About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>: R) A  F/ v* ?# J# m, ~3 |
<TBODY>6 V2 `/ g$ Z- C5 e. Y3 c
<TR>7 s; _! ?7 H5 R  F* W6 P
<TD><PRE>Method 01 . i$ S$ T1 f2 |* N* S
=========( U2 U6 c5 W# C% t- g
. `  w" h1 u: m# A6 M  s& h
This method of detection of SoftICE (as well as the following one) is. y  F' Y' @7 g4 Q+ O
used by the majority of packers/encryptors found on Internet.
* O- G; v6 Z" a4 G$ M% SIt seeks the signature of BoundsChecker in SoftICE
" `  S6 h! b. K% B4 B, E$ t+ d% c& K
    mov     ebp, 04243484Bh        ; 'BCHK'% f) A6 R6 X: P, k' V
    mov     ax, 04h9 l8 r& Y: a: B% y% ^
    int     3      
7 k! Z5 g. _& B. X    cmp     al,4
  B, J) {4 d% X    jnz     SoftICE_Detected
" Z* o$ @7 W7 m0 G4 F, R# i/ M+ W" x4 J3 U, Z- ~% ^
___________________________________________________________________________' o- l0 N! @. g4 C+ Y

0 C% j6 x: ^& n% K. T' nMethod 02! L: L5 `! O! u6 q' m1 ~% f+ c7 @
=========
% E5 g8 `0 Q0 v
. u: E; u0 M* O& m& }1 B, p; _Still a method very much used (perhaps the most frequent one).  It is used) q' I. M) y* i& C
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
/ w* i% {  ^: W. @3 Gor execute SoftICE commands...3 T4 n! }) O( \" T- }
It is also used to crash SoftICE and to force it to execute any commands
/ ~8 z2 w# k6 }6 m+ R& J1 V& {(HBOOT...) :-((  . S9 O0 D& I' y3 Q: N& n+ z' `
- q  o8 S; m5 p% n9 _0 l
Here is a quick description:" r6 l" B: s$ J" Z( z' c% w; e
-AX = 0910h   (Display string in SIce windows)
2 I" u) ~1 O3 ]: o% d8 U-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)
6 w- x) z8 ^# R  m  u-AX = 0912h   (Get breakpoint infos)
! U2 R* }) M# Q7 K' u-AX = 0913h   (Set Sice breakpoints)
% t+ U  u4 z- _0 v-AX = 0914h   (Remove SIce breakoints)! A+ h9 m, P/ s9 k

# q: B, ], ], J! c1 I/ w0 iEach time you'll meet this trick, you'll see:9 `# T) G0 ^; X# `2 j
-SI = 4647h
3 T" b* M: V* V4 X4 \% b-DI = 4A4Dh5 C) u4 O7 S& ?
Which are the 'magic values' used by SoftIce.
7 C0 b# Q8 ?+ |, j  FFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
1 h* W8 o4 |4 N+ j
5 v7 g6 {3 u8 z5 J' `8 W% yHere is one example from the file "Haspinst.exe" which is the dongle HASP7 F8 q0 U9 h# ?+ K, @
Envelope utility use to protect DOS applications:1 p1 C$ Q# N. o- [
* ~) R' H% }8 D  {% ]6 m2 U

7 D6 c, K3 O# c1 g' r8 Q4C19:0095   MOV    AX,0911  ; execute command.: e9 @3 _" ]: v7 j, N2 B1 g6 T
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).0 B/ U% L2 W* O9 ^" m( O( F
4C19:009A   MOV    SI,4647  ; 1st magic value.7 {9 P* v9 S4 \& ~& V7 S  v
4C19:009D   MOV    DI,4A4D  ; 2nd magic value.$ t  P: [1 @1 l* o
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
/ v+ Y' |1 y" z- z" {7 `7 w' k4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute% E: ]# ^/ z! J$ @# }: t" V1 Z
4C19:00A4   INC    CX! W+ J  L' @% L+ E% k3 Q2 R
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
* R+ |( G/ i. J( r- T4C19:00A8   JB     0095     ; 6 different commands.
* @- {5 {. q: U7 m/ Z4C19:00AA   JMP    0002     ; Bad_Guy jmp back., r" k. D' k: @) ]3 d8 g) K
4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)
1 ~6 o& s  K; H; d# ^: c+ y9 ~
# b4 Y' g  ]0 u, \1 XThe program will execute 6 different SIce commands located at ds:dx, which
5 O, ]+ ?* r3 J/ R2 Uare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.& F; _7 [1 j9 D1 E5 d9 Y' L/ R1 n. j

