找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
! c/ X" M# y' S2 p, N; u  s$ U<TBODY># [2 v. j4 s3 ?$ R
<TR>
7 ?6 P: c# }# N5 G) _+ e; z<TD><PRE>Method 01 $ B# @: L' P& t4 N0 D% [" h! O
=========
" o5 `( O5 i) W' k8 b9 \. C) _  R
This method of detection of SoftICE (as well as the following one) is
7 j1 R4 l1 i$ A' }6 Lused by the majority of packers/encryptors found on Internet.* G) S) T) b9 h1 \7 }0 ?
It seeks the signature of BoundsChecker in SoftICE
5 ?/ D$ O4 ?  u5 T1 `5 u8 m  e. c. S+ ?1 j  a
    mov     ebp, 04243484Bh        ; 'BCHK'$ ^3 N3 ~- k: I: p; e7 p4 K: T
    mov     ax, 04h* J, ]# R7 U6 B3 J6 w( t- W1 i
    int     3       ; s# _1 {  b; {, h5 J" R! ?1 a
    cmp     al,4* }' D; ^% N) z4 I3 p: @  Z) y
    jnz     SoftICE_Detected- ]0 L5 |: G7 x) \; F  v
9 g# a% N, b, n# S9 E. e8 f" C
___________________________________________________________________________
4 @$ {$ O( e$ I, C' X* j& Y, C0 l) T9 u+ q- }
Method 02
1 M2 x4 T3 D; \: D: J4 H=========4 K' l1 p/ `4 C. V

6 P# w/ e4 ?, ~/ |2 f& N0 U- RStill a method very much used (perhaps the most frequent one).  It is used3 s# n: S7 @: V* a
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
3 b. W+ t  h* X( N$ A5 ior execute SoftICE commands...6 U, x' I1 p2 c, x/ Q  f" K; f* [. `
It is also used to crash SoftICE and to force it to execute any commands
) N  Y. @7 A+ G* {0 Q! c1 z( \(HBOOT...) :-((  
; R4 F% A3 K- _% f9 @& n
, A+ `; Y7 p- }7 J/ j/ dHere is a quick description:
; p6 A& K- j8 A' Q/ M/ `2 B-AX = 0910h   (Display string in SIce windows)
! P& P4 T5 o% w; K-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)4 t% [" M3 R( d+ u, b. u$ r0 Y1 H
-AX = 0912h   (Get breakpoint infos)
8 j8 ]% f  ~( g# A-AX = 0913h   (Set Sice breakpoints)5 g& d* v1 \  J9 b$ c8 k: [; F$ x
-AX = 0914h   (Remove SIce breakoints)0 D$ a  L, z; I# m  ~& u- v
$ p1 I: V* K7 Q: Y
Each time you'll meet this trick, you'll see:
# u( e# ^" Z$ N* g" x-SI = 4647h/ A+ z$ d5 z3 g' ~* l; x* W" l
-DI = 4A4Dh
! m# Z* Y! Z' y5 K. a* {7 T% a3 pWhich are the 'magic values' used by SoftIce.
3 S8 G+ L8 V. K* P4 h: [For more informations, see "Ralf Brown Interrupt list" chapter int 03h.1 {9 [+ w3 w6 {6 @* u9 d
6 s. k2 X% ~, D" W+ Z$ R
Here is one example from the file "Haspinst.exe" which is the dongle HASP. ^2 z* X9 W: s! {6 S4 G
Envelope utility use to protect DOS applications:2 O  O7 ?# l% K2 ?" Z6 M

5 r) c" L9 C- X) L1 o
8 H3 f) L6 V: T8 f  W1 ~5 z4C19:0095   MOV    AX,0911  ; execute command./ p; \: _& _% M" ~1 b4 O
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
, T& p0 E+ ^( o8 {* Z2 V4C19:009A   MOV    SI,4647  ; 1st magic value.& Q3 E+ F! ~9 R. u
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
* I8 f. Z* e! Z8 X6 R7 F8 I0 O4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
/ ?7 k% F) @0 y0 o% a- M5 b: O; W" L4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
# F; _: m3 D9 q) E9 |4C19:00A4   INC    CX9 S+ W' b% H3 E
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
3 R' k; P+ \* b4C19:00A8   JB     0095     ; 6 different commands.- |& e' U5 }9 f2 j2 D9 ^% g4 i
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
5 h# `' p. c2 `4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)6 L9 z4 C) ^/ s8 T

