找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
' O+ G+ U* [, b) B* W<TBODY>8 Z/ g; S/ c' H3 f* F9 A1 g( a0 C' A& ~
<TR>
" _8 r9 z% G$ M, G$ H: H5 e; s: t" q<TD><PRE>Method 01 / @9 G5 {" n5 m: e$ P1 Q
=========
( W2 R9 s4 O2 l/ |1 U2 B/ B% ?, u
" ~; m: ~1 X: v( Z* iThis method of detection of SoftICE (as well as the following one) is
1 Q" q- d7 j: Jused by the majority of packers/encryptors found on Internet.( s$ Y( ^# f9 r
It seeks the signature of BoundsChecker in SoftICE; q1 ~/ p. C/ m0 M, P
+ Y" N1 a8 c: ]8 b& F
    mov     ebp, 04243484Bh        ; 'BCHK'
) @3 D' j- C. [    mov     ax, 04h# S. n' n- r5 }! D
    int     3       4 a& ]4 Y1 n; |
    cmp     al,4
( F& r) ]( f0 z) f0 b: A    jnz     SoftICE_Detected
) b: f" ^; E2 \* z, @: G
: _3 k0 z6 S2 q/ `___________________________________________________________________________
; d- }3 \* \( _/ w9 H# n5 N( Z+ @& R9 |: w
Method 02
; x9 Z" G& w$ m, F9 d=========: {3 j" G' N; _# w- Z: U. ~( U* i* c

+ y. ]: w7 K) V" U: H4 J' F/ o. hStill a method very much used (perhaps the most frequent one).  It is used
  j& V. j- V4 _2 p1 Y  e- {/ oto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
& p9 x! P: u; d. q8 s* t$ _" ~or execute SoftICE commands...+ k- p2 h* G/ i/ X/ M
It is also used to crash SoftICE and to force it to execute any commands- {* w8 m- Y9 f% `
(HBOOT...) :-((  
: R( G& R( F! h5 n$ J3 u# M4 R+ w" _- Q; g( z, N
Here is a quick description:
+ o+ h& G6 O# d0 T-AX = 0910h   (Display string in SIce windows): U5 s. N" b8 E' R5 ^
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)3 }7 w( }; V4 L# U0 }4 [
-AX = 0912h   (Get breakpoint infos)
# l9 d* W7 \% a-AX = 0913h   (Set Sice breakpoints)
# B0 z" X: @  l. L. e% P-AX = 0914h   (Remove SIce breakoints)/ {% A. \6 w, F% F

  t2 y" n) _6 ZEach time you'll meet this trick, you'll see:
% V" h" Z; W* @# p8 @* T/ D-SI = 4647h
8 l! n- u  [$ Z' Q' {3 N) y-DI = 4A4Dh
4 _) l; e- M4 V$ a! j& ^Which are the 'magic values' used by SoftIce.
" i# N5 g0 s8 x8 JFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.) F" A; t1 a& Y! |6 l& r9 n' n
- H( X+ C* ?9 U1 V
Here is one example from the file "Haspinst.exe" which is the dongle HASP* N: b: k+ M# Z0 v
Envelope utility use to protect DOS applications:& x5 Z/ Z' H- a4 V1 i

1 p6 B' m  g0 d3 T3 d/ @
2 i0 k2 x- D; R4C19:0095   MOV    AX,0911  ; execute command.
# h% Z) q% V  y9 y+ z; ?4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).) ?# V% Q, B! [4 b
4C19:009A   MOV    SI,4647  ; 1st magic value.# q3 U- P+ Y  y2 m1 k
4C19:009D   MOV    DI,4A4D  ; 2nd magic value., O1 B* e: g8 U2 l( {
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
0 B6 ]: T2 ?7 p- p/ P: O+ l7 E; g4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute, `- b8 `6 J$ n- s/ b* z! \
4C19:00A4   INC    CX
3 S+ E" @% L- f4 _. p4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute- Q3 |8 F3 h, @. j
4C19:00A8   JB     0095     ; 6 different commands.
2 x* q1 U+ ]" Q( [4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
: h7 ?6 b6 I; i! a4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)# z% }2 D  h1 j, p9 G! L
+ U' m1 g1 o- C2 S% h1 L
The program will execute 6 different SIce commands located at ds:dx, which
; N7 E1 P9 c& g3 {6 |, L$ d3 Ware: LDT, IDT, GDT, TSS, RS, and ...HBOOT.! ^1 D) ?+ H( W- a! k0 I* h1 D

