 @$ e, O& ]/ `% A- x  j

. L- T- t2 k* j& N% v, A_________________________________________________________________________) k/ F  d, [: [2 c6 v

4 z+ v. t9 G$ SMethod 07  V% ]. D# @; o) M& U; {
=========$ b4 G, O* e/ S- ]' T$ c
) I" l; \4 m# B
Method of detection of the WinICE handler in the int68h (V86)
! O  I3 n9 V" e0 P+ k# D* `; O, U, h) J8 l' v, o& f& K# i+ ~
    mov     ah,43h* n) z; \6 H6 g8 I; }
    int     68h
1 d) l; X+ h  L3 o( R) [+ }/ ~7 X    cmp     ax,0F386h
4 ^2 M% G  ]: u! H    jz      SoftICE_Detected
( y" m& a/ m6 B! p3 S+ g) j$ V. f6 i& h/ t. o/ x4 Y- o* K/ z* ?

0 u0 j) E2 L# b7 l: Z6 w& x# n=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit0 p) [6 j+ H6 x9 b% I9 y# F3 y! G
   app like this:% P+ ]% z& u# o+ F

+ W  J! k0 g8 ^9 S   BPX exec_int if ax==684 |* _9 w8 g2 e1 B2 Y4 |6 [# U& c
   (function called is located at byte ptr [ebp+1Dh] and client eip is1 n# ^/ H1 L+ Q) x) G
   located at [ebp+48h] for 32Bit apps), ^! l& B- N7 A% W6 ^. T
__________________________________________________________________________3 y0 d7 L6 _& [+ j% B" V/ H' E$ Y
# S/ ?, q$ c0 e, i# R0 U
; \6 o. N9 `  D7 H
Method 08
$ b$ j( Q) @8 A+ |=========
- ~' P8 i9 R3 Y0 r9 m" _) Y( k) h5 R3 Q
It is not a method of detection of SoftICE but a possibility to crash the) r6 S$ i/ K: l9 M" f
system by intercepting int 01h and int 03h and redirecting them to another
# H# W4 c+ P: m" a0 ?  c" T. groutine.
8 B& G% L6 |& ?! ]6 u4 r$ uIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
1 h) O& Z2 p8 y% m8 P6 pto the new routine to execute (hangs computer...)7 E8 B  ^9 p1 U5 u

4 p2 Y1 Y, J* w$ E    mov     ah, 25h
7 `5 l/ _& X6 ]; g4 G. r    mov     al, Int_Number (01h or 03h)9 f% `! W9 @# M- f
    mov     dx, offset New_Int_Routine% I6 d8 T5 S' D3 s' A( h
    int     21h0 u6 Y2 o4 }* C3 Z: G

0 R5 T/ c6 J1 ?& a5 B* O$ J__________________________________________________________________________. a" c, D% [+ e7 O( T+ S, z# u8 u# r
# |8 B) x" O, u+ `1 f, v
Method 09
: x% c/ Q: N' l- y- D" u3 S$ N2 c=========1 b. }  X+ l! D, e
$ {' _+ S5 _) H
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only! _7 J8 I, d+ _" S7 t
performed in ring0 (VxD or a ring3 app using the VxdCall).+ r3 @0 v. f% {1 P
The Get_DDB service is used to determine whether or not a VxD is installed; |7 I3 Y$ V8 ~
for the specified device and returns a Device Description Block (in ecx) for
0 i8 E! U/ z4 N7 m+ _that device if it is installed.  }* ^. h2 ?3 {5 A% J: w
! a# E3 J  _! \) t, U6 f+ _; o% m
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
0 D9 G  T5 A4 @# q7 C$ A5 s   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
8 y* e+ J% \2 }* `) r$ y   VMMCall Get_DDB
& K2 I9 ~0 |4 x: O$ y* s  I1 r0 N5 I   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
, G) g6 V; k# ~7 r$ c2 w+ R* U" R3 {+ ]1 m5 \, D: |0 q" E
Note as well that you can easily detect this method with SoftICE:# W6 r$ k9 I& ^/ E( y8 f( L
   bpx Get_DDB if ax==0202 || ax==7a5fh7 q, [  [7 s3 C9 W/ s8 v
* p9 R; @! v6 s# _; ~8 q) H
__________________________________________________________________________
. O0 P4 }& N" J" J) @4 U% J6 p
# W5 h: i6 j6 C  _Method 10
6 T. {7 x- q- {" G; n=========9 _2 b- g3 b% f. {8 J  g
! u1 `: Y. Z2 r6 ^! _; w
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
9 h, s4 ], D3 }) M) N/ q: c# D  SoftICE while the option is enable!!
/ [" \# p; G% `3 z7 q9 H/ O. I" u8 Q- U
This trick is very efficient:
" n% E" c% m) G! ^1 Y7 o7 ^" Gby checking the Debug Registers, you can detect if SoftICE is loaded# r5 q  M" e9 O2 d( Y/ \
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
& j+ |; c! z" t# `! {6 E. @: Kthere are some memory breakpoints set (dr0 to dr3) simply by reading their
* Y8 f" G) M! V1 y4 Uvalue (in ring0 only). Values can be manipulated and or changed as well) K) k, V7 t5 X8 W- s; l
(clearing BPMs for instance)
0 s! M2 r9 ]" J  t
( d/ X, l7 ^! c4 J  @1 R& @__________________________________________________________________________( d  ?" i( B& k% u9 u. J
- h+ q1 V+ ^7 t
Method 11
) x- s7 o9 ?7 R& h" J1 W=========6 h! d1 n: C/ X9 c

