About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>5 S7 U0 r0 n% M8 F, [0 U( R
<TBODY>5 J, ]0 Y* V+ k1 v
<TR>5 A! x3 _! h, ~5 s& F! F6 b+ L
<TD><PRE>Method 01
1 r  f$ T" x) ?  J7 z4 M=========
& v* c, h/ n2 A* j8 d6 k% r* w2 L
1 U" O3 R5 J& A1 G0 CThis method of detection of SoftICE (as well as the following one) is5 n) e3 C' u! q! f; y# i- v' s4 [
used by the majority of packers/encryptors found on Internet.
3 X, z$ x& t' }! b- L$ DIt seeks the signature of BoundsChecker in SoftICE) f, c7 e% ^( V) K
7 K$ w+ y9 d5 |# I! b2 L
    mov     ebp, 04243484Bh        ; 'BCHK'
% j" P5 Q$ l! u7 J6 o3 W! M    mov     ax, 04h2 Q2 k& e1 f5 E6 Y+ a* A
    int     3       / y, ~0 p4 T8 z' Y+ a
    cmp     al,48 t/ B: w" n; u. p  G
    jnz     SoftICE_Detected
% e' y" ^8 n6 @+ i: i
' L, Q3 h( H; j$ Y___________________________________________________________________________
' Z5 w, C/ b7 u6 q4 e9 q% U3 C0 ~# b0 Y- F4 [
Method 02
; T0 P. \: P) a* [3 V9 {5 J! z1 g=========
1 B) e0 V# x" D/ m
, |- ~2 ?) t, a: V! [Still a method very much used (perhaps the most frequent one).  It is used
: E' a$ u5 b5 Y  i3 ?to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
$ c' X4 j0 D2 Uor execute SoftICE commands...
* U$ p0 ]1 W2 \" V$ T/ R/ `It is also used to crash SoftICE and to force it to execute any commands# C7 E' ?6 U3 j+ o. N) G: O
(HBOOT...) :-((  / E' G4 s7 f- \

2 n: ]3 s# ^& P; B3 CHere is a quick description:7 v3 V2 p- ~# H  b" A8 D% `
-AX = 0910h   (Display string in SIce windows)
) u1 o- Z% Z# r, }8 J& P7 b9 F) B-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
3 `% U, G1 _/ S8 V/ q5 B' @+ q- j9 o0 V) m-AX = 0912h   (Get breakpoint infos)0 T* G; Y% O; W) D
-AX = 0913h   (Set Sice breakpoints)
9 m1 X) s# X5 K# y1 B-AX = 0914h   (Remove SIce breakoints)
, w2 E% j4 \, j$ m4 t" E+ _, E: G: z. M0 q' z
Each time you'll meet this trick, you'll see:' w  s' Q% T, N
-SI = 4647h
+ ~, R/ F& {+ w& c) m! J7 X& f-DI = 4A4Dh
: g" g% T- M1 o' z. N  G- rWhich are the 'magic values' used by SoftIce.
# o& o) |* k& o6 C9 o- S4 dFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
& ^" t& g4 N6 Y/ S# b6 n5 H, c* Q: m6 R
Here is one example from the file "Haspinst.exe" which is the dongle HASP5 R- e. g( Q# c5 v; C; V9 I
Envelope utility use to protect DOS applications:
8 F3 N' ]1 _( c6 z5 G6 _  \0 q9 r( E& k& ^& k
3 j- l/ W  p, p) m6 D( n% E$ U
4C19:0095   MOV    AX,0911  ; execute command.; }) R2 O* ^4 y3 Z% |* f# U4 w
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
$ C3 r, E. M- t; F. a1 `4C19:009A   MOV    SI,4647  ; 1st magic value.- q" B4 D: b# J/ w, E0 Q: k2 w
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
3 p" L) N/ o7 {. f9 b1 h! c3 d4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)" Z8 B. c: o2 r) `
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute' z! ?1 O; B+ _9 N; J! H
4C19:00A4   INC    CX
) J9 U& A3 y" K! k4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute' ~3 K% L1 a1 }
4C19:00A8   JB     0095     ; 6 different commands.8 Z3 S- v2 P' F! N% ^
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.3 ]7 P) _$ v( c% N
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :): g2 |) s3 _4 D" \$ H) J2 L
0 D% d5 u; [! g
The program will execute 6 different SIce commands located at ds:dx, which/ ~4 [. ?9 F3 v
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
) F' d6 B6 b- K$ i6 y  r( }& d2 \7 n# s) J
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.; _1 k+ \# B( Q6 {. \3 A: T
___________________________________________________________________________# U- i- g' W% X
4 t% r& D& k. I& s

