About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
/ l9 ?" Z6 C! y* ?<TBODY>
: z  \* ^! h1 ~' ?& I<TR>2 ^  j* P7 i6 N( J
<TD><PRE>Method 01
1 n5 k& V$ s3 u=========
8 Z. t2 d' l8 N  o5 F0 z% D4 S
( u# z& V0 }/ e* ?- y. BThis method of detection of SoftICE (as well as the following one) is
4 i( H1 k) s) Z' Q9 D$ ?. Gused by the majority of packers/encryptors found on Internet.
* F7 c; i1 j, F" q9 d6 P7 K; ?It seeks the signature of BoundsChecker in SoftICE
) |% [) e& X7 e8 |. F! t" i( u1 j3 f8 B9 s9 o" G- t9 q0 S" j
    mov     ebp, 04243484Bh        ; 'BCHK'
/ d. Z$ }: g5 Q& ?9 N) m+ O4 M; q    mov     ax, 04h
6 b  U# m$ f1 M! M; F    int     3      
$ U6 O' a- G% _- C& ]    cmp     al,4
( `. B3 |% @; q3 P& I    jnz     SoftICE_Detected
! v0 z4 l& ]# G3 d8 e
1 D3 e; G' J' l  ]: R0 n___________________________________________________________________________
( h" O  W4 e7 ?; K6 _+ g" s: i' U# {% a
Method 029 c3 `$ q& M4 I6 i5 j
=========* P/ e/ J/ `; e
) h  J! d- ^  Y  J/ r
Still a method very much used (perhaps the most frequent one).  It is used
/ K+ S: F, T- L; y( |+ Mto get SoftICE 'Back Door commands' which gives infos on Breakpoints,+ g8 n. |  Z3 T6 _/ ~3 r
or execute SoftICE commands...
4 U3 S7 D1 L. Y' VIt is also used to crash SoftICE and to force it to execute any commands2 l9 z6 G" H4 k3 w
(HBOOT...) :-((  
$ s" Q0 @! D# w( X
% J% s. d2 h/ O9 mHere is a quick description:
' T1 ?* H4 c) {6 K9 u8 i/ e! [-AX = 0910h   (Display string in SIce windows)$ E/ b' H/ \( ]2 l, \
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx)/ [0 E1 I) E( Q2 u( y$ p" B
-AX = 0912h   (Get breakpoint infos); x0 b4 i# m- i5 u2 K0 K% m5 m; n
-AX = 0913h   (Set Sice breakpoints)( l3 Q% m; N2 d) a8 `) x9 \
-AX = 0914h   (Remove SIce breakoints)
* I: Q( N# P8 H& n
. W) S2 b- G! IEach time you'll meet this trick, you'll see:& i3 f& E6 K; q$ X: P2 l0 j; |1 [
-SI = 4647h
/ _1 n; q4 P2 z% T. O  Y! l-DI = 4A4Dh' q5 v% w# F# i2 ^8 z
Which are the 'magic values' used by SoftIce.1 x5 F0 y; z5 z2 f. C7 v- I
For more informations, see "Ralf Brown Interrupt list" chapter int 03h.; X5 T) R! x: `/ l7 _* \% G

