About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>9 T( E+ B! ?3 t$ E  G5 m
<TBODY>6 {1 \6 y, m% L4 W; H
<TR>: F2 D0 L7 N7 ?) i* {& V/ e
<TD><PRE>Method 01 2 K- e9 K$ ~7 j+ N9 ^! @$ W" ]/ M. _
=========
1 ~( `$ s" X' Q3 B# \/ F0 q$ @
" B; ?. G0 i  X. Y* G* i& ^( a: kThis method of detection of SoftICE (as well as the following one) is3 H3 o; L& a7 ]- }
used by the majority of packers/encryptors found on Internet.% e. l# }: n9 b8 L6 Z
It seeks the signature of BoundsChecker in SoftICE* M5 F) _( X( X+ Q

0 {& v/ M+ }7 O4 h% U, s! k    mov     ebp, 04243484Bh        ; 'BCHK'
* X3 @8 M8 W! E$ |/ [    mov     ax, 04h: `, S9 |& ^6 P/ J$ b- C: n; I
    int     3      
% \9 x9 f: b* B5 y9 L5 [    cmp     al,4
' l: h4 V9 J3 X* y. m    jnz     SoftICE_Detected5 a; U; u, b+ n( V1 ?

  Y# X1 \: v  ]: I0 m___________________________________________________________________________* }3 U, V8 W! w1 C2 R: \' B+ j

- R. M, v% v; `9 |Method 02
7 C8 {9 w4 {0 w5 {0 M=========, V1 Q: [. z8 g: @$ ]6 o
6 H: G$ C' Z5 m( Y9 W9 W
Still a method very much used (perhaps the most frequent one).  It is used
! ]3 E$ P- W: J9 vto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
- Q  r5 @, @5 }  ^or execute SoftICE commands...# {( q0 F' l/ y# c( M. \( g+ V
It is also used to crash SoftICE and to force it to execute any commands
: ^1 Y; O1 r6 d  x/ {0 g(HBOOT...) :-((  
& |3 N  o& j# N+ L- n
* A5 z5 m. N8 W3 G7 @+ e, P! WHere is a quick description:% G+ P) C, K/ T9 v9 B9 C; a9 \
-AX = 0910h   (Display string in SIce windows)
* t7 o3 r; f6 ?8 }0 [  T, M9 o-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
9 ]! [; }5 L% b3 h; \0 S1 ]-AX = 0912h   (Get breakpoint infos)
$ y* G, T3 ^. n0 B/ \' b-AX = 0913h   (Set Sice breakpoints)
6 B$ d8 [8 d2 {/ c6 E) C$ J-AX = 0914h   (Remove SIce breakoints)' t0 ^5 r3 ?: B6 H

/ W. c) Q9 h# j0 M  X& R  eEach time you'll meet this trick, you'll see:7 i' W2 x4 e8 }. m/ p7 u* W  G
-SI = 4647h. P( o% L2 h# n$ _
-DI = 4A4Dh
' E. A& C) `& B3 N7 C% I* sWhich are the 'magic values' used by SoftIce.( ?: o$ g8 v% g$ \' M
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
  C6 i! B# ~& a3 X8 f/ N  R' @2 m$ J% ~- Q+ @; [
Here is one example from the file "Haspinst.exe" which is the dongle HASP  J: F  {& j1 B" C+ l" u* Q
Envelope utility use to protect DOS applications:2 M- _- G7 B: k$ ]4 B% g

