找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
2 Q. V4 _) B! }8 I' c' T- _<TBODY>2 ~; `9 E7 ]' N* S: ~- ]- ]* p
<TR>
) x( J/ B( |" n<TD><PRE>Method 01 " `) J" \* I+ ^$ Q9 h
=========
0 W# u: r, h: V  A% M7 F5 u: c7 U6 y* z; p$ I
This method of detection of SoftICE (as well as the following one) is
) h2 [1 o: s% F8 q6 f1 u2 Aused by the majority of packers/encryptors found on Internet.! o, [8 N4 z  {) b0 u9 W1 |3 v! g
It seeks the signature of BoundsChecker in SoftICE6 k- X4 l% P! U, r, B% B7 U
2 X0 i" @1 W0 n% y  T" {
    mov     ebp, 04243484Bh        ; 'BCHK'- {- R6 j) r6 s" P( l: }& C
    mov     ax, 04h- t1 G, S* X5 M) s) \# W
    int     3      
: n0 G8 I9 i6 ]3 v- I7 _8 I' t    cmp     al,4
" E' s( l- |1 Q2 l- M3 C. p0 D    jnz     SoftICE_Detected
7 V( Y) D+ n4 E& e6 ?& y
# q: ?# p( d2 j" L: e/ `" S___________________________________________________________________________
9 v' f0 Y- T) E5 q( k, Z; c! b' `
" ~/ s4 m+ o8 s" L/ G9 I+ S2 GMethod 025 ~) V$ O) J" ?5 R
=========
) Y, e4 v2 v, g( c4 S' n0 M) m+ K0 \: C9 C5 B+ V/ q
Still a method very much used (perhaps the most frequent one).  It is used
6 M2 w6 ]6 C  v$ n+ R8 I+ E6 sto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
# q! ~8 @1 }+ Q  Gor execute SoftICE commands...5 i, ?/ m0 a8 q# ^; p8 [+ Q  m* x! B
It is also used to crash SoftICE and to force it to execute any commands
% o8 r2 c7 {( S$ B(HBOOT...) :-((  * p: G* }; i3 ?: M+ i, W

# e8 P- J) k0 |( O$ V& XHere is a quick description:
, T: w4 O0 l( y/ x( T-AX = 0910h   (Display string in SIce windows). G; [" o2 y$ f$ m6 \
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)2 C) y' A$ O& l: b- z; @
-AX = 0912h   (Get breakpoint infos)5 j) J  ^9 c. @- b1 O
-AX = 0913h   (Set Sice breakpoints)
; F1 ]% A$ X/ t/ J) {( k-AX = 0914h   (Remove SIce breakoints)+ }2 R$ d, w. i. X2 a, Y

1 U5 s, q% |4 g7 w* wEach time you'll meet this trick, you'll see:
3 b6 S9 P, _7 U7 w0 u) g4 A! h-SI = 4647h
7 z+ l& z1 R" G-DI = 4A4Dh; {# J3 ]( [6 d1 b, h9 G: H& i
Which are the 'magic values' used by SoftIce.* C) b. d8 o: X3 n4 `. j
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
8 \8 O3 x. O1 O% a- r
1 w1 U1 X4 F- f  X7 GHere is one example from the file "Haspinst.exe" which is the dongle HASP& D- O8 W+ |5 f, Q
Envelope utility use to protect DOS applications:9 i) G, @2 b8 b) F4 @
+ X3 I7 G- M8 D( ~1 C$ ]

! e3 U! m+ |* J4 g3 n4C19:0095   MOV    AX,0911  ; execute command.
$ B4 p5 D7 m; v8 T1 M9 x4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).5 n9 V- m; F) G7 J) C% [/ t
4C19:009A   MOV    SI,4647  ; 1st magic value.
$ i; d+ C! O# B3 i( N3 K7 l4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
+ l/ b4 T4 _9 C( N7 A- F2 H, I4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
( Z" Q$ x. z" ~9 o7 {6 c. S1 e4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute& Y6 T: J3 [6 A6 f
4C19:00A4   INC    CX
$ b$ T( C' i7 _7 K. V4 D1 n4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
& y# s' ?) C/ ?" f% f4C19:00A8   JB     0095     ; 6 different commands.$ v5 V  x& e+ H( |$ x- E/ l8 j
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
: X  y* v" t$ J5 x# e- }: a% M5 }4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)  C2 `* n9 J) I! E$ u. F& Q* U% T

