找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
. h9 z) O1 ~' ]5 j$ C! M6 j  B<TBODY>( U9 o9 q! w' y, O! B9 w5 F
<TR>/ ]! u3 J" G. m  X8 b, j
<TD><PRE>Method 01
+ o0 P# _& L6 ?5 P=========# K/ z/ F4 Q. A. m, L( s7 E
/ K" }& A' {5 E6 M5 r7 L2 E+ S
This method of detection of SoftICE (as well as the following one) is' _: f$ N& v3 l+ `2 ~
used by the majority of packers/encryptors found on Internet.
- a+ Q0 s$ D& ~5 c- _It seeks the signature of BoundsChecker in SoftICE
! w& |: ~1 h0 V% i9 W: m- X) Q- n- T) Y" m3 r6 t; S7 a: \- c
    mov     ebp, 04243484Bh        ; 'BCHK'
& B4 I1 [  y, o    mov     ax, 04h
1 f  c1 n- ]9 {3 X/ S* E    int     3      
# Z2 |: H: i1 l0 |6 `5 k& ]' J6 i    cmp     al,4
7 w2 |$ k7 u" B    jnz     SoftICE_Detected0 e3 e1 X5 x1 ?1 f( x$ M

- r9 U) Q; j5 O5 b___________________________________________________________________________" r$ s8 a8 F, s7 ~5 t- Y& M
1 k/ f" k% F( M8 k( C+ N' {  J
Method 02$ U# v; o0 \/ q' [$ C! S" g# }
=========: g( _* ]( K' o0 C+ Q
, ^  u) e6 Z( [: {0 v' g& D/ f  L
Still a method very much used (perhaps the most frequent one).  It is used
5 B5 s' _3 J7 y$ Tto get SoftICE 'Back Door commands' which gives infos on Breakpoints,3 ^; h( w/ F3 v' q! _5 Y
or execute SoftICE commands...
# P. d/ z- J. EIt is also used to crash SoftICE and to force it to execute any commands* g+ m  f4 _3 k2 l% c8 ?
(HBOOT...) :-((  
! c7 Z' P" I- S# Z$ j6 |  {
' K: s" ]7 n- i( SHere is a quick description:
4 m0 H( D; }# G- A-AX = 0910h   (Display string in SIce windows)& m( Y, w0 j- b, w1 `5 b
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)6 u6 O% D5 i( _5 i; D" D
-AX = 0912h   (Get breakpoint infos)
, v! j0 n, e, u3 T1 J-AX = 0913h   (Set Sice breakpoints)
" z2 l6 P- b4 B0 y-AX = 0914h   (Remove SIce breakoints)0 ?0 P8 q1 L* n4 |! e+ k3 W/ w7 N
7 S1 J+ \- j/ R) F
Each time you'll meet this trick, you'll see:
/ m& m+ y2 _+ T-SI = 4647h
; Q. n# j0 ?/ U' Y- z-DI = 4A4Dh5 P- c" U4 f6 T$ k" E
Which are the 'magic values' used by SoftIce.
+ ^+ y7 ~; Z+ v2 x( EFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
8 Z6 b1 Y0 C* D! G/ R/ ^) O* F0 G4 K( z8 r6 ^: l
Here is one example from the file "Haspinst.exe" which is the dongle HASP9 S& V0 o( i- N
Envelope utility use to protect DOS applications:
: X- s9 N6 t+ \
7 @& w. ^/ T0 A2 k  d
; [* S. J# k! p1 p% v4 L' `4C19:0095   MOV    AX,0911  ; execute command.7 @) A4 s4 h; M2 I
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).0 m* ?" x" E  B) Z/ f2 ?9 F
4C19:009A   MOV    SI,4647  ; 1st magic value.6 h8 A# U$ f. y( x5 J
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.* d, x3 o# k( L' r3 t
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
" e2 P2 Q% ^/ F4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
% P4 f5 _! A% a2 {$ r4C19:00A4   INC    CX
7 }4 k  {0 X( B5 J. Q! _5 C& w6 \4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute3 L7 o+ G# e4 m* A# Q
4C19:00A8   JB     0095     ; 6 different commands.0 P6 d: Z& Z7 l% r% q
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
- s  a# h9 k$ R1 z: J, ~+ w4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)0 B0 u8 G& \8 \% m& P5 \
, d: P0 Y7 M2 |& Y
The program will execute 6 different SIce commands located at ds:dx, which# y! d! v- o) A6 L) P5 i
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.7 o1 p. J& c9 n: _6 n, @
; a/ o! v& c6 t3 ^5 k
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.5 \7 w7 I5 e( Z" F- G
___________________________________________________________________________
5 }& B2 N! L9 l# @6 O
* `  r9 f- e0 \
7 ^9 a* P( z# v- bMethod 03
7 i4 j* b2 g5 o/ u* e, I=========0 _% g1 B7 z, x) P
+ q. P$ M, S4 D7 S* j# c- [
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
6 m" B: z2 t5 j1 a5 k% d(API Get entry point)/ y) a- r$ F3 f2 t' q
        6 D% _, v4 B' T3 ]2 F9 `: M8 x  F

