About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
  U8 K9 v+ A- d. [0 z<TBODY>
$ \" Z' N5 E% Y3 c4 v0 D$ }) z<TR>
: u. C3 V* h8 E! P<TD><PRE>Method 01 ( d( M, i4 Y1 T3 ^9 Y9 l
=========
; m; f1 S$ I  v% v& ]& p0 o: b, ^# |7 {3 d
This method of detection of SoftICE (as well as the following one) is
; R- ]1 H: E% e0 qused by the majority of packers/encryptors found on Internet.; e4 X2 w% ~+ P+ X/ R5 v# y% N5 B
It seeks the signature of BoundsChecker in SoftICE
  ^6 }) @. S3 X
+ c/ u- W! ]2 V, c    mov     ebp, 04243484Bh        ; 'BCHK'7 y, K; }3 F7 M+ i- b
    mov     ax, 04h
# F+ m: t: _8 v  f    int     3       7 `8 `7 L; }6 _6 _8 a( S
    cmp     al,43 R% a0 c- v1 s  T
    jnz     SoftICE_Detected  V$ k. m% D4 g# C3 Q3 s
8 C; `' h) n  |! J6 B" d
___________________________________________________________________________
$ @6 K6 `' z; f  ^  b5 Z* W' C, {/ c, p: _" [# _
Method 02; l$ S0 x% S) e5 B5 T0 C+ E
=========+ S9 |: H- f5 Y; N
4 }: w4 S7 \" `
Still a method very much used (perhaps the most frequent one).  It is used. Q# t) Y9 X0 d: M5 |; d
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
* W) @% p1 @" g$ [1 @8 mor execute SoftICE commands...3 s. |% l8 f5 @2 T% W
It is also used to crash SoftICE and to force it to execute any commands' i9 n7 U6 u& |# O/ `/ r2 C- k3 h, j
(HBOOT...) :-((  
" w1 N4 r8 t/ R
/ y3 x$ q5 o: G1 N! ]% W. z5 pHere is a quick description:3 ~/ U; s4 r, @+ T' l
-AX = 0910h   (Display string in SIce windows)1 `, f7 z9 g& c; q
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
0 \& n7 v: B! y. k-AX = 0912h   (Get breakpoint infos)
% R2 [! _4 {8 ~- P0 J: Y; T-AX = 0913h   (Set Sice breakpoints)
( U% `: \. V, D-AX = 0914h   (Remove SIce breakoints)
1 g; R) k6 x8 M+ I# M  w" Z- _, t3 l0 }
Each time you'll meet this trick, you'll see:2 x# N' \, Q0 b7 j* q: O
-SI = 4647h. W; k, Q4 @& I1 Z$ Q
-DI = 4A4Dh1 d- G! R6 C+ W5 x! ?5 u: O7 V
Which are the 'magic values' used by SoftIce.
7 y- b) R$ t" j0 ~1 \* c' lFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
; l8 c$ P0 Y0 D, b5 t  a! _
6 ~( b( _6 Q  p0 U) \" iHere is one example from the file "Haspinst.exe" which is the dongle HASP7 \2 @8 a* I4 a: g
Envelope utility use to protect DOS applications:3 s3 g1 V7 P0 }; J

* G5 K) X; n9 o5 |( H
8 V9 t, G3 y1 E  C* ^# W( e4C19:0095   MOV    AX,0911  ; execute command.- J: [) w' y7 m" n. r1 |
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
' z/ M: k. `9 t  A: j. j4C19:009A   MOV    SI,4647  ; 1st magic value.
: B8 |$ P, [3 A' T3 p0 J8 b4C19:009D   MOV    DI,4A4D  ; 2nd magic value.3 u  [' p9 Z; _: ?5 i
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)1 h- [& V* y* x# C3 R2 D. R
4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute7 Q5 K& i' e1 s9 w9 _* s
4C19:00A4   INC    CX
' D- B* x% }/ `( L' N4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute0 i9 g' J, ?; O+ K2 D
4C19:00A8   JB     0095     ; 6 different commands.* F$ z! e. A6 R5 o. @; b& T
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.1 ^; A  n" R$ R1 D$ Q3 ]) N
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
4 r0 j$ v: d0 X
  `# N8 e% ~$ ?2 k0 l, v; c/ |' sThe program will execute 6 different SIce commands located at ds:dx, which* F3 B% Y( m2 d7 k7 @( q* x
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
7 m/ v" N3 e3 {) w) Q& {' D
* A# s$ b$ o, _# b8 r* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
+ k# o& h* w$ @6 C  S___________________________________________________________________________& V) }' _5 |& {1 W5 X
0 g8 Q' Q6 X/ a

