找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
9 p3 u  n7 f" @. F9 S<TBODY>
# X7 W6 \: I. o4 Z; c<TR>
) K- d# Y& ]4 ~  Z  A7 e; m/ b/ H<TD><PRE>Method 01 ' ^2 W2 ~# j5 b
=========' g- n4 L* j+ c2 z

0 c  q: w: d0 l5 m% K/ R" f  U0 ^This method of detection of SoftICE (as well as the following one) is
) n- D( |* H) I, z# d: rused by the majority of packers/encryptors found on Internet.
4 S+ a5 D6 [3 iIt seeks the signature of BoundsChecker in SoftICE3 g# x" l2 U9 k5 z) P

: j' o5 t2 T- z    mov     ebp, 04243484Bh        ; 'BCHK'/ ?6 U2 i* T0 ^* r/ b' r
    mov     ax, 04h
, w  r* n" k7 {( Q) [) M# R    int     3      
! J8 n$ B- n" a" {4 {) v    cmp     al,4
* U8 x4 Z7 E; r    jnz     SoftICE_Detected9 l- U3 E; m1 ]- R
" ?, c2 ]- n0 [; u: d
___________________________________________________________________________! M# d8 x; l, m& [* C5 I

/ c. @+ J/ ~# S' Z0 dMethod 02
& h* p0 l& R4 c; X% @7 {* ~# ]4 W4 Q" ~6 u=========8 D! @! T1 `1 @5 ^/ j1 t, @

+ _' {3 D8 N  V0 e/ r0 [* sStill a method very much used (perhaps the most frequent one).  It is used4 r, N/ j" g  f, F; E0 k
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
* @6 A( U0 s& ]9 U+ n; eor execute SoftICE commands...7 V/ J0 V7 ?0 `9 q
It is also used to crash SoftICE and to force it to execute any commands
/ _/ J  b, N5 Z1 d# D0 h$ X9 S(HBOOT...) :-((  
6 F: ^9 [: \9 c2 U! ^
* r0 k/ K7 `4 R, p; ?& O0 AHere is a quick description:4 U* m) a( g' e" n
-AX = 0910h   (Display string in SIce windows)
- `! a3 w' R- t& {-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
3 h8 K4 I, H9 w% D4 ^% q-AX = 0912h   (Get breakpoint infos)- s9 Y. E' u! S, v" H
-AX = 0913h   (Set Sice breakpoints)- @) U- V" v- x6 g
-AX = 0914h   (Remove SIce breakoints)& h* }* T7 d3 K" h# m3 \* k

3 i' Y. g; k7 R- `Each time you'll meet this trick, you'll see:
) {7 H" x# ?6 L3 b9 _1 t* U-SI = 4647h" u5 Q& F0 o- z6 d) ~; w
-DI = 4A4Dh/ R3 f8 N) N2 y2 N% V6 H7 q4 L
Which are the 'magic values' used by SoftIce.$ G9 z7 l/ G0 o5 V# R/ R1 w
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.0 r9 ]( l/ S1 o

) j' i8 u5 F& Q! Y+ P. }. X( bHere is one example from the file "Haspinst.exe" which is the dongle HASP
0 @* I! c' E+ V) vEnvelope utility use to protect DOS applications:
/ j" X( z( w& E+ C! I( X/ f3 A2 x, u4 {1 h: _& R
) _. Y% o" z9 n# |$ S
4C19:0095   MOV    AX,0911  ; execute command.
" v6 K. H& f, r4 Z( E4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
7 @6 P$ I. b: i/ f& T4C19:009A   MOV    SI,4647  ; 1st magic value.- N! N9 i' i5 J2 T
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.$ |( F- K. y  h+ P) S; s
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
4 g# s' s# V6 G4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
# ?( D- u$ P' ?5 u! s' ?9 ]/ Y4C19:00A4   INC    CX/ j) E5 ?+ R1 n  U
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute0 O( t# z, w& l0 P$ W
4C19:00A8   JB     0095     ; 6 different commands.
6 T: r' {. b+ K* p) b4C19:00AA   JMP    0002     ; Bad_Guy jmp back., V' K2 O7 ^) l1 Q/ v1 M
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :): q7 n, x8 d' b( g7 t% P8 P

