About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>. d. P7 ]/ T* k. C- a
<TBODY>
: n4 H, ]/ z5 A<TR>
0 A  R4 C/ K% _2 _<TD><PRE>Method 01 # ]5 _0 U) Y/ ]5 W, ?. J/ q6 l
=========
  v/ ~7 u' D# T$ k3 R; A
9 [! a) z" I+ ~6 d% n7 g; oThis method of detection of SoftICE (as well as the following one) is/ L# n! G% a- ]0 W
used by the majority of packers/encryptors found on Internet.
0 g, H) c6 l; }, U$ W5 g2 EIt seeks the signature of BoundsChecker in SoftICE* Q4 x( v% H1 V! _, Z" [

1 X/ O5 m7 v) K% s# ^3 @/ Y    mov     ebp, 04243484Bh        ; 'BCHK'
4 b& c( p1 ^$ o6 }* Y    mov     ax, 04h
0 [2 _' R) Q1 F; ]% s- f3 m( D    int     3      
  q% A, D; @. y+ G    cmp     al,47 |2 I/ e( v- I" A( s
    jnz     SoftICE_Detected# z1 \3 ?9 H* {* f$ b
( z( w0 u; H. W- }, `% Z) ?: M, ]1 Q
___________________________________________________________________________" p' x! m9 ^5 I' C/ p1 Z: w
( C0 V) s2 I/ {7 O% i" W- h
Method 02% h2 Y* ]; ^* S( Q) |
=========0 F/ v1 C3 j* O; u+ @
/ s& x" M( d; J8 w
Still a method very much used (perhaps the most frequent one).  It is used
6 ~* ?5 h# d6 G- N$ X0 d1 d, mto get SoftICE 'Back Door commands' which gives infos on Breakpoints,
7 c3 U* v+ X  h$ ~3 \or execute SoftICE commands...9 V" a. S% p0 M/ P) P* w
It is also used to crash SoftICE and to force it to execute any commands
. \" D$ C. [: E2 Z. j$ J- f(HBOOT...) :-((  
' @2 f# X. L' r' J2 R& ]: @% J2 L; n, k- o( n1 G( B5 H7 W
Here is a quick description:3 T2 Z1 Q. T% j! _( e. }! Q0 x
-AX = 0910h   (Display string in SIce windows)* r# j" `7 p  Z) j
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)% @! |% \6 ]0 U/ A+ W$ {
-AX = 0912h   (Get breakpoint infos)1 L& w, i! {, k8 W1 M$ ]. u
-AX = 0913h   (Set Sice breakpoints)6 c( u5 a" I( {% Y5 P' P
-AX = 0914h   (Remove SIce breakoints)
/ d) a4 `" F7 u0 c& }6 k4 K0 ?6 K2 n3 y4 U
Each time you'll meet this trick, you'll see:
: t/ b( {$ D3 B: K' T8 E-SI = 4647h- O" y3 Y7 l9 r3 B- o8 M. n
-DI = 4A4Dh
1 R/ [- B" ?3 `9 y4 n; zWhich are the 'magic values' used by SoftIce.
3 g3 D% N8 T( X# R: EFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
% e$ Y1 Y7 \2 Y- U/ w3 H
5 r( |& _1 v3 Q' c5 l3 `  H. h( aHere is one example from the file "Haspinst.exe" which is the dongle HASP  T  p3 V+ B! v0 g
Envelope utility use to protect DOS applications:1 g7 l9 e$ I# e  b7 o& b& D* ]& n
4 L# |' V9 }) R8 ^$ P
1 ~8 q" E- Q4 c8 y4 \2 W' r
4C19:0095   MOV    AX,0911  ; execute command.
! P) X4 I! d5 P2 X" x4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
- S  U) x4 ]1 h5 o: E$ }: \4C19:009A   MOV    SI,4647  ; 1st magic value.
. @) m" x5 r5 p4C19:009D   MOV    DI,4A4D  ; 2nd magic value.( }/ B& ?# x, ^
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
% o7 p9 j. _5 E# n; u4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
% ?8 _7 h7 O5 x+ ^7 ?4C19:00A4   INC    CX- m1 U7 m; n0 S8 I' D+ Z
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute  f0 W* R/ H: [9 {6 F6 I
4C19:00A8   JB     0095     ; 6 different commands./ J9 a* k+ W9 n  `
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
: R4 [. h0 N6 K9 Q) s0 E. T4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :); @7 G7 y6 w# W5 o1 z8 ?

