找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>) h& b* ]; P4 F/ b) n- F
<TBODY>6 L( r( j. o9 h$ {' t% t6 }
<TR>7 G5 w4 M8 k# U/ ~. |- @( l
<TD><PRE>Method 01
2 h  Q* c. W! E% m! I=========
1 l& S0 f9 H9 M, y8 _6 S7 _
/ C" Q' `8 p* [. G9 P4 zThis method of detection of SoftICE (as well as the following one) is2 R, h! y( J$ \8 X* T, F, T
used by the majority of packers/encryptors found on Internet.
8 _( k$ C) t: X: U$ JIt seeks the signature of BoundsChecker in SoftICE
8 z& V5 W. D1 ?6 x0 B2 R5 V$ u7 T
    mov     ebp, 04243484Bh        ; 'BCHK'; c' C5 n9 b" u! l6 v
    mov     ax, 04h
8 E5 x; x+ K; {5 K# [# J4 R    int     3      
  }, }8 r& R4 o1 ^$ ?0 I" }: u- n    cmp     al,4
! b4 k  T% f* x- i    jnz     SoftICE_Detected
, |. F" G8 t6 s8 b* ^2 i6 D/ q3 W4 L4 M, w
___________________________________________________________________________
5 f; ?  r+ r6 c9 H* G+ C+ ~
9 }: i, p% i6 FMethod 02
7 E- a6 e, E) n2 s8 W+ B=========- y8 o+ f+ I+ B2 C6 W
- h" `5 K; a7 U( Z/ P) e5 z
Still a method very much used (perhaps the most frequent one).  It is used" [! @& \* H. r6 N
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
% K/ E1 ~4 D" Y7 c' B8 S; i% Lor execute SoftICE commands...; \! S8 v, `. Q' U2 E& c  ^
It is also used to crash SoftICE and to force it to execute any commands
7 U9 z$ Q/ H  w& w: r; D(HBOOT...) :-((  , i- O' H, ?/ ]; w+ H& W! t

3 G  |& B& L4 d: S( vHere is a quick description:* r+ {- Y2 G  f: p1 q
-AX = 0910h   (Display string in SIce windows)2 [1 f% O& J! d/ a6 b# I" E
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)1 K  t( r( {( N" t
-AX = 0912h   (Get breakpoint infos)
  t; ~- x, A  @8 w3 V: `1 D-AX = 0913h   (Set Sice breakpoints)
/ d9 w  L# T; j-AX = 0914h   (Remove SIce breakoints)
7 h- y& e  p" L8 s# O. g+ Q6 W1 o
/ w% a$ g, u- Z3 @4 lEach time you'll meet this trick, you'll see:. b9 V% I8 S7 C, }# w) c, o, z3 Y4 d
-SI = 4647h
% D" ]  M/ d$ e0 Z-DI = 4A4Dh/ o' T; c5 C# r2 K9 E& G
Which are the 'magic values' used by SoftIce.& i8 `" f) h7 g* l
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
! t  R& s" `( U$ d2 o( ]3 d) K, V+ H/ V2 Q
Here is one example from the file "Haspinst.exe" which is the dongle HASP8 e8 q9 G% E$ R% @1 x
Envelope utility use to protect DOS applications:
) T8 L4 c2 X0 B! [& T6 [, Z
9 {* A9 Q; j6 z$ k/ l% _, n/ ^! L$ l. \5 u& q6 L3 `+ H
4C19:0095   MOV    AX,0911  ; execute command.4 A' [- _1 J: x. i" `2 c
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below)." f* l, B. S8 G( {+ V
4C19:009A   MOV    SI,4647  ; 1st magic value.$ W2 w# x- Z) N
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.* t$ F- p$ _  Q# |) @7 {
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)( U# b  S, m# M* z5 m' }6 m
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute8 O+ l* @+ D5 t$ [6 ^
4C19:00A4   INC    CX
+ @- o4 }+ M, U) |; P* R# L4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
4 |' s) W" L" c4C19:00A8   JB     0095     ; 6 different commands.; z9 d% k* l+ Q: U
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
% x1 I) J( w8 M3 p4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
( a; e) D0 [' s$ a& L' [5 G6 j1 r4 h3 d6 C
The program will execute 6 different SIce commands located at ds:dx, which. l0 @' D/ _/ x7 z: F
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
/ P+ \/ s3 u4 e( p  z4 E" g0 w7 ~5 h# O" g: w! \, O$ I4 V0 }
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
( q) Z/ F( Z& ^) Z4 @# f___________________________________________________________________________3 x( V4 v; R! Q! f& h0 ~

