About anti-SoftICE tricks

[复制链接]
发表于 2008-9-28 16:34:50 | 显示全部楼层 |阅读模式
<TABLE width=500>
' W- i7 G' Z4 }6 J4 X' A6 N<TBODY>
3 d4 j6 |8 \# J- c<TR>! d7 F7 V' g! f6 d* u
<TD><PRE>Method 01
1 h0 j9 r: \  r  Y=========
( D* C: O, g/ f1 {1 ~1 [, `% M4 x7 c0 \! Z, X
This method of detection of SoftICE (as well as the following one) is
1 c. U- Z, ~! t- ^6 P. zused by the majority of packers/encryptors found on Internet.& n3 L9 l1 i6 z
It seeks the signature of BoundsChecker in SoftICE6 l4 S+ i. W& [6 P$ _  M
% a. F* [8 F" d, m
    mov     ebp, 04243484Bh        ; 'BCHK'
8 \3 E0 Z3 m- Z0 _    mov     ax, 04h
: l* c. X) r; k" s% y  h    int     3      
5 [- m6 n# ]5 ^    cmp     al,4" h6 A9 b& d4 N- E  ]- M3 e& Z. p
    jnz     SoftICE_Detected
8 V5 F: Z$ l7 R0 O' O2 B% v" L" l) Y6 g6 m  L/ W0 F) d
___________________________________________________________________________
' ?5 d3 r* ]6 S! u4 u
0 q, v* H- q9 ^9 FMethod 02( @4 `) N6 J/ }$ A: k) ^: \
=========- _3 p8 r- @& e0 F- Z

" z$ c. |. r6 f( T! s0 OStill a method very much used (perhaps the most frequent one).  It is used  i( s" L4 y+ Z( i
to get SoftICE 'Back Door commands' which gives infos on Breakpoints,
! |4 F, Z( _! c2 W2 F  y7 W; c9 lor execute SoftICE commands...- S7 `6 x, h. c$ V# D& R+ i
It is also used to crash SoftICE and to force it to execute any commands
3 Y: l( D. _! i- E* W. V! a(HBOOT...) :-((  5 h) B, @$ ]7 ~

0 x& c$ x3 M8 r) n* K2 vHere is a quick description:/ e8 Q) H# q6 A' c
-AX = 0910h   (Display string in SIce windows)$ }9 e# W: p5 l' ^& X2 Y
-AX = 0911h   (Execute SIce commands -command is displayed is ds:dx): W" M2 M. E+ x( s
-AX = 0912h   (Get breakpoint infos)1 m- ^! @. l+ _7 ?: ], _$ Z  x( K
-AX = 0913h   (Set Sice breakpoints)
2 @5 Q, {7 v0 w, z7 a. A; I-AX = 0914h   (Remove SIce breakoints)
: N- W+ f0 o! S) [
  t0 h# V0 W! n- m- o( S  ^* H3 T1 }Each time you'll meet this trick, you'll see:
, t' J+ v2 Y( I, C/ Y' N-SI = 4647h3 U6 i& ], j4 N9 ?! M+ g0 D$ o
-DI = 4A4Dh/ h* X. F. a; L2 E. K' J
Which are the 'magic values' used by SoftIce.
/ n1 a  p( V5 g4 J5 _1 KFor more informations, see "Ralf Brown Interrupt list" chapter int 03h.
. d  C- w7 J! R! d) @
2 L3 Y) e6 M4 q0 X5 N$ gHere is one example from the file "Haspinst.exe" which is the dongle HASP6 T' K1 u9 U% d3 m$ o8 J- s
Envelope utility use to protect DOS applications:, U" e; p2 I7 H* t4 t; X0 T: K* \) V1 R
% A. T7 q9 H$ t8 f3 ~! i4 B
5 o& ~! }) E' b! [* s
4C19:0095   MOV    AX,0911  ; execute command.
' b; d) s  ]6 y, c, d& B7 j4C19:0098   MOV    DX,[BX]  ; ds:dx point to the command (see below).
8 P# V" m4 T- L) r4C19:009A   MOV    SI,4647  ; 1st magic value.
2 `+ B* j2 I$ z5 A9 a/ D4C19:009D   MOV    DI,4A4D  ; 2nd magic value.
- [& p* L, C1 Q6 [1 e' `4C19:00A0   INT    3        ; Int call.(if SIce is not loaded, jmp to 00AD*)
9 Y7 b/ ^, C. w4C19:00A1   ADD    BX,02    ; BX+2 to point to next command to execute0 y. B6 j4 w8 `5 Q( {
4C19:00A4   INC    CX
! j; f& y. i% T+ X* I8 d# g# B- x4C19:00A5   CMP    CX,06    ; Repeat 6 times  to execute
8 l5 a, s5 c- ]& Y9 V4 Z* g4C19:00A8   JB     0095     ; 6 different commands.* Q: q6 D4 O9 p" I- h3 C
4C19:00AA   JMP    0002     ; Bad_Guy jmp back.
3 L4 Z9 y; S6 u4C19:00AD   MOV    BX,SP    ; Good_Guy go ahead :)4 ]* n* Z5 l% _' d: h6 W) e

