About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
$ h4 }/ U, x) B* U6 \( M, M<TBODY>
2 j1 Z1 v) v) t<TR>/ q8 r, j, H( V6 v/ O
<TD><PRE>Method 01
+ C0 A9 Q- n& ^5 L=========
- h* l1 f# ]4 M9 R+ h9 s0 M6 d. g1 D$ R( [
This method of detection of SoftICE (as well as the following one) is! Z% b# N$ E4 W8 B* p
used by the majority of packers/encryptors found on Internet.
# g* c- o: @4 ~, hIt seeks the signature of BoundsChecker in SoftICE
+ R  N1 Z6 e' O/ ~% W; v. V
% T1 d* F; D4 q# F# b) J    mov     ebp, 04243484Bh        ; 'BCHK'9 }" m" \2 [# W0 G& V
    mov     ax, 04h
6 ~! L. J+ ^! T0 P5 V    int     3       * W, q9 A4 O) W0 G9 b
    cmp     al,4$ T& j, q) ]: k3 |& B
    jnz     SoftICE_Detected% \: \' X5 l1 l& v0 M
# s$ a) T+ F$ F4 R& @4 S3 Y
___________________________________________________________________________4 H4 [. D8 W& f, U7 C, h

6 `, g8 v5 Q( t; ?Method 02$ x" W; @7 L. j/ ]
=========4 i: F  v! g/ {: u8 C8 |0 z
1 Q5 [) }+ K- q( r2 B! R
Still a method very much used (perhaps the most frequent one).  It is used8 h6 ]* J. y0 [1 i2 y* P/ c( B
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
2 O) ^! ?! F/ r! E% i# I) Lor execute SoftICE commands.... ?5 s9 }; J* {& b
It is also used to crash SoftICE and to force it to execute any commands2 h" K5 N3 r: w0 X
(HBOOT...) :-((  " f/ s6 B2 O3 C3 j7 M$ }; b! Y/ w, i

" L) U. C1 X0 I! a1 B7 WHere is a quick description:+ H0 v+ w  g* @0 Z& {4 b+ {
-AX = 0910h   (Display string in SIce windows)
* {' m! @9 O+ h% Z-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
  T# l2 T$ N# c" K8 K  M2 T) t-AX = 0912h   (Get breakpoint infos)4 l& {$ W1 z! n+ \5 f
-AX = 0913h   (Set Sice breakpoints)& C2 _  L1 D- J% S! D5 g
-AX = 0914h   (Remove SIce breakoints)
. S1 Y3 Q- x* u6 r! M3 ~1 g1 {% b& U. S2 j( o: p
Each time you'll meet this trick, you'll see:1 I( Q6 M3 j: h
-SI = 4647h
9 `4 u7 g6 b! t, ?7 D, y+ @# |7 y-DI = 4A4Dh0 g4 A, o; Z1 s7 o3 J- ^/ G
Which are the 'magic values' used by SoftIce.
" p5 o, f$ t; v, qFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
4 a# ~* Y# t, \  `. q  p& B& k
! W- A& O5 I8 q( mHere is one example from the file "Haspinst.exe" which is the dongle HASP4 c/ g$ B- |7 ^8 C
Envelope utility use to protect DOS applications:: c+ k) B' @" u' E8 |- c" a

$ i" R" o. }* U* q% g8 O- H5 E) k' S+ r! S2 V+ ]/ j) |
4C19:0095   MOV    AX,0911  ; execute command.% U0 Q/ B; f* J8 Q
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).; \, D4 P  R! l  i: d
4C19:009A   MOV    SI,4647  ; 1st magic value.
, w6 G3 l% M; G* G6 b7 d4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
  c: O) B- p& f/ \+ w9 d! ?/ n4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
3 Z, J! j: n; m+ @7 U4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
/ M( Q8 Q, j4 _! s$ i3 n4C19:00A4   INC    CX0 b* M4 z5 d8 Z( y6 n
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute+ Y: q5 i& \+ {- ^( z
4C19:00A8   JB     0095     ; 6 different commands.8 K( y( x* J5 `" r8 [
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.0 M0 F8 X  j+ Z! M" q9 u/ f3 U
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :): }2 N, _" G6 P% n