! [9 }( X& c& E6 @# j% U" ~Method 03" q& g9 J2 f$ K0 ^1 d' x. X8 [
=========
2 U. Q' t) D1 h8 H8 t5 N+ ~0 l& ~3 ?* r& D
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
1 d, ]8 ^6 [2 X( Q$ }: O0 ~1 ^(API Get entry point)
/ F3 j7 V8 x* d" P7 u& [! p. ~! {        
: `7 p7 \6 k% m& D0 r8 }) F) w  P1 G* x% S7 x
    xor     di,di; R$ I  _8 y1 x6 T2 o2 P% ?4 \
    mov     es,di
- u# W% d$ ]) f1 |9 L- L    mov     ax, 1684h       $ a* v  k% d2 \2 Z
    mov     bx, 0202h       ; VxD ID of winice
; D9 u3 y8 [5 V6 d5 h8 ?5 l( U. R5 [    int     2Fh4 ?' L1 j  f( v, D
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
' }+ ?5 `! R4 j  a: Y    add     ax, di
6 Z# |" q) n6 a1 L( F0 ~    test    ax,ax0 ?/ [8 S, _* X- H! i0 r
    jnz     SoftICE_Detected
; D7 P0 E1 e; s2 }9 I" ~' M) ~! j. T! Z* K5 c4 e) v* u% S! I  n
___________________________________________________________________________5 D) R& F5 Y7 f
# F  S3 c& ]6 M5 G
Method 04
2 b- e% n$ i% q! m=========5 z4 M3 G. H# O! g* i
& h+ W" b* _: O) v
Method identical to the preceding one except that it seeks the ID of SoftICE
4 n% i5 n6 r# K' ~2 K- v  tGFX VxD.5 A4 Y9 l  W0 |7 @2 j* t

7 l" E  Y/ o7 @2 [: U  F    xor     di,di
+ E# E. G8 g7 i    mov     es,di
+ l' T/ Q; G9 w! ?    mov     ax, 1684h      
4 U# E# Z& a# u3 \( ^9 z% ]% R) E    mov     bx, 7a5Fh       ; VxD ID of SIWVID$ w) X3 B/ O3 n- E4 P
    int     2fh
, n5 u1 {' ?3 D4 I  e$ T" J    mov     ax, es          ; ES:DI -&gt; VxD API entry point6 e0 _! P8 O5 l$ d* Q" T
    add     ax, di
) b9 y) E# L+ _9 U/ z8 c    test    ax,ax
: e4 _/ [& D2 \/ x6 y4 _    jnz     SoftICE_Detected
# W: {, ?# W% ]' L  c2 H" ?1 ~5 l. u6 w2 i0 f
__________________________________________________________________________/ [( J- k, _1 p7 C, w2 ?4 R# x% s
2 E! E& J0 i, _- y9 u% K  x$ k
9 y8 \2 O+ {$ J% H9 d. r
Method 052 U6 g: e* g! }. ], k. c5 m
=========4 b6 e2 y  R7 [0 z2 j+ z( E