3 S+ s5 S- H: b" n7 b
+ ^$ p6 f4 X( t6 i0 C( e& ^4C19:0095   MOV    AX,0911  ; execute command.
7 a" s; A  b) t; ^! Y7 x; s4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
% F* {- U9 Y8 H2 H4C19:009A   MOV    SI,4647  ; 1st magic value.
; Q% l8 F1 |% E4C19:009D   MOV    DI,4A4D  ; 2nd magic value." s& W' Z2 c6 a6 R
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
: J! ^& O0 k/ t$ @2 I. Q4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
, O- ~' ?7 e9 K% M4C19:00A4   INC    CX
  a$ J% b$ R, u. ^3 s4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
* T  u+ W( C; d( m5 @$ f+ d% ~4 f4C19:00A8   JB     0095     ; 6 different commands." z1 {2 Z6 G3 M( h1 L- T: Z
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.( U, y: y  H: F5 d% Q% b
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
- Y9 B" ?# O' x6 I. ]" F
7 G- Z" L) t# i+ }! I5 {& B' ]The program will execute 6 different SIce commands located at ds:dx, which3 \. x3 I* x: Z- i, K
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
2 ^' V( c6 [, m8 T; [. v
% K  }5 R5 \7 X6 b' J' N7 V* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.2 e. C8 d  I# R9 u: E' ]% L
___________________________________________________________________________: B- v; u! S' D# e! `; g- z) E
% c! g0 v) m- M# v" @
4 N" [* l. j0 Z3 p) S
Method 03
9 |" i* l, ~8 ^/ g4 C6 ]1 Q=========
! N9 I) M, O( [8 l& @( g! f; t% S3 \7 K; p
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
4 H  T4 @9 _- V4 f8 C& |: E' m(API Get entry point)5 F: z  c; r* t5 @6 M' J
        
+ C+ J0 D% E, M9 J0 F9 i; o2 h- M' y5 R
    xor     di,di- Y* g' s+ V. ^- y' P
    mov     es,di1 n, B1 `3 L6 @0 T; X! P! [
    mov     ax, 1684h       $ W3 n6 g5 ]3 W" R) c
    mov     bx, 0202h       ; VxD ID of winice
+ r3 Q% Q* `+ Y) D/ [! d    int     2Fh+ d! C( K1 j* Q% Q! U- D6 k! {
    mov     ax, es          ; ES:DI -&gt; VxD API entry point) F4 W1 s0 }3 ]2 `
    add     ax, di$ X, E* u! E6 L4 [% _: b4 e" K
    test    ax,ax% V2 Y1 H" N: s! j/ h1 K
    jnz     SoftICE_Detected* Z+ \0 [4 K$ t4 c: u. }0 J. d1 j

) F+ D/ C- n8 b4 [3 }; R___________________________________________________________________________
; a  R. k8 R) G7 W
4 R/ O: B0 O0 Q) U2 c2 fMethod 04" k$ A$ T' D. ~0 L" f. X
=========: O3 \4 E5 ?+ R) ^, |
' z+ M, V) U- @& ?7 M9 {( t
Method identical to the preceding one except that it seeks the ID of SoftICE
6 y) a; G9 ~3 G0 H: AGFX VxD.4 y* L5 C+ t7 j

2 G9 w: P7 L- u* m- e4 G    xor     di,di9 ?6 R0 q; g! W0 @. S( `" I' f+ O
    mov     es,di
' ~% o$ \! [% {1 [. |7 C    mov     ax, 1684h         N( k7 D; Z2 V1 H; v; U* ?7 c7 b0 Z! E
    mov     bx, 7a5Fh       ; VxD ID of SIWVID" ]; d$ h( `' }6 b. z
    int     2fh2 x# l- P4 K2 T. P% x9 h
    mov     ax, es          ; ES:DI -&gt; VxD API entry point1 _, r8 U4 ~# D& F* q
    add     ax, di
7 D: Z/ M, p' I    test    ax,ax' I) D- t( ]7 n% C3 N9 J
    jnz     SoftICE_Detected% y, g' w$ K* S, c7 Q( F
* }! U0 |9 m( _$ a) @' f3 S. A
__________________________________________________________________________  N, l. a* @, O+ D! h
( {" @3 k1 p# a) e+ u1 u
( Y. {( x/ l  U3 o( T
Method 05, w1 K8 Y, \( B0 Z8 _
=========+ S* j! `, p2 q& R# F' O# k# l
& r" t# Y6 {0 {3 X1 T
Method seeking the 'magic number' 0F386h returned (in ax) by all system- `. b$ ]! P7 P" O5 d: J$ a
debugger. It calls the int 41h, function 4Fh.; A/ J( {- R* U) Q
There are several alternatives.  - v  o3 M7 ?0 d5 S/ I9 d
+ x9 M  I: z  u9 s0 ?
The following one is the simplest:
3 a9 }) p& O! l' ^' J) i6 M' z3 `' f. [# Q: I, D
    mov     ax,4fh
) d* }# E6 D0 f+ Q) }    int     41h* z/ `+ @" t! z* W. w; }# j
    cmp     ax, 0F386' M+ ?/ K( t3 p6 N$ [; A( k
    jz      SoftICE_detected. ?) [8 Y/ A" D