6 t3 V2 `4 ~5 E9 aThe program will execute 6 different SIce commands located at ds:dx, which$ i; J, j5 L# d& k+ l+ F1 i
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
' _* j9 d- j) R; S1 A3 L
( ^" m$ G1 Q% g, H2 Y* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
! L$ W% a8 G- L) r( i$ c7 s___________________________________________________________________________
. W4 M+ O: i, ~. k8 C  C  [6 j( d8 I7 I, c$ g* J+ @# `

# t  A. O9 B) V- X/ t( r$ K& bMethod 03
4 S7 {9 `1 h0 g. L4 P=========
& A1 [* w6 k) h1 |  m/ N# J
2 w" k5 O) S* p, oLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
& f+ |/ y. g; u" F' ?(API Get entry point): k4 S" i, ?- m8 Z
        
' p0 u8 }8 i8 d) K  H+ x6 s0 S8 M7 F. G/ ^
    xor     di,di; O) _" Z# v3 x9 |% T
    mov     es,di
3 d4 n3 I# \- h3 i    mov     ax, 1684h      
9 V; `" v3 V2 v: R2 {$ F9 W    mov     bx, 0202h       ; VxD ID of winice" S2 }8 @( ^" e+ K4 X5 w
    int     2Fh" c* P2 k& q" V: I  E1 @
    mov     ax, es          ; ES:DI -&gt; VxD API entry point5 ?+ x9 ?  i2 V$ w' m. [
    add     ax, di
. D3 S6 ^# g0 Q' [; K6 B    test    ax,ax
' g/ a9 ]1 C! A4 z% U    jnz     SoftICE_Detected# M3 f/ E8 n% x+ l" @% D2 V% c: o

& I2 y. f% ?; C1 L+ O' H. }___________________________________________________________________________
% O' S: a, M  l0 C
% @2 u7 f( B# V2 P$ G) u" PMethod 04
3 Z" D# u: Z- v. z/ D3 R" S=========
: k. m% \: U, Z% K+ e
! S, y% k) _& z- z$ K; q2 [Method identical to the preceding one except that it seeks the ID of SoftICE) w7 L$ f# ~0 X- K' T
GFX VxD.. Z1 @& M9 f2 B* d
0 D* U( K7 p  w# z0 b" `' W
    xor     di,di% N, H" |4 O$ F$ ^  X
    mov     es,di% x; h+ m0 `, }6 |8 V( H% ~
    mov     ax, 1684h       6 f9 w( N" r* b3 R& [0 Q/ q
    mov     bx, 7a5Fh       ; VxD ID of SIWVID3 q( ^( J2 Y1 D# y' M6 o3 L
    int     2fh
% D0 p, e$ `- i, k2 x    mov     ax, es          ; ES:DI -&gt; VxD API entry point
; j5 r, I/ _, t' H& N    add     ax, di
: }. j* ?7 g7 w    test    ax,ax* R1 Z! @0 }! E3 l. b
    jnz     SoftICE_Detected
7 |3 f( B  @6 m" J7 a4 I3 [3 F2 `' k  i4 s
__________________________________________________________________________
2 [. d$ ~9 k9 N3 E  @+ ?4 i) e. s, W( v' Y- X: U

5 l4 `( O4 O) _8 gMethod 05: I- x2 R9 b# @/ r( _  g- z0 k
=========) l7 l! J: u! q$ b: \" v( v

/ H  v& N. K1 w- D5 J8 SMethod seeking the 'magic number' 0F386h returned (in ax) by all system
8 S% j; q4 e' h% F; c* T" |debugger. It calls the int 41h, function 4Fh.
1 }9 y$ f2 N* r& JThere are several alternatives.  / [& d( U5 J* F* ]0 I* O' i& c

) d) u9 `2 P/ hThe following one is the simplest:
/ z/ V* `8 v" p7 [2 H
8 d0 J4 V: C$ Z4 c% q    mov     ax,4fh# h" j3 l5 F+ U/ S( q
    int     41h
% ^! J7 [( N1 ?6 Y0 k2 k/ Q* t    cmp     ax, 0F3866 Y' E+ f5 X; V0 n; C
    jz      SoftICE_detected
7 R2 y( N9 E: o+ B- G; e" k2 x3 S# D: H& }4 c/ _8 f

