About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
3 p4 R3 X6 ~* ~* |<TBODY>& H$ ?( M, k/ t" E
<TR>3 h$ ?6 L% U/ T6 U: F/ k  R7 H* X1 J' F$ X
<TD><PRE>Method 01   b+ G" S' ~5 z9 }/ D3 ^/ O; x. V
=========
% a: Q0 _! Y( _. v! o6 q8 y( q7 u: m* d
This method of detection of SoftICE (as well as the following one) is4 [. W6 P: a: b% H8 ]& T/ T
used by the majority of packers/encryptors found on Internet.0 r0 b" C4 F# o" c6 E  `9 F* e
It seeks the signature of BoundsChecker in SoftICE; Q0 a0 D* R  u2 M

# R0 \$ {4 k& D, U8 ~    mov     ebp, 04243484Bh        ; 'BCHK'" d! Z$ {, L* l* l/ j0 q
    mov     ax, 04h
: T% `8 }; Z% t3 L5 p    int     3      
/ J8 I, h/ {5 {7 C" \/ V9 X1 D  X/ J    cmp     al,4% s: o: D6 {2 u
    jnz     SoftICE_Detected; Y; y  e" ^1 N8 ?5 S9 o
. q$ N) n. p! f% n+ _
___________________________________________________________________________. J- X/ x7 ~' C" i8 X: J& ^

9 p2 Z0 y1 v: u2 k2 E- ]8 }Method 02& v. N+ W$ C6 V6 L" N4 ]
=========8 I) L( J9 r; m. z6 \/ K

  H' _, i+ y4 n& ?- A9 a# QStill a method very much used (perhaps the most frequent one).  It is used5 O7 V! _8 S# U) M
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
8 ^9 ~, m6 Y. For execute SoftICE commands...; G8 e3 Q0 `- s
It is also used to crash SoftICE and to force it to execute any commands  |  X* g* I$ _
(HBOOT...) :-((  , _3 B% ~& ^' _7 Y
  a" n" P+ [' I# y9 W' [
Here is a quick description:
& u% C) ]( b& u-AX = 0910h   (Display string in SIce windows)
7 L6 J* C% h. k9 i6 x" [/ V-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx): G: V7 W8 Z# j4 G) i/ `2 H' @+ ]0 q
-AX = 0912h   (Get breakpoint infos)
4 H7 m& p  L. O5 U7 n-AX = 0913h   (Set Sice breakpoints)
' b1 X* O6 w, T$ v& n3 }-AX = 0914h   (Remove SIce breakoints)/ |! |  E! \3 y$ h4 w% U
9 |/ w& E9 p0 U/ P" _" [
Each time you'll meet this trick, you'll see:' G# W% O+ d1 x, L7 X
-SI = 4647h5 D2 j+ s3 u* ]3 p) V- p* E
-DI = 4A4Dh
7 K8 |5 G2 }3 {) OWhich are the 'magic values' used by SoftIce., s8 {) k$ s- h5 G$ S
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.! q' M; Z( ], v7 m+ e0 R

  _7 A! z4 N8 K1 u/ Z% ?Here is one example from the file "Haspinst.exe" which is the dongle HASP
- |$ N' m/ }" V, k  k+ p  ?0 vEnvelope utility use to protect DOS applications:, U+ `. B3 Z2 w: Y$ v
5 @2 q! t8 [( ?$ d# K

* p* I) z2 A  B6 l/ t4C19:0095   MOV    AX,0911  ; execute command., @$ |8 R; t! P6 j
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
: G5 ?5 Z- A& E; d! H4C19:009A   MOV    SI,4647  ; 1st magic value.
; u- C" a: V3 m( d( `5 _+ J1 Y4C19:009D   MOV    DI,4A4D  ; 2nd magic value.7 g* y/ w" Y3 r, m# i
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
  i/ c0 R# r9 Q% Q( f+ ~4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute7 {; \+ U( X3 ~* s# [5 I+ G7 c. K# w
4C19:00A4   INC    CX8 D: w, l9 p; N, M8 V6 |4 x
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute' {8 P& {. N; w
4C19:00A8   JB     0095     ; 6 different commands.( w/ d6 q  z& g$ Y- u
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
+ B% t/ s- |% K, `( \; \7 D4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
7 h# {) Y# u: }# u7 o. Z" |. P5 |  Y: u
The program will execute 6 different SIce commands located at ds:dx, which0 `" X$ L+ z! f4 U8 z, n
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.2 v# V3 u9 E9 M- J- b5 Z