( ?+ o& y, c+ f9 cThe program will execute 6 different SIce commands located at ds:dx, which* P5 u. c$ f$ H1 ]6 L! }4 o
are: LDT, IDT, GDT, TSS, RS, and ...HBOOT./ V3 u% j  j) ?7 ]

: X$ `1 ~, E( ?9 N6 v. O" x; [* the "jmp to 00ADh" is performed via an SEH if the debugger is not loaded.% S4 f' s! K9 b
___________________________________________________________________________0 ]/ d0 x% N. ~8 q& s6 Y

, H8 f; h" f& g1 J% c  u  |8 A+ v! f; a& q; V: d+ R* f
Method 035 t5 c/ O5 V" S( r
=========: R7 f) D) H5 z* b1 T  g, j. T. Z8 G

; Q% v/ s& i3 u8 U. v4 B/ ^& GLess used method.  It seeks the ID of SoftICE VxD via the int 2Fh/1684h) v2 i+ A0 x0 B
(API Get entry point)
' ^: V8 G# B8 e3 p6 l1 k        
3 s5 J$ f! v* v" ?2 d" Q. R7 `( {/ M/ l
    xor     di,di3 k- C3 U( z/ v
    mov     es,di
+ a- b) Z* n% S  k9 y8 u& @    mov     ax, 1684h      
* N. M" r3 c% y    mov     bx, 0202h       ; VxD ID of winice
* l; T3 _& O2 q+ T* w% E    int     2Fh
, ^8 F3 }* ]" L; g1 [7 m    mov     ax, es          ; ES:DI -&gt; VxD API entry point. y0 |: y' @2 C& y
    add     ax, di
7 g, c4 K: S+ @" z    test    ax,ax4 h. z7 \. F. w1 z1 |
    jnz     SoftICE_Detected8 `7 y/ h" Q2 n/ b( {+ f

  S- ]6 H4 m/ Y/ q9 ]___________________________________________________________________________
8 V, @  N: X; N  n& ?. e1 m, e7 m$ j2 v. Y1 l
Method 04
0 V% C6 Y! e1 E=========
8 Q* `. c/ ~0 t. _# {1 N( u+ d+ y* b, q2 b
Method identical to the preceding one except that it seeks the ID of SoftICE. ?0 Q: P  T" J4 A0 M6 d
GFX VxD.
* ^" z7 L9 \9 `- o  p+ T3 x# M
& V# i2 s6 G- }2 g7 H. e/ C& |    xor     di,di. e  }; a, p  L2 I# x8 B4 h: Z* Y8 Q
    mov     es,di) l. L' \0 `: P$ E$ w" b0 u/ b5 [
    mov     ax, 1684h      
5 q7 a( A! Z* B7 _! R$ _    mov     bx, 7a5Fh       ; VxD ID of SIWVID1 X5 S* u+ B4 ~) a& o. s9 W( Q2 {6 ^* J
    int     2fh
3 E( ~2 P8 n# k1 W    mov     ax, es          ; ES:DI -&gt; VxD API entry point
6 h! o! d7 V- J4 {# v# J    add     ax, di
( e5 [9 ~- M' Z" G; I; ^0 @    test    ax,ax
8 b" G2 Q9 g1 I5 \9 \, U    jnz     SoftICE_Detected  ]/ S3 [  b) l- V: |