+ Z* Q- Y) ~" d, D" R0 V) a* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
/ G6 J. T( B& C% c7 Y, c5 ~___________________________________________________________________________
* y( g. H6 w, _4 L9 I9 o* \7 e
% o7 A$ h, M! M' C
7 A# h: v* A7 i. g' Z- B3 J! `Method 03
# Q# U  e2 e3 z' E. X- w=========: |: W9 M' f$ _8 n+ p
) J" q+ T5 t+ R! b
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h
4 S- l9 P) X( i0 R; P, b1 d(API Get entry point); i% Q+ e& L* C" t
        - `0 V9 T# [% e! g
' P: L% _: q  c6 H
    xor     di,di1 a; b$ d2 T( j: [( ?
    mov     es,di
& }3 _! z; r0 h1 a! N( r$ O) @/ y# E    mov     ax, 1684h      
! L' [5 E; a5 y3 s- i, R. K+ a( @    mov     bx, 0202h       ; VxD ID of winice* k6 j" r3 U" x5 |. M0 q/ l' l& p
    int     2Fh
& e8 D0 S, ?; Y# l  I) G2 u" S' u    mov     ax, es          ; ES:DI -&gt; VxD API entry point
; q% h7 \3 u8 e' I8 m) D    add     ax, di$ U+ e% g1 b" d* k- G" A
    test    ax,ax
: j: y# D" q; y% w1 c( m) \    jnz     SoftICE_Detected* v; p8 Z' y- {- q" I

+ ^( F; [* I& I___________________________________________________________________________" a& f& ~# V: J: q

! G& }4 E7 F2 u8 C! NMethod 04
% F, _0 a9 M' m* d, t( l3 d=========/ ?3 w; v  r8 L& ^0 T) f
' b( a% A2 E) s2 ~6 C; }/ T
Method identical to the preceding one except that it seeks the ID of SoftICE
4 J* l0 ^0 j) i7 [6 w5 f6 M0 TGFX VxD.2 ~$ z: w9 r" s8 _* r6 E4 i

% m# v' L! l7 ^$ r- k5 Y! P& f    xor     di,di
) j) }6 W' ?8 v! _; j, X    mov     es,di
% C3 Z1 w/ n2 n4 `5 ?# M, H    mov     ax, 1684h       % g9 C7 Q& F. J
    mov     bx, 7a5Fh       ; VxD ID of SIWVID- G7 p. f6 s; q
    int     2fh; Y" M$ v, }, ^( Q' s, n
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
( g( w& i2 F! b9 D# l4 G& q    add     ax, di
" O6 u6 ]6 O) U+ b' p. _! q# L    test    ax,ax6 I* K5 s  _5 }
    jnz     SoftICE_Detected
1 \) `: Z- D% ~8 m0 |
- {0 h3 W) V* ]__________________________________________________________________________+ v( s; o3 e1 I+ y: y- `

; v: `* Z5 T, j5 j- D5 B3 ?9 n4 H3 i# ~# e# [1 c+ \7 j4 i$ A6 M
Method 052 G  f) i* h; h* R) M2 B
=========
3 G5 Y4 I* ~: p! ?# A, B* T
  l9 z( T) U! X- H! YMethod seeking the 'magic number' 0F386h returned (in ax) by all system& t* }! E8 M+ ^- K, }
debugger. It calls the int 41h, function 4Fh., Z8 S2 M" g. f/ Q' w( y
There are several alternatives.  
8 w( ]3 k& j" f, S8 W! m0 P( \, ^8 E% t2 C  t5 Q
The following one is the simplest:
7 Y& q* ?4 H. h- ~" ^6 Q( Z% b$ _8 r* `! K7 J
    mov     ax,4fh% t  |! n( p0 Z! B" ^0 \* D
    int     41h0 a, |. ?7 x! g3 r" ]; D+ O8 ]
    cmp     ax, 0F386
" S3 u7 h! \; ]    jz      SoftICE_detected1 {5 W4 p) C9 |6 l) F1 s# S

