About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
' r0 \- z7 I9 q1 R+ T<TBODY>' `' p8 r) I6 e& c/ n& R) _
<TR>! ~% G6 c1 g; q7 n* _4 X
<TD><PRE>Method 01
! t7 s2 N- W1 r( D$ n0 ?=========' h0 G& [2 v  ^4 ]/ {
' M  Q# \: U5 z3 A! I
This method of detection of SoftICE (as well as the following one) is! J2 @# B# K# k6 L3 _
used by the majority of packers/encryptors found on Internet.
3 ]8 P3 k7 z. M2 {3 |+ G9 YIt seeks the signature of BoundsChecker in SoftICE8 i* z1 p/ h: I9 F# b9 {. e2 t

  U4 E! x' B* ^, E9 q1 d    mov     ebp, 04243484Bh        ; 'BCHK'
- W+ ]; {; P/ e  A    mov     ax, 04h
' e+ ?9 s7 k) h, G" m* o% f0 `    int     3       - H3 E# ?& D& _, s  i8 c: W' Z; b
    cmp     al,4
, i' y. l/ m8 c2 N' H6 c$ ?    jnz     SoftICE_Detected6 G) L) H" r8 A4 c* J
% p* \: @/ _4 E$ w0 G5 e/ f
___________________________________________________________________________( I4 n) T4 p: ?0 H

: Y' y9 D7 }. e* C  f7 ^! |Method 02
- Q& A7 ?$ V' q( _# h# J=========
2 \, `+ T2 X- Z+ u/ [! d
# f% Y; Y: i& R5 t2 m  L+ I; tStill a method very much used (perhaps the most frequent one).  It is used
+ E% X. ?' b- n' Y% sto get SoftICE 'Back Door commands' which gives infos on Breakpoints,2 [6 [1 @( h8 l( b1 \! S( \& H
or execute SoftICE commands...7 d- |! x/ j3 ]
It is also used to crash SoftICE and to force it to execute any commands
9 N+ D' H9 R/ k(HBOOT...) :-((  1 ^% a5 Y: J/ ]: J
% ]( O0 {6 c% h" T6 @6 K& V+ T
Here is a quick description:
# _! ?% ]8 J" s& H, a+ d7 \-AX = 0910h   (Display string in SIce windows)
$ u6 n1 F4 G6 f3 Y: M# z- T$ F-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
/ |  Q# ?: }! g& J9 M-AX = 0912h   (Get breakpoint infos)% w9 S5 |# F3 z, H) {
-AX = 0913h   (Set Sice breakpoints)) j& b. E4 v6 T4 _" Y4 e& Y
-AX = 0914h   (Remove SIce breakoints)
6 L& h5 T% [' Z0 e3 S  ^  u
7 J( l6 d$ Y3 l9 ]Each time you'll meet this trick, you'll see:, H0 w" q2 i% Z; d) W/ a9 r
-SI = 4647h
! S8 C- n( X4 g, a9 s" K$ y-DI = 4A4Dh( w9 ^+ M/ W- ~
Which are the 'magic values' used by SoftIce.
, N1 T. j/ [4 r. l! mFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
9 `3 E- H6 M. F( ~. o  X6 k
* `% t4 [1 I- y0 U/ {/ XHere is one example from the file "Haspinst.exe" which is the dongle HASP2 z0 @8 H" ?; B* c& f* r
Envelope utility use to protect DOS applications:
. D$ r( F! D% W# o
& F; o: \8 s5 l" @( ]" O7 W$ w* ^- x0 n* \$ k
4C19:0095   MOV    AX,0911  ; execute command.' g3 p/ K: i( y
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).: N: Y7 n- m9 ~  M7 o
4C19:009A   MOV    SI,4647  ; 1st magic value.
+ ?: h5 {& J, Q& p: e) R" K4C19:009D   MOV    DI,4A4D  ; 2nd magic value., X5 L5 O& a. M+ H; ^! C# I
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
0 E9 g/ i$ q$ J3 _2 R4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute6 m# C/ J% K+ M% H( h; ~8 a
4C19:00A4   INC    CX* M) f5 H4 J8 p* e# Q
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute, }# u' S7 S" T+ L) m7 q0 }
4C19:00A8   JB     0095     ; 6 different commands.
* H3 W( J% N$ V( {6 J% Q% `* K$ m  ?; x4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
. W( V- p1 b/ f; [4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
6 ^% L1 \6 }# F# e) ~3 P1 E7 e; ]
/ I5 W3 @2 h4 w! _$ @% }: vThe program will execute 6 different SIce commands located at ds:dx, which
+ L1 l) j& d" t6 v- a6 N; i7 kare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.7 d( _# ?( V6 ?5 K( q- T, C3 a5 ^9 j
/ ?' {) ]7 _/ f0 L' Q; a
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
% V2 j- L. {5 g1 o: O3 Q) u* c___________________________________________________________________________
. r9 k( K2 J& C6 e. S6 U  b! `! l& ?- ^% Z/ k5 B1 B) B$ o! a3 t6 z9 O
7 w8 C7 d3 f! o+ ^
Method 03
" A; n" w2 ^% Y, m=========; V0 W+ {- A! x8 y, l, N8 z) `8 G