# u/ z. }, D6 L2 @: @8 W8 x$ `/ t) ^7 X% ?1 \. C6 g
Method 03
( ^9 I) a% G) G2 [# A=========
: r1 q' @/ t9 j: J+ d7 |. q1 @/ ~5 _: l+ T5 T  W
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h% {2 Z, \: Y, q$ o
(API Get entry point)
; U! K3 o: d1 Q/ e7 I5 g- D% M        
0 p/ S4 H$ X+ s' L1 F, P
3 O6 a" L9 L4 ]* r; A* d    xor     di,di1 K! [4 K3 b1 }! [9 i9 W
    mov     es,di9 r" b2 N5 ]# L7 w
    mov     ax, 1684h      
; K% F) V& w+ O! }' `    mov     bx, 0202h       ; VxD ID of winice0 V; a7 _! l$ r7 ?8 s) j. i2 ?
    int     2Fh
( P  ]) h- g5 ~/ f7 {) j    mov     ax, es          ; ES:DI -&gt; VxD API entry point! C7 _* I: }4 U* p4 M4 u2 w0 a
    add     ax, di# I/ @3 E: g/ w
    test    ax,ax
- S* F2 l* ^2 |6 @; W    jnz     SoftICE_Detected! I( ^5 O% {8 M- Y0 J0 s  i% `

$ }0 D" b) N0 c" m1 c___________________________________________________________________________
% d0 `  x0 e! e3 \
0 @. k/ c; j7 C7 @2 T( yMethod 04$ ]' P+ m4 V# `. ]6 j3 |
=========  w9 e" S! l4 j. r% F0 [( c
* E' A& t8 H- @9 s9 p2 u
Method identical to the preceding one except that it seeks the ID of SoftICE3 d8 V" i4 Y% u5 M: X; B
GFX VxD.2 [* O, }! X! I1 j0 ?% @

' p/ `4 @5 k: U- P  a    xor     di,di  n. x3 q; v, i( ~- U
    mov     es,di
+ j0 F+ J" u$ ~7 M% J    mov     ax, 1684h       - A8 S) _3 C% p2 h
    mov     bx, 7a5Fh       ; VxD ID of SIWVID; ~( L2 |9 E" M2 U: Y. b: x: D7 [
    int     2fh$ i$ U$ l, F& v& S
    mov     ax, es          ; ES:DI -&gt; VxD API entry point7 R8 s. e: Y" R6 r0 G+ n
    add     ax, di
+ z7 b3 w5 d: w+ \# ?8 M    test    ax,ax
3 J5 |6 q' U2 N+ b) ~$ o+ ]$ [: {    jnz     SoftICE_Detected
0 d- L! `( \2 m4 A+ [  M' r
6 y* q. Y! q; a( D0 r5 m- X- b! L__________________________________________________________________________
7 Y$ M' _; l  w% T- D1 a3 h
& c0 j2 A# U' {0 r
. r4 h" T( h  Z, j8 ^' gMethod 055 W8 M" N6 @& y( z8 Y& \2 \+ U
=========& b; M% D8 z( D6 C+ B& G6 a
. g1 H* G* ~/ K7 {( _, m
Method seeking the 'magic number' 0F386h returned (in ax) by all system
* ?7 u; b4 d1 D: J# fdebugger. It calls the int 41h, function 4Fh.
4 o# r3 {- l$ ?& N# ]  eThere are several alternatives.  + |2 \# F7 P/ }$ ]* |