9 {5 W5 C/ b' }- t% N# m, W# l3 v. E    xor     di,di5 a. ]) c! N1 s% F
    mov     es,di% P  P' E* s) y; n( H
    mov     ax, 1684h      
/ J0 p& b* N2 j/ Z, A0 i" w; \    mov     bx, 0202h       ; VxD ID of winice* j/ G+ V7 l) h/ u0 R0 w1 y# I
    int     2Fh
! [: d# b' o) @1 h* y0 n. X    mov     ax, es          ; ES:DI -&gt; VxD API entry point
: D" @+ n0 l& R& R# d# p  F/ T    add     ax, di) W9 g0 k9 _8 e. {$ ]) D
    test    ax,ax$ b( K7 ~6 c8 Z2 N
    jnz     SoftICE_Detected$ G8 c3 W- T# I6 k: ?

/ ]* R; U! _3 Z1 ^" P$ v- E___________________________________________________________________________
# a% T3 i) I2 T8 {0 g) h  M* c: |3 v0 z6 Z4 ?
Method 044 C, x1 [" ]# {
=========2 S. P. U" W2 f# U7 X  M# y7 Z1 a

% }" z" P/ `* V0 r9 ZMethod identical to the preceding one except that it seeks the ID of SoftICE3 I! S% c1 _3 E3 e7 b2 C7 V5 c1 T
GFX VxD.
  E' V, \) u5 V  U# d7 j
9 E6 q! @& y4 R( C( b9 v6 c/ d7 f    xor     di,di: V, l2 q2 _4 n: }3 }: A& s6 b' A! x
    mov     es,di5 `8 p; z4 R* \# U
    mov     ax, 1684h       0 t8 Q$ E& S: k* h4 V+ j" F0 x5 e) V
    mov     bx, 7a5Fh       ; VxD ID of SIWVID% f+ N, h& ?0 R+ m
    int     2fh. j: k/ q- @& A( ]
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
& f& u' r; _) A# ?4 m5 r    add     ax, di
6 w6 K. T  {4 ^1 L    test    ax,ax
! |$ m# D0 a2 X* R    jnz     SoftICE_Detected
% [  I& d$ K$ l' S1 I# G. E1 ?$ n+ L+ q' g, K
__________________________________________________________________________
# M0 q8 {& }! b3 M9 a
4 O4 s& o" \) o2 T6 k. N) g2 f/ v$ ?# T$ V& K& s7 m9 Z6 s
Method 05/ [5 h0 v0 n/ t
=========
8 m: _; O  U" P, d# a/ _
4 }" c+ f5 e" b' B, l6 `7 d4 ?Method seeking the 'magic number' 0F386h returned (in ax) by all system; m. O" Q6 }+ y: b  \7 m8 i, I
debugger. It calls the int 41h, function 4Fh.
. Y+ p. P! B* u5 z; D  }There are several alternatives.  " [# J6 _, f0 {0 a