; }/ [/ f( ^% Q
& D, B. ~0 t' L8 G. zNext method as well as the following one are 2 examples from Stone's * e: u; v4 J; E3 `( {( |3 N
"stn-wid.zip" (www.cracking.net):  v' u# k- B& o. p. w
: ^9 j- \/ x; e1 }) ~5 h, a. r
    mov     bx, cs
+ l* F6 Y  x1 W4 ~1 z; ~" G    lea     dx, int41handler2
( z7 A! F8 m5 Z0 D. _5 O    xchg    dx, es:[41h*4]+ y" S' F4 w% W5 {% j# h
    xchg    bx, es:[41h*4+2]
0 x, |, d( f; K, I! j    mov     ax,4fh
' o' G0 j, |% R  u    int     41h
" u9 |3 I7 z8 _) v    xchg    dx, es:[41h*4]- Q( B( ?$ n* h- ]
    xchg    bx, es:[41h*4+2]* z/ D) Z4 x# V% W  Y$ l: {6 a
    cmp     ax, 0f386h
  X  }; o) m0 Z, Q2 v+ G* V    jz      SoftICE_detected
" J' Y; M% z. u9 }7 s1 l/ n: F# U( d4 ~, v
int41handler2 PROC
3 a% f$ [& ~/ T, e& {+ _/ H: r    iret* [% k1 A2 H/ J2 F" |: a. ^
int41handler2 ENDP) |( M; Q; [4 {4 j0 n, p% C
" a+ `/ x" P- V5 Y/ e/ u
. v! U9 m4 v& c8 v) f/ M
_________________________________________________________________________3 O4 G1 p; K1 b9 D3 q6 l

. c( ]  O) n+ t# V3 |- W/ e) Z  K+ U: Q
Method 06; X! ^$ M9 C& Z+ X; X5 Q: G, g6 G( z  x
=========. N/ Z3 i- s" y, U

/ u$ a2 I! ~2 i* }4 j+ `% d" o4 q; N4 h( x
2nd method similar to the preceding one but more difficult to detect:
. u8 s6 v( l) d" Q
! w( r8 N6 F  W& u1 k# ~. ]; h  F( g, K/ Z2 G" Z( e, f
int41handler PROC! V7 \* g" M% R+ N4 J7 x
    mov     cl,al
. |# }" e" h6 |( D    iret
6 \) M* W3 B2 ?2 y" j; X# V' F2 pint41handler ENDP
; ~4 ]# |, U5 ~  ?4 z8 q- t  i; i5 j: V! J3 I

6 A( n5 r) W/ q8 W# L    xor     ax,ax
9 D& C% O  X2 \+ Y9 V+ i/ k4 ]    mov     es,ax6 @0 w6 Q9 p; [5 N5 |# _
    mov     bx, cs8 H' R$ d6 A8 r' a3 e6 R
    lea     dx, int41handler
2 P; c0 e- [0 [    xchg    dx, es:[41h*4]& j6 c5 W. @& J# S- R- b
    xchg    bx, es:[41h*4+2]) N5 Z, X$ _5 j$ Y! D4 L
    in      al, 40h
# u$ s6 ]2 x  j5 w1 a    xor     cx,cx& b8 }& N1 Q; o% w2 a; M9 x# R& d  \
    int     41h
+ V  Y% u2 N! |) }    xchg    dx, es:[41h*4]
, N9 ^( g/ W! ]: ~6 F9 w    xchg    bx, es:[41h*4+2]
# P4 I# O; Z( t. N% R6 Z. h    cmp     cl,al
  v3 P6 W! n& [1 y0 n- S4 X( J    jnz     SoftICE_detected; K5 A2 V( x0 E" S, ^7 J+ _
" C* i) r* r# _0 {
_________________________________________________________________________
7 r8 H8 S1 e: V( \/ L+ K# \& x4 J* W# V& @& e
Method 07* m9 T7 G( ~  [; B! b7 n1 o) n/ x
=========: ]5 B' h( e: ?8 I& w+ }& t

