About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>. H' i3 [2 Z$ P2 g/ x, n+ w
<TBODY>  _, i9 D( u% t* L( p
<TR>' f  |. ?  ~- @, d" |/ P" Z) E
<TD><PRE>Method 01 7 m6 i! H8 r; Z4 E) y- T' X3 e
=========; b4 Y. j, m2 `; \

: \1 [) U! U0 Y1 D( s  qThis method of detection of SoftICE (as well as the following one) is7 O3 H5 ?: H+ r& m* B, }$ d, |
used by the majority of packers/encryptors found on Internet.
9 M) r  O3 G5 r0 A& hIt seeks the signature of BoundsChecker in SoftICE8 P8 Q/ ]$ G7 h4 t& d; X+ H5 s
) v2 v' q; `" m% |+ T+ g# A; X" R
    mov     ebp, 04243484Bh        ; 'BCHK'* l. O7 y. r1 k
    mov     ax, 04h  Y* X+ i0 v# O' c
    int     3       * x$ H* G8 H1 m: I: j
    cmp     al,43 M& ^  H) B/ p, U: d
    jnz     SoftICE_Detected
7 H6 q, \" ^# c0 W' V0 c- [
' p, Z$ G" Y! r5 B* K7 u___________________________________________________________________________
; z4 c9 {8 @4 O! A5 [- Q+ S
0 D$ W7 i1 {( c3 `, fMethod 02) L2 F) A" c2 M8 F+ `
=========3 Y& y7 ?* T% D4 M
( k  ?9 z0 H' M+ m6 G5 K# Z5 J
Still a method very much used (perhaps the most frequent one).  It is used) I7 j. e+ R9 o, W* `2 w9 V
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
3 x: }) R* n' _0 Qor execute SoftICE commands...
# M, j8 ^( S5 D1 uIt is also used to crash SoftICE and to force it to execute any commands
! W" |* t3 Z5 X% N$ C: B* h5 x$ s8 z(HBOOT...) :-((  # y9 W  e3 ^, T% L$ z/ I

( |8 T; `0 k! Q" nHere is a quick description:
9 b4 u% H( p" v# N) Y; Q-AX = 0910h   (Display string in SIce windows)3 T; c4 N! N" ~& J6 S) x8 d
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
, C0 \4 M: s( O6 W-AX = 0912h   (Get breakpoint infos)2 V# j9 J1 c  m
-AX = 0913h   (Set Sice breakpoints)
1 S$ T# n; d5 I-AX = 0914h   (Remove SIce breakoints)
' d& T2 ]3 U: K) R0 e/ C( V; [
; d- j; q- q6 l9 z& d# ~Each time you'll meet this trick, you'll see:3 h' \2 G7 G( P4 X. B" s6 |* X
-SI = 4647h' f" g& h3 i# O  C  p
-DI = 4A4Dh
' H0 C& _2 E# h; a4 OWhich are the 'magic values' used by SoftIce.
; M1 n$ F+ n7 Z- B7 KFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.% `9 A7 _2 O  C+ Z) d

1 F: ]8 d" x9 j  l6 Z% b3 RHere is one example from the file "Haspinst.exe" which is the dongle HASP
+ M3 h3 s# q  ?2 ^0 hEnvelope utility use to protect DOS applications:
: B8 l" g4 X$ q, e
1 E7 m2 |' b* v! _  {) R8 g
4 D" J% ^. M- C; {5 q7 ]4C19:0095   MOV    AX,0911  ; execute command.3 j( J" X! V" h, j+ S$ S0 ~) E
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).- q3 L+ Q8 S2 Y% Q
4C19:009A   MOV    SI,4647  ; 1st magic value./ b: z0 E1 Y0 @0 Z4 r: L
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
) l5 F2 b& s6 p0 C0 p4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
2 M. b! q# e" w) o! b. j  H4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
& W. g6 ]9 X/ A. w6 f4C19:00A4   INC    CX
- [# ^9 ]3 J% E  i8 Q9 m4 m8 J4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute( S( H& L1 ]% E8 {/ ^; x( o
4C19:00A8   JB     0095     ; 6 different commands.7 V/ ^- P; G8 L7 @+ q
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
/ h. V% v7 G- f; i" A9 @- |4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)& p. J  y5 ~* G& n+ b
0 M+ i7 C+ o! N- w6 n. l
The program will execute 6 different SIce commands located at ds:dx, which9 N# ]. a( ]  {5 |% m. R
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.! T' R0 z, B+ L