% E7 I# l/ F) P7 |# kThis method is most known as 'MeltICE' because it has been freely distributed
5 z& k! l7 [/ n* v4 Pvia www.winfiles.com. However it was first used by NuMega people to allow
; \. U' O( R1 _Symbol Loader to check if SoftICE was active or not (the code is located! X% c! ?6 X5 k* Z, e  G3 d/ H* O, u
inside nmtrans.dll).1 b! y( X$ G7 Q8 M9 y' C
- k) ^* E& \0 S3 Z1 z5 T( R, ]
The way it works is very simple:% s; `# i7 g  [! J, Z# `
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for! Z6 a) \% I  V) Y( P
WinNT) with the CreateFileA API.
6 r% d6 @% h) V  n# c
! o9 _) B( q  |9 i; _" E. UHere is a sample (checking for 'SICE'):) h2 m5 a7 Y  m

1 ?/ q% X( ?* B- G5 jBOOL IsSoftIce95Loaded()
' q. _% Z! _) A2 B" _{# O: a! ]+ H/ s
   HANDLE hFile;  
+ v) Q5 g% f# X4 B1 S: I4 }3 M   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,& ]  J4 S0 `' c; @/ i2 ?
                      FILE_SHARE_READ | FILE_SHARE_WRITE,: j5 _( I6 S! L
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
7 O* E1 b0 y/ g8 w, ^) ~; o   if( hFile != INVALID_HANDLE_VALUE )
( m; _  ~$ e7 l3 p: T" z   {
$ M& C; P% U1 l7 S* E      CloseHandle(hFile);
9 J9 u+ A( @; q$ r      return TRUE;# Q1 N6 I" I6 p) G# U/ Q& m# n
   }
; j+ ]& L; [. H, j1 ^( x% n' e   return FALSE;
  G, b# {; M! v; n5 I}
3 v# P9 l" e$ P6 J6 Z% @0 g  b* s6 X& s1 i0 [
Although this trick calls the CreateFileA function, don't even expect to be% @0 `" I$ ^+ t5 t& F( V
able to intercept it by installing a IFS hook: it will not work, no way!2 z4 M' O3 m9 K/ Z2 `/ R8 I4 C+ i
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
% d1 a$ H# a1 p# n* \service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
6 q5 D  ^- T: W. cand then browse the DDB list until it find the VxD and its DDB_Control_Proc) ~, b- L3 n# K+ k7 `, s
field.
* g4 [, X/ X9 pIn fact, its purpose is not to load/unload VxDs but only to send a
) L. J6 @, @: `+ x, vW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
' E3 |) y& \7 q$ {to the VxD Control_Dispatch proc (how the hell a shareware soft could try
1 o, y8 S5 L- C  w# ]9 b. w/ qto load/unload a non-dynamically loadable driver such as SoftICE ;-).
2 Y7 d& m$ d# F8 ?If the VxD is loaded, it will always clear eax and the Carry flag to allow; i# |) a0 J* Z9 X
its handle to be opened and then, will be detected.8 l2 T- l. f6 H1 v$ }3 T
You can check that simply by hooking Winice.exe control proc entry point8 u1 U, Z5 n+ \4 c& \' O
while running MeltICE.) F9 U7 n* t, j9 [8 d0 W: E0 C) _
* q$ Y' P7 P2 `: b
; g/ B+ m4 {( z3 m) O
  00401067:  push      00402025    ; \\.\SICE
