找回密码
 注册

QQ登录

只需一步,快速开始

About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>0 \+ F1 T- U' }4 n1 z) O/ g8 z& ^; g
<TBODY>2 |$ [4 J! u7 @, V% y
<TR>
$ U4 ~* p) Y; u4 k( J' {<TD><PRE>Method 01 1 _5 g, f: |* p
=========6 T' V- `. \8 c
9 i$ F; B6 i6 C* Q
This method of detection of SoftICE (as well as the following one) is
& d. S: v/ v6 h5 |1 M6 h4 [$ m7 O) s! Jused by the majority of packers/encryptors found on Internet.
3 G3 l* i- x* F3 F" F- hIt seeks the signature of BoundsChecker in SoftICE
3 _, G2 j, Z& ]% }
7 W' X  h7 h6 e; P    mov     ebp, 04243484Bh        ; 'BCHK', N7 ^. T- s9 @6 D) I& |8 X
    mov     ax, 04h0 s6 H8 f2 E. S. p3 W
    int     3      
( f) r, O; I8 i! c' k    cmp     al,4
: v0 a) T! J  J; k    jnz     SoftICE_Detected
1 @; E% ]9 H) A& ]. V7 N( P2 c& J4 D. u
___________________________________________________________________________9 E  r+ e9 A' x& ?

# {9 L/ ?$ K$ k9 D* eMethod 02
; Z/ m3 [8 s6 k5 A  K2 r=========
2 C3 _+ C' z3 s# W
7 P6 L6 U+ n4 y0 `: W: Z' yStill a method very much used (perhaps the most frequent one).  It is used; i# {6 o- f) ?
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,. d5 W+ U4 l3 F! \9 Y; ?
or execute SoftICE commands...
3 e  E5 L0 f! c0 ~+ eIt is also used to crash SoftICE and to force it to execute any commands
+ y7 [( F3 B) |. j1 _4 }(HBOOT...) :-((  0 v$ e( g! o! u: }/ ?* d  V) m
3 L2 t6 s  s8 p
Here is a quick description:
6 D4 K$ |% q1 n; i2 l/ v9 s1 F' C-AX = 0910h   (Display string in SIce windows)( y, a) \+ Z% D& u9 M3 I2 y
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
* c5 ^2 f7 w' {-AX = 0912h   (Get breakpoint infos)* _* \& m& M1 {" o- z) h
-AX = 0913h   (Set Sice breakpoints)
+ M+ D- ^, z8 N  q  w! T7 d-AX = 0914h   (Remove SIce breakoints)& l+ i+ F9 y. B+ ^

( q( @4 ^; d+ P. y* {5 SEach time you'll meet this trick, you'll see:4 R4 L! W' H. R* y9 _
-SI = 4647h7 A7 }/ e" H( @2 M8 e0 o7 x  Z
-DI = 4A4Dh# D/ i6 m" D6 _* _6 R& r
Which are the 'magic values' used by SoftIce.* k, O2 _) H% j, Z5 |$ O+ O8 n; X5 @( h
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.
! P- s% z6 u* d9 r3 F2 @8 b# i" Z2 n5 _, B6 b7 U
Here is one example from the file "Haspinst.exe" which is the dongle HASP6 }8 E% k9 M6 x3 N
Envelope utility use to protect DOS applications:
* B! z! o3 g( k* i8 j0 p; F# Y8 e+ N5 J8 @$ T7 u3 h' y
# t1 o# u8 ?+ ?$ l' o
4C19:0095   MOV    AX,0911  ; execute command.3 v; }& v, o& l: W9 Q8 e4 i1 a
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).2 R- P8 c0 t6 |" g- I: v+ f% v( [/ h# N
4C19:009A   MOV    SI,4647  ; 1st magic value.  f2 s7 E! B( M( H
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
/ d3 @3 c0 z/ W4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
3 @' l  G1 D$ Z4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute+ m/ q) F* a9 ^" {: x
4C19:00A4   INC    CX
3 ~1 T% R4 `* {2 ^) g; w4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute+ P2 ^/ ]0 G" G% t$ N- m2 o4 h
4C19:00A8   JB     0095     ; 6 different commands.& V% A* k. g! v
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
+ r# s! r  P' {. D4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)9 B& c6 h# Y2 _# }
* U; N1 `. [, k+ a
The program will execute 6 different SIce commands located at ds:dx, which. Z; [" G  i% t
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
3 M) O0 H* \; }4 _" Q6 L/ F; H5 p
* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
+ b' i8 i. l( n0 ~5 I6 R% W___________________________________________________________________________
) E2 b6 d$ b" O7 c! T3 P7 H
1 ]" A3 U* O& S. ~+ E  U+ j
. Z2 M: }0 E- t5 o, ]3 x' V8 {" l7 |Method 03) W- A* u# c& V. m
=========( \' e. E) c8 f; y