5 `, W" ]: J: r% G4 v, z# tMethod 03
4 ~, E% [( e9 F) O8 F=========0 n! `; }2 _& y( R
2 e6 I: U# V5 D% D( Q! a+ d% C
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h& K6 ]1 ~1 a3 Y$ W* V
(API Get entry point)
( u6 L0 e  W$ N5 }  t1 a% D5 a) b        
- E9 z$ Z  _+ k$ i* r7 j3 k( _+ @3 {' D
    xor     di,di! y! v4 X5 M. }: u/ T. q3 g: D) L8 H
    mov     es,di3 X& ~' |$ W7 j: C9 N& r
    mov     ax, 1684h       # s8 p  ^8 o8 b9 f
    mov     bx, 0202h       ; VxD ID of winice$ w# {% ~* Q5 p- Z6 W3 x, j" j
    int     2Fh# S- a1 q; @: i7 }( U8 Q+ B: O
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
8 t7 Q: H7 W# ]$ a( |/ _    add     ax, di" `! Z7 g) X  _5 p4 P4 n
    test    ax,ax
+ Z# S2 D7 ^& ^( V0 W    jnz     SoftICE_Detected* E$ U! R) o- s

! i9 H6 l4 ~# W  {1 a: O  w+ u+ \___________________________________________________________________________
/ Z8 m9 ?) k' y) t/ B# e: o+ g9 I: K, A6 k2 p
Method 04
2 ~  g9 T/ ?! k% C2 j: P$ {4 G$ T+ P& R=========
+ q% X: \9 q* y# X( K' J/ F
6 X) @! n/ a, y6 u5 p0 KMethod identical to the preceding one except that it seeks the ID of SoftICE& S1 r. X$ z  i. u
GFX VxD.' S5 ^2 n- W3 n" w, }+ d" o7 y2 q2 p

" v  Q# H$ G# E+ g    xor     di,di
- ^1 m7 |" R4 A) {! q    mov     es,di" _" L+ b9 _6 v5 E
    mov     ax, 1684h       + U  N6 c5 Y8 Z; F- z
    mov     bx, 7a5Fh       ; VxD ID of SIWVID
3 i/ g0 L- B  M8 i    int     2fh4 ~: X7 Y2 P$ m$ n1 ~
    mov     ax, es          ; ES:DI -&gt; VxD API entry point$ R; v1 U4 a* c# Z# R: N1 `" {
    add     ax, di. T8 C  h8 u$ i7 M8 D
    test    ax,ax
8 G' Y' T! w0 d9 m# l& f    jnz     SoftICE_Detected; R1 \( M/ F! e# E, w1 v
4 A5 \3 a9 N' W4 K
__________________________________________________________________________, @+ J6 _8 B# [! ?9 K

) y, `" h+ g+ h+ c! @- H) A3 E; Y/ G9 q4 D  A" ]7 Y! x
Method 05( D& e9 \5 t9 U  P( p6 s
=========
* n; f! x5 B/ W$ Z5 p
9 X- F, q+ S  H# `$ pMethod seeking the 'magic number' 0F386h returned (in ax) by all system
. Y7 ~! G* {8 |2 y+ pdebugger. It calls the int 41h, function 4Fh.
6 ~7 C& u4 w& t( _  {; cThere are several alternatives.  
' f# Y* G: a; T# v
6 e' @- N2 i$ V# F0 ]1 ZThe following one is the simplest:
' H! @4 |: R( \; d2 S/ f8 p/ @! u4 L# F
    mov     ax,4fh
! h. u9 E  P" u0 t    int     41h
7 {6 o0 F& n/ [/ D* \* B& n    cmp     ax, 0F386
7 ], s1 o5 H$ e/ c. _$ j    jz      SoftICE_detected4 I6 V; Q/ k3 W$ b- e0 h" P