# R" `: k8 p2 I; @* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
! s# p: M/ s) ]. x5 |* [___________________________________________________________________________% J" e7 t7 m1 S5 D' I

) Z% ]6 y) ^( h6 T; `8 t9 Q6 a4 Z5 a( R
Method 03
4 \& V8 U- ~9 j4 e6 m; w7 r# f=========
6 w1 y! n: E6 \% X/ e! L0 o1 r+ f7 I! }# N) p
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
& h% i/ H( o* K4 Q4 r5 Y(API Get entry point)
0 _/ @" H. i. z9 I# A# r        
$ D/ M5 h, M0 X4 N  V$ Z3 f; A' K* z9 ]: ]# W9 o
    xor     di,di# J& t0 j& Z9 M1 Q. [2 M( I
    mov     es,di# x% E8 n3 X7 ~% f/ @; h: h* ?( g
    mov     ax, 1684h      
" y* Y, X* s  k4 `! C; _1 Y    mov     bx, 0202h       ; VxD ID of winice
, v# M$ W' @, Q8 A; v, V7 ~, m    int     2Fh7 C: a* m% j1 [. f' k( p# i0 n
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
: n0 `9 M6 ]* v1 I/ d    add     ax, di& n) `6 T6 f- T+ k' r$ I- m
    test    ax,ax# O& p% Q: G% p3 o* ?9 H. J' N3 D9 c
    jnz     SoftICE_Detected
# e  w$ C& Z8 @7 e
6 U! v# ?9 h0 ?) s4 E  t# z- A% c( P% L7 g___________________________________________________________________________
  Z& O+ |' q, |
2 d8 u8 i! [/ F% m1 VMethod 04
1 s# }! k  M% e7 s4 i=========
, l- n, {3 V+ f' @" B; i* V& f" u3 Q/ H9 F9 M" o; T
Method identical to the preceding one except that it seeks the ID of SoftICE
' r( R' \, t; Z8 e$ T1 w) oGFX VxD.& u2 B1 X4 V- w% M0 `! f/ I2 P. G( t

/ ~( A9 D2 |3 p1 D! i7 Z    xor     di,di
, S) W$ ?# M9 n3 r! g0 n    mov     es,di
7 Q& T( ~7 w0 _" b6 s, ~    mov     ax, 1684h      
) j7 ]6 [* f9 B8 D7 C8 h. W( J    mov     bx, 7a5Fh       ; VxD ID of SIWVID1 z/ P2 @+ p0 |. g
    int     2fh
- ?: A4 P( E6 y3 ?) v( o9 x    mov     ax, es          ; ES:DI -&gt; VxD API entry point
9 `1 N7 c# Z5 d$ u2 S9 c# O    add     ax, di! p1 c! B! @# T, j6 L5 ^/ T
    test    ax,ax7 f8 X/ S; v$ I
    jnz     SoftICE_Detected
; h6 W2 b2 C( W
$ G) e; {) Q- t" X/ \+ F" B7 @" c% V__________________________________________________________________________  t* Y6 M* J$ ^$ v

  L, T# T% T5 k- ^7 M: w' }: R8 G% L/ v% y% T8 n# }
Method 05% F; s$ R9 U% S( |" c
=========
, U0 E, a- [/ w# r+ U0 ], h8 s  A% @  e* t- e
Method seeking the 'magic number' 0F386h returned (in ax) by all system( z) @* q1 t, V! c
debugger. It calls the int 41h, function 4Fh.
6 l- J, u! E( g; G5 G( ?5 ]" w0 I  I0 fThere are several alternatives.  % x1 G# r0 y+ `