0 B* f& y! J$ i6 S- f6 ?' L6 y% i8 \9 n
Next method as well as the following one are 2 examples from Stone's # s2 |; k/ v: a" P. n
"stn-wid.zip" (www.cracking.net):( Z) |3 S. v( @) L4 ]: g, k

+ d5 t, ]$ H! M8 x. l% I# z    mov     bx, cs
% K& r& k, T6 a8 J2 [    lea     dx, int41handler28 f% y( d; p7 l* ~( Q
    xchg    dx, es:[41h*4]
; ~, ~) Q4 Z" [    xchg    bx, es:[41h*4+2]+ [& K! P' A' n/ N0 l
    mov     ax,4fh. @* L1 C, X+ u* {% F3 U
    int     41h
7 V7 k" |/ J& P$ I  p) C) i    xchg    dx, es:[41h*4]7 S! T; ~1 g) F( U
    xchg    bx, es:[41h*4+2]
6 e* U& o  g4 w" E6 A( Q    cmp     ax, 0f386h8 l/ x. |2 v( C9 E
    jz      SoftICE_detected
  W; @# Y4 w6 M4 X; ^
  E2 ^" C2 E- W" P# [" G6 o: Q, N/ X% m' Vint41handler2 PROC
6 C. {  x% I  Q# @. V    iret# o; p' G  {" R7 ]
int41handler2 ENDP
7 `, f1 X  ?" d2 d2 n$ N% E1 \( X  n& I& {; t

0 p* M3 `( o. ]7 K  |0 m2 O% U_________________________________________________________________________) v) M* h* \8 s$ K
; d& {2 \8 b. `2 r
& e) f- x$ T6 n4 _5 A: ]
Method 06
! S3 U5 X) E$ Y. {3 C9 b=========
5 w9 `( I9 O9 w. W& c7 n4 V. L, B0 J  D/ `0 q/ C  m( F) H
& Y! ?5 M8 p, V7 B
2nd method similar to the preceding one but more difficult to detect:
! j5 I; e7 u% A  T" z. ~6 y/ [) t+ r& r, j; l0 Z4 g

5 E5 W% M  o4 _+ mint41handler PROC
7 S1 c6 r( D" S: s5 n    mov     cl,al
$ u2 U) {( W; r3 I2 v* o, ^    iret: h. F1 H1 I0 r3 g3 z4 o8 ]- Q
int41handler ENDP
/ K# l! E# Z0 K7 A- M- i# j8 J- Q
2 O7 v( u- [# L7 ^8 m( \- K7 h: U  _- N) q# \$ C& \5 i" ]  _( ]
    xor     ax,ax. G( g6 Z+ h/ c! j" y
    mov     es,ax
; `7 R' y2 S# I/ ?6 O    mov     bx, cs
7 [* V( I2 G- p* `# f  O) ]# r: Z    lea     dx, int41handler
2 W; q: V7 V1 ]3 z, G    xchg    dx, es:[41h*4]! t8 k. w1 N* y9 A
    xchg    bx, es:[41h*4+2]: L) m8 y& F- [1 B# b+ C  q1 i
    in      al, 40h
) _5 y5 t! x- b+ {    xor     cx,cx
- d6 h- a+ M. {    int     41h4 e1 [5 n# ?+ U% B$ X
    xchg    dx, es:[41h*4]7 I) p7 \% L2 J
    xchg    bx, es:[41h*4+2]4 k6 J' r$ ?4 o4 m4 o
    cmp     cl,al, Q' N9 K2 p5 D& X
    jnz     SoftICE_detected; O: }, }0 f6 ^9 F; M
/ v* m; m/ ~' {( w: P
_________________________________________________________________________
6 [5 b6 _# Q& j' W$ c9 p1 _$ x  Z* G: }; R
Method 07' |; \2 `) m4 d/ q& U
=========
* G0 d" S* K4 r' u. E+ q& Y4 x& V- t/ M9 Q+ v% Q' d1 F6 L) H: A
Method of detection of the WinICE handler in the int68h (V86)) U* S* C. u. I0 Q# r( W
! J, R) }/ o, a( z5 ^1 ^( P9 {
    mov     ah,43h7 W8 @+ b/ \! K1 G0 }/ J: k
    int     68h- K, y. y* ~; C3 v8 k. n5 h
    cmp     ax,0F386h
* U' A% ]- M, L& Q    jz      SoftICE_Detected6 Y/ |6 F# A) W; Y6 p  L$ b