7 q2 m/ N. L! H- j* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.6 [% {; g/ S, I, U% I" D
___________________________________________________________________________$ Q6 D* K4 Y( z4 A" [

  l$ F# M( h* T/ ]! l
  Z4 m; ^8 G7 B, c. E( p% [Method 03: h. O) ^. V3 Q
=========  ?$ e( K' i# I. l( a2 _3 z

5 \( f! e2 V8 m9 [) t  P& U/ e/ I/ x" {Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h, q! R% ?1 H1 e+ i3 m  e7 V: ~# C8 g7 D
(API Get entry point)
* `/ {8 U4 b$ v, v) o        9 g+ d) Q- |# \) Z9 R, Z; [

) {3 p4 F; x7 g" k    xor     di,di  F2 R1 b! K' Z. t
    mov     es,di) ?. W" U2 c! y6 I
    mov     ax, 1684h      
2 C! `8 z0 s$ X+ i) k    mov     bx, 0202h       ; VxD ID of winice6 r5 H+ x3 B+ W, Z
    int     2Fh1 x- S: c  {, f) B8 U
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
8 a: J2 O! _- H0 ^$ ~3 E+ T    add     ax, di
8 P6 E* c! O4 \9 C& x$ P    test    ax,ax( K, w# w" f+ r8 c5 R0 L4 a
    jnz     SoftICE_Detected
1 N" P- v. A) d& T6 h4 A) b
2 Q6 ]1 V- Q4 l5 r___________________________________________________________________________
; Z. O0 I% d' H+ j/ s! T1 K
9 l  \% h6 o/ t% _Method 04
* V7 I# ~- I$ R3 ^=========. B8 k. k9 t. W4 X
3 i& y  Y; v6 R) O
Method identical to the preceding one except that it seeks the ID of SoftICE
2 K( }7 q9 B, |4 o! ^& Y3 AGFX VxD.! ?/ ~, F" c0 X+ v8 z# v
' [: E2 n2 s' e. n8 q
    xor     di,di' P: {  y0 D3 j( z
    mov     es,di
' F( D0 L7 ?3 g( c) J, }( V    mov     ax, 1684h      
( {, G& c) ^: @- e, S    mov     bx, 7a5Fh       ; VxD ID of SIWVID
# `% ]+ x) L& I0 f' x7 [" `* y+ }8 w    int     2fh6 Z8 ?, _( A9 @. S+ x6 X
    mov     ax, es          ; ES:DI -&gt; VxD API entry point9 ^; a( H. L' X/ }* w- E, p$ @5 \
    add     ax, di2 L! Y# b) d! `: S% J# q" _
    test    ax,ax
7 g0 r$ ]) S8 g    jnz     SoftICE_Detected9 Q# K& Y8 f( d2 B0 x' R2 G8 P

2 g1 {* p! I+ n__________________________________________________________________________' Y6 G% w9 L  }2 h. U

! M, N# Q# \3 {2 Z
1 Q# u! v/ N5 e% O1 b7 v$ UMethod 05
; {% N! e) D4 I9 P: O. J2 R=========: q  a5 s8 w. f$ o  Z" r0 N" ^
/ v* Z; y7 p5 W1 G
Method seeking the 'magic number' 0F386h returned (in ax) by all system* ]5 f# I* `) U3 t* R, }. l* ?
debugger. It calls the int 41h, function 4Fh.
6 O( S8 `  J; qThere are several alternatives.  
0 r2 Q4 z5 z% Q" k7 ?7 i3 n$ s1 O2 P
The following one is the simplest:7 X$ b& [- E( C) j! m: s$ |