' c+ N9 |6 u/ K3 A5 Z9 y2 JThe following one is the simplest:
, Y# |7 E: h- G4 W3 V
3 \" O4 I- \! n! i+ K9 _    mov     ax,4fh, d& v( o5 @1 L% \2 d2 |
    int     41h( q& a, \* |$ k% a* d
    cmp     ax, 0F386% @0 M! }- N! e( h2 r' M, m
    jz      SoftICE_detected
9 [! b& J  v2 X
3 l+ Z( G  B  b+ {  B1 R! `! W: G8 h6 {- E- @# h
Next method as well as the following one are 2 examples from Stone's % r/ V' A' Y9 O* o& m. H1 q4 {
"stn-wid.zip" (www.cracking.net):
# s, H- h/ t- e6 h9 b- C8 A+ ~  U( `4 F' {" {  s' s# F( D/ k
    mov     bx, cs
: j7 ~9 X8 e& i, n, i    lea     dx, int41handler2& v( E" q. e$ t2 l# L, V+ N
    xchg    dx, es:[41h*4]
- G  L. O" J* @& o) c: C    xchg    bx, es:[41h*4+2]) F) b8 u7 c; r& Z4 S7 k; D
    mov     ax,4fh
6 O9 F7 E1 g9 Q9 B. B    int     41h; G" ~# s* {! r2 Q, C: j# K6 I
    xchg    dx, es:[41h*4]
. {7 {8 G# n4 U; o8 ~& F    xchg    bx, es:[41h*4+2]
7 T9 @- u2 w" [$ W6 k  z3 |5 V4 @    cmp     ax, 0f386h1 u" I/ A, X3 D: ^5 p3 Y" C1 u
    jz      SoftICE_detected9 z& f, G6 R% ~7 n; Z- n* m3 d( G

3 G  Z1 K7 B/ ]# I9 [, d$ @3 Oint41handler2 PROC
0 A% ?1 z/ J* L# T/ J& }    iret" v: H% E( ]( u5 Y
int41handler2 ENDP' n0 H! w  Y% Z; _8 ^/ l( B( @
, S9 D7 D7 R- n( {7 V

3 m0 }+ V9 A0 h9 j* b$ I" I$ K_________________________________________________________________________
+ m2 C7 w# V5 l. f* d  m) M  V, I2 }( q. E0 A3 O, X8 _
: S+ ^, h2 t( `- m2 n
Method 06" }5 K8 Y' c  _
=========
6 `; v9 j8 s4 m  ?
5 k1 x; K# q/ Y3 L- Z0 q
8 t- J+ u* c! c) w+ G6 `# M2nd method similar to the preceding one but more difficult to detect:
& g) J2 n- Z7 p' T  m7 D4 ~
' R2 N# O8 ]0 W* `( u; b9 c* n
2 R! N5 ]5 y6 y# Eint41handler PROC
% e# b& V& C; w" ?  D6 i    mov     cl,al
5 T! n6 k6 L$ @/ X    iret9 t: _& r: `2 V6 i6 v  F, f
int41handler ENDP$ `" B; i6 ~! g4 G

$ I  t% K/ \% X! B& i5 M& o1 j  c+ Z' V5 }- ^- x1 T- k
    xor     ax,ax
, g9 \& l) s' p( [' J7 x    mov     es,ax5 N' I- B! n) d1 ~4 q
    mov     bx, cs
. o9 y5 N' R- [2 v: y    lea     dx, int41handler1 \3 Q, ]3 ]; C8 _& L! ~
    xchg    dx, es:[41h*4]
; }* |" A1 m; ^, I: A    xchg    bx, es:[41h*4+2]0 I0 ?- m9 m( S2 a
    in      al, 40h
! n; `8 I7 K' N' U* n8 x    xor     cx,cx
, }' x( e  r8 x2 e# x+ L    int     41h
" r/ m# a3 F7 @: @7 }1 o' X$ L    xchg    dx, es:[41h*4]) X  W5 m* W$ d0 ~( b5 v, ^0 |
    xchg    bx, es:[41h*4+2]9 o4 E5 b" J$ E9 v, s6 F0 [
    cmp     cl,al. d5 e* a2 Z+ v/ w
    jnz     SoftICE_detected
6 m, n  |! O1 R7 Y7 b5 t2 I! W
3 v5 r0 b, G/ P0 a% B6 A+ Z_________________________________________________________________________3 P. l- [; }/ o# D( {

