找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
% K: x. \& G- c  g5 m# g<TBODY>% B/ B$ W2 ^! Q+ ^, d
<TR>4 n9 p) B( K, B& J  F8 j* ]/ l
<TD><PRE>Method 01
" c* N! h' A1 Q=========: ^1 D, v0 F( q. Y! i' X6 b* F2 g# J
% b/ S' I4 {& J$ X0 X
This method of detection of SoftICE (as well as the following one) is# _8 S- U1 ~* R* @1 D- w
used by the majority of packers/encryptors found on Internet./ r8 z, @* P' Z1 b% L; K
It seeks the signature of BoundsChecker in SoftICE  w% D% F4 j0 C; W7 y
0 Z2 v- ^  r* n& H9 r5 {
    mov     ebp, 04243484Bh        ; 'BCHK'
: U3 Q$ j8 j' P3 ]4 G  f$ ^    mov     ax, 04h
. A0 I( U: z5 M. Z# E. g; F    int     3      
% {# C/ F/ P- ^) L1 k    cmp     al,46 [6 M7 v6 v  {( K1 X9 A8 n
    jnz     SoftICE_Detected) T5 v8 H+ [1 Z0 F* q

( Q+ ?4 x/ k- r0 D___________________________________________________________________________8 [$ p6 P; S* N/ u% H$ y3 s
7 S2 B: ~  C4 e* M5 ?& ]
Method 02
& V9 P6 k  K% I' _5 v5 n# `3 ]# E=========' N( p: \6 l" J# ]
8 v$ `9 c1 _0 T* e
Still a method very much used (perhaps the most frequent one).  It is used. J5 {1 r" c. F. C5 t2 ]1 F
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,6 F; {0 b1 l; {3 R" h
or execute SoftICE commands..." {$ ?; Z' I. O$ e& e! B) Y
It is also used to crash SoftICE and to force it to execute any commands
) T# F* y$ w6 ^2 W& J(HBOOT...) :-((  
: ~  u: Q$ w$ e0 N. |" b' M+ S" U! F% a2 G
Here is a quick description:! T6 w9 A1 B8 m) B5 C! l1 X: R' e
-AX = 0910h   (Display string in SIce windows)
0 k8 Y+ ], u: i; y1 q-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)% C/ t$ k8 h% Q
-AX = 0912h   (Get breakpoint infos); I/ n+ Y. ~3 q( A8 d' n# K6 p
-AX = 0913h   (Set Sice breakpoints); y# ^6 t7 h# E  K
-AX = 0914h   (Remove SIce breakoints)
  V5 h; Z2 r$ H7 j5 e: ~+ P  n3 }8 @6 ~/ \& v, e9 {3 I7 [2 L
Each time you'll meet this trick, you'll see:9 r3 c) y6 H) g- W
-SI = 4647h
& e* x7 o+ \. Z, X/ I  L-DI = 4A4Dh8 W* Q) M  d$ m0 M8 A( L
Which are the 'magic values' used by SoftIce.6 k5 o/ I$ s" {# o
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
. ~& V/ c& w- {. L
/ U. N$ d# W7 ~Here is one example from the file "Haspinst.exe" which is the dongle HASP
1 H( t+ f  N. R! FEnvelope utility use to protect DOS applications:7 ^/ K8 _3 E+ }; v0 h) J& A, i' _+ w

5 O% i5 D" \/ I( ?7 g/ {1 K  u
$ q; P3 m% f, {$ X& ~( w4C19:0095   MOV    AX,0911  ; execute command.
: r+ ^% M5 O( E! l4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below)." p$ }& K! {' k: z) @5 T- A
4C19:009A   MOV    SI,4647  ; 1st magic value.
9 W) q# ~) k3 x- @0 Z3 Y8 a4C19:009D   MOV    DI,4A4D  ; 2nd magic value./ l* t7 T7 F3 I6 e3 @% ~
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
6 d2 v& ~  J; K- g! W4 [& A4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
7 R. o& o3 d9 r( z2 Q1 w) b4 ?4C19:00A4   INC    CX
. X0 f- @: F  Q4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute9 s, w" o+ x) @( ~) g: w. U
4C19:00A8   JB     0095     ; 6 different commands.5 C5 _% ]9 c/ _! M2 J
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
$ a2 T4 K% d' R! r: y  K- [  J/ j4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
6 P' a* S$ s$ k2 {
- J$ i+ s9 j, y% PThe program will execute 6 different SIce commands located at ds:dx, which0 L, u; k1 h/ y
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.1 v# l5 }& r2 I1 y