& f, @% \1 S8 m  uLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
3 Y. H0 k5 p9 O/ }- I% e- x# a4 Z: A(API Get entry point)' I( Y; ~5 {3 g( g+ \
        
2 H- z- @( w& E
+ n+ G- m/ _$ m    xor     di,di
0 T3 Y6 A# Q7 W6 S& C( A    mov     es,di
+ X* H- c" b: }) s& m2 |: R- \  p    mov     ax, 1684h         m: N' F1 t# E
    mov     bx, 0202h       ; VxD ID of winice
" s& m, l0 v. f+ ^% @6 j& [    int     2Fh. X( u9 ~: Y& B
    mov     ax, es          ; ES:DI -&gt; VxD API entry point6 b8 F. c* P2 \4 `" V
    add     ax, di! r0 }  r- U4 n* r$ A3 h; o4 I7 g$ _% w
    test    ax,ax
& O2 Y0 @, \1 P. c7 }( N    jnz     SoftICE_Detected
/ f, r* ^2 P4 W6 \; k$ T. q2 n" `9 l" p' b' f! T
___________________________________________________________________________
6 H) j) W) E% Q! J& G" Y' W
) X1 y$ [9 ]3 D2 rMethod 046 c% `; [% H3 p9 T  M$ E& S; O
=========5 V1 H2 h. e1 K5 j! i- n0 w% l3 ~- a

) v3 j; x! k1 [' X, M- OMethod identical to the preceding one except that it seeks the ID of SoftICE
* y7 {" U3 t) i# m: [+ _  ^. KGFX VxD." Y8 p, I$ N, |3 n
, s+ ?5 s8 m2 A3 n+ P0 u4 F
    xor     di,di
7 r# z3 T9 S2 Y    mov     es,di  Y. {+ p/ i9 [) m
    mov     ax, 1684h      
9 e: t" x7 B, k# T    mov     bx, 7a5Fh       ; VxD ID of SIWVID" P. w0 l6 ]* D% r+ M* S- p
    int     2fh7 D% [7 ^: p- c- L2 e
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
3 `- N9 P1 C/ @" @5 u    add     ax, di$ e& c- D1 b# ?6 J
    test    ax,ax% v7 \$ o, j4 ?( a
    jnz     SoftICE_Detected
  x8 ?) \; ^1 x5 `9 M3 W4 D4 F: e* B- U
__________________________________________________________________________4 \/ w; m/ D* v. O- m: S% a' N# |
! N# L3 L1 d$ y8 g
# G( u, ?4 ]& t8 |7 P# A4 P
Method 05
) d# [" V- c) Z/ W1 b$ h=========
; f% \+ z) D8 ?! l6 S- f) {7 r: X( c  h& V9 Y- B4 o
Method seeking the 'magic number' 0F386h returned (in ax) by all system
& d( u1 C3 m- Z& W+ K3 `  Pdebugger. It calls the int 41h, function 4Fh.$ N4 i  j4 g+ O& i
There are several alternatives.  
0 s( |/ S( s7 `4 ~$ b  R9 t7 t# N+ Q2 X, g8 ?( K  s3 p
The following one is the simplest:
# Y8 Z- C* y: u" A' {% ?2 V4 w, D3 T- J' T; M9 s( |2 v/ F
    mov     ax,4fh; g7 B4 |0 Q& Z* O6 M
    int     41h' w2 P% @) |, i3 E4 u
    cmp     ax, 0F386
0 W+ n/ o0 {  X6 @    jz      SoftICE_detected
0 x# f( [2 R8 H0 `) r+ [2 g/ W2 i# C( k