; [, g" h: q, V$ U8 V" QLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
& {% o& f  W9 B, u(API Get entry point)
, h8 f3 k/ j/ y& P2 O5 z        # \( N. n) b1 H( M& Y5 q

+ z! m) U* f! J' B% k; m    xor     di,di
4 J9 t1 \; t1 `% |6 a% z    mov     es,di. B; i' f, H9 l
    mov     ax, 1684h       + H. q  ]$ H) P" }/ ?
    mov     bx, 0202h       ; VxD ID of winice
  A! J1 n* e3 p- I    int     2Fh
8 D6 ?- o& G/ g8 _( x2 S6 F    mov     ax, es          ; ES:DI -&gt; VxD API entry point
+ d6 X4 P* t2 Z; K9 _    add     ax, di
1 I: X1 S' X5 G0 s0 e' x# X7 t4 n1 Y    test    ax,ax/ \8 _/ }+ @& \7 V, \  _% @
    jnz     SoftICE_Detected
1 N+ o. k5 X9 Z; G) @. t! [
6 Z+ L2 `) n8 F___________________________________________________________________________
# s# Y( x7 z( X: ?+ y) a+ O: V: q0 V2 V$ |& z. B  ]
Method 04% C0 b) t- P3 B/ D) u) B
=========' N8 _! Z& |# n- H7 I
$ k( y# \* u) C4 ]
Method identical to the preceding one except that it seeks the ID of SoftICE
! H, h) t4 \8 r/ t2 E, d! \GFX VxD.
8 Z; @; E# P+ l! ?- q8 S+ e. }! }, _* P) \4 H, z' L$ ?
    xor     di,di
/ Z+ ]" e8 p) l; }0 z; J. P( S    mov     es,di
9 I7 d3 v  Y! X0 G    mov     ax, 1684h       : q' i8 V* D1 ~
    mov     bx, 7a5Fh       ; VxD ID of SIWVID, ]: ?" e7 m+ C/ c4 ]
    int     2fh1 I4 g9 S$ _6 M$ Q+ ]& G
    mov     ax, es          ; ES:DI -&gt; VxD API entry point$ j' i: _, k8 p. v7 K3 s# k
    add     ax, di) _9 \  a: g/ `* ]3 l7 a
    test    ax,ax
$ ]+ F! @& o$ c; r# e2 L9 t    jnz     SoftICE_Detected' K9 g9 K0 e) ]6 H  D

' `+ {' a+ o; e__________________________________________________________________________* r; \# n$ w# K6 ]7 `

+ {' N/ `/ H% ?) g5 ]4 D
& ~: ~9 i7 w% z& ?Method 05
- J9 d: @: x: s) u) F  v9 K& g=========
% T7 s$ N2 N2 a" f9 b. \! |
' J8 B& l4 }: W: S# [" U3 nMethod seeking the 'magic number' 0F386h returned (in ax) by all system
* k3 ?! {  U, E$ q% O& q# Mdebugger. It calls the int 41h, function 4Fh.8 B; q7 M' D5 X/ U
There are several alternatives.  3 O: E. d# V4 i