" k% F: ?) g( \- B7 u% ~8 t/ }
0 g/ S9 k+ @2 \/ Z2 X9 o# Q4 F- CNext method as well as the following one are 2 examples from Stone's
9 t! ]8 N0 ^) w' }: v- A"stn-wid.zip" (www.cracking.net):$ t5 s( G. ]/ o6 y* d6 J0 D. s
+ T4 i0 _9 s0 S$ P
    mov     bx, cs
9 ^0 `, B5 P% }4 r    lea     dx, int41handler2  V7 C% K, g( E& {9 ?( ~, o& l3 U
    xchg    dx, es:[41h*4]2 C2 i2 Q' y) l# p
    xchg    bx, es:[41h*4+2]% l8 g4 z' y2 V, B% k. C$ m
    mov     ax,4fh
" {6 _+ L" s- C/ Q- n$ n/ P' V" ~    int     41h- K: q2 M( {. w
    xchg    dx, es:[41h*4]2 k  q& ~4 p5 x% j# K4 [3 ~
    xchg    bx, es:[41h*4+2]
/ U9 |( Y) h# l5 S: J9 k    cmp     ax, 0f386h) E. V% l4 A( P: f6 t6 D
    jz      SoftICE_detected
, K6 [7 d; e% M; o8 D% m8 s# e4 V4 p: Z& m1 i
int41handler2 PROC
7 n; q; w9 k: N5 i    iret
3 Y. D3 G' h2 E4 E6 O' j, |" ]int41handler2 ENDP
3 x- [: h3 v: c5 j  }! J
6 B/ Q* l2 R* L2 r% \7 V0 y/ y
+ V* u6 M) q" Z7 M0 u3 P  a: w# ~_________________________________________________________________________2 Z0 a; {: a8 ?2 b" D, Z
0 s" Q; e$ \* M

4 i- b5 |2 C* V" U0 y# dMethod 06
" m$ R1 q: g& _) @" @# T4 j; {=========+ r9 w; l! x4 `6 O

' P/ l% q+ M4 @1 Q! ~* h% M: v7 \  m. y$ r
2nd method similar to the preceding one but more difficult to detect:
4 m7 }+ h& D# U2 q8 V$ ?
0 T/ I2 i* K- W& T$ |
; r1 I5 I8 ?! o8 I# c3 dint41handler PROC
' u/ Y7 T2 I* t! K1 J    mov     cl,al
4 V  P  Y% P/ G+ \    iret: E" f3 {$ l& r" \  d
int41handler ENDP
7 J5 K% r3 T( x. n# K8 s0 d: Z/ c* T% H6 c0 @/ F5 H3 g

0 e2 X, G  |$ }0 [7 Y( t  _( G    xor     ax,ax
& u- Q% b2 t! ^" n2 m    mov     es,ax- c; A3 P, U0 o' p3 j
    mov     bx, cs
' a- m$ {( y9 S) B+ @0 ?& F! a    lea     dx, int41handler+ _& }# k( G2 o) b2 p' T/ _3 K
    xchg    dx, es:[41h*4]; E) [. Z1 |* R5 x7 Z% W  q4 Y
    xchg    bx, es:[41h*4+2]
: z5 V2 y$ h) @% k0 v    in      al, 40h
1 {* y3 }- ]7 {+ L. f3 `% L    xor     cx,cx9 V$ t+ `* h  V4 u. v
    int     41h- Y+ X& M. K3 `2 G+ }1 @
    xchg    dx, es:[41h*4]
- A3 T8 y/ O7 X6 Y    xchg    bx, es:[41h*4+2]7 }. C( T4 c, y, V$ }0 ^
    cmp     cl,al
5 C7 `# g7 ^, U+ f    jnz     SoftICE_detected+ B8 ~/ Z& T' n/ u* m2 \5 L

