找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
8 U$ B! o: V7 C2 Q% V' L<TBODY>- g; `# f( L0 Q, |0 ~
<TR>
3 D) f$ e3 Z* _: [  F<TD><PRE>Method 01
5 A# e. x2 S) E=========
+ }) e/ ~3 z8 ^+ B& i( |4 C6 z7 E0 z( m( v- d) K$ g
This method of detection of SoftICE (as well as the following one) is
7 q. Z0 P6 U; T, V: {  j, ?5 h7 Fused by the majority of packers/encryptors found on Internet.9 S1 q* D5 J( n/ I* a1 E6 D) J
It seeks the signature of BoundsChecker in SoftICE+ U* t+ }1 b/ C
3 m& B' u3 G6 Y' Q3 `$ R
    mov     ebp, 04243484Bh        ; 'BCHK'
4 H) {# e' {! r4 T    mov     ax, 04h$ M& a) M( X3 E  H1 ~
    int     3      
& _2 h+ W/ G& X7 @+ U" Z    cmp     al,4
8 H  t: {* Z$ o% \8 R: t    jnz     SoftICE_Detected4 R) t8 U- I- w) t8 Z) U

/ Z3 Z: X9 F2 }! Z7 r  W+ c5 {& Q___________________________________________________________________________9 b, O* l$ ]6 E$ l! p% z# O2 v
0 u9 H3 V% s+ I) E9 ~( n' z* Y
Method 02
9 u9 x- ~9 @5 k- n=========8 h, E/ |7 W/ K5 H# o, k9 v' `

7 V. ]3 |, f. NStill a method very much used (perhaps the most frequent one).  It is used+ C' u' @' J) l# o
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,, ^/ |! e$ f* H
or execute SoftICE commands..., ]- u, W: J/ v$ l$ k
It is also used to crash SoftICE and to force it to execute any commands
. v. H) `4 p. P2 P& x8 k; `, O(HBOOT...) :-((  9 d6 _7 j; ~6 Z, f  K$ C

- S3 ^: h) \, I, BHere is a quick description:1 ?2 P1 ^; \1 w5 J* n2 y
-AX = 0910h   (Display string in SIce windows)5 o1 e1 d5 e1 j2 i
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)7 \: v( q" g7 b: F/ n0 ?
-AX = 0912h   (Get breakpoint infos)
& E$ m  a8 {  z) j9 _4 Q/ l2 V) _5 y2 i-AX = 0913h   (Set Sice breakpoints)
- Q; a: ^$ }. ~-AX = 0914h   (Remove SIce breakoints)
" `% `$ ?: `$ v: D7 l2 Y5 }3 a1 p, U) k( I% \$ [7 s2 A/ z3 B
Each time you'll meet this trick, you'll see:
  n) u. S  y2 h( P# N- d" W# A-SI = 4647h' w& B) K" Z6 Y
-DI = 4A4Dh( T# j7 g* F& n4 G
Which are the 'magic values' used by SoftIce.
3 C0 I: q( i6 x" h7 VFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
8 Q) f0 l4 f: h0 C9 g
3 G# H8 j, v2 {+ X3 w8 pHere is one example from the file "Haspinst.exe" which is the dongle HASP3 H3 ^  ?7 ~/ }0 C! ?8 |) W
Envelope utility use to protect DOS applications:2 l0 e3 A3 [7 G, t

1 B' V0 a2 ^. Z+ [9 D  e9 Y3 h) O1 o# z8 P/ O: b0 o4 r
4C19:0095   MOV    AX,0911  ; execute command.
5 e3 B  E+ L$ g1 z+ O- M4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below)., z  X" q7 ]- i) B- I
4C19:009A   MOV    SI,4647  ; 1st magic value.0 X( e% Q" U, S& v( U& |) z8 {
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
! w; H4 C) T2 {7 v4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)# r6 t0 x4 N( _( `. u
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute5 \5 s, [/ u3 W/ Q9 T7 g, X/ R$ }
4C19:00A4   INC    CX
+ T  s* f+ j" k4 `! @4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute) _  D' F" U: j  N" e
4C19:00A8   JB     0095     ; 6 different commands.$ O# g. r' g* e, Y
4C19:00AA   JMP    0002     ; Bad_Guy jmp back." R: r! W0 a3 j" r1 G, }/ w3 k
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :); r- f$ `" N* Z# c5 Q' h* A9 f" V