+ x: G- q* b- b( ^The program will execute 6 different SIce commands located at ds:dx, which
; D$ r) `( \0 G3 Vare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
6 N- F- T3 R9 R6 _, v5 H3 B9 z. f6 R, z- \6 }# i% V( ]% F6 G
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.% _9 g' R) D3 l) B* i/ m
___________________________________________________________________________4 w! [& R7 }2 K) @  i

# O/ s, K' z* @/ S/ v# Y9 y
  }9 d4 ?% A2 T7 VMethod 03
; M0 T; s2 E" z- ~6 N: p' D( `=========8 ]" B% h% L: X  ~: \1 p: s0 v
- d% o7 ?  p! |7 X/ X3 G. f
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h. Y; W  p8 X4 g$ v' ~, O! r! `# f) d
(API Get entry point)9 L- A+ R. B! ?& \7 V2 [
        * E/ L  C. s$ O# }$ x

4 `4 `- h. R' u  I0 u- _    xor     di,di
* M& ]& f# ~* N. }5 l    mov     es,di# @% r# }2 ~% ^% r
    mov     ax, 1684h       # P/ ~2 y1 O% |: a. \
    mov     bx, 0202h       ; VxD ID of winice' t* p& V2 x3 I. v, `
    int     2Fh
7 p0 U" X& j0 _0 n7 A    mov     ax, es          ; ES:DI -&gt; VxD API entry point
0 V! V6 M: h& R: S0 u  z7 U    add     ax, di: H6 R$ I& I# J
    test    ax,ax
, c; P& l3 y+ j8 J    jnz     SoftICE_Detected
: u$ Z" l. t* l9 s6 S+ n- D( t# A# B  o3 v* F) \( h
___________________________________________________________________________
8 d% s$ h, L3 e( C! u3 d1 I* F- _5 y
1 e# K- d2 o; Q$ T5 }Method 04
3 d& ]# `5 F9 m: v5 _5 R! W=========! x2 M. \5 |7 E1 ?1 k. u2 v
# H" c4 W7 b% ^# Q4 J$ I
Method identical to the preceding one except that it seeks the ID of SoftICE
( q/ `8 B( W7 P; K) UGFX VxD.5 g! M  h1 f& O% i7 W5 M- f

1 g/ s! P9 Q3 o    xor     di,di- V% a, G# _/ |
    mov     es,di
' b/ y& v9 U/ h5 \  Y/ X    mov     ax, 1684h      
& W! x* S  H# Q; s- H8 e    mov     bx, 7a5Fh       ; VxD ID of SIWVID: T* i& ]' g  G; J4 G. D  c
    int     2fh- v; D$ p9 f- p1 I% v, ~
    mov     ax, es          ; ES:DI -&gt; VxD API entry point$ g9 D# B8 H% F
    add     ax, di
( f& g$ X2 K7 [! q7 H' ]8 ]6 u    test    ax,ax7 ^  K1 A% V; B" A' r/ ^$ W8 D
    jnz     SoftICE_Detected1 o7 }2 Q+ g- U3 ?
' D4 l( u5 m/ [5 ^; ^; U& n' k
__________________________________________________________________________; {- G0 O1 p7 e" P" m