5 H9 z/ w+ j: m) u+ z: g& nMethod 07! L( r9 D9 ?3 s& i; d
=========: D6 E8 p+ [" ]; x& L7 }+ s
: O! D6 R2 v2 h4 |  D
Method of detection of the WinICE handler in the int68h (V86): F/ S/ y2 S, p1 M7 X# U( y3 U
$ N2 d  n& H; @* |% i
    mov     ah,43h) n/ _, d0 p' ?& ?9 }/ B" K
    int     68h
9 y+ D+ C; h- p3 c4 D  f    cmp     ax,0F386h
7 E$ E/ j4 U* F8 R. Q    jz      SoftICE_Detected
5 T/ n+ c7 x% n1 a  q! |/ u8 a: u
- c$ f  e# K5 W% N& Z! I* w: p' B) C6 j' g, P1 y2 U
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit: `+ _% z1 G7 f9 A6 ^
   app like this:
, q8 [* ~% J0 R3 ]" V
5 O& W  L  x) n+ G4 h$ `   BPX exec_int if ax==68, G" P% _" E0 F7 }6 S, v
   (function called is located at byte ptr [ebp+1Dh] and client eip is
* y! y$ K$ ?, v$ p$ g   located at [ebp+48h] for 32Bit apps)
' ^9 J8 N! H4 N0 X0 W__________________________________________________________________________! Z' r; C  q, H4 v

! M7 I( y- ?( B9 z6 L# t4 R' {
- {+ k. K. n  h$ sMethod 08
4 g* I: {* i& ^' B( D' U) ]=========
& E, V3 g  \' e
' W, o% \1 N* W! B: U0 }It is not a method of detection of SoftICE but a possibility to crash the# c  f6 |. ^9 e
system by intercepting int 01h and int 03h and redirecting them to another
5 M. `) D# r. B! [4 \( ^# n' P1 eroutine.
! t4 i* b* R+ X" Y- U  ]It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points4 S' S& ^- ?/ P; D% e" U
to the new routine to execute (hangs computer...): h% C+ i$ `8 l6 \9 y( B

; }# p5 m' N) C0 w; q    mov     ah, 25h
) E. ^# a1 U; x    mov     al, Int_Number (01h or 03h), G1 J* k) W$ k% o! Q) k/ N$ @
    mov     dx, offset New_Int_Routine
& X2 D' J% p  e- n+ q    int     21h: L5 N: l  u' Y5 L5 X. _' `

% s0 Z3 o8 ~' Z/ K7 y__________________________________________________________________________8 x5 N3 h) n. t! ]6 h" ?, v

" M0 w' k) F' d) \Method 09
2 a' k/ z, ]  i5 X=========
/ m- |( @- G+ F( S0 R6 E; P% G+ X) R* ~8 `; W; D
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only5 o* }' ]- N) o! {& Y
performed in ring0 (VxD or a ring3 app using the VxdCall).
( b# m" {6 S1 Y' H0 w: p6 gThe Get_DDB service is used to determine whether or not a VxD is installed
+ w* l* X& o2 P( H  @for the specified device and returns a Device Description Block (in ecx) for& l8 `# I% r. i0 B. u% F: @/ V# G# a% D
that device if it is installed.
. o# [& b# v1 i, q5 i
( K" M3 }' l5 t" G3 r; L4 B   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID' G# u  `+ W) e4 B& y, [, d
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)4 f% h- B: h  P# M8 D
   VMMCall Get_DDB
. R2 V" G, }# y5 O+ b- I   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
4 f( ^2 Q: ]7 b1 g5 D
6 }( @& A# \) T0 b) eNote as well that you can easily detect this method with SoftICE:
* Y" `: R+ C4 H   bpx Get_DDB if ax==0202 || ax==7a5fh+ d2 i; G8 I& U: n