1 [5 @/ G6 T  d6 o2 t  k) ~5 wThe program will execute 6 different SIce commands located at ds:dx, which7 S5 E, u5 U7 b
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT./ }  y4 S1 p" f, t9 ~- }/ A

6 l8 \: b* J% f7 `, C1 s4 B* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
3 T$ O4 }7 v+ L5 V0 X___________________________________________________________________________
0 {4 }8 L! ]/ Y: w, Z
  b: A% U" P3 t* M$ T
, @9 |# t* r+ `2 w# Z2 nMethod 03
% _- v( Q( N: ~0 J=========! {( u: i* F4 D) m. z/ @
2 l" R4 x  R2 |% L- j9 }8 N. B
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h* m7 Q) h  I" e
(API Get entry point)
" [. e. _4 S- u# }% z7 ]' }        
, L0 f: x1 a, E' d
9 x/ I$ j# c  X( j% K    xor     di,di
$ E4 K& f3 r/ R/ H+ v7 E2 R    mov     es,di( x$ f- h+ t" v" z6 e1 i1 [
    mov     ax, 1684h       $ z+ G1 ^4 A6 u: W$ x0 O. |9 |
    mov     bx, 0202h       ; VxD ID of winice
" q0 d, c6 p! g' W' }0 ^* f    int     2Fh% I1 r/ v2 i, `) }, V8 G, }
    mov     ax, es          ; ES:DI -&gt; VxD API entry point! Y6 B2 \* `' T/ u( O
    add     ax, di8 _/ H3 ^5 A2 `
    test    ax,ax3 Q* v* H7 T2 [. k; v' j
    jnz     SoftICE_Detected* O+ d0 n. }" f4 O3 s" z
2 h: G$ z; ~1 ^& y' r
___________________________________________________________________________
7 _$ z7 s7 B2 p  y
( f9 W6 \2 j+ G% H3 ]& ^Method 04
" p  M) c3 t, O* s  a* q3 w=========" y/ y5 h$ ^7 e( J/ b7 i; l4 V# J
" J" Q# P+ A: m' K
Method identical to the preceding one except that it seeks the ID of SoftICE# c( J& Y7 Q& K& z
GFX VxD.
8 l/ U! a" H" P" U2 \+ [4 o- K5 A$ L) v7 S9 M9 N
    xor     di,di' w% r* c+ f% j% e
    mov     es,di: N! z; T/ H+ C
    mov     ax, 1684h      
8 G. S0 x0 r& Y5 o% v    mov     bx, 7a5Fh       ; VxD ID of SIWVID4 R2 G5 K. Z9 d% L
    int     2fh
) B3 \, q: z& [4 C& q( I0 C    mov     ax, es          ; ES:DI -&gt; VxD API entry point
* h% g. e6 A1 J" Y2 V2 Z( S  C# x  a    add     ax, di2 e/ W" p! q1 i5 c
    test    ax,ax
/ w- N( h9 L/ ^    jnz     SoftICE_Detected
$ C  Y( l: m6 ~. r, M
, y) _" ?. f' V' e( b8 k: h__________________________________________________________________________
$ K( @5 f6 y& f- K3 Q2 p8 K5 d6 X) A1 f7 \4 H
- m  k  d2 P* y4 H: ^
Method 05. b; R2 m$ F- x  X9 I* P
=========
" |2 n) g9 z* n7 }" C; [' x% t3 N* v$ d7 I
Method seeking the 'magic number' 0F386h returned (in ax) by all system
1 L4 N) z6 M; Z2 E; b5 O4 rdebugger. It calls the int 41h, function 4Fh.2 j. r, f4 i1 I! }# u% N/ G
There are several alternatives.  
" F& U- p3 d  m# ]1 B  F. N: @
: J4 ^6 \' W! X1 {& f# v9 L. j9 jThe following one is the simplest:
2 j( |* |, R9 a) K- C. @/ {* A) n$ Y8 D
    mov     ax,4fh
" ^. s$ a" M* d! B. \; r    int     41h
, w! W  ^; }2 [    cmp     ax, 0F386
4 k2 m! C) ~4 ]8 F! ], B; ~- C    jz      SoftICE_detected6 p. w' W5 f  b7 L8 K; A- M& h

