About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
3 Y& Y8 `7 `& `; s$ w7 }<TBODY>
3 k+ o0 J5 _- [/ e5 f<TR>
8 N, z, Y3 m7 _+ ]" m<TD><PRE>Method 01 4 Y+ E# H) ~' r) K* ~
=========2 f. m2 `- a. q+ J* r* ^

! z( V3 M' C1 XThis method of detection of SoftICE (as well as the following one) is  A6 y1 r' n  ^/ g; ]) Y- `6 L  f
used by the majority of packers/encryptors found on Internet.
/ [* j) s; o5 q9 J0 H) `8 jIt seeks the signature of BoundsChecker in SoftICE
5 e# {# f/ I, k" Z
6 r, u" y, O* E. B; f9 {    mov     ebp, 04243484Bh        ; 'BCHK'
. P1 G- K: x( d( |9 B1 I5 i+ v    mov     ax, 04h( a- c" N2 B# e) \
    int     3       " R; d9 o# J) T
    cmp     al,4
' w( R# a9 |5 ~8 w6 f$ T    jnz     SoftICE_Detected  {/ i/ E5 a/ o' B4 A% c

  C# R! f. |% \, i# `( q  j___________________________________________________________________________
0 ?9 Y' F* [; W& D
% ~! s- M* O9 B+ e* u+ R. [Method 02- H4 A( q# ]% |) Y4 G" F4 U
=========2 I* Y+ d) O" C+ x- ?& {$ h
' e5 |6 d# @  w7 C. m
Still a method very much used (perhaps the most frequent one).  It is used4 o& Z, O% H4 z3 Z# L/ U7 M- c- Y: y
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,4 [) O' c/ C0 K
or execute SoftICE commands...: I, @: v& n1 _3 `) Y, K
It is also used to crash SoftICE and to force it to execute any commands
' Y1 Y. Y: \" G. H+ f5 w(HBOOT...) :-((  
0 G1 d9 }$ y& h1 X7 v! R* x+ U% G  y+ _! b! w
Here is a quick description:1 ~" W7 x2 o4 \/ C6 Y, Y
-AX = 0910h   (Display string in SIce windows)# K/ s8 g# l) a4 U
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)% E' V, W4 ~3 ]% O4 V
-AX = 0912h   (Get breakpoint infos)( U+ H! P+ K1 B) i- M/ _3 L
-AX = 0913h   (Set Sice breakpoints)
0 k9 T' y- c, u% g* w/ j4 X- K' ^-AX = 0914h   (Remove SIce breakoints)7 v. k/ a5 p" Y$ |

9 J5 @/ ?6 U' A3 T, nEach time you'll meet this trick, you'll see:
; c( e) B/ h% u-SI = 4647h* ~! S  O, o7 q3 z/ i8 A/ v+ j* [# Z
-DI = 4A4Dh( Z! [- y2 [( G9 q. y7 y4 ^
Which are the 'magic values' used by SoftIce.7 ]0 P! G# z. K" y% }9 J- K
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
9 T5 c( ~9 R# O3 [: ?0 e
0 ]7 N( _$ l) K  uHere is one example from the file "Haspinst.exe" which is the dongle HASP4 ?  c3 Y7 m) x3 R( F* w
Envelope utility use to protect DOS applications:( n1 C' T' W% ^9 P

1 I5 N+ J, E/ x( i9 X4 U* Q: L) V. T; k8 G7 f8 U# N) g+ X
4C19:0095   MOV    AX,0911  ; execute command.
$ ~1 s5 o) u, t4 \% o" n0 ^4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
+ {8 w) n" H6 G# @8 k3 D4C19:009A   MOV    SI,4647  ; 1st magic value.
" g  q' h/ Q; d( @4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
+ M4 O6 V0 b/ c$ u5 r  t4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)4 I0 l& @( v# r" S  M" D
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute  k7 t( h! w( ~" E, r$ H& ~5 o
4C19:00A4   INC    CX. y6 ^/ X7 g0 M  |" ?/ c* S+ Z
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
1 w7 e. e2 J) D% B3 X8 R4C19:00A8   JB     0095     ; 6 different commands.
6 ?$ o3 D( V7 Z$ U6 G, x% r4C19:00AA   JMP    0002     ; Bad_Guy jmp back.& T( A# |% G, d2 ^, m4 {
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)& i* h# }2 P9 k7 N
0 X, j9 f" F8 X9 a5 C& d4 W
The program will execute 6 different SIce commands located at ds:dx, which/ L8 K0 d9 d; U; I3 j6 {
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.3 U" V& j. {9 s8 ^9 g
  M" a3 z, W. n# y% W3 S
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
1 o# F7 }" F6 C7 u1 M9 k___________________________________________________________________________6 X1 a  L* d5 L! m* \