6 a: x7 R6 \4 z3 @- `- UMethod of detection of the WinICE handler in the int68h (V86)4 w* |& s- F. g0 H! d

. s, K3 L5 J+ x7 f2 m. k& l    mov     ah,43h$ K, Q( C8 N4 I3 u% R7 _. A( h- F
    int     68h
: r, n5 s( v4 Y* r    cmp     ax,0F386h
7 Q% J2 |0 y+ F    jz      SoftICE_Detected* s# X; E+ b; H$ i0 t% s

8 G( Y5 ?% k4 U1 Q, n0 \
  O7 T1 i+ U0 ^5 d& Y! a, i: }=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit& K2 R  e% w  _4 _/ S' V
   app like this:6 r' `* ^# }# v
. Z0 e, V  f( k2 I8 y" J( k5 R3 L
   BPX exec_int if ax==68  q9 z" R" f* u7 v
   (function called is located at byte ptr [ebp+1Dh] and client eip is( |7 ]# t3 E* T, y4 x' t
   located at [ebp+48h] for 32Bit apps)# e. z* ^- h5 M6 k9 y
__________________________________________________________________________9 `& _& ?* J( B+ G  m

* n! v% p) h$ V. u! R! Q9 e0 T# ^( N
Method 08
* d, P, E5 U/ Y" V) |=========
- R/ m. g7 z) W- ~) N7 s9 c! }6 T2 _
It is not a method of detection of SoftICE but a possibility to crash the  f/ A1 a; f1 Q
system by intercepting int 01h and int 03h and redirecting them to another
0 j& N& v+ \" \routine.3 ^. s. f( M$ c7 a# ]4 }/ ?
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
# N  f+ N* K1 i, o4 ito the new routine to execute (hangs computer...)
, R* x4 N: W9 F
. ]/ Z3 X8 m6 u- k0 F' }# c    mov     ah, 25h. c0 X+ w: ^' N4 }
    mov     al, Int_Number (01h or 03h)
9 X7 v, \$ u% e! f6 ~& x; U' A    mov     dx, offset New_Int_Routine9 p1 ~# I$ S" I: F$ o
    int     21h& _. D5 |* A( \0 Z
) I8 F- Q1 B5 z; B  u$ m7 f
__________________________________________________________________________
8 E' p. V0 A% g7 G8 S. j) T7 |1 d8 C5 N. U
Method 09
( o0 T& q8 n& \1 r; I3 v8 t=========' l% T1 W: F( j9 {

& E9 l0 _& h, c. `This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only# \/ F4 R3 L. c7 ~; V
performed in ring0 (VxD or a ring3 app using the VxdCall).
# D2 n8 u1 X7 y# }* z. BThe Get_DDB service is used to determine whether or not a VxD is installed
+ y5 S# f. [0 i( @5 j) @- @  I$ J+ g: zfor the specified device and returns a Device Description Block (in ecx) for5 U/ z4 B" T! c6 }
that device if it is installed.% e* G( ?$ s0 v$ |

1 W& N( h& M; ]* ?   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
) f0 l$ f1 u" \' i5 o   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)# g% x0 G- e7 z
   VMMCall Get_DDB/ t& i3 i4 e+ D' `/ V. m
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
" q( k6 m7 m; z$ x  r
6 J  [7 p6 ]5 q- KNote as well that you can easily detect this method with SoftICE:: F- u2 d  m3 H7 a. s4 w% {2 u
   bpx Get_DDB if ax==0202 || ax==7a5fh
4 a& K( W' G$ N  l8 t* O" u! _) J4 w) y
__________________________________________________________________________! g3 P# T) ^- @: z- z' X