' N# f3 M' T% O! F5 B+ ~  0040106C:  call      CreateFileA
/ h$ Q2 F+ u! X  |( ]  00401071:  cmp       eax,-001
! G2 E' `6 s5 o9 r% u. A6 R  00401074:  je        00401091
; Z5 n, T9 ]: @% w
8 Y; \- c- m6 \+ \& z
$ b2 t( y1 |+ F1 c8 J1 r; pThere could be hundreds of BPX you could use to detect this trick.  `5 Y/ `' B4 G  W' c& k
-The most classical one is:
& B1 ^2 s2 A6 z$ p8 D, n  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
" B0 H4 z3 Y/ h1 N9 z+ E    *(esp-&gt;4+4)=='NTIC'
# I6 g* i" i$ d2 J' v4 o4 P
9 A9 g2 ^% [& ^, g* v6 c-The most exotic ones (could be very slooooow :-(
( Z& Y/ s7 A6 G1 I) a   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
) z5 c$ m% A& a0 |: ?  c     ;will break 3 times :-(0 I" Y! f% ]  t* y$ J- s. C! f. _- V
+ q! H$ `' \; P1 a
-or (a bit) faster: ; t- Z! c) _1 {; ^& Z  L% Z
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')5 C$ m, X. \. R% I9 \6 R5 S5 P

" c0 o( y4 I# j   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
& e) i5 P- s4 |. g3 b0 W     ;will break 3 times :-(7 [. E  }  U8 i4 o( r" w9 D
6 V  j! `, s$ f. n1 M
-Much faster:' K8 @* n0 p" b4 \% H$ n: J9 c
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
0 Q, V, O/ B/ C$ J, p( m0 L% `
1 E/ F! @; w- B% I0 A, RNote also that some programs (like AZPR3.00) use de old 16-bit _lopen( F# @7 O7 H* K$ u. x
function to do the same job:
! V! p* I$ j$ Q  w! F. K7 C: [& D- h9 J. p
   push    00                        ; OF_READ
1 n8 b/ s2 m& e3 v   mov     eax,[00656634]            ; '\\.\SICE',0
  b- A) {9 L' u/ T% E% d( X   push    eax' O. n/ [2 M9 Q, r
   call    KERNEL32!_lopen, m. ~$ C) P. ^: Y; i# p
   inc     eax4 t% G3 C: @# |" G; _6 p0 h
   jnz     00650589                  ; detected3 |5 G& m: E# ]- S+ d
   push    00                        ; OF_READ/ ?' E/ R  b2 S6 `
   mov     eax,[00656638]            ; '\\.\SICE'
3 \: \, g/ K0 [   push    eax
  O8 J1 N/ }1 I! u   call    KERNEL32!_lopen
# b1 W7 Q" S. O: }! |0 _9 E9 ]. j   inc     eax% |# W% h0 w4 J. `2 k
   jz      006505ae                  ; not detected
, ^7 w3 a# t3 n/ j8 N3 V7 N
0 r* X5 B. o5 T, K- L4 J& [# T" x: o$ O$ S# d& A) B
__________________________________________________________________________* ~' w5 ]( W/ i+ r% S  H3 u; T

# V3 |7 y, L/ {1 T" n+ U) XMethod 12
: ]1 ]- X. W) V' N=========& p( r, {. P, S: f

. N6 D# T5 i$ j' UThis trick is similar to int41h/4fh Debugger installation check (code 05
& r% _% G. l4 H+ V( c&amp; 06) but very limited because it's only available for Win95/98 (not NT)
' g5 {2 O" v  q" {& cas it uses the VxDCall backdoor. This detection was found in Bleem Demo.6 I$ V, W7 T1 {. m