- M" x9 R9 ]: w6 X, T+ {+ d( `% e  a6 m/ U! |
Next method as well as the following one are 2 examples from Stone's
1 I& B, `: n, R1 J"stn-wid.zip" (www.cracking.net):
( j6 N' s. `4 c: X) Q
9 j; H0 o$ X3 l    mov     bx, cs: s1 Y1 h8 w4 ~' }7 N
    lea     dx, int41handler2$ c- W- c$ W; k0 k% O& I) b/ V5 Z
    xchg    dx, es:[41h*4]" v! M  Z% R% |/ d! P
    xchg    bx, es:[41h*4+2]
$ X, j' z7 U! o    mov     ax,4fh7 \/ D4 {* ?) [
    int     41h1 I9 p+ G. V/ n3 j
    xchg    dx, es:[41h*4]
9 M& F: b- t* J  K0 l    xchg    bx, es:[41h*4+2]
- |4 {6 ~6 T% u) e3 C    cmp     ax, 0f386h
' h2 h( }8 w0 x; K7 C    jz      SoftICE_detected4 {2 w4 H% T% j. Q5 d( W

3 v6 m& ?! u, z! X6 J( w$ {8 ^int41handler2 PROC5 i5 J8 d6 h& f- n
    iret, L$ K: [4 D# u' {; }
int41handler2 ENDP2 D( _2 \" |- `6 @9 `2 c0 m& ]
; F! j4 P& [& y3 Y( Z2 z0 r

# g1 X! V! |; e/ g_________________________________________________________________________0 r4 f5 Y. K- i$ }& v7 e, O

, `3 R  U  u. d% l5 j( ^* f1 y
: X! g& O4 \" h, xMethod 06) {" ?( C! T* c
=========
' Q  Q" z, t, n; D  i. g0 F. p1 W, i3 Q2 i4 Y9 t& l

( q2 I5 S' Y7 A- V4 S2nd method similar to the preceding one but more difficult to detect:0 q0 x+ m4 Q# K

0 j& v) x$ G# {3 u  p6 ?
- b( Z" h1 y% i7 J. h- Yint41handler PROC
1 u4 T% p  B* c  L    mov     cl,al
7 k& J$ X; f, g- E9 T: b& M    iret
( a; K5 F. y# c2 i5 Qint41handler ENDP
, I" i4 D1 x& `8 Y/ ?4 w- T3 B- f, X1 p: I1 j0 p+ K, q+ \) G

: z( \- J( w  j/ c( @    xor     ax,ax  ?5 I# q% V! X
    mov     es,ax
/ {! t4 Q/ x; k1 g    mov     bx, cs
6 C% ~: ~9 `& X+ T& e- f8 |    lea     dx, int41handler5 r5 N6 @! z' D, X! |, c/ U3 w4 U
    xchg    dx, es:[41h*4]6 y% ]1 a; I" G: W) N( F/ ?
    xchg    bx, es:[41h*4+2]0 Z  g+ m/ n- ~: |
    in      al, 40h$ e: w$ q. ]4 I. P
    xor     cx,cx- ~: w$ t  [; g9 M6 I' C( g0 k
    int     41h+ w5 l9 ]6 W2 ?. |: I
    xchg    dx, es:[41h*4]
& S) L- A" |& Y3 b* ^+ x* Q5 i    xchg    bx, es:[41h*4+2]. M2 B" C# }3 f2 A
    cmp     cl,al
5 S& P* W! H% n    jnz     SoftICE_detected6 G9 a# ?* `8 Z4 O, {# B
, \$ t  _6 ]1 z, |
_________________________________________________________________________+ {2 F# c) ~* L( r" e* \2 Z