2 `1 M$ G3 B$ T7 b3 d. _9 W( U1 L4 p. i( c0 W
Method 05
/ y1 A# N" c& U' b# d4 h=========
1 j* a+ y. T% y6 T) ^( J! d
" \$ l; ~% D% S9 x* }Method seeking the 'magic number' 0F386h returned (in ax) by all system
, O+ H) U' v9 d5 b9 _" s5 s# |debugger. It calls the int 41h, function 4Fh.
, o) g+ L. A$ o* r' u7 CThere are several alternatives.  ' k$ R+ R& A/ v  ~2 Q
0 O) G- ~6 o4 S% n; i
The following one is the simplest:
2 ?/ X; a" q9 h/ Q; M
& Q: ~! }/ Y! ?, o    mov     ax,4fh* U) k- [# x, [$ ~6 E! z
    int     41h
7 [; A4 K' h" |; ~! q# A    cmp     ax, 0F386
+ l! ]/ D5 \6 o- Z" z% d5 v. g" b    jz      SoftICE_detected
- m6 C$ m0 X* n, i) O( m% u
9 c6 F: K; L) Y8 [+ t! _7 P/ ^9 w& c
Next method as well as the following one are 2 examples from Stone's
2 j, K; A1 @( S9 |) l"stn-wid.zip" (www.cracking.net):
' v9 f- O/ A- n/ R3 i
; c$ O$ Z& D! _# V4 J    mov     bx, cs
! A9 F. [6 x6 F: p    lea     dx, int41handler28 L4 a+ \  l/ V4 Z( }. R2 q
    xchg    dx, es:[41h*4]
! G1 O/ U5 |) z8 Q- B( @$ @7 i" L: M    xchg    bx, es:[41h*4+2]
, P. T  z5 [/ K" p" p! M3 {    mov     ax,4fh
& e  X) `9 n4 I; M6 D7 V    int     41h
. `( b( a" B, c2 y    xchg    dx, es:[41h*4]
4 @" L! Q& f* p8 E1 y    xchg    bx, es:[41h*4+2]1 }/ H6 ~3 _  s$ b9 C2 K/ Q  b
    cmp     ax, 0f386h
& Q; h3 N2 p! O  t0 E6 W3 s    jz      SoftICE_detected
5 X! R9 b+ e3 C- N, {+ i9 n. p1 l* O
int41handler2 PROC
( c3 m, [% L1 K; A0 @    iret" [( W" q9 j9 s* O
int41handler2 ENDP
9 ]& W+ s1 _  I( _0 @- E# S; @8 S* G# f# M2 z" r6 g. O

- G# M( Y7 l) W9 J: U_________________________________________________________________________
" Y* W- D+ d# L# P/ k7 [
; s# ^  H1 Y$ u& j& J; F' l* W8 R0 R' B; y2 a
Method 06
. x+ Q) S8 q: u) _( u3 C2 S3 \" \=========2 w/ `7 {* V0 k% R: ]8 w6 J( D

: t4 W" b6 x* x  y) w( F# M" z, y3 J2 h7 e; H; J" H; w
2nd method similar to the preceding one but more difficult to detect:
" `; Z: T7 t# {2 D' G8 ]8 x& l, d- Y+ _, f6 P

+ N0 H! W4 _* [( c% W6 F2 T% Bint41handler PROC. E( u2 H! |  P& N0 m: ]' N) i: i* ^
    mov     cl,al+ y. t/ U1 \1 o0 ?. D- ^( }9 \2 b
    iret2 K% o, E; d) o1 Y
int41handler ENDP0 x2 \- g/ A5 \. ^8 j( \4 E" b