% C, g/ Y$ o1 n" o0 K  \3 TThe following one is the simplest:
3 c- p% g# ^  G6 N5 n# @' L  _
' ^# N* G6 B* [. G' c3 z    mov     ax,4fh( [6 M2 ~. E$ ~. g: \
    int     41h
* N7 C1 Z* o, ~0 C1 X# f    cmp     ax, 0F386
' X5 c% D7 Z1 E- H& `: _! I+ S( t! j7 ~: D    jz      SoftICE_detected4 d9 F5 T% C! M- e0 v7 J3 q

2 |1 v; [& v1 S; L( K& `: E& T8 Q: j' V
Next method as well as the following one are 2 examples from Stone's
2 h. P, c) @- H' d; u"stn-wid.zip" (www.cracking.net):
9 O6 A: R# o/ O# l5 z  P1 Y. K, X" V, h
    mov     bx, cs
- ^+ \7 z1 x6 a% i& u2 A! E    lea     dx, int41handler2
# Z: V9 m% y* t# n) o    xchg    dx, es:[41h*4]" }3 G3 l) c: Y( x& ~) s
    xchg    bx, es:[41h*4+2]4 h1 N- U  k$ q' `
    mov     ax,4fh# Z, j5 J( _( D2 j
    int     41h; |2 F+ u9 I" w5 {- X
    xchg    dx, es:[41h*4]
' R, \3 b# [: w6 z; x    xchg    bx, es:[41h*4+2]
  q" Q  x/ i5 g: N. H    cmp     ax, 0f386h5 A  y; Z3 }/ i7 X
    jz      SoftICE_detected
. N4 G( f; c  c% C+ v  t6 @, G) A( V* S; n# |
int41handler2 PROC  E$ J: C: c- s9 T. D
    iret, ?& J0 B- g* L4 z/ x4 P7 u
int41handler2 ENDP  V0 y' s8 g; A. O: M# x

+ i$ _8 Y+ R  k6 R3 ?9 l
9 K' r9 S/ Z( ~; G# a& V, ^_________________________________________________________________________
; j4 C6 k0 {: l1 i. ?2 _% Z, m2 q( Y7 y9 W
8 I! W; K3 N, x0 j& t9 u
Method 06: V( o( ~0 m+ a3 N/ X
=========
1 O7 h$ x1 ~6 S4 `; U/ {) _& z% g; @: I

; ]0 S# Z# L. b- M8 |% W& c7 o2nd method similar to the preceding one but more difficult to detect:4 @* ]9 I5 Z% E; l

2 }( W$ q2 Q4 A6 B& e+ a$ J& `; x& _
int41handler PROC$ F" D/ i7 G% ~3 U9 ?* l
    mov     cl,al1 K$ Q; t2 l; U7 S
    iret
# U" y4 s% X) i" f& F$ eint41handler ENDP
' T7 s7 g4 ~7 f0 Z: V! M& J9 U( C3 J1 L+ C' j' W2 C
$ q- v5 \; e: X& G( C
    xor     ax,ax
/ c0 e2 |0 i/ b    mov     es,ax+ Y) b& D# @( f
    mov     bx, cs( z# p  }; V& P2 S" k+ p
    lea     dx, int41handler
( t( M+ l! K2 Q8 A% I" r    xchg    dx, es:[41h*4]5 P6 M/ }$ V' d7 a+ ^+ y
    xchg    bx, es:[41h*4+2]- W8 q' `6 T3 A4 N
    in      al, 40h
( p, p9 l8 M) y0 n5 ^# ?    xor     cx,cx
; x$ @, m) H8 W1 ~- S    int     41h
* _, ]7 l" d& A0 I  }; N, t1 F3 y    xchg    dx, es:[41h*4]
9 [  g8 s: N" s1 L. T, J, }    xchg    bx, es:[41h*4+2]
, q0 `; w" B5 E. W8 F; ]! g5 ~    cmp     cl,al! y( y7 n$ t' h+ }( d
    jnz     SoftICE_detected
: r9 t6 }' O- F& I* I8 P0 m. `! B2 K! o# D$ @7 `
_________________________________________________________________________
2 {" p/ B0 _( z$ T, ]5 o- E
' k" y/ B3 s7 q3 s5 uMethod 07
( c  L, M. y# D9 |, F% J# d4 e=========
) u1 I) }( c& [* Z1 u! ~) a5 v) ^) E8 z
Method of detection of the WinICE handler in the int68h (V86)
& J# ]9 ]. L2 v0 x7 @, D" _. R( n7 X- y9 D) s
    mov     ah,43h
/ s8 L7 t2 L3 N( o9 |0 @    int     68h
6 O- q! c) n. w2 N9 P    cmp     ax,0F386h
8 f* ^2 G. `8 r; z    jz      SoftICE_Detected4 c. Q. j; J. C# M6 C1 ^% [
  Y5 p  i8 ~% Z8 ]5 Y

