About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
6 U9 f( Q) o+ K; b% A% q% _! ?4 x<TBODY>, y; j* D" t3 _1 M/ ?' L) o5 H2 M
<TR>
' J% S& k5 i6 K% }. s<TD><PRE>Method 01
+ `$ \1 n% g  _. {* k=========' ^% g" B. u' J9 [

1 p' k8 W, W" o1 g2 hThis method of detection of SoftICE (as well as the following one) is
* h% s7 o* a9 F* g% U) q" ^used by the majority of packers/encryptors found on Internet.! ]/ p8 l, I; T
It seeks the signature of BoundsChecker in SoftICE
% b% p/ V, v, \' |
  C! q4 y2 v& h0 d- B  c, D0 S    mov     ebp, 04243484Bh        ; 'BCHK'
2 k" b" @1 w) {; p    mov     ax, 04h( n2 B. o  {# w
    int     3       4 @% y- K+ X- G& S& _5 j; E
    cmp     al,4
9 C0 ~/ @' Y8 d/ e. m    jnz     SoftICE_Detected0 X* u0 x" {* ~  ]% E  V( O
; x  z$ U* M0 e# Q2 ]3 Z
___________________________________________________________________________
8 X  I* J; t# {% a+ G/ D. E" M' f7 Z$ `2 }8 `
Method 02
! B3 k: d! `: F- C9 C  ^3 S=========9 l3 f0 V. v3 {7 L4 k
/ N: a) l4 W& f, \/ h
Still a method very much used (perhaps the most frequent one).  It is used& L/ d( h/ E! Q0 F
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
  ]% K9 C/ b, |or execute SoftICE commands...* @+ X3 c- s, Q3 D  q
It is also used to crash SoftICE and to force it to execute any commands/ d  g5 X/ B. s) f9 a
(HBOOT...) :-((  9 t7 D; c0 ]& t4 o
, u6 U: Q* a* W" S; D6 l
Here is a quick description:
3 c8 j6 j+ w6 P" L! `# q-AX = 0910h   (Display string in SIce windows)
* P. t$ n' `( Y" Z( `4 |8 h-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)) u" ~8 G- D+ I4 M' k
-AX = 0912h   (Get breakpoint infos)
5 t% J8 f- y  D5 x6 }4 P- Z: @' V. r( c-AX = 0913h   (Set Sice breakpoints)$ ]7 Z) e1 S0 a  Q+ `+ e7 r
-AX = 0914h   (Remove SIce breakoints)
7 W8 ?8 L% p5 h9 F; w6 d3 R
9 |% c' v" L  S7 z& eEach time you'll meet this trick, you'll see:( L/ ?9 [% f' K7 ^& [
-SI = 4647h; W( c/ y* g9 p2 [5 _  i
-DI = 4A4Dh
  ]. G' O7 Z7 f5 p- JWhich are the 'magic values' used by SoftIce.+ b3 P7 I% X- c# y( f
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.& C$ |1 k2 d' w
. B6 {! e4 c- ?1 q
Here is one example from the file "Haspinst.exe" which is the dongle HASP
$ U6 W% V9 n: @Envelope utility use to protect DOS applications:
* E9 S4 a- z; m, T* f( y6 @4 k# y! @
, R! i! i+ h, P  y. Z5 K
4C19:0095   MOV    AX,0911  ; execute command.. Z* X3 ~8 t) b! s$ c
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).1 d3 m( j; d9 P6 h+ `
4C19:009A   MOV    SI,4647  ; 1st magic value.
0 ?: I" S+ g3 X4C19:009D   MOV    DI,4A4D  ; 2nd magic value.( G/ I/ Q3 [: O" E+ d
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
/ `( U+ C! S0 s$ T$ D; B" h! s" n- S4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
2 X, F: u% _- K& H8 L# r4C19:00A4   INC    CX7 V1 }; [  f, u+ [. E
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
- L# L5 g6 f% m7 V6 f( f4C19:00A8   JB     0095     ; 6 different commands.
& j4 X" ~+ M9 R; p, E& y; @4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
9 m* E1 _* i) P, @4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
; k. O5 i2 |; r/ w6 G- K/ j# I7 E9 a3 d8 k/ d+ }1 z% h
The program will execute 6 different SIce commands located at ds:dx, which7 B. e8 Y' m2 j% N# h
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
" L9 N7 p8 _. s( W- @1 U0 H% U& J
8 s# M& q" P. }9 i5 ~' s6 t2 z4 T& }* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
/ c  Z' G! \2 D, U# {' V/ J* |7 l9 ____________________________________________________________________________
' d$ }3 A4 z& D# }' |: I5 J3 \1 V; [6 p
& y7 a+ L1 J* Q9 k6 K; |
Method 03
" m+ {' _# R8 {* [4 M=========+ |3 ~, `9 m0 r& y- E+ l# F, o