$ ^3 ^& G: U! w$ m* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
; T8 I. I% o: K: X; H' f# x7 H" m___________________________________________________________________________
1 i, N* ~5 t( }- _  U6 G. e# y# |0 H! N3 |) A' C. n) ]

+ C5 r( }- l! ]+ P6 qMethod 03
, _  z  c2 `  m& d5 ^=========
+ W, e: ?7 I8 x3 t8 I+ r  b9 L- q4 S5 j
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
: `& P2 c; }( E! f% z# @8 P: P(API Get entry point)
) m' k2 x8 A& I' c7 o1 [        
1 N6 P4 z+ }* |; x& D+ }9 S- j; v* |; q8 B& o, q0 e7 A
    xor     di,di
4 o! ~( w5 c3 F) |" I    mov     es,di0 Q9 `8 P! w7 j4 @- k8 p% W+ ~2 j
    mov     ax, 1684h      
5 P+ w2 {; M$ S    mov     bx, 0202h       ; VxD ID of winice
$ w0 V, v" E0 m: d+ q1 g3 A( a) `    int     2Fh! a) X% ^* c: r: q; v
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
- B4 E, a) p* z* Q1 E% X: F    add     ax, di% I* Q4 K9 p) F1 b5 ~
    test    ax,ax
/ F  m( w) g; t5 i& X. g    jnz     SoftICE_Detected! c: |1 i. W& M7 w( f

7 w, |: g3 b' `" }; q  [" X/ G___________________________________________________________________________
4 o/ X$ D; q" M$ L# c+ i4 Z3 F& H5 D& A
Method 045 j+ m) `2 {# u; h' b& T* k
=========8 b, c8 t$ j) R8 Y' f; \9 k

, q  G4 q0 u" L5 ^/ IMethod identical to the preceding one except that it seeks the ID of SoftICE
; Y$ }: G4 f" K9 oGFX VxD.
; R6 j1 H0 [+ A5 e
  A0 ?8 G0 q+ Q3 O; N% d    xor     di,di! C, {8 @& C3 I) W/ v+ _
    mov     es,di
- r4 U# n& z1 [, [    mov     ax, 1684h      
( |# ~/ Y1 Q+ O' x3 Z2 u    mov     bx, 7a5Fh       ; VxD ID of SIWVID
3 w1 `/ Z8 q) p0 Y( `    int     2fh
; u5 \6 F1 Y) [3 ]1 f    mov     ax, es          ; ES:DI -&gt; VxD API entry point( M. [. @$ }/ m0 h! y4 Z6 e0 _
    add     ax, di0 B% n( t- O  s; s, [
    test    ax,ax' u! T: K9 d- d% B! y7 O4 {
    jnz     SoftICE_Detected, d& S4 e7 O% {3 o
% S1 _0 x# x! C1 a& n
__________________________________________________________________________
6 }; q) G2 c% a4 t$ [& B: N7 G( h0 `% I3 t  f
1 V# a! _: [4 [( v& ^2 t7 w4 w
Method 05# j8 {  ~! K# c
=========" t4 `$ {+ ~' }. [
" o( q4 |% |6 F* U& d& r4 D
Method seeking the 'magic number' 0F386h returned (in ax) by all system" c0 e8 o6 `9 e: t$ }6 D
debugger. It calls the int 41h, function 4Fh.
3 J# c# h1 \. v. Y  o( _There are several alternatives.  # P% c8 |6 C  f0 z' ~( ]
( ]( G$ \$ ]" t  y
The following one is the simplest:
  W6 e# b" I6 P. S6 B
& S" D+ k" N2 h( ~7 E% D" X6 U    mov     ax,4fh
$ y- P* A( }3 q8 S. L0 K    int     41h+ _, N" g5 F! U+ \
    cmp     ax, 0F386
, F& v, }, A) g  q' ^9 a    jz      SoftICE_detected+ B5 ^8 `4 z" r8 \/ a* `