- l- A7 {) W. }1 F) QThe program will execute 6 different SIce commands located at ds:dx, which
' k- b/ _. c) f0 nare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
: z4 t" a% j. i5 \# D' `+ I, m8 v
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
; q' k7 m/ e8 J___________________________________________________________________________
2 }; |/ J* S8 i- O8 y% b* n6 \* \' D# ~) D" }" S" e( w
5 C+ F9 H* x7 j  [: E9 X; Q4 ~
Method 03& e3 A8 G" `4 e* s4 A( z
=========4 e: W$ D6 O1 e' |5 {1 u, E
. T# ^: G+ J( g) z+ R4 D7 M7 ~
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
! \7 N- q5 y6 I2 C; s8 `% g- O(API Get entry point)3 d, P6 u: C1 x
        3 R0 T5 a/ @1 Z* j

4 {( m" v. |8 q: u9 c7 b7 i    xor     di,di
1 C- e7 D- Z: S6 u% Z    mov     es,di
( v: v: i3 c, o' X; N    mov     ax, 1684h       3 }  y1 H0 e7 t7 k. S1 R/ B1 z
    mov     bx, 0202h       ; VxD ID of winice2 x* \4 M* T2 G7 A# \" H
    int     2Fh
0 Q; K7 F9 a3 ~2 p0 c    mov     ax, es          ; ES:DI -&gt; VxD API entry point
. P. O2 @' r, i% n: P% m& x" T2 p& ]    add     ax, di
, Z7 g; R6 n7 O/ d1 K1 m6 ]    test    ax,ax/ K+ O/ g. _2 g1 z' u7 B
    jnz     SoftICE_Detected
. f. `! q( ]4 s6 X
; f9 y5 M0 o" C/ s; x1 c6 ~___________________________________________________________________________
+ r# ^" D0 l  E4 f
; d, r( J3 D) `+ FMethod 04
2 e3 h# L- ^  M, x8 q1 s=========6 S8 a" G! P- z+ L6 {- U
6 g8 V6 z2 s% _
Method identical to the preceding one except that it seeks the ID of SoftICE
# S$ X3 x4 Z6 ?; u2 WGFX VxD., j/ T: X! X5 f
- N7 r6 C, m! {- a4 q2 _
    xor     di,di
1 Q/ m4 V7 a* b: d2 D7 u    mov     es,di% s' A; Q$ v$ ]* F
    mov     ax, 1684h      
* u* O) N1 o# |0 {/ s3 U* V    mov     bx, 7a5Fh       ; VxD ID of SIWVID
0 q0 O, @# N: ~: H    int     2fh
, ~! K: ]1 h, l) d2 [    mov     ax, es          ; ES:DI -&gt; VxD API entry point! f1 l; Z9 I- y) C/ _6 U
    add     ax, di/ a/ V  o7 ]* f# F1 l- P
    test    ax,ax
( ~' z1 }7 |) }% z- @3 P    jnz     SoftICE_Detected
) R+ l9 i9 k0 B8 R2 Y9 B# {" s- h3 f! `8 j' g4 G7 O" Z
__________________________________________________________________________# v/ c% A. w, w9 ?3 D' p
% f! b9 M- b# p4 z% ?; f) \4 ]- L
8 o- a) _/ T+ X) H
Method 058 N( ^- e( }: X) z2 ^' h" `
=========
2 f2 ~2 S  ~5 x1 f- q% b2 b8 ~$ ]! R2 d" C
Method seeking the 'magic number' 0F386h returned (in ax) by all system
. W8 z# h) i+ w4 V2 Wdebugger. It calls the int 41h, function 4Fh.
  z3 K- a. Y: i1 R2 ]. H3 H0 J5 Y3 EThere are several alternatives.  4 q7 h' [! s9 V! Z4 Z+ i% f' @
  b5 X, m' g7 v9 U
The following one is the simplest:5 f; s9 w& Q! a% U' q- l% [4 R8 c
5 B0 @3 O2 w4 |$ W/ l; {! B
    mov     ax,4fh
0 n2 P) V8 j9 D    int     41h
8 r" D4 ^0 h. V5 R# S, L5 h    cmp     ax, 0F386
- _. G2 K. }* d# I% |+ \    jz      SoftICE_detected
0 ]* M0 H! M& ^# \
  d; Y: _" j; ?: g7 C0 l
& p& s5 b" @7 M" Z5 @Next method as well as the following one are 2 examples from Stone's
( a( {2 u. d8 [- d' U9 G"stn-wid.zip" (www.cracking.net):3 T9 Y2 |  k3 T9 }