' V% R1 x# q% Z/ _# U" K6 A: rLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
  U" }: o* q7 W% H, c7 s! Q8 l(API Get entry point)
$ K8 z+ V- T' D7 t3 l: h        
0 j8 G" X: Q9 z- A6 u4 B3 o$ ^. C1 }& w0 ^* {) J4 S
    xor     di,di2 e4 H# B2 m& f, y4 d/ q; Q
    mov     es,di
* ^, z: D! C; s% o" M+ Q6 ]& K    mov     ax, 1684h       & |* z: [+ W+ Q# f
    mov     bx, 0202h       ; VxD ID of winice! I# d2 q% r! D; x6 l7 A
    int     2Fh
! L* n2 a6 X0 b  d    mov     ax, es          ; ES:DI -&gt; VxD API entry point& `6 V2 |% h6 Q2 {" y  ^/ n
    add     ax, di$ T0 P: s& Q: i6 L% P
    test    ax,ax
8 H: v8 I$ V0 h( r3 ?    jnz     SoftICE_Detected
. g/ \5 I; U  \& ~
1 _0 H" R. v# e4 f$ j' q$ e5 z___________________________________________________________________________5 G) d2 q5 U* j6 C
" g; v& u. H& z) V$ `2 Z( ~* D
Method 04
. Z+ i' ^9 n0 |+ x/ |=========( ]- G0 R- ^- C5 k3 Q7 q2 b

5 E/ k5 V# T% B: mMethod identical to the preceding one except that it seeks the ID of SoftICE
4 l& C# K# |3 B$ c, a. y, JGFX VxD.
/ M: y9 F3 ^. ^$ ?$ g1 A3 L1 R; |9 H: Q! @6 Q8 r, Z
    xor     di,di  M/ u) f( h5 l- `+ [5 u9 U8 j
    mov     es,di6 q+ v3 t8 P, }! m! i' w# V
    mov     ax, 1684h      
4 J; O6 m4 N$ W+ c) Y. z' W    mov     bx, 7a5Fh       ; VxD ID of SIWVID/ S: q: m, r5 A+ \- }4 \& ?
    int     2fh  H1 R" S( L! t
    mov     ax, es          ; ES:DI -&gt; VxD API entry point5 O9 m3 K' ~; l- n3 G+ _1 f
    add     ax, di! A: `( R, @! ?) _: z3 X4 Y
    test    ax,ax
# H! {+ o1 m3 a7 l3 k% g% @    jnz     SoftICE_Detected4 ], p: v: T% B5 q, L/ d: \3 a

) A' p4 F& `  d  ]; }! K0 c* i__________________________________________________________________________
6 u) q7 |5 Z$ I# v$ z! t7 ], \1 M, L* t
/ T7 \: |2 `! D0 A
Method 054 }8 P1 M, S' ]5 T
=========  C7 q: |. V! i' i2 A( g/ m

) |! k5 V: K! Z8 E3 LMethod seeking the 'magic number' 0F386h returned (in ax) by all system
/ o+ S1 \4 m2 l! v/ g, S' idebugger. It calls the int 41h, function 4Fh.
' J6 \! j# r& b! S! XThere are several alternatives.  * r% }! w: V+ m5 e4 I) I( k
; U( t' _$ H) _, ~1 V4 J3 t0 `
The following one is the simplest:
3 |; ~* l* W% i1 ?9 d7 u" W' B+ Y5 T* L( h' C- C
    mov     ax,4fh# }' {8 J- }% k+ I
    int     41h
1 b' f8 K( E2 E" }. A9 H    cmp     ax, 0F386
; y7 x+ w7 [  x3 ]0 F" z; d    jz      SoftICE_detected
* l$ z8 {- T' @4 f8 @( }( _3 C. y4 O