5 }2 X8 P! g- l1 ~& _- P2 MHere is one example from the file "Haspinst.exe" which is the dongle HASP
2 i4 m0 _3 Z4 X8 [3 ]Envelope utility use to protect DOS applications:
6 O" w" `& x+ _- a$ Y, E( {/ g* C
' ?" \8 p; F2 ~, I+ a' d
4C19:0095   MOV    AX,0911  ; execute command.' I* d5 P; C& R- b$ Q) T8 Q3 `
4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
' I' K' E3 I; F7 e2 W4C19:009A   MOV    SI,4647  ; 1st magic value.
6 |6 [: o- Y7 k4C19:009D   MOV    DI,4A4D  ; 2nd magic value.2 G- p! i. K4 d9 ]' F
4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
( F4 B8 D* F* c- k5 k& h- R& \4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute
) Y: G( U9 O1 z( ]5 z! n+ \4C19:00A4   INC    CX) ]# a7 _; m& [0 t- F
4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute3 B0 D. A5 y0 L0 ?8 M
4C19:00A8   JB     0095     ; 6 different commands.
- X( h, H* l/ K' x  s! ]4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
7 v* N" g3 @$ m" k' L4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :), m/ J, }* d2 x
9 N$ k. j! n8 [+ F: X& W9 D1 L' s
The program will execute 6 different SIce commands located at ds:dx, which
" b8 F' Y$ S4 M3 N" X6 vare: LDT, IDT, GDT, TSS, RS, and ...HBOOT.
  g( V8 T; b4 a
8 b! C% X* [, h+ u: o& ^* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.2 V8 D$ Q! i; U: A
___________________________________________________________________________
% O6 M) s# ?! [6 T, Z& [
9 Z# B) w# U% U) X0 n  J1 Z
* d4 b, K% a! e* j( y& L/ tMethod 03
6 M- b7 r: I6 \2 B0 P=========4 N/ f9 x7 u# \1 n) V

4 Q3 W; a) u' i* \Less used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h* j* J7 P  ^& C1 c' Z
(API Get entry point)0 I, u3 |9 q1 Q- A) b/ X1 n& b6 s
        * q# w" J+ I+ {/ |8 U7 ~. e* b: L

! u8 |% K* J- ~: Z4 ^" g    xor     di,di
4 e& c/ T) ]7 ?( Z    mov     es,di4 H+ u; e* R  H! O  K
    mov     ax, 1684h       6 n% Z! r) l8 l6 j3 e7 n) T; R2 b
    mov     bx, 0202h       ; VxD ID of winice$ t$ Z4 o4 q2 m
    int     2Fh$ t* G) c& B- v1 P
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
# J  b9 L! H8 U* c/ L* m9 `    add     ax, di
, u, y  g* s6 ~$ {( e    test    ax,ax/ Y* r7 q( p) s6 R- w; Q
    jnz     SoftICE_Detected
/ @( i- l# M2 Y5 \0 W/ [, X! a# e. i2 N' H% f4 a# W0 q
___________________________________________________________________________* E+ U9 T: l: k6 a$ s% v1 G
( Q3 d3 u8 R! o) b8 r
Method 04
# e8 H5 E9 N* f; o2 T=========
* h& X- w! i1 V# {# M
! {8 n, O; ?) x/ H' q; M% m( cMethod identical to the preceding one except that it seeks the ID of SoftICE
) L. A- c3 v2 k' c5 m" d" D8 W5 e( G0 dGFX VxD.
& ]" C* X" _. t' S8 x+ m: r7 j8 H) W7 S+ T( x0 H2 W$ _4 L
    xor     di,di
/ x! A% Q: y4 |& g% O$ G+ K    mov     es,di
1 K* W! m7 |2 \1 p" B    mov     ax, 1684h       & B7 d/ U4 p( N2 W. y
    mov     bx, 7a5Fh       ; VxD ID of SIWVID" J5 X7 \6 V# n
    int     2fh6 ]1 X9 }+ O" L
    mov     ax, es          ; ES:DI -&gt; VxD API entry point
; R+ `/ ?! K8 [3 J# K9 x7 _    add     ax, di: j: ]& j" R5 ~1 q+ f+ B3 F1 `  M2 x
    test    ax,ax
7 {* K* Q0 t% R# @* }# P; V( L    jnz     SoftICE_Detected
3 C8 s& y9 }) ^2 w* c  E/ w" w: ?* ]
__________________________________________________________________________
( @  |4 `6 K0 F7 W0 f' |0 {' ~* ?
( c' R9 I: E" a+ t+ w6 u  f
6 H! o: D! k/ m$ b5 V  PMethod 05
; j- v# s' R! C1 B/ N7 O: H8 X=========
9 ~7 J  k8 U5 O0 T. v% g5 \8 z/ A5 N" I1 v5 L; ^& t* h/ E- k- q! i
Method seeking the 'magic number' 0F386h returned (in ax) by all system' j! l8 w6 p  a; t$ r' O/ `% q
debugger. It calls the int 41h, function 4Fh., C  G( F' a  b7 {6 \
There are several alternatives.  
/ V% S' v7 e8 N8 X+ p8 `+ F- N0 |, u
The following one is the simplest:5 I& x2 y" ^9 K& R$ N9 ~7 W8 W
# _! `3 f3 o. i% M
    mov     ax,4fh' K6 k7 p  U- \# w
    int     41h
+ I1 {2 W/ P6 ^; Y% _0 I( j; P    cmp     ax, 0F386
$ Z" s/ i3 |- }    jz      SoftICE_detected1 k( F+ D2 H8 j& L, I* m