( B, p0 n( b- K1 \. uThe program will execute 6 different SIce commands located at ds:dx, which
& Z* ]/ G) P! s) j  Qare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.+ J4 S" X. j/ U- W0 @3 J, E
$ O6 C8 `; {+ ~
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
$ p$ L2 Q9 K: q1 S0 E___________________________________________________________________________
3 i! |: E8 W$ \& G0 c+ e; W
& y$ J4 K6 c$ r) R' ~
2 S5 u; E1 c) _6 t& y7 p$ G; hMethod 03
" @  @" }  f4 l, I4 M& j3 f- x=========3 B2 i- Z: J/ n9 w/ F. q

. N5 S7 q. L" R2 |* H, e& ~; s/ aLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h! _) b6 s; E( u2 B" c# s8 K# \$ F
(API Get entry point)
1 C8 m0 `1 ]. H        
; \- G. z( y' w" F: A! |. V: Z
8 @* p( L  x- S' Y7 b    xor     di,di% @% i% E5 r4 g& e
    mov     es,di- k3 y  B  ?7 L2 ^
    mov     ax, 1684h      
. a+ u* j; P- q    mov     bx, 0202h       ; VxD ID of winice9 f% w& n+ }# N- Q$ G9 E7 ~
    int     2Fh( V0 f0 U* \2 M. ]
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
  W; ]2 z/ C9 s/ y1 h; Q    add     ax, di2 y9 v9 v2 D6 p3 F9 ~
    test    ax,ax
7 z2 l4 ]/ s( X3 ]! I5 T    jnz     SoftICE_Detected
7 Y: C5 o. ~/ a% R
7 o9 B1 B% g9 A! R4 f4 P" g___________________________________________________________________________
( ~& {9 k* J5 N- Y. A% f5 o2 v) s
! V2 p: v  r6 U, O, kMethod 04
; g1 L" m  t* P! [3 G8 s=========3 D! G! T% X- m% E

6 s; a3 ]4 a5 v' S6 u5 eMethod identical to the preceding one except that it seeks the ID of SoftICE6 W0 T4 ]; J% h- B* `# c
GFX VxD.
+ @% M- [( ~& a. W4 U* T9 t, T) Z+ l
/ B9 Z  q% D" x, R! e0 w! @# t    xor     di,di
& t- k" R! J7 E    mov     es,di* s. s3 L5 T5 E! ~
    mov     ax, 1684h       . T3 E+ v0 {2 G, l. o9 |, i
    mov     bx, 7a5Fh       ; VxD ID of SIWVID
8 G, Z# l; D" E6 Y! p8 a2 G    int     2fh
/ G: \7 u, U9 G0 g$ i    mov     ax, es          ; ES:DI -&gt; VxD API entry point
* u% |# W+ V% k) V  E    add     ax, di
% t: Y( n+ J7 O    test    ax,ax! m: Q0 D- n; r' ?! s! ]) |
    jnz     SoftICE_Detected
9 p' J# f0 R" h; t$ |; v7 A
( ~0 }; [, x( l! u, ]# _. {__________________________________________________________________________
" J1 a! a& w- z4 Z) ]. O% G" Z

7 a* O$ Y  O& h: ^; VMethod 05
. C! S- }5 W5 d- Z=========3 e* M4 E8 r+ m4 I3 E( v) n: c) F
% H' p1 [/ t$ l2 s# s+ N" l
Method seeking the 'magic number' 0F386h returned (in ax) by all system! u' b3 f( q; e
debugger. It calls the int 41h, function 4Fh.
  C6 y% B& A: A0 v0 _, H/ sThere are several alternatives.  3 T  m; r6 T0 Y% P, L5 e! \8 t