. C! d9 ?- v' S5 g__________________________________________________________________________6 ~: U: s2 d7 M$ l
- y5 n" p& v3 y; x6 ^( R

7 L; u; v9 j3 ?- T9 C- ~1 e) |Method 05' c& _; c7 i5 V, v
=========
2 W3 y* Q" K2 p% J3 @% T( w
# E$ G% M3 M, G% \$ b2 iMethod seeking the 'magic number' 0F386h returned (in ax) by all system6 I! F! `- r; [/ d; D3 P. R. h% g
debugger. It calls the int 41h, function 4Fh.
- I' u. G3 U3 EThere are several alternatives.  
% J$ N3 g; D, X  U5 p  g" x* p# W- n
The following one is the simplest:
0 W9 r! @/ K& o& L( z4 Q/ X! w0 B
9 `% u! G$ j& U" K6 _- z, O! n    mov     ax,4fh
) B5 `! ?4 r4 V5 D1 ?0 D6 A    int     41h
8 m$ H- \  m: c+ T/ l# h    cmp     ax, 0F3864 I' A5 B) `2 t% u" U( M8 x3 \/ Z
    jz      SoftICE_detected
$ V, r! r* r" o& V
3 C+ ~, r8 _  V* ~  _) p' z' i  g, e
Next method as well as the following one are 2 examples from Stone's
' S" i- {/ @7 R- H( ~! Y"stn-wid.zip" (www.cracking.net):
, [; ?* a' k0 `8 v: ^
1 I! T" ~  x* s2 _6 ]6 h    mov     bx, cs
+ h6 b& ?* r9 O: l+ C    lea     dx, int41handler2
: G1 V/ R$ n/ W. ~6 j! q+ g    xchg    dx, es:[41h*4]
4 X" w6 r! _  E    xchg    bx, es:[41h*4+2]! x( J1 J6 V* W. g  h; k5 o
    mov     ax,4fh
% ~5 s% m( S, F2 Z" S; v( [0 w    int     41h
1 i! G& ?% G, c+ f/ i6 O* F- ~    xchg    dx, es:[41h*4]
% ^7 v; y9 P5 r% ~% J, E8 z    xchg    bx, es:[41h*4+2]+ n3 S9 P) V0 U3 q' S6 F
    cmp     ax, 0f386h* }3 D1 K% l  S
    jz      SoftICE_detected
5 c' ~2 f  |  J9 T% J5 L; i% g& r# F( T
int41handler2 PROC
, f% Q: J& R! Z! m! K& X    iret8 q. @0 T6 e. N# x. Q
int41handler2 ENDP; x2 j5 N% U. ]  S  |! ^+ }

- ^7 w# V# d# ]( W
0 U. F1 i2 D& D+ `_________________________________________________________________________" \. n: Q2 Y: e
# v; w- V. q$ q1 }" n
; d. f; i# Y4 W% u5 b
Method 06
( W% ^% z, v, }& s$ J, j. U  V4 t=========  A0 T- {) Y, G: C
0 R" f3 r, W. I1 r% g2 f+ T4 t
. ?: n# Q0 p7 E0 k3 }) ]
2nd method similar to the preceding one but more difficult to detect:5 t- T# q  [! O. A7 T' ~1 x
- N: k& d7 ~" b

  H# g+ A8 x8 T! ^$ N4 B, Zint41handler PROC, Z2 U; ~6 {$ @; ~9 Z
    mov     cl,al
+ r% R. V$ |$ ~$ I    iret1 b' u8 B) ^' @% ~& |/ l
int41handler ENDP6 `- A9 E6 y& S8 h# Q) @$ }
7 \3 n* i  c  X2 \0 e+ n' }