& {+ R7 S* i- B; N" N. g4 I5 \8 U8 m7 o' ^4 z$ K
Next method as well as the following one are 2 examples from Stone's
* X/ n: i! s" @( ~0 C9 b+ i/ a8 J"stn-wid.zip" (www.cracking.net):
/ [5 x! G1 v2 @
: e  x$ l" j8 Q; L# a6 F' f# e) O    mov     bx, cs
4 ^1 C  i* L7 q    lea     dx, int41handler29 C* `1 L  b6 {" u' ]8 Q& M7 r
    xchg    dx, es:[41h*4]
4 {' V. a- Z/ I# D    xchg    bx, es:[41h*4+2]
  a' E& k5 |6 L4 k/ Z: X+ h1 L+ N    mov     ax,4fh
% e+ M  p8 ]7 {4 i  P    int     41h7 j7 X' T$ L8 B. c) |
    xchg    dx, es:[41h*4]
3 o, ^4 Q0 W+ {# D, c- D8 `    xchg    bx, es:[41h*4+2]6 z3 {6 H9 L" [" ^9 H7 `! G
    cmp     ax, 0f386h* O- `% J+ M; _% e
    jz      SoftICE_detected  v$ b: i4 K, B4 B- L; A  a
* I$ r+ H% G5 j  L
int41handler2 PROC* K* v( _5 {+ Y) j
    iret9 k9 d7 a6 m" q' q
int41handler2 ENDP
" K. c" k- T, N/ ]6 _% s, g7 w3 t, q1 a
& X7 ?9 e: l0 r, A# O- u' u
_________________________________________________________________________
0 x# k6 U/ L. j  z4 }6 w' Z9 ?  H  N

' r5 ]3 J6 w3 b2 Y+ _$ kMethod 06* i2 b% `! J* j0 b0 c
=========$ o. B% q/ F, I

  T) O+ b- l6 b( u7 e" F" U' L1 F. O- @; k7 d% D3 F1 t5 D
2nd method similar to the preceding one but more difficult to detect:
- p% ?8 p& {# g5 x  O5 J, w6 a; ~$ i
/ P; B4 U3 Z% \# l
int41handler PROC
5 L" s/ u) j, w  }    mov     cl,al
3 }+ D* S- J; t/ {. t7 N5 |1 H/ e    iret* u  `7 P2 P  `+ i. J2 v
int41handler ENDP$ U4 k3 Y. ?6 i: X+ A

, i, j4 N6 u0 D7 {! R5 x  N. R* Z# H; Y  p8 b/ S
    xor     ax,ax) f5 E9 S+ D/ E, J6 G/ y7 K
    mov     es,ax
7 ^! L  C: S( h! ]    mov     bx, cs
1 s  B# L2 v/ F  Y) t    lea     dx, int41handler+ D0 t/ `  c2 ~) Y
    xchg    dx, es:[41h*4]0 n8 T9 I$ S5 W* e( _$ _) g
    xchg    bx, es:[41h*4+2], c: A/ I! B- \5 F1 U; |+ ~
    in      al, 40h  i+ B3 Z# m4 w3 I4 c* D% T
    xor     cx,cx
0 n; G* `8 c* A    int     41h
5 a8 Z% m1 I. J- K6 J; w    xchg    dx, es:[41h*4]5 {/ R2 h; d. x. |
    xchg    bx, es:[41h*4+2]
3 R4 D4 Q1 S$ V4 D1 |0 \    cmp     cl,al. Y9 E  r. N8 b: h
    jnz     SoftICE_detected1 C8 X* K. l+ _0 {% x0 e
3 e3 u; L7 H6 z
_________________________________________________________________________, G4 b4 b" B2 F  B0 {$ X! ~