5 W6 d5 g( ?* X+ Y0 X  bThe following one is the simplest:
' l) A( x$ P# m) y/ k  S3 \: e  I4 x0 M( J  K( Y5 }
    mov     ax,4fh
( I9 O# T5 P. j- I    int     41h3 f# g, S+ G8 p! R
    cmp     ax, 0F386
7 R0 X4 f. j+ u' C9 Z1 A    jz      SoftICE_detected  z* J  u' M% j
/ F/ F& S' }' A
: i! s. z# Z, e7 ?
Next method as well as the following one are 2 examples from Stone's * G: ?8 A% D  X0 W& V2 V
"stn-wid.zip" (www.cracking.net):+ ~4 A" M) J, m# ^
8 k) g% b+ Z1 i  ]* T  o
    mov     bx, cs
& ]9 e$ e6 d1 A/ j( u) ~3 g4 L    lea     dx, int41handler2
2 k0 r' T( K7 I# h    xchg    dx, es:[41h*4]
" o8 T4 f4 o# `. V7 n2 F% w    xchg    bx, es:[41h*4+2]
+ F0 `" \) A" l# D# v8 g    mov     ax,4fh
! P1 V$ ]0 `3 f5 v/ N# P* W    int     41h7 Z" O/ s  \& z6 B' X) H
    xchg    dx, es:[41h*4]
* x4 n# q% s+ t3 s    xchg    bx, es:[41h*4+2]
, q$ [/ ]. e: I6 o    cmp     ax, 0f386h
7 S4 i- y) Y& f9 a0 P' \9 M    jz      SoftICE_detected
, l! Y; @& }- g4 N+ N+ {& e" T- D, V1 S2 r' c1 L' A8 ?% O
int41handler2 PROC- B1 _$ s& F' u% L% m3 |
    iret. b. `7 D" p5 O/ k" K
int41handler2 ENDP9 ^$ H) j2 Y" R$ [7 C  U) y

% a: q, L; P+ e$ P6 z
: P, s2 G8 H0 t; ^; D_________________________________________________________________________
) Y6 Z% T9 Z, S
8 V! h# X5 g: l/ T1 E/ [6 d; N+ r
( t  S) V9 [4 q+ v- r9 H/ s; VMethod 067 f. U! D+ o3 g% H( {
=========
+ G0 z: Y$ I. ~: ^8 R8 v% E6 W' ^! l& z' U$ I
- J1 E) ~7 c& A. A0 `7 I6 w! G
2nd method similar to the preceding one but more difficult to detect:. p# u; ~+ U' w. U' e2 c: ?5 t
4 D. ^! y  @2 V  o1 @  L" [
$ P: |# R3 D: e: [7 B0 R
int41handler PROC
: U" ?4 ~& ^+ L& P$ b7 w    mov     cl,al5 j, w0 \& n1 Y- r
    iret7 n7 ^3 n/ V+ X
int41handler ENDP
+ C* I7 Z8 m7 h$ X# R& u" o9 }
2 ?' \2 |" |+ r
& ?# n" P0 W: r2 a! r' B8 f/ @  [    xor     ax,ax; I# Z' b5 I% [/ K4 V
    mov     es,ax
* k: u2 i' L/ ~2 R; }0 p    mov     bx, cs
; C* Y; |4 h6 a4 r9 B    lea     dx, int41handler
; n  h6 L, t; {6 V& p    xchg    dx, es:[41h*4]
3 G6 u5 ^( ~! C' j. d1 J    xchg    bx, es:[41h*4+2]! b  z9 m8 ~% T7 ?# E6 |; w
    in      al, 40h# G, [& x0 @9 C7 W$ X
    xor     cx,cx
( ]! n' f2 @. b6 z& C    int     41h, y% p% M  q5 R1 L" c  V: @4 q% _
    xchg    dx, es:[41h*4]
0 O# r* S+ B6 d$ P) A" k$ s8 b    xchg    bx, es:[41h*4+2]: z  P0 O3 G" k. Z
    cmp     cl,al
. I; T7 P' g& f& y" @    jnz     SoftICE_detected: ]8 a: \) c; R$ w