5 c) m) G+ A6 {/ q8 [2 i
3 k, y3 y3 [! uNext method as well as the following one are 2 examples from Stone's ' O) Q6 H- P) J; F& ?% L% |
"stn-wid.zip" (www.cracking.net):% h# J# e5 K; V4 r
; u: j1 j5 V# M7 g
    mov     bx, cs
2 }4 J: \' z7 ^8 J    lea     dx, int41handler25 T7 K, N& y# B4 l# x4 Q, M
    xchg    dx, es:[41h*4]
% ~1 e5 B# U; O% ]: k    xchg    bx, es:[41h*4+2]6 g' V5 ~* F7 n) M4 H
    mov     ax,4fh6 s3 W; w7 N4 V/ v1 x
    int     41h
0 v- M1 P$ \( l6 L9 c1 K" j# M    xchg    dx, es:[41h*4]" T2 B5 F9 K+ _& _# F: E
    xchg    bx, es:[41h*4+2]( _6 T. k4 y+ R" w
    cmp     ax, 0f386h
# `# l( g' P% a! T6 B1 }    jz      SoftICE_detected) E; Y) F: e* V+ |9 \4 k
) M- i. V6 G# r* B; J0 a4 R; j
int41handler2 PROC
$ ~# P( P  `! w* e    iret
- X5 `8 q7 F" u7 mint41handler2 ENDP3 j* [. u8 z& {/ z) z/ {1 i
/ {. P) v* S4 Y( r

% L! \: |) m3 h4 A_________________________________________________________________________7 F/ r$ F3 s2 E# X- K
/ H: ~/ M3 N8 K

* @1 j- O$ ~: Y1 e/ R& I1 l/ JMethod 06
& z; [2 r5 o) g5 G/ D. v! |! \=========# q, t" ]6 v7 n  E- {

9 d. `% K. Z1 H, _8 U
3 m% v: E) o' D5 h8 F& a  d6 a2nd method similar to the preceding one but more difficult to detect:
5 e) T8 j9 n. s" t3 [
) K" `% F9 Z* p3 R# N, q$ O8 k! n" C- f$ X4 v8 S: N0 U7 }
int41handler PROC+ b4 n' y& q! |+ H3 i* o0 d3 V9 j
    mov     cl,al
8 _( j3 r4 J7 D9 i    iret
, V, g4 l3 v; e4 ]3 b& |! Zint41handler ENDP
/ o7 ?& i0 {: s- _6 p$ I: X* J5 @, C: |( ~/ k4 i
+ z+ K/ L- s, c8 g3 d/ E8 k
    xor     ax,ax
% R4 D& J+ t* K5 ^7 i% ?% t6 p    mov     es,ax  p" X4 ]7 _6 e9 W3 T4 s" H
    mov     bx, cs0 \1 E; v% m( P: C3 ^: x5 g
    lea     dx, int41handler, F: t5 e: u' H. G& ]- Q' K% ?
    xchg    dx, es:[41h*4]
6 a- [& t: B* y% U; ^    xchg    bx, es:[41h*4+2]2 l9 p9 ?5 v! I& i+ t- o4 N
    in      al, 40h& e( |: _( {0 A' B0 r; E1 q( V6 m
    xor     cx,cx
3 r' T" ?$ a' v  X8 K$ |! E- g    int     41h
1 E8 @) n7 Y7 Q* w5 g2 ^0 y+ {: j    xchg    dx, es:[41h*4]
8 e. l2 a3 O* |# T8 M7 ?4 K1 V    xchg    bx, es:[41h*4+2]
# _2 Y- [  t6 a* o1 q    cmp     cl,al
- U2 @& X. ]1 i- o2 r    jnz     SoftICE_detected
2 Z& j5 f1 y' Q' L8 D( [  U" q$ R2 q" J( J% \9 o4 d
_________________________________________________________________________
  ^+ S- c  A7 O6 p
# n# y, X/ K1 ^4 V: h# dMethod 07
  z8 y* Q& \/ u=========
  {- j' D) `& j0 }! j7 j# s+ L$ b  P2 f! K" W" H
Method of detection of the WinICE handler in the int68h (V86)  \2 H1 v. t9 X- ^: z
  B7 p% Z1 Z+ U5 y* x
    mov     ah,43h5 D9 y+ Y) y$ [) _5 j2 t/ Z  \
    int     68h2 w0 {# Z0 r- R- K$ q5 r
    cmp     ax,0F386h# x" N2 M: L% ]- _
    jz      SoftICE_Detected
$ C5 i; J& m. ^( f( h8 S" N' k" L: A3 q: W* D