& n2 G5 w9 a; hNext method as well as the following one are 2 examples from Stone's 0 ?2 W, G/ a! s7 I
"stn-wid.zip" (www.cracking.net):
$ m/ s3 |; p$ G" k
4 V& Z- W0 o$ d    mov     bx, cs& D" C4 ]4 s6 ~" e; ?- A
    lea     dx, int41handler2
1 E( ~  N1 D! W1 E1 V    xchg    dx, es:[41h*4]
. i% y$ N1 \5 {6 O' j" c    xchg    bx, es:[41h*4+2]" Q! x" j  M3 ]! h5 \# u2 K! I: X5 I
    mov     ax,4fh' @+ q# l- L8 Q
    int     41h8 t( J0 x- b9 y) n9 i- O  _
    xchg    dx, es:[41h*4]4 X* @9 ^0 [) Z2 g# ~
    xchg    bx, es:[41h*4+2]
5 w+ Y( B) `$ g; Y5 B. Z4 b- Q    cmp     ax, 0f386h+ Y- j. Q9 |& m! `0 G
    jz      SoftICE_detected
' h. {1 q- e8 {& V) O# e5 Q" S4 E7 T3 l3 j$ D2 W; e$ V! V& G
int41handler2 PROC
5 o, M: t9 m/ O: F0 ^    iret
2 M% a' R* \# f$ V4 M! eint41handler2 ENDP" T( r0 Y4 r5 I

0 {+ C4 D9 z" g+ C* |" _$ M8 u% ^5 K' N1 U$ g- G  D
_________________________________________________________________________
1 H- \! Y7 [3 n6 u" C/ B5 E1 Q4 L1 W. ]/ i. U
7 _2 w9 i- l) A5 v0 g8 t5 b; E# O
Method 06
0 @' ]* \4 u$ ~5 p8 D3 t" A/ C=========
; b3 E& M' E/ r8 q9 @& x
# H' I, P& x8 I5 R6 e* j  @3 ~# w# F; `+ R( V0 N7 S2 \: D
2nd method similar to the preceding one but more difficult to detect:, ?/ G, W8 q/ C0 J& e- E3 O8 `

1 M$ c4 L/ U3 x0 _0 n2 {
8 |. w0 T4 I- j' ]4 Y6 I& Gint41handler PROC
' F/ t4 V# {: @. v) Y    mov     cl,al: S; \# z! T$ r0 R% f
    iret% _& e, {, E/ K* W! k/ N
int41handler ENDP
6 w4 f. o4 g5 y6 e: G% _5 I1 H7 t. y6 ^
# P' S" v) v. s; M: _9 A) z; ]* ~7 [
    xor     ax,ax
4 Z$ S# C! @6 S    mov     es,ax( ]( @: }8 o! F/ Z0 m
    mov     bx, cs
1 ~3 ^. q2 I6 J# f' l9 b; e" A1 l    lea     dx, int41handler
1 X* l$ w% H% F" B: Q/ ]    xchg    dx, es:[41h*4]
5 S+ }8 m  c' g4 ~9 w: W    xchg    bx, es:[41h*4+2]
7 h( s: K% y) F    in      al, 40h2 v  k  G/ z4 p+ {; _/ D! @* u! ]
    xor     cx,cx
* i" {2 u3 ]; ]1 ]# c2 U, R7 @    int     41h4 A: L# ^  h4 Q7 ~7 N& t
    xchg    dx, es:[41h*4]6 s; h/ D: L3 r% G  `, |
    xchg    bx, es:[41h*4+2]
, K, |  A) ?( ?/ L    cmp     cl,al7 _: E( V9 t; ?! J' W% w6 f
    jnz     SoftICE_detected* z; Z( u& R3 ?: o0 h$ f  _1 d
7 C/ F7 P+ f3 y0 c( m
_________________________________________________________________________# B/ J' I( j6 F4 ^* q0 {
7 C- V5 ?  @* J% p3 V, f
Method 079 G5 V  u/ S0 q/ B1 r7 F- e3 U
=========
; z' ?7 N7 ?1 A/ @- [# b( t7 _! v2 h" X2 ]5 D
Method of detection of the WinICE handler in the int68h (V86)
: U4 D! Y1 I. p, E( x) s7 {, b/ @7 t% ?+ y. z- F3 |
    mov     ah,43h8 W9 |( }" {4 P' b
    int     68h- \" X/ j, [, L: f1 y
    cmp     ax,0F386h, {6 k2 N, G$ V  E0 h
    jz      SoftICE_Detected
+ {+ b* H: @8 s; g$ G+ G: Y% m* W/ `4 R9 l6 [