+ |# v$ J3 [' t' H" X8 |Method 07' X; o( d: p! R# I
=========
& c" C3 \9 x2 [/ x* @% J  @7 q0 I, r
Method of detection of the WinICE handler in the int68h (V86)9 i, d7 z% e+ P4 p. c. i7 c7 S2 ^

* l+ {: @7 O$ {5 H; T    mov     ah,43h
. f5 J' G' r$ X    int     68h
0 R7 R! ]$ a* h+ N    cmp     ax,0F386h7 u' z; q7 |5 u2 h) e
    jz      SoftICE_Detected$ W$ Q4 s" r5 O8 H3 T  u/ t
# b: ^5 e% ^) V/ e  M
6 w6 d% p% _/ u9 p( E
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit7 P0 c0 G$ H" M; z
   app like this:
' u6 M6 w% [$ n4 u* d8 ^% k. p3 Q2 C) z0 g9 ?8 ]9 s/ l
   BPX exec_int if ax==68! ?% d! w' v4 x; K! J& Q( K
   (function called is located at byte ptr [ebp+1Dh] and client eip is5 w* c; E5 O  ^4 I9 F* {
   located at [ebp+48h] for 32Bit apps)! d* Q& C$ R2 b) s/ N' U
__________________________________________________________________________4 o, Y7 z2 H1 p  ^
! E5 i3 I/ d4 i# n/ Y( z1 f
$ H/ O+ O+ }) D3 q4 x
Method 08
5 Y4 m& E% @- K=========
  X$ ^8 R1 b0 w* S8 d) z
0 g! c0 ~, Y+ a0 V/ w4 RIt is not a method of detection of SoftICE but a possibility to crash the; ^( v3 D$ z+ W
system by intercepting int 01h and int 03h and redirecting them to another
! M+ ^8 e+ V% e( B3 D  Oroutine.
0 W: t8 E0 f2 AIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
2 Z0 |. H6 q/ D; ~8 Lto the new routine to execute (hangs computer...)
& v7 a/ C  Z1 [+ o4 l1 G2 J9 G, {, ?4 |+ H( x) z
    mov     ah, 25h% V7 q: p- `/ C, [$ Z% m7 b4 k
    mov     al, Int_Number (01h or 03h)  _; r# K& T, _& L
    mov     dx, offset New_Int_Routine" ?  `4 [" X$ N% O
    int     21h
. @5 z# o- P0 C- S8 ]6 ?
0 m$ x; l  ?& \; b& _- H__________________________________________________________________________* g! N0 F7 O6 p5 |4 m# ~( V3 x+ V

' G' ^+ V, m, @' _Method 09
* b( k* O( L- ~4 c% \6 @=========
% G' P7 k8 `8 ~' m+ s
6 Z" j+ d3 _" t$ LThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only; W  [6 U! h- i& c  |$ Z4 G' s7 ]4 c+ @
performed in ring0 (VxD or a ring3 app using the VxdCall).9 \  L2 z: i  [. m+ y
The Get_DDB service is used to determine whether or not a VxD is installed
/ N" x/ \* w, e# Cfor the specified device and returns a Device Description Block (in ecx) for" N2 C1 e1 `' l/ k
that device if it is installed.# f; c4 |6 z$ g. E1 s) I- C

& J7 v, \2 {9 {, ?) n2 ~   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID3 _7 {  E) i% f' B' U2 C
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)0 F  ^/ Y' `+ k% b% Y
   VMMCall Get_DDB5 i$ D  c4 \* D; N# X! c- O, o
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
9 j  F1 d5 k, j
/ p# [8 ?' C: u  f' k3 l) k( ANote as well that you can easily detect this method with SoftICE:
# O, X9 I" _# ?   bpx Get_DDB if ax==0202 || ax==7a5fh
9 F. N) T0 `3 w% I- U/ G7 F8 f8 |) z# w3 _9 r" T( P
__________________________________________________________________________) K3 X/ Q1 [% \6 U1 y( X3 T