+ B9 G+ h5 E" T: B9 }Method 104 l4 x/ g/ U. G' ?7 P% d! |8 G
=========
: [5 {* ^! }- w( \3 M$ ]) N4 M, B
! z3 `! K* f6 l* k. K. `4 K=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with
4 ~7 c4 ]+ o. N, z, g4 n; S& g  SoftICE while the option is enable!!: b+ ?8 y* U$ j  I( q# F" r/ w

& J1 S* p1 n& `$ O, e) ^2 b+ vThis trick is very efficient:/ P+ \* H$ J4 b1 G, A
by checking the Debug Registers, you can detect if SoftICE is loaded
( A/ L3 M$ N) r8 i, `2 V(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
, a  X) \7 G/ e: mthere are some memory breakpoints set (dr0 to dr3) simply by reading their
! s. r3 H8 ^/ [. \7 t( Xvalue (in ring0 only). Values can be manipulated and or changed as well
0 [0 _  y, r$ K- Q+ J) h(clearing BPMs for instance)- ^+ z$ Z2 f$ |% f! R( a; M/ a% s4 b: Y
. j2 n5 c/ `+ u& e9 J3 f# B: j( P8 U( H
__________________________________________________________________________5 C: u3 R" k/ u5 z. S% u3 Q, h
% ?! S; D5 o# I
Method 11% G0 y8 h% p, @3 E
=========, _* I5 r, |, E" b% ^! _& i

& d; N: f! Z0 I6 F& ^$ j9 }This method is most known as 'MeltICE' because it has been freely distributed% `: X( h: V, O& Y6 C( W. w
via www.winfiles.com. However it was first used by NuMega people to allow
  a' W; z7 z/ U: gSymbol Loader to check if SoftICE was active or not (the code is located
/ V) B9 T/ e9 s: b# O6 Kinside nmtrans.dll).  s) r$ z" F# c, v$ C