2 D" T* e6 h1 j" f2 k; {$ |9 kMethod seeking the 'magic number' 0F386h returned (in ax) by all system7 E* P: B4 P" `& ^% M' w3 p3 q; k5 b
debugger. It calls the int 41h, function 4Fh.3 l) t* m# p/ I* A" B( w7 l7 A: a
There are several alternatives.  ! c, r: Q" ?' r0 J4 f9 {- }
# A4 N0 _* j( Q7 {5 R% ]
The following one is the simplest:
& w  R3 z3 ?5 r
. M" Z* V. c' L- `5 e, _9 C    mov     ax,4fh
; L; S4 @9 J1 j$ A  G    int     41h: l* f* t7 Z2 c4 M% }  F7 Q. s
    cmp     ax, 0F386, I8 E# J0 f* L+ \5 u; G( ^& n
    jz      SoftICE_detected
$ d+ b4 {" u, c- Z+ u, y
$ C. \' \( }6 ~! n" N2 c, @. x( }8 x' z* Z
Next method as well as the following one are 2 examples from Stone's + Z) F$ {0 _1 ^: B6 A% S6 q* R" N
"stn-wid.zip" (www.cracking.net):
: B! n7 x4 J  l0 v7 R7 p) o1 Q
  U  O2 O# u  x& @    mov     bx, cs  q; N$ V6 v- u  L4 e) N
    lea     dx, int41handler22 N4 E$ E8 y9 y- [# T: A' i' J7 L
    xchg    dx, es:[41h*4]
( w# N* q* U8 L* E# O! f    xchg    bx, es:[41h*4+2]
7 f/ c& J. d) \( D$ P. y/ O2 r9 S    mov     ax,4fh8 d, p% m2 Z$ t$ U/ |! h/ i! k
    int     41h2 y- o' l, c$ x' |
    xchg    dx, es:[41h*4]  x! x; }5 }- w% v. i4 E3 e7 ~
    xchg    bx, es:[41h*4+2]4 k$ }6 a# [+ p9 \
    cmp     ax, 0f386h
' @4 a, M) m9 X' i. |    jz      SoftICE_detected! s. e# x! j# M+ `: |- Z- o; Q

, n4 K+ T" W" J, Vint41handler2 PROC+ {5 D5 q+ Z+ K# t7 I, v( Z. L
    iret
" H5 A4 B% x9 D0 E, h- Jint41handler2 ENDP4 X& z* Y' C# i1 I; {; B6 l, g0 h. `

. G! d$ n# _- `/ F9 C* P2 X' h
) n: ^4 z8 F# P  k2 B_________________________________________________________________________  }. C& g1 F0 J  N# w; f; y$ Z

8 E) Z' A9 o% m
6 r' Q. a/ r% {, pMethod 06" S3 G. y. S6 B8 W$ Q  ?, S
=========5 |$ H1 e; s2 _% E7 C7 @2 S
0 E" a5 A* z$ p& {/ M+ ^8 s2 ]
8 u/ A  S( v" i! ^3 K0 m+ P
2nd method similar to the preceding one but more difficult to detect:" m4 d/ t1 u0 G! m( `; Q; C- H) p

' I, R7 f0 I- T/ _; I4 {7 X' L/ U' M$ k
int41handler PROC# I% ]% i7 f1 C% R: W4 U
    mov     cl,al# _) g2 g! K/ x# B+ b
    iret
7 ], w" b, t) ^$ pint41handler ENDP* R3 O! ^0 m7 K  |/ ]; P6 C
& p# S& [  [# T. x0 i1 z+ {
4 v, i( g) D4 X" p  f
    xor     ax,ax5 G9 @7 F7 d3 ]) m# X
    mov     es,ax
7 S3 m* k7 y; N$ ~1 _& V% g( c" R    mov     bx, cs
+ ?( Z# B/ P6 t4 |. G    lea     dx, int41handler
! b1 a4 o& `: G2 C- r" A2 f5 w) }    xchg    dx, es:[41h*4]( g/ D% @7 W5 S, ^
    xchg    bx, es:[41h*4+2]5 f* S9 [% X4 G+ L$ N
    in      al, 40h
1 @* X; q* y* Q& Y0 e    xor     cx,cx
, a" b& Z: j0 V: y3 W. r3 O    int     41h0 e9 s0 n& p; ]/ S" w- Z
    xchg    dx, es:[41h*4]) o9 O; i, x; k+ V& d0 ^
    xchg    bx, es:[41h*4+2]
) r# ]* ]7 R) F; e, ^9 g    cmp     cl,al
# C; }$ s$ J3 [6 ^& y6 h  }    jnz     SoftICE_detected2 ^5 _" G  I4 V. R8 r  |! t