: U. V9 Y3 g7 P$ z6 z( KMethod 10
' y/ p+ F( p" B$ F  J- ~( @" P/ N=========8 @3 {( M5 Q1 g" U) g- a) O5 V
6 ?/ h* s& r& w$ c0 O7 z; R
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with6 R8 \0 H7 ]: `- Z7 A  T
  SoftICE while the option is enable!!2 J8 R& B& `2 t: p2 _  U  Y* c
6 ^4 Z4 h$ R: s$ I. L: ]
This trick is very efficient:: D% B& j3 u8 v, a! |$ F
by checking the Debug Registers, you can detect if SoftICE is loaded
2 j3 g2 M3 N/ \* ~(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if3 g* d6 J# L, h+ T; ~) M% r
there are some memory breakpoints set (dr0 to dr3) simply by reading their
8 X9 X" D$ C' Hvalue (in ring0 only). Values can be manipulated and or changed as well
; l  I: E. k. f2 c3 j7 b(clearing BPMs for instance)( w! V1 z. x# k3 d
( r: u. X8 I% n" ^1 v4 m* D% d
__________________________________________________________________________
" r0 v$ o8 K/ I
* B$ Q& Y- O3 uMethod 110 a# N9 [4 {9 Z2 H1 w* q3 y
=========
8 C7 l6 G- D% c7 P' J
' ~* y" `. X  @/ E2 T: K0 C- D' k" SThis method is most known as 'MeltICE' because it has been freely distributed
; I, o; T" _, ~  U+ P" P0 Kvia www.winfiles.com. However it was first used by NuMega people to allow' f, v# u$ i7 P6 \* c
Symbol Loader to check if SoftICE was active or not (the code is located3 [% i. ]/ w2 Q" L
inside nmtrans.dll).: D. M8 [1 i( ], n# p0 V

9 D, Q  i- Y0 }The way it works is very simple:
: A$ c: b, G. H! V4 Z, K5 eIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for# X' k6 z) P& ~: w7 ?; y) q
WinNT) with the CreateFileA API.( g0 j3 N4 r( R! l

, u% k  i. K5 q0 s% M3 ^) f1 u8 GHere is a sample (checking for 'SICE'):- I+ B# H$ w1 w7 A
2 {& v; ]5 ]$ O( V" {. k
BOOL IsSoftIce95Loaded()
3 s2 [. J" }: J) G! S- N+ ]{
' j4 K: l+ C- Y9 b2 U   HANDLE hFile;  ( b% |& m+ F+ c) @$ r% w8 a3 z: a
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
- y3 C; f, d5 a" g" f4 ]1 M                      FILE_SHARE_READ | FILE_SHARE_WRITE,, D5 C- Z9 q0 n7 m* C
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);& H. n6 _4 s3 b+ g/ C
   if( hFile != INVALID_HANDLE_VALUE )
' `3 L+ U' \$ d; n; g5 }& D   {# |$ Z" U7 ^2 l# k' `% T
      CloseHandle(hFile);/ e: R5 j  h. a1 ]- _+ f" @
      return TRUE;9 h, E$ w& V% ~* c7 x) {
   }2 O7 l! J( f, i) n: P# u/ Q# z" _$ f
   return FALSE;
2 f! P- v' [/ k8 ]$ b9 ?}8 k/ {9 g* K8 m

; Q. U" ]1 R& W# a- `/ UAlthough this trick calls the CreateFileA function, don't even expect to be
! P6 a- ^+ {3 R# Q2 |# V' @able to intercept it by installing a IFS hook: it will not work, no way!
5 Z5 @+ D2 g: m! c% M) t& O+ @In fact, after the call to CreateFileA it will get through VWIN32 0x001F* g( t0 c! ?8 u$ b# k8 u3 I
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)5 I+ U: `3 P* l: P' y  E3 Y& ~0 R
and then browse the DDB list until it find the VxD and its DDB_Control_Proc  m8 n5 P. a5 D, o" h* D/ k
field., `  |) x" u' D
In fact, its purpose is not to load/unload VxDs but only to send a 4 _( e4 R1 ?  }, T3 Z% \
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
* q4 u3 ^+ V/ I; xto the VxD Control_Dispatch proc (how the hell a shareware soft could try
, {8 R. V  m' J2 t! s& Qto load/unload a non-dynamically loadable driver such as SoftICE ;-).
, n2 Y$ _+ K! Z& x' uIf the VxD is loaded, it will always clear eax and the Carry flag to allow
; d# Q& l- }& S! E( qits handle to be opened and then, will be detected.
" Z2 _) h& T1 W$ BYou can check that simply by hooking Winice.exe control proc entry point
% ~' _* a. r1 ]3 ?$ |while running MeltICE.
) z5 W5 G( Z4 s* T7 o
, w# a/ o3 Q+ [* X% Y7 _( U) Q+ U8 H
+ x: J! N" D! f6 Q  b9 F  00401067:  push      00402025    ; \\.\SICE$ S1 B' D0 N1 R6 t6 e- F3 |
  0040106C:  call      CreateFileA2 E2 E# }7 |# t& H$ T' a. y
  00401071:  cmp       eax,-001/ A4 z  `0 Q: h5 k; N# y" \
  00401074:  je        004010918 g3 M# s" I7 d
0 o! _  ^8 O, E, n6 g/ ^' j0 W0 k# T