: [7 f) j9 g! F2 L5 K1 }" _# k9 x    mov     bx, cs
; E! o# Y. Z9 t$ E  ~    lea     dx, int41handler29 e. Z3 e/ N& t1 g4 E- ^
    xchg    dx, es:[41h*4]0 L6 Y. E9 |) z% P
    xchg    bx, es:[41h*4+2]
" e- e8 {+ G" P2 E5 V! }/ G    mov     ax,4fh
( |1 N/ M+ I( c9 ~9 s4 `    int     41h, r: @: |1 K1 |; Z0 C2 U9 k( T
    xchg    dx, es:[41h*4]; F6 m, U& M* [5 G4 i
    xchg    bx, es:[41h*4+2]% D* r. S# Y( ?, s
    cmp     ax, 0f386h
8 ~4 H6 F2 g! L0 r! d3 Y. d! Q% M0 i    jz      SoftICE_detected+ M  C# @2 U2 \- s0 z3 \
3 N7 C' M4 u- _  V) X2 k9 U2 l
int41handler2 PROC/ s3 a7 D( t) |1 N) U4 ~# }% P
    iret- l% E6 E% p' e* d+ {1 q$ g
int41handler2 ENDP/ z( L. D5 s. u9 I- w9 g* t5 R/ k
3 S* _& O& c  I* J" \3 l& K1 P' }
% H  r* w: u* [# h
_________________________________________________________________________5 U0 X( S& X( ^8 ]- g6 A8 |

% Q# V7 H( G, o7 e$ X) y
* V1 b  m5 `4 f6 [+ z1 c4 DMethod 06
  h3 j5 \: F; f% S' b; Z( j=========9 X' }/ m5 S) Q& c

# V7 }8 `  m5 H
/ {: `8 `5 Z$ Z# G% }9 ]  ]2nd method similar to the preceding one but more difficult to detect:
" {' O5 N& T3 f3 [9 O# o  q+ c. d) D" p! ~: R
7 F: d4 v) n: X' U; A7 y5 ~
int41handler PROC
% \6 [7 O- @& v/ s( C6 A, q: V    mov     cl,al% |$ c4 @9 t6 n& }% ^: e
    iret
* I+ J# w" t" Gint41handler ENDP# M5 l4 _- u  K* G
3 ^4 P9 W& x  p7 A9 \$ ~9 X
% T" `  v1 T$ U$ J
    xor     ax,ax
- O9 Y9 U' y1 h% R  J    mov     es,ax" r8 [; E( k( Q" X5 U# B4 ?
    mov     bx, cs
7 V5 [, F( R6 Z9 d7 w    lea     dx, int41handler5 a8 \# h: Y, B8 y$ o8 h
    xchg    dx, es:[41h*4]: _# A1 Y  v$ V* w4 m5 R7 b1 C
    xchg    bx, es:[41h*4+2]
; c' @8 N  D7 v1 z    in      al, 40h
, q( B' L! C4 \1 u    xor     cx,cx2 J# G  P! P' ^* Q
    int     41h
( w5 P6 h9 ]) W  ?: k    xchg    dx, es:[41h*4]
3 `% i* ]7 a* p. f    xchg    bx, es:[41h*4+2]# z, r( y6 v/ P
    cmp     cl,al. W, t* J+ s4 }3 Z$ b
    jnz     SoftICE_detected" s6 E- C- k3 W4 F4 y2 {* S% r
9 [; t3 J9 _' G. l* K
_________________________________________________________________________4 P8 B3 A/ v) ^6 I
- T8 J- O) `- [: e
Method 07* x; ~# m* ~6 E4 c( Y
=========$ d" G4 W- E; n. n( b$ h' z6 Q