+ W, b' L& o9 W6 J=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit+ R* d# ~2 L" @
   app like this:
! j7 g6 R+ l9 G, k& x2 h+ {, Z) U( O
   BPX exec_int if ax==68; D5 J& j) R8 a: {4 H. S
   (function called is located at byte ptr [ebp+1Dh] and client eip is2 h; m6 C! x$ [( M* V
   located at [ebp+48h] for 32Bit apps)
  p( s2 _/ K3 B" W__________________________________________________________________________3 a% q4 S- E* F9 R4 ^
# b! ^5 }7 I1 k! K. T6 @( x

. I+ m+ d8 F4 y" C& M$ s6 M( rMethod 08( n' R9 n+ t" |* @6 p! t2 @% C
=========
4 ^: M# d' T8 p0 e8 F- o" }
+ j% R" Q# H/ {6 B, _8 qIt is not a method of detection of SoftICE but a possibility to crash the0 t5 B9 b- o. y9 {8 r  D
system by intercepting int 01h and int 03h and redirecting them to another$ v" V+ I$ L4 x5 s
routine.. Y- I1 \& g% F' M' {
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points+ \; h* _5 d4 b; l6 E2 ]9 O! W0 V* Z
to the new routine to execute (hangs computer...)$ h& Z3 I/ P- o8 P2 j

0 |) ]; Q/ [" D$ F- l5 ]. ]1 B0 G    mov     ah, 25h
! o. Q/ g; }& B7 z' k0 M3 ^    mov     al, Int_Number (01h or 03h)7 O* I3 i. o7 B" _* A  D
    mov     dx, offset New_Int_Routine9 f, z; r; V+ b4 ]/ D0 u% P
    int     21h1 ^5 S( ~* j; I- L) Q. y$ \0 @4 c* @
/ Y. y. p. o( c7 o' \
__________________________________________________________________________% j+ O: o4 E/ h2 Y! B, P
" T' n$ d; R/ q# e7 N0 W. t
Method 09+ l+ ?3 B/ }3 b# H' N* y, V
=========8 R6 V6 ]" W& K6 n7 ]/ S1 P  Z
# \' Q& X9 v" o2 P" Z/ g/ u
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only2 }) ?9 B# q7 u% X
performed in ring0 (VxD or a ring3 app using the VxdCall).' q3 _3 M4 s. F+ G8 k9 S9 Y
The Get_DDB service is used to determine whether or not a VxD is installed
0 m2 l! d; w- }6 X3 G; r  Mfor the specified device and returns a Device Description Block (in ecx) for. l% y3 i* s  u- x# k: S
that device if it is installed.
: ]" M) B& M/ r1 H" f" ]% Q8 q5 q) H- z7 l3 b# i
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
" {0 \1 s% Y3 T! A   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
  N) |& d) c, H" m   VMMCall Get_DDB& }; g4 c3 K$ A! f8 i8 X9 r* F
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
) B# V6 ?# ?9 ^$ I9 ]/ [5 p+ \5 E- u
Note as well that you can easily detect this method with SoftICE:. }+ T. H/ l' e$ C
   bpx Get_DDB if ax==0202 || ax==7a5fh
4 ?! b0 Y' V6 `
/ u2 K0 i. Y8 L5 P__________________________________________________________________________( K: z$ T; r6 ~' o% ^