  o. }7 R& ^7 h, X6 X) k& S/ a+ K" L1 s/ g  p9 ?. }+ B* Q
Method 03' R' d) |& J% H9 v' M
=========
" v. F1 W4 Z: b2 w6 k5 v7 ?, t  s. P8 Z& U. Z  A( g
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h% e9 t, u, e/ k/ H1 B$ \! \+ B: ~
(API Get entry point)
7 z# T1 y& E( v0 [        & i* |3 ^/ f* J8 p& i4 ^" [; e0 u0 b

. X, Z% a7 o% l5 U. N    xor     di,di0 V! z4 B1 T, ~1 K! |& s
    mov     es,di
3 K) f  ~, L. G6 A5 F2 D    mov     ax, 1684h       ' O1 Q  M  D/ l' E5 V
    mov     bx, 0202h       ; VxD ID of winice; W/ y6 _- T! N, j
    int     2Fh
8 ~1 G3 r9 C/ z# Z3 l    mov     ax, es          ; ES:DI -&gt; VxD API entry point% D' t: S1 C: X* j4 `2 Z
    add     ax, di  M- m$ U5 i/ T+ Y$ M  i, B
    test    ax,ax
4 h1 r/ {% Z- o8 y: Q; k* s    jnz     SoftICE_Detected
' ^4 `) z3 N+ G6 J% [# O+ M7 z6 f; Z# V* I' D- B
___________________________________________________________________________
! T* X* M1 w- ~" X+ a: M. o0 u2 r; T  C; w, v
Method 04! b6 ~  @3 q% \* s( Z' P* y$ }
=========
- \. j, z3 m6 S# K3 \& y
7 z' g) j; n! N3 J4 W5 mMethod identical to the preceding one except that it seeks the ID of SoftICE
0 }9 ?5 V* M* MGFX VxD.1 R7 L) s' v0 k2 V( B. q2 \

' P, ]( J& x% A1 ?9 k- B    xor     di,di
8 `, ?, o9 j$ g3 r4 I    mov     es,di
+ }2 x+ R$ P3 X, `7 S( I; F    mov     ax, 1684h      
$ u* ~+ o, n5 t% V  |    mov     bx, 7a5Fh       ; VxD ID of SIWVID
3 F8 M. W4 n8 ^) d0 h1 v    int     2fh& C# J+ v4 w0 ~% e0 N/ A
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
5 P6 A1 U5 E# B- e    add     ax, di9 z/ L% X2 P3 P( ~7 l& e3 z0 M$ F) Q8 |
    test    ax,ax
( K" h# w/ H. G0 g! h    jnz     SoftICE_Detected
5 I3 M3 ]$ p! u$ d  ^4 [
2 y. `/ a( g) |! i9 O__________________________________________________________________________
, D$ J8 W3 x" |) k$ |5 D( K. I4 o3 p/ ~0 c

1 e# ~  |7 B, q4 pMethod 05
: u* e1 d) q- S, o) z& p! i" R=========
2 o' e+ h* J; u7 a! b
! x" s7 D4 ^& T1 u( p0 n+ _Method seeking the 'magic number' 0F386h returned (in ax) by all system# S" t( @) t, j9 b1 h) ]2 W' B0 |
debugger. It calls the int 41h, function 4Fh.* F7 p. ^0 \+ L0 C; N
There are several alternatives.  2 O$ w: E) s6 b% @
# c  }8 `, q; {+ w) [; ?
The following one is the simplest:- u. ]  c2 W0 B) h1 u  C" H# X