4 h  _0 Z4 m1 ?4 F7 }2 J2 N0 L% k    mov     ax,4fh: i5 K+ S( X; F+ `8 q2 ]$ b
    int     41h
, ^5 d8 k* \, I/ u) ]* C+ N    cmp     ax, 0F3862 e: q+ k# N3 o) q# _! H
    jz      SoftICE_detected
, ]4 f/ p; V% g8 R, V% R3 r; s( ?, L  Q2 E) C
  t2 J! X0 `' Q9 w( b$ U1 ]9 Z
Next method as well as the following one are 2 examples from Stone's ( B/ [$ d3 I' Z7 b
"stn-wid.zip" (www.cracking.net):2 Q+ x, G5 X( F& ~

6 g3 r% P. O2 |    mov     bx, cs0 U  O' n3 F: n
    lea     dx, int41handler2
3 I7 Z6 c. ~/ |: e( {    xchg    dx, es:[41h*4]
3 u4 M3 q3 `' b& }2 y    xchg    bx, es:[41h*4+2]) t3 @. p7 Z# Q% ]) q- g( Y
    mov     ax,4fh
4 ]2 P" H, l! f, F    int     41h
. m' M( ~, u% E9 |9 `    xchg    dx, es:[41h*4]
2 u3 K8 B  V# h" L/ [: q    xchg    bx, es:[41h*4+2]: G9 Q2 y& B! ?4 L7 h
    cmp     ax, 0f386h9 `! j2 H* _( L9 s: H: N# f  N
    jz      SoftICE_detected! y7 V8 h. C7 Z7 Y, S/ W
+ B% A' f4 g2 g% H  v1 @. ~: [- h
int41handler2 PROC
1 l1 k( p# b6 t" v2 b    iret2 W8 R" i- x) p5 H( H
int41handler2 ENDP
' H5 ^8 w9 t; T8 g+ a( S3 _3 G9 p/ Q& F$ V

/ Z% P  a: [8 t8 ?_________________________________________________________________________
; U3 [$ S' k; A: Q7 m. k' ^, W/ ?6 b. R* B" c! I7 {

1 {& d4 J% J3 m8 O: Z  Y, b* fMethod 06
" M/ B0 G6 c5 d4 p# D; U0 C=========; u/ K- a5 A7 @" l9 G' G
: m  y, U! V, V# G
! \' i4 C! ?* R9 O
2nd method similar to the preceding one but more difficult to detect:
" n8 h. n4 D" F5 M0 d6 W1 a% D# N8 j; i' o" X4 i0 @1 }4 r3 L2 B

! x) N$ X2 k  r4 v* ]int41handler PROC1 H2 ]' z- z/ @$ @/ c' ^- Q- t
    mov     cl,al
: k- q4 e! }( y) H* h    iret" g6 P7 |4 Z6 L) z% y5 @1 p
int41handler ENDP
( G9 [+ U8 D2 m. L5 E) b1 }+ P& ]5 G8 A0 f1 [  E* I1 N+ f

( ]% _' m$ ?4 l- |* i    xor     ax,ax2 ~' @" x% V9 k5 I# J' A
    mov     es,ax
  b" d  }% ^9 ]6 J3 n( B7 V( k    mov     bx, cs/ Y- K. p% K( Q1 P# E! Q
    lea     dx, int41handler
0 n; J% u$ s7 \' R2 [7 E8 ]& p$ J    xchg    dx, es:[41h*4]( M/ E1 H+ h' f9 Z. O  n
    xchg    bx, es:[41h*4+2]
8 L. `9 I3 X, z7 a# n; A5 T0 J8 o    in      al, 40h
# L+ T* ~4 J6 Y4 R) g    xor     cx,cx
6 b6 b/ p0 ?' X8 @; S    int     41h) o& e+ L9 ^$ W/ c( Z: r
    xchg    dx, es:[41h*4]
! c8 K9 `- t; X- n0 \. R: G    xchg    bx, es:[41h*4+2]1 d7 H( Q$ W* o  l7 P3 e
    cmp     cl,al% n/ y7 X2 V9 H' p
    jnz     SoftICE_detected
7 D4 x  f& R0 z2 S
: L" k  `$ E" r6 g_________________________________________________________________________6 N( H$ s+ S( z7 W* t( p