9 A8 n& X6 a0 b/ T* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
! r0 d; s! K! w. _$ W% G___________________________________________________________________________
! H$ C3 z# t- t1 w. k0 N- U9 s  g) z+ P0 \% X

( N: C) e6 o- h& XMethod 03
. @! w" V( s; j( G: m=========
; Q  J7 x2 Z- d7 v" y: P
- w& L# ?/ M; ~5 h& ~& C' NLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h: U" m. d+ I8 v/ i# N
(API Get entry point)! g$ |6 p( w+ V4 i# L* o
        
0 E5 ^7 @6 F! ?: l; L% ^! e7 U) O% G% H1 t3 M# {5 [/ i
    xor     di,di/ y# F! W$ L5 L4 b, A7 Q; {. k( a6 j
    mov     es,di, k5 [6 T2 f0 J& [4 G" Y- B& y
    mov     ax, 1684h       ' A' i( ]: U  F5 ]: @
    mov     bx, 0202h       ; VxD ID of winice
. e& w! k' r9 P- z* O; \: ^; `    int     2Fh) i! I* ]% j  Z* e9 v  r
    mov     ax, es          ; ES:DI -&gt; VxD API entry point) {" Y6 e5 L( O. X6 Q3 e$ Q% z
    add     ax, di' w1 U  L; G5 n- S- E
    test    ax,ax
* f% m) s* b3 k/ t2 k3 l    jnz     SoftICE_Detected' n# s' ]# U* d" Q6 V# s  `
" N) n' E. h- h% [
___________________________________________________________________________! v6 X4 R* l0 v% P+ R

. J$ l. H" U9 z! r, EMethod 04' X, P* y( M( y) I
=========
  u+ ]  o6 m3 s* s4 A) Z& [* I. L6 z4 Y# J4 E1 E
Method identical to the preceding one except that it seeks the ID of SoftICE
  a' d9 \" ?0 Q7 U( ]6 i  IGFX VxD.
( a* {9 Y) g- J
2 C# d( {, G+ z: a: E& V    xor     di,di: N& r& z9 r/ w* e7 x5 q; z) I; @
    mov     es,di0 a9 H/ L7 {# i2 H
    mov     ax, 1684h       $ S) n( v3 z% o3 e( h
    mov     bx, 7a5Fh       ; VxD ID of SIWVID/ g+ Z% Y- a; o. R7 }
    int     2fh3 K# \4 \- s5 p% }" @
    mov     ax, es          ; ES:DI -&gt; VxD API entry point& S  t, z$ k# h% \; i) O% Q
    add     ax, di
( _! j9 a: t5 |1 L0 p    test    ax,ax9 A  o1 r0 O# z8 c. ^5 j' A
    jnz     SoftICE_Detected; H* u$ m1 t/ E) ^# A

, a5 W8 U) G7 ?+ ^: }) G__________________________________________________________________________* p. _- D" W# B& E, h& ^

$ [& T+ z. p6 G5 v6 {$ q1 _# R6 E7 m( t6 ]8 _! {
Method 05
- @/ n9 _) e; |8 h=========% _+ i8 L4 L" C% e: T
6 {( Z7 `6 T( g0 I
Method seeking the 'magic number' 0F386h returned (in ax) by all system
- Q0 e8 a! M) e6 C* T6 V$ {8 @/ Jdebugger. It calls the int 41h, function 4Fh.+ W$ H6 n! s' G& D
There are several alternatives.  , H$ l1 U  m* P, O9 x9 o