$ R9 v! d( g3 u4 B+ Y. p- P" QThe program will execute 6 different SIce commands located at ds:dx, which( u& W1 Q, [4 w* k
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
7 {; l% @; o; W  @5 i6 G
9 n$ k% s% J4 `- i7 H2 h* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.
8 r: {8 f* E5 f: Q- [2 E6 k___________________________________________________________________________2 v' V$ l- `: S4 C' S% M: _
+ H+ D" `. @1 r+ s4 B
- R# X; K1 Y- k; X" E0 n# y
Method 037 G  l1 x8 L, I: v6 u- t$ b
=========
9 I1 k1 H& L6 P' f8 j' k& `! P/ a& N: ]4 k" e: M8 \
Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h' \4 }# o' x7 X. p
(API Get entry point)
5 N! ?0 C. l3 L  o        : }: b6 j$ P1 F% h

; C( u  |/ R+ A+ v: O    xor     di,di
! _0 W& t  Z: ^" w: E, R    mov     es,di$ \( C6 d( j1 ~+ K  j  `( `
    mov     ax, 1684h      
7 \" d0 E+ D( [. }    mov     bx, 0202h       ; VxD ID of winice  Q1 E% g# I: l5 f
    int     2Fh+ s! e9 g+ W3 n) q% B. f
    mov     ax, es          ; ES:DI -&gt; VxD API entry point- j/ Q; l+ Z* X) \# m2 {5 j/ P! M
    add     ax, di
' ?! @- W( O4 Z& Y    test    ax,ax
, Q3 |! x& Z0 n: m; B    jnz     SoftICE_Detected
  Y% p2 h9 g2 E0 y9 {$ L' C9 L# E
___________________________________________________________________________, z1 H0 X% T  n- R- ]; p
& o# f4 M. @' a' n
Method 04" e/ ]) W+ b$ P* `% }
=========$ X4 s8 }7 ^9 e- n
4 U! g* S- X, ]- p. {/ R
Method identical to the preceding one except that it seeks the ID of SoftICE
4 c- U0 Q+ I0 X* y* E/ T; |* ~GFX VxD.
3 c/ q" m4 z% f. s# W7 m+ z, J# ^% \# O# I, y4 f' ^
    xor     di,di
0 |( |9 @" o. B' l    mov     es,di
$ c* Q# Q1 Y9 a: Q: x" {5 G    mov     ax, 1684h       6 `! S* f1 F# n* @- [( [( G
    mov     bx, 7a5Fh       ; VxD ID of SIWVID
! e. ?1 i8 G# g9 q    int     2fh
0 j7 @5 }7 T+ ?' X! [) d/ f% H    mov     ax, es          ; ES:DI -&gt; VxD API entry point# Y. G. }- q( z2 L
    add     ax, di
4 a" p) s  D  q+ W3 a    test    ax,ax& q& H/ ?+ R! h. n- H
    jnz     SoftICE_Detected
! q9 g+ k9 T  x" @& D+ ^5 K9 M) R* S; v/ d
__________________________________________________________________________
/ K( q/ f: v/ T! X! x) f
7 A' }2 B* A4 }; ?! }
' k* J( v; z* YMethod 05
: x. [! \* O8 F2 P7 p9 U4 G=========
' C& D: j9 |+ v2 U2 a! ~* V' O) _7 r- C) j; y
Method seeking the 'magic number' 0F386h returned (in ax) by all system
$ u6 m* @7 v6 q3 |debugger. It calls the int 41h, function 4Fh.
( ]: V/ l( e" g  K8 {: O+ f( mThere are several alternatives.  
6 f, S/ R* {  [" x! P: K$ L
; f& b/ q) K1 w/ mThe following one is the simplest:: j) d: o$ b" w8 U; J: B