6 f! M- I- @/ L1 _4 K   push  0000004fh         ; function 4fh
% s5 _0 Z4 J! }" @   push  002a002ah         ; high word specifies which VxD (VWIN32)
& d# S( t/ y- o# a; @                           ; low word specifies which service. \1 k3 U  t) q9 N$ M# u+ @
                             (VWIN32_Int41Dispatch)  C; M* q; ]" p
   call  Kernel32!ORD_001  ; VxdCall
! o9 b* @& B# l/ Y% W8 f' S* A( F: i   cmp   ax, 0f386h        ; magic number returned by system debuggers
0 g2 Q( k0 a' L% S   jz    SoftICE_detected) r$ I" u8 J. \5 N; s3 y7 t
3 S5 V$ k. k% A5 r
Here again, several ways to detect it:
# ^! y: Z; ]+ D. e3 S( z& j6 b# h2 ~4 w/ m! v6 _! N8 p4 ?
    BPINT 41 if ax==4f3 ~6 }! A( {% C- [( @" C$ p5 P
' j2 [( L, _0 {% l
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
0 `4 E/ M; p' {( a' d' e1 b
8 d# t6 ~2 D5 g, y9 Y* b% ^% f    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A+ O! T% j9 X$ v8 i* j
6 M, n( q) F: |- \4 Q4 u
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
. |+ k) P( ^# T! F# B6 l3 Z! ^& Y% j9 W9 p: S' o
__________________________________________________________________________* v& o9 ]6 {# _

. d  j. o* s0 x2 J( n# l3 _Method 137 z+ J! @1 v; k: G
=========
) J; P0 f& X! ?/ q5 `3 U
* k9 W: r- Z# m1 PNot a real method of detection, but a good way to know if SoftICE is% T: p/ _  ~* R" W4 @* m3 _
installed on a computer and to locate its installation directory.+ J  ^; U& F% Q9 D. ~" Q" r. g
It is used by few softs which access the following registry keys (usually #2) :
3 K( N7 q7 K( m# E7 g1 ]. h! t
# T( u( u( k1 o" c  R: i-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion" X: G- h  m6 \* ~5 W7 B
\Uninstall\SoftICE
& V0 e7 ]  m( M-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE) Z8 ~3 q" b  ^8 W7 \" p* T( H  F
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
; x; R( I7 Y: h& h$ E/ r5 @0 ]- U\App Paths\Loader32.Exe
+ P: D/ x$ ?. I/ g+ @" @# z
0 g: f7 ?6 O4 ~. L# r6 K3 t) ~, X' r$ z( E3 R. e5 C
Note that some nasty apps could then erase all files from SoftICE directory
! O5 M4 p7 `/ }1 w) t6 q" p0 e(I faced that once :-(# e; \" g+ h5 }' C

- A, j( C. T7 F4 L; qUseful breakpoint to detect it:0 U0 Z2 R  |4 R6 P; l
" K- B! s9 n3 T1 L. q( P6 {
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'/ R, F/ d7 p7 q2 H4 P2 u0 S/ s" L- F! q
8 e; u0 y% D' \) Z6 a" q- A
__________________________________________________________________________) W' j8 ~2 d0 q4 J" h: j

& s/ t: r: {5 @" N- z
4 P/ z; z4 ~( ~+ O( k# LMethod 14
2 c8 x6 f4 @1 L7 R. `0 _4 c=========9 q) i% a- j$ F+ Y( m' h7 o

. D% p( i1 Y/ d  o9 iA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose: O9 e% z! Y" ^+ A- H( q/ N
is to determines whether a debugger is running on your system (ring0 only).
( J2 p2 ^6 o. {! o; c( A" z
& r' T  t  ?+ J4 a$ U5 N; f( w   VMMCall Test_Debug_Installed
5 S* F: x) B7 a8 c5 s   je      not_installed  k7 n) X$ R( {+ K" G/ Q

7 b( S8 s: f; R5 O" g3 v0 p$ L* t& zThis service just checks a flag.0 e$ H. N2 ~2 ]- x) J) O
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部