8 ^4 }4 r5 u* ^& E8 ^, F- ]( ~_________________________________________________________________________
7 \9 A! ~2 G5 ?! f: x1 @! T  s" Z
Method 076 a2 D4 q3 x1 o1 s9 I1 l
=========
, G( u: O7 D* F, [1 Z2 |( n8 a
3 u  A' H& _1 S$ h9 U+ v3 XMethod of detection of the WinICE handler in the int68h (V86)
; K+ r: N6 _) `) j: y1 o6 [
# N% d3 ?$ B( X! w    mov     ah,43h
+ `/ k+ X# {6 t) n    int     68h1 Q' g- ]* T6 [
    cmp     ax,0F386h* s& L+ V* n/ l7 G
    jz      SoftICE_Detected
; K" p0 f" S+ N; J$ |; w4 _) C9 T2 h' ?0 |  ]# _# s# Q$ F
7 T' c* o  A, F
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
$ u, J: W- d7 Q7 j8 T4 A   app like this:7 S4 k' H. h# S1 T7 Q5 \
. B9 Q% T% p7 O  B/ q
   BPX exec_int if ax==68* |$ b' N7 b2 S2 C9 s& z! y
   (function called is located at byte ptr [ebp+1Dh] and client eip is6 `( V9 R5 G, r% F+ X% p% I; i2 }
   located at [ebp+48h] for 32Bit apps)& R  a( B# G' a" r
__________________________________________________________________________  ^) M) f. r4 m! E+ r6 S4 w
9 M4 Y/ d5 ?' F5 b- p

0 j7 r7 L' t1 Y3 V; R2 W" eMethod 08
6 n# k: Y  B$ j) y" a=========
+ t! i! T/ W2 N2 q; p7 D" s+ c& Q( b0 N$ w
It is not a method of detection of SoftICE but a possibility to crash the1 l% G: [, h* r7 O$ F7 _/ ~
system by intercepting int 01h and int 03h and redirecting them to another3 @1 o7 H; Q! f8 h
routine.
$ _' M9 F% ~. K& ?% {5 CIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points  E: G& Q# f: C4 k  t
to the new routine to execute (hangs computer...)+ N# \! C0 M4 ]0 d4 X

) G$ a( W$ q: D- ^: d: O5 J    mov     ah, 25h
) \0 d( B9 n% B8 Y  o" b& [5 c5 G' F    mov     al, Int_Number (01h or 03h)
# ]/ |$ p* C# r% K8 y, Y    mov     dx, offset New_Int_Routine
% o4 O+ l0 ?$ s- }* J: F" d4 o2 A    int     21h8 \4 u8 M" k* z) l6 J

1 F& x# k9 o( |  v! ]; q7 ~__________________________________________________________________________6 r$ K% B+ T  O$ K

$ K/ ?1 s5 v' k+ H- A- h+ GMethod 09
# J: R4 G! t7 i2 w% h" l6 z=========
0 E! G; J/ B3 N+ d& F5 N3 ~* A/ D, n* {9 B# w. B" C) @
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only  c+ v4 s1 ], {
performed in ring0 (VxD or a ring3 app using the VxdCall).+ ^7 z7 ~* L1 ^) V
The Get_DDB service is used to determine whether or not a VxD is installed
- U  u& f; ], l2 ]( X) Q4 dfor the specified device and returns a Device Description Block (in ecx) for
1 G  }* U, l+ |+ B6 Z, e2 h# jthat device if it is installed.- Y7 _, b. W$ N, k2 s

2 h% H# X& o6 u) B8 n   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
; Q; m2 h, y; b4 w; Y   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
8 ~$ {, i5 |8 I; s6 I   VMMCall Get_DDB
  R* \/ x3 P( ^( t; ^   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
2 |  u% N* L+ ?, v! M9 e7 z- R' m3 j7 m0 Q+ D+ b8 n/ Q
Note as well that you can easily detect this method with SoftICE:, k$ j2 b( U% \8 E* l
   bpx Get_DDB if ax==0202 || ax==7a5fh5 _4 Q& z3 q0 D5 e/ f/ b7 K

  e- z6 ?( |. L. i5 Q7 N8 }__________________________________________________________________________( i2 r! z; j1 _, |