% b% T- E* {3 P6 u6 p) s7 G6 d    mov     ax,4fh
) M. U6 g! q4 Q    int     41h
6 W# A( l, e! S& I+ H3 J9 X    cmp     ax, 0F386
; t! B; g, b  p# \    jz      SoftICE_detected
/ D4 [1 e' `* g) b+ L& V
  y! o. G) ^9 I) a7 ?
$ o4 E9 j6 n# |( T: [+ t- pNext method as well as the following one are 2 examples from Stone's 4 C: k5 i- Y3 T  d" n; m
"stn-wid.zip" (www.cracking.net):
% B: y, x- }8 g3 r  l8 x7 B* _& e# o7 x7 x6 o% n
    mov     bx, cs
' X4 \, D- e- C. \9 r1 r5 P    lea     dx, int41handler2
3 H3 _2 e  _! f4 B1 I- h    xchg    dx, es:[41h*4]  j0 G2 N5 k$ ?) A
    xchg    bx, es:[41h*4+2]
5 }6 b- h) x, x% y6 N2 @    mov     ax,4fh1 Z# i8 [2 g& e% z; r! p
    int     41h
6 B4 k( X9 ^8 g0 a3 I  S& F9 o    xchg    dx, es:[41h*4]( m7 P2 Q" n/ B1 t2 K2 P
    xchg    bx, es:[41h*4+2]9 r' C$ O% ]1 A# k# e+ j
    cmp     ax, 0f386h8 `1 ^4 Z8 n) w% m
    jz      SoftICE_detected
% v$ m  B) ~' d( {. f& q# z9 B, x+ X* |" r( ?2 u2 Y! F
int41handler2 PROC
' O/ s/ }8 N. |( y0 u: q+ N    iret
* a; L. s: C5 m' _& L" @int41handler2 ENDP
6 N0 A& H' \% G' N8 m2 @; ?9 ^# }/ F6 }+ H

9 B; D3 e4 D2 u: c) B9 G) |_________________________________________________________________________9 b( X- z  ]# @0 j0 j
' j% W1 \' e$ ~9 D1 ]$ y

7 q8 f8 Q. z+ HMethod 06
1 Q6 C" Y3 n5 J# Z7 u$ O=========
- H* P0 P" Q" Y" E  z: \6 q( G* ?) L
6 x9 V: F. Q5 a" c: r! U
2nd method similar to the preceding one but more difficult to detect:
2 [  V6 ]8 N0 K% n# P# s5 b& G! u: [- d# |# L

* t& q6 V# y# m) _. e* C7 A  D: z/ Wint41handler PROC8 K! H6 g& ~9 a8 C7 P7 d$ z
    mov     cl,al. o+ k7 z- L" p
    iret* j" V& `. u% I7 m' b+ X5 C% e
int41handler ENDP6 p6 a7 T! Y3 ~( s/ Z1 M: D! Q

/ q) b9 g$ ?4 m+ h% y& z  U% _
+ S5 ~0 h, J% T1 G# J  Q    xor     ax,ax: S  Z, i: ?" K4 Q
    mov     es,ax) ~9 N# _  _- [2 {9 z
    mov     bx, cs
# N$ _9 ~) A# T6 L4 A9 Y8 f    lea     dx, int41handler
9 W) c- P! F% A. U    xchg    dx, es:[41h*4]
5 t# w! H# ^& s# h$ z1 N    xchg    bx, es:[41h*4+2]
9 c' a0 I6 g$ w6 x( j  l9 j) |    in      al, 40h
* S. w' N+ l% i' I/ W$ a& O$ K+ T    xor     cx,cx
: ^% k5 X( L4 w" B" W7 |/ R    int     41h! k8 \4 S; v' `7 p9 M* P7 j
    xchg    dx, es:[41h*4]
) {8 p. x/ ?3 q' C. ~    xchg    bx, es:[41h*4+2]0 i9 A2 c& I4 q
    cmp     cl,al
: b  e$ C. N2 k7 b5 T7 ~! e    jnz     SoftICE_detected$ d" L: R" z7 b, W