# v% `9 i, E' v1 {The following one is the simplest:1 s. c: T2 s+ j1 Q/ S# C
4 {5 ?4 {0 F& A. d
    mov     ax,4fh
+ K% ]$ P+ n3 Z4 m    int     41h
" t3 @% i% h, [. K5 }    cmp     ax, 0F386. j& |  X% p. O8 ^; W# s
    jz      SoftICE_detected7 m2 L/ f4 w5 T: Y
  o* [0 c" v' f9 W
; Y  ]- W. T2 V+ e( E- x, ]7 @1 s7 k
Next method as well as the following one are 2 examples from Stone's ' g" x5 Y6 Z9 L9 P
"stn-wid.zip" (www.cracking.net):: j1 _0 g4 r5 c9 F/ b. Q

5 U6 v! X- Q' `  e. V7 X; ^8 Q    mov     bx, cs
: t8 |9 t6 U9 L! G* Y' X8 F3 \. }    lea     dx, int41handler2: e* ~9 G0 q2 c
    xchg    dx, es:[41h*4]. L6 `3 A9 U4 g5 d  @
    xchg    bx, es:[41h*4+2]
( `0 @" `' e8 i    mov     ax,4fh. J* t' L. w; o" u( |% v
    int     41h2 \( s& g- w, I) {7 ?
    xchg    dx, es:[41h*4]% |, O, l  |7 H, N+ r
    xchg    bx, es:[41h*4+2]
8 x' V% S( K5 J( s. {3 h3 T2 c    cmp     ax, 0f386h
  X) k* R# d+ a  t8 s" @' F' Q    jz      SoftICE_detected
4 G' D% d' O/ y# D, W, ]7 b6 m* S9 {; ~
# A9 h! e, Z  Q+ e9 p& O/ Cint41handler2 PROC! o& I: {1 s! g8 }( _' ~
    iret
" q# Z& Z8 j3 a0 Y$ jint41handler2 ENDP
. X) a1 v$ O1 J8 e5 V. z; l5 K  r; r

  n) K* @  m9 T) x' T2 R_________________________________________________________________________/ o1 s( B' q' |& Q" Y
, A, }, N3 i6 X3 y/ N/ A* ]0 m
+ R# S  V0 h. u1 ]) m
Method 06
/ v$ V) ~# ?% o% k' d+ D/ M=========' U/ ^6 }+ O7 |! T" }0 }, F  A% K
) M/ _3 `) t3 v1 i6 }  N

8 I+ S% @: a5 F1 ~9 h2nd method similar to the preceding one but more difficult to detect:
, i. z1 j, A! `1 q4 `1 `& p
. r& C  M- S" p1 B6 l# N9 \# }
int41handler PROC9 h8 _9 w" X$ r, Q
    mov     cl,al
0 }! ]2 h! Y' Z# h    iret
# g! X& H0 g! c4 q- Z2 eint41handler ENDP
! |6 T& t2 U2 O& T# G0 a8 f' ]# O; F. C4 q/ \
' X& Y/ r# h. M2 X
    xor     ax,ax$ p% O6 s# {5 B
    mov     es,ax8 x1 B& L- \, i( a  z8 ~8 p
    mov     bx, cs
: T# z6 T3 s4 Y    lea     dx, int41handler, `1 B% D; r) C6 C: u4 k
    xchg    dx, es:[41h*4]
# o1 k. F) r+ @7 i. Q    xchg    bx, es:[41h*4+2], `1 S, \& j: h* z. D
    in      al, 40h4 r  g# C; v1 V' T! U' e
    xor     cx,cx
' f. f+ \0 C+ p1 F8 S- Y    int     41h
4 Z% C- S3 ^7 B! a* J    xchg    dx, es:[41h*4]
1 Z- Q: ?9 T; G* ^0 u* }    xchg    bx, es:[41h*4+2]+ {$ x- r; G, K" x$ V
    cmp     cl,al
6 w$ x" T: ~' c$ \3 e) S" ~    jnz     SoftICE_detected
! f: g9 x  h  V4 \; Z$ L4 q1 R& h; |/ m3 T! `0 A- r
_________________________________________________________________________( W' H6 s. [! d$ P$ G6 q
/ A- A# E' f0 t# j) ^
Method 07
7 p8 A7 W4 {# S0 B$ m3 @) o, o=========5 }) w% x7 x6 z