) t" b; b& W# b6 V    mov     ax,4fh
6 h6 ^- ^% X; F- W( L# o2 @, H* V    int     41h& S0 m: T7 o- V
    cmp     ax, 0F3862 l: B4 S* u9 [
    jz      SoftICE_detected" F! B: Y3 g9 X9 u! |1 X2 R& V

6 X2 k! x0 O# n5 I
: a9 p: p" c+ r" W" }. yNext method as well as the following one are 2 examples from Stone's
- U+ z9 s+ k; H"stn-wid.zip" (www.cracking.net):
* G5 A4 |" i- I& U" Z8 Z( y; _6 W; W% V+ V
    mov     bx, cs
- B" P5 y% g% O    lea     dx, int41handler2
* i% h+ `  h2 d0 H    xchg    dx, es:[41h*4]4 a5 N% q! c5 r; W
    xchg    bx, es:[41h*4+2]
" E( a  t% h8 |. \, k    mov     ax,4fh' I, R" w5 a/ M: |- ]: C1 w
    int     41h6 S2 @5 q- g# ^
    xchg    dx, es:[41h*4]* }; v% z8 F3 G; A& q& D: d
    xchg    bx, es:[41h*4+2]; j, t1 v1 Y+ ^# u4 o7 @+ D: H
    cmp     ax, 0f386h
  _9 J2 X, W# J: }; k    jz      SoftICE_detected8 X' E% r- r& m2 p( {
: ^8 j  a2 ~& X/ X" o$ g
int41handler2 PROC5 r& p5 N% C5 J# o# z$ E7 B
    iret" u4 f$ f. ?$ d! z
int41handler2 ENDP
( m* C  t* O) i) G, C" S0 Q& a8 D5 a$ w% L+ `2 v' X

2 J) t7 Q5 I' b! f7 x6 W( u_________________________________________________________________________
' F2 G2 x' Z8 ~& C  X$ k7 ~3 N- b5 K$ w" P$ Y; g/ v4 I; B* ], K

- I% @: P' Y, o3 z* i+ S  w& |6 pMethod 06
0 \) R+ {" V" E! s9 k7 u: ~: n% H=========
; O& N5 Q1 |! b% t
5 J& K! a, c; d! f4 c  K0 J/ n% z' R" x" K. r% N) n6 @
2nd method similar to the preceding one but more difficult to detect:- G' g; e5 X9 h$ k- P% ]

, u& ?8 q7 n  t: a: f2 M( p# v" G% y8 O6 a
int41handler PROC
5 l! a2 @" S1 r. k1 [    mov     cl,al
+ E+ L4 @! H2 ~3 i# o9 V+ ?# v    iret4 M8 Q! F* x3 Z. C5 u
int41handler ENDP* w* n6 n* L; ]) Z# c