: J1 ?% W) _5 Q( {2 Z_________________________________________________________________________
9 |( C5 d; h5 ^$ e* ~9 f( Q' c1 N- t0 r/ u
Method 07
/ r7 D' b! B2 Q. ^6 `* w0 m/ c=========
, X  ]% I' J+ {; K
" C) E- K5 C3 _- N% QMethod of detection of the WinICE handler in the int68h (V86)
3 Z6 k; b: A% {
5 C8 Z5 V. @; m$ N    mov     ah,43h
% x5 v# e; @) a1 o8 u: k    int     68h
- F+ j  J! R) v    cmp     ax,0F386h
; u$ G" t" ?7 q. |/ U2 @( o    jz      SoftICE_Detected
/ l- y3 i" \' n. c
8 ~% J, K, T, _  j# D& h  r/ A7 d5 z
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
# h8 c8 W- u7 v' z   app like this:2 A& E6 Z% p( F$ `& ]& V$ w& m
+ [' x$ k9 J' ?0 w
   BPX exec_int if ax==68+ Y5 H1 Y# d- p1 a$ S
   (function called is located at byte ptr [ebp+1Dh] and client eip is
3 e2 {" s. q' T6 D! D; n' M   located at [ebp+48h] for 32Bit apps)1 [! A' o3 k! m0 l
__________________________________________________________________________
9 t* F! y3 w7 q+ q
: X3 H$ B4 l- Y9 v+ J' Q
) Y. _' v( `) }+ G8 rMethod 08- G7 F+ u* I  ?2 N/ @4 ^' A6 c2 U
=========
, L4 ~3 ]+ w* U2 h: z
! T, W% H4 W' JIt is not a method of detection of SoftICE but a possibility to crash the
3 {7 i# t7 B# \; S) W# Q; Esystem by intercepting int 01h and int 03h and redirecting them to another" e# }, ~# z% f/ B
routine.8 G1 C; f  z, I# K
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
% A* f. @4 ]# ^9 s- s& sto the new routine to execute (hangs computer...)
# d( t+ G7 Y9 h3 Y+ e' Y1 L- p+ a& b* q+ B2 }
    mov     ah, 25h
) W6 {/ Z% e, U5 K* |; P$ k    mov     al, Int_Number (01h or 03h)
9 D. [" y6 |' r( c* i    mov     dx, offset New_Int_Routine: J! U1 `9 s+ z
    int     21h  i: C. v, ^( L7 g* s( j: X
, M1 h* o* o: x0 b. i
__________________________________________________________________________8 P/ m0 H' {( C9 @
/ G% j1 r4 I5 ?7 ^
Method 097 ?* s! f  v7 r& X( ]" v* n1 a
=========
7 a+ Y- q! b  R& j  L, r" O* M: H( T! S- G
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
: |6 L$ h9 G1 r2 ^6 S( {performed in ring0 (VxD or a ring3 app using the VxdCall).. k6 v, T. _8 a2 y4 w
The Get_DDB service is used to determine whether or not a VxD is installed3 R. |( Q0 [) @1 I4 ?* A( @0 D4 k
for the specified device and returns a Device Description Block (in ecx) for" ]; F: l+ k7 h- f7 r$ [8 t
that device if it is installed.. K2 h% ~% y4 I' B# t8 P, v
5 p  S1 z/ p  B% B5 n5 F
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
3 j7 Z2 P$ O$ f5 C, d& g   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
5 c2 J4 y$ |5 @& l; ?& ~   VMMCall Get_DDB' G* L! y7 H: l" ]: M8 a
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed' r# Z0 C, i/ P5 P/ X+ C( K
8 B: }+ s; L, G& h( z8 g
Note as well that you can easily detect this method with SoftICE:" v# U1 ~) n# `2 s) }
   bpx Get_DDB if ax==0202 || ax==7a5fh
1 g' |: f% k/ K2 z0 g  @
: N# b& {' Q' ~4 ]__________________________________________________________________________
: Q7 ?# U4 l, E3 s
+ j3 f5 P$ @7 v$ p4 S+ bMethod 10
7 j1 N3 p" G5 F0 w8 M' \1 |3 x=========
2 A0 N) M; u+ o. c7 O$ i
. \% r- K" L) E4 `# T- T: L=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
/ `3 r4 {% y3 g$ J  SoftICE while the option is enable!!
" V3 t% R* ^8 z8 ?4 b2 D% n/ X
/ M) _, u; I& V6 i7 v/ f7 {' @This trick is very efficient:8 I' Q2 _, U. t' b: Y
by checking the Debug Registers, you can detect if SoftICE is loaded* e, t6 @1 i: t' h9 p5 E$ N2 ^2 Q
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if3 l  e$ Q/ Y0 ~  ]8 N
there are some memory breakpoints set (dr0 to dr3) simply by reading their; |( @" |6 i$ ~- x$ m; X8 w: Q
value (in ring0 only). Values can be manipulated and or changed as well4 S! c( Q2 n" I/ q
(clearing BPMs for instance), m7 \% X7 j! z/ o