* l: B) i7 y4 Q, y3 B; V/ ?    xor     ax,ax
" W! I5 S0 B( V$ P: U* J8 Y: R( S    mov     es,ax5 S+ B& Q. m6 x, h
    mov     bx, cs
6 X7 X3 H3 _) o3 I' v) L    lea     dx, int41handler  ^9 j: k- j& ~9 _) w4 w
    xchg    dx, es:[41h*4]
& s3 c* X* s) d9 Y8 ^    xchg    bx, es:[41h*4+2]; ?5 g8 O5 Z8 J. F# F
    in      al, 40h% t0 @3 l2 [& ]
    xor     cx,cx3 k: Y( t) k" n
    int     41h8 E/ e( \7 Z) M3 |
    xchg    dx, es:[41h*4]1 k+ p# l) R, o! h
    xchg    bx, es:[41h*4+2]
) \. V! p; ~/ l& h; I  h8 Q) d9 d    cmp     cl,al! T. o# X" {! W( U) Z% d# Z. P
    jnz     SoftICE_detected
( J, G  m3 H+ p3 `
4 B' ~$ X- Z$ c1 ]( [_________________________________________________________________________
# z) `2 S6 k6 c( w3 j- s9 D! y- i7 `
Method 07# |0 m# A: m% b) I+ o0 z5 i
=========
! M4 {3 n+ }  ?$ F: J" Z  l
/ i. H. W5 o" o- \Method of detection of the WinICE handler in the int68h (V86)* ]( g; Z! l/ I/ }$ o

& g  z4 e8 M4 [1 j* e+ l6 b: [    mov     ah,43h
6 b! ?+ Z  Z6 U# L/ j' _    int     68h
) j) {: x- x" X; U    cmp     ax,0F386h
7 x3 H: G; e5 S1 i    jz      SoftICE_Detected9 Z: y0 R; P# T; B. [( z- Z/ `
7 U; E# ~- l6 T4 l  W

  m& Y9 u" O" ]6 s5 R, \1 i6 f8 G0 b=&gt; it is not possible to set a BPINT 68 with softice but you can hook a 32Bit% B) |6 y0 x( h% Z! Z5 |
   app like this:1 N$ H) s2 J) c' L# e. y- ~/ E4 l/ y

9 W8 s9 B7 j. N! c   BPX exec_int if ax==68/ J6 s% `8 C7 Q( j- G
   (function called is located at byte ptr [ebp+1Dh] and client eip is
5 F3 @/ i8 Q! T  v0 V7 k   located at [ebp+48h] for 32Bit apps)
3 v, C% a. k0 @) U/ p3 E__________________________________________________________________________
5 n: Q% ~. x+ g( }6 w7 C& h. N6 N2 f
" s# x4 d, U, d+ D
Method 08
. u/ N/ Z* V- h" r2 m; Y$ T/ x=========
3 R* V9 T4 w( K) g: H4 y# |
0 {% E" R" i% s# U9 f5 WIt is not a method of detection of SoftICE but a possibility to crash the, U* I4 f) R# Y, r
system by intercepting int 01h and int 03h and redirecting them to another& A2 A3 _6 ]% p3 A
routine.
- K/ n7 |; P1 N/ z- V- }% V' `! |It calls int 21h functions 25h and 35h (set/get int vector) and ds:dx points
8 k2 q/ m& H4 E8 r4 l' N% l  ^to the new routine to execute (hangs computer...)3 g5 F# ]8 T, t; k8 {" Q