1 I; j3 c- i# f$ W0 }Method of detection of the WinICE handler in the int68h (V86)7 P0 i9 E' U) O
: e4 `# K" U& V7 |, E3 n/ v+ j2 U
    mov     ah,43h; @3 ]( f% I! {! C
    int     68h
. O( L- l, E1 U    cmp     ax,0F386h; m+ J# z: m) i' o6 H! K7 T: S3 L/ Q
    jz      SoftICE_Detected5 U9 O* I9 k: ?2 h
5 c$ F$ s# C- A

% H7 [4 ~) K2 s) Q7 B9 K6 p% {=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
! U6 i4 E/ j+ |$ W8 C, O; s   app like this:
: B* Q( t, y5 M7 s( F5 N2 d- o/ n- q8 W: N, ]  d/ B
   BPX exec_int if ax==68
0 V6 T( Z1 c1 n5 S6 b( M) Z   (function called is located at byte ptr [ebp+1Dh] and client eip is8 _9 X6 M! _7 Z3 L" ~- O) I& ^
   located at [ebp+48h] for 32Bit apps)
5 [( S* h/ U8 ^$ [) y5 Q__________________________________________________________________________
" h: Y* p3 B) Y8 \+ r3 ^" ]6 R4 P8 ^
5 H( P, y3 v% Y- B: V; v/ @! R3 |$ o' A4 K
Method 08
/ P4 e7 x, M2 Q2 ]3 n# _1 R! |=========
( I  p% j4 C" g2 L: s6 p" I
4 N! W# b" X& W: H% O$ N9 OIt is not a method of detection of SoftICE but a possibility to crash the! j# l- [5 l  p, u1 F' r# z% O& ?
system by intercepting int 01h and int 03h and redirecting them to another
- g; Z( n# L; \0 troutine.
* y3 ], K& W% TIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
) i! [& m0 |; P; |0 H* W; ?to the new routine to execute (hangs computer...)- w% J0 R. y7 \. Y. I

& H2 ~5 x5 o5 E* a5 _1 A8 p( c    mov     ah, 25h
+ P; w8 @6 v! z2 B    mov     al, Int_Number (01h or 03h)) A1 g% V8 R4 R  n
    mov     dx, offset New_Int_Routine  l( o  R& Q' k! g- }' J/ L
    int     21h+ b! r) Q5 ]7 Q* Z8 \) a
* B2 }; v% E5 r9 N. D) H2 q
__________________________________________________________________________
, c' T3 E- z! G( v0 K4 i9 o- k
) G- Y' G- u. u+ HMethod 09
% w$ Y2 V" o' S# J6 W4 [5 c=========* e. B7 t, R& [- g
( w9 S! y0 U( |5 U
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only  O6 }: ~4 U, g! Z& y& v! C
performed in ring0 (VxD or a ring3 app using the VxdCall).
  o7 Q2 C7 N% Y+ N6 eThe Get_DDB service is used to determine whether or not a VxD is installed; T  }  P  x  H% |# |5 @) z% S) O
for the specified device and returns a Device Description Block (in ecx) for
/ A- y$ i* M* W/ l" Dthat device if it is installed.: O* |5 q6 n% G. B0 V. A+ N' J
7 S/ M1 m0 P2 F; d4 @* t! m5 p9 {
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID2 [0 Y' M% r+ w& U$ c4 [+ r
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)4 R+ v" q; ?) U5 I
   VMMCall Get_DDB
  o) E+ `% O8 u0 v4 O) G* z   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
. S* r. r/ w8 y0 [2 t- H: _5 ]3 ^
Note as well that you can easily detect this method with SoftICE:
: Q  T4 D" U# R9 S. P- _   bpx Get_DDB if ax==0202 || ax==7a5fh, b8 k4 }: L6 W7 _, q