3 h# |$ Z6 n8 X2 q% pNext method as well as the following one are 2 examples from Stone's
- Q$ i6 i! ^  n5 T" @6 k"stn-wid.zip" (www.cracking.net):& l/ ?9 {0 y5 {; E+ B

' n! S. p8 T; H1 x% w3 ]    mov     bx, cs
& K: b+ B# g6 j1 v1 B0 c    lea     dx, int41handler2$ k9 q0 X/ m5 F  h
    xchg    dx, es:[41h*4]3 v0 m0 |: [' F- W5 C& {* N
    xchg    bx, es:[41h*4+2]1 H2 x; q0 J4 t" K
    mov     ax,4fh" J( m* j% N: s8 y- Y/ L- w* D
    int     41h
% h) B" ^# w5 V7 J  \& ^    xchg    dx, es:[41h*4]# q; N( ?8 [6 N3 M
    xchg    bx, es:[41h*4+2]
% S7 I2 P- @2 A& m3 h5 U3 T3 B" f    cmp     ax, 0f386h$ u0 h+ i& g6 R% l: \# b
    jz      SoftICE_detected
6 B5 x" S3 q8 i! x4 @% h8 Z3 c+ d3 e- O- b& B9 L, j% z: a$ h
int41handler2 PROC+ m( y$ H6 m& h' i- Z1 m. L: _  b5 Y! V
    iret
+ D/ M& c0 ~$ [int41handler2 ENDP
0 `' \+ ~5 C( g) |7 B2 s- c
/ _5 g' g0 a3 ?, A3 }! I
2 |; ~' b( c& l) M, v( U_________________________________________________________________________" I( i( ?- y, [+ E2 Z3 T5 |
3 k' I% i% T# V. q3 E" I

" V) |' t" w+ a- LMethod 06  }) k) [  R& }5 k4 X% s& ]
=========! R0 u' R9 s1 T+ {1 ~

" r- L7 e7 _) M: e& A! `3 s% _* N; D8 c
2nd method similar to the preceding one but more difficult to detect:
7 \: ^+ B) G' b0 ~: q7 {6 ]* N
# v* H$ T3 g& \7 O: J# L" _' X0 K( e6 }/ j
int41handler PROC- t* j' n  U$ p8 e% K
    mov     cl,al3 v( {1 P% R  A$ e$ V
    iret& e: P: X. [1 h# E- D2 _7 O- A8 c
int41handler ENDP+ W+ h0 x% I7 q2 {" p* ]

6 }5 q) l3 j& l8 W" y+ N  B" `6 ~% H% Z' \/ d
    xor     ax,ax
- \* H  g- J5 E2 b8 G    mov     es,ax
" o/ \% G4 w: R) @! f# ?3 d7 M    mov     bx, cs
# Y2 x# Q! S' z, O    lea     dx, int41handler2 D# b  K$ g$ s+ L) L% A( }' L
    xchg    dx, es:[41h*4]
% S8 o6 V) J  ]* V+ V, I5 k+ ]    xchg    bx, es:[41h*4+2]
9 e) J( `& [2 t7 x    in      al, 40h* J* q$ J7 M; @" s  X) _
    xor     cx,cx
. h3 Q$ W5 t  ^. \5 f8 @    int     41h+ }5 |! V  ~' _* k' t) v) o9 D; l
    xchg    dx, es:[41h*4]
5 ]0 {' R" G5 |$ _4 j. ]7 Q/ q    xchg    bx, es:[41h*4+2]
6 @% x5 l% X' W5 ]2 w1 M( X9 T    cmp     cl,al
  z% H0 X& F* P' L5 f* U( }    jnz     SoftICE_detected
# u% S3 G0 u5 K& q9 `, n! Z$ q# D  r( _  \
_________________________________________________________________________7 T: T5 I; k0 `- v  d2 C