7 [: T- l8 n/ d    mov     ah, 25h7 @% b: d$ s+ |0 L! {  I
    mov     al, Int_Number (01h or 03h)
: J4 g/ S, k) `, Z2 w7 R    mov     dx, offset New_Int_Routine0 z7 ?' a( g/ n; k
    int     21h
! j  P9 u$ k' A' a2 U& g7 k" `
6 _; h* w( M( Q: M7 F__________________________________________________________________________
9 q( _# a0 X$ j8 d# t. q9 G
  {! V5 C( f7 i' j( M# @Method 09
% s7 m' k  y8 k* C; M=========
! u8 m6 t! d' M0 @& G- a/ N
. {) M, v# i) _This method is closed to methods 03 and 04 (int 2Fh/1684h) but it is only
# n# e4 M  a% y" Eperformed in ring0 (VxD or a ring3 app using the VxdCall).
! q5 ]. s) T+ m" F) Z$ qThe Get_DDB service is used to determine whether or not a VxD is installed% O" k& b0 T" o( U$ f" B
for the specified device and returns a Device Description Block (in ecx) for
& A2 d: v. y9 p7 P  T" c$ dthat device if it is installed.7 J" e( P  P5 p
$ r( W0 Y6 @% S; }3 U% R
   mov     eax, Device_ID   ; 202h for SICE or 7a5Fh for SIWVID VxD ID- k0 M3 v) r( B
   mov     edi, Device_Name ; only used if no VxD ID (useless in our case ;-)6 L* \9 Y8 p- Y8 o4 f8 f
   VMMCall Get_DDB
. ]: s6 u* O2 e* |/ P   mov     [DDB], ecx       ; ecx=DDB or 0 if the VxD is not installed
) d8 U8 w. U* o9 P9 E0 ^& a
; J/ P  I+ V- s8 i/ p5 _" |# n4 SNote as well that you can easily detect this method with SoftICE:
( B/ z$ N$ p0 A) J' T3 |, n   bpx Get_DDB if ax==0202 || ax==7a5fh7 d3 G% N$ Y! @$ X
9 L6 b) ~9 i: d  L% |/ D5 b
__________________________________________________________________________7 d2 [/ p9 s' k4 ~9 n9 X5 `

, L% j4 j, k# a/ q4 {6 b- CMethod 10
4 c, Z. z9 \4 h, B, |5 [" M* y. L=========( G4 v$ s; N4 z) W( l+ d& @5 r

" m: b0 B: K# z7 G=&gt;Disable or clear breakpoints before using this feature. DO NOT trace with  z! ~+ B0 a. H5 t: j% U/ S
  SoftICE while the option is enable!!
" F( F; O' `+ r1 N5 B* _5 B
# }% F. p; w6 T3 `0 ~/ pThis trick is very efficient:
, M# |0 O0 U+ r/ |7 S6 p5 Gby checking the Debug Registers, you can detect if SoftICE is loaded' F' h$ C9 F& ^
(dr7=0x700 if you loaded the soft with SoftICE loader, 0x400 otherwise) or if
, O  C* A2 b+ k" |" `- {there are some memory breakpoints set (dr0 to dr3) simply by reading their
: i- {. o0 c0 N& X2 L. gvalue (in ring0 only). Values can be manipulated and or changed as well1 o7 l+ X  T+ W$ x0 D
(clearing BPMs for instance)
, p; B/ _5 V1 Z3 h8 H/ H! q5 A3 A  ]2 M1 G
__________________________________________________________________________
) m  X( r- }( A9 b; R. `9 x0 J6 ^/ |4 v, F+ j
Method 11
3 Z; ~7 A( h+ I' l# X9 D$ `=========/ g& |4 `- E, N# Z* E

3 V! h  \/ q1 h% FThis method is most known as 'MeltICE' because it has been freely distributed" U$ u6 i6 r9 N* [2 I- v
via www.winfiles.com. However it was first used by NuMega people to allow
+ Y' d( h) ?9 s) zSymbol Loader to check if SoftICE was active or not (the code is located" d+ b' a+ t3 M3 M( j+ b5 Z4 m: D
inside nmtrans.dll).$ u/ v2 t( o5 g) @: z* ]1 i3 b