6 q. W& Z1 ^- q: B+ L1 V& r, PNext method as well as the following one are 2 examples from Stone's
$ x2 L" h' e9 H! o9 |"stn-wid.zip" (www.cracking.net):
8 f+ P& u. r9 z5 l" i
: p' u" d- `# m1 [: I! ^. V    mov     bx, cs' h4 J- V  m2 q/ i
    lea     dx, int41handler26 A* u+ r* o/ }) ~( R- G, B5 T8 y
    xchg    dx, es:[41h*4]
, g/ ~0 Q) \1 w2 \  z( G    xchg    bx, es:[41h*4+2]! l$ N' T: _2 T1 Q
    mov     ax,4fh
' C% Q$ G8 B: {; d* _) Q+ j    int     41h
, u/ z. Y4 B# L+ f3 N# z    xchg    dx, es:[41h*4]9 k" R9 r" T; ?3 j
    xchg    bx, es:[41h*4+2]+ d" r$ o' j6 b' z) f) j: q1 m3 C
    cmp     ax, 0f386h$ h/ K0 k9 Y: ^9 N$ u) K0 x
    jz      SoftICE_detected- _: ?0 S4 n+ m9 A" K( u- h2 h

; u! t$ y" Q* L$ C' M  ~( x/ Z* F9 Gint41handler2 PROC% O, `' S7 @' d& n
    iret6 `! v, M3 d7 D" ?. t
int41handler2 ENDP
/ ]& r5 `6 u( i' W5 u9 {& z* ^, s7 n: ^1 x7 O. m. _
8 }* z. y6 N: Z
_________________________________________________________________________
9 ]  @' N) Y  I7 s$ D4 F
( W7 E! j5 J  a# v$ b
' u6 J1 Q. }% D' y! ?$ }. E! MMethod 06$ O3 |. e) S# U. S# {- y9 r
=========
1 E' ?6 i8 [9 n% z
4 P) V6 s3 L+ V" v# y4 ?6 P1 u5 \" w- y# {
2nd method similar to the preceding one but more difficult to detect:
# Q/ h0 f) k& Z8 i$ S" O, h0 |% h
0 C9 j$ _. I+ c; Q1 x2 O6 {+ Z; s! y8 t# M
int41handler PROC
7 F8 V3 T9 t* T/ A' g    mov     cl,al
) N% M5 |' X  [) w    iret, Y. S7 e7 C' C/ p! t+ P# ?
int41handler ENDP; {  T7 p+ ^% J# y5 r+ f

7 G6 H4 ^% |( B, ]9 R
8 l1 E! k& x! {* n. r    xor     ax,ax
4 {6 n: @9 L$ o' N( b    mov     es,ax3 L" e  X% C2 d6 N$ q
    mov     bx, cs1 H  Q- A* f. h
    lea     dx, int41handler/ m* w; t9 Z- ?; m$ j/ g& o) L
    xchg    dx, es:[41h*4]
; ~$ b; g, X* s) g4 ^5 h5 \    xchg    bx, es:[41h*4+2]
  C/ q) M* b( P1 c2 D9 F% D    in      al, 40h
2 d8 Q4 ]2 m. y0 F  }' y5 [" w; N    xor     cx,cx+ Z4 h: G: J- u$ V- t$ `
    int     41h( |3 a& c5 w( y: m2 p7 _1 _
    xchg    dx, es:[41h*4]0 u# k# k, y( U6 E; C( ?8 w2 V4 e, }
    xchg    bx, es:[41h*4+2]4 Z' x" w8 \& f9 E
    cmp     cl,al
/ r( V/ i+ a+ W' D4 J8 c0 d    jnz     SoftICE_detected
) i; P# o0 B" g1 x" f
  _/ f2 @  |8 ?( T9 Y5 j; @_________________________________________________________________________
+ k" C9 V. B) F7 Q
, g' B: C; y! ^# g" c% E4 P8 o1 _Method 07
4 s( _! h) v# l3 E5 M' \=========6 X4 f* U' N. H- [
! P0 E3 V3 _- J  p% \6 d
Method of detection of the WinICE handler in the int68h (V86)# M# d5 O  w- C  |
" T* j& l; H/ g% w; S& R
    mov     ah,43h& h* [9 h! H$ X
    int     68h
. G: V! y1 R9 D- D' z    cmp     ax,0F386h
& n7 u6 P. V- t4 c( d7 g6 {7 w    jz      SoftICE_Detected& s: \* k) i  M' k2 Y6 E# V3 _; u