7 J  b6 E. u: a- a. |0 i3 S
: K4 y0 w3 E* v$ O% R8 o' F0 j) d    xor     ax,ax
: A" Y& E' x6 m; S' d, A    mov     es,ax
2 C0 K# x" `/ T    mov     bx, cs
( b& J% g/ Q* j1 Y( d    lea     dx, int41handler; S& k# `0 P+ L' I. S4 g
    xchg    dx, es:[41h*4]
1 P7 H+ f5 e2 A1 k/ j) }. S% e% v7 g    xchg    bx, es:[41h*4+2]
- e( D% ]# R& b  `    in      al, 40h  e; S" i% L, Z/ O% n9 g5 W; M
    xor     cx,cx
+ a6 ]6 n; m/ I5 P3 h    int     41h
9 e1 O) i- b# C( i8 R# C6 ]0 s    xchg    dx, es:[41h*4]! b+ F' N) [( s3 b! O
    xchg    bx, es:[41h*4+2]
- _4 \) x  K# i9 s9 y    cmp     cl,al8 j2 [1 Z- Q2 Q% u) a3 y
    jnz     SoftICE_detected& q6 x4 ?+ Q) ~8 h! r$ D6 k
7 e; v# q* L- S9 t( G9 c; ]# `
_________________________________________________________________________5 k7 K$ \: G! _. v, j
/ _" Q/ o5 X* @7 v, G% z6 m
Method 07
# e8 s3 p, a& R# F  r. n=========
: a& `( a) A# ~/ e( Y6 F, M
7 S  G& e, Z2 g. U4 VMethod of detection of the WinICE handler in the int68h (V86)
& u! T& g* |: q3 V' Q# g+ ?7 e5 U
: u5 f4 y' x$ L& v    mov     ah,43h
9 g; M; }' }& V; P    int     68h) t: i1 w" ~' L; Y4 X7 I* `
    cmp     ax,0F386h0 Q7 m4 }6 F+ f- v
    jz      SoftICE_Detected
0 O& O6 C4 K8 j8 U/ C4 W1 @, v/ a
) s+ G) h: Q1 Q. T- ~0 W1 ]3 L" m  ]: Y' t8 S
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
  a# N/ s/ s" o9 {9 N   app like this:3 g4 p& Y; ~9 ~) U( g
$ A+ Y' [! i5 V2 n* c+ y
   BPX exec_int if ax==68* g" p" ~- R+ ]; f0 ^% Y: q
   (function called is located at byte ptr [ebp+1Dh] and client eip is
; z0 B* R/ u! j7 ]   located at [ebp+48h] for 32Bit apps)& f( o+ C6 _6 y3 l1 e
__________________________________________________________________________
& N1 z- [( K# @: `2 S
6 D5 [& X9 ~6 j" w; J- V0 F+ ^+ f5 q7 {: [8 X
Method 08
& ?/ Q( L! l: ^=========
* C$ H" R5 C+ N6 u, @* {! d6 K4 j8 T* E0 X. ~6 x/ Q
It is not a method of detection of SoftICE but a possibility to crash the/ W" K( X& a. j- `( o% g' [
system by intercepting int 01h and int 03h and redirecting them to another
8 |1 s5 c( W5 S" R0 H# a$ I1 ^routine.
; b9 ~7 W9 [  f, iIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
2 h* Z* B$ l' q; r9 Tto the new routine to execute (hangs computer...)
5 o+ K( Q3 M7 z) g8 y
& E$ G$ q" i1 Q* M& [    mov     ah, 25h
+ d- Z. T8 ]+ I# X    mov     al, Int_Number (01h or 03h)
8 d, D  }5 O1 {6 j+ v% N2 E    mov     dx, offset New_Int_Routine
; u; ?  o' H  p+ E) e- f    int     21h9 h$ ?6 L  P2 ?/ S0 w6 @6 }6 N
+ E; m7 F% k, ~2 f5 w
__________________________________________________________________________; w. u  l- A1 B" \
1 }) i1 A0 x  V3 }( C% O. R8 [
Method 09
7 t, |) Y; S( [8 R: Z" t; U=========# @' Q( Q" N. k