0 h$ E) W" y4 U8 }8 ?1 RThe way it works is very simple:
! [0 u% {$ }) \It tries to open SoftICE drivers handles (SICE, SIWVID for Win9x, NTICE for
3 b! x  o8 V& b% e" m" Y" {WinNT) with the CreateFileA API.
9 C* d9 M. r% I2 X% Y) h
3 c. X. z1 H, R' `Here is a sample (checking for 'SICE'):
( ?. `$ L) y) t! }8 I
( i- D+ }2 E1 @: P/ ^BOOL IsSoftIce95Loaded()
2 a6 {5 Z1 H3 A* N2 c2 T; L{
; `8 {8 R4 y' F# }5 d   HANDLE hFile;  3 T  K. ~% w8 G# x4 i5 n
   hFile = CreateFile( "\\\\.\\SICE", GENERIC_READ | GENERIC_WRITE,
  F) M# }% w# W) W- Z7 [                      FILE_SHARE_READ | FILE_SHARE_WRITE,+ H0 E  v  X% w
                      NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
# u% O$ q& F+ ?   if( hFile != INVALID_HANDLE_VALUE )! w: P: \, `; ]+ j" g
   {. ~! [" ^! I* a+ u4 z5 `! K
      CloseHandle(hFile);
% p1 E8 a  Q  ]5 P      return TRUE;
# T3 t$ Y. ?2 I, {. G   }
1 K! J( f- ^% Z' {& h6 _& \$ l/ D   return FALSE;: P. @4 x9 ?& U1 f2 [' n& t& u
}! p* ?+ X2 G, e
  }# d1 \( u. h+ Y( f% d# ]
Although this trick calls the CreateFileA function, don't even expect to be
1 s6 Z8 O* c; Y5 jable to intercept it by installing a IFS hook: it will not work, no way!4 G, u; G3 v2 b: f/ j
In fact, after the call to CreateFileA it will get through VWIN32 0x001F
+ v( v% \0 q/ e$ P2 U" ~service _VWIN32_ReleaseWin32Mutex (via Kernel32!ORD_0001/VxDCall function)
7 j* c- ~" k3 t+ d8 Vand then browse the DDB list until it find the VxD and its DDB_Control_Proc
' i7 N5 i" @* ?, Mfield.& D# J2 d; I2 D' Y
In fact, its purpose is not to load/unload VxDs but only to send a
" r& O( q3 q) q7 y8 @1 M7 zW32_DEVICEIOCONTROL (0x23) control message (DIOC_OPEN and DIOC_CLOSEHANDLE)+ u, l) @* U5 V( _( F" F
to the VxD Control_Dispatch proc (how the hell a shareware soft could try& l% ?/ ^7 s5 C; h* S" I% t
to load/unload a non-dynamically loadable driver such as SoftICE ;-).
$ ^, g1 D$ B' ]6 ~4 ^/ T7 MIf the VxD is loaded, it will always clear eax and the Carry flag to allow' M) M* J- g: B, q+ E
its handle to be opened and then, will be detected.7 t! ]7 r1 Y3 w4 x9 `  c$ H- b
You can check that simply by hooking Winice.exe control proc entry point
. K- q3 Y4 q/ pwhile running MeltICE.! \" T+ }5 a; X1 p3 l" e/ ?' c
( x- ^1 W! d4 t) m8 z
5 C8 [. h2 Q; {5 L# o- b, E
  00401067:  push      00402025    ; \\.\SICE( @* K$ |) c9 S0 O. j) K  w/ ]
  0040106C:  call      CreateFileA
3 Q; d& h' I9 G" ^3 {  00401071:  cmp       eax,-001& L! F* W8 u6 k6 B* _- a
  00401074:  je        004010917 L4 r1 A, i  |' q4 c) m/ D$ p

% c  Q4 h! y' q7 |( r2 G
4 t+ E% t) w1 h9 k5 x$ d- VThere could be hundreds of BPX you could use to detect this trick.9 p+ S, X# D' ]' h( a# l
-The most classical one is:
1 C8 ]" x2 Z2 l) F. w% V, H  BPX CreateFileA if *(esp-&gt;4+4)=='SICE' || *(esp-&gt;4+4)=='SIWV' ||- o6 b7 a9 N, T7 F
    *(esp-&gt;4+4)=='NTIC'
; Y1 d+ x( o& Z0 q/ Y6 A
! j: N9 l6 o$ p2 _9 ~, y1 ~-The most exotic ones (could be very slooooow :-(3 W0 B- F( C, f
   BPINT 30 if eax==002A001F &amp;&amp; (*edi=='SICE' || *edi=='SIWV')  2 |- \, c6 D: H+ K; T1 T* P7 `
     ;will break 3 times :-(! z$ L' @( Q. z, S