" d) K& F4 P  U_________________________________________________________________________: `+ R& D8 p/ F5 R" q$ p
2 x  f6 m; ]* ~2 g: b) X
Method 07
6 D6 d2 j! X5 o=========- P3 z6 A% g. F6 e% @

  Y8 _2 k' g3 TMethod of detection of the WinICE handler in the int68h (V86)3 C0 J5 R$ a! h4 Q

3 K; J6 D+ K( P/ N" z    mov     ah,43h
* q* S& T: t1 S$ y; J7 V  Y1 P    int     68h5 [6 L5 {. m  n3 H% `
    cmp     ax,0F386h
9 P2 w# @) _% e    jz      SoftICE_Detected
1 {4 A( s" i0 `3 P+ y: \; {& ?8 V- t- X: w7 Y; y

) o0 _" S% f5 i2 ?; j  j=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit$ v( y- w9 ^& H, ?8 D
   app like this:! M2 _7 [5 @* I+ [
( I; h: L" l- D( M9 v: \  I
   BPX exec_int if ax==68" ^! u1 G: Q! N
   (function called is located at byte ptr [ebp+1Dh] and client eip is
' V/ J& b$ R5 o3 }9 _4 f/ A   located at [ebp+48h] for 32Bit apps)
& m! |. P1 m( h3 G& |& C$ q) `__________________________________________________________________________2 D, ^! D4 `, M4 E. b

) w7 h& ?+ j- V; Q4 v( }8 w+ j; u8 p) \, x/ n
Method 08
( @; }0 g6 F# n* ]6 c6 n=========
( q# m: |% W8 ?# v1 h% q. L7 m: e$ W: R: v( L
It is not a method of detection of SoftICE but a possibility to crash the; X" k7 s& M8 [, L+ g) J* F
system by intercepting int 01h and int 03h and redirecting them to another
+ c3 S( c2 m( O8 ]routine.& t1 E& i9 v% j+ ^0 r" c. W, g
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
% }# A  {/ r0 f% O& n5 eto the new routine to execute (hangs computer...)' @5 u: F/ K5 @

3 A; J# Z$ N  ?  `6 m    mov     ah, 25h
7 u: q6 W3 B3 Y    mov     al, Int_Number (01h or 03h)6 q% _* e$ l% R5 r+ D% b, T
    mov     dx, offset New_Int_Routine6 K0 {; q3 K6 p( `+ h; z9 x* A
    int     21h$ r2 h3 N9 Q  b1 e6 H: S

, O4 L* @. x. _& A0 {9 s# |__________________________________________________________________________. A: q5 s: G) Y3 J* ^

+ V3 C, W9 o: U+ f& E# S  }Method 09
( A1 ~  y) d: W7 T; U* D=========
( i5 f: N" o3 e: J
- t5 _% A6 i+ B9 R; E' {$ uThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
# B. q* b; @; I( o3 Hperformed in ring0 (VxD or a ring3 app using the VxdCall)./ O  I$ o0 T3 I/ ?! h% o2 w
The Get_DDB service is used to determine whether or not a VxD is installed
) L8 Y/ _9 G& K2 s' bfor the specified device and returns a Device Description Block (in ecx) for% @" _  Z2 `: n8 p0 y7 x
that device if it is installed.. p" q$ z: \' `# l; x; A/ P% w