( E( d* s/ p* B" @7 OThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
9 ^' e* @" Y! V0 ?performed in ring0 (VxD or a ring3 app using the VxdCall).) X4 w. I. l6 d( X5 K, S: u
The Get_DDB service is used to determine whether or not a VxD is installed, n& ?: n9 l8 ]7 ]* f0 B
for the specified device and returns a Device Description Block (in ecx) for
3 g3 }/ D  B8 g3 Vthat device if it is installed.
0 P, X. Q1 Y9 H
" D5 Y+ r5 \/ A( l$ f   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
5 K: a) f4 Z" B+ P- v8 Q4 C! B   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
  k5 Q0 \; H! ^) \   VMMCall Get_DDB+ v1 E  f, S4 C; b2 {$ a
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
- i! X# t& z  n
  @/ r$ `* }/ d4 e+ B# e: @. S% {/ vNote as well that you can easily detect this method with SoftICE:
% `. [6 x1 L1 Y# [5 w7 k4 U( T+ \, U7 R0 p8 e   bpx Get_DDB if ax==0202 || ax==7a5fh) q# b. ?# O( e" R! W4 x
! u3 S; J$ ^* x* j
__________________________________________________________________________# ]9 p+ D9 N% _$ o$ b
% u4 d& J7 }& Z7 W: x2 D' H( U3 V. T
Method 10" Q5 `  y$ U' v
=========
/ d' |8 h: j# Y! `; p2 {: q
1 j4 q+ S# Z/ [* O6 v=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with3 m. o9 L( t0 Q% D1 }" J
  SoftICE while the option is enable!!
6 C- j& V  o6 J; o" S1 [
) c, \+ D3 |; sThis trick is very efficient:& o0 T# z# o5 S: ?& w& P8 y
by checking the Debug Registers, you can detect if SoftICE is loaded2 B' J$ {( O% ?! @9 N# s' w3 v
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if# {' z+ P, J8 a, i: v" t
there are some memory breakpoints set (dr0 to dr3) simply by reading their
9 b* U' j3 Z" avalue (in ring0 only). Values can be manipulated and or changed as well. m$ y: Z$ w- b& W' I) P
(clearing BPMs for instance)
" F5 |- ~+ p. ^! N, R
; `5 \2 P4 h8 k( x5 k) t) C__________________________________________________________________________
" K: ~8 n6 p" j9 a# [# V' g- \
: {& A: E6 \/ d7 s3 d& m6 g% w/ UMethod 11
9 [6 n0 h3 @6 i- X# }=========0 W; t! H" o5 Y+ t* _8 A" P

' N/ k1 O! n2 r2 RThis method is most known as 'MeltICE' because it has been freely distributed
* V5 u8 |1 k$ h3 mvia www.winfiles.com. However it was first used by NuMega people to allow
' h; p+ P! V+ d3 uSymbol Loader to check if SoftICE was active or not (the code is located
: |* w2 p/ e' e* D2 {% B# e3 [inside nmtrans.dll).
) d( W' g* [6 y+ k! T
1 v" J/ q; H! UThe way it works is very simple:
( K' [3 I. t! V* [% rIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for+ r  w+ c; l8 {' D" X7 k% e
WinNT) with the CreateFileA API.
/ Q9 ^+ w8 v& h+ x: d
/ b  F# }& v( QHere is a sample (checking for 'SICE'):' y* @, Y/ \  k# D! k
) ]  w, `$ E3 S& H# D
BOOL IsSoftIce95Loaded(). U3 ^6 _- D& t/ O$ E
{
& J  C) L) I2 J' @   HANDLE hFile;  
; }* O, t" }3 a  V; k  v- X  |   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
% h7 `% S" ]" Z# p$ n6 q/ ~                      FILE_SHARE_READ | FILE_SHARE_WRITE,
+ N& y. O# \/ u9 P7 I# d& A                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
7 v5 U; W% i1 `5 i% k   if( hFile != INVALID_HANDLE_VALUE )
3 j4 w1 e5 f; w  Z% O2 A   {6 c* `- h) _9 o
      CloseHandle(hFile);% J2 E! C) a7 r3 l
      return TRUE;) Q& i" |* L$ \; B
   }
7 T1 z9 O8 T1 s$ o  f' m   return FALSE;( U  ~& \( o$ t
}  }4 ~3 w" d2 Y3 R, ?