) L0 `  w" Q% {" b-or (a bit) faster: - n6 ~1 m; [% s
   BPINT 30 if (*edi=='SICE' || *edi=='SIWV')
! e8 z/ Y  @2 X' d4 f1 Q! ~: V9 i% S& ], d/ o& L& o% E( }7 Z* B, V* i
   BPX KERNEL32!ORD_0001 if *edi=='SICE' || *edi=='SIWV'  + H# |) R# L) X% D+ I* k+ `
     ;will break 3 times :-(
: Z6 ?- M% P5 R* T' I0 Q& Y
6 k$ G! G- g# a* V-Much faster:* t$ M) K9 R8 @' e1 I% \, W  W: ]
   BPX VMM_GetDDBList if eax-&gt;3=='SICE' || eax-&gt;3=='SIWV'
) [7 n! B2 |# i  ^. k( z. L5 F- R1 H" u, J# A
Note also that some programs (like AZPR3.00) use de old 16-bit _lopen
/ i! {% M1 d' }7 {function to do the same job:* }% c" Q, ?1 H. g0 p

3 H" M0 z2 f; M. M4 I( W8 `" ?" x   push    00                        ; OF_READ
; h  P8 J) a$ W) H) D* A% p   mov     eax,[00656634]            ; '\\.\SICE',0) }4 W% f1 c0 u' e) a; Y- J; f; }: M
   push    eax
4 f8 `# j0 u3 @3 a- K3 x; ^   call    KERNEL32!_lopen
8 K8 A" V2 u# Z* {) m, e   inc     eax
, `7 m: s1 Y' @8 {) O   jnz     00650589                  ; detected
/ _0 u  c; ?' _7 @2 H7 D& {   push    00                        ; OF_READ6 M3 F- }: a6 E! n
   mov     eax,[00656638]            ; '\\.\SICE'1 z4 M7 X! L/ D4 i
   push    eax
+ k1 h. o" T) l2 C& `6 W% F   call    KERNEL32!_lopen
  T- @2 x( D3 f7 g/ m9 c8 S( y   inc     eax. _" v7 j# w, P( I4 i4 I7 E
   jz      006505ae                  ; not detected
: x' c% Y. ?% _6 c7 D" C
" n* ]* C8 p2 I4 E* T- A! d+ G* t, k8 A; {
__________________________________________________________________________' V$ s* V0 P+ J' _
0 m5 }9 l. l" O; s
Method 12
; s) Z" c  g4 j=========# ]; ]6 @- _; D, U" X# R$ c2 v& A" W
3 e" x: r. g% `7 S% [
This trick is similar to int41h/4fh Debugger installation check (code 05
1 a2 d- R4 q3 D0 j" }&amp; 06) but very limited because it's only available for Win95/98 (not NT)& D6 R8 z+ {* t+ Y6 A
as it uses the VxDCall backdoor. This detection was found in Bleem Demo.
* w% F$ t: I/ N, M/ H6 H
5 h  S& K+ r6 C2 c, j   push  0000004fh         ; function 4fh
3 R6 E: {" b$ g/ l   push  002a002ah         ; high word specifies which VxD (VWIN32)# }: b0 L9 ~8 G5 c
                           ; low word specifies which service' h. f0 [6 H% ]1 _! f8 L. s
                             (VWIN32_Int41Dispatch)
/ u: |8 ?/ l% Z' t% N" l   call  Kernel32!ORD_001  ; VxdCall
0 u) _# Z6 u9 f" B& r6 |   cmp   ax, 0f386h        ; magic number returned by system debuggers
1 E8 `0 ]7 c% A9 y) ]) @6 x   jz    SoftICE_detected
- s% q& O3 U3 Z& a1 L( v1 L6 c
* V. {, b$ u( Y! AHere again, several ways to detect it:/ A/ W0 m$ E1 v6 U' ?
% Y+ }4 t# s" k