- k1 W/ I* p$ O, S8 y6 ~- i) s& BMethod 07
- b9 s3 R. F5 E) _5 T. l5 b! w=========
& s+ f8 [1 |( K! m1 Z+ w5 n
4 d/ P9 h. L( I3 pMethod of detection of the WinICE handler in the int68h (V86)
% L1 a, J/ B. M5 O- B
3 S% T0 }- Y! v$ u, w  K    mov     ah,43h9 W# H8 y  I. |- `
    int     68h( z; H& j/ [- o; [- [
    cmp     ax,0F386h
* q8 B, M6 g& d) k0 K    jz      SoftICE_Detected7 v5 _. v$ H/ K2 v

" M9 d5 J% [2 P' e5 f. t# T# v4 Q
5 G3 R8 Z, ?' W5 i0 E7 P+ Q) P5 C=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
5 B# l; j5 \( G   app like this:1 f1 M& O' ]2 i2 A$ {+ K9 m
- O/ P; }. f/ l6 m" d$ d- B
   BPX exec_int if ax==68& H& G0 b3 a, W8 |
   (function called is located at byte ptr [ebp+1Dh] and client eip is
# ]- e' m3 c, d   located at [ebp+48h] for 32Bit apps)
  v3 V7 v& W' K% |+ Q__________________________________________________________________________4 Y/ y+ d% `9 S

4 y( H0 C& N5 D/ L; ]3 z2 Y5 o2 V& J  F8 H7 m8 v) \
Method 08
3 v! l4 n7 L& M  ]' O=========/ B- ^9 l0 O, ^. p8 \
7 @: K. J* h/ B# |" r
It is not a method of detection of SoftICE but a possibility to crash the" ^# I5 c/ M: V% K* ^% r
system by intercepting int 01h and int 03h and redirecting them to another7 N% i! E  T- ?5 T' X# C4 Z
routine.
2 n3 @' f! S0 C7 w% h4 c; ~/ IIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
  _1 h/ ?$ r$ u* }  W( @+ Fto the new routine to execute (hangs computer...)
! h2 ~! E1 N/ g. h9 I1 N% y2 F
: I0 w9 v4 c8 u2 M5 d- s- _    mov     ah, 25h
; ?, E9 A7 h! E7 V0 T. h; ^    mov     al, Int_Number (01h or 03h)
" _8 k% L) t. Z+ e6 B8 `2 m    mov     dx, offset New_Int_Routine
; S6 d: ^6 @2 i0 a7 H8 c/ G    int     21h, d" a7 Z/ {" V! N
5 p/ @+ e1 d& m
__________________________________________________________________________
; H: w: F7 V  P2 t+ h* e
# V: `9 o! c9 H- rMethod 09- {, r: J0 G! N% K- y7 K
=========
: F# u: M5 Q: g. \8 H: _
! E+ ^" q7 Q9 Z1 y: kThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only2 M1 q2 J5 a4 T8 U3 [
performed in ring0 (VxD or a ring3 app using the VxdCall).7 k/ W; R, A, _: n8 d  [
The Get_DDB service is used to determine whether or not a VxD is installed
: e" Q* j+ n( A3 P0 sfor the specified device and returns a Device Description Block (in ecx) for- I: E- D) D: R# z& c
that device if it is installed.
$ T! f/ g! O% g' t6 v
, e3 ]0 f. g; g- U: x. {( K0 ]   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID0 L. x% x# C# \& I' k" F
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
" w9 w( f- p( f7 }  h   VMMCall Get_DDB
# v  z6 ?" O( F   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
2 k$ P" U: ^( @; M* P) i8 i, V( U
Note as well that you can easily detect this method with SoftICE:
% o$ O5 g& P( q. F( @2 ]) r* b   bpx Get_DDB if ax==0202 || ax==7a5fh+ J; Q' Z' O2 z' H% \

$ r8 P! ]& v' T__________________________________________________________________________( Y6 j: l5 u, s$ c) O