8 x" O1 Z2 M% X' ]: D0 n. R# a* P" |
( r8 F5 j4 A9 l0 L=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit$ V/ A. C& w; I# d: c4 \* u% Z0 V
   app like this:$ f. p: [9 S/ B* i

* b% B: r; m6 V/ }9 A   BPX exec_int if ax==68
! H3 z) {& A* E% H. b   (function called is located at byte ptr [ebp+1Dh] and client eip is$ J: I4 H* J8 u! \
   located at [ebp+48h] for 32Bit apps)
2 O3 }" P' R" ^) u$ U; H__________________________________________________________________________3 J5 P4 h( F7 g# h, f; j4 b' B! E8 w
8 @1 }0 F! h. ]9 L: G: p

$ U% ?: L0 G; w3 b- YMethod 086 a. e* l- R7 l* g3 s/ n
=========
4 v% w: \+ v4 H
% ^: y5 _& \, d+ I( {, W4 [It is not a method of detection of SoftICE but a possibility to crash the
( @2 T) O# N9 r2 n% Q; Osystem by intercepting int 01h and int 03h and redirecting them to another1 K% o0 `: F( G
routine.6 A* m  J  n" l' a" g# ]1 H9 {
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
0 \; V) r+ Z( y" ~1 dto the new routine to execute (hangs computer...)/ f3 o1 F) o: g( {6 J
& M, v3 f6 d0 q* J
    mov     ah, 25h
. n" Q% B% b( v  m0 V    mov     al, Int_Number (01h or 03h)
) N, V  Q0 u" C8 W8 G9 P5 I" ]    mov     dx, offset New_Int_Routine9 I$ ^- ]7 y2 H  W9 \
    int     21h
7 w8 p3 Q, h+ E8 K+ n' G& D# A6 s+ M9 n. p+ n
__________________________________________________________________________" n0 J% l% }3 ~# v( M: C( n
& |$ A  H) A  E3 w* j
Method 09
/ F& U& Y7 Y$ q+ T=========
1 ~4 R: S1 d, t3 T, E( c9 F8 P3 V  y9 N9 @" i
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only4 \& g. ^/ U3 f5 I; [( Z) g
performed in ring0 (VxD or a ring3 app using the VxdCall).( O$ N% }. |, m2 W
The Get_DDB service is used to determine whether or not a VxD is installed# n7 [( r* H; e
for the specified device and returns a Device Description Block (in ecx) for
7 ~0 L! y1 o0 g+ n! o& A+ Y2 k( Athat device if it is installed.
) r- n, B2 |0 ~# c. Z
8 D  b$ o' W  @! H$ v' o  ^/ b( }' J   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
; I* I+ a; B0 m9 O2 p8 K   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
' U4 ^" `+ O9 H. d   VMMCall Get_DDB: Y6 ?$ w5 M5 C+ D
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
* P8 T, Z" v/ a3 h' v
% o3 R+ H/ x2 {% F" }Note as well that you can easily detect this method with SoftICE:3 V( ]. X( @. i2 V" F
   bpx Get_DDB if ax==0202 || ax==7a5fh
: k8 V- O1 R, b8 q7 M. ^1 X4 L* Q
__________________________________________________________________________
" N( ^& @/ Z2 c7 x$ [# F2 j5 r
" ?/ i& ~& |" {; i* ~6 i) f& NMethod 10$ O* B9 b! J+ n( Q1 U9 i
=========
. K  V# x' v! @. U1 Q& D3 M4 @  r. {+ R
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with; j0 X: v5 S. ?
  SoftICE while the option is enable!!
8 i  V8 c# P% p
. y+ C# Q0 n) fThis trick is very efficient:4 ~5 L2 b; g/ S; C
by checking the Debug Registers, you can detect if SoftICE is loaded
1 r4 r$ ~& L; C4 {$ T" a(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
9 ?* L! ]2 O8 d- d4 r3 d+ Ethere are some memory breakpoints set (dr0 to dr3) simply by reading their" ~# D( F1 ~! K, l! k3 N
value (in ring0 only). Values can be manipulated and or changed as well* k5 n2 Q0 b) x5 s1 a/ }
(clearing BPMs for instance)
, v- x2 E9 }, ?! g5 A1 @# H5 |: X* q5 Q( v" E/ O. }
__________________________________________________________________________
8 W+ D* N( m6 s4 ?; I) V) F/ ?
" h0 ^6 }1 V3 c+ sMethod 11. P9 Y# Z9 o4 M
=========4 H0 T/ T+ n1 D+ y: `4 e& w0 ?