7 O2 w% I! @& G% u7 f_________________________________________________________________________
; I( d, k- R$ ]) ~- J; S! C( E4 e0 D$ M7 o
Method 075 L5 n% m; F+ |) u5 V1 K
=========
, X( M+ C7 F4 a; j
, H- ~- M: v3 `/ P* sMethod of detection of the WinICE handler in the int68h (V86)
: n8 N9 a* s0 E0 y/ y# A$ b7 x+ o7 t) D' K
    mov     ah,43h
# z. o( L3 x9 X- ?, W: S0 b    int     68h
( b3 k4 d; G+ ]    cmp     ax,0F386h$ U( n" W% W* t' O0 N, Z, c
    jz      SoftICE_Detected; S& b: p/ i4 R9 Q# `0 A- B

$ ]: E! O: q1 T3 R2 r
; H$ F. O# \7 l0 I=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
, E$ o, d6 K& G; E% z/ x- F2 M   app like this:
: X" C  o" q1 |/ Z$ }/ G; [. X
' Z# m/ u* s) k2 m   BPX exec_int if ax==68; [' O3 w3 D5 v( p4 q3 P; q
   (function called is located at byte ptr [ebp+1Dh] and client eip is
# c) O% o& l( j7 H& S. T, p   located at [ebp+48h] for 32Bit apps)  u# S* T2 i/ T0 a6 o
__________________________________________________________________________
) D0 x+ d1 P* ~) K5 L/ p% E3 ]3 f% l1 t- `  S7 f
8 f0 Z6 `3 u2 f! a- y- }
Method 080 @8 L' t7 i% ~; ~& ?
=========; \  |# l1 K9 w

/ z$ L" r" W  T) ]' y* KIt is not a method of detection of SoftICE but a possibility to crash the
  T4 ?1 @) _$ k- x: F# B* Usystem by intercepting int 01h and int 03h and redirecting them to another" F! A- x, U( e' i& x# l, e
routine.
0 c# E9 z" H4 }0 L* fIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
( F1 P2 Y  R1 \to the new routine to execute (hangs computer...)
, x+ x, S8 c0 b" n! _5 |0 d0 I8 i. g, H3 r
    mov     ah, 25h
- P, F& j8 D; k4 ]- v6 Q    mov     al, Int_Number (01h or 03h)9 K- x( e; K1 x8 z' a' f  h4 z- P% Z
    mov     dx, offset New_Int_Routine9 e8 I2 Q/ l/ N4 t$ a, |) G3 j
    int     21h7 M+ ?9 E5 v! h7 X) {0 h* {2 P+ b& a
* ^6 m9 X7 O% R& Z
__________________________________________________________________________3 {6 i5 b% x2 Q0 |6 i3 V( L
) _- t1 w1 o$ j; }3 e8 s" B
Method 09/ V; R3 `- L; e8 A* _  P4 ~
=========
4 o7 E0 T' T3 W' |) x
/ M9 X: ^0 I0 M, kThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only/ {, N9 d, U$ @: f) J
performed in ring0 (VxD or a ring3 app using the VxdCall).7 g; h# x" k0 q/ K
The Get_DDB service is used to determine whether or not a VxD is installed
" [, T8 Z6 j1 |) ?for the specified device and returns a Device Description Block (in ecx) for$ F% R. Z* d, }  E$ u
that device if it is installed.
1 c. _/ x8 s0 H! e, S7 T" g4 \. h8 ?) k: f4 `: b
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID: b4 [& @3 b, T. G, W% z. B
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
  T' e5 G" e2 x4 c: i# e  Y! f/ @   VMMCall Get_DDB
# i4 j6 |8 C8 g+ \   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed/ ?$ ]  H9 G; Z% k, c$ M$ P9 [3 ?  D
4 K$ K+ P' f0 A9 e6 I) s
Note as well that you can easily detect this method with SoftICE:  {7 n0 v7 Z- m7 w" a9 ~
   bpx Get_DDB if ax==0202 || ax==7a5fh
5 {  c! Z& A1 m% i+ |
' R# Z* Y' D' y0 ?" N__________________________________________________________________________3 }$ I& O. ]& V3 b* P% x/ e$ E
5 R. h. q7 P& E/ D
Method 10
& k: D- B! E  _' s/ _$ I" W5 u=========
2 I" Q4 B% G* Z& K& f+ D
, W! R: x" X$ D. ~& ]=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with* a& |( f# R0 ^
  SoftICE while the option is enable!!
- h: H( d* w# n5 c- N) q  l6 ?/ g6 p8 u; I% Y
This trick is very efficient:
% r- ?( b( o( G# M; uby checking the Debug Registers, you can detect if SoftICE is loaded
; D+ Z* K9 H7 G3 r3 G(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if2 z. U$ s. {& j( P5 k" J/ i
there are some memory breakpoints set (dr0 to dr3) simply by reading their( R: ~; J& L7 z8 K9 G
value (in ring0 only). Values can be manipulated and or changed as well3 ?7 I* I4 x. A, j  s
(clearing BPMs for instance)0 X! n- l4 O6 M/ Q+ u0 D" d: B" P7 F& z
- E0 d, R# l: ?8 I, R: S6 v
__________________________________________________________________________
+ O+ {) x1 I, E7 x: I% s
* V& @9 W$ S8 oMethod 110 A+ m4 [2 A: ]! x: O
=========; ]. h: m# y1 {6 a4 P2 q- C/ V