9 P3 L. L, g/ ?9 |5 v8 t$ KThere could be hundreds of BPX you could use to detect this trick.7 s4 d+ x* L- _2 D6 z
-The most classical one is:
$ @& \) K0 F7 `7 K. Z( i  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
. ]* z  C# e; Q- p7 h* j    *(esp-&gt;4+4)=='NTIC'8 d6 y: }7 ^) W6 q2 `6 d

& k; ~5 p! M% b) L$ K4 A-The most exotic ones (could be very slooooow :-(
- q8 h& g0 @; g  @" O8 O  j   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
5 \  A* j! _8 b1 }     ;will break 3 times :-(
% j, L5 Y4 X4 W( ?! O# x) w
# I$ S. ]; a+ o6 k. H. \-or (a bit) faster:
8 c2 [% ?" x& r! R% D( V* R+ J   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')0 a8 j! }  i1 t3 F7 _7 X& `, ^

3 C9 _" |- ]5 J# g   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
" }. Y  L5 V; L     ;will break 3 times :-(
/ ]( I3 L' d7 n1 _0 h
  R" P+ r: s+ P# y* R) `-Much faster:  G7 z2 H; I5 y5 N  d. o2 W
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
9 i( z% U8 J' w3 M5 x3 o9 Z/ m: W8 N; F6 D  U0 [
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen0 W: B2 L8 J/ V
function to do the same job:
  p# n  i- G$ j( i0 r: A& j$ _
1 s! v; c( X* E7 z' i) f% K, ~   push    00                        ; OF_READ. s9 v! I3 k1 a  _
   mov     eax,[00656634]            ; '\\.\SICE',0
0 N. ]& W& y. ?   push    eax
0 u1 r: J4 \. p   call    KERNEL32!_lopen
* ?; ]  [6 U2 L/ D+ z6 f' W3 L   inc     eax& Z0 B! Y8 r* ]+ {' d& A5 C: k
   jnz     00650589                  ; detected
+ D) K4 J" h5 Z9 W! T   push    00                        ; OF_READ
& E" e0 [) P4 o7 }& f   mov     eax,[00656638]            ; '\\.\SICE'
) N, v  A; c$ d   push    eax) q/ g1 L7 i! U- c
   call    KERNEL32!_lopen" ^& M5 Q- L% |" n3 t  [
   inc     eax
# v6 s- A; B' c* i   jz      006505ae                  ; not detected
' J% i. Q: x# S# P2 y. N
0 c4 P4 L! [  q. k. W% s* |% |
: B1 y+ S" t5 x' v) n__________________________________________________________________________8 f- f, b# z3 K5 ~& @8 N/ c