' [7 K: }; `" e6 v. E& e6 GMethod 07
9 z1 G, M/ l! X) s=========
3 G$ Q! U6 Z  F  c  o+ N. S6 Q- B8 F1 S; T0 R
Method of detection of the WinICE handler in the int68h (V86)
9 I: T" Y. q7 U$ t. m( p& ?! h% h2 t1 e" F  p1 ]! x6 U
    mov     ah,43h
) _/ f* \; h0 N/ ?8 F    int     68h* c9 @* U3 x) `( z' N
    cmp     ax,0F386h0 V1 x# t! c6 [# j/ E
    jz      SoftICE_Detected) z1 I" N, e5 r& A; q' R" ]  B) d6 f0 a

) z1 Z# {5 h+ V" _$ I2 P0 Q0 @& `  }* V" @
=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit
( N  m$ n# @2 z# ~- @8 ?   app like this:
! I% a5 L# u: P
2 P8 Y& P" i% W+ s; Q) \& o: u   BPX exec_int if ax==68
! p$ Y" K) ?  B# M   (function called is located at byte ptr [ebp+1Dh] and client eip is
2 N4 k8 u! M  T5 w; Z   located at [ebp+48h] for 32Bit apps)
" X$ [( x+ m/ G+ L8 ?* t( ^' ~__________________________________________________________________________) [7 k! U9 p6 |4 V: d" K: ^4 j
8 B! K/ {  `; ~2 W8 L

$ N4 q* g& f. z0 YMethod 08
6 [' v  X- D% A/ v+ s=========4 N; ]- r' e1 z, ^  v) q0 I
- }' J' \( y0 v  J7 E+ @
It is not a method of detection of SoftICE but a possibility to crash the, c5 p$ c6 o( m( G6 H* z3 m
system by intercepting int 01h and int 03h and redirecting them to another. @: q1 Z* v( b  ]$ D9 Q
routine.
' e1 ~+ X2 u! x; P, iIt calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
% V. }+ }9 G9 P) I5 A8 hto the new routine to execute (hangs computer...)5 O1 g- j: ?/ k# d

& I3 O( u3 g9 _& Z    mov     ah, 25h, Q$ s9 B4 |5 A' k; q- k
    mov     al, Int_Number (01h or 03h)6 W' _# @, q9 V6 ~# V! [1 p2 M8 L, N
    mov     dx, offset New_Int_Routine/ V0 q5 N4 W; R8 h9 L
    int     21h
, }* W$ m4 g$ m+ Y) g5 J5 v2 g4 n" L
__________________________________________________________________________6 c- x# G! O% O4 s  t8 u  N, s

& s; \. L% U$ x9 ]2 yMethod 09
0 ]( o2 U) n+ V/ X) }' {=========8 M) }( o7 p& v
7 a8 {( J2 e. y
This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
/ ]- q! J; J6 T0 ], a& ~3 _performed in ring0 (VxD or a ring3 app using the VxdCall).
/ V( a7 k3 B- v; u6 |+ w- m( pThe Get_DDB service is used to determine whether or not a VxD is installed
$ \& Q/ B) s: C7 o9 Vfor the specified device and returns a Device Description Block (in ecx) for
1 t  _+ L% r. k% J0 hthat device if it is installed.
& C, B5 y% R: t( b
! V' X/ r& D: \( U   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID
0 m* |3 B3 J/ y% |   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
& @# j' {# L. L   VMMCall Get_DDB
$ R# ?" X, I* H* R; R' i/ ?   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
- L8 n7 X& Q6 G4 ?; h
: h/ k( q/ R& f5 O; z8 N- N9 q* L, _Note as well that you can easily detect this method with SoftICE:
( J  C8 z5 X( z1 a) y0 t0 q) c* ]! X   bpx Get_DDB if ax==0202 || ax==7a5fh
. O  ^4 r$ N5 d7 v$ E* |( H4 W5 w2 R1 ]. R' j
__________________________________________________________________________
7 m" `- J0 [: X. m4 Y% Z# v& G! N$ t0 |- I0 L
Method 10
/ y# p  p- Z3 p=========* `" L- I( T! k9 j5 {& x9 H