# m7 a( l& X, O8 y5 hThis method is most known as 'MeltICE' because it has been freely distributed
6 I0 q4 f" k1 V1 M4 Nvia www.winfiles.com. However it was first used by NuMega people to allow
( c" c! H) p! w, gSymbol Loader to check if SoftICE was active or not (the code is located7 _$ ^5 \7 T, \  S6 Y5 Q
inside nmtrans.dll).
1 D7 L0 c% @+ {, d; e0 \* t# [- ?  ~6 B; k- X  u0 G
The way it works is very simple:+ _& e6 D1 ^* t! `% j9 \
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for5 W3 d' F3 \8 W2 g/ V) Q
WinNT) with the CreateFileA API.0 S+ c9 ?) [# n

9 Y  b" F: B6 N" ~4 K& }) G3 j7 NHere is a sample (checking for 'SICE'):
- S! R$ k0 n! v* o, \  j
' z- j9 Z8 j5 k% M! j( s# {2 DBOOL IsSoftIce95Loaded(); o" u; y# T4 {1 v1 X! |" d
{
0 v& m5 q5 u1 f/ o4 U8 d& S1 a6 }$ i   HANDLE hFile;  1 S: @1 ~! g% P- x( j; e
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
( s' g$ l9 s0 R" S6 k! i                      FILE_SHARE_READ | FILE_SHARE_WRITE,
4 S0 f+ j6 [1 b9 _: z7 n; L+ y                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
( J3 ^) t' ]5 G/ w+ `$ o( Z) J   if( hFile != INVALID_HANDLE_VALUE )6 H8 Z- q7 A& Z# |3 c; g$ B
   {
/ L6 g  C- l# t1 M& _' ]      CloseHandle(hFile);
& O. r& U9 @6 x3 y9 T      return TRUE;. J8 B$ {; x; [
   }
: R8 d/ N; n) I7 Z! z   return FALSE;, |9 _9 B- C; E) R8 q
}
0 h) }1 ^1 P# Z6 d# \6 {1 h6 d/ }& O* g
Although this trick calls the CreateFileA function, don't even expect to be- z5 S' {. \2 ]8 |3 p" v
able to intercept it by installing a IFS hook: it will not work, no way!
# o9 L9 b% c; l' RIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
  x0 M5 G& J+ u" ?5 z: O5 Gservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
3 N$ [" [$ ?0 f9 J8 x  qand then browse the DDB list until it find the VxD and its DDB_Control_Proc
8 t  L; t$ f8 k. z* A/ `field.( f( g# g" a- |# t( O' t: @
In fact, its purpose is not to load/unload VxDs but only to send a + ?, y6 {: w  q; n
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
* K: k) d9 B$ m+ Z; Cto the VxD Control_Dispatch proc (how the hell a shareware soft could try
9 s5 R7 s+ ^' }6 eto load/unload a non-dynamically loadable driver such as SoftICE ;-).
7 o# j: M# b, ?9 Y6 jIf the VxD is loaded, it will always clear eax and the Carry flag to allow) s1 h+ O1 z. f6 p
its handle to be opened and then, will be detected.. I, D, m: S8 W+ b/ X$ @
You can check that simply by hooking Winice.exe control proc entry point2 C1 p1 @0 k! O) l, B5 Y* U# \; A
while running MeltICE.
( {9 ^4 g4 D+ G8 L0 m9 i$ p7 K6 L4 k- ~" g, t7 w' i9 G
! _% F: ?" m$ A9 F$ d, c
  00401067:  push      00402025    ; \\.\SICE; {1 @+ O* \% g* S+ w/ N/ J
  0040106C:  call      CreateFileA' a- h3 O# b! U" d5 C8 a; X
  00401071:  cmp       eax,-001: J2 k0 x; L6 v! ~: i9 }* D
  00401074:  je        00401091& C2 x) c( D' s5 Q- B