$ J: [0 T: T; H6 ^=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
0 t1 v, |' J4 [, \# y   app like this:6 F* Z2 [' ~5 K/ D6 y1 P; {

6 l% _, h" [# b* R5 f2 O: a1 M   BPX exec_int if ax==68
/ Y9 M& @4 }8 M$ }' z3 N$ k! D4 f   (function called is located at byte ptr [ebp+1Dh] and client eip is
2 ^- k# T6 \0 d- r& k6 h   located at [ebp+48h] for 32Bit apps)
$ ]; v9 @1 q/ T: F__________________________________________________________________________% w( f) e% f5 s7 ?, I8 q

, P! [& u9 i4 r: x2 w. a2 z$ F$ z6 y  d2 G1 _
Method 08
+ h/ t4 ~; u2 z' {( P=========) o9 d: Z6 s$ \1 L2 F  F1 T4 Z

/ Z, v$ s9 b' o! o  e2 a: @: ZIt is not a method of detection of SoftICE but a possibility to crash the# i! Z6 |2 f$ X' [% `* x! v
system by intercepting int 01h and int 03h and redirecting them to another+ }$ N# f1 ?+ ]& r/ {' t: K+ g8 @9 Y& x# h
routine.
- d1 F+ D9 `* D% f% _+ sIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points$ |$ |+ b/ K: k9 R/ v4 q
to the new routine to execute (hangs computer...)7 P2 G2 f" e4 `2 n
5 k) I8 |. ]: _/ ~6 x) W1 V
    mov     ah, 25h: ^9 ]- S% M) T& U7 D% `7 D( A6 `5 B! U
    mov     al, Int_Number (01h or 03h)$ N8 J% U5 v$ H
    mov     dx, offset New_Int_Routine" I" O( g* u# k6 D+ t" P
    int     21h% r5 \5 p5 \" M, ~

4 T+ d. m& V3 K, T8 l__________________________________________________________________________
$ G: E( ]3 J* e/ p# W
0 \  S( H& U* IMethod 09$ C- Q4 u  s0 G4 ?! Z
=========
. c6 G9 w1 n$ o  C$ X* ?5 D* s2 ]4 Q! v; C- m5 L$ J) s% y" R
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only: R0 F3 y$ v( c  \# M
performed in ring0 (VxD or a ring3 app using the VxdCall).
: h1 [7 [9 f' ~" ^0 Q6 h# NThe Get_DDB service is used to determine whether or not a VxD is installed
$ M$ ?8 v% O- I8 s  W4 P  j# sfor the specified device and returns a Device Description Block (in ecx) for6 m2 z/ ?2 j7 t
that device if it is installed.5 ^9 C% G. n3 j" o; s
2 E+ T% ?$ V5 z4 D/ \6 K2 _( r. V& U
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID( ~5 P  q( [% f" \
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)  P9 b+ E" N* w4 E- L! t
   VMMCall Get_DDB
2 S* r+ W' |3 d4 n. P; P9 O* b: c   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed* m1 l+ \: C, P; w/ u# E8 E
( P: X5 p- z2 w3 @
Note as well that you can easily detect this method with SoftICE:1 _" C( z0 k1 z7 ^
   bpx Get_DDB if ax==0202 || ax==7a5fh" \) V/ D' b- {% X1 p