3 u2 A9 O7 K' f( d__________________________________________________________________________
5 z' E2 M! I# p7 o
2 t' g: a) ?1 d" s/ W7 eMethod 109 ^& H6 d$ R4 G
=========3 I( d5 M5 R, z7 A& e" J8 t% f
) r$ m& F* T4 |( n
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with0 |( i6 U& e( N" G
  SoftICE while the option is enable!!
' k5 V% f. @, }. I* H9 N: g1 X
. H5 s& a2 |* _0 Y1 @This trick is very efficient:& g4 W+ M5 I0 d$ _
by checking the Debug Registers, you can detect if SoftICE is loaded- y: u% b( r4 G. f8 S; s6 v$ B- p
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if5 U: G4 g! u9 I% n2 g/ z
there are some memory breakpoints set (dr0 to dr3) simply by reading their" _, [- }1 E* O& y- t. ^6 n
value (in ring0 only). Values can be manipulated and or changed as well
8 S+ {8 R+ u8 v7 T! y(clearing BPMs for instance)
$ H" _* p  H! [0 H9 o
2 k: b* u$ F! J' E$ n% P* R__________________________________________________________________________
$ Z* j" O9 \  _: Y, _
" m7 I% y" Q( ?; m. |Method 11! n6 ?7 U* C+ `3 ~8 b2 |
=========! V5 t/ D" W) b3 ~7 k
% h( l- @- `% N0 [* _3 R- ]+ l. e# H" s
This method is most known as 'MeltICE' because it has been freely distributed
3 J1 T' h' A& `) b' s9 r0 U- o$ Vvia www.winfiles.com. However it was first used by NuMega people to allow3 u* A8 I8 s; S3 A3 h8 t* E3 Q* f
Symbol Loader to check if SoftICE was active or not (the code is located
: m. [* {3 c  _1 W5 Linside nmtrans.dll).
0 Z6 ]5 M# m. f7 X: U
" z  ~4 Z1 i& w8 Z& c6 ]The way it works is very simple:
( S' y4 I3 @" g; ?% [! DIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
9 {8 ^6 I4 H" c& F, Z$ @( EWinNT) with the CreateFileA API.
5 S/ D! b: c* V. n; s
  x6 J% T, b: h2 Q; ^: pHere is a sample (checking for 'SICE'):
5 T6 u% l! y- l& s: z
2 U: `+ [- @- z. w& sBOOL IsSoftIce95Loaded()
# C1 ]: g0 d+ ]+ J{
6 I: W1 l- h: P9 ]" z7 o   HANDLE hFile;  
0 S/ ~/ o, H( A% G0 R   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
! \/ q" }# G# K7 S5 z* c                      FILE_SHARE_READ | FILE_SHARE_WRITE,
8 B7 j7 z% m0 B, l) J0 h                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);1 |7 r. i1 X8 [
   if( hFile != INVALID_HANDLE_VALUE )
) R4 J4 `: z" @: j% V$ z% B. w   {
6 C2 K. k# ~8 g2 O4 I# r: ^      CloseHandle(hFile);
+ P3 C9 n; l4 \6 G! E6 @      return TRUE;/ @3 |4 {8 `8 p) t
   }
$ |; t9 H- Q& J. `6 c# z   return FALSE;
' [7 A5 j: ?! \. l}
6 a9 K' w3 H  b
4 V$ e/ N! B% N4 P, c& y0 E! SAlthough this trick calls the CreateFileA function, don't even expect to be
/ \- A+ ~7 y! a: aable to intercept it by installing a IFS hook: it will not work, no way!
) ?$ x0 @1 B2 r9 V/ e6 }+ sIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
, P9 K. S" A3 R5 ^) l2 m: u2 {service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
' O1 _' `: i" p- Mand then browse the DDB list until it find the VxD and its DDB_Control_Proc
5 L0 j& ?3 @7 ^  vfield.
' c( |- s3 C  YIn fact, its purpose is not to load/unload VxDs but only to send a + T" }# l& |6 R" P4 Z5 B6 w: Y
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)" X5 u! c" g5 S& z
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
5 E3 B. H# E/ H0 R3 eto load/unload a non-dynamically loadable driver such as SoftICE ;-).
" K0 C, ^" o/ z1 H' A/ gIf the VxD is loaded, it will always clear eax and the Carry flag to allow2 s( U. [* }4 I3 o
its handle to be opened and then, will be detected.
2 C3 ~8 p* V7 bYou can check that simply by hooking Winice.exe control proc entry point
2 R) {0 B% Q/ n* h/ qwhile running MeltICE.5 X2 \3 F, [. H9 R+ |
! X/ g; I, N3 ]7 h