0 b9 Z, ^7 D* F. C) A; w
* A% d" A' U' s4 m+ O2 T    xor     ax,ax
+ j7 y0 u# n6 u2 ]! f    mov     es,ax
$ m  o; v5 J: ]3 F    mov     bx, cs
5 N9 Z4 D; J$ k7 A+ t    lea     dx, int41handler
. ^" M! v9 h7 D% i. ?2 a( m    xchg    dx, es:[41h*4]
9 w7 u# H! @- y% B3 j6 r- V4 U    xchg    bx, es:[41h*4+2], d- U7 ^+ a: |/ u( J- x" I
    in      al, 40h
- V* y" f, H5 M    xor     cx,cx
* o7 @! y+ V8 J. m    int     41h7 u# {# o: e. C6 A
    xchg    dx, es:[41h*4]7 A/ V$ p, p6 U! {7 U3 G/ `$ y
    xchg    bx, es:[41h*4+2]( [( K& V' Q+ E* C+ X8 Z) `* R
    cmp     cl,al5 X2 H' D. w+ _) }7 g- v# V4 G
    jnz     SoftICE_detected! ~8 I+ E. }  [3 [& A
. D: f# y. i9 @7 v
_________________________________________________________________________
" ~: e. v& \! k- D! {2 |* C: d3 ?6 x/ {$ y
Method 07& a+ \/ P& Z/ J. H
=========
3 D3 z$ u/ K7 h( m% b, f4 I% n8 J& E4 [% p7 i; S
Method of detection of the WinICE handler in the int68h (V86)
+ d: P# D6 z: P7 z: x
1 B5 i+ {( `- z$ m  u; ~+ Z- }    mov     ah,43h( l. N% [7 P- ]4 f1 Y7 H/ ^2 {
    int     68h/ I7 z- @6 k+ ?! z
    cmp     ax,0F386h+ o1 Z% w2 X! \/ q$ W
    jz      SoftICE_Detected
% h3 u. {! ~& ]0 o4 o  D6 G& T
4 M$ k# v2 o) h- K! m( v+ i! o- E' E9 j3 G$ n3 r
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
0 i) G3 |1 h% U$ E* Y9 x5 l5 H. W   app like this:
6 m. t. @, a/ R! \" Q: v* }
- B/ d, Z1 t+ m   BPX exec_int if ax==68& x5 T8 U# E9 H0 \
   (function called is located at byte ptr [ebp+1Dh] and client eip is2 U) g: ^0 P& A
   located at [ebp+48h] for 32Bit apps)2 Q' h4 R; i2 z0 \8 @7 h
__________________________________________________________________________1 G; W) g7 H- K4 \7 N% y# C$ G

) [: Y& e$ q! T/ K! T
% `* h8 O$ j% AMethod 08
5 ?/ I6 A( u' K/ N- l=========- H8 g0 V7 J  H9 |7 ]
% ^8 z) F4 g4 _4 ^
It is not a method of detection of SoftICE but a possibility to crash the
* m1 H5 M- V& ?  ^! v8 z# r& ^system by intercepting int 01h and int 03h and redirecting them to another
3 M" n7 a! T- s& i# Y4 G) p. Froutine.  E  t6 V* O$ m
It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points( ?. Z1 ?; b* O6 W
to the new routine to execute (hangs computer...)
7 H) o0 Y3 M5 u; @% p% T" U9 f) ?$ R8 u0 Q" [8 |9 _
    mov     ah, 25h& l0 A" L. s2 C+ J* o. |! Z
    mov     al, Int_Number (01h or 03h)
8 j( ]) ]9 u1 O6 x; P& Y, i+ N; w    mov     dx, offset New_Int_Routine' \) {0 C, X; x: P3 _. C
    int     21h
% E5 T$ |: q: W. i. l8 C) i# \- ~" c3 d, D5 U; o- t
__________________________________________________________________________. N3 C0 A) E7 y

% Q7 P" x6 D. U4 u, y' [2 _4 W  LMethod 09# a% v7 O/ ^. q8 r
=========1 c3 _' E2 N2 p' f! p, F; q

: G( }8 D9 k) RThis method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only& J1 d: U$ a" d
performed in ring0 (VxD or a ring3 app using the VxdCall).
; o* e9 I4 @1 oThe Get_DDB service is used to determine whether or not a VxD is installed$ g4 z' Y" O3 |) Z' ^1 {( O
for the specified device and returns a Device Description Block (in ecx) for
: D/ s) r" @! Athat device if it is installed./ F7 p8 u/ ^. v- _
! }6 s' S1 r4 u& }) b8 ]
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID2 m# B, W& U0 t3 T
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
( k% `0 ]% L! S/ x" O3 g1 v   VMMCall Get_DDB0 H7 O' H5 M# ~( ]$ m
   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed/ o% ~; T1 j8 A, `: ]: w9 D/ ?