6 ?/ ], T! J5 ]This method is most known as 'MeltICE' because it has been freely distributed
7 ]8 g+ B- v. g. Vvia www.winfiles.com. However it was first used by NuMega people to allow6 L  s) H# e- P( J1 G
Symbol Loader to check if SoftICE was active or not (the code is located- {# Q  A& w. |
inside nmtrans.dll).* f) ^5 g( D1 e: ?  O

6 P: d9 p. J" s4 s& K9 rThe way it works is very simple:
* p& ~, c" t9 I. o! P/ _It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
5 t' b. M5 I$ ^% vWinNT) with the CreateFileA API.
" ]/ o4 e/ r7 J- G4 `( L' d
1 R3 Q2 y# k! t( eHere is a sample (checking for 'SICE'):
" j+ j+ _+ b8 X4 y6 U- J, ~$ X* h
) e8 q  m, o& S9 K8 F! `, FBOOL IsSoftIce95Loaded()8 [# x$ s" [# M+ g
{2 t" d; _+ \* ^+ R9 t' T
   HANDLE hFile;  ' L% t, c% W! Y2 [% D) R' j
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
+ y1 w$ R) B; A) Y+ {0 P8 o: x$ X                      FILE_SHARE_READ | FILE_SHARE_WRITE,
4 H: Y+ L; Z; t$ U                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);2 U7 N# h2 D$ U! a9 |: t( ^6 }
   if( hFile != INVALID_HANDLE_VALUE )
: u. D, }4 F, U( b7 Y4 [   {
' k* G: x  C7 U) E      CloseHandle(hFile);5 S+ l  X4 h* [# Q' n
      return TRUE;0 e. M6 K* Q7 t2 b
   }$ @8 w" b) w5 p3 m% g. J! r9 b) [
   return FALSE;) P3 H0 f! _0 O6 w- j
}5 b4 V; a/ @% g  K3 i

2 Y( O; {/ e0 G# A2 I' CAlthough this trick calls the CreateFileA function, don't even expect to be$ ?5 L+ u2 q  _1 {" [- g* F: L2 q
able to intercept it by installing a IFS hook: it will not work, no way!  g, c+ a! Q0 @' e: l  q' X
In fact, after the call to CreateFileA it will get through VWIN32 0x001F* Z( f0 X, [3 m$ ~  S1 {* w5 X
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
" U( u  y; E5 }and then browse the DDB list until it find the VxD and its DDB_Control_Proc" p+ w4 w2 [; q- C) U/ f& C
field.( n5 g' \2 C3 u6 t7 f
In fact, its purpose is not to load/unload VxDs but only to send a ) W1 y# q8 a8 z2 v! q
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
0 v1 c  k% e. B( s9 a2 n+ N% rto the VxD Control_Dispatch proc (how the hell a shareware soft could try
& U9 D1 B7 e) b9 Qto load/unload a non-dynamically loadable driver such as SoftICE ;-).
$ Y  L- r7 i0 J3 VIf the VxD is loaded, it will always clear eax and the Carry flag to allow
% f- h% l4 ?; U& O3 Iits handle to be opened and then, will be detected.* S/ U- s; Q# H) O) R; C* ~
You can check that simply by hooking Winice.exe control proc entry point
! a4 \3 h( J+ y6 xwhile running MeltICE.$ Z+ l3 S3 l8 d+ d
2 _5 s' b# T  O9 L. H1 U9 h