$ d$ P% K0 U. H) C! ~__________________________________________________________________________
) c, D( l1 d! G8 _! P7 Y! ?  s2 @/ J! J% S. T; J0 n) d# L# p; F
Method 116 I  Z0 O' b- R$ C* y
=========
* q4 @9 P% {8 f$ p/ n- _
; q# V9 z* |# gThis method is most known as 'MeltICE' because it has been freely distributed! s' s; K8 z  X/ @6 ^
via www.winfiles.com. However it was first used by NuMega people to allow1 x7 z/ m4 W' P5 |+ y7 s
Symbol Loader to check if SoftICE was active or not (the code is located
: F: _+ [6 J0 f5 t$ Winside nmtrans.dll).7 q& K) z& t) O9 [( J
1 O0 c; n6 K# `" _1 B
The way it works is very simple:0 U4 Y! p- Z) o6 A- G4 o
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for' _" V4 R  Q, ]
WinNT) with the CreateFileA API.9 D" O3 ^/ g3 g+ h, U1 }
) M* g! a3 R7 c5 ~' I+ ~
Here is a sample (checking for 'SICE'):
# p$ h2 f% U/ J7 S! W2 L
  [# E) p8 X" {( l6 V% q8 B6 P0 C* wBOOL IsSoftIce95Loaded()9 ^5 J' a4 D( i9 S/ F; O6 \
{" j( [! q2 [- c$ `$ y# U
   HANDLE hFile;  
5 I) Y. c0 I4 ^   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,- y1 a( p) h: O' x
                      FILE_SHARE_READ | FILE_SHARE_WRITE,
( {4 j4 C! k- L+ `% {                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
: x' C9 a9 T# |2 n# @2 t   if( hFile != INVALID_HANDLE_VALUE )) r% H9 }5 q. d
   {6 _) P0 }$ O  ]. ?
      CloseHandle(hFile);
  d, t/ H# O% Y0 q      return TRUE;
9 M# [+ E! L7 e# p   }- B. K) d  I) Y( ?3 u2 e
   return FALSE;
: P; `. B; U6 k  `* ]( p* W}$ d/ I0 Y( ~: u. l$ M

/ k  c- L* ~3 g# n- ]8 ?) }Although this trick calls the CreateFileA function, don't even expect to be
2 s9 V  f7 `2 q% j% Q9 c5 T/ Table to intercept it by installing a IFS hook: it will not work, no way!
/ W2 u$ T% W$ l! f  u* ]" z* D, wIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
& ~$ b' e- _" ?9 fservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
, F: x4 z, y5 [4 Qand then browse the DDB list until it find the VxD and its DDB_Control_Proc) O" R6 ?% h6 O; N
field.$ Q. O( t7 y1 U6 s" E
In fact, its purpose is not to load/unload VxDs but only to send a   g, @: N7 T7 w( l. [& w# {
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)& h& o# F$ \* C% @# S# ]9 t. l2 p
to the VxD Control_Dispatch proc (how the hell a shareware soft could try# ?& t9 m- h; @% U! B  Q, L
to load/unload a non-dynamically loadable driver such as SoftICE ;-).) h) q/ `! J9 l7 N7 `
If the VxD is loaded, it will always clear eax and the Carry flag to allow
3 K# w( y4 K4 O2 q! Bits handle to be opened and then, will be detected.1 R* q! i6 C7 v% T  @; L
You can check that simply by hooking Winice.exe control proc entry point3 a, s) L, Y" V; Z* v) o
while running MeltICE.6 N+ g3 h/ I; \" X+ L