3 f& A+ N% V. Z7 _; A9 ^Note as well that you can easily detect this method with SoftICE:
  ~% \( Y7 y' |$ L0 o/ o* E   bpx Get_DDB if ax==0202 || ax==7a5fh$ H0 S! `( ]' d0 j/ n

& I" A6 C& V& O2 F/ \; H__________________________________________________________________________4 G1 s* N4 r) l; a# X: T  B- X$ j- c

( w  L1 J' q9 p3 y  N+ v6 BMethod 10
% R% s$ U, ^! r) n=========
% W9 |( N2 j0 W# }8 O  T7 r* _/ V6 v7 r2 U
=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with" T/ [2 t5 z) l
  SoftICE while the option is enable!!2 N* Q8 w/ T% m# B/ a! X  h! N/ Z% C
$ ^+ f" {6 N  }' H& s$ Q
This trick is very efficient:
1 D: H" A" z  ?( K" J5 hby checking the Debug Registers, you can detect if SoftICE is loaded
9 v5 d9 B9 f9 x  e( Z(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
: ~# G4 ]! ~  G( C* pthere are some memory breakpoints set (dr0 to dr3) simply by reading their
7 I* h: q! w; `" X# \$ a/ O+ Bvalue (in ring0 only). Values can be manipulated and or changed as well7 s& i3 Y" @' i2 ?+ N' t( Z5 A- c) i4 L
(clearing BPMs for instance)
+ b7 A3 {0 K- S4 n- `% G! _% y' v+ P' @$ ^, J! \6 v0 T
__________________________________________________________________________/ r% \; b5 {6 X8 F- P0 @1 p* h3 T

$ Z+ ^0 v, c$ f( z" t: \8 pMethod 11
- x/ O6 E/ ~9 T% H2 C( [" e/ f=========
; U- f! J& M7 _7 {# z6 a! g/ p+ e. G- f) R2 n0 r
This method is most known as 'MeltICE' because it has been freely distributed
/ N+ c; f) f+ Xvia www.winfiles.com. However it was first used by NuMega people to allow9 k+ e3 W& ~  R6 [/ @
Symbol Loader to check if SoftICE was active or not (the code is located
% J* R$ c0 l8 O2 Iinside nmtrans.dll).* k0 ~& g, H0 U9 q. H0 X: X

3 N( X! Q- Q8 tThe way it works is very simple:
$ s3 n! }' k! o9 [, eIt tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
( n0 k7 I/ ]3 M+ iWinNT) with the CreateFileA API.
0 }. ~# i- H' h. r1 j4 A) G7 p/ @( e/ U* I; ^, e
Here is a sample (checking for 'SICE'):& j5 J* `4 T7 Y9 Y
7 S4 U. i( U2 V
BOOL IsSoftIce95Loaded()# S" t. b) Q6 H" r6 [+ ?
{
9 k: q- D& P) p4 g   HANDLE hFile;  
$ s- O. `0 K. \2 T   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
4 A2 R* U. o+ h6 g/ p. }, g& K                      FILE_SHARE_READ | FILE_SHARE_WRITE,
- W* y* b- y3 V% _, R2 X# e                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);0 r' V% @" g% {
   if( hFile != INVALID_HANDLE_VALUE )
8 O5 r& H* s/ N0 s   {
4 K5 q) B$ @8 N- G      CloseHandle(hFile);8 F' w& S; k; T4 U& z* O' |/ u
      return TRUE;
, v" a* D& D5 u" i: g. e& S   }
2 `' R% g' ]6 b5 Z; i  J4 i   return FALSE;
% b: d8 U9 I) v% V3 V}: n' C3 ^) c( _& y6 q2 D& {

1 f# a' E% r2 A& @6 W! f; _Although this trick calls the CreateFileA function, don't even expect to be
1 e1 E  W: M5 M/ ~able to intercept it by installing a IFS hook: it will not work, no way!# F6 Y, ]+ |3 ]9 ^* C, x
In fact, after the call to CreateFileA it will get through VWIN32 0x001F: {. I3 o+ e% r* R
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)' w8 e) H4 S- E8 p
and then browse the DDB list until it find the VxD and its DDB_Control_Proc# z2 C+ A4 ?8 m
field.& b9 s, p9 P% g, A9 g  C, c" m
In fact, its purpose is not to load/unload VxDs but only to send a ) ^! d: a" K. J. i" o
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)6 d1 R. R7 r4 ^* g
to the VxD Control_Dispatch proc (how the hell a shareware soft could try
$ y7 x: [' _) B  H0 z1 ]$ ~to load/unload a non-dynamically loadable driver such as SoftICE ;-).
2 u0 |, ~7 l2 ]! B9 b* I2 H9 Z6 iIf the VxD is loaded, it will always clear eax and the Carry flag to allow
3 A4 H- c3 V6 D1 `its handle to be opened and then, will be detected.* B$ T, p$ _# q- b. {
You can check that simply by hooking Winice.exe control proc entry point; k* V, Q- K% Q$ m3 g( ~
while running MeltICE.% ]3 O7 h" M: r& L
3 J3 I1 }* a% z: l/ _