" z. H5 v. R- [" Q- ^5 M9 T5 gMethod 108 l, X0 n8 a% j. @
=========
7 S3 v  o2 h% s! [$ g( e
/ M+ G6 u& n9 F  U9 G' I7 Q# _8 V=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with  b. L" t" H# m* A# s
  SoftICE while the option is enable!!
* P. ?9 @* ]: ~' b5 |: l9 c) V: e: q8 X/ [; n( X) E( ~( H/ q
This trick is very efficient:
7 o  e+ j8 _( A3 x1 Hby checking the Debug Registers, you can detect if SoftICE is loaded5 L* v6 p; g6 u  {- v8 ^
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
+ z# d) e* t2 C( A) Cthere are some memory breakpoints set (dr0 to dr3) simply by reading their6 ]0 W  |; y1 f( D) |( l
value (in ring0 only). Values can be manipulated and or changed as well% a7 D9 \1 o) c
(clearing BPMs for instance)
7 G9 Q/ y/ v1 R7 n' n8 M: n7 {" h& T
__________________________________________________________________________9 U: m  Z$ m8 Q; M  m, y2 x

2 M" e9 j! `8 t* d( D+ WMethod 116 G0 I8 q5 n" z3 r+ [5 [
=========2 r7 s7 d6 y8 N$ |, @

5 z4 G* V- z% C9 u2 Q2 sThis method is most known as 'MeltICE' because it has been freely distributed; N  _4 v) M' i! D
via www.winfiles.com. However it was first used by NuMega people to allow- p3 [* I2 O% \' C8 p0 _0 q+ q" k" \
Symbol Loader to check if SoftICE was active or not (the code is located5 a4 U, H3 j& S- i( C
inside nmtrans.dll).0 t8 G- C8 z* A# \
8 ^( K1 T" F/ }2 n) {* }
The way it works is very simple:
* m0 N( ~  i1 y% R+ o/ Y0 T2 ]' m2 qIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
& q( `' b% j4 YWinNT) with the CreateFileA API." M5 g9 ?/ p5 R3 \
' z( G% F8 t- g4 j- c2 \
Here is a sample (checking for 'SICE'):
8 g( i' [- g4 d5 H5 y- b) z1 P3 D+ m! l8 t7 V7 h) e
BOOL IsSoftIce95Loaded()/ }4 D) l4 r* F
{
& a% M3 V/ u6 I: x" `3 h- _  x   HANDLE hFile;  6 x' a  f* V5 Y( R
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,( P. z: L$ C7 p  v) g
                      FILE_SHARE_READ | FILE_SHARE_WRITE,  S; U$ Z/ H$ I: i
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);/ ^/ \, N2 Z% c2 Q
   if( hFile != INVALID_HANDLE_VALUE )
$ V4 s: l2 ^  r" G. Q   {4 }+ H( ?" }( L9 m
      CloseHandle(hFile);
1 q0 x0 u& k# R8 i' x      return TRUE;* p2 J- o7 c* }% }2 k8 f, X
   }! @; a) t' X  Z! R2 b$ B9 t
   return FALSE;" r- w5 w' h$ l2 E4 v9 k- X
}; D; H+ k8 X- H, ^, Y1 ?0 b
0 B# O/ J( L1 M
Although this trick calls the CreateFileA function, don't even expect to be
1 r. J( S& A# ?  @5 E3 w) Qable to intercept it by installing a IFS hook: it will not work, no way!
1 S6 h- Z5 _8 P& yIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
& x$ w; P" p: }& Fservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
. o8 g% E8 L' b* Dand then browse the DDB list until it find the VxD and its DDB_Control_Proc
5 L- g' D, J$ L3 pfield.
" X% @9 r1 l. o( k; JIn fact, its purpose is not to load/unload VxDs but only to send a - T7 `! K! h8 b1 z0 |# p' D
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)5 A1 j9 _& t( Y
to the VxD Control_Dispatch proc (how the hell a shareware soft could try7 B7 d, c  @7 B: n6 h+ s
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
- k8 |4 m. Y+ I: g. C) ?If the VxD is loaded, it will always clear eax and the Carry flag to allow
0 P4 l- w( X& ~& X5 ~its handle to be opened and then, will be detected.  x7 ?; t& j: S) l# @, Z
You can check that simply by hooking Winice.exe control proc entry point5 _/ j! V4 }) E( h+ Q$ l7 X  p
while running MeltICE./ ?# r% z8 `; L# N4 |( q3 j