3 l' x- J, q5 g* @- o0 d  dMethod 10
& J% Q$ d+ u$ M7 c) x4 t# V& i=========
. H( l: d: {- P: ~6 g/ V- ?$ ~  }/ ?& o, _
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with# C/ A: b  t) e8 r
  SoftICE while the option is enable!!
+ }) M9 r) m, f# T# h
, _# x3 C; A' _- d7 ^4 jThis trick is very efficient:. }9 ~: Z0 z( \2 M$ v$ K  w+ v
by checking the Debug Registers, you can detect if SoftICE is loaded
( E3 _! ^5 z" n+ U(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if9 ~  D! t1 h$ A1 a2 D. u: D9 U
there are some memory breakpoints set (dr0 to dr3) simply by reading their5 S1 c( B/ x/ H8 X' v' y" b
value (in ring0 only). Values can be manipulated and or changed as well* w# r/ _% F" |
(clearing BPMs for instance)
: U: L3 t* T6 y  O' @8 |8 h5 w7 k4 h6 s6 {7 x. k1 T
__________________________________________________________________________
9 c& x5 X6 J3 i: N; L% \8 c- U, `
Method 11! ?% Z+ Q  ]& d- H9 K- Y
=========) z% _4 w" J, v: g( [
$ X7 ^9 Z' Q9 }/ L- W3 I
This method is most known as 'MeltICE' because it has been freely distributed
3 q& k* Q5 i& V7 ivia www.winfiles.com. However it was first used by NuMega people to allow
6 w7 h' q7 c7 f: ISymbol Loader to check if SoftICE was active or not (the code is located( b0 j8 L4 J& r
inside nmtrans.dll).
: ?% ]. P+ l8 W$ E! K7 C- |  R/ ]- }, M" d$ y. q& @
The way it works is very simple:% ^/ {& P* C% B
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
; ?# a. {  H; b# d% b0 i: TWinNT) with the CreateFileA API.
5 z3 I, @# K% Z9 F  Z+ {# j
0 t. o% K2 E6 P3 W% SHere is a sample (checking for 'SICE'):
( E5 c- F0 }; \5 o: d8 u) ]
2 ?5 y9 k) D" q% W4 w7 \BOOL IsSoftIce95Loaded()
% y" t! p5 K2 U8 {- p( ]1 @{; b  K, B6 X9 Z1 Z- ~
   HANDLE hFile;  + h4 h2 M& I4 n3 m+ Z& e
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
- Q  B. ?5 ]8 _. |4 p9 E/ |                      FILE_SHARE_READ | FILE_SHARE_WRITE,
) o: G0 K& l; @; Q                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);+ ?$ D, }( X9 x6 Z" [6 {% M/ s
   if( hFile != INVALID_HANDLE_VALUE )
8 U9 ~. v6 w' ?, Z0 P: m* v2 y   {$ }# s. i& Q, B- J- A' A
      CloseHandle(hFile);
8 j; ]& {& y$ R3 S9 R+ l/ B& F, G      return TRUE;* q% A/ z, r9 t8 p" p. l, o
   }
" M; k* V. B8 a   return FALSE;
* C7 d  f; W2 _+ J3 U2 Q}& O2 O; u9 K3 Q
) o( K1 V) t# K0 T/ M
Although this trick calls the CreateFileA function, don't even expect to be! Z' n$ f# V. c% `0 Q8 {4 I$ _
able to intercept it by installing a IFS hook: it will not work, no way!
  U$ d; v/ T$ C% P5 {In fact, after the call to CreateFileA it will get through VWIN32 0x001F
; l6 b( K  e9 r3 L1 `2 l/ a- b2 qservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
3 h' e* ~$ a% w* ~) k( d2 Land then browse the DDB list until it find the VxD and its DDB_Control_Proc) m4 l/ N# e  q6 Q1 n: y) l0 T
field.
- \1 e. B3 A5 S0 D- M  HIn fact, its purpose is not to load/unload VxDs but only to send a 7 d1 ?( \' T  `9 \) x# g
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
# C( J7 N$ E  {# R8 jto the VxD Control_Dispatch proc (how the hell a shareware soft could try# \5 B  s8 x3 z2 ]
to load/unload a non-dynamically loadable driver such as SoftICE ;-).! }- b- L0 v& I! M! P9 n% r
If the VxD is loaded, it will always clear eax and the Carry flag to allow
; `7 T: G, H' A$ r3 D( X2 n5 }its handle to be opened and then, will be detected.4 ~) A5 l# I+ C- c& g. u5 X- p
You can check that simply by hooking Winice.exe control proc entry point1 u' W, b7 `8 z+ n% l
while running MeltICE.
# U( F' Z$ m7 }, \
0 E8 x/ H# I% P1 Q; S2 F
! G! D( A( C: P7 C  00401067:  push      00402025    ; \\.\SICE8 f. a' K2 _( t1 c9 x$ b" s. e
  0040106C:  call      CreateFileA
) P, t" U) @! z2 t  00401071:  cmp       eax,-001
7 T# M2 W1 n& v/ ~1 V; S  00401074:  je        00401091' ?% C1 P* k: ], o0 G8 r1 T