3 d2 K, y. ^: V! P6 {7 F* q" M. ~1 e' `; h, f
There could be hundreds of BPX you could use to detect this trick.
0 H/ W2 Y3 p' r-The most classical one is:7 T$ Y0 ^$ n$ `/ U7 N  w
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
% Q& _; _3 {7 }, T% _% ]/ F5 i    *(esp-&gt;4+4)=='NTIC'' k1 u9 D4 B4 S; E  r7 |

- v6 d8 T- P5 v. l0 y9 i-The most exotic ones (could be very slooooow :-(
9 ?( @, l8 l6 @5 ^4 w+ u   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
, }2 U; `) Z! v( Q' {( g( ]9 I     ;will break 3 times :-(5 a/ H6 {9 j! ]- p
( P0 ^& d) j8 j" K+ Y
-or (a bit) faster: 6 @( l! U& W/ h) c
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
% L) r3 m0 B% L8 m3 U5 O! e
! Z4 Y2 x; V% o8 v& O   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
& O& G5 _+ ~5 g, u3 X+ d3 D0 ]     ;will break 3 times :-(
9 I* L0 c. m8 U4 K! v& b  g
4 v* W1 B% i1 {7 ~" `# e8 m9 K) _-Much faster:
2 ~3 H2 v) v: z) c* Q5 c/ \   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
5 C5 r% ]; Y9 S! @6 a, x' r8 R, ^: j) _% e8 j
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
) k  S9 ]0 j% W( ~) M7 `$ L! @" G8 U* Zfunction to do the same job:( x) K# @1 s: \. S
: ?4 q# ]9 `4 T+ o! A8 [
   push    00                        ; OF_READ
/ s9 ], j- V' R   mov     eax,[00656634]            ; '\\.\SICE',0
3 K. R1 V8 H9 O1 r' U9 I, Z   push    eax
7 b6 J/ ^2 _: A4 B2 i: b   call    KERNEL32!_lopen
, w0 h* H6 U: p  g" b) V   inc     eax
- t% C- O1 @$ J% i5 ~* Z# d   jnz     00650589                  ; detected
2 e7 k4 C1 X- o   push    00                        ; OF_READ
8 Z6 q7 z0 L- `$ i! Z7 r8 U; Y7 g   mov     eax,[00656638]            ; '\\.\SICE'
$ c* N5 Q& R2 Z. t" u, ?$ X! F2 X   push    eax
# p( S/ s$ {* m+ E1 z$ B5 y. R6 e4 I   call    KERNEL32!_lopen: a! y5 A& g: ~6 r3 S' ?7 O
   inc     eax
5 Z2 [" j0 X) [2 d% |( a   jz      006505ae                  ; not detected) y8 m1 H- w3 F/ c* E) X% k
3 {2 }, i1 ]4 ~  Y8 T