5 D5 U1 i1 N  b' P+ zThe way it works is very simple:
. h" p6 Q4 ?$ |+ PIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for2 c  Z5 T" ?. d# R4 e& x" _% Q
WinNT) with the CreateFileA API.
* H2 b4 B4 T6 n4 N( Z9 u. B/ {* O% c$ @( H& d7 z* K3 I: @
Here is a sample (checking for 'SICE'):) a( g% c* M8 U9 g, ^
% {( C3 f6 i, L/ v
BOOL IsSoftIce95Loaded()! h. D) l2 l8 z' G
{
& m  {" |! {7 t0 j/ q9 w  P7 i   HANDLE hFile;  
" m5 Y+ B8 D; k% y   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,3 I& W4 S/ F# A( C: q+ O
                      FILE_SHARE_READ | FILE_SHARE_WRITE,- I" L/ ?, ]8 z( @
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);+ R6 z& y# I2 b9 @2 {$ ^& q$ @
   if( hFile != INVALID_HANDLE_VALUE ); q! @' B0 |0 V6 ~, X$ b2 \% r
   {( ]) E% y/ d7 ]
      CloseHandle(hFile);
) s# b% \$ N% i9 M      return TRUE;& J/ h5 g  |/ j3 @; F( U$ a
   }, |% l% F* |4 ^
   return FALSE;/ U6 u! `; W% z# r, y5 D
}
, |2 M: N, J0 ^, Z# N4 c
. q+ Y: ~0 [$ A6 A5 |3 f9 Z8 W3 BAlthough this trick calls the CreateFileA function, don't even expect to be
5 Y# r) t: [% S9 u$ y5 i8 nable to intercept it by installing a IFS hook: it will not work, no way!
# S: ?% n  `3 r9 k) r  HIn fact, after the call to CreateFileA it will get through VWIN32 0x001F
) r9 ^3 |4 {# u$ A. ^service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
9 l- q" \3 O' m7 c; p+ jand then browse the DDB list until it find the VxD and its DDB_Control_Proc' I3 s9 x' D6 ]; P, k& B
field.: f" X; S0 d* |+ s2 w# k# }' f4 a8 h
In fact, its purpose is not to load/unload VxDs but only to send a 3 Z, w3 y9 @7 h) z) S
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)6 X* R5 E7 X) p. m+ O8 H
to the VxD Control_Dispatch proc (how the hell a shareware soft could try; X! G$ s) n9 ]3 p
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
: r9 j% |. i0 f9 S( U( `7 _If the VxD is loaded, it will always clear eax and the Carry flag to allow+ l' U$ x) j/ G, {- R$ W, n
its handle to be opened and then, will be detected.- d8 J! J; N% Z& @$ p. I
You can check that simply by hooking Winice.exe control proc entry point* R9 r* c+ y+ ?
while running MeltICE.
/ I( z. q# N2 K. `1 K
. w% A- F+ \* ^9 I& q( t, u: P5 @  S/ c
  00401067:  push      00402025    ; \\.\SICE8 E( _6 d  s0 V4 ~5 c( U
  0040106C:  call      CreateFileA
5 `, K" i3 d. S  00401071:  cmp       eax,-001* R1 e- r  V- w* N7 X/ q+ c8 |$ r1 C
  00401074:  je        00401091
/ {. U8 \. R& v0 v% {  ~3 F* y2 h* x3 M/ Y% O2 F* ^
/ {) E+ h% P5 B: {' P: e+ @; \
There could be hundreds of BPX you could use to detect this trick.
; g1 \( ]- M% N-The most classical one is:
+ B* }+ m' D; `' g  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||
9 ?# C- w3 p1 a, v    *(esp-&gt;4+4)=='NTIC'. b5 Y; z" A1 P4 A
2 e( ]+ T& m- Q4 Q; f8 x) J
-The most exotic ones (could be very slooooow :-(6 n" R7 c; ?9 Y. H2 l) U& G( M
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
- S1 H1 |& s% k: r     ;will break 3 times :-(
) J' ^/ w& C1 A+ q
  U# }- C! `' v7 f8 Y" p& r3 s-or (a bit) faster:
/ v4 p/ F. _4 C: h3 ?$ C   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')! M2 q& v* t# X% B0 J$ H! T  e
1 b* X( J  k- @, v/ S7 @; }9 d; s" g
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  / P2 J9 @3 w7 y; ~) J. R; T
     ;will break 3 times :-(
4 X- K6 s" W( m2 @, N( R9 V+ p& i8 [- A
+ N- v( B: V! k$ X-Much faster:
0 v3 Z% X: S3 `, s   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
# L! P, P' W7 z& p" Q& {! n7 W/ E8 O: {/ P7 ~- [8 I; p
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
1 G3 m3 r: C5 p% B0 wfunction to do the same job:' O( o8 E0 c/ p( K8 j

; ^$ X3 a# h! q/ P% n8 x0 V   push    00                        ; OF_READ
6 w( |$ X$ H# d. e: v   mov     eax,[00656634]            ; '\\.\SICE',05 Z, w3 o0 y8 F( X
   push    eax
; v/ f* E$ f: [% D2 D   call    KERNEL32!_lopen
% `) z! F5 h/ h7 N   inc     eax  G+ a$ a2 P  T4 F* `8 w+ m
   jnz     00650589                  ; detected, f5 A4 U+ ~5 C. G4 D, I6 H) h
   push    00                        ; OF_READ) P) R4 j% k- ^2 h: Q
   mov     eax,[00656638]            ; '\\.\SICE'
4 D& C; U, u; O3 @   push    eax
3 H" O6 p  Y! N+ _3 y   call    KERNEL32!_lopen; c; l3 t- \1 F3 e: a0 A& i
   inc     eax
6 p- j6 t4 H8 g" b. n( f4 ~4 s, F4 P   jz      006505ae                  ; not detected/ b4 F4 ^$ N# b# N( [2 n4 L
4 b5 A: ]2 y% A1 s
; F9 W' G% ?* M
__________________________________________________________________________8 ^  ]/ t* c! M! Y

8 r% C( j  P% n; o4 \Method 12/ J4 q! s& @1 Z1 s7 X; }
=========
5 v0 i' J9 t4 A" l
. u0 k1 S+ B& _9 V  O: ?This trick is similar to int41h/4fh Debugger installation check (code 05
. W* g6 Q, d7 S: a' c&amp; 06) but very limited because it's only available for Win95/98 (not NT)
: h" B, B  x; R. uas it uses the VxDCall backdoor. This detection was found in Bleem Demo.8 b- ^/ p: L2 M& X% p