+ m! h: W4 k- h=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with$ J! n: t7 h5 O' L9 u
  SoftICE while the option is enable!!$ N4 G9 p; J7 L
7 _( L2 \# }( r' q+ N9 p) g. a
This trick is very efficient:
2 E, E; m7 S2 C1 u6 Sby checking the Debug Registers, you can detect if SoftICE is loaded
: M6 B( }  J% G(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
6 G) G; \: e, d! ~there are some memory breakpoints set (dr0 to dr3) simply by reading their
( V/ Q$ c1 o( {& V3 Zvalue (in ring0 only). Values can be manipulated and or changed as well
  W+ O5 Y5 ]) d(clearing BPMs for instance)% b% u: a  F) F/ k
# i: U; S2 t* a  X  N4 n
__________________________________________________________________________$ g. |( z4 Q0 Y4 p. E
9 t: i+ X8 y% A2 f; ^1 C
Method 11
/ }- r  x4 o; F0 {9 H( s=========5 u% e& b5 n) h3 W  \& {

* v- D6 b9 A4 r( {This method is most known as 'MeltICE' because it has been freely distributed  [) P0 l; Q- l2 z
via www.winfiles.com. However it was first used by NuMega people to allow6 V# e. X$ e+ p$ m5 g. N" P
Symbol Loader to check if SoftICE was active or not (the code is located) [% v) h6 `( A4 L5 x, M" m" O
inside nmtrans.dll).
/ C( Y  U% e3 ?1 O/ \
( F* U5 P1 `4 c. D# e: _- ^4 tThe way it works is very simple:
/ F0 z( x6 _6 Z7 ]( P9 |& |# v. _It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
' g% Z2 Y$ O5 l9 d9 F% PWinNT) with the CreateFileA API.
' O# O+ W2 A& H. D- ~1 a" j/ x) P: p/ `  C3 x: b
Here is a sample (checking for 'SICE'):
% O+ W3 I2 W5 u/ V. f- U: Q) w! l4 d1 V& E9 Q7 \
BOOL IsSoftIce95Loaded()
4 O* S0 Q. n- f) V0 Q6 r9 ^" t* q3 I{
6 N1 {( d" R8 k' D   HANDLE hFile;  
# U; B! Y# q# G   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
0 b( J7 A8 M/ X; t' v5 e                      FILE_SHARE_READ | FILE_SHARE_WRITE,& w# a& e5 ^/ E5 K
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
. R9 X' ^/ A+ G* V8 x# X   if( hFile != INVALID_HANDLE_VALUE )
# \* e! D* Y' H0 W7 U   {: |% O# D, F. ?: ?0 C( Y
      CloseHandle(hFile);
0 y% @8 d" I: m0 F) U: g2 W      return TRUE;  C/ s5 ^1 w8 `
   }& X7 M. }: L) L- P
   return FALSE;- F/ _* n; i) P1 ~* j
}; F* g4 R) @0 O, w2 J
; I4 a5 d  ?: l7 V
Although this trick calls the CreateFileA function, don't even expect to be
2 u( k% x7 E9 P& C: Z; R6 Rable to intercept it by installing a IFS hook: it will not work, no way!1 t" o& Z6 K7 E
In fact, after the call to CreateFileA it will get through VWIN32 0x001F7 W2 _5 N+ _) [
service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
& e" |  }, w; e7 C% o2 Land then browse the DDB list until it find the VxD and its DDB_Control_Proc2 u. d% d/ M' I8 J& |: w# T
field.
$ E- c' f+ p4 zIn fact, its purpose is not to load/unload VxDs but only to send a 3 U$ T3 J% f8 R7 B  U
W32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)7 o9 u. t1 g! K3 F' z' u
to the VxD Control_Dispatch proc (how the hell a shareware soft could try" p5 e- B; P$ ]* x
to load/unload a non-dynamically loadable driver such as SoftICE ;-)." B& U* D5 g! z1 v6 f0 x0 ?% f% d
If the VxD is loaded, it will always clear eax and the Carry flag to allow
0 f9 ~; W' [( |3 E% p" Q: W9 Iits handle to be opened and then, will be detected.
* R" B4 ?5 b9 K4 z* V' R) b: cYou can check that simply by hooking Winice.exe control proc entry point
# h6 T0 \3 i  u0 \+ m4 @while running MeltICE.+ X7 d& p8 |9 K/ X
1 ]  F7 I  C, z: t+ E