1 G( C; ?$ w- }; D8 L  00401067:  push      00402025    ; \\.\SICE6 Z, i7 Z7 z7 q- P
  0040106C:  call      CreateFileA6 ~) H. M0 J8 R! B+ g
  00401071:  cmp       eax,-001
* y+ v0 Q2 J7 _) O0 ]: y. H  Z% v, |  00401074:  je        00401091
8 [8 ]9 f* `* {4 E7 Q8 z) G
8 p: R0 E$ E. Y+ p0 J& v2 S1 D+ P2 v& {  D" X
There could be hundreds of BPX you could use to detect this trick.7 Z# w1 F) u% I# y; Y  n/ m
-The most classical one is:/ @; B+ U; |( c9 R, U9 H( F
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||* R, W7 }4 b4 d$ x' `0 P1 E
    *(esp-&gt;4+4)=='NTIC'# ?* P  c2 Q( w4 J7 ?4 c9 T

$ D6 w0 g0 |; X4 L0 W. {5 f7 L-The most exotic ones (could be very slooooow :-(
, A7 ?7 t8 @; l7 F   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
% s/ A7 H# G) z! V1 j+ z     ;will break 3 times :-(
2 u) P6 _! M7 h, V% l8 v; u/ W4 i9 g
-or (a bit) faster: 0 d' N) \4 t8 n3 w2 f; K( j
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
% N/ A3 [4 z( |/ Z$ \# `. o  [8 o. J/ T" L4 g% y
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'    `* y6 P: g+ @
     ;will break 3 times :-(% H9 O# W2 D& J
0 e7 Y: B5 b; |6 O) K# v9 }
-Much faster:0 v' o# x  Y! l8 r- x0 b% ?
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
* N# V; F% z, B* X9 S3 E, V' Q0 ]6 R2 g5 {6 B# k$ t0 S" l
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
+ C0 ~, x0 [1 N4 r5 v, zfunction to do the same job:$ B8 R) K7 |/ c1 Z
; C2 s! g5 T  E9 \- ~) D
   push    00                        ; OF_READ' }- S0 ]5 t3 l0 G
   mov     eax,[00656634]            ; '\\.\SICE',0( u" [+ L! r% [# i  L) d
   push    eax
2 P2 W1 {5 X  Z   call    KERNEL32!_lopen
7 s; \2 K1 X7 b# n   inc     eax
% Y7 l; a  m- R: }9 F+ t   jnz     00650589                  ; detected
2 [4 V: z8 A# w) X   push    00                        ; OF_READ
  B: t5 @5 y2 _3 T) q& |9 g; v" \' U   mov     eax,[00656638]            ; '\\.\SICE'
  ]5 ?- A; l0 r7 q   push    eax( Q1 z5 t6 E* b' r7 S. o
   call    KERNEL32!_lopen
2 J3 S8 B/ f2 S! ~# Y6 @   inc     eax
2 g2 o5 Z1 M: H   jz      006505ae                  ; not detected2 `+ t6 r# L' O1 C! n' A( n+ l. _
! O( R7 B+ `# E+ W1 r" k  m
' z9 \3 a% Z/ j' P, `; i
__________________________________________________________________________6 L, o: }$ b  o# X
0 s3 v9 x; ]  w. `- R  F( F, f. g
Method 12
: h9 G- v  _! v% O3 n( S: i1 q8 t+ }1 m=========) o7 B- g& E9 c# {- x

9 N" k2 i! R/ P% `This trick is similar to int41h/4fh Debugger installation check (code 05* ^" j" A9 d9 n
&amp; 06) but very limited because it's only available for Win95/98 (not NT)9 j' y2 c, T2 Z, I5 b7 J: Y4 X
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.+ l' {# U3 B9 g- ~2 k* B. T3 s- k