& {5 W4 V2 j3 n/ e; _6 u: B5 QMethod 07/ F; U( w( X, n% e5 E* [+ d
=========7 _* `; s9 [, O3 d3 j

7 m' v+ q, _8 R, A2 B0 b2 n* j- iMethod of detection of the WinICE handler in the int68h (V86)8 {# E& ?9 A% G/ W
( j, @- o  e) s3 g$ j
    mov     ah,43h
! k. R; a% E; c4 \% l    int     68h
; n6 n+ U9 Y( `( b# H' |0 Y1 I    cmp     ax,0F386h! n- N# z& W$ C9 c- x) a
    jz      SoftICE_Detected/ l2 f( C2 l) B0 @7 B( J. j) {, c3 L
2 \9 E) _; d$ F! v; w
8 J. Y0 L8 B" o. }3 V* {% O3 ~
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit# U( J* y5 k, q. D9 s+ n
   app like this:
- w% ^! c" ~( p/ I$ ?& |7 I2 W( O+ Q/ Z5 L) s+ N# n  K
   BPX exec_int if ax==68
+ x4 J0 `% X; w  N   (function called is located at byte ptr [ebp+1Dh] and client eip is- q& B- o/ y# i* p5 l/ G
   located at [ebp+48h] for 32Bit apps)
6 _4 ^  H& v6 ?1 w6 v__________________________________________________________________________0 z5 n( ^- {" q( M& L! D1 F: l' u

, N8 T6 {: E- p: U: w. d
+ I, G  m1 k+ G$ tMethod 08, l: ^1 u' [" W6 y
=========1 o. c) h# ~) h7 N
% F1 ~2 o9 y* q7 Y$ W
It is not a method of detection of SoftICE but a possibility to crash the
9 r" c& z+ M$ gsystem by intercepting int 01h and int 03h and redirecting them to another9 ^+ B5 a% s% h) w) r; c; w( I  J
routine.
- o  b' B0 s* f( N4 u, g1 cIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
3 x& D0 B" q* @( N0 j1 ]* hto the new routine to execute (hangs computer...)% w& ^1 Q. \2 J+ i- c* k
6 }& J; T* c5 r
    mov     ah, 25h% j% c3 B" l. l9 S+ \0 K: N/ e) d
    mov     al, Int_Number (01h or 03h)4 Y* U6 u: G/ P
    mov     dx, offset New_Int_Routine
7 s8 T) ?& u5 ]    int     21h
, \1 Q" b; F7 v) @9 ~5 c0 X2 ?' m
/ Y# E8 l7 V" u2 u0 `; _5 i& N__________________________________________________________________________
! j* j/ g5 v' i: f: Q
% A. W7 r6 h0 ~. r! L4 CMethod 09
, t3 ?3 @* x3 N- C5 Y0 M1 l=========) w+ P2 `) K( T+ U

; t$ f, r6 K. ?" u4 @: ^, PThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
( \. O+ w- T1 M/ j/ u/ sperformed in ring0 (VxD or a ring3 app using the VxdCall).
  K0 t$ T( k; xThe Get_DDB service is used to determine whether or not a VxD is installed8 d6 T0 T: X4 H& W/ k: z6 P& Y
for the specified device and returns a Device Description Block (in ecx) for: o5 b# V) ^, P5 J9 Q. w! o
that device if it is installed.% ?$ c+ E0 [/ K( R
$ ^! g0 w* f9 Y$ c1 h5 @/ L( s
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
8 Y9 |3 \% {, k) d& W1 R$ A4 N   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
8 p* }! _, F  M5 y% t: }& [/ O9 m   VMMCall Get_DDB
! a4 B: ?( S& ?   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed. T6 u5 c# b) o/ X1 i( j

0 L1 _6 q5 B9 M2 x8 g7 r* kNote as well that you can easily detect this method with SoftICE:7 Y8 u* ], O, j; [* P& N) Q; I
   bpx Get_DDB if ax==0202 || ax==7a5fh; J- e9 m* {  c" r
: k' p) {1 g- x5 l: s
__________________________________________________________________________+ f6 n* t+ c* y8 z. P1 l
8 q4 g+ T( _/ U5 Q! p9 t) F* \
Method 10: V- ^- I; B; _# a
=========+ v* j3 Z# p# f$ X( B9 y8 b