8 P# I& y. G% t4 U$ Z# u; J7 k7 |) O8 f+ V+ f
  00401067:  push      00402025    ; \\.\SICE
' x' E% C0 b6 S! m/ Y6 J9 a; N  0040106C:  call      CreateFileA
/ P# I2 m) @" X4 l  00401071:  cmp       eax,-001
( N+ W% w$ y3 j- ?9 E! s$ K) u0 q  00401074:  je        00401091
( s0 y% @, _2 O# p: w$ g! H/ N& U3 i( j) |
+ I; @' I/ |1 [" P2 t7 u# V
There could be hundreds of BPX you could use to detect this trick.
8 c. ]9 r5 P8 d! d, J-The most classical one is:
: o8 \7 F( L" X# j  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
0 r2 H0 l& x  T$ B: T" U; P% n* m    *(esp-&gt;4+4)=='NTIC'( A4 B) Q4 J# l+ ^/ L
1 m- e9 a% e2 r: m; r7 ~
-The most exotic ones (could be very slooooow :-(
) Q; R  x+ z7 }# X4 I9 k8 x   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
/ d: V3 o) Y/ O5 z! a) S1 ~& }. {     ;will break 3 times :-(
, N3 O7 [0 V/ s$ A. T$ m+ ]2 q. A, H7 o$ `* x
-or (a bit) faster: " D- s& g4 L' _% }1 t
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
5 \8 [7 A; s! ~# X
9 w& \' T- R# _   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  ) a# D  s4 q; G' Z' l
     ;will break 3 times :-(
! {6 ?( d8 e% s9 |: v# h% K$ Y4 `5 K! ?
-Much faster:
! O" E  n9 p6 b   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
( k* x  h# Y' ~4 t/ K9 q% d0 v  q1 F! G; }+ @9 U2 o3 w+ e/ n
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
7 ^: j0 \9 G9 k( M0 g3 wfunction to do the same job:$ R+ W0 I; n+ d* P1 ]! p+ q; F
( s4 A9 X  a3 N2 {
   push    00                        ; OF_READ/ a- q, m0 i7 m( E6 M0 E
   mov     eax,[00656634]            ; '\\.\SICE',0
! b0 w  D0 U5 h: `   push    eax
. a) x6 C& Q, B' {3 T   call    KERNEL32!_lopen
. `' N' g5 i0 k2 N   inc     eax
0 |* ?0 _  @0 y   jnz     00650589                  ; detected& |+ f! `4 o/ ?0 r
   push    00                        ; OF_READ( [' M, c( q: K! z! B
   mov     eax,[00656638]            ; '\\.\SICE'. ?. s" ~) k7 N- }5 l9 Q
   push    eax& C0 L2 s& T. |8 @: ]+ r
   call    KERNEL32!_lopen
$ ]. e: ^( D5 n   inc     eax
  t. r, F# B( d& L   jz      006505ae                  ; not detected! D7 Z6 j4 z) k  i8 L6 U0 N
3 d2 c, v# ^+ F4 ^+ Z

7 h9 ?2 ^2 J7 G: R__________________________________________________________________________# Y" }3 q. o, R! g( Y
8 b6 v0 L7 F- \8 h" i
Method 12; y0 u! F: Y5 T) s: A4 G6 I
=========
, d# f3 E. U. b$ v& N+ u6 x1 p2 A7 c6 ]6 A) ]; I) u
This trick is similar to int41h/4fh Debugger installation check (code 05) d) u! v$ z, L
&amp; 06) but very limited because it's only available for Win95/98 (not NT)8 t: c2 T7 {- i
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.7 p* L$ `2 ?+ T% q