/ B$ V6 p2 ~# v- r__________________________________________________________________________
0 Z& S( Z1 k% ^* J' n. A5 Y6 j5 z/ [! w. W2 k0 k' _& `
Method 10( b8 Z; u, U( }- K
=========. d( ?3 ^/ M  M$ e7 E
1 k+ Z2 N) ?3 `
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
; S' T, J' R6 t& p# d  SoftICE while the option is enable!!
# Z5 O9 d/ J9 L7 T8 j- h4 F3 }. s# r0 [# M8 {. ^; _6 R
This trick is very efficient:; h5 G* y, ~2 Q- l% i
by checking the Debug Registers, you can detect if SoftICE is loaded2 G. L* X- r3 D1 J1 k6 A
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if, v- q2 `' D9 D; S! Q
there are some memory breakpoints set (dr0 to dr3) simply by reading their9 X: m4 t& l4 Y- j3 w! h) D3 T
value (in ring0 only). Values can be manipulated and or changed as well
; v4 W2 g8 g5 |5 k4 r) ?( [(clearing BPMs for instance)* u6 Y9 W3 J1 I9 S1 m6 r; n: k

  U' ]& A. w' _4 C__________________________________________________________________________
! c8 ?& n3 U# B# O7 k2 a
# ~5 e0 {- J" K( R8 a# t6 [7 z* zMethod 11
: Y0 K$ g- [! N7 @( g=========
0 c' V, s9 \4 R0 P  }- \7 W+ G
: @; n' u9 p3 {; N. C/ \This method is most known as 'MeltICE' because it has been freely distributed1 e. ^- T1 [4 t- _; g% X
via www.winfiles.com. However it was first used by NuMega people to allow
' w) s6 ^, u) w  }2 ~  b- {Symbol Loader to check if SoftICE was active or not (the code is located
( N: q" w& S' z7 r$ `! S8 Ginside nmtrans.dll).( g) m. Y& n& o5 y
( e' M( {. s9 N/ i  w6 y$ }" A
The way it works is very simple:+ g8 Q% @" C+ C% Y9 f- L
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
; _9 V" \( E1 `4 V. tWinNT) with the CreateFileA API.
! L: Y9 P7 O, n! V. b5 `: s
% V6 D2 J' W& Q' p5 L7 F2 WHere is a sample (checking for 'SICE'):
+ N6 w: D6 e: h$ S; e. R* U% j0 e$ r) D0 ?* \5 v  X! O0 v' p( R4 ]
BOOL IsSoftIce95Loaded()
* x- r5 W! f* ~# g{
% I8 o1 `. N( H& G   HANDLE hFile;  
+ b4 M( t1 i8 H& ?6 r0 R9 ~* x   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
' c" ^2 i  Z7 @9 E# p                      FILE_SHARE_READ | FILE_SHARE_WRITE,9 a( Z* y4 _: z
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
/ b& o  S: p* ?* E0 C! J7 k" G9 w   if( hFile != INVALID_HANDLE_VALUE )7 m% ^+ x  j9 v7 G; R
   {5 R2 w  E' [7 g# k  x% B+ z7 J
      CloseHandle(hFile);
! P% Y7 {6 T& x      return TRUE;# |* M. ?# q8 T# v
   }
% d$ U- h5 i9 k3 P   return FALSE;$ y) {% y9 [: Z! X6 z6 _+ A
}
  o7 d; [2 h: Y: i
$ x' K; Z' E& z& HAlthough this trick calls the CreateFileA function, don't even expect to be
) J  ]& e" g8 |6 J" Sable to intercept it by installing a IFS hook: it will not work, no way!
: C8 \9 `5 t3 a/ L! G/ u( ]In fact, after the call to CreateFileA it will get through VWIN32 0x001F
8 u7 J( X. _2 H5 o6 ^service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
# R0 g$ \$ u$ r: Nand then browse the DDB list until it find the VxD and its DDB_Control_Proc/ Y1 W5 `$ ~8 a
field.9 m$ M+ G- N- I, a3 `* L
In fact, its purpose is not to load/unload VxDs but only to send a
  a: v1 y- w$ @# ]W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)& Q( [: ^2 s* ?& H
to the VxD Control_Dispatch proc (how the hell a shareware soft could try+ [, z- Q" G. [" J7 T1 S
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
1 F. R  L8 P# ~* l8 lIf the VxD is loaded, it will always clear eax and the Carry flag to allow1 t8 \8 J: W9 w
its handle to be opened and then, will be detected.! B0 _+ |" T9 n) L( q' v
You can check that simply by hooking Winice.exe control proc entry point2 k9 _8 P6 b4 n7 g! F# Q
while running MeltICE.
: E$ A; M6 _# D0 M$ I+ V, S  u/ Q
6 ~) N' O; V- `" Z+ ]: Y
, q9 b: _. I+ Y: D& n" A& }8 ]  00401067:  push      00402025    ; \\.\SICE
6 A) x% @0 Q! y3 r- }  0040106C:  call      CreateFileA* n7 z3 @; `# Z
  00401071:  cmp       eax,-001& w  F; V0 g5 J. c
  00401074:  je        00401091
& h- @2 t# u* e) [
) j0 H8 P; d4 E" L, f/ V6 Z9 G" F+ K2 e
There could be hundreds of BPX you could use to detect this trick.
; U) R# [7 F; }-The most classical one is:
3 U4 M4 J0 t9 n/ m0 K, k  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||$ W2 {  S0 {  D' ]
    *(esp-&gt;4+4)=='NTIC'
3 T% H' o+ s% |& g) |0 ^  F+ g* ^$ \3 U
-The most exotic ones (could be very slooooow :-(
) z' I1 t- `8 O6 Y' T   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
1 K- X, V* l3 H% [2 t. X3 m     ;will break 3 times :-(+ G2 |4 Z: l! ?/ U5 u$ a6 @* n1 g
' h* e% n  Y8 `' K0 [+ N3 Q. t# H
-or (a bit) faster:
4 d/ v8 C9 g3 w: e# n6 f, h   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')9 u2 N% e  Y9 r+ L$ e! c: V
, O( l: k# i0 |& p( s
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  0 T7 k8 S3 g  @
     ;will break 3 times :-(1 o' o9 D# b, ~7 ~2 ~