; C; o# k  j& G0 s9 N4 nThe following one is the simplest:: r: ^0 v: I' x) v
; p( [, B& a: `. O6 M: m
    mov     ax,4fh
2 p7 J5 l. s+ Z* X1 K    int     41h
, p! v  [5 R* j/ Y# F1 [    cmp     ax, 0F386: Y! S& ~7 ?: [5 v
    jz      SoftICE_detected
& S! o3 }& R8 N! n2 p) u
' Z& M' {  T' z
" P0 }- a1 L* r7 }; R3 R0 ~Next method as well as the following one are 2 examples from Stone's 1 s0 d$ \7 a8 v: B0 P+ O+ @
"stn-wid.zip" (www.cracking.net):! G# o2 p$ o( V+ E

% O) |* X' U5 f6 s0 ]3 _    mov     bx, cs, P, k; ?+ Z8 C" i3 _+ c3 P
    lea     dx, int41handler2
* q& x  {1 O3 O6 m8 ]/ P    xchg    dx, es:[41h*4]
0 k7 b9 T/ m2 A4 s1 P# z* S( V: A2 A    xchg    bx, es:[41h*4+2]
* H' O  Z# v' e" f+ s    mov     ax,4fh
. f+ R; Z9 P$ V. c' X7 `0 e- d    int     41h" n5 h! d  `4 A3 ?) U0 F7 J
    xchg    dx, es:[41h*4]
2 |$ y& f5 s9 U% Z1 W    xchg    bx, es:[41h*4+2]
: Z' }1 c. ~3 L  T: D    cmp     ax, 0f386h
1 g, B8 X8 ~) K# r4 p' w* C! }    jz      SoftICE_detected
" V" Q% C$ U6 Z1 E7 [2 _6 t+ o; m3 {9 q% o* [, g7 d5 ]
int41handler2 PROC
3 S' U; \: B; W( }: c. d: n2 `    iret
7 M( \- g, @" A* Vint41handler2 ENDP
5 j0 C+ }) L* b3 O9 d8 c! o& O# a1 E( |4 ]

; y' s. N1 w  e) R6 L' \_________________________________________________________________________
3 ~! N0 w7 y/ X
$ x3 g( R% B- F$ ^. J- K
/ a7 {; n5 n" M7 v7 rMethod 06
: T+ l4 k8 N4 `. g0 f/ ]=========
+ L% W, R* V9 Q3 l/ w" ?! ]0 U# L# f$ [, b, v0 H5 z

  V1 \! h9 b$ w& n# d7 v- Q2nd method similar to the preceding one but more difficult to detect:
5 _4 n" v5 U& A8 h+ c. `
& g9 h' E3 b4 G( J7 {8 c3 N
0 M/ V) U0 r4 Q& B; m2 z! jint41handler PROC
! R5 K: U% w; W% ]' T4 T    mov     cl,al2 t) m: ?9 C8 [4 T/ h2 M
    iret
8 B4 W6 O  v9 r, b* oint41handler ENDP
1 u7 O/ j6 H* D& ^; G! M' a& B( p* W! p1 x
  P8 V. E. b3 e/ B
    xor     ax,ax
3 }, U0 D; E+ U: L7 B* C- A    mov     es,ax# d, }2 n. x/ L1 b& j* ~1 ^
    mov     bx, cs: J6 o7 i" h& L. r* v9 I
    lea     dx, int41handler
" h# |) H. e5 g" K% a; G    xchg    dx, es:[41h*4]
: t7 _) U" S6 r6 s  y  s7 g    xchg    bx, es:[41h*4+2]6 Q4 C; N2 e7 Z, t! |- q& [
    in      al, 40h
/ i; O, n" M* d! S/ }" _9 M    xor     cx,cx
# P" ^$ m$ D8 G) L2 @$ i* g# c: U- J    int     41h( @% O( u0 d$ I. X# |
    xchg    dx, es:[41h*4]+ N2 }8 O3 N  q/ F) d) D4 J* o
    xchg    bx, es:[41h*4+2]  |+ |% P  {) M% C6 a
    cmp     cl,al4 P9 M8 h% T3 s! \9 [3 T& C. X
    jnz     SoftICE_detected
( ^, ~2 d* Y. Q+ x8 h8 a) _6 a. s$ ^( @! k1 H5 ]
_________________________________________________________________________
( K$ C" A5 ~& e0 R! i4 k+ {6 f& l' j0 P! m$ r
Method 07
/ j. b7 t# T# ]* \. V=========+ o8 r9 x6 B" e2 _
% i# p$ a3 `, }3 ^
Method of detection of the WinICE handler in the int68h (V86)# j: t  X) ]$ q* A" R9 ~( s
. r$ @8 [- }$ `7 z" s6 ?, `' K. k
    mov     ah,43h. ^7 z% s, o- {% w; G
    int     68h
4 B5 P1 e( t- `& B1 k' S    cmp     ax,0F386h- k* s, @) |7 E
    jz      SoftICE_Detected, w0 W: c( l' j+ f7 M8 Y