. }5 v& M; Z3 @% M$ ~7 O" }" S/ V/ SMethod 12# d+ @9 {8 _0 _
=========
# u' O2 k" }. d' |
8 t# N/ E( p2 U+ d& VThis trick is similar to int41h/4fh Debugger installation check (code 05' x1 g! Q+ j% T. O1 n
&amp; 06) but very limited because it's only available for Win95/98 (not NT)
7 G6 S4 {9 |1 qas it uses the VxDCall backdoor. This detection was found in Bleem Demo.
% A/ _% ]& M" C$ I  a# u$ [
  O0 f6 n( d9 `, ^. {' X   push  0000004fh         ; function 4fh
! h: W$ `+ i7 k# t- z8 [# s   push  002a002ah         ; high word specifies which VxD (VWIN32)
2 C1 Q% z  Q( p                           ; low word specifies which service
: Y) n* k7 e* c" i% h                             (VWIN32_Int41Dispatch)* A! ]$ F( e9 y* A
   call  Kernel32!ORD_001  ; VxdCall
8 E% z; }4 W9 ~  j1 E/ }; M6 A   cmp   ax, 0f386h        ; magic number returned by system debuggers' }9 Q3 z. V, f4 g" c
   jz    SoftICE_detected  _- G6 V: a; T% T! F9 `+ b, o
4 l6 w- k3 P6 a7 K
Here again, several ways to detect it:
* n; Y- m' c$ ~6 Y
  N; X. r: e, t' Z6 }$ }    BPINT 41 if ax==4f; F9 p/ E7 a+ c+ N8 L# m
" z! ?, M% R5 J5 o3 B1 n
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
  F3 O& H# B+ j  A! Z3 _. [3 C# T" }( \& Y8 d5 S+ z+ Z, k
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A( x4 r; E$ |& A) y
5 ^1 E7 H/ F3 p% ?( R. R6 A5 y
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!+ G( Q) R% `9 D1 \& s8 g
; |2 @0 H) V) \9 [3 O; }) q1 A& s4 S
__________________________________________________________________________7 Y4 V1 F7 Z9 @& N4 b* }. u  \
. H- M! R; t) J& Y$ y
Method 139 i- |3 v# r+ ~+ z" U. ^$ w2 a
=========
2 b; \% p9 J/ e2 ~1 L6 s; T  v% _% k. _  Q5 j6 t
Not a real method of detection, but a good way to know if SoftICE is
/ U+ H+ l, O: F9 H+ Tinstalled on a computer and to locate its installation directory.  r! x" U4 n1 l) p. ^
It is used by few softs which access the following registry keys (usually #2) :- T3 h* v7 z! u" s9 i

1 O: |( L: t8 t+ @: X-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion- u# [/ X( o! A5 `( D+ o; j1 }' F
\Uninstall\SoftICE# t* W* g6 M0 E! z# S4 {
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
) j5 i, E. ]+ Z% ?. P+ z-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
0 [0 r; N8 a/ @1 D- R& \# t\App Paths\Loader32.Exe
0 {! z8 \3 V; z* u) p( D7 V' D+ T
2 N# o+ @* V, x/ e: R3 u
9 N  G. W% c# ?- F' `" ANote that some nasty apps could then erase all files from SoftICE directory2 t8 Q2 q" b' [+ E$ D0 ]6 K& p1 a
(I faced that once :-(( S' j3 ^! t) V" L
3 w9 P! d+ D2 r7 n/ ~! y2 q+ f( f
Useful breakpoint to detect it:. h6 l3 }. u+ k1 Y% {8 t- z
" v4 V4 N9 c# _# E, @& Z: {
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE') i" I/ j: O9 n# Q# C4 x5 G
1 r) [1 d3 \- t( W8 I
__________________________________________________________________________
9 [: Z4 y8 }4 |7 ]2 m
- g1 k4 u+ w5 p# N" L) d5 x* V- f# I5 x/ X) a: _. A8 ~( _9 ?
Method 14
) |/ z% b& v) b=========
) b7 K& s- P( `5 M3 X. u' H( N, H
8 p# r* }7 S( L& S9 U3 j, V2 qA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
1 S2 ^6 S: g8 M5 b5 p" n/ n/ n2 Cis to determines whether a debugger is running on your system (ring0 only).
# y! o8 k' r- b- z  f/ d
- |5 o  Z1 i- F; |% f- _$ L   VMMCall Test_Debug_Installed
/ n; Z: ^( W8 T   je      not_installed
8 E4 `- U- H: W; r3 O7 V* x" }. ]7 Z' C  g2 C  L6 q" u! ], ~
This service just checks a flag.. }: ]+ W: @3 t& d. Y1 y; D. C
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-7-27 15:09

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表