$ T$ U. c! r6 y" F7 R' v( M& [: n  Q- l5 H0 N. ?7 ?
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
! E5 J! A! }3 G   app like this:
- _7 A' N! _- v2 ?' U+ v
( O' N- O' w' ^6 b( g7 b+ M   BPX exec_int if ax==68
- ]. P3 ~: X3 z% {# v   (function called is located at byte ptr [ebp+1Dh] and client eip is
4 O( ?7 {6 n) N, m   located at [ebp+48h] for 32Bit apps)$ ?# l5 f0 u' o! Q  J, V% A7 ]
__________________________________________________________________________
8 s  b1 T: |8 X+ v/ L7 y* P: M3 `9 e, f/ ^( s5 k
  ^7 ?6 Y5 Y) g" \- }: S
Method 088 w; V0 \: k- r- f) z
=========% i" ^2 n# J- Z/ s! _
- f/ r6 k! _9 `9 d+ I. n* {7 Z6 a
It is not a method of detection of SoftICE but a possibility to crash the& r# S& ~" X/ |0 H: Y; T
system by intercepting int 01h and int 03h and redirecting them to another& j, c3 S- ~3 Y& X
routine.
+ v6 i. u. n; fIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points: k4 k( f% x* `7 k6 `+ P
to the new routine to execute (hangs computer...)
9 H4 m- d' o3 l+ B
  n& ]+ b( z+ Y7 c5 C    mov     ah, 25h0 A& r) }) Z! P& `
    mov     al, Int_Number (01h or 03h)
" w. ?/ f- w  w4 @$ J    mov     dx, offset New_Int_Routine
, I9 ?) K! \) N1 G    int     21h
2 k% _: X/ {4 U3 t! a4 L; t
; Y6 Z/ p* x* Y0 x) h6 |( I__________________________________________________________________________
6 @5 R4 `  N+ y. X% S
! u/ ~9 K" Y' o* }  o& l8 v/ DMethod 090 Q5 V5 y% }7 k, I  p* ^$ B
=========
- z( L4 T5 ?; e1 e: {1 W- q0 p0 c, N
; \5 _- S2 K' R) ~1 s4 r! DThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only- W; ]2 s& y4 k5 C4 }
performed in ring0 (VxD or a ring3 app using the VxdCall)./ l' O1 b9 J- M! g5 a
The Get_DDB service is used to determine whether or not a VxD is installed
8 d' ~: F& O$ j- wfor the specified device and returns a Device Description Block (in ecx) for; o& ]. S5 S$ i- ~
that device if it is installed.
% x/ P$ P" d3 H$ z8 a5 N0 q7 K- [, X- i9 D
6 J8 W0 S# c4 C# ]- V0 ^   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID8 m, q9 x2 A8 X% g( f8 Q3 d6 V) K! U
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
# S! E0 P- n" h0 r% o7 p   VMMCall Get_DDB9 F& K, `- Q2 {6 `# X+ J% y
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed' G. v% @; t/ c- i9 U. X9 d
7 j  v8 L" n8 r# v8 t: q8 k
Note as well that you can easily detect this method with SoftICE:% T. o7 V: D8 A! l! d' {6 {6 Q
   bpx Get_DDB if ax==0202 || ax==7a5fh
9 p, j9 ?" s" N6 v6 N1 p% b3 @
5 s3 ?3 K1 I! ?1 t__________________________________________________________________________* Y" r. v8 j& s