/ Z2 A' D& m8 N! t( n__________________________________________________________________________
) G  }8 Q; V3 p& J$ o/ {0 u7 Z/ L, a# B
Method 10  f0 t1 a& [1 ?, R1 X  @
=========
7 n0 i. W& D+ [$ D& S5 P6 U! f- p2 S$ |9 I, d* @0 Q
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with( v& G; D! t; v9 X
  SoftICE while the option is enable!!0 b$ d# x5 h- a, d4 V& k
' w3 S) E  F3 Q
This trick is very efficient:
2 j# r& Q( m  a) x; t; \by checking the Debug Registers, you can detect if SoftICE is loaded
. q, j' I- ]# i$ D4 l: x" [(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if, M6 G6 T5 Z$ B
there are some memory breakpoints set (dr0 to dr3) simply by reading their. Y+ w. M" y7 B" _# A2 K0 U
value (in ring0 only). Values can be manipulated and or changed as well8 C. j8 I% S/ m  I2 f8 s
(clearing BPMs for instance)
$ n6 S" N) X3 F* ?, g7 o8 s
! l( n$ n/ i% g__________________________________________________________________________0 ^! C: x3 y& o9 P: a9 p1 X
' i4 W- u1 @, S+ O. d7 I
Method 11( o6 S" G7 `; x/ Z6 w; j1 {$ Q
=========0 F: ~5 Y; c. a' `* @
+ B$ M* T  c! G9 k+ h# n4 o8 ^% Y
This method is most known as 'MeltICE' because it has been freely distributed; D) X1 B2 y) u8 }3 F8 Q+ N1 o
via www.winfiles.com. However it was first used by NuMega people to allow0 n1 a5 c  I7 ^6 w
Symbol Loader to check if SoftICE was active or not (the code is located
5 k2 i, P6 k2 O- vinside nmtrans.dll).
4 V5 B9 c( H- o/ \% y5 C8 ?! V6 i3 ]* e
The way it works is very simple:
  n$ Z! J6 ~( `% `# O' f& C  VIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
- K5 f: |# }5 {" w/ bWinNT) with the CreateFileA API.
9 o! S0 E4 p! [3 O) _1 C
& B8 X# B7 Q7 z# J7 s+ zHere is a sample (checking for 'SICE'):  M1 l, P' G+ w' I

' J7 X8 v2 i/ r3 BBOOL IsSoftIce95Loaded()
' I1 ]( B& d; r3 @% F{
3 Q+ s: C$ r3 W1 h   HANDLE hFile;  ' K, s$ T% ~3 Y( h. S- ^
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
4 ]& y. i# C+ Z                      FILE_SHARE_READ | FILE_SHARE_WRITE,8 s8 m& @- `0 A1 q' @+ X$ g) _1 a/ O
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);! `  `+ o- D# \5 O& h/ s/ C
   if( hFile != INVALID_HANDLE_VALUE )
/ J" q$ f" Q, r% W& }   {( b5 U( g% g  h5 g5 P1 n1 x
      CloseHandle(hFile);1 i7 `3 g9 t3 y4 S" e. r' f
      return TRUE;' T( |$ @1 u* w" {! C: D$ G4 l
   }
$ e5 G6 E! u5 J1 _9 q/ k   return FALSE;
: ]/ P9 L, s  t+ ^1 c. s7 `! V! z}
8 a# g: h" `* c
( k3 |* z/ ^) U' b$ |0 pAlthough this trick calls the CreateFileA function, don't even expect to be
; L+ h+ s/ c% C! |6 pable to intercept it by installing a IFS hook: it will not work, no way!% {% i* g3 n3 l
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
! U+ K' }3 @& A2 E; ~. }service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
) ~3 V8 |/ \' P, M) _% U# Y. Eand then browse the DDB list until it find the VxD and its DDB_Control_Proc
+ |# ~% j/ G: Sfield.) h# ^9 K* v* I& l3 t  P
In fact, its purpose is not to load/unload VxDs but only to send a ! T7 C- m9 G# X  t& E
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
! ^2 d3 H! R: A/ g2 Lto the VxD Control_Dispatch proc (how the hell a shareware soft could try6 T" ?7 K% k6 l% ]* @
to load/unload a non-dynamically loadable driver such as SoftICE ;-).2 W0 R5 O0 `4 O
If the VxD is loaded, it will always clear eax and the Carry flag to allow
! _& e8 Q  j" Aits handle to be opened and then, will be detected.
, N% J# i4 L; TYou can check that simply by hooking Winice.exe control proc entry point
5 j) \% X' ]( vwhile running MeltICE.
* w( q/ @, d7 W) y3 a! X4 X
- s. x" f6 L8 ~5 c* w0 i0 I% q, H$ n7 }& C7 J
  00401067:  push      00402025    ; \\.\SICE
5 j# W7 Q  ~- z9 e+ L  0040106C:  call      CreateFileA
1 S# t2 |! Y% D8 s1 `# |  00401071:  cmp       eax,-001
, A1 w( q  v7 `) A' v, L$ T  00401074:  je        004010916 w' I$ ?1 j4 i