9 F/ U3 `- {& S9 `The following one is the simplest:) V# _  e+ [8 r: k& s. B

6 U) U" {, V8 g6 Y    mov     ax,4fh
1 ?* u+ ~: U9 m  Z& v8 ^    int     41h9 h) f8 c4 f" w2 x5 }
    cmp     ax, 0F386# B* z  H. x* V* `
    jz      SoftICE_detected' ~: R; \" x8 `& {+ v

- ~0 b! _4 M3 l6 k; }0 y, u6 H5 H
7 _1 }$ m0 o7 u$ Z2 P; P9 ]" {" ?' ENext method as well as the following one are 2 examples from Stone's
5 c+ J4 P3 C2 c* R/ ^"stn-wid.zip" (www.cracking.net):* W& l0 ^( m' ]+ |1 z) C

+ Q9 W: [- w% I2 d, y" ?: Y# k2 s    mov     bx, cs
' @0 G% e9 X& b4 {    lea     dx, int41handler27 y+ Q# t* ~" _# a# @3 S
    xchg    dx, es:[41h*4], U$ m0 c+ E3 N: D( m  r6 ~
    xchg    bx, es:[41h*4+2]
/ G" {) Q. E% a3 A, N( T* `    mov     ax,4fh6 E3 C' u$ t& v! [4 ~9 \) e
    int     41h
" m6 K1 {  W; F1 F' H* Y    xchg    dx, es:[41h*4]
- t) H/ q. d, N. n4 r- W    xchg    bx, es:[41h*4+2]
- ^- D1 D7 a2 a/ A) E    cmp     ax, 0f386h
  t# Q; Q4 z+ D) ~& W    jz      SoftICE_detected6 ?' R7 k) d; R4 k& m4 Y+ d
5 b* `; {% e* v+ ?! T; l" \7 S( D
int41handler2 PROC6 o0 n  I' U8 i5 t+ I( {( o
    iret' j" _* I/ P7 C& L' m1 j% Q# H
int41handler2 ENDP
$ B* f2 E: i* m6 R! y% Q6 x) S6 |) R4 J. M) i4 y' V1 M
9 e. Q3 F! W: H
_________________________________________________________________________
0 M: ^( b. m/ ~1 K; z* @# L' l; h* q% N7 |0 O% y4 y

# U2 ?, V( \/ o$ F3 G. r) zMethod 06, f2 q% L6 l# H1 _( ^9 W' p
=========
: K7 A2 U+ }7 P; a2 T& \- @% }* f- ?$ p1 l+ Q( W

) I% @' a; I7 V2nd method similar to the preceding one but more difficult to detect:
& c3 {$ c$ b0 D' A" d4 P& u/ M; E  S8 I
# N3 [. \9 q% r/ |! M7 O
int41handler PROC4 x  |7 y' ~: L  s) f- Y
    mov     cl,al
: m& q0 G+ M" \6 p( \* }# f    iret
" ]8 ^8 v: S+ V, bint41handler ENDP6 m- @. t5 ~$ i7 L& r

# o  H& A1 T+ j; t+ _2 J4 W3 J
+ u, L( z) ]) l9 I  r3 V' S    xor     ax,ax
2 q  ]& J& z+ `0 U& \9 n    mov     es,ax
# o* `: a1 ]7 `9 u& P! @6 A    mov     bx, cs
, a1 p5 ^' P! \1 O' w+ G# P    lea     dx, int41handler
9 [9 k9 O! p: y# B7 b9 F    xchg    dx, es:[41h*4]
& V- W" J$ ~, ?" j    xchg    bx, es:[41h*4+2]. J/ N" ]( S% v( m6 k+ q
    in      al, 40h
7 L- |8 q4 G# O# B4 R    xor     cx,cx9 |! S/ t/ g" o: U& `( _3 i# q
    int     41h
- J2 _; M! J! j/ u% }6 k    xchg    dx, es:[41h*4]1 S$ g  l6 f! x7 S* L7 {- U' I2 ?
    xchg    bx, es:[41h*4+2]
; z1 B) `- V5 Z& G    cmp     cl,al$ A6 X6 e7 y1 J& B7 w& s$ V
    jnz     SoftICE_detected3 p5 w% ^- T0 @$ k. o1 E& G
5 H/ \# v3 u5 a! z, i+ b* U+ y
_________________________________________________________________________
8 E: I1 |& g% C
& [8 M1 I% D3 g- jMethod 07, x3 u% S; |8 q. A0 A7 h
=========% P4 @4 f, C4 V& H2 `8 t) r: n