4 |0 w) [, `2 {1 a) d1 B0 K' h5 L2 l) w* o
  00401067:  push      00402025    ; \\.\SICE
3 e3 x$ Y) ~9 _2 ?  0040106C:  call      CreateFileA
9 ?& y! H7 }6 E7 W/ r* @# ^- Q5 ~  00401071:  cmp       eax,-0012 z% p0 G3 p4 `4 ?
  00401074:  je        00401091
, A% M+ F5 @1 V( j
0 \8 a9 Z; s2 k% D3 N" `
3 N' A4 R% O9 c9 _! MThere could be hundreds of BPX you could use to detect this trick.
' |0 A; F4 v) G5 S6 {-The most classical one is:
( i2 F! ]! G6 g  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||/ @. m5 Q; S/ N% f  f4 X1 z% v' ]' W
    *(esp-&gt;4+4)=='NTIC'
- U9 J% h% F3 Q' b3 I5 W- N/ _+ n$ \" Y
$ y: d! G" l7 I, Q4 i% t-The most exotic ones (could be very slooooow :-(- V# k5 @( ~- q
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  5 `" S0 D* |7 _# n* Y) w. I4 U
     ;will break 3 times :-(
) g, X! m' F  w2 A5 W7 {
4 N* B  n+ b. {7 E3 Q: c-or (a bit) faster:
2 F- L' \/ @8 D: h- U   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
$ O3 h& _& y, J2 B' ]( D3 C
/ r2 R5 _! b/ P- d- @# w6 x   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
4 K! _$ b8 U4 a0 _$ C( O     ;will break 3 times :-(: l' u: S1 b7 O6 q

' M& X% g# Z4 D% ^-Much faster:
# n- c- l+ l. M4 k, q% H5 v   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
) i) A  x, t+ N" _: A: _# M4 {* ^. P- H6 g# o0 C7 L* l- S7 J
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
* p4 r6 |$ ~/ ^( A( E' }2 w" ~function to do the same job:
$ N  V! i* |, M1 U
, K9 b; l5 [0 z3 n7 `. `1 m) ]   push    00                        ; OF_READ
. r0 g# ~' B" d* ?: a   mov     eax,[00656634]            ; '\\.\SICE',0# Y* ?: b% H9 J0 p; h8 v' @
   push    eax7 a) ]0 m/ o: W9 R- {/ l+ D
   call    KERNEL32!_lopen0 q5 V- X1 i- M
   inc     eax* n2 Y2 l9 e. I' i6 N4 b2 d3 E: N7 u
   jnz     00650589                  ; detected5 s+ q$ c" @* F9 }8 L
   push    00                        ; OF_READ
  p5 p; p2 A0 ~& R7 z, F   mov     eax,[00656638]            ; '\\.\SICE'/ a( e5 M& h; W5 G0 n, Y* J
   push    eax
+ n6 I; o! `; H( X1 Y0 j   call    KERNEL32!_lopen
: I% y) t% Q* ?) j   inc     eax6 j( Z( d) X7 E- \1 H5 e( A; Q
   jz      006505ae                  ; not detected
% }: G( v! v8 N- z0 k
) u4 A  O3 n; u$ t, Y) d' ^9 q2 ?" W% t
__________________________________________________________________________& q+ t! K$ ~6 F: ^
, \; ^' ?! _0 K- y6 p3 F
Method 125 ?/ N9 p2 R7 z' w+ \' P
=========4 \, v$ C- [) z