4 r# J  M" }2 h6 y+ _" l& |-Much faster:6 Y0 o+ n/ M! k) T) i- }; |8 g
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
2 ~( m' o" I0 ~9 r
4 [2 V  w5 v/ s, s8 `Note also that some programs (like AZPR3.00) use de old 16-bit _lopen! B" ], L8 ~9 _7 k" W# ~  ^
function to do the same job:3 y! R3 R% _: m1 H' X
2 `) H- u; q) m3 o( M3 N9 P& g
   push    00                        ; OF_READ
" y8 [8 X: E1 n' {+ `) \  L   mov     eax,[00656634]            ; '\\.\SICE',06 l$ n& B3 s. N+ {- [* x
   push    eax
! c8 A: }+ \0 o  v( U+ ?- M   call    KERNEL32!_lopen
( e% w% i# B* H/ ]* m   inc     eax
* h- G8 g1 r. M$ k  l- Z1 b   jnz     00650589                  ; detected
8 m/ _3 E, K7 q# P4 a$ B   push    00                        ; OF_READ! L2 g7 d/ N+ }% y) z2 ]! }: c
   mov     eax,[00656638]            ; '\\.\SICE'3 g5 a% n9 X6 i' n! e- U# T
   push    eax$ E) i) y1 E1 f0 A9 K: j
   call    KERNEL32!_lopen
2 v$ a# H" }- I+ F1 }   inc     eax' x5 ]8 z3 i, P" ]5 K1 i: a
   jz      006505ae                  ; not detected
- L+ C1 e1 Z3 g9 S/ `
) K% ^/ z! ?1 Y) i
: v: N: E2 m5 K$ [3 c! j+ m1 D__________________________________________________________________________3 P, y) C2 c/ `) m% J. m
. Y3 A% K* n! g: s( F) S+ X2 q
Method 12
( ]1 H2 \: e- o' A, D6 @=========
6 c" k- b1 x8 q' l4 u2 v1 |& _
. e* ?. i# p1 I  \- nThis trick is similar to int41h/4fh Debugger installation check (code 05
4 ~& d  v6 B+ c! H. O( [$ b8 b9 N&amp; 06) but very limited because it's only available for Win95/98 (not NT)& @+ S; @5 h' }  B+ D. L
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.3 V  j6 O& b5 z
" ]; Z' ~" q1 S2 M4 a3 g( ^* P
   push  0000004fh         ; function 4fh
  w) o6 ]' z- ^   push  002a002ah         ; high word specifies which VxD (VWIN32)
! v6 h2 S) _9 M$ @# ^" F2 `                           ; low word specifies which service
3 a$ E7 V/ J* T4 |4 s4 e3 Q                             (VWIN32_Int41Dispatch)
" c6 D  F( H7 k5 k+ d- V: M   call  Kernel32!ORD_001  ; VxdCall7 h* J/ e( Q! n# {* j! A
   cmp   ax, 0f386h        ; magic number returned by system debuggers; d9 Y* I  S- j, T- [0 f( j5 d4 \6 u
   jz    SoftICE_detected
- @7 C' W3 f: U9 y9 F6 Q7 ?" ?( p
+ J. M. W3 W# n5 F: u% FHere again, several ways to detect it:
  E/ J3 m9 K9 y) R( {# }* C6 N8 t9 |3 j# W, F0 |! _
    BPINT 41 if ax==4f9 ~1 M6 f- p$ X