$ p& Q5 J( x( k4 S" w& F$ a  00401067:  push      00402025    ; \\.\SICE
+ ]* H+ E" ?/ N6 m3 X& q; o* ^3 B  0040106C:  call      CreateFileA5 A( h9 M; [) F( E! U
  00401071:  cmp       eax,-001  l! `% o- U$ G
  00401074:  je        004010915 e# {9 x5 D+ g& O: V

8 J9 }, h5 X: }' p6 @* i* K2 x* W, W3 D5 y
There could be hundreds of BPX you could use to detect this trick.! U% L1 s' S0 t3 n6 \: u( e
-The most classical one is:9 g* i9 ^+ O" b1 F, {- ^9 v$ K8 X, _; _
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||2 I  L" F- o9 O
    *(esp-&gt;4+4)=='NTIC'
- ]2 F4 o7 S+ B+ f$ U6 c# e
; B9 B$ u7 a5 j" Z/ D. h5 q/ }-The most exotic ones (could be very slooooow :-(, r. E  S) c8 P
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  4 \8 I: b8 T2 ?$ ]
     ;will break 3 times :-(
1 J# D0 L; C+ ^) \- G1 m. k. f# S. ]2 W# {% C
-or (a bit) faster: & h2 P6 P, E. {  i! T% y6 S) k
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')% d1 W) F. b4 C& E

- z. U$ `7 G7 o7 n   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
# Z: c! Z0 v" g8 _! g' X+ T% t     ;will break 3 times :-($ t  y) M! [) G& t" C- h: k
5 G0 ?  T3 {- b1 Q6 b
-Much faster:
5 l6 O9 @. ~1 x+ M   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
* l4 Y. i4 k3 n- H) V9 a
! |9 m6 R- i: O0 dNote also that some programs (like AZPR3.00) use de old 16-bit _lopen
8 o. D& o0 Y% S4 s: X% U( mfunction to do the same job:
2 _  A4 l( O) y: z) k2 A/ q/ M" H; ~
   push    00                        ; OF_READ
7 [0 ^9 C3 Q" S3 n7 t" p% {   mov     eax,[00656634]            ; '\\.\SICE',0
2 S- t, f! F, E; }+ J5 w& H5 H# R   push    eax) h% c& w* F) A
   call    KERNEL32!_lopen
- i: V7 A  L- X: F2 B- t5 _+ J( G' P   inc     eax
/ q: v, _" h7 r3 q) C   jnz     00650589                  ; detected( A) T* e2 ?5 a( n; `
   push    00                        ; OF_READ
5 t; D, C8 X2 E4 _% c$ k' g7 o   mov     eax,[00656638]            ; '\\.\SICE'0 Z: S. i$ e) c6 l; \+ Y" X
   push    eax' C) S; X, n. C8 S+ K
   call    KERNEL32!_lopen, \& Q2 a( H0 O
   inc     eax
% E5 w/ B3 A# J. p: i# Y   jz      006505ae                  ; not detected% e! Y! {; f$ I4 U' F' n3 \& Z

; x  {# k6 z. U& X% G8 r% a7 a4 s6 ~; w9 D
__________________________________________________________________________. e- M* w& m: V+ w/ u/ r

* j3 |' D* c% q0 i$ [# N9 m: s2 jMethod 12
2 n+ \+ g, U: P# P) d& J=========$ J& N( A, s0 ?# t3 ^; A
3 T3 H9 s! J$ p6 y6 T. B
This trick is similar to int41h/4fh Debugger installation check (code 05
$ V# f: L- K$ ?9 n1 Y& B2 _  ^&amp; 06) but very limited because it's only available for Win95/98 (not NT)/ r8 D3 J7 z, A$ @# C7 @' R
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.0 N/ O  W4 _& g8 ~+ V- _