+ b! u2 V* m- I=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
2 D, C+ f! W1 z! N9 K1 o: ~8 G/ d   app like this:7 v8 I  d  F5 x5 U1 x5 A- N9 o! ?
: z5 d% L# K+ Y& d5 y+ y0 @# _  R
   BPX exec_int if ax==68
4 x0 [) e" t1 `6 {) Q( y2 z& _   (function called is located at byte ptr [ebp+1Dh] and client eip is* ?' X, a4 h$ ]
   located at [ebp+48h] for 32Bit apps)
8 ^$ G* |" Z! c9 w) W8 x' _! D" u__________________________________________________________________________
3 ~: W, \) _# L7 w( y# ~" i. M# g$ q1 r. x

3 f+ F/ H) P' w+ y9 V/ ~% Y/ yMethod 085 x+ r- S! x7 j$ h; S
=========4 o) d* X; ~  S: |: r- d1 N
/ N+ o7 G2 s( u8 `
It is not a method of detection of SoftICE but a possibility to crash the! v0 I" p- e9 F" _4 C7 n, s
system by intercepting int 01h and int 03h and redirecting them to another; ]7 [. t$ A8 t& s3 I
routine.
  d6 W5 ?6 ]; cIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
8 h, t0 l" N7 S. _* eto the new routine to execute (hangs computer...)  u9 U$ P, W( S- [  P$ R) W: W

, i6 ]' r3 I7 q4 e+ u7 {    mov     ah, 25h. E; y; ~: Y& F! ~- s/ T' T& `
    mov     al, Int_Number (01h or 03h): r; ?# T- R6 {9 T) j
    mov     dx, offset New_Int_Routine
! Y0 a: k) u: h" F9 H    int     21h
1 P! ]) R' A5 H2 {7 m3 G: k. Z2 x+ m8 ^5 h. Q# g
__________________________________________________________________________" J2 b7 Q2 r' }# Q, Z
) y6 W1 f' ?! H7 i/ d: h
Method 09) J* u6 L+ v1 [
=========: B+ }; }% b" z' H9 o  i! I% \
' ~7 I, U5 f  a
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only9 l. A' j% T1 l. O, L8 G1 q
performed in ring0 (VxD or a ring3 app using the VxdCall).
: {- }- a0 l" A* v4 QThe Get_DDB service is used to determine whether or not a VxD is installed$ U% G+ c* Y: H% [6 a
for the specified device and returns a Device Description Block (in ecx) for
' ]/ Y. P. ?  u" f8 [2 P' O  |that device if it is installed.
# s# Q0 L5 @+ T; x$ w: T
- t$ i" e5 k( ]7 b) U   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID0 d- B( Y, \* g
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
) X$ }, H$ \/ T3 S7 D. Z   VMMCall Get_DDB
9 v3 p2 T2 n7 D% s7 h# B7 H9 Q: A9 ?   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
" f: e8 x% U" p" X1 w
9 O/ C1 l  I3 z& k: lNote as well that you can easily detect this method with SoftICE:
& b) L3 B# ~3 k* P1 q+ ~+ p   bpx Get_DDB if ax==0202 || ax==7a5fh+ k( o$ `1 a3 C4 ]3 @
# x& n7 r5 V" z( f" Q
__________________________________________________________________________, r' @/ r. F/ K+ w8 U9 h/ j