! [8 u0 {& v% E  [=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with& \4 D+ Y! g: g
  SoftICE while the option is enable!!
* b! I7 N5 C; _' N) `4 ?0 q) L1 S
+ l$ i- \' w9 U8 [. U0 ^9 VThis trick is very efficient:( ^! Z$ a7 }2 o0 F: h7 e' b
by checking the Debug Registers, you can detect if SoftICE is loaded% K1 l0 i6 E2 Z5 J, P$ N1 C
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
* |, F0 X9 y  p% sthere are some memory breakpoints set (dr0 to dr3) simply by reading their" u; V2 p. A% R& \
value (in ring0 only). Values can be manipulated and or changed as well
: I5 u' \/ \& E& [) v(clearing BPMs for instance)' L; q) `" Q+ c; [2 p

6 @# W7 g2 {  e' q- V: q__________________________________________________________________________
" ~7 A. h: O$ k; B. W4 l3 ~% n% z4 q/ h$ h  a9 z$ F9 T6 ?
Method 111 b$ y4 C/ V5 j& A% Z+ K
=========; A( E- Z* `" v
% j1 k5 r6 N( s! Y1 V7 y
This method is most known as 'MeltICE' because it has been freely distributed
" b$ |7 r! M( `, [5 C# wvia www.winfiles.com. However it was first used by NuMega people to allow
# {+ m" @* t1 h6 F: t6 M! t8 wSymbol Loader to check if SoftICE was active or not (the code is located
/ k- n, }9 Y/ M7 X# o; C  |inside nmtrans.dll).
! U7 Q# m! q5 E6 ?0 _  O! p+ A4 M" n1 O6 z" j! O. c
The way it works is very simple:
$ @! M1 X9 b5 c* iIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
; H" G) i3 U; bWinNT) with the CreateFileA API.
, Q& l7 _* e# ^5 n+ e9 d
# y- f: {. @6 y. @Here is a sample (checking for 'SICE'):
2 C  U% D5 A5 G( J; s  S" c" e8 P' h* d9 d6 w& q
BOOL IsSoftIce95Loaded(); A" R$ b  y6 }- n
{
; ^; Z! X4 a+ ^% S' E0 Q  U: E$ N' n: M   HANDLE hFile;  * ^; r; [: \% I
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,& Q- _2 j0 w3 V. v& Q
                      FILE_SHARE_READ | FILE_SHARE_WRITE,0 |) |9 l- a- J1 Q/ ^8 W# {
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
! c4 u5 J6 f; L7 c   if( hFile != INVALID_HANDLE_VALUE )
% K) {8 G4 c* k   {, E7 I( _% {# E0 Y3 d4 \0 E* N4 q& b
      CloseHandle(hFile);
& k1 P" H* W& i      return TRUE;
4 j5 I  c/ M  F, ?& Z& Q# @1 F4 E   }
0 B$ p  a. z1 j* B   return FALSE;$ {- K* T- k$ u( f/ M9 Q
}
2 D& y5 f5 J3 z( M3 M: m
3 ^8 O% r  z, \6 A- l- I6 pAlthough this trick calls the CreateFileA function, don't even expect to be! R% G8 k  e& o+ o5 C/ y
able to intercept it by installing a IFS hook: it will not work, no way!# S5 y1 U2 H; k- Q, j
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
! K- {: z6 B# Oservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
. f, M. u! Q8 N7 A! \: Land then browse the DDB list until it find the VxD and its DDB_Control_Proc
2 |# g% T% m/ @% g1 H+ g" |field.
7 {" `1 E- H; S( s9 H6 p& OIn fact, its purpose is not to load/unload VxDs but only to send a
# y$ @" v3 _. U. G9 e) E1 `W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)0 [( \* R  Z' t
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
2 j# a1 s6 @3 R. bto load/unload a non-dynamically loadable driver such as SoftICE ;-).
: w1 {! g7 m$ K+ G2 KIf the VxD is loaded, it will always clear eax and the Carry flag to allow
, X/ @, s) H+ U2 aits handle to be opened and then, will be detected.6 s$ C6 f% m/ I* w  {% W" Y' x6 s
You can check that simply by hooking Winice.exe control proc entry point9 R" e  k2 v4 i7 R. J6 U
while running MeltICE.1 f0 v4 t6 r3 }' D) Y