! ]' L( w9 Z4 O9 w8 c' n   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID) ^# P$ O9 ?" W+ E, j. U
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)* h" X, [2 |, s5 k& p
   VMMCall Get_DDB0 A- C) o  h) k
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
1 |  M6 ~4 l9 P
+ _  P7 M: w7 c6 X. P% \Note as well that you can easily detect this method with SoftICE:
. }( H; x/ v" l3 w+ {   bpx Get_DDB if ax==0202 || ax==7a5fh
# u! w. K9 g8 u+ [' ^
$ z8 D6 s0 x" j5 D" c0 K  a/ V__________________________________________________________________________
, h7 |; {; ~" K6 K
9 @2 J9 u7 ?6 y$ vMethod 10
. F2 V; |  R* X+ R% q. T' a5 h, Q=========$ p5 f1 M- c5 r- J4 L" u
& `) y$ Z+ Z; {1 R( j
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
. [/ l2 S' i" x  SoftICE while the option is enable!!
! ~; }& M( y8 S  f5 y: s/ B- W7 ~  v' E; W% B+ Z! N
This trick is very efficient:* J" j9 U! F& t0 Z' b- H( D
by checking the Debug Registers, you can detect if SoftICE is loaded
/ t1 N7 ~, t5 F3 Q(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if6 [3 ?0 ?2 i1 O: R6 t3 c
there are some memory breakpoints set (dr0 to dr3) simply by reading their* |$ x9 Z4 O+ ^( ^/ u/ f
value (in ring0 only). Values can be manipulated and or changed as well
  D' O/ p/ e" m0 d* c+ j0 ?(clearing BPMs for instance)
2 Q9 |. F/ ~0 m2 h8 q4 ?! k5 g( ?1 t+ U$ o* L* z; p
__________________________________________________________________________) _8 Y% m7 r( A+ S  H* S
) X: Q+ D) ?' y+ \/ L' t
Method 11, \$ a; X+ G; F: H" F. H
=========4 b  f3 m! w! n! {, S) j. ?
% n& _1 Z1 W: q6 k: B8 W9 _- A: B
This method is most known as 'MeltICE' because it has been freely distributed- P9 @" d% g/ W3 n" W) N
via www.winfiles.com. However it was first used by NuMega people to allow
3 p8 S' I- A0 TSymbol Loader to check if SoftICE was active or not (the code is located
4 M# {/ b" B+ K$ S2 o2 pinside nmtrans.dll).% _1 ^$ A1 Q4 J: Y
9 {! p9 Y" \: ~) C! S- w0 A# ~
The way it works is very simple:0 u1 N  z8 U( n7 ~4 ?3 q
It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for- W1 n# g& u1 d& F4 @
WinNT) with the CreateFileA API.# N# q' ?) P1 c, _8 v* c' I* S

* w3 z% q/ n5 P% [( n9 s2 [Here is a sample (checking for 'SICE'):- n( |- ^* W: W# q" b6 C: `

  ?. F! M, ]2 Y& |, u% G+ c% y/ SBOOL IsSoftIce95Loaded(), o7 t0 S$ m/ o/ Q" \+ k" Q& ^
{
( D& N, W) `/ D: `   HANDLE hFile;  
( [4 S7 Y# p9 j* c$ I5 v, W7 h   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
/ j0 B$ ~6 m5 l( w- ^# Y( }( y                      FILE_SHARE_READ | FILE_SHARE_WRITE," O1 T  |; o% w' z
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);" k8 i$ s: I6 l6 P3 J% w
   if( hFile != INVALID_HANDLE_VALUE )0 B0 I  C8 h; W6 p- q2 G6 K: L% @
   {
5 N, o# k" C; w3 o% `: x" V2 \, z7 k6 v      CloseHandle(hFile);- `) c4 O4 q+ t: Z8 ]
      return TRUE;0 O1 f' E, |- m' M5 H: s: L
   }/ }4 W- q$ W- X8 t. t
   return FALSE;
+ q9 }/ I! h, r; }+ n' w0 h}( C* r4 {% B% P6 ?2 y& H