& w( V2 K3 ~9 d: n7 q6 K/ m* a4 k1 U0 n6 R7 i
There could be hundreds of BPX you could use to detect this trick.
, V% `  q0 Y% f0 }/ k. I- _) G- ~-The most classical one is:+ |: X1 |7 _# Q5 `
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||4 n/ F5 F6 C# ^& _. L. @0 J. x0 z( D
    *(esp-&gt;4+4)=='NTIC'; u4 C2 Y; E2 b$ ~( }$ @" e2 ]

/ [# K1 f  ?0 p% \-The most exotic ones (could be very slooooow :-(
( i4 Z, |4 B# |6 c3 v" M& h   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
# `& m0 C' y5 x, C4 n9 ]/ p% K, x! F     ;will break 3 times :-(/ H7 |5 s9 w$ B9 C% k! @8 M+ O! [
8 S6 A  E8 j  M; e8 w) M% V% Q
-or (a bit) faster:
! y! X- V. G( \   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
3 s$ G# x4 o& J! e, Z' b3 H  \0 J' l+ s0 O% s
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
$ X, ^4 c  U, o# |8 a     ;will break 3 times :-(
7 [- U  Z% C' C& B, U* t8 `* ?& m, b0 z
-Much faster:
# C* s  b! w7 R) Q. y. b   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'9 F: _6 }; \+ s

: H5 ?' w+ ^% {7 e+ g3 b; FNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
4 F1 X, G$ ~3 y( S: m, M. k9 Yfunction to do the same job:
- h* q* z7 x. `1 D9 J4 |. H
$ y* S2 f0 }# }/ B' S) C   push    00                        ; OF_READ
/ r- h5 `& g( I0 W% F   mov     eax,[00656634]            ; '\\.\SICE',0
* _9 w9 W( {( ^- F/ Y0 x% }   push    eax* a2 D* h4 ~6 c: W3 B
   call    KERNEL32!_lopen! Y7 D' d2 w% O7 ~
   inc     eax
$ E- w% {, b5 P   jnz     00650589                  ; detected% ?" v( {/ R* T+ h$ S& Q; u  a% Y, A
   push    00                        ; OF_READ4 E: ]0 B' [# o' G0 K1 b
   mov     eax,[00656638]            ; '\\.\SICE'
( W# q$ b7 z8 r9 O2 w  Y9 A4 h4 i1 E   push    eax+ V- q$ T# @0 W$ {/ E
   call    KERNEL32!_lopen. j1 y$ ?; L% C' [
   inc     eax
6 f% P0 l% k; e* t$ c: C   jz      006505ae                  ; not detected0 B) O: P& X0 H* u