+ K+ `  J; I. y7 k
. |6 [8 f* B# g* Q, C& B8 D  00401067:  push      00402025    ; \\.\SICE' P; D* o2 c+ h% |  q$ W; N
  0040106C:  call      CreateFileA
6 Y5 ?  i9 F+ W! x1 e2 \2 A% X  00401071:  cmp       eax,-001
0 r1 {8 u* Z1 q/ W9 d! b& R! i1 S  00401074:  je        00401091" Z$ I) U; {8 P1 X7 @0 A  s
. o( s( ~$ u  D) k! n

& R0 H' a  U: y' J7 K9 vThere could be hundreds of BPX you could use to detect this trick.5 P7 g% |, g$ Z4 h6 Z4 w
-The most classical one is:
. `5 c% z% w) f  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||. S0 a2 S- p5 i% _/ e3 {
    *(esp-&gt;4+4)=='NTIC'" J: k5 S$ }  J7 n

1 }) O: [( t/ p1 @# P-The most exotic ones (could be very slooooow :-(
+ k7 {) D; i4 Y( @: l   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  ' V6 J! q) ~' p6 n7 v1 l8 f
     ;will break 3 times :-(
/ q- P- t* u$ y2 s  t
6 S. \$ D# x4 Z. ^7 }, P' w# M* ~8 b-or (a bit) faster: ) V/ S" Z* A- {" G1 z5 K6 r
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
$ d  b# K; f# d1 k- |6 j0 p: P" b8 T$ K! V, W# h
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  8 h" w6 W3 K! R% K# v; y
     ;will break 3 times :-(7 `8 E9 _; ]0 h0 z
! F0 V. @6 H- A% w4 P
-Much faster:/ N& I2 K2 t( h+ J( k) x9 d
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
/ S1 M2 C$ N: j4 ?+ |
0 z" Q: ^; E! tNote also that some programs (like AZPR3.00) use de old 16-bit _lopen% [5 h. O  d4 O7 W8 r
function to do the same job:
% H1 T2 X% I, t  X# r  Z' o6 p6 S
   push    00                        ; OF_READ
  Y6 I* J* b$ i- D$ Z   mov     eax,[00656634]            ; '\\.\SICE',0
9 r2 P1 j6 s, B4 i   push    eax; |" [6 q2 {  K) a+ [$ p( G
   call    KERNEL32!_lopen
. b" f- p6 o9 c) a4 Y0 Y0 m6 ?   inc     eax
' P. W4 V! d# X. M, n   jnz     00650589                  ; detected
% |5 j0 x5 p9 O$ I& ^' R* F: b# H   push    00                        ; OF_READ
$ @! G; P1 |% Q7 J! `   mov     eax,[00656638]            ; '\\.\SICE'
5 u7 ?3 p8 J7 M: }8 {2 l" F/ g3 V, A   push    eax
* ~# b  l3 y7 A; B/ d   call    KERNEL32!_lopen
3 I" c: C4 C! Z( e, p% y* N   inc     eax  w+ S8 F3 @+ z: s) r! h  D
   jz      006505ae                  ; not detected) F( A: S+ v  v4 y/ G, L5 E  q

0 H" x& I* ~% Z5 L, {" U0 d6 q( `6 i+ J+ Q, N$ e1 y4 L
__________________________________________________________________________0 T; Q5 @% R) u% B
8 {- W4 ~, W' Z2 F8 G" I
Method 12% z# m2 x; v, {+ w
=========$ v0 b' Q, O  O* u1 ]! A# W

/ Q" i& z" n3 l! M/ A  AThis trick is similar to int41h/4fh Debugger installation check (code 05/ s/ U) H( c3 @& T2 ^) j0 \/ T# A
&amp; 06) but very limited because it's only available for Win95/98 (not NT)
4 f) E( `; O* v" P4 u$ W) Xas it uses the VxDCall backdoor. This detection was found in Bleem Demo.! B. W  G5 \( h/ Z4 R5 j
) _2 g7 g5 q+ l. y* W  ?
   push  0000004fh         ; function 4fh) ~7 O5 ?" w( {% e& V  _' O6 s% c* j
   push  002a002ah         ; high word specifies which VxD (VWIN32)0 K) v3 T! \: d6 N. Y) U: A
                           ; low word specifies which service
" }/ Q( F( f1 G6 U& V# s- s                             (VWIN32_Int41Dispatch)9 q0 i! ^: o+ W* H
   call  Kernel32!ORD_001  ; VxdCall. S$ i8 O1 \- y, ^8 P# F
   cmp   ax, 0f386h        ; magic number returned by system debuggers! p; W" i6 `2 l5 K8 a" \: @" z
   jz    SoftICE_detected) ]0 y1 C+ T& }1 t

; Q8 ]! m1 A, r0 p6 \; uHere again, several ways to detect it:* N  t7 B+ I' Y9 V
# D; K+ P, E: A! z3 a2 x' }
    BPINT 41 if ax==4f
8 ]0 Y- N- v) A' L* w! s( w1 W1 D! }7 B2 G0 `0 f
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
4 w' C4 N1 |6 \" ?; }; I. L' k6 e  |2 w5 n
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A) e" E2 g3 F( u; B

5 A( d& b9 Z$ @0 |2 Y    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!7 q' [4 f: _9 m2 w) D% [. W) r

$ t5 G1 v2 V/ l& U7 ?' C6 e__________________________________________________________________________
( D6 V* c% b/ l$ C- F3 \9 i7 Z9 S) n* Q/ p
Method 13; Q& ~: P  \6 R- a
=========  h2 h8 ?2 B8 e6 Y: h
% L6 h' @2 t$ }1 k6 t! F3 }
Not a real method of detection, but a good way to know if SoftICE is- ?! W/ H0 ^" C/ r; A  [! N
installed on a computer and to locate its installation directory.: i% T: D3 s% x6 V2 w8 L0 @* x
It is used by few softs which access the following registry keys (usually #2) :
$ {0 E8 k! c3 r& U7 v* n& H3 m4 t5 U/ V
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion  L. z7 l+ Z8 _5 C9 i# m5 C
\Uninstall\SoftICE: a# V5 W  I, [7 |; b4 s0 \% o2 e
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE  b* L. C; M5 K% ?6 ^0 w/ u7 k
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
. d$ p$ \( |$ s\App Paths\Loader32.Exe( v8 p8 O2 ~( x8 O4 J- A

2 f2 t+ o" ?# g, m# k0 b4 [( j! Y8 X3 g1 I  K& F7 k
Note that some nasty apps could then erase all files from SoftICE directory
- G3 `. [9 `+ }. w" |. O(I faced that once :-(
- V  c* m5 L" i* q+ O, r6 H9 i
% d1 V* a9 r4 o" [7 TUseful breakpoint to detect it:
. _; Q/ |: X6 T: f* I
* |$ d: D4 q" ^) o( U9 v  C; [  [     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'6 ~# I1 Y8 Z1 q1 m# ?
# q1 W9 @) l4 C, L" r5 d3 R
__________________________________________________________________________
  j! V7 Y2 Y$ q# w: \& z0 s- d( A- P; t) q+ G
: N  N, H  k. y  o$ \2 W
Method 14
& w6 X7 b8 N2 p4 @6 w) ~! f=========* k4 q& H! y/ O# ^5 b& r+ s7 M

$ D! b; w6 @) n/ P6 F) _A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
/ ^3 k  B4 ]" [1 |1 iis to determines whether a debugger is running on your system (ring0 only).
3 y6 b% J, ]4 z" C; n
4 @6 k* b2 `# D) ~7 v   VMMCall Test_Debug_Installed, H/ e7 W+ ~7 l1 }- f) F$ A
   je      not_installed1 X; F! F7 P/ O7 B% }: t* p& w$ R& `3 d

* g+ R. o$ v9 o) W! W! DThis service just checks a flag.( o5 `; o9 ?5 U, s3 h6 b* ?
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-7-22 14:46

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表