0 O  T' r+ X" A+ E$ p0 U* F/ C3 K# Q, u0 R# z% B
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit' d6 E# R8 G% _3 I) [
   app like this:
, E% V7 T3 Y4 q; O# f4 w# D" I2 y2 n1 `6 g+ u
   BPX exec_int if ax==68' P3 x% f) {8 u, W$ G
   (function called is located at byte ptr [ebp+1Dh] and client eip is
( s. \% v" W7 t( k6 Y   located at [ebp+48h] for 32Bit apps)$ D- z- h% \8 R
__________________________________________________________________________7 C' n/ e# L' q8 s

4 c! I( ]" a0 R8 v4 S# X1 d0 A- C  L% z1 M0 ]1 J
Method 08
' Q4 l( V  k( O) H& ^. ^& t=========
8 O0 E4 s$ V  A& E: N, b) v2 F- Z) B# P6 k/ K5 @
It is not a method of detection of SoftICE but a possibility to crash the. |" j8 k: F, P* j7 |6 {3 F
system by intercepting int 01h and int 03h and redirecting them to another3 C6 {4 n: o5 f$ U/ s/ h
routine.8 q. `6 V" s+ V6 c1 w' M
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
  K9 o# e0 i* ?7 n0 pto the new routine to execute (hangs computer...)% O! u& h4 ^. L+ k+ b

$ k7 ]: M( t9 ~- X9 u" o, A4 ]    mov     ah, 25h( u6 e- }% C2 E% S5 W
    mov     al, Int_Number (01h or 03h)6 \4 j6 @! Y- b. _# t, [% C
    mov     dx, offset New_Int_Routine9 ^) u4 ^5 s1 o: v6 \. M; Y
    int     21h
( Z. D8 q) C1 |& _5 Y" z$ I/ h; E1 Q9 R
__________________________________________________________________________
; \2 J1 `0 F* V0 ?# q! f
: Q; i$ ]9 q! O9 B2 t& `9 fMethod 09
: c7 H% r. A9 O* }0 z=========2 A+ c' K6 W5 F7 @; W9 L
) Z0 x  p4 Y0 k, B$ h. V( \3 M! U8 z
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only0 a& F; N3 w  X
performed in ring0 (VxD or a ring3 app using the VxdCall).
/ ]; K& k$ L0 @3 mThe Get_DDB service is used to determine whether or not a VxD is installed
$ k& a3 p& F! K2 O; Yfor the specified device and returns a Device Description Block (in ecx) for+ @2 }& O# t; m4 x
that device if it is installed.
" O; ~3 [3 s4 ]
. P' U+ {5 N* S   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
# {# D! ?6 r; N   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
+ J  ^0 T2 O2 L6 e   VMMCall Get_DDB
1 G$ k8 ?+ h* q& A2 K) [   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
+ Z' Q7 s8 A9 ]2 y$ |8 [
: H0 s8 E7 N* N! y: uNote as well that you can easily detect this method with SoftICE:- U5 y5 r& @6 u" `/ ~+ P  V% N* D4 M
   bpx Get_DDB if ax==0202 || ax==7a5fh
, I7 m1 I3 X" c
9 Z( Q; g7 E) i- E* r__________________________________________________________________________0 w- i, M6 O) p/ g& e  W& y, h