( V- s: d) T) F* A" JMethod of detection of the WinICE handler in the int68h (V86)
' A0 w. u  J( w- }3 R5 O1 w) x) u* H4 N, T
    mov     ah,43h2 M0 W5 p! D  m
    int     68h
1 k$ |0 P7 n- U& J, v    cmp     ax,0F386h
% K' }- d6 B. ^2 E( o* h% C1 Q" l$ i7 A    jz      SoftICE_Detected
/ \) A: x0 m- [# |7 E# z3 S* X  C5 F5 J) ^- m4 v* f9 D+ r
: Y6 l0 l% e5 z
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
: U, D5 @6 I/ O1 J   app like this:
$ s/ T' x6 y1 V, E) p) U- A
/ D) C4 j- n( e9 ^9 E* m( ^% C5 e   BPX exec_int if ax==68
* l6 B0 f8 x+ g; E/ ]6 h1 L   (function called is located at byte ptr [ebp+1Dh] and client eip is
1 g: ~6 R. J3 F3 E( g7 M   located at [ebp+48h] for 32Bit apps)
7 G) s, n2 W/ z! C, }__________________________________________________________________________
; ^. t6 ~/ l( K& X: R7 q5 I" N  S$ z+ s9 }* D! \: _

" B3 t: P# }; T" VMethod 08
3 o. G; ^. t7 D5 o* i$ p=========
, |, \+ {, m9 l# t8 _) u7 P
8 t( t" v6 M6 O9 R4 u& IIt is not a method of detection of SoftICE but a possibility to crash the. ?; z, i  F, |* k) ?/ ]6 V- V* m5 I
system by intercepting int 01h and int 03h and redirecting them to another0 r# Q$ R; F; \0 v6 V0 x6 S
routine." X# c% m/ e* L
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points' |7 `% C6 w  s$ P+ |
to the new routine to execute (hangs computer...)
) Z$ ?  Y7 b7 N" q* b& y+ _) T9 |; P# j8 L3 ^4 k
    mov     ah, 25h: g0 P# v* U6 A( y0 S
    mov     al, Int_Number (01h or 03h)
9 _3 E5 f: N, Y5 e! s) L    mov     dx, offset New_Int_Routine
. J$ G; r. w& g& e% s4 }    int     21h
4 \8 U! m3 {) h# |' A; t0 }$ L4 C
( m& q, N/ h, C3 t- r__________________________________________________________________________
8 Y/ ^9 t/ h3 ~' _
' T4 u* ?6 Y! e; Q1 W  m5 m/ j  T, _4 HMethod 09
* I+ Y, ~; l- g=========
: l$ P$ O  J4 ?; p7 O) ?% ?6 I; V$ Y
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only+ [* R- e% b9 u6 O9 T) l1 q, v6 ]
performed in ring0 (VxD or a ring3 app using the VxdCall).8 x( n; ?5 |. Q3 ?: p. e- H) Q  E
The Get_DDB service is used to determine whether or not a VxD is installed  E8 G  b  l) t/ k9 v' E# D
for the specified device and returns a Device Description Block (in ecx) for
" ~4 P; d# p  `3 v8 O! Cthat device if it is installed.
1 K8 J+ q% A% t3 H( D+ o6 S# p0 o0 f* O9 e8 `7 J4 E+ P
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID, Z) ^. y- R( v0 N
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)3 Y7 {, F3 o: M+ p- ?
   VMMCall Get_DDB9 o7 v6 `2 X0 l
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
: b, I( h  T' j' R! |" t
; ^: F' r. m7 ]" a( _Note as well that you can easily detect this method with SoftICE:
6 |2 a1 K* n. M# v   bpx Get_DDB if ax==0202 || ax==7a5fh
3 j' ]. k( C  u/ g  g2 F& S& {6 D) t1 m9 H
__________________________________________________________________________
4 v9 `! h1 N3 {6 x
& j" Z+ U; W, wMethod 10
4 b9 ^' c' O( _4 L+ P* m- ]=========3 r! }% \/ {" {0 M3 G' G