5 ~/ q6 U3 H/ v, i" w  00401067:  push      00402025    ; \\.\SICE
1 y& j5 ^0 x7 I0 G  0040106C:  call      CreateFileA
" D6 Y1 A0 N1 t1 W3 Q% U2 u  f  00401071:  cmp       eax,-001
% M2 y4 r; Y7 l% r  V4 D  00401074:  je        00401091& i' e; f2 {3 H! K  T# C) _
+ n% i1 \1 [" g- f
" r) {4 E. [- f+ m* `
There could be hundreds of BPX you could use to detect this trick.3 L4 W# L( {- w) L. L/ U
-The most classical one is:$ X0 |# d  |* f: N; b% u' u, P# l
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||1 [. o" o& R. f3 I) e1 m
    *(esp-&gt;4+4)=='NTIC'
# n& V1 y5 A; g2 b8 k/ f1 a6 K; F" z( g7 f$ }# V5 j
-The most exotic ones (could be very slooooow :-(5 ^' s" x7 Z6 C( u. V6 L% r
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
- e$ u% c! m! I$ c5 _     ;will break 3 times :-($ U) }, ~- ~6 E/ }- d
1 S# e# n0 _5 e4 R  J
-or (a bit) faster: 9 K2 ~$ z5 x; J2 W( e. b
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
/ z* w2 j+ k- U0 c' o; r% _7 |% L% b% k0 t. P0 p/ x" ~2 c) U
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  1 b: F. n1 Y4 a1 U; R, Z* y
     ;will break 3 times :-(! m$ O9 d- C* H3 L8 {; {: ^" n- e

5 y& k) i1 s+ P-Much faster:. X& P9 J4 n: ?9 K
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'  \$ S  o: t1 C3 R6 c# f* t

9 p' Y4 q+ i; }) Y1 M( jNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
- q; v* i9 v0 b2 K4 ^function to do the same job:8 |3 N' S3 G# s- }0 U3 I

) r% O; h* N* p8 L" b' [" Y) a' ?   push    00                        ; OF_READ! t: U8 g$ _  e
   mov     eax,[00656634]            ; '\\.\SICE',0
$ ^3 v9 I. I$ d! G! l+ N4 B, l   push    eax
$ o! x4 r. f: U8 S* K   call    KERNEL32!_lopen
4 A1 I8 r5 h4 j, K+ T* ]   inc     eax5 j% m9 a2 e7 t& C  d4 t
   jnz     00650589                  ; detected- p  G9 i; ?" f: F# Q' F
   push    00                        ; OF_READ
" @! s8 l! o9 m( g% }   mov     eax,[00656638]            ; '\\.\SICE'
/ K3 \6 y  p3 i) ^; e   push    eax
, q7 n- Q$ i! s5 b7 j" u   call    KERNEL32!_lopen( e' g; Z: ~5 {* Q6 C$ n* \/ E$ s
   inc     eax) e1 [4 G" ~' Q' ?0 f& K
   jz      006505ae                  ; not detected+ i5 U; b) O2 \9 ^( I
0 `8 b  D% X+ ~: F8 i