3 S/ Q& r% e+ N; w1 d% q: v$ Y1 Z* [% hMethod of detection of the WinICE handler in the int68h (V86)4 X% v1 P% Q$ u6 w7 X& r

* w# [: N3 g& y/ w( l    mov     ah,43h
, R4 c, J- Y- Y: B$ B    int     68h7 M: }2 ~+ R1 z, y8 c  q
    cmp     ax,0F386h
1 P& H* j0 Y( }( N4 k" l    jz      SoftICE_Detected
. B) j2 Z6 a4 b1 ]- I. C: [, c
& T: a, c$ M; w; r# w% z% j8 e0 h# i1 V9 Z: k, ]# V
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit( ]% c1 _! i, U: s
   app like this:
  `$ E" n8 x+ ^  C" m: D3 R: m1 N1 g+ }- z: ~$ O+ v
   BPX exec_int if ax==68
8 M+ k$ P( {7 y7 c   (function called is located at byte ptr [ebp+1Dh] and client eip is
& I1 Q& u0 |/ B' [8 H5 F0 l$ r+ _   located at [ebp+48h] for 32Bit apps)5 K5 X, k% V2 \9 m% v9 B
__________________________________________________________________________3 _; m% z2 [) n% W
9 H, I6 H! j; }& `- ^8 u

0 D: C6 @3 n( N3 e$ `) b7 D1 L5 aMethod 080 q4 z, l; w0 q/ K+ X% m
=========
8 m/ y8 x% [% ]" F2 |" \
/ g- h3 q" u: ~3 ?It is not a method of detection of SoftICE but a possibility to crash the8 c. Y! I# A: V
system by intercepting int 01h and int 03h and redirecting them to another
+ |5 {* H5 ], Y& P+ {; Hroutine.
. l9 ^2 J1 a! [It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
% P, N- b3 P1 R( B5 p0 d  ^to the new routine to execute (hangs computer...)
9 _  F* f6 X* Q* _1 l2 X' f
/ q. F; J' I* D& A    mov     ah, 25h
& d) M/ k2 o: s, j5 c; y    mov     al, Int_Number (01h or 03h)' `/ A3 P3 Y1 o) A
    mov     dx, offset New_Int_Routine( d3 C+ S/ g8 V  {
    int     21h
; S) \9 G# ?1 t0 }& z. V+ o- l# U# V; u. z' c  E) t: l
__________________________________________________________________________/ |" N1 w! E# ~$ }- Z  ~5 G; {3 h% T
/ ~1 o, K4 e% ?: Z: U0 H
Method 09
6 y+ T% T# N# }=========
" }7 C& v( b* [& l
! @5 R! _6 t: d/ \* }This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only7 X  A4 Q& v$ ~7 ?9 J5 o
performed in ring0 (VxD or a ring3 app using the VxdCall).
, `. I' g: w" v# h5 |/ jThe Get_DDB service is used to determine whether or not a VxD is installed
  r1 V0 N' W! `: E7 Ufor the specified device and returns a Device Description Block (in ecx) for- ~3 E+ b5 J* s6 U: p2 U9 g2 y
that device if it is installed.
' S+ v  E' ~( a- e' U2 L$ B, `& s3 b' B: Q+ ~7 W
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
# J# {9 \- z. Q6 X- b2 J   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
& j0 g& W- `* ?! B/ |9 R. R7 [   VMMCall Get_DDB3 I1 s3 h( Q8 y# k2 @( T* ~7 a
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed7 o8 Z$ [0 e5 @8 m
; H# U, _* i5 y" o
Note as well that you can easily detect this method with SoftICE:
: p* L" k+ r0 q6 e. G0 i0 ~   bpx Get_DDB if ax==0202 || ax==7a5fh
. `- Z! J4 R; M3 ~, K0 Y* f
+ r0 m7 W9 z$ U__________________________________________________________________________
6 X" k1 Q4 ]* Y( i
3 S  U( F; {, Z4 i% B1 z. Y4 V' I6 EMethod 104 \# u5 G$ A: N. q
=========( S% P7 J1 o9 A, u% q5 A