& w9 N1 c8 M! g4 ^* \9 DMethod 10- w1 M, ?" o. v( V2 a! `. {
=========
8 g3 r. p( W9 s: A5 w
5 _  w# Z3 ^3 U& y8 M=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with: E' z$ @! h% x! i
  SoftICE while the option is enable!!
/ r1 ^, @" n3 K7 ^* y3 _7 ?$ e# ~! B. P; e/ i  o
This trick is very efficient:
8 H, |+ v; F3 V5 lby checking the Debug Registers, you can detect if SoftICE is loaded
4 S9 I/ r+ h- E+ L" Y3 L(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if$ n, o  x+ c& w4 w  z9 @
there are some memory breakpoints set (dr0 to dr3) simply by reading their
9 ]1 x4 i# g$ \& L0 V; T$ ?, Wvalue (in ring0 only). Values can be manipulated and or changed as well
) e/ r% V0 r' |- U( D(clearing BPMs for instance)% E6 _  j* g2 R+ I- q/ |. D% C

  M5 ]3 h7 U; g. D2 u( ?; u1 E__________________________________________________________________________# X6 d' A" @7 W) u# V) q* g! I
* U0 }* l+ p& Q* o: _
Method 11' }: |+ i) B- I, T# Y' N4 Q
=========
" i% F4 b5 b7 e! g/ m; _& k3 |9 w$ G4 F/ L
This method is most known as 'MeltICE' because it has been freely distributed: o; h% E. N5 t6 _  H5 ]
via www.winfiles.com. However it was first used by NuMega people to allow% s6 y0 k5 Z' H9 t! ~# P
Symbol Loader to check if SoftICE was active or not (the code is located, _; r. e" E: a9 P
inside nmtrans.dll).( p7 Z0 O- A% A) a7 O5 X
7 C! q2 e8 H% W# s0 c
The way it works is very simple:
  G6 K" r# O% W: Z# OIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
8 c7 v6 w: m( d- Q3 M7 DWinNT) with the CreateFileA API.
  w" w0 @! w6 a5 ?6 X1 p6 [
9 @/ `7 u; ^7 O% {) FHere is a sample (checking for 'SICE'):
) W2 W; V" p4 z' h5 n
0 a* D2 _( K! R6 {BOOL IsSoftIce95Loaded()
2 S& R& O  R& M{8 ^" H1 L; f  M9 g% M
   HANDLE hFile;  . }( K/ N* \. T0 {
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
8 P( M" n! f# w- g, P0 t$ J                      FILE_SHARE_READ | FILE_SHARE_WRITE,
9 R/ \0 h  V, g" d$ G                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);  c+ ^$ g* J/ s5 i
   if( hFile != INVALID_HANDLE_VALUE )
5 e' m7 k0 y+ q, y! Y, ~& }   {
5 @, ^/ |: y7 d. @; l+ T      CloseHandle(hFile);
: W( R0 u! h: m& M- K- C      return TRUE;( K/ c4 ~$ L0 J# v
   }
7 g1 D( y  L" a& o- Q! n   return FALSE;: t3 |5 u# w9 H
}
! j8 S3 n+ C9 S1 E
7 ^, c) _0 `6 e0 y4 x# VAlthough this trick calls the CreateFileA function, don't even expect to be
0 G+ }$ Q; b6 y/ S6 l0 A4 `+ Q% Zable to intercept it by installing a IFS hook: it will not work, no way!
. S) M! A" ?3 \In fact, after the call to CreateFileA it will get through VWIN32 0x001F/ T8 A: {9 Y! h5 T; [) o3 X4 `
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)6 X  x& k  I. o3 _' E; i
and then browse the DDB list until it find the VxD and its DDB_Control_Proc  q8 q- ^+ p, F7 W& Y1 w
field.
# `$ h1 Z) ^: HIn fact, its purpose is not to load/unload VxDs but only to send a
5 ^7 C& M! r* T/ k+ E( y1 T5 HW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
- f  y& i% W6 U, v4 q; J' Ato the VxD Control_Dispatch proc (how the hell a shareware soft could try
6 j) j6 G4 Y3 U9 U9 Dto load/unload a non-dynamically loadable driver such as SoftICE ;-).
9 u* p- E! x' \If the VxD is loaded, it will always clear eax and the Carry flag to allow
( K* g- ?4 w1 e1 \7 l/ @its handle to be opened and then, will be detected.
2 k& C7 x+ F: j1 x/ K+ g. [- }4 UYou can check that simply by hooking Winice.exe control proc entry point
2 R0 T; ?( p# ~$ ?! P3 \% nwhile running MeltICE." J7 Z3 L: L8 L9 F* y& A# q$ R
6 N2 \, a" ]! i