" v6 ]9 Z! `" q1 i6 Z8 a, o   push  0000004fh         ; function 4fh
$ r: d: S% ^8 _# E   push  002a002ah         ; high word specifies which VxD (VWIN32)' T3 j* Q' s  P; C8 Q
                           ; low word specifies which service3 q- X2 D6 Q  r8 G( b
                             (VWIN32_Int41Dispatch)
' {) e! L* H: h$ s: v" j8 ^! Y   call  Kernel32!ORD_001  ; VxdCall
  T( h  y9 N- r3 L* v   cmp   ax, 0f386h        ; magic number returned by system debuggers9 K% O7 u5 j# B
   jz    SoftICE_detected# Y* M5 l$ I9 s& o/ q
: W* q& J+ w& x" `5 S
Here again, several ways to detect it:  ]' o' G" e) Q' R' {

# \/ G2 ]6 b9 Y) F6 N; E8 v$ v# Z2 z    BPINT 41 if ax==4f
% M5 a" o" c- `% }3 v& N* q% ^+ T, ^! h3 f. q) Y' I
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one! J: ~$ b0 F: g$ a# K
3 Y' k* p/ V9 ~
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
) F5 ?8 M7 @5 E2 Y9 `6 R; g4 X  b) [
/ K4 V& X9 g2 ^3 ?- S1 O    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
" V" H, [( P5 [
0 f" z: S! u9 ^- j/ S/ u4 R__________________________________________________________________________0 W- E, i, |$ F% C& ]

- ~3 D1 @# D( s$ _; Y, l  U5 jMethod 13
$ J# |: @' B2 H9 H. N$ a=========2 n* M% a5 I4 k6 p, ~8 T

/ D# ], t4 S, O/ `" d3 F7 n) e, ^, vNot a real method of detection, but a good way to know if SoftICE is
2 O) x# p  g# |* |; Winstalled on a computer and to locate its installation directory.
" l& n' [8 T0 fIt is used by few softs which access the following registry keys (usually #2) :
. w: V9 H8 n) I0 M$ o7 {
) A9 ^+ U; o  h  Y+ t: }-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
0 N1 M' L5 b6 c\Uninstall\SoftICE! Q9 N* V, d1 x; r( @+ D9 G% o
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE0 z# A/ n) `/ g6 J
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion- X$ Z3 ~2 O% g- l
\App Paths\Loader32.Exe
4 F- {6 R3 d* ]% }
, i  b! U; v- O# Z6 G8 n/ |- `. [4 e2 L5 C, I
Note that some nasty apps could then erase all files from SoftICE directory
) o) S' v& S# w; t# J(I faced that once :-(
( a- q  g7 e# i. H* a1 y2 ]" o/ l" }/ i# b. ^
Useful breakpoint to detect it:/ {0 P9 s* E- l7 S, S8 L- _1 |
5 d- k& k- m- t2 C  k& r( Z1 ~
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'8 k" W3 T& o  \* e

. K# ]3 E# \- o. ]- P3 [__________________________________________________________________________
5 ?2 [3 {( y3 t6 x) c! L+ S1 [# r$ {. @  `4 ]
- l8 p8 r0 `3 s" U7 v/ r
Method 14
7 t! ~1 K( X8 Q) u=========+ ]) Y$ S! B( w$ J  K3 v, ^
% S# N# h; y3 R8 w$ @" @5 A2 V
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
3 E! @" Y& ?: H0 v% B1 his to determines whether a debugger is running on your system (ring0 only).
7 ]  o0 Z' j  e2 F5 P  C. b
6 }! C. r0 n% o; h   VMMCall Test_Debug_Installed" h& D. M  H2 }7 c3 N7 @
   je      not_installed5 Z; V* _( `/ _8 z, x1 A8 z% p- [9 e
; O/ ]1 L) t% ]) b9 [
This service just checks a flag." I! K6 M" C# i7 A$ r: P
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部