% Z6 I4 a9 U4 WAlthough this trick calls the CreateFileA function, don't even expect to be
8 F# t. w. B. ?0 dable to intercept it by installing a IFS hook: it will not work, no way!
& u/ B# _) }3 r0 jIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
- _7 }- B0 ]: ]1 u& M7 C! U) yservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
, T1 K( F2 \+ c3 Q. M* A9 Cand then browse the DDB list until it find the VxD and its DDB_Control_Proc/ B5 W( {9 H! w+ }8 y7 _" X3 b
field./ J$ o+ T; Z# Q  d) l* F/ i
In fact, its purpose is not to load/unload VxDs but only to send a . ?; O8 y( L- _/ v
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
7 x- q- ^( F' G! z& A+ M, dto the VxD Control_Dispatch proc (how the hell a shareware soft could try
( k4 p: K. n+ J  k9 Ito load/unload a non-dynamically loadable driver such as SoftICE ;-).: `* A" P$ S( Y6 v& s- y$ U
If the VxD is loaded, it will always clear eax and the Carry flag to allow
+ F, h( ^3 y$ O& {$ ~- j' Yits handle to be opened and then, will be detected./ P6 [# Z' l9 Q2 R
You can check that simply by hooking Winice.exe control proc entry point
& _$ `6 v; e# C6 E; j) Zwhile running MeltICE.
/ v) p0 @1 a. j. q1 s" a8 q. K! U" \) |5 T; Z8 v- a9 ^2 G  [/ m, o
3 r0 n8 O- E/ U5 N) a
  00401067:  push      00402025    ; \\.\SICE& M* F- r: y% _; v5 F  w7 q
  0040106C:  call      CreateFileA
5 R3 d1 U; F- L- W7 D2 Y% m5 {% [  00401071:  cmp       eax,-001& U, z2 |9 Q, h
  00401074:  je        00401091
, t* q& z- u5 P2 G: `1 ~! ?0 {8 A- ~) k8 r/ m
/ }! }* Q* Z( I& f" D% g1 c! k0 R7 H% @
There could be hundreds of BPX you could use to detect this trick.6 {9 f2 [1 y6 d7 f5 f3 x
-The most classical one is:
. c: {8 C- F7 b1 W3 Q) b  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
$ q2 P% ?$ e( n( H    *(esp-&gt;4+4)=='NTIC'
; x3 z4 n! u! M7 Y$ j9 ^  r' |8 `3 a
-The most exotic ones (could be very slooooow :-(4 H/ Z8 M* \, `& b0 C8 W
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  . f8 h& u% T% I9 y: x
     ;will break 3 times :-(
6 V4 S! S/ [" G& y* J1 v; M% w# g6 ~4 ?' H4 [0 _4 g
-or (a bit) faster:
6 b5 h! u/ N0 \5 K( F   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
2 [2 m  Q9 Y* I$ ]* t; U1 I2 e7 b# b. _* w7 ?( G
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
2 V4 @& R4 X( K& m. W7 W     ;will break 3 times :-(
/ ?' O! I$ L; [7 O7 Y
5 p( ]3 T) t7 c1 ^6 ~-Much faster:
8 D; m4 k" b6 q   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
. o% m) d) t7 d4 J0 N4 V0 y
, G  a! a( k; H- k- iNote also that some programs (like AZPR3.00) use de old 16-bit _lopen1 G% G0 S1 @+ x) m  L9 S
function to do the same job:
8 y. Q0 N7 s: {$ e: |
7 \7 H  c- N, V; z  Y0 j   push    00                        ; OF_READ
  {9 x- ^$ ^/ ]- @- I! v: F   mov     eax,[00656634]            ; '\\.\SICE',08 ]8 ?9 S" X7 ~6 ^
   push    eax$ s% i: V8 y/ F3 s
   call    KERNEL32!_lopen3 p) C2 P  E7 ]- Q7 |
   inc     eax7 Z" W2 N2 a/ |
   jnz     00650589                  ; detected' K5 p' ^$ h9 y5 T/ o5 S
   push    00                        ; OF_READ
; }1 \( r2 ^" C' C7 I, s1 K4 F% R: G   mov     eax,[00656638]            ; '\\.\SICE'
) l0 X6 E- n* Q* I0 E' P   push    eax
+ e; \+ N  _6 K* j: \/ e/ y   call    KERNEL32!_lopen( G+ f6 J, `. w) E, J
   inc     eax: x: P$ k3 q. t: a
   jz      006505ae                  ; not detected3 I: s% @. }7 \3 |3 ^
$ `' U; m, Y7 h% H- I1 C% S' W4 f6 p