+ G* b0 J) P1 v- R- p=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with5 B* x9 b' J& P* J
  SoftICE while the option is enable!!0 J  D9 \1 z! b! U5 g* U$ D

; v4 |( N. u. i2 @6 |; ~This trick is very efficient:4 O9 G2 h5 w* u
by checking the Debug Registers, you can detect if SoftICE is loaded1 O& U, S7 j) T' w) a
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
3 l6 a2 q) @6 C' L) l% a& s6 tthere are some memory breakpoints set (dr0 to dr3) simply by reading their
$ A- }7 t  y) m% |value (in ring0 only). Values can be manipulated and or changed as well
, @8 m2 h) ]0 P; e2 X, W(clearing BPMs for instance)
& M* w% i% g: o" r
& \) J# `! M+ M4 q% }3 m, O* C__________________________________________________________________________
: E, h7 w2 {6 `6 y  i6 k- U/ f7 Q, x/ }3 ~$ Q  H5 r
Method 11+ ~5 ]6 }: g, K! a  o4 a
=========9 r! J. ~3 e4 B0 R

- K3 d/ Y/ e6 NThis method is most known as 'MeltICE' because it has been freely distributed$ J/ U; _& F7 `5 I
via www.winfiles.com. However it was first used by NuMega people to allow* O1 T2 o' d9 e% Q
Symbol Loader to check if SoftICE was active or not (the code is located3 z3 H% F) a1 Z/ M" m& X4 Z
inside nmtrans.dll).8 k1 P' f5 m2 ]! t
! o1 j- l3 i  Q+ `3 P0 }$ h
The way it works is very simple:
: f) w2 i# S5 p) X, x5 f  t# ~It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for5 R# K( s8 |  d5 P
WinNT) with the CreateFileA API.
/ G% y! V% a) _! E" X/ o  h, s* c& Y) w- H3 z+ ?$ L, Q
Here is a sample (checking for 'SICE'):
! `$ ~0 j$ W2 ^# ~9 D( q2 ^6 }1 q
BOOL IsSoftIce95Loaded()% t+ ~  Z; D2 n. f( {. m7 {
{
: r. d( f. j: G# P   HANDLE hFile;  ) [$ O1 P3 O8 S
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
0 I5 V+ q6 L/ X, i3 X                      FILE_SHARE_READ | FILE_SHARE_WRITE,
$ g$ {; ~! n  n                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
5 x5 P8 n: R% U) [( f( D   if( hFile != INVALID_HANDLE_VALUE )
# B; [- e! n9 x1 X' K   {- S' E. ]% q' Y
      CloseHandle(hFile);
3 [$ W8 w8 t3 u$ H      return TRUE;
  ]3 C7 S2 G3 a: @; Z   }' E. ?+ L+ a, |6 h- ~( G5 T1 M
   return FALSE;
0 s) Q6 F& \* [}
- u1 Q3 t/ @9 A% R  w# S$ @2 K! M+ `& {* [6 H# h
Although this trick calls the CreateFileA function, don't even expect to be% F; e# e# l  `- [
able to intercept it by installing a IFS hook: it will not work, no way!7 k6 m& s2 D5 q9 Q% }% d
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
: @: i5 y9 r/ B; c) |service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)# @7 g( H. D6 U7 b7 J7 ?' X
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
2 x9 ?+ J5 ?  H) {1 c2 nfield.
3 w  v/ f; n$ Y8 q* m5 C# P; S. U6 R; {In fact, its purpose is not to load/unload VxDs but only to send a 3 L- z( V& y4 X7 m' [8 ~% r) x
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)$ l/ @- ^9 i, E
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
8 u. R5 a: ?3 e: P: Y0 |  B  Xto load/unload a non-dynamically loadable driver such as SoftICE ;-).5 A* Q- G* \% A) d. f9 E" p6 s% h
If the VxD is loaded, it will always clear eax and the Carry flag to allow/ N) r; f! `0 \  n" T
its handle to be opened and then, will be detected.
( S8 s- T: x: o: A0 E) vYou can check that simply by hooking Winice.exe control proc entry point' c9 K% h. s( Y
while running MeltICE.
: ^' b9 D9 W3 R, |# B, v  Q( K6 M
, K8 L$ F, m! A' K/ g! N: Z# ~* b
  00401067:  push      00402025    ; \\.\SICE
) |. L, A- x& u8 g  M' x1 F  0040106C:  call      CreateFileA
( Z: e3 B4 n2 g  00401071:  cmp       eax,-001
2 a. D) t# y; L6 ~9 W  00401074:  je        00401091& R- E+ ^0 u5 y8 c% M
, m" z8 v0 q7 i" d; [) ^+ `