, {6 ~/ r0 U# V. }5 A) y6 o$ A, o% L$ lAlthough this trick calls the CreateFileA function, don't even expect to be
+ i0 }; E7 _, H" K2 }able to intercept it by installing a IFS hook: it will not work, no way!) P1 s& H/ R! O( h+ E" Y, ^8 k+ a
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
( R% b3 d# H/ j) _service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
# n' d' F( O( k* Y$ Gand then browse the DDB list until it find the VxD and its DDB_Control_Proc
# I# s/ y( ~) m' j# }* E7 ufield.
  o* w8 S2 b* ^: e2 l% m  D$ oIn fact, its purpose is not to load/unload VxDs but only to send a ! z4 y3 y9 z( w' [  |8 c
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)
! f" ~3 }+ Q$ X9 |- Q% Zto the VxD Control_Dispatch proc (how the hell a shareware soft could try
" l( `) G% D+ Rto load/unload a non-dynamically loadable driver such as SoftICE ;-).  [  H0 Q, g- }; t. }' [) n- g
If the VxD is loaded, it will always clear eax and the Carry flag to allow; x% U& `0 a+ U6 m
its handle to be opened and then, will be detected.
' l9 o5 R3 h( n. A' y: p. l6 JYou can check that simply by hooking Winice.exe control proc entry point+ E; Z; f5 u3 a- ]
while running MeltICE.
8 `6 V3 O* I2 s# Q0 M/ j, H' W/ K6 }1 z" D
; G& s8 a" C8 j( {- X8 P
  00401067:  push      00402025    ; \\.\SICE
5 q4 t; \7 o3 Z# k. q+ l  p  0040106C:  call      CreateFileA
4 v. t- ^7 j% ?3 [! v  00401071:  cmp       eax,-001( G9 G- I8 w, c# o
  00401074:  je        00401091
! s: b( `; f. v% e6 x% _
& s+ Y2 e" E- J( n/ z* A3 Z$ J
. L; b; {& v1 E6 L8 HThere could be hundreds of BPX you could use to detect this trick.
* J9 q0 D" S% Y2 L! p! K5 b# L-The most classical one is:
" U+ _* r# u5 M! g* N3 T  q  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||, }& |  @# _; f* Q
    *(esp-&gt;4+4)=='NTIC'
" |$ b3 X# C' G9 Y+ t, {4 M: M0 m9 E3 K; M- i
-The most exotic ones (could be very slooooow :-(
1 k7 d: Y! D" U- f3 _/ c  `   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  8 L& _' g) n7 {) ^7 B) v4 M3 V2 b
     ;will break 3 times :-(
  t: x' K# D1 j  Q, h# p! T- y0 S1 W2 H/ V5 b/ [; t$ N/ h: u
-or (a bit) faster: 6 i9 F* U: s2 C! Q4 q2 c
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
0 T5 }5 P6 G# o
. j( y( t% k. D3 c1 V   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  . E& V7 {' S/ |& S, J: V( l  C
     ;will break 3 times :-(/ Q% b. r( r2 E  Q% y9 F2 B7 T
% o* ~5 o) C. v" m* e$ s" S! q0 y
-Much faster:
; q& S9 i2 E3 M  g   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
, N/ [4 j  ?+ V! N2 y/ ?% Y
0 g; i7 |" H2 S1 j  _* a# xNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
+ e4 K, D, {, t" |; m; cfunction to do the same job:# k; r: @1 U  Q" a. w8 i8 J
! G0 w& z# w. M) T3 }/ Y
   push    00                        ; OF_READ7 S6 t: P& F6 Z; O: R0 O$ K
   mov     eax,[00656634]            ; '\\.\SICE',0
- l0 q- a# _& L8 E8 E- D" f   push    eax8 u. D: j+ C2 F% Y+ k& [5 D6 E% m
   call    KERNEL32!_lopen
. `; \& p9 k4 i7 r8 y4 B( @9 b   inc     eax9 F: ?' w% Z' Z' i9 ~' t( c' z9 t
   jnz     00650589                  ; detected
6 Q' o$ F* [* x   push    00                        ; OF_READ
  n  F8 h0 K) ]" Q- Y- T" V   mov     eax,[00656638]            ; '\\.\SICE'
: W- }. \, A1 {- s; S4 B4 l7 p# x   push    eax
! l9 k: t% |# d   call    KERNEL32!_lopen/ U% ~3 M* V, B; \
   inc     eax  l# I# g# q, x4 y
   jz      006505ae                  ; not detected
: W' }7 `( f; b5 t) m; X& U) a" `" p) p
( V) |4 M$ }6 Q/ i+ q5 Z
__________________________________________________________________________# ~& D* R4 J( p! l