1 J! f- U$ M) C# j  m, V# EMethod 107 x; [/ }7 t/ L. W1 l
=========! T) ~/ ~5 Y) D5 ^. P

+ O$ C6 n+ O: j2 n=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
4 Z6 {. B& ]1 m  SoftICE while the option is enable!!5 ?" M4 L4 z5 j
6 {& J: o) Q+ \5 x9 |0 f% c
This trick is very efficient:( [0 P5 l/ ]  r8 }( n2 J3 ^2 X6 g
by checking the Debug Registers, you can detect if SoftICE is loaded
) V7 {; Z- y, v' @3 U; Q3 }(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
) A) |1 X9 Z6 y3 w4 V6 i+ W1 w- O2 _there are some memory breakpoints set (dr0 to dr3) simply by reading their
4 u( |! U9 S+ \4 w7 B. `value (in ring0 only). Values can be manipulated and or changed as well
/ w* k5 e/ [' ~& r4 h6 V(clearing BPMs for instance)2 p1 ~  B- f; A! m0 N
% j4 O$ N- T  {6 V! b& x
__________________________________________________________________________
9 X# {/ h) m; c( e/ [% t0 k2 Q
2 D. |  _/ M  J1 d& FMethod 11
' N: H* q6 ?, k# X* k6 @6 y=========1 k, r) E  D; \

7 D" Z) ^0 }0 }7 C: a7 dThis method is most known as 'MeltICE' because it has been freely distributed. ~" A; L. i: w( ]5 d+ G
via www.winfiles.com. However it was first used by NuMega people to allow6 f* Y& H( V! L& B  a
Symbol Loader to check if SoftICE was active or not (the code is located) S, _4 ?. G4 L
inside nmtrans.dll).$ ?6 y5 Z* {. N+ n7 R7 l  V; i
2 a0 i0 ^$ A% u
The way it works is very simple:* `9 H) G+ m' R3 |. [( J# T
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
' b; M! Y( l# x  EWinNT) with the CreateFileA API.  k" \2 q3 r4 D8 H; s2 d# g1 W

7 {8 V% H5 C3 W6 U3 A* }" j2 g* l9 [# oHere is a sample (checking for 'SICE'):: R. G, `) Q4 f: f  k
8 F) o) L4 l' z+ N4 B
BOOL IsSoftIce95Loaded(): T; Y5 }5 q9 y- l* W" `& |
{1 |4 N. k8 z% v
   HANDLE hFile;  
; S! K4 g' \0 L% O   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,' i6 O' r+ l% G& ?
                      FILE_SHARE_READ | FILE_SHARE_WRITE,3 B' q6 e) |) M) F# S  W
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
& Y( }# `$ j; N/ \& ?4 x   if( hFile != INVALID_HANDLE_VALUE )
+ v; o& n7 C5 c8 s   {8 E/ L5 _! n& d: W" p
      CloseHandle(hFile);
* y$ i9 t* M. L( T! }6 K" w      return TRUE;# ^1 P  T8 r' x( |! |8 Q% A
   }
; h! c# }! ], {- B! F1 n3 B   return FALSE;  c* H5 h# h8 D
}
5 r8 G7 g% U8 {1 @0 k; R7 `* ?5 }8 L' ]' V+ l, w! a& e( Z
Although this trick calls the CreateFileA function, don't even expect to be
! V0 x8 x& d" Q) w- rable to intercept it by installing a IFS hook: it will not work, no way!. m* F2 S$ C' W! {% N
In fact, after the call to CreateFileA it will get through VWIN32 0x001F8 Q. m7 r) ?. _$ J1 l3 b6 A
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)& B2 ~1 [5 ]  O! ]6 t( e% a' r
and then browse the DDB list until it find the VxD and its DDB_Control_Proc( [8 Y' Y; C# J! Q- s( X
field.
' v; E3 C. E+ IIn fact, its purpose is not to load/unload VxDs but only to send a
* u9 }  a& |0 m: j5 JW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)- R3 A7 E: G% ^; I$ N3 ]. M/ R
to the VxD Control_Dispatch proc (how the hell a shareware soft could try9 s. N7 \- g2 U& E4 R, C- P
to load/unload a non-dynamically loadable driver such as SoftICE ;-)., P. E. n9 Q" }
If the VxD is loaded, it will always clear eax and the Carry flag to allow
2 ]) L4 j, E& P2 W4 }its handle to be opened and then, will be detected.6 [; |- O0 K' K8 e
You can check that simply by hooking Winice.exe control proc entry point
( j5 N' j6 B5 {4 Zwhile running MeltICE.
2 T* s" p* }0 U+ e. w% U% T& m6 s  S; \0 E  \0 x6 b  v2 L1 W. h