8 |% T) s/ q" I, P6 R" n2 k9 h+ ^" O2 D/ v/ {! ~
There could be hundreds of BPX you could use to detect this trick.
; l0 z- o7 A+ Y4 w2 Q: q-The most classical one is:8 T% a3 Z! f' Y1 T8 p, P: q% h
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
$ C4 `" [5 g4 K+ j1 i    *(esp-&gt;4+4)=='NTIC'- w  ]  K% w$ T% d5 H
' K% V3 i! K) {7 d
-The most exotic ones (could be very slooooow :-() ]+ v: M% J6 J# X& y9 Q
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
0 I4 m2 |0 D8 P# B! t     ;will break 3 times :-(
- |) H% x  h$ h
3 G  r+ E+ X4 O6 s-or (a bit) faster: / J1 Z8 _+ m# U& u
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')7 F' {2 N/ Q. |- x8 Y4 ?! @
3 O; f- ?8 ~* [/ Y. u
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  . x- q: v) s& h( j+ M
     ;will break 3 times :-(
! n5 j8 ^' ^/ N! _3 f7 d& ~, a7 {, \+ L( m9 k, n  m
-Much faster:- O, u+ b5 t/ K5 d2 o5 N  W
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'0 U. x$ r+ ]. N' X, P2 C! X6 \

% C4 {8 Q- B9 y+ a: Y' GNote also that some programs (like AZPR3.00) use de old 16-bit _lopen( M& W, I- k% n1 g3 r
function to do the same job:0 i. t# p$ E: j2 i" p' @
" [. t4 |& b9 J& h! j4 Y7 B1 l( X
   push    00                        ; OF_READ" H7 d; b* `' F1 `% E
   mov     eax,[00656634]            ; '\\.\SICE',0
* ~0 j- @& [  R  G8 L$ ]2 z0 {   push    eax9 F0 l% }7 ^' k: p) m* u. c) [
   call    KERNEL32!_lopen
- C- T5 Z; t9 A; E. L   inc     eax
- l5 q# X+ K, ^: }, u& S! k  A   jnz     00650589                  ; detected
7 p  ^: z. I- H$ R+ J; q* U   push    00                        ; OF_READ
9 d8 o; ?, f5 s+ L2 w8 E   mov     eax,[00656638]            ; '\\.\SICE'
: ~9 o1 K9 k& ^" L5 I   push    eax
6 r- g4 Y% C( z7 W7 `1 k, f# H   call    KERNEL32!_lopen" y$ z' T$ R7 N) I0 A- t$ H
   inc     eax
0 f; P" i5 @- @. \; o$ m   jz      006505ae                  ; not detected/ r+ w- o- [3 e& H! N" a
& |" r0 `0 J2 Q  w& D

  V% r  c9 O: f, g& q& a__________________________________________________________________________, M" n6 u2 n& e
( X( c7 @: h2 r& g( |
Method 12) ~1 D( ~3 [6 w  V" v
=========/ r# E) p. T  P