' `7 _* w/ C; z# ?3 U" ?* d, S5 Q+ T* XThere could be hundreds of BPX you could use to detect this trick.8 W% a2 V" C2 ]+ y, z
-The most classical one is:! a. [- |: H# X, g$ T, V
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||! k: d7 L( Z6 H
    *(esp-&gt;4+4)=='NTIC', h+ r+ t# [$ ~) X) I2 O& C

" l% H3 T+ L! L* `5 _-The most exotic ones (could be very slooooow :-(
% Z6 @2 F( }* M4 c5 g  j0 U   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
4 O5 K) H. F/ c1 @* l& t& Z2 p4 ~     ;will break 3 times :-(
) n/ w! M! A2 d$ D4 P9 Y" j. m; T3 }5 @* s$ H4 `# }" ]0 y6 }
-or (a bit) faster: 8 C) Q3 K1 H/ k" \. k4 H
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
+ P! E% |) j* G2 a+ Y0 `9 K3 k, ~+ z2 x
. y8 n0 D5 S" U" P) v8 b   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
% ~6 F% ?; {2 u* x4 b* e     ;will break 3 times :-(
% I7 ~, a# f+ o1 J9 l" {; T7 I7 |* e; C$ M; l: `8 ]% ~' A
-Much faster:
! ?+ i9 N) W% |3 Q7 |2 B   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
* B4 ]3 Z1 i* A0 T/ Q( ?# K6 b2 h3 e8 h& |
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen9 C4 e. w9 d4 |! V
function to do the same job:4 ]& a( K6 x3 j