5 J( y+ ^1 G  _8 h7 h/ T5 R2 m  00401067:  push      00402025    ; \\.\SICE7 [5 a" t/ o! ~7 k
  0040106C:  call      CreateFileA: p+ Z" e* \9 I
  00401071:  cmp       eax,-001/ }5 A8 @- ]0 W8 k8 R  q- h
  00401074:  je        004010910 e  _# q" y: R) Q% ]

/ y# b; ^8 O4 {
% ^$ _# U3 k& c2 k& ~! k! b4 lThere could be hundreds of BPX you could use to detect this trick.1 X  T' K- ]/ @/ V
-The most classical one is:5 j6 m, \6 H  u9 ~/ M2 Z- _5 b
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||) z7 J. o! b( u" v7 Y' e& x/ M
    *(esp-&gt;4+4)=='NTIC'
4 k. _  }5 x- w! b/ v) y5 I& E9 Z) a4 X. e
-The most exotic ones (could be very slooooow :-(
0 m; N% B5 j( ^$ X   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
1 @9 ]& T" U) Y# ]6 M     ;will break 3 times :-(4 H$ B! V  A: `/ R. K9 _+ r  K

# a% l; z0 i5 G& [9 Y3 a-or (a bit) faster:
+ `0 h; f/ Q+ M   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
& [$ R9 H7 g/ Z$ O  x1 B
1 K9 L9 u- P: h/ ~4 S   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  2 \* T4 G- e# [# U1 y) w% G
     ;will break 3 times :-(
3 a* s  S; @1 y7 I' p1 [  ~
- C: ?  ?3 q8 k6 [-Much faster:$ `( I5 `, _9 d% K
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
6 k' ]: u" F! r9 D# F1 \! M3 z) F+ [
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
' g& _( _% H4 ^' Z0 r% s: b* ~function to do the same job:  ~& ~; q& Q  I$ k

7 P- b- e% H$ Q" g3 d0 J   push    00                        ; OF_READ; f0 Z& y- _0 f7 j
   mov     eax,[00656634]            ; '\\.\SICE',0
* ]* `0 d  p2 J8 \2 @: {, Q( h   push    eax( `" C9 R0 V5 p& R
   call    KERNEL32!_lopen
, H# R  _' C6 P   inc     eax
0 C) y9 r+ w" {7 C3 o   jnz     00650589                  ; detected
" J: t* u& N# Z& m   push    00                        ; OF_READ
3 x, e0 j" |: f6 T! b* V1 i   mov     eax,[00656638]            ; '\\.\SICE'
: ^4 N+ h$ T* w: D" A3 g4 J   push    eax
) H" S. v  \- i& m* I5 c* [" I   call    KERNEL32!_lopen( R! u5 r  h6 y7 k2 M$ l$ ~
   inc     eax  [9 J5 ~% K$ ~
   jz      006505ae                  ; not detected* q; l% M: c5 h9 Z' R3 L
: M6 M- q$ o5 g0 O6 P

# \! v% c5 o9 I__________________________________________________________________________
3 w# T% n. V: Q+ ]# d
, O/ X3 b. F7 `9 O" H8 c" hMethod 129 u  s$ P" y# L" t& w
=========3 G( g+ n1 q; Y0 z) [) t! q+ s% V