/ e- r- D) b7 O1 OMethod 12* Q6 R; U! G/ m+ s
=========$ t6 @% l: i% @/ v% L& @2 C1 \6 s
  j4 }& ~" R7 o0 T* X: ^' L
This trick is similar to int41h/4fh Debugger installation check (code 05
. u' O  r  ]" ~' q1 I5 k0 s&amp; 06) but very limited because it's only available for Win95/98 (not NT)
( n2 {& \  k: ~, O% ]/ }* M1 J# oas it uses the VxDCall backdoor. This detection was found in Bleem Demo.6 {+ M4 r" L& L- e6 A$ P. t0 m; x
: r9 o- B" `7 q( T
   push  0000004fh         ; function 4fh
2 K' ^; r2 l1 z3 x0 a   push  002a002ah         ; high word specifies which VxD (VWIN32)3 s& L) J3 N3 E: ]
                           ; low word specifies which service; l* E: y9 u. G. A+ B
                             (VWIN32_Int41Dispatch)& t; ^2 X0 J/ S% m0 u
   call  Kernel32!ORD_001  ; VxdCall
9 F0 ?" M  x+ S8 K   cmp   ax, 0f386h        ; magic number returned by system debuggers8 @  n+ S! T5 F9 F
   jz    SoftICE_detected
4 a/ A# d/ [. s% S8 Z: u" S( e9 A5 M3 b2 D# c  x7 I+ |. f5 k7 ~$ U
Here again, several ways to detect it:
: n: h2 c8 x4 }3 b: J( o9 ?' s) t5 z3 |0 k- @" K% O
    BPINT 41 if ax==4f& R4 [5 g. L8 T

' s  X5 Y/ T+ t" Q    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one- S& v- x) f7 X$ Q5 X7 i1 l2 G
7 D) Y/ n+ ^# Z; @( W0 Z
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A5 _$ C, F, [# T! [: n( ?
7 D: O; F2 b8 O0 v* A9 _' l
    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!2 q) `8 D' G5 Z2 u! b
. G$ q  ]: J( w1 A( s. t* C3 A
__________________________________________________________________________3 m& X+ ?9 D+ I( Y

" \2 [. f: B+ h% j# PMethod 13
) C. B* u& `, M! U/ O=========
: h9 E* A, ~- x" J. Q- I
; m4 c& P( O5 I# gNot a real method of detection, but a good way to know if SoftICE is
# n+ d  r% q) `) A: q& ~installed on a computer and to locate its installation directory.
& O% X% e( u  @. CIt is used by few softs which access the following registry keys (usually #2) :9 ~% t, S# D4 Y
7 _' S% N$ x7 H" c
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
: g  [1 S; a) d7 F2 |- `, V" t& k\Uninstall\SoftICE7 i# v" f; G5 t
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE' K/ B& G: l1 Z+ R' j
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion5 A/ a$ j" }  N; \5 F& J( x
\App Paths\Loader32.Exe- H3 f1 W3 D. ]* D# [( F

4 k; l. \+ X" q3 m% D% [
# |( Y5 G/ {$ b6 ^& i1 DNote that some nasty apps could then erase all files from SoftICE directory, Y+ x6 k9 t7 M2 O  |/ j3 \3 |5 V
(I faced that once :-() S4 E  S+ O+ t4 |; z- X

) b. W1 \+ N3 J- h0 @Useful breakpoint to detect it:
6 J: s% R6 |$ y4 F6 i! j
" ~( b& z: X" [7 v- m) \+ f+ F     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
$ |! R) O6 Y1 _( x5 z) E7 S& G2 W" F9 g/ N# r( v
__________________________________________________________________________
" N6 F/ K$ ~7 E* p
1 ~9 j6 q, x: R2 V& R/ b0 `
& m: |1 F+ R6 h" `Method 14 : r$ A- o! v% |+ l1 _
=========
( H  a$ v+ ]" B3 c. Z& N# ^* z1 V
$ p$ L* J- w* v: j/ F4 ]2 f4 vA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
  M" S1 k: \& a5 R, T7 q' J' ris to determines whether a debugger is running on your system (ring0 only).; l1 V- ]0 b7 f% I, Q! `
0 D/ T) ~! [4 [# J7 \# r
   VMMCall Test_Debug_Installed
/ ^5 t5 I, b6 G( l9 p3 l   je      not_installed7 V6 d; b2 I+ i* m9 b
" [% k! s+ E; K6 t6 _
This service just checks a flag.9 a! f% T" o( g
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部