( h2 G; J/ e' I( N3 w1 h: [) o=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with7 y& n7 s2 t3 X- z
  SoftICE while the option is enable!!; L5 ]+ E2 F) o5 D' l& T0 A4 a

) p  a8 ^+ D  |5 r1 L0 DThis trick is very efficient:% R3 E( G( W; f- O9 s% N
by checking the Debug Registers, you can detect if SoftICE is loaded
  }& P8 V9 m# h3 z(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
; Q, N, t- q8 a" K. O, ^4 |; V. ithere are some memory breakpoints set (dr0 to dr3) simply by reading their# M2 l. b. [1 B$ l  w' ]& ]2 b
value (in ring0 only). Values can be manipulated and or changed as well0 c- z5 m0 x. [3 i9 I1 l* |+ G
(clearing BPMs for instance)/ Z# \( w& T/ g+ G2 P( Z% ~7 z6 T

4 N" v/ f* s+ @( A4 M__________________________________________________________________________: u  X) e! j9 f9 Q8 n8 I( V
9 D9 }. Z1 a8 s9 {0 ]" \
Method 11
, J' O( C* q, v3 k" Z$ h6 c=========
  P: b3 M) y2 D+ K6 p* _6 `- s$ t. J5 T6 V% i0 c/ B! X
This method is most known as 'MeltICE' because it has been freely distributed$ b2 [5 R6 _" Q# k1 H
via www.winfiles.com. However it was first used by NuMega people to allow
& g9 q7 K8 T: m# V0 e- gSymbol Loader to check if SoftICE was active or not (the code is located
! \0 O# w0 @- I5 [) Z5 Sinside nmtrans.dll).
6 h+ U/ W* t+ e3 r
5 r& v3 k. R( K5 g. q' MThe way it works is very simple:1 N" `, C* b7 i: C  g# q( ?
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
% p9 c0 T' ^/ c* S( s% t- fWinNT) with the CreateFileA API.
1 `  D# p% Z1 w; A8 @& @$ i, F) d) P1 x, {
Here is a sample (checking for 'SICE'):  V/ ^' i+ d5 P) c# L( b6 d

  ^9 O1 d+ j5 X& aBOOL IsSoftIce95Loaded()4 Z8 u1 Q  L5 C
{8 T& r1 p, z# e% S' r% Q
   HANDLE hFile;  6 i/ S  P3 i9 a! \- u* g
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
$ ]6 S' X( C, u) b                      FILE_SHARE_READ | FILE_SHARE_WRITE,4 L, C1 z0 l" _/ Z
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);* v- m! |4 b9 r4 D7 K( M# `
   if( hFile != INVALID_HANDLE_VALUE )# H! _+ P& V2 I; t
   {9 n8 A4 J" m- y$ L& [" ^! k# v0 e  y$ n
      CloseHandle(hFile);. z3 [$ {; Y* F: R) T
      return TRUE;, W4 Z) ~' U3 ]  e! K4 Q
   }
1 s9 j. ?* f! z   return FALSE;& i' S) w1 E! z9 H) o: y0 ]
}
1 Q! s, K: k+ f& A; V
$ k( J  _+ e; ?; W( sAlthough this trick calls the CreateFileA function, don't even expect to be
! _" M& }: U# Q! o1 H/ s8 fable to intercept it by installing a IFS hook: it will not work, no way!
, S1 c( h& W. I- UIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
8 k2 H6 m  k( D+ Bservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)0 ?$ r- b4 E2 T5 W2 c6 c
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
5 Z: u0 I; Z, c5 Z2 |field.2 F% C6 j  L' g
In fact, its purpose is not to load/unload VxDs but only to send a 8 a+ q; L4 @6 y7 }# [/ x9 y
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)8 h7 J! B" r" U0 b0 b! O
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
, ^/ t  Z7 f# \! a' o8 Bto load/unload a non-dynamically loadable driver such as SoftICE ;-).) h/ J5 ]; i6 o. f
If the VxD is loaded, it will always clear eax and the Carry flag to allow* P' I( Y# w& n3 b. U% B
its handle to be opened and then, will be detected.
0 X! q0 F$ U3 X: B3 q7 t- I/ SYou can check that simply by hooking Winice.exe control proc entry point
! Y( x6 T  Q0 f' J9 V+ J3 _4 x. Pwhile running MeltICE.
* F4 k! C% c. N, ?- |
5 c, r$ S8 G- y- u
/ T1 v7 _) H2 ?( K9 ?7 S( X  00401067:  push      00402025    ; \\.\SICE# e/ o! a0 k2 \$ }" D5 p  u
  0040106C:  call      CreateFileA
" a0 [2 P0 @8 o" u  00401071:  cmp       eax,-0015 ^2 L1 D5 v( \; R3 k9 I) P
  00401074:  je        00401091
: U( P2 P) g1 g% y- y  x8 b8 E% i  O  t/ i2 v' n) q