" q4 i( u0 ]7 o* P2 u, P, F. k3 F. m/ sThis trick is similar to int41h/4fh Debugger installation check (code 05
2 Q9 f2 P) G) }! E  Q&amp; 06) but very limited because it's only available for Win95/98 (not NT)
4 K1 u1 K- a% M# ]7 X; y- Vas it uses the VxDCall backdoor. This detection was found in Bleem Demo.* S$ m% L7 [( F
7 I6 ]; H) n( a1 z  W
   push  0000004fh         ; function 4fh
0 ]& \, d8 W: D' R   push  002a002ah         ; high word specifies which VxD (VWIN32)9 Z7 Q6 m7 Q, F5 u2 d8 b# j7 L! ^
                           ; low word specifies which service
, e$ k: r& z. W0 V) Z                             (VWIN32_Int41Dispatch)
0 K1 D' Y4 B4 W" t   call  Kernel32!ORD_001  ; VxdCall& W9 a6 v3 g% m2 @0 B+ L
   cmp   ax, 0f386h        ; magic number returned by system debuggers6 S, b( `) K4 A1 L
   jz    SoftICE_detected
6 f% s7 G& m% Q5 V& @* A1 H; S( `8 J( D$ B( R7 C
Here again, several ways to detect it:" ^& U$ |! w0 ]3 P( p
, q# O. @! }- y, ^' ^8 f
    BPINT 41 if ax==4f
+ h& B! J# N4 w7 n% |8 h
+ t2 q# s. v9 p7 j# r    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
9 H" ]2 k" R* P9 j; f0 ~& p5 P5 E8 N5 @$ j: p
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
' B5 o- ~- s) o: Z  J* L3 p% i  R# \' V/ u
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
% M9 T1 W/ c/ M8 ?5 d  a- W" h5 T6 h  N# ~
__________________________________________________________________________
7 m: D3 J; x; f% s, q
6 |3 f4 W5 D# m4 y! D# S/ K5 eMethod 13
/ }$ @. ^* e3 b& ~4 I: ^% \=========
0 ~/ O* y, ^- y" w* D* F' k) q( G. X" A2 V4 H! S
Not a real method of detection, but a good way to know if SoftICE is
6 K! v1 }( G& _! y; D. }6 e. dinstalled on a computer and to locate its installation directory.' `; d$ b. u4 Y1 `
It is used by few softs which access the following registry keys (usually #2) :
+ Z) E9 @( W) U& E( H0 ~7 c5 q8 K' l' m1 b# U
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
; U3 y' f: w% O9 L: m7 a0 t4 ]\Uninstall\SoftICE
; }2 @3 _; g6 r% h$ t6 ?-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
0 f( M/ V* T3 E' U: ~  X( j, n-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion$ G, X3 a' ^" _! c
\App Paths\Loader32.Exe+ q- Y( r* R' {  `0 [! `% V2 J- ]
7 n0 {9 w8 x5 t: s+ u

8 ?2 D& ]" m. X, O( n" ?Note that some nasty apps could then erase all files from SoftICE directory
; g+ V0 d7 k  _* R(I faced that once :-(( u, h% D& N5 Q% p

. t, J7 j0 U: d9 [& x& r) F4 gUseful breakpoint to detect it:! z/ `  k1 @$ O+ M+ V2 L
% j% ]* M( Z* _  [7 m% l, G
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'( i% d# n9 p# p7 Y4 W3 M
. n3 w, I& e7 p  m" ^9 o
__________________________________________________________________________
' p9 z* d6 s( W6 ]
# s$ [, A0 ^* U- N! L! K' ^
( g+ W% q. `# r- EMethod 14
: r) X2 o, _! O2 K% E% A: B4 B=========0 }6 j* f% M+ k3 P
, E9 m& k# }+ l" J3 r
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose0 l  H$ D& \3 p/ m( W
is to determines whether a debugger is running on your system (ring0 only).% \' @% a, [9 e6 @# T6 D/ e

: B3 O  `. |/ e4 t   VMMCall Test_Debug_Installed" M, q/ {1 i/ B$ m
   je      not_installed
3 d( e9 W0 Y, v: l3 i8 N" J1 z
5 L6 f- |  R+ tThis service just checks a flag.5 i9 U7 o; K5 @# ]0 [7 r4 Y
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部