" E7 e8 c8 Z: E& j+ }9 x" b9 E__________________________________________________________________________
# R) z9 W6 b7 C6 D
* H1 l3 q. O7 z- g5 E  `2 r8 wMethod 12: d! j' u. O- d! D5 f! I& d/ A; d- D
=========
# s; Y) t6 R2 J& }1 T$ O
& M! H! z2 t& k: u% P6 OThis trick is similar to int41h/4fh Debugger installation check (code 05
; [7 }* t" ?" Y) O&amp; 06) but very limited because it's only available for Win95/98 (not NT)6 X! r) z  H. o/ k
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.% q  I5 B  u6 F% A
8 D. O5 i) ]0 p2 P% Q4 ^& F: R! Q
   push  0000004fh         ; function 4fh% {) S- J! x2 A2 f0 m7 B! K
   push  002a002ah         ; high word specifies which VxD (VWIN32)
2 P7 _8 z$ ]. i+ I                           ; low word specifies which service
( q" O+ ]( h+ T+ \3 c  P                             (VWIN32_Int41Dispatch)* t8 o5 i2 N/ ^8 [$ z
   call  Kernel32!ORD_001  ; VxdCall( n/ K* N5 e/ e' A
   cmp   ax, 0f386h        ; magic number returned by system debuggers
& j& C1 {9 M+ s% a* d4 d2 h   jz    SoftICE_detected( w4 z" M5 g8 }- }# [2 O4 O

7 ]& Z+ C1 M9 ~$ }$ hHere again, several ways to detect it:
! _" E5 G6 ~. K& q% t* x
8 G+ I' e0 T1 B# @6 W8 Y9 G    BPINT 41 if ax==4f1 Q4 r6 c% v$ J: P/ S, ]* c  z% O
9 R9 ]2 R! U2 ]  F: G! H
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one3 Y7 n9 d* d* `& a) O& F
" T. N- j: K6 Y( E9 h
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
+ S2 t! ?* b3 z4 u
0 Y7 }; V; K! ?! |3 H+ A    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!  l  S. y2 O( w. @1 N0 @. O: p

- G# R% |. T' y* a* ~__________________________________________________________________________
( |# }  l9 @+ P+ G3 y3 ]9 Q3 q
8 W& z8 @8 O6 p% y* K$ v0 |Method 13
, ^" S, a8 s$ L6 i# g=========
4 G9 Q& @. ^) X( B* P7 Y" m7 ?; h8 ~
( Y/ i% @3 p+ s9 n. e8 [% tNot a real method of detection, but a good way to know if SoftICE is
* |' X7 V; r. c4 j4 O& `' n" sinstalled on a computer and to locate its installation directory.% J* U" x" _2 g# e
It is used by few softs which access the following registry keys (usually #2) :
# V# G( R9 f9 M% t, q) R$ g, z0 A( p! r% ~$ t
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion! [8 o& z' x& k4 ]8 h2 m' s
\Uninstall\SoftICE0 q( E5 K  N6 W3 m
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE) B7 l  R' a$ `4 E- k7 i$ k9 N
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion2 @5 K( b9 N, ]: S. @
\App Paths\Loader32.Exe0 E4 J  L. s; Q) T- t' O* C
5 d, u9 d* O; M7 L$ w
$ v+ F  t( Y6 H# v1 ~. z
Note that some nasty apps could then erase all files from SoftICE directory
: i* Q4 f7 Z% S+ J1 w, D(I faced that once :-(
1 W9 y! z& T/ Z$ `$ U2 Z4 s# p8 }; f
Useful breakpoint to detect it:3 P& _# n: `0 s
9 T0 }7 p) j/ x  H) T& e
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE': P% Q7 t4 H& g: v+ F) i7 h3 q2 \+ `
( u" P+ G8 ?; `6 @
__________________________________________________________________________
# V8 f+ p9 b8 B) u* g% O' i& c1 g' e$ y! o- _

0 f$ U& N$ R; b3 R1 JMethod 14
4 Y( ^7 Q$ q: {( e, u=========
7 o4 m) I$ _; t8 ]" G, C$ K) W; p/ I5 q
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
3 O9 v* [) o/ U( Pis to determines whether a debugger is running on your system (ring0 only).
5 [9 @' n& c7 W4 }' {, S3 t- Q0 r8 ?- x2 j+ m$ x& z' @
   VMMCall Test_Debug_Installed
- `/ ^1 e9 i2 r7 W, b1 [" x; O' v   je      not_installed
0 h* r; W8 y5 K' F7 v9 V# X
& X$ u* l3 ?! F" u4 {This service just checks a flag.2 b8 o7 {! C$ e
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部