: y! M4 }. q; r6 Q* o__________________________________________________________________________
8 X# z. h0 ?3 f& D
' G6 P( {# Z) A+ t( {. HMethod 125 x2 i' o8 M3 e$ {
=========
) p# z6 q7 Q/ y: n% L1 J  k" @" i% X  S2 h$ }% c# g; b
This trick is similar to int41h/4fh Debugger installation check (code 05
7 B6 W5 C8 \, [5 m# [1 p; s&amp; 06) but very limited because it's only available for Win95/98 (not NT)
; N6 }4 r& S6 f1 O( has it uses the VxDCall backdoor. This detection was found in Bleem Demo.
2 [$ U' f( n& M' o3 k0 B
7 J. U4 ?: q% N   push  0000004fh         ; function 4fh
7 Q+ G, j, N2 v9 l   push  002a002ah         ; high word specifies which VxD (VWIN32)
. i, h( U3 z7 k& E8 C# V+ |# |                           ; low word specifies which service9 y' w/ z1 _0 G2 o$ F
                             (VWIN32_Int41Dispatch)' F; g) K: |2 p; y0 q# u
   call  Kernel32!ORD_001  ; VxdCall
7 _+ J2 A3 t  S& j$ d* ~   cmp   ax, 0f386h        ; magic number returned by system debuggers
$ e1 _' y) X/ l# g/ E   jz    SoftICE_detected( K  k4 u, @6 i) W) l+ W, z& G% {
0 b8 L/ Z0 l1 i, k! J" S
Here again, several ways to detect it:
1 k9 q  a0 `; J) X  |9 v' |# Q' t: y! @
    BPINT 41 if ax==4f
) ~' g* R) P5 m
* M" \# Q. ~- k" P7 Z' A    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one) k* |2 p$ g2 N: }

2 {6 q4 R0 E- Y    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A  i0 g2 y$ I' h4 k) A
4 E0 I1 y( {' O' z2 {
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
$ y$ a) n5 D2 X6 [: [& t# U3 ?
7 n: U1 w. f" Q) f& E' c- v__________________________________________________________________________
9 a; d! J5 e, ?9 k2 s$ y+ o4 K! |8 c2 o9 b
Method 13  E. B3 I" T  U1 ?7 b
=========
6 b: Z' Y7 g* c# e8 \+ x* O4 R% I* g& S+ w
Not a real method of detection, but a good way to know if SoftICE is8 T* `' y# A7 _& ~
installed on a computer and to locate its installation directory.
+ K9 d9 O: D& ~+ C- t; D: T3 k5 dIt is used by few softs which access the following registry keys (usually #2) :
7 z+ E: a4 f5 j. R" ^- @, ~2 \8 W- W
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion& [8 D+ T, }. s3 F
\Uninstall\SoftICE6 V+ C6 h& S6 ^, `$ o; V
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE, P; [$ B  D* a% K
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion" u5 D4 L$ n- B0 \' M
\App Paths\Loader32.Exe( l- \: I8 b" r' ^" T
2 c8 m2 Z, I/ |" Z6 e& b8 r

2 ^5 M! O: i$ i6 W5 Y2 U! HNote that some nasty apps could then erase all files from SoftICE directory' r/ s: l1 I' W" W7 N$ N: @
(I faced that once :-(
9 L5 ], d4 J" V! T+ m5 d3 R: L+ f6 y: m9 l% j! ^0 K7 _! ^' Q' n- n
Useful breakpoint to detect it:( d& h: b1 M- x1 N6 X5 f
7 p1 @; m  }4 J3 f$ k# z7 e, C" n
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'( [  `7 ?/ U" o. s6 a
% p* i$ b4 v0 x# V
__________________________________________________________________________. `, w' q% J4 M9 G0 G
, P9 G4 l$ ~5 F3 U  B
6 K2 P/ I5 o! V4 H
Method 14 ) ^! J6 p0 V  \9 H: |3 x2 f
=========+ ^7 K& [' L- M# U( }- p6 ^
6 N; L9 r) F' |& K( r; W. K
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
/ }) ?; X% n# q; @6 h/ i' @is to determines whether a debugger is running on your system (ring0 only).
) ^) W( q, B8 D* g% ~+ S0 \( m, w5 r3 T: G0 L# c' z5 x, Q
   VMMCall Test_Debug_Installed
, o# E! e' d# r5 z5 b1 D   je      not_installed0 A+ a) n3 ~& e. l

2 i' E4 L6 j, B1 @& UThis service just checks a flag.
  Q6 c5 F, _6 Z1 x6 R. f</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-8-11 15:35

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表