1 P  ?  ^- i2 ^# |3 t6 p   push    00                        ; OF_READ! z9 @+ g6 t% D' ~- @
   mov     eax,[00656634]            ; '\\.\SICE',0
! }% d5 f( h' j! n& G   push    eax) Q& a) z) G' r" k
   call    KERNEL32!_lopen
$ m1 F$ ]& C7 R; j   inc     eax/ S. N3 R3 n& ?/ `+ G" [' q' P
   jnz     00650589                  ; detected+ [; E% ^3 r" M* [! u
   push    00                        ; OF_READ; H3 x. G; T; V
   mov     eax,[00656638]            ; '\\.\SICE'
8 U0 M- q  v- B2 }   push    eax9 L7 L* b- ], E- d. X
   call    KERNEL32!_lopen: v* W; d7 d: x2 M' v
   inc     eax
) ^8 [# T, Q! A# W; O- v" Z   jz      006505ae                  ; not detected
! e9 [% V' R# }  L% [- \
$ K7 a4 j7 Z8 ]' r* c- r9 t) h1 Z4 g6 o4 ]6 r- i% ?! s; m
__________________________________________________________________________
  {4 h0 m+ `9 M  s0 z/ m: v* U1 `1 D6 S2 x7 o5 R
Method 12  R6 ^; s! ]: @  i' Q0 ]+ [4 w
=========0 l0 Q8 `1 U7 y  T$ B5 \' X  w
8 L4 n1 V2 z1 s( o
This trick is similar to int41h/4fh Debugger installation check (code 05
0 d6 R8 a/ R4 r' q' M&amp; 06) but very limited because it's only available for Win95/98 (not NT)
5 m1 V( |7 P! Xas it uses the VxDCall backdoor. This detection was found in Bleem Demo.
" s1 a% A  G7 ~3 [8 \
6 b: {* O. H& h) K   push  0000004fh         ; function 4fh6 ?- F/ j# f# P9 r
   push  002a002ah         ; high word specifies which VxD (VWIN32)6 }+ Z" t: A7 N! {' T4 s
                           ; low word specifies which service
3 {5 w! _+ I" Y7 e: Z9 I- S                             (VWIN32_Int41Dispatch)1 E, z& ?: p, Y4 b; t9 C# a  y
   call  Kernel32!ORD_001  ; VxdCall1 L, {  I2 x& U+ |8 c  A% V% N. ^
   cmp   ax, 0f386h        ; magic number returned by system debuggers
. v# _, R1 T. a; x6 n# N   jz    SoftICE_detected
" W8 _+ }+ z, `1 Y6 i. c" W$ x8 S/ x, F# ]
Here again, several ways to detect it:
. _7 h% z# ]# `: O( A0 M: z! e6 h$ ~% @& i" j  l# G
    BPINT 41 if ax==4f
% q3 Q4 i1 W% D, r( f" W
# [) q8 N. V) F, M    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one9 k; c! ]( A3 D% [2 U! C+ X' U
$ J9 e5 u* p+ P+ m1 Y
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
; Q( Z% `$ L4 F+ O) ?0 p$ }4 E. R0 h& m
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
. C( h2 A* H/ b  J+ \8 t: X5 D4 j
0 _0 e& E) y" }0 @0 R: h) ]__________________________________________________________________________9 i% a8 M" h$ E7 F% V. f) c

/ m) ]/ e5 D! E. n2 R( I0 o; `+ `( OMethod 13
+ t1 \' l6 f" N5 ^2 _=========
- u4 V; P% R) u& U. b& e: j3 [0 g% P* ]( _
Not a real method of detection, but a good way to know if SoftICE is/ g+ g9 T7 d! }+ R* U
installed on a computer and to locate its installation directory.+ ?% o+ _: i5 J# y, T0 z1 Q) t( L; k0 Q
It is used by few softs which access the following registry keys (usually #2) :
7 u- w) |( X7 A7 ~+ X* \- `" s$ i" U! Q4 s! h1 R
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion' B& a8 O6 \8 d* Z" d
\Uninstall\SoftICE
1 i- l$ c+ ~/ I1 r- m7 T& {-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE! `  R( n) i$ J* l
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion& j1 z9 Y2 k7 ^) n8 K( W( n
\App Paths\Loader32.Exe9 j0 J6 @! ], e: A, s
/ N& [* A- {* N

. m) o% p, w2 R* e( Q$ m  m' nNote that some nasty apps could then erase all files from SoftICE directory  X5 R# ^$ i" R# q: G+ Q
(I faced that once :-(( ?4 \* f5 p8 e( b
8 `/ f; o( {4 g) W7 [
Useful breakpoint to detect it:
# l" R6 E% m# O& y# r' a' C7 p8 H2 E, X) G
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
% ?2 }% `  x; ^
+ _5 d* o# k5 t5 a3 F/ q4 V__________________________________________________________________________! U& t  R3 m# l

7 L2 h( E8 ]  Z9 W( y7 Y2 X- z
, c- M, E$ l! s$ B! S& d/ U. m9 c: bMethod 14 9 i8 s# d& w3 d
=========+ S0 W( H" Q/ \; l/ J
0 |7 Q0 y8 G( s: h1 s
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
) ^8 A. Q! Q/ K/ D# `is to determines whether a debugger is running on your system (ring0 only).- W5 v% W  \$ @
4 u0 S  V$ ?$ t6 p& @7 m' U: z
   VMMCall Test_Debug_Installed( B2 z& ?% E3 G, d
   je      not_installed
. r% d( [5 k+ S- B! B2 L
' Y$ i; }2 U# \; _+ ~This service just checks a flag.
" @* j) q0 h3 i/ p5 \, j0 E</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-7-29 01:19

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表