! \) b: a( Z0 }/ q- o! QThere could be hundreds of BPX you could use to detect this trick.
8 ]8 y5 t4 M3 Z4 d. `; i6 v-The most classical one is:
; ]( w( _- E/ U0 X  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||) Z. n' v' f- d; J/ [2 t$ b
    *(esp-&gt;4+4)=='NTIC'1 z; }+ n1 }, h/ r3 J
5 U" P, _2 `+ {) j7 ~- r
-The most exotic ones (could be very slooooow :-(
" N) T- J" w+ Y/ W0 |   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
& k2 w8 n4 \& K9 F* a6 x% Q6 R     ;will break 3 times :-(4 O( n6 b1 U% o" m1 H
" U0 ?1 D; R  N3 `
-or (a bit) faster: 2 h% ]- N) y% B2 M" n2 ~/ l
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')$ T* M+ I' ~( r, t, t

# V/ G# S2 S& j2 M* h9 a   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
7 b3 v& ]* o# j8 h# e     ;will break 3 times :-(. Z) I. ?% m5 T$ @4 w
4 g9 D7 B, b2 e  e
-Much faster:6 |3 N' m8 a* W& Z
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
! V7 Z+ l8 Z2 L( R" d3 J& x( b; j1 J+ u& p& i" f9 G# h
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen) k! U2 T+ [1 K8 ]) s9 c# a
function to do the same job:
) j& b- E% r+ H( p& r3 @" t5 Y) Q4 }
   push    00                        ; OF_READ8 b/ \* d# g, I) i; J
   mov     eax,[00656634]            ; '\\.\SICE',0& Z8 t# O' s+ X7 y+ ]' |, s
   push    eax
# a; f- C1 }5 v" q, F   call    KERNEL32!_lopen
; I% E0 X6 a: x  b   inc     eax
; v9 W- f$ h8 d  l$ M2 h. N% F$ f2 i  Y4 ]   jnz     00650589                  ; detected4 g) V( o2 w) g# {8 t! O6 ?5 h6 ]
   push    00                        ; OF_READ
1 D( e# U3 Y, I! W# p7 c9 Y, H   mov     eax,[00656638]            ; '\\.\SICE'
3 C1 I0 v0 M* n- G( z   push    eax2 J/ w/ U( _% m, |9 g- V
   call    KERNEL32!_lopen' {3 o6 _- g+ }  H) j/ x
   inc     eax
! i- p; h! w) |' H, R& J+ \   jz      006505ae                  ; not detected1 X  d5 O; v5 T! E