9 I( Y: b0 i+ r% [$ a- d  00401067:  push      00402025    ; \\.\SICE" A8 d4 R/ M2 b4 X
  0040106C:  call      CreateFileA
2 u; l, M" K& m% W0 e) j. _2 y  00401071:  cmp       eax,-001
! w3 K4 @  X, J/ \) y) J- v  00401074:  je        00401091
- N9 j: C+ s2 C2 ~6 P- Z; l7 K% @0 e
4 q3 E6 |9 \/ {8 X' e+ b3 p3 l7 a
There could be hundreds of BPX you could use to detect this trick.
0 x7 N+ w$ @7 l9 i-The most classical one is:, v  ~2 w: B9 C2 @3 O
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
' y. v! O  F  h; j- ]    *(esp-&gt;4+4)=='NTIC'
: F1 G- t; |9 e2 F5 w# r+ |3 g$ }$ z1 j  U2 f( f- ^
-The most exotic ones (could be very slooooow :-(# g9 G  G( @% ~7 v* W' R' ?
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
  x" `9 a: r8 Y, L# E$ H  w- F     ;will break 3 times :-(. m5 L& A9 M, A: }0 U

& s. L+ g6 p8 L2 E) u6 ]; E8 O-or (a bit) faster:   i1 }; Y) L7 L6 T4 H
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
. v1 |( |/ {/ S2 B+ W# {8 a9 g4 d' G/ o1 f0 j" r- V2 Q
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  * }2 _8 O% X* y* ?0 {& {1 E5 b3 X- |
     ;will break 3 times :-(: ?6 N! ], g( O. D, I3 e$ v& e

3 G+ H& X7 R2 Q8 |-Much faster:
. |6 H( h" F* ?+ J   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
: l+ @* J, s8 [3 @2 }" u5 g
3 W8 ^  K7 `' c* ANote also that some programs (like AZPR3.00) use de old 16-bit _lopen
! a7 y, b- ^5 H; dfunction to do the same job:& A' J; I* [% X1 J4 ~8 n7 ?

- r5 K4 `# P- K5 O2 W: y- |   push    00                        ; OF_READ& k  b+ n9 U' v) x5 P
   mov     eax,[00656634]            ; '\\.\SICE',0
! w, s+ C3 x  D, I0 B! J+ A/ z1 b   push    eax" W6 D" w, [2 H0 X
   call    KERNEL32!_lopen
" E( X* h5 _2 y& c9 e   inc     eax
# \% T3 I5 u$ [9 D% ~   jnz     00650589                  ; detected
( S$ [6 Y) g1 ?4 |3 }   push    00                        ; OF_READ
5 M2 V% _; M7 W3 a) o" Q   mov     eax,[00656638]            ; '\\.\SICE'
. ^& u' B: \1 _. G  v( q   push    eax: U1 t. T/ C1 P+ H5 l6 T7 u
   call    KERNEL32!_lopen
* y8 s2 E5 G6 E$ p   inc     eax  z6 ~% X1 |/ P2 Z% c
   jz      006505ae                  ; not detected0 k$ r8 d0 v8 |3 M# E. X
+ G  B+ i% ?5 |) m, [1 x; ^/ u- l