9 Y- w( a* G* \7 m  00401067:  push      00402025    ; \\.\SICE* u! }% e% K) ~) R
  0040106C:  call      CreateFileA+ S% r5 o, \8 C
  00401071:  cmp       eax,-001- B9 s& _6 q" x( s
  00401074:  je        00401091* ~. n" ^! `5 \$ u, |5 \) V
2 r+ v! o/ f% t/ `
3 M5 r7 E2 M7 V0 C. O, V
There could be hundreds of BPX you could use to detect this trick.
; Q% L$ n* l6 L5 b/ d-The most classical one is:2 b4 X' `- O. E% E! g- b2 x3 B
  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||3 u, O- z* A  B/ R  h& n0 A
    *(esp-&gt;4+4)=='NTIC'" N4 L5 W& M: p( j  V% U

5 r3 w7 G# _, {4 E& L-The most exotic ones (could be very slooooow :-(
% i2 f1 J+ T5 _   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  
& L  U! l/ h3 l     ;will break 3 times :-(
9 B2 R+ Q1 q  F6 I* I/ ~% ?4 i! G
( K& [7 ]+ a9 v4 e, L-or (a bit) faster:
5 z. W$ T( `5 c0 B   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')' d4 ~+ o* X4 g# b. k: l% j) Z4 j' S
( n" X% d3 @% _, Q0 b' @5 G- {
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  
. g( O0 r+ O* x' z7 r     ;will break 3 times :-(
! E; W0 [& {+ w5 F# e9 J9 m# Z4 i2 Y+ g0 a& d
-Much faster:( d/ c  z5 C/ w+ y
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'4 z' D6 D* n( G- _( l

  V. N$ U& c+ YNote also that some programs (like AZPR3.00) use de old 16-bit _lopen5 n; U6 L' ]# W* I) c
function to do the same job:; _' p5 A& \$ S! F4 [0 M

. A9 ~$ z# G4 D: j2 x9 _- l; w   push    00                        ; OF_READ
* ?& n' B6 z2 b& Q2 _5 B   mov     eax,[00656634]            ; '\\.\SICE',03 u9 |0 N  v6 x, U
   push    eax2 A9 j) O7 l8 X0 ?/ t2 x% c6 o+ |
   call    KERNEL32!_lopen
- Q3 v5 _, @( r4 l* V   inc     eax
7 v. o3 U( C3 @9 x+ E   jnz     00650589                  ; detected* j: |9 t4 F1 Q0 v+ s& }2 j  K8 f
   push    00                        ; OF_READ
4 z: J: A% s+ W! o) T   mov     eax,[00656638]            ; '\\.\SICE'
; s! l  k" |7 \! ?: g' r: P   push    eax& E9 q1 p' _( ~
   call    KERNEL32!_lopen
: _- [: ?$ N7 }$ C) `   inc     eax
* o2 K# D, q6 s5 g. S   jz      006505ae                  ; not detected& j+ k; D+ R. B' l
/ `! h  u: _. a" f2 c5 ^- k/ S8 w& N

- k+ j& v! p8 A/ H: z: _1 o+ u__________________________________________________________________________
$ a/ ~; o1 z0 e, p/ x! b
$ M, P% `6 J# K/ u1 a5 C  EMethod 125 z$ d  k; ~1 t8 D
=========$ m' u  e3 \; U; ~
4 l. O0 j3 ]) U
This trick is similar to int41h/4fh Debugger installation check (code 05
/ o& }  |) r0 c- \0 |&amp; 06) but very limited because it's only available for Win95/98 (not NT)
9 c! F8 d& }; S: m& V0 }; \2 oas it uses the VxDCall backdoor. This detection was found in Bleem Demo.; `1 e  I; S1 t$ b5 f. f8 m