  U. ~6 c% _9 l4 v  m8 CMethod 101 q! q2 y( V( \- A- S) ]  f# K
=========
4 m3 }4 l3 P& S. T  g
! V$ V) l% v- P2 T% ?  A2 j=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
4 Y  G) H6 `1 J6 x8 R  SoftICE while the option is enable!!
* @2 h6 Y  k# w; H* P/ s5 |) n0 d5 O( G
This trick is very efficient:
# i/ O3 W$ e8 U  Mby checking the Debug Registers, you can detect if SoftICE is loaded
! j8 f5 @9 v, y(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
4 ^1 Z& N3 \; a' hthere are some memory breakpoints set (dr0 to dr3) simply by reading their
" _; H* l5 Z- s- n9 Mvalue (in ring0 only). Values can be manipulated and or changed as well
- ]1 |# T: @2 U4 B- r. Q6 O' @0 H(clearing BPMs for instance)
" z% {9 t* D4 m) A! L2 A: f1 k: V! [
__________________________________________________________________________! @8 `! N" z' `: o1 r5 l" m

/ g  I! R- l6 K/ J* l7 U7 i7 VMethod 111 U+ n5 k  b$ W3 C3 j* }) Z4 ^- H
=========6 O1 ^$ F/ X( T: R+ k

- A5 K) ?2 d4 `7 O& wThis method is most known as 'MeltICE' because it has been freely distributed6 }( p7 r$ x$ \, r. G/ u/ W
via www.winfiles.com. However it was first used by NuMega people to allow
8 u6 Y# V! \" h- \* [: X# O6 c* y/ ESymbol Loader to check if SoftICE was active or not (the code is located
8 U+ X! Y9 ~) Qinside nmtrans.dll).6 H2 m4 c1 b" C8 R

' M* r; R/ w9 x5 z# P$ j7 t. KThe way it works is very simple:
/ T2 _$ r, V( Q( y: j# @It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for6 v  `+ Z0 m6 g6 d* ?, q1 v3 f% T
WinNT) with the CreateFileA API.# k4 G0 w6 q1 Z

% R. M3 R3 P9 x2 @Here is a sample (checking for 'SICE'):4 f. j3 [; _" h, t
9 I4 x: C, X* h+ @, }7 s. [
BOOL IsSoftIce95Loaded()
0 a0 l6 P, H0 ]. k{
6 h4 k4 a. w8 X9 f, O! C" R   HANDLE hFile;  - C+ L+ k9 |/ ?* O7 G/ h* k* n" l
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,4 w( D; Y2 b7 e! k% K4 F4 h
                      FILE_SHARE_READ | FILE_SHARE_WRITE,, {1 \5 d) d$ l
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
2 w/ i1 s" {4 L   if( hFile != INVALID_HANDLE_VALUE )
: {$ B# F# l% S; g' V2 M6 k   {1 |2 V5 V  L3 |6 a7 T9 C* [
      CloseHandle(hFile);
# U6 a3 c1 K3 m6 C. {2 m# D      return TRUE;$ i' }9 @3 _6 P; S
   }! j) l; }4 d6 r0 i! B5 S. N) |
   return FALSE;
2 d, [9 ~* f) ]- ^+ Y2 D. _}
. Z! b% V" {# u. F3 d) {- D4 A& P0 b7 L. Q7 o4 Q
Although this trick calls the CreateFileA function, don't even expect to be8 H2 o2 C4 M& T8 x- l- O! q
able to intercept it by installing a IFS hook: it will not work, no way!5 U' H4 `( t8 U
In fact, after the call to CreateFileA it will get through VWIN32 0x001F8 W# A5 O8 |) q. R5 \
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
- G7 l, a8 c8 {) g) q+ D! dand then browse the DDB list until it find the VxD and its DDB_Control_Proc3 \5 K( @: H( Y4 _4 ^, n+ q+ V
field.- s  D+ [$ j$ `+ `
In fact, its purpose is not to load/unload VxDs but only to send a 6 s# x( g; a/ J& @9 g
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
. v- Q) ]1 ^4 Zto the VxD Control_Dispatch proc (how the hell a shareware soft could try
* W3 Q" u9 S4 m# J* D2 V, Mto load/unload a non-dynamically loadable driver such as SoftICE ;-)., N  @) ~; j9 g) Q
If the VxD is loaded, it will always clear eax and the Carry flag to allow
+ H: e) m% K# m$ b8 Zits handle to be opened and then, will be detected.# R* S: I% R" i3 C3 U9 Q
You can check that simply by hooking Winice.exe control proc entry point
" Z9 f4 H7 ]4 L1 P# uwhile running MeltICE.
) s& c, K) t/ c+ O5 V" x  M3 R* L( w2 P& b