3 Z* s' l5 |6 H, H. n    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
- `2 ^% p2 Z7 E
+ C2 @6 B$ S; D) f8 Z    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
" s! R. ?- j1 O; s$ R( v  j( S! S# Z  j# p
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!8 c* Y+ B, n5 v0 g) m/ X9 J
- J% i, g; H7 L6 v% Y9 f; I$ c( c
__________________________________________________________________________. o0 F4 F9 |) J5 U+ z( _$ t

  R2 w5 B; }$ o& H* w) xMethod 13
& S" B8 n9 y" T, T, }=========
- g. G! ^- p0 |% d# a5 ~+ M
: J: y* r( l- @8 d& f2 f8 ?Not a real method of detection, but a good way to know if SoftICE is* M8 u: P) E; ]" `' T
installed on a computer and to locate its installation directory.
7 R( ]; v" ^: W9 h5 sIt is used by few softs which access the following registry keys (usually #2) :+ D, ^0 E/ ]2 L2 s
% H' b. Z: h* Y/ K) f  P$ l
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion) N  q  C  }; V
\Uninstall\SoftICE
) h: s: [' O4 O$ T! x+ v! u-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE/ T$ b0 J$ ]' X0 M; p5 [9 U
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
* ?; n4 N% {4 V  u9 ?\App Paths\Loader32.Exe, q2 P0 A4 o1 r$ u
6 p; |7 B& g+ K+ I
9 o1 t! Y7 S6 ?
Note that some nasty apps could then erase all files from SoftICE directory
( t( T- T; [- ~  O& f# ~(I faced that once :-(
$ \; ~9 \* ~4 {6 B% y! s2 K" \" R
& ]6 d8 f' U( w$ `Useful breakpoint to detect it:  ^$ t7 r$ A( C8 x- z
; n8 S" C6 Z- D$ y8 O4 I
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'  K6 F5 y' _) z/ J0 c$ B9 V

* \1 _0 b4 g: G0 O3 T__________________________________________________________________________: x) B9 U( D9 S! V
" o# C7 r' s; _: o

# r+ c/ V0 [, `/ Q6 c" ]Method 14 * y* s% K! \6 C5 w5 y% x
=========( m* d- {9 K- ?- c& e
+ U, j9 x/ u! B) q9 e
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose2 }& n6 z/ a3 u
is to determines whether a debugger is running on your system (ring0 only).
: Y. q- O" p% g# f
! h. d0 k7 u3 X) M   VMMCall Test_Debug_Installed: O! W* ~) e1 B
   je      not_installed
9 w6 k( F9 Q' Z+ h  y* m& p9 o% s$ f4 v  s
This service just checks a flag.+ c1 v2 S" m# K) F" ^# w+ \( P3 R
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部