3 j7 d# h* N* @) MMethod 10
. Y6 h- }3 B- I1 p: ~8 G: C=========
& n' Q2 n# ?# E. {
5 R4 Y$ M% n1 s, o6 c- @=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with, v2 w! Y6 P+ p5 q
  SoftICE while the option is enable!!( T2 [5 [: s2 b0 I$ @

) J/ m- o7 Y& G1 B* Q$ ]" v0 Y5 s$ bThis trick is very efficient:. _( Y. O0 w- Y+ x
by checking the Debug Registers, you can detect if SoftICE is loaded5 o( U8 h' n+ F
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
% h$ y, N* i# d- U3 ?there are some memory breakpoints set (dr0 to dr3) simply by reading their
  a3 F" T& D' |) ^; P3 Wvalue (in ring0 only). Values can be manipulated and or changed as well" d! L/ h( _2 O2 n# c5 d9 K
(clearing BPMs for instance)+ x% g- K) J. w' A

# T2 @6 s! T; O% f; x8 o# F- d3 x3 `__________________________________________________________________________5 b7 G, x/ F. }: _2 J8 E0 ?6 W: }6 \/ Z
/ @4 H! n, r; g$ |
Method 11
( G  x6 V- d4 [9 I1 n/ m=========
3 T+ d- P; N+ G1 {* q1 G
4 E' \; l0 W9 N2 x: WThis method is most known as 'MeltICE' because it has been freely distributed+ e3 f( J5 z7 f$ ?
via www.winfiles.com. However it was first used by NuMega people to allow
- `4 l" r- i- Z0 bSymbol Loader to check if SoftICE was active or not (the code is located/ E& E+ ]" D, a) l7 p2 J
inside nmtrans.dll).; O( x) z( v. `$ [- D$ n# ~1 P

" F! M! E. E/ X) a% SThe way it works is very simple:
6 a, x; U1 z# ?1 G7 dIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
, g3 f; f, X. a7 }: QWinNT) with the CreateFileA API.
' [! p4 h( I$ y1 H! A1 r; Z' O6 }4 s* {
Here is a sample (checking for 'SICE'):! m( b7 c4 P* d+ }, T

3 l6 I* U0 }; _BOOL IsSoftIce95Loaded()
4 @8 T; Y7 ?# ~' n9 H! Y4 E{
! ^5 Y4 u4 d! T: r# @6 A   HANDLE hFile;  
+ n& o$ h+ A9 B7 b( s   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
; V- e$ W- ~, o! f                      FILE_SHARE_READ | FILE_SHARE_WRITE,5 B+ ~2 N" s! Z5 t
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);% N4 i9 G4 w% f3 Q  K* @1 O5 H" [4 [
   if( hFile != INVALID_HANDLE_VALUE )9 b% k% V1 m; x5 ]( J! m7 y
   {: Q# W3 j3 a) E8 s
      CloseHandle(hFile);8 k& J- c- ?1 H% B7 p4 q
      return TRUE;$ O( z: V+ q% M
   }
' j* P( y- R. [- i( l4 r   return FALSE;, Z7 x% k0 D, b0 ^5 v/ l6 l) e/ C
}0 ^! i! W# v$ v
: G( Z3 [6 G# w+ b0 k
Although this trick calls the CreateFileA function, don't even expect to be
3 }) W& f* c  P  s7 a5 ^2 ?/ Gable to intercept it by installing a IFS hook: it will not work, no way!& h% S7 d6 {# }! y3 ]" ?: d& I
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
  @" f3 k. X6 D" P) Uservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)* w1 B# j+ }: Q* N, g4 ]( p
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
3 X7 Z7 d* g* E4 Y8 O8 {  gfield.0 u* j7 M  b  `
In fact, its purpose is not to load/unload VxDs but only to send a
) `) ]' M/ W( @: G3 L) ?& K# fW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
* g, x( F/ _/ v& mto the VxD Control_Dispatch proc (how the hell a shareware soft could try  _# V# l6 B3 g5 b* D. g
to load/unload a non-dynamically loadable driver such as SoftICE ;-).# ?, e2 \$ ^$ N% W; d0 x' ?
If the VxD is loaded, it will always clear eax and the Carry flag to allow
7 A- `. ~# E( W' P% y3 @% nits handle to be opened and then, will be detected.) p' y( ^7 b7 |4 I7 n! S+ O' g
You can check that simply by hooking Winice.exe control proc entry point/ `; L9 v/ K. e; r
while running MeltICE.5 {# I& j* J  J! l! e  G: S