* G0 F; @/ ^9 Q4 ^  00401067:  push      00402025    ; \\.\SICE5 ]: p& E, g7 E1 C( J
  0040106C:  call      CreateFileA% d$ G# I* w" P2 h% d
  00401071:  cmp       eax,-001
; V  F" |: }! \  00401074:  je        00401091
8 k4 G! o* c7 s+ r+ z4 D& Y$ d
5 P& x7 d5 d, L% x' i* u8 n- t; Y. y. N% _! N& l) n5 {( s" y
There could be hundreds of BPX you could use to detect this trick.
2 k' @. L$ l5 h0 I) P9 v' P-The most classical one is:
2 Q" K. v- k* M" l+ X! u+ s  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
  d+ i6 t/ ^( @  t/ c    *(esp-&gt;4+4)=='NTIC'
' Y$ m  B$ ?, r  O) p2 ^4 w: ~; X! n
2 e1 ~  ^- Y9 U! v' y  Z+ H-The most exotic ones (could be very slooooow :-(, a( Z. |5 V- L
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
9 }1 W8 x' F- b; F1 s# e     ;will break 3 times :-(( W% Z2 @1 p% c- h2 m
& d; }1 d$ s1 z8 w* o" A
-or (a bit) faster: 9 e& \  ~! ~& ^0 ~; `
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')" _- w  Y( e& s! [
8 q/ |  A/ [# `
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
, m" ^  P, Q  T" I, s# W     ;will break 3 times :-(; j6 F8 n9 T1 v- \2 T& F
" J$ p6 S/ M: [) x0 m
-Much faster:$ b8 F! C. A( m7 `+ d
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
, ?: V9 U3 W6 u
1 P1 R: W  R8 I  G2 a1 y5 A0 rNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
/ n9 z; G, T6 \5 s$ g5 z1 B3 g+ W% dfunction to do the same job:
& ~/ l' D& M4 `, |1 O( {) ?- h& r$ s
   push    00                        ; OF_READ+ W* A1 s& E( {" X# X# T! q, u" E
   mov     eax,[00656634]            ; '\\.\SICE',0
+ R  o2 n) w/ B- {, l2 p   push    eax
( F# k8 S; U$ @- v* m. W  d   call    KERNEL32!_lopen! Z) E* X8 Q. n: b' x
   inc     eax
7 C; @* M6 C6 h& k; K   jnz     00650589                  ; detected- @) L2 i+ D4 _- j& [2 m
   push    00                        ; OF_READ% C8 O" p; M$ ^! ]' Y) w
   mov     eax,[00656638]            ; '\\.\SICE'
% C# q) a' `6 C! M. X. g0 P. L   push    eax
6 g6 _2 b! ?- n7 Y   call    KERNEL32!_lopen, ?$ ?0 r9 m. @6 P) S4 m0 x1 J; G) F
   inc     eax
$ {% W9 Z+ l# a& F- }! q& c1 G# ^   jz      006505ae                  ; not detected
5 Q, C' _1 `7 T+ }- I
3 ~; o. ~: n+ v( K; T# Q$ b1 `- Q/ g
) G+ d4 x# i0 o/ @__________________________________________________________________________
9 p, U$ }5 l6 J  y" V' k! _- q+ B, i4 P. O) W
Method 12. a7 a. p" `$ ?+ ~: e
=========
6 B1 F8 W/ E1 N! J8 D
3 z4 g7 A( d! g! ZThis trick is similar to int41h/4fh Debugger installation check (code 05' S' j, \: L) {& m+ }% ]* D
&amp; 06) but very limited because it's only available for Win95/98 (not NT). c$ w! F' q$ `
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.% J6 b- N4 W7 V, D5 T