; N* F7 W) r3 E6 w5 O& K& i   push  0000004fh         ; function 4fh( H9 E) k0 T( ~
   push  002a002ah         ; high word specifies which VxD (VWIN32)
) O* f7 b5 `! L  r                           ; low word specifies which service. T$ ^: H2 r0 |5 j$ p% F
                             (VWIN32_Int41Dispatch)' E3 E' o/ y4 j( M
   call  Kernel32!ORD_001  ; VxdCall2 E! h6 h5 s1 b& k3 M* o' P' M
   cmp   ax, 0f386h        ; magic number returned by system debuggers
0 [6 K% X7 Q1 h3 I( q   jz    SoftICE_detected
/ x/ ]1 X4 ?0 y) s! P) Y
! K- ]5 \2 n; r5 G+ c' d. m$ B# yHere again, several ways to detect it:: c( T6 c5 v) Q: s1 l) o5 f. o+ x

! g5 l  D7 T) t! I* `    BPINT 41 if ax==4f
" L3 u5 O4 u# V4 Z+ }4 {7 T( g  [/ k. Z! x4 o) J: M8 c
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one  f  W# ^' V( ]# {

% [: M4 d4 ^) \$ h    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A2 P; g9 m% w! H' f

, \+ w: S/ P3 F; S- `) s    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
6 Z" Z6 s" m9 _. @  h" h' }3 [% t: p- N, B+ `
__________________________________________________________________________
% |4 C! {. W, B+ g$ x; J2 c
! Y, {' V; f6 L: s1 |) R  eMethod 131 d9 d2 R9 w: K& k; X
=========5 Y% @* @- m! x( U+ _
& @) q, c& t6 M
Not a real method of detection, but a good way to know if SoftICE is
& G' d/ e' C8 Ainstalled on a computer and to locate its installation directory.
$ V' R9 }# Q/ ~' h$ p4 OIt is used by few softs which access the following registry keys (usually #2) :
7 d# Q1 K7 F$ S" h0 b5 S& x8 R. x1 b9 I
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
( g: A( |! c8 v3 P0 i\Uninstall\SoftICE
1 X  t$ o1 Z+ _-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE6 A/ D$ o; o4 p! V
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
6 s0 f/ `' f9 y) h\App Paths\Loader32.Exe
, d# Z" M  H7 _9 F: ^) @% w. ^1 Z( Z! H

2 K  J/ B+ y5 y; z/ `+ i' t# {* [Note that some nasty apps could then erase all files from SoftICE directory( D( M2 }2 j% U& C6 W9 M" b% D9 f, M
(I faced that once :-(
2 N1 e! @4 `7 I9 {# I; `* [7 b2 Q/ y
; C+ l: z' E" l6 bUseful breakpoint to detect it:
8 U3 i% k% `/ O4 d8 t, x  D/ G' t( Z
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'- O2 r, s6 ^4 ]9 I

4 V8 T. a! m8 d2 A6 a( H/ k7 j$ y__________________________________________________________________________
4 `- d& D: p6 E6 R# \' t. k& `* z! x, _

/ \2 ?7 g; r6 }$ E$ A7 Q9 S1 y7 FMethod 14 0 |! D$ _1 _' I1 x) p
=========
9 w7 m; ?+ r; g
' V# M) P0 ^/ J% T, v9 I' ~. kA call to VMM 'Test_Debug_Installed' service. As the name says, its purpose( I: s. r8 j  l1 D! U( v
is to determines whether a debugger is running on your system (ring0 only).
( H6 ]3 u, w, r+ o( u! s! w# t7 [, ]2 V. b* z3 j8 B: C
   VMMCall Test_Debug_Installed
6 P8 }0 `, D0 |- u5 a  n* ?5 O   je      not_installed0 `4 s+ k9 b" C% L
* A; a8 f1 ?  z7 {8 a8 ^
This service just checks a flag.
# g) @4 ]- x$ l2 a</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部