3 g( u" |" p' a, u& E# ?; _7 I/ W+ J, m) E$ N- Y; @5 w
  00401067:  push      00402025    ; \\.\SICE
/ p5 q# i3 ^$ D3 u) I  0040106C:  call      CreateFileA
# O% l: w+ R0 I  00401071:  cmp       eax,-001
7 Z' @4 `: V9 m; B  00401074:  je        004010911 c; j% e# _. v& X
3 t  W1 v" T1 Z7 F% W
2 ^* p( ?2 h5 C8 |
There could be hundreds of BPX you could use to detect this trick.) p# h4 U' O1 k" r# ]
-The most classical one is:
/ ^; u" R3 S4 F4 X! c: p  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||- n0 s' `" f7 }0 b" U7 L; d
    *(esp-&gt;4+4)=='NTIC', V" W9 n& M: l' K9 H
  i: ^7 A0 A  {( v8 M) n: ]
-The most exotic ones (could be very slooooow :-(9 r( q, p8 F4 s( x, X9 Z! H
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
+ p9 \3 a/ d5 Z2 X6 B  H' t     ;will break 3 times :-(; F3 k+ e& Y- M9 I
/ @; D/ B- p# o5 w0 W
-or (a bit) faster:
' b. u8 L) J0 T   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
' Q8 K1 k/ f" Q( ?- A8 I$ e. e% f' _. ^  O, X, m% z8 _8 i
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  . `9 A9 ]3 D, Y# J, s
     ;will break 3 times :-(
# @, `/ w1 i& Z( \& a* |8 k& R2 H' i, Y; F2 H+ e, A$ t4 ^
-Much faster:
- X# q7 f/ ^7 G( G& S. n, [) X   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
& j" ]1 S9 p# K! }3 _6 s) c1 }- F3 ^: k: e% T+ r( ~$ D- D
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
" L; L7 R4 Q7 x; g# f1 Ffunction to do the same job:
4 v- F$ d, K. B- J
+ R9 `7 E3 c8 x. e   push    00                        ; OF_READ
9 [# x5 J8 M1 @7 U   mov     eax,[00656634]            ; '\\.\SICE',04 W+ i, }8 G, J7 X* V  u. R' `
   push    eax; N" s% L9 P# {) H7 p9 x$ u
   call    KERNEL32!_lopen
8 {8 {! d# A  a2 O; A   inc     eax& \. F; S% F  H, _- n& Q: v
   jnz     00650589                  ; detected
* s* x3 L! M/ c( b. T8 y   push    00                        ; OF_READ
- Z9 |9 `1 Z; h: W4 c& U   mov     eax,[00656638]            ; '\\.\SICE'4 `; A  Z/ I) A# @4 A
   push    eax7 M! h0 X5 T6 v. {
   call    KERNEL32!_lopen0 P# I9 R7 l& f7 h/ e: j4 L) F7 j9 P& G
   inc     eax
& O, y* {# [7 G' |% q. [   jz      006505ae                  ; not detected! Z0 b% ~8 j5 L7 f8 q2 g) @' t