5 j8 t3 V: B3 z8 Z! U2 z
% N( j8 H( E' |  |__________________________________________________________________________
7 @! k: D# D. H* D/ Y9 G! f
# H; c8 h  g1 s1 R* f7 CMethod 12
, _/ ?$ ^9 R$ V, m=========
9 n, w( e: v4 B: c1 |! C) D" V* m2 C
This trick is similar to int41h/4fh Debugger installation check (code 05
0 W; V, U) I, {' \" X; a&amp; 06) but very limited because it's only available for Win95/98 (not NT)$ [& ^4 A% T, ?$ M8 \
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
! e7 |1 f3 V8 b! t6 ~7 F, p, ?' E* u9 g) Z6 A  q4 Q/ N
   push  0000004fh         ; function 4fh3 z* z( @4 u( \" E! h
   push  002a002ah         ; high word specifies which VxD (VWIN32)
' t$ r" {" I1 k                           ; low word specifies which service9 G: @4 ]) x) A( x' m" c
                             (VWIN32_Int41Dispatch)
7 K) m+ L9 @1 C3 N/ F# n7 w& }   call  Kernel32!ORD_001  ; VxdCall% h1 M8 S8 f6 z! {+ y' F5 V
   cmp   ax, 0f386h        ; magic number returned by system debuggers
0 k& F5 `7 O7 F4 K; Z7 H( H8 L   jz    SoftICE_detected( ~3 H( a; `  W4 y
2 V# \2 H& F+ z
Here again, several ways to detect it:6 {5 w5 y* d4 s3 q+ O
- [+ o( T" b* e/ e# g; Z
    BPINT 41 if ax==4f2 H2 R; V  G& V
3 @0 l; `; a/ W* g4 j4 R
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
( Q. ?& O# w" h4 {# H3 U2 Q7 R( v6 k- g5 W* p$ L5 W$ Y4 d/ A
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
, M% R: W6 H: b3 R% Z6 g1 R! |# I6 G  f
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!* W( Q* d" E  w- U9 f" Y- |7 ]1 n9 o8 l
% w3 i- J6 G. _, f
__________________________________________________________________________9 x9 j$ E: o+ g' D9 e. r

) [3 Q4 `$ _/ }4 i8 oMethod 13
* S. _  h" K! x5 z; ]! h* A& j=========
+ V1 ?4 f$ N+ P' d* [
& b4 Z) O) g! dNot a real method of detection, but a good way to know if SoftICE is
: Z: R% F, ^; C  ?8 X4 Winstalled on a computer and to locate its installation directory.  \" T' r2 J9 Y
It is used by few softs which access the following registry keys (usually #2) :
  S# ^0 o8 j% M6 L
4 W7 V' M2 X: C+ J-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
" c9 K  A, e, T8 e\Uninstall\SoftICE$ X8 I5 _* C. t% _# o3 F
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
$ s$ `9 e' b4 E( V-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion9 s& H; O' ]& r7 v  e
\App Paths\Loader32.Exe
& I( D0 G9 a, o  ^2 g
" F; [7 j1 F! |' H! d2 J, |7 W; M  F' s) R
Note that some nasty apps could then erase all files from SoftICE directory
& j4 L7 Y5 N7 P/ Z7 N: C(I faced that once :-(
2 `& j1 Z5 ~2 \' v( l9 r  F3 Q6 I% \1 I* Q7 ~* n* c2 \
Useful breakpoint to detect it:
) e' A$ u2 ]5 k9 ?9 ?7 L( g' C7 Y6 e" o7 N9 ^
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'8 l) a- ^& b' W* {7 k4 Q0 c

% _0 {& _6 m8 s) {__________________________________________________________________________) D( A+ A8 f  d2 V9 W- E/ ?

8 p* `4 p# p1 q2 c) X5 [6 ~* g, o  l! q; c$ X
Method 14
. b. p3 {% Z1 J" x7 j=========
! p+ }, Q" _. h& g. e
' ^1 U- m) V) zA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
( _! n) L) s5 R3 t$ E( U6 G- s0 |is to determines whether a debugger is running on your system (ring0 only).
8 I  e0 m8 D  P1 T" d( P  J; t  R! p% h6 G) r) V3 u
   VMMCall Test_Debug_Installed/ i5 H- `& i% b% I- d
   je      not_installed( o& {5 G, D& n. s5 h) Z
$ Q; d6 q' A4 ^6 J" h" x
This service just checks a flag.6 B$ D; F6 P+ X
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-8-15 18:30

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表