% F- Z) u0 `  t  b
) P- j4 j3 Z) \1 e& H  q__________________________________________________________________________
- T+ l4 [, K$ R, v; s
7 f/ s: b& B' S% EMethod 12. u- J' j$ _4 [' N5 Q# K& ^6 [
=========
0 Z( r5 j9 A; K  x
. k! ?% C( v% m0 ^This trick is similar to int41h/4fh Debugger installation check (code 05
) O5 O$ t  K2 n&amp; 06) but very limited because it's only available for Win95/98 (not NT)
* z, W4 w! V3 Q* ]as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
* t+ D( J/ A4 Q+ b6 e4 F# {3 G8 y! a  `* [# k1 `
   push  0000004fh         ; function 4fh& {- `8 U4 Z- j8 K0 c/ ]
   push  002a002ah         ; high word specifies which VxD (VWIN32)
6 i8 h, q" _3 S: q( g# S- p1 f                           ; low word specifies which service) [- a) l, j3 `, m% G
                             (VWIN32_Int41Dispatch)! S% x# n0 j! y/ u+ L
   call  Kernel32!ORD_001  ; VxdCall% y3 p. I. r) P2 D& i  w
   cmp   ax, 0f386h        ; magic number returned by system debuggers$ \' H+ ]+ \  p% q3 O
   jz    SoftICE_detected  l- K2 d2 `8 M$ P4 u

/ F6 M" [6 ~1 e: b& `# OHere again, several ways to detect it:
, w! d& W4 x9 {: i; I; l, Q) M, a( h% V  O) Y! a  F. M
    BPINT 41 if ax==4f3 F5 ]4 G$ j3 G' Q) p0 W* G2 s6 u

% w/ T7 [3 P+ K, q1 l! B2 E    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
. o6 _# F# |* B) @& Y; G6 d+ E1 Q5 d. z! P, h2 c* _+ S3 A" w3 `1 |
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
) E8 `7 ?2 l! K) X( E& o# v; v1 m. z$ P, D( }$ a5 i8 h" r3 B
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!: T  w% f; ], O
' c9 O3 d0 Y4 G, {5 P4 N' j: Z8 [
__________________________________________________________________________+ _7 a) _8 @. Y9 A
8 l* j8 a  j( o; e. L  r
Method 13
; F; n1 m2 S+ w: m4 K=========
; _9 b: Z' P# I4 W' l
; @. I* L2 \0 O1 F/ sNot a real method of detection, but a good way to know if SoftICE is
# ?' r7 P2 V) z0 m) [installed on a computer and to locate its installation directory.
" D1 G8 h, d% Q4 N# _6 j3 zIt is used by few softs which access the following registry keys (usually #2) :1 h9 ~* [$ b' R
( T$ V+ J! A+ Z( \% D& ^# V  @
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion, l: e; j! p2 e3 i( H+ \1 l+ [
\Uninstall\SoftICE* [2 S8 T: ]& K' b: F/ t0 Y
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
  a% V  i' Y/ f-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion/ U3 F! j' Y+ o, J* d& y7 w
\App Paths\Loader32.Exe. b: x8 q" n1 r1 i
2 h% x: I# W: U) O: {/ \7 i
5 C: m+ |, X, b! r! Q
Note that some nasty apps could then erase all files from SoftICE directory
: b5 ]" v7 l, D' M6 u8 G+ l2 x(I faced that once :-(
5 R. E: b6 I! y$ T5 \
, r4 c6 G, N7 P9 Z1 p! J9 GUseful breakpoint to detect it:0 Z9 M* o6 h4 U: f4 ]- D& M4 o1 G
* e" u/ N, p# _( M+ ]. p- b3 T; V
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'! S  o& I3 s1 x2 ^. s% w- \" e

# w$ }/ d7 ~5 W) Y, w5 K& m__________________________________________________________________________. N7 W3 o" F7 I# I
! m4 k  \, J% B+ Z7 f; \

$ ~5 ^& {, ^3 m7 x% @9 GMethod 14 2 l: u: q, x/ z; `- H' k
=========
1 y3 p, {/ E$ g7 ~8 V1 ?+ Y; |8 B( r8 i2 l0 o
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
  R1 u8 U3 k. H1 D- i" mis to determines whether a debugger is running on your system (ring0 only).
3 Y$ k1 T1 b: T8 _' ?
- h0 l" u5 I# L, g; Y   VMMCall Test_Debug_Installed
2 U, _. E9 f7 H% j   je      not_installed1 |- K& ~9 @$ n9 Q) a1 i

* E" l3 f* Q- P# ]" xThis service just checks a flag.
' C, L4 R+ W& @4 H2 q; u# B" @</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-8-12 19:22

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表