  p6 B' z1 h# O9 g  y7 n3 x* N2 h. W0 O# c) H( a  F6 g% Q
__________________________________________________________________________
. H" z2 ~% I7 m! a1 T. u/ K% V8 y* V" d' d# V+ o: x
Method 121 X4 _' `2 A' D1 X
=========
) l4 F( {* z* H% A5 K, m  z. x/ X4 K
This trick is similar to int41h/4fh Debugger installation check (code 05
& [3 X' P* T4 r8 n( j4 \8 h+ v&amp; 06) but very limited because it's only available for Win95/98 (not NT)  G9 N0 C+ Y' B& C" c& M+ t; I
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.; f& z3 g( V9 j- U
1 ~) l2 g& [' l; z$ d, c
   push  0000004fh         ; function 4fh. J0 r( _# v6 H* x7 ?
   push  002a002ah         ; high word specifies which VxD (VWIN32)
) l7 C+ u7 Q# f                           ; low word specifies which service
4 L- z3 v" D- J7 C+ H3 a2 a6 I. F) C' Z                             (VWIN32_Int41Dispatch)
+ ~- K6 }9 i- c  X   call  Kernel32!ORD_001  ; VxdCall
! w) C6 M* L: a" D' o# i- S1 L   cmp   ax, 0f386h        ; magic number returned by system debuggers, f5 h. e; l  m8 M8 F
   jz    SoftICE_detected
2 C0 N6 N3 x* R( r' x- a
" T7 W! g( g) [* i4 E; YHere again, several ways to detect it:
& _7 a& N. A8 f% Q1 F4 B, ?2 O2 I; z6 `) c4 ^7 Z2 y* F, x
    BPINT 41 if ax==4f1 }! F+ g5 ~3 m" G0 w( A5 j

( t- y( J6 H% q- Z4 d6 w6 E  K    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one' M. j0 S" e8 }
( Q8 {$ I$ m+ o
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A5 [0 @1 C% r$ ?2 P' L( q
* E6 p: k$ M7 R/ E% O; g4 k
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!5 k6 i2 J/ k4 o7 t
6 J$ k7 Z( h0 s7 y
__________________________________________________________________________
2 `) g- A$ M. I" R$ i7 {: H9 d, ?$ e) l9 X
Method 13
5 u0 R$ s0 x# X6 T" ^" J- G5 U=========+ {- T+ ]+ Z+ K! {! c+ |

  k9 Y' D, x- tNot a real method of detection, but a good way to know if SoftICE is
# h8 |. M" m9 Qinstalled on a computer and to locate its installation directory.; P3 h8 ~6 }0 h5 ~
It is used by few softs which access the following registry keys (usually #2) :/ H  Y* d" D- ~, |) n

6 K' b* |1 Z( `& ]; v3 N-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion+ D+ D& }8 L3 Y2 {
\Uninstall\SoftICE
4 N. L( u" ^+ `' R! O' g4 x3 b-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
8 Z: ~0 x9 v, _7 R1 b7 B6 D/ a-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
( q. d- P  B6 P6 G\App Paths\Loader32.Exe
: c* B" b8 J8 Z$ W8 X, {* {& {% l4 a0 h0 d; \9 h0 h! g
( E1 u5 f9 \. Q: X) R
Note that some nasty apps could then erase all files from SoftICE directory
8 C, P1 y9 l$ ~1 K: I(I faced that once :-(
0 Q+ s! g& S& f: u) [
- R4 W/ C2 l& ?' V8 ~Useful breakpoint to detect it:- J& N1 p4 P1 ?- M

& N8 r% G! _$ E: R     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
6 }# L( p* p+ m/ r4 I9 @7 U9 R
& ^( z% g# Q! I1 Y5 k& l% a* ]__________________________________________________________________________) d, A9 L& {/ r. F% m
% w4 i; Z. j+ b- n4 y. N4 K

. h/ o! [9 k  MMethod 14 : E2 n, a, @. ^( L' n, ^' r' I
=========
. o6 k! h2 p/ p5 F- _; i& B8 f+ E
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
% s! D6 t$ z9 V1 I% z2 lis to determines whether a debugger is running on your system (ring0 only).
9 t8 Q& q' g' @3 h, `; T$ \: N% l. T& h$ d( c
   VMMCall Test_Debug_Installed0 i1 C  ]# L' k
   je      not_installed
1 ]! _8 n: C; q% i3 r7 t8 L' P+ ^9 T2 V* {( ^, H2 [1 }
This service just checks a flag.
) l5 C9 w2 k; R6 G) H% t4 k  T</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部