9 d; g4 D% v0 p9 \$ ]__________________________________________________________________________, t- Z2 J+ N; m9 w4 {% N
$ _- x- J& r, b
Method 12  {+ |4 c/ A3 [" V  h/ d$ [; r$ S
=========
" e% ~5 r' o+ l) e
/ F& ~, n5 {. a5 H1 wThis trick is similar to int41h/4fh Debugger installation check (code 05
: Z. e1 p$ `1 d$ @0 z' A4 x! v& K&amp; 06) but very limited because it's only available for Win95/98 (not NT)' ]& z1 O5 V& U0 B
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.% g. B. f; |9 X) R
& Q5 f0 ?/ G7 l/ O3 ~
   push  0000004fh         ; function 4fh5 M$ g$ v! k/ f3 ^8 q4 k1 d1 b6 _% l9 a
   push  002a002ah         ; high word specifies which VxD (VWIN32)/ J; e9 h' p( H4 z+ V7 _
                           ; low word specifies which service
0 U: [9 @6 b8 ^& A                             (VWIN32_Int41Dispatch)# W; G, _( R+ t$ Q) y1 v! ~2 C% `, ?/ U
   call  Kernel32!ORD_001  ; VxdCall
( v, H4 D9 |, h   cmp   ax, 0f386h        ; magic number returned by system debuggers
& I2 s& D7 U! \% @$ o   jz    SoftICE_detected
' a# e8 n4 R' z1 Z6 C5 y8 O& Q1 u* _% y& K2 O
Here again, several ways to detect it:
' z: U6 b+ h: y4 ]6 W0 N, m, K* R: O: ?7 l( g- J# G6 Y4 Y
    BPINT 41 if ax==4f
/ @0 N& s+ ^: I9 m( N8 i2 A; t2 t  d7 D! H
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
% o# p& S) S# ~! g: A% W1 f% P. U
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A# n4 L( j  t) L9 P' ?

0 n( i& N# e6 J% u9 e    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!/ Q/ i0 X! U0 {* P$ x9 o

+ x; T" A# g, a$ T__________________________________________________________________________
. X- b2 k0 I+ ~* [* k: Y8 H6 q8 f- E+ Z% }' C# }* }
Method 131 u& h! ?* l; Y8 P
=========. K( C: [+ `9 B

/ |2 r' J3 [& K5 K* ?/ ~Not a real method of detection, but a good way to know if SoftICE is
# q4 x2 {& [! H# v5 e. b" b1 Vinstalled on a computer and to locate its installation directory.
" W3 P8 L$ t: Y# J/ Z$ JIt is used by few softs which access the following registry keys (usually #2) :
& W. l1 ~$ V0 n# N, H
: I* H# Z$ f9 X9 \# j. X# \. T-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
1 }9 U$ @$ z( @  [) S9 m& {0 Z% ^& ^, _\Uninstall\SoftICE( X, K! {0 E! D# |: }
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE4 Q( v$ n) `$ H6 J4 M& s: d$ o. d
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion, |( b( t  j5 b& k
\App Paths\Loader32.Exe4 n% L; k4 t- n% a$ X1 I. u+ Q
& y* C$ D7 [- I' `5 }

, S) z6 Z! y. A) m0 \Note that some nasty apps could then erase all files from SoftICE directory# r+ ~- ?+ w, w
(I faced that once :-(
6 H- f: _' U: A. t6 q% ~
* F5 c) k8 A& ~- RUseful breakpoint to detect it:. E0 f4 }1 X5 u5 G5 n8 G1 X7 G7 C3 K5 N
8 s2 u8 _+ `  g& F3 }; D
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
7 `4 ]7 z+ x7 o8 y- u4 [3 ~$ T8 }) Q: ^3 \  C
__________________________________________________________________________
5 G6 Z* k* J6 m/ e7 ?0 j" x1 @3 G" h6 w; I% R3 W5 K% ?

( F* c( S# H: P  M# I- b5 m0 DMethod 14
5 M* U6 |$ C; s& c/ e* \=========
6 m& ~  _) D& @- m' [: |  B. H3 ~+ ^
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose0 z# @9 R" t" e  F- O* C) F
is to determines whether a debugger is running on your system (ring0 only).
7 k* Z, d9 v7 |3 j9 }
- l! k+ w3 B. T' X8 ]3 p$ J7 s   VMMCall Test_Debug_Installed
( x9 y* E' Z  g" Y3 k6 g   je      not_installed' g3 M$ C1 |' a( o

* I2 ~# @4 h: n9 t2 DThis service just checks a flag.) G/ _& p' a$ p5 B5 K
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部