. z0 T& x+ @; E/ o7 o& Z__________________________________________________________________________
3 p( s) H1 x; o
4 k1 B0 v( ]; D- gMethod 122 k2 k/ q+ Q; H# r. J* z; D. b5 q
=========
, |- i* H0 f  i. h; t( P) u  S: p4 }1 T* i
This trick is similar to int41h/4fh Debugger installation check (code 05
/ |% {1 m( S$ E! y5 K&amp; 06) but very limited because it's only available for Win95/98 (not NT)$ V1 p& W: F, ^  s, g
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
: _. t& [5 E. d& ~, }  `9 V0 {# O3 }; {/ x
   push  0000004fh         ; function 4fh) f% e: r0 L! g. H
   push  002a002ah         ; high word specifies which VxD (VWIN32)# X# H2 c) F- A* X& g
                           ; low word specifies which service
0 I3 E% Z% O# z                             (VWIN32_Int41Dispatch)3 \& _+ V1 W9 ?3 y
   call  Kernel32!ORD_001  ; VxdCall
  a: W- }% ]. H: d0 A   cmp   ax, 0f386h        ; magic number returned by system debuggers
& P+ N5 h$ |$ @. |8 v   jz    SoftICE_detected
+ l& J: R# E. y) t* F: v, k
7 _9 J/ N- V8 ?4 v# k! XHere again, several ways to detect it:
% E* A/ |/ @: o% |3 S2 G/ Q9 s5 V' q1 k( J7 e! i7 D
    BPINT 41 if ax==4f
- y- M3 g( i- n2 m& i2 C, e4 X
8 I' r  Y. H& `) C* U# \1 v8 n  J    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
! B0 z, R) L" {- A' u# T* ~6 c/ a
. q9 v, m( }3 I0 k3 g    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A" N2 ~8 N6 x5 G0 g4 S8 c

) s$ T3 r6 H' W1 y    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!9 ^9 h( j3 ~, _9 U  a/ t$ Q

$ o) ~  M' W+ u__________________________________________________________________________
3 u# p  N/ M2 @6 P9 c$ h, z+ ~* n" N, L0 j
Method 13
! Y* f/ y4 }) }' n0 @=========
* ^1 @7 Q8 q  T! J: ?4 w' [& f- o. q) {, P6 R7 Y! `4 {
Not a real method of detection, but a good way to know if SoftICE is8 `. l2 E( n5 v$ h
installed on a computer and to locate its installation directory.
& c0 d1 v" J; y& A, \0 MIt is used by few softs which access the following registry keys (usually #2) :
; b( m! `; v- {% m/ w( o& D6 q7 @3 I/ p9 ^  T$ d
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion$ @# g, P( X( }6 B2 J
\Uninstall\SoftICE4 |5 N7 P0 J" v/ X0 E
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
+ w! N* q: Q9 j: Q/ G; [8 H-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion$ v) k& n$ _, ~
\App Paths\Loader32.Exe
, c4 d, C9 }4 {+ c# H% }
# ?" R* f! B& N( I( T2 n0 M1 V; t- s
Note that some nasty apps could then erase all files from SoftICE directory. l+ P% Z( S1 F
(I faced that once :-(0 A. L: q* x0 e1 Y1 |8 U' B
: T/ u: V' r7 q7 M, N' Y
Useful breakpoint to detect it:* d' R6 E/ J6 S  T  S$ C  ?

- {' z9 G- i5 A) z: M5 Z     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE', q$ M) ?6 f" @/ n* @

$ Z, X' H# q% W1 V: u% p; o+ |; g__________________________________________________________________________6 x  R9 s/ A: [0 d

; N$ k) s/ n/ n& {, ~! k9 l; [; @0 k
Method 14
& v+ m  M$ t+ M! f! B6 J. g=========
% J- d) m. `2 J
1 y& [3 f) Q: \1 t  y: V  ^: ^& {4 ZA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose. R' {8 k0 C4 X$ ]- X7 T! \
is to determines whether a debugger is running on your system (ring0 only).9 }! j6 k$ P9 l7 g( L

7 N* J3 X+ R( d/ k. K0 y; Y$ I   VMMCall Test_Debug_Installed
. Z, p7 h" y; j5 p( J/ i% Q; J% q   je      not_installed2 r- {' U% |% G5 n+ E, n1 B7 F
. y% E  h! v; Q- j" _7 U- t
This service just checks a flag.
- v& M* o8 G. W& D</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-7-27 08:08

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表