    BPINT 41 if ax==4f
% F0 a1 F2 Y) Y' v9 z# B& P! E0 v8 Y6 W" c5 o0 _
    BPINT 30 if ax==0xF386   ; SoftICE must be loaded for this one/ G" H. Y! F: \6 ~6 @2 l6 ?& h
3 K! L0 k& m3 V
    BPX Exec_PM_Int if eax==41 &amp;&amp; edx-&gt;1c==4f &amp;&amp; edx-&gt;10==002A002A
" g. `; J, ?3 P2 I" ?7 M( k! S
/ [! W) Y1 X& r6 b, W  F    BPX Kernel32!ord_0001 if esp-&gt;4==002A002A &amp;&amp; esp-&gt;8==4f   ; slooooow!
2 I9 y% G$ f* Y0 w; j) _$ @' Q0 }( F
__________________________________________________________________________
" t/ w* ~" ~4 C8 N  \0 |* u
! W$ X& u3 }# y4 V8 oMethod 13; e: [3 g1 N0 M4 W, e
=========
5 Z1 {/ `9 S9 z6 C5 F) S# P; K( u6 P
Not a real method of detection, but a good way to know if SoftICE is
: f, e3 x; E8 Q  y3 b+ Pinstalled on a computer and to locate its installation directory.
4 E" |$ H. v" pIt is used by few softs which access the following registry keys (usually #2) :
3 ^) d1 C! n+ o+ p( Z; ^/ q$ Q
0 s0 j" T. Z3 D; e-#1: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
- T4 D# D6 j3 g3 N7 x\Uninstall\SoftICE4 l" q$ p3 T5 _" j  A0 J4 U
-#2: HKEY_LOCAL_MACHINE\Software\NuMega\SoftICE) n. @% I" K, B/ w: U! w
-#3: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
# R1 ~- J; E, l; m! N" B: C\App Paths\Loader32.Exe
) Y6 Z* G. }! e$ [; S
0 F- _3 o6 }8 z! H+ p; y
# \1 I* r5 K3 [" P! m) P/ n- wNote that some nasty apps could then erase all files from SoftICE directory; b2 t8 ~7 |/ \) E- s( S
(I faced that once :-() E2 |( l( d' E; c- d- i' X! b/ O
1 I4 K+ C- M% C3 v7 }
Useful breakpoint to detect it:
3 |8 h' u* u, a/ w9 b1 s* O9 H
& A: ^1 D# l$ H& O/ s     BPX _regopenkey if *(esp-&gt;8+0x13)=='tICE' || *(esp-&gt;8+0x37)=='tICE'
5 h# t) q+ u) @
/ H; y, S" v8 B9 U__________________________________________________________________________
& F" z( x+ ^: {& M9 w6 S1 X' V1 Z# J
. X* w9 I8 c3 w' V% l
Method 14 % w* h  c. R; o; V: g; x% B% ~
=========' v5 H) [. M( `& n+ C9 m1 r! \
; f: [7 i/ w0 Q
A call to VMM 'Test_Debug_Installed' service. As the name says, its purpose
% T0 W  Y/ A# X7 j/ yis to determines whether a debugger is running on your system (ring0 only).* u' ?. s+ q2 V3 M: R8 G

' a+ M' S% D  M& f   VMMCall Test_Debug_Installed7 x  ?# C; R2 O8 \
   je      not_installed
' F( _9 _* g' p3 E2 Z9 G
( [$ _& k: ~8 S  H* AThis service just checks a flag.1 z! h! I' W/ p) c6 F% b% [$ T5 `
</PRE></TD></TR></TBODY></TABLE>
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关注公众号

相关侵权、举报、投诉及建议等,请发 E-mail:admin@discuz.vip

Powered by Discuz! X5.0 © 2001-2026 Discuz! Team.|鲁ICP备19052200号-1

在本版发帖
关注公众号
QQ客服返回顶部