6 d3 g2 Z4 ]2 p* A   push  0000004fh         ; function 4fh
# o5 n% {5 N, Z' @; |4 `9 t/ C2 I   push  002a002ah         ; high word specifies which VxD (VWIN32)2 {# I; ?0 A, Q
                           ; low word specifies which service
6 ^2 g5 `; w( s9 m# I4 p' n7 G                             (VWIN32_Int41Dispatch)
# S8 r, l3 E8 j   call  Kernel32!ORD_001  ; VxdCall6 k$ t$ ~5 i! M
   cmp   ax, 0f386h        ; magic number returned by system debuggers
" q# J6 y$ `0 c* h- E! u) u   jz    SoftICE_detected
* g; M; N  |4 m! g' t1 u
1 Q( p, Q$ i' K0 q5 m4 {+ [$ e2 SHere again, several ways to detect it:
$ Q  [' U3 o. u) p( p* v6 m9 W  P+ ^9 P3 h( m
    BPINT 41 if ax==4f& e2 {, V2 @, {; Q) H

7 z3 u  D- F/ z: R+ n1 h$ W    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one5 F3 [/ N! E# n1 }5 P. }% W" j

' z; X& r" t; N: W% B    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A6 |3 y2 J8 D! f6 C5 k

6 Q/ }* |: z/ Z$ [1 _    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
9 `9 b# [" U  ~8 U- }5 |+ U0 c7 N9 }0 _
__________________________________________________________________________; Y* E! m) ^2 N( [) I0 e2 s
) k7 V* U7 j5 F2 M9 B* ~/ w
Method 13. N2 U- s" f, T, v4 F
=========
1 m, f7 O; N7 h  p6 y: e- y( L" r  R0 L* t4 q
Not a real method of detection, but a good way to know if SoftICE is
! Q) b6 G9 x# z* ]# O6 @( D9 S$ K7 xinstalled on a computer and to locate its installation directory.
! K) A" f# ?$ U2 \" H7 j$ mIt is used by few softs which access the following registry keys (usually #2) :; G- F; d/ T9 \' z& L! k

% r+ ]5 F( Y- L- @0 H, k: [-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion6 d) |9 A+ N7 {' @+ ^
\Uninstall\SoftICE
: h" W* c9 X. `6 G% ]-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE. F9 V' V0 t6 o4 w1 V
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion2 A4 x$ v# l: ^# m8 l* L/ ]
\App Paths\Loader32.Exe
+ ^  y: M8 Q9 `! \
  m0 @. W: Q3 C0 q$ W. [, y6 P7 @' @$ P2 ~! I& P
Note that some nasty apps could then erase all files from SoftICE directory
# w+ q( U: y/ Z' f  H(I faced that once :-(5 a/ ]' ]- b4 C
  Z& d% t1 P' s! F* \# {
Useful breakpoint to detect it:
" j* F1 Y6 ?' m- K; y
( w) n2 }# O% ^8 X1 V' s6 d     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'' m9 Y1 f1 U7 \5 s8 U

3 c! Y3 p8 a4 [! P7 n: U__________________________________________________________________________
. t! ?2 K( n9 v% f/ O- W
' u/ g3 H! j, |1 b- h4 n! H: h, i# r5 d; ?
Method 14 * N! y3 _" V6 N9 F- F
=========
: p: ^2 P! E; _' q+ f  N& H/ l7 t- G. _2 Y: ^) R! c& v% j
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose/ y. c! Z9 u0 q6 q: E. x" V. Y6 I
is to determines whether a debugger is running on your system (ring0 only).1 X8 a1 c( c6 B
1 k$ x2 a4 X1 E
   VMMCall Test_Debug_Installed: f) U6 T# z, ~9 U
   je      not_installed
; Q- k3 _4 M$ S: h8 c( M
5 R+ l& U3 r! q* l! R3 \This service just checks a flag.
+ n! L, v# Y( b( G4 {" Z# ~8 f</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部