+ u  E( C. p. V/ |0 `% k9 b, k/ aThis trick is similar to int41h/4fh Debugger installation check (code 05* j% D8 \. F6 Q: L. @  h9 X
&amp; 06) but very limited because it's only available for Win95/98 (not NT)5 t3 L7 [$ E6 Q) r) R- F. ^
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
( R; D# I$ L7 u3 H+ g
: I9 F; d$ h: ~& K# l$ X   push  0000004fh         ; function 4fh
* ^9 ]1 q/ @" x: l   push  002a002ah         ; high word specifies which VxD (VWIN32)
$ B' ~' u" e! u, R                           ; low word specifies which service
; e8 q; r0 C# Q9 b! {6 |& B                             (VWIN32_Int41Dispatch)
" C8 E% J7 i0 _   call  Kernel32!ORD_001  ; VxdCall
9 S5 f2 ?2 J" m2 s2 ?   cmp   ax, 0f386h        ; magic number returned by system debuggers
2 C& V0 A/ ]9 F   jz    SoftICE_detected
8 g2 j: t0 O4 K+ r% ]. c4 U: }) x- n. M* ~0 j$ [( K
Here again, several ways to detect it:
( m( {+ U' @$ J, X5 j9 E0 @7 @
4 J* N! L+ ^  ^5 k    BPINT 41 if ax==4f% I# T! t7 Q; ^, I1 E8 N# w1 L
2 z2 G6 `3 t2 o( a$ T
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one; L/ }% Y( J1 w' ]( I$ A, K

( s1 c6 o" Z6 n6 r. i# y2 Z- ]    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
* d" V/ Q! z5 h1 e) M' U4 r. q" n7 W" x3 _$ k
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!6 U+ R: K' T' i' C5 _: m' {

5 A/ k& B4 i# x2 Z. O0 P- u1 H__________________________________________________________________________
3 Y2 W4 q) J% l5 g7 a1 ^: ]+ w: Q
Method 13
! v% `; q) ^1 \: H  h" s3 y; a=========& I" E1 b+ J* c# R5 j

5 A7 F9 X+ g& n5 [9 qNot a real method of detection, but a good way to know if SoftICE is
3 e3 Z( e7 j; [( Binstalled on a computer and to locate its installation directory.$ ]0 G  a( G: j0 {# ?8 B4 I6 d
It is used by few softs which access the following registry keys (usually #2) :8 C+ x6 D  B0 S) _8 f6 k

( T* F5 {6 X: x7 A0 q' H-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion& K. T' V2 p& u4 N7 q% y
\Uninstall\SoftICE& l3 q  g2 c5 A/ M8 U- R7 k) L4 O! L8 p
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
% E$ I1 o/ y% C- b$ U% d9 {0 V-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
/ J5 J* b! M  [% p+ I* e1 Q2 x% q\App Paths\Loader32.Exe
% f: o) p/ c$ L* b( z( {9 z  z  U# }. V6 T

* e) M7 z" G) Q; }6 k6 R0 G8 C& _+ PNote that some nasty apps could then erase all files from SoftICE directory7 U5 Z1 J+ A! k" {
(I faced that once :-(
: r# r9 r: e$ O+ ~/ k5 s5 X+ H3 X+ `) M
Useful breakpoint to detect it:
& o) W3 ~! C: {) {5 D8 d2 F/ R6 Y  ^: X& _/ h' ~' S: ~9 _- p
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'. R; V- @. N3 R% Y( P& W/ b- _4 X
! p3 g7 F! B6 ?+ B' F( I: S+ Q
__________________________________________________________________________
3 y! X0 r5 N" k8 A) }0 U2 S- f$ W) Y+ E7 ]7 B7 l  @

+ L4 c0 m' T, O/ h( K4 B. JMethod 14
# h) v  @) e3 T2 k, ^0 n* v, l=========
, J! V; m7 j. M8 h" S; d4 f6 |9 e. A# ~6 V0 i
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
. l, E+ H/ p( _$ j# f2 q" F8 yis to determines whether a debugger is running on your system (ring0 only).) T9 k0 b5 N, z  U- k
4 h% x  u8 v2 b& W7 Z4 z7 j
   VMMCall Test_Debug_Installed! g. ^' ]  m5 o% ?" V/ m% e+ ^
   je      not_installed% M/ B, C7 d* \2 ~
" [. K3 K7 e% q! d+ U
This service just checks a flag." v  c7 [0 w. r/ l+ V
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-8-15 09:01

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表