; D6 ~6 J  E' l7 `* Y; EThis trick is similar to int41h/4fh Debugger installation check (code 05
1 A2 O6 o* s6 v$ x" F; u&amp; 06) but very limited because it's only available for Win95/98 (not NT)& |+ \- G  U9 ^# Y
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.. M! n4 w) X9 n, Y: I* j* k
4 n, F, V, i# \) s) m+ `! h
   push  0000004fh         ; function 4fh" x+ i: d/ M3 J. Z1 M: \
   push  002a002ah         ; high word specifies which VxD (VWIN32)2 Y; N4 q# ]! p9 T  b/ Q
                           ; low word specifies which service
* y/ q7 R3 g  \7 o* ]6 M5 D                             (VWIN32_Int41Dispatch)
. C+ [- j! U; p! J7 a( W+ ^   call  Kernel32!ORD_001  ; VxdCall
$ s( h# {! k+ m   cmp   ax, 0f386h        ; magic number returned by system debuggers
2 B6 `* ]2 ]6 R# G0 x; u   jz    SoftICE_detected
  J2 z& O2 |& v* h# y& _# [3 F4 n$ ^, S7 C6 y* b. n- [4 {0 v) L
Here again, several ways to detect it:
" e2 }, I8 F: b0 o. |" ~$ s  v3 ~' E
    BPINT 41 if ax==4f
+ a5 S  {2 v9 g3 L) ^$ i8 `; F6 d6 i+ V5 Y% {
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
, t. C" `9 ^) e) {
6 m8 l3 ^# x; v6 K) l" Y7 k    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A. f. e0 y( f5 M* K' I& I# L: Z

, M, H# }( p) d! r1 }    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
: j0 T' ?3 w$ G
$ E% c, M" L8 [: m0 ~2 p__________________________________________________________________________+ q* @4 P' \5 w5 X$ ~8 e0 c/ c
" ?5 r+ E/ U: h% Q; }
Method 13
7 H! o8 u( c" s# s6 d=========) `+ V  W% ?# r" f

3 Q% v) ]5 W1 HNot a real method of detection, but a good way to know if SoftICE is, h* S: Q8 ]5 u# w% k! p
installed on a computer and to locate its installation directory.
* x; c( S. u( U4 ]1 ?, ~$ EIt is used by few softs which access the following registry keys (usually #2) :) X+ _- Y1 O3 c' U0 N7 A' \
; N0 b( g* z0 K/ ^- i
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
' A% ]0 U0 g; x$ [1 u+ P' x\Uninstall\SoftICE: T. i0 n6 x% ?
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE8 c& H/ T$ r5 f7 H  H; `' {! W
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
# o/ k" k/ t1 Y$ ?6 @& S\App Paths\Loader32.Exe
( k2 G+ Q. h& ~- t8 \# p' l' c  M6 X* R8 T& _. `
; ^4 ]* H3 W/ I) D! K
Note that some nasty apps could then erase all files from SoftICE directory
' Z1 a1 h5 Q+ I" Q0 C! N(I faced that once :-(
: l/ `9 `7 t* j2 ?) Z0 X2 A! y4 T5 G3 t5 \: t6 @9 {
Useful breakpoint to detect it:" q0 [' r# d  z/ t2 T. F( l* Q

6 r4 J3 M1 m- Z/ C     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'( s' @$ r) }3 \5 P, u  A& h7 Y# o
) b- I: h. G  n
__________________________________________________________________________
7 X5 N! n5 O* [5 Q' [" t/ \% d) `% b5 J) \- y' Q
- J- C  F7 b' Z2 T( t
Method 14
4 z% w& x( T# R/ o=========
% {# W1 T2 d- K) N. \5 I7 q
) G, e$ b$ j+ F- v5 T& {' n$ xA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose1 N8 v8 U' o5 }' i+ j" Z
is to determines whether a debugger is running on your system (ring0 only).% t' N& m6 k/ u9 ]/ w4 ^8 K
# S3 R6 M/ G9 t
   VMMCall Test_Debug_Installed$ v" }& ]% I8 r( {- W$ Q
   je      not_installed
# C2 G+ b. k1 B4 ?- x
6 s: [  _! F! IThis service just checks a flag.. {+ O2 C, [# b' x  P% A
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部