* Q* e  k" [! P, N" k2 o9 @9 W   push  0000004fh         ; function 4fh7 f& y/ t) Z& q9 v
   push  002a002ah         ; high word specifies which VxD (VWIN32)
- s1 _7 F3 {5 S& O7 V' L( R% Y8 f                           ; low word specifies which service+ ?0 _' _3 s/ a, s6 t7 ]
                             (VWIN32_Int41Dispatch)( v! k7 c' z7 u/ g
   call  Kernel32!ORD_001  ; VxdCall2 G- W8 b! n8 q* _+ T4 Y
   cmp   ax, 0f386h        ; magic number returned by system debuggers
4 z' F) s/ A, {6 M. H: U   jz    SoftICE_detected
0 c# j3 Z% Y! q0 v7 P( l' i) @- [6 H1 ]* f5 W4 i( j
Here again, several ways to detect it:
) s2 f3 u6 F1 `* \( u/ d  q6 e: S$ L  m& e3 Z4 s; F
    BPINT 41 if ax==4f0 `6 c8 f1 C- w- i' l4 W

) m1 v$ w% }, ~    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one
7 K+ e/ s( ]$ p$ K( X4 e, W% m& N; l7 s; n7 Z% l7 m; p7 Z2 w, S( y7 i
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A6 ^, d4 h' M/ |. _- r. P) g3 d

3 l% @2 h4 P5 c" a5 k    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!! \% k+ Z) P) m# \' N, l0 E
& V" B0 n7 {; o4 a
__________________________________________________________________________
( P; E; }( s# R/ D
/ v  {; @$ y$ G/ o# R( q9 {Method 13" W& f' g  L+ `" b1 W4 E
=========
1 [% {( S5 B1 y" r6 J3 l$ P) {9 v- o9 N8 V$ R' }9 H; f
Not a real method of detection, but a good way to know if SoftICE is5 w" Z1 @$ V7 w' d( }. c
installed on a computer and to locate its installation directory.
; u2 S! R2 @. m& @1 }It is used by few softs which access the following registry keys (usually #2) :2 c6 B2 N, j: a

2 E+ c1 j! x* {# V-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion% G1 g' E2 s8 m
\Uninstall\SoftICE, l3 Z% [  t" r8 s6 Y
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
! b- \" n7 c* F3 K3 Q-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion, C+ q9 K+ o# [
\App Paths\Loader32.Exe! j/ e, E" }) r5 x. `% _
" o0 E% D1 h& [7 T3 l7 A* W+ d; n& T
) ~9 e/ J8 ?: A0 g8 w$ a$ c, r( B
Note that some nasty apps could then erase all files from SoftICE directory
" S) M. D1 f. f4 Z, R(I faced that once :-(8 N6 v2 b/ j+ }5 G! x1 j$ P

% k$ z" l5 G& g2 cUseful breakpoint to detect it:) M, I0 q3 u9 {: P+ M5 `$ q

/ C3 F! ~6 W& k0 L9 R     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'; j! Z% w' ^6 F' D2 n% B% O% M/ d

3 ?" K( y% U, h, u__________________________________________________________________________
1 ^8 N7 T3 \5 N! y+ T) K; `
) ^6 E8 _+ v; h$ k) g- M3 x6 v' K6 c
Method 14
/ E. U' ^4 I; e& F7 m5 J=========& }% W% r3 l: H! o

* S  @3 n( }- |0 M- L% ~A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
, h% Z$ K+ c& j, {* Bis to determines whether a debugger is running on your system (ring0 only).9 L' |+ F& v% n5 b7 a  M8 W+ f
# j% M3 D- U2 l
   VMMCall Test_Debug_Installed  d( i) @- i( E; X) C+ @! S" g& k
   je      not_installed5 N1 v" t- S% B7 f; `: }
2 v% _9 @: Z, y3 l
This service just checks a flag.# W4 J0 n% [3 {7 ^0 l
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|本地广告联系: QQ:905790666 TEL:13176190456|Archiver|手机版|小黑屋|汶上信息港 ( 鲁ICP备19052200号-1 )

GMT+8, 2026-8-17 07:37

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表