# X! u& ]1 f" n' L' T: `0 y+ M   push  0000004fh         ; function 4fh
) `) M8 E) w# y$ Q$ n1 P# n+ \5 y   push  002a002ah         ; high word specifies which VxD (VWIN32)
5 E" R3 U5 w$ M6 C  {- \5 v6 C4 A                           ; low word specifies which service
, O. O+ B" l' E; U" L* W( r                             (VWIN32_Int41Dispatch)
4 ?, `  Z/ k5 m; T, R) }0 ]   call  Kernel32!ORD_001  ; VxdCall
: i7 k& t9 ?! \' X' _6 D( K   cmp   ax, 0f386h        ; magic number returned by system debuggers# Y8 F& l0 _, \  Y: {
   jz    SoftICE_detected
2 w, |' c  {/ ~" o# }2 n% I& A  z) X0 s( @# a1 w
Here again, several ways to detect it:6 @( O. N5 _9 V5 k1 r- @. ?

3 u: f+ y! L5 x4 b7 L    BPINT 41 if ax==4f
  I# \4 [* K( ]" m6 D- {3 M- ~- A3 w0 T- N; Q+ r) I
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one! N% b! b) Z- E. N
7 W3 {0 G3 u, d# s, `, u: l
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
' O0 B. s3 V& c% {
8 c. k: |4 t) s" L) w- V    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!/ Z' \- n! w' P* f8 X) u% K! {

3 i% h% h: c. M8 X2 [__________________________________________________________________________
. X' U2 B4 [. _+ w4 z+ H. k8 ?, r! e" C6 o2 ?
Method 13
/ Y6 j; w$ e: {=========/ b- Y- s) a( }
" [  r" {+ U6 g1 _( y" A
Not a real method of detection, but a good way to know if SoftICE is3 \' b( n0 M6 V" P3 C7 R+ q
installed on a computer and to locate its installation directory.8 q9 G- h3 x7 \: M6 `4 c
It is used by few softs which access the following registry keys (usually #2) :
! N( G  S/ F, ?" ?6 O3 l1 a( e1 G, }
-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
  B! D6 c% @- ?: N/ u  b# R\Uninstall\SoftICE. M( b: r: {: l2 }8 e5 i
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE
( o; J/ z# R7 X, f) f/ ^) l-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
, S' C' U  @: z  b; _( q, v\App Paths\Loader32.Exe& P0 l- [: Z& ~1 o* ^2 P2 e- b/ x

: @# [; W, d' f$ T7 \' L, p+ x) \3 R! Z* O0 a
Note that some nasty apps could then erase all files from SoftICE directory" O' y: o* q  D; N
(I faced that once :-(8 o- l- I$ I2 B* ~! N7 H
  U) Z5 m; y& v
Useful breakpoint to detect it:& y1 c* }1 z# e* k+ W
* S7 z! J* `: j/ Y! L1 I
     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
1 k' G  u, F4 x( Z* d9 O
% I8 F- v0 V1 L__________________________________________________________________________
& w6 P5 R. v' g9 ]/ G
0 D9 ?' a% t7 i" E/ {
( c+ X/ Z/ O, X. R' yMethod 14
* E! ~( q" B; I; `/ w' a: O=========
; \( w8 t( L$ Y, D5 M& {# x% j, U' l" z1 _+ Y5 I
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose: K: M6 {0 D# ?# f3 E/ D9 s& W
is to determines whether a debugger is running on your system (ring0 only).
6 x& z7 b: p1 J5 [; t: v9 `8 s7 s7 Q1 F' A9 X6 c7 L. v+ C6 `
   VMMCall Test_Debug_Installed% f9 I2 ?8 W& g4 i( p8 q
   je      not_installed
, g$ x8 O& M5 F7 V
* ?2 e% s: t) M+ \This service just checks a flag.
/ `% n3 q" _! a/ Y% I# Y</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部