# @5 L0 e3 N7 Z8 l: H# @   push  0000004fh         ; function 4fh
1 o* s. a- T' m, u2 k+ ?: k" d   push  002a002ah         ; high word specifies which VxD (VWIN32)# v2 T$ a3 B) G* W
                           ; low word specifies which service
, A- w: C* c. Q                             (VWIN32_Int41Dispatch)* \; B7 H  n; F
   call  Kernel32!ORD_001  ; VxdCall* R4 E1 X; j& P2 e3 ^! [
   cmp   ax, 0f386h        ; magic number returned by system debuggers
) n! v3 [2 K. m1 U   jz    SoftICE_detected4 K2 M7 j  n1 K6 Z6 F

2 p3 P* ]) I- t& m) J, AHere again, several ways to detect it:
+ r  G7 l% d7 `9 C) }' s2 C
3 v$ D% a5 q6 J3 Y* B/ y    BPINT 41 if ax==4f) U2 s# H* g* Q3 k0 V

/ x0 ?6 }' ^2 G! l; k2 ?' j$ v    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one% B: [( W, l* _7 ]

6 a# \8 @$ [3 g+ C9 v    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A) Q& M- h# W+ Y: P# E- C/ c

+ A+ M- R0 r% V/ G6 Z    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
& \# D/ D1 n3 z
6 r! o+ {9 B8 v' A3 e__________________________________________________________________________
' ^! }5 N4 l3 c* j
: I# K  ^9 Z5 g, g; \6 b+ s9 sMethod 13
& K, w% a. I1 s=========5 @9 D  y' S0 g6 R8 }1 J

) W9 y8 @+ t; n  p" z2 W* uNot a real method of detection, but a good way to know if SoftICE is
- [" K" A+ Z) ainstalled on a computer and to locate its installation directory.
( |3 p% A& v: W  H5 w1 oIt is used by few softs which access the following registry keys (usually #2) :) [4 D/ T5 v% x  u
% V7 b# H3 s( }9 I
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
% n! j8 N8 u1 b. y6 M6 B7 ~7 D\Uninstall\SoftICE8 V) [; L) u2 o5 l% t( ~
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE& k$ n0 l% g  J+ s- {
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
- e# F: y: w" m* C% l& Y\App Paths\Loader32.Exe
; [1 g5 }5 t5 U4 z- _+ {; i, z( w: S# N4 ^6 q( X! M/ L5 c- S) w
7 b: C- A4 a3 c) H# t/ r
Note that some nasty apps could then erase all files from SoftICE directory
6 q. w9 S! y6 e7 ~$ x(I faced that once :-(' A! o7 d8 c6 G4 d# P- e
9 q( ?# Y& J1 `! E/ u3 w
Useful breakpoint to detect it:
+ `5 F/ U  Z; |4 z0 m; `9 v& g( v+ w1 k+ Z1 I& U2 c$ o. i, N
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'% c& s! f4 n$ U3 l
  F( P7 e* u( M* l1 t+ J5 E* G
__________________________________________________________________________
7 C5 ]- E7 g6 t  p2 B5 b% y! N% U
7 d3 m6 g7 O, F7 n: p1 A6 k0 @* A  f8 {) c: L" p2 ^
Method 14
8 h8 x- g0 _0 U: L$ C& V; e=========
! ^2 T5 k: I4 V+ R
9 o" e6 l9 ?* [! g  IA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose9 w1 e9 R- e4 f3 G
is to determines whether a debugger is running on your system (ring0 only).
2 F' c0 i) r5 E/ m0 o1 \8 H9 T* P3 k: F, v' ?
   VMMCall Test_Debug_Installed7 t' X" n3 m; S! t4 ?
   je      not_installed
& o- H  k4 Y$ e; q
; u( c7 t0 B$ O( o6 k3 f& W. GThis service just checks a flag.( U( o. Y5 Q8 n1 ~6 }% P9 ?
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部