About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>6 Z( F  n) K+ x0 j0 U
<TBODY>
, w9 C7 M- x! a, M* R$ M<TR>
" ?" p) U" T' n* n<TD><PRE>Method 01
3 W+ _0 _. x; _8 H4 Y1 ?# T& B=========
6 C( N! K/ j) t4 C  t- ^; t: `3 C- H
3 f. Z0 ?" d2 q1 c1 bThis method of detection of SoftICE (as well as the following one) is
3 \& l' H6 `2 x% |% h5 N, u$ f  @used by the majority of packers/encryptors found on Internet.  p3 o% Z, J+ {8 q& r9 t2 H, E
It seeks the signature of BoundsChecker in SoftICE
) D; [- P- q8 a$ o* b2 J8 M, U9 ^- `7 m
    mov     ebp, 04243484Bh        ; 'BCHK'
2 }; H, [  n6 X  k, T    mov     ax, 04h
% y4 i: G- H' U1 \/ f( ~4 ~# N    int     3      
4 z$ \% R# l) [4 j& {  {# X* A, u$ ^5 h    cmp     al,4
- ]0 v  _& A5 e    jnz     SoftICE_Detected1 m: @, k( a1 k3 e0 I+ i
& c6 @# p' s. S
___________________________________________________________________________
( L6 z/ \( w; b$ s  l: @8 L7 y8 S/ ?$ W: U
Method 023 \" i, `5 m4 \$ N$ F
=========
9 w, q' |' Y. x1 C$ B8 x/ l* ?
) }9 w7 B* w! E* \+ ]1 Z) w% sStill a method very much used (perhaps the most frequent one).  It is used
  E" o" p( C3 hto get SoftICE 'Back Door commands' which gives infos on Breakpoints,9 \) ~  {: h8 }$ f3 G8 h
or execute SoftICE commands...
; `3 ^; {. L3 AIt is also used to crash SoftICE and to force it to execute any commands
: j# V- |' \) J(HBOOT...) :-((  
% y9 a  B6 z8 \) y
) c$ O+ ^; ?! u' R% uHere is a quick description:
8 r& w9 Z) q3 `-AX = 0910h   (Display string in SIce windows)8 {3 P+ [. B  M8 p+ x
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)( ]( F/ T1 L! j+ l/ r
-AX = 0912h   (Get breakpoint infos)# W6 t+ e. k) J! D
-AX = 0913h   (Set Sice breakpoints)! h' q% k9 r( M3 b* U
-AX = 0914h   (Remove SIce breakoints)* @6 `# \9 q" Z! p% c7 N. b  o

, g5 ~) k- q6 q5 P- P$ ^Each time you'll meet this trick, you'll see:
) v3 ]% p2 O% M$ t-SI = 4647h5 \& b; {5 o: G/ y4 H7 ^2 @( U5 \+ `
-DI = 4A4Dh
: l/ `2 Y+ w: i" V: r  Q8 ~0 IWhich are the 'magic values' used by SoftIce.
2 I8 {* @' s: {6 _For more informations, see "Ralf Brown Interrupt list" chapter int 03h.  o7 r% p' q7 _$ p; B0 x

7 J* X- P% ^" O0 KHere is one example from the file "Haspinst.exe" which is the dongle HASP1 C9 f4 y$ ^" d2 q' A9 W8 h
Envelope utility use to protect DOS applications:
# g9 q" p/ w+ F8 G$ R! h
: E1 d0 Z, @/ W7 V: r) t) }2 r! {* ]6 n$ c' i- y5 f: {; _3 {$ I1 m
4C19:0095   MOV    AX,0911  ; execute command.) ]" ^! c2 T4 o: r& {3 J
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).- \+ v2 H* m/ O  C6 @! o( A- {
4C19:009A   MOV    SI,4647  ; 1st magic value.
  }# l. {: P+ o! ?# v/ M4C19:009D   MOV    DI,4A4D  ; 2nd magic value.) ~1 L5 r6 ?9 j8 X: A( }3 X
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)" x) u- E3 }8 N; R
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
2 U. m+ _/ l) N0 y' H4C19:00A4   INC    CX+ ]6 W) s! v: w+ K* K5 I
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute7 v2 U2 c, C3 I( A
4C19:00A8   JB     0095     ; 6 different commands.
/ k; P/ g6 N5 G% [; z0 {% k4C19:00AA   JMP    0002     ; Bad_Guy jmp back.* H( ~. E$ X# {' Q8 o
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
% h4 X+ i' E; w# m/ [
6 V: H/ y6 q. T5 H7 j; M2 h+ CThe program will execute 6 different SIce commands located at ds:dx, which
% J, Y* [0 i# _are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.0 y2 _, g; @6 g- z+ \  h
# H  L, A! l8 l. Z# p* E; _) s
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
0 J9 r3 \/ Q/ a9 g. b___________________________________________________________________________0 O( z' H8 i/ L  R+ k" B" D- P
0 i/ z/ J% n: A% c9 H

/ {" U# ~! V! LMethod 034 ?* m& O- s* i2 Q
=========1 x. C7 W- W, \( Z: h) Y

6 @& g" K0 `, XLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
2 ^7 A7 `" C0 T) _4 m(API Get entry point)8 _/ b% v% X) u* w/ B2 `
        9 w. c+ ]4 I8 \, Q  a

  C. \  ^# \/ ^( Q( T* m    xor     di,di
6 |) x0 G; u+ D    mov     es,di& S! ~) l4 O8 U1 v
    mov     ax, 1684h       ' `" F+ O1 s6 l1 |9 m+ G8 h7 C
    mov     bx, 0202h       ; VxD ID of winice
4 E8 n; _) Y( }$ s    int     2Fh
, k- J6 O1 V* p. k' ~$ a    mov     ax, es          ; ES:DI -&gt; VxD API entry point9 `4 D2 S. `/ i: s: f
    add     ax, di- o6 {" n. O) f$ C+ ]2 a' d1 Q
    test    ax,ax# n8 \+ M; c: V) c0 k9 c) C. H
    jnz     SoftICE_Detected; n& a5 o; B* o( E6 |! A2 k( {

  A: f8 K/ O2 H! O___________________________________________________________________________
8 P2 ~+ T' M+ Z- i
1 S3 a( b( B% }0 o6 E; d4 wMethod 042 _( ~$ k: k9 {5 |# @
=========5 R' _6 U7 L! ~, S; j: h# x
9 n: O9 a3 {4 T1 l- y
Method identical to the preceding one except that it seeks the ID of SoftICE
& T9 N; `& m/ |/ U4 X3 A/ zGFX VxD.! N6 F( Q$ D) q0 C  J! \

( @, F# \( I5 O! l& u( t    xor     di,di
2 e, @9 W$ q! p$ k    mov     es,di
# o/ w+ U$ F( r0 N    mov     ax, 1684h      
! H& ^& Y) Q) U- B" o8 t    mov     bx, 7a5Fh       ; VxD ID of SIWVID
7 G5 p- j" n! b    int     2fh
# C+ v- z0 m! ^( W- U; j. @3 G    mov     ax, es          ; ES:DI -&gt; VxD API entry point
; F* d! d; N8 u9 F! P$ A4 W    add     ax, di
8 E3 _' K& x+ n/ {/ p5 Q7 q    test    ax,ax7 j$ ^7 P  h# @
    jnz     SoftICE_Detected
, h8 r# {! {- ?, ?6 H2 y
& _3 e6 g7 j1 B" I__________________________________________________________________________) v' e  F3 ?' N1 [7 q# n4 t" {) R

0 s# w9 K: q. B: p# Y# I; u- I/ F5 C
Method 05
; Z4 H  @  h0 |$ H* c=========
$ v* Y1 T, T: g2 ^% C6 t8 g& e, G0 M; x4 c
Method seeking the 'magic number' 0F386h returned (in ax) by all system
" s; _2 \" S( u5 D" ]debugger. It calls the int 41h, function 4Fh.7 Y$ q1 C% i. c4 M* K! i$ F
There are several alternatives.  
. v5 w4 i; h/ _  D1 h( v4 w1 j9 Z: t+ d0 |8 f, g+ T
The following one is the simplest:) D$ Q* [4 g) i: w( C/ {* @8 u2 ]
  \) j# l9 @& I& K8 F
    mov     ax,4fh; s" \4 h# ~4 f- A
    int     41h2 g( J% |3 W% `1 L; X
    cmp     ax, 0F386& K2 }9 W; }! X: {
    jz      SoftICE_detected5 L" s( x) R. \: X' G
+ s1 M, l5 v. y. R5 S
- G# c; U9 T2 s
Next method as well as the following one are 2 examples from Stone's
) K1 W: C% k  d( P"stn-wid.zip" (www.cracking.net):  N) C2 ?) R- u' z& T
* x/ g" D5 K( `/ Q& z' b
    mov     bx, cs/ w1 ]$ d, M, j0 A
    lea     dx, int41handler2! w) [1 |' C) H$ P. d4 s
    xchg    dx, es:[41h*4]
. l; P7 ]6 u( P' ]; M; {    xchg    bx, es:[41h*4+2]# L4 ~# c4 j5 B; _' M1 z' S
    mov     ax,4fh
9 a: U! z! \) `& Z# t3 o* @    int     41h( G4 l; N' ^) B+ e; G! J5 [7 N
    xchg    dx, es:[41h*4]
" k9 J; e1 y) t( m2 F5 {$ |# @0 J4 v    xchg    bx, es:[41h*4+2]
9 A( |6 H$ C& C! A& C4 n: e    cmp     ax, 0f386h* Y9 p. f# N) G0 G
    jz      SoftICE_detected' P( @: o$ O( {
: {; z- f) t  K: Y( ?0 o
int41handler2 PROC
+ a! v6 x' i1 j    iret- V' ~/ q- \0 L# E; K+ s4 |" C0 R
int41handler2 ENDP
5 L# |- r6 ~# j" p3 t
6 l" l: D' I. c5 S  q
# i6 }6 I& h% A_________________________________________________________________________
: f( H) q. R- J, I4 ^0 J4 ]: V# V; l/ u2 Y" p$ L

) R$ t! b. Q3 N, IMethod 06
+ w% w3 U' m  ]=========
" C% [8 w8 N  i" Z( O1 E5 q3 K$ C

) t' H; X9 ?/ g. ?3 |2nd method similar to the preceding one but more difficult to detect:- j0 Y2 u; P; f& V( }

# B/ C3 p+ A: q  n7 t* h- _" P$ Z: E. x) h; k' K; d' p
int41handler PROC
  Q+ [  T8 E. X; n6 l    mov     cl,al
; M- ?2 T; [9 C  V    iret
1 S+ }: m1 m: F$ w- P- hint41handler ENDP
! t' a8 V! O' e6 N+ r  z+ @! A7 L

# o2 m/ I2 r% Z( Y+ q& G5 ]    xor     ax,ax6 `7 U# T: \9 E8 Q
    mov     es,ax8 z5 E" U/ p  b  {6 Y9 N
    mov     bx, cs4 s) z2 X; j0 V4 {9 m( o, X4 y1 H, S) c
    lea     dx, int41handler
1 }% \! V# [. {2 H, o  g' N    xchg    dx, es:[41h*4]
' ], J8 K) k  g+ j# ^$ w' L    xchg    bx, es:[41h*4+2]$ W/ m- p/ v) E  h: M
    in      al, 40h
" L! [4 m% v" `5 j0 j, k    xor     cx,cx
" f# H/ U" {4 t: N5 a    int     41h
  ?8 O( ~$ Q+ ^* H7 f& R    xchg    dx, es:[41h*4], q0 G  m. x# z' d* J" M
    xchg    bx, es:[41h*4+2]
8 u5 M0 i$ I; V; R2 i+ l& _! T" v    cmp     cl,al
, ?# Y" @* t: l! i    jnz     SoftICE_detected
! p% e  q1 `& [7 G4 o% J# `
, y% ^' T/ w( j+ A% B8 o_________________________________________________________________________$ [' B1 }# [* l, t+ M
/ u* i$ S4 g* ?1 c; ]0 h& u4 H2 ?
Method 07
; H2 }' V8 |* {' G* E! e! `=========& [: ^2 A. a5 w% m( i/ y- G/ ~

' M/ }( j' E. e3 Q. H# CMethod of detection of the WinICE handler in the int68h (V86); Y2 q1 a! }0 Z# ^" [

4 K3 Q  C# ]6 x, ?) C/ R! l4 l' Y, x7 O    mov     ah,43h+ X* q6 r3 e: i9 W
    int     68h) @5 o  `9 D  e+ p. ~7 n
    cmp     ax,0F386h9 Y. Q* }4 S) t& _5 m0 y$ \
    jz      SoftICE_Detected7 j2 B* D+ n/ v6 \4 d1 ^# Q
/ n" Y( M! B; C; ?
0 c% S. s' W4 c& V
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
1 `4 p1 E" Z& v9 R- s  N   app like this:1 B. }8 q9 }' U+ t
4 B/ V1 O) j/ G. V0 v- r9 Y! Z, K4 {
   BPX exec_int if ax==68% ^& i# y3 A) |3 U  n4 l! P6 V. z
   (function called is located at byte ptr [ebp+1Dh] and client eip is( v& L3 d9 }  N' N7 U5 }9 @
   located at [ebp+48h] for 32Bit apps)- w. y) E: L7 ^+ Q5 h
__________________________________________________________________________# C( ?) b! S* P: j3 G' u

( f# A- P) d4 Q: K: @' M: C  \! c+ r1 n
Method 08
2 P1 [9 o+ `/ v( Q=========' Z& `4 P& O6 N" u. y+ w0 r# S

3 S4 g. z/ \7 c/ b2 ZIt is not a method of detection of SoftICE but a possibility to crash the7 P$ ~" U2 w% I: a7 W) W
system by intercepting int 01h and int 03h and redirecting them to another
# p3 b" v; t8 c- `/ ?9 B( g- L  droutine.& {) y: S  t+ X; C6 A+ y$ J
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points. K% R! }1 M% |- ~
to the new routine to execute (hangs computer...)
% F! J, D- U$ N3 k+ g- a* W
8 ]( {! c( w2 O    mov     ah, 25h
6 W+ ]2 i* {, v5 ]    mov     al, Int_Number (01h or 03h)2 m2 I5 ?  U( L4 o
    mov     dx, offset New_Int_Routine  A4 I& ~! N' B5 g
    int     21h& C, G0 F# ]+ V( J7 p5 O' j
2 U3 ~. R' N0 _5 [( L
__________________________________________________________________________1 V, k1 b, t/ F) |3 ?9 t/ C
0 Q5 R. V  ~' G
Method 09
+ m  ~6 B4 A- y/ C/ i' E7 f7 }2 @=========- ^9 Q9 G. f4 Q3 S

. s$ S9 a2 y6 s) F; GThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
7 h4 @7 C0 L4 E' ~( C) vperformed in ring0 (VxD or a ring3 app using the VxdCall).4 b- q' H4 d; u2 K4 P
The Get_DDB service is used to determine whether or not a VxD is installed
' p" H6 `8 i! S, ?$ N  y" ufor the specified device and returns a Device Description Block (in ecx) for9 x7 A( s/ d; X8 V8 R8 ~
that device if it is installed.
: U5 |& C9 g! L& i
: g5 t" t* k  C4 p& G- I   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID" W* G/ Y8 k# _
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)0 ~* c6 c/ W, S
   VMMCall Get_DDB$ {. R8 w% d0 M
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed5 x! d) ]: p# l9 a  f

& R! K$ X* c, @' mNote as well that you can easily detect this method with SoftICE:7 C& C3 c. ]. A7 h
   bpx Get_DDB if ax==0202 || ax==7a5fh
# e! k9 v* ~; b) j
/ c  _4 y# A9 J' g__________________________________________________________________________6 ^' d( ]! n* w6 U; _
, Z7 O1 b3 j$ r) z- J
Method 10  q6 U( l+ v8 Q5 i! [" `2 o
=========9 O% e& U; E* g  n3 V

- N, u8 Y/ ^1 T; U5 u=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
  E* X$ y1 g* w6 v( z  SoftICE while the option is enable!!' y6 R+ t. Q& ?# o6 }9 m1 w

2 W4 d& n, l% Q  T$ S1 dThis trick is very efficient:$ Z. D/ `: r7 [' N; R
by checking the Debug Registers, you can detect if SoftICE is loaded
" D0 ?) ]1 o5 O! k0 q: P0 K(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
4 x; C: _0 q, hthere are some memory breakpoints set (dr0 to dr3) simply by reading their5 O: I( i& V: C. w; ~( R  G6 V
value (in ring0 only). Values can be manipulated and or changed as well4 J3 B8 G* O  h( {  N
(clearing BPMs for instance)
' V) A$ u- B/ o
3 \$ O5 ?6 j6 r( S__________________________________________________________________________& a7 [- H' [6 @5 @, ]  K

" s! p3 {4 {/ P$ c5 R! nMethod 11
6 i; p% g2 n" V2 t$ I=========
8 j; }+ L+ \% Y" \
) c  i9 F% p7 D2 W2 L8 AThis method is most known as 'MeltICE' because it has been freely distributed
; k7 R9 n( T6 f  ^# H# W; G) Mvia www.winfiles.com. However it was first used by NuMega people to allow' k$ t2 C3 p, C* m8 j# ~1 ]
Symbol Loader to check if SoftICE was active or not (the code is located" U) @  ]( u0 X% H& q7 p
inside nmtrans.dll).4 P3 n/ }2 l- Y% S4 n

% s9 R( Q) w+ W% j/ IThe way it works is very simple:) m& T8 s, v- [( I. p* M
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
0 w; d! t$ |3 }& s( m2 _WinNT) with the CreateFileA API.2 P. Y5 q+ W+ f; S+ @

$ ~4 B* e; J9 d( ]Here is a sample (checking for 'SICE'):
; e& Q# N2 B. X+ E$ ]( l4 L) m: q; Y4 h+ d+ h6 r/ c1 \
BOOL IsSoftIce95Loaded()- R# \9 ], Z  Z
{. v7 S& |- }0 e0 _) Q
   HANDLE hFile;  6 W( [* z" [* C, a
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,9 c$ ^- f/ \2 k& }4 I; I9 X
                      FILE_SHARE_READ | FILE_SHARE_WRITE,
$ p4 Y1 H- \6 _& f# J- }                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
1 ~7 p3 O" v8 D1 v2 I   if( hFile != INVALID_HANDLE_VALUE )
+ ~' Q. R# s  k1 S$ e; ]( d: a   {% Q- Y0 V; B, u# t) t+ o9 ^: z
      CloseHandle(hFile);- D) [! `1 h& O
      return TRUE;1 z4 j1 M7 T, [9 \4 d& `2 h
   }1 j. E! H  ^! @6 F4 C7 F' o2 Z. a$ c
   return FALSE;
+ x' h3 W1 {# o}
' ^/ d+ |% S2 ^- U4 g1 V
3 }/ f8 _( e$ t1 E% [Although this trick calls the CreateFileA function, don't even expect to be$ E3 ~( M+ f2 [4 [' ~, G
able to intercept it by installing a IFS hook: it will not work, no way!
7 F6 y' g, x9 X/ R$ u* PIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
0 y  o# K  H3 k* {( U* Z* mservice _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)' Z, y" j% [" @! Z% @! N
and then browse the DDB list until it find the VxD and its DDB_Control_Proc
9 H' p/ S/ E  f1 e  \3 Kfield.( L. e! B# g% s
In fact, its purpose is not to load/unload VxDs but only to send a " r' [  F7 N! _- z* r8 _
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)5 Q1 ?' e+ i8 ~
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
% ?2 T( V& s! p' F2 l: j; rto load/unload a non-dynamically loadable driver such as SoftICE ;-).
7 |( l& e" \% [, q- i# z+ _/ v) vIf the VxD is loaded, it will always clear eax and the Carry flag to allow* x2 n5 J$ S3 J9 d9 h; N
its handle to be opened and then, will be detected.' d, S. V  x' K7 t( W: k
You can check that simply by hooking Winice.exe control proc entry point
  q* E+ L. i! ^; ^0 Gwhile running MeltICE." U$ l' u" A6 }, U* a1 y

: O" x' q5 `% h3 N) d3 U- A# C0 `! x7 W% t, ]: ?% a# V9 A
  00401067:  push      00402025    ; \\.\SICE
  c8 q* [& p5 `$ I  0040106C:  call      CreateFileA; q1 b0 q" {& U" Q
  00401071:  cmp       eax,-001
0 P7 K; X) d+ [2 Q) M  00401074:  je        00401091
8 w0 `4 x3 x) V, T! o+ i5 _+ I$ n0 a: C8 }; a1 M

2 @2 }! C" N+ H2 cThere could be hundreds of BPX you could use to detect this trick.$ W8 O7 B1 ]6 E* G, D
-The most classical one is:6 L  f7 g6 Y4 |! h( T
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||3 N% |1 @+ W( a. [/ v* b9 B: [. o
    *(esp-&gt;4+4)=='NTIC'
# j6 }" }5 m, B  V: O
' s: u' Q: y$ Q% g' m-The most exotic ones (could be very slooooow :-(' P/ y0 F( Z: v
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  * [. _4 x8 s# z- W0 ]( ~0 n
     ;will break 3 times :-(
# T: I9 o6 Z: m
, t" U2 y# I2 r1 M+ G* B-or (a bit) faster: / Z, l5 R$ f1 i1 S0 R! b  d+ r7 }
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')- K3 Z. R% I( f! z( x! I4 Y

+ y5 }" r2 j" q/ Z* y1 q   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
! q  ~  M! D3 K6 Z3 D     ;will break 3 times :-(- {+ L3 ^7 D' F4 ~8 f/ q1 a, |

5 k" }. A' c; N+ {) u8 u-Much faster:0 _' |+ _5 ?0 V  N. A( r4 A+ Q- H
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'/ O3 q! e1 ]- z
- ^; r$ J8 t# o3 m9 g* r3 @0 R: J
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen5 @4 l; q# q* @# V- E# u( q
function to do the same job:
" K8 A1 }) |1 U
$ T5 [+ C7 X$ V' P$ y& L& ^! s& \   push    00                        ; OF_READ
4 `; _2 \/ N/ S& y8 ]   mov     eax,[00656634]            ; '\\.\SICE',05 W( V* M# |% i0 Z
   push    eax
- k1 I4 z! f* j- d7 t   call    KERNEL32!_lopen: Z# b8 V( f4 }
   inc     eax( l; |, [8 ^+ r) X. N9 @8 M
   jnz     00650589                  ; detected0 `5 {5 i! \3 f+ D4 ~
   push    00                        ; OF_READ2 f9 U7 m; h) ~& g8 B: F; O
   mov     eax,[00656638]            ; '\\.\SICE'
7 _: s3 J2 s+ ]& M4 L: o% {   push    eax
1 `* S. e1 ?: b1 C   call    KERNEL32!_lopen
/ ?! V8 P8 G3 R) }   inc     eax
( K0 c. R$ H: P% k) r. K  ]( }   jz      006505ae                  ; not detected
$ @# e5 s4 T4 H2 U# ?3 w1 e- @. y) t
  o: n) X' A0 O7 a/ W
__________________________________________________________________________6 |, `7 X+ j; O+ ^
+ r0 i7 B4 A: o' o7 H) e& g3 Y) k
Method 12
5 d1 a, g' a6 ^$ u& ~1 F& Y9 B! n=========
/ @9 P' R; |, A% b  I
9 L9 X7 |# M6 P' Z1 ]6 EThis trick is similar to int41h/4fh Debugger installation check (code 059 ~' u4 v. o5 ?5 K
&amp; 06) but very limited because it's only available for Win95/98 (not NT)
) q2 B1 T* C+ O- w4 |( ?/ Zas it uses the VxDCall backdoor. This detection was found in Bleem Demo.
  B7 o! t+ {$ t4 U7 y- ~0 K
- p& G* R# P9 h' J* C' T. l# i3 V   push  0000004fh         ; function 4fh( A( j4 U. {5 c4 c) L
   push  002a002ah         ; high word specifies which VxD (VWIN32)
+ \) @, \# @' x) j* S  L/ l2 T# z                           ; low word specifies which service( X2 G  O% X3 N" ^4 U6 E1 k
                             (VWIN32_Int41Dispatch)
" q. x: R8 ]* \' {& d   call  Kernel32!ORD_001  ; VxdCall
$ h. z8 l% q/ u6 B3 I/ `   cmp   ax, 0f386h        ; magic number returned by system debuggers9 w: x) S7 ^3 e6 W; A" `7 L- ~; l5 B8 G
   jz    SoftICE_detected- g; U+ O; @/ O# l+ y6 Z; b

! w; J; x8 j& x3 \Here again, several ways to detect it:
0 z% t' _0 ]2 A' M- k$ f
8 H7 V7 L/ j- R7 A    BPINT 41 if ax==4f0 {, g, n; n5 T! V

" _1 j' u) ]$ O5 Q( D    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
+ `; }# H# j2 K5 V1 Q2 r7 l- \) \1 \& ^& N4 [1 Y+ w( v& P# O$ E+ P
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A# K7 e# X: g' a4 ~3 Q. G8 ^# x2 X
% O# k; q/ l* H/ o, H; ^$ X0 @
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
- ?% ]: @' w. b/ I
3 V, g) v- P2 \, J8 u/ c__________________________________________________________________________  {7 S6 J$ s1 E( `  h1 g$ S& K2 i
- P0 m, B+ [' `" _0 K
Method 13  ~, k1 F( ^2 M: k, f0 }/ Q
=========1 c, f! M5 ?. J: F
9 {& u# ~. a! G8 I4 ]# f6 p
Not a real method of detection, but a good way to know if SoftICE is# |. r& p9 |; u" M( {5 I
installed on a computer and to locate its installation directory.( |$ `. Y' U7 B2 c8 E
It is used by few softs which access the following registry keys (usually #2) :
9 w2 _2 `/ R( D: C
5 k& c$ t6 |( P+ @3 B, _-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
2 i* C& T6 y: Q+ X' f\Uninstall\SoftICE
% [. j8 u4 v5 ^% W& ^% O" Z-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
& m- X" m  s' ~' e  n8 n-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
% I# }- }5 U. D4 h/ O  A5 c% c# N\App Paths\Loader32.Exe" q9 M$ V; S1 l7 E- J+ n7 {

* S; z8 `9 F& h% F
  J* r) t' Q! p  C' ^4 @+ sNote that some nasty apps could then erase all files from SoftICE directory# X2 \4 ^5 \) l1 X6 C
(I faced that once :-(3 S- \% s" ^4 w4 I+ j& x

2 g( I' R# ~. ^. {Useful breakpoint to detect it:# `7 i$ i) Z7 v
2 `# w; b: p% `1 [
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
7 t2 c. Q/ h" d& Z' f+ \) J) X. M- n: H
__________________________________________________________________________7 _8 |+ B( Y; }
; `5 q  E: k. g' }7 Z2 s+ p; j
1 H' v3 R+ Z5 _* D9 |* k% j
Method 14
4 P9 J0 A; u7 w$ b% d, A* _% n1 b=========
4 X& z* Q; }$ d) Q. }* D2 A! l- Q" w1 r: b# k3 x- r$ l1 i
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose1 V$ N* I5 q: R
is to determines whether a debugger is running on your system (ring0 only).) |9 V3 V5 b5 C7 i6 _: L
7 D) V7 H  W  U' Z; r; K8 Z* i7 w8 h4 n
   VMMCall Test_Debug_Installed+ f/ ]- x# [. t$ a9 Y
   je      not_installed
9 v0 C+ p# b  q% [' N# i2 _# w9 U* p9 y
This service just checks a flag